diff --git a/.brain/ERRORS.md b/.brain/ERRORS.md
deleted file mode 100644
index ef021afe7..000000000
--- a/.brain/ERRORS.md
+++ /dev/null
@@ -1,600 +0,0 @@
-| 2026-05-15T11:14:00.045Z | buildAgentPerformance | task=171-019 agent=architect ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017,17 |
-| 2026-05-15T11:14:00.046Z | buildAgentPerformance | task=171-020 agent=architect ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017,17 |
-| 2026-05-15T11:14:00.046Z | buildAgentPerformance | task=171-021 agent=ci-guardian ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017, |
-| 2026-05-15T11:14:00.046Z | buildAgentPerformance | task=171-022 agent=data-engineer ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-01 |
-| 2026-05-15T11:14:00.047Z | buildAgentPerformance | task=171-023 agent=doc-writer ev=NO_GO evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017, |
-| 2026-05-15T11:14:00.047Z | buildAgentPerformance | task=171-024 agent=doc-writer ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017,1 |
-| 2026-05-15T11:14:00.048Z | buildAgentPerformance | task=171-025 agent=architecture-planner ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016 |
-| 2026-05-15T11:14:00.048Z | buildAgentPerformance | task=171-026 agent=data-engineer ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-01 |
-| 2026-05-15T11:14:00.049Z | buildAgentPerformance | task=171-027 agent=doc-writer ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017,1 |
-| 2026-05-15T11:14:00.049Z | buildAgentPerformance | task=171-028 agent=data-engineer ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-01 |
-| 2026-05-15T11:14:00.050Z | buildAgentPerformance | task=171-029 agent=architect ev=DONE evalMapSize=31 evalKeys=[171-001,171-002,171-003,171-004,171-005,171-006,171-007,171-008,171-009,171-010,171-011,171-012,171-013,171-014,171-015,171-016,171-017,17 |
-| 2026-05-15T11:14:00.053Z | finalizeSprint:breadcrumb | Step 10b (selfAuditGate) — entering |
-| 2026-05-15T11:14:02.750Z | runSelfAuditGate:tsc | status=PASS errors=0 |
-| 2026-05-15T11:15:22.027Z | runSelfAuditGate:vitest | status=FAIL delta.fail=1 |
-| 2026-05-15T11:15:22.038Z | docker-backend:exit | taskId=171-023-fix exitCode=0 |
-| 2026-05-15T11:15:22.230Z | runSelfAuditGate:honesty | violations=0 |
-| 2026-05-15T11:15:22.231Z | runSelfAuditGate | overallGate=GATE_FAILURE sprint=sprint-171 |
-| 2026-05-15T11:15:22.231Z | finalizeSprint:selfAuditGate | Gate completed: overallGate=GATE_FAILURE |
-| 2026-05-15T11:15:22.232Z | finalizeSprint:selfAuditGate | Status updated: RETROSPECTIVE → GO_WITH_GATE_FAILURE |
-| 2026-05-15T11:15:22.232Z | finalizeSprint:selfAuditGate | Gate result written to /home/alperen/deckent-dev/.deckent/sprint-171-gate.json overallGate=GATE_FAILURE |
-| 2026-05-15T11:15:22.233Z | finalizeSprint:breadcrumb | Step 10c (loadReport) — entering |
-| 2026-05-15T11:15:22.235Z | finalizeSprint:loadReport | Load test report written to /home/alperen/deckent-dev/docs/audits/sprint-171/load-test-report.md |
-| 2026-05-15T11:15:22.236Z | finalizeSprint:breadcrumb | Step 10c (loadReport) — done |
-| 2026-05-15T11:15:22.236Z | finalizeSprint:breadcrumb | Step 10c2 (metricsRotation) — entering |
-| 2026-05-15T11:15:22.238Z | observability-rotation | Rotated 29230 bytes → /home/alperen/deckent-dev/.deckent/archive/metrics/metrics-sprint-171.jsonl.gz (1852 bytes gzipped), pruned 1 old archives |
-| 2026-05-15T11:15:22.238Z | finalizeSprint:metricsRotation | Rotated 29230 bytes → /home/alperen/deckent-dev/.deckent/archive/metrics/metrics-sprint-171.jsonl.gz (1852 bytes gzipped), pruned 1 old archives |
-| 2026-05-15T11:15:22.239Z | finalizeSprint:breadcrumb | Step 10c2 (metricsRotation) — done |
-| 2026-05-15T11:15:22.239Z | finalizeSprint:breadcrumb | Step 10d (featuresManifest) — entering |
-| 2026-05-15T11:15:22.350Z | finalizeSprint:featuresManifest | Sync exit=0: ✓ Features manifest written: /home/alperen/deckent-dev/.deckent/features-manifest.json (31 features) |
-| 2026-05-15T11:15:22.350Z | finalizeSprint:breadcrumb | Step 12 (archiveDirectives) — entering |
-| 2026-05-15T11:15:22.351Z | archiveDirectives | Archived DIRECTIVES.md → /home/alperen/deckent-dev/.brain/archive/DIRECTIVES-sprint-171.md (preserved; autoArchive=false default per ADR-046 amendment Sprint 168 C0a-4) |
-| 2026-05-15T11:15:22.352Z | finalizeSprint:breadcrumb | Step 12b (archiveOrphanTasks) — entering |
-| 2026-05-15T11:15:22.366Z | createPreArchiveSnapshot | Snapshot created: /home/alperen/deckent-dev/.deckent/sprint-171-pre-archive.tar.gz (155 files, hash=2bbe335db2ae...) |
-| 2026-05-15T11:15:22.367Z | finalizeSprint:preArchiveSnapshot | Snapshot created: 155 files, hash=2bbe335db2ae... |
-| 2026-05-15T11:15:22.378Z | archiveOrphanTasks | Archived 155 task files to /home/alperen/deckent-dev/.brain/archive/sprint-171-tasks |
-| 2026-05-15T11:15:22.379Z | finalizeSprint:archiveOrphanTasks | Archived 155 orphan task files |
-| 2026-05-15T11:15:22.379Z | finalizeSprint:breadcrumb | Step 12c (cleanTasksArchive) — entering |
-| 2026-05-15T11:15:22.380Z | finalizeSprint:cleanTasksArchive | Removed 0 old .tasks/archive/ dirs |
-| 2026-05-15T11:15:22.380Z | finalizeSprint:breadcrumb | Step 12d (sprintFileRetention) — entering |
-| 2026-05-15T11:15:22.383Z | finalizeSprint:sprintFileRetention | Retention complete: archived=4, countersDeleted=2, forensicMoved=0, bytesFreed=4397 |
-| 2026-05-15T11:15:22.384Z | finalizeSprint:breadcrumb | Step 13 (jobSummary) — entering |
-| 2026-05-15T11:15:22.384Z | finalizeSprint:jobSummary | Job summary written to /home/alperen/deckent-dev/.deckent/jobs/sprint-171.json |
-| 2026-05-15T11:15:22.385Z | finalizeSprint:breadcrumb | Step 14 (postFinalizeHooks) — entering |
-| 2026-05-15T11:15:22.395Z | postFinalizeHooks:memoryExport | 4 files written, 0 errors |
-| 2026-05-15T11:15:22.426Z | postFinalizeHooks:adrInsert | inserted=1 updated=2 skipped=50 |
-| 2026-05-15T11:15:22.441Z | postFinalizeHooks:ruleRegen | Rule regeneration hook called |
-| 2026-05-15T11:15:22.441Z | finalizeSprint:postFinalizeHooks | memExport=4 identity=skipped adrInsert=inserted=1/updated=2/skipped=50 ruleRegen=true errors=0 |
-| 2026-05-15T11:15:22.442Z | [Brain] | Cleanup delayed 180000ms — .tasks/ files remain readable |
-| 2026-05-18T04:16:10.670Z | readJsonSafeAsync | ENOENT: no such file or directory, open '/home/alperen/.deckent/config.json' |
-| 2026-05-18T04:16:10.762Z | planSprint:learning-bonuses | Loaded 18 learning bonuses from previous sprints |
-| 2026-05-18T04:16:10.763Z | planSprint:temp-skill | Generated project-conventions skill for typescript |
-| 2026-05-18T04:16:10.764Z | planSprint:temp-agent | Generated temp agent: temp-react-ts-specialist for typescript/react |
-| 2026-05-18T04:16:10.765Z | planSprint:temp-agent | Generated temp agent: temp-react-specialist for typescript/react |
-| 2026-05-18T04:16:10.766Z | planSprint:evolved-rules | Injected 4 auto-applied evolved rules into activation configs |
-| 2026-05-18T04:16:10.768Z | planSprint:routing-v2 | Task 172-001 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.769Z | planSprint:routing-v2 | Task 172-002 → agent=architect, skills=[system-architect, documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.770Z | planSprint:routing-v2 | Task 172-003 → agent=architect, skills=[system-architect], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.771Z | planSprint:routing-v2 | Task 172-004 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.772Z | planSprint:routing-v2 | Task 172-005 → agent=devops-engineer, skills=[typescript-expert, ci-testing], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.772Z | planSprint:routing-v2 | Task 172-006 → agent=api-builder, skills=[typescript-expert, api-builder], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.773Z | planSprint:routing-v2 | Task 172-007 → agent=devops-engineer, skills=[typescript-expert, devops-engineer], confidence=high, intent=implementation |
-| 2026-05-18T04:16:10.774Z | planSprint:routing-v2 | Task 172-008 → agent=data-engineer, skills=[database-migration], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.775Z | planSprint:routing-v2 | Task 172-009 → agent=devops-engineer, skills=[git-expert, devops-engineer], confidence=high, intent=implementation |
-| 2026-05-18T04:16:10.775Z | planSprint:routing-v2 | Task 172-010 → agent=doc-writer, skills=[documentation-writer, git-expert], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.776Z | planSprint:routing-v2 | Task 172-011 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:16:10.777Z | planSprint:routing-v2 | Task 172-012 → agent=refactorer, skills=[monorepo-expert], confidence=high, intent=config |
-| 2026-05-18T04:16:10.777Z | planSprint:task-write | Writing 172-001: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:16:10.778Z | planSprint:task-write | Writing 172-002: assignedAgent=architect, assignedSkills=[system-architect, documentation-writer] |
-| 2026-05-18T04:16:10.779Z | planSprint:task-write | Writing 172-003: assignedAgent=architect, assignedSkills=[system-architect] |
-| 2026-05-18T04:16:10.780Z | planSprint:task-write | Writing 172-004: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:16:10.781Z | planSprint:task-write | Writing 172-005: assignedAgent=devops-engineer, assignedSkills=[typescript-expert, ci-testing] |
-| 2026-05-18T04:16:10.781Z | planSprint:task-write | Writing 172-006: assignedAgent=api-builder, assignedSkills=[typescript-expert, api-builder] |
-| 2026-05-18T04:16:10.782Z | planSprint:task-write | Writing 172-007: assignedAgent=devops-engineer, assignedSkills=[typescript-expert, devops-engineer] |
-| 2026-05-18T04:16:10.783Z | planSprint:task-write | Writing 172-008: assignedAgent=data-engineer, assignedSkills=[database-migration] |
-| 2026-05-18T04:16:10.784Z | planSprint:task-write | Writing 172-009: assignedAgent=devops-engineer, assignedSkills=[git-expert, devops-engineer] |
-| 2026-05-18T04:16:10.785Z | planSprint:task-write | Writing 172-010: assignedAgent=doc-writer, assignedSkills=[documentation-writer, git-expert] |
-| 2026-05-18T04:16:10.785Z | planSprint:task-write | Writing 172-011: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:16:10.786Z | planSprint:task-write | Writing 172-012: assignedAgent=refactorer, assignedSkills=[monorepo-expert] |
-| 2026-05-18T04:26:17.386Z | readJsonSafeAsync | ENOENT: no such file or directory, open '/home/alperen/.deckent/config.json' |
-| 2026-05-18T04:26:18.337Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T04:26:18.338Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T04:26:18.338Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T04:26:18.339Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T04:26:18.339Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T04:26:18.340Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T04:26:18.340Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T04:26:18.340Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T04:26:18.341Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T04:26:18.341Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T04:26:18.342Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T04:26:18.347Z | planSprint:learning-bonuses | Loaded 18 learning bonuses from previous sprints |
-| 2026-05-18T04:26:18.348Z | planSprint:temp-skill | Generated project-conventions skill for typescript |
-| 2026-05-18T04:26:18.348Z | planSprint:temp-agent | Generated temp agent: temp-react-ts-specialist for typescript/react |
-| 2026-05-18T04:26:18.349Z | planSprint:temp-agent | Generated temp agent: temp-react-specialist for typescript/react |
-| 2026-05-18T04:26:18.351Z | planSprint:evolved-rules | Injected 4 auto-applied evolved rules into activation configs |
-| 2026-05-18T04:26:18.353Z | planSprint:routing-v2 | Task 172-001 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.354Z | planSprint:routing-v2 | Task 172-002 → agent=architect, skills=[system-architect, documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.355Z | planSprint:routing-v2 | Task 172-003 → agent=architect, skills=[system-architect], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.356Z | planSprint:routing-v2 | Task 172-004 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.356Z | planSprint:routing-v2 | Task 172-005 → agent=devops-engineer, skills=[typescript-expert, ci-testing], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.357Z | planSprint:routing-v2 | Task 172-006 → agent=api-builder, skills=[typescript-expert, api-builder], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.358Z | planSprint:routing-v2 | Task 172-007 → agent=devops-engineer, skills=[typescript-expert, devops-engineer], confidence=high, intent=implementation |
-| 2026-05-18T04:26:18.359Z | planSprint:routing-v2 | Task 172-008 → agent=data-engineer, skills=[database-migration], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.359Z | planSprint:routing-v2 | Task 172-009 → agent=devops-engineer, skills=[git-expert, devops-engineer], confidence=high, intent=implementation |
-| 2026-05-18T04:26:18.360Z | planSprint:routing-v2 | Task 172-010 → agent=doc-writer, skills=[documentation-writer, git-expert], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.361Z | planSprint:routing-v2 | Task 172-011 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.361Z | planSprint:routing-v2 | Task 172-012 → agent=refactorer, skills=[monorepo-expert], confidence=high, intent=config |
-| 2026-05-18T04:26:18.362Z | planSprint:task-write | Writing 172-001: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:26:18.363Z | planSprint:task-write | Writing 172-002: assignedAgent=architect, assignedSkills=[system-architect, documentation-writer] |
-| 2026-05-18T04:26:18.364Z | planSprint:task-write | Writing 172-003: assignedAgent=architect, assignedSkills=[system-architect] |
-| 2026-05-18T04:26:18.364Z | planSprint:task-write | Writing 172-004: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:26:18.365Z | planSprint:task-write | Writing 172-005: assignedAgent=devops-engineer, assignedSkills=[typescript-expert, ci-testing] |
-| 2026-05-18T04:26:18.366Z | planSprint:task-write | Writing 172-006: assignedAgent=api-builder, assignedSkills=[typescript-expert, api-builder] |
-| 2026-05-18T04:26:18.367Z | planSprint:task-write | Writing 172-007: assignedAgent=devops-engineer, assignedSkills=[typescript-expert, devops-engineer] |
-| 2026-05-18T04:26:18.368Z | planSprint:task-write | Writing 172-008: assignedAgent=data-engineer, assignedSkills=[database-migration] |
-| 2026-05-18T04:26:18.369Z | planSprint:task-write | Writing 172-009: assignedAgent=devops-engineer, assignedSkills=[git-expert, devops-engineer] |
-| 2026-05-18T04:26:18.370Z | planSprint:task-write | Writing 172-010: assignedAgent=doc-writer, assignedSkills=[documentation-writer, git-expert] |
-| 2026-05-18T04:26:18.371Z | planSprint:task-write | Writing 172-011: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:26:18.371Z | planSprint:task-write | Writing 172-012: assignedAgent=refactorer, assignedSkills=[monorepo-expert] |
-| 2026-05-18T04:26:18.392Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.deckent/sprint-state.json' |
-| 2026-05-18T04:26:18.406Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T04:26:18.406Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T04:26:18.407Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T04:26:18.407Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T04:26:18.409Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T04:26:18.409Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T04:26:18.410Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T04:26:18.410Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T04:26:18.411Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T04:26:18.411Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T04:26:18.412Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T04:26:18.413Z | planSprint:learning-bonuses | Loaded 18 learning bonuses from previous sprints |
-| 2026-05-18T04:26:18.413Z | planSprint:temp-skill | Generated project-conventions skill for typescript |
-| 2026-05-18T04:26:18.414Z | planSprint:temp-agent | Generated temp agent: temp-react-ts-specialist for typescript/react |
-| 2026-05-18T04:26:18.415Z | planSprint:temp-agent | Generated temp agent: temp-react-specialist for typescript/react |
-| 2026-05-18T04:26:18.415Z | planSprint:evolved-rules | Injected 4 auto-applied evolved rules into activation configs |
-| 2026-05-18T04:26:18.416Z | planSprint:routing-v2 | Task 172-001 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.417Z | planSprint:routing-v2 | Task 172-002 → agent=architect, skills=[system-architect, documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.417Z | planSprint:routing-v2 | Task 172-003 → agent=architect, skills=[system-architect], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.418Z | planSprint:routing-v2 | Task 172-004 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.419Z | planSprint:routing-v2 | Task 172-005 → agent=devops-engineer, skills=[typescript-expert, ci-testing], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.420Z | planSprint:routing-v2 | Task 172-006 → agent=api-builder, skills=[typescript-expert, api-builder], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.420Z | planSprint:routing-v2 | Task 172-007 → agent=devops-engineer, skills=[typescript-expert, devops-engineer], confidence=high, intent=implementation |
-| 2026-05-18T04:26:18.421Z | planSprint:routing-v2 | Task 172-008 → agent=data-engineer, skills=[database-migration], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.422Z | planSprint:routing-v2 | Task 172-009 → agent=devops-engineer, skills=[git-expert, devops-engineer], confidence=high, intent=implementation |
-| 2026-05-18T04:26:18.422Z | planSprint:routing-v2 | Task 172-010 → agent=doc-writer, skills=[documentation-writer, git-expert], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.423Z | planSprint:routing-v2 | Task 172-011 → agent=doc-writer, skills=[documentation-writer], confidence=high, intent=documentation |
-| 2026-05-18T04:26:18.424Z | planSprint:routing-v2 | Task 172-012 → agent=refactorer, skills=[monorepo-expert], confidence=high, intent=config |
-| 2026-05-18T04:26:18.424Z | planSprint:task-write | Writing 172-001: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:26:18.425Z | planSprint:task-write | Writing 172-002: assignedAgent=architect, assignedSkills=[system-architect, documentation-writer] |
-| 2026-05-18T04:26:18.426Z | planSprint:task-write | Writing 172-003: assignedAgent=architect, assignedSkills=[system-architect] |
-| 2026-05-18T04:26:18.426Z | planSprint:task-write | Writing 172-004: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:26:18.427Z | planSprint:task-write | Writing 172-005: assignedAgent=devops-engineer, assignedSkills=[typescript-expert, ci-testing] |
-| 2026-05-18T04:26:18.428Z | planSprint:task-write | Writing 172-006: assignedAgent=api-builder, assignedSkills=[typescript-expert, api-builder] |
-| 2026-05-18T04:26:18.428Z | planSprint:task-write | Writing 172-007: assignedAgent=devops-engineer, assignedSkills=[typescript-expert, devops-engineer] |
-| 2026-05-18T04:26:18.431Z | planSprint:task-write | Writing 172-008: assignedAgent=data-engineer, assignedSkills=[database-migration] |
-| 2026-05-18T04:26:18.431Z | planSprint:task-write | Writing 172-009: assignedAgent=devops-engineer, assignedSkills=[git-expert, devops-engineer] |
-| 2026-05-18T04:26:18.432Z | planSprint:task-write | Writing 172-010: assignedAgent=doc-writer, assignedSkills=[documentation-writer, git-expert] |
-| 2026-05-18T04:26:18.433Z | planSprint:task-write | Writing 172-011: assignedAgent=doc-writer, assignedSkills=[documentation-writer] |
-| 2026-05-18T04:26:18.433Z | planSprint:task-write | Writing 172-012: assignedAgent=refactorer, assignedSkills=[monorepo-expert] |
-| 2026-05-18T04:26:18.435Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T04:26:18.435Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T04:26:18.436Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T04:26:18.436Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T04:26:18.437Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T04:26:18.437Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T04:26:18.437Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T04:26:18.438Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T04:26:18.438Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T04:26:18.439Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T04:26:18.439Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T04:27:40.374Z | sprint-checkpoint:phaseTransition | Phase PLAN → writing checkpoint |
-| 2026-05-18T04:27:40.375Z | sprint-checkpoint:write | Checkpoint #1 written for sprint-172 |
-| 2026-05-18T04:27:40.377Z | spawnWorkers:collision | File "DECKENT.md" written by tasks: 172-001, 172-010 |
-| 2026-05-18T04:27:40.378Z | spawnWorkers:collision | File "api-surface.md" written by tasks: 172-001, 172-010 |
-| 2026-05-18T04:27:40.378Z | spawnWorkers:collision | File "CLAUDE.md" written by tasks: 172-002, 172-010 |
-| 2026-05-18T04:27:40.380Z | spawnWorkers:collision | File ".deckent/workspace/IDENTITY.md" written by tasks: 172-002, 172-005 |
-| 2026-05-18T04:27:40.381Z | spawnWorkers:collision | File "IDENTITY.md" written by tasks: 172-002, 172-005 |
-| 2026-05-18T04:27:40.384Z | spawnWorkers:collision | File "README.md" written by tasks: 172-004, 172-005 |
-| 2026-05-18T04:27:40.385Z | spawnWorkers:collision | File "README-TR.md" written by tasks: 172-004, 172-005 |
-| 2026-05-18T04:27:40.386Z | spawnWorkers:collision | File "package.json" written by tasks: 172-005, 172-006, 172-007, 172-012 |
-| 2026-05-18T04:27:40.386Z | spawnWorkers:skipBlocked | Task 172-001 blocked by scope collision |
-| 2026-05-18T04:27:40.387Z | spawnWorkers:skipBlocked | Task 172-002 blocked by scope collision |
-| 2026-05-18T04:27:40.405Z | docker-backend:spawn-lock | taskId=172-003 acquired 1 spawn lock(s) |
-| 2026-05-18T04:27:40.521Z | docker-backend:spawn | taskId=172-003 container=deckent-w-172-003 model=sonnet |
-| 2026-05-18T04:27:40.522Z | docker-backend:spawn-attempt | taskId=172-003 attempt=1/2 |
-| 2026-05-18T04:27:44.074Z | docker-backend:spawn-ok | taskId=172-003 containerId=93601e6daa9a instantExit=false |
-| 2026-05-18T04:27:44.078Z | spawnWorkers:skipBlocked | Task 172-004 blocked by scope collision |
-| 2026-05-18T04:27:44.078Z | spawnWorkers:skipBlocked | Task 172-005 blocked by scope collision |
-| 2026-05-18T04:27:44.079Z | spawnWorkers:skipBlocked | Task 172-006 blocked by scope collision |
-| 2026-05-18T04:27:44.115Z | sprint-checkpoint:phaseTransition | Phase SPAWN → writing checkpoint |
-| 2026-05-18T04:27:44.117Z | sprint-checkpoint:write | Checkpoint #2 written for sprint-172 |
-| 2026-05-18T04:30:22.774Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:30:54.624Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:31:26.736Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:31:28.184Z | docker-backend:kill | taskId=172-003 (graceful stop --time=15) |
-| 2026-05-18T04:31:35.165Z | docker-backend:post-stop-verify | taskId=172-003 .result verified + fsynced |
-| 2026-05-18T04:31:35.270Z | docker-backend:spawn-lock | taskId=172-003 released 1 spawn lock(s) on kill |
-| 2026-05-18T04:31:35.272Z | docker-backend:exit | taskId=172-003 exitCode=0 |
-| 2026-05-18T04:31:35.414Z | docker-backend:spawn-lock | taskId=172-007 acquired 4 spawn lock(s) |
-| 2026-05-18T04:31:35.510Z | docker-backend:spawn | taskId=172-007 container=deckent-w-172-007 model=opus |
-| 2026-05-18T04:31:35.510Z | docker-backend:spawn-attempt | taskId=172-007 attempt=1/2 |
-| 2026-05-18T04:31:42.146Z | docker-backend:spawn-ok | taskId=172-007 containerId=11c0f7ce2d81 instantExit=false |
-| 2026-05-18T04:31:59.956Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:32:31.795Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:32:51.538Z | waitForResults:progress | Sprint devam ediyor — 1/12 task tamamlandı (5dk) |
-| 2026-05-18T04:33:04.294Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:33:04.341Z | readJsonSafeAsync | ENOENT: no such file or directory, open '/home/alperen/.deckent/config.json' |
-| 2026-05-18T04:33:36.710Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:34:09.060Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:34:41.847Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:35:14.534Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:35:47.274Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:36:20.069Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:36:42.480Z | forceRescanIfIdle | slot idle for 300s — respawning 5 orphan PENDING task(s): 172-001, 172-002, 172-004, 172-005, 172-006 |
-| 2026-05-18T04:36:42.494Z | scope-sanitizer | warnings=3, rejected=0 |
-| 2026-05-18T04:36:42.495Z | docker-backend:spawn-lock | taskId=172-001 acquired 5 spawn lock(s) |
-| 2026-05-18T04:36:42.596Z | docker-backend:spawn | taskId=172-001 container=deckent-w-172-001 model=sonnet |
-| 2026-05-18T04:36:42.596Z | docker-backend:spawn-attempt | taskId=172-001 attempt=1/2 |
-| 2026-05-18T04:36:45.942Z | docker-backend:spawn-ok | taskId=172-001 containerId=243a26cbf143 instantExit=false |
-| 2026-05-18T04:36:45.954Z | scope-sanitizer | warnings=3, rejected=0 |
-| 2026-05-18T04:36:45.955Z | docker-backend:spawn-lock | taskId=172-002 acquired 5 spawn lock(s) |
-| 2026-05-18T04:36:46.056Z | docker-backend:spawn | taskId=172-002 container=deckent-w-172-002 model=sonnet |
-| 2026-05-18T04:36:46.057Z | docker-backend:spawn-attempt | taskId=172-002 attempt=1/2 |
-| 2026-05-18T04:36:52.236Z | docker-backend:spawn-ok | taskId=172-002 containerId=e8ca8f6d8175 instantExit=false |
-| 2026-05-18T04:36:52.246Z | scope-sanitizer | warnings=2, rejected=0 |
-| 2026-05-18T04:36:52.247Z | docker-backend:spawn-lock | taskId=172-004 acquired 4 spawn lock(s) |
-| 2026-05-18T04:36:52.352Z | docker-backend:spawn | taskId=172-004 container=deckent-w-172-004 model=sonnet |
-| 2026-05-18T04:36:52.352Z | docker-backend:spawn-attempt | taskId=172-004 attempt=1/2 |
-| 2026-05-18T04:36:55.724Z | docker-backend:spawn-ok | taskId=172-004 containerId=c8fcbef0bdaa instantExit=false |
-| 2026-05-18T04:36:55.773Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:36:55.785Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: scripts/lint-links.mjs (taskId=172-007, age=320s) |
-| 2026-05-18T04:36:55.786Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/.vitepress/config.ts (taskId=172-007, age=320s) |
-| 2026-05-18T04:36:55.787Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: tests/scripts/lint-links.test.ts (taskId=172-007, age=320s) |
-| 2026-05-18T04:36:55.787Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: package.json (taskId=172-007, age=320s) |
-| 2026-05-18T04:36:55.808Z | scope-sanitizer | warnings=3, rejected=0 |
-| 2026-05-18T04:36:55.809Z | waitForResults:queue-spawn | Failed to spawn queued task 172-005: Spawn lock conflict on README.md: file is currently held by task 172-004 |
-| 2026-05-18T04:36:55.817Z | scope-sanitizer | warnings=1, rejected=0 |
-| 2026-05-18T04:36:55.818Z | docker-backend:spawn-lock | taskId=172-006 acquired 9 spawn lock(s) |
-| 2026-05-18T04:36:55.917Z | docker-backend:spawn | taskId=172-006 container=deckent-w-172-006 model=opus |
-| 2026-05-18T04:36:55.917Z | docker-backend:spawn-attempt | taskId=172-006 attempt=1/2 |
-| 2026-05-18T04:36:59.275Z | docker-backend:spawn-ok | taskId=172-006 containerId=376c69a76d3d instantExit=false |
-| 2026-05-18T04:37:28.605Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:37:52.113Z | waitForResults:progress | Sprint devam ediyor — 1/12 task tamamlandı (10dk) |
-| 2026-05-18T04:37:58.605Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:38:31.410Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:39:04.159Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:39:36.840Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:39:40.259Z | docker-backend:kill | taskId=172-001 (graceful stop --time=15) |
-| 2026-05-18T04:39:50.402Z | docker-backend:post-stop-verify | taskId=172-001 .result verified + fsynced |
-| 2026-05-18T04:39:50.504Z | docker-backend:spawn-lock | taskId=172-001 released 5 spawn lock(s) on kill |
-| 2026-05-18T04:39:50.505Z | docker-backend:exit | taskId=172-001 exitCode=0 |
-| 2026-05-18T04:39:50.653Z | docker-backend:spawn-lock | taskId=172-008 acquired 2 spawn lock(s) |
-| 2026-05-18T04:39:50.758Z | docker-backend:spawn | taskId=172-008 container=deckent-w-172-008 model=opus |
-| 2026-05-18T04:39:50.758Z | docker-backend:spawn-attempt | taskId=172-008 attempt=1/2 |
-| 2026-05-18T04:39:54.211Z | docker-backend:spawn-ok | taskId=172-008 containerId=5524b28e0311 instantExit=false |
-| 2026-05-18T04:40:09.486Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:40:42.105Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:41:08.703Z | docker-backend:kill | taskId=172-002 (graceful stop --time=15) |
-| 2026-05-18T04:41:14.620Z | docker-backend:post-stop-verify | taskId=172-002 .result verified + fsynced |
-| 2026-05-18T04:41:14.718Z | docker-backend:spawn-lock | taskId=172-002 released 5 spawn lock(s) on kill |
-| 2026-05-18T04:41:14.784Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:41:14.813Z | docker-backend:exit | taskId=172-002 exitCode=0 |
-| 2026-05-18T04:41:14.956Z | docker-backend:spawn-lock | taskId=172-009 acquired 2 spawn lock(s) |
-| 2026-05-18T04:41:15.051Z | docker-backend:spawn | taskId=172-009 container=deckent-w-172-009 model=sonnet |
-| 2026-05-18T04:41:15.052Z | docker-backend:spawn-attempt | taskId=172-009 attempt=1/2 |
-| 2026-05-18T04:41:18.458Z | docker-backend:spawn-ok | taskId=172-009 containerId=166f7d36d20a instantExit=false |
-| 2026-05-18T04:41:47.486Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:42:20.182Z | readJsonSafe | ENOENT: no such file or directory, open '/home/alperen/deckent-dev/.tasks/task-test-docker-38991.json' |
-| 2026-05-18T04:42:20.194Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: scripts/gen-reference-docs.mjs (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.194Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: server.ts (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.195Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/reference/mcp-resources.md (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.195Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: README-TR.md (taskId=172-004, age=328s) |
-| 2026-05-18T04:42:20.196Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/adr/README.md (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.196Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: package.json (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.197Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: tests/scripts/gen-reference-docs.test.ts (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.197Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/reference/mcp-tools.md (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.198Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/reference/cli.md (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:20.198Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: src/mcp/server.ts (taskId=172-004, age=328s) |
-| 2026-05-18T04:42:20.199Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: README.md (taskId=172-004, age=328s) |
-| 2026-05-18T04:42:20.199Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .length (taskId=172-004, age=328s) |
-| 2026-05-18T04:42:20.200Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/reference/agents.md (taskId=172-006, age=324s) |
-| 2026-05-18T04:42:52.377Z | waitForResults:progress | Sprint devam ediyor — 3/12 task tamamlandı (15dk) |
-| 2026-05-18T04:45:03.337Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: scripts/verify-archive-db-parity.mjs (taskId=172-008, age=313s) |
-| 2026-05-18T04:45:03.338Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/audits/sprint-171/archive-parity-report.md (taskId=172-008, age=313s) |
-| 2026-05-18T04:46:23.321Z | forceRescanIfIdle | slot idle for 305s — respawning 1 orphan PENDING task(s): 172-005 |
-| 2026-05-18T04:46:23.330Z | scope-sanitizer | warnings=3, rejected=0 |
-| 2026-05-18T04:46:23.331Z | docker-backend:spawn-lock | taskId=172-005 acquired 7 spawn lock(s) |
-| 2026-05-18T04:46:23.425Z | docker-backend:spawn | taskId=172-005 container=deckent-w-172-005 model=opus |
-| 2026-05-18T04:46:23.426Z | docker-backend:spawn-attempt | taskId=172-005 attempt=1/2 |
-| 2026-05-18T04:46:26.796Z | docker-backend:spawn-ok | taskId=172-005 containerId=eb789c692f19 instantExit=false |
-| 2026-05-18T04:46:26.800Z | docker-backend:kill | taskId=172-004 (graceful stop --time=15) |
-| 2026-05-18T04:46:30.909Z | docker-backend:post-stop-verify | taskId=172-004 .result verified + fsynced |
-| 2026-05-18T04:46:31.006Z | docker-backend:exit | taskId=172-004 exitCode=0 |
-| 2026-05-18T04:46:31.148Z | scope-sanitizer | warnings=7, rejected=0 |
-| 2026-05-18T04:46:31.149Z | docker-backend:spawn-lock | taskId=172-010 acquired 12 spawn lock(s) |
-| 2026-05-18T04:46:31.246Z | docker-backend:spawn | taskId=172-010 container=deckent-w-172-010 model=sonnet |
-| 2026-05-18T04:46:31.246Z | docker-backend:spawn-attempt | taskId=172-010 attempt=1/2 |
-| 2026-05-18T04:46:34.616Z | docker-backend:spawn-ok | taskId=172-010 containerId=7cb91e204051 instantExit=false |
-| 2026-05-18T04:46:38.593Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .npmignore (taskId=172-009, age=324s) |
-| 2026-05-18T04:46:38.594Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .gitignore (taskId=172-009, age=324s) |
-| 2026-05-18T04:47:58.327Z | waitForResults:progress | Sprint devam ediyor — 4/12 task tamamlandı (20dk) |
-| 2026-05-18T04:48:28.483Z | docker-backend:kill | taskId=172-007 (graceful stop --time=15) |
-| 2026-05-18T04:48:46.747Z | docker-backend:post-stop-verify | taskId=172-007 .result verified + fsynced |
-| 2026-05-18T04:48:46.853Z | docker-backend:exit | taskId=172-007 exitCode=137 |
-| 2026-05-18T04:48:46.854Z | docker-backend:reconcile | taskId=172-007 exitCode=137 but .result=DONE → HB DONE |
-| 2026-05-18T04:48:46.995Z | scope-sanitizer | warnings=1, rejected=0 |
-| 2026-05-18T04:48:46.995Z | docker-backend:spawn-lock | taskId=172-011 acquired 2 spawn lock(s) |
-| 2026-05-18T04:48:47.096Z | docker-backend:spawn | taskId=172-011 container=deckent-w-172-011 model=sonnet |
-| 2026-05-18T04:48:47.097Z | docker-backend:spawn-attempt | taskId=172-011 attempt=1/2 |
-| 2026-05-18T04:48:50.511Z | docker-backend:spawn-ok | taskId=172-011 containerId=877b0696e484 instantExit=false |
-| 2026-05-18T04:48:55.519Z | docker-backend:kill | taskId=172-008 (graceful stop --time=15) |
-| 2026-05-18T04:49:13.746Z | docker-backend:post-stop-verify | taskId=172-008 .result verified + fsynced |
-| 2026-05-18T04:49:13.841Z | docker-backend:exit | taskId=172-008 exitCode=137 |
-| 2026-05-18T04:49:13.843Z | docker-backend:reconcile | taskId=172-008 exitCode=137 but .result=DONE → HB DONE |
-| 2026-05-18T04:49:13.985Z | waitForResults:queue-spawn | Failed to spawn queued task 172-012: Spawn lock conflict on package.json: file is currently held by task 172-005 |
-| 2026-05-18T04:49:50.996Z | docker-backend:exit | taskId=172-009 exitCode=0 |
-| 2026-05-18T04:51:16.246Z | docker-backend:exit | taskId=172-006 exitCode=0 |
-| 2026-05-18T04:51:34.954Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .deckent/workspace/IDENTITY.md (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.954Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/vision/blueprint.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.955Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/CHANGELOG.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.956Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: VISION-TR.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.956Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: README-TR.md (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.957Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: tests/scripts/update-readme-stats.test.ts (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.957Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: NEXT-SESSION.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.958Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/analysis/full-audit.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.958Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: CLAUDE.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.959Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: package.json (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.959Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/launch/CONDUCT.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.960Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: scripts/update-readme-stats.mjs (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.961Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: IDENTITY.md (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.961Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: VISION.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.962Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: README.md (taskId=172-005, age=312s) |
-| 2026-05-18T04:51:34.962Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/vision/roadmap.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.963Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: DECKENT.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.963Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: api-surface.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:51:34.964Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: next-session-prompt.md (taskId=172-010, age=304s) |
-| 2026-05-18T04:53:00.991Z | waitForResults:progress | Sprint devam ediyor — 8/12 task tamamlandı (25dk) |
-| 2026-05-18T04:53:53.885Z | forceRescanIfIdle | slot idle for 303s — respawning 1 orphan PENDING task(s): 172-012 |
-| 2026-05-18T04:53:53.892Z | docker-backend:spawn-lock | taskId=172-012 acquired 2 spawn lock(s) |
-| 2026-05-18T04:53:53.990Z | docker-backend:spawn | taskId=172-012 container=deckent-w-172-012 model=sonnet |
-| 2026-05-18T04:53:53.991Z | docker-backend:spawn-attempt | taskId=172-012 attempt=1/2 |
-| 2026-05-18T04:53:57.334Z | docker-backend:spawn-ok | taskId=172-012 containerId=250ee261f1da instantExit=false |
-| 2026-05-18T04:54:17.719Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: WORKER-GUIDE.md (taskId=172-011, age=331s) |
-| 2026-05-18T04:54:17.720Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/guide/workers.md (taskId=172-011, age=331s) |
-| 2026-05-18T04:55:01.115Z | docker-backend:exit | taskId=172-010 exitCode=0 |
-| 2026-05-18T04:56:23.713Z | docker-backend:exit | taskId=172-012 exitCode=0 |
-| 2026-05-18T04:56:23.881Z | docker-backend:spawn-lock | taskId=172-012 released 2 spawn lock(s) on exit |
-| 2026-05-18T04:58:01.857Z | waitForResults:progress | Sprint devam ediyor — 10/12 task tamamlandı (30dk) |
-| 2026-05-18T05:02:08.630Z | docker-backend:exit | taskId=172-011 exitCode=0 |
-| 2026-05-18T05:03:08.528Z | waitForResults:progress | Sprint devam ediyor — 11/12 task tamamlandı (35dk) |
-| 2026-05-18T05:03:25.966Z | sprint-checkpoint:phaseTransition | Phase EXECUTE → writing checkpoint |
-| 2026-05-18T05:03:25.967Z | sprint-checkpoint:write | Checkpoint #3 written for sprint-172 |
-| 2026-05-18T05:03:25.968Z | runEvaluatePhase:start | totalTasks=12 collectedResults=12 collectedIds=[172-003,172-001,172-002,172-004,172-007,172-008,172-009,172-006,172-010,172-012,172-011,172-005] |
-| 2026-05-18T05:03:28.616Z | runEvaluatePhase:task | task=172-001 selfAssessment=DONE evaluation=DONE testsPassed=true |
-| 2026-05-18T05:03:28.618Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T05:03:28.619Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T05:03:28.619Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T05:03:28.620Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T05:03:28.620Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T05:03:28.621Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T05:03:28.621Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T05:03:28.621Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T05:03:28.622Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T05:03:28.622Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T05:03:28.623Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T05:03:31.172Z | runEvaluatePhase:task | task=172-002 selfAssessment=GO_WITH_TECH_DEBT evaluation=DONE testsPassed=true |
-| 2026-05-18T05:03:31.174Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T05:03:31.175Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T05:03:31.175Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T05:03:31.176Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T05:03:31.176Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T05:03:31.177Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T05:03:31.177Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T05:03:31.178Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T05:03:31.178Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T05:03:31.178Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T05:03:31.179Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T05:03:33.706Z | runEvaluatePhase:task | task=172-003 selfAssessment=GO_WITH_TECH_DEBT evaluation=DONE testsPassed=true |
-| 2026-05-18T05:03:33.708Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T05:03:33.709Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T05:03:33.710Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T05:03:33.710Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T05:03:33.710Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T05:03:33.711Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T05:03:33.711Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T05:03:33.712Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T05:03:33.712Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T05:03:33.713Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T05:03:33.713Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T05:03:36.211Z | runEvaluatePhase:task | task=172-004 selfAssessment=DONE evaluation=DONE testsPassed=true |
-| 2026-05-18T05:03:36.213Z | runEvaluatePhase:task | task=172-005 selfAssessment=DONE evaluation=NO_GO testsPassed=true |
-| 2026-05-18T05:03:36.214Z | runEvaluatePhase:task | task=172-006 selfAssessment=DONE evaluation=NO_GO testsPassed=true |
-| 2026-05-18T05:03:36.215Z | enforceHonestResultGate | Task 172-007: BOUNDARY_VIOLATION — files outside scope.filesWrite: .lintlinkignore, docs/guide/quickstart.md, docs/guide/faq.md, docs/guide/concepts.md, docs/guide/first-sprint.md, docs/guide/getting- |
-| 2026-05-18T05:03:36.215Z | runEvaluatePhase:honestGate | task=172-007 violation=BOUNDARY_VIOLATION → forced NO_GO |
-| 2026-05-18T05:03:36.216Z | runEvaluatePhase:task | task=172-007 selfAssessment=NO_GO evaluation=NO_GO testsPassed=true |
-| 2026-05-18T05:03:36.217Z | runEvaluatePhase:task | task=172-008 selfAssessment=DONE evaluation=NO_GO testsPassed=true |
-| 2026-05-18T05:03:36.218Z | enforceHonestResultGate | Task 172-009: BOUNDARY_VIOLATION — files outside scope.filesWrite: .brain/archive/.gitignore |
-| 2026-05-18T05:03:36.218Z | runEvaluatePhase:honestGate | task=172-009 violation=BOUNDARY_VIOLATION → forced NO_GO |
-| 2026-05-18T05:03:36.219Z | runEvaluatePhase:task | task=172-009 selfAssessment=NO_GO evaluation=NO_GO testsPassed=true |
-| 2026-05-18T05:03:36.219Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T05:03:36.220Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T05:03:36.220Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T05:03:36.221Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T05:03:36.221Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T05:03:36.222Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T05:03:36.222Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T05:03:36.223Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T05:03:36.223Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T05:03:36.224Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T05:03:36.224Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T05:03:38.863Z | runEvaluatePhase:task | task=172-010 selfAssessment=DONE evaluation=DONE testsPassed=true |
-| 2026-05-18T05:03:38.865Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T05:03:38.866Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T05:03:38.867Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T05:03:38.867Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T05:03:38.868Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T05:03:38.868Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T05:03:38.868Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T05:03:38.869Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T05:03:38.869Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T05:03:38.870Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T05:03:38.870Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T05:03:41.520Z | runEvaluatePhase:task | task=172-011 selfAssessment=DONE evaluation=DONE testsPassed=true |
-| 2026-05-18T05:03:41.522Z | runEvaluatePhase:task | task=172-012 selfAssessment=DONE evaluation=NO_GO testsPassed=true |
-| 2026-05-18T05:03:41.523Z | runEvaluatePhase:done | evaluations.size=12 keys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012] |
-| 2026-05-18T05:03:41.524Z | evaluateFailureCascade | task 172-005: CODE → retry=false cascade=true |
-| 2026-05-18T05:03:41.525Z | dependency-scheduler:applyFailureCascade | Task 172-005 (CODE): cascading block to transitive dependents |
-| 2026-05-18T05:03:41.525Z | applyCascadeToSprint | Cascade applied: 172-005 (CODE) → 0 tasks blocked |
-| 2026-05-18T05:03:41.526Z | evaluateFailureCascade | task 172-006: CODE → retry=false cascade=true |
-| 2026-05-18T05:03:41.527Z | dependency-scheduler:applyFailureCascade | Task 172-006 (CODE): cascading block to transitive dependents |
-| 2026-05-18T05:03:41.527Z | applyCascadeToSprint | Cascade applied: 172-006 (CODE) → 0 tasks blocked |
-| 2026-05-18T05:03:41.528Z | evaluateFailureCascade | task 172-007: CODE → retry=false cascade=true |
-| 2026-05-18T05:03:41.528Z | dependency-scheduler:applyFailureCascade | Task 172-007 (CODE): cascading block to transitive dependents |
-| 2026-05-18T05:03:41.529Z | applyCascadeToSprint | Cascade applied: 172-007 (CODE) → 2 tasks blocked |
-| 2026-05-18T05:03:41.530Z | evaluateFailureCascade | task 172-008: CODE → retry=false cascade=true |
-| 2026-05-18T05:03:41.530Z | dependency-scheduler:applyFailureCascade | Task 172-008 (CODE): cascading block to transitive dependents |
-| 2026-05-18T05:03:41.531Z | applyCascadeToSprint | Cascade applied: 172-008 (CODE) → 1 tasks blocked |
-| 2026-05-18T05:03:41.531Z | evaluateFailureCascade | task 172-009: CODE → retry=false cascade=true |
-| 2026-05-18T05:03:41.532Z | dependency-scheduler:applyFailureCascade | Task 172-009 (CODE): cascading block to transitive dependents |
-| 2026-05-18T05:03:41.532Z | applyCascadeToSprint | Cascade applied: 172-009 (CODE) → 0 tasks blocked |
-| 2026-05-18T05:03:41.533Z | evaluateFailureCascade | task 172-012: CODE → retry=false cascade=true |
-| 2026-05-18T05:03:41.534Z | dependency-scheduler:applyFailureCascade | Task 172-012 (CODE): cascading block to transitive dependents |
-| 2026-05-18T05:03:41.534Z | applyCascadeToSprint | Cascade applied: 172-012 (CODE) → 0 tasks blocked |
-| 2026-05-18T05:03:41.538Z | sprint-checkpoint:phaseTransition | Phase EVALUATE → writing checkpoint |
-| 2026-05-18T05:03:41.539Z | sprint-checkpoint:write | Checkpoint #4 written for sprint-172 |
-| 2026-05-18T05:03:41.543Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Cargo.toml' |
-| 2026-05-18T05:03:41.543Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/go.mod' |
-| 2026-05-18T05:03:41.544Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/setup.py' |
-| 2026-05-18T05:03:41.544Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pyproject.toml' |
-| 2026-05-18T05:03:41.545Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/requirements.txt' |
-| 2026-05-18T05:03:41.545Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Pipfile' |
-| 2026-05-18T05:03:41.546Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/pom.xml' |
-| 2026-05-18T05:03:41.546Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/build.gradle' |
-| 2026-05-18T05:03:41.547Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/CMakeLists.txt' |
-| 2026-05-18T05:03:41.547Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/Makefile' |
-| 2026-05-18T05:03:41.548Z | isStackStale:statSyncFile | ENOENT: no such file or directory, stat '/home/alperen/deckent-dev/meson.build' |
-| 2026-05-18T05:03:41.549Z | spawnWorkers:collision | File "package.json" written by tasks: 172-005-fix, 172-006-fix, 172-007-fix, 172-012-fix |
-| 2026-05-18T05:03:41.549Z | spawnWorkers:skipBlocked | Task 172-005-fix blocked by scope collision |
-| 2026-05-18T05:03:41.549Z | spawnWorkers:skipBlocked | Task 172-006-fix blocked by scope collision |
-| 2026-05-18T05:03:41.550Z | spawnWorkers:skipBlocked | Task 172-007-fix blocked by scope collision |
-| 2026-05-18T05:03:41.586Z | docker-backend:spawn-lock | taskId=172-008-fix acquired 2 spawn lock(s) |
-| 2026-05-18T05:03:41.687Z | docker-backend:spawn | taskId=172-008-fix container=deckent-w-172-008-fix model=opus |
-| 2026-05-18T05:03:41.688Z | docker-backend:spawn-attempt | taskId=172-008-fix attempt=1/2 |
-| 2026-05-18T05:03:45.063Z | docker-backend:spawn-ok | taskId=172-008-fix containerId=9cd7b7960757 instantExit=false |
-| 2026-05-18T05:03:45.073Z | docker-backend:spawn-lock | taskId=172-009-fix acquired 2 spawn lock(s) |
-| 2026-05-18T05:03:45.180Z | docker-backend:spawn | taskId=172-009-fix container=deckent-w-172-009-fix model=sonnet |
-| 2026-05-18T05:03:45.181Z | docker-backend:spawn-attempt | taskId=172-009-fix attempt=1/2 |
-| 2026-05-18T05:03:48.621Z | docker-backend:spawn-ok | taskId=172-009-fix containerId=36e03d1c6924 instantExit=false |
-| 2026-05-18T05:03:48.623Z | spawnWorkers:skipBlocked | Task 172-012-fix blocked by scope collision |
-| 2026-05-18T05:03:48.624Z | docker-backend:exit | taskId=172-005 exitCode=0 |
-| 2026-05-18T05:07:38.688Z | docker-backend:exit | taskId=172-008-fix exitCode=0 |
-| 2026-05-18T05:07:38.844Z | docker-backend:spawn-lock | taskId=172-008-fix released 2 spawn lock(s) on exit |
-| 2026-05-18T05:08:54.149Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .npmignore (taskId=172-009-fix, age=309s) |
-| 2026-05-18T05:08:54.150Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .gitignore (taskId=172-009-fix, age=309s) |
-| 2026-05-18T05:08:54.188Z | forceRescanIfIdle | slot idle for 306s — respawning 4 orphan PENDING task(s): 172-005-fix, 172-006-fix, 172-007-fix, 172-012-fix |
-| 2026-05-18T05:08:54.196Z | scope-sanitizer | warnings=3, rejected=0 |
-| 2026-05-18T05:08:54.198Z | docker-backend:spawn-lock | taskId=172-005-fix acquired 7 spawn lock(s) |
-| 2026-05-18T05:08:54.301Z | docker-backend:spawn | taskId=172-005-fix container=deckent-w-172-005-fix model=opus |
-| 2026-05-18T05:08:54.302Z | docker-backend:spawn-attempt | taskId=172-005-fix attempt=1/2 |
-| 2026-05-18T05:08:57.682Z | docker-backend:spawn-ok | taskId=172-005-fix containerId=b428c7597133 instantExit=false |
-| 2026-05-18T05:08:57.692Z | scope-sanitizer | warnings=1, rejected=0 |
-| 2026-05-18T05:08:57.693Z | waitForResults:queue-spawn | Failed to spawn queued task 172-006-fix: Spawn lock conflict on package.json: file is currently held by task 172-005-fix |
-| 2026-05-18T05:08:57.701Z | waitForResults:queue-spawn | Failed to spawn queued task 172-007-fix: Spawn lock conflict on package.json: file is currently held by task 172-005-fix |
-| 2026-05-18T05:08:57.710Z | waitForResults:queue-spawn | Failed to spawn queued task 172-012-fix: Spawn lock conflict on package.json: file is currently held by task 172-005-fix |
-| 2026-05-18T05:08:57.710Z | waitForResults:progress | Sprint devam ediyor — 1/6 task tamamlandı (5dk) |
-| 2026-05-18T05:10:17.703Z | docker-backend:exit | taskId=172-009-fix exitCode=0 |
-| 2026-05-18T05:14:01.465Z | forceRescanIfIdle | slot idle for 304s — respawning 3 orphan PENDING task(s): 172-006-fix, 172-007-fix, 172-012-fix |
-| 2026-05-18T05:14:01.473Z | scope-sanitizer | warnings=1, rejected=0 |
-| 2026-05-18T05:14:01.474Z | waitForResults:queue-spawn | Failed to spawn queued task 172-006-fix: Spawn lock conflict on package.json: file is currently held by task 172-005-fix |
-| 2026-05-18T05:14:01.482Z | waitForResults:queue-spawn | Failed to spawn queued task 172-007-fix: Spawn lock conflict on package.json: file is currently held by task 172-005-fix |
-| 2026-05-18T05:14:01.490Z | waitForResults:queue-spawn | Failed to spawn queued task 172-012-fix: Spawn lock conflict on package.json: file is currently held by task 172-005-fix |
-| 2026-05-18T05:14:01.490Z | waitForResults:progress | Sprint devam ediyor — 2/6 task tamamlandı (10dk) |
-| 2026-05-18T05:14:11.793Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: .deckent/workspace/IDENTITY.md (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:11.794Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: README-TR.md (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:11.795Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: tests/scripts/update-readme-stats.test.ts (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:11.795Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: package.json (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:11.796Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: scripts/update-readme-stats.mjs (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:11.797Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: IDENTITY.md (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:11.797Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: README.md (taskId=172-005-fix, age=318s) |
-| 2026-05-18T05:14:42.330Z | docker-backend:exit | taskId=172-005-fix exitCode=0 |
-| 2026-05-18T05:19:01.730Z | forceRescanIfIdle | slot idle for 300s — respawning 3 orphan PENDING task(s): 172-006-fix, 172-007-fix, 172-012-fix |
-| 2026-05-18T05:19:01.738Z | scope-sanitizer | warnings=1, rejected=0 |
-| 2026-05-18T05:19:01.740Z | docker-backend:spawn-lock | taskId=172-006-fix acquired 9 spawn lock(s) |
-| 2026-05-18T05:19:01.864Z | docker-backend:spawn | taskId=172-006-fix container=deckent-w-172-006-fix model=opus |
-| 2026-05-18T05:19:01.865Z | docker-backend:spawn-attempt | taskId=172-006-fix attempt=1/2 |
-| 2026-05-18T05:19:05.244Z | docker-backend:spawn-ok | taskId=172-006-fix containerId=b312cb6323eb instantExit=false |
-| 2026-05-18T05:19:05.255Z | waitForResults:queue-spawn | Failed to spawn queued task 172-007-fix: Spawn lock conflict on package.json: file is currently held by task 172-006-fix |
-| 2026-05-18T05:19:05.263Z | waitForResults:queue-spawn | Failed to spawn queued task 172-012-fix: Spawn lock conflict on package.json: file is currently held by task 172-006-fix |
-| 2026-05-18T05:19:05.263Z | waitForResults:progress | Sprint devam ediyor — 3/6 task tamamlandı (15dk) |
-| 2026-05-18T05:22:59.474Z | docker-backend:exit | taskId=172-006-fix exitCode=0 |
-| 2026-05-18T05:22:59.645Z | docker-backend:spawn-lock | taskId=172-006-fix released 9 spawn lock(s) on exit |
-| 2026-05-18T05:24:08.083Z | forceRescanIfIdle | slot idle for 303s — respawning 2 orphan PENDING task(s): 172-007-fix, 172-012-fix |
-| 2026-05-18T05:24:08.093Z | docker-backend:spawn-lock | taskId=172-007-fix acquired 4 spawn lock(s) |
-| 2026-05-18T05:24:08.199Z | docker-backend:spawn | taskId=172-007-fix container=deckent-w-172-007-fix model=opus |
-| 2026-05-18T05:24:08.200Z | docker-backend:spawn-attempt | taskId=172-007-fix attempt=1/2 |
-| 2026-05-18T05:24:11.577Z | docker-backend:spawn-ok | taskId=172-007-fix containerId=4c8f6b4c78e8 instantExit=false |
-| 2026-05-18T05:24:11.586Z | waitForResults:queue-spawn | Failed to spawn queued task 172-012-fix: Spawn lock conflict on package.json: file is currently held by task 172-007-fix |
-| 2026-05-18T05:24:11.586Z | waitForResults:progress | Sprint devam ediyor — 4/6 task tamamlandı (20dk) |
-| 2026-05-18T05:29:15.860Z | forceRescanIfIdle | slot idle for 304s — respawning 1 orphan PENDING task(s): 172-012-fix |
-| 2026-05-18T05:29:15.883Z | waitForResults:queue-spawn | Failed to spawn queued task 172-012-fix: Spawn lock conflict on package.json: file is currently held by task 172-007-fix |
-| 2026-05-18T05:29:15.883Z | waitForResults:progress | Sprint devam ediyor — 4/6 task tamamlandı (25dk) |
-| 2026-05-18T05:29:36.933Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: scripts/lint-links.mjs (taskId=172-007-fix, age=329s) |
-| 2026-05-18T05:29:36.934Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: docs/.vitepress/config.ts (taskId=172-007-fix, age=329s) |
-| 2026-05-18T05:29:36.934Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: tests/scripts/lint-links.test.ts (taskId=172-007-fix, age=329s) |
-| 2026-05-18T05:29:36.935Z | file-lock:clearStaleSpawnLocks | Released stale spawn lock: package.json (taskId=172-007-fix, age=329s) |
-| 2026-05-18T05:32:27.842Z | docker-backend:exit | taskId=172-007-fix exitCode=0 |
-| 2026-05-18T05:33:51.825Z | sprint-checkpoint:phaseTransition | Phase FIX → writing checkpoint |
-| 2026-05-18T05:33:51.827Z | sprint-checkpoint:write | Checkpoint #5 written for sprint-172 |
-| 2026-05-18T05:33:51.846Z | finalizeSprint:preRetro | evaluations.size=17 keys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-008-fix,172-009-fix] |
-| 2026-05-18T05:33:51.847Z | buildAgentPerformance | task=172-001 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:33:51.848Z | buildAgentPerformance | task=172-002 agent=architect ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-00 |
-| 2026-05-18T05:33:51.849Z | buildAgentPerformance | task=172-003 agent=architect ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-00 |
-| 2026-05-18T05:33:51.849Z | buildAgentPerformance | task=172-004 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:33:51.849Z | buildAgentPerformance | task=172-005 agent=devops-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix |
-| 2026-05-18T05:33:51.850Z | buildAgentPerformance | task=172-006 agent=api-builder ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172 |
-| 2026-05-18T05:33:51.850Z | buildAgentPerformance | task=172-007 agent=devops-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix |
-| 2026-05-18T05:33:51.851Z | buildAgentPerformance | task=172-008 agent=data-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,1 |
-| 2026-05-18T05:33:51.851Z | buildAgentPerformance | task=172-009 agent=devops-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix |
-| 2026-05-18T05:33:51.852Z | buildAgentPerformance | task=172-010 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:33:51.852Z | buildAgentPerformance | task=172-011 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:33:51.852Z | buildAgentPerformance | task=172-012 agent=refactorer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172- |
-| 2026-05-18T05:35:28.070Z | finalizeSprint:tripleLink | Triple-link created for sprint-172 |
-| 2026-05-18T05:35:28.091Z | finalizeSprint:routing-outcomes | Recorded 12 routing outcomes to learnings.json |
-| 2026-05-18T05:35:28.092Z | finalizeSprint:rule-evolution | 17 new rules evolved |
-| 2026-05-18T05:35:28.095Z | rule-evolver:saveRules | 17 rules saved to .deckent/routing/evolved-rules.json |
-| 2026-05-18T05:35:28.105Z | finalizeSprint:syncStatsToManifests | Synced 18 agents, 20 skills to manifest files |
-| 2026-05-18T05:35:28.107Z | finalizeSprint:promotion | agent 'test-writer': 125 tasks, 90% success — meets promotion criteria |
-| 2026-05-18T05:35:28.108Z | promotion-pipeline:promote | Temp agent 'test-writer' not found |
-| 2026-05-18T05:35:28.108Z | finalizeSprint:promotion | skill 'code-reviewer': 32 tasks, 91% success — meets promotion criteria |
-| 2026-05-18T05:35:28.109Z | promotion-pipeline:promote | Temp skill 'code-reviewer' not found |
-| 2026-05-18T05:35:28.116Z | finalizeSprint:breadcrumb | Step 10 (richOutput) — entering |
-| 2026-05-18T05:35:28.138Z | buildAgentPerformance | task=172-001 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:35:28.139Z | buildAgentPerformance | task=172-002 agent=architect ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-00 |
-| 2026-05-18T05:35:28.139Z | buildAgentPerformance | task=172-003 agent=architect ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-00 |
-| 2026-05-18T05:35:28.140Z | buildAgentPerformance | task=172-004 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:35:28.141Z | buildAgentPerformance | task=172-005 agent=devops-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix |
-| 2026-05-18T05:35:28.141Z | buildAgentPerformance | task=172-006 agent=api-builder ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172 |
-| 2026-05-18T05:35:28.142Z | buildAgentPerformance | task=172-007 agent=devops-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix |
-| 2026-05-18T05:35:28.142Z | buildAgentPerformance | task=172-008 agent=data-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,1 |
-| 2026-05-18T05:35:28.143Z | buildAgentPerformance | task=172-009 agent=devops-engineer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix |
-| 2026-05-18T05:35:28.143Z | buildAgentPerformance | task=172-010 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:35:28.143Z | buildAgentPerformance | task=172-011 agent=doc-writer ev=DONE evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172-0 |
-| 2026-05-18T05:35:28.144Z | buildAgentPerformance | task=172-012 agent=refactorer ev=NO_GO evalMapSize=17 evalKeys=[172-001,172-002,172-003,172-004,172-005,172-006,172-007,172-008,172-009,172-010,172-011,172-012,172-005-fix,172-006-fix,172-007-fix,172- |
-| 2026-05-18T05:35:28.147Z | finalizeSprint:breadcrumb | Step 10b (selfAuditGate) — entering |
-| 2026-05-18T05:35:30.697Z | runSelfAuditGate:tsc | status=PASS errors=0 |
-| 2026-05-18T05:36:38.370Z | runSelfAuditGate:vitest | status=FAIL delta.fail=2 |
-| 2026-05-18T05:36:38.410Z | runSelfAuditGate:honesty | violations=0 |
-| 2026-05-18T05:36:38.411Z | runSelfAuditGate | overallGate=GATE_FAILURE sprint=sprint-172 |
-| 2026-05-18T05:36:38.411Z | finalizeSprint:selfAuditGate | Gate completed: overallGate=GATE_FAILURE |
-| 2026-05-18T05:36:38.412Z | finalizeSprint:selfAuditGate | Status updated: RETROSPECTIVE → GO_WITH_GATE_FAILURE |
-| 2026-05-18T05:36:38.413Z | finalizeSprint:selfAuditGate | Gate result written to /home/alperen/deckent-dev/.deckent/sprint-172-gate.json overallGate=GATE_FAILURE |
-| 2026-05-18T05:36:38.413Z | finalizeSprint:breadcrumb | Step 10c (loadReport) — entering |
-| 2026-05-18T05:36:38.415Z | finalizeSprint:loadReport | Load test report written to /home/alperen/deckent-dev/docs/audits/sprint-172/load-test-report.md |
-| 2026-05-18T05:36:38.416Z | finalizeSprint:breadcrumb | Step 10c (loadReport) — done |
-| 2026-05-18T05:36:38.416Z | finalizeSprint:breadcrumb | Step 10c2 (metricsRotation) — entering |
-| 2026-05-18T05:36:38.417Z | observability-rotation | Rotated 11167 bytes → /home/alperen/deckent-dev/.deckent/archive/metrics/metrics-sprint-172.jsonl.gz (1012 bytes gzipped), pruned 1 old archives |
-| 2026-05-18T05:36:38.418Z | finalizeSprint:metricsRotation | Rotated 11167 bytes → /home/alperen/deckent-dev/.deckent/archive/metrics/metrics-sprint-172.jsonl.gz (1012 bytes gzipped), pruned 1 old archives |
-| 2026-05-18T05:36:38.419Z | finalizeSprint:breadcrumb | Step 10c2 (metricsRotation) — done |
-| 2026-05-18T05:36:38.419Z | finalizeSprint:breadcrumb | Step 10d (featuresManifest) — entering |
-| 2026-05-18T05:36:38.522Z | finalizeSprint:featuresManifest | Sync exit=0: ✓ Features manifest written: /home/alperen/deckent-dev/.deckent/features-manifest.json (31 features) |
-| 2026-05-18T05:36:38.523Z | finalizeSprint:breadcrumb | Step 12 (archiveDirectives) — entering |
-| 2026-05-18T05:36:38.524Z | archiveDirectives | Archived DIRECTIVES.md → /home/alperen/deckent-dev/.brain/archive/DIRECTIVES-sprint-172.md (preserved; autoArchive=false default per ADR-046 amendment Sprint 168 C0a-4) |
-| 2026-05-18T05:36:38.525Z | finalizeSprint:breadcrumb | Step 12b (archiveOrphanTasks) — entering |
-| 2026-05-18T05:36:38.534Z | createPreArchiveSnapshot | Snapshot created: /home/alperen/deckent-dev/.deckent/sprint-172-pre-archive.tar.gz (91 files, hash=335ec5a19c21...) |
-| 2026-05-18T05:36:38.534Z | finalizeSprint:preArchiveSnapshot | Snapshot created: 91 files, hash=335ec5a19c21... |
-| 2026-05-18T05:36:38.542Z | archiveOrphanTasks | Archived 91 task files to /home/alperen/deckent-dev/.brain/archive/sprint-172-tasks |
-| 2026-05-18T05:36:38.542Z | finalizeSprint:archiveOrphanTasks | Archived 91 orphan task files |
-| 2026-05-18T05:36:38.542Z | finalizeSprint:breadcrumb | Step 12c (cleanTasksArchive) — entering |
-| 2026-05-18T05:36:38.543Z | finalizeSprint:cleanTasksArchive | Removed 0 old .tasks/archive/ dirs |
-| 2026-05-18T05:36:38.543Z | finalizeSprint:breadcrumb | Step 12d (sprintFileRetention) — entering |
-| 2026-05-18T05:36:38.546Z | finalizeSprint:sprintFileRetention | Retention complete: archived=6, countersDeleted=2, forensicMoved=0, bytesFreed=17904 |
-| 2026-05-18T05:36:38.547Z | finalizeSprint:breadcrumb | Step 13 (jobSummary) — entering |
-| 2026-05-18T05:36:38.548Z | finalizeSprint:jobSummary | Job summary written to /home/alperen/deckent-dev/.deckent/jobs/sprint-172.json |
-| 2026-05-18T05:36:38.548Z | finalizeSprint:breadcrumb | Step 14 (postFinalizeHooks) — entering |
-| 2026-05-18T05:36:38.559Z | postFinalizeHooks:memoryExport | 4 files written, 0 errors |
-| 2026-05-18T05:36:38.583Z | postFinalizeHooks:adrInsert | inserted=0 updated=3 skipped=50 |
-| 2026-05-18T05:36:38.600Z | postFinalizeHooks:ruleRegen | Rule regeneration hook called |
-| 2026-05-18T05:36:38.600Z | finalizeSprint:postFinalizeHooks | memExport=4 identity=skipped adrInsert=inserted=0/updated=3/skipped=50 ruleRegen=true errors=0 |
-| 2026-05-18T05:36:38.601Z | [Brain] | Cleanup delayed 180000ms — .tasks/ files remain readable |
diff --git a/.brain/MEMORY.md b/.brain/MEMORY.md
deleted file mode 100644
index 61438ea19..000000000
--- a/.brain/MEMORY.md
+++ /dev/null
@@ -1,201 +0,0 @@
-## Sprint sprint-132 Learnings
-## Sprint sprint-133 Learnings
-- HTTP API Bearer Token Auth: GO_WITH_TECH_DEBT — HTTP API Bearer Token Authentication implemented. Changes:
-
-1. NEW FILE: src/api/auth.ts — bearerAuthMiddleware with res
-- loadConfig() Module-Level Cache: GO_WITH_TECH_DEBT — loadConfig() module-level cache implemented. Changes: (1) Added module-level cachedConfig/cacheStamp/cachedProjectRoot v
-- Sprint 131 ADR'leri Yazımı (ADR-029..032): GO_WITH_TECH_DEBT — 4 ADR yazıldı (ADR-029 through ADR-032), her biri ≥50 satır. ADR-029 (51 lines): Managed-Docs Universalization — kullanı
-- Competitive Analysis Güncelleme: GO_WITH_TECH_DEBT — Competitive analysis fully updated for April 2026. Changes: (1) competitive-analysis.md — title updated 'March 2026' → '
-## Sprint sprint-135 Learnings
-- Docker Backend Graceful Shutdown (Docker Bug Offensive Root Cause Fix): GO_WITH_TECH_DEBT — Docker graceful shutdown offensive root cause fix implemented. Changes: (1) spawn-backend-docker.ts kill() method: docke
-- askBrain() Extraction Finish — Conservative Move + Re-Export Shim: NO_GO — Docker worker exited without writing result file
-- Structured Planner Priority + Dependencies Parsing: GO_WITH_TECH_DEBT — parseStructuredDirectives() and parseBulletOrNumberedTasks() now parse '- Priority: CRITICAL|HIGH|NORMAL|LOW' lines. New
-- GO_WITH_GATE_FAILURE Status Propagation Wire: GO_WITH_TECH_DEBT — GO_WITH_GATE_FAILURE status propagation wire implemented:
-1. Added `import { getRecentSprintStats, GO_WITH_GATE_FAILURE 
-- Dashboard vs MCP State Divergence Fix: NO_GO — Created src/monitor/sprint-state.ts with getCurrentSprintId() that reads .deckent/sprint-state.json (source 1: sprint-ac
-- Brain Memory Budget Enforcement + Config Sync: GO_WITH_TECH_DEBT — Brain Memory Budget Enforcement + Config Sync tamamlandı. (1) DECAY_EXEMPT constant: DECISIONS.md ve PROJECT-IDENTITY.md
-## Sprint sprint-136 Learnings
-- 5 Test Regression Fix (Sprint 136 Opener): GO_WITH_TECH_DEBT — 5 target test files (start-sandbox, start, i18n-integration, docker-backend, error-handling-unification) all pass (262 t
-- Async I/O İlk Kademe (Hot Path fs.promises Migration): NO_GO — Docker worker exited without writing result file
-- Brain Spurious NO_GO Evaluation Reconciliation (Sprint 135 N9): GO_WITH_TECH_DEBT — Brain Spurious NO_GO Evaluation Reconciliation implemented. Added tryCodeVerifiedDone() helper to result-evaluator.ts wi
-- `.deckent/sprint-NNN-gate.json` Output Wiring (Sprint 135 N5): GO_WITH_TECH_DEBT — gate.json wiring implemented. Added `import { promises as fsPromises } from 'node:fs'` to sprint-finalizer.ts. Inside th
-- `load-test-report.md` Auto-Generation (Sprint 135 N6): GO_WITH_TECH_DEBT — Wired generateLoadReport() into finalizeSprint() in sprint-finalizer.ts. Added import of generateLoadReport from core/ob
-- T-005 Dep Pipeline Canlı Dogfood Rerun (Sprint 135 Chicken-Egg): NO_GO — Fix A (sprint-controller.ts): Added 'priority?' and 'dependencies?' fields to directiveSources type annotation (line 505
-- ErrorRegistry Lint Rule Enforcement: NO_GO — Docker worker exited without writing result file
-- sprint-controller.ts Full Slim (Sprint 134 T-010 Final): NO_GO — Docker worker exited without writing result file
-- Rubric Field Null Fix for Test-Writer Tasks (Sprint 135 N7): GO_WITH_TECH_DEBT — Added rubric requirement to test-writer agent systemPrompt and worker prompt building in task-builder.ts. Fixed test thr
-- sprint-docs-helpers.ts Test Coverage (Sprint 135 T-010 Debt): GO_WITH_TECH_DEBT — Wrote comprehensive unit tests for sprint-docs-helpers.ts module. 61 test cases covering all 8 exported functions: build
-## Sprint sprint-137 Learnings
-- Brain Budget Decay No-Op Bug Fix: GO_WITH_TECH_DEBT — Fixed brain budget decay no-op bug in runDecay() (debt-manager.ts). Root cause: shouldRun guard used total linesBefore (
-## Sprint sprint-138 Learnings
-- ADR-035 Verification Protocol Standard: GO_WITH_TECH_DEBT — ADR-035 Brain ↔ Worker ↔ Auditor Verification Protocol Standard başarıyla .brain/DECISIONS.md dosyasına eklendi. 15 kana
-- Worker Honest Assessment Calibration v2: GO_WITH_TECH_DEBT — Worker Honest Assessment Calibration v2 tamamlandı. 3 alt-iş uygulandı:
-
-1. Alt-iş A (task-builder.ts): buildWorkerPromp
-## Sprint sprint-139 Learnings
-## Sprint sprint-141 Learnings
-- src/orchestra/ Analysis (82 dosya): NO_GO — Docker worker exited without writing result file
-- src/cli/ Analysis (75 dosya): GO_WITH_TECH_DEBT — src/cli/ analizi tamamlandı. 75 rapor dosyası oluşturuldu (.deckent/sprint-140-analysis/src/cli/ altında). Tüm dosyalar 
-- src/agents/ + src/providers/ + src/monitor/ + src/api/ + src/extensions/ Analysis (30 dosya): NO_GO — Docker worker exited without writing result file
-- tests/ Category Analysis (28 kategori): GO_WITH_TECH_DEBT — 28 test kategorisi READ-ONLY analizi tamamlandı. Tüm raporlar .deckent/sprint-140-analysis/tests/ altında. Toplam 5133 s
-- docs/ Analysis (260 markdown): GO_WITH_TECH_DEBT — Batch analysis of 260 markdown docs across 8 categories. Read-only analysis completed successfully. Produced 7 detailed 
-- META — Architecture Graph + Circular Dependency: GO_WITH_TECH_DEBT — Comprehensive architecture graph and circular dependency analysis completed. 354 TypeScript files analyzed across 11 mod
-- META — Dead Code + Type Safety + Security: GO_WITH_TECH_DEBT — Read-only cross-cutting analysis completed: (1) Dead Code — 4 fully dead modules (~360 LoC), 14+ unused exports, ADR-038
-- META — ADR Compliance + CLI/MCP Parity + i18n: GO_WITH_TECH_DEBT — Comprehensive 3-section cross-cutting analysis completed: (1) ADR Compliance: 40/40 ADRs audited — 36 COMPLIANT, 2 PARTI
-- META — Test Coverage Map + Performance + Error Handling + TODO inventory: GO_WITH_TECH_DEBT — Completed all 4 cross-cutting analyses. Report at .deckent/sprint-140-analysis/meta/coverage-perf-errors-todo.md (563 li
-- META — Memory V2 Integrity Verification: GO_WITH_TECH_DEBT — Memory V2 Integrity Verification completed. 482-line report covering all 7 dimensions: (1) DB Schema: 5/5 tables + FTS5 
-## Sprint sprint-142 Learnings
-- src/core/ batch 1 — Memory V2 modulleri: GO_WITH_TECH_DEBT — Read-only deep analysis of 10 files completed. 10 per-file reports written to .deckent/sprint-god-analysis/src/core/. Al
-- src/core/ batch 2 — Types + Routing: GO_WITH_TECH_DEBT — Read-only deep analysis completed for 10 files in src/core/ batch 2 (Types + Routing). All 10 files analyzed with 16-sec
-- src/core/ batch 4 — Provider + Model + Notification: GO_WITH_TECH_DEBT — Read-only deep analysis of 10 assigned files + 1 bonus (webhook.ts) = 11 analysis reports. All reports follow the 16-sec
-- src/core/ batch 5 — Utils + Security + Remaining: GO_WITH_TECH_DEBT — Read-only deep analysis completed for all 10 assigned files. Key findings:
-
-**P0 Findings:**
-- deck-file.ts: createDeckT
-- src/core/ batch 6 — Remaining core files: GO_WITH_TECH_DEBT — Read-only deep analysis of 10 src/core/ files completed. All 10 reports written with 16-section template. Key findings: 
-- src/core/ batch 7 — Final core files: GO_WITH_TECH_DEBT — Read-only deep analysis of 13 source files completed. 13 per-file reports written, each ≥40 lines with full 16-section t
-- src/orchestra/ batch 1 — Brain + Sprint lifecycle: GO_WITH_TECH_DEBT — Read-only deep analysis of 6 sprint lifecycle core files completed. All 6 reports written with 16-section template, each
-- src/orchestra/ batch 2 — Debt + Result + Retro: GO_WITH_TECH_DEBT — Read-only deep analysis of 8 orchestra files (debt-manager, sprint-retro-writer, sprint-reporter, result-evaluator, resu
-- src/orchestra/ batch 3 — Task + Routing + Spawn: GO_WITH_TECH_DEBT — Read-only deep analysis of 10 src/orchestra/ files (task-builder, task-router, task-analyzer, task-retry, planner, spawn
-- src/orchestra/ batch 4 — Event stream + Pattern + Decision: GO_WITH_TECH_DEBT — Read-only deep analysis of 10 orchestra files completed. 10 per-file reports written using 16-section template. All repo
-## Sprint sprint-143 Learnings
-- Memory V2 Tam Migrasyon (ci-reporter + managed-docs): NO_GO — Docker worker exited without writing result file
-- MCP Disconnect Fix (Background Sprint Runner): GO_WITH_TECH_DEBT — MCP Disconnect Fix implemented. sprint-runner-entry.ts provides a detached child process entry point for running sprints
-## Sprint sprint-144 Learnings
-- worker.ts Split (1669 → 4 dosya): NO_GO — Worker timeout — process exceeded time limit and was killed
-- Ölü Kod Silme Wave A (Agent + V1 Routing, 17 dosya, 2780 LoC): NO_GO — Worker timeout — process exceeded time limit and was killed
-- Ölü Kod Silme Wave B (Orchestra Sahipsiz + Feature Flag, 12 dosya, 2139 LoC): NO_GO — Docker worker exited without writing result file
-- Event Stream Emit Wire: GO_WITH_TECH_DEBT — Sprint 138 event-stream.ts foundation wired into Brain, Worker, and Auditor. 7 new CHANNELS constants added: SPRINT_STAR
-- Retro sprint-id Normalize: GO_WITH_TECH_DEBT — Retro sprint-id normalize completed: (1) sprint-retro-writer.ts already used canonical `retro-${sprint.id}` format → no 
-## Sprint sprint-145 Learnings
-- Brain Heuristic Timeout Estimator: NO_GO — Brain Heuristic Timeout Estimator implemented as specified. New file timeout-estimator.ts (~170 LoC) with brainEstimateT
-- EventBus Abstraction + Subscribe API: GO_WITH_TECH_DEBT — EventBus Abstraction + Subscribe API implemented as specified.
-
-1. NEW: src/orchestra/event-bus.ts (~250 LoC) — EventBus
-- ADR-037 RBAC Runtime Wire — checkWorkerAuthority: GO_WITH_TECH_DEBT — ADR-037 RBAC Runtime Wire completed. Changes:
-
-1. Fixed checkWorkerAuthority() bug — was always returning true even on v
-- CHANNELS.NOTIFY writeEvent Emit Wire: GO_WITH_TECH_DEBT — Added emitNotify() helper to event-stream.ts (source='deckent', target='user', channel=CHANNELS.NOTIFY). Added 4 strateg
-- NotifyDispatcher Wire + 3 Adapter: GO_WITH_TECH_DEBT — NotifyDispatcher successfully wired in both MCP server and CLI entry points. 3 adapters (MCP, CLI, File) connected via e
-- ADR-038 Self-Modifying Detector Runtime Wire: GO_WITH_TECH_DEBT — ADR-038 Self-Modifying Detector Runtime Wire completed. Three changes: (1) Added alias exports to self-modifying-detecto
-- registerResume CLI Wire + CLI Registration Test Harness: GO_WITH_TECH_DEBT — Fixed registerResume (audit finding #5) + registerHelp (also unregistered, found during investigation). Added tests/cli/
-- T-144-002 Helper Migration — countDebtItems → store.getByType: GO_WITH_TECH_DEBT — DB-first debt counting migration complete. Created src/cli/helpers/debt-counter.ts with MemoryStore.getByType('debt') im
-- worker.sh Template Update — TASK_TIMEOUT Env Var: GO_WITH_TECH_DEBT — All 3 backends updated with adaptive timeout wiring:
-
-1. DockerSpawnBackend: worker.sh template now uses `TIMEOUT=${TASK
-- Result Atomicity Guarantee — TIMEOUT_WITH_WORK Partial Result: GO_WITH_TECH_DEBT — TIMEOUT_WITH_WORK partial result mechanism implemented across 4 source files + 1 test file (14 tests). Changes: (1) Dock
-## Sprint sprint-146 Learnings
-- Agent Truncation Bug Fix: GO_WITH_TECH_DEBT — Root cause: task-builder.ts:761 had `agentPrompt.slice(0, 2000)` which truncated agent prompts to 2000 chars. This cause
-- ADR Relevance Scoring Engine: GO_WITH_TECH_DEBT — ADR Relevance Scoring Engine implemented. Created src/orchestra/adr-selector.ts (~330 LoC) with: selectRelevantAdrs() sc
-- Scope Sanitizer: GO_WITH_TECH_DEBT — Created scope-sanitizer.ts with 8 filter rules (absolute path reject, path traversal reject, dist/ remove, extension-onl
-- Generative Useful God Template — buildTaskPrompt Single Entry: GO_WITH_TECH_DEBT — buildTaskPrompt() implemented as single entry point in prompt-god-template.ts (~270 LoC). Pipeline: agent block → skill 
-- DIRECTIVES.md Mid-Sprint Silme Bug Fix: GO_WITH_TECH_DEBT — Phase guard added to archiveDirectives() — rejects calls outside CLEANUP/COMPLETE phase. Emergency restore function adde
-- Rubric System Consolidation: GO_WITH_TECH_DEBT — Rubric system consolidated: (1) Removed rubricScores spec from worker prompt in prompt-god-template.ts — workers no long
-- Sprint 145 vitest Regression Fix: NO_GO — Docker worker exited without writing result file
-## Sprint sprint-147 Learnings
-## Sprint sprint-148 Learnings
-- Vitest Triage — 135 Fail → < 50 Fail: NO_GO — Docker worker exited without writing result file
-- Sprint 146 T-146-011 Docker Worker Exit Pattern Root Cause Fix: GO_WITH_TECH_DEBT — Docker Worker Exit Pattern root cause fixed. Problem: Container SIGKILL (exit 137, OOM kill) bypasses all shell traps — 
-## Sprint sprint-149 Learnings
-- `deckent mode` CLI Command: GO_WITH_TECH_DEBT — Created `deckent mode` CLI command with 5 subcommands: show, sprint, task, auto, global. Follows ADR-012 register<Name>(
-## Sprint sprint-150 Learnings
-- Docker Worker Exit Pattern Final Fix (Sprint 146+148 Debt): GO_WITH_TECH_DEBT — Docker Worker Exit Pattern Final Fix completed. 3 changes: (1) containers Map now stores {containerId, model} so host-si
-- Scope Sanitizer Code Snippet False Positive Fix (Sprint 148 Debt): NO_GO — All requirements from Sprint 148 debt already implemented in Sprint 149. Verified: (1) isPlaceholderPath() rejects foo/b
-- Auditor Stale Alert Race Condition Fix (Sprint 148 Debt): GO_WITH_TECH_DEBT — Auditor stale alert race condition fix was already implemented in Sprint 149 (auditor.ts lines 293-316 + heartbeat-types
-- VerhexIO/deckent-hub Repo Create + Templates: GO_WITH_TECH_DEBT — deckent-hub/ local dizin scaffold tamamlandı. Docker worker tarafından önceden yazılmış tüm dosyalar doğrulandı ve eksik
-- AGENTS.md Refresh (39 Sprint Behind): NO_GO — AGENTS.md dosyası incelendi. Sprint 149'da zaten güncel durumda: 15 built-in agent (ADR-041 reform sonrası), 'test-write
-- npm pack --dry-run + Version Bump 1.0.0-beta.1: GO_WITH_TECH_DEBT — npm pack --dry-run PASSES: tarball 1.08MB (<2MB limit), no secrets, no sensitive dirs, all 6 package.json metadata field
-- `cleanOrphanIpcDirs` Wire-Up with Live-PID Check: NO_GO — cleanOrphanIpcDirs function updated: new sync API with live-PID check support (opts: { checkLivePid, minAgeMs }). Old as
-- Feature Manifest Canlılaştırma (Tam Scope): GO_WITH_TECH_DEBT — Feature Manifest Canlılaştırma — 7 adımlı plan tamamlandı:
-
-1. scripts/sync-manifest.mjs (~230 LoC): 31 feature tanımlı,
-- `deckent audit` + `deckent recover` User-Facing CLI + MCP Yüzeyi: GO_WITH_TECH_DEBT — Implemented `deckent audit` + `deckent recover` CLI commands and `deckent_audit` + `deckent_recover` MCP tools. Full ADR
-## Sprint sprint-151 Learnings
-- Public Repo Flip — VerhexIO/deckent-dev → VerhexIO/deckent: GO_WITH_TECH_DEBT — DURUM: ../deckent-public dizini mevcut değil — Alperen'in önce git clone yapması gerekiyor. Handoff dökümanı bu senaryoy
-- Discord Bot Deploy + Smoke Test: GO_WITH_TECH_DEBT — ## Tamamlanan İşler
-
-**scripts/deploy-discord.sh** (yeni, ~185 satır):
-- Prereq kontrolü: Node >= 18, .deck dosyası, DIS
-- Nervous System 6-10 Detector Activation (Sprint 147 Plan): GO_WITH_TECH_DEBT — 5 yeni nervous system detector oluşturuldu (6→11 toplam): BuildFailureRecurrenceDetector, TokenSpikeDetector, AgentRouti
-## Sprint sprint-152 Learnings
-- `deckent doctor` Derin Audit: NO_GO — READ-ONLY audit task per Sprint 152 DIRECTIVES. Report written to docs/audits/sprint-152/T-152-002-doctor-deep-audit.md 
-- CLI Smoke Part 1 — Core Lifecycle (15 komut): NO_GO — READ-ONLY audit sprint. 15 CLI core lifecycle commands smoke-tested via `node dist/cli/entry.js <cmd>`. Result: 14/15 PA
-- CLI Smoke Part 2 — Memory + Checkpoint + Run (10 komut): NO_GO — CLI Smoke Part 2 audit complete. 12 commands exercised (recall family 5, memory subcommands 9, remember 1, memory-query 
-- CLI Smoke Part 3 — Agent + Skill + Plugin (12 komut): NO_GO — Read-only CLI smoke audit of agent + skill + plugin command families. 12 main commands + 6 bonus sub-help spot checks ra
-- CLI Smoke Part 4 — Nervous System + Audit + Feature + Mode (12+ komut): NO_GO — CLI Smoke Part 4 — Nervous/Audit/Features/Recover/Mode + 19 residual commands. 46/46 top-level command --help coverage (
-- MCP Smoke Part 1 — Lifecycle Tools (8 tool): NO_GO — READ-ONLY MCP smoke audit completed for 8 lifecycle tools (deckent_init, set_directives, plan, start, status, review, re
-- MCP Smoke Part 2 — Observational + Advanced (10 tool): NO_GO — MCP Smoke Part 2 — Observational + Advanced (10 tool) audit complete. CLI-MCP parity matrix delivered for doctor, analyz
-- MCP Smoke Part 3 — Docs + Agent/Skill + Nervous + Beta Trio (9 tool): NO_GO — READ-ONLY audit of 12 MCP tools (deckent_docs, deckent_agent_list, deckent_skill_list, deckent_kill, deckent_nervous_sub
-- MCP 8 Resource Fetch Test: NO_GO — READ-ONLY MCP 8 resource fetch audit. Live stdio JSON-RPC 2.0 invocation of dist/mcp/server.js inside docker worker cont
-- Memory V2 DB Integrity + FTS5 Recall Test: NO_GO — Memory V2 DB integrity audit completed. 464-line report written to docs/audits/sprint-152/T-152-011-memory-v2-integrity.
-## Sprint sprint-153 Learnings
-- Brain 8-Phase Sprint Lifecycle: NO_GO — Brain 8-Phase Sprint Lifecycle dokümantasyonu oluşturuldu. Her faz için Amaç, Kritik Karar ve Temel I/O bölümleri yazıld
-- Memory V2 SQLite Schema: NO_GO — Memory V2 SQLite schema documentation written. File docs/smoke-2026-05-12/T-SMOKE-03.md created with 1001 words (minimum
-- Multi-Provider Routing: NO_GO — docs/smoke-2026-05-12/T-SMOKE-04.md oluşturuldu. 587 kelime (gerekli ≥200). İçerik: multi-provider genel bakış tablosu, 
-- Nervous System Detector'ları: NO_GO — T-SMOKE-06.md oluşturuldu: 982 kelime (≥200 minimum karşılandı). 11 detector tam olarak belgelendi: stale-worker, scope-
-- Ed25519 Skill Signature: NO_GO — T-SMOKE-07.md yazıldı: 722 kelime (≥200 şart karşılandı). Kapsanan konular: OpenClaw %20 malicious skill problemi, Ed255
-- Sprint Kill ve Cleanup Disiplini: NO_GO — T-SMOKE-08.md oluşturuldu. 679 kelime (≥200 koşulu sağlandı). Sprint kill kullanıcı onayı zorunluluğu, Nervous System lo
-- ADR-008 Unidirectional Imports: NO_GO — ADR-008 Unidirectional Imports dokümantasyonu oluşturuldu. 773 kelime (≥200 eşiği aşıldı). Kapsam: Brain→orchestra→core 
-- Beta GA 20-Gate Listesi: NO_GO — Beta GA 20-Gate dökümanı oluşturuldu. Her kapı için açıklama, ölçüm kriteri ve Sprint 152 sonu durumu (PASS/IN_PROGRESS)
-## Sprint sprint-154 Learnings
-- RubricRegistry Core Foundation: NO_GO — RubricRegistry foundation created at src/orchestra/rubric-registry.ts (196 LoC). Spec compliance: (1) TaskType taxonomy 
-- RubricRegistry Test Suite: NO_GO — Created tests/orchestra/rubric-registry.test.ts with 26 test cases (exceeds 20+ requirement): isAuditTask (7), isDocumen
-## Sprint sprint-155 Learnings
-## Sprint sprint-156 Learnings
-- Workflow Rename VERIFY (read-only audit): NO_GO — Audit-only task completed. All 3 primary workflow files (ci.yml, docs.yml, cross-platform-e2e.yml) confirmed to use bran
-- dependency_pipeline_enabled Default Flip: NO_GO — Sprint 156 Task 2 — dependency_pipeline_enabled default flipped from undefined (falsy) → true. Three precise changes ins
-- Cascade/Unblock Runtime Wire: GO_WITH_TECH_DEBT — Sprint 156 Task 003 complete. Wired applyCascadeToSprint into runEvaluatePhase (after each NO_GO with a real result file
-- Task Tmpfile Cleanup Discipline: NO_GO — Sprint 156 Task 4 — Task Tmpfile Cleanup Discipline. Three changes:
-
-1) spawn-backend-docker.ts:567-581 — Removed the in
-- IDEMPOTENCY_KEY Worker Prompt Inject: NO_GO — IDEMPOTENCY_KEY worker prompt + container env injection wired end-to-end. (1) spawn-backend-docker.ts dockerArgs: append
-- Brain Self-Rebuild Gate (NO BUILD CALL): GO_WITH_TECH_DEBT — Sprint 156 Task 008 — Brain Self-Rebuild Gate (NO BUILD CALL) implemented.
-
-WHAT WAS DONE:
-1. src/orchestra/sprint-phase
-- assertSpawnSafe Whitelist Runtime: NO_GO — HONEST SELF-ASSESSMENT: Module + tests fully shipped (100% of in-scope work). spawn-backend-docker.ts wire-up explicitly
-- Runtime File Lock (flock spawn-time): NO_GO — Implemented spawn-time `.spawnlock` API in src/core/file-lock.ts (acquireSpawnLock, releaseSpawnLock, acquireSpawnLocks 
-- EffectClass Annotation rubric-registry: GO_WITH_TECH_DEBT — EffectClass annotation eklendi. src/orchestra/rubric-registry.ts'e: (1) EffectClass type union ('pure'|'reversible'|'ide
-## Sprint sprint-162 Learnings
-- Sprint Phase Observability + EvaluationAuditTrail Runtime Wire (T-003, composite): GO_WITH_TECH_DEBT — T-003 composite (phase observability + EvaluationAuditTrail runtime wire) complete. persistPhaseTransition helper export
-- Crash Injection Integration Test + E2E Smoke (T-007): NO_GO — T-007 — 9/9 tests PASS (6 crash injection + 3 e2e smoke). Crash file: 6 it() blocks S1-S6 (grep -nE 'S[1-6]:' → 18 match
-## Sprint sprint-163 Learnings
-## Sprint sprint-164 Learnings
-- Vitest Gate +1 Fail Closure — Chronic Regression Eradication: NO_GO — Vitest gate +1 fail chronic regression closure — TAMAMLANDI. Discovery: full vitest run 17 fail / 8 dosya tespit etti (n
-## Sprint sprint-165 Learnings
-## Sprint sprint-168 Learnings
-- T3 Kill Recovery Simulation (DEPENDS T1): NO_GO — Task blocked by unmet dependency. Task 168-003 (T3 Kill Recovery Simulation) depends on task sprint-168-smoke-T1 (T1 Sco
-## Sprint sprint-169 Learnings
-- W3.1 C0c Collision Detection Live Trigger Investigation + Fix: NO_GO — W3.1 RC identified as path-normalization gap (RC-C from plan §2.1). `detectScopeCollisions` (conflict-resolver.ts:173) c
-- W3.2 Smoke Directive Dependency Parser Fix: NO_GO — Sprint 169 W3.2 fix: parseDependencyField helper added (src/orchestra/task-builder.ts:186) accepting 3 formats — bare st
-- C1 Memory Relations Migration: NO_GO — Sprint 169 C1 — Memory Relations Migration complete.
-
-What changed:
-1. src/core/memory-types.ts — added MemoryRelation i
-- H2 Stub Memory Entries Backfill: NO_GO — Sprint 169 H2 — Stub Memory Entries Backfill implemented per plan Task 4 (Steps 4.1-4.5, 4.7). Added MemoryStore.update(
-- H3 OSS Pre-Flip Secret Scan Baseline: NO_GO — H3 OSS Pre-Flip Secret Scan Baseline — 3/3 deliverable şartı eksiksiz. (1) scripts/security/secret-baseline.mjs: 10 rege
-- H4 Dashboard Build CI Gate: NO_GO — H4 Dashboard Build CI Gate tamamlandı. Yeni .github/workflows/dashboard-build.yml workflow'u: Node 18.x/20.x/22.x matrix
-- H1 ADR DB→FS Export Pipeline + ADR-046 Reverse Hook: NO_GO — Sprint 169 H1 — ADR DB→FS Export Pipeline + ADR-046 Bi-Directional Hook amendment COMPLETE. (1) src/core/memory-export.t
-## Sprint sprint-170 Learnings
-- P0-3 Tmux Prompt Filename TaskId-Aware: GO_WITH_TECH_DEBT — Sprint 170 P0-3 (Bug 2B / ADR-048 §Negative closure) — fix architecturally complete; 3/3 mandated TDD tests GREEN; 5 pre
-- P0-5 Docker Spawn Race Window Closure: GO_WITH_TECH_DEBT — P0-5 Docker Spawn Race Window Closure — Sprint 169 Bug 2A eradication. TDD red-green disciplined: 6 tests written first 
-- Fix: P0-6 Event Stream Prompt Write/Delete Visibility: NO_GO — Worker exited without writing result (exitCode=0)
-- P0-6 Event Stream Prompt Write/Delete Visibility: GO_WITH_TECH_DEBT — P0-6 Event Stream Prompt Write/Delete Visibility tamamlandı.
-
-## Yapılanlar
-1. src/orchestra/event-stream.ts: CHANNELS.P
-## Sprint sprint-171 Learnings
-- Doc Audit Root: NO_GO — Sprint 171 Task 23 — Doc Audit Root tamamlandı. Repo kökündeki 19 markdown dosyası tek tek denetlendi (DIRECTIVES'in idd
-## Sprint sprint-172 Learnings
-- C1 — update-readme-stats.mjs auto-gen + CI gate: NO_GO — TDD discipline: önce tests/scripts/update-readme-stats.test.ts yazıldı (RED — script yok, import fail), sonra scripts/up
-- C2 — reference docs auto-gen (MCP/ADR/CLI/agents): NO_GO — Sprint 172 Task C2 — reference docs auto-gen (5 üretici TDD). RED: tests/scripts/gen-reference-docs.test.ts ilk çalıştır
-- C3 — lint:link dead-link gate: NO_GO — Sprint 172 C3 — lint:link dead-link gate. TDD RED→GREEN: 28/28 unit test pass. `node scripts/lint-links.mjs` exit 0 (156
-- B1 — archive DB-parity doğrulama (B2 ön-koşulu): NO_GO — B1 archive ↔ memory.db parity verifier tamamlandı (read-only). Çıktı: 23 parity-OK retro + 196 DB-eksik (121 sprint + 75
-- B2 — .gitignore/.npmignore + archive git rm --cached: NO_GO — B2 tamamlandı — kısmi (B1 parity eksikliği nedeniyle). 
-
-## DONE:
-1. .gitignore §4.3 bloğu eklendi: sprint-*-tasks/, spr
-- B5 — deckent-hub kararı + examples workspace fix: NO_GO — Step 1 TAMAMLANDI: examples/quickstart/package.json 'workspace:*' → '^1.0.0-beta.1'. OSS kullanıcıları artık 'npm instal
-## Sprint sprint-173 Learnings
-## Sprint sprint-174 Learnings
-- Fix debt: Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp: NO_GO — Worker exited without writing result (exitCode=0)
\ No newline at end of file
diff --git a/.brain/RETRO.md b/.brain/RETRO.md
deleted file mode 100644
index 57b7d3718..000000000
--- a/.brain/RETRO.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# Sprint sprint-174 Retrospective
-
-## Summary
-Completed 5/7 tasks in 14 minutes 51s.
-
-## Highlights
-- 5 tasks completed on first try
-- No boundary violations detected
-
-## Issues
-- Task 174-001 (Fix debt: Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp) failed — Worker exited without writing result (exitCode=0)
-
-## Metrics
-| What | Value |
-|------|-------|
-| Tasks completed | 5/7 |
-| Code changes | +858 / -0 |
-| Sprint time | 14 minutes 51s |
-| NO_GO rate | 29% (2/7) |
-
-
-## Agent Performance
-| Agent | Tasks | Done | Debt | NoGo | Avg Coverage |
-|-------|-------|------|------|------|-------------|
-| doc-writer | 5 | 5 | 0 | 0 | 0% |
-| bug-fixer | 1 | 0 | 0 | 1 | 0% |
-
-
-## Skill Performance
-| Skill | Tasks | Done | Debt | NoGo | Avg Coverage |
-|-------|-------|------|------|------|-------------|
-| documentation-writer | 5 | 5 | 0 | 0 | 0% |
-
-## Token Usage
-| Task | Model | Input | Output | Cache Read | Total |
-|------|-------|-------|--------|------------|-------|
-| 174-001 | opus | 0 | 0 | 0 | 0 |
-| 174-002 | sonnet | 8.5K | 2.8K | 4.2K | 15.5K |
-| 174-003 | sonnet | 8.5K | 1.8K | 0 | 10.3K |
-| 174-004 | sonnet | 3.2K | 620 | 0 | 3.8K |
-| 174-005 | sonnet | 8.5K | 1.8K | 0 | 10.3K |
-| 174-006 | sonnet | 12.0K | 2.2K | 0 | 14.2K |
-| **Total** | — | 40.7K | 9.2K | 4.2K | 54.1K |
-
-### Quality Dimensions (sprint-174)
-| Task | Correctness | Coverage | Scope Adherence | Completeness | Overall |
-|------|-------------|----------|-----------------|--------------|---------|
-| 174-001 — Fix debt: Tech debt from 170-0 | 0 | 0 | 100 | 0 | 20 |
-| 174-002 — Pitch deck — marketing-ai-pitc | 100 | 0 | 100 | 100 | 75 |
-| 174-003 — Canva template map — canva-kit | 100 | 0 | 100 | 100 | 75 |
-| 174-004 — Canva bulk CSV — canva-kit/can | 100 | 0 | 100 | 100 | 75 |
-| 174-005 — Aylık üretim rehberi — canva-k | 100 | 0 | 100 | 100 | 75 |
-| 174-006 — Kit index + tutarlılık — canva | 100 | 0 | 100 | 100 | 75 |
-| **Sprint Avg** | — | — | — | — | **66** |
-
-## Learnings
-- Fix debt: Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp: failed — Worker exited without writing result (exitCode=0)
-- Open HIGH debt: ADR-019 reconciliation: language-agnostic verify not implemented
-- Open CRITICAL debt: Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp
-
-### Gate Failure
-Self-audit gate failed for sprint sprint-174. Status: GO_WITH_GATE_FAILURE.
-
-- vitest: 2 failing tests
diff --git a/.brain/archive/DIRECTIVES-sprint-173.md b/.brain/archive/DIRECTIVES-sprint-173.md
new file mode 100644
index 000000000..fabf314c2
--- /dev/null
+++ b/.brain/archive/DIRECTIVES-sprint-173.md
@@ -0,0 +1,274 @@
+# DIRECTIVES — Sprint 172: Doc-Reorg + OSS GA
+
+## Spec + Plan Referansları
+
+- **Plan (bağlayıcı kontrat):** `docs/superpowers/plans/2026-05-16-sprint-172-doc-reorg-plan.md` (commit `c0678c0`) — her worker kendi Task bölümünü + aşağıdaki **Worker Contract**'ı mutlaka okur. Per-task adım/dosya/kanıt orada.
+- **Girdi:** `docs/audits/sprint-171/00-SYNTHESIS.md` §4 (ideal ağaç/dosya→hedef/ignore) + `docs/audits/sprint-171/00-VERIFICATION-LOG.md` (C-05/07, C-13, C-14, BA-03, BA-05 doğrulanmış verdict'ler).
+- **Predecessor:** Sprint 171 self-audit + manuel fix-phase (Bug A/B + C-03/C-04 + TMUX-SF FIX, BA-05 backfill `0771f6d`). Bootstrap runtime aktif.
+- **Kararlar (Alperen 2026-05-16):** 3 faz tek sprint sıralı A→C→B; EN kanonik + TR tam paralel korunur (hiçbir TR dosya silinmez/birleştirilmez); archive `git rm --cached` (disk'te kalır, geri-dönülebilir, DB-parity önce). memory.db'ye ASLA dokunulmaz.
+
+## Goal
+
+OSS GA öncesi dokümantasyonu (A) kullanıcı-yanıltan drift'lerden arındır, (C) drift'i kalıcı önleyen auto-gen pipeline kur, (B) ideal ağaca yeniden yapılandır. **GA flip kapısı = Faz A+C tam**; Faz B GA'yı bloklamaz, paralel/sonra. Sprint 171 fix-phase bootstrap'ı onardı; bu sprint dokümantasyonu public-ready yapar.
+
+## Brain Planning Instructions
+
+Mode: structured. Wave: 3 (Wave 1 = Faz A 4 paralel, Wave 2 = Faz C 3, Wave 3 = Faz B 5). Max workers: 4. `dependency_pipeline_enabled: false` → Wave geçişleri + GATE doğrulamaları Brain manuel (ADR-047, Sprint 164-171 kanıtlı). **GA-GATE-C sonrası Alperen checkpoint: public flip + beta.2 onayı** (deckent otomatik flip ETMEZ). Wave 2, GATE-A tüm DONE doğrulanmadan başlamaz; Wave 3, GATE-C doğrulanmadan başlamaz. B2 blockedBy B1 (DB-parity şart). Alperen review: sprint başlangıç (plan tablosu) + GA-GATE-C (flip) + finalize. Provider: claude.
+
+## Worker Contract
+
+Tüm worker'lar plan dosyasındaki kendi Task bölümünü + bu Worker Contract'ı mutlaka okur. Özet invariant:
+
+- **Bu sprint dosya YAZAR** (Sprint 171 audit-only değildi — bu farklı): atanan task scope'undaki .md/script/config dosyaları modify edilir. Scope DIŞINA yazma YASAK (ADR-037, auditor `git diff --stat` izler).
+- **TDD ZORUNLU (Faz C kod task'ları C1/C2/C3 + B1):** script = production kod → RED-GREEN-REFACTOR, test önce yazılır fail görülür. Faz A/B doc task'ları: kod yok, kanıt = `grep` + `npm run lint:link`/`docs:*:check` gate exit 0.
+- **Çıktı dili:** doküman içeriği OSS public için **README.md/VISION.md/CONTRIBUTING vb. = İngilizce (kanonik)**; README-TR.md/VISION-TR.md = Türkçe tam paralel. Worker raporu/notları Türkçe. Hiçbir TR dosya silinmez/birleştirilmez (Alperen kararı).
+- **memory.db kuralı:** SADECE read-only SELECT (B1 parity doğrulama). Yazma/DROP/rebuild KESİN YASAK. Archive temizliği `git rm --cached` (disk'te kalır).
+- **Kod gerçeği = tek-hakikat:** Faz A'da doc koda hizalanır (kod doğru olan yerde doc düzeltilir, davranış DEĞİŞMEZ). Yeni ADR uydurulmaz; ADR-010 amendment (supersede değil).
+- `.tasks/task-<id>.result`: `selfAssessment`, `filesChanged`, Faz C için `coverage` (test var); Faz A/B `coverage: null`.
+
+## GO/NO_GO Criteria
+
+**Faz-gate (plan ⛔ GATE'leri):**
+
+- **GA-GATE-A:** A1-A4 commit'li; `grep` kanıtları geçer; hiçbir kod/test değişmedi (sadece .md+ADR); `npm run lint:adr` + `tsc --noEmit` temiz.
+- **GA-GATE-C / OSS FLIP:** C1-C3 commit'li; `npm run docs:stats:check && docs:ref:check && lint:link` hepsi exit 0; `prepublishOnly` gate'leri içerir. **Bu kapı geçilince public flip + beta.2 Alperen onayıyla AÇIK.**
+- **GATE-B:** B1-B5 commit'li; `lint:link`+`docs:stats:check`+`docs:ref:check`+`tsc --noEmit`+`npx vitest run` temiz; `npm pack --dry-run` temiz paket; CLAUDE.md/DECKENT.md tüm @ref geçerli.
+
+**Sprint verdict:** **GO** = 3 gate tam. **GO_WITH_TECH_DEBT** = GA-GATE-A+C tam (GA açılabilir) + GATE-B kısmi (≤2 B-task re-iterate backlog). **NO_GO** = GA-GATE-A veya C ihlali (doc-honesty/auto-gen eksik → public flip YASAK).
+
+**Kritik:** Faz B eksikliği GA'yı bloklamaz (kararla post-GA paralel). GA-blocking SADECE Faz A (honesty) + Faz C (drift-proof).
+
+## Sprint 173+ Handoff
+
+Post-GA: integrity-hardening V2 (C-13 RBAC hard-flip + C-14 verify-gate wire + BA-05 ADR-046 hook crash-safe — davranış-değiştiren, ayrı sprint), coverage re-audit (SYNTHESIS §5.3 ~92 potansiyel gap), AEGIS manifesto içeriği (ADR-061).
+
+---
+
+## Task 1: A1 — dependency_pipeline_enabled provenance drift
+
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: DECKENT.md, .contracts/api-surface.md
+- Scope: ./
+
+### Description
+
+C-05/07 doğrulanmış doc-drift. Kod gerçeği: `config.ts:600` default `true`, `:883 ?? true`; `.deckent/config.json:198 false` (bu proje bilinçli override). `DECKENT.md:51` "Sprint 167 flip: true — Wave goes live" bu projede YANLIŞ + `api-surface.md:83` "default since Sprint 156" ile çelişen provenance. Plan Task A1 adımlarını izle: DECKENT.md:51 → kod default true + bu proje false (Brain manuel wave) açıklaması; api-surface:83 → tek doğru köken. Kod/config DEĞİŞMEZ, sadece iki doküman.
+
+**Kanıt:** `grep -n "deckent-dev bu projede bilinçli false" DECKENT.md` → eklendi; iki dosyada çelişki yok.
+
+**Test:** Doc-only — `grep` kanıtı + `tsc --noEmit` temiz (kod değişmedi teyidi).
+
+---
+
+## Task 2: A2 — RBAC + verify-gate enforcement honesty
+
+- Model: sonnet
+- Effort: normal
+- Skills: system-architect, documentation-writer
+- Agent: architect
+- Files: CLAUDE.md, .deckent/workspace/IDENTITY.md, .claude/rules/worker-default.md
+- Scope: ./
+
+### Description
+
+C-13 + C-14 doğrulanmış. `authority-enforcer.ts:29` "always soft", `worker.ts:480 return true`, ADR-037 `decisions.md:1825` runtime eksik kabul; `enforceVerifyLoop`/`runTestVerifyLoop` 0-caller. Doküman bunu "runtime enforcement" diye abartıyor. Plan Task A2: CLAUDE.md gotcha + IDENTITY → "RBAC compile-time lint + audit-trail; runtime advisory/soft (ADR-037 V1.0 Layer-2 kasıtlı eksik, hard-flip V2)"; worker-default verify → "prompt talimatı, kod-enforce değil". Kod/test DEĞİŞMEZ (hard-flip post-GA V2).
+
+**Kanıt:** `grep -ni "runtime enforcement" CLAUDE.md .deckent/workspace/IDENTITY.md` → her geçiş "soft/advisory" niteleyicili.
+
+**Test:** Doc-only — grep kanıtı; kod/test değişmedi (`git diff --stat src/ tests/` boş).
+
+---
+
+## Task 3: A3 — ADR-010 amendment (7 runtime dep)
+
+- Model: sonnet
+- Effort: normal
+- Skills: system-architect
+- Agent: architect
+- Files: docs/adr/010-tek-runtime-dependency.md
+- Scope: docs/adr/
+
+### Description
+
+BA-03 doğrulanmış: package.json 7 runtime dep, ADR-010 metni "yalnızca commander" (Sprint 044 CLI-only kalıntısı). Plan Task A3: ADR-010'a **Amendment** bölümü ekle (supersede DEĞİL — accepted kalır) — 7 dep'in her biri sonraki accepted ADR'ye map'li (@modelcontextprotocol/sdk←ADR-017, better-sqlite3←Memory V2, telegraf/discord←ADR-016, zod←plan validation, @noble←ADR-014). Güncel ilke: minimal + ADR-gerekçeli; keyfi ekleme hâlâ yasak. DB adr-010 entry ile tutarlı (kanonik DB ise MemoryStore upsert).
+
+**Kanıt:** ADR-010 Amendment'ta 7 dep ADR-map'li; `npm run lint:adr` geçer.
+
+**Test:** Doc-only — `npm run lint:adr` exit 0.
+
+---
+
+## Task 4: A4 — README 5-drift badge gerçek değer
+
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: README.md, README-TR.md
+- Scope: ./
+
+### Description
+
+C-41/BD-01 doğrulanmış: README "16434+ tests / dashboard pages / 27 MCP tools / 60+ ADR / custom+2 agent" 5 drift bir arada (OSS ilk-vitrin yanılgı). Plan Task A4: gerçek değerleri komutla topla (vitest gerçek pass, `ls src/dashboard/pages`, `grep -c registerTool src/mcp/server.ts`, `getByType('adr').length`, `ls .deckent/agents`), README.md + README-TR.md senkron düzelt (EN kanonik, TR paralel — karar). Manuel düzeltme = Faz C auto-gen'e köprü.
+
+**Kanıt:** README.md her sayı Step 1 komut çıktısıyla eşleşir; README-TR.md senkron.
+
+**Test:** Doc-only — sayı↔komut eşleşme kanıtı.
+
+---
+
+## Task 5: C1 — update-readme-stats.mjs auto-gen + CI gate
+
+- Model: opus
+- Effort: high
+- Skills: typescript-expert, ci-testing
+- Agent: devops-engineer
+- Files: scripts/update-readme-stats.mjs, README.md, README-TR.md, .deckent/workspace/IDENTITY.md, package.json, tests/scripts/update-readme-stats.test.ts
+- Scope: scripts/, tests/scripts/, ./
+
+### Description
+
+Plan Task C1 (TDD ZORUNLU). RED: `--check` stale badge'de exit≠0 testi (script yok → fail). GREEN: script gerçek kaynaklardan okur (vitest count, dashboard pages, registerTool, ADR DB, agents), README/README-TR/IDENTITY'deki `<!-- AUTOGEN:stat -->` bloklarını değiştirir; `--check`/`--write` modları. A4 manuel değerleri marker içine alınır. package.json `docs:stats`/`docs:stats:check` + `prepublishOnly --check`.
+
+**Kanıt:** `npm run docs:stats:check` exit 0; `tests/scripts/update-readme-stats.test.ts` PASS (RED→GREEN izlendi).
+
+**Test:** TDD — stale-fail + güncel-pass + marker-replace 3+ test.
+
+---
+
+## Task 6: C2 — reference docs auto-gen (MCP/ADR/CLI/agents)
+
+- Model: opus
+- Effort: high
+- Skills: typescript-expert, api-builder
+- Agent: api-builder
+- Files: scripts/gen-reference-docs.mjs, docs/reference/mcp-tools.md, docs/reference/mcp-resources.md, docs/adr/README.md, docs/reference/cli.md, docs/reference/agents.md, package.json, tests/scripts/gen-reference-docs.test.ts
+- Scope: scripts/, tests/scripts/, docs/reference/, docs/adr/, ./
+
+### Description
+
+Plan Task C2 (TDD). RED: `--check` stale fail testi. GREEN: 5 üretici — MCP tools (`server.ts` registerTool parse), MCP resources, ADR index (`store.getByType('adr')` tablo), CLI (`commander` introspect), agents (DB/.deckent/agents). `--check` CI gate + `--write`. package.json `docs:ref`/`docs:ref:check` + prepublishOnly. Üretilen sayılar Faz A değerleriyle tutarlı.
+
+**Kanıt:** `npm run docs:ref:check` exit 0; test PASS; mcp-tools.md sayısı `grep -c registerTool` ile eşleşir.
+
+**Test:** TDD — 5 üretici × stale-fail/güncel-pass; 5+ test.
+
+---
+
+## Task 7: C3 — lint:link dead-link gate
+
+- Model: opus
+- Effort: high
+- Skills: typescript-expert, devops-engineer
+- Agent: devops-engineer
+- Files: scripts/lint-links.mjs, docs/.vitepress/config.ts, package.json, tests/scripts/lint-links.test.ts
+- Scope: scripts/, tests/scripts/, docs/.vitepress/, ./
+
+### Description
+
+Plan Task C3 (TDD). RED: script kırık relatif .md link'te exit≠0 (mevcut kırık link'ler — SYNTHESIS Wave 4). GREEN: `lint-links.mjs` (relatif link + anchor doğrula), `config.ts` `ignoreDeadLinks:false`, package.json `lint:link`. Mevcut kırık link'ler düzeltilir (bu gate Faz B taşımalarını korur — B3/B4 ön-koşulu).
+
+**Kanıt:** `npm run lint:link` exit 0 (mevcut kırıklar düzeltildi); test PASS.
+
+**Test:** TDD — kırık-link-fail + temiz-pass + anchor 3+ test.
+
+---
+
+## Task 8: B1 — archive DB-parity doğrulama (B2 ön-koşulu)
+
+- Model: opus
+- Effort: normal
+- Skills: database-migration
+- Agent: data-engineer
+- Files: scripts/verify-archive-db-parity.mjs, docs/audits/sprint-171/archive-parity-report.md
+- Scope: scripts/, docs/audits/sprint-171/
+
+### Description
+
+Plan Task B1. Read-only script: her `.brain/archive/sprint-*.md` + `retro-sprint-*.md` için DB'de karşılık (store sprint/retro entry) var mı (read-only SELECT, BA-05 backfill sonrası 167 dahil). Rapor: parity-OK vs DB-eksik liste. **DB-eksik HİÇBİR dosya git rm edilmez** (önce backfill — BA-05 deseni). memory.db SADECE read-only.
+
+**Kanıt:** `node scripts/verify-archive-db-parity.mjs` → "N parity-OK, M eksik" raporu; M dosyaları B2 kapsamı dışı.
+
+**Test:** Read-only script — parity raporu doğruluğu (örnek dosya DB-lookup spot-check).
+
+---
+
+## Task 9: B2 — .gitignore/.npmignore + archive git rm --cached
+
+- Model: sonnet
+- Effort: normal
+- Skills: git-expert, devops-engineer
+- Agent: devops-engineer
+- Files: .gitignore, .npmignore
+- Scope: ./
+- Dependencies: ["172-008"]
+
+### Description
+
+Plan Task B2 (B1 parity ŞART). `.gitignore`'a SYNTHESIS §4.3 blok; `.npmignore` oluştur (§4.3 npmignore). `git rm --cached -r` SADECE B1 parity-OK + ignore kapsamı (dosyalar DİSKTE KALIR). memory.db ASLA. `npm pack --dry-run` temiz paket doğrula.
+
+**Kanıt:** `npm pack --dry-run` internal state yok + boyut düştü; `ls .brain/archive | head` dosyalar diskte; `git status` temiz.
+
+**Test:** Doc/git-only — `npm pack --dry-run` çıktı + disk-mevcudiyet kanıtı.
+
+---
+
+## Task 10: B3 — kök → docs/ taşıma + redirect
+
+- Model: sonnet
+- Effort: high
+- Skills: documentation-writer, git-expert
+- Agent: doc-writer
+- Files: docs/vision/, docs/release/, docs/reference/, CLAUDE.md, DECKENT.md
+- Scope: docs/, ./
+- Dependencies: ["172-007"]
+
+### Description
+
+Plan Task B3 (C3 lint:link gate aktif olmalı). git mv per SYNTHESIS §4.2: BETA-TRACKER→docs/release/, COMPETITIVE-ANALYSIS→docs/vision/, ROADMAP-GOD-LEVEL(root+docs)→docs/vision/roadmap.md (birleştir), BLUEPRINT/MASTER-BLUEPRINT→docs/vision/blueprint.md, VISION.md+VISION-TR.md→docs/vision/ (**TR korunur**), .contracts/api-surface.md→docs/reference/ (CLAUDE.md @ref güncelle). Sil: NEXT-SESSION.md, next-session-prompt.md, docs/analysis/full-audit.md. Redirect: docs/CHANGELOG.md→root, docs/launch/CONDUCT.md→root. Her taşımada `npm run lint:link`.
+
+**Kanıt:** `npm run lint:link` exit 0 (0 kırık); CLAUDE.md/DECKENT.md @ref'leri geçerli (`grep @.contracts` güncellenmiş).
+
+**Test:** Doc-only — lint:link gate + @ref geçerlilik.
+
+---
+
+## Task 11: B4 — worker-guide 3→1 + ADR-046 dup merge + reference rename
+
+- Model: sonnet
+- Effort: high
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: docs/guide/workers.md, docs/adr/, docs/reference/
+- Scope: docs/, .deckent/workspace/
+- Dependencies: ["172-007"]
+
+### Description
+
+Plan Task B4. 3 worker-guide (docs/development/, docs/, .deckent/workspace/WORKER-GUIDE.md) → docs/guide/workers.md canonical; workspace 1-satır refer (runtime @ref kırılmaz — doğrula). ADR-046 iki dosya → tek + Amendment section, DB adr-046 tutarlı. 3 reference çifti lowercase rename + link fix. Her adımda `npm run lint:link`.
+
+**Kanıt:** `lint:link` exit 0; ADR-046 tek dosya; DB↔FS ADR parity; workspace @ref runtime kırılmadı.
+
+**Test:** Doc-only — lint:link + ADR-046 tekillik + @ref runtime smoke.
+
+---
+
+## Task 12: B5 — deckent-hub kararı + examples workspace fix
+
+- Model: sonnet
+- Effort: normal
+- Skills: monorepo-expert
+- Agent: refactorer
+- Files: examples/quickstart/package.json
+- Scope: examples/, ./
+
+### Description
+
+Plan Task B5. `examples/quickstart/package.json` `workspace:*` → `^1.0.0-beta.1` (OSS'te workspace protokolü çözülmez). deckent-hub disposition (SYNTHESIS "karar" flag): git submodule mi inline+pubkey mi — **Alperen mini-onay gerekli** (worker bu kararı VERMEZ, checkpoint question yazar, otonom ilerlemez).
+
+**Kanıt:** examples/quickstart/package.json `^1.0.0-beta.1`; deckent-hub kararı Alperen checkpoint'e bağlı (worker önermez, sorar).
+
+**Test:** Doc/config-only — package.json geçerli JSON + version resolve smoke.
diff --git a/.brain/archive/DIRECTIVES-sprint-174.md b/.brain/archive/DIRECTIVES-sprint-174.md
new file mode 100644
index 000000000..256fb0129
--- /dev/null
+++ b/.brain/archive/DIRECTIVES-sprint-174.md
@@ -0,0 +1,127 @@
+# DIRECTIVES — Sprint 174: Pazarlama AI Karar Motoru — Patron Pitch'i + Canva Kiti
+
+## Spec Referansı (bağlayıcı kontrat)
+
+`docs/superpowers/specs/2026-05-18-marketing-ai-pitch-design.md` — her worker kendi task bölümünü + bu spec'in §1 Dürüstlük Çerçevesi, §2 Kararlar, §3 Teslimatlar, §5 GO kriterlerini MUTLAKA okur.
+
+## Goal
+
+Proje köküne firma patronuna sunulacak tek `marketing-ai-pitch.md` (15 slide, Türkçe, satış/vizyon pitch'i) + `canva-kit/` (markalara aylık rapor için Canva Bulk-Create kiti) üret. Tek deckent sprint'i, DAG bağımlı (pitch → canva-kit). **Bu sprint kod YAZMAZ** — sadece yeni `.md`/`.csv` doküman dosyaları. Throwaway demo: sunum sonrası dosyalar silinecek, commit yok.
+
+## Brain Planning Instructions
+
+Mode: structured. `dependency_pipeline_enabled: true` (bu sprint geçici) → Kahn topolojik wave OTOMATİK. Max workers: 6. Provider: claude. Model: sonnet (dokümantasyon — memory kuralı). Agent: doc-writer. Skill: documentation-writer. Beklenen wave: W0={pitch} → W1={template-map} → W2={csv, howto} → W3={kit-README}. (174-001 = otomatik enjekte debt task, boş scope, sunumla alakasız — beklenen NO_GO/no-op, zararsız.)
+
+## Worker Contract — DÜRÜSTLÜK BAĞLAYICI
+
+- Her worker SADECE kendi `Files` dosyalarını yazar. Scope dışına yazma YASAK (ADR-037, auditor `git diff --stat` izler). **Kaynak kod/test DEĞİŞMEZ** (`git diff --stat src/ tests/` boş olmalı).
+- **Dürüstlük kuralı (spec §1):** deckent bugün marketing yapmıyor; bu sistem deckent'in *inşa edip işletebileceği* yeni üründür. Her slide'da "Bugün gerçek olan" vs "İnşa edilecek (faz)" ayrımı net. Abartı / yanlış vaat / "deckent zaten yapıyor" ifadesi = NO_GO.
+- **Otonomi tutarlılığı:** Sistem reklam hesabında SADECE "öner + tek-tık insan onayı" yapar. Hiçbir slide "tam otonom kampanya yönetimi" vaat etmez. Onay her zaman insanda.
+- **Canva gerçeği:** Native `.canva` üretilemez. Çözüm = Canva Bulk Create (placeholder şablon + CSV + manuel tetik). Bu sınır dürüstçe yazılır, otomasyon "gelecek faz" olarak.
+- Slide formatı: tek `# ` H1 + 6-14 satır presenter-ready içerik (dolu, placeholder DEĞİL), gerekirse tablo/diagram (ASCII/markdown). Türkçe. Fiyat/SLA rakamı UYDURULMAZ (slide 15 pilot çerçeve; net rakamı Alperen sonra girer → `{{...}}` placeholder bırak).
+- Kod/test yok → `.result`: `coverage: null`, `selfAssessment`, `filesChanged`.
+
+## GO/NO_GO Criteria
+
+- **GO:** `marketing-ai-pitch.md` (15 slide, her biri tek H1, B-kapalı-döngü akışı) + `canva-kit/` 3 dosya mevcut; CSV başlıkları template-map ile birebir; otonomi her slide "öner+onay" tutarlı; "bugün vs inşa" ayrımı slide 5/8/9/11/14'te açık; `git diff --stat src/ tests/` boş.
+- **GO_WITH_TECH_DEBT:** ≤2 slide dürüstlük-etiketi zayıf ama dosyalar tam + içerik dolu + abartı yok.
+- **NO_GO:** Eksik dosya, placeholder içerik, abartı/yanlış vaat, tam-otonom vaadi, CSV↔map uyumsuz, veya kod/test değişti.
+
+---
+
+## Task 1: Pitch deck — marketing-ai-pitch.md (15 slide)
+
+- Model: sonnet
+- Effort: high
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: marketing-ai-pitch.md
+- Scope: ./
+
+### Description
+
+Spec §3.1'deki 15 slide outline'ını birebir üret (Kapak → Problem → Çözüm → Kapalı-döngü diagram → Veri kaynakları → 22 metrik tablo → Desen tespiti → Önerilen aksiyon → Tek-tık onay → WhatsApp trigger → Aylık Canva rapor → Ajans kaldıraç → Güven/guardrail → Yol haritası → Kapanış/CTA). B-omurga (Veri→İçgörü→Öneri→**Onay**→Uygula→Ölç). Slide 6: spec §3.2'deki 22 metrik tablo halinde. Dürüstlük kuralı bağlayıcı: slide 5/8/9/11/14'te "Bugün gerçek" vs "İnşa edilecek" etiketi; otonomi her yerde "öner+onay"; Canva sınırı slide 11'de dürüst. Fiyat/SLA = `{{pilot_fiyat}}` placeholder.
+
+**Kanıt:** `grep -c '^# ' marketing-ai-pitch.md` → 15; `grep -ci "tam otonom\|fully autonomous" marketing-ai-pitch.md` → 0 (yasaklı vaat yok); slide 11'de "Bulk Create" + sınır ifadesi.
+
+**Test:** Doc-only — slide sayısı + yasaklı-vaat-yok + dürüstlük-etiket grep kanıtı.
+
+---
+
+## Task 2: Canva template map — canva-kit/canva-bulk-template-map.md
+
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: canva-kit/canva-bulk-template-map.md
+- Scope: canva-kit/
+- Dependencies: ["174-002"]
+
+### Description
+
+Spec §3.3. `marketing-ai-pitch.md`'yi OKU (slide 6 metrik listesi + slide 11 aylık rapor formatı). Canva şablonu placeholder'larını metrik alanlarına eşle: `{{marka}}`, `{{donem}}`, `{{roas}}`, `{{cpc}}`, `{{cac}}`, `{{trafik_trend}}`, `{{aksiyon_onerileri}}` vb. — her placeholder ↔ hangi metrik/kaynak. Tablo formatı. CSV (Task 3) bu map'in başlık satırını birebir izleyecek, o yüzden placeholder isimleri kesin/tutarlı.
+
+**Kanıt:** `test -f canva-kit/canva-bulk-template-map.md`; pitch slide 6 metrikleriyle placeholder seti tutarlı (atıf var).
+
+**Test:** Doc-only — dosya mevcut + pitch metrik atfı.
+
+---
+
+## Task 3: Canva bulk CSV — canva-kit/canva-bulk-sample.csv
+
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: canva-kit/canva-bulk-sample.csv
+- Scope: canva-kit/
+- Dependencies: ["174-003"]
+
+### Description
+
+Spec §3.3. `canva-bulk-template-map.md`'yi OKU. Canva Bulk Create'in beklediği CSV: başlık satırı = template-map'teki placeholder isimleri **birebir** (örn. `marka,donem,roas,cpc,cac,trafik_trend,aksiyon_onerileri,...`). 2 örnek marka satırı (gerçekçi ama kurgu veri). Marka başı 1 satır → Canva 1 deck basar.
+
+**Kanıt:** `head -1 canva-kit/canva-bulk-sample.csv` başlıkları template-map placeholder'larıyla eşleşir; ≥3 satır (başlık + 2 örnek).
+
+**Test:** Doc-only — başlık↔map eşleşme + satır sayısı.
+
+---
+
+## Task 4: Aylık üretim rehberi — canva-kit/monthly-brand-report-howto.md
+
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: canva-kit/monthly-brand-report-howto.md
+- Scope: canva-kit/
+- Dependencies: ["174-002", "174-003"]
+
+### Description
+
+Spec §3.3. `marketing-ai-pitch.md` + `canva-bulk-template-map.md`'yi OKU. Aylık üretim akışı adım adım: (1) deckent çalıştır → marka verisi topla, (2) CSV üret (map şemasına göre), (3) Canva'da şablona Bulk Create ile CSV yükle, (4) marka-renkli deck → markaya teslim. Manuel adımları + sınırları (Canva API otomasyonu gelecek faz; bugün manuel tetik) DÜRÜSTÇE yaz. Abartı yok.
+
+**Kanıt:** `test -f canva-kit/monthly-brand-report-howto.md`; 4 adım + "manuel/gelecek faz" dürüstlük ifadesi mevcut.
+
+**Test:** Doc-only — dosya + adım + dürüstlük-sınır grep.
+
+---
+
+## Task 5: Kit index + tutarlılık — canva-kit/README.md
+
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: canva-kit/README.md
+- Scope: canva-kit/
+- Dependencies: ["174-002", "174-003", "174-004", "174-005"]
+
+### Description
+
+Spec §4 W3. `marketing-ai-pitch.md` + canva-kit/ 3 dosyayı OKU. Kit index'i yaz: 3 dosya ne işe yarar, kullanım sırası, pitch ile ilişki. **Tutarlılık denetimi (yaz):** CSV başlıkları ↔ template-map placeholder'ları birebir mi, pitch slide 6 metrikleri ↔ map alanları örtüşüyor mu, otonomi tutarlı mı — uyumsuzluk varsa README "Bilinen sapma" bölümünde dürüstçe listele (kod düzeltme YOK, sadece rapor).
+
+**Kanıt:** `test -f canva-kit/README.md`; CSV↔map tutarlılık ifadesi + 4 dosyaya atıf.
+
+**Test:** Doc-only — README mevcut + tutarlılık-denetim bölümü.
diff --git a/.brain/archive/DIRECTIVES-sprint-175.md b/.brain/archive/DIRECTIVES-sprint-175.md
new file mode 100644
index 000000000..7a4315add
--- /dev/null
+++ b/.brain/archive/DIRECTIVES-sprint-175.md
@@ -0,0 +1,378 @@
+# DIRECTIVES — Sprint 175: Embedded Web Terminal (Sub-project #1/4)
+
+## Spec + Plan Referansları
+
+- **Plan (bağlayıcı kontrat):** `docs/superpowers/plans/2026-05-19-embedded-web-terminal.md` (commit `905087d`) — her worker kendi Task bölümündeki **adım/kod/kanıt/test'i** + aşağıdaki Worker Contract'ı **mutlaka** okur. Per-task tam kod orada (DIRECTIVES tekrarlamaz).
+- **Spec (doğrulanmış gerçek):** `docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md` — §1c (Step A verified), §1c.2 (auth kök-neden), §1d (VSCode dock + enterprise dikişler). Worker spec'i değiştiremez; davranış spec'e uyar.
+- **Predecessor:** Sprint 172-174 (doc-reorg + OSS GA prep + dashboard repair). Brainstorm→spec→Step A→writing-plans→systematic-debugging gate tamamlandı (Alperen onaylı).
+
+## Goal
+
+deckent dashboard'una VSCode-benzeri **gömülü, dock-edilebilir terminal** ekle: interaktif `claude`/`gemini`/`codex`/`deckent`/`shell` PTY oturumları, `ws` transport, tmux-benzeri reattach, **global API bypass'tan bağımsız + daha katı** localhost-default token auth (token localhost-only sayfa-enjekte → WS subprotocol), şeffaf tenant-scoped `memory.db` audit (ham PTY çıktısı ASLA persist edilmez). Enterprise/k8s **dikişleri** (`AuthProvider`/`SessionBackend`/`tenantId`) baştan konur ama implement edilmez (#3). Bu sub-project #1/4; #2-4 ayrı sprint.
+
+## Brain Planning Instructions
+
+Mode: structured. **Self-modifying / dogfood: ZORUNLU sequential** (`src/api/` + `src/dashboard/` → `self-modifying-detector.ts` tetikler). Wave: 5 (Wave 0→4, plandaki sıra; **wave'ler ÇAKIŞMAZ, sıralı**). Max workers: 2 (sequential — paralel değil; aynı wave içinde bağımsız task'lar en fazla 2). `dependency_pipeline_enabled: false` → Wave geçişleri + GATE doğrulamaları **Brain manuel** (ADR-047, Sprint 164-174 kanıtlı). Provider: claude. Bir wave, önceki wave'in tüm task'ları DONE + GATE doğrulanmadan başlamaz. Alperen review: sprint başlangıç (bu tablo) + her wave GATE + finalize. **Build/run (npm run build:all, deckent serve, npm publish) son doğrulama Alperen'in kararı — worker çalıştırmaz** (memory: build approval).
+
+## Worker Contract
+
+Tüm worker'lar plan dosyasındaki kendi Task bölümünü + bu Contract'ı okur. Invariant:
+
+- **Bu sprint kod + test YAZAR** (doc değil): atanan task scope'undaki dosyalar modify/create edilir. Scope DIŞINA yazma YASAK (ADR-037, auditor `git diff --stat` izler — advisory).
+- **TDD ZORUNLU (tüm kod task'ları):** plandaki RED→GREEN→REFACTOR adımları aynen; test önce yazılır, fail görülür, sonra minimal implementasyon. Plan adımlarını atlama.
+- **ESM:** import'larda `.js` uzantısı zorunlu (Node16). Yeni runtime dep yalnız Task 0.1'de (`node-pty`, `ws`) — başka dep ekleme YASAK; ADR-010 amendment Task 0.2'de.
+- **memory.db:** SADECE additive migration (Task 1.3 `tenant_id` kolon + `audit` tip). DROP/rebuild/sil KESİN YASAK (memory: db_silmek_yasak). Schema-version + non-destructive ALTER.
+- **Güvenlik invariant'ı (spec §1c.2):** terminal WS auth `DECKENT_API_AUTH_DISABLED`'dan BAĞIMSIZ ve daha katı — bypass shell'i AÇMAZ. Token header'da değil WS subprotocol'de. Ham PTY çıktısı audit'e/diske ASLA yazılmaz.
+- **Enterprise dikişleri (spec §1d):** `AuthProvider`/`SessionBackend` interface + `tenantId` baştan; ama multi-tenant/SSO/k8s **implement EDİLMEZ** (#3). YAGNI — interface var, tek `"local"` impl.
+- `.tasks/task-<id>.result`: `selfAssessment`, `filesChanged`, `coverage` (test var — kod task'ları), `notes`.
+
+## GO/NO_GO Criteria
+
+**Wave-gate (Brain manuel, ADR-047):**
+
+- **GATE-0** (Wave 0): Task 0.1-0.4 commit'li; `npm install` + `npm run lint` (tsc --noEmit) exit 0; `npm run lint:adr` exit 0; `tests/core/config-terminal.test.ts` PASS; ADR-010 amendment 2 satır + ADR-062 mevcut.
+- **GATE-1** (Wave 1): 1.1-1.4 commit'li; `npx vitest run tests/api/terminal/{auth-provider,session-backend,audit,session-manager}.test.ts` PASS; bypass-independence testi PASS; ring-buffer bound + detach≠kill + idle-reaper(deckent muaf) testleri PASS.
+- **GATE-2** (Wave 2): 2.1-2.3 commit'li; ws-gateway auth-before-bridge + reattach replay PASS; HTTP control routes PASS; serve `--host`/`--no-terminal` PASS; `npm run lint` exit 0.
+- **GATE-3** (Wave 3): 3.1-3.6 commit'li; `npm run test:dashboard` tüm yeşil; dock panel toggle/resize + multi-tab + subprotocol-token testleri PASS.
+- **GATE-4** (Wave 4): e2e reattach (disconnect→replay MARKER_ONE+TWO) PASS; `npm run lint:link`+`docs:ref`+`docs:stats` exit 0; full `npx vitest run` PASS; `npm pack --dry-run` temiz (node-pty/ws var, internal state yok).
+
+**Sprint verdict:** **GO** = 5 gate tam. **GO_WITH_TECH_DEBT** = GATE-0..2 tam (backend sağlam) + GATE-3/4 kısmi (≤2 frontend/doc task re-iterate backlog). **NO_GO** = GATE-0 veya 1 ihlali (deps/ADR/config/auth çekirdeği eksik → frontend anlamsız) veya güvenlik invariant'ı ihlali (bypass shell açıyor / ham çıktı persist ediliyor → kesin NO_GO).
+
+**Kritik:** Güvenlik invariant ihlali (auth bypass-bağımlılığı veya ham-çıktı-persist) = otomatik NO_GO, tech debt KABUL EDİLMEZ (RCE yüzeyi).
+
+## Sprint 176+ Handoff
+
+Post-#1: sub-project #2 (self-security prosedürü — prompt/komut guard), #3 (milyon-ölçek multi-tenant izolasyon + k8s — `AuthProvider`/`SessionBackend` impl'leri buraya), #4 (enterprise dış-dünya entegrasyon). Server-restart session persistence (disk) post-#1 backlog. Her biri ayrı spec→plan→sprint.
+
+---
+
+## Task 1: W0.1 — Runtime deps (node-pty + ws)
+- Model: sonnet
+- Effort: low
+- Skills: typescript-expert
+- Agent: devops-engineer
+- Files: package.json
+- Scope: ./
+
+### Description
+Plan Task 0.1 adımları. `node-pty@^1.0.0` + `ws@^8.18.0` → dependencies; `@types/ws` → devDependencies (alfabetik). `npm install` + `npm run lint` exit 0 (kullanım yok).
+
+**Kanıt:** `node -e "const p=require('./package.json');console.log(!!p.dependencies['node-pty'],!!p.dependencies['ws'])"` → `true true`; `npm run lint` exit 0.
+**Test:** Build-only — lint exit 0 (TDD yok, sadece dep ekleme).
+
+---
+
+## Task 2: W0.2 — ADR-010 amendment ext + ADR-062
+- Model: sonnet
+- Effort: normal
+- Skills: system-architect, documentation-writer
+- Agent: architect
+- Files: docs/adr/010-tek-runtime-dependency-commander-js.md, docs/adr/062-embedded-web-terminal.md
+- Scope: docs/adr/
+
+### Description
+Plan Task 0.2. Mevcut Sprint-172 Amendment tablosuna 2 satır ekle (ws, node-pty → ADR-062 map, mevcut desen). ADR-062 oluştur (ADR-061 yapısı, MADR hibrit, status accepted): PtySessionManager+ws gateway+AuthProvider/SessionBackend interface; güvenlik = localhost-default, token bypass-bağımsız+daha katı (B-022 hizalı), localhost sayfa-enjekte→WS subprotocol; tenant-scoped audit, ham çıktı persist edilmez; reattack server-restart sınırı; multi-tenant/k8s #3'e ertelenir. `npm run lint:adr` exit 0, non-destructive DB sync.
+
+**Kanıt:** ADR-010'da ws+node-pty satırları; `docs/adr/062-embedded-web-terminal.md` mevcut; `npm run lint:adr` exit 0.
+**Test:** Doc — `npm run lint:adr` exit 0.
+
+---
+
+## Task 3: W0.3 — TerminalConfig → DeckentConfig
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert
+- Agent: refactorer
+- Files: src/core/config.ts, src/core (DeckentConfig tip dosyası), tests/core/config-terminal.test.ts
+- Scope: src/core/, tests/core/, ./
+
+### Description
+Plan Task 0.3 (TDD). RED: `tests/core/config-terminal.test.ts` (terminal defaults) fail. GREEN: gerçek `TerminalConfig` interface + `DeckentConfig.terminal` (intersection bolt-on DEĞİL — mevcut `dependency_pipeline_enabled` tip-borcunu tekrarlama); `DEFAULT_CONFIG` + nested merge (`model_strategy` deseni). Defaults: enabled true, bind 127.0.0.1, maxSessions 10, idleTimeoutMs 1_800_000, scrollbackBytes 262_144, allowShellKind true.
+
+**Kanıt:** `npx vitest run tests/core/config-terminal.test.ts` PASS (RED→GREEN izlendi); `npm run lint` exit 0.
+**Test:** TDD — defaults + override-merge 2+ test.
+
+---
+
+## Task 4: W0.4 — Shared terminal types
+- Model: sonnet
+- Effort: low
+- Skills: typescript-expert
+- Agent: refactorer
+- Files: src/api/terminal/types.ts
+- Scope: src/api/terminal/, ./
+
+### Description
+Plan Task 0.4. `TenantId`/`SessionKind`/`AiTool`/`CreateSessionInput`/`SessionMeta`/`AuditAction`/`AuditEvent` (plandaki tam tanımlar). `tenantId` tüm yapılarda baştan (enterprise dikişi). `npm run lint` exit 0.
+
+**Kanıt:** `src/api/terminal/types.ts` mevcut, plandaki tüm tipler export; `npm run lint` exit 0.
+**Test:** Type-only — tsc --noEmit exit 0 (TDD yok, saf tip modülü).
+
+---
+
+## Task 5: W1.1 — AuthProvider (bypass-independent)
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert, security-specialist
+- Agent: security-auditor
+- Files: src/api/terminal/auth-provider.ts, tests/api/terminal/auth-provider.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-004"]
+
+### Description
+Plan Task 1.1 (TDD). RED: 4 test (doğru/yanlış/boş token + **DECKENT_API_AUTH_DISABLED=1 iken yanlış token RED**). GREEN: `AuthProvider` interface + `LocalTokenAuthProvider` (SHA-256 + `timingSafeEqual`, env bypass'ı KASITLI yok-sayar — spec §1c.2). Güvenlik invariant.
+
+**Kanıt:** `npx vitest run tests/api/terminal/auth-provider.test.ts` PASS (4); bypass-independence testi yeşil.
+**Test:** TDD — 4 test (RED→GREEN).
+
+---
+
+## Task 6: W1.2 — SessionBackend + LocalPtyBackend
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert
+- Agent: api-builder
+- Files: src/api/terminal/session-backend.ts, tests/api/terminal/session-backend.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-001","175-004"]
+
+### Description
+Plan Task 1.2 (TDD). RED: gerçek `bash -c echo` spawn → output + exit test fail. GREEN: `SessionBackend` interface + `LocalPtyBackend` (node-pty spawn/write/resize/kill, plandaki tam kod). Enterprise dikişi: interface (remote/k8s #3).
+
+**Kanıt:** `npx vitest run tests/api/terminal/session-backend.test.ts` PASS (hello-pty + exitCode 0).
+**Test:** TDD — spawn/stream/exit 1+ test.
+
+---
+
+## Task 7: W1.3 — TerminalAudit (tenant-scoped DB)
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert, database-migration
+- Agent: data-engineer
+- Files: src/api/terminal/audit.ts, src/core/memory-store.ts, src/core/memory-types.ts, tests/api/terminal/audit.test.ts
+- Scope: src/api/terminal/, src/core/, tests/api/terminal/
+- Dependencies: ["175-004"]
+
+### Description
+Plan Task 1.3 (TDD). RED: structured event + ham-çıktı-yok testi fail. GREEN: MemoryStore additive `tenant_id TEXT` kolon (schema-version migration, NON-destructive ALTER — DROP/rebuild YASAK) + `audit` tip; `TerminalAudit.record()` (plandaki kod). Ham PTY çıktısı ASLA geçirilmez (güvenlik invariant).
+
+**Kanıt:** `npx vitest run tests/api/terminal/audit.test.ts` PASS; content ANSI/raw içermez; `npm run lint` exit 0; migration additive.
+**Test:** TDD — structured-write + no-raw 2+ test.
+
+---
+
+## Task 8: W1.4 — PtySessionManager
+- Model: opus
+- Effort: high
+- Skills: typescript-expert
+- Agent: api-builder
+- Files: src/api/terminal/session-manager.ts, tests/api/terminal/session-manager.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-006","175-004"]
+
+### Description
+Plan Task 1.4 (TDD). RED: 4 test (ring-buffer bound, detach≠kill, maxSessions, idle-reaper deckent-muaf). GREEN: `PtySessionManager` (plandaki tam kod — Map, bounded ring, attach/detach, kill, reapIdle deckent exempt).
+
+**Kanıt:** `npx vitest run tests/api/terminal/session-manager.test.ts` PASS (4); detach kill çağırmıyor, deckent reaper'dan muaf.
+**Test:** TDD — 4 test (RED→GREEN).
+
+---
+
+## Task 9: W2.1 — WS gateway (auth-before-bridge + reattach)
+- Model: opus
+- Effort: high
+- Skills: typescript-expert, security-specialist
+- Agent: api-builder
+- Files: src/api/terminal/ws-gateway.ts, tests/api/terminal/ws-gateway.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-005","175-008","175-007"]
+
+### Description
+Plan Task 2.1 (TDD). RED: (a) geçersiz subprotocol token → upgrade RED, **session spawn YOK**; (b) geçerli token → attach + buffer replay. GREEN: `attachTerminalGateway` (plandaki kod — `server.on('upgrade')`, token `Sec-WebSocket-Protocol`'den, auth BRIDGE'DEN ÖNCE, backpressure, detach≠kill, `handleProtocols` ayarı). Güvenlik invariant: auth fail → spawn yok.
+
+**Kanıt:** `npx vitest run tests/api/terminal/ws-gateway.test.ts` PASS (2); kötü token close 4401/spawn yok.
+**Test:** TDD — reject-before-spawn + accept+replay 2+ test.
+
+---
+
+## Task 10: W2.2 — HTTP control + localhost bootstrap inject
+- Model: opus
+- Effort: high
+- Skills: typescript-expert
+- Agent: api-builder
+- Files: src/api/server.ts, tests/api/terminal/server-routes.test.ts
+- Scope: src/api/, tests/api/terminal/
+- Dependencies: ["175-009","175-003"]
+
+### Description
+Plan Task 2.2. `createHttpServer`'a: cfg.terminal.enabled ise manager+audit+auth kur (`auth = LocalTokenAuthProvider(finalToken ?? randomUUID())` — terminal HER ZAMAN token, API auth kapalı olsa bile), `attachTerminalGateway`, idle reaper interval (close'da temizle); `GET/POST /api/terminal/sessions` + `DELETE /:id` (mevcut Bearer middleware AFTER); **localhost-only** (`req.socket.remoteAddress` 127.0.0.1/::1) index.html'e `window.__DECKENT_TERMINAL_TOKEN__` enjekte; `api.terminalToken` test-expose.
+
+**Kanıt:** `npx vitest run tests/api/terminal/server-routes.test.ts` PASS (create 201/list/delete); `npm run lint` exit 0.
+**Test:** TDD — CRUD + localhost-inject 2+ test.
+
+---
+
+## Task 11: W2.3 — serve CLI surface
+- Model: sonnet
+- Effort: normal
+- Skills: typescript-expert
+- Agent: devops-engineer
+- Files: src/cli/commands/serve.ts, tests/cli/serve-terminal.test.ts
+- Scope: src/cli/, tests/cli/
+- Dependencies: ["175-010"]
+
+### Description
+Plan Task 2.3 (TDD). RED: `--host`/`--no-terminal` opsiyon yok testi fail. GREEN: `.option('--host <addr>','Bind address','127.0.0.1')` + `.option('--no-terminal',...)`; createHttpServer'a geçir; `--host` non-localhost + token yok → stderr warning + terminal'i ETKİNLEŞTİRME (spec §5).
+
+**Kanıt:** `npx vitest run tests/cli/serve-terminal.test.ts` PASS; opsiyonlar mevcut.
+**Test:** TDD — opsiyon-varlık + remote-refuse 2+ test.
+
+---
+
+## Task 12: W3.1 — xterm deps + terminal-api
+- Model: sonnet
+- Effort: normal
+- Skills: react-specialist, typescript-expert
+- Agent: frontend-designer
+- Files: src/dashboard/package.json, src/dashboard/src/lib/terminal-api.ts, tests/dashboard/terminal/terminal-api.test.ts
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-010"]
+
+### Description
+Plan Task 3.1 (TDD). `@xterm/xterm@^5.5.0`+`@xterm/addon-fit@^0.10.0` devDeps (ADR-010 etkilenmez — frontend devDep). RED: terminal-api modül-yok fail. GREEN: `getBootstrapToken`/`createSession`/`listSessions`/`killSession` (plandaki kod).
+
+**Kanıt:** `npm run test:dashboard -- terminal-api` PASS; bootstrap-token + create POST.
+**Test:** TDD — token-read + create 2+ test.
+
+---
+
+## Task 13: W3.2 — useTerminalSocket
+- Model: opus
+- Effort: high
+- Skills: react-specialist, typescript-expert
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/terminal/useTerminalSocket.ts, tests/dashboard/terminal/useTerminalSocket.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-012"]
+
+### Description
+Plan Task 3.2 (TDD). RED: WS `deckent.<token>` subprotocol + attach gönderimi fail. GREEN: `useTerminalSocket` (plandaki kod — subprotocol token, onopen→attach, reconnect backoff→reattach, input/resize send).
+
+**Kanıt:** `npm run test:dashboard -- useTerminalSocket` PASS; protocols `['deckent.tk']`, attach gönderiliyor.
+**Test:** TDD — subprotocol+attach 1+ test.
+
+---
+
+## Task 14: W3.3 — TerminalView (xterm)
+- Model: opus
+- Effort: normal
+- Skills: react-specialist
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/terminal/TerminalView.tsx, tests/dashboard/terminal/TerminalView.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-013"]
+
+### Description
+Plan Task 3.3 (TDD). RED: container render fail (xterm/fit mock'lu). GREEN: `TerminalView` (plandaki kod — Terminal+FitAddon, onData→socket, ResizeObserver→fit+resize, dispose cleanup).
+
+**Kanıt:** `npm run test:dashboard -- TerminalView` PASS; `[data-terminal="s1"]` render.
+**Test:** TDD — render 1+ test.
+
+---
+
+## Task 15: W3.4 — TerminalTabs + TerminalPanel
+- Model: opus
+- Effort: high
+- Skills: react-specialist
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/terminal/TerminalTabs.tsx, src/dashboard/src/components/terminal/TerminalPanel.tsx, tests/dashboard/terminal/TerminalPanel.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-014"]
+
+### Description
+Plan Task 3.4 (TDD). RED: shell quick-launch yeni sekme fail. GREEN: `TerminalTabs` (5 kind quick-launch claude/gemini/codex/deckent/shell + close) + `TerminalPanel` (multi-tab state, create/kill, active view) — plandaki tam kod.
+
+**Kanıt:** `npm run test:dashboard -- TerminalPanel` PASS; shell launch → view:s-new.
+**Test:** TDD — quick-launch 1+ test.
+
+---
+
+## Task 16: W3.5 — DockPanel + Layout
+- Model: opus
+- Effort: high
+- Skills: react-specialist, frontend-design
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/DockPanel.tsx, src/dashboard/src/components/Layout.tsx, tests/dashboard/terminal/DockPanel.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-015"]
+
+### Description
+Plan Task 3.5 (TDD). RED: toggle aç/kapa görünürlük fail. GREEN: `DockPanel` (VSCode-benzeri sabit-alt, toggle, ns-resize, plandaki kod) + `Layout.tsx`'e `<DockPanel><TerminalPanel/></DockPanel>` (Outlet DIŞINDA — route'lar arası kalıcı) + main scroll `pb-8`. Runtime @ref/route kırılmaz (doğrula).
+
+**Kanıt:** `npm run test:dashboard -- DockPanel` PASS; `npm run test:dashboard` tümü yeşil; toggle çalışıyor.
+**Test:** TDD — toggle 1+ test + tüm dashboard suite yeşil.
+
+---
+
+## Task 17: W3.6 — ConfigPage Terminal kategori + i18n
+- Model: sonnet
+- Effort: normal
+- Skills: react-specialist, documentation-writer
+- Agent: frontend-designer
+- Files: src/dashboard/src/pages/ConfigPage.tsx, src/dashboard/src/i18n/en.ts, src/dashboard/src/i18n/tr.ts
+- Scope: src/dashboard/
+
+### Description
+Plan Task 3.6 (data-only). `CONFIG_FIELDS`'a 5 terminal alanı (enabled/allowShellKind/maxSessions/idleTimeoutMs/scrollbackBytes, category "Terminal"), `CATEGORIES`+`CATEGORY_KEY_MAP`, en/tr i18n key. Drift yok (mevcut dinamik kategori sistemi).
+
+**Kanıt:** `npm run test:dashboard` yeşil; `npm run lint` exit 0; ConfigPage'de Terminal kategorisi.
+**Test:** Data-only — dashboard suite yeşil (mevcut ConfigPage testleri kırılmaz).
+
+---
+
+## Task 18: W4.1 — E2E reattach integration
+- Model: opus
+- Effort: high
+- Skills: typescript-expert, testing-expert
+- Agent: api-builder
+- Files: tests/api/terminal/e2e-reattach.test.ts
+- Scope: tests/api/terminal/
+- Dependencies: ["175-009","175-008"]
+
+### Description
+Plan Task 4.1. Gerçek pty + gerçek ws: attach→input→disconnect→(disconnected iken mgr.write)→reconnect→attach→replay MARKER_ONE+MARKER_TWO. Reattach client-disconnect'e dayanır (server-restart DEĞİL — spec sınırı).
+
+**Kanıt:** `npx vitest run tests/api/terminal/e2e-reattach.test.ts` PASS; replay her iki MARKER'ı içerir.
+**Test:** Integration — 1 e2e test (full pipeline).
+
+---
+
+## Task 19: W4.2 — Docs (guide EN+TR + reference)
+- Model: sonnet
+- Effort: normal
+- Skills: documentation-writer
+- Agent: doc-writer
+- Files: docs/guide/terminal.md, docs/guide/terminal-tr.md, docs/reference/ (regen)
+- Scope: docs/
+
+### Description
+Plan Task 4.2. `docs/guide/terminal.md` (EN kanonik): ne olduğu, güvenlik modeli (localhost-default, token auto-inject, bypass-bağımsız, remote=explicit --host+token+kullanıcı-TLS), audit timeline, reattach + server-restart sınırı, config key'leri. `docs/guide/terminal-tr.md` TR paralel (TR dosya silinmez — proje kuralı). `npm run docs:ref && docs:stats && lint:link` exit 0.
+
+**Kanıt:** iki guide mevcut; `npm run lint:link` exit 0; reference regen temiz.
+**Test:** Doc — lint:link + docs:*:check exit 0.
+
+---
+
+## Task 20: W4.3 — Final verification
+- Model: sonnet
+- Effort: normal
+- Skills: ci-testing
+- Agent: ci-guardian
+- Files: (verification-only — fix gerekirse ilgili dosya)
+- Scope: ./
+
+### Description
+Plan Task 4.3 Step 1+3. Tüm gate: `npm run lint` · `npx vitest run` · `npm run test:dashboard` · `npm run lint:adr` · `npm run lint:link` · `npm pack --dry-run` — hepsi exit 0/PASS, node-pty/ws pakette, internal state yok. **Step 2 manuel smoke (build:all/serve) Alperen'in — worker ÇALIŞTIRMAZ** (memory: build approval); worker yalnız non-build gate'leri koşar, fix'leri commit'ler.
+
+**Kanıt:** 5 otomatik gate exit 0/PASS; `npm pack --dry-run` çıktısı temiz.
+**Test:** Verification — tüm otomatik gate yeşil (build/serve hariç — Alperen).
diff --git a/.brain/exports/debt.md b/.brain/exports/debt.md
index 5a1e158e6..ebf03e114 100644
--- a/.brain/exports/debt.md
+++ b/.brain/exports/debt.md
@@ -4,8 +4,10 @@
 
 | ID | Title | Priority | Sprint | Status |
 |----|-------|----------|--------|--------|
-| debt-adr-019-reconciliation | ADR-019 reconciliation: language-agnostic verify not implemented | high | sprint-172 | active |
-| debt-170-001-fix | Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp | critical | sprint-170 | active |
+| debt-175-020-fix | Tech debt from 175-020-fix: All 5 automatic verification gates executed:
+
+1. npm | normal | sprint-175 | active |
+| debt-adr-019-reconciliation | ADR-019 reconciliation: language-agnostic verify not implemented | critical | sprint-172 | active |
 
 ## Resolved Technical Debt
 
@@ -121,3 +123,4 @@ M | normal | - | resolved |
 | debt-156-008 | Tech debt from 156-008: Sprint 156 Task 008 — Brain Self-Rebuild Gate (NO BUILD  | normal | - | resolved |
 | debt-156-011-fix | Tech debt from 156-011-fix: Code physically verified despite missing .result (Sp | normal | - | resolved |
 | debt-162-001 | Tech debt from 162-001: T-003 composite (phase observability + EvaluationAuditTr | normal | - | resolved |
+| debt-170-001-fix | Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp | normal | - | resolved |
diff --git a/.brain/exports/memory.md b/.brain/exports/memory.md
index d18009634..469619454 100644
--- a/.brain/exports/memory.md
+++ b/.brain/exports/memory.md
@@ -1,5 +1,23 @@
 # Sprint Learnings (auto-generated)
 
+## Sprint sprint-175 Learnings
+- Sprint sprint-175 Learnings: ## Sprint sprint-175 Learnings
+- W1.2 — SessionBackend + LocalPtyBackend: NO_GO — W1.2 — SessionBackend interface + LocalPtyBackend implementation, plan §Task 1.2 ile birebir aynı. RED→GREEN TDD akışı:
+
+- W1.4 — PtySessionManager: NO_GO — W1.4 PtySessionManager — implemented per plan §1.4. TDD: wrote 4 tests first (bounded ring, detach≠kill, maxSessions, id
+- W2.2 — HTTP control + localhost bootstrap inject: NO_GO — Worker exited without writing result (exitCode=0)
+- W3.3 — TerminalView (xterm): NO_GO — W3.3 TerminalView (xterm) — TDD complete. RED phase confirmed: 'Failed to resolve import TerminalView' before implementa
+- W3.4 — TerminalTabs + TerminalPanel: NO_GO — W3.4 multi-tab TerminalPanel + quick-launch (claude/gemini/codex/deckent/shell) implemented per plan §3.4 verbatim. TDD 
+- W3.5 — DockPanel + Layout: NO_GO — W3.5 DockPanel + Layout integration complete (TDD).
+
+## Deliverables
+1. src/dashboard/src/components/DockPanel.tsx (NEW,
+- W3.6 — ConfigPage Terminal kategori + i18n: NO_GO — Added 5 Terminal config fields (terminal.enabled, terminal.allowShellKind, terminal.maxSessions, terminal.idleTimeoutMs,
+- W4.1 — E2E reattach integration: NO_GO — W4.1 — E2E reattach integration test implemented per Plan §Task 4.1 and DIRECTIVES Task 18.
+
+Flow (1 it(), real `node-pt
+- W4.3 — Final verification: GO_WITH_TECH_DEBT — Worker had heartbeat but failed to write result within grace period — kill blocked by panic guard (user approval require
+
 ## Sprint sprint-174 Learnings
 - Sprint sprint-174 Learnings: ## Sprint sprint-174 Learnings
 - Fix debt: Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp: NO_GO — Worker exited without writing result (exitCode=0)
diff --git a/.brain/exports/summary.md b/.brain/exports/summary.md
index fe37afd5a..b458e46b7 100644
--- a/.brain/exports/summary.md
+++ b/.brain/exports/summary.md
@@ -58,6 +58,8 @@
 | adr-061 | AEGIS — Agentic Effect-Governed Iterative Stewardship Methodology | proposed |
 
 ## Recent Learnings
+- **Sprint sprint-175 Learnings** (sprint-175): ## Sprint sprint-175 Learnings
+- W1.2 — SessionBackend + LocalPtyBackend: NO_GO — W1.2 — SessionBackend interface + L...
 - **Sprint sprint-174 Learnings** (sprint-174): ## Sprint sprint-174 Learnings
 - Fix debt: Tech debt from 170-001-fix: Code physically verified despite missing .resu...
 - **Sprint sprint-173 Learnings** (sprint-173): ## Sprint sprint-173 Learnings
@@ -78,11 +80,12 @@ Sprint 167 Read-Only Self-Audit deliverable'ları (kaynak: .audit/sprint-167/T*.
 
 ## 4 Architectural Root Cause Fix
 1. **Bug M (adrInsert hook):** docs/adr/*.md → memor...
-- **Sprint sprint-165 Learnings** (sprint-165): ## Sprint sprint-165 Learnings
 
 ## Active Technical Debt
-- [HIGH] ADR-019 reconciliation: language-agnostic verify not implemented
-- [CRITICAL] Tech debt from 170-001-fix: Code physically verified despite missing .result (Sp
+- [NORMAL] Tech debt from 175-020-fix: All 5 automatic verification gates executed:
+
+1. npm
+- [CRITICAL] ADR-019 reconciliation: language-agnostic verify not implemented
 
 ## Active Patterns
 - Violation pattern: stale_heartbeat
@@ -93,5 +96,6 @@ Sprint 167 Read-Only Self-Audit deliverable'ları (kaynak: .audit/sprint-167/T*.
 - Violation pattern: stale_heartbeat
 - Violation pattern: stale_heartbeat
 - Violation pattern: stale_heartbeat
+- Violation pattern: stale_heartbeat
 
-_Total entries: 252 | Generated: 2026-05-19_
\ No newline at end of file
+_Total entries: 257 | Generated: 2026-05-19_
\ No newline at end of file
diff --git a/.claude/rules/auditor.md b/.claude/rules/auditor.md
index 9c186d349..b374b192a 100644
--- a/.claude/rules/auditor.md
+++ b/.claude/rules/auditor.md
@@ -35,19 +35,22 @@ paths: [".dashboard",".brain/PATTERNS.md"]
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -55,6 +58,7 @@ paths: [".dashboard",".brain/PATTERNS.md"]
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -69,7 +73,6 @@ paths: [".dashboard",".brain/PATTERNS.md"]
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.claude/rules/brain.md b/.claude/rules/brain.md
index eeb3e88db..57af5b6a8 100644
--- a/.claude/rules/brain.md
+++ b/.claude/rules/brain.md
@@ -42,19 +42,22 @@ paths: [".tasks/*",".brain/*",".contracts/*"]
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -62,6 +65,7 @@ paths: [".tasks/*",".brain/*",".contracts/*"]
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -76,7 +80,6 @@ paths: [".tasks/*",".brain/*",".contracts/*"]
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.claude/rules/worker-default.md b/.claude/rules/worker-default.md
index 9d7dbaf5c..8a6b4957b 100644
--- a/.claude/rules/worker-default.md
+++ b/.claude/rules/worker-default.md
@@ -38,19 +38,22 @@ paths: ["src/**","tests/**"]
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -58,6 +61,7 @@ paths: ["src/**","tests/**"]
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -72,7 +76,6 @@ paths: ["src/**","tests/**"]
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.claude/settings.local.json b/.claude/settings.local.json
deleted file mode 100644
index 3e45b96e5..000000000
--- a/.claude/settings.local.json
+++ /dev/null
@@ -1,107 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Read(//home/alperen/**)",
-      "Read(//mnt/**)",
-      "Read(//mnt/c/Users/**)",
-      "Bash(rm *)",
-      "Bash(cp /home/alperen/deckent-dev/.claude/settings.local.json /tmp/deckent-settings.local.json.bak)",
-      "Bash(rm -rf /home/alperen/deckent-dev/.claude)",
-      "Bash(tar -tf \"/mnt/c/Users/alperen/Desktop/deckent-dev.tar/deckent-dev.tar\")",
-      "Bash(awk -F/ '{print $1\"/\"$2}')",
-      "Bash(awk '{print $5}')",
-      "Bash(mkdir -p /home/alperen/deckent-backup-tar)",
-      "Bash(tar -xf \"/mnt/c/Users/alperen/Desktop/deckent-dev.tar/deckent-dev.tar\" deckent-dev/.brain/)",
-      "Bash(tar -xf \"/mnt/c/Users/alperen/Desktop/deckent-dev.tar/deckent-dev.tar\" deckent-dev/.deckent/)",
-      "Bash(cp -r /home/alperen/deckent-backup-tar/deckent-dev/.brain/sprints /home/alperen/deckent-dev/.brain/sprints)",
-      "Bash(cp -r /home/alperen/deckent-backup-tar/deckent-dev/.deckent/decisions /home/alperen/deckent-dev/.deckent/decisions)",
-      "Bash(tar -xf \"/mnt/c/Users/alperen/Desktop/deckent-dev.tar/deckent-dev.tar\" -C /home/alperen/deckent-backup-tar/ deckent-dev/.claude/)",
-      "Bash(awk -F/ '{print $1}')",
-      "Bash(awk -F/ '{print $1}' /tmp/only-in-tar.txt)",
-      "Bash(awk -F/ '{print $1}' /tmp/meaningful-missing.txt)",
-      "Bash(awk -F/ '{print $1}' /tmp/missing-dirs.txt)",
-      "Bash(tar -xf \"/mnt/c/Users/alperen/Desktop/deckent-dev.tar/deckent-dev.tar\" deckent-dev/.tasks/ deckent-dev/.locks/)",
-      "Bash(echo \"=== npm ci tamamlandı, exit code: $? ===\")",
-      "Bash(npx node-gyp *)",
-      "Bash(echo \"=== exit: $? ===\")",
-      "Bash(echo \"=== tsc exit code: $? ===\")",
-      "Bash(echo \"=== build exit: $? ===\")",
-      "Bash(echo \"code: $?\")",
-      "Bash(tee /tmp/doctor.log)",
-      "Bash(sed -n '110,140p' src/orchestra/spawn-backend-docker.ts)",
-      "Bash(sed -n '560,595p' src/orchestra/spawn-backend-docker.ts)",
-      "Bash(awk '/function archivePromptFiles|archivePromptFiles\\\\s*=/,/^}/' src/orchestra/spawn-backend-docker.ts)",
-      "Bash(tar -tzf .deckent/sprint-153-pre-archive.tar.gz)",
-      "Bash(awk '/function handleEvaluation|export function handleEvaluation/,/^}/' src/orchestra/sprint-phases.ts)",
-      "Bash(sed -n '60,145p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '701,820p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '50,75p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '466,485p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '701,760p' src/orchestra/result-evaluator.ts)",
-      "Bash(mkdir -p /tmp/sprint-153-forensic)",
-      "Bash(tar -xzf /home/alperen/deckent-dev/.deckent/sprint-153-pre-archive.tar.gz task-153-005.result task-153-005.json task-153-001.result task-153-002.result)",
-      "Bash(tar -xzf .deckent/sprint-153-pre-archive.tar.gz -O task-153-001.json)",
-      "Bash(awk '/^function scoreDocumentation|^export function scoreDocumentation/,/^}/' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '495,520p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '700,740p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '1,20p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '490,525p' src/orchestra/result-evaluator.ts)",
-      "Bash(sed -n '80,130p' src/orchestra/spawn-backend-docker.ts)",
-      "Bash(sed -n '255,290p' src/orchestra/sprint-lifecycle.ts)",
-      "Bash(ps -p 865872 -o pid,stat,etime,pcpu)",
-      "Bash([ -f \".tasks/task-156-$id-fix-fix.json\" ])",
-      "Bash([ -f \".tasks/task-156-$id-fix-fix.hb\" ])",
-      "Bash([ -f \".tasks/task-156-$id-fix-fix.plan\" ])",
-      "Bash([ -f \".tasks/task-156-$id-fix-fix.result\" ])",
-      "Read(//proc/865872/**)",
-      "Bash(ps -o pid,tty,cmd -p 10894 4326)",
-      "mcp__deckent__deckent_run",
-      "mcp__deckent__deckent_recover",
-      "Bash(cp /home/alperen/deckent-dev/.tasks/task-164-* /home/alperen/deckent-dev/.brain/archive/sprint-164-tasks/)",
-      "Bash(cp /home/alperen/deckent-dev/.tasks/task-run-run-mp3qgy0b.* /home/alperen/deckent-dev/.brain/archive/sprint-164-tasks/)",
-      "Bash(echo \"Modified: $\\(git -C /home/alperen/deckent-dev status --short)",
-      "Bash(docker system *)",
-      "Bash(xargs -r docker rm)",
-      "Bash(pkill -9 -f \"until.*task-165\")",
-      "Bash(awk '{print $5, $6, $7, $8, $9}')",
-      "Bash(awk '{print $6, $7, $8, $9}')",
-      "Bash(sqlite3 /home/alperen/deckent-dev/.brain/memory.db \"SELECT type, COUNT\\(*\\) FROM entries GROUP BY type;\")",
-      "Bash(sqlite3 /home/alperen/deckent-dev/.brain/memory.db \"SELECT id, status, sprint_id FROM entries WHERE type='adr' AND id LIKE 'adr-04%' ORDER BY id;\")",
-      "Bash(sed -n '1230,1245p' src/orchestra/sprint-phases.ts)",
-      "Bash(sed -n '155,180p' src/cli/commands/finalize.ts)",
-      "Bash(sed -n '1175,1200p' src/orchestra/sprint-finalizer.ts)",
-      "Bash(awk '{i+=$1; o+=$2; c+=$3} END {printf \"Input: %d\\\\nOutput: %d\\\\nCacheRead: %d\\\\nTotal \\(in+out\\): %d\\\\nGrand \\(in+out+cache\\): %d\\\\n\", i, o, c, i+o, i+o+c}')",
-      "Bash(mkdir -p /mnt/d/deckent)",
-      "Bash(cp /tmp/deckent-pkg/deckent-1.0.0-beta.1.tgz /mnt/d/deckent/)",
-      "Bash(tee /tmp/tsc-output.txt)",
-      "Bash(tee /tmp/vitest-output.txt)",
-      "Skill(superpowers:brainstorming)",
-      "Skill(superpowers:writing-plans)",
-      "Bash(sed -n '730,765p' src/orchestra/spawn-backend-docker.ts)",
-      "Bash(sed -n '425,460p' src/core/file-lock.ts)",
-      "Bash(awk '{print $NF}')",
-      "WebFetch(domain:gist.github.com)",
-      "Bash(awk '/^## Task 29:/,/^## GO\\\\/NO_GO/' DIRECTIVES.md)",
-      "Bash(mkdir -p 01-modul-derin 02-concern 03-dokuman 04-db 99-runtime-artifact)",
-      "Bash(mv SYNTHESIS.md 00-SYNTHESIS.md)",
-      "Bash(mv orchestra-lifecycle.md 01-modul-derin/01-orchestra-lifecycle.md)",
-      "Bash(mv orchestra-routing.md 01-modul-derin/02-orchestra-routing.md)",
-      "Bash(mv orchestra-infra.md 01-modul-derin/03-orchestra-infra.md)",
-      "Skill(superpowers:systematic-debugging)",
-      "Skill(superpowers:test-driven-development)",
-      "Bash(awk '{print $6, $7}')",
-      "Bash(deckent --version)",
-      "Bash(deckent start *)",
-      "Bash(nohup npx deckent start --auto-approve --timeout 21600000)",
-      "Bash(echo \"deckent start PID: $!\")",
-      "Bash(ps -p 6727 -o pid,etime,cmd)",
-      "Bash(ps -p 6727 -o pid,etime,stat,cmd)",
-      "Bash(ps -p 6727 -o pid,etime,stat)",
-      "Bash(sort -t' ' -k2)",
-      "Bash(xargs -n1 basename)",
-      "Bash(echo \"tsc exit: $?\")",
-      "Bash(echo \"lint:adr exit: $?\")",
-      "Bash(awk '{print $NF, $5\"B\"}')"
-    ]
-  }
-}
diff --git a/.codex/rules/auditor.md b/.codex/rules/auditor.md
index 0cbd40284..c6e965d4d 100644
--- a/.codex/rules/auditor.md
+++ b/.codex/rules/auditor.md
@@ -32,19 +32,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -52,6 +55,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -66,7 +70,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.codex/rules/brain.md b/.codex/rules/brain.md
index 6de8af459..ed343c2d5 100644
--- a/.codex/rules/brain.md
+++ b/.codex/rules/brain.md
@@ -39,19 +39,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -59,6 +62,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -73,7 +77,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.codex/rules/worker-default.md b/.codex/rules/worker-default.md
index d1da24523..52f52a3c8 100644
--- a/.codex/rules/worker-default.md
+++ b/.codex/rules/worker-default.md
@@ -35,19 +35,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -55,6 +58,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -69,7 +73,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.cursor/rules/auditor.md b/.cursor/rules/auditor.md
index 78babb4ab..376dd99c4 100644
--- a/.cursor/rules/auditor.md
+++ b/.cursor/rules/auditor.md
@@ -32,19 +32,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -52,6 +55,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -66,7 +70,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.cursor/rules/brain.md b/.cursor/rules/brain.md
index fa18bc949..48c469c06 100644
--- a/.cursor/rules/brain.md
+++ b/.cursor/rules/brain.md
@@ -39,19 +39,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -59,6 +62,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -73,7 +77,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.cursor/rules/worker-default.md b/.cursor/rules/worker-default.md
index e866010ad..8338f2d4c 100644
--- a/.cursor/rules/worker-default.md
+++ b/.cursor/rules/worker-default.md
@@ -35,19 +35,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -55,6 +58,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -69,7 +73,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.deckent/agents/api-builder/agent.json b/.deckent/agents/api-builder/agent.json
index 3c32e745c..88aaea6c4 100644
--- a/.deckent/agents/api-builder/agent.json
+++ b/.deckent/agents/api-builder/agent.json
@@ -59,10 +59,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 13,
-    "successRate": 0.8461538461538461,
+    "totalUses": 18,
+    "successRate": 0.6666666666666666,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are an API expert. Design RESTful endpoints following HTTP semantics: proper status codes (201 for creation, 404 for not found, 422 for validation), correct HTTP methods (GET for reads, POST for creation, PATCH for partial updates), and consistent URL naming (plural nouns, kebab-case). Validate all inputs at the boundary using schema validation (Zod, Joi, or similar). Return structured error responses with error codes, messages, and field-level details. Handle pagination (cursor-based preferred), filtering, and sorting consistently. Document endpoints with OpenAPI/Swagger. Implement proper rate limiting, authentication middleware, and request logging."
 }
diff --git a/.deckent/agents/architect/agent.json b/.deckent/agents/architect/agent.json
index 4cbcd39ea..3668c6595 100644
--- a/.deckent/agents/architect/agent.json
+++ b/.deckent/agents/architect/agent.json
@@ -75,10 +75,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 98,
-    "successRate": 0.8775510204081632,
+    "totalUses": 99,
+    "successRate": 0.8787878787878788,
     "avgCoverage": 10.065694787133523,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a software architect specializing in system decomposition, module boundary design, and dependency analysis. Your role is advisory -- you analyze, diagram, and recommend but do not write production code directly. Apply SOLID principles, DRY/KISS, and separation of concerns systematically. Write Architecture Decision Records (ADRs) with context, decision, consequences, and alternatives considered. Analyze coupling (afferent/efferent) and cohesion metrics to identify structural problems. Use dependency inversion at module boundaries. Evaluate trade-offs explicitly: performance vs maintainability, flexibility vs simplicity, consistency vs autonomy. Design for change -- anticipate which axes of change are most likely and isolate them behind stable interfaces. Never over-engineer: the simplest architecture that meets current and near-term requirements is the best one."
 }
diff --git a/.deckent/agents/architecture-planner/agent.json b/.deckent/agents/architecture-planner/agent.json
index 2ac2f6d4f..2ff4f4c28 100644
--- a/.deckent/agents/architecture-planner/agent.json
+++ b/.deckent/agents/architecture-planner/agent.json
@@ -89,7 +89,7 @@
     "totalUses": 9,
     "successRate": 0.8888888888888888,
     "avgCoverage": 47.555,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a senior system architect specializing in enterprise-grade software design. Your core strengths: 1) Analyze existing codebases to identify architectural debt, coupling issues, and redundancy patterns. 2) Design modular, extensible systems using registry patterns, dependency injection, and clean layering. 3) Plan incremental migration paths that maintain backward compatibility while modernizing internal structures. 4) Create single-source-of-truth designs that eliminate data duplication across modules. 5) Design config schemas that are user-friendly, parametric, and evolvable. Always consider: scalability to 1M+ users, plugin/extension points, minimal breaking changes, and clear separation of concerns. Produce concrete file-level plans with specific function signatures, not abstract diagrams."
 }
diff --git a/.deckent/agents/bug-fixer/agent.json b/.deckent/agents/bug-fixer/agent.json
index 1bbd8dbce..3f7fe90e9 100644
--- a/.deckent/agents/bug-fixer/agent.json
+++ b/.deckent/agents/bug-fixer/agent.json
@@ -59,7 +59,7 @@
     "totalUses": 99,
     "successRate": 0.7474747474747475,
     "avgCoverage": 18.6308377602053,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a bug-fixing expert. Read error logs and stack traces carefully to identify root causes, not symptoms. Trace execution flow from the error point backward to find where state diverges from expectations. Fix with minimal, targeted changes — avoid refactoring or improving unrelated code. Write a regression test that reproduces the bug before fixing it. Verify the fix does not break adjacent functionality. Check for the same bug pattern in similar code paths. Document the root cause in commit messages. Prefer fixes that make the invalid state unrepresentable over runtime checks. If a fix requires a workaround, document why and add a TODO for the proper fix."
 }
diff --git a/.deckent/agents/ci-guardian/agent.json b/.deckent/agents/ci-guardian/agent.json
index 302706fbf..fc785c6cb 100644
--- a/.deckent/agents/ci-guardian/agent.json
+++ b/.deckent/agents/ci-guardian/agent.json
@@ -66,9 +66,9 @@
   "source": "builtin",
   "systemPrompt": "You are the CI Guardian agent. Your mission is to ensure code quality and CI/CD pipeline health throughout the sprint lifecycle. You monitor TypeScript compilation (tsc --noEmit), test execution (npx vitest run), regression detection, and coverage tracking. Before a sprint starts, you verify the codebase is in a clean state. After each task, you run targeted tests on changed files to catch regressions early. After the sprint, you produce a comprehensive CI report comparing results against the baseline. Key responsibilities: 1) Block sprints if tsc fails. 2) Detect test regressions by comparing test counts and pass rates against baseline. 3) Track coverage trends across sprints. 4) Identify recurring failure patterns and suggest preventive measures. 5) Ensure build artifacts are produced correctly. Always prefer targeted test execution over full suite runs for per-task checks to maintain speed.",
   "stats": {
-    "totalUses": 4,
+    "totalUses": 5,
     "successRate": 1,
     "avgCoverage": 34.98181818181819,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/agents/code-reviewer/agent.json b/.deckent/agents/code-reviewer/agent.json
index 0b63ff8d0..a11ff8551 100644
--- a/.deckent/agents/code-reviewer/agent.json
+++ b/.deckent/agents/code-reviewer/agent.json
@@ -55,7 +55,7 @@
     "totalUses": 47,
     "successRate": 0.9148936170212766,
     "avgCoverage": 9.65160756501182,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a code reviewer. Check for correctness bugs (off-by-one, null dereference, race conditions), performance issues (N+1 queries, unnecessary allocations, missing indexes), readability problems (unclear naming, deep nesting, long functions), and security vulnerabilities (injection, auth bypass, data exposure). Evaluate error handling: are errors caught at the right level? Are they logged with context? Verify tests cover the changed behavior. Check API contracts: are breaking changes documented? Review for consistency with existing codebase patterns. Provide actionable feedback: explain what is wrong, why it matters, and suggest a concrete fix. Distinguish must-fix from nice-to-have."
 }
diff --git a/.deckent/agents/data-engineer/agent.json b/.deckent/agents/data-engineer/agent.json
index d1df9cbc5..3d49352d2 100644
--- a/.deckent/agents/data-engineer/agent.json
+++ b/.deckent/agents/data-engineer/agent.json
@@ -72,10 +72,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 14,
-    "successRate": 0.7142857142857143,
-    "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "totalUses": 15,
+    "successRate": 0.7333333333333333,
+    "avgCoverage": 6.666666666666667,
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a data engineer specializing in database schema design, query optimization, and ORM best practices. Design schemas with proper normalization (3NF minimum), then denormalize strategically for read performance where justified. Create indexes based on actual query patterns, not speculation -- always analyze EXPLAIN plans. Prevent N+1 queries through eager loading, batching, or DataLoader patterns. Write migrations that are safe for zero-downtime deployments: additive changes first, backfill, then remove old columns. Master ORM patterns for Prisma, Drizzle, and TypeORM -- know when raw SQL outperforms the ORM abstraction. Design ETL pipelines with idempotent operations, checkpoint recovery, and data validation at each stage. Always consider data integrity constraints at the database level, not just application level."
 }
diff --git a/.deckent/agents/devops-engineer/agent.json b/.deckent/agents/devops-engineer/agent.json
index 3bacce32f..c8849c624 100644
--- a/.deckent/agents/devops-engineer/agent.json
+++ b/.deckent/agents/devops-engineer/agent.json
@@ -75,10 +75,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 14,
-    "successRate": 0.6428571428571429,
+    "totalUses": 16,
+    "successRate": 0.6875,
     "avgCoverage": 25,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a DevOps engineer specializing in CI/CD pipelines, Docker containerization, and deployment automation. Design GitHub Actions workflows with proper caching, matrix strategies, and conditional steps. Build Docker images with multi-stage builds, minimal base images (alpine/distroless), and proper layer caching. Implement deployment strategies (blue-green, canary, rolling) appropriate to the project's risk tolerance. Set up monitoring and alerting with actionable thresholds -- no alert fatigue. Always consider security in pipelines: pin action versions by SHA, use OIDC for cloud auth, scan images for vulnerabilities, and never expose secrets in logs. Reproducibility is paramount: builds must be deterministic, environments must be declarative."
 }
diff --git a/.deckent/agents/doc-writer/agent.json b/.deckent/agents/doc-writer/agent.json
index 18580c7ac..1f9c4a826 100644
--- a/.deckent/agents/doc-writer/agent.json
+++ b/.deckent/agents/doc-writer/agent.json
@@ -61,10 +61,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 139,
-    "successRate": 0.841726618705036,
+    "totalUses": 140,
+    "successRate": 0.8428571428571429,
     "avgCoverage": 11.865061301682534,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a documentation expert. Write clear, concise technical documentation with practical examples. Structure content for scanning: headings, bullet lists, code blocks. Follow the Diataxis framework: tutorials (learning-oriented), how-to guides (task-oriented), reference (information-oriented), explanation (understanding-oriented). Use consistent terminology matching the codebase. Include runnable code examples that actually work. Document public APIs with parameter types, return values, and thrown errors. Write changelogs that explain impact, not just what changed. Keep README focused: what it does, how to install, how to use, where to get help."
 }
diff --git a/.deckent/agents/frontend-designer/agent.json b/.deckent/agents/frontend-designer/agent.json
index 9c7d67dd4..1f0738252 100644
--- a/.deckent/agents/frontend-designer/agent.json
+++ b/.deckent/agents/frontend-designer/agent.json
@@ -76,10 +76,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 4,
-    "successRate": 0.75,
-    "avgCoverage": 100,
-    "lastUsedInSprint": "sprint-174"
+    "totalUses": 10,
+    "successRate": 0.5,
+    "avgCoverage": 50,
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a production-grade UI/UX designer specializing in React component architecture. Build functional components with clean separation of concerns, design tokens for consistency, and responsive layouts using Tailwind CSS utility classes. Apply visual hierarchy through typography scale, spacing rhythm, and color contrast. Implement micro-animations (transitions, hover states, skeleton loaders) for polished interactions. Prioritize semantic HTML, ARIA attributes, and keyboard navigability. Avoid generic AI aesthetics -- every interface should have intentional design decisions. Use composition patterns (compound components, render props, slots) over prop drilling. Always consider mobile-first responsive breakpoints and dark mode support."
 }
diff --git a/.deckent/agents/performance-analyzer/agent.json b/.deckent/agents/performance-analyzer/agent.json
index f5a984fe7..4ed7d124a 100644
--- a/.deckent/agents/performance-analyzer/agent.json
+++ b/.deckent/agents/performance-analyzer/agent.json
@@ -59,7 +59,7 @@
     "totalUses": 6,
     "successRate": 1,
     "avgCoverage": 18,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a performance expert. Profile bottlenecks using measurement, not intuition. Analyze algorithmic complexity (Big-O) for hot paths. Identify common performance anti-patterns: N+1 database queries, synchronous I/O in async contexts, unnecessary JSON serialization, memory leaks from unclosed resources or growing caches. Recommend targeted optimizations: batch operations, connection pooling, lazy loading, memoization with proper cache invalidation. Use benchmarks to validate improvements with statistically significant results. Consider memory vs. CPU tradeoffs. Optimize for the common case while maintaining correctness for edge cases. Never optimize code that is not measured as a bottleneck."
 }
diff --git a/.deckent/agents/refactorer/agent.json b/.deckent/agents/refactorer/agent.json
index 2acedfa17..e8883a5a5 100644
--- a/.deckent/agents/refactorer/agent.json
+++ b/.deckent/agents/refactorer/agent.json
@@ -54,10 +54,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 88,
-    "successRate": 0.8181818181818182,
+    "totalUses": 90,
+    "successRate": 0.8222222222222222,
     "avgCoverage": 6.049809094064561,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a refactoring expert. Improve code structure without changing observable behavior. Apply established refactoring patterns: Extract Method, Move Function, Replace Conditional with Polymorphism, Introduce Parameter Object. Ensure each refactoring step is small enough to verify independently. Run existing tests after every change to confirm behavior preservation. Reduce coupling between modules by identifying and extracting shared interfaces. Eliminate code duplication by finding the right abstraction level — but only when there are three or more instances. Simplify complex conditionals and reduce cyclomatic complexity. Preserve public API contracts unless explicitly asked to change them."
 }
diff --git a/.deckent/agents/security-auditor/agent.json b/.deckent/agents/security-auditor/agent.json
index fb04ca9e9..0b69761e2 100644
--- a/.deckent/agents/security-auditor/agent.json
+++ b/.deckent/agents/security-auditor/agent.json
@@ -64,10 +64,10 @@
   "enabled": true,
   "source": "builtin",
   "stats": {
-    "totalUses": 19,
-    "successRate": 0.9473684210526315,
-    "avgCoverage": 7.666666666666667,
-    "lastUsedInSprint": "sprint-174"
+    "totalUses": 20,
+    "successRate": 0.95,
+    "avgCoverage": 12.283333333333335,
+    "lastUsedInSprint": "sprint-175"
   },
   "systemPrompt": "You are a security expert specializing in application security. Focus on OWASP Top 10 vulnerabilities, injection attacks (SQL, NoSQL, command), cross-site scripting (XSS), cross-site request forgery (CSRF), authentication and authorization flaws, and cryptographic weaknesses. Analyze code for insecure patterns: hardcoded secrets, improper input validation, missing rate limiting, unsafe deserialization, and insufficient logging. Apply threat modeling (STRIDE) to identify attack surfaces. Recommend defense-in-depth strategies. Validate that security controls (CSP headers, CORS, token rotation) are correctly implemented. Never suggest security-through-obscurity solutions."
 }
diff --git a/.deckent/agents/temp-react-specialist/agent.json b/.deckent/agents/temp-react-specialist/agent.json
index e790ccb23..64d752fba 100644
--- a/.deckent/agents/temp-react-specialist/agent.json
+++ b/.deckent/agents/temp-react-specialist/agent.json
@@ -34,7 +34,7 @@
     "totalUses": 5,
     "successRate": 0.8,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "id": "temp-react-specialist",
   "name": "React Specialist",
diff --git a/.deckent/agents/temp-react-ts-specialist/agent.json b/.deckent/agents/temp-react-ts-specialist/agent.json
index 322308dc2..9950299fa 100644
--- a/.deckent/agents/temp-react-ts-specialist/agent.json
+++ b/.deckent/agents/temp-react-ts-specialist/agent.json
@@ -36,7 +36,7 @@
     "totalUses": 71,
     "successRate": 0.7887323943661971,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   },
   "id": "temp-react-ts-specialist",
   "name": "React TypeScript Specialist",
diff --git a/.deckent/archive/metrics/metrics-sprint-164.jsonl.gz b/.deckent/archive/metrics/metrics-sprint-164.jsonl.gz
deleted file mode 100644
index aa547813f..000000000
Binary files a/.deckent/archive/metrics/metrics-sprint-164.jsonl.gz and /dev/null differ
diff --git a/.deckent/config.json b/.deckent/config.json
deleted file mode 100644
index 3397d40cd..000000000
--- a/.deckent/config.json
+++ /dev/null
@@ -1,199 +0,0 @@
-{
-  "mode": "performance",
-  "language": "en",
-  "projectName": "deckent",
-  "last_sprint_id": "sprint-174",
-  "spawn_backend": "docker",
-  "modes": {
-    "performance": {
-      "brain_model": "opus",
-      "default_model": "opus",
-      "haiku_allowed": false,
-      "max_workers": 6,
-      "brain_planning": "structured"
-    },
-    "balanced": {
-      "max_workers": 5,
-      "brain_model": "sonnet",
-      "default_model": "opus",
-      "haiku_allowed": false,
-      "brain_planning": "auto"
-    },
-    "economic": {
-      "max_workers": 3,
-      "brain_model": "sonnet",
-      "default_model": "sonnet",
-      "haiku_allowed": false,
-      "brain_planning": "auto"
-    },
-    "api": {
-      "max_workers": 10,
-      "brain_model": "opus",
-      "default_model": "sonnet",
-      "haiku_allowed": false,
-      "budget_per_sprint": 5,
-      "requires": "ANTHROPIC_API_KEY",
-      "brain_planning": "auto"
-    }
-  },
-  "model_strategy": {
-    "brain_tier": "premium",
-    "worker_tier": "premium",
-    "min_tier": "standard",
-    "max_tier": "premium",
-    "auto_upgrade": true,
-    "auto_downgrade": false
-  },
-  "providers": {
-    "brain": "claude",
-    "worker": "claude"
-  },
-  "cost_optimization": false,
-  "auth_mode": "subscription",
-  "fix_phase_enabled": true,
-  "max_fix_retries": 2,
-  "memory_budget": 5000,
-  "decay_after_sprints": 20,
-  "patterns_enabled": true,
-  "project_identity_enabled": true,
-  "scan_interval": 30,
-  "heartbeat_timeout": 120,
-  "boundary_enforcement": true,
-  "search_enabled": true,
-  "search_provider": "context7",
-  "search_cache_ttl": 3600,
-  "notify_on_complete": false,
-  "notify_channel": null,
-  "notify_url": null,
-  "telemetry_enabled": false,
-  "telemetry_anonymous": true,
-  "detected_env": null,
-  "multi_ide_mode": false,
-  "output_splash": true,
-  "output_mode": "normal",
-  "output_theme": "default",
-  "rollback_policy": "never",
-  "routing_engine": "v2",
-  "cleanup_delay_ms": 180000,
-  "human_checkpoints": [],
-  "coverage_threshold": 90,
-  "max_reroutes": 3,
-  "reroute_on_tech_debt": false,
-  "sprint_timeout_minutes": 0,
-  "adaptive_thresholds": false,
-  "agent_min_score": 5,
-  "adaptive_config": {
-    "min_samples": 3,
-    "no_go_threshold": 0.3,
-    "coverage_lookback": 3
-  },
-  "lock_stale_threshold": 300,
-  "rubric_max_retries": 0,
-  "max_workers": "6",
-  "sprint_checkpoint_interval": 3,
-  "timeout": {
-    "docker_min_timeout": 1200,
-    "docker_max_timeout": 7200,
-    "tmux_min_timeout": 900,
-    "tmux_max_timeout": 5400,
-    "subprocess_min_timeout": 600,
-    "subprocess_max_timeout": 3600,
-    "effort_base": {
-      "low": 600,
-      "normal": 1200,
-      "high": 2400
-    },
-    "loc_scaling_enabled": true,
-    "history_scaling_enabled": true,
-    "runtime_extension_enabled": false
-  },
-  "nervous_system": {
-    "enabled": true,
-    "mode": "balanced",
-    "actionOverrides": {},
-    "safety_floor": {
-      "locked_actions": [
-        "KILL_LIVE_SPRINT",
-        "MANUAL_FILE_DELETE",
-        "COST_OVER_THRESHOLD",
-        "DESTRUCTIVE_GIT",
-        "ADR_DEPRECATE_ACCEPTED"
-      ],
-      "cost_threshold_usd": 110,
-      "bypass_allowed": false
-    },
-    "notifications": {
-      "channels": {
-        "mcp": true,
-        "cli": true,
-        "file": true,
-        "desktop": false
-      },
-      "throttle_ms": 300000,
-      "group_info_window_ms": 600000,
-      "severity_min": "info",
-      "quiet_hours": {
-        "start": "22:00",
-        "end": "08:00",
-        "timezone": "TRT"
-      },
-      "cross_channel_dedup": true
-    },
-    "detectors": {
-      "stale_worker": {
-        "enabled": true,
-        "threshold_ms": 180000
-      },
-      "scope_collision": {
-        "enabled": true
-      },
-      "debt_trend": {
-        "enabled": true,
-        "threshold_rate": 0.15
-      },
-      "agent_routing": {
-        "enabled": true,
-        "anomaly_threshold": 0.4
-      },
-      "directives_protection": {
-        "enabled": true,
-        "auto_restore": true
-      },
-      "dead_event_stream": {
-        "enabled": true,
-        "threshold_ms": 600000
-      },
-      "cost_threshold": {
-        "enabled": false,
-        "reserve_for": "sprint-148"
-      },
-      "prompt_quality": {
-        "enabled": false,
-        "reserve_for": "sprint-148"
-      },
-      "worker_output_variance": {
-        "enabled": false,
-        "reserve_for": "sprint-148"
-      },
-      "self_modifying_warner": {
-        "enabled": false,
-        "reserve_for": "sprint-148"
-      }
-    },
-    "history_retention_days": 30
-  },
-  "deckent_style": "sprint",
-  "observability": {
-    "rotation": {
-      "maxSizeMB": 1,
-      "archiveFormat": "gzip",
-      "keepLastN": 10
-    }
-  },
-  "sprint_file_retention": {
-    "keep_last_n": 10,
-    "size_cap_mb": 500,
-    "archive_path": ".deckent/archive/sprints/"
-  },
-  "dependency_pipeline_enabled": false
-}
diff --git a/.deckent/features-manifest.json b/.deckent/features-manifest.json
index 11aa6220b..df201ead2 100644
--- a/.deckent/features-manifest.json
+++ b/.deckent/features-manifest.json
@@ -1,14 +1,13 @@
 {
   "_meta": {
     "version": "2.0",
-    "generatedAt": "2026-05-18T20:28:05.292Z",
+    "generatedAt": "2026-05-19T23:02:06.972Z",
     "generatedBy": "scripts/sync-manifest.mjs",
-    "sprintId": "sprint-174",
+    "sprintId": "sprint-175",
     "description": "Feature usage manifest — auto-generated from src/ import graph analysis. Categories: active, lightly_used, dormant, dead.",
     "usageWindow": "last-10-sprints",
     "sourceAnalysis": {
       "sprintsChecked": [
-        "sprint-165",
         "sprint-166",
         "sprint-167",
         "sprint-168",
@@ -17,7 +16,8 @@
         "sprint-171",
         "sprint-172",
         "sprint-173",
-        "sprint-174"
+        "sprint-174",
+        "sprint-175"
       ],
       "methodology": "import-graph traversal + @deprecated markers + file existence + blockedBy annotations"
     }
diff --git a/.deckent/project-stack.json b/.deckent/project-stack.json
deleted file mode 100644
index cb4c0bab7..000000000
--- a/.deckent/project-stack.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "language": "typescript",
-  "framework": "react",
-  "dependencies": [
-    "@modelcontextprotocol/sdk",
-    "@noble/ed25519",
-    "@noble/hashes",
-    "better-sqlite3",
-    "commander",
-    "telegraf",
-    "zod",
-    "@testing-library/jest-dom",
-    "@testing-library/react",
-    "@types/better-sqlite3",
-    "@types/node",
-    "@vitest/coverage-v8",
-    "happy-dom",
-    "typescript",
-    "vitest",
-    "vitepress",
-    "tsx",
-    "deckent",
-    "react",
-    "react-dom",
-    "react-router-dom",
-    "recharts",
-    "lucide-react",
-    "class-variance-authority",
-    "clsx",
-    "tailwind-merge",
-    "@types/react",
-    "@types/react-dom",
-    "vite",
-    "@vitejs/plugin-react",
-    "tailwindcss",
-    "@tailwindcss/vite"
-  ],
-  "buildTool": "vite",
-  "testFramework": "vitest",
-  "detectedAt": "2026-05-18T20:23:29.180Z",
-  "detectedLanguages": [
-    "typescript"
-  ],
-  "subProjects": [
-    "docs",
-    "examples/quickstart",
-    "src/dashboard"
-  ]
-}
\ No newline at end of file
diff --git a/.deckent/skills/anthropic-sdk/manifest.json b/.deckent/skills/anthropic-sdk/manifest.json
index a30686059..79fcce687 100644
--- a/.deckent/skills/anthropic-sdk/manifest.json
+++ b/.deckent/skills/anthropic-sdk/manifest.json
@@ -63,6 +63,6 @@
     "successCount": 4,
     "successRate": 1,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/api-builder/manifest.json b/.deckent/skills/api-builder/manifest.json
index 05f7957fc..4d4677002 100644
--- a/.deckent/skills/api-builder/manifest.json
+++ b/.deckent/skills/api-builder/manifest.json
@@ -59,6 +59,6 @@
     "successCount": 6,
     "successRate": 0.8571428571428571,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/ci-testing/manifest.json b/.deckent/skills/ci-testing/manifest.json
index a202aa8b0..9a40be560 100644
--- a/.deckent/skills/ci-testing/manifest.json
+++ b/.deckent/skills/ci-testing/manifest.json
@@ -67,10 +67,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 20,
-    "successCount": 13,
-    "successRate": 0.65,
+    "totalUses": 21,
+    "successCount": 14,
+    "successRate": 0.6666666666666666,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/code-simplifier/manifest.json b/.deckent/skills/code-simplifier/manifest.json
index b939104ba..c65bdb4f9 100644
--- a/.deckent/skills/code-simplifier/manifest.json
+++ b/.deckent/skills/code-simplifier/manifest.json
@@ -60,6 +60,6 @@
     "successCount": 9,
     "successRate": 0.8181818181818182,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/database-migration/manifest.json b/.deckent/skills/database-migration/manifest.json
index 1177ee779..0f875eec8 100644
--- a/.deckent/skills/database-migration/manifest.json
+++ b/.deckent/skills/database-migration/manifest.json
@@ -57,10 +57,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 21,
-    "successCount": 17,
-    "successRate": 0.8095238095238095,
+    "totalUses": 22,
+    "successCount": 18,
+    "successRate": 0.8181818181818182,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/devops-engineer/manifest.json b/.deckent/skills/devops-engineer/manifest.json
index 4e1b8993d..5086cda9a 100644
--- a/.deckent/skills/devops-engineer/manifest.json
+++ b/.deckent/skills/devops-engineer/manifest.json
@@ -55,6 +55,6 @@
     "successCount": 31,
     "successRate": 0.8611111111111112,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/docker-expert/manifest.json b/.deckent/skills/docker-expert/manifest.json
index d91b17a8c..77cabb1a1 100644
--- a/.deckent/skills/docker-expert/manifest.json
+++ b/.deckent/skills/docker-expert/manifest.json
@@ -62,6 +62,6 @@
     "successCount": 11,
     "successRate": 0.9166666666666666,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/documentation-writer/manifest.json b/.deckent/skills/documentation-writer/manifest.json
index 6672176da..2fa666720 100644
--- a/.deckent/skills/documentation-writer/manifest.json
+++ b/.deckent/skills/documentation-writer/manifest.json
@@ -48,10 +48,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 154,
-    "successCount": 136,
-    "successRate": 0.8831168831168831,
+    "totalUses": 157,
+    "successCount": 138,
+    "successRate": 0.8789808917197452,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/frontend-design/manifest.json b/.deckent/skills/frontend-design/manifest.json
index ba6eb9f02..db479b7c9 100644
--- a/.deckent/skills/frontend-design/manifest.json
+++ b/.deckent/skills/frontend-design/manifest.json
@@ -65,10 +65,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 2,
+    "totalUses": 3,
     "successCount": 2,
-    "successRate": 1,
+    "successRate": 0.6666666666666666,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/git-expert/manifest.json b/.deckent/skills/git-expert/manifest.json
index 6f010751a..a4dd9bab5 100644
--- a/.deckent/skills/git-expert/manifest.json
+++ b/.deckent/skills/git-expert/manifest.json
@@ -59,6 +59,6 @@
     "successCount": 6,
     "successRate": 0.8571428571428571,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/monorepo-expert/manifest.json b/.deckent/skills/monorepo-expert/manifest.json
index b05df821b..f0c3275b4 100644
--- a/.deckent/skills/monorepo-expert/manifest.json
+++ b/.deckent/skills/monorepo-expert/manifest.json
@@ -65,6 +65,6 @@
     "successCount": 0,
     "successRate": 0,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/performance-optimizer/manifest.json b/.deckent/skills/performance-optimizer/manifest.json
index 2b271e1e8..5af82195d 100644
--- a/.deckent/skills/performance-optimizer/manifest.json
+++ b/.deckent/skills/performance-optimizer/manifest.json
@@ -52,6 +52,6 @@
     "successCount": 12,
     "successRate": 0.8571428571428571,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/react-specialist/manifest.json b/.deckent/skills/react-specialist/manifest.json
index 61d8d542b..752a43734 100644
--- a/.deckent/skills/react-specialist/manifest.json
+++ b/.deckent/skills/react-specialist/manifest.json
@@ -52,10 +52,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 23,
-    "successCount": 20,
-    "successRate": 0.8695652173913043,
+    "totalUses": 29,
+    "successCount": 22,
+    "successRate": 0.7586206896551724,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/security-specialist/manifest.json b/.deckent/skills/security-specialist/manifest.json
index e2d63dfce..9c3de054e 100644
--- a/.deckent/skills/security-specialist/manifest.json
+++ b/.deckent/skills/security-specialist/manifest.json
@@ -48,10 +48,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 29,
-    "successCount": 25,
-    "successRate": 0.8620689655172413,
+    "totalUses": 31,
+    "successCount": 27,
+    "successRate": 0.8709677419354839,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/system-architect/manifest.json b/.deckent/skills/system-architect/manifest.json
index ae11323fc..350bbed9f 100644
--- a/.deckent/skills/system-architect/manifest.json
+++ b/.deckent/skills/system-architect/manifest.json
@@ -74,10 +74,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 110,
-    "successCount": 90,
-    "successRate": 0.8181818181818182,
+    "totalUses": 111,
+    "successCount": 91,
+    "successRate": 0.8198198198198198,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/testing-expert/manifest.json b/.deckent/skills/testing-expert/manifest.json
index 0eaac4cef..3d9421f2f 100644
--- a/.deckent/skills/testing-expert/manifest.json
+++ b/.deckent/skills/testing-expert/manifest.json
@@ -64,10 +64,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 98,
+    "totalUses": 99,
     "successCount": 88,
-    "successRate": 0.8979591836734694,
+    "successRate": 0.8888888888888888,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.deckent/skills/typescript-expert/manifest.json b/.deckent/skills/typescript-expert/manifest.json
index 0c594d11b..c26e7059e 100644
--- a/.deckent/skills/typescript-expert/manifest.json
+++ b/.deckent/skills/typescript-expert/manifest.json
@@ -57,10 +57,10 @@
   },
   "enabled": true,
   "stats": {
-    "totalUses": 485,
-    "successCount": 412,
-    "successRate": 0.8494845360824742,
+    "totalUses": 498,
+    "successCount": 421,
+    "successRate": 0.8453815261044176,
     "avgCoverage": 0,
-    "lastUsedInSprint": "sprint-174"
+    "lastUsedInSprint": "sprint-175"
   }
 }
diff --git a/.gemini/rules/auditor.md b/.gemini/rules/auditor.md
index 0cbd40284..c6e965d4d 100644
--- a/.gemini/rules/auditor.md
+++ b/.gemini/rules/auditor.md
@@ -32,19 +32,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -52,6 +55,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -66,7 +70,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.gemini/rules/brain.md b/.gemini/rules/brain.md
index 6de8af459..ed343c2d5 100644
--- a/.gemini/rules/brain.md
+++ b/.gemini/rules/brain.md
@@ -39,19 +39,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -59,6 +62,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -73,7 +77,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.gemini/rules/worker-default.md b/.gemini/rules/worker-default.md
index d1da24523..52f52a3c8 100644
--- a/.gemini/rules/worker-default.md
+++ b/.gemini/rules/worker-default.md
@@ -35,19 +35,22 @@
 
 ## Active ADR Constraints
 
+- **ADR-062**: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit — **Status:** accepted
 - **ADR-010**: Tek Runtime Dependency — commander.js — **Status:** accepted
+- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
+- **ADR-048**: Prompt Lifecycle Contract — **Status:** accepted
+- **ADR-047**: Manuel Subagent Dispatch Protocol — **Status:** accepted
 - **ADR-046**: Brain Self-Update Hook Architecture — **Status:** accepted
-- **ADR-048**: Prompt Lifecycle Contract — Sprint 168 C0e BUG-HH eradication. .tasks/.prompt-*.txt selective cleanup via getActiveWorkerIds() shared helper. Cross-
-- **ADR-047**: Manuel Subagent Dispatch Protocol — Sprint 164-168 manuel survival pattern formal kontrat. Hardened dispatch: git worktree isolation + file authority matrix
 - **ADR-045**: Wave-Based Execution Semantics — respawnEligibleTasks Runtime Wire — **Status:** accepted
 - **ADR-043**: Brain Crash Recovery Protocol — **Status:** accepted
 - **ADR-044**: Sprint State Observability Contract — **Status:** accepted
+- **ADR-053**: TaskType Taxonomy — Audit / Document-Write / Code-Development + Extensibility Roadmap — **Status:** accepted
 - **ADR-041**: Agent Taxonomy — Horizontal Skills vs Vertical Agents — **Status:** accepted
+- **ADR-042**: Hybrid Mode Architecture — Sprint + Task Dual Modes — **Status:** accepted
 - **ADR-040**: Nervous System Architecture — Proactive Meta-Orchestrator — **Status:** accepted
 - **ADR-038**: Dead Code Disposition — Sprint 139 Audit Results — **Status:** accepted
 - **ADR-039**: Self-Modifying Task Detection — Deckent Dogfood vs User Project Discrimination — **Status:** accepted
 - **ADR-035**: Brain ↔ Worker ↔ Auditor Verification Protocol Standard (Sprint 138) — **Status:** accepted
-- **ADR-037**: Brain-Auditor-Worker Authority Matrix — RBAC Protocol V1.0 — **Status:** accepted
 - **ADR-033**: Product Vision — Product Not Service — **Status:** accepted
 - **ADR-034**: Multi-Project Isolation — Per-Project Security Boundaries — **Status:** accepted
 - **ADR-029**: Managed-Docs Universalization — Sprint Lifecycle Template-Based Document Generation — **Status:** accepted
@@ -55,6 +58,7 @@
 - **ADR-031**: Content Hash Cache — Sprint Dokümanları Hash-Based Invalidation — **Status:** accepted
 - **ADR-032**: i18n Pattern System — TR/EN İçerik Çeşitliliği Desteği — **Status:** accepted
 - **ADR-036**: ADR Governance Integration — Mandatory Architecture Decision Enforcement — **Status:** accepted
+- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-027**: Hybrid Spawn Backend (Sprint 123, Revisited Sprint 139) — **Status:** accepted
 - **ADR-025**: Graceful Shutdown Stratejisi — SIGINT → interruptActiveSprint (Sprint 076) — **Status:** accepted
 - **ADR-026**: God Object Split Stratejisi — Faz 1-3 Tamamlandı (Sprint 076) — **Status:** accepted
@@ -69,7 +73,6 @@
 - **ADR-016**: Connector Module — provider lifecycle (Sprint 044) — **Status:** accepted
 - **ADR-020**: Rich Sprint Output — 7-section summary (Sprint 044) — **Status:** accepted
 - **ADR-021**: Kraken ASCII Brand Identity (Sprint 044) — **Status:** accepted
-- **ADR-028**: Decision-Engine V1 → V2 Routing Migration — **Status:** accepted
 - **ADR-013**: DECKENT.md Adapter Pattern (Sprint 15) — **Status:** accepted
 - **ADR-001**: TypeScript + ESM — **Status:** accepted
 - **ADR-002**: Node16 Module Resolution — **Status:** accepted
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 994a90c89..e0ce18126 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,9 +14,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - run: npm run lint
 
   security:
@@ -26,9 +27,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: npm audit (high severity)
         run: npm audit --audit-level=high
         continue-on-error: true
@@ -39,7 +41,13 @@ jobs:
     needs: typecheck
     strategy:
       matrix:
-        node-version: [18.x, 20.x, 22.x]
+        # Node 18/20/22 dropped — all EOL by May 2026:
+        # - v18 EOL Apr 2025 (1+ year dead)
+        # - v20 (Iron) Maintenance EOL Mar 2026
+        # - v22 (Jod) Maintenance EOL May 2026 (this month)
+        # Active LTS = v24 (Krypton, until May 2027). v26 = Current.
+        # better-sqlite3 v12.10.0 prebuilds: v24 + v26 (v20/v23 removed).
+        node-version: [24.x, 26.x]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -47,6 +55,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run core tests
         run: npx vitest run tests/core/ tests/agents/
         timeout-minutes: 5
@@ -57,7 +66,7 @@ jobs:
     needs: typecheck
     strategy:
       matrix:
-        node-version: [18.x, 20.x, 22.x]
+        node-version: [24.x, 26.x]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -65,6 +74,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run orchestra tests
         # Orchestra suite is large (~118 test files) — historical OOM on default
         # 2GB heap. Bumped to 8GB + forks pool (isolated workers, no shared state).
@@ -80,7 +90,7 @@ jobs:
     needs: typecheck
     strategy:
       matrix:
-        node-version: [18.x, 20.x, 22.x]
+        node-version: [24.x, 26.x]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -88,6 +98,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run CLI tests
         run: npx vitest run tests/cli/
         timeout-minutes: 10
@@ -98,7 +109,7 @@ jobs:
     needs: typecheck
     strategy:
       matrix:
-        node-version: [18.x, 20.x, 22.x]
+        node-version: [24.x, 26.x]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -106,6 +117,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run remaining tests
         run: npx vitest run tests/mcp/ tests/api/ tests/integration/ tests/security/ tests/providers/ tests/monitor/ tests/skills/ tests/analytics/ tests/github/
         timeout-minutes: 10
@@ -122,9 +134,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run docs and scripts tests
         run: npx vitest run tests/docs/ tests/scripts/ --pool=forks
         timeout-minutes: 5
@@ -137,9 +150,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Install dashboard dependencies
         run: npm install --prefix src/dashboard --ignore-scripts 2>/dev/null || true
       - name: Run dashboard tests
@@ -156,9 +170,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run core tests (Windows informational)
         run: npx vitest run tests/core/ tests/agents/
         timeout-minutes: 10
@@ -172,9 +187,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Run tests with coverage
         run: npm run test:coverage
         timeout-minutes: 20
@@ -193,9 +209,10 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
       - run: npm ci
+      - run: npm run ci:rebuild-native
       - name: Install dashboard dependencies
         run: npm install --prefix src/dashboard --ignore-scripts 2>/dev/null || true
       - run: npm run build
diff --git a/.github/workflows/cross-platform-e2e.yml b/.github/workflows/cross-platform-e2e.yml
index feecbff40..db4221be3 100644
--- a/.github/workflows/cross-platform-e2e.yml
+++ b/.github/workflows/cross-platform-e2e.yml
@@ -28,10 +28,11 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: npm
 
       - run: npm ci
+      - run: npm run ci:rebuild-native
 
       - run: npm run build
 
diff --git a/.github/workflows/dashboard-build.yml b/.github/workflows/dashboard-build.yml
index 7ac03dbdb..32ed05f6f 100644
--- a/.github/workflows/dashboard-build.yml
+++ b/.github/workflows/dashboard-build.yml
@@ -33,7 +33,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18.x, 20.x, 22.x]
+        # Node 18/20/22 dropped: all EOL by May 2026. Tailwind 4 + better-
+        # sqlite3 12.10.0 prebuilds target Node 24 (Active LTS) + 26 (Current).
+        node-version: [24.x, 26.x]
     env:
       ARTIFACT_SIZE_LIMIT_BYTES: 5242880
     steps:
@@ -49,6 +51,9 @@ jobs:
       - name: Install root dependencies
         run: npm ci
 
+      - name: Rebuild native binding (better-sqlite3)
+        run: npm run ci:rebuild-native
+
       - name: Install dashboard dependencies
         run: npm install --prefix src/dashboard --ignore-scripts
 
@@ -77,7 +82,7 @@ jobs:
         run: npx vitest run tests/dashboard/dashboard-build-smoke.test.ts --config vitest.dashboard.config.ts
 
       - name: Upload dashboard artifact
-        if: matrix.node-version == '22.x'
+        if: matrix.node-version == '24.x'
         uses: actions/upload-artifact@v4
         with:
           name: dashboard-dist
@@ -97,12 +102,15 @@ jobs:
       - name: Setup Node.js 22.x
         uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
 
       - name: Install root dependencies
         run: npm ci
 
+      - name: Rebuild native binding (better-sqlite3)
+        run: npm run ci:rebuild-native
+
       - name: Install dashboard dependencies
         run: npm install --prefix src/dashboard --ignore-scripts
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a80418ce2..5206c9210 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -33,12 +33,15 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
 
       - name: Install dependencies
         run: npm ci
 
+      - name: Rebuild native binding (better-sqlite3)
+        run: npm run ci:rebuild-native
+
       - name: Install docs dependencies
         run: npm install --prefix docs
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 671d2e8f4..c06d0c80f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,13 +22,16 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: npm ci
 
+      - name: Rebuild native binding (better-sqlite3)
+        run: npm run ci:rebuild-native
+
       - name: Type check
         run: npm run lint
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a1c5b2792..dbbb4a11c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,13 +22,16 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           cache: npm
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: npm ci
 
+      - name: Rebuild native binding (better-sqlite3)
+        run: npm run ci:rebuild-native
+
       - name: Type check (lint)
         run: npm run lint
 
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index d0839d1b4..60517fd3e 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -16,6 +16,6 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
       - name: Run secret scan
         run: node scripts/security/secret-baseline.mjs
diff --git a/.gitignore b/.gitignore
index f1d8f2fea..18c20f122 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,11 +8,14 @@ coverage/
 .locks/
 .dashboard
 
-# Brain runtime (DECISIONS.md + PROJECT-IDENTITY.md are tracked)
+# Brain runtime (Memory V2 — exports/ are tracked, raw runtime files are not)
 .brain/MEMORY.md
 .brain/RETRO.md
 .brain/DEBT.md
 .brain/PATTERNS.md
+.brain/ERRORS.md
+.brain/PROJECT-IDENTITY.md
+.brain/directives-backup/
 
 # Memory V2 SQLite DB (binary, rebuilt from exports)
 .brain/memory.db
@@ -66,8 +69,16 @@ coverage/
 .deckent/sprint-*-checkpoint.json
 .deckent/sprint-*-gate.json
 .deckent/sprint-*-pre-archive.*
+.deckent/sprint-*-panic-*.json
+.deckent/sprint-*-*-result.json
+.deckent/sprint-*-subagent-prompts/
+.deckent/sprint-*-merge-runbook.sh
+.deckent/sprint-*-worktree-setup.sh
+.deckent/sprint-*-dispatch-locks.json
+.deckent/evaluations/
 .deckent/pids/
 .claude/scheduled_tasks.lock
+.claude/settings.local.json
 
 # Deckent runtime artifacts (per-sprint, ephemeral)
 .deckent/mcp-server.pid
@@ -96,3 +107,12 @@ Thumbs.db
 # Dashboard sub-project
 src/dashboard/node_modules
 src/dashboard/dist
+src/dashboard/tsconfig.tsbuildinfo
+
+# SQLite URI test artifacts (regression guard, Sprint 175)
+file:audit-idem-*
+
+# Local diagnostic outputs (test logs, npm cache, personal notes)
+.npm-cache/
+vitest-out.txt
+kendimenot.md
diff --git a/.secrets-baseline b/.secrets-baseline
index 35c7f12ed..dcee0d189 100644
--- a/.secrets-baseline
+++ b/.secrets-baseline
@@ -1,21 +1,51 @@
 {
   "_comment": "Secret scan allowlist — Sprint 169 H3. Each entry permits a specific (file, hash) match. Review on every change.",
-  "builtAt": "2026-05-14T22:24:03.865Z",
+  "builtAt": "2026-05-20T06:04:24.909Z",
   "allowlist": [
     {
-      "file": ".audit/sprint-167/T6-test-build-security.md",
+      "file": "docs/adr/README.md",
+      "pattern": "OPENAI_KEY",
+      "hash": "-fa30bf0",
+      "note": "baseline-build"
+    },
+    {
+      "file": "docs/adr/README.md",
+      "pattern": "OPENAI_KEY",
+      "hash": "-fa30bf0",
+      "note": "baseline-build"
+    },
+    {
+      "file": "docs/audits/sprint-167/T6-test-build-security.md",
       "pattern": "GITHUB_PAT",
       "hash": "-1c845370",
       "note": "baseline-build"
     },
     {
-      "file": ".audit/sprint-167/T6-test-build-security.md",
+      "file": "docs/audits/sprint-167/T6-test-build-security.md",
+      "pattern": "GOOGLE_API_KEY",
+      "hash": "-66552f6b",
+      "note": "baseline-build"
+    },
+    {
+      "file": "docs/audits/sprint-167/oss-whitelist.json",
+      "pattern": "GOOGLE_API_KEY",
+      "hash": "-66552f6b",
+      "note": "baseline-build"
+    },
+    {
+      "file": "docs/audits/sprint-171/01-modul-derin/14-extensions-scripts.md",
+      "pattern": "PRIVATE_KEY",
+      "hash": "33de280f",
+      "note": "baseline-build"
+    },
+    {
+      "file": "docs/audits/sprint-171/02-concern/03-security.md",
       "pattern": "GOOGLE_API_KEY",
       "hash": "-66552f6b",
       "note": "baseline-build"
     },
     {
-      "file": ".audit/sprint-167/oss-whitelist.json",
+      "file": "docs/audits/sprint-171/02-concern/03-security.md",
       "pattern": "GOOGLE_API_KEY",
       "hash": "-66552f6b",
       "note": "baseline-build"
diff --git a/DIRECTIVES.md b/DIRECTIVES.md
index fabf314c2..7a4315add 100644
--- a/DIRECTIVES.md
+++ b/DIRECTIVES.md
@@ -1,274 +1,378 @@
-# DIRECTIVES — Sprint 172: Doc-Reorg + OSS GA
+# DIRECTIVES — Sprint 175: Embedded Web Terminal (Sub-project #1/4)
 
 ## Spec + Plan Referansları
 
-- **Plan (bağlayıcı kontrat):** `docs/superpowers/plans/2026-05-16-sprint-172-doc-reorg-plan.md` (commit `c0678c0`) — her worker kendi Task bölümünü + aşağıdaki **Worker Contract**'ı mutlaka okur. Per-task adım/dosya/kanıt orada.
-- **Girdi:** `docs/audits/sprint-171/00-SYNTHESIS.md` §4 (ideal ağaç/dosya→hedef/ignore) + `docs/audits/sprint-171/00-VERIFICATION-LOG.md` (C-05/07, C-13, C-14, BA-03, BA-05 doğrulanmış verdict'ler).
-- **Predecessor:** Sprint 171 self-audit + manuel fix-phase (Bug A/B + C-03/C-04 + TMUX-SF FIX, BA-05 backfill `0771f6d`). Bootstrap runtime aktif.
-- **Kararlar (Alperen 2026-05-16):** 3 faz tek sprint sıralı A→C→B; EN kanonik + TR tam paralel korunur (hiçbir TR dosya silinmez/birleştirilmez); archive `git rm --cached` (disk'te kalır, geri-dönülebilir, DB-parity önce). memory.db'ye ASLA dokunulmaz.
+- **Plan (bağlayıcı kontrat):** `docs/superpowers/plans/2026-05-19-embedded-web-terminal.md` (commit `905087d`) — her worker kendi Task bölümündeki **adım/kod/kanıt/test'i** + aşağıdaki Worker Contract'ı **mutlaka** okur. Per-task tam kod orada (DIRECTIVES tekrarlamaz).
+- **Spec (doğrulanmış gerçek):** `docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md` — §1c (Step A verified), §1c.2 (auth kök-neden), §1d (VSCode dock + enterprise dikişler). Worker spec'i değiştiremez; davranış spec'e uyar.
+- **Predecessor:** Sprint 172-174 (doc-reorg + OSS GA prep + dashboard repair). Brainstorm→spec→Step A→writing-plans→systematic-debugging gate tamamlandı (Alperen onaylı).
 
 ## Goal
 
-OSS GA öncesi dokümantasyonu (A) kullanıcı-yanıltan drift'lerden arındır, (C) drift'i kalıcı önleyen auto-gen pipeline kur, (B) ideal ağaca yeniden yapılandır. **GA flip kapısı = Faz A+C tam**; Faz B GA'yı bloklamaz, paralel/sonra. Sprint 171 fix-phase bootstrap'ı onardı; bu sprint dokümantasyonu public-ready yapar.
+deckent dashboard'una VSCode-benzeri **gömülü, dock-edilebilir terminal** ekle: interaktif `claude`/`gemini`/`codex`/`deckent`/`shell` PTY oturumları, `ws` transport, tmux-benzeri reattach, **global API bypass'tan bağımsız + daha katı** localhost-default token auth (token localhost-only sayfa-enjekte → WS subprotocol), şeffaf tenant-scoped `memory.db` audit (ham PTY çıktısı ASLA persist edilmez). Enterprise/k8s **dikişleri** (`AuthProvider`/`SessionBackend`/`tenantId`) baştan konur ama implement edilmez (#3). Bu sub-project #1/4; #2-4 ayrı sprint.
 
 ## Brain Planning Instructions
 
-Mode: structured. Wave: 3 (Wave 1 = Faz A 4 paralel, Wave 2 = Faz C 3, Wave 3 = Faz B 5). Max workers: 4. `dependency_pipeline_enabled: false` → Wave geçişleri + GATE doğrulamaları Brain manuel (ADR-047, Sprint 164-171 kanıtlı). **GA-GATE-C sonrası Alperen checkpoint: public flip + beta.2 onayı** (deckent otomatik flip ETMEZ). Wave 2, GATE-A tüm DONE doğrulanmadan başlamaz; Wave 3, GATE-C doğrulanmadan başlamaz. B2 blockedBy B1 (DB-parity şart). Alperen review: sprint başlangıç (plan tablosu) + GA-GATE-C (flip) + finalize. Provider: claude.
+Mode: structured. **Self-modifying / dogfood: ZORUNLU sequential** (`src/api/` + `src/dashboard/` → `self-modifying-detector.ts` tetikler). Wave: 5 (Wave 0→4, plandaki sıra; **wave'ler ÇAKIŞMAZ, sıralı**). Max workers: 2 (sequential — paralel değil; aynı wave içinde bağımsız task'lar en fazla 2). `dependency_pipeline_enabled: false` → Wave geçişleri + GATE doğrulamaları **Brain manuel** (ADR-047, Sprint 164-174 kanıtlı). Provider: claude. Bir wave, önceki wave'in tüm task'ları DONE + GATE doğrulanmadan başlamaz. Alperen review: sprint başlangıç (bu tablo) + her wave GATE + finalize. **Build/run (npm run build:all, deckent serve, npm publish) son doğrulama Alperen'in kararı — worker çalıştırmaz** (memory: build approval).
 
 ## Worker Contract
 
-Tüm worker'lar plan dosyasındaki kendi Task bölümünü + bu Worker Contract'ı mutlaka okur. Özet invariant:
+Tüm worker'lar plan dosyasındaki kendi Task bölümünü + bu Contract'ı okur. Invariant:
 
-- **Bu sprint dosya YAZAR** (Sprint 171 audit-only değildi — bu farklı): atanan task scope'undaki .md/script/config dosyaları modify edilir. Scope DIŞINA yazma YASAK (ADR-037, auditor `git diff --stat` izler).
-- **TDD ZORUNLU (Faz C kod task'ları C1/C2/C3 + B1):** script = production kod → RED-GREEN-REFACTOR, test önce yazılır fail görülür. Faz A/B doc task'ları: kod yok, kanıt = `grep` + `npm run lint:link`/`docs:*:check` gate exit 0.
-- **Çıktı dili:** doküman içeriği OSS public için **README.md/VISION.md/CONTRIBUTING vb. = İngilizce (kanonik)**; README-TR.md/VISION-TR.md = Türkçe tam paralel. Worker raporu/notları Türkçe. Hiçbir TR dosya silinmez/birleştirilmez (Alperen kararı).
-- **memory.db kuralı:** SADECE read-only SELECT (B1 parity doğrulama). Yazma/DROP/rebuild KESİN YASAK. Archive temizliği `git rm --cached` (disk'te kalır).
-- **Kod gerçeği = tek-hakikat:** Faz A'da doc koda hizalanır (kod doğru olan yerde doc düzeltilir, davranış DEĞİŞMEZ). Yeni ADR uydurulmaz; ADR-010 amendment (supersede değil).
-- `.tasks/task-<id>.result`: `selfAssessment`, `filesChanged`, Faz C için `coverage` (test var); Faz A/B `coverage: null`.
+- **Bu sprint kod + test YAZAR** (doc değil): atanan task scope'undaki dosyalar modify/create edilir. Scope DIŞINA yazma YASAK (ADR-037, auditor `git diff --stat` izler — advisory).
+- **TDD ZORUNLU (tüm kod task'ları):** plandaki RED→GREEN→REFACTOR adımları aynen; test önce yazılır, fail görülür, sonra minimal implementasyon. Plan adımlarını atlama.
+- **ESM:** import'larda `.js` uzantısı zorunlu (Node16). Yeni runtime dep yalnız Task 0.1'de (`node-pty`, `ws`) — başka dep ekleme YASAK; ADR-010 amendment Task 0.2'de.
+- **memory.db:** SADECE additive migration (Task 1.3 `tenant_id` kolon + `audit` tip). DROP/rebuild/sil KESİN YASAK (memory: db_silmek_yasak). Schema-version + non-destructive ALTER.
+- **Güvenlik invariant'ı (spec §1c.2):** terminal WS auth `DECKENT_API_AUTH_DISABLED`'dan BAĞIMSIZ ve daha katı — bypass shell'i AÇMAZ. Token header'da değil WS subprotocol'de. Ham PTY çıktısı audit'e/diske ASLA yazılmaz.
+- **Enterprise dikişleri (spec §1d):** `AuthProvider`/`SessionBackend` interface + `tenantId` baştan; ama multi-tenant/SSO/k8s **implement EDİLMEZ** (#3). YAGNI — interface var, tek `"local"` impl.
+- `.tasks/task-<id>.result`: `selfAssessment`, `filesChanged`, `coverage` (test var — kod task'ları), `notes`.
 
 ## GO/NO_GO Criteria
 
-**Faz-gate (plan ⛔ GATE'leri):**
+**Wave-gate (Brain manuel, ADR-047):**
 
-- **GA-GATE-A:** A1-A4 commit'li; `grep` kanıtları geçer; hiçbir kod/test değişmedi (sadece .md+ADR); `npm run lint:adr` + `tsc --noEmit` temiz.
-- **GA-GATE-C / OSS FLIP:** C1-C3 commit'li; `npm run docs:stats:check && docs:ref:check && lint:link` hepsi exit 0; `prepublishOnly` gate'leri içerir. **Bu kapı geçilince public flip + beta.2 Alperen onayıyla AÇIK.**
-- **GATE-B:** B1-B5 commit'li; `lint:link`+`docs:stats:check`+`docs:ref:check`+`tsc --noEmit`+`npx vitest run` temiz; `npm pack --dry-run` temiz paket; CLAUDE.md/DECKENT.md tüm @ref geçerli.
+- **GATE-0** (Wave 0): Task 0.1-0.4 commit'li; `npm install` + `npm run lint` (tsc --noEmit) exit 0; `npm run lint:adr` exit 0; `tests/core/config-terminal.test.ts` PASS; ADR-010 amendment 2 satır + ADR-062 mevcut.
+- **GATE-1** (Wave 1): 1.1-1.4 commit'li; `npx vitest run tests/api/terminal/{auth-provider,session-backend,audit,session-manager}.test.ts` PASS; bypass-independence testi PASS; ring-buffer bound + detach≠kill + idle-reaper(deckent muaf) testleri PASS.
+- **GATE-2** (Wave 2): 2.1-2.3 commit'li; ws-gateway auth-before-bridge + reattach replay PASS; HTTP control routes PASS; serve `--host`/`--no-terminal` PASS; `npm run lint` exit 0.
+- **GATE-3** (Wave 3): 3.1-3.6 commit'li; `npm run test:dashboard` tüm yeşil; dock panel toggle/resize + multi-tab + subprotocol-token testleri PASS.
+- **GATE-4** (Wave 4): e2e reattach (disconnect→replay MARKER_ONE+TWO) PASS; `npm run lint:link`+`docs:ref`+`docs:stats` exit 0; full `npx vitest run` PASS; `npm pack --dry-run` temiz (node-pty/ws var, internal state yok).
 
-**Sprint verdict:** **GO** = 3 gate tam. **GO_WITH_TECH_DEBT** = GA-GATE-A+C tam (GA açılabilir) + GATE-B kısmi (≤2 B-task re-iterate backlog). **NO_GO** = GA-GATE-A veya C ihlali (doc-honesty/auto-gen eksik → public flip YASAK).
+**Sprint verdict:** **GO** = 5 gate tam. **GO_WITH_TECH_DEBT** = GATE-0..2 tam (backend sağlam) + GATE-3/4 kısmi (≤2 frontend/doc task re-iterate backlog). **NO_GO** = GATE-0 veya 1 ihlali (deps/ADR/config/auth çekirdeği eksik → frontend anlamsız) veya güvenlik invariant'ı ihlali (bypass shell açıyor / ham çıktı persist ediliyor → kesin NO_GO).
 
-**Kritik:** Faz B eksikliği GA'yı bloklamaz (kararla post-GA paralel). GA-blocking SADECE Faz A (honesty) + Faz C (drift-proof).
+**Kritik:** Güvenlik invariant ihlali (auth bypass-bağımlılığı veya ham-çıktı-persist) = otomatik NO_GO, tech debt KABUL EDİLMEZ (RCE yüzeyi).
 
-## Sprint 173+ Handoff
+## Sprint 176+ Handoff
 
-Post-GA: integrity-hardening V2 (C-13 RBAC hard-flip + C-14 verify-gate wire + BA-05 ADR-046 hook crash-safe — davranış-değiştiren, ayrı sprint), coverage re-audit (SYNTHESIS §5.3 ~92 potansiyel gap), AEGIS manifesto içeriği (ADR-061).
+Post-#1: sub-project #2 (self-security prosedürü — prompt/komut guard), #3 (milyon-ölçek multi-tenant izolasyon + k8s — `AuthProvider`/`SessionBackend` impl'leri buraya), #4 (enterprise dış-dünya entegrasyon). Server-restart session persistence (disk) post-#1 backlog. Her biri ayrı spec→plan→sprint.
 
 ---
 
-## Task 1: A1 — dependency_pipeline_enabled provenance drift
-
+## Task 1: W0.1 — Runtime deps (node-pty + ws)
 - Model: sonnet
-- Effort: normal
-- Skills: documentation-writer
-- Agent: doc-writer
-- Files: DECKENT.md, .contracts/api-surface.md
+- Effort: low
+- Skills: typescript-expert
+- Agent: devops-engineer
+- Files: package.json
 - Scope: ./
 
 ### Description
+Plan Task 0.1 adımları. `node-pty@^1.0.0` + `ws@^8.18.0` → dependencies; `@types/ws` → devDependencies (alfabetik). `npm install` + `npm run lint` exit 0 (kullanım yok).
 
-C-05/07 doğrulanmış doc-drift. Kod gerçeği: `config.ts:600` default `true`, `:883 ?? true`; `.deckent/config.json:198 false` (bu proje bilinçli override). `DECKENT.md:51` "Sprint 167 flip: true — Wave goes live" bu projede YANLIŞ + `api-surface.md:83` "default since Sprint 156" ile çelişen provenance. Plan Task A1 adımlarını izle: DECKENT.md:51 → kod default true + bu proje false (Brain manuel wave) açıklaması; api-surface:83 → tek doğru köken. Kod/config DEĞİŞMEZ, sadece iki doküman.
-
-**Kanıt:** `grep -n "deckent-dev bu projede bilinçli false" DECKENT.md` → eklendi; iki dosyada çelişki yok.
-
-**Test:** Doc-only — `grep` kanıtı + `tsc --noEmit` temiz (kod değişmedi teyidi).
+**Kanıt:** `node -e "const p=require('./package.json');console.log(!!p.dependencies['node-pty'],!!p.dependencies['ws'])"` → `true true`; `npm run lint` exit 0.
+**Test:** Build-only — lint exit 0 (TDD yok, sadece dep ekleme).
 
 ---
 
-## Task 2: A2 — RBAC + verify-gate enforcement honesty
-
+## Task 2: W0.2 — ADR-010 amendment ext + ADR-062
 - Model: sonnet
 - Effort: normal
 - Skills: system-architect, documentation-writer
 - Agent: architect
-- Files: CLAUDE.md, .deckent/workspace/IDENTITY.md, .claude/rules/worker-default.md
-- Scope: ./
+- Files: docs/adr/010-tek-runtime-dependency-commander-js.md, docs/adr/062-embedded-web-terminal.md
+- Scope: docs/adr/
 
 ### Description
+Plan Task 0.2. Mevcut Sprint-172 Amendment tablosuna 2 satır ekle (ws, node-pty → ADR-062 map, mevcut desen). ADR-062 oluştur (ADR-061 yapısı, MADR hibrit, status accepted): PtySessionManager+ws gateway+AuthProvider/SessionBackend interface; güvenlik = localhost-default, token bypass-bağımsız+daha katı (B-022 hizalı), localhost sayfa-enjekte→WS subprotocol; tenant-scoped audit, ham çıktı persist edilmez; reattack server-restart sınırı; multi-tenant/k8s #3'e ertelenir. `npm run lint:adr` exit 0, non-destructive DB sync.
 
-C-13 + C-14 doğrulanmış. `authority-enforcer.ts:29` "always soft", `worker.ts:480 return true`, ADR-037 `decisions.md:1825` runtime eksik kabul; `enforceVerifyLoop`/`runTestVerifyLoop` 0-caller. Doküman bunu "runtime enforcement" diye abartıyor. Plan Task A2: CLAUDE.md gotcha + IDENTITY → "RBAC compile-time lint + audit-trail; runtime advisory/soft (ADR-037 V1.0 Layer-2 kasıtlı eksik, hard-flip V2)"; worker-default verify → "prompt talimatı, kod-enforce değil". Kod/test DEĞİŞMEZ (hard-flip post-GA V2).
+**Kanıt:** ADR-010'da ws+node-pty satırları; `docs/adr/062-embedded-web-terminal.md` mevcut; `npm run lint:adr` exit 0.
+**Test:** Doc — `npm run lint:adr` exit 0.
 
-**Kanıt:** `grep -ni "runtime enforcement" CLAUDE.md .deckent/workspace/IDENTITY.md` → her geçiş "soft/advisory" niteleyicili.
+---
 
-**Test:** Doc-only — grep kanıtı; kod/test değişmedi (`git diff --stat src/ tests/` boş).
+## Task 3: W0.3 — TerminalConfig → DeckentConfig
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert
+- Agent: refactorer
+- Files: src/core/config.ts, src/core (DeckentConfig tip dosyası), tests/core/config-terminal.test.ts
+- Scope: src/core/, tests/core/, ./
 
----
+### Description
+Plan Task 0.3 (TDD). RED: `tests/core/config-terminal.test.ts` (terminal defaults) fail. GREEN: gerçek `TerminalConfig` interface + `DeckentConfig.terminal` (intersection bolt-on DEĞİL — mevcut `dependency_pipeline_enabled` tip-borcunu tekrarlama); `DEFAULT_CONFIG` + nested merge (`model_strategy` deseni). Defaults: enabled true, bind 127.0.0.1, maxSessions 10, idleTimeoutMs 1_800_000, scrollbackBytes 262_144, allowShellKind true.
 
-## Task 3: A3 — ADR-010 amendment (7 runtime dep)
+**Kanıt:** `npx vitest run tests/core/config-terminal.test.ts` PASS (RED→GREEN izlendi); `npm run lint` exit 0.
+**Test:** TDD — defaults + override-merge 2+ test.
+
+---
 
+## Task 4: W0.4 — Shared terminal types
 - Model: sonnet
-- Effort: normal
-- Skills: system-architect
-- Agent: architect
-- Files: docs/adr/010-tek-runtime-dependency.md
-- Scope: docs/adr/
+- Effort: low
+- Skills: typescript-expert
+- Agent: refactorer
+- Files: src/api/terminal/types.ts
+- Scope: src/api/terminal/, ./
 
 ### Description
+Plan Task 0.4. `TenantId`/`SessionKind`/`AiTool`/`CreateSessionInput`/`SessionMeta`/`AuditAction`/`AuditEvent` (plandaki tam tanımlar). `tenantId` tüm yapılarda baştan (enterprise dikişi). `npm run lint` exit 0.
 
-BA-03 doğrulanmış: package.json 7 runtime dep, ADR-010 metni "yalnızca commander" (Sprint 044 CLI-only kalıntısı). Plan Task A3: ADR-010'a **Amendment** bölümü ekle (supersede DEĞİL — accepted kalır) — 7 dep'in her biri sonraki accepted ADR'ye map'li (@modelcontextprotocol/sdk←ADR-017, better-sqlite3←Memory V2, telegraf/discord←ADR-016, zod←plan validation, @noble←ADR-014). Güncel ilke: minimal + ADR-gerekçeli; keyfi ekleme hâlâ yasak. DB adr-010 entry ile tutarlı (kanonik DB ise MemoryStore upsert).
+**Kanıt:** `src/api/terminal/types.ts` mevcut, plandaki tüm tipler export; `npm run lint` exit 0.
+**Test:** Type-only — tsc --noEmit exit 0 (TDD yok, saf tip modülü).
 
-**Kanıt:** ADR-010 Amendment'ta 7 dep ADR-map'li; `npm run lint:adr` geçer.
+---
 
-**Test:** Doc-only — `npm run lint:adr` exit 0.
+## Task 5: W1.1 — AuthProvider (bypass-independent)
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert, security-specialist
+- Agent: security-auditor
+- Files: src/api/terminal/auth-provider.ts, tests/api/terminal/auth-provider.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-004"]
 
----
+### Description
+Plan Task 1.1 (TDD). RED: 4 test (doğru/yanlış/boş token + **DECKENT_API_AUTH_DISABLED=1 iken yanlış token RED**). GREEN: `AuthProvider` interface + `LocalTokenAuthProvider` (SHA-256 + `timingSafeEqual`, env bypass'ı KASITLI yok-sayar — spec §1c.2). Güvenlik invariant.
 
-## Task 4: A4 — README 5-drift badge gerçek değer
+**Kanıt:** `npx vitest run tests/api/terminal/auth-provider.test.ts` PASS (4); bypass-independence testi yeşil.
+**Test:** TDD — 4 test (RED→GREEN).
 
-- Model: sonnet
+---
+
+## Task 6: W1.2 — SessionBackend + LocalPtyBackend
+- Model: opus
 - Effort: normal
-- Skills: documentation-writer
-- Agent: doc-writer
-- Files: README.md, README-TR.md
-- Scope: ./
+- Skills: typescript-expert
+- Agent: api-builder
+- Files: src/api/terminal/session-backend.ts, tests/api/terminal/session-backend.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-001","175-004"]
 
 ### Description
+Plan Task 1.2 (TDD). RED: gerçek `bash -c echo` spawn → output + exit test fail. GREEN: `SessionBackend` interface + `LocalPtyBackend` (node-pty spawn/write/resize/kill, plandaki tam kod). Enterprise dikişi: interface (remote/k8s #3).
 
-C-41/BD-01 doğrulanmış: README "16434+ tests / dashboard pages / 27 MCP tools / 60+ ADR / custom+2 agent" 5 drift bir arada (OSS ilk-vitrin yanılgı). Plan Task A4: gerçek değerleri komutla topla (vitest gerçek pass, `ls src/dashboard/pages`, `grep -c registerTool src/mcp/server.ts`, `getByType('adr').length`, `ls .deckent/agents`), README.md + README-TR.md senkron düzelt (EN kanonik, TR paralel — karar). Manuel düzeltme = Faz C auto-gen'e köprü.
+**Kanıt:** `npx vitest run tests/api/terminal/session-backend.test.ts` PASS (hello-pty + exitCode 0).
+**Test:** TDD — spawn/stream/exit 1+ test.
 
-**Kanıt:** README.md her sayı Step 1 komut çıktısıyla eşleşir; README-TR.md senkron.
+---
 
-**Test:** Doc-only — sayı↔komut eşleşme kanıtı.
+## Task 7: W1.3 — TerminalAudit (tenant-scoped DB)
+- Model: opus
+- Effort: normal
+- Skills: typescript-expert, database-migration
+- Agent: data-engineer
+- Files: src/api/terminal/audit.ts, src/core/memory-store.ts, src/core/memory-types.ts, tests/api/terminal/audit.test.ts
+- Scope: src/api/terminal/, src/core/, tests/api/terminal/
+- Dependencies: ["175-004"]
 
----
+### Description
+Plan Task 1.3 (TDD). RED: structured event + ham-çıktı-yok testi fail. GREEN: MemoryStore additive `tenant_id TEXT` kolon (schema-version migration, NON-destructive ALTER — DROP/rebuild YASAK) + `audit` tip; `TerminalAudit.record()` (plandaki kod). Ham PTY çıktısı ASLA geçirilmez (güvenlik invariant).
+
+**Kanıt:** `npx vitest run tests/api/terminal/audit.test.ts` PASS; content ANSI/raw içermez; `npm run lint` exit 0; migration additive.
+**Test:** TDD — structured-write + no-raw 2+ test.
 
-## Task 5: C1 — update-readme-stats.mjs auto-gen + CI gate
+---
 
+## Task 8: W1.4 — PtySessionManager
 - Model: opus
 - Effort: high
-- Skills: typescript-expert, ci-testing
-- Agent: devops-engineer
-- Files: scripts/update-readme-stats.mjs, README.md, README-TR.md, .deckent/workspace/IDENTITY.md, package.json, tests/scripts/update-readme-stats.test.ts
-- Scope: scripts/, tests/scripts/, ./
+- Skills: typescript-expert
+- Agent: api-builder
+- Files: src/api/terminal/session-manager.ts, tests/api/terminal/session-manager.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-006","175-004"]
 
 ### Description
+Plan Task 1.4 (TDD). RED: 4 test (ring-buffer bound, detach≠kill, maxSessions, idle-reaper deckent-muaf). GREEN: `PtySessionManager` (plandaki tam kod — Map, bounded ring, attach/detach, kill, reapIdle deckent exempt).
 
-Plan Task C1 (TDD ZORUNLU). RED: `--check` stale badge'de exit≠0 testi (script yok → fail). GREEN: script gerçek kaynaklardan okur (vitest count, dashboard pages, registerTool, ADR DB, agents), README/README-TR/IDENTITY'deki `<!-- AUTOGEN:stat -->` bloklarını değiştirir; `--check`/`--write` modları. A4 manuel değerleri marker içine alınır. package.json `docs:stats`/`docs:stats:check` + `prepublishOnly --check`.
+**Kanıt:** `npx vitest run tests/api/terminal/session-manager.test.ts` PASS (4); detach kill çağırmıyor, deckent reaper'dan muaf.
+**Test:** TDD — 4 test (RED→GREEN).
 
-**Kanıt:** `npm run docs:stats:check` exit 0; `tests/scripts/update-readme-stats.test.ts` PASS (RED→GREEN izlendi).
+---
 
-**Test:** TDD — stale-fail + güncel-pass + marker-replace 3+ test.
+## Task 9: W2.1 — WS gateway (auth-before-bridge + reattach)
+- Model: opus
+- Effort: high
+- Skills: typescript-expert, security-specialist
+- Agent: api-builder
+- Files: src/api/terminal/ws-gateway.ts, tests/api/terminal/ws-gateway.test.ts
+- Scope: src/api/terminal/, tests/api/terminal/
+- Dependencies: ["175-005","175-008","175-007"]
 
----
+### Description
+Plan Task 2.1 (TDD). RED: (a) geçersiz subprotocol token → upgrade RED, **session spawn YOK**; (b) geçerli token → attach + buffer replay. GREEN: `attachTerminalGateway` (plandaki kod — `server.on('upgrade')`, token `Sec-WebSocket-Protocol`'den, auth BRIDGE'DEN ÖNCE, backpressure, detach≠kill, `handleProtocols` ayarı). Güvenlik invariant: auth fail → spawn yok.
+
+**Kanıt:** `npx vitest run tests/api/terminal/ws-gateway.test.ts` PASS (2); kötü token close 4401/spawn yok.
+**Test:** TDD — reject-before-spawn + accept+replay 2+ test.
 
-## Task 6: C2 — reference docs auto-gen (MCP/ADR/CLI/agents)
+---
 
+## Task 10: W2.2 — HTTP control + localhost bootstrap inject
 - Model: opus
 - Effort: high
-- Skills: typescript-expert, api-builder
+- Skills: typescript-expert
 - Agent: api-builder
-- Files: scripts/gen-reference-docs.mjs, docs/reference/mcp-tools.md, docs/reference/mcp-resources.md, docs/adr/README.md, docs/reference/cli.md, docs/reference/agents.md, package.json, tests/scripts/gen-reference-docs.test.ts
-- Scope: scripts/, tests/scripts/, docs/reference/, docs/adr/, ./
+- Files: src/api/server.ts, tests/api/terminal/server-routes.test.ts
+- Scope: src/api/, tests/api/terminal/
+- Dependencies: ["175-009","175-003"]
 
 ### Description
+Plan Task 2.2. `createHttpServer`'a: cfg.terminal.enabled ise manager+audit+auth kur (`auth = LocalTokenAuthProvider(finalToken ?? randomUUID())` — terminal HER ZAMAN token, API auth kapalı olsa bile), `attachTerminalGateway`, idle reaper interval (close'da temizle); `GET/POST /api/terminal/sessions` + `DELETE /:id` (mevcut Bearer middleware AFTER); **localhost-only** (`req.socket.remoteAddress` 127.0.0.1/::1) index.html'e `window.__DECKENT_TERMINAL_TOKEN__` enjekte; `api.terminalToken` test-expose.
 
-Plan Task C2 (TDD). RED: `--check` stale fail testi. GREEN: 5 üretici — MCP tools (`server.ts` registerTool parse), MCP resources, ADR index (`store.getByType('adr')` tablo), CLI (`commander` introspect), agents (DB/.deckent/agents). `--check` CI gate + `--write`. package.json `docs:ref`/`docs:ref:check` + prepublishOnly. Üretilen sayılar Faz A değerleriyle tutarlı.
+**Kanıt:** `npx vitest run tests/api/terminal/server-routes.test.ts` PASS (create 201/list/delete); `npm run lint` exit 0.
+**Test:** TDD — CRUD + localhost-inject 2+ test.
 
-**Kanıt:** `npm run docs:ref:check` exit 0; test PASS; mcp-tools.md sayısı `grep -c registerTool` ile eşleşir.
+---
+
+## Task 11: W2.3 — serve CLI surface
+- Model: sonnet
+- Effort: normal
+- Skills: typescript-expert
+- Agent: devops-engineer
+- Files: src/cli/commands/serve.ts, tests/cli/serve-terminal.test.ts
+- Scope: src/cli/, tests/cli/
+- Dependencies: ["175-010"]
+
+### Description
+Plan Task 2.3 (TDD). RED: `--host`/`--no-terminal` opsiyon yok testi fail. GREEN: `.option('--host <addr>','Bind address','127.0.0.1')` + `.option('--no-terminal',...)`; createHttpServer'a geçir; `--host` non-localhost + token yok → stderr warning + terminal'i ETKİNLEŞTİRME (spec §5).
 
-**Test:** TDD — 5 üretici × stale-fail/güncel-pass; 5+ test.
+**Kanıt:** `npx vitest run tests/cli/serve-terminal.test.ts` PASS; opsiyonlar mevcut.
+**Test:** TDD — opsiyon-varlık + remote-refuse 2+ test.
 
 ---
 
-## Task 7: C3 — lint:link dead-link gate
+## Task 12: W3.1 — xterm deps + terminal-api
+- Model: sonnet
+- Effort: normal
+- Skills: react-specialist, typescript-expert
+- Agent: frontend-designer
+- Files: src/dashboard/package.json, src/dashboard/src/lib/terminal-api.ts, tests/dashboard/terminal/terminal-api.test.ts
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-010"]
+
+### Description
+Plan Task 3.1 (TDD). `@xterm/xterm@^5.5.0`+`@xterm/addon-fit@^0.10.0` devDeps (ADR-010 etkilenmez — frontend devDep). RED: terminal-api modül-yok fail. GREEN: `getBootstrapToken`/`createSession`/`listSessions`/`killSession` (plandaki kod).
+
+**Kanıt:** `npm run test:dashboard -- terminal-api` PASS; bootstrap-token + create POST.
+**Test:** TDD — token-read + create 2+ test.
+
+---
 
+## Task 13: W3.2 — useTerminalSocket
 - Model: opus
 - Effort: high
-- Skills: typescript-expert, devops-engineer
-- Agent: devops-engineer
-- Files: scripts/lint-links.mjs, docs/.vitepress/config.ts, package.json, tests/scripts/lint-links.test.ts
-- Scope: scripts/, tests/scripts/, docs/.vitepress/, ./
+- Skills: react-specialist, typescript-expert
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/terminal/useTerminalSocket.ts, tests/dashboard/terminal/useTerminalSocket.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-012"]
 
 ### Description
+Plan Task 3.2 (TDD). RED: WS `deckent.<token>` subprotocol + attach gönderimi fail. GREEN: `useTerminalSocket` (plandaki kod — subprotocol token, onopen→attach, reconnect backoff→reattach, input/resize send).
 
-Plan Task C3 (TDD). RED: script kırık relatif .md link'te exit≠0 (mevcut kırık link'ler — SYNTHESIS Wave 4). GREEN: `lint-links.mjs` (relatif link + anchor doğrula), `config.ts` `ignoreDeadLinks:false`, package.json `lint:link`. Mevcut kırık link'ler düzeltilir (bu gate Faz B taşımalarını korur — B3/B4 ön-koşulu).
-
-**Kanıt:** `npm run lint:link` exit 0 (mevcut kırıklar düzeltildi); test PASS.
-
-**Test:** TDD — kırık-link-fail + temiz-pass + anchor 3+ test.
+**Kanıt:** `npm run test:dashboard -- useTerminalSocket` PASS; protocols `['deckent.tk']`, attach gönderiliyor.
+**Test:** TDD — subprotocol+attach 1+ test.
 
 ---
 
-## Task 8: B1 — archive DB-parity doğrulama (B2 ön-koşulu)
-
+## Task 14: W3.3 — TerminalView (xterm)
 - Model: opus
 - Effort: normal
-- Skills: database-migration
-- Agent: data-engineer
-- Files: scripts/verify-archive-db-parity.mjs, docs/audits/sprint-171/archive-parity-report.md
-- Scope: scripts/, docs/audits/sprint-171/
+- Skills: react-specialist
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/terminal/TerminalView.tsx, tests/dashboard/terminal/TerminalView.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-013"]
 
 ### Description
+Plan Task 3.3 (TDD). RED: container render fail (xterm/fit mock'lu). GREEN: `TerminalView` (plandaki kod — Terminal+FitAddon, onData→socket, ResizeObserver→fit+resize, dispose cleanup).
 
-Plan Task B1. Read-only script: her `.brain/archive/sprint-*.md` + `retro-sprint-*.md` için DB'de karşılık (store sprint/retro entry) var mı (read-only SELECT, BA-05 backfill sonrası 167 dahil). Rapor: parity-OK vs DB-eksik liste. **DB-eksik HİÇBİR dosya git rm edilmez** (önce backfill — BA-05 deseni). memory.db SADECE read-only.
+**Kanıt:** `npm run test:dashboard -- TerminalView` PASS; `[data-terminal="s1"]` render.
+**Test:** TDD — render 1+ test.
 
-**Kanıt:** `node scripts/verify-archive-db-parity.mjs` → "N parity-OK, M eksik" raporu; M dosyaları B2 kapsamı dışı.
+---
 
-**Test:** Read-only script — parity raporu doğruluğu (örnek dosya DB-lookup spot-check).
+## Task 15: W3.4 — TerminalTabs + TerminalPanel
+- Model: opus
+- Effort: high
+- Skills: react-specialist
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/terminal/TerminalTabs.tsx, src/dashboard/src/components/terminal/TerminalPanel.tsx, tests/dashboard/terminal/TerminalPanel.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-014"]
+
+### Description
+Plan Task 3.4 (TDD). RED: shell quick-launch yeni sekme fail. GREEN: `TerminalTabs` (5 kind quick-launch claude/gemini/codex/deckent/shell + close) + `TerminalPanel` (multi-tab state, create/kill, active view) — plandaki tam kod.
+
+**Kanıt:** `npm run test:dashboard -- TerminalPanel` PASS; shell launch → view:s-new.
+**Test:** TDD — quick-launch 1+ test.
 
 ---
 
-## Task 9: B2 — .gitignore/.npmignore + archive git rm --cached
+## Task 16: W3.5 — DockPanel + Layout
+- Model: opus
+- Effort: high
+- Skills: react-specialist, frontend-design
+- Agent: frontend-designer
+- Files: src/dashboard/src/components/DockPanel.tsx, src/dashboard/src/components/Layout.tsx, tests/dashboard/terminal/DockPanel.test.tsx
+- Scope: src/dashboard/, tests/dashboard/
+- Dependencies: ["175-015"]
 
+### Description
+Plan Task 3.5 (TDD). RED: toggle aç/kapa görünürlük fail. GREEN: `DockPanel` (VSCode-benzeri sabit-alt, toggle, ns-resize, plandaki kod) + `Layout.tsx`'e `<DockPanel><TerminalPanel/></DockPanel>` (Outlet DIŞINDA — route'lar arası kalıcı) + main scroll `pb-8`. Runtime @ref/route kırılmaz (doğrula).
+
+**Kanıt:** `npm run test:dashboard -- DockPanel` PASS; `npm run test:dashboard` tümü yeşil; toggle çalışıyor.
+**Test:** TDD — toggle 1+ test + tüm dashboard suite yeşil.
+
+---
+
+## Task 17: W3.6 — ConfigPage Terminal kategori + i18n
 - Model: sonnet
 - Effort: normal
-- Skills: git-expert, devops-engineer
-- Agent: devops-engineer
-- Files: .gitignore, .npmignore
-- Scope: ./
-- Dependencies: ["172-008"]
+- Skills: react-specialist, documentation-writer
+- Agent: frontend-designer
+- Files: src/dashboard/src/pages/ConfigPage.tsx, src/dashboard/src/i18n/en.ts, src/dashboard/src/i18n/tr.ts
+- Scope: src/dashboard/
 
 ### Description
+Plan Task 3.6 (data-only). `CONFIG_FIELDS`'a 5 terminal alanı (enabled/allowShellKind/maxSessions/idleTimeoutMs/scrollbackBytes, category "Terminal"), `CATEGORIES`+`CATEGORY_KEY_MAP`, en/tr i18n key. Drift yok (mevcut dinamik kategori sistemi).
 
-Plan Task B2 (B1 parity ŞART). `.gitignore`'a SYNTHESIS §4.3 blok; `.npmignore` oluştur (§4.3 npmignore). `git rm --cached -r` SADECE B1 parity-OK + ignore kapsamı (dosyalar DİSKTE KALIR). memory.db ASLA. `npm pack --dry-run` temiz paket doğrula.
-
-**Kanıt:** `npm pack --dry-run` internal state yok + boyut düştü; `ls .brain/archive | head` dosyalar diskte; `git status` temiz.
-
-**Test:** Doc/git-only — `npm pack --dry-run` çıktı + disk-mevcudiyet kanıtı.
+**Kanıt:** `npm run test:dashboard` yeşil; `npm run lint` exit 0; ConfigPage'de Terminal kategorisi.
+**Test:** Data-only — dashboard suite yeşil (mevcut ConfigPage testleri kırılmaz).
 
 ---
 
-## Task 10: B3 — kök → docs/ taşıma + redirect
-
-- Model: sonnet
+## Task 18: W4.1 — E2E reattach integration
+- Model: opus
 - Effort: high
-- Skills: documentation-writer, git-expert
-- Agent: doc-writer
-- Files: docs/vision/, docs/release/, docs/reference/, CLAUDE.md, DECKENT.md
-- Scope: docs/, ./
-- Dependencies: ["172-007"]
+- Skills: typescript-expert, testing-expert
+- Agent: api-builder
+- Files: tests/api/terminal/e2e-reattach.test.ts
+- Scope: tests/api/terminal/
+- Dependencies: ["175-009","175-008"]
 
 ### Description
+Plan Task 4.1. Gerçek pty + gerçek ws: attach→input→disconnect→(disconnected iken mgr.write)→reconnect→attach→replay MARKER_ONE+MARKER_TWO. Reattach client-disconnect'e dayanır (server-restart DEĞİL — spec sınırı).
 
-Plan Task B3 (C3 lint:link gate aktif olmalı). git mv per SYNTHESIS §4.2: BETA-TRACKER→docs/release/, COMPETITIVE-ANALYSIS→docs/vision/, ROADMAP-GOD-LEVEL(root+docs)→docs/vision/roadmap.md (birleştir), BLUEPRINT/MASTER-BLUEPRINT→docs/vision/blueprint.md, VISION.md+VISION-TR.md→docs/vision/ (**TR korunur**), .contracts/api-surface.md→docs/reference/ (CLAUDE.md @ref güncelle). Sil: NEXT-SESSION.md, next-session-prompt.md, docs/analysis/full-audit.md. Redirect: docs/CHANGELOG.md→root, docs/launch/CONDUCT.md→root. Her taşımada `npm run lint:link`.
-
-**Kanıt:** `npm run lint:link` exit 0 (0 kırık); CLAUDE.md/DECKENT.md @ref'leri geçerli (`grep @.contracts` güncellenmiş).
-
-**Test:** Doc-only — lint:link gate + @ref geçerlilik.
+**Kanıt:** `npx vitest run tests/api/terminal/e2e-reattach.test.ts` PASS; replay her iki MARKER'ı içerir.
+**Test:** Integration — 1 e2e test (full pipeline).
 
 ---
 
-## Task 11: B4 — worker-guide 3→1 + ADR-046 dup merge + reference rename
-
+## Task 19: W4.2 — Docs (guide EN+TR + reference)
 - Model: sonnet
-- Effort: high
+- Effort: normal
 - Skills: documentation-writer
 - Agent: doc-writer
-- Files: docs/guide/workers.md, docs/adr/, docs/reference/
-- Scope: docs/, .deckent/workspace/
-- Dependencies: ["172-007"]
+- Files: docs/guide/terminal.md, docs/guide/terminal-tr.md, docs/reference/ (regen)
+- Scope: docs/
 
 ### Description
+Plan Task 4.2. `docs/guide/terminal.md` (EN kanonik): ne olduğu, güvenlik modeli (localhost-default, token auto-inject, bypass-bağımsız, remote=explicit --host+token+kullanıcı-TLS), audit timeline, reattach + server-restart sınırı, config key'leri. `docs/guide/terminal-tr.md` TR paralel (TR dosya silinmez — proje kuralı). `npm run docs:ref && docs:stats && lint:link` exit 0.
 
-Plan Task B4. 3 worker-guide (docs/development/, docs/, .deckent/workspace/WORKER-GUIDE.md) → docs/guide/workers.md canonical; workspace 1-satır refer (runtime @ref kırılmaz — doğrula). ADR-046 iki dosya → tek + Amendment section, DB adr-046 tutarlı. 3 reference çifti lowercase rename + link fix. Her adımda `npm run lint:link`.
-
-**Kanıt:** `lint:link` exit 0; ADR-046 tek dosya; DB↔FS ADR parity; workspace @ref runtime kırılmadı.
-
-**Test:** Doc-only — lint:link + ADR-046 tekillik + @ref runtime smoke.
+**Kanıt:** iki guide mevcut; `npm run lint:link` exit 0; reference regen temiz.
+**Test:** Doc — lint:link + docs:*:check exit 0.
 
 ---
 
-## Task 12: B5 — deckent-hub kararı + examples workspace fix
-
+## Task 20: W4.3 — Final verification
 - Model: sonnet
 - Effort: normal
-- Skills: monorepo-expert
-- Agent: refactorer
-- Files: examples/quickstart/package.json
-- Scope: examples/, ./
+- Skills: ci-testing
+- Agent: ci-guardian
+- Files: (verification-only — fix gerekirse ilgili dosya)
+- Scope: ./
 
 ### Description
+Plan Task 4.3 Step 1+3. Tüm gate: `npm run lint` · `npx vitest run` · `npm run test:dashboard` · `npm run lint:adr` · `npm run lint:link` · `npm pack --dry-run` — hepsi exit 0/PASS, node-pty/ws pakette, internal state yok. **Step 2 manuel smoke (build:all/serve) Alperen'in — worker ÇALIŞTIRMAZ** (memory: build approval); worker yalnız non-build gate'leri koşar, fix'leri commit'ler.
 
-Plan Task B5. `examples/quickstart/package.json` `workspace:*` → `^1.0.0-beta.1` (OSS'te workspace protokolü çözülmez). deckent-hub disposition (SYNTHESIS "karar" flag): git submodule mi inline+pubkey mi — **Alperen mini-onay gerekli** (worker bu kararı VERMEZ, checkpoint question yazar, otonom ilerlemez).
-
-**Kanıt:** examples/quickstart/package.json `^1.0.0-beta.1`; deckent-hub kararı Alperen checkpoint'e bağlı (worker önermez, sorar).
-
-**Test:** Doc/config-only — package.json geçerli JSON + version resolve smoke.
+**Kanıt:** 5 otomatik gate exit 0/PASS; `npm pack --dry-run` çıktısı temiz.
+**Test:** Verification — tüm otomatik gate yeşil (build/serve hariç — Alperen).
diff --git a/README-TR.md b/README-TR.md
index a889b0792..d4343ed6b 100644
--- a/README-TR.md
+++ b/README-TR.md
@@ -5,7 +5,7 @@
 **Disiplin isteyen geliştiriciler için AI orkestratör.**
 
 <!-- AUTOGEN:START id="badges" -->
-[![npm version](https://img.shields.io/npm/v/deckent.svg)](https://www.npmjs.com/package/deckent) [![tests](https://img.shields.io/badge/tests-16697%2B-brightgreen)](https://github.com/VerhexIO/deckent) [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![sprints](https://img.shields.io/badge/sprints-172%2B-teal)](https://github.com/VerhexIO/deckent) [![version](https://img.shields.io/badge/version-v1.0.0--beta.1-orange)](https://github.com/VerhexIO/deckent)
+[![npm version](https://img.shields.io/npm/v/deckent.svg)](https://www.npmjs.com/package/deckent) [![tests](https://img.shields.io/badge/tests-16774%2B-brightgreen)](https://github.com/VerhexIO/deckent) [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![sprints](https://img.shields.io/badge/sprints-175%2B-teal)](https://github.com/VerhexIO/deckent) [![version](https://img.shields.io/badge/version-v1.0.0--beta.1-orange)](https://github.com/VerhexIO/deckent)
 <!-- AUTOGEN:END id="badges" -->
 
 Deckent, iki modlu bir AI agent orkestrasyon CLI'dir: geliştiriciler için yapılandırılmış çok-agent sprint'leri sunan **Sprint Mode** ve tek seferlik yaşam asistanı görevleri için **Task Mode**. Hedeflerinizi yazın; Deckent görevleri planlar, paralel AI worker'lar atar, kaliteyi izler ve sonuçları disiplinle teslim eder.
@@ -43,6 +43,7 @@ deckent run "Günün sonuna kadar PR'ı gözden geçirmeyi hatırlat"
 
 ## Öne Çıkanlar
 
+- **Gömülü Web Terminali (Sprint 175, ADR-062)** — Dashboard içinde VSCode-benzeri dock-edilebilir terminal paneli. Çoklu sekme ile interaktif `claude` / `gemini` / `codex` / `deckent` / shell oturumları WebSocket üzerinden, browser refresh'i sonrası tmux-vari reattach, localhost-default + global API bypass'tan bağımsız ve daha katı auth, şeffaf tenant-scoped audit (ham PTY çıktısı asla persist edilmez). Bkz. [`docs/guide/terminal-tr.md`](docs/guide/terminal-tr.md). Alt-proje #1/4 — self-security, multi-tenant/k8s ve enterprise entegrasyonlar ayrı sprint'lerde gelir.
 - **Brain Self-Update Hook Mimarisi (ADR-046)** — post-finalize hook zinciri (memoryExport → adrInsert → ruleRegen → updateProjectDocs) resmi olarak tanımlı ve zorunlu.
 - **Veri bütünlüğü** — debt satırları `sprint_id` taşır, sprint memory kayıtları geri yüklendi ve 3 katmanlı doc-sync ground-truth kontrolü agent sayısı sapmalarını engeller.
 
diff --git a/README.md b/README.md
index d366592e9..34e197a80 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,13 @@
+<p align="center">
+  <img src="docs/assets/logo.png" width="140" alt="Deckent — circuit kraken emblem" />
+</p>
+
 # deckent
 
 **The AI orchestrator for developers who want discipline.**
 
 <!-- AUTOGEN:START id="badges" -->
-[![npm version](https://img.shields.io/npm/v/deckent.svg)](https://www.npmjs.com/package/deckent) [![tests](https://img.shields.io/badge/tests-16697%2B-brightgreen)](https://github.com/VerhexIO/deckent) [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![sprints](https://img.shields.io/badge/sprints-172%2B-teal)](https://github.com/VerhexIO/deckent) [![version](https://img.shields.io/badge/version-v1.0.0--beta.1-orange)](https://github.com/VerhexIO/deckent)
+[![npm version](https://img.shields.io/npm/v/deckent.svg)](https://www.npmjs.com/package/deckent) [![tests](https://img.shields.io/badge/tests-16774%2B-brightgreen)](https://github.com/VerhexIO/deckent) [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![sprints](https://img.shields.io/badge/sprints-175%2B-teal)](https://github.com/VerhexIO/deckent) [![version](https://img.shields.io/badge/version-v1.0.0--beta.1-orange)](https://github.com/VerhexIO/deckent)
 <!-- AUTOGEN:END id="badges" -->
 
 Deckent is an AI agent orchestration CLI with two modes: **Sprint Mode** for structured multi-agent development sprints, and **Task Mode** for one-shot life assistant tasks. Write your goals, and Deckent plans tasks, assigns parallel AI workers, monitors quality, and delivers results — all with discipline.
@@ -24,13 +28,15 @@ Deckent is an AI agent orchestration CLI with two modes: **Sprint Mode** for str
 ## Quick Start
 
 ```bash
-npm install -g deckent
+# No global install needed:
+npx deckent@latest init          # detects + (with consent) installs missing CLIs
+# or: npm install -g deckent && deckent init
 
 # Developer workflow (Sprint Mode)
-deckent init
 deckent mode sprint
 # Edit DIRECTIVES.md with your goals, then:
 deckent start
+deckent web                      # open the web dashboard at http://localhost:3100
 
 # Life assistant (Task Mode)
 deckent mode task
@@ -41,6 +47,7 @@ deckent run "Remind me to review the PR before end of day"
 
 ## Highlights
 
+- **Embedded Web Terminal (Sprint 175, ADR-062)** — VSCode-like dockable terminal panel inside the dashboard. Multi-tab interactive `claude` / `gemini` / `codex` / `deckent` / shell sessions over WebSocket, tmux-style reattach across browser refreshes, localhost-default with auth that is independent of and stricter than the global API bypass, transparent tenant-scoped audit (raw PTY output never persisted). See [`docs/guide/terminal.md`](docs/guide/terminal.md). Sub-project #1/4 — self-security, multi-tenant/k8s, and enterprise integrations follow in dedicated sprints.
 - **Brain Self-Update Hook Architecture (ADR-046)** — post-finalize hook chain (memoryExport → adrInsert → ruleRegen → updateProjectDocs) is formally specified and enforced.
 - **Data integrity** — debt rows carry `sprint_id`, sprint memory entries are restored, and a 3-layer doc-sync ground-truth check blocks agent-count drift.
 
@@ -215,19 +222,24 @@ See the [full competitive analysis](docs/analysis/competitive-analysis.md) for d
 
 **Claude Subscription:** Pro, Max 5x, Max 20x, or API key (pay-as-you-go). Codex and Gemini are integrated through their own CLIs (`codex`, `gemini`); Gemini additionally needs `GOOGLE_API_KEY` and can also run via the Google Generative AI API. The Codex CLI integration is still in development.
 
+**Zero-setup:** `deckent init` detects everything above and, with your per-tool consent, installs the missing provider CLIs (claude/codex/gemini). Use `--yes` to install all without prompting (CI), or `--no-install` for detection only. OS packages (tmux) / Node / Docker are surfaced as instructions, never auto-installed (ADR-062).
+
 ---
 
 ## Installation
 
 ```bash
-npm install -g deckent
+npx deckent@latest init      # recommended — no global install
+# or
+npm install -g deckent && deckent init
 ```
 
-Verify:
+Verify and open the dashboard:
 
 ```bash
 deckent --version    # 1.0.0-beta.1
-deckent doctor
+deckent doctor       # pre-flight health gate
+deckent web          # web dashboard at http://localhost:3100
 ```
 
 ---
diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
index c456c071a..70f7b3e2d 100644
--- a/docs/.vitepress/config.ts
+++ b/docs/.vitepress/config.ts
@@ -16,7 +16,7 @@ export default defineConfig({
 
   // Head tags
   head: [
-    ['link', { rel: 'icon', href: '/favicon.svg', type: 'image/svg+xml' }],
+    ['link', { rel: 'icon', href: '/favicon.png', type: 'image/png' }],
     ['meta', { name: 'theme-color', content: '#5B21B6' }],
     ['meta', { property: 'og:type', content: 'website' }],
     ['meta', { property: 'og:site_name', content: 'Deckent' }],
@@ -25,8 +25,10 @@ export default defineConfig({
   // Dark/light theme
   appearance: 'auto',
 
-  // Exclude directories containing TypeScript generics, placeholder syntax (<N>, <T>, <Record>)
-  // that VitePress Vue compiler treats as unclosed HTML elements.
+  // Exclude directories containing TypeScript generics, placeholder syntax (<N>, <T>, <Record>),
+  // or HTML-like substrings (e.g. `<noreply@anthropic.com>` in co-author trailers, `<PID>` in
+  // placeholders) that VitePress's Vue compiler treats as unclosed HTML elements. These are
+  // developer notes / specs / audits, not user-facing documentation.
   // Only guide/ and index.md are built as user-facing docs.
   srcExclude: [
     'directives/**',
@@ -35,7 +37,10 @@ export default defineConfig({
     'release/**',
     'development/**',
     'architecture/**',
-    'reference/**',
+    'superpowers/**',
+    'audits/**',
+    'launch/**',
+    'governance/**',
     'SPRINT-LOG.md',
     'CHANGELOG.md',
   ],
@@ -48,8 +53,8 @@ export default defineConfig({
 
   // Theme config
   themeConfig: {
-    // Logo placeholder
-    logo: '/logo.svg',
+    // Brand emblem — pixel-art circuit kraken (ADR-021)
+    logo: '/logo.png',
     siteTitle: 'Deckent',
 
     // Top navigation
diff --git a/docs/.vitepress/public/favicon.png b/docs/.vitepress/public/favicon.png
new file mode 100755
index 000000000..d8b60746e
Binary files /dev/null and b/docs/.vitepress/public/favicon.png differ
diff --git a/docs/.vitepress/public/logo.png b/docs/.vitepress/public/logo.png
new file mode 100755
index 000000000..2d37129b8
Binary files /dev/null and b/docs/.vitepress/public/logo.png differ
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index ea22b8bc7..87a249a12 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,6 +1,28 @@
 # Changelog
 
 > **This file has been consolidated.** The canonical changelog is at the project root: [CHANGELOG.md](../CHANGELOG.md).
+## [1.0.0-beta.1-sprint175] - 2026-05-19
+
+### Added
+
+- W0.1 — Runtime deps (node-pty + ws)
+- W0.2 — ADR-010 amendment ext + ADR-062
+- W0.3 — TerminalConfig → DeckentConfig
+- W0.4 — Shared terminal types
+- W1.1 — AuthProvider (bypass-independent)
+- W1.3 — TerminalAudit (tenant-scoped DB)
+- W2.1 — WS gateway (auth-before-bridge + reattach)
+- W2.3 — serve CLI surface
+- W3.1 — xterm deps + terminal-api
+- W3.2 — useTerminalSocket
+
+### Changed
+
+- W4.3 — Final verification (completed with tech debt)
+
+
+_Tasks: 37 total, 21 done, 2 tech debt, 16 no-go_
+
 ## [1.0.0-beta.1-sprint174] - 2026-05-18
 
 ### Added
diff --git a/docs/ROADMAP-GOD-LEVEL.md b/docs/ROADMAP-GOD-LEVEL.md
new file mode 100644
index 000000000..a53f81ee4
--- /dev/null
+++ b/docs/ROADMAP-GOD-LEVEL.md
@@ -0,0 +1,798 @@
+# Deckent God-Level Roadmap — Sprint 149 → Sprint 200
+
+**Created:** 2026-04-20 (Sprint 148 sonrası)
+**Status:** CANONICAL — Sprint 149-200 anchor document
+**Vision:** OpenClaw'ın god-level üstün hali — developer-first + life-assistant dual platform
+**Brainstorming:** Alperen onayları 12+ karar, 5 paralel agent kod tabanı analizi
+**Last update:** 2026-05-20 (Sprint 175 Embedded Web Terminal teslimat — aşağıdaki ⚡ 2026-05-20)
+**Reconciliation note:** §4 Master Roadmap + §5 20-Gate + §6 Debt = 2026-04-21 snapshot, historical. Güncel temel: ⚡ 2026-05-20.
+
+---
+
+## ⚡ 2026-05-20 (Sprint 175 → Embedded Web Terminal #1/4 Teslim)
+
+VSCode-benzeri **gömülü web terminal** dashboard içinde **canlı çalışıyor** (Alperen smoke 2026-05-20). 4-parçalı agentic-OS yolunun #1 alt-projesi.
+
+### Sprint 175 (Embedded Web Terminal, 2026-05-19 → 2026-05-20)
+
+- **Branch:** `docs/embedded-web-terminal-spec` (origin push'lı); 17 commit (5 wave-bazlı feature + 2 hotfix + spec/plan/DIRECTIVES + debt closure + #2 backlog notları). PR URL: `https://github.com/VerhexIO/deckent-develop/pull/new/docs/embedded-web-terminal-spec`.
+- **Test sonucu:** 46/46 terminal-spesifik test PASS (backend 30 + frontend 15 + e2e reattach 1). Build temiz: `tsc` exit 0, `vite` SUCCESS (2.87s, 1066KB / gzip 296KB).
+- **ADR:** ADR-062 (Embedded Web Terminal) accepted; ADR-010 Sprint-172 Amendment table'a `node-pty` + `ws` satırları eklendi (dep count 7→9). 062 isim çakışması: consent-based-provisioning → 063 rename ile çözüldü.
+- **Operasyonel kanıt:** `DECKENT_API_AUTH_DISABLED=1 npx deckent serve` + browser hard-refresh sonrası dock panel canlı; `+claude`, `+gemini`, `+shell` sekmeleri gerçek interaktif PTY oturumlarına bağlandı.
+- **Kilitli mimari kararlar (spec §1c/§1d):** tam interaktif PTY (`node-pty`) + `ws` + xterm.js; çoklu-sekme; localhost-bind + zero-config oto-token; tmux-vari reattach (sunucu restart'ta DEĞİL — bilinçli sınır); audit `memory.db`'de yapısal event olarak (ham PTY çıktısı ASLA persist edilmez); `LocalTokenAuthProvider` `DECKENT_API_AUTH_DISABLED`'dan **kasıtlı bağımsız** (RCE bypass'a mahrum); enterprise dikişleri (`AuthProvider`/`SessionBackend`/`tenantId`) ilk günden konumlu.
+- **Bookkeeping/öğrenim:** systematic-debugging Phase-1 ile `debt-170-001-fix` 5-sprintlik döngü **honest closure** ile kapatıldı (Phase-4.5 mimari pattern). İki kalıcı feedback memory yazıldı (`feedback_trust_brain_eval_not_worker`, `feedback_trust_deckent_recovery`) — Brain verdict'i ≠ worker self-report, FIX phase'i küçümseme.
+
+### Sub-project Backlog (#2-#4 sırayla)
+
+| # | Alt-proje | Scope (özet) |
+|---|-----------|----|
+| 2 | **Self-security prosedürü + planner state hygiene** | prompt/komut guard, audit timeline UI; ek 6 maddelik planner state-hygiene defekti (auto-debt-inject empty-scope, re-plan orphan cleanup, DEP0190 `shell:true`, schema-gate coverage enforcement, WorkerCard/DashboardPage pre-existing TS, doctor DECISIONS.md obsolete check) |
+| 3 | **Milyon-ölçek güvenlik** | multi-tenant izolasyon (gerçek `tenantId`), `SessionBackend` k8s pod-exec impl'i, sandbox, rate/kaynak limitleri, OIDC/SSO `AuthProvider` impl'i |
+| 4 | **Enterprise dış-dünya entegrasyon + güvenli veri alışverişi** | denetim altyazısı zenginleştirme, dış sistem hook'ları, compliance (SOC2/GDPR) |
+
+Sprint 176+ önceliklerinden: node-pty kalıcı fix (`@lydell/node-pty-linux-x64` optionalDep), şu an çalışan manuel workaround'u tek-komut install'a indirir.
+
+---
+
+## ⚡ 2026-05-19 (Sprint 173-174 → 1 Haziran Beta Reconciliation)
+
+Bu doküman `afc2638`'den restore edildi (Sprint 172 doc-reorg'da kayıp 722 satır,
+commit `9372f8d`). Aşağıdaki ⚡ tarihli bölümler + §1-3 Sprint 166'da, §4-6 Master
+Roadmap 2026-04-21'de donmuştu. Bu bölüm güncel temeli kurar; alttaki tarihli kayıtlar
+ve §4-6 **historical** olarak korunur (silinmez — kanıt/iz).
+
+### Durum (2026-05-19)
+
+- **Brain + Deckent stabil çalışıyor.** Sprint 162-163 Brain stability mührü (6/6 DONE,
+  0 NO_GO), Sprint 165-166 Brain Self-Update + Data Integrity Closure, Sprint 167-172
+  doc-honesty + doc-reorg, Sprint 173 ADR-honesty turu. Pipeline production-grade.
+- **Sürüm:** v1.0.0-beta.1. Güncel sprint: sprint-173/174.
+
+### Reality Reconciliation — §4 Phase 2-5 vs Gerçek
+
+§4 Master Roadmap'in sprint-numaralı temaları (Sprint 152-200: messaging→hub→daemon→
+voice→mobile) **historical plandır, sprint numaralarıyla 1:1 gerçekleşmedi**. Gerçek
+Sprint 152-174 sistemin olgunlaşmasına (Brain stability + data integrity + ADR/doc
+governance + doc-reorg) ayrıldı. Bu bir gecikme değil — temel sağlamlaştırma; feature
+roadmap'i (messaging/dashboard/vertical) **beta sonrası arka** kayar.
+
+### Güncel Anchor (bu satırlar §4'ü supersede eder)
+
+- **1 Haziran 2026 = OSS Public Beta** (tarih KESİN — Alperen 2026-05-19). Yüzey =
+  **Sprint Mode** (kod orkestrasyon, 170+ sprint dogfood-kanıtlı). §4 "Sprint 151 Beta
+  GA Çar 22 Nis" hedefi historical — güncel hedef 1 Haziran.
+- **Post-beta ark (roadmap'te taahhüt, beta'yı bloklamaz):** AEGIS metodoloji
+  implementasyonu Sprint 175-200 (ADR-061); Task Mode + Process Mode vertical
+  (gündelik iş / ERP / reklam / tüm sektörler); dashboard → kullanıcı uygulaması;
+  multi-tenant SaaS fazları. AEGIS impl. beta stabilitesinden SONRA (Alperen 2026-05-15).
+- **Değişmeyen DNA (geçerli):** §2 god-level vizyon, §7 rekabet konumu, §2.6 güvenlik
+  (.deck + AST sandbox + Ed25519), §11 anchor kuralları (ADR-041 / nervous-critical /
+  product-not-service ADR-033 / doc-önce-kod / Hot Fix pattern / meta-dogfood sayacı).
+
+### §5 20-Gate Notu
+
+2026-04-21 "17/20" ölçümü historical. Güncel beta launch-blocker seti (break-sprint-
+bug-cycle disiplini): bkz. ileride beta-gate çalışması. §5 tablosu kanıt olarak korunur.
+
+---
+
+## ⚡ 2026-05-13 (Sprint 165→166 Final Stability + Brain Self-Update + Data Integrity Closure)
+
+### Sprint 165 (Final Stability + Open Source Hazırlık, 2026-05-12)
+
+5/5 task delivery, npm publish `v1.0.0-beta.1` hazır, Open Source GA Sprint 168'e ertelendi:
+
+- **T1 (Bug X):** "no-result → CODE_VERIFIED_DONE" stub kaldırıldı, honest-result gate runtime devrede
+- **T2 (Bug Y):** processQueue legacy FIFO stall fix (flag false modunda) — respawnEligibleTasks 13 grep match canlı çalışıyor
+- **T3 (Bug Z):** Vitest gate +1 fail kronik regresyon kaynak forensic + worker/Brain audit uyumu (NO_GO — Sprint 165 retro deliverable)
+- **T4 (Bug W):** dead_event_stream detector activate (Sprint 148 `reserve_for: sprint-148` cleared)
+- **T5:** Documentation freeze + public repo flip (`VerhexIO/deckent-dev` → `VerhexIO/deckent`) prep — GO_WITH_TECH_DEBT, public flip Sprint 168'e taşındı
+
+### Sprint 166 (Brain Self-Update + Data Integrity Closure, 2026-05-13)
+
+**11/11 task DONE** (10 DONE + 1 GO_WITH_TECH_DEBT), ~2735 LoC + 35+ test PASS, 0 regression. 4 architectural root cause kalıcı kapatıldı:
+
+| Task | Bug | Fix Özeti |
+|---|---|---|
+| **T1** | **Bug M (adrInsert hook eksik)** | `src/core/adr-file-sync.ts` NEW 244 LoC — MADR v3 başlık regex + memory.db upsert. `identity-generator.ts:308-356` postFinalizeHooks **Step 3 (adrInsert)** insert + ruleRegen Step 4'e renumber (Step Ordering Contract Section 5.1) |
+| **T2** | **Bug N+O (onRuleRegen manuel finalize path)** | `cli/commands/finalize.ts:166` finalizeSprint çağrısına `onRuleRegen: regenerateRules` callback eklendi + `rule-generator.ts` CUSTOM_TEMPLATE block (AUTO kopyası değil, empty template) |
+| **T3** | **Bug S (doc-cache sprint-aware cache key)** | `doc-cache.ts` cache key `fileHash + entryHash + sprint.id` (GO_WITH_TECH_DEBT — runner wire-up Sprint 167'e ertelendi) |
+| **T4** | **Bug Y2 (Doc-sync ground-truth 3-layer defense)** | Plan-time count assertion + helper `verifyDocSyncGroundTruth` + Auditor runtime check (`src/monitor/auditor.ts:705`) + `.deckent/ground-truth-overrides.json` whitelist (agents_count=15 anchor) |
+| **T5-T10** | **Bug R+T+U+V+C+X+P+Q+W+K+L bundled** | Data integrity + living docs: AGENTS.md docs.json entry, identityRegen deprecate, sprint type insert + debt sprint_id backfill (100 entry), DECKENT.md broken ref fix, summary debt filter `status != 'resolved'`, TOOLS/BOOT/WORKER-GUIDE auto-content generators, provider parity (.codex/.gemini/.cursor frontmatter sync), emitAlert helper + stale_md detector, verify-ran atomic write |
+| **T11** | **ADR-046 Brain Self-Update Hook Architecture** | MADR v3 hibrit, accepted — Wave 1.5 strictly serial gate (T1+T2+T3 DONE → Alperen manuel `npx deckent memory rebuild` CHECKPOINT). Step ordering kontratı, koşulsuz invocation pattern, falsifiable predicate |
+
+**Yeni infrastructure:**
+- Docker container memory 4GB → 8GB (Bug G workaround — Sprint 167 adaptive model-aware fix planlanıyor)
+- `src/monitor/alert-emitter.ts` (+30 LoC) — `emitAlert(type, payload)` → `.dashboard.json` + event jsonl atomic write
+- `.deckent/ground-truth-overrides.json` whitelist schema v1.0
+
+**Test büyümesi:** Sprint 166 sonrası test suite ~16,434 PASS (Sprint 166 35+ yeni test ekledi, 0 regression).
+
+### Sprint 166 Sırasında Tespit Edilen Yeni 4 Bug (Sprint 167 P0)
+
+| Bug | Tanım | Sprint 167 Aksiyon |
+|---|---|---|
+| **Bug E** | Spawn-lock leak — 3× replay aynı sprint içinde, manuel survival lock takip | `acquireSpawnLock` TTL + heartbeat-aware cleanup |
+| **Bug G** | OOM exit 137 — container 4GB→8GB workaround Sprint 166'da proven, mimari fix bekliyor | Adaptive model-aware memory allocator (opus=8GB, sonnet=4GB, haiku=2GB) |
+| **Bug Z2** | Planner `Files:` parser DIRECTIVES.md bare token üretiyor (`.md`, `brain.md`, git hash) | Token sanitizer regex + skip-on-malformed validation |
+| **Bug Z3** | `npx deckent memory rebuild` semantics yanlış — aslında export yapıyor, import için Sprint 167 fix | CLI subcommand split: `rebuild` (import) vs `export` (dump) |
+
+### Sprint 167 Tema (Architectural Refactor + Monitoring Baseline)
+
+- Bug E+G+Z2+Z3 mimari fix
+- `dependency_pipeline_enabled: true` flip (Wave scheduling live) — anchor decision Sprint 167 DIRECTIVES
+- M1-M4 monitoring baseline tracking aktif (Sprint 166 advisory, Sprint 167 P0 automatic blocker)
+- **ADR-047:** Manuel Survival Pattern + Brain Hot-Fix Architecture (planned)
+
+### Sprint 168 (Open Source GA Hedefi)
+
+- `VerhexIO/deckent-dev` → `VerhexIO/deckent` public flip (Sprint 165 T5 hazırlık → Sprint 168 cutover)
+- `npm publish v1.0.0-beta.2` GA
+- Show HN launch + Twitter/Reddit/Discord community feedback wave
+
+### Sprint 165-166 Beta GA Exit Gate Güncel Durum
+
+| # | Gate | Sprint 164 sonu | Sprint 166 sonu |
+|---|------|------------------|------------------|
+| #1 tsc 0 errors | ✅ | ✅ |
+| #2 vitest gate | ⚠️ +1 fail kronik | ✅ Sprint 166 35+ yeni test PASS, 0 regression |
+| #11 Documentation sync | ⚠️ | ✅ Living docs T8+T9 wire (TOOLS/BOOT/WORKER-GUIDE auto-content) |
+| #13 Messaging trio | 🟡 | 🟡 (Sprint 168 community launch) |
+| #15 Hub publish | 🟡 | 🟡 (Sprint 168 GA) |
+| **Yeni: Brain self-update integrity** | — | ✅ ADR-046 accepted, postFinalize Step 1-5 contract live |
+| **Yeni: Ground-truth verification** | — | ✅ 3-layer defense + whitelist (Bug Y2 zero-tolerance) |
+
+**Sprint 168 Beta GA için kalan 3 gate:** #3 (coverage long-term Sprint 170+), #13 (messaging smoke), #15 (hub publish).
+
+### Meta-Dogfood Kanıt — 6. Uygulama (Sprint 165-166 Hattı)
+
+Sprint 164 (5. uygulama) → Sprint 165 (honest-result gate canlı kanıt) → Sprint 166 (Brain self-update hook chain doğru sırada çalıştı, ADR-043/044/045/046 hepsi memory.db'ye düştü). Deckent kendi mimari kontratını kendi finalize çıktısında doğruladı.
+
+---
+
+## ⚡ 2026-05-13 (Sprint 157→164 Brain Stability Hattı + dep_pipeline Yol B Wire)
+
+### Sprint 157-164 — 8 Sprint Brain Stability Hattı
+
+Sprint 157-164 boyunca Brain stability hattı:
+
+- **Sprint 157-159:** Bug X (dual-eval race) + Sprint-Stall + Brain state update bug fix denemeleri, kronik NO_GO rate %87
+- **Sprint 160:** SPAWN crash (plan.md path collision) — T-001 survivor exception handler + redactor commit
+- **Sprint 161:** Resmi survivors — T-002 checkpoint loop + T-006 double-MCP guard + config fix
+- **Sprint 162:** T-003 phase observability + T-004 sprint-controller wire + T-007 finalize. Spurious NO_GO bug canlı tespit (3/3 DONE worker → Brain NO_GO sayım).
+- **Sprint 163 (Brain Stability Closure):** 6/6 DONE %0 NO_GO. B1 spurious NO_GO fix + B2 docker container_start_failed + ADR-043 Brain Crash Recovery + ADR-044 Sprint State Observability + Security Review 3/3 + Dogfood smoke 6/6.
+- **Sprint 164 (dep_pipeline Yol B Wire + Vitest Gate + Housekeeping, 2026-05-13):** 5/6 DONE + 1 hayalet stub. ADR-045 Wave-Based Execution Semantics accepted, respawnEligibleTasks runtime wire 13 grep match (sprint-controller'a kadar derinleşti), task.status inline mutation 3 dal, 14 yeni test (8 wire + 6 integration) PASS. **Wire RUNTIME DEVRE DIŞI:** `dependency_pipeline_enabled: false` kaldı, Sprint 166 flip için bekletilir.
+
+### Sprint 164 Canlı Dogfood Bulguları (Sprint 165 P0)
+
+- **Bug X canlı replay:** 164-006 worker docker HB shutdown → Brain "CODE_VERIFIED_DONE" stub yazımı. Sprint 156-011 CRITICAL debt EXACT replay.
+- **Bug Y canlı replay:** Brain processQueue legacy FIFO Wave 2→3 geçişinde stall — 164-006 spawn olmadı. Sprint 161 stalled forensic'in dogfood replay'i.
+- **Bug Z:** Vitest gate +1 fail Sprint 159'dan beri 6 sprint kronik. 164-003-fix worker 17→0 raporladı ama Brain audit hâlâ FAIL — worker iddiası ile Brain self-audit script uyumsuzluğu.
+- **Bug W:** Auditor dead_event_stream detector Sprint 148'den `reserve_for: sprint-148` ile uyuyor. 164-006 27dk hayalet kaldı, alarm verilmedi.
+
+### Sprint 165 Tema: Brain Final Stability + Open Source Hazırlık
+
+- **T1:** Bug X fix — "no-result → CODE_VERIFIED_DONE" stub kaldırılır
+- **T2:** Bug Y fix — processQueue legacy FIFO stall (flag false modunda)
+- **T3:** Bug Z fix — vitest gate +1 fail kaynak araştırma + worker/Brain audit uyumu
+- **T4:** Bug W fix — dead_event_stream detector activate
+- **T5:** Documentation freeze + public repo prep (open source GA için)
+
+### Beta GA Exit Gate Güncel Durum (Sprint 164 Sonrası)
+
+- **#2 vitest gate** hâlâ FAIL — Sprint 165 T3 ile kapanır
+- **#11 Documentation sync** — Sprint 165 T5 ile final
+- **Yeni feature:** Wave-Based Execution Semantics code-complete (ADR-045), runtime activation Sprint 166
+
+### Meta-Dogfood Kanıt — 5. Uygulama
+
+Sprint 164 kendi kodunun aktif buglarını kendi sprint'i sırasında 4 ayrı katmandan reproduce etti (Bug X+Y+Z+W). Worker'lar HONEST raporladı, Brain stub yarattı, force recovery ile diskte tüm kazanım korundu.
+
+---
+
+## ⚡ 2026-05-12 (Sprint 156 Pipeline Hardening — T4 god-level dogfood)
+
+### Sprint 156 Final Metrikler (~50 dk, force finalize ile)
+
+- **15 orig + 7 fix = 22 task evaluation:** 7 DONE + 15 TECH_DEBT + 0 NO_GO
+- **11 src/ değişiklik + 1 NEW dosya** (spawn-safety.ts) + **11 yeni test dosyası** + **3 ADR draft** (053/055/060) + per-change security review
+- **`dependency_pipeline_enabled: true` default flip** — wave-based spawning + cascade-on-NO_GO + unblock-on-DONE artık aktif
+- **0 NO_GO** — Sprint 155 sonrası Bug B fix kalıcı, registry doc-write + audit rubric dispatch çalışıyor
+- **Force finalize gerekti** — 3 major bug Brain orchestra'sını stuck'a soktu (aşağıda)
+
+### Sprint 156 Mimari Kazanımlar
+
+| Modül | Etki |
+|---|---|
+| `src/core/config.ts` | dependency_pipeline_enabled default flip + DeckentConfigWithPipeline alias |
+| `src/orchestra/sprint-phases.ts` | applyCascadeToSprint + applyUnblockToSprint runtime wire + DEPENDENCY_{CASCADE,UNBLOCK}_APPLIED events |
+| `src/orchestra/spawn-backend-docker.ts` | tmpfile preservation + IDEMPOTENCY_KEY env inject + spawn-time lock + lock leak fix |
+| `src/orchestra/sprint-lifecycle.ts` | CleanupPhaseKind ('sprint-end'/'spawn-fail') gating |
+| `src/monitor/auditor.ts` | Baseline collection retry + vitest_invocation_status enum |
+| `src/orchestra/prompt-god-template.ts` | buildDependenciesBlock previous-result content embed + idempotency key directive |
+| `src/orchestra/rubric-registry.ts` | EffectClass type + getEffectClass + DEFAULT_EFFECT_MAP (Reversibility tohumu) |
+| `src/orchestra/debt-manager.ts` + sprint-spawner.ts | Fresh-Eyes rotation (opus→sonnet, architect→code-reviewer+bug-fixer) |
+| **NEW** `src/core/spawn-safety.ts` (157 LoC) | assertSpawnSafe + ADAPTER_BIN_WHITELIST + SH_C_ALLOWED + SpawnSafetyError (ADR-038 ref) |
+| `src/core/file-lock.ts` | acquireSpawnLock/Locks + releaseAllSpawnLocks + SpawnLockError + batch rollback |
+
+### 3 Major Bug — Canlı Forensic Kanıt (Sprint 157 P0)
+
+#### Bug X — Dual-Evaluator Stale-State Race
+2 saniyede iki rakip evaluate pass (Sprint 162C ADR-049 patolojisi):
+```
+13:51:01 Pass 1: completedTasks=22, techDebt=15, noGo=0  → RETRO yazılmaya başladı
+13:51:03 Pass 2: completedTasks=10, techDebt=4,  noGo=12 → 6 fix-fix.json yazıldı
+```
+Aynı disk state'in 2sn'de farklı değerlendirilmesi. Brain race'e takıldı.
+
+#### Bug Sprint-Stall — fix-fix Spawn Edilmedi
+6 fix-fix.json definition yazıldı AMA worker spawn=0 (.hb/.plan/.result yok). Brain runner sleeping state'e geçti. `runFixPhase` SADECE 1 KEZ çağrılıyor, recursion yok (Sprint 161 audit Bug Stall pattern tekrarı).
+
+#### Bug Brain State Update Missing
+Fix workers `.result` yazdı (DONE/GO_WITH_TECH_DEBT) AMA task.json status EXECUTING freeze. `npx deckent finalize` "6 in-progress" hatası verdi → `--force` gerekti. `handleEvaluation → updateTaskStatus` wire eksik (Sprint 153 P0 memory bug'ı canlı kanıt).
+
+### Bonus Bug'lar (Slot Monitor Forensic)
+
+4. **Heartbeat Write Race** — `.tasks/task-NNN.hb` birden fazla process tarafından yazılıyor (Slot 1+3 yakaladı, workerId clobber)
+5. **sprint-state.json Update Freeze** — mtime 16:11 (spawn anı), 38dk hiç güncellenmedi (Sprint 161 audit Bug R2)
+6. **Retro Naming Off-By-One** — `retro-sprint-156.md` aslında Sprint 155 retrosunu içeriyor
+
+### Worker Honesty Highlights (T4 discipline kanıtı)
+
+- **156-009-fix** GO_WITH_TECH_DEBT scope refusal — filesWrite vs scope.directories çelişki tespit, edit yapmadı, hint döndü
+- **156-002-fix** OOM cascade recovery — 0 file change rubric 100/95/100/95 (sprintin en yüksek), orig kod doğru olduğunu kanıtladı
+- **156-003** downstream breakage self-confession — `fix-phase-map.test.ts` (5 test) breakage kendi atfetti
+
+### Sprint 156 Beta GA Gate Durumu
+
+| # | Gate | Sprint 155 sonu | Sprint 156 sonu |
+|---|------|------------------|------------------|
+| #1 tsc 0 errors | ✅ | ✅ (76 file diff, 0 type error) |
+| #2 vitest ≥%99.5 | ⚠️ 2 pre-existing fail | ⚠️ 2-4 fail (gemini-integration + docker-e2e, environment-dependent) |
+| Implicit: Pipeline Health | ✅ | ⚠️ Brain orchestra Bug X + Stall canlı kanıt (Sprint 157 P0) |
+| #11 Documentation sync | ⚠️ | ✅ ROADMAP + memory + CHANGELOG Sprint 156 güncel |
+| **Yeni: Reversibility Layer foundation** | — | ✅ EffectClass + spawn-safety + file-lock primitives |
+| **Yeni: TOPP foundation** | — | ✅ dependency_pipeline_enabled + cascade/unblock + tmpfile discipline |
+
+### Sprint 157 Tema — Brain Orchestra Hardening + EvaluationAuditTrail
+
+| # | Madde | Konum | Effort |
+|---|---|---|---|
+| P0-1 | Dual-evaluator race close (Bug X) | sprint-phases.ts runEvaluatePhase | high |
+| P0-2 | Sprint-Stall fix-fix spawn loop | sprint-phases.ts runFixPhase recursion | high |
+| P0-3 | Brain handleEvaluation → updateTaskStatus wire | debt-manager.ts:139-152 | normal |
+| P0-4 | EvaluationAuditTrail `.deckent/evaluations/*.json` | sprint-phases.ts evaluateWithRubric çıktı persist | normal |
+| P0-5 | Heartbeat write atomicity | spawn-backend-docker.ts HB writer | normal |
+| P0-6 | sprint-state.json phase transition update | sprint-phases.ts SPRINT_PHASE_CHANGE wire | normal |
+| P1-1 | scoreTestCoverage Math.min(null,100)=0 fix | result-evaluator.ts:586 | low |
+| P1-2 | AUDIT_RUBRIC threshold tuning small audit | rubric-registry.ts | normal |
+| P1-3 | Retro naming off-by-one fix | sprint-lifecycle.ts retro write | low |
+| P2-1 | sprint-phases.ts:425 cleanup 'spawn-fail' caller | sprint-phases.ts | low |
+| P2-2 | DeckentConfig'e dependency_pipeline_enabled field | config-types.ts:69-312 | low |
+
+### Meta-Dogfood Kanıt 4. Uygulama
+
+Sprint 156 dogfood'undaki sprint sırasında **kendi kodunun bug'larını canlı keşfetti**:
+- Sprint 154 fix'leri devrede ama Bug X + Stall + state update miss farklı katmanlardan ortaya çıktı
+- Worker'lar HONEST raporladı, Brain stuck'a takıldı
+- Force finalize ile diskte tüm kazanım korundu
+- Sprint 157'de Brain self-orchestra fix'leri için kanıt seti hazır
+
+---
+
+## ⚡ 2026-05-12 Session Kapanış — Sprint 152.5 Restore + Sprint 153 Smoke + Sprint 154 Bug B Fix
+
+---
+
+## ⚡ 2026-05-12 Session Kapanış — Sprint 152.5 Restore + Sprint 153 Smoke + Sprint 154 Bug B Fix
+
+### Restore Operasyonu (2026-05-12 sabah)
+
+- **Baseline:** commit `224618c` (Sprint 152 sonu, 2026-05-05) restore-152 branch
+- **Cherry-pick:** commit `9b91405` (Sprint 154 Wave A T1+T4+T6+T10 — claude.json:rw ROOT CAUSE, dist chmod, FIX timeout 30dk, adr-validator path)
+- **Backup integration:** Apr 22 tar dosyasından `.brain/memory.db` (2.3MB, 174 entries) + `.brain/sprints/` + `.deckent/{jobs,pids,cache,routing,plugins}/` + `.tasks/archive/` surgical extract
+- **Yeni repo:** `VerhexIO/deckent-develop` (private) `main` branch, push edildi commit `359bd10`
+- **Eski repo:** `VerhexIO/deckent-dev` `origin-archive` remote olarak korundu
+
+### Sprint 153 Smoke (2026-05-12, restore validation)
+
+10 doc-only paralel task, mini smoke. Pipeline LIVE kanıtı:
+- ✅ 6 worker docker spawn (claude.json:rw fix kanıtlı)
+- ✅ 10/10 .md dosyası diske düştü (`docs/smoke-2026-05-12/`)
+- ❌ Brain 9/10 NO_GO verdi (Bug B canlı: `validateResultSchema:499` `typeof null !== 'number'` schema fail)
+- ✅ 1 task DONE (153-005, worker `coverage:0` number yazdı — null'dan kaçtı)
+- **Forensic kazanım:** Worker non-determinism + tek-tip rubric birleşince false NO_GO; TaskType taxonomy ihtiyacı somutlandı
+
+### Sprint 154 Bug B Fix Dogfood (~14 dk, 6 opus task)
+
+Deckent kendi kendini fixledi — pipeline çalışırken kendi rubric'ini çoklu-tip yaptı:
+- **NEW** `src/orchestra/rubric-registry.ts` (196 LoC): TaskType taxonomy (audit/document-write/code-development) + 3 rubric + scope-shape detection + getRubric + coverageOptional
+- `src/orchestra/result-evaluator.ts` (+287/-6): registry import + `validateResultSchema(result, task?)` + 6 yeni scorer (scoreWordCount/scoreAuditCompleteness/scoreFindingCount/scoreCitationDensity/scoreMigrationTriage/scoreDocumentationQuality) + scoreCriterion switch ext + evaluateWithRubric registry wire
+- **NEW** `tests/orchestra/rubric-registry.test.ts` (26 test) + `result-evaluator-typed.test.ts` (8+ scenario)
+- Brain 5 DONE + 4 NO_GO etiketledi (kendi schema'sı yeni registry'i okumadığı için fix-of-fix race), AMA fiziksel kod tam disk'te + tsc PASS
+- `npm run build` + MCP restart sonrası canlı
+
+### Dogfood Bulguları (yeni mimari kanıtlar)
+
+| Bulgu | Konum | Etki |
+|---|---|---|
+| Brain self-contradiction | `debt-manager.ts:126-140` worker rubricScores LITERAL kopya + "NO_GO" mantık çelişkili reason | Fix-of-fix gereksiz spawn, token bleed |
+| `dependency_pipeline_enabled: false` default | `sprint-spawner.ts:220-234` | Wave gating disabled → paralel race |
+| Cascade/Unblock dangling exports | `sprint-spawner.ts:681-774` runtime çağrı yok | NO_GO sonrası dependents PAUSED gelmiyor |
+| Soft enforcement scope collision | `authority-enforcer.ts:5-6` ADR-037 | Auditor warn, Brain spawn 17ms sonra |
+| Bind-mount /workspace shared | `spawn-backend-docker.ts:241-245` | Container isolation YOK, POSIX overwrite |
+| `.locks/` mount edilmiş, kullanılmıyor | spawn-time runtime mutex eksik | File lock plan-time only |
+| Worker prompt previous-result CONTENT eksik | `prompt-god-template.ts:240-255` | Chain continuation = disk timing race |
+| External dependency ID graph'a girmiyor | `dependency-scheduler.ts:183-189` local-only | DIRECTIVES "Dependencies: 153-001" ignored |
+| Idempotency key var ama API'ye geçmiyor | `spawn-backend-docker.ts:92` promptId | External API retry'da duplicate riski |
+| Destructive whitelist tasarımda (Sprint 162A ADR-047) | restore'da YOK | Worker bash blocklist yok |
+
+### 3-Katman Mimari (Sprint 155+ canonical reference)
+
+Sprint 154 dogfood'undan türetildi. Üç katman birbirini tamamlar:
+
+#### Katman 1: TaskType Taxonomy + Hybrid Scoring — NE değerlendirilecek
+- 3 baseline tip (audit/document-write/code-development), genişletilebilir (user-mail-send, erp-create-purchase-order, payment-process vb.)
+- 5-layer hybrid pipeline: Schema → Gates → Quality Score → Outcome Tracker → Auditor Independent
+- Storage hiyerarşisi: TS core + SQLite Memory V2 + JSON manifest + Ed25519-signed hub plugin
+- Multi-language: statik İngilizce ID + i18n label layer (Sprint 162A 12-lang extension)
+- 5-channel self-awareness propagation: `deckent init` seed + `deckent sync types` + `.deckent/rubrics/*.json` + skill manifest + worker prompt enrichment
+
+#### Katman 2: Task Orchestration Pipeline Patterns (TOPP) — NASIL koordine edilecek
+- Topological wave scheduling (Kahn algoritması — kodda var, default disabled)
+- Hard-block on dependency (spawn precondition — kodda var, default disabled)
+- File-conflict → consolidation/sequencing (Auditor "consolidate-or-sequence" sinyali)
+- Worker prompt context enrichment (önceki task `.result.notes` + `filesChanged` embed)
+- Runtime file lock (`.locks/` flock spawn-time mutex)
+
+#### Katman 3: Reversibility Layer — YANLIŞ GİDERSE NE OLACAK
+- EffectClass taksonomi (pure/reversible/idempotent/compensable/critical-irreversible)
+- Pre-execution gate (class-aware spawn)
+- Compensation registry (Saga pattern — Ed25519 imzalı for hub plugins)
+- Effect log (5-layer schema: Identity/Action/Outcome/Compensation/Privacy)
+- Cross-worker effect coordination + Fresh-Eyes Rule for fix worker
+- Multi-tenant isolation 3-faz (Docker namespace → K8s namespace → Zero-trust audit ledger)
+
+### Sprint 155-180 Tema Önerileri (gradual evolution)
+
+| Sprint | Tema | Skor |
+|---|---|---|
+| 155 | **Brain self-rebuild smoke + Bug B canlı validation** (Sprint 154 fix'i Brain'in kendi rubric'inde devrede mi) | P0 |
+| 156 | Config defaults flip: `dependency_pipeline_enabled: true` + cascade/unblock wire (Sprint 154 Wave B'den) | P0 |
+| 157 | Worker prompt context enrichment (önceki task `.result.notes` embed) | P0 |
+| 158 | Idempotency key worker prompt env inject | P1 |
+| 159-160 | Destructive ops whitelist (`assertSpawnSafe` Sprint 162A ADR-047 cherry-pick) | P1 |
+| 161-162 | EffectClass annotation + pre-execution gate + saga registry foundation | P0 |
+| 163-164 | Effect log 5-layer schema implement + Memory V2 migration | P1 |
+| 165 | Per-tenant docker namespace (Reversibility Faz 1) | P2 |
+| 166 | Fresh-Eyes fix worker rotation (different model/agent + auditor diff review) | P1 |
+| 167-170 | Hub plugin TaskType + Ed25519 compensation imza | P2 |
+| 171-180 | K8s namespace per tenant (Reversibility Faz 2) | P3 |
+
+### Önemli Bulgu — Hot Fix Pattern Devam Ediyor
+
+Sprint 150A → 152.5 → 154 → 162A → şimdi 154-restore. 5. uygulama. Deckent kendi kırılganlığını kendi mimarisiyle keşfediyor — meta-dogfood paradigmasının 17. sprint'lik kanıtı.
+
+### Beta GA Gate Durumu (2026-05-12 Sprint 154 restore sonrası)
+
+| # | Gate | Sprint 150A sonu | Sprint 154 restore sonu |
+|---|------|------------------|--------------------------|
+| #1 tsc 0 errors | ✅ | ✅ |
+| #2 vitest ≥%99.5 | ✅ %99.94 | ⚠️ baseline re-run gerek |
+| #11 Documentation sync | 🟡 | ⚠️ ROADMAP bu update'le çatallı |
+| #13 Messaging trio smoke | 🟡 token bekleniyor | 🟡 |
+| Implicit: Pipeline Health | ✅ DONE (Sprint 150A) | ✅ Sprint 153 smoke + 154 dogfood kanıt |
+| **Yeni implicit: TaskType taxonomy foundation** | — | ✅ Sprint 154 (Bug B fix) |
+| **Yeni implicit: 3-katman mimari plan** | — | ✅ Sprint 154 dogfood türevi |
+
+---
+
+## ⚡ 2026-04-21 Session Kapanış — Sprint 150 + Hot Fix Özeti
+
+### Sprint 150 Final Metrikler (1h 20m)
+- **37/41 task DONE (%90)** — 38 orijinal + 3 FIX (T-008/013/021 re-try)
+- **4 NO_GO:** T-150-008/022/028 "verification-blind" pattern (Brain evaluator rubric bug) + T-150-008 fix döngüsü
+- **tsc:** PASS (0 error sprint sonunda)
+- **vitest:** delta 5 fail (gate FAIL) ama baseline 104 fail
+- **0 boundary violation, 0 honesty violation**
+- **+8032 / -227 LoC**
+- **Code churn:** 38 task → 11 meta-dogfood kanıt (Sprint 148 rekoru 6, 2x artış)
+
+### Hot Fix with Claude Subagents (Session 1, ~68 dakika)
+Deckent kırık haliyle Deckent'i tamir etme sonsuz döngü riskinden kaçınmak için Alperen direktifiyle Claude Code subagent'lar ile cerrahi müdahale yapıldı:
+
+| # | Hot Fix | Süre | Sonuç |
+|---|---------|-----:|-------|
+| **H1** | CLI `skill publish` duplicate fix | 3 dk | 49 CLI komut geri geldi (tüm `deckent *` broken idi) |
+| **H2** | Vitest triage + fix | 33 dk | **104 → 9 fail** (Gate %99.5 aşıldı → %99.94) |
+| **H3** | Config sadeleştirme tam | 5 dk | Flat providers silindi, retention+rotation defaults eklendi |
+| **H4** | T-150-035 retention runtime wire | 2.5 dk | 17 sprint → 10, archive canlı, forensic taşındı |
+| **H5** | T-150-030 rotation runtime wire | 4 dk | metrics.jsonl 268KB → 0, 15x gzip compression |
+| **H6** | DECKENT→USER:NOTIFY wire + Nervous bridge | 12.5 dk | 5 lifecycle hook + CLI+MCP+File adapters + nervous bridge canlı |
+| **H7** | Rebuild + MCP restart + canlı test | 8 dk | **`ℹ️ [deckent] Task H6 DONE` terminal'e yazıldı — ilk canlı DECKENT→USER:NOTIFY kanıtı** |
+
+**Toplam:** ~1M token, 145+ file, +6047/-5473 LoC, **Beta GA Exit Gate'lerin 17/20'si açıldı**.
+
+### 3 Yeni MCP Tool Canlı Deploy (Sprint 150 T-029/032)
+- `deckent_audit` — Brain Self-Audit Gate user-facing
+- `deckent_feature_query` — Feature Manifest runtime query (16 active feature)
+- `deckent_recover` — Crash recovery user-facing (orphan cleanup + stale lock + archive)
+
+### Meta-Dogfood Kanıtları (Sprint 150 + Hot Fix)
+13 canlı kanıt, Sprint 148 rekoru 6'dan 2.2x artış:
+1. T-150-008 scope sanitizer `.gz` false positive sprint içinde fix
+2. T-150-033 safety-point stale sprint-149 bug kendi implementasyonuyla çözüldü
+3. T-150-030 event stream stuck 27 event bug — kodu yazıldı
+4. T-150-028 orphan IPC 0 count canlı kanıt (preflight cleanup)
+5. T-150-036 managed-docs-cache.json git-untrack canlı
+6. T-150-035 retention canlı tetiklendi (sprint boundary trigger)
+7. Sprint 149 paradoksu (27/27 fake DONE vs Sprint 150 gerçek 37/41)
+8. Worker `coverage=0` rubric schema ihlali (Sprint 151 T-151-NEW-D)
+9. T-150-034 config flat provider removal yarım kalıp H3 ile tamamlandı
+10. T-150-007 Docker HB fix Sprint 146-148 debt tamamen kapanmadı (vitest timeout kayboldu H2 sonrası)
+11. T-150-029 `scripts/sync-manifest.mjs` canlı 16 active feature listeledi
+12. Gate.json generation pipeline canlı (sprint-150-gate.json yazıldı)
+13. **Sprint 139 T-041 DECKENT→USER:NOTIFY kanalı 12 sprint ölü kaldıktan sonra H6+H7 ile canlandı** — Alperen terminal'inde `ℹ️ [deckent] Task H6 DONE` okundu
+
+### Sprint 151 P0 Debt (Hot Fix ile Taşınan)
+| Debt | Kaynak | Sprint 151 Task |
+|------|--------|-----------------|
+| Vitest 9 residual fail (config-sprint064 + error-handling whitelist) | H2 kalan | T-151-NEW-E (minor fix) |
+| Brain evaluator verification-blind + global build race + rubric schema | Sprint 150 retro | T-151-NEW-D |
+| Docker HB 3-sprint debt (vitest timeout cascade) | Sprint 146-148-150 | T-151-NEW-G |
+| MODE_PRESETS duplicate (`config.ts:84-105` vs `mode-presets.ts`) | H3 opsiyonel scope | T-151-NEW-H (opsiyonel) |
+| `src/orchestra/task-mode-runner.ts` bare `throw new Error` whitelist | Sprint 150 T-003 | T-151-NEW-D kapsamı |
+| `fix-of-fix` retry spawn ama execute edilmedi (max_fix_retries=1 limit) | Sprint 150 FIX phase | T-151-NEW-D-3 FIX context enrichment |
+
+---
+
+---
+
+## 1. Vizyon Özeti
+
+Deckent = **Sprint Mode** (developer orchestrator, GO/NO-GO disiplin) **+ Task Mode** (günlük life assistant, OpenClaw benzeri) birleşik platform. Config-driven (`deckent_style: "sprint" | "task"`) tek mode aktif, user tercih eder.
+
+**OpenClaw benchmarkı** (Kasım 2025 launch → 346K star / 5 ay / %20 malicious skill):
+- Deckent **daha olgun** başlıyor (%99.12 test coverage, 41 ADR, 148 sprint discipline)
+- Deckent **daha güvenli** (AST sandbox + Ed25519 signature)
+- Deckent **eşit hızda evrimleşmeli** (post-launch bug fix frenzy = community building)
+
+**Beta GA hedef:** Sprint 150 Perşembe 23 Nis 2026 TRT — `v1.0.0-beta.1`
+
+**God-level GA hedef:** Sprint 200 (~6 ay sonra, Ekim-Kasım 2026) — `v1.0.0` stable
+
+---
+
+## 2. Anchor Kararlar (Alperen Onaylı)
+
+### 2.1 Mode Architecture
+- **Config key:** `deckent_style: "sprint" | "task"` (kod kelimesi çakışması önlemek için `style`)
+- **Single mode aktif** — dual değil, config ile toggle
+- **2-layer user ayarı**: `~/.deckent/config.json` global + `./project/.deckent/config.json` project override (mevcut ADR-004 3-layer merge üzerine)
+- **CLI**: `deckent mode task` / `deckent mode sprint` / `deckent mode auto` (context-detect)
+
+### 2.2 Hub Repo
+- **Ayrı repo**: `VerhexIO/deckent-hub` (OpenClaw ClawHub pattern parity)
+- **20 seed skill** Sprint 149 (spotify-control, telegram-bot, calendar-google, email-imap, weather-forecast, rss-reader, web-scraper, github-issues, slack-notifier, notion-sync, todoist, spotify-playlist, youtube-downloader, reddit-fetcher, twitter-post, screenshot-vision, file-organizer, currency-converter, translator, discord-moderator)
+- **Signing**: Ed25519 (Deckent'in OpenClaw %20 malicious sorununa yanıtı)
+- **`deckent skill publish`** — sign + push to registry
+
+### 2.3 Messaging Trio
+- **Discord** (developer community, local bot kurulumu)
+- **Telegram** (genel user, Türkiye'de popüler)
+- **WhatsApp** (hazırlık scaffold, aktivasyon Business API onayı sonrası)
+- **Local-first**: User kendi bot API key `.deck` file'a yazar veya ENV'den ref verir
+
+### 2.4 Public Repo Açılışı
+- **`VerhexIO/deckent`** repo hazır Sprint 149 sonu
+- Sprint 150 Alperen manual flip — göz kontrolü sonrası public
+
+### 2.5 Milestone-Gated Features
+- **Voice (STT/TTS)**: 10K GitHub star sonrası (Sprint 171-180)
+- **Mobile app**: 50K GitHub star sonrası (Sprint 181-200)
+- **Cloud hosted**: v1.0 GA sonrası opsiyonel
+
+### 2.6 Güvenlik Prensibi
+- **AST sandbox** zorunlu (zaten var, OpenClaw'da yok)
+- **Ed25519 signature** zorunlu (Sprint 149 yeni)
+- **`.deck` secret file** — hiç commit olmaz, interpolation ile config'e ref
+- **Dockerfile non-root** — USER directive zorunlu (Sprint 149 fix)
+- **OpenClaw %20 malicious antitheziyiz** — pazarlama mesajımız
+
+---
+
+## 3. Kod Tabanı Gap Analizi (Sprint 148 sonrası)
+
+### 3.1 Hazırlık Oranı
+
+| Alan | Hazır % | Gerekçe |
+|------|---------|---------|
+| Messaging/Connectors | **20%** | Provider+dispatcher pattern var, 0 adapter |
+| Hub/Skill Marketplace | **75%** | Sandbox+registry-client+install CLI var, Ed25519+separate repo eksik |
+| Config & Mode Toggle | **95%** | 3-layer merge+env+.deck hepsi var, sadece `deckent_style` key ekleme |
+| Security + .deck | **85%** | P0 4/5 kapalı (shell/path/memory.db/API auth), Dockerfile root+.deck interpolation eksik |
+| Nervous + Dashboard + Daemon | **80%** | 5 detector+SSE+heartbeat-daemon var, chat tab+`deckentd`+Electron yok |
+| **GENEL HAZIR** | **71%** | God-level'e sandığımızdan yakın |
+
+### 3.2 Reuse Edilecek Mevcut Altyapı (ZATEN VAR)
+
+**Messaging:**
+- `src/core/provider.ts:32-82` — ProviderAdapter interface (template)
+- `src/nervous/dispatcher.ts:40-42` — ChannelAdapter (extend)
+- `src/core/notification-dispatcher.ts:30-34` — NotificationAdapter (outgoing Discord/Slack)
+- `src/api/server.ts:283-545` — HTTP server + Zod + rate limiter
+
+**Hub:**
+- `src/core/marketplace/skill-sandbox.ts:70-168` — AST sandbox (eval, Function, child_process, fs, process.env blok)
+- `src/core/marketplace/registry-client.ts:1-79` — RegistryClient HTTP/HTTPS
+- `src/cli/commands/skill.ts:286-454` — `skill install <source>` (git + SHA256)
+- `src/orchestra/promotion-pipeline.ts:12-74` — PromotionPipeline
+- `src/core/credentials.ts:54-241` — AES-256-GCM
+
+**Config:**
+- `src/core/config.ts:636-812` — 3-layer merge
+- `src/core/deck-file.ts:1-199` — `.deck` format (11 known keys, gitignore enforcement)
+- `src/core/global-config.ts:17-74` — `~/.deckent/` erişim
+
+**Security:**
+- Sprint 143-144'te kapalı: shell injection (tmux.ts), path traversal (validators.ts), memory.db (.gitignore), API auth (auth.ts)
+
+**Nervous + Dashboard:**
+- `src/nervous/detector-registry.ts:1-120` — 5 active + extension pattern
+- `src/dashboard/src/pages/*` — 6 page React+Vite+Tailwind
+- `src/api/server.ts:416-428` — SSE `/api/events`
+- `src/cli/commands/run.ts` + `src/mcp/tools/run.ts:19-112` — `deckent run` one-shot
+- `src/orchestra/heartbeat-daemon.ts:1-120` — heartbeat daemon
+
+### 3.3 TAMAMEN YENİ — Yazılacak
+
+**Sprint 149 (Çar 22 Nis) — 27 task, ~1450 LoC yeni:**
+- Block A: `deckent_style` config key (5-6 satır modif)
+- Block B: Dockerfile USER + `.deck` interpolation (~150 LoC)
+- Block C: `src/connectors/` 6 module Discord+Telegram+WhatsApp+pool+router (~800 LoC)
+- Block D: Ed25519 + VerhexIO/deckent-hub repo + 20 seed skill (~400 LoC)
+- Block E: Doc consolidation (388 .md review)
+- Block F: ADR-041 accept + npm publish dry-run v1.0.0-beta.1
+
+**Sprint 150 (Per 23 Nis) — Beta GA:**
+- npm publish v1.0.0-beta.1
+- Dashboard ChatPage.tsx (7. page)
+- deckent-hub public flip
+- Discord + Telegram bots canlı
+
+---
+
+## 4. Sprint 149-200 Master Roadmap (2026-04-21 güncellendi)
+
+> **🕓 HISTORICAL (2026-04-21 snapshot).** Sprint-numaralı temalar 1:1 gerçekleşmedi —
+> güncel temel ⚡ 2026-05-19. Bu bölüm orijinal plan kaydı olarak korunur.
+
+### Phase 1: Beta GA Launch (Sprint 149-151)
+**Hedef: Solid launch + community preview**
+
+| Sprint | Gün | Tema | Task | Çıktı | Durum |
+|--------|-----|------|------|-------|-------|
+| **149** | Pzr 20 Nis | Hybrid Foundation — attempt 1 | 27 task | FAİL (DIRECTIVES kayboldu), attempt1 arşivi | ❌ FAİL |
+| **150** | Pzr 20 Nis (re-run) | Hybrid Foundation + Debt Liquidation + 2026-04-21 Konsolidasyon | 38 task (8 block × 7 wave) | 37/41 DONE (%90), 4 NO_GO, 17/20 Beta GA gate açıldı, +8032 LoC, 13 meta-dogfood kanıt | ✅ DONE |
+| **150A** | Sal 21 Nis | 🔧 **HOT FIX WITH CLAUDE SUBAGENTS** (Deckent kırıkken) | 7 hot fix (H1..H7) | CLI düzeldi, vitest %99.94, retention+rotation+notification wire canlı, DECKENT→USER:NOTIFY ilk kanıt | ✅ DONE |
+| **151** | Çar 22 Nis | 🚀 BETA GA CUTOVER v1.0.0-beta.1 + P0 Residual Debt | ~13-15 task | npm publish + public repo flip + Discord/Telegram launch + T-NEW-A/B/C/D/E/F/G residual fix | ⏳ Plan |
+
+**Hot Fix Session (Sprint 150A — 2026-04-21):**
+Sprint 150 kırık haliyle Deckent'le Deckent'i tamir sonsuz döngü riskinden kaçınmak için Alperen direktifiyle Claude Code subagent'lar ile cerrahi müdahale. 7 hot fix, ~68 dakika, ~1M token, 145+ file, +6047/-5473 LoC. Canlı kanıt: `ℹ️ [deckent] Task H6 DONE` Alperen terminal'inde göründü — DECKENT→USER:NOTIFY 12 sprint sonra canlandı.
+
+### Phase 2: Post-Launch Bug Frenzy + Messaging (Sprint 152-160)
+**Hedef: Community feedback + messaging ecosystem + hub growth**
+
+Not: Sprint 151 Beta GA cutover'a kaydı, Phase 2 bir sprint kaydı. 2026-04-21 Hot Fix session direct Sprint 151'e connect ediyor.
+
+| Sprint | Gün | Tema | Task |
+|--------|-----|------|------|
+| 152 | Per 23 Nis | Community Bug Triage Week 1 — P0 fixes (community reported) | 10-15 task |
+| 153 | Cum 24 Nis | WhatsApp Business API activation + Slack connector + Email (IMAP/SMTP) | 12 task |
+| 154 | Pzt 27 Nis | Hub Growth — 20 → 50 skill + moderation CI + rating system | 10 task |
+| 155 | Sal 28 Nis | Feature requests triage + routing V4 + skill heuristics | 12 task |
+| 156 | Çar 29 Nis | Adaptive agent activation (analiz → öneri + autonomous apply) | 10 task |
+| 157 | Per 30 Nis | DeckentHub moderation queue + CI auto-signature + Ed25519 rotation | 10 task |
+| 158 | Cum 1 May | Messaging polish + thread management + user context memory | 10 task |
+| 159 | Pzt 4 May | Nervous system 6-10 detector activation (Sprint 147 plan) | 10 task |
+| 160 | Sal 5 May | CLI/MCP parity audit + i18n TR/EN gaps + docs site | 12 task |
+| 161 | Çar 6 May | Marketplace 50 → 100 skill + vector search (FTS5 extend) | 10 task |
+
+### Phase 3: Daemon + Local AI + Polish (Sprint 161-170)
+**Hedef: 7/24 background operation + local model support**
+
+| Sprint | Tema | Anahtar Çıktı |
+|--------|------|---------------|
+| 161 | `deckentd` daemon wrapper | systemd/launchd service files, PID management |
+| 162 | Electron tray (optional) + desktop app scaffold | macOS/Linux tray icon |
+| 163 | Local LLM (Ollama) integration | Ollama adapter + config |
+| 164 | Groq + Fireworks + Together AI adapters | litellm proxy pattern |
+| 165 | Embeddings (OpenAI + Voyage + local) | RAG-ready skill context |
+| 166 | SWE-bench benchmark run + publish score | competitive positioning |
+| 167 | Monorepo support (multi-project sprint) | workspace-aware planner |
+| 168 | Template gallery (DIRECTIVES library) | 20 project template |
+| 169 | Blog post + tutorial campaign | 10 long-form content |
+| 170 | 1st month retrospective + 10K star push | Hacker News/Twitter round 2 |
+
+### Phase 4: Voice + Intelligence (Sprint 171-180)
+**Gate: 10K+ GitHub star (Alperen milestone)**
+
+| Sprint | Tema |
+|--------|------|
+| 171-173 | STT (Whisper) adapter + wake word (Porcupine) |
+| 174-176 | TTS (OpenAI Voice + ElevenLabs) + real-time streaming |
+| 177-178 | Voice-activated sprint commands |
+| 179-180 | Voice UX polish + accessibility |
+
+### Phase 5: Mobile (Sprint 181-200)
+**Gate: 50K+ GitHub star (Alperen milestone)**
+
+| Sprint | Tema |
+|--------|------|
+| 181-185 | React Native iOS/Android MCP client |
+| 186-190 | Push notifications (APNs + FCM) |
+| 191-195 | Mobile-specific skills (Contacts, GPS, camera) |
+| 196-200 | v1.0.0 stable GA — "God-level üstün" launch |
+
+---
+
+## 5. Beta GA (Sprint 151) Exit Criteria — 20 Gate (BETA-TRACKER + Sprint 150 Konsolidasyon)
+
+> **🕓 HISTORICAL (2026-04-21, "17/20").** Güncel beta = 1 Haziran 2026 (⚡ 2026-05-19).
+> Tablo kanıt olarak korunur.
+
+**Durum (2026-04-21 Hot Fix session sonrası): 17/20 açıldı** ✅
+
+| # | Gate | Hedef | Mevcut | Durum |
+|---|------|-------|--------|-------|
+| 1 | `tsc --noEmit` 0 errors | 0 | 0 error | ✅ PASS |
+| 2 | vitest ≥ %99.5 pass | 99.5%+ | **%99.94** (9 fail / 15671 pass) | ✅ **H2 ile aşıldı** |
+| 3 | Coverage ≥ 85% | 85%+ | ~%52 (uzun vadeli, Sprint 160+) | 🔄 Phase 2 |
+| 4 | 27+ MCP tool functional | 27+ | 30 (yeni: audit/feature_query/recover) | ✅ PASS |
+| 5 | 45+ CLI komut functional | 45+ | 49 (H1 sonrası) | ✅ PASS |
+| 6 | `npm pack --dry-run` temiz | 0 warning | 1.08MB, 0 warning | ✅ T-150-026 |
+| 7 | Cross-platform 3/3 | 3/3 | 3/3 | ✅ Sprint 148 |
+| 8 | Multi-provider 3/3 | 3/3 | 3/3 | ✅ Sprint 148 |
+| 9 | `deckent_style` toggle canlı | sprint/task switch | canlı | ✅ T-150-001..003 |
+| 10 | Memory V2 stress test | Pass | Pass | ✅ Sprint 145 |
+| 11 | Documentation sync | Current | Sprint 150 post-update, 151 güncelle | 🟡 Sprint 151 |
+| 12 | Built-in Bundle (npm pack) | 15+21 bundle | 36/36 bundle'da | ✅ T-150-031 P0 |
+| 13 | Messaging trio smoke test | Discord+Telegram canlı | Connectors deploy, bot credentials Sprint 151 | 🟡 Sprint 151 |
+| 14 | Dockerfile USER non-root | non-root | USER deckent | ✅ T-150-005 |
+| 15 | DeckentHub 20 seed skill | 20 published + signed | Ed25519 infra canlı, publish Sprint 151 | 🟡 Sprint 151 |
+| 16 | Config duplicate removal | ✅ | Flat providers silindi | ✅ H3 |
+| 17 | Managed-docs cache git-untrack | ✅ | git-untrack | ✅ T-150-036 |
+| 18 | docs.json private/public split | ✅ | template + runtime split | ✅ T-150-037 |
+| 19 | Metrics.jsonl rotation | rotate | 268KB → 0, gzip archive | ✅ H5 canlı |
+| 20 | Sprint file count ≤ 60 | ≤ 60 | 17 → 10 sprint (54 file) | ✅ H4 canlı |
+
+**Sprint 151 Beta GA için kalan 3 gate:** #3 (coverage long-term), #13 (messaging smoke), #15 (hub publish). Messaging + hub Sprint 151 cutover işleri.
+
+---
+
+## 6. Taşınan Debt (Sprint 148 → 149 → 150 → 151)
+
+> **🕓 HISTORICAL (2026-04-21 snapshot).** Güncel debt için `.brain/exports/debt.md`.
+> Bu bölüm kanıt olarak korunur.
+
+### Sprint 148 → 149 (tarihsel)
+8 item: Docker HB + scope sanitizer + auditor stale + Dockerfile root + .deck interpolation + ADR-041 reform kalıntı → hepsi Sprint 149/150 tarafından kapatıldı.
+
+### Sprint 150 → 151 (Hot Fix sonrası kalan)
+
+| Debt | Öncelik | Kaynak | Sprint 151 Task |
+|------|---------|--------|-----------------|
+| Brain evaluator verification-blind (filesChanged=0 → false NO_GO) | **P0** | Sprint 150 retro (T-008/022/028) | **T-151-NEW-D** 5-in-1 rubric fix |
+| Worker coverage field missing (rubric 4D → max 75/100) | **P0** | Sprint 150 retro schema gap | **T-151-NEW-D-2** |
+| FIX task context enrichment (brain NO_GO gerekçesi yok) | **P0** | T-008 fix döngü | **T-151-NEW-D-3** |
+| Global build race (sprint-ortası TSC fail → rubric düşüşü) | **P0** | T-028 pre-existing errors | **T-151-NEW-D-4** |
+| Scope compliance heuristic relaxation (T-007/T-009 scope=0) | P1 | Sprint 150 retro | **T-151-NEW-D-5** |
+| Vitest 9 residual (config-sprint064 `claude_backend` + error-handling whitelist) | P1 | H2 kalan | **T-151-NEW-E** |
+| MODE_PRESETS duplicate (`config.ts:84-105` vs `mode-presets.ts`) | P2 | H3 opsiyonel scope | **T-151-NEW-H** (opsiyonel) |
+| Docker HB + vitest timeout debt 3-sprint spiral | P0 | Sprint 146-148-150 | **T-151-NEW-G** |
+| CLI 49 komut tam smoke test harness | P1 | Alperen direktif | **T-151-NEW-C** |
+
+**Toplam:** 9 P0/P1 debt → Sprint 151'e entegre. Beta GA cutover 8 roadmap task ile birlikte **~13-15 task Sprint 151 DIRECTIVES**.
+
+---
+
+## 7. Rekabet Konumu — OpenClaw vs Deckent
+
+| Kriter | OpenClaw (Nis 2026) | Deckent (Nis 2026) | Değerlendirme |
+|--------|---------------------|---------------------|---------------|
+| GitHub star | 346K (5 ay) | 0 (launch bekleyen) | OpenClaw momentum 🏆 |
+| Mevcut skill | 44K (%20 malicious) | 21 built-in + 20 seed | OpenClaw scale, Deckent quality 🏆 |
+| Target audience | Life assistant (genel user) | Developer + life dual | Deckent geniş 🏆 |
+| Security | AST eksik, %20 malicious skandal | AST sandbox + Ed25519 | Deckent 🏆 |
+| Multi-provider | 200+ LLM | 3 provider + 13 model | OpenClaw 🏆 |
+| Voice/Speech | ✅ macOS/iOS/Android | ❌ yok (10K star sonrası) | OpenClaw 🏆 |
+| Mobile | ✅ | ❌ (50K star sonrası) | OpenClaw 🏆 |
+| Messaging | WhatsApp/iMessage/SMS | Discord+Telegram+WhatsApp | Eşitleniyor 🤝 |
+| Sprint discipline | ❌ ad-hoc | ✅ GO/NO-GO + rubric | Deckent 🏆 |
+| Self-healing nervous | ❌ reactive | ✅ 5 detector proactive | Deckent 🏆 |
+| Test coverage | ? bilinmiyor | %99.12 (15256 test) | Deckent 🏆 |
+| Memory system | Session state | DB-first SQLite FTS5 i18n | Deckent 🏆 |
+| ADR governance | ❌ yok | ✅ 41 ADR MADR v3 | Deckent 🏆 |
+
+**Deckent'in rekabet stratejisi:** "Open source, AST-sandboxed, disciplined alternative to OpenClaw — developer-first ama hayat asistanı olabilir."
+
+---
+
+## 8. Pazarlama Mesajları (Sprint 150 Launch)
+
+### Ana Tagline Adayları
+1. **"The AI orchestrator OpenClaw never built — for developers who want discipline."**
+2. **"148 sprints. 99.12% test coverage. 0 malicious skills. Open source."**
+3. **"Deckent: Sprint Mode + Task Mode. Developer + Life Assistant. One platform."**
+
+### USP (Unique Selling Points)
+- **Sprint Discipline**: GO/NO-GO gates + rubric grading (hiçbir rakipte yok)
+- **Nervous System**: Proactive detector (Deckent sees problems before you do)
+- **AST Sandbox**: Zero malicious skills (OpenClaw %20 problem çözümü)
+- **Multi-Provider Freedom**: Claude + Codex + Gemini (vendor lock-in yok)
+- **Memory V2**: SQLite FTS5 dual-layer i18n (Turkish + English + German %100 recall)
+- **Dual Mode**: Sprint (developer) + Task (life assistant) single platform
+- **148 Sprint Battle-Tested**: solo dev disiplin + public evolution
+
+### Launch Kanalları (Sprint 150 Perşembe 10:00 TRT = 03:00 EST)
+1. Show HN — "Deckent: Open source AI orchestrator with nervous system (Solo dev, 148 sprints)"
+2. Reddit r/LocalLLaMA + r/programming + r/opensource
+3. Twitter thread (Alperen hesabı)
+4. Turkish dev Twitter (Webtekno, ShiftDelete, Teknokulis)
+5. Discord server launch (community hub)
+6. Dev.to post + Hashnode
+
+---
+
+## 9. Risk Matrix (Sprint 149-200)
+
+| Risk | Olasılık | Etki | Mitigation |
+|------|----------|------|------------|
+| Sprint 149 8h aşımı (27 task) | Orta | Orta | Block E-F ertelenebilir Sprint 150'ye |
+| Sprint 150 launch provider error | Düşük | Yüksek | npm publish --dry-run Sprint 149'da |
+| Community no-show Sprint 150 | Orta | Yüksek | Turkish dev network ile pre-announce |
+| Hub skill security breach | Düşük | Yüksek | Ed25519 + CI sandbox scan zorunlu |
+| WhatsApp Business API red | Orta | Orta | Scaffold Sprint 149, aktivasyon Sprint 152+ |
+| Post-launch bug flood | **Yüksek** | Orta | **Bu beklenen** — Sprint 151 community triage |
+| Sprint 149 AI mode yine fail | Orta | Düşük | Structured fallback hazır |
+| God-level 50 sprint sürer | Orta | Düşük | OpenClaw 24 ayda 0→70K, biz 6 ayda 10K+ hedef |
+| Solo dev burnout | Orta | Yüksek | Sprint pace < 2/gün, milestone-gated features |
+
+---
+
+## 10. Bağlantılı Dokümanlar
+
+- `BETA-TRACKER.md` + `BETA-TRACKER-TR.md` — sprint-level exit criteria
+- `DECKENT-MASTER-BLUEPRINT.md` — architectural blueprint
+- `DECKENT-ANA-PLAN-TR.md` — Turkish master plan
+- `VISION.md` + `VISION-TR.md` — product vision
+- `COMPETITIVE-ANALYSIS.md` — rekabet analizi
+- `docs/audits/sprint-132/FINAL-EXECUTIVE-REPORT.md` — god-audit 233 findings
+- `.deckent/sprint-god-analysis/FINAL-REPORT.md` — 317 files × 74K LoC analysis
+- `docs/analysis/competitive-analysis.md` — OpenClaw/Cursor/Devin head-to-head
+- `docs/superpowers/specs/2026-04-20-sprint-148-meta-dogfood-design.md` — Sprint 148 spec
+- `.brain/exports/summary.md` — 41 ADR registry
+
+---
+
+## 11. Anchor Kuralları — Yoldan Şaşmamak İçin
+
+1. **Sprint 151 Beta GA Çarşamba 22 Nis** — (Sprint 150 re-run + Hot Fix sonrası güncel hedef), catastrophic fail dışında ertelenmez
+2. **ADR-041 Agent Taxonomy** — Sprint 148 reform kalıcı (15 vertical agents), testing horizontal skill olarak korunur, vertical testing agent tekrar eklenmez
+3. **Nervous system production-critical** — her sprint'te event kanıtı aranır; **2026-04-21 Hot Fix H6 sonrası DECKENT→USER:NOTIFY canlı** + nervous bridge aktif
+4. **Ed25519 signature zorunlu** — imzasız skill hub'a kabul edilmez
+5. **Deckent "ürün değil servis"** — SaaS/paywall/enterprise edition yasak (ADR-033)
+6. **Milestone-gated**: Voice 10K, Mobile 50K (Alperen kararı)
+7. **Solo dev hikayesi** pazarlama asset'idir — solo + sprint disiplini = USP
+8. **OpenClaw mesafe azalıyor** — her sprint rekabet pozisyonu güncellenir
+9. **.deck + AST sandbox + Ed25519 = güvenlik DNA'sı** — bu üçlüden taviz yok
+10. **Doküman-önce-kod** — her sprint öncesi design spec + DIRECTIVES
+11. **Hot Fix with Claude Subagents pattern (2026-04-21 kurulmuş)** — Deckent kırıkken Deckent'le Deckent'i tamir sonsuz döngü riski. Kritik P0 bug'ları cerrahi müdahale için Claude Code `Agent` tool (`general-purpose` subagent) ile paralel/sequential çözülür. Deckent sprint pipeline bypass edilir, sadece **deploy-level bug fix** için uygulanır. Sprint 150A (H1..H7, ~68dk) ilk canlı uygulama, rekor kabul.
+12. **Meta-dogfood kanıt sayacı per-sprint** — Sprint 146 (1), Sprint 147 (3), Sprint 148 (6), Sprint 150 (11) + Sprint 150A Hot Fix (13). Her sprint kendi kodu kendi canlı kanıtladığı bulgu sayısı rekor artıyor.
+
+---
+
+**İmza (orijinal):** Koordinatör (5 paralel agent analiz + Alperen 12 karar + OpenClaw rekabet verisi)
+**İmza (2026-04-21 Hot Fix güncellemesi):** Koordinatör (Claude Code subagent-driven hot fix session — H1..H7 7 paralel/sequential general-purpose subagent, ~68dk, ~1M token, 145+ file, DECKENT→USER:NOTIFY 12 sprint sonra canlandı)
+**Diriliş:** Bu doküman Sprint 149-200 canlı — her sprint sonu güncellenecek
+**Sonraki revize:** Sprint 151 Beta GA cutover sonrası — npm publish + public repo flip + Show HN launch metrikleri ile güncelle
diff --git a/docs/SPRINT-LOG.md b/docs/SPRINT-LOG.md
index 64aadb16d..0aa55fda5 100644
--- a/docs/SPRINT-LOG.md
+++ b/docs/SPRINT-LOG.md
@@ -4761,3 +4761,44 @@ Sprint 080: Dashboard zenginleştirildi. SSE bağlantı durumu göstergesi eklen
 - 174-006: Kit index + tutarlılık — canva-kit/README.md (DONE)
 
 ---
+## Sprint 175 — sprint-175
+
+**Status:** RETROSPECTIVE
+**Date:** 2026-05-19
+**Duration:** 3849s
+
+### Results
+
+| Metric | Value |
+|--------|-------|
+| Total Tasks | 37 |
+| Completed | 21 |
+| Tech Debt | 2 |
+| No-Go | 16 |
+| Coverage | 15.0% |
+| Duration | 3849199ms |
+
+### Tasks
+
+- 175-001: W0.1 — Runtime deps (node-pty + ws) (DONE)
+- 175-002: W0.2 — ADR-010 amendment ext + ADR-062 (DONE)
+- 175-003: W0.3 — TerminalConfig → DeckentConfig (DONE)
+- 175-004: W0.4 — Shared terminal types (DONE)
+- 175-005: W1.1 — AuthProvider (bypass-independent) (DONE)
+- 175-006: W1.2 — SessionBackend + LocalPtyBackend (NO_GO)
+- 175-007: W1.3 — TerminalAudit (tenant-scoped DB) (DONE)
+- 175-008: W1.4 — PtySessionManager (NO_GO)
+- 175-009: W2.1 — WS gateway (auth-before-bridge + reattach) (DONE)
+- 175-010: W2.2 — HTTP control + localhost bootstrap inject (NO_GO)
+- 175-011: W2.3 — serve CLI surface (DONE)
+- 175-012: W3.1 — xterm deps + terminal-api (DONE)
+- 175-013: W3.2 — useTerminalSocket (DONE)
+- 175-014: W3.3 — TerminalView (xterm) (NO_GO)
+- 175-015: W3.4 — TerminalTabs + TerminalPanel (NO_GO)
+- 175-016: W3.5 — DockPanel + Layout (NO_GO)
+- 175-017: W3.6 — ConfigPage Terminal kategori + i18n (NO_GO)
+- 175-018: W4.1 — E2E reattach integration (NO_GO)
+- 175-019: W4.2 — Docs (guide EN+TR + reference) (DONE)
+- 175-020: W4.3 — Final verification (GO_WITH_TECH_DEBT)
+
+---
diff --git a/docs/adr/010-tek-runtime-dependency-commander-js.md b/docs/adr/010-tek-runtime-dependency-commander-js.md
index 1b458c369..fc43670c3 100644
--- a/docs/adr/010-tek-runtime-dependency-commander-js.md
+++ b/docs/adr/010-tek-runtime-dependency-commander-js.md
@@ -33,5 +33,7 @@
 | `zod` | `^3.25.0` | Plan/config schema validation at runtime | Task planner validation (Sprint 044+) |
 | `@noble/ed25519` | `^2.3.0` | Ed25519 signing for `.deck` secret files | ADR-014: .deck Secret File System |
 | `@noble/hashes` | `^1.8.0` | SHA-512 hashing for `.deck` key derivation | ADR-014: .deck Secret File System |
+| `node-pty` | `^1.0.0` | Interactive PTY for embedded web terminal (claude/gemini/codex/shell sessions) | ADR-062: Embedded Web Terminal |
+| `ws` | `^8.18.0` | Browser WebSocket transport for terminal stream (audited zero-dep; hand-rolled RFC6455 rejected as a security surface) | ADR-062: Embedded Web Terminal |
 
-**Consequence:** The principle shifts from "1 dependency" to "minimum necessary, every dependency ADR-backed". Any new runtime dependency proposal must include an ADR reference or a new ADR. The dependency count (7) reflects the full product scope — CLI + MCP + Memory + Connectors + Crypto.
+**Consequence:** The principle shifts from "1 dependency" to "minimum necessary, every dependency ADR-backed". Any new runtime dependency proposal must include an ADR reference or a new ADR. The dependency count (9) reflects the full product scope — CLI + MCP + Memory + Connectors + Crypto + Embedded Web Terminal (Sprint 175).
diff --git a/docs/adr/030-template-engine-plugin-loader-managed-docs-render-pipeline.md b/docs/adr/030-template-engine-plugin-loader-managed-docs-render-pipeline.md
index 0b6e3948a..2d51252a9 100644
--- a/docs/adr/030-template-engine-plugin-loader-managed-docs-render-pipeline.md
+++ b/docs/adr/030-template-engine-plugin-loader-managed-docs-render-pipeline.md
@@ -20,7 +20,7 @@ Built-in generator sistemi genişletilemez yapıda kalırsa, her yeni section t
 İki katmanlı extensibility sistemi tasarlandı:
 
 **Katman 1: Template Renderer (`template-renderer.ts`)**
-- `{{path.to.value}}` placeholder syntax — `DocUpdateContext`'e karşı çözümlenir
+- `&#123;&#123;path.to.value&#125;&#125;` placeholder syntax — `DocUpdateContext`'e karşı çözümlenir
 - `buildTemplateScope()` — sprint result, config, metrikler, agent/skill sayıları, paket versiyonu gibi standart değerleri scope'a ekler
 - `resolvePath()` — nokta-ayrılmış yol üzerinden nested nesne/Map erişimi
 - `renderTemplate()` — regex replace, unresolved placeholder → boş string (non-fatal)
@@ -35,7 +35,7 @@ Built-in generator sistemi genişletilemez yapıda kalırsa, her yeni section t
 Güvenlik kararı: JSON generator'lar `loadUserGeneratorsSync()` ile sync olarak sprint içinde çalışır; MJS generator'lar ise ayrı `loadUserGeneratorsAsync()` çağrısı gerektirir ve yalnızca güvenilen kaynaklardan yüklenmelidir.
 
 **Consequences (+):**
-- Template syntax öğrenme eğrisi düşük — `{{metrics.coveragePercent}}%` yeterli
+- Template syntax öğrenme eğrisi düşük — `&#123;&#123;metrics.coveragePercent&#125;&#125;%` yeterli
 - JSON format code review kolaylığı ve static analysis uyumluluğu sağlar
 - MJS format güçlü extensibility (herhangi bir hesaplama yapılabilir)
 - User generator'lar built-in'leri override edebilir — proje-spesifik davranış mümkün
diff --git a/docs/adr/062-embedded-web-terminal.md b/docs/adr/062-embedded-web-terminal.md
new file mode 100644
index 000000000..58f63e4c0
--- /dev/null
+++ b/docs/adr/062-embedded-web-terminal.md
@@ -0,0 +1,241 @@
+# ADR-062: Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit
+
+**Status:** accepted
+
+**Deciders:** Alperen Sartaçoğlu (product owner), Brain (orchestrator)
+
+**Date:** 2026-05-19
+
+**Sprint:** Sprint 175 (Embedded Web Terminal — Sub-project #1/4)
+
+---
+
+## Status
+
+accepted — implements the VSCode-like dockable terminal feature for the deckent dashboard.
+Sub-project #1/4; sub-projects #2 (prompt/command guard), #3 (multi-tenant/k8s isolation),
+#4 (enterprise external integration) are deferred to separate sprints.
+
+> **Numbering note (Sprint 175, RESOLVED):** A collision with
+> `docs/adr/062-consent-based-provisioning.md` (Sprint 175 Workstream A, same date)
+> was resolved by renaming the consent-based ADR to `063-consent-based-provisioning.md`.
+> This file retains `062-` per its spec/plan precedent. `memory.db` `adr-062` already
+> points to this Embedded Web Terminal record.
+
+---
+
+## Context
+
+The deckent dashboard (React + Vite + Tailwind) provides sprint monitoring but offers no
+way to run interactive AI tools (`claude`, `gemini`, `codex`, `deckent`) or a shell session
+directly from the browser. Users must switch between the dashboard and a terminal, breaking
+focus during sprint supervision.
+
+Sprint 172–174 stabilised the dashboard and completed OSS GA preparation. Sprint 175 adds
+an embedded terminal as sub-project #1 of a 4-part roadmap.
+
+Key constraints established in the verified spec (`docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md`):
+
+1. **Security invariant (§1c.2):** The terminal WebSocket auth is **independent of and
+   stricter than** `DECKENT_API_AUTH_DISABLED`. Disabling the global API auth gate does
+   NOT open the shell. This invariant must never be relaxed (RCE surface if violated).
+
+2. **Auth delivery (§1c):** The token is generated per-server-start, injected into the
+   index.html page only for `127.0.0.1`/`::1` callers as `window.__DECKENT_TERMINAL_TOKEN__`,
+   and presented via the `Sec-WebSocket-Protocol` subprotocol header (never in a plain HTTP
+   Authorization header on the WS upgrade).
+
+3. **Audit invariant:** Raw PTY output (ANSI sequences, user keystrokes, command output)
+   is **never persisted** to disk or `memory.db`. Only structured, low-volume audit events
+   (session created/attached/detached/killed) are stored, scoped by `tenantId`.
+
+4. **Reattach boundary:** A PTY session survives client disconnect (browser tab closed,
+   network blip) and can be reattached with scrollback replay. It does NOT survive a server
+   restart (in-memory only). Disk persistence is a post-#1 backlog item.
+
+5. **Enterprise seams (§1d):** `AuthProvider` and `SessionBackend` interfaces are defined
+   from day one, with exactly one implementation each (`LocalTokenAuthProvider`,
+   `LocalPtyBackend`). Multi-tenant SSO, remote backends, and k8s pod exec are deferred
+   to sub-project #3.
+
+---
+
+## Decision
+
+A self-contained terminal subsystem is added under `src/api/terminal/` with the following
+components and contracts:
+
+### Module Boundary
+
+```
+src/api/terminal/
+  types.ts          — shared types (TenantId, SessionKind, AiTool, CreateSessionInput,
+                       SessionMeta, AuditAction, AuditEvent)
+  auth-provider.ts  — AuthProvider interface + LocalTokenAuthProvider
+  session-backend.ts — SessionBackend interface + LocalPtyBackend (node-pty)
+  session-manager.ts — PtySessionManager (Map, bounded ring buffer, attach/detach, reaper)
+  audit.ts          — TerminalAudit (structured events → memory.db, tenant-scoped)
+  ws-gateway.ts     — attachTerminalGateway (HTTP upgrade → auth → bridge)
+```
+
+`src/api/server.ts` wires the gateway, exposes HTTP control routes (`GET/POST/DELETE
+/api/terminal/sessions`), and injects the bootstrap token into `index.html` for localhost
+callers only.
+
+`src/cli/commands/serve.ts` adds `--host <addr>` (default `127.0.0.1`) and `--no-terminal`
+options; non-localhost `--host` without explicit token triggers a security warning and
+leaves terminal disabled unless the user opts in explicitly.
+
+### AuthProvider Interface
+
+```typescript
+interface AuthProvider {
+  verifyToken(token: string): boolean | Promise<boolean>;
+}
+```
+
+`LocalTokenAuthProvider` implements this with SHA-256 + `crypto.timingSafeEqual`. It
+deliberately ignores `DECKENT_API_AUTH_DISABLED` — auth bypass applies only to the REST
+API, not to the PTY shell.
+
+### SessionBackend Interface
+
+```typescript
+interface SessionBackend {
+  spawn(input: CreateSessionInput, tenantId: TenantId): PtySession;
+}
+```
+
+`LocalPtyBackend` wraps `node-pty` for in-process PTY spawning. Remote backends (k8s exec,
+Docker exec, SSH) are sub-project #3 implementations of this interface.
+
+### PtySessionManager
+
+- Sessions stored in a `Map<string, PtySessionEntry>` keyed by `sessionId` (UUID).
+- Each session holds an in-memory bounded ring buffer (configurable `scrollbackBytes`,
+  default 256 KiB) for reattach replay. Buffer does not overflow to disk.
+- `detach(sessionId)` releases the client WebSocket reference without killing the PTY
+  process. `kill(sessionId)` terminates the process and removes the entry.
+- Idle reaper runs on a configurable interval; deckent-managed sessions (kind `deckent`)
+  are exempt from idle-kill to avoid interrupting active sprints.
+- `maxSessions` cap (default 10) rejects new spawns when the limit is reached.
+
+### WS Gateway
+
+`attachTerminalGateway(server, deps)` hooks `server.on('upgrade')`:
+
+1. Token is extracted from `Sec-WebSocket-Protocol: deckent.<token>` — never from
+   query string or cookie.
+2. `AuthProvider.verifyToken()` is called **before** any session is spawned or a WebSocket
+   is accepted. On failure: `socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n')` + destroy.
+3. On success: `new WebSocket(socket)` with `handleProtocols` returning the matched
+   subprotocol; gateway forwards PTY output → WS and WS data → PTY stdin/resize.
+4. On WS close: `manager.detach(sessionId)` — session remains alive for reattach.
+
+### TerminalConfig
+
+Added to `DeckentConfig` via the `terminal` key:
+
+```typescript
+interface TerminalConfig {
+  enabled: boolean;          // default: true
+  bind: string;              // default: '127.0.0.1'
+  maxSessions: number;       // default: 10
+  idleTimeoutMs: number;     // default: 1_800_000 (30 min)
+  scrollbackBytes: number;   // default: 262_144 (256 KiB)
+  allowShellKind: boolean;   // default: true
+}
+```
+
+### Audit
+
+`TerminalAudit.record(event)` writes structured `AuditEvent` objects (session lifecycle
+only) to `memory.db` via the existing `MemoryStore`. The `memory.db` schema gains an
+additive `tenant_id TEXT` column via a non-destructive `ALTER TABLE` migration guarded by
+`schema_version`. Raw PTY bytes are never passed to this function.
+
+### Frontend
+
+A `DockPanel` component wraps a `TerminalPanel` (multi-tab, `TerminalTabs` + `TerminalView`
+using `@xterm/xterm`). The dock is mounted outside the React Router `<Outlet>` in
+`Layout.tsx` so it persists across route navigation. The WS hook (`useTerminalSocket`)
+reads `window.__DECKENT_TERMINAL_TOKEN__` and presents it via the `Sec-WebSocket-Protocol`
+subprotocol.
+
+---
+
+## Consequences
+
+### Positive
+
+- Dashboard gains real interactive terminal capability without leaving the browser.
+- Security-by-default: localhost-only token injection, bypass-independent auth, no raw
+  output persistence — RCE surface stays closed.
+- Enterprise extensibility built in from day one via `AuthProvider`/`SessionBackend` seams.
+- Reattach survives browser disconnect without server-side storage.
+- Audit trail (structured events only) integrates with existing `memory.db` infrastructure.
+
+### Negative / Risks
+
+- `node-pty` is a native addon — requires platform-specific prebuilt or compilation.
+  Handled by `node-pty`'s prebuilt binary system; `npm install` fails loudly if a platform
+  is unsupported (acceptable failure mode, not silent).
+- PTY sessions are in-memory: a server restart loses all sessions. Disk persistence is a
+  post-#1 backlog item (acceptable, documented boundary).
+- `scrollbackBytes` cap means long-running sessions lose early output after the buffer
+  wraps. Users requiring full history should pipe to a log file inside the PTY.
+- The `--host` non-localhost path requires users to manage their own TLS + token delivery
+  (no HTTPS termination built in); spec §5 documents this explicitly.
+
+---
+
+## Alternatives Considered
+
+- **xtermjs hosted via iframe / separate server:** Rejected — cross-origin auth complexity,
+  no shared token injection, user must manage a second process.
+- **Hand-rolled RFC6455 WebSocket server:** Rejected — security surface (frame parsing bugs,
+  masking errors); `ws` library is audited with zero runtime deps of its own.
+- **Persist raw PTY output to `memory.db`:** Rejected — ANSI escape sequences + keystrokes
+  are PII-adjacent and exceed the "structured audit only" security invariant. Raw output
+  may contain passwords, API keys, and personal data.
+- **Global auth bypass applies to terminal too:** Rejected — `DECKENT_API_AUTH_DISABLED`
+  was designed for local dev API convenience, not for shell access. Conflating the two would
+  create an RCE vector (spec §1c.2, B-022).
+- **No session limit / unbounded ring buffer:** Rejected — DoS vector; bounded defaults
+  with configurable overrides are the correct trade-off.
+
+---
+
+## Related ADRs
+
+- **ADR-006** — spawnSync Security Pattern: `LocalPtyBackend` spawn uses array args,
+  `shell: false` (except `win32` npm wrapper), mirroring the existing secure spawn pattern.
+- **ADR-010** — Minimal runtime dependencies: `ws` + `node-pty` added as the 8th and 9th
+  runtime deps, both ADR-justified (this record).
+- **ADR-014** — .deck Secret File System: terminal token uses `randomUUID()` (crypto-random,
+  not `.deck`-managed); complementary, not conflicting.
+- **ADR-016** — Connector Module: `AuthProvider`/`SessionBackend` follow the same
+  interface + local-impl pattern established for connectors.
+- **ADR-034** — Multi-Project Isolation: `tenantId` on audit events prepares the audit
+  trail for multi-project isolation when sub-project #3 lands.
+- **ADR-036** — ADR Governance Integration: this ADR is the runtime constraint record for
+  the terminal subsystem; enforced via Brain prompt enrichment.
+- **ADR-039** — Self-Modifying Task Detection: terminal touches `src/api/` + `src/dashboard/`
+  → dogfood mode triggered → sequential execution mandatory (verified in DIRECTIVES).
+- **ADR-045** — Wave-Based Execution Semantics: terminal implementation uses 5-wave
+  sequential structure (Wave 0→4) due to self-modifying-detector dogfood mode.
+- **ADR-047** — Manuel Subagent Dispatch Protocol: wave gate transitions are Brain-managed
+  manually per this ADR (dependency_pipeline_enabled: false for deckent-dev project).
+
+## Notes
+
+DB sync: this `.md` is intended for upsert into `memory.db` via the ADR-046 `adrInsert`
+post-finalize hook (`adr-file-sync.ts`) — never via destructive rebuild.
+
+Sub-project roadmap:
+- **#1 (this sprint):** Core terminal: PTY sessions, WS gateway, auth, audit, frontend dock
+- **#2:** Security: prompt/command guard — prevent dangerous command patterns
+- **#3:** Multi-tenant isolation: `AuthProvider`/`SessionBackend` k8s/SSO implementations
+- **#4:** Enterprise external integration: remote PTY backends, audit export, SIEM hooks
+
+**İmza:** Brain (orchestrator) — Sprint 175 Wave 0.
diff --git a/docs/adr/063-consent-based-provisioning.md b/docs/adr/063-consent-based-provisioning.md
new file mode 100644
index 000000000..e9674020a
--- /dev/null
+++ b/docs/adr/063-consent-based-provisioning.md
@@ -0,0 +1,104 @@
+# ADR-063: Consent-Based Prerequisite Provisioning
+
+> **Numbering note (Sprint 175):** This ADR was originally numbered 062 alongside
+> `062-embedded-web-terminal.md` (Sprint 175 concurrent work). Renamed to 063 to
+> resolve the collision; the Embedded Web Terminal ADR retains 062 per its
+> spec/plan precedent.
+
+**Status:** accepted
+**Deciders:** Alperen Sartaçoğlu (product owner), Brain (orchestrator)
+**Date:** 2026-05-19
+**Sprint:** Sprint 175 (1 Haziran Beta — Kusursuz Kurulum Deneyimi, Workstream A)
+
+---
+
+## Status
+
+accepted — implements the blueprint §3.4 "anyone can install & use" promise. Documents an
+implemented + TDD-tested capability (`src/core/provisioner.ts`, 23 tests). Geç-ADR pattern
+(implementation-first documentation), accepted Deckent practice (cf. ADR-053, ADR-061 Notes).
+
+## Context
+
+`deckent init` / `deckent doctor` only **detected** missing prerequisites and printed a hint
+string (`getProviderInstallHint` in `doctor.ts:410` + duplicated in `doctor-format.ts:69`).
+blueprint §3.4 falsely claimed "tmux auto-installed on first run if missing" — no install path
+existed anywhere (`spawnSync('npm', ['install', ...])` was absent from the codebase).
+
+For the 1 Haziran OSS public beta the critical-path goal is a frictionless install experience
+("Deckent herkesin kurabileceği kolaylık"). A non-developer running `deckent init` should be
+guided to a working setup, not handed a list of manual `npm i -g` commands. But silently
+installing global packages / running OS package managers is a security- and trust-sensitive
+action that must not happen without explicit user consent.
+
+## Decision
+
+A single provisioning module (`src/core/provisioner.ts`) is the source of truth for "how is a
+prerequisite installed", consent-gated and OS-aware:
+
+1. **`planInstall(tool, opts)`** — deterministic, pure mapping `ToolId → InstallPlan`:
+   - `claude/codex/gemini` → `method: 'npm-global'`, `npm install -g <pkg>`
+   - `tmux` → `method: 'os-package'` — OS-aware instruction (apt/dnf/pacman/brew)
+   - `node`, `docker` → `method: 'manual'` — never auto-installed (runtime / privileged)
+2. **`installTool`** — only `npm-global` plans are auto-executed, and only when
+   `consent === true`. Array args, `shell: false` (shell:true ONLY on win32 for the npm `.cmd`
+   wrapper, mirroring `provider.ts:detectCliVersion`). Executable checked against
+   `PROVISIONER_BIN_WHITELIST` (frozen, `['npm']` — `sh`/`bash` intentionally absent). Non-zero
+   exit returns `{ status: 'failed' }` (never throws). `os-package`/`manual` are surfaced as an
+   instruction string the user runs themselves — **no silent sudo**.
+3. **`provisionMissing`** — orchestration: `mode` ∈ `prompt | yes | no-install`.
+   - `prompt` (default) — per-tool consent prompt
+   - `yes` (CLI `--yes`, MCP `installMissing:true`) — install all without prompting (CI)
+   - `no-install` (CLI `--no-install`) — legacy hint-only behavior preserved (backward compat)
+4. **Single source of truth** — `getProviderInstallHint` (both `doctor.ts` and
+   `doctor-format.ts` copies) now delegates the package mapping to `planInstall`; legacy hint
+   string format preserved (no test/UX regression).
+5. **MCP parity** — `deckent_init` gains an `installMissing` opt-in (MCP has no interactive
+   consent channel, so it is explicit opt-in === CLI `--yes`; default reports only).
+
+## Alternatives Considered
+
+- **Silent auto-install (no consent).** Rejected — installing global npm packages / OS
+  packages without consent violates user trust and the security DNA (ROADMAP §11 anchor #9).
+- **Keep hint-only.** Rejected — does not meet the beta "frictionless install" goal.
+- **Bundle provider CLIs as deps.** Rejected — bloats the package, conflicts with ADR-010
+  (minimal runtime dependencies) and provider-agnostic vision.
+
+## Consequences
+
+### Positive
+- `deckent init` becomes a real provisioner — closes the blueprint §3.4 reality gap.
+- Security-preserving: consent-gated, whitelist + shell-free spawn (companion to ADR-006
+  spawnSync pattern + `spawn-safety.ts`), no silent sudo.
+- Single source of truth removes the duplicated install-hint mapping (DRY across 3 sites).
+- Backward compatible: `--no-install` preserves the prior hint-only behavior exactly.
+
+### Negative / Risks
+- Global `npm i -g` may require elevated permissions on some setups; failures are reported
+  with the manual command (graceful, non-fatal) rather than auto-escalating.
+- OS-package (tmux) still requires a manual user step on Linux (sudo) — by design.
+- Provider CLI package names (`@anthropic-ai/claude-code`, `@openai/codex`,
+  `@google/gemini-cli`) are now centralized; if a vendor renames a package, update one place.
+
+## Related ADRs
+
+- **ADR-006** — spawnSync Security Pattern: provisioner spawn obeys the array-args /
+  shell-free invariant; `PROVISIONER_BIN_WHITELIST` is a companion to `spawn-safety.ts`.
+- **ADR-010** — Minimal runtime dependencies: provisioner installs *external* CLIs on
+  consent rather than bundling them as deps.
+- **ADR-011** — node:readline/promises prompt: the interactive consent prompt uses the
+  existing `promptConfirm` helper.
+- **ADR-036** — ADR Governance: this ADR is the runtime contract for the provisioning
+  capability; written as governance record for the implemented behavior.
+
+## Notes
+
+ADR number selected as the next free slot above the highest existing ADR (061). Slots
+049–052 / 054 / 056–059 are intentionally left for the TaskType-taxonomy ADR family
+(ADR-053/055/060 already exist; cf. `project-task-type-taxonomy-vision` memory) to avoid
+cross-family collision. Verified against both `docs/adr/` and `memory.db` (`type='adr'`).
+
+DB sync: this `.md` is upserted into `memory.db` via the ADR-046 `adrInsert` post-finalize
+hook (`adr-file-sync.ts`) — never via destructive rebuild (cf. `feedback_db_silmek_yasak`).
+
+**İmza:** Brain (orchestrator) — Sprint 175 Workstream A, behavior implemented + 23 tests PASS.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 073129f44..16c731886 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -5,9 +5,9 @@
 The canonical source of truth for ADR content is `.brain/memory.db` (Memory V2). This index is generated by scanning `docs/adr/*.md` filenames.
 
 <!-- AUTOGEN:START id="adr-index" -->
-> 52 ADRs. Generated from `docs/adr/*.md`.
+> 54 ADRs. Generated from `docs/adr/*.md`.
 
-**By status:** accepted (48) · deprecated (1) · proposed (3)
+**By status:** accepted (50) · deprecated (1) · proposed (3)
 
 | ID | Title | Status | File |
 |----|-------|--------|------|
@@ -63,4 +63,6 @@ The canonical source of truth for ADR content is `.brain/memory.db` (Memory V2).
 | ADR-055 | Hybrid Scoring 5-Layer Pipeline — Schema / Gates / Quality / Outcome / Auditor | proposed | [`055-hybrid-scoring-pipeline.md`](./055-hybrid-scoring-pipeline.md) |
 | ADR-060 | Self-Awareness Propagation — 5-Channel Context Enrichment Architecture | proposed | [`060-self-awareness-channels.md`](./060-self-awareness-channels.md) |
 | ADR-061 | AEGIS — Agentic Effect-Governed Iterative Stewardship Methodology | proposed | [`061-aegis-methodology.md`](./061-aegis-methodology.md) |
+| ADR-062 | Embedded Web Terminal — PTY Sessions, WS Gateway, Auth & Audit | accepted | [`062-embedded-web-terminal.md`](./062-embedded-web-terminal.md) |
+| ADR-063 | Consent-Based Prerequisite Provisioning | accepted | [`063-consent-based-provisioning.md`](./063-consent-based-provisioning.md) |
 <!-- AUTOGEN:END id="adr-index" -->
diff --git a/docs/assets/logo.png b/docs/assets/logo.png
new file mode 100755
index 000000000..2d37129b8
Binary files /dev/null and b/docs/assets/logo.png differ
diff --git a/docs/audits/sprint-139/dead-code-report.md b/docs/audits/sprint-139/dead-code-report.md
index 7521f73ca..8fded16ce 100644
--- a/docs/audits/sprint-139/dead-code-report.md
+++ b/docs/audits/sprint-139/dead-code-report.md
@@ -1,6 +1,6 @@
 # Dead Code Audit Report — Sprint 139
 
-**Date:** 2026-05-18
+**Date:** 2026-05-19
 **Tool:** scripts/dead-code-audit.mjs
 **Scope:** src/ directory (read-only analysis)
 
@@ -75,7 +75,7 @@ These suspects turned out to be actively used.
 
 ## Unused Export Sampling
 
-Found **719** potentially unused exports across src/.
+Found **730** potentially unused exports across src/.
 Top 20 shown below (full list requires deeper analysis):
 
 | File | Export | Import Count |
diff --git a/docs/audits/sprint-173/load-test-report.md b/docs/audits/sprint-173/load-test-report.md
new file mode 100644
index 000000000..16139e10f
--- /dev/null
+++ b/docs/audits/sprint-173/load-test-report.md
@@ -0,0 +1,45 @@
+# Sprint Load Test Report
+
+Generated: 2026-05-18T19:44:34.059Z
+Total entries: 81
+
+## Wave Timeline
+
+| Time | Wave | Count |
+|------|------|-------|
+| 2026-05-18T19:28:57.265Z | dep-pipeline | 4 |
+| 2026-05-18T19:39:38.559Z | dep-pipeline | 1 |
+
+## Percentile Distribution (p50/p95/p99)
+
+| Operation | Count | p50 | p95 | p99 | Min | Max |
+|-----------|-------|-----|-----|-----|-----|-----|
+| wave.start | 2 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| result.collected | 22 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| collect.batch | 22 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| wave.transition | 12 | 3536.00 | 11235.30 | 12350.26 | 2088.00 | 12629.00 |
+| hb.stale | 20 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| trace:wait_results | 2 | 371040.44 | 573936.43 | 591971.63 | 145600.45 | 596480.43 |
+
+## File Lock Histogram
+
+| Bucket (ms) | Count |
+|-------------|-------|
+| <=0 | 0 |
+| 0-10 | 0 |
+| 10-50 | 0 |
+| 50-100 | 0 |
+| 100-500 | 0 |
+| 500-1000 | 0 |
+| 1000-5000 | 0 |
+| >5000 | 0 |
+
+## Critical Path Analysis
+
+Top 5 slowest operations by p99:
+
+1. **trace:wait_results** — p99: 591971.63ms (2 samples)
+2. **wave.transition** — p99: 12350.26ms (12 samples)
+3. **result.collected** — p99: 1.00ms (22 samples)
+4. **collect.batch** — p99: 1.00ms (22 samples)
+5. **hb.stale** — p99: 1.00ms (20 samples)
diff --git a/docs/audits/sprint-174/load-test-report.md b/docs/audits/sprint-174/load-test-report.md
new file mode 100644
index 000000000..110cf6220
--- /dev/null
+++ b/docs/audits/sprint-174/load-test-report.md
@@ -0,0 +1,45 @@
+# Sprint Load Test Report
+
+Generated: 2026-05-18T20:28:05.178Z
+Total entries: 47
+
+## Wave Timeline
+
+| Time | Wave | Count |
+|------|------|-------|
+| 2026-05-18T20:11:46.661Z | dep-pipeline | 2 |
+| 2026-05-18T20:23:42.724Z | dep-pipeline | 1 |
+
+## Percentile Distribution (p50/p95/p99)
+
+| Operation | Count | p50 | p95 | p99 | Min | Max |
+|-----------|-------|-----|-----|-----|-----|-----|
+| wave.start | 2 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| result.collected | 7 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| collect.batch | 7 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| hb.stale | 25 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| wave.transition | 3 | 3557.00 | 6727.70 | 7009.54 | 3557.00 | 7080.00 |
+| trace:wait_results | 2 | 415941.99 | 698244.19 | 723337.72 | 102272.89 | 729611.10 |
+
+## File Lock Histogram
+
+| Bucket (ms) | Count |
+|-------------|-------|
+| <=0 | 0 |
+| 0-10 | 0 |
+| 10-50 | 0 |
+| 50-100 | 0 |
+| 100-500 | 0 |
+| 500-1000 | 0 |
+| 1000-5000 | 0 |
+| >5000 | 0 |
+
+## Critical Path Analysis
+
+Top 5 slowest operations by p99:
+
+1. **trace:wait_results** — p99: 723337.72ms (2 samples)
+2. **wave.transition** — p99: 7009.54ms (3 samples)
+3. **result.collected** — p99: 1.00ms (7 samples)
+4. **collect.batch** — p99: 1.00ms (7 samples)
+5. **hb.stale** — p99: 1.00ms (25 samples)
diff --git a/docs/audits/sprint-175/load-test-report.md b/docs/audits/sprint-175/load-test-report.md
new file mode 100644
index 000000000..ec342e1d1
--- /dev/null
+++ b/docs/audits/sprint-175/load-test-report.md
@@ -0,0 +1,47 @@
+# Sprint Load Test Report
+
+Generated: 2026-05-19T23:02:06.131Z
+Total entries: 104
+
+## Wave Timeline
+
+| Time | Wave | Count |
+|------|------|-------|
+| 2026-05-19T21:56:41.538Z | legacy | 6 |
+| 2026-05-19T22:32:05.237Z | legacy | 6 |
+
+## Percentile Distribution (p50/p95/p99)
+
+| Operation | Count | p50 | p95 | p99 | Min | Max |
+|-----------|-------|-----|-----|-----|-----|-----|
+| collision.detected | 1 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| wave.start | 2 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| hb.stale | 1 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| result.collected | 36 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| collect.batch | 36 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| queue.force_rescan_spawn | 12 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| honesty.check | 13 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
+| trace:wait_results | 2 | 1806508.98 | 1892439.01 | 1900077.23 | 1711031.17 | 1901986.79 |
+
+## File Lock Histogram
+
+| Bucket (ms) | Count |
+|-------------|-------|
+| <=0 | 0 |
+| 0-10 | 0 |
+| 10-50 | 0 |
+| 50-100 | 0 |
+| 100-500 | 0 |
+| 500-1000 | 0 |
+| 1000-5000 | 0 |
+| >5000 | 0 |
+
+## Critical Path Analysis
+
+Top 5 slowest operations by p99:
+
+1. **trace:wait_results** — p99: 1900077.23ms (2 samples)
+2. **collision.detected** — p99: 1.00ms (1 samples)
+3. **hb.stale** — p99: 1.00ms (1 samples)
+4. **result.collected** — p99: 1.00ms (36 samples)
+5. **collect.batch** — p99: 1.00ms (36 samples)
diff --git a/docs/guide/docker-backend.md b/docs/guide/docker-backend.md
index ebd1ebacb..cbb1a4560 100644
--- a/docs/guide/docker-backend.md
+++ b/docs/guide/docker-backend.md
@@ -372,4 +372,4 @@ sudo chown -R $USER:$USER .locks/
 
 - [Quickstart Guide](quickstart.md) — General sprint setup
 - [Configuration Reference](../reference/config-reference.md) — All config options
-- [Architecture Overview](../architecture/architecture.md) — Sprint lifecycle internals
+- [Architecture Overview](https://github.com/VerhexIO/deckent/blob/main/docs/architecture/architecture.md) — Sprint lifecycle internals
diff --git a/docs/guide/terminal-tr.md b/docs/guide/terminal-tr.md
new file mode 100644
index 000000000..a53de7ddd
--- /dev/null
+++ b/docs/guide/terminal-tr.md
@@ -0,0 +1,207 @@
+# Gömülü Web Terminali
+
+> deckent dashboard'una entegre edilmiş, VSCode benzeri yerleştirilebilir bir terminal. Tarayıcıyı terk etmeden `claude`, `gemini`, `codex`, `deckent` veya düz bir kabuk oturumu başlatın.
+
+---
+
+## Genel Bakış
+
+Gömülü terminal, dashboard'un her sayfasının altına yeniden boyutlandırılabilir bir dock paneli ekler. Oturumlar PTY tabanlıdır (yalnızca komut konsolu değil, tam etkileşimli terminal), dolayısıyla etkileşimli AI CLI'ları yerel terminalinizde olduğu gibi çalışır.
+
+Temel özellikler:
+
+- **Çoklu sekme:** aynı anda birden fazla oturum açabilirsiniz (claude, deckent, shell vb.)
+- **Yeniden bağlanma (reattach):** tarayıcı sekmesini kapatmak oturumu sonlandırmaz — yeniden bağlandığınızda kaydırma tamponu yeniden oynatılır ve canlı akım devam eder
+- **Varsayılan olarak güvenli:** otomatik oluşturulan token ile yalnızca localhost bağlama; manuel kurulum gerekmez
+- **Denetlendi:** her oturum yaşam döngüsü olayı (oluşturma, bağlanma, sonlandırma, kimlik doğrulama) `memory.db`'ye kaydedilir; ham PTY çıktısı **asla** disk üzerine yazılmaz
+
+---
+
+## Terminali Açmak
+
+1. Dashboard'u başlatın: `deckent serve`
+2. Tarayıcıda `http://localhost:3000` adresini açın
+3. Dock panelini genişletmek için terminal simgesine tıklayın (alt çubuk veya `Ctrl+`` kısayolu)
+4. Oturum başlatmak için hızlı başlatma düğmelerinden birine tıklayın:
+   - **claude** — etkileşimli Claude Code oturumu açar
+   - **gemini** — Gemini CLI oturumu açar
+   - **codex** — OpenAI Codex CLI oturumu açar
+   - **deckent** — deckent CLI oturumu açar
+   - **shell** — düz `$SHELL` oturumu açar
+
+---
+
+## Oturum Türleri
+
+| Tür | Komut | Notlar |
+|-----|-------|--------|
+| `claude` | `claude` | Etkileşimli Claude Code CLI |
+| `gemini` | `gemini` | Gemini CLI (`GOOGLE_API_KEY` gerektirir) |
+| `codex` | `codex` | OpenAI Codex CLI (`OPENAI_API_KEY` gerektirir) |
+| `deckent` | `deckent <args>` | deckent CLI |
+| `shell` | `$SHELL` | Düz kabuk; `allowShellKind` ile etkinleştirme/devre dışı bırakma |
+
+---
+
+## Yeniden Bağlanma Davranışı
+
+Oturumlar istemci bağlantısı koptuğunda yaşamaya devam eder. Yalnızca açık sonlandırma veya boşta bekleyen reaper oturumları kapatır.
+
+```
+Tarayıcı sekmesi kapanır ──► WS kapanır ──► PTY yaşamaya devam eder
+                                            ring-buffer dolmaya devam eder (sınırlı)
+
+Tarayıcı yeniden bağlanır ──► WS açılır ──► tampon yeniden oynatılır ──► canlı akım devam eder
+```
+
+**Önemli sınır:** Yeniden bağlanma yalnızca **istemci** bağlantısı kopmaları için geçerlidir. **Sunucu yeniden başlatılırsa** tüm oturumlar kaybolur — bellekte yaşarlar, disk üzerinde değil. Bu, alt proje #1 için kasıtlı bir tasarım kararıdır; disk üzerinde kalıcı oturumlar #1 sonrası kapsama alınacaktır.
+
+`deckent` türündeki oturumlar **boşta kalma reaperından muaftır** — uzun süren bir sprint, etkinlik olmadığı gerekçesiyle sonlandırılmaz. Diğer türler (`claude`, `shell` vb.) `idleTimeoutMs` süresince etkin olmazsa reaper tarafından kapatılır.
+
+---
+
+## Güvenlik Modeli
+
+### Varsayılan olarak localhost
+
+Terminal WebSocket, varsayılan olarak `127.0.0.1`'e bağlanır. Uzaktan erişim için açık bir kabul gereklidir (bkz. [Uzaktan Erişim](#uzaktan-erişim)).
+
+### Token otomatik enjeksiyonu
+
+Başlatma sırasında sunucu rastgele bir oturum token'ı oluşturur. Dashboard sayfası `localhost`'tan yüklendiğinde, sunucu bu token'ı doğrudan HTML'ye yerleştirir:
+
+```html
+<script>window.__DECKENT_TERMINAL_TOKEN__ = "...";</script>
+```
+
+Tarayıcı SPA token'ı okur ve WebSocket subprotocol başlığı olarak iletir:
+
+```
+Sec-WebSocket-Protocol: deckent.<token>
+```
+
+Sunucu, herhangi bir PTY oturumu başlatılmadan **önce** SHA-256 + `timingSafeEqual` kullanarak token'ı doğrular. Reddedilen bir token bağlantıyı hemen kapatır — hiçbir oturum oluşturulmaz.
+
+### Bypass'tan bağımsız kimlik doğrulama
+
+Global API kimlik doğrulama bypass'ı (`DECKENT_API_AUTH_DISABLED=1`), yalnızca okuma amaçlı dashboard geliştirme kolaylığıdır. Terminal kimlik doğrulaması üzerinde **hiçbir etkisi yoktur**. Terminal, bypass etkin olsa bile kendi token'ını zorunlu kılar — sprint durumunu okumak için kullanılan bir kolaylık bayrağı, sessizce uzak bir kabuk açmamalıdır.
+
+Bu, Sprint 171 denetimiyle belirlenen B-022 güvenlik bulgusuna uyumludur.
+
+### Uzaktan Erişim
+
+Uzaktan erişim varsayılan olarak devre dışıdır. Etkinleştirmek için:
+
+1. `.deckent/config.json`'da `terminal.bind`'ı localhost dışı bir adrese ayarlayın veya `deckent serve`'e `--host <addr>` geçin
+2. Güçlü bir token yapılandırıldığından emin olun
+3. **TLS sizin sorumluluğunuzdadır.** deckent'i ağ üzerinden açtığınızda önüne bir ters proxy (nginx, Caddy vb.) koyun. Şifrelenmemiş uzaktan erişim, terminal oturumlarınızı dinlemeye açık bırakır
+
+```bash
+# Örnek: tüm arayüzlere bağlama (her zaman ters proxy ile TLS ekleyin)
+deckent serve --host 0.0.0.0
+```
+
+`--host` localhost dışı bir adrese ayarlanmışsa ve token yapılandırılmamışsa, deckent bir uyarı kaydeder ve **terminali başlatmaz**.
+
+---
+
+## Denetim Zaman Çizelgesi
+
+Her oturum yaşam döngüsü olayı, `memory.db`'de `audit` türü altında yapılandırılmış bir giriş olarak kaydedilir. Denetim günlüğünü şu komutla sorgulayabilirsiniz:
+
+```bash
+deckent recall "terminal audit"
+```
+
+Kaydedilen olaylar:
+
+| Olay | Ne Zaman |
+|------|----------|
+| `auth.ok` | WS el sıkışması başarılı |
+| `auth.deny` | WS el sıkışması reddedildi (hatalı token) |
+| `session.create` | Oturum PTY'si başlatıldı |
+| `session.attach` | İstemci mevcut bir oturuma bağlandı |
+| `session.detach` | İstemci bağlantısı kesildi (oturum yaşamaya devam eder) |
+| `session.kill` | Oturum açıkça sonlandırıldı |
+| `session.exit` | PTY işlemi çıkış yaptı |
+
+**Ham PTY çıktısı asla disk üzerine yazılmaz.** Kaydırma tamponu yalnızca bellektedir (`scrollbackBytes` ile sınırlı). Denetim girdileri yalnızca yapılandırılmış meta veri içerir — terminal içeriği yoktur.
+
+---
+
+## Yapılandırma
+
+`.deckent/config.json`'a varsayılanları geçersiz kılmak için bir `terminal` bölümü ekleyin:
+
+```json
+{
+  "terminal": {
+    "enabled": true,
+    "bind": "127.0.0.1",
+    "maxSessions": 10,
+    "idleTimeoutMs": 1800000,
+    "scrollbackBytes": 262144,
+    "allowShellKind": true
+  }
+}
+```
+
+| Anahtar | Tür | Varsayılan | Açıklama |
+|---------|-----|------------|----------|
+| `enabled` | `boolean` | `true` | Terminal özelliğini tamamen etkinleştirin veya devre dışı bırakın |
+| `bind` | `string` | `"127.0.0.1"` | Terminal WebSocket bağlama adresi. Uzaktan erişim için `"0.0.0.0"` olarak değiştirin (TLS ters proxy gerektirir) |
+| `maxSessions` | `number` | `10` | Maksimum eşzamanlı PTY oturumu sayısı |
+| `idleTimeoutMs` | `number` | `1800000` | Boşta kalma reaper zaman aşımı (ms). Bu süre boyunca etkin olmayan oturumlar kapatılır. `deckent` türü oturumlar muaftır. Varsayılan: 30 dakika |
+| `scrollbackBytes` | `number` | `262144` | Oturum başına bellek içi halka tampon boyutu (bayt). Varsayılan: 256 KB |
+| `allowShellKind` | `boolean` | `true` | Düz `$SHELL` oturumlarına izin verin. Kullanıcıları yalnızca AI CLI oturumlarıyla sınırlamak için `false` olarak ayarlayın |
+
+`deckent serve`'e `--host <addr>` ve `--no-terminal` da geçebilirsiniz:
+
+```bash
+# Terminali tamamen devre dışı bırakın
+deckent serve --no-terminal
+
+# Belirli bir adrese bağlayın
+deckent serve --host 192.168.1.100
+```
+
+---
+
+## Mimari Genel Bakış
+
+```
+Tarayıcı (xterm.js, çoklu sekme)
+   │  WS  /api/terminal/ws       ← el sıkışmada kimlik doğrulama, herhangi bir PTY başlatılmadan ÖNCE
+   │  HTTP /api/terminal/sessions ← mevcut Bearer kimlik doğrulaması
+   ▼
+ws-gateway.ts ──► PtySessionManager ──► node-pty
+                       │
+                       ├── Map<sessionId, { pty, ringBuffer, kind, status }>
+                       ├── attach/detach ≠ kill
+                       ├── sınırlı kaydırma tamponu (yalnızca bellekte)
+                       └── TerminalAudit → memory.db
+```
+
+`AuthProvider` ve `SessionBackend`, başlangıçtan itibaren arayüzlerdir:
+
+- **`AuthProvider`** — bugün: yerel enjekte token; gelecekte: OIDC/SSO/mTLS (alt proje #3)
+- **`SessionBackend`** — bugün: süreç içi `node-pty`; gelecekte: uzak pod-exec (alt proje #3)
+
+---
+
+## Alt Proje Yol Haritası
+
+| # | Kapsam |
+|---|--------|
+| **#1** | Gömülü terminal (bu özellik) — PTY + ws + xterm.js; localhost-varsayılan + token |
+| #2 | Öz-güvenlik — komut/istem koruması; planlayıcı durum hijyeni |
+| #3 | Milyonluk ölçek güvenliği — çok kiracılı izolasyon, sandbox, kaynak limitleri, k8s |
+| #4 | Kurumsal entegrasyonlar — OIDC/SSO, güvenli veri alışverişi |
+
+---
+
+## İlgili
+
+- [Yapılandırma Referansı](/reference/config) — tam yapılandırma belgeleri
+- [Güvenlik Modeli](/reference/security) — deckent genel güvenlik mimarisi
+- [ADR-062](/adr/062-embedded-web-terminal) — gömülü terminal mimari kararları
diff --git a/docs/guide/terminal.md b/docs/guide/terminal.md
new file mode 100644
index 000000000..3ab03e475
--- /dev/null
+++ b/docs/guide/terminal.md
@@ -0,0 +1,207 @@
+# Embedded Web Terminal
+
+> A VSCode-like dockable terminal built into the deckent dashboard. Run `claude`, `gemini`, `codex`, `deckent`, or a plain shell directly from your browser — without leaving the dashboard.
+
+---
+
+## Overview
+
+The embedded terminal adds a resizable dock panel to the bottom of every dashboard page. Sessions are PTY-based (full interactive terminal, not just a command console), so interactive AI CLIs work exactly as they do in your local terminal.
+
+Key properties:
+
+- **Multi-tab:** open multiple sessions simultaneously (claude, deckent, shell, etc.)
+- **Reattach:** closing the browser tab does not kill the session — reconnecting replays the scrollback buffer and resumes the live stream
+- **Secure by default:** localhost-only bind with an auto-generated token; no manual setup required
+- **Audited:** every session lifecycle event (create, attach, kill, auth) is recorded in `memory.db`; raw PTY output is **never** persisted
+
+---
+
+## Opening the Terminal
+
+1. Start the dashboard: `deckent serve`
+2. Open `http://localhost:3000` in your browser
+3. Click the terminal icon (bottom bar, or `Ctrl+`` shortcut) to expand the dock panel
+4. Click a quick-launch button to start a session:
+   - **claude** — opens an interactive Claude Code session
+   - **gemini** — opens a Gemini CLI session
+   - **codex** — opens an OpenAI Codex CLI session
+   - **deckent** — opens a deckent CLI session
+   - **shell** — opens a plain `$SHELL` session
+
+---
+
+## Session Types
+
+| Kind | Command | Notes |
+|------|---------|-------|
+| `claude` | `claude` | Interactive Claude Code CLI |
+| `gemini` | `gemini` | Gemini CLI (requires `GOOGLE_API_KEY`) |
+| `codex` | `codex` | OpenAI Codex CLI (requires `OPENAI_API_KEY`) |
+| `deckent` | `deckent <args>` | deckent CLI |
+| `shell` | `$SHELL` | Plain shell; enable/disable via `allowShellKind` |
+
+---
+
+## Reattach Behavior
+
+Sessions survive client disconnects. Only explicit kills or the idle reaper terminate them.
+
+```
+Browser tab closes ──► WS closes ──► PTY stays alive
+                                      ring-buffer keeps filling (bounded)
+
+Browser reconnects ──► WS opens ──► buffer replays ──► live stream resumes
+```
+
+**Important boundary:** reattach works across **client** disconnects only. A **server restart** clears all sessions — they live in memory, not on disk. This is an explicit design decision for sub-project #1; disk-persisted sessions are post-#1 scope.
+
+`deckent` kind sessions are **exempt from the idle reaper** — a long-running sprint will not be killed due to inactivity. Other kinds (`claude`, `shell`, etc.) are reaped after `idleTimeoutMs` of inactivity.
+
+---
+
+## Security Model
+
+### Localhost by default
+
+The terminal WebSocket binds to `127.0.0.1` by default. Remote access requires an explicit opt-in (see [Remote Access](#remote-access)).
+
+### Token auto-inject
+
+On startup, the server generates a random session token. When the dashboard page is loaded from `localhost`, the server injects this token directly into the HTML:
+
+```html
+<script>window.__DECKENT_TERMINAL_TOKEN__ = "...";</script>
+```
+
+The browser SPA reads the token and passes it as a WebSocket subprotocol header:
+
+```
+Sec-WebSocket-Protocol: deckent.<token>
+```
+
+The server verifies the token using SHA-256 + `timingSafeEqual` **before** any PTY session is spawned. A rejected token closes the connection immediately — no session is created.
+
+### Bypass-independent auth
+
+The global API auth bypass (`DECKENT_API_AUTH_DISABLED=1`) is a read-only dashboard development convenience. It has **no effect on terminal authentication**. The terminal enforces its own token even when the bypass is active — a convenience flag for reading sprint status must never silently open a remote shell.
+
+This aligns with B-022 (security finding from Sprint 171 audit).
+
+### Remote access
+
+Remote access is disabled by default. To enable it:
+
+1. Set `terminal.bind` to a non-localhost address in `.deckent/config.json`, or pass `--host <addr>` to `deckent serve`
+2. Ensure a strong token is configured
+3. **You are responsible for TLS.** Use a reverse proxy (nginx, Caddy, etc.) in front of deckent when exposing it over a network. Unencrypted remote access exposes your terminal sessions to eavesdropping
+
+```bash
+# Example: bind to all interfaces (always add TLS via reverse proxy)
+deckent serve --host 0.0.0.0
+```
+
+If `--host` is set to a non-localhost address and no token is configured, deckent will log a warning and **will not start the terminal**.
+
+---
+
+## Audit Timeline
+
+Every session lifecycle event is recorded as a structured entry in `memory.db` under the `audit` type. You can query the audit log with:
+
+```bash
+deckent recall "terminal audit"
+```
+
+Events recorded:
+
+| Event | When |
+|-------|------|
+| `auth.ok` | WS handshake succeeded |
+| `auth.deny` | WS handshake rejected (bad token) |
+| `session.create` | Session PTY spawned |
+| `session.attach` | Client connected to an existing session |
+| `session.detach` | Client disconnected (session stays alive) |
+| `session.kill` | Session explicitly killed |
+| `session.exit` | PTY process exited |
+
+**Raw PTY output is never persisted.** The scrollback buffer is in-memory only (bounded by `scrollbackBytes`). Audit entries contain only structured metadata — no terminal content.
+
+---
+
+## Configuration
+
+Add a `terminal` section to `.deckent/config.json` to override defaults:
+
+```json
+{
+  "terminal": {
+    "enabled": true,
+    "bind": "127.0.0.1",
+    "maxSessions": 10,
+    "idleTimeoutMs": 1800000,
+    "scrollbackBytes": 262144,
+    "allowShellKind": true
+  }
+}
+```
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| `enabled` | `boolean` | `true` | Enable or disable the terminal feature entirely |
+| `bind` | `string` | `"127.0.0.1"` | Bind address for the terminal WebSocket. Change to `"0.0.0.0"` for remote access (requires TLS reverse proxy) |
+| `maxSessions` | `number` | `10` | Maximum number of concurrent PTY sessions |
+| `idleTimeoutMs` | `number` | `1800000` | Idle reaper timeout (ms). Sessions inactive longer than this are killed. `deckent` kind sessions are exempt. Default: 30 minutes |
+| `scrollbackBytes` | `number` | `262144` | Per-session in-memory ring-buffer size (bytes). Default: 256 KB |
+| `allowShellKind` | `boolean` | `true` | Allow plain `$SHELL` sessions. Set to `false` to restrict users to AI CLI sessions only |
+
+You can also pass `--host <addr>` and `--no-terminal` to `deckent serve`:
+
+```bash
+# Disable the terminal entirely
+deckent serve --no-terminal
+
+# Bind to a specific address
+deckent serve --host 192.168.1.100
+```
+
+---
+
+## Architecture Overview
+
+```
+Browser (xterm.js, multi-tab)
+   │  WS  /api/terminal/ws       ← auth in handshake, BEFORE any PTY spawn
+   │  HTTP /api/terminal/sessions ← existing Bearer auth
+   ▼
+ws-gateway.ts ──► PtySessionManager ──► node-pty
+                       │
+                       ├── Map<sessionId, { pty, ringBuffer, kind, status }>
+                       ├── attach/detach ≠ kill
+                       ├── bounded scrollback (in-memory only)
+                       └── TerminalAudit → memory.db
+```
+
+The `AuthProvider` and `SessionBackend` are interfaces from day one:
+
+- **`AuthProvider`** — today: local injected token; future: OIDC/SSO/mTLS (sub-project #3)
+- **`SessionBackend`** — today: in-process `node-pty`; future: remote pod-exec (sub-project #3)
+
+---
+
+## Sub-project Roadmap
+
+| # | Scope |
+|---|-------|
+| **#1** | Embedded terminal (this feature) — PTY + ws + xterm.js; localhost-default + token |
+| #2 | Self-security — command/prompt guard; planner state hygiene |
+| #3 | Million-scale security — multi-tenant isolation, sandbox, resource limits, k8s |
+| #4 | Enterprise integrations — OIDC/SSO, secure data exchange |
+
+---
+
+## Related
+
+- [Config Reference](/reference/config) — full configuration documentation
+- [Security Model](/reference/security) — deckent overall security architecture
+- [ADR-062](/adr/062-embedded-web-terminal) — embedded terminal architecture decisions
diff --git a/docs/launch/blog-devto-launch.md b/docs/launch/blog-devto-launch.md
index 2436e679d..e451d9326 100644
--- a/docs/launch/blog-devto-launch.md
+++ b/docs/launch/blog-devto-launch.md
@@ -1,7 +1,7 @@
 ---
 title: I Built an AI Orchestrator Over 150 Sprints — Here's What I Learned
 published: false
-description: Six months of solo development, 150+ sprints of self-dogfooding, and one hard-won insight: multi-agent AI systems need sprint discipline, not just fire-and-forget execution.
+description: "Six months of solo development, 150+ sprints of self-dogfooding, and one hard-won insight: multi-agent AI systems need sprint discipline, not just fire-and-forget execution."
 tags: opensource, ai, typescript, productivity
 cover_image: https://github.com/VerhexIO/deckent/raw/main/docs/assets/deckent-cover.png
 canonical_url: https://dev.to/alperensartacoglu/i-built-an-ai-orchestrator-over-150-sprints
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index f656f9fe6..21133636a 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -1006,7 +1006,7 @@ deckent web --dev
 | `deckent memory` | Memory V2 management |
 | `deckent migrate` | Migrate config.json to the latest full format (adds missing fields with defaults) |
 | `deckent mode` | Get/set deckent_style (sprint\|task\|auto) |
-| `deckent nervous` | Configure Nervous System authority mode and action overrides', ) .action(async () => { const root = resolveProjectRoot(); await handleInteractive(root); }); // deckent config nervous set mode <preset> nervousCmd .command('set |
+| `deckent nervous` | Configure Nervous System authority mode and action overrides', ) .action(async () => { const root = resolveProjectRoot(); await handleInteractive(root); }); // deckent config nervous set mode &lt;preset&gt; nervousCmd .command('set |
 | `deckent nervous` | Nervous System dashboard — monitor, accept, reject proactive suggestions |
 | `deckent onboard` | Run the onboarding wizard |
 | `deckent output <taskId>` | Show captured output for a specific worker task |
diff --git a/docs/reference/managed-docs.md b/docs/reference/managed-docs.md
index 76265714e..041b9b695 100644
--- a/docs/reference/managed-docs.md
+++ b/docs/reference/managed-docs.md
@@ -57,7 +57,7 @@ Section headings that Deckent **never** touches. Use this for:
 
 ### templates
 
-User-defined templates per section with `{{path.to.value}}` placeholders resolved against the sprint context. Templates take precedence over built-in generators for matching sections.
+User-defined templates per section with `&#123;&#123;path.to.value&#125;&#125;` placeholders resolved against the sprint context. Templates take precedence over built-in generators for matching sections.
 
 ```json
 {
diff --git a/docs/reference/mcp-tools.md b/docs/reference/mcp-tools.md
index e6f8bbdf8..65fd78bd7 100644
--- a/docs/reference/mcp-tools.md
+++ b/docs/reference/mcp-tools.md
@@ -11,7 +11,7 @@ Deckent ships an MCP server that exposes orchestration to MCP-compatible IDEs (C
 |------|-------|-------------|
 | `deckent_agent_list` | Agent List | List all registered agents in the Deckent project — both built-in and dynamically generated temp agents. |
 | `deckent_analyze_project` | Analyze Project | Analyze the current project to detect: language (TypeScript/JavaScript/Python/Go/Rust/etc.), framework (React/Express/FastAPI/etc.), test framework (vitest/jest/pytest/etc.), build tool (tsc/webpack/vite/etc.), CI system (GitHub Actions/GitLab CI/etc.), project size (small/medium/large based on file count), and methodology recommendation. Returns config suggestions (e.g. recommended plan mode, worker count). Useful before init to pick the right configuration, or to verify stack detection. Does not modify any files. |
-| `deckent_audit` | Sprint Audit | Run Brain Self-Audit Gate for a sprint. Checks tsc, vitest, honesty violations, and observability. Returns gate result (PASS or GATE_FAILURE) and writes to .deckent/<sprint-id>-gate.json. Read-only: does not modify source code or sprint state. |
+| `deckent_audit` | Sprint Audit | Run Brain Self-Audit Gate for a sprint. Checks tsc, vitest, honesty violations, and observability. Returns gate result (PASS or GATE_FAILURE) and writes to .deckent/{sprintId}-gate.json. Read-only: does not modify source code or sprint state. |
 | `deckent_checkpoint` | Checkpoint Management | List, approve, or reject human checkpoints in sprint lifecycle. Checkpoints pause sprint execution at configured phases (plan/evaluate/fix) until a human approves or rejects. Use action=list to see pending checkpoints, action=approve/reject with sprintId and phase to respond. |
 | `deckent_cleanup` | Sprint Cleanup | Remove sprint artifacts and optionally trim memory budget. Deletes all task files (.json, .plan, .hb, .result, .paused, .log) from .tasks/ and all lock files from .locks/. With decay=true, also runs memory decay on .brain/ files if they exceed the line budget (trims MEMORY.md, RETRO.md, sprint logs). Use dryRun=true first to preview what would be deleted. Typically run after a sprint completes (deckent_review) or before starting a fresh sprint after kill. |
 | `deckent_config` | Config Manager | Read, get, or set Deckent configuration values in .deckent/config.json. Three actions: |
diff --git a/docs/reference/security.md b/docs/reference/security.md
index 0b289f3af..383e7df57 100644
--- a/docs/reference/security.md
+++ b/docs/reference/security.md
@@ -335,7 +335,7 @@ Brain reads this file but cannot write it. Workers have no access to it. Changes
 
 ## Related Documentation
 
-- [ADR Index](../adr/) — Architecture Decision Records (ADR-014, ADR-034, ADR-037 govern security)
+- [ADR Index](../adr/README) — Architecture Decision Records (ADR-014, ADR-034, ADR-037 govern security)
 - [Core Concepts](../guide/concepts.md) — Overall system architecture
 - [Config Reference](./config-reference.md) — Security-relevant config keys
 - `.contracts/api-surface.md` — Worker scope contract definition
diff --git a/docs/release/beta-tracker-tr.md b/docs/release/beta-tracker-tr.md
index 40dd4c781..f20c6f1f9 100644
--- a/docs/release/beta-tracker-tr.md
+++ b/docs/release/beta-tracker-tr.md
@@ -1,7 +1,45 @@
 <!-- Dil: TR | Teknik terimler EN -->
 # Deckent Beta Tracker
 
-**Son güncelleme:** 2026-05-14 (Sprint 166 sonrası commit) | **Sprint:** 166 DONE (11/11, 10 DONE + 1 GO_WITH_TECH_DEBT) | **Test:** 16,434+ (Sprint 166'da +35, Sprint 164'ten beri +5.000+) | **Versiyon:** v1.0.0-beta.1 → v1.0.0-beta.2 hedef (Sprint 168 Open Source GA)
+**Son güncelleme:** 2026-05-20 (Sprint 175 — Gömülü Web Terminali teslim edildi) | **Son sprint:** 175 (Alperen tarafından smoke ile doğrulandı) | **Versiyon:** v1.0.0-beta.1 → v1.0.0-beta.2 hedef | **Branch:** `docs/embedded-web-terminal-spec` (origin push'lı)
+
+---
+
+## Sprint 175 — Gömülü Web Terminali (2026-05-19 → 2026-05-20) — TESLİM
+
+Dashboard içinde VSCode-benzeri dock-edilebilir terminal paneli. **4-parçalı agentic-OS yolunun #1 alt-projesi.** Alperen 2026-05-20 smoke kanıtı: `+claude` / `+gemini` / `+shell` sekmeleri gerçek interaktif PTY oturumları tetikledi.
+
+**Teslim edilenler:**
+- `node-pty` PTY backend `SessionBackend` interface'i arkasında (#3 k8s pod-exec için enterprise dikişi)
+- WebSocket gateway, token `Sec-WebSocket-Protocol` subprotocol'ünde; auth pty spawn'dan ÖNCE doğrulanır (tarayıcı `WebSocket`'te `Authorization` header set edemez)
+- `LocalTokenAuthProvider` — bypass-bağımsız (`DECKENT_API_AUTH_DISABLED`'ı **kasıtlı yok-sayar**; SHA-256 + `timingSafeEqual`)
+- HTTP control route'ları (`/api/terminal/sessions` CRUD) + servis edilen `index.html`'e localhost-only `window.__DECKENT_TERMINAL_TOKEN__` enjeksiyonu
+- Çoklu-sekme UI: `claude` / `gemini` / `codex` / `deckent` / shell quick-launch; `DockPanel` React Router `Outlet` DIŞINDA mount'lu (sayfa geçişlerinde oturum kalıcı)
+- tmux-vari reattach: oturum başına sınırlı in-memory scrollback ring buffer, `detach ≠ kill`, e2e test client disconnect sonrası MARKER replay'i doğruluyor (sunucu restart desteklenMEZ — bilinçli sınır)
+- Şeffaf tenant-scoped audit → `memory.db` (sadece düşük-hacim yapısal event; ham PTY çıktısı **asla** persist edilmez)
+- `deckent serve --host` / `--no-terminal` CLI; uzak bind, açık token olmadan terminal'i etkinleştirmeyi reddeder
+- ADR-062 (Embedded Web Terminal) accepted; ADR-010 Sprint-172 Amendment table iki yeni runtime dep ile genişledi (`node-pty`, `ws`) — dep count 7→9, hepsi ADR-gerekçeli
+
+**Metrikler:**
+- 46/46 terminal-spesifik test PASS (backend 30, frontend 15, e2e reattach 1)
+- `tsc --noEmit` temiz; `vite build` SUCCESS (1066KB / gzip 296KB)
+- `npm pack --dry-run` temiz (node-pty + ws bundled)
+- `docs/embedded-web-terminal-spec` üzerinde 17 commit (5 wave-bazlı feature + 2 hotfix + spec/plan/DIRECTIVES + debt closure + #2 backlog notları)
+
+**Dürüst kalan iş:**
+- node-pty linux-x64 prebuild `node-pty@^1.0.0`'da yok — Sprint 175'te manuel workaround uygulandı (`@lydell/node-pty-linux-x64`'tan kopyala); kalıcı fix (optionalDep) Sprint 176 hedefi (~5 dk iş)
+- `DECKENT_API_AUTH_DISABLED=1` dashboard'un terminal-dışı data call'ları (SSE / status / events) için hâlâ gerekli — frontend genel API auth altyapısı yok. Bu terminal regresyonu **değildir** (terminal auth bağımsız), alt-proje #1'in bilinen sınırı (frontend auth altyapısı #2/#3'e ertelendi).
+
+**Alt-proje #2-#4 backlog (spec §1d resmi kayıt):**
+1. Self-security prosedürü (prompt/komut guard) + planner state-hygiene (6 yakalanmış madde: auto-debt-inject empty-scope, re-plan orphan cleanup, DEP0190 `shell:true`, schema-gate `coverage` enforcement, pre-existing WorkerCard/DashboardPage TS errors, doctor `DECISIONS.md` obsolete check)
+2. Milyon-ölçek: multi-tenant izolasyon, gerçek `tenantId`, `SessionBackend` k8s pod-exec impl, sandbox, rate/kaynak limit, OIDC/SSO `AuthProvider` impl
+3. Enterprise dış-dünya entegrasyon + güvenli veri alışverişi (audit zenginleştirme, compliance: SOC2/GDPR)
+
+**Süreç öğrenimleri (kalıcı hafıza yazıldı):**
+- `feedback_trust_brain_eval_not_worker` — worker `.result.selfAssessment` ipucu; Brain evaluation verdict gerçek karar. Çelişebilirler; zor yoldan öğrendim.
+- `feedback_trust_deckent_recovery` — deckent'in kendi FIX phase / recovery kanalları var; manuel müdahale öneri listesinin SON maddesi, ilki değil.
+
+Spec: `docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md`. Plan: `docs/superpowers/plans/2026-05-19-embedded-web-terminal.md`. Kullanıcı rehberi: `docs/guide/terminal-tr.md`. PR: `https://github.com/VerhexIO/deckent-develop/pull/new/docs/embedded-web-terminal-spec`.
 
 ---
 
diff --git a/docs/release/beta-tracker.md b/docs/release/beta-tracker.md
index 91f5ed199..423c4836b 100644
--- a/docs/release/beta-tracker.md
+++ b/docs/release/beta-tracker.md
@@ -1,7 +1,7 @@
 <!-- Language: EN | Technical terms remain as-is -->
 # Deckent Beta Tracker
 
-**Last updated:** 2026-05-14 (Sprint 166 post-commit) | **Sprint:** 166 DONE (11/11, 10 DONE + 1 GO_WITH_TECH_DEBT) | **Tests:** 16,434+ (35+ new in Sprint 166, +5,000+ since Sprint 164) | **Version:** v1.0.0-beta.1 → v1.0.0-beta.2 target (Sprint 168 Open Source GA)
+**Last updated:** 2026-05-20 (Sprint 175 — Embedded Web Terminal delivered) | **Latest sprint:** 175 (operationally smoke-confirmed by user) | **Version:** v1.0.0-beta.1 → v1.0.0-beta.2 target | **Branch:** `docs/embedded-web-terminal-spec` (origin push'd)
 
 **Related:** [roadmap.md](../vision/roadmap.md) — Sprint 149-200 master plan
 
@@ -36,6 +36,44 @@ Before tagging `v1.0.0-beta.2` and running `npm publish`, **all 20 gates must PA
 
 ---
 
+## Sprint 175 — Embedded Web Terminal (2026-05-19 → 2026-05-20) — DELIVERED
+
+VSCode-style dockable terminal panel inside the dashboard. **Sub-project #1 of a 4-part agentic-OS path.** Operationally smoke-confirmed by Alperen on 2026-05-20: `+claude` / `+gemini` / `+shell` tabs all spawn real interactive PTY sessions.
+
+**What shipped:**
+- `node-pty` PTY backend behind `SessionBackend` interface (enterprise seam for #3 k8s pod-exec)
+- WebSocket gateway with token in `Sec-WebSocket-Protocol` subprotocol, auth verified BEFORE pty spawn (browsers can't set `Authorization` on `WebSocket`)
+- `LocalTokenAuthProvider` — bypass-independent (deliberately ignores `DECKENT_API_AUTH_DISABLED`; SHA-256 + `timingSafeEqual`)
+- HTTP control routes (`/api/terminal/sessions` CRUD) + localhost-only bootstrap inject of `window.__DECKENT_TERMINAL_TOKEN__` into served `index.html`
+- Multi-tab UI: `claude` / `gemini` / `codex` / `deckent` / shell quick-launch with `DockPanel` mounted outside the React Router `Outlet` for cross-page session persistence
+- tmux-style reattach: bounded in-memory scrollback ring buffer per session, `detach ≠ kill`, e2e test verifies MARKER replay across client disconnect (server-restart NOT supported — explicit boundary)
+- Transparent tenant-scoped audit → `memory.db` (low-volume structured events only; raw PTY output is **never** persisted)
+- `deckent serve --host` / `--no-terminal` CLI surface; remote bind refuses to enable the terminal without an explicit token
+- ADR-062 (Embedded Web Terminal) accepted; ADR-010 Sprint-172 Amendment extended with both new runtime deps (`node-pty`, `ws`) — dependency count 7→9, all ADR-justified
+
+**Metrics:**
+- 46/46 terminal-specific tests PASS (backend 30, frontend 15, e2e reattach 1)
+- `tsc --noEmit` clean; `vite build` SUCCESS (1066KB / gzip 296KB)
+- `npm pack --dry-run` clean (node-pty + ws bundled)
+- 17 commits on `docs/embedded-web-terminal-spec` (5 wave-based feature commits + 2 hotfixes + spec/plan/DIRECTIVES + debt closure + #2 backlog notes)
+
+**Honest debt:**
+- node-pty linux-x64 prebuild absent in `node-pty@^1.0.0` — manual workaround applied during Sprint 175 (copy from `@lydell/node-pty-linux-x64`); permanent fix (optionalDep) targeted for Sprint 176 (~5 min work)
+- `DECKENT_API_AUTH_DISABLED=1` still required for the dashboard's non-terminal data calls (SSE / status / events) because the frontend has no general API auth plumbing — this is **not** a terminal regression (terminal auth is independent), but a known limit of sub-project #1 (frontend auth infra deferred to #2/#3)
+
+**Sub-project #2-#4 backlog (formal record, spec §1d):**
+1. Self-security procedure (prompt/command guard) + planner state-hygiene (6 captured items: auto-debt-inject empty-scope bug, re-plan orphan cleanup, DEP0190 `shell:true`, schema-gate `coverage` enforcement, pre-existing WorkerCard/DashboardPage TS errors, doctor `DECISIONS.md` obsolete check)
+2. Million-scale: multi-tenant isolation, real `tenantId`, `SessionBackend` k8s pod-exec impl, sandbox, rate/resource limits, OIDC/SSO `AuthProvider` impl
+3. Enterprise external-world integrations + secure data exchange (audit enrichment, compliance: SOC2/GDPR)
+
+**Process learnings (durable feedback memories written):**
+- `feedback_trust_brain_eval_not_worker` — worker `.result.selfAssessment` is a hint; Brain's evaluation verdict is the real gate. They can disagree; I learned the hard way.
+- `feedback_trust_deckent_recovery` — deckent's lifecycle has its own FIX phase / recovery channels; manual intervention is the LAST recommendation, not the first.
+
+Spec: `docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md`. Plan: `docs/superpowers/plans/2026-05-19-embedded-web-terminal.md`. User guide: `docs/guide/terminal.md`. PR: `https://github.com/VerhexIO/deckent-develop/pull/new/docs/embedded-web-terminal-spec`.
+
+---
+
 ## Sprint 145-150 Roadmap — Beta GA Countdown
 
 | Sprint | Day | Theme | Key Deliverables | Readiness |
diff --git a/docs/release/roadmap.md b/docs/release/roadmap.md
index 8eff4bdd4..67bccdf68 100644
--- a/docs/release/roadmap.md
+++ b/docs/release/roadmap.md
@@ -53,6 +53,27 @@ Use Deckent to build Deckent. Validate the sprint loop on real development work.
 
 ---
 
+## Phase 3.6: Embedded Web Terminal (May 2026, Sprint 175) — COMPLETE
+
+VSCode-style dockable terminal panel inside the web dashboard. Sub-project #1 of a 4-part path toward agentic-OS-grade workflows; sub-projects #2-4 (self-security, multi-tenant/k8s, enterprise integrations) follow in dedicated sprints — `AuthProvider`, `SessionBackend`, and `tenantId` seams are in place from day one.
+
+- [x] **PTY backend** — `node-pty` spawn behind a pluggable `SessionBackend` interface (Sprint 175 W1)
+- [x] **WS gateway** — `server.on('upgrade')` + `Sec-WebSocket-Protocol` token auth verified BEFORE pty spawn; backpressure + reattach replay (W2)
+- [x] **HTTP control** — sessions CRUD at `/api/terminal/sessions`; localhost-only bootstrap injection of `window.__DECKENT_TERMINAL_TOKEN__` into served `index.html` (W2)
+- [x] **Bypass-independent auth** — `LocalTokenAuthProvider` deliberately ignores `DECKENT_API_AUTH_DISABLED`; SHA-256 + `timingSafeEqual` constant-time compare; aligns with Sprint-171 B-022 hardening (W1)
+- [x] **Multi-tab UI** — `claude` / `gemini` / `codex` / `deckent` / shell quick-launch; resizable + collapsible bottom `DockPanel` mounted outside the React Router `Outlet` for session persistence across page navigation (W3)
+- [x] **tmux-style reattach** — bounded in-memory scrollback ring buffer per session; `detach ≠ kill`; e2e test verifies MARKER replay across client disconnect (W4)
+- [x] **Transparent audit** — low-volume structured events (session.create/attach/detach/kill/exit, auth.ok/deny) → `memory.db` with `tenant_id` column; raw PTY output is never persisted (W1)
+- [x] **`deckent serve --host` / `--no-terminal`** — remote bind refuses to enable the terminal without an explicit token (spec §5) (W2)
+- [x] **ADR-062 + ADR-010 amendment** — both runtime deps (`node-pty`, `ws`) are ADR-justified (W0)
+- [ ] **Sub-project #2** — self-security procedure (prompt/command guard, planner state-hygiene)
+- [ ] **Sub-project #3** — million-scale: multi-tenant isolation, sandbox, rate/resource limits
+- [ ] **Sub-project #4** — enterprise external-world integrations + secure data exchange
+
+See `docs/guide/terminal.md` for the user guide and ADR-062 for the architectural record.
+
+---
+
 ## Phase 3.5: Multi-Provider & Platform Support (March 2026) — COMPLETE
 
 Make Deckent provider-agnostic and cross-platform ready.
diff --git a/docs/superpowers/plans/2026-05-19-embedded-web-terminal.md b/docs/superpowers/plans/2026-05-19-embedded-web-terminal.md
new file mode 100644
index 000000000..6362238e2
--- /dev/null
+++ b/docs/superpowers/plans/2026-05-19-embedded-web-terminal.md
@@ -0,0 +1,1566 @@
+# Embedded Web Terminal — Implementation Plan (Sub-project #1)
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** A VSCode-like dockable terminal in the deckent dashboard that runs interactive `claude`/`gemini`/`codex`/`deckent`/`shell` PTY sessions over a WebSocket, with tmux-like reattach, secure-by-default localhost auth independent of the global API bypass, and a transparent DB audit trail.
+
+**Architecture:** Backend PTY sessions live in a `PtySessionManager` behind a `SessionBackend` interface (in-process `node-pty` today). A `ws` gateway handles the HTTP `upgrade`, authenticates the token from the `Sec-WebSocket-Protocol` subprotocol via an `AuthProvider` interface (local token today; independent of and stricter than `DECKENT_API_AUTH_DISABLED`), then bridges socket ↔ pty. The server injects the auto-generated token into the served dashboard page only for `127.0.0.1` callers; the SPA reads it and opens the WS. Frontend adds a dock-panel layer to `Layout.tsx` hosting an xterm.js multi-tab panel. Audit events (low-volume, structured, `tenantId`-scoped) go to `memory.db`; raw PTY output is never persisted (in-memory bounded ring buffer only).
+
+**Tech Stack:** TypeScript (ESM, `.js` import suffix), Node `node:http`, `ws`, `node-pty`, `better-sqlite3` (existing MemoryStore), vitest; frontend React 19 + Vite + Tailwind + `@xterm/xterm` + `@xterm/addon-fit`.
+
+**Verified ground truth & locked decisions:** see `docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md` §1c (Step A), §1c.2 (auth root cause), §1d (UX dock + enterprise seams). This plan proceeds only from those verified facts.
+
+**Self-modifying / dogfood:** touches `src/api/` + `src/dashboard/` → `self-modifying-detector.ts` triggers dogfood mode → **sequential execution mandatory**. Sprint DIRECTIVES must declare this; waves below are strictly ordered.
+
+---
+
+## File Structure
+
+**Backend — create:**
+- `src/api/terminal/types.ts` — `SessionKind`, `PtySession`, `TerminalConfig`, `AuditEvent`, `TenantId` (one responsibility: shared terminal types)
+- `src/api/terminal/auth-provider.ts` — `AuthProvider` interface + `LocalTokenAuthProvider` (token compare, bypass-independent)
+- `src/api/terminal/session-backend.ts` — `SessionBackend` interface + `LocalPtyBackend` (node-pty spawn/write/resize/kill)
+- `src/api/terminal/session-manager.ts` — `PtySessionManager` (map, ring buffer, attach/detach, kill, idle reaper)
+- `src/api/terminal/audit.ts` — `TerminalAudit` (structured events → MemoryStore, tenant-scoped)
+- `src/api/terminal/ws-gateway.ts` — `attachTerminalGateway(server, deps)` (upgrade + auth + bridge + protocol)
+
+**Backend — modify:**
+- `src/api/server.ts` — wire gateway; HTTP control routes; localhost-only bootstrap token injection
+- `src/cli/commands/serve.ts` — add `--host`, `--terminal-token`, `--no-terminal` options
+- `src/core/config.ts` + config types file — add `terminal{}` to `DeckentConfig` properly
+- `src/core/memory-store.ts` (+ memory schema) — `audit` entry type + `tenant_id` column migration
+- `package.json` — add `ws`, `node-pty` runtime deps
+- `docs/adr/010-tek-runtime-dependency-commander-js.md` + new `docs/adr/0NN-embedded-web-terminal.md` + DB
+
+**Frontend — create:**
+- `src/dashboard/src/lib/terminal-api.ts` — bootstrap token read + sessions CRUD
+- `src/dashboard/src/components/terminal/useTerminalSocket.ts` — WS hook (reconnect, reattach, subprotocol token)
+- `src/dashboard/src/components/terminal/TerminalView.tsx` — single xterm.js instance bound to a session
+- `src/dashboard/src/components/terminal/TerminalTabs.tsx` — multi-tab bar + quick-launch
+- `src/dashboard/src/components/terminal/TerminalPanel.tsx` — composes tabs + active view
+- `src/dashboard/src/components/DockPanel.tsx` — resizable/collapsible bottom dock layer
+
+**Frontend — modify:**
+- `src/dashboard/src/components/Layout.tsx` — host `DockPanel` containing `TerminalPanel`
+- `src/dashboard/src/pages/ConfigPage.tsx` — add `Terminal` config category (data-only)
+- `src/dashboard/package.json` — add `@xterm/xterm`, `@xterm/addon-fit` devDeps
+- `src/dashboard/src/i18n/en.ts`, `tr.ts` — terminal labels
+
+**Tests — create:** `tests/api/terminal/*.test.ts`, `tests/dashboard/terminal/*.test.tsx`
+
+---
+
+## WAVE 0 — Foundations (deps, ADR, config, types)
+
+### Task 0.1: Add runtime dependencies
+
+**Files:**
+- Modify: `package.json`
+
+- [ ] **Step 1: Add deps**
+
+In `package.json` `"dependencies"`, add (keep alphabetical):
+```json
+"node-pty": "^1.0.0",
+"ws": "^8.18.0"
+```
+And in `"devDependencies"` add:
+```json
+"@types/ws": "^8.5.12"
+```
+
+- [ ] **Step 2: Install & verify build**
+
+Run: `npm install && npm run lint`
+Expected: install succeeds, `tsc --noEmit` exits 0 (no usage yet).
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add package.json package-lock.json
+git commit -m "build: add node-pty + ws runtime deps (embedded terminal)"
+```
+
+### Task 0.2: ADR-010 amendment extension + new ADR
+
+**Files:**
+- Modify: `docs/adr/010-tek-runtime-dependency-commander-js.md`
+- Create: `docs/adr/062-embedded-web-terminal.md` (use the next free number — verify with `ls docs/adr/ | sort | tail`)
+
+- [ ] **Step 1: Extend the existing Sprint-172 Amendment**
+
+In `010-tek-runtime-dependency-commander-js.md`, find the `## Amendment — Sprint 172` section's dependency mapping table and append two rows following the exact existing pattern:
+```markdown
+| `ws` | Embedded Web Terminal (ADR-062) — browser WebSocket transport; audited zero-dep library; hand-rolled RFC6455 rejected as a security surface |
+| `node-pty` | Embedded Web Terminal (ADR-062) — interactive PTY for claude/gemini/codex/shell; no pure-JS equivalent |
+```
+
+- [ ] **Step 2: Create ADR-062**
+
+Create `docs/adr/062-embedded-web-terminal.md` in the same MADR hybrid format as a recent ADR (copy structure from `docs/adr/061-aegis-methodology.md`). Content must state: status `accepted`; decision = PtySessionManager + ws gateway + `AuthProvider`/`SessionBackend` interfaces; security = localhost-default, terminal token independent of and stricter than `DECKENT_API_AUTH_DISABLED` (aligns B-022), token via localhost page-inject → WS subprotocol; transparent `tenantId`-scoped audit in `memory.db`, raw PTY output never persisted; explicit boundary: reattach survives client disconnect, NOT server restart; multi-tenant/k8s deferred to sub-project #3 via the two interfaces.
+
+- [ ] **Step 3: Sync ADR to DB (non-destructive)**
+
+Run: `npm run lint:adr`
+Expected: exit 0 (ADR validator passes). If the project uses a memory sync hook, run the documented ADR→DB upsert (see `.brain` export flow); do **not** rebuild the DB.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add docs/adr/010-tek-runtime-dependency-commander-js.md docs/adr/062-embedded-web-terminal.md
+git commit -m "docs(adr): ADR-010 amendment ext (ws,node-pty) + ADR-062 embedded web terminal"
+```
+
+### Task 0.3: Terminal config in `DeckentConfig` (proper, no bolt-on)
+
+**Files:**
+- Modify: `src/core/config.ts`
+- Modify: the config type file that defines `DeckentConfig` (find via `grep -rn "interface DeckentConfig" src/core`)
+- Test: `tests/core/config-terminal.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/core/config-terminal.test.ts
+import { describe, it, expect } from 'vitest';
+import { loadConfig } from '../../src/core/config.js';
+
+describe('terminal config', () => {
+  it('provides secure defaults', () => {
+    const cfg = loadConfig(process.cwd());
+    expect(cfg.terminal).toBeDefined();
+    expect(cfg.terminal.enabled).toBe(true);
+    expect(cfg.terminal.bind).toBe('127.0.0.1');
+    expect(cfg.terminal.allowShellKind).toBe(true);
+    expect(cfg.terminal.maxSessions).toBe(10);
+    expect(cfg.terminal.idleTimeoutMs).toBe(1_800_000);
+    expect(cfg.terminal.scrollbackBytes).toBe(262_144);
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/core/config-terminal.test.ts`
+Expected: FAIL — `cfg.terminal` is undefined / property missing on type.
+
+- [ ] **Step 3: Add the type**
+
+In the file defining `DeckentConfig`, add a real interface and field (NOT an intersection bolt-on):
+```typescript
+export interface TerminalConfig {
+  enabled: boolean;
+  /** Bind address for the terminal WS. Default 127.0.0.1. */
+  bind: string;
+  /** Max concurrent PTY sessions. */
+  maxSessions: number;
+  /** Idle reaper timeout (ms) for shell/ai kinds; deckent kind exempt. */
+  idleTimeoutMs: number;
+  /** Per-session in-memory scrollback ring buffer size (bytes). */
+  scrollbackBytes: number;
+  /** Whether the plain `shell` session kind is allowed. */
+  allowShellKind: boolean;
+}
+// add to DeckentConfig:
+//   terminal: TerminalConfig;
+```
+
+- [ ] **Step 4: Add defaults + merge**
+
+In `src/core/config.ts` `DEFAULT_CONFIG` (near line 600), add:
+```typescript
+terminal: {
+  enabled: true,
+  bind: '127.0.0.1',
+  maxSessions: 10,
+  idleTimeoutMs: 1_800_000,
+  scrollbackBytes: 262_144,
+  allowShellKind: true,
+},
+```
+In the config merge path(s) (mirror how a nested object like `model_strategy` is merged — find with `grep -n "model_strategy" src/core/config.ts`), merge `terminal` the same way so project overrides apply per-key.
+
+- [ ] **Step 5: Run test to verify it passes**
+
+Run: `npx vitest run tests/core/config-terminal.test.ts && npm run lint`
+Expected: PASS, `tsc --noEmit` exits 0.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/core/ tests/core/config-terminal.test.ts
+git commit -m "feat(config): add TerminalConfig to DeckentConfig with secure defaults"
+```
+
+### Task 0.4: Shared terminal types
+
+**Files:**
+- Create: `src/api/terminal/types.ts`
+
+- [ ] **Step 1: Create the types module**
+
+```typescript
+// src/api/terminal/types.ts
+export type TenantId = string; // "local" today; future: real tenant id (#3 seam)
+export type SessionKind = 'ai' | 'deckent' | 'shell';
+export type AiTool = 'claude' | 'gemini' | 'codex';
+
+export interface CreateSessionInput {
+  kind: SessionKind;
+  tool?: AiTool;            // required when kind==='ai'
+  cwd?: string;
+  args?: string[];          // for kind==='deckent'
+  tenantId?: TenantId;      // default 'local'
+}
+
+export interface SessionMeta {
+  id: string;
+  kind: SessionKind;
+  tenantId: TenantId;
+  createdAt: string;        // ISO 8601
+  status: 'running' | 'exited';
+  exitCode?: number;
+}
+
+export type AuditAction =
+  | 'session.create' | 'session.attach' | 'session.detach'
+  | 'session.kill' | 'session.exit' | 'auth.ok' | 'auth.deny';
+
+export interface AuditEvent {
+  action: AuditAction;
+  tenantId: TenantId;
+  sessionId?: string;
+  detail?: string;          // never raw PTY output — short structured note only
+  at: string;               // ISO 8601
+}
+```
+
+- [ ] **Step 2: Verify build**
+
+Run: `npm run lint`
+Expected: exit 0.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/api/terminal/types.ts
+git commit -m "feat(terminal): shared terminal types (tenant-scoped from day one)"
+```
+
+---
+
+## WAVE 1 — Backend core
+
+### Task 1.1: AuthProvider (bypass-independent local token)
+
+**Files:**
+- Create: `src/api/terminal/auth-provider.ts`
+- Test: `tests/api/terminal/auth-provider.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/api/terminal/auth-provider.test.ts
+import { describe, it, expect } from 'vitest';
+import { LocalTokenAuthProvider } from '../../../src/api/terminal/auth-provider.js';
+
+describe('LocalTokenAuthProvider', () => {
+  it('accepts the correct token', () => {
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify('secret-abc')).toBe(true);
+  });
+  it('rejects a wrong token', () => {
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify('nope')).toBe(false);
+  });
+  it('rejects empty/undefined', () => {
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify(undefined)).toBe(false);
+    expect(p.verify('')).toBe(false);
+  });
+  it('is independent of DECKENT_API_AUTH_DISABLED', () => {
+    process.env['DECKENT_API_AUTH_DISABLED'] = '1';
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify('wrong')).toBe(false); // bypass MUST NOT open the shell
+    delete process.env['DECKENT_API_AUTH_DISABLED'];
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/api/terminal/auth-provider.test.ts`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```typescript
+// src/api/terminal/auth-provider.ts
+import { createHash, timingSafeEqual } from 'node:crypto';
+
+/** Pluggable auth for the terminal WS. Future (#3): OIDC/SSO/mTLS impls. */
+export interface AuthProvider {
+  /** @returns true iff the presented credential is valid. */
+  verify(presented: string | undefined): boolean;
+}
+
+function sha256(s: string): Buffer {
+  return createHash('sha256').update(s).digest();
+}
+
+/**
+ * Local single-token provider. Deliberately ignores DECKENT_API_AUTH_DISABLED:
+ * a read-only-dashboard dev bypass must never silently open a remote shell
+ * (spec §1c.2, aligns with Sprint-171 B-022 hardening).
+ */
+export class LocalTokenAuthProvider implements AuthProvider {
+  private readonly expected: Buffer;
+  constructor(token: string) {
+    if (!token) throw new Error('LocalTokenAuthProvider requires a non-empty token');
+    this.expected = sha256(token);
+  }
+  verify(presented: string | undefined): boolean {
+    if (!presented) return false;
+    const actual = sha256(presented);
+    return timingSafeEqual(actual, this.expected);
+  }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run tests/api/terminal/auth-provider.test.ts`
+Expected: PASS (4 tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/api/terminal/auth-provider.ts tests/api/terminal/auth-provider.test.ts
+git commit -m "feat(terminal): AuthProvider + bypass-independent LocalTokenAuthProvider"
+```
+
+### Task 1.2: SessionBackend interface + LocalPtyBackend
+
+**Files:**
+- Create: `src/api/terminal/session-backend.ts`
+- Test: `tests/api/terminal/session-backend.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/api/terminal/session-backend.test.ts
+import { describe, it, expect } from 'vitest';
+import { LocalPtyBackend } from '../../../src/api/terminal/session-backend.js';
+
+describe('LocalPtyBackend', () => {
+  it('spawns a process, streams output, and reports exit', async () => {
+    const be = new LocalPtyBackend();
+    const chunks: string[] = [];
+    let exitCode: number | undefined;
+    const h = be.spawn(
+      { file: 'bash', args: ['-c', 'echo hello-pty'], cwd: process.cwd() },
+      (d) => chunks.push(d),
+      (code) => { exitCode = code; },
+    );
+    await new Promise<void>((r) => {
+      const t = setInterval(() => { if (exitCode !== undefined) { clearInterval(t); r(); } }, 20);
+    });
+    expect(chunks.join('')).toContain('hello-pty');
+    expect(exitCode).toBe(0);
+    h.kill();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/api/terminal/session-backend.test.ts`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```typescript
+// src/api/terminal/session-backend.ts
+import * as pty from 'node-pty';
+
+export interface SpawnSpec {
+  file: string;
+  args: string[];
+  cwd: string;
+  env?: NodeJS.ProcessEnv;
+  cols?: number;
+  rows?: number;
+}
+export interface BackendHandle {
+  write(data: string): void;
+  resize(cols: number, rows: number): void;
+  kill(): void;
+}
+/** Pluggable execution backend. Future (#3): remote / k8s pod-exec impl. */
+export interface SessionBackend {
+  spawn(
+    spec: SpawnSpec,
+    onData: (data: string) => void,
+    onExit: (code: number) => void,
+  ): BackendHandle;
+}
+
+export class LocalPtyBackend implements SessionBackend {
+  spawn(
+    spec: SpawnSpec,
+    onData: (data: string) => void,
+    onExit: (code: number) => void,
+  ): BackendHandle {
+    const p = pty.spawn(spec.file, spec.args, {
+      name: 'xterm-color',
+      cols: spec.cols ?? 80,
+      rows: spec.rows ?? 24,
+      cwd: spec.cwd,
+      env: { ...process.env, ...spec.env },
+    });
+    p.onData((d) => onData(d));
+    p.onExit(({ exitCode }) => onExit(exitCode));
+    return {
+      write: (data) => p.write(data),
+      resize: (cols, rows) => p.resize(cols, rows),
+      kill: () => { try { p.kill(); } catch { /* already dead */ } },
+    };
+  }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run tests/api/terminal/session-backend.test.ts`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/api/terminal/session-backend.ts tests/api/terminal/session-backend.test.ts
+git commit -m "feat(terminal): SessionBackend interface + LocalPtyBackend (node-pty)"
+```
+
+### Task 1.3: TerminalAudit (structured, tenant-scoped, DB)
+
+**Files:**
+- Create: `src/api/terminal/audit.ts`
+- Modify: `src/core/memory-store.ts` (allow `audit` entry type + `tenant_id` column)
+- Test: `tests/api/terminal/audit.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/api/terminal/audit.test.ts
+import { describe, it, expect } from 'vitest';
+import { TerminalAudit } from '../../../src/api/terminal/audit.js';
+
+describe('TerminalAudit', () => {
+  it('records a structured event and never stores raw output', () => {
+    const recorded: unknown[] = [];
+    const fakeStore = { insert: (e: unknown) => recorded.push(e) };
+    const audit = new TerminalAudit(fakeStore as never);
+    audit.record({
+      action: 'session.create', tenantId: 'local',
+      sessionId: 's1', detail: 'kind=shell', at: new Date().toISOString(),
+    });
+    expect(recorded).toHaveLength(1);
+    const e = recorded[0] as { type: string; tenant_id: string; content: string };
+    expect(e.type).toBe('audit');
+    expect(e.tenant_id).toBe('local');
+    expect(e.content).toContain('session.create');
+    expect(e.content).not.toContain('\x1b['); // no ANSI / raw pty bytes
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/api/terminal/audit.test.ts`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Add `tenant_id` column + `audit` type to MemoryStore**
+
+In `src/core/memory-store.ts`: extend the `entries` table schema with a nullable `tenant_id TEXT` column behind a schema-version migration (follow the existing migration pattern — `grep -n "schema_version\|ALTER TABLE\|CREATE TABLE entries" src/core/memory-store.ts`). Add `'audit'` to the allowed entry `type` union (in `memory-types.ts`). The migration must be additive and non-destructive (never drop/rebuild — see memory: `feedback_db_silmek_yasak`).
+
+- [ ] **Step 4: Implement TerminalAudit**
+
+```typescript
+// src/api/terminal/audit.ts
+import type { AuditEvent } from './types.js';
+
+export interface AuditSink { insert(entry: Record<string, unknown>): void; }
+
+/** Low-volume structured audit → memory.db. Raw PTY output is NEVER passed here. */
+export class TerminalAudit {
+  constructor(private readonly store: AuditSink) {}
+  record(ev: AuditEvent): void {
+    this.store.insert({
+      type: 'audit',
+      tenant_id: ev.tenantId,
+      title: `terminal:${ev.action}`,
+      content: JSON.stringify({
+        action: ev.action, sessionId: ev.sessionId,
+        detail: ev.detail, at: ev.at,
+      }),
+      decay_exempt: true,
+    });
+  }
+}
+```
+
+- [ ] **Step 5: Run test + build**
+
+Run: `npx vitest run tests/api/terminal/audit.test.ts && npm run lint`
+Expected: PASS, exit 0.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/api/terminal/audit.ts src/core/memory-store.ts src/core/memory-types.ts tests/api/terminal/audit.test.ts
+git commit -m "feat(terminal): tenant-scoped DB audit (raw output never persisted)"
+```
+
+### Task 1.4: PtySessionManager (map, ring buffer, attach/detach, reaper)
+
+**Files:**
+- Create: `src/api/terminal/session-manager.ts`
+- Test: `tests/api/terminal/session-manager.test.ts`
+
+- [ ] **Step 1: Write the failing tests**
+
+```typescript
+// tests/api/terminal/session-manager.test.ts
+import { describe, it, expect, vi } from 'vitest';
+import { PtySessionManager } from '../../../src/api/terminal/session-manager.js';
+import type { SessionBackend, BackendHandle } from '../../../src/api/terminal/session-backend.js';
+
+function fakeBackend() {
+  let onDataCb: (d: string) => void = () => {};
+  let onExitCb: (c: number) => void = () => {};
+  const handle: BackendHandle = { write: vi.fn(), resize: vi.fn(), kill: vi.fn() };
+  const be: SessionBackend = {
+    spawn: (_s, onData, onExit) => { onDataCb = onData; onExitCb = onExit; return handle; },
+  };
+  return { be, handle, emit: (d: string) => onDataCb(d), exit: (c: number) => onExitCb(c) };
+}
+
+describe('PtySessionManager', () => {
+  it('creates a session and buffers output (bounded ring)', () => {
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 8, idleTimeoutMs: 0 });
+    const s = m.create({ kind: 'shell' });
+    f.emit('ABCDEFGHIJ'); // 10 bytes into an 8-byte ring
+    expect(m.replay(s.id)).toBe('CDEFGHIJ'); // last 8 bytes only
+  });
+
+  it('detach does NOT kill; kill is explicit', () => {
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 1024, idleTimeoutMs: 0 });
+    const s = m.create({ kind: 'shell' });
+    m.detach(s.id);
+    expect(f.handle.kill).not.toHaveBeenCalled();
+    m.kill(s.id);
+    expect(f.handle.kill).toHaveBeenCalledOnce();
+  });
+
+  it('enforces maxSessions', () => {
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 16, idleTimeoutMs: 0, maxSessions: 1 });
+    m.create({ kind: 'shell' });
+    expect(() => m.create({ kind: 'shell' })).toThrow(/max/i);
+  });
+
+  it('idle reaper kills idle shell but exempts deckent kind', () => {
+    vi.useFakeTimers();
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 16, idleTimeoutMs: 1000 });
+    const shell = m.create({ kind: 'shell' });
+    const dk = m.create({ kind: 'deckent' });
+    vi.advanceTimersByTime(1500);
+    m.reapIdle();
+    expect(m.get(shell.id)).toBeUndefined();
+    expect(m.get(dk.id)).toBeDefined();
+    vi.useRealTimers();
+  });
+});
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `npx vitest run tests/api/terminal/session-manager.test.ts`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```typescript
+// src/api/terminal/session-manager.ts
+import { randomUUID } from 'node:crypto';
+import type { SessionBackend, BackendHandle, SpawnSpec } from './session-backend.js';
+import type { CreateSessionInput, SessionMeta, TenantId } from './types.js';
+
+interface ManagerOpts {
+  scrollbackBytes: number;
+  idleTimeoutMs: number;
+  maxSessions?: number;
+}
+
+interface Session {
+  meta: SessionMeta;
+  handle: BackendHandle;
+  ring: string;            // bounded scrollback (last N bytes)
+  lastActivity: number;
+  listeners: Set<(d: string) => void>;
+}
+
+const KIND_CMD: Record<string, (i: CreateSessionInput) => Pick<SpawnSpec, 'file' | 'args'>> = {
+  ai: (i) => ({ file: i.tool ?? 'claude', args: [] }),
+  deckent: (i) => ({ file: 'deckent', args: i.args ?? [] }),
+  shell: () => ({ file: process.env['SHELL'] ?? 'bash', args: [] }),
+};
+
+export class PtySessionManager {
+  private readonly sessions = new Map<string, Session>();
+  constructor(private readonly backend: SessionBackend, private readonly opts: ManagerOpts) {}
+
+  create(input: CreateSessionInput): SessionMeta {
+    if (this.opts.maxSessions && this.sessions.size >= this.opts.maxSessions) {
+      throw new Error(`max sessions reached (${this.opts.maxSessions})`);
+    }
+    const id = randomUUID();
+    const tenantId: TenantId = input.tenantId ?? 'local';
+    const cmd = (KIND_CMD[input.kind] ?? KIND_CMD['shell'])(input);
+    const meta: SessionMeta = {
+      id, kind: input.kind, tenantId,
+      createdAt: new Date().toISOString(), status: 'running',
+    };
+    const sess: Session = {
+      meta, ring: '', lastActivity: Date.now(), listeners: new Set(),
+      handle: {} as BackendHandle,
+    };
+    sess.handle = this.backend.spawn(
+      { file: cmd.file, args: cmd.args, cwd: input.cwd ?? process.cwd() },
+      (d) => {
+        sess.ring = (sess.ring + d).slice(-this.opts.scrollbackBytes);
+        sess.lastActivity = Date.now();
+        for (const l of sess.listeners) l(d);
+      },
+      (code) => { sess.meta.status = 'exited'; sess.meta.exitCode = code; },
+    );
+    this.sessions.set(id, sess);
+    return meta;
+  }
+
+  get(id: string): SessionMeta | undefined { return this.sessions.get(id)?.meta; }
+  list(): SessionMeta[] { return [...this.sessions.values()].map((s) => s.meta); }
+  replay(id: string): string { return this.sessions.get(id)?.ring ?? ''; }
+
+  write(id: string, data: string): void {
+    const s = this.sessions.get(id);
+    if (!s) return;
+    s.lastActivity = Date.now();
+    s.handle.write(data);
+  }
+  resize(id: string, cols: number, rows: number): void {
+    this.sessions.get(id)?.handle.resize(cols, rows);
+  }
+  attach(id: string, listener: (d: string) => void): void {
+    this.sessions.get(id)?.listeners.add(listener);
+  }
+  detach(id: string, listener?: (d: string) => void): void {
+    const s = this.sessions.get(id);
+    if (!s) return;
+    if (listener) s.listeners.delete(listener);
+    else s.listeners.clear();
+    // detach NEVER kills (tmux-like)
+  }
+  kill(id: string): void {
+    const s = this.sessions.get(id);
+    if (!s) return;
+    s.handle.kill();
+    this.sessions.delete(id);
+  }
+  reapIdle(): void {
+    if (!this.opts.idleTimeoutMs) return;
+    const now = Date.now();
+    for (const [id, s] of this.sessions) {
+      if (s.meta.kind === 'deckent') continue; // long sprints exempt
+      if (now - s.lastActivity > this.opts.idleTimeoutMs) this.kill(id);
+    }
+  }
+}
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npx vitest run tests/api/terminal/session-manager.test.ts`
+Expected: PASS (4 tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/api/terminal/session-manager.ts tests/api/terminal/session-manager.test.ts
+git commit -m "feat(terminal): PtySessionManager (ring buffer, detach≠kill, idle reaper)"
+```
+
+---
+
+## WAVE 2 — Backend wiring
+
+### Task 2.1: WS gateway (upgrade + subprotocol auth + bridge + reattach)
+
+**Files:**
+- Create: `src/api/terminal/ws-gateway.ts`
+- Test: `tests/api/terminal/ws-gateway.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/api/terminal/ws-gateway.test.ts
+import { describe, it, expect, vi } from 'vitest';
+import { createServer } from 'node:http';
+import { WebSocket } from 'ws';
+import { attachTerminalGateway } from '../../../src/api/terminal/ws-gateway.js';
+import { PtySessionManager } from '../../../src/api/terminal/session-manager.js';
+import { LocalPtyBackend } from '../../../src/api/terminal/session-backend.js';
+import { LocalTokenAuthProvider } from '../../../src/api/terminal/auth-provider.js';
+
+function setup(token: string) {
+  const server = createServer();
+  const mgr = new PtySessionManager(new LocalPtyBackend(), { scrollbackBytes: 65536, idleTimeoutMs: 0 });
+  attachTerminalGateway(server, {
+    manager: mgr,
+    auth: new LocalTokenAuthProvider(token),
+    audit: { record: vi.fn() },
+  });
+  return { server, mgr };
+}
+
+describe('terminal ws gateway', () => {
+  it('rejects upgrade without valid subprotocol token (no session spawned)', async () => {
+    const { server, mgr } = setup('good');
+    await new Promise<void>((r) => server.listen(0, '127.0.0.1', r));
+    const port = (server.address() as { port: number }).port;
+    const ws = new WebSocket(`ws://127.0.0.1:${port}/api/terminal/ws`, ['deckent.bad']);
+    const closed = await new Promise<number>((res) => ws.on('close', (c) => res(c)));
+    expect(closed).toBe(4401);
+    server.close();
+  });
+
+  it('accepts valid token, attaches a session, replays buffer', async () => {
+    const { server, mgr } = setup('good');
+    const s = mgr.create({ kind: 'shell' });
+    await new Promise<void>((r) => server.listen(0, '127.0.0.1', r));
+    const port = (server.address() as { port: number }).port;
+    const ws = new WebSocket(`ws://127.0.0.1:${port}/api/terminal/ws`, ['deckent.good']);
+    await new Promise<void>((r) => ws.on('open', () => r()));
+    ws.send(JSON.stringify({ t: 'attach', sessionId: s.id }));
+    ws.send(JSON.stringify({ t: 'input', data: 'exit\n' }));
+    const got = await new Promise<string>((res) => {
+      ws.on('message', (m) => res(m.toString()));
+    });
+    expect(got).toContain('"t":"output"');
+    server.close();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/api/terminal/ws-gateway.test.ts`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```typescript
+// src/api/terminal/ws-gateway.ts
+import type { Server, IncomingMessage } from 'node:http';
+import type { Socket } from 'node:net';
+import { WebSocketServer, type WebSocket } from 'ws';
+import type { PtySessionManager } from './session-manager.js';
+import type { AuthProvider } from './auth-provider.js';
+import type { AuditEvent } from './types.js';
+
+interface GatewayDeps {
+  manager: PtySessionManager;
+  auth: AuthProvider;
+  audit: { record(ev: AuditEvent): void };
+}
+
+const PREFIX = 'deckent.'; // subprotocol carries the token: "deckent.<token>"
+
+/**
+ * Attaches the terminal WS gateway. Token is read from Sec-WebSocket-Protocol
+ * (browsers cannot set Authorization on WebSocket — spec §1c.2). Auth is verified
+ * BEFORE any session bridge, independent of DECKENT_API_AUTH_DISABLED.
+ */
+export function attachTerminalGateway(server: Server, deps: GatewayDeps): void {
+  const wss = new WebSocketServer({ noServer: true });
+
+  server.on('upgrade', (req: IncomingMessage, socket: Socket, head: Buffer) => {
+    const url = req.url ?? '';
+    if (!url.startsWith('/api/terminal/ws')) return; // not ours — leave it
+    const protos = (req.headers['sec-websocket-protocol'] ?? '')
+      .split(',').map((s) => s.trim());
+    const tokenProto = protos.find((p) => p.startsWith(PREFIX));
+    const token = tokenProto ? tokenProto.slice(PREFIX.length) : undefined;
+
+    if (!deps.auth.verify(token)) {
+      deps.audit.record({
+        action: 'auth.deny', tenantId: 'local',
+        detail: 'ws upgrade rejected', at: new Date().toISOString(),
+      });
+      // 4401 = app-level unauthorized close (sent after a minimal accept-less reject)
+      socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+    deps.audit.record({
+      action: 'auth.ok', tenantId: 'local',
+      detail: 'ws upgrade accepted', at: new Date().toISOString(),
+    });
+    wss.handleUpgrade(req, socket, head, (ws) => bridge(ws, tokenProto!, deps));
+  });
+}
+
+function bridge(ws: WebSocket, acceptedProto: string, deps: GatewayDeps): void {
+  let sessionId: string | null = null;
+  const onData = (d: string) => {
+    if (ws.bufferedAmount > 1_000_000) return; // backpressure: drop while saturated
+    ws.send(JSON.stringify({ t: 'output', data: d }));
+  };
+
+  ws.on('message', (raw) => {
+    let msg: { t: string; sessionId?: string; data?: string; cols?: number; rows?: number };
+    try { msg = JSON.parse(raw.toString()); } catch { return; }
+    if (msg.t === 'attach' && msg.sessionId) {
+      if (sessionId) deps.manager.detach(sessionId, onData);
+      sessionId = msg.sessionId;
+      ws.send(JSON.stringify({ t: 'output', data: deps.manager.replay(sessionId) }));
+      deps.manager.attach(sessionId, onData);
+      deps.audit.record({
+        action: 'session.attach', tenantId: 'local',
+        sessionId, detail: '', at: new Date().toISOString(),
+      });
+    } else if (msg.t === 'input' && sessionId && typeof msg.data === 'string') {
+      deps.manager.write(sessionId, msg.data);
+    } else if (msg.t === 'resize' && sessionId && msg.cols && msg.rows) {
+      deps.manager.resize(sessionId, msg.cols, msg.rows);
+    }
+  });
+
+  ws.on('close', () => {
+    if (sessionId) {
+      deps.manager.detach(sessionId, onData); // detach ≠ kill (tmux-like)
+      deps.audit.record({
+        action: 'session.detach', tenantId: 'local',
+        sessionId, detail: '', at: new Date().toISOString(),
+      });
+    }
+  });
+  // echo accepted subprotocol so the browser's WebSocket.protocol matches
+  void acceptedProto;
+}
+```
+Note: pass the accepted subprotocol back by configuring `WebSocketServer` with `handleProtocols`. If the `ws` version requires it, add `handleProtocols: (set) => [...set].find((p) => p.startsWith(PREFIX)) ?? false` to the `WebSocketServer` options.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run tests/api/terminal/ws-gateway.test.ts`
+Expected: PASS (2 tests). Fix the `handleProtocols` option if the close code/protocol assertions fail.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/api/terminal/ws-gateway.ts tests/api/terminal/ws-gateway.test.ts
+git commit -m "feat(terminal): ws gateway — subprotocol auth before bridge, reattach replay"
+```
+
+### Task 2.2: HTTP control routes + localhost-only bootstrap token inject
+
+**Files:**
+- Modify: `src/api/server.ts`
+- Test: `tests/api/terminal/server-routes.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/api/terminal/server-routes.test.ts
+import { describe, it, expect } from 'vitest';
+import { createHttpServer } from '../../../src/api/server.js';
+
+describe('terminal HTTP control', () => {
+  it('POST /api/terminal/sessions creates, GET lists, DELETE removes', async () => {
+    const api = createHttpServer(process.cwd(), { port: 0, autoGenerateToken: true });
+    const addr = api.server.address() as { port: number };
+    const base = `http://127.0.0.1:${addr.port}`;
+    const tok = process.env['__TEST_TOKEN__']; // see Step 3 for how token is exposed in tests
+    const h = { Authorization: `Bearer ${tok}` };
+    const c = await fetch(`${base}/api/terminal/sessions`, {
+      method: 'POST', headers: { ...h, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ kind: 'shell' }),
+    });
+    expect(c.status).toBe(201);
+    const { id } = await c.json();
+    const l = await fetch(`${base}/api/terminal/sessions`, { headers: h });
+    expect((await l.json()).some((s: { id: string }) => s.id === id)).toBe(true);
+    const d = await fetch(`${base}/api/terminal/sessions/${id}`, { method: 'DELETE', headers: h });
+    expect(d.status).toBe(200);
+    await api.close();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/api/terminal/server-routes.test.ts`
+Expected: FAIL — routes 404.
+
+- [ ] **Step 3: Implement in `server.ts`**
+
+In `createHttpServer`, after `finalToken` is resolved and before `server.listen`:
+1. If `cfg.terminal.enabled`, construct `manager = new PtySessionManager(new LocalPtyBackend(), { scrollbackBytes, idleTimeoutMs, maxSessions })`, `audit = new TerminalAudit(memoryStore)`, `auth = new LocalTokenAuthProvider(finalToken ?? randomUUID())` (terminal ALWAYS has a token even if API auth is disabled — spec §1c.2). Call `attachTerminalGateway(server, { manager, auth, audit })`.
+2. Start an idle reaper: `const reaper = setInterval(() => manager.reapIdle(), 30_000)`; clear it in `close()`.
+3. In `handleRequest`, add (inside the `/api/` block, AFTER the existing auth middleware so HTTP control uses Bearer): `GET /api/terminal/sessions` → `manager.list()`; `POST /api/terminal/sessions` → `manager.create(body)` → 201 `{id}`; `DELETE /api/terminal/sessions/:id` → `manager.kill(id)` → 200.
+4. **Localhost-only bootstrap token inject:** in the static `index.html` serving branch, if `req.socket.remoteAddress` is `127.0.0.1`/`::1`, inject `<script>window.__DECKENT_TERMINAL_TOKEN__=${JSON.stringify(terminalToken)}</script>` before `</head>`. For non-localhost callers, do NOT inject (they must supply the token another way — out of scope #1). Expose `terminalToken` to tests via `api.terminalToken` on the returned object.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run tests/api/terminal/server-routes.test.ts && npm run lint`
+Expected: PASS, exit 0. (Update the test to read `api.terminalToken` instead of an env var.)
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/api/server.ts tests/api/terminal/server-routes.test.ts
+git commit -m "feat(terminal): HTTP control routes + localhost-only bootstrap token inject"
+```
+
+### Task 2.3: `serve` CLI surface (`--host`, `--no-terminal`)
+
+**Files:**
+- Modify: `src/cli/commands/serve.ts`
+- Test: `tests/cli/serve-terminal.test.ts`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/cli/serve-terminal.test.ts
+import { describe, it, expect } from 'vitest';
+import { Command } from 'commander';
+import { registerServe } from '../../src/cli/commands/serve.js';
+
+describe('serve CLI terminal options', () => {
+  it('exposes --host and --no-terminal', () => {
+    const program = new Command();
+    registerServe(program);
+    const serve = program.commands.find((c) => c.name() === 'serve')!;
+    const opts = serve.options.map((o) => o.long);
+    expect(opts).toContain('--host');
+    expect(opts).toContain('--no-terminal');
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run tests/cli/serve-terminal.test.ts`
+Expected: FAIL — options absent.
+
+- [ ] **Step 3: Implement**
+
+In `serve.ts`, add to the command builder:
+```typescript
+.option('--host <addr>', 'Bind address', '127.0.0.1')
+.option('--no-terminal', 'Disable the embedded web terminal')
+```
+Pass through to `createHttpServer`: `{ port, host: opts.host, autoGenerateToken: true, /* terminal enabled unless opts.terminal === false */ }`. When `--host` is non-localhost AND no explicit token is configured, print a clear stderr warning and refuse to enable the terminal (per spec §5: remote requires explicit token).
+
+- [ ] **Step 4: Run test + build**
+
+Run: `npx vitest run tests/cli/serve-terminal.test.ts && npm run lint`
+Expected: PASS, exit 0.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/cli/commands/serve.ts tests/cli/serve-terminal.test.ts
+git commit -m "feat(serve): --host + --no-terminal; refuse remote terminal without token"
+```
+
+---
+
+## WAVE 3 — Frontend (dock panel + xterm)
+
+### Task 3.1: xterm deps + terminal-api lib
+
+**Files:**
+- Modify: `src/dashboard/package.json`
+- Create: `src/dashboard/src/lib/terminal-api.ts`
+- Test: `tests/dashboard/terminal/terminal-api.test.ts`
+
+- [ ] **Step 1: Add devDeps**
+
+In `src/dashboard/package.json` `devDependencies`: `"@xterm/xterm": "^5.5.0"`, `"@xterm/addon-fit": "^0.10.0"`. Run `cd src/dashboard && npm install`.
+
+- [ ] **Step 2: Write the failing test**
+
+```typescript
+// tests/dashboard/terminal/terminal-api.test.ts
+import { describe, it, expect, vi } from 'vitest';
+import { getBootstrapToken, createSession } from '../../../src/dashboard/src/lib/terminal-api';
+
+describe('terminal-api', () => {
+  it('reads the injected bootstrap token', () => {
+    (window as unknown as Record<string, unknown>).__DECKENT_TERMINAL_TOKEN__ = 'tok-1';
+    expect(getBootstrapToken()).toBe('tok-1');
+  });
+  it('POSTs a session create', async () => {
+    const fetchMock = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ id: 's1' }) });
+    vi.stubGlobal('fetch', fetchMock);
+    const r = await createSession({ kind: 'shell' });
+    expect(r.id).toBe('s1');
+    expect(fetchMock).toHaveBeenCalledWith('/api/terminal/sessions', expect.objectContaining({ method: 'POST' }));
+  });
+});
+```
+
+- [ ] **Step 3: Run test to verify it fails**
+
+Run: `npm run test:dashboard -- terminal-api`
+Expected: FAIL — module not found.
+
+- [ ] **Step 4: Implement**
+
+```typescript
+// src/dashboard/src/lib/terminal-api.ts
+export interface SessionMeta { id: string; kind: string; status: string; }
+
+export function getBootstrapToken(): string | undefined {
+  return (window as unknown as { __DECKENT_TERMINAL_TOKEN__?: string }).__DECKENT_TERMINAL_TOKEN__;
+}
+export async function createSession(input: { kind: string; tool?: string; args?: string[] }): Promise<SessionMeta> {
+  const res = await fetch('/api/terminal/sessions', {
+    method: 'POST', headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(input),
+  });
+  if (!res.ok) throw new Error(`createSession failed: ${res.status}`);
+  return res.json();
+}
+export async function listSessions(): Promise<SessionMeta[]> {
+  const res = await fetch('/api/terminal/sessions');
+  return res.ok ? res.json() : [];
+}
+export async function killSession(id: string): Promise<void> {
+  await fetch(`/api/terminal/sessions/${id}`, { method: 'DELETE' });
+}
+```
+
+- [ ] **Step 5: Run test + commit**
+
+Run: `npm run test:dashboard -- terminal-api`
+Expected: PASS.
+```bash
+git add src/dashboard/package.json src/dashboard/package-lock.json src/dashboard/src/lib/terminal-api.ts tests/dashboard/terminal/terminal-api.test.ts
+git commit -m "feat(dashboard): xterm deps + terminal-api (bootstrap token + sessions)"
+```
+
+### Task 3.2: useTerminalSocket hook (reconnect + reattach + subprotocol token)
+
+**Files:**
+- Create: `src/dashboard/src/components/terminal/useTerminalSocket.ts`
+- Test: `tests/dashboard/terminal/useTerminalSocket.test.tsx`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/dashboard/terminal/useTerminalSocket.test.tsx
+import { describe, it, expect, vi } from 'vitest';
+import { renderHook, act } from '@testing-library/react';
+import { useTerminalSocket } from '../../../src/dashboard/src/components/terminal/useTerminalSocket';
+
+class FakeWS {
+  static instances: FakeWS[] = [];
+  onopen?: () => void; onmessage?: (e: { data: string }) => void; onclose?: () => void;
+  sent: string[] = []; protocol: string;
+  constructor(public url: string, public protocols?: string[]) { this.protocol = protocols?.[0] ?? ''; FakeWS.instances.push(this); }
+  send(d: string) { this.sent.push(d); }
+  close() { this.onclose?.(); }
+}
+
+describe('useTerminalSocket', () => {
+  it('opens WS with deckent.<token> subprotocol and sends attach', () => {
+    vi.stubGlobal('WebSocket', FakeWS as unknown as typeof WebSocket);
+    (window as unknown as Record<string, unknown>).__DECKENT_TERMINAL_TOKEN__ = 'tk';
+    const onOutput = vi.fn();
+    renderHook(() => useTerminalSocket('sess-1', onOutput));
+    const ws = FakeWS.instances.at(-1)!;
+    expect(ws.protocols).toEqual(['deckent.tk']);
+    act(() => ws.onopen?.());
+    expect(ws.sent.some((m) => m.includes('"t":"attach"') && m.includes('sess-1'))).toBe(true);
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npm run test:dashboard -- useTerminalSocket`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```typescript
+// src/dashboard/src/components/terminal/useTerminalSocket.ts
+import { useEffect, useRef } from 'react';
+import { getBootstrapToken } from '../../lib/terminal-api';
+
+export interface TerminalSocket {
+  send(data: string): void;
+  resize(cols: number, rows: number): void;
+}
+
+export function useTerminalSocket(
+  sessionId: string | null,
+  onOutput: (data: string) => void,
+): React.MutableRefObject<TerminalSocket | null> {
+  const api = useRef<TerminalSocket | null>(null);
+  useEffect(() => {
+    if (!sessionId) return;
+    let ws: WebSocket | null = null;
+    let retry = 0;
+    let stopped = false;
+
+    const connect = () => {
+      const token = getBootstrapToken();
+      const proto = `${location.protocol === 'https:' ? 'wss' : 'ws'}://${location.host}/api/terminal/ws`;
+      ws = new WebSocket(proto, token ? [`deckent.${token}`] : []);
+      ws.onopen = () => {
+        retry = 0;
+        ws!.send(JSON.stringify({ t: 'attach', sessionId }));
+      };
+      ws.onmessage = (e) => {
+        try {
+          const m = JSON.parse(typeof e.data === 'string' ? e.data : '');
+          if (m.t === 'output') onOutput(m.data);
+        } catch { /* ignore non-JSON */ }
+      };
+      ws.onclose = () => {
+        if (stopped) return;
+        retry = Math.min(retry + 1, 5);
+        setTimeout(connect, retry * 1000); // reconnect → re-attach (tmux-like)
+      };
+      api.current = {
+        send: (data) => ws?.readyState === WebSocket.OPEN && ws.send(JSON.stringify({ t: 'input', data })),
+        resize: (cols, rows) => ws?.readyState === WebSocket.OPEN && ws.send(JSON.stringify({ t: 'resize', cols, rows })),
+      };
+    };
+    connect();
+    return () => { stopped = true; ws?.close(); };
+  }, [sessionId, onOutput]);
+  return api;
+}
+```
+
+- [ ] **Step 4: Run test + commit**
+
+Run: `npm run test:dashboard -- useTerminalSocket`
+Expected: PASS.
+```bash
+git add src/dashboard/src/components/terminal/useTerminalSocket.ts tests/dashboard/terminal/useTerminalSocket.test.tsx
+git commit -m "feat(dashboard): useTerminalSocket — subprotocol token, auto reattach"
+```
+
+### Task 3.3: TerminalView (xterm bound to a session)
+
+**Files:**
+- Create: `src/dashboard/src/components/terminal/TerminalView.tsx`
+- Test: `tests/dashboard/terminal/TerminalView.test.tsx`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/dashboard/terminal/TerminalView.test.tsx
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '@testing-library/react';
+vi.mock('@xterm/xterm', () => ({ Terminal: class { open = vi.fn(); write = vi.fn(); onData = vi.fn(); loadAddon = vi.fn(); dispose = vi.fn(); } }));
+vi.mock('@xterm/addon-fit', () => ({ FitAddon: class { fit = vi.fn(); } }));
+import { TerminalView } from '../../../src/dashboard/src/components/terminal/TerminalView';
+
+describe('TerminalView', () => {
+  it('renders a container for the given session', () => {
+    const { container } = render(<TerminalView sessionId="s1" />);
+    expect(container.querySelector('[data-terminal="s1"]')).toBeTruthy();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npm run test:dashboard -- TerminalView`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```tsx
+// src/dashboard/src/components/terminal/TerminalView.tsx
+import { useEffect, useRef } from 'react';
+import { Terminal } from '@xterm/xterm';
+import { FitAddon } from '@xterm/addon-fit';
+import '@xterm/xterm/css/xterm.css';
+import { useTerminalSocket } from './useTerminalSocket';
+
+export function TerminalView({ sessionId }: { sessionId: string }) {
+  const elRef = useRef<HTMLDivElement>(null);
+  const termRef = useRef<Terminal | null>(null);
+  const writeRef = useRef<(d: string) => void>(() => {});
+  const sock = useTerminalSocket(sessionId, (d) => writeRef.current(d));
+
+  useEffect(() => {
+    if (!elRef.current) return;
+    const term = new Terminal({ convertEol: true, fontSize: 13 });
+    const fit = new FitAddon();
+    term.loadAddon(fit);
+    term.open(elRef.current);
+    fit.fit();
+    writeRef.current = (d) => term.write(d);
+    term.onData((d) => sock.current?.send(d));
+    termRef.current = term;
+    const ro = new ResizeObserver(() => { fit.fit(); sock.current?.resize(term.cols, term.rows); });
+    ro.observe(elRef.current);
+    return () => { ro.disconnect(); term.dispose(); };
+  }, [sessionId, sock]);
+
+  return <div data-terminal={sessionId} ref={elRef} style={{ width: '100%', height: '100%' }} />;
+}
+```
+
+- [ ] **Step 4: Run test + commit**
+
+Run: `npm run test:dashboard -- TerminalView`
+Expected: PASS.
+```bash
+git add src/dashboard/src/components/terminal/TerminalView.tsx tests/dashboard/terminal/TerminalView.test.tsx
+git commit -m "feat(dashboard): TerminalView — xterm + fit bound to a session"
+```
+
+### Task 3.4: TerminalTabs + TerminalPanel (multi-tab)
+
+**Files:**
+- Create: `src/dashboard/src/components/terminal/TerminalTabs.tsx`
+- Create: `src/dashboard/src/components/terminal/TerminalPanel.tsx`
+- Test: `tests/dashboard/terminal/TerminalPanel.test.tsx`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/dashboard/terminal/TerminalPanel.test.tsx
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+vi.mock('../../../src/dashboard/src/components/terminal/TerminalView', () => ({ TerminalView: ({ sessionId }: { sessionId: string }) => <div>view:{sessionId}</div> }));
+vi.mock('../../../src/dashboard/src/lib/terminal-api', () => ({ createSession: vi.fn(async () => ({ id: 's-new', kind: 'shell', status: 'running' })), listSessions: vi.fn(async () => []), killSession: vi.fn() }));
+import { TerminalPanel } from '../../../src/dashboard/src/components/terminal/TerminalPanel';
+
+describe('TerminalPanel', () => {
+  it('opens a new shell tab on quick-launch', async () => {
+    render(<TerminalPanel />);
+    fireEvent.click(screen.getByRole('button', { name: /shell/i }));
+    await waitFor(() => expect(screen.getByText('view:s-new')).toBeInTheDocument());
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npm run test:dashboard -- TerminalPanel`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```tsx
+// src/dashboard/src/components/terminal/TerminalTabs.tsx
+import type { SessionMeta } from '../../lib/terminal-api';
+const KINDS: { label: string; kind: string; tool?: string }[] = [
+  { label: 'claude', kind: 'ai', tool: 'claude' },
+  { label: 'gemini', kind: 'ai', tool: 'gemini' },
+  { label: 'codex', kind: 'ai', tool: 'codex' },
+  { label: 'deckent', kind: 'deckent' },
+  { label: 'shell', kind: 'shell' },
+];
+export function TerminalTabs(props: {
+  tabs: SessionMeta[]; activeId: string | null;
+  onSelect: (id: string) => void; onClose: (id: string) => void;
+  onLaunch: (kind: string, tool?: string) => void;
+}) {
+  return (
+    <div className="flex items-center gap-1 border-b px-2 py-1 text-sm">
+      {props.tabs.map((t) => (
+        <span key={t.id} className={`px-2 py-0.5 rounded cursor-pointer ${t.id === props.activeId ? 'bg-muted' : ''}`}>
+          <button onClick={() => props.onSelect(t.id)}>{t.kind}:{t.id.slice(0, 6)}</button>
+          <button aria-label={`close ${t.id}`} className="ml-1" onClick={() => props.onClose(t.id)}>×</button>
+        </span>
+      ))}
+      <span className="ml-auto flex gap-1">
+        {KINDS.map((k) => (
+          <button key={k.label} className="px-2 py-0.5 rounded bg-primary/10"
+            onClick={() => props.onLaunch(k.kind, k.tool)}>+{k.label}</button>
+        ))}
+      </span>
+    </div>
+  );
+}
+```
+```tsx
+// src/dashboard/src/components/terminal/TerminalPanel.tsx
+import { useEffect, useState } from 'react';
+import { TerminalView } from './TerminalView';
+import { TerminalTabs } from './TerminalTabs';
+import { createSession, listSessions, killSession, type SessionMeta } from '../../lib/terminal-api';
+
+export function TerminalPanel() {
+  const [tabs, setTabs] = useState<SessionMeta[]>([]);
+  const [activeId, setActiveId] = useState<string | null>(null);
+  useEffect(() => { listSessions().then((s) => { setTabs(s); if (s[0]) setActiveId(s[0].id); }); }, []);
+  const launch = async (kind: string, tool?: string) => {
+    const s = await createSession({ kind, tool });
+    setTabs((t) => [...t, s]); setActiveId(s.id);
+  };
+  const close = async (id: string) => {
+    await killSession(id);
+    setTabs((t) => t.filter((x) => x.id !== id));
+    setActiveId((a) => (a === id ? null : a));
+  };
+  return (
+    <div className="flex flex-col h-full">
+      <TerminalTabs tabs={tabs} activeId={activeId} onSelect={setActiveId} onClose={close} onLaunch={launch} />
+      <div className="flex-1 min-h-0">
+        {activeId ? <TerminalView key={activeId} sessionId={activeId} />
+          : <div className="p-4 text-sm text-muted-foreground">Open a session ↗</div>}
+      </div>
+    </div>
+  );
+}
+```
+
+- [ ] **Step 4: Run test + commit**
+
+Run: `npm run test:dashboard -- TerminalPanel`
+Expected: PASS.
+```bash
+git add src/dashboard/src/components/terminal/TerminalTabs.tsx src/dashboard/src/components/terminal/TerminalPanel.tsx tests/dashboard/terminal/TerminalPanel.test.tsx
+git commit -m "feat(dashboard): multi-tab TerminalPanel + quick-launch"
+```
+
+### Task 3.5: DockPanel + Layout integration
+
+**Files:**
+- Create: `src/dashboard/src/components/DockPanel.tsx`
+- Modify: `src/dashboard/src/components/Layout.tsx`
+- Test: `tests/dashboard/terminal/DockPanel.test.tsx`
+
+- [ ] **Step 1: Write the failing test**
+
+```typescript
+// tests/dashboard/terminal/DockPanel.test.tsx
+import { describe, it, expect } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+import { DockPanel } from '../../../src/dashboard/src/components/DockPanel';
+
+describe('DockPanel', () => {
+  it('toggles open/closed', () => {
+    render(<DockPanel><div>PANELBODY</div></DockPanel>);
+    expect(screen.queryByText('PANELBODY')).not.toBeVisible();
+    fireEvent.click(screen.getByRole('button', { name: /terminal/i }));
+    expect(screen.getByText('PANELBODY')).toBeVisible();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npm run test:dashboard -- DockPanel`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+```tsx
+// src/dashboard/src/components/DockPanel.tsx
+import { useState, type ReactNode } from 'react';
+
+export function DockPanel({ children }: { children: ReactNode }) {
+  const [open, setOpen] = useState(false);
+  const [height, setHeight] = useState(280);
+  return (
+    <>
+      <div className="fixed bottom-0 left-0 right-0 z-40 border-t bg-background"
+        style={{ height: open ? height : 32 }}>
+        <button className="w-full text-left px-3 py-1 text-xs font-mono border-b"
+          onClick={() => setOpen((o) => !o)} aria-label="toggle terminal">
+          ▸ Terminal {open ? '▾' : '▴'}
+        </button>
+        <div style={{ height: height - 32, display: open ? 'block' : 'none' }}>
+          {children}
+        </div>
+        {open && (
+          <div role="separator" aria-label="resize terminal"
+            className="absolute top-0 left-0 right-0 h-1 cursor-ns-resize"
+            onMouseDown={(e) => {
+              const startY = e.clientY, startH = height;
+              const mv = (ev: MouseEvent) => setHeight(Math.max(120, startH + (startY - ev.clientY)));
+              const up = () => { window.removeEventListener('mousemove', mv); window.removeEventListener('mouseup', up); };
+              window.addEventListener('mousemove', mv); window.addEventListener('mouseup', up);
+            }} />
+        )}
+      </div>
+    </>
+  );
+}
+```
+In `Layout.tsx`, import `DockPanel` + `TerminalPanel`, and render `<DockPanel><TerminalPanel /></DockPanel>` once at the end of the layout shell (outside `<Outlet />` so it persists across route changes). Add bottom padding (`pb-8`) to the main scroll area so content isn't hidden behind the collapsed dock bar.
+
+- [ ] **Step 4: Run test + commit**
+
+Run: `npm run test:dashboard -- DockPanel && npm run test:dashboard`
+Expected: PASS (all dashboard tests green).
+```bash
+git add src/dashboard/src/components/DockPanel.tsx src/dashboard/src/components/Layout.tsx tests/dashboard/terminal/DockPanel.test.tsx
+git commit -m "feat(dashboard): VSCode-like resizable DockPanel hosting the terminal"
+```
+
+### Task 3.6: ConfigPage Terminal category + i18n
+
+**Files:**
+- Modify: `src/dashboard/src/pages/ConfigPage.tsx`
+- Modify: `src/dashboard/src/i18n/en.ts`, `src/dashboard/src/i18n/tr.ts`
+
+- [ ] **Step 1: Add config fields (data-only)**
+
+In `CONFIG_FIELDS`, add entries with `category: "Terminal"` for `terminal.enabled` (boolean), `terminal.allowShellKind` (boolean), `terminal.maxSessions` (number), `terminal.idleTimeoutMs` (number), `terminal.scrollbackBytes` (number). Add `"Terminal"` to `CATEGORIES` and `CATEGORY_KEY_MAP` (`"Terminal": "config.category.terminal"`). Add the i18n keys to `en.ts` and `tr.ts`.
+
+- [ ] **Step 2: Build + commit**
+
+Run: `npm run test:dashboard && npm run lint`
+Expected: green, exit 0.
+```bash
+git add src/dashboard/src/pages/ConfigPage.tsx src/dashboard/src/i18n/en.ts src/dashboard/src/i18n/tr.ts
+git commit -m "feat(dashboard): Terminal config category in ConfigPage"
+```
+
+---
+
+## WAVE 4 — Integration, docs, final verification
+
+### Task 4.1: End-to-end integration test (real pty over real ws + reattach)
+
+**Files:**
+- Test: `tests/api/terminal/e2e-reattach.test.ts`
+
+- [ ] **Step 1: Write the test**
+
+```typescript
+// tests/api/terminal/e2e-reattach.test.ts
+import { describe, it, expect } from 'vitest';
+import { createServer } from 'node:http';
+import { WebSocket } from 'ws';
+import { attachTerminalGateway } from '../../../src/api/terminal/ws-gateway.js';
+import { PtySessionManager } from '../../../src/api/terminal/session-manager.js';
+import { LocalPtyBackend } from '../../../src/api/terminal/session-backend.js';
+import { LocalTokenAuthProvider } from '../../../src/api/terminal/auth-provider.js';
+
+describe('terminal e2e — reattach survives client disconnect', () => {
+  it('output produced while disconnected is replayed on reattach', async () => {
+    const server = createServer();
+    const mgr = new PtySessionManager(new LocalPtyBackend(), { scrollbackBytes: 65536, idleTimeoutMs: 0 });
+    attachTerminalGateway(server, { manager: mgr, auth: new LocalTokenAuthProvider('t'), audit: { record() {} } });
+    await new Promise<void>((r) => server.listen(0, '127.0.0.1', r));
+    const port = (server.address() as { port: number }).port;
+    const s = mgr.create({ kind: 'shell' });
+
+    const ws1 = new WebSocket(`ws://127.0.0.1:${port}/api/terminal/ws`, ['deckent.t']);
+    await new Promise<void>((r) => ws1.on('open', () => r()));
+    ws1.send(JSON.stringify({ t: 'attach', sessionId: s.id }));
+    ws1.send(JSON.stringify({ t: 'input', data: 'echo MARKER_ONE\n' }));
+    await new Promise((r) => setTimeout(r, 400));
+    ws1.close(); // disconnect
+
+    mgr.write(s.id, 'echo MARKER_TWO\n'); // produced while no client attached
+    await new Promise((r) => setTimeout(r, 400));
+
+    const ws2 = new WebSocket(`ws://127.0.0.1:${port}/api/terminal/ws`, ['deckent.t']);
+    await new Promise<void>((r) => ws2.on('open', () => r()));
+    const replay = await new Promise<string>((res) => {
+      let buf = '';
+      ws2.on('message', (m) => { buf += JSON.parse(m.toString()).data ?? ''; if (buf.includes('MARKER_TWO')) res(buf); });
+      ws2.send(JSON.stringify({ t: 'attach', sessionId: s.id }));
+    });
+    expect(replay).toContain('MARKER_ONE');
+    expect(replay).toContain('MARKER_TWO');
+    mgr.kill(s.id); server.close();
+  });
+});
+```
+
+- [ ] **Step 2: Run + commit**
+
+Run: `npx vitest run tests/api/terminal/e2e-reattach.test.ts`
+Expected: PASS.
+```bash
+git add tests/api/terminal/e2e-reattach.test.ts
+git commit -m "test(terminal): e2e — reattach replays output produced while disconnected"
+```
+
+### Task 4.2: Docs — reference + user guide
+
+**Files:**
+- Modify: `docs/reference/` (whatever `npm run docs:ref` regenerates) and a new `docs/guide/terminal.md`
+
+- [ ] **Step 1: Write the user guide**
+
+Create `docs/guide/terminal.md` (EN canonical) covering: what it is, security model (localhost-default, token auto-injected, independent of `DECKENT_API_AUTH_DISABLED`, remote requires explicit `--host` + token + user-managed TLS), the audit timeline, reattach semantics + the server-restart boundary, config keys. Add a TR parallel `docs/guide/terminal-tr.md` (no TR file is ever removed — project rule).
+
+- [ ] **Step 2: Regenerate reference + link check**
+
+Run: `npm run docs:ref && npm run docs:stats && npm run lint:link`
+Expected: all exit 0.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add docs/
+git commit -m "docs(terminal): user guide (EN+TR) + regenerated reference"
+```
+
+### Task 4.3: Final full verification
+
+- [ ] **Step 1: Run the whole gate**
+
+Run, and confirm each exits 0 / passes:
+```bash
+npm run lint            # tsc --noEmit
+npx vitest run          # full suite
+npm run test:dashboard  # dashboard suite
+npm run lint:adr        # ADR validator
+npm run lint:link       # dead-link gate
+npm pack --dry-run      # clean package, node-pty/ws present, no internal state
+```
+
+- [ ] **Step 2: Manual smoke (Alperen — build/run is the user's call per memory)**
+
+`npm run build:all` then `deckent serve` → open dashboard → toggle the dock → launch a `shell` tab → run `echo hi` → refresh the browser → confirm the session reattaches and scrollback replays → open the audit timeline and confirm `session.create`/`attach` events, no raw output. Verify a `deckent` tab can run `deckent status`.
+
+- [ ] **Step 3: Commit any fixes, then finalize**
+
+```bash
+git add -A && git commit -m "chore(terminal): final verification fixes"
+```
+
+---
+
+## Self-Review (completed by plan author)
+
+1. **Spec coverage:** PTY/multi-tab → 1.2/1.4/3.4; `ws` transport → 2.1; localhost-default + token + bypass-independence → 1.1/2.2/2.3; token via localhost page-inject → 2.2 + 3.1/3.2; tmux reattach → 1.4/2.1/4.1; audit DB tenant-scoped, raw never persisted → 1.3; ADR-010 ext + ADR-062 → 0.2; config in DeckentConfig → 0.3; VSCode dock panel → 3.5; enterprise seams (`AuthProvider`/`SessionBackend`/`tenantId`) → 1.1/1.2/0.4/1.3; self-mod sequential → declared in header + DIRECTIVES note; server-restart boundary → documented (4.2), tested boundary is client-disconnect only (4.1). No spec requirement left without a task.
+2. **Placeholder scan:** no TBD/TODO; every code step has concrete code; the few "follow existing pattern" notes (config merge, schema migration) point at exact `grep` anchors rather than hand-waving — acceptable because the pattern is project-specific and must match existing code.
+3. **Type consistency:** `SessionMeta`, `CreateSessionInput`, `AuditEvent`, `TenantId` defined once in `types.ts` (0.4) and reused; `SessionBackend`/`BackendHandle` defined in 1.2 and consumed unchanged in 1.4; `AuthProvider.verify` signature consistent across 1.1/2.1; WS message shape `{t,sessionId,data,cols,rows}` identical in 2.1/3.2.
+
+## Execution Handoff
+
+This is a **self-modifying / dogfood** sprint (touches `src/api/` + `src/dashboard/`) → sequential execution mandatory; waves are ordered 0→4 and must not overlap. Convert this plan to sprint `DIRECTIVES.md` with: `dependency_pipeline_enabled` semantics manual (ADR-047), self-modifying declared, model = opus for code tasks / sonnet for doc tasks (per project rule), one task per plan Task, scope = the listed files.
diff --git a/docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md b/docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md
new file mode 100644
index 000000000..18c3f7d66
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md
@@ -0,0 +1,359 @@
+# Embedded Web Terminal — Design Spec
+
+- **Date:** 2026-05-19
+- **Status:** Approved (brainstorming) — pending implementation plan
+- **Author:** Brainstormed with Alperen
+- **Scope:** Sub-project #1 of a 4-part vision (see "Decomposition" below)
+
+---
+
+## 1. Problem & Vision
+
+deckent's web dashboard (`localhost:3000`, or a user-deployed server) should offer a
+VSCode-like **embedded terminal** so users can drive deckent **and** interactively run
+the AI CLIs (`claude`, `gemini`, `codex`) from the browser — the way Claude Code feels
+native in a terminal — without leaving the dashboard. Users watch the live flow in the
+terminal itself and configure deckent (`config`) from the same web UI.
+
+The terminal must feel **native, premium, and effortless**: the user accomplishes
+something genuinely hard (audited, secure, reattachable remote shell + embedded AI CLIs)
+with zero configuration.
+
+### Decomposition (full god-level vision, sequenced — NOT reduced)
+
+This spec covers **only sub-project #1**. The others get their own spec → plan → impl
+cycle. Decomposition is sequencing, not MVP/minimization.
+
+| # | Sub-project | Depends on |
+|---|-------------|-----------|
+| **1** | **Embedded web terminal** (this spec) — PTY + `ws` + xterm.js; claude/gemini/codex/deckent/shell; localhost-default + token; ADR amendment | — |
+| 2 | Self-security procedure — secure-by-default, transparent audit, prompt/command guard + **planner state hygiene** (see §1d backlog) | 1 |
+| 3 | Million-scale security — multi-tenant isolation, sandbox, rate/resource limits | 1, 2 |
+| 4 | Enterprise external-world integrations + secure data exchange | 2, 3 |
+
+### Security principle (cross-cutting, locked)
+
+**Secure-by-default + zero-config + transparent.** The user is protected without effort
+(no setup), but can always **see and audit** what happens (documented policy, queryable
+audit timeline). "User doesn't have to deal with it" ✅ — "user is kept unaware" ❌.
+Hidden behavior is an anti-pattern for an OSS product aimed at millions and is an
+instant disqualifier for enterprise (SOC2/GDPR).
+
+---
+
+## 1b. Process Gate (before reorg AND before the implementation plan)
+
+Locked working discipline (Alperen, 2026-05-19):
+
+1. Before starting any work, **both Alperen and Claude fully analyze the current
+   dashboard + deckent processes** (routes, build, API surface, SSE, config flow) —
+   no assumed behavior.
+2. The implementation plan proceeds **only from verified / proven processes**.
+3. Before finalizing the plan, **run systematic-debugging** as a definitive check to
+   confirm current behavior matches documentation (catch drift first).
+4. Reorg companion constraints: `2026-05-19-terminal-aware-reorg-note.md`.
+
+## 1c. Verified Current State — Step A (2026-05-19, joint analysis, Alperen-approved)
+
+Facts below are **verified against the codebase** (not assumed). The implementation
+plan proceeds ONLY from these. Drifts vs the original spec draft are corrected here.
+
+**Confirmed (spec assumptions hold):**
+
+- `src/api/server.ts:42` `LOCALHOST_ONLY='127.0.0.1'`, `:864 server.listen(port,host)`,
+  strict localhost-only CORS — **the security posture already exists in code**.
+- SSE `/api/events` exists (`server.ts:441-443`, `text/event-stream`, `sseClients`).
+  Terminal **complements** it; must not break it.
+- `src/orchestra/self-modifying-detector.ts:40` path list includes **both `src/api/`
+  and `src/dashboard/`** → this feature **WILL trigger dogfood/self-modifying mode →
+  sequential execution is mandatory**. Must be declared in the sprint DIRECTIVES.
+- `node-pty` / `ws` absent from runtime deps (verified) — ADR work genuinely required.
+- `ConfigPage` uses a dynamic category system — a `terminal` config group is additive.
+- Routes/nav are a closed hardcoded list (`dashboard/src/App.tsx` +
+  `components/Layout.tsx` navItems) — adding `/terminal` = 3 known edits.
+
+**Corrections (original draft was wrong/assumed):**
+
+1. **ADR-010 path:** real file is `docs/adr/010-tek-runtime-dependency-commander-js.md`.
+   ADR-010 **already has an "Amendment — Sprint 172"** (`.brain/exports/decisions.md:210`)
+   mapping 7 runtime deps each to a governing ADR. Therefore the ADR task is to
+   **EXTEND that existing Sprint-172 Amendment with `node-pty` + `ws`, following its
+   established mapping pattern** — NOT to author a fresh amendment.
+2. **Auth — RESOLVED via systematic-debugging (Phase 1, root cause confirmed):**
+   - `serve.ts` exposes only `--port` (no token/host/autogen). `.deckent/config.json`
+     has **no `api_auth_token`**. Frontend (`api.ts`, `useApi`, `useSSE`) sends **zero
+     token** and `EventSource`/`WebSocket` **cannot** set an `Authorization` header.
+   - `verifyBearerToken` (`auth.ts:44`) reads **only** the `Authorization` header
+     (no query/cookie/subprotocol path).
+   - **Root cause:** the dashboard works ONLY because the environment has
+     `DECKENT_API_AUTH_DISABLED=1` (Sprint-143 local-dev bypass). Without it, no token
+     ⇒ `auth.ts:91` returns 401 for ALL `/api/` incl. SSE ⇒ dashboard dead. There is
+     **no working browser→server auth path for header-less transports** in the codebase.
+   - `DECKENT_API_AUTH_DISABLED` is flagged **B-022 [MEDIUM]** (Sprint-171 audit,
+     `docs/audits/sprint-171/02-concern/03-security.md:226`), recommended for removal.
+   - **Decisions (Alperen):** (a) terminal WS auth is a **new path independent of and
+     stricter than the global bypass** — it enforces its own token even when
+     `DECKENT_API_AUTH_DISABLED=1` (a read-only-dashboard dev convenience must NEVER
+     silently open a remote shell; aligns with B-022 hardening). (b) Token delivery:
+     **server injects an auto-generated token into the served page via a localhost-only
+     bootstrap**; the SPA reads it and passes it on the WS `Sec-WebSocket-Protocol`
+     subprotocol; server-side compares via the existing SHA-256 + `timingSafeEqual`
+     primitive (NOT header-bound `verifyBearerToken`). (c) `serve.ts` gains the missing
+     CLI surface (`--host`, terminal token/bind options). Frontend token plumbing is
+     **in scope for #1**.
+3. **WS auth primitive:** `bearerAuthMiddleware` is `(req,res)→boolean`; the `upgrade`
+   event gives `(req,socket,head)` with no `res`. Reuse the lower-level
+   `verifyBearerToken(req,token)` from `auth.ts` inside a custom upgrade-auth function,
+   NOT the middleware.
+4. **`upgrade` handler absent (verified):** add `server.on('upgrade')` alongside the
+   existing `createServer` — a real implementation task.
+5. **config.ts type-surface debt:** there is NO `terminal` key; `dependency_pipeline_enabled`
+   is bolted on via an intersection type with a "should be added to DeckentConfig" TODO.
+   `terminal{}` must be added **properly to the `DeckentConfig` type**, not repeat the
+   bolt-on debt.
+
+**Git/branch (Alperen-decided):** dashboard repair + provisioner commits live on
+`docs/embedded-web-terminal-spec` (main is behind). Continue on this branch
+(spec + dashboard-fix + terminal together) → single PR/merge to main at the end.
+
+## 1d. Post-Step-A Locked Decisions (2026-05-19, Alperen)
+
+**UX — VSCode-like dock panel (NOT a separate full page).** The terminal is a
+**dockable, resizable panel** in the dashboard shell (bottom/side, toggle, persisted),
+so the user manages everything from one screen regardless of the active page. Step A
+verified the dashboard currently has **no panel/dock system** (full-page views only,
+`components/Layout.tsx`). Therefore #1 adds a **dock-panel layer to `Layout.tsx`** —
+this is added frontend scope (more than a `/terminal` route), deliberate.
+
+**Enterprise/k8s — design the seams now, implement in #3 (god-level architecture,
+sequenced delivery; NOT MVP-reduction).** #1 runs single-user localhost but bakes in
+**extension interfaces so #2/#3 extend without rewrite**:
+
+- `AuthProvider` interface — impl today = local injected token; future = OIDC/SSO/mTLS
+  (new impl only, no call-site changes).
+- `SessionBackend` interface — impl today = in-process `node-pty`; future = remote /
+  k8s pod-exec behind the same interface.
+- `tenantId` / identity field threaded through every session + audit structure from
+  the start (single `"local"` tenant today).
+- Audit `memory.db` schema includes a **tenant-scoped column** from day one.
+
+These seams are low-cost now and prevent a rewrite for the "localhost → server → k8s"
+trajectory. Multi-tenant isolation / SSO / k8s execution themselves remain **sub-project
+#3** (own spec, full scope). Decomposition + ship-and-iterate preserved.
+
+### Sub-project #2 — backlog (planner state hygiene, captured during Sprint 175 prep)
+
+Caught while preparing the Sprint 175 dogfood run; both are planner state-hygiene
+defects, formally deferred to #2 (Alperen 2026-05-20):
+
+1. **Auto-debt-injection empty-scope bug** (`src/orchestra/sprint-planner.ts:197-216`):
+   CRITICAL debt items are prepended as tasks with `scope:{directories:[],filesWrite:[]}`
+   → workers have nothing to do → no `.result` → debt re-perpetuates next sprint
+   (4-sprint loop confirmed for `debt-170-001-fix`, closed 2026-05-20). Fix should
+   either carry the original task's scope or skip auto-inject for "verified-no-result"
+   class debts and surface them for honest closure instead.
+2. **Re-plan orphan cleanup**: `deckent plan` rewrites `.tasks/task-{sprintId}-*.json`
+   but does NOT unlink task files from a previous plan iteration whose ID slot is no
+   longer used (Sprint 175 dry-run showed 20 tasks while disk held 21; orphan
+   `task-175-021.json` from the pre-debt-closure iteration was hand-removed and
+   committed). Fix: planner must reconcile by deleting stale `.tasks/*.json` not in
+   the new plan's id set.
+3. **DEP0190 / ADR-006 violation — `shell:true` + args array (3 call-sites,
+   unconditionally on all platforms)** observed during Sprint 175 EXECUTE:
+   `src/core/plugin-hooks.ts:395`, `:577`, `src/orchestra/baseline-tracker.ts:85`
+   all call `spawnSync('npx', ['vitest','run',…], { shell:true })`. Node DEP0190
+   warns ("security vulnerabilities, arguments are not escaped, only concatenated"
+   — future Error). Also violates ADR-006 (spawnSync Security Pattern) which
+   `src/orchestra/authority-enforcer.ts:464-481` already flags as a lint issue but
+   is not runtime-enforced (ADR-037 V1.0 Layer-2 advisory). Fix: drop `shell:true`
+   or gate it on `process.platform === 'win32'` (npm/npx `.cmd` resolution on
+   Windows is the only legitimate need — see `src/providers/subprocess.ts:147` for
+   the existing conditional pattern).
+4. **Schema-gate coverage enforcement gap**: `config.coverage_threshold` defaults
+   to 90 (`src/core/config.ts:554`) and is wired into the EVALUATE phase
+   (`sprint-controller.ts:679`), but the gate is **advisory** — sprint-finalizer
+   auto-lowers the threshold when "avg coverage < 70%" (`sprint-finalizer.ts:413,
+   450`), so a sprint of low-coverage work silently re-baselines the bar. Recent
+   sprints (172–175) show coverage drifting 0.0–15.0% while the gate keeps moving
+   with it. Fix should split into two knobs: a hard floor (never auto-lowered)
+   and an aspirational threshold that the auto-learn loop may tune.
+5. **WorkerCard / DashboardPage pre-existing TS errors**: `cd src/dashboard && npx
+   tsc --noEmit` surfaces TS2345 in `src/components/WorkerCard.tsx:127` and
+   `src/pages/DashboardPage.tsx:284` — the i18n `t()` signature uses a literal
+   union of 340+ keys but is passed to a child that types `key: string`, so the
+   contravariance fails. Suppressed because `npm run test:dashboard` uses Vite
+   (which transpiles without strict type checks) and the root `npm run lint`
+   doesn't recurse into `src/dashboard/tsconfig.json`. Fix: relax the `t()`
+   return-type to `(key: string, params?: ...) => string` at the prop boundary,
+   or thread the literal union all the way down. Either way, wire the dashboard
+   tsc into root `lint` so this doesn't regress silently.
+6. **`doctor` DECISIONS.md obsolete check**: `src/cli/commands/doctor.ts:193`
+   still lists `DECISIONS_FILE` (`.brain/DECISIONS.md`) in `requiredFiles`, but
+   Memory V2 (Sprint 143) moved this to `.brain/memory.db` with `.brain/exports/
+   decisions.md` as the generated snapshot. The check reports a false-positive
+   "missing required file" on any clean Memory-V2 install. Cascade fossils:
+   `src/core/constants.ts:37` exports the constant, `src/orchestra/debt-manager.
+   ts:481` keeps `DECISIONS.md` in `DECAY_EXEMPT`, `src/orchestra/sprint-docs-
+   helpers.ts:142` writes "See .brain/DECISIONS.md" into the now-deprecated
+   PROJECT-IDENTITY.md, and `src/orchestra/authority-enforcer.ts:118` lists the
+   path in its allow-list. Fix: replace with `.brain/memory.db` (or the export
+   path) + sweep the cascade.
+
+### Sub-project #2 — self-security procedure scope (captured 2026-05-20)
+
+Beyond the planner state-hygiene defects above, #2 introduces a runtime **prompt
+& command guard** between the terminal session and the AI tools running inside
+it (claude / gemini / codex / deckent). Working notes — to be designed into
+ADR-form during the #2 spec phase:
+
+- **Prompt guard**: terminal pipes user input into AI tools; an injected prompt
+  could exfiltrate via the same PTY. Pre-input filter (token bucket on suspect
+  patterns: long base64 blobs, OSC sequences from upstream that escape to the
+  host terminal, `curl … | sh` chains). Block on signal, surface to audit as
+  structured event, never drop bytes silently (security ≠ trust loss).
+- **Command guard**: explicit deny-list for shell-kind sessions when
+  `allowShellKind=true` but `host !== 127.0.0.1` (i.e. opt-in remote-shell).
+  Candidates: `rm -rf /`, `mkfs.*`, `dd of=/dev/*`, `:(){:|:&};:`, ssh-keygen
+  rewrites, `.ssh/authorized_keys` touches. Same audit + surface pattern.
+- **Outbound rate-limit**: per-session ws send-bytes cap (already present as
+  backpressure pause); add a *daily* tenant-scoped quota so a compromised AI
+  loop can't exfiltrate gigabytes before the operator notices.
+- **Mutual-TLS hook**: `AuthProvider` interface (#3 implements multi-tenant)
+  needs a designed hook for client-cert auth, separate from the localhost token
+  path. Capture in the #2 spec so #3 doesn't have to re-litigate.
+- **Self-audit-of-audit**: terminal audit writes to `memory.db`, but who watches
+  the writer? Periodic integrity check (HMAC chain over append-only event
+  series) — explore in #2, ship in #3.
+
+These are the *requirement* surfaces — the #2 plan will translate them into
+TDD'able tasks.
+
+## 2. Locked Decisions
+
+| Decision | Choice | Rationale |
+|---|---|---|
+| Terminal capability | Full interactive PTY shell | claude/gemini/codex are interactive PTY apps; command-console insufficient |
+| Deployment model | Single-user now; session abstraction for future multi-user (no impl) | YAGNI; multi-user = sub-project #3 |
+| Transport | `ws` library | Hand-rolled RFC6455 is itself a security surface; `ws` is audited, zero-dep, less code → faster + safer GA |
+| Security posture | localhost-only bind by default + token; remote = explicit opt-in flag + strong token | Full PTY = RCE; secure-by-default; TLS/reverse-proxy is user responsibility (documented) |
+| Session model | Multi-tab: AI chat / deckent / plain shell | Matches "embed + convenience" vision; VSCode multi-terminal feel |
+| Session persistence | Persistent server-side PTY + reattach (tmux-like) | Long deckent sprints survive client disconnect |
+| `shell` kind default | Enabled + localhost + audited + `allowShellKind` to disable; remote shell needs extra explicit opt-in | Balances full-shell vision with secure-by-default |
+| Audit sink | Structured low-volume events → `memory.db` new `audit` type; raw PTY output NEVER persisted | Zero disk burden; queryable native audit timeline; DB-first culture |
+
+---
+
+## 3. Architecture
+
+```
+Browser (xterm.js, multi-tab)
+   │  WS  /api/terminal/ws        (auth in handshake, BEFORE upgrade/spawn)
+   │  HTTP /api/terminal/sessions (Bearer — existing auth.ts)
+   ▼
+ws-gateway.ts ──► session-manager.ts ──► node-pty (claude|gemini|codex|deckent|$SHELL)
+                       │ Map<sessionId, PtySession{ pty, ringBuffer, kind, status }>
+                       │ attach/detach ≠ kill · bounded scrollback · audit events
+```
+
+- New **runtime** deps: `node-pty`, `ws` → **ADR-010 Amendment + new ADR**.
+- `xterm.js` (+ fit addon) is a dashboard **devDependency** — does NOT affect ADR-010.
+- Reuses existing `src/api/server.ts`, `src/api/auth.ts`, `src/api/rate-limiter.ts`.
+
+### Components (each single-responsibility, independently testable)
+
+| Unit | File | Responsibility |
+|---|---|---|
+| **PtySessionManager** | `src/api/terminal/session-manager.ts` | node-pty lifecycle; `Map<sessionId, PtySession>`; bounded ring-buffer (scrollback) per session; attach/detach (does NOT kill on disconnect); explicit kill; idle-reaper via `idleTimeoutMs` (deckent kind exempt by default) |
+| **WsGateway** | `src/api/terminal/ws-gateway.ts` | `/api/terminal/ws` upgrade; **verify token BEFORE pty spawn**; protocol; reattach replay; backpressure (pause pty if ws send buffer too large) |
+| **HTTP control** | `src/api/server.ts` (additions) | `GET /api/terminal/sessions`, `POST /api/terminal/sessions`, `DELETE /api/terminal/sessions/:id` — existing Bearer middleware |
+| **Audit writer** | `src/api/terminal/audit.ts` | Append structured low-volume events to `memory.db` (`audit` entry type); never writes raw PTY bytes |
+| **TerminalPage** | `src/dashboard/src/pages/TerminalPage.tsx` (+ components) | xterm.js + fit; tab bar with quick-launch (claude/gemini/codex/deckent/shell); auto-reconnect + reattach by sessionId; "reconnecting" state |
+| **Config** | `.deckent/config.json → terminal{}` | `enabled, bind, maxSessions, idleTimeoutMs, scrollbackBytes, allowShellKind`; surfaced in ConfigPage |
+
+### WS protocol (minimal JSON)
+
+- Client → server: `{t:'attach', sessionId}` · `{t:'input', data}` · `{t:'resize', cols, rows}`
+- Server → client: `{t:'output', data}` · `{t:'exit', code}` · `{t:'sessions', list}` · `{t:'error', msg}`
+- Auth: token sent in WS subprotocol / first handshake message — **never** in query string (avoid logging). Verified before any PTY spawn.
+
+---
+
+## 4. Data Flow & Reattach
+
+1. `POST /api/terminal/sessions {kind, tool?, cwd?}` → manager spawns node-pty
+   (`claude` | `gemini` | `codex` | `deckent <args>` | `$SHELL`) → returns `sessionId`.
+2. Browser opens WS, auth handshake, sends `attach{sessionId}` → server **replays
+   bounded ring-buffer**, then live-streams `pty.onData → ws`; `ws input → pty.write`.
+3. **Disconnect:** ws closes, **pty stays alive**, ring-buffer keeps filling (bounded).
+4. **Reconnect:** new ws → `attach{sessionId}` → replay buffer → resume live.
+5. **Kill:** only explicit (`DELETE` / UI close-with-kill) or idle-reaper
+   via `idleTimeoutMs` (deckent kind exempt by default).
+
+---
+
+## 5. Security Details
+
+- **Bind:** default `127.0.0.1`. Remote requires explicit `terminal.bind` config **and**
+  a non-empty strong token (refuse to start remote-bound terminal without a token).
+- **Auth:** WS upgrade reuses the **`verifyBearerToken(req,token)` primitive** from
+  `auth.ts` (NOT `bearerAuthMiddleware` — no `res` in the `upgrade` event; see §1c.3),
+  verified **before** pty spawn. HTTP `/api/terminal/*` uses the existing middleware.
+  Zero-config but authed locally: `deckent serve` prints an **auto-generated session
+  token** on start (user does nothing, but no anonymous access). NOTE: frontend has no
+  token plumbing today (§1c.2) — adding it is in scope; real auth behavior confirmed
+  via systematic-debugging before the plan is finalized.
+- **Transparent audit:** every session create/attach/kill + command-start + auth
+  success/deny → structured event in `memory.db` (`audit` type, decay-exempt,
+  FTS-excluded). Surfaced as a native "Activity / Security" timeline in the dashboard.
+  Raw PTY output is **never** persisted (in-memory bounded ring-buffer only).
+- **Remote `shell` kind:** requires an extra explicit opt-in beyond remote bind.
+- **Limits:** `maxSessions` cap + `rate-limiter.ts` on the create endpoint.
+
+---
+
+## 6. Error Handling
+
+- node-pty spawn failure → structured error to client, no session created.
+- AI CLI binary missing (`claude`/`gemini`/`codex` not on PATH) → friendly message
+  with install hint.
+- WS auth failure → close with policy code, **no PTY spawned**.
+- ws send buffer bloat → pause pty (backpressure), resume on drain.
+- **Server restart = sessions lost** (in-memory). This is an explicit, documented
+  boundary of sub-project #1. Reattach survives **client** disconnect only, NOT server
+  restart. Disk-persisted sessions are out of scope (post-#1, note for future).
+
+---
+
+## 7. Testing (TDD — project culture)
+
+- **Unit — session-manager:** create / attach / detach (no kill) / explicit kill /
+  ring-buffer bound enforcement / idle-reaper (deckent kind exempt) with mock pty.
+- **Unit — ws-gateway:** auth gate rejects **before** spawn; protocol framing; backpressure.
+- **Unit — security:** remote bind refused without token; default localhost; remote
+  shell extra opt-in enforced.
+- **Unit — audit:** structured event written to DB; raw output never persisted.
+- **Integration:** spawn real `bash -c 'echo …'`, attach via ws, assert output;
+  disconnect → reattach → buffer replay.
+- **Frontend (vitest.dashboard):** TerminalPage tab create/close/switch; reconnect state.
+
+---
+
+## 8. ADR Work (ADR-036 governance — mandatory)
+
+- **ADR-010 — EXTEND existing Sprint-172 Amendment** (file:
+  `docs/adr/010-tek-runtime-dependency-commander-js.md`; DB:
+  `.brain/exports/decisions.md:210`): add `node-pty` + `ws` rows following the
+  established 7-dep → governing-ADR mapping pattern. Not a fresh amendment. (See §1c.1.)
+- **New ADR — Embedded Web Terminal Architecture:** PtySessionManager + ws gateway +
+  localhost-default security + transparent audit + reattach semantics + explicit
+  server-restart boundary.
+
+---
+
+## 9. Out of Scope (sub-project #1)
+
+- Multi-tenant isolation / sandboxing / per-user resource limits → #3.
+- Disk-persisted sessions surviving server restart → post-#1.
+- Self-security command/prompt guard → #2.
+- Enterprise external integrations / secure data exchange → #4.
+- Remote access UX beyond opt-in flag + token + documented TLS/reverse-proxy guidance.
diff --git a/docs/superpowers/specs/2026-05-19-terminal-aware-reorg-note.md b/docs/superpowers/specs/2026-05-19-terminal-aware-reorg-note.md
new file mode 100644
index 000000000..2a6bd7f1a
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-19-terminal-aware-reorg-note.md
@@ -0,0 +1,56 @@
+# Terminal-Aware Dashboard Reorg Note
+
+- **Date:** 2026-05-19
+- **Companion to:** `2026-05-19-embedded-web-terminal-design.md` (sub-project #1)
+- **Purpose:** Things to preserve / leave room for during the upcoming dashboard
+  reorg so the embedded web terminal integrates **painlessly later**. This is NOT a
+  reorg plan — it is a constraint checklist for whoever does the reorg.
+
+> Precondition (process discipline, see §0): the reorg itself starts only after the
+> joint current-state analysis of dashboard + deckent processes. This note is the
+> *terminal-specific* slice of that analysis input.
+
+## 0. Process gate (applies before reorg AND before impl plan)
+
+- Before starting any of this work, **both Alperen and Claude fully analyze the
+  current dashboard + deckent processes** (routes, build, API surface, SSE, config flow).
+- The implementation plan proceeds **only from verified/proven processes** — no
+  assumed behavior.
+- Before finalizing the plan, **run systematic-debugging** as a definitive check
+  (confirm the current flow actually behaves as documented; catch drift first).
+
+## 1. Frontend — leave room for these (do not paint into a corner)
+
+| Need | Reorg implication |
+|---|---|
+| New route `/terminal` + nav entry | Keep the router/nav extensible; reserve a nav slot. Don't hardcode a closed page list. |
+| `TerminalPage.tsx` + `components/terminal/` | Reserve a pages/ + components/ location; don't flatten in a way that blocks a new feature page. |
+| VSCode-like dock area | Leave a layout region (bottom or side panel) where a terminal can dock alongside the live dashboard — don't lock the layout to fixed full-page views only. |
+| `ConfigPage` gets a `terminal{}` section | Keep ConfigPage section-driven/extensible (it is 29KB — if reorg splits it, keep an "add a config group" seam). |
+| `DashboardPage` live flow vs terminal | Decide the relationship now: terminal output and the structured live panel coexist. Don't make DashboardPage assume it owns the whole viewport. |
+| xterm.js (+ fit addon) | Frontend **devDependency** only (ADR-010 unaffected). If reorg touches `src/dashboard` build/deps, leave the dep-add path clean. |
+
+## 2. API server — do NOT claim or break these paths
+
+- Reserve path prefix **`/api/terminal/*`** (sessions CRUD) and the WS upgrade path
+  **`/api/terminal/ws`**. Reorg/refactor of `src/api/server.ts` must not collide with
+  these or remove the `http` server's `upgrade` event capability (ws needs it).
+- **Preserve** existing patterns the terminal complements (does NOT replace):
+  `/api/events` (SSE), `/api/worker/:taskId/log`, Bearer middleware in `auth.ts`,
+  `rate-limiter.ts`. The terminal reuses these — keep them as stable seams.
+- The `/api/v1/...` → `/api/...` normalization must keep working for the new routes.
+
+## 3. Security seams to keep intact
+
+- `auth.ts` Bearer middleware must remain reusable for `/api/terminal/*` and the WS
+  handshake (token verified **before** upgrade). Don't fold auth into something
+  HTTP-only that a WS upgrade can't reach.
+- Keep a place to surface the auto-generated session token in `deckent serve` startup
+  output (zero-config-but-authed).
+
+## 4. Out of scope for the reorg
+
+The reorg should **not** implement any terminal code. It only avoids decisions that
+would force a painful rework when sub-project #1 is built. If a reorg choice is
+cheap-now / expensive-later for the terminal, prefer the terminal-friendly option;
+otherwise leave it and note it.
diff --git a/docs/vision/VISION-TR.md b/docs/vision/VISION-TR.md
index 3b1176553..dc1b27ddd 100644
--- a/docs/vision/VISION-TR.md
+++ b/docs/vision/VISION-TR.md
@@ -16,9 +16,9 @@ Uzun vadeli hedef: Deckent, her zaman açık, kendi kendini geliştiren bir geli
 
 Solo AI asistanı kullanımı doğası gereği sınırlıdır: tek context window, tek görev, tek bakış açısı. Deckent bu sınırı Brain-Worker-Auditor mimarisi ile aşar. Brain stratejiyi belirler, Worker'lar paralel çalışır, Auditor kaliteyi garanti eder. Her sprint sonunda öğrenimler hafızaya yazılır — sistem her iterasyonda daha iyi kararlar alır.
 
-**Şu an neredeyiz:** AI orkestrasyon CLI — 3 spawn backend (tmux, subprocess, Docker), 3 AI provider, **15 agent**, 21 skill, 27 MCP tool, ADR governance (46 ADR), Memory V2 (SQLite FTS5) ile sprint bazlı çok-ajanlı yürütme.
+**Şu an neredeyiz:** AI orkestrasyon CLI — 3 spawn backend (tmux, subprocess, Docker), 3 AI provider, **15 agent**, 21 skill, 27 MCP tool, ADR governance (46 ADR), Memory V2 (SQLite FTS5) ile sprint bazlı çok-ajanlı yürütme; **Sprint 175** itibarıyla dashboard içinde VSCode-benzeri dock-edilebilir panel olarak çalışan **gömülü web terminali** — `claude` / `gemini` / `codex` / `deckent` / shell oturumlarını kullanıcı tek ekrandan sürer (ADR-062). Bu terminal, agentic-OS düzeyindeki iş akışlarına giden 4-parçalı yolun #1 alt-projesidir; bkz. `docs/guide/terminal-tr.md`.
 
-**Nereye gidiyoruz:** Otonom AI asistanı — heartbeat daemon, proaktif görev yürütme, kanal entegrasyonları (Slack, GitHub), kod tabanı semantik anlayışı, always-on gateway. OpenClaw'ın mimarisi + Deckent'in çok-ajanlı disiplini.
+**Nereye gidiyoruz:** Otonom AI asistanı — heartbeat daemon, proaktif görev yürütme, kanal entegrasyonları (Slack, GitHub), kod tabanı semantik anlayışı, always-on gateway. Gömülü terminal bu geleceğe atılan ilk somut adım: "orkestratör" ile "gerçekten çalıştığın yer" arasındaki sınırı kaldırır. Alt-projeler #2 (self-security: prompt/komut guard), #3 (multi-tenant / k8s izolasyonu) ve #4 (enterprise dış-dünya entegrasyonları) bunu **yeniden yazmadan** genişletir — `AuthProvider`, `SessionBackend` ve `tenantId` dikişleri ilk günden konumlandı. OpenClaw'ın mimarisi + Deckent'in çok-ajanlı disiplini.
 
 ---
 
diff --git a/docs/vision/VISION.md b/docs/vision/VISION.md
index 0de386514..5521c533a 100644
--- a/docs/vision/VISION.md
+++ b/docs/vision/VISION.md
@@ -16,9 +16,9 @@ The long-term goal: Deckent becomes an always-on, self-improving development tea
 
 Solo AI assistants are inherently limited: one context window, one task, one perspective. Deckent breaks through this ceiling with its Brain-Worker-Auditor architecture. Brain sets the strategy, Workers execute in parallel, Auditor guarantees quality. After every sprint, learnings persist to memory — the system makes better decisions with each iteration.
 
-**Where we are now:** AI orchestration CLI — sprint-based multi-agent execution with 3 spawn backends (tmux, subprocess, Docker), 3 AI providers, **15 agents**, 21 skills, 27 MCP tools, ADR governance (46 ADRs), Memory V2 (SQLite FTS5).
+**Where we are now:** AI orchestration CLI — sprint-based multi-agent execution with 3 spawn backends (tmux, subprocess, Docker), 3 AI providers, **15 agents**, 21 skills, 27 MCP tools, ADR governance (46 ADRs), Memory V2 (SQLite FTS5), and as of **Sprint 175** an **embedded web terminal** that lets users drive `claude` / `gemini` / `codex` / `deckent` / shell sessions from a VSCode-style dockable panel inside the dashboard (ADR-062). That terminal is sub-project #1 of a four-part path toward agentic-OS-grade workflows; see `docs/guide/terminal.md`.
 
-**Where we are going:** Autonomous AI assistant — heartbeat daemon, proactive task execution, channel integrations (Slack, GitHub), codebase semantic understanding, always-on gateway. Think OpenClaw's architecture + Deckent's multi-agent discipline.
+**Where we are going:** Autonomous AI assistant — heartbeat daemon, proactive task execution, channel integrations (Slack, GitHub), codebase semantic understanding, always-on gateway. The embedded terminal is the first concrete step into that future: it dissolves the boundary between "orchestrator" and "where you actually work". Sub-projects #2 (self-security: prompt/command guard), #3 (multi-tenant / k8s isolation), and #4 (enterprise external integrations) extend it without rewriting — `AuthProvider`, `SessionBackend`, and `tenantId` seams are in place from day one. Think OpenClaw's architecture + Deckent's multi-agent discipline.
 
 ---
 
diff --git a/docs/vision/blueprint.md b/docs/vision/blueprint.md
index c5fc42846..ee959e6ec 100644
--- a/docs/vision/blueprint.md
+++ b/docs/vision/blueprint.md
@@ -275,12 +275,17 @@ $ deckent init
 
 ```
 Required:
-  Node.js ≥ 18 (22 recommended)
+  Node.js ≥ 18 (22 recommended)         — detected; install guidance only (not auto-installed)
   git
-  tmux (auto-installed on first run if missing)
-  Claude Code CLI (npm install -g @anthropic-ai/claude-code)
+  tmux                                  — detected; OS-package instruction surfaced (sudo never run silently)
+  Claude Code CLI                       — `deckent init` offers consent-based install (npm i -g @anthropic-ai/claude-code); --yes for CI, --no-install for hint-only
   Claude subscription (Pro, Max, or API key)
 
+  Note (ADR-062): `deckent init` detects missing prerequisites and, with the
+  user's per-tool consent, installs the provider CLIs (claude/codex/gemini).
+  OS packages (tmux) and runtimes (node)/docker are surfaced as instructions
+  the user runs — never silently auto-installed.
+
 Supported OS:
   macOS (Intel + Apple Silicon)
   Linux (Ubuntu 20+, Debian 11+, Fedora 38+, Arch)
@@ -1122,10 +1127,18 @@ $ deckent status
 ╚══════════════════════════════════════════════════════╝
 ```
 
-## Phase 2: Web Dashboard — DONE (Sprint 11)
+## Phase 2: Web Dashboard — DONE (Sprint 11), end-to-end repaired (Sprint 175)
 
 React + Vite + Tailwind, 6 pages, shadcn/ui components, SSE for real-time updates.
 
+> **Sprint 175 repair (honesty):** The dashboard shipped but was not end-to-end
+> usable — `web`/`serve` resolved the static dir to a non-existent path
+> (`<projectRoot>/src/dashboard/dist`) and `serve` never passed it; the build
+> chain could ship an empty `dist/dashboard`; `/api/chat` returned 404. Fixed:
+> bundled-dashboard resolver (`dist/dashboard`, install-safe), resilient
+> `build:dashboard`, and a real `/api/chat` handler. `deckent web` now serves a
+> working dashboard from the installed package.
+
 - **Dashboard page:** Live agent status, progress bars, alerts with badge colors, elapsed time, auditor status indicator
 - **Settings page:** Config viewer
 - **History page:** Sprint history with charts (Recharts)
diff --git a/package-lock.json b/package-lock.json
index 4e5904270..acbc682d2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,12 +9,14 @@
       "version": "1.0.0-beta.1",
       "license": "MIT",
       "dependencies": {
+        "@lydell/node-pty": "^1.2.0-beta.12",
         "@modelcontextprotocol/sdk": "^1.27.1",
         "@noble/ed25519": "^2.3.0",
         "@noble/hashes": "^1.8.0",
-        "better-sqlite3": "^12.9.0",
+        "better-sqlite3": "^12.10.0",
         "commander": "^13.0.0",
         "telegraf": "^4.16.0",
+        "ws": "^8.18.0",
         "zod": "^3.25.0"
       },
       "bin": {
@@ -26,13 +28,14 @@
         "@testing-library/react": "^16.3.2",
         "@types/better-sqlite3": "^7.6.13",
         "@types/node": "^25.5.0",
+        "@types/ws": "^8.5.14",
         "@vitest/coverage-v8": "^3.0.0",
         "happy-dom": "^20.8.4",
         "typescript": "^5.7.0",
         "vitest": "^3.0.0"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=24.0.0"
       },
       "optionalDependencies": {
         "discord.js": "^14.26.3"
@@ -823,6 +826,98 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@lydell/node-pty": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty/-/node-pty-1.2.0-beta.12.tgz",
+      "integrity": "sha512-qIK890UwPupoj07osVvgOIa++1mxeHbcGry4PKRHhNVNs81V2SCG34eJr46GybiOmBtc8Sj5PB1/GGM5PL549g==",
+      "license": "MIT",
+      "optionalDependencies": {
+        "@lydell/node-pty-darwin-arm64": "1.2.0-beta.12",
+        "@lydell/node-pty-darwin-x64": "1.2.0-beta.12",
+        "@lydell/node-pty-linux-arm64": "1.2.0-beta.12",
+        "@lydell/node-pty-linux-x64": "1.2.0-beta.12",
+        "@lydell/node-pty-win32-arm64": "1.2.0-beta.12",
+        "@lydell/node-pty-win32-x64": "1.2.0-beta.12"
+      }
+    },
+    "node_modules/@lydell/node-pty-darwin-arm64": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty-darwin-arm64/-/node-pty-darwin-arm64-1.2.0-beta.12.tgz",
+      "integrity": "sha512-tqaifcY9Cr41SblO1+FLzh8oxxtkNhuW9Dhl22lKme9BreYvKvxEZcdPIXTuqkJc5tagOEC4QHShKmJjLyLXLQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@lydell/node-pty-darwin-x64": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty-darwin-x64/-/node-pty-darwin-x64-1.2.0-beta.12.tgz",
+      "integrity": "sha512-4LrS5pCJwqHKDVf1zS2gyNV0m4hKAXch+XZNhbZ6LY8uwVL8BhchzQBO40Os5anuRxRCWzHpw4Sp64Ie8q7E4Q==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@lydell/node-pty-linux-arm64": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty-linux-arm64/-/node-pty-linux-arm64-1.2.0-beta.12.tgz",
+      "integrity": "sha512-Sx+A71x5BDGHt9ansfrtGxwq2VFVDWvJUAdlUL0Hv0qeiJUfts+hgopx+CgT4PSwahKjdEgtu0+FAfY9rICKRw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@lydell/node-pty-linux-x64": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty-linux-x64/-/node-pty-linux-x64-1.2.0-beta.12.tgz",
+      "integrity": "sha512-bJzs94njofYhGg/UDqW1nj0dtvvu+2OvxMY+RlLS1T17VgcktKoIR6PuenTwE5HJ/D6StCPADmXcT0nNsCKmIQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@lydell/node-pty-win32-arm64": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty-win32-arm64/-/node-pty-win32-arm64-1.2.0-beta.12.tgz",
+      "integrity": "sha512-p7POgjVEiFaBC3/y+AKuV1FzePCsJ6HmZDv2XK+jBZSfwP8+uBAw181ZiKYN1YuRa/XpmBGaWezcI8hZkbW++g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@lydell/node-pty-win32-x64": {
+      "version": "1.2.0-beta.12",
+      "resolved": "https://registry.npmjs.org/@lydell/node-pty-win32-x64/-/node-pty-win32-x64-1.2.0-beta.12.tgz",
+      "integrity": "sha512-IDFa00g7qUDGUYgByrUBJtC+mOjYVt/8KYyWivCg5JjGOHbBUACUQZLl0jTWmnr+tld/UyTpX90a2PY6oTVtRw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.27.1",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.27.1.tgz",
@@ -1740,9 +1835,9 @@
       "license": "MIT"
     },
     "node_modules/better-sqlite3": {
-      "version": "12.9.0",
-      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.9.0.tgz",
-      "integrity": "sha512-wqUv4Gm3toFpHDQmaKD4QhZm3g1DjUBI0yzS4UBl6lElUmXFYdTQmmEDpAFa5o8FiFiymURypEnfVHzILKaxqQ==",
+      "version": "12.10.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.10.0.tgz",
+      "integrity": "sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -1750,7 +1845,7 @@
         "prebuild-install": "^7.1.1"
       },
       "engines": {
-        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
+        "node": "20.x || 22.x || 23.x || 24.x || 25.x || 26.x"
       }
     },
     "node_modules/bindings": {
@@ -4758,7 +4853,6 @@
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
       "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/package.json b/package.json
index f977d601e..676ac6c99 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:dashboard": "vitest run --config vitest.dashboard.config.ts",
-    "build:dashboard": "cd src/dashboard && npx vite build --outDir ../../dist/dashboard",
+    "build:dashboard": "node scripts/build-dashboard.mjs",
     "build:all": "tsc && node scripts/copy-assets.mjs && npm run build:dashboard",
     "postbuild": "npm run build:dashboard",
     "lint": "tsc --noEmit",
@@ -30,6 +30,7 @@
     "lint:errors": "node scripts/check-error-handling.mjs",
     "lint:link": "node scripts/lint-links.mjs",
     "clean": "rm -rf dist",
+    "ci:rebuild-native": "npm rebuild better-sqlite3 --ignore-scripts=false",
     "validate:publish": "npx tsx scripts/validate-publish.ts",
     "docs:generate-cli": "npx tsx scripts/generate-cli-docs.ts",
     "docs:ref": "node scripts/gen-reference-docs.mjs --write",
@@ -60,16 +61,18 @@
   },
   "homepage": "https://deckent.agency",
   "dependencies": {
+    "@lydell/node-pty": "^1.2.0-beta.12",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@noble/ed25519": "^2.3.0",
     "@noble/hashes": "^1.8.0",
-    "better-sqlite3": "^12.9.0",
+    "better-sqlite3": "^12.10.0",
     "commander": "^13.0.0",
     "telegraf": "^4.16.0",
+    "ws": "^8.18.0",
     "zod": "^3.25.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=24.0.0"
   },
   "files": [
     "dist",
@@ -88,6 +91,7 @@
     "@testing-library/react": "^16.3.2",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.5.0",
+    "@types/ws": "^8.5.14",
     "@vitest/coverage-v8": "^3.0.0",
     "happy-dom": "^20.8.4",
     "typescript": "^5.7.0",
diff --git a/scripts/build-dashboard.mjs b/scripts/build-dashboard.mjs
new file mode 100644
index 000000000..d6bbe56bc
--- /dev/null
+++ b/scripts/build-dashboard.mjs
@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// Resilient dashboard build — closes the "published package ships an empty
+// dist/dashboard" gap (src/dashboard is a separate workspace whose deps are
+// NOT installed by a root `npm install`, so `vite build` failed silently and
+// every user got a broken dashboard).
+//
+// Behavior:
+//   1. Ensure src/dashboard deps are present (install only if vite missing).
+//   2. Run `vite build --outDir ../../dist/dashboard`.
+//
+// Invoked by package.json `build:dashboard` (and transitively by `postbuild`
+// / `build:all` / `prepublishOnly`).
+
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const dashDir = join(repoRoot, 'src', 'dashboard');
+
+function run(cmd, args, cwd) {
+  const r = spawnSync(cmd, args, {
+    cwd,
+    stdio: 'inherit',
+    // npm/vite resolve through .cmd wrappers on Windows; POSIX stays shell-free.
+    shell: process.platform === 'win32',
+  });
+  if (r.status !== 0) {
+    console.error(`\n[build-dashboard] \`${cmd} ${args.join(' ')}\` failed (exit ${r.status}).`);
+    process.exit(r.status ?? 1);
+  }
+}
+
+if (!existsSync(dashDir)) {
+  console.error(`[build-dashboard] src/dashboard not found at ${dashDir}`);
+  process.exit(1);
+}
+
+// 1. Ensure deps — install only when the build toolchain is absent.
+const viteBin = join(dashDir, 'node_modules', 'vite');
+if (!existsSync(viteBin)) {
+  console.log('[build-dashboard] Installing src/dashboard dependencies…');
+  run('npm', ['install', '--no-audit', '--no-fund'], dashDir);
+}
+
+// 2. Build into the package's dist/dashboard (shipped via package.json files).
+console.log('[build-dashboard] Building dashboard → dist/dashboard');
+run('npx', ['vite', 'build', '--outDir', '../../dist/dashboard', '--emptyOutDir'], dashDir);
+console.log('[build-dashboard] Done.');
diff --git a/scripts/close-debt-170-001-fix.ts b/scripts/close-debt-170-001-fix.ts
new file mode 100644
index 000000000..06a1cfeb2
--- /dev/null
+++ b/scripts/close-debt-170-001-fix.ts
@@ -0,0 +1,91 @@
+/**
+ * One-off: mark debt-170-001-fix resolved with honest Phase-4.5 closure note.
+ *
+ * Context:
+ *  - Spec: docs/superpowers/specs/2026-05-19-embedded-web-terminal-design.md
+ *  - Approved by Alperen 2026-05-20 (Sprint 175 unblock).
+ *  - Root cause established via systematic-debugging Phase 1 + Phase 4.5
+ *    (3+ failed identical-mode fixes = architectural loop, not a code bug).
+ *
+ * Action: non-destructive upsert of the existing debt entry — status → 'resolved',
+ * metadata.resolvedInSprintId='sprint-175', metadata.resolution=<full note below>.
+ * NO row deletion, NO schema change. memory.db remains intact.
+ *
+ * Run with:  npx tsx scripts/close-debt-170-001-fix.ts
+ */
+import { join, resolve } from 'node:path';
+import { MemoryStore } from '../src/core/memory-store.js';
+
+const DEBT_ID = 'debt-170-001-fix';
+const RESOLVED_IN = 'sprint-175';
+
+const CLOSURE_NOTE = `Resolved via Sprint 175 architectural closure (systematic-debugging Phase 4.5).
+
+Original 170-001 code (tmux taskId-aware prompt) landed in commit 5ffbf3e, verified
+present at src/orchestra/tmux.ts:61-70. The "missing .result" was a docker HB
+shutdown artifact from a worker process whose state is permanently un-reproducible
+(cleanup completed long since). The structural cause is already addressed by the
+Docker HB Core Fix (Sprint 138 Task 13, src/agents/worker.ts:297 atomic write +
+fsync + SIGTERM grace) for future tasks.
+
+Auto-debt-injection (sprint-planner.ts:197-216) produced empty-scope tasks that
+could not resolve a bookkeeping artifact. Re-injection across 4 sprints (170 -> 174,
+175 dry-run) was a Phase-4.5 architectural loop (3+ failed identical-mode fixes).
+Closure is honest acknowledgment of the historical artifact + verified-in-repo
+code — NOT a code change.
+
+Architectural follow-up (auto-debt-injection empty-scope bug) deferred to
+sub-project #2 (self-security procedure) per Alperen 2026-05-20.`;
+
+const projectRoot = resolve(process.cwd());
+const dbPath = join(projectRoot, '.brain', 'memory.db');
+
+const store = new MemoryStore(dbPath);
+try {
+  const entry = store.getById(DEBT_ID);
+  if (!entry) {
+    console.error(`✗ Debt entry ${DEBT_ID} not found in DB`);
+    process.exit(2);
+  }
+  if (entry.status === 'resolved') {
+    console.log(`• Already resolved (no-op): ${DEBT_ID}`);
+    process.exit(0);
+  }
+
+  console.log(`Found ${DEBT_ID}:`);
+  console.log(`  status=${entry.status}  priority=${entry.priority}  sprint=${entry.sprint_id ?? '-'}`);
+
+  const meta = JSON.parse(entry.metadata || '{}') as Record<string, unknown>;
+  const tags = entry.tag_text ? entry.tag_text.split(' ').filter(Boolean) : [];
+
+  store.upsert(
+    {
+      id: entry.id,
+      type: entry.type,
+      title: entry.title,
+      content: entry.content,
+      source: entry.source,
+      summary: entry.summary ?? undefined,
+      tags,
+      status: 'resolved',
+      priority: entry.priority ?? undefined,
+      sprint_id: entry.sprint_id ?? undefined,
+      sprint_num: entry.sprint_num ?? undefined,
+      lang: entry.lang ?? undefined,
+      metadata: {
+        ...meta,
+        resolvedInSprintId: RESOLVED_IN,
+        resolution: CLOSURE_NOTE,
+      },
+    },
+    'brain',
+  );
+
+  const verify = store.getById(DEBT_ID);
+  console.log(`✓ Updated. New status: ${verify?.status}`);
+  const newMeta = JSON.parse(verify?.metadata || '{}') as Record<string, unknown>;
+  console.log(`  metadata.resolvedInSprintId=${newMeta['resolvedInSprintId']}`);
+  console.log(`  metadata.resolution attached (${(newMeta['resolution'] as string)?.length ?? 0} chars)`);
+} finally {
+  store.close();
+}
diff --git a/scripts/gen-reference-docs.mjs b/scripts/gen-reference-docs.mjs
index c8fac993e..e584d9f68 100644
--- a/scripts/gen-reference-docs.mjs
+++ b/scripts/gen-reference-docs.mjs
@@ -178,7 +178,16 @@ export function parseAgents(agentsDir) {
 // ─── escape helper for markdown table cells ──────────────────────────────────
 
 function tableCell(s) {
-  return String(s ?? '').replace(/\|/g, '\\|').replace(/\r?\n/g, ' ').trim();
+  return String(s ?? '')
+    .replace(/\|/g, '\\|')
+    .replace(/\r?\n/g, ' ')
+    // VitePress's Vue compiler parses bare `<word>` patterns as unclosed HTML
+    // tags and bombs the build (e.g. `<command>`, `<sprint-id>` in usage
+    // strings). Escape as HTML entities so they render as literal text but
+    // are no longer parsed as element openers. Real HTML in source (e.g.
+    // `<br/>`, `<sub>`) won't match this anchored single-token pattern.
+    .replace(/<([a-zA-Z][a-zA-Z0-9_-]*)>/g, '&lt;$1&gt;')
+    .trim();
 }
 
 // ─── Renderers ───────────────────────────────────────────────────────────────
diff --git a/src/api/chat-handler.ts b/src/api/chat-handler.ts
new file mode 100644
index 000000000..871a716a2
--- /dev/null
+++ b/src/api/chat-handler.ts
@@ -0,0 +1,28 @@
+// ─── /api/chat handler ───────────────────────────────────────────────────
+// Closes the dashboard ChatPage stub: POST { message } → { reply }.
+// Minimal but real — recognizes status/help commands and always returns
+// actionable guidance (never a "not implemented" stub or 404).
+
+export interface ChatContext {
+  /** Returns a one-line current sprint status summary, if available. */
+  status?: () => string;
+}
+
+const HELP =
+  'Kullanılabilir komutlar: "status" — güncel sprint durumu. ' +
+  'Sprint başlatmak/izlemek için dashboard panellerini (New Sprint / Status) kullan.';
+
+export function buildChatReply(message: string, ctx: ChatContext): string {
+  const m = message.trim().toLowerCase();
+  if (!m) {
+    return `Komutlar: "status", "help". ${HELP}`;
+  }
+  if (/\b(status|durum)\b/.test(m)) {
+    const s = ctx.status?.() ?? 'No status available.';
+    return `Sprint durumu: ${s}`;
+  }
+  if (/\b(help|yardım|komut)\b/.test(m)) {
+    return HELP;
+  }
+  return `Anlamadım: "${message.trim()}". Komutlar: "status", "help". ${HELP}`;
+}
diff --git a/src/api/server.ts b/src/api/server.ts
index fa8ef3980..c7dd28a7f 100644
--- a/src/api/server.ts
+++ b/src/api/server.ts
@@ -2,6 +2,12 @@ import { createServer, type Server, type IncomingMessage, type ServerResponse }
 import { readFileSync, existsSync, readdirSync, writeFileSync } from 'node:fs';
 import { join, extname, resolve } from 'node:path';
 import { randomBytes, randomUUID } from 'node:crypto';
+import type { SessionBackend } from './terminal/session-backend.js';
+import { PtySessionManager } from './terminal/session-manager.js';
+import { LocalTokenAuthProvider } from './terminal/auth-provider.js';
+import { TerminalAudit, type AuditSink } from './terminal/audit.js';
+import { attachTerminalGateway } from './terminal/ws-gateway.js';
+import type { CreateSessionInput, SessionKind, TenantId } from './terminal/types.js';
 import { z } from 'zod';
 import {
   DASHBOARD_FILE, BRAIN_DIR, SPRINTS_DIR, TASKS_DIR, LOCKS_DIR,
@@ -28,6 +34,7 @@ import {
   validateWebhookKey,
 } from '../connectors/incoming-router.js';
 import { loadDeckSecrets } from '../core/deck-file.js';
+import { buildChatReply } from './chat-handler.js';
 
 const MIME_TYPES: Record<string, string> = {
   '.html': 'text/html',
@@ -99,6 +106,7 @@ const PlanSchema = z.object({
   mode: z.enum(['ai', 'structured', 'auto']).optional(),
 });
 const SetDirectivesSchema = z.object({ content: z.string().min(1) });
+const ChatSchema = z.object({ message: z.string() });
 const ConfigSchema = z.record(z.string(), z.unknown());
 const WORKER_ID_RE = /^[a-zA-Z0-9-]+$/;
 
@@ -174,6 +182,22 @@ function readDashboardJson(dashPath: string): unknown | null {
   return readJsonSafe<unknown>(dashPath);
 }
 
+/** One-line current status for the /api/chat handler. */
+function chatStatusLine(projectRoot: string, dashPath: string): string {
+  const data = readDashboardJson(dashPath) as {
+    sprint?: { id?: string; phase?: string; status?: string };
+    progress?: { done?: number; active?: number; blocked?: number; total?: number };
+  } | null;
+  if (data?.sprint) {
+    const s = data.sprint;
+    const p = data.progress ?? {};
+    return `${s.id ?? 'sprint'} — ${s.phase ?? s.status ?? 'running'} — ` +
+      `${p.done ?? 0}/${p.total ?? 0} done, ${p.active ?? 0} active, ${p.blocked ?? 0} blocked`;
+  }
+  const last = getLatestSprintLog(projectRoot);
+  return last ? `idle — last sprint ${last.id}` : 'idle — no sprint yet';
+}
+
 function getLatestSprintLog(projectRoot: string): { id: string; metrics: Record<string, string>; tasks: string[] } | null {
   const sprintsDir = join(projectRoot, BRAIN_DIR, SPRINTS_DIR);
   if (!existsSync(sprintsDir)) return null;
@@ -549,6 +573,19 @@ async function handleRequest(
       return;
     }
 
+    if (url === '/api/chat') {
+      const parsed = ChatSchema.safeParse(body);
+      if (!parsed.success) {
+        sendError(res, 400, parsed.error.message);
+        return;
+      }
+      const reply = buildChatReply(parsed.data.message, {
+        status: () => chatStatusLine(projectRoot, dashPath),
+      });
+      sendJson(res, { reply });
+      return;
+    }
+
     // POST /api/kill/:workerId
     if (url.startsWith('/api/kill/')) {
       const workerId = url.slice('/api/kill/'.length);
@@ -727,6 +764,8 @@ async function handleRequest(
 
 export interface HttpApi {
   server: Server;
+  /** Terminal auth token (test-exposed). Only set when terminal is enabled. */
+  terminalToken?: string;
   close(): Promise<void>;
 }
 
@@ -741,6 +780,8 @@ export interface HttpServerOptions {
   autoGenerateToken?: boolean;
   /** Max requests per minute per IP. Defaults to 100. 0 disables rate limiting. */
   rateLimit?: number;
+  /** PTY session backend for embedded terminal support (Sprint 175). */
+  terminalBackend?: SessionBackend;
 }
 
 export function createHttpServer(projectRoot: string, port?: number, staticDir?: string, apiToken?: string): HttpApi;
@@ -758,6 +799,7 @@ export function createHttpServer(
 
   let autoGenerateToken = false;
   let rateLimitMax = 100;
+  let terminalBackend: SessionBackend | undefined;
 
   if (typeof portOrOpts === 'object' && portOrOpts !== null) {
     listenPort = portOrOpts.port ?? DEFAULT_PORT;
@@ -766,6 +808,7 @@ export function createHttpServer(
     host = portOrOpts.host ?? LOCALHOST_ONLY;
     autoGenerateToken = portOrOpts.autoGenerateToken ?? false;
     rateLimitMax = portOrOpts.rateLimit ?? 100;
+    terminalBackend = portOrOpts.terminalBackend;
   } else {
     listenPort = portOrOpts ?? DEFAULT_PORT;
     resolvedStaticDir = staticDir;
@@ -824,18 +867,179 @@ export function createHttpServer(
     }
   }
 
+  // ─── Terminal setup (Sprint 175) ──────────────────────────────
+  let terminalToken: string | undefined;
+  let terminalMgr: PtySessionManager | undefined;
+  let terminalAudit: TerminalAudit | undefined;
+  let terminalAuth: LocalTokenAuthProvider | undefined;
+  let terminalReaper: NodeJS.Timeout | undefined;
+
+  if (terminalBackend) {
+    // Check if terminal is enabled via project config (sync read — createHttpServer is synchronous)
+    let terminalEnabled = true;
+    const projCfgPath = join(projectRoot, PROJECT_CONFIG_PATH);
+    if (existsSync(projCfgPath)) {
+      try {
+        const raw = readFileSync(projCfgPath, 'utf-8');
+        const projCfg = JSON.parse(raw) as { terminal?: { enabled?: boolean } };
+        if (projCfg?.terminal?.enabled === false) {
+          terminalEnabled = false;
+        }
+      } catch { /* ignore parse errors */ }
+    }
+
+    if (terminalEnabled) {
+      // Terminal ALWAYS mints its own token — independent of API auth (spec §1c.2).
+      // LocalTokenAuthProvider uses constant-time SHA-256 compare (timingSafeEqual)
+      // and DELIBERATELY ignores DECKENT_API_AUTH_DISABLED.
+      terminalToken = randomUUID();
+      process.stderr.write(`[deckent:info] Auto-generated API token: ${terminalToken}\n`);
+      terminalMgr = new PtySessionManager(terminalBackend, {
+        scrollbackBytes: 262_144,
+        idleTimeoutMs: 1_800_000,
+        maxSessions: 10,
+      });
+      // Structured audit recorder. Tests pass a no-op sink; production wires
+      // MemoryStore. Raw PTY output is NEVER routed here (security invariant).
+      const auditSink: AuditSink = { insert: () => { /* no-op default */ } };
+      terminalAudit = new TerminalAudit(auditSink);
+      terminalAuth = new LocalTokenAuthProvider(terminalToken);
+    }
+  }
+
   const server = createServer((req: IncomingMessage, res: ServerResponse) => {
-    handleRequest(req, res, projectRoot, dashPath, sseClients, resolvedStaticDir, initWatcher, finalToken, rateLimiter, authMiddleware).catch((err: unknown) => {
+    (async () => {
+      const rawUrl = req.url ?? '/';
+      const urlPath = rawUrl.split('?')[0] ?? '/';
+      const method = req.method ?? 'GET';
+
+      // ─── Terminal routes (bypass-independent auth, spec §1c.2) ─
+      if (terminalMgr && terminalAuth && terminalAudit && rawUrl.startsWith('/api/terminal/')) {
+        const authHeader = req.headers['authorization'] ?? '';
+        const tok = authHeader.replace(/^Bearer\s+/i, '');
+        if (!terminalAuth.verify(tok || undefined)) {
+          terminalAudit.record({
+            action: 'auth.deny',
+            tenantId: 'local',
+            detail: `http ${method} ${urlPath}`,
+            at: new Date().toISOString(),
+          });
+          res.writeHead(401, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Unauthorized' }));
+          return;
+        }
+        // POST /api/terminal/sessions
+        if (method === 'POST' && urlPath === '/api/terminal/sessions') {
+          let body: unknown;
+          try { body = await parseBody(req); } catch { body = {}; }
+          const input = body as { kind?: string; tool?: string; args?: string[] };
+          const kind = input.kind ?? 'shell';
+          try {
+            const sess = terminalMgr.create({
+              kind: kind as SessionKind,
+              tool: input.tool as CreateSessionInput['tool'],
+              args: input.args,
+              tenantId: 'local' as TenantId,
+            });
+            terminalAudit.record({
+              action: 'session.create',
+              tenantId: 'local',
+              sessionId: sess.id,
+              detail: `kind=${sess.kind}`,
+              at: new Date().toISOString(),
+            });
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(sess));
+          } catch (err: unknown) {
+            const msg = err instanceof Error ? err.message : 'create failed';
+            res.writeHead(409, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: msg }));
+          }
+          return;
+        }
+        // GET /api/terminal/sessions
+        if (method === 'GET' && urlPath === '/api/terminal/sessions') {
+          const list = terminalMgr.list();
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify(list));
+          return;
+        }
+        // DELETE /api/terminal/sessions/:id
+        if (method === 'DELETE' && urlPath.startsWith('/api/terminal/sessions/')) {
+          const id = urlPath.slice('/api/terminal/sessions/'.length);
+          terminalMgr.kill(id);
+          terminalAudit.record({
+            action: 'session.kill',
+            tenantId: 'local',
+            sessionId: id,
+            detail: 'http delete',
+            at: new Date().toISOString(),
+          });
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true }));
+          return;
+        }
+        // Unknown terminal route
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Not found' }));
+        return;
+      }
+
+      // ─── Localhost-only terminal token injection into index.html ─
+      if (terminalToken && resolvedStaticDir && method === 'GET' &&
+          (urlPath === '/' || urlPath === '/index.html')) {
+        const remoteAddr = req.socket.remoteAddress ?? '';
+        const isLocalhost = remoteAddr === '127.0.0.1' || remoteAddr === '::1' ||
+                            remoteAddr === '::ffff:127.0.0.1';
+        if (isLocalhost) {
+          const indexPath = join(resolvedStaticDir, 'index.html');
+          if (existsSync(indexPath)) {
+            try {
+              let html = readFileSync(indexPath, 'utf-8');
+              const inject = `<script>window.__DECKENT_TERMINAL_TOKEN__ = ${JSON.stringify(terminalToken)};</script>`;
+              html = html.replace('</head>', inject + '</head>');
+              res.writeHead(200, { 'Content-Type': 'text/html' });
+              res.end(html);
+              return;
+            } catch { /* fall through to normal handling */ }
+          }
+        }
+      }
+
+      await handleRequest(req, res, projectRoot, dashPath, sseClients, resolvedStaticDir, initWatcher, finalToken, rateLimiter, authMiddleware);
+    })().catch((err: unknown) => {
       sendError(res, 500, err instanceof Error ? err.message : 'Internal server error');
     });
   });
 
+  // Attach WS gateway for live terminal sessions (spec §1c.2 — auth verified
+  // BEFORE bridge, independent of DECKENT_API_AUTH_DISABLED).
+  if (terminalMgr && terminalAuth && terminalAudit) {
+    attachTerminalGateway(server, {
+      manager: terminalMgr,
+      auth: terminalAuth,
+      audit: terminalAudit,
+    });
+    // Idle reaper — sweeps stale non-deckent sessions every 30s.
+    // unref() so the timer does not keep the event loop alive in tests.
+    terminalReaper = setInterval(() => {
+      terminalMgr?.reapIdle();
+    }, 30_000);
+    terminalReaper.unref?.();
+  }
+
   server.listen(listenPort, host);
 
   return {
     server,
+    terminalToken,
     close(): Promise<void> {
       watcher?.close();
+      if (terminalReaper) {
+        clearInterval(terminalReaper);
+        terminalReaper = undefined;
+      }
+      terminalMgr?.reapIdle();
       for (const client of sseClients) {
         client.end();
       }
diff --git a/src/api/terminal/audit.ts b/src/api/terminal/audit.ts
new file mode 100644
index 000000000..442f8835d
--- /dev/null
+++ b/src/api/terminal/audit.ts
@@ -0,0 +1,38 @@
+import type { AuditEvent } from './types.js';
+
+/**
+ * Minimal sink contract the audit recorder needs. MemoryStore satisfies this
+ * structurally; tests can substitute a fake. The shape is deliberately loose
+ * (`Record<string, unknown>`) — TerminalAudit owns the strict schema below.
+ */
+export interface AuditSink {
+  insert(entry: Record<string, unknown>): void;
+}
+
+/**
+ * Low-volume structured audit recorder for terminal lifecycle events.
+ *
+ * Security invariant (spec §1c.2): raw PTY output is NEVER routed through
+ * this class. Callers MUST construct an {@link AuditEvent} with a short,
+ * pre-redacted `detail` string. The recorder serializes only the structured
+ * fields (`action`, `sessionId`, `detail`, `at`) into `content` — nothing
+ * else is read from the event object and no stream/buffer is copied.
+ */
+export class TerminalAudit {
+  constructor(private readonly store: AuditSink) {}
+
+  record(ev: AuditEvent): void {
+    this.store.insert({
+      type: 'audit',
+      tenant_id: ev.tenantId,
+      title: `terminal:${ev.action}`,
+      content: JSON.stringify({
+        action: ev.action,
+        sessionId: ev.sessionId,
+        detail: ev.detail,
+        at: ev.at,
+      }),
+      decay_exempt: true,
+    });
+  }
+}
diff --git a/src/api/terminal/auth-provider.ts b/src/api/terminal/auth-provider.ts
new file mode 100644
index 000000000..7c72e5e68
--- /dev/null
+++ b/src/api/terminal/auth-provider.ts
@@ -0,0 +1,45 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+
+/**
+ * Pluggable auth for the embedded terminal WebSocket gateway.
+ *
+ * V1 ships a single implementation (LocalTokenAuthProvider). Future enterprise
+ * impls (OIDC, SSO, mTLS) plug in behind the same interface — see spec §1d.
+ */
+export interface AuthProvider {
+  /** @returns true iff the presented credential is valid. */
+  verify(presented: string | undefined): boolean;
+}
+
+function sha256(s: string): Buffer {
+  return createHash('sha256').update(s).digest();
+}
+
+/**
+ * Local single-token provider.
+ *
+ * Security invariant (spec §1c.2, aligns with Sprint-171 B-022 hardening):
+ * this provider DELIBERATELY ignores `DECKENT_API_AUTH_DISABLED`. The global
+ * read-only-dashboard dev bypass must never silently open a remote shell.
+ * A terminal session ALWAYS requires the correct token — even when the rest
+ * of the HTTP API has its bearer middleware disabled for local development.
+ *
+ * Comparison is constant-time via `timingSafeEqual` over fixed-length SHA-256
+ * digests, which also avoids a timing/length oracle on the raw token bytes.
+ */
+export class LocalTokenAuthProvider implements AuthProvider {
+  private readonly expected: Buffer;
+
+  constructor(token: string) {
+    if (!token) {
+      throw new Error('LocalTokenAuthProvider requires a non-empty token');
+    }
+    this.expected = sha256(token);
+  }
+
+  verify(presented: string | undefined): boolean {
+    if (!presented) return false;
+    const actual = sha256(presented);
+    return timingSafeEqual(actual, this.expected);
+  }
+}
diff --git a/src/api/terminal/session-backend.ts b/src/api/terminal/session-backend.ts
new file mode 100644
index 000000000..6fe70bea9
--- /dev/null
+++ b/src/api/terminal/session-backend.ts
@@ -0,0 +1,54 @@
+import * as pty from '@lydell/node-pty';
+
+export interface SpawnSpec {
+  file: string;
+  args: string[];
+  cwd: string;
+  env?: NodeJS.ProcessEnv;
+  cols?: number;
+  rows?: number;
+}
+
+export interface BackendHandle {
+  write(data: string): void;
+  resize(cols: number, rows: number): void;
+  kill(): void;
+}
+
+/** Pluggable execution backend. Future (#3): remote / k8s pod-exec impl. */
+export interface SessionBackend {
+  spawn(
+    spec: SpawnSpec,
+    onData: (data: string) => void,
+    onExit: (code: number) => void,
+  ): BackendHandle;
+}
+
+export class LocalPtyBackend implements SessionBackend {
+  spawn(
+    spec: SpawnSpec,
+    onData: (data: string) => void,
+    onExit: (code: number) => void,
+  ): BackendHandle {
+    const p = pty.spawn(spec.file, spec.args, {
+      name: 'xterm-color',
+      cols: spec.cols ?? 80,
+      rows: spec.rows ?? 24,
+      cwd: spec.cwd,
+      env: { ...process.env, ...spec.env },
+    });
+    p.onData((d) => onData(d));
+    p.onExit(({ exitCode }) => onExit(exitCode));
+    return {
+      write: (data) => p.write(data),
+      resize: (cols, rows) => p.resize(cols, rows),
+      kill: () => {
+        try {
+          p.kill();
+        } catch {
+          /* already dead */
+        }
+      },
+    };
+  }
+}
diff --git a/src/api/terminal/session-manager.ts b/src/api/terminal/session-manager.ts
new file mode 100644
index 000000000..39726516c
--- /dev/null
+++ b/src/api/terminal/session-manager.ts
@@ -0,0 +1,118 @@
+import { randomUUID } from 'node:crypto';
+import type { SessionBackend, BackendHandle, SpawnSpec } from './session-backend.js';
+import type { CreateSessionInput, SessionMeta, TenantId } from './types.js';
+
+interface ManagerOpts {
+  scrollbackBytes: number;
+  idleTimeoutMs: number;
+  maxSessions?: number;
+}
+
+interface Session {
+  meta: SessionMeta;
+  handle: BackendHandle;
+  ring: string;
+  lastActivity: number;
+  listeners: Set<(d: string) => void>;
+}
+
+type KindCmd = (i: CreateSessionInput) => Pick<SpawnSpec, 'file' | 'args'>;
+const SHELL_CMD: KindCmd = () => ({ file: process.env['SHELL'] ?? 'bash', args: [] });
+const KIND_CMD: Record<string, KindCmd> = {
+  ai: (i) => ({ file: i.tool ?? 'claude', args: [] }),
+  deckent: (i) => ({ file: 'deckent', args: i.args ?? [] }),
+  shell: SHELL_CMD,
+};
+
+export class PtySessionManager {
+  private readonly sessions = new Map<string, Session>();
+  constructor(private readonly backend: SessionBackend, private readonly opts: ManagerOpts) {}
+
+  create(input: CreateSessionInput): SessionMeta {
+    if (this.opts.maxSessions && this.sessions.size >= this.opts.maxSessions) {
+      throw new Error(`max sessions reached (${this.opts.maxSessions})`);
+    }
+    const id = randomUUID();
+    const tenantId: TenantId = input.tenantId ?? 'local';
+    const cmd = (KIND_CMD[input.kind] ?? SHELL_CMD)(input);
+    const meta: SessionMeta = {
+      id,
+      kind: input.kind,
+      tenantId,
+      createdAt: new Date().toISOString(),
+      status: 'running',
+    };
+    const sess: Session = {
+      meta,
+      ring: '',
+      lastActivity: Date.now(),
+      listeners: new Set(),
+      handle: {} as BackendHandle,
+    };
+    sess.handle = this.backend.spawn(
+      { file: cmd.file, args: cmd.args, cwd: input.cwd ?? process.cwd() },
+      (d) => {
+        sess.ring = (sess.ring + d).slice(-this.opts.scrollbackBytes);
+        sess.lastActivity = Date.now();
+        for (const l of sess.listeners) l(d);
+      },
+      (code) => {
+        sess.meta.status = 'exited';
+        sess.meta.exitCode = code;
+      },
+    );
+    this.sessions.set(id, sess);
+    return meta;
+  }
+
+  get(id: string): SessionMeta | undefined {
+    return this.sessions.get(id)?.meta;
+  }
+
+  list(): SessionMeta[] {
+    return [...this.sessions.values()].map((s) => s.meta);
+  }
+
+  replay(id: string): string {
+    return this.sessions.get(id)?.ring ?? '';
+  }
+
+  write(id: string, data: string): void {
+    const s = this.sessions.get(id);
+    if (!s) return;
+    s.lastActivity = Date.now();
+    s.handle.write(data);
+  }
+
+  resize(id: string, cols: number, rows: number): void {
+    this.sessions.get(id)?.handle.resize(cols, rows);
+  }
+
+  attach(id: string, listener: (d: string) => void): void {
+    this.sessions.get(id)?.listeners.add(listener);
+  }
+
+  detach(id: string, listener?: (d: string) => void): void {
+    const s = this.sessions.get(id);
+    if (!s) return;
+    if (listener) s.listeners.delete(listener);
+    else s.listeners.clear();
+    // detach NEVER kills (tmux-like)
+  }
+
+  kill(id: string): void {
+    const s = this.sessions.get(id);
+    if (!s) return;
+    s.handle.kill();
+    this.sessions.delete(id);
+  }
+
+  reapIdle(): void {
+    if (!this.opts.idleTimeoutMs) return;
+    const now = Date.now();
+    for (const [id, s] of this.sessions) {
+      if (s.meta.kind === 'deckent') continue;
+      if (now - s.lastActivity > this.opts.idleTimeoutMs) this.kill(id);
+    }
+  }
+}
diff --git a/src/api/terminal/types.ts b/src/api/terminal/types.ts
new file mode 100644
index 000000000..b313b1e40
--- /dev/null
+++ b/src/api/terminal/types.ts
@@ -0,0 +1,32 @@
+export type TenantId = string; // "local" today; future: real tenant id (#3 seam)
+export type SessionKind = 'ai' | 'deckent' | 'shell';
+export type AiTool = 'claude' | 'gemini' | 'codex';
+
+export interface CreateSessionInput {
+  kind: SessionKind;
+  tool?: AiTool;       // required when kind==='ai'
+  cwd?: string;
+  args?: string[];     // for kind==='deckent'
+  tenantId?: TenantId; // default 'local'
+}
+
+export interface SessionMeta {
+  id: string;
+  kind: SessionKind;
+  tenantId: TenantId;
+  createdAt: string;   // ISO 8601
+  status: 'running' | 'exited';
+  exitCode?: number;
+}
+
+export type AuditAction =
+  | 'session.create' | 'session.attach' | 'session.detach'
+  | 'session.kill' | 'session.exit' | 'auth.ok' | 'auth.deny';
+
+export interface AuditEvent {
+  action: AuditAction;
+  tenantId: TenantId;
+  sessionId?: string;
+  detail?: string;     // never raw PTY output — short structured note only
+  at: string;          // ISO 8601
+}
diff --git a/src/api/terminal/ws-gateway.ts b/src/api/terminal/ws-gateway.ts
new file mode 100644
index 000000000..ef11db9bb
--- /dev/null
+++ b/src/api/terminal/ws-gateway.ts
@@ -0,0 +1,128 @@
+import type { Server, IncomingMessage } from 'node:http';
+import type { Socket } from 'node:net';
+import { WebSocketServer, type WebSocket } from 'ws';
+import type { PtySessionManager } from './session-manager.js';
+import type { AuthProvider } from './auth-provider.js';
+import type { AuditEvent } from './types.js';
+
+export interface GatewayDeps {
+  manager: PtySessionManager;
+  auth: AuthProvider;
+  audit: { record(ev: AuditEvent): void };
+}
+
+const PREFIX = 'deckent.';
+const PATH = '/api/terminal/ws';
+const BACKPRESSURE_LIMIT_BYTES = 1_000_000;
+const APP_CLOSE_UNAUTHORIZED = 4401;
+
+/**
+ * Attaches the terminal WS gateway. Token is read from `Sec-WebSocket-Protocol`
+ * (browsers cannot set Authorization on WebSocket — spec §1c.2). Auth is verified
+ * BEFORE any session bridge, independent of DECKENT_API_AUTH_DISABLED.
+ */
+export function attachTerminalGateway(server: Server, deps: GatewayDeps): void {
+  const wss = new WebSocketServer({
+    noServer: true,
+    handleProtocols: (set: Set<string>): string | false => {
+      for (const p of set) if (p.startsWith(PREFIX)) return p;
+      return false;
+    },
+  });
+
+  server.on('upgrade', (req: IncomingMessage, socket: Socket, head: Buffer) => {
+    const url = req.url ?? '';
+    if (!url.startsWith(PATH)) return;
+
+    const header = req.headers['sec-websocket-protocol'];
+    const protos = (Array.isArray(header) ? header.join(',') : header ?? '')
+      .split(',')
+      .map((s) => s.trim())
+      .filter((s) => s.length > 0);
+    const tokenProto = protos.find((p) => p.startsWith(PREFIX));
+    const token = tokenProto ? tokenProto.slice(PREFIX.length) : undefined;
+
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      if (!deps.auth.verify(token)) {
+        deps.audit.record({
+          action: 'auth.deny',
+          tenantId: 'local',
+          detail: 'ws upgrade rejected',
+          at: new Date().toISOString(),
+        });
+        ws.close(APP_CLOSE_UNAUTHORIZED, 'unauthorized');
+        return;
+      }
+      deps.audit.record({
+        action: 'auth.ok',
+        tenantId: 'local',
+        detail: 'ws upgrade accepted',
+        at: new Date().toISOString(),
+      });
+      bridge(ws, deps);
+    });
+  });
+}
+
+interface ClientMessage {
+  t: string;
+  sessionId?: string;
+  data?: string;
+  cols?: number;
+  rows?: number;
+}
+
+function bridge(ws: WebSocket, deps: GatewayDeps): void {
+  let sessionId: string | null = null;
+  const onData = (d: string): void => {
+    if (ws.bufferedAmount > BACKPRESSURE_LIMIT_BYTES) return;
+    ws.send(JSON.stringify({ t: 'output', data: d }));
+  };
+
+  ws.on('message', (raw) => {
+    let msg: ClientMessage;
+    try {
+      msg = JSON.parse(raw.toString()) as ClientMessage;
+    } catch {
+      return;
+    }
+    if (msg.t === 'attach' && typeof msg.sessionId === 'string') {
+      if (sessionId) deps.manager.detach(sessionId, onData);
+      sessionId = msg.sessionId;
+      const replayBuf = deps.manager.replay(sessionId);
+      if (replayBuf.length > 0) {
+        ws.send(JSON.stringify({ t: 'output', data: replayBuf }));
+      }
+      deps.manager.attach(sessionId, onData);
+      deps.audit.record({
+        action: 'session.attach',
+        tenantId: 'local',
+        sessionId,
+        detail: '',
+        at: new Date().toISOString(),
+      });
+    } else if (msg.t === 'input' && sessionId && typeof msg.data === 'string') {
+      deps.manager.write(sessionId, msg.data);
+    } else if (
+      msg.t === 'resize' &&
+      sessionId &&
+      typeof msg.cols === 'number' &&
+      typeof msg.rows === 'number'
+    ) {
+      deps.manager.resize(sessionId, msg.cols, msg.rows);
+    }
+  });
+
+  ws.on('close', () => {
+    if (sessionId) {
+      deps.manager.detach(sessionId, onData); // detach ≠ kill (tmux-like)
+      deps.audit.record({
+        action: 'session.detach',
+        tenantId: 'local',
+        sessionId,
+        detail: '',
+        at: new Date().toISOString(),
+      });
+    }
+  });
+}
diff --git a/src/cli/commands/doctor-format.ts b/src/cli/commands/doctor-format.ts
index 4f66ddf0c..0d6b90fbd 100644
--- a/src/cli/commands/doctor-format.ts
+++ b/src/cli/commands/doctor-format.ts
@@ -10,6 +10,7 @@ import type { HealthCheckResult } from '../../orchestra/connector.js';
 import type { CIBaseline, CIReport } from '../helpers/output.js';
 import { formatCIHealthSection } from '../helpers/output.js';
 import { detectEnvironment } from '../../core/environment.js';
+import { planInstall } from '../../core/provisioner.js';
 import { loadDeckSecrets, validateDeckFile, KNOWN_DECK_KEYS } from '../../core/deck-file.js';
 
 // ─── Types ──────────────────────────────────────────────────────────
@@ -67,12 +68,10 @@ export function getReadinessLabel(result: DoctorResult, brainLines: number, brai
 }
 
 export function getProviderInstallHint(name: string): string {
-  switch (name) {
-    case 'claude': return 'install: npm i -g @anthropic-ai/claude-code';
-    case 'codex': return 'install: npm i -g @openai/codex';
-    case 'gemini': return 'install: npm i -g @google/gemini-cli';
-    default: return '';
-  }
+  // Single source of truth: package mapping lives in provisioner.planInstall.
+  if (name !== 'claude' && name !== 'codex' && name !== 'gemini') return '';
+  const pkg = planInstall(name).args[2];
+  return `install: npm i -g ${pkg}`;
 }
 
 export function getProviderTips(providers: DetectedProvider[]): string[] {
diff --git a/src/cli/commands/doctor.ts b/src/cli/commands/doctor.ts
index 0bec2279a..846de2637 100644
--- a/src/cli/commands/doctor.ts
+++ b/src/cli/commands/doctor.ts
@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { platform } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import type { Command } from 'commander';
+import { planInstall } from '../../core/provisioner.js';
 import type { DoctorResult, SystemProfile } from '../../core/types.js';
 import type { DetectedProvider } from '../../core/provider.js';
 import type { HealthCheckResult } from '../../orchestra/connector.js';
@@ -408,12 +409,10 @@ export function getReadinessLabel(result: DoctorResult, brainLines: number, brai
  * Returns an install command suggestion string, or empty string if unknown.
  */
 export function getProviderInstallHint(name: string): string {
-  switch (name) {
-    case 'claude': return 'install: npm i -g @anthropic-ai/claude-code';
-    case 'codex': return 'install: npm i -g @openai/codex';
-    case 'gemini': return 'install: npm i -g @google/gemini-cli';
-    default: return '';
-  }
+  // Single source of truth: package mapping lives in provisioner.planInstall.
+  if (name !== 'claude' && name !== 'codex' && name !== 'gemini') return '';
+  const pkg = planInstall(name).args[2];
+  return `install: npm i -g ${pkg}`;
 }
 
 /**
diff --git a/src/cli/commands/init.ts b/src/cli/commands/init.ts
index 8c6feb9b9..92cd8886a 100644
--- a/src/cli/commands/init.ts
+++ b/src/cli/commands/init.ts
@@ -22,7 +22,13 @@ import { detectEnvironment } from '../../core/environment.js';
 import { detectFullStack } from '../../core/stack-detector.js';
 import type { FullStackResult } from '../../core/stack-detector.js';
 import { DECKENT_VERSION } from '../../core/constants.js';
-import { promptText, promptSelect } from '../helpers/prompt.js';
+import { promptText, promptSelect, promptConfirm } from '../helpers/prompt.js';
+import {
+  provisionMissing,
+  resolveProvisionMode,
+  collectMissingTools,
+  planInstall,
+} from '../../core/provisioner.js';
 import { print, printError } from '../helpers/output.js';
 import { getMessage } from '../helpers/messages.js';
 import { resolveProjectRoot } from '../helpers/process.js';
@@ -122,7 +128,9 @@ export function registerInit(program: Command): void {
     .option('--upgrade', 'Update existing files while preserving user customizations (merge strategy)')
     .option('--force', 'Force overwrite of existing env files without warning')
     .option('--repair', 'Show which init steps failed and how to fix them')
-    .action(async (options: { auto?: boolean; manual?: boolean; cursor?: boolean; claudeCode?: boolean; env?: string; allEnvs?: boolean; upgrade?: boolean; force?: boolean; repair?: boolean }) => {
+    .option('-y, --yes', 'Install all missing prerequisites without prompting (CI)')
+    .option('--no-install', 'Detect missing prerequisites but never install them (legacy hint-only)')
+    .action(async (options: { auto?: boolean; manual?: boolean; cursor?: boolean; claudeCode?: boolean; env?: string; allEnvs?: boolean; upgrade?: boolean; force?: boolean; repair?: boolean; yes?: boolean; install?: boolean }) => {
       const root = resolveProjectRoot();
       const failedSteps: Array<{ step: string; error: string }> = [];
 
@@ -292,12 +300,36 @@ export function registerInit(program: Command): void {
 
         writeProviderConfig(root, mode, language, projectName, providerConfig);
 
-        // 7e. Run deckent doctor
+        // 7e. Run deckent doctor + consent-based provisioning of missing tools
         try {
           const doctorResult = runDoctorChecks(root);
-          if (!doctorResult.ok) {
-            const failedChecks = doctorResult.checks.filter(c => c.required && !c.passed);
-            print(`\n  Health check: ${failedChecks.length} issue(s) found — run 'deckent doctor' for details`);
+          const missing = collectMissingTools(providers, doctorResult.checks);
+          if (missing.length > 0) {
+            const mode = resolveProvisionMode({ yes: options.yes, noInstall: options.install === false });
+            if (mode === 'no-install') {
+              print(`\n  Missing prerequisites: ${missing.join(', ')} — run 'deckent doctor' for install hints`);
+            } else {
+              print(`\n  Missing prerequisites detected: ${missing.join(', ')}`);
+              const provisionResults = await provisionMissing({
+                missing,
+                mode,
+                confirm: async (tool, instruction) =>
+                  promptConfirm(`  Install ${tool}? (${instruction})`, false),
+                log: print,
+              });
+              for (const r of provisionResults) {
+                if (r.status === 'installed') print(`  ✓ ${r.tool} installed`);
+                else if (r.status === 'failed') print(`  ✗ ${r.tool} install failed: ${r.error}`);
+                else if (r.reason === 'manual') print(`  → ${r.tool}: ${planInstall(r.tool).instruction}`);
+                else print(`  • ${r.tool} skipped`);
+              }
+            }
+          }
+          // Re-verify after provisioning
+          const finalDoctor = runDoctorChecks(root);
+          if (!finalDoctor.ok) {
+            const failedChecks = finalDoctor.checks.filter(c => c.required && !c.passed);
+            print(`\n  Health check: ${failedChecks.length} issue(s) remaining — run 'deckent doctor' for details`);
           }
         } catch { /* doctor failure is non-fatal */ }
 
diff --git a/src/cli/commands/serve.ts b/src/cli/commands/serve.ts
index 2246e13e3..0f80e0c3e 100644
--- a/src/cli/commands/serve.ts
+++ b/src/cli/commands/serve.ts
@@ -1,9 +1,10 @@
 import type { Command } from 'commander';
 import { existsSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
 import { createHttpServer } from '../../api/server.js';
+import { LocalPtyBackend } from '../../api/terminal/session-backend.js';
 import { resolveProjectRoot } from '../helpers/process.js';
 import { print, printError } from '../helpers/output.js';
+import { getDashboardStaticDir } from '../helpers/dashboard-dir.js';
 
 /** Extended MIME types for static file serving (superset of server.ts defaults) */
 export const EXTENDED_MIME_TYPES: Record<string, string> = {
@@ -49,6 +50,8 @@ interface ServeOpts {
   port?: string;
   dev?: boolean;
   devPort?: string;
+  host?: string;
+  terminal?: boolean;
 }
 
 export function registerServe(program: Command): void {
@@ -58,6 +61,8 @@ export function registerServe(program: Command): void {
     .option('--port <number>', 'Port to listen on', '3100')
     .option('--dev', 'Enable dev proxy mode — expects Vite dev server on --dev-port')
     .option('--dev-port <number>', 'Vite dev server port for --dev proxy mode', '5173')
+    .option('--host <addr>', 'Bind address for the server', '127.0.0.1')
+    .option('--no-terminal', 'Disable the embedded web terminal')
     .action((opts: ServeOpts) => {
       const root = resolveProjectRoot();
       const port = parseInt(opts.port ?? '3100', 10);
@@ -68,18 +73,32 @@ export function registerServe(program: Command): void {
         return;
       }
 
-      // Build check: warn if dashboard dist/ is missing or empty
-      if (!opts.dev) {
-        const staticDir = join(root, 'src', 'dashboard', 'dist');
+      // Non-localhost host: disable terminal and warn (spec §5)
+      const host = opts.host ?? '127.0.0.1';
+      const isLocalhost = host === '127.0.0.1' || host === '::1' || host === 'localhost';
+      const terminalEnabled = opts.terminal !== false && isLocalhost;
+      if (!isLocalhost && opts.terminal !== false) {
+        process.stderr.write('Warning: terminal disabled — non-localhost host requires explicit --no-terminal\n');
+      }
+
+      // Instantiate the local PTY backend when the terminal is enabled. This
+      // wires the embedded web terminal subsystem in server.ts (token mint,
+      // bootstrap inject, ws gateway, HTTP control routes). Without it, the
+      // server boots in API-only mode and the terminal panel cannot connect.
+      const terminalBackend = terminalEnabled ? new LocalPtyBackend() : undefined;
+
+      // Build check: warn if the bundled dashboard is missing or empty
+      const staticDir = opts.dev ? undefined : getDashboardStaticDir();
+      if (!opts.dev && staticDir) {
         const distCheck = checkDistDirectory(staticDir);
         if (!distCheck.exists) {
-          print(`Warning: Static directory not found: ${staticDir}`);
+          print(`Warning: Bundled dashboard not found: ${staticDir}`);
           print('Run the dashboard build before serving: npm run build:dashboard');
           print('Or use --dev flag to proxy a Vite dev server.');
           print('API endpoints will still work without static files.');
           print('');
         } else if (!distCheck.hasContent) {
-          print(`Warning: Static directory is empty: ${staticDir}`);
+          print(`Warning: Bundled dashboard is empty: ${staticDir}`);
           print('Run the dashboard build: npm run build:dashboard');
           print('');
         }
@@ -93,9 +112,19 @@ export function registerServe(program: Command): void {
         print('');
       }
 
-      const api = createHttpServer(root, port);
+      const api = createHttpServer(root, {
+        port,
+        staticDir,
+        host,
+        terminalBackend,
+      });
 
-      print(`Deckent API server listening on http://localhost:${port}`);
+      print(`Deckent API server listening on http://${host}:${port}`);
+      if (terminalEnabled && api.terminalToken) {
+        print(`Embedded terminal enabled (token auto-injected for localhost callers)`);
+      } else if (!terminalEnabled) {
+        print('Embedded terminal disabled');
+      }
 
       const cleanup = (): void => {
         api.close().then(() => {
diff --git a/src/cli/commands/web.ts b/src/cli/commands/web.ts
index c08142220..62c8e8d1c 100644
--- a/src/cli/commands/web.ts
+++ b/src/cli/commands/web.ts
@@ -1,8 +1,9 @@
-import { join, extname } from 'node:path';
+import { extname } from 'node:path';
 import type { Command } from 'commander';
 import { createHttpServer } from '../../api/server.js';
 import { resolveProjectRoot } from '../helpers/process.js';
 import { print } from '../helpers/output.js';
+import { getDashboardStaticDir, dashboardIsBuilt } from '../helpers/dashboard-dir.js';
 
 interface WebOpts {
   port?: string;
@@ -35,7 +36,11 @@ export function registerWeb(program: Command): void {
         print("Run 'cd src/dashboard && npm run dev' for Vite dev server on port 5173");
       }
 
-      const staticDir = opts.dev ? undefined : join(root, 'src', 'dashboard', 'dist');
+      const staticDir = opts.dev ? undefined : getDashboardStaticDir();
+      if (staticDir && !dashboardIsBuilt(staticDir)) {
+        print(`Warning: bundled dashboard not found at ${staticDir}`);
+        print("Run 'npm run build:dashboard' (repo) or reinstall deckent. API still works.");
+      }
       const api = createHttpServer(root, port, staticDir);
 
       print(`Deckent Web Dashboard on http://localhost:${port}`);
diff --git a/src/cli/entry.ts b/src/cli/entry.ts
index af61d8e66..bcf43c332 100644
--- a/src/cli/entry.ts
+++ b/src/cli/entry.ts
@@ -7,9 +7,9 @@ import { killAllSessions } from '../orchestra/tmux.js';
 
 // ─── Node Version Guard ─────────────────────────────────────────────────────
 const [major] = process.versions.node.split('.').map(Number);
-if ((major ?? 0) < 18) {
+if ((major ?? 0) < 24) {
   process.stderr.write(
-    `deckent requires Node.js >= 18. Current version: ${process.versions.node}\n`,
+    `deckent requires Node.js >= 24 (Active LTS). Current version: ${process.versions.node}\n`,
   );
   process.exit(1);
 }
diff --git a/src/cli/helpers/dashboard-dir.ts b/src/cli/helpers/dashboard-dir.ts
new file mode 100644
index 000000000..c9354966b
--- /dev/null
+++ b/src/cli/helpers/dashboard-dir.ts
@@ -0,0 +1,30 @@
+// ─── Dashboard static dir resolver ───────────────────────────────────────
+// The web dashboard is built to <pkg>/dist/dashboard
+// (`vite build --outDir ../../dist/dashboard`). At runtime this helper lives
+// at <pkg>/dist/cli/helpers/dashboard-dir.js, so it resolves the dashboard
+// relative to ITS OWN module URL — correct both in-repo and in an installed
+// npm package, where the user's project root is NOT the deckent package dir.
+// (Previous bug: web.ts/serve.ts used join(projectRoot, 'src/dashboard/dist').)
+
+import { fileURLToPath } from 'node:url';
+import { existsSync, readdirSync } from 'node:fs';
+
+/** Pure: given a module URL at dist/cli/helpers/, return the package's
+ *  dist/dashboard absolute path. */
+export function dashboardDirFromModuleUrl(moduleUrl: string): string {
+  return fileURLToPath(new URL('../../dashboard', moduleUrl));
+}
+
+/** Resolve the bundled dashboard static dir for the running deckent install. */
+export function getDashboardStaticDir(): string {
+  return dashboardDirFromModuleUrl(import.meta.url);
+}
+
+/** True when the bundled dashboard exists and has content (was built/shipped). */
+export function dashboardIsBuilt(dir: string = getDashboardStaticDir()): boolean {
+  try {
+    return existsSync(dir) && readdirSync(dir).length > 0;
+  } catch {
+    return false;
+  }
+}
diff --git a/src/core/config-types.ts b/src/core/config-types.ts
index 03ce49078..ba18e258a 100644
--- a/src/core/config-types.ts
+++ b/src/core/config-types.ts
@@ -31,6 +31,21 @@ export interface TimeoutConfig {
   runtime_extension_enabled: boolean;
 }
 
+// ─── Terminal Configuration ─────────────────────────────────────────
+export interface TerminalConfig {
+  enabled: boolean;
+  /** Bind address for the terminal WS. Default 127.0.0.1. */
+  bind: string;
+  /** Max concurrent PTY sessions. */
+  maxSessions: number;
+  /** Idle reaper timeout (ms) for shell/ai kinds; deckent kind exempt. */
+  idleTimeoutMs: number;
+  /** Per-session in-memory scrollback ring buffer size (bytes). */
+  scrollbackBytes: number;
+  /** Whether the plain `shell` session kind is allowed. */
+  allowShellKind: boolean;
+}
+
 // ─── Configuration (Blueprint 13) ───────────────────────────────────
 export interface PlanModeConfig {
   max_workers: number | 'auto';
@@ -309,6 +324,10 @@ export interface DeckentConfig {
   // ─── Runtime Style ─────────────────────────────────────────────────
   /** Active runtime style — sprint (developer orchestration) or task (one-shot life assistant) */
   deckent_style?: 'sprint' | 'task';
+
+  // ─── Terminal ──────────────────────────────────────────────────────
+  /** Embedded web terminal configuration (Sprint 175). */
+  terminal?: TerminalConfig;
 }
 
 // ─── Nervous System Config Types ────────────────────────────────────
@@ -500,6 +519,12 @@ export interface ResolvedConfig {
   observability?: DeckentConfig['observability'];
   /** Resolved runtime style — always 'sprint' or 'task' */
   deckent_style: 'sprint' | 'task';
+  /** Resolved embedded web terminal configuration. Mirrors the `model_strategy`
+   * optional-on-both-sides pattern: optional on the type, runtime-populated by
+   * `loadConfig`/`mergeConfigs` (DEFAULT_TERMINAL_CONFIG) so consumers can rely
+   * on it being present without forcing every ResolvedConfig literal to spell
+   * it out. Sprint 175. */
+  terminal?: TerminalConfig;
 }
 
 // ─── Config Metadata ──────────────────────────────────────────────
diff --git a/src/core/config.ts b/src/core/config.ts
index bde2ec725..35be38093 100644
--- a/src/core/config.ts
+++ b/src/core/config.ts
@@ -18,6 +18,7 @@ import type {
   PlanModeConfig,
   ResolvedConfig,
   SystemProfile,
+  TerminalConfig,
   TimeoutConfig,
 } from './types.js';
 import { ALL_MODELS, PROVIDER_MODEL_MAP } from './types.js';
@@ -64,6 +65,19 @@ export const DEFAULT_AUTO_DOCS: AutoDocsConfig = {
   tier3: false,
 };
 
+// ─── Default Terminal Config ────────────────────────────────────────
+// Single source of truth for embedded web terminal defaults (Sprint 175).
+// Mirrors the DEFAULT_TIMEOUT_CONFIG / DEFAULT_AUTO_DOCS pattern: one named
+// const, structuredClone()'d at each use-site to keep instances independent.
+export const DEFAULT_TERMINAL_CONFIG: TerminalConfig = {
+  enabled: true,
+  bind: '127.0.0.1',
+  maxSessions: 10,
+  idleTimeoutMs: 1_800_000,
+  scrollbackBytes: 262_144,
+  allowShellKind: true,
+};
+
 // ─── Mode Aliases ────────────────────────────────────────────────────
 
 /**
@@ -618,6 +632,8 @@ export function createDefaultConfig(): DeckentConfig {
     },
     // Runtime Style
     deckent_style: 'sprint',
+    // Terminal (Sprint 175 — embedded web terminal)
+    terminal: structuredClone(DEFAULT_TERMINAL_CONFIG),
     // Nervous System (disabled by default — Sprint 148 will activate)
     nervous_system: {
       enabled: false,
@@ -893,6 +909,11 @@ export async function loadConfig(projectRoot?: string, options?: { force?: boole
     nervous_system: config.nervous_system,
     // Runtime Style
     deckent_style: config.deckent_style ?? 'sprint',
+    // Terminal (Sprint 175) — deepMerge'd `config` already carries defaults from
+    // createDefaultConfig(); fallback is defensive for hot-reload scenarios.
+    terminal: config.terminal
+      ? deepMerge(DEFAULT_TERMINAL_CONFIG, config.terminal as Partial<TerminalConfig>)
+      : structuredClone(DEFAULT_TERMINAL_CONFIG),
   };
 
   // ─── $DECK: interpolation ────────────────────────────────────────────
@@ -1398,6 +1419,12 @@ export function mergeConfigs(
     // Sprint 156: default true unless overridden by user/project config
     dependency_pipeline_enabled:
       (config as DeckentConfigWithPipeline).dependency_pipeline_enabled ?? true,
+    // Terminal (Sprint 175) — deepMerge applies any partial project override on
+    // top of DEFAULT_TERMINAL_CONFIG so unspecified keys inherit defaults,
+    // mirroring the model_strategy nested-merge pattern.
+    terminal: config.terminal
+      ? deepMerge(DEFAULT_TERMINAL_CONFIG, config.terminal as Partial<TerminalConfig>)
+      : structuredClone(DEFAULT_TERMINAL_CONFIG),
   };
 }
 
diff --git a/src/core/memory-store.ts b/src/core/memory-store.ts
index 1195292a2..707ff5b26 100644
--- a/src/core/memory-store.ts
+++ b/src/core/memory-store.ts
@@ -43,6 +43,7 @@ interface EntryRow {
   lang: string;
   decay_exempt: number;
   metadata: string;
+  tenant_id: string | null;
   created_at: string;
   updated_at: string;
   deleted_at: string | null;
@@ -68,6 +69,7 @@ function rowToEntry(row: EntryRow): MemoryEntryV2 {
     lang: row.lang,
     decay_exempt: row.decay_exempt === 1,
     metadata: row.metadata,
+    tenant_id: row.tenant_id ?? null,
     created_at: row.created_at,
     updated_at: row.updated_at,
     deleted_at: row.deleted_at,
@@ -114,6 +116,7 @@ export class MemoryStore {
         lang TEXT NOT NULL DEFAULT 'en',
         decay_exempt INTEGER NOT NULL DEFAULT 0,
         metadata TEXT NOT NULL DEFAULT '{}',
+        tenant_id TEXT,
         created_at TEXT NOT NULL DEFAULT (datetime('now')),
         updated_at TEXT NOT NULL DEFAULT (datetime('now')),
         deleted_at TEXT
@@ -146,6 +149,11 @@ export class MemoryStore {
       );
     `);
 
+    // Additive, non-destructive migrations for existing DBs (DROP/rebuild forbidden).
+    // Each migration is column-existence-guarded via PRAGMA so re-opening a DB
+    // is idempotent and never raises "duplicate column" errors.
+    this.applyAdditiveMigrations();
+
     // Indexes
     this.db.exec(`
       CREATE INDEX IF NOT EXISTS idx_entries_type ON entries(type);
@@ -174,6 +182,22 @@ export class MemoryStore {
     this.recordSchemaVersion();
   }
 
+  /**
+   * Idempotent ALTER TABLE migrations for `entries`. Adds columns introduced
+   * after the initial schema without rebuilding the table. PRAGMA-guarded so
+   * repeated calls (re-opening the same DB file) are no-ops.
+   *
+   * Invariant: NEVER DROP or rebuild — historical rows must survive.
+   */
+  private applyAdditiveMigrations(): void {
+    const cols = this.db.prepare(`PRAGMA table_info(entries)`).all() as Array<{ name: string }>;
+    const have = new Set(cols.map(c => c.name));
+
+    if (!have.has('tenant_id')) {
+      this.db.exec(`ALTER TABLE entries ADD COLUMN tenant_id TEXT`);
+    }
+  }
+
   private createIndexIfNotExists(name: string, ddl: string): void {
     const exists = this.db.prepare(
       `SELECT 1 FROM sqlite_master WHERE type='index' AND name=?`,
@@ -272,6 +296,7 @@ export class MemoryStore {
     const lang = input.lang ?? 'en';
     const decayExempt = input.decay_exempt ? 1 : 0;
     const metadata = JSON.stringify(input.metadata ?? {});
+    const tenantId = input.tenant_id ?? null;
     const relations = input.relations ?? [];
 
     const tagText = tags.join(' ');
@@ -285,12 +310,12 @@ export class MemoryStore {
         id, type, source, title, content, summary,
         tag_text, title_norm, content_norm, summary_norm, tag_norm,
         status, priority, sprint_id, sprint_num, lang,
-        decay_exempt, metadata
+        decay_exempt, metadata, tenant_id
       ) VALUES (
         @id, @type, @source, @title, @content, @summary,
         @tag_text, @title_norm, @content_norm, @summary_norm, @tag_norm,
         @status, @priority, @sprint_id, @sprint_num, @lang,
-        @decay_exempt, @metadata
+        @decay_exempt, @metadata, @tenant_id
       )
     `);
 
@@ -327,6 +352,7 @@ export class MemoryStore {
         lang,
         decay_exempt: decayExempt,
         metadata,
+        tenant_id: tenantId,
       });
 
       for (const tag of tags) {
@@ -374,6 +400,7 @@ export class MemoryStore {
     const lang = input.lang ?? 'en';
     const decayExempt = input.decay_exempt ? 1 : 0;
     const metadata = JSON.stringify(input.metadata ?? {});
+    const tenantId = input.tenant_id ?? null;
 
     const tagText = tags.join(' ');
     const titleNorm = turkishNormalize(input.title);
@@ -398,6 +425,7 @@ export class MemoryStore {
       ['lang', existing.lang, lang],
       ['decay_exempt', existing.decay_exempt, decayExempt],
       ['metadata', existing.metadata, metadata],
+      ['tenant_id', existing.tenant_id, tenantId],
     ];
 
     for (const [field, oldVal, newVal] of fieldMap) {
@@ -427,6 +455,7 @@ export class MemoryStore {
         lang = @lang,
         decay_exempt = @decay_exempt,
         metadata = @metadata,
+        tenant_id = @tenant_id,
         updated_at = datetime('now')
       WHERE id = @id
     `);
@@ -458,6 +487,7 @@ export class MemoryStore {
         lang,
         decay_exempt: decayExempt,
         metadata,
+        tenant_id: tenantId,
       });
 
       // Replace tags
diff --git a/src/core/memory-types.ts b/src/core/memory-types.ts
index d8297ba5e..fe8e37e3a 100644
--- a/src/core/memory-types.ts
+++ b/src/core/memory-types.ts
@@ -17,6 +17,7 @@ export type EntryType =
   | 'retro'
   | 'error'
   | 'identity'
+  | 'audit'
   | 'custom';
 
 /** Who created this entry. */
@@ -77,6 +78,8 @@ export interface MemoryEntryV2 {
   lang: string;
   decay_exempt: boolean;
   metadata: string;
+  /** Multi-tenant scope tag. NULL for legacy/single-tenant entries (default). */
+  tenant_id?: string | null;
   created_at: string;
   updated_at: string;
   deleted_at: string | null;
@@ -98,6 +101,8 @@ export interface CreateEntryInput {
   lang?: string;
   decay_exempt?: boolean;
   metadata?: Record<string, unknown>;
+  /** Multi-tenant scope tag (omit for single-tenant default). */
+  tenant_id?: string;
   relations?: Array<{ to_id: string; rel_type: RelationType }>;
 }
 
diff --git a/src/core/provisioner.ts b/src/core/provisioner.ts
new file mode 100644
index 000000000..235c7b3a9
--- /dev/null
+++ b/src/core/provisioner.ts
@@ -0,0 +1,229 @@
+// ─── Provisioner — consent-based, OS-aware tool installer ────────────────
+// Closes the blueprint §3.4 gap: `deckent init`/`doctor` previously only
+// *detected* missing prerequisites and printed hints. This module turns a
+// detected gap into an actionable, consent-gated install.
+//
+// Security (companion to ADR-006 spawnSync pattern + spawn-safety.ts):
+//   - Only npm-global installs are auto-executed, with array args and
+//     shell:false (shell:true ONLY on win32 where npm resolves via a .cmd
+//     wrapper, mirroring provider.ts:detectCliVersion).
+//   - OS-package (tmux) and runtime (node) / docker installs are NEVER
+//     auto-executed: they require sudo / privileged context, so they are
+//     surfaced as an instruction string the user runs explicitly.
+//   - The executable is checked against PROVISIONER_BIN_WHITELIST before
+//     spawn — `sh`/`bash` are intentionally absent (no shell interpolation).
+
+import { spawnSync } from 'node:child_process';
+
+export type ToolId = 'claude' | 'codex' | 'gemini' | 'tmux' | 'node' | 'docker';
+export type LinuxPkgManager = 'apt' | 'dnf' | 'pacman';
+export type InstallMethod = 'npm-global' | 'os-package' | 'manual';
+
+export interface InstallPlan {
+  tool: ToolId;
+  method: InstallMethod;
+  /** Binary to execute (npm-global only). For os-package/manual this is the
+   *  suggested command but it is never auto-spawned. */
+  command: string;
+  args: string[];
+  /** Human-facing instruction — shown as the consent hint and used verbatim
+   *  for os-package/manual methods the user must run themselves. */
+  instruction: string;
+}
+
+export interface PlanOptions {
+  platform?: NodeJS.Platform;
+  linuxPkgManager?: LinuxPkgManager;
+}
+
+export type SpawnResult = { status: number | null; stdout?: string; stderr?: string };
+export type SpawnFn = (
+  command: string,
+  args: string[],
+  opts: { shell: boolean; stdio?: unknown; timeout?: number; encoding?: string },
+) => SpawnResult;
+
+export interface InstallOptions extends PlanOptions {
+  consent: boolean;
+  spawn?: SpawnFn;
+  log?: (msg: string) => void;
+}
+
+export type InstallResult =
+  | { tool: ToolId; status: 'installed' }
+  | { tool: ToolId; status: 'skipped'; reason: 'no-consent' | 'manual' }
+  | { tool: ToolId; status: 'failed'; error: string };
+
+/** Binaries the provisioner is permitted to spawn. Frozen; shell-free. */
+export const PROVISIONER_BIN_WHITELIST: readonly string[] = Object.freeze(['npm']);
+
+const NPM_PKG: Record<'claude' | 'codex' | 'gemini', string> = {
+  claude: '@anthropic-ai/claude-code',
+  codex: '@openai/codex',
+  gemini: '@google/gemini-cli',
+};
+
+function tmuxInstruction(opts: PlanOptions): string {
+  const platform = opts.platform ?? process.platform;
+  if (platform === 'darwin') return 'brew install tmux';
+  if (platform === 'linux') {
+    switch (opts.linuxPkgManager) {
+      case 'dnf': return 'sudo dnf install -y tmux';
+      case 'pacman': return 'sudo pacman -S --noconfirm tmux';
+      case 'apt':
+      default: return 'sudo apt-get install -y tmux';
+    }
+  }
+  return 'Install tmux for your platform (see https://github.com/tmux/tmux/wiki/Installing)';
+}
+
+export function planInstall(tool: ToolId, opts: PlanOptions = {}): InstallPlan {
+  if (tool === 'claude' || tool === 'codex' || tool === 'gemini') {
+    const pkg = NPM_PKG[tool];
+    return {
+      tool,
+      method: 'npm-global',
+      command: 'npm',
+      args: ['install', '-g', pkg],
+      instruction: `npm install -g ${pkg}`,
+    };
+  }
+  if (tool === 'tmux') {
+    const instruction = tmuxInstruction(opts);
+    return { tool, method: 'os-package', command: 'tmux', args: [], instruction };
+  }
+  if (tool === 'node') {
+    return {
+      tool,
+      method: 'manual',
+      command: 'node',
+      args: [],
+      instruction: 'Install Node.js >= 18 (22 recommended) from https://nodejs.org or via nvm',
+    };
+  }
+  // docker
+  return {
+    tool,
+    method: 'manual',
+    command: 'docker',
+    args: [],
+    instruction: 'Install Docker from https://docs.docker.com/get-docker/ (no safe silent auto-install)',
+  };
+}
+
+const defaultSpawn: SpawnFn = (command, args, opts) =>
+  spawnSync(command, args, {
+    shell: opts.shell,
+    stdio: (opts.stdio as 'inherit') ?? 'inherit',
+    timeout: opts.timeout ?? 300_000,
+    encoding: 'utf-8',
+  }) as unknown as SpawnResult;
+
+export async function installTool(tool: ToolId, opts: InstallOptions): Promise<InstallResult> {
+  const plan = planInstall(tool, opts);
+  if (!opts.consent) return { tool, status: 'skipped', reason: 'no-consent' };
+  if (plan.method !== 'npm-global') {
+    opts.log?.(`Manual step required for ${tool}: ${plan.instruction}`);
+    return { tool, status: 'skipped', reason: 'manual' };
+  }
+  if (!PROVISIONER_BIN_WHITELIST.includes(plan.command)) {
+    return { tool, status: 'failed', error: `command not allowed: ${plan.command}` };
+  }
+  const spawn = opts.spawn ?? defaultSpawn;
+  // npm on Windows resolves through a .cmd wrapper that needs a shell to be
+  // found in PATH; every POSIX platform stays shell-free (no sh -c).
+  const isWindows = (opts.platform ?? process.platform) === 'win32';
+  opts.log?.(`Installing ${tool}: ${plan.command} ${plan.args.join(' ')}`);
+  const res = spawn(plan.command, plan.args, { shell: isWindows, stdio: 'inherit', timeout: 300_000 });
+  if (res.status === 0) return { tool, status: 'installed' };
+  const error = (res.stderr || res.stdout || `exit ${String(res.status)}`).toString().trim();
+  return { tool, status: 'failed', error };
+}
+
+// ─── Orchestration — what `deckent init` / MCP init wires into ───────────
+
+export type ProvisionMode = 'prompt' | 'yes' | 'no-install';
+
+export interface ProvisionOptions extends PlanOptions {
+  /** Tools detected as missing by doctor/provider checks. */
+  missing: ToolId[];
+  /** prompt = ask per tool; yes = install all (CI); no-install = legacy hint-only. */
+  mode: ProvisionMode;
+  /** Injected consent prompt (init.ts supplies a readline-backed impl). */
+  confirm?: (tool: ToolId, instruction: string) => Promise<boolean>;
+  /** Injected installer (defaults to installTool; overridable for tests). */
+  install?: (tool: ToolId, opts: InstallOptions) => Promise<InstallResult>;
+  spawn?: SpawnFn;
+  log?: (msg: string) => void;
+}
+
+/** Map `deckent init` CLI flags to a provision mode. --no-install is the
+ *  conservative default-preserving choice and wins over --yes. */
+export function resolveProvisionMode(flags: { yes?: boolean; noInstall?: boolean }): ProvisionMode {
+  if (flags.noInstall) return 'no-install';
+  if (flags.yes) return 'yes';
+  return 'prompt';
+}
+
+/** Doctor check `name` → provisionable ToolId. Names not present here
+ *  (e.g. 'git') are intentionally not auto-provisioned. */
+const DOCTOR_NAME_TO_TOOL: Readonly<Record<string, ToolId>> = Object.freeze({
+  tmux: 'tmux',
+  'Node.js': 'node',
+  Docker: 'docker',
+  'Claude CLI': 'claude',
+});
+
+/** Derive the set of provisionable missing tools from provider detection
+ *  (claude/codex/gemini) plus failed doctor checks. Deduped. */
+export function collectMissingTools(
+  providers: ReadonlyArray<{ name: string; available: boolean }>,
+  doctorChecks: ReadonlyArray<{ name: string; passed: boolean; required: boolean }>,
+): ToolId[] {
+  const set = new Set<ToolId>();
+  for (const p of providers) {
+    if (!p.available && (p.name === 'claude' || p.name === 'codex' || p.name === 'gemini')) {
+      set.add(p.name);
+    }
+  }
+  for (const c of doctorChecks) {
+    if (c.passed) continue;
+    const tool = DOCTOR_NAME_TO_TOOL[c.name];
+    if (tool) set.add(tool);
+  }
+  return [...set];
+}
+
+export async function provisionMissing(opts: ProvisionOptions): Promise<InstallResult[]> {
+  const doInstall = opts.install ?? installTool;
+  const baseInstallOpts = {
+    platform: opts.platform,
+    linuxPkgManager: opts.linuxPkgManager,
+    spawn: opts.spawn,
+    log: opts.log,
+  };
+  const results: InstallResult[] = [];
+  for (const tool of opts.missing) {
+    const plan = planInstall(tool, opts);
+    if (opts.mode === 'no-install') {
+      results.push({
+        tool,
+        status: 'skipped',
+        reason: plan.method === 'npm-global' ? 'no-consent' : 'manual',
+      });
+      continue;
+    }
+    if (opts.mode === 'yes') {
+      results.push(await doInstall(tool, { consent: true, ...baseInstallOpts }));
+      continue;
+    }
+    // prompt
+    const consented = opts.confirm ? await opts.confirm(tool, plan.instruction) : false;
+    if (!consented) {
+      results.push({ tool, status: 'skipped', reason: 'no-consent' });
+      continue;
+    }
+    results.push(await doInstall(tool, { consent: true, ...baseInstallOpts }));
+  }
+  return results;
+}
diff --git a/src/dashboard/index.html b/src/dashboard/index.html
index 8841a56b0..7c0c02a25 100644
--- a/src/dashboard/index.html
+++ b/src/dashboard/index.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" type="image/png" href="/favicon.png" />
     <title>Deckent Dashboard</title>
   </head>
   <body class="dark">
diff --git a/src/dashboard/package.json b/src/dashboard/package.json
index b857fc77e..e9bb5145b 100644
--- a/src/dashboard/package.json
+++ b/src/dashboard/package.json
@@ -19,16 +19,18 @@
     "tailwind-merge": "^2.6.0"
   },
   "devDependencies": {
+    "@tailwindcss/vite": "^4.0.0",
     "@testing-library/jest-dom": "^6.0.0",
     "@testing-library/react": "^16.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.3.0",
+    "@xterm/addon-fit": "^0.10.0",
+    "@xterm/xterm": "^5.5.0",
     "happy-dom": "^16.0.0",
+    "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vite": "^6.0.0",
-    "vitest": "^3.0.0",
-    "@vitejs/plugin-react": "^4.3.0",
-    "tailwindcss": "^4.0.0",
-    "@tailwindcss/vite": "^4.0.0"
+    "vitest": "^3.0.0"
   }
 }
diff --git a/src/dashboard/public/favicon.png b/src/dashboard/public/favicon.png
new file mode 100755
index 000000000..d8b60746e
Binary files /dev/null and b/src/dashboard/public/favicon.png differ
diff --git a/src/dashboard/public/logo.png b/src/dashboard/public/logo.png
new file mode 100755
index 000000000..2d37129b8
Binary files /dev/null and b/src/dashboard/public/logo.png differ
diff --git a/src/dashboard/src/components/DockPanel.tsx b/src/dashboard/src/components/DockPanel.tsx
new file mode 100644
index 000000000..380a1f38e
--- /dev/null
+++ b/src/dashboard/src/components/DockPanel.tsx
@@ -0,0 +1,67 @@
+import { useState, type ReactNode } from 'react';
+
+const COLLAPSED_HEIGHT = 32;
+const DEFAULT_HEIGHT = 280;
+const MIN_HEIGHT = 120;
+
+export function DockPanel({ children }: { children: ReactNode }) {
+  const [open, setOpen] = useState(false);
+  const [height, setHeight] = useState(DEFAULT_HEIGHT);
+
+  const startResize = (event: React.MouseEvent) => {
+    const startY = event.clientY;
+    const startHeight = height;
+    const onMove = (moveEvent: MouseEvent) => {
+      const delta = startY - moveEvent.clientY;
+      setHeight(Math.max(MIN_HEIGHT, startHeight + delta));
+    };
+    const onUp = () => {
+      window.removeEventListener('mousemove', onMove);
+      window.removeEventListener('mouseup', onUp);
+    };
+    window.addEventListener('mousemove', onMove);
+    window.addEventListener('mouseup', onUp);
+  };
+
+  const panelHeight = open ? height : COLLAPSED_HEIGHT;
+  const bodyHeight = Math.max(0, height - COLLAPSED_HEIGHT);
+
+  return (
+    <div
+      className="fixed bottom-0 left-0 right-0 z-40 border-t border-zinc-800 bg-zinc-950 text-zinc-100 shadow-[0_-2px_10px_rgba(0,0,0,0.4)]"
+      style={{ height: panelHeight }}
+      data-dock-panel="true"
+      data-open={open ? 'true' : 'false'}
+    >
+      {open && (
+        <div
+          role="separator"
+          aria-label="resize terminal"
+          aria-orientation="horizontal"
+          className="absolute top-0 left-0 right-0 h-1 cursor-ns-resize bg-transparent hover:bg-blue-500/40 transition-colors"
+          onMouseDown={startResize}
+        />
+      )}
+      <button
+        type="button"
+        className="flex w-full items-center justify-between px-3 py-1 text-left text-xs font-mono border-b border-zinc-800 hover:bg-zinc-900 transition-colors"
+        onClick={() => setOpen((value) => !value)}
+        aria-label="toggle terminal"
+        aria-expanded={open}
+        style={{ height: COLLAPSED_HEIGHT }}
+      >
+        <span className="flex items-center gap-1.5">
+          <span aria-hidden="true">{open ? '▾' : '▸'}</span>
+          <span>Terminal</span>
+        </span>
+        <span className="text-zinc-500" aria-hidden="true">{open ? 'collapse' : 'expand'}</span>
+      </button>
+      <div
+        className="overflow-hidden"
+        style={{ height: bodyHeight, display: open ? 'block' : 'none' }}
+      >
+        {children}
+      </div>
+    </div>
+  );
+}
diff --git a/src/dashboard/src/components/Layout.tsx b/src/dashboard/src/components/Layout.tsx
index 50e59b92c..86a6833bc 100644
--- a/src/dashboard/src/components/Layout.tsx
+++ b/src/dashboard/src/components/Layout.tsx
@@ -5,6 +5,8 @@ import { cn } from "../lib/utils";
 import { Sheet, SheetTrigger, SheetContent } from "./ui/sheet";
 import { ScrollArea } from "./ui/scroll-area";
 import { Badge } from "./ui/badge";
+import { DockPanel } from "./DockPanel";
+import { TerminalPanel } from "./terminal/TerminalPanel.js";
 import { useSSEWithStatus } from "../hooks/useSSE";
 import type { SSEStatus } from "../hooks/useSSE";
 import { useTranslation } from "../i18n/LanguageProvider";
@@ -77,9 +79,17 @@ function SidebarContent({ onNavigate, sseState, sseStatus }: { onNavigate?: () =
   return (
     <>
       <div className="mb-4 px-3">
-        <h1 className="text-lg font-bold text-zinc-100 tracking-tight">
-          deckent
-        </h1>
+        <div className="flex items-center gap-2">
+          <img
+            src="/logo.png"
+            alt="Deckent"
+            className="h-7 w-7 shrink-0"
+            style={{ imageRendering: 'pixelated' }}
+          />
+          <h1 className="text-lg font-bold text-zinc-100 tracking-tight">
+            deckent
+          </h1>
+        </div>
         <p className="text-xs text-zinc-500">{t('layout.subtitle')}</p>
       </div>
       {sseState?.sprint && (
@@ -140,10 +150,14 @@ export function Layout() {
           <span className="ml-3 text-sm font-bold text-zinc-100">deckent</span>
         </header>
 
-        <ScrollArea className="flex-1 p-6">
+        <ScrollArea className="flex-1 p-6 pb-8">
           <Outlet />
         </ScrollArea>
       </div>
+
+      <DockPanel>
+        <TerminalPanel />
+      </DockPanel>
     </div>
   );
 }
diff --git a/src/dashboard/src/components/terminal/TerminalPanel.tsx b/src/dashboard/src/components/terminal/TerminalPanel.tsx
new file mode 100644
index 000000000..712476b4b
--- /dev/null
+++ b/src/dashboard/src/components/terminal/TerminalPanel.tsx
@@ -0,0 +1,63 @@
+import { useEffect, useState } from 'react';
+import { TerminalView } from './TerminalView.js';
+import { TerminalTabs } from './TerminalTabs.js';
+import {
+  createSession,
+  killSession,
+  listSessions,
+  type SessionMeta,
+} from '../../lib/terminal-api.js';
+
+export function TerminalPanel() {
+  const [tabs, setTabs] = useState<SessionMeta[]>([]);
+  const [activeId, setActiveId] = useState<string | null>(null);
+
+  useEffect(() => {
+    let mounted = true;
+    listSessions().then((s) => {
+      if (!mounted) return;
+      setTabs(s);
+      if (s[0]) setActiveId(s[0].id);
+    });
+    return () => {
+      mounted = false;
+    };
+  }, []);
+
+  const launch = async (kind: string, tool?: string) => {
+    const s = await createSession({ kind, tool });
+    setTabs((t) => [...t, s]);
+    setActiveId(s.id);
+  };
+
+  const close = async (id: string) => {
+    await killSession(id);
+    setTabs((t) => {
+      const next = t.filter((x) => x.id !== id);
+      setActiveId((a) => {
+        if (a !== id) return a;
+        return next.length > 0 ? next[next.length - 1].id : null;
+      });
+      return next;
+    });
+  };
+
+  return (
+    <div className="flex flex-col h-full">
+      <TerminalTabs
+        tabs={tabs}
+        activeId={activeId}
+        onSelect={setActiveId}
+        onClose={close}
+        onLaunch={launch}
+      />
+      <div className="flex-1 min-h-0">
+        {activeId ? (
+          <TerminalView key={activeId} sessionId={activeId} />
+        ) : (
+          <div className="p-4 text-sm text-muted-foreground">Open a session ↗</div>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/src/dashboard/src/components/terminal/TerminalTabs.tsx b/src/dashboard/src/components/terminal/TerminalTabs.tsx
new file mode 100644
index 000000000..782dc7e65
--- /dev/null
+++ b/src/dashboard/src/components/terminal/TerminalTabs.tsx
@@ -0,0 +1,54 @@
+import type { SessionMeta } from '../../lib/terminal-api.js';
+
+const KINDS: { label: string; kind: string; tool?: string }[] = [
+  { label: 'claude', kind: 'ai', tool: 'claude' },
+  { label: 'gemini', kind: 'ai', tool: 'gemini' },
+  { label: 'codex', kind: 'ai', tool: 'codex' },
+  { label: 'deckent', kind: 'deckent' },
+  { label: 'shell', kind: 'shell' },
+];
+
+export interface TerminalTabsProps {
+  tabs: SessionMeta[];
+  activeId: string | null;
+  onSelect: (id: string) => void;
+  onClose: (id: string) => void;
+  onLaunch: (kind: string, tool?: string) => void;
+}
+
+export function TerminalTabs(props: TerminalTabsProps) {
+  return (
+    <div className="flex items-center gap-1 border-b px-2 py-1 text-sm">
+      {props.tabs.map((t) => (
+        <span
+          key={t.id}
+          className={`px-2 py-0.5 rounded cursor-pointer ${t.id === props.activeId ? 'bg-muted' : ''}`}
+        >
+          <button type="button" onClick={() => props.onSelect(t.id)}>
+            {t.kind}:{t.id.slice(0, 6)}
+          </button>
+          <button
+            type="button"
+            aria-label={`close ${t.id}`}
+            className="ml-1"
+            onClick={() => props.onClose(t.id)}
+          >
+            ×
+          </button>
+        </span>
+      ))}
+      <span className="ml-auto flex gap-1">
+        {KINDS.map((k) => (
+          <button
+            key={k.label}
+            type="button"
+            className="px-2 py-0.5 rounded bg-primary/10"
+            onClick={() => props.onLaunch(k.kind, k.tool)}
+          >
+            +{k.label}
+          </button>
+        ))}
+      </span>
+    </div>
+  );
+}
diff --git a/src/dashboard/src/components/terminal/TerminalView.tsx b/src/dashboard/src/components/terminal/TerminalView.tsx
new file mode 100644
index 000000000..d7b67d919
--- /dev/null
+++ b/src/dashboard/src/components/terminal/TerminalView.tsx
@@ -0,0 +1,45 @@
+import { useEffect, useRef } from 'react';
+import { Terminal } from '@xterm/xterm';
+import { FitAddon } from '@xterm/addon-fit';
+import '@xterm/xterm/css/xterm.css';
+import { useTerminalSocket } from './useTerminalSocket.js';
+
+export interface TerminalViewProps {
+  sessionId: string;
+}
+
+export function TerminalView({ sessionId }: TerminalViewProps) {
+  const elRef = useRef<HTMLDivElement>(null);
+  const termRef = useRef<Terminal | null>(null);
+  const writeRef = useRef<(d: string) => void>(() => {});
+  const sock = useTerminalSocket(sessionId, (d) => writeRef.current(d));
+
+  useEffect(() => {
+    if (!elRef.current) return;
+    const term = new Terminal({ convertEol: true, fontSize: 13 });
+    const fit = new FitAddon();
+    term.loadAddon(fit);
+    term.open(elRef.current);
+    fit.fit();
+    writeRef.current = (d) => term.write(d);
+    term.onData((d) => sock.current?.send(d));
+    termRef.current = term;
+    const ro = new ResizeObserver(() => {
+      fit.fit();
+      sock.current?.resize(term.cols, term.rows);
+    });
+    ro.observe(elRef.current);
+    return () => {
+      ro.disconnect();
+      term.dispose();
+    };
+  }, [sessionId, sock]);
+
+  return (
+    <div
+      data-terminal={sessionId}
+      ref={elRef}
+      style={{ width: '100%', height: '100%' }}
+    />
+  );
+}
diff --git a/src/dashboard/src/components/terminal/useTerminalSocket.ts b/src/dashboard/src/components/terminal/useTerminalSocket.ts
new file mode 100644
index 000000000..adcaca01c
--- /dev/null
+++ b/src/dashboard/src/components/terminal/useTerminalSocket.ts
@@ -0,0 +1,65 @@
+import { useEffect, useRef } from 'react';
+import type { MutableRefObject } from 'react';
+import { getBootstrapToken } from '../../lib/terminal-api.js';
+
+export interface TerminalSocket {
+  send(data: string): void;
+  resize(cols: number, rows: number): void;
+}
+
+export function useTerminalSocket(
+  sessionId: string | null,
+  onOutput: (data: string) => void,
+): MutableRefObject<TerminalSocket | null> {
+  const api = useRef<TerminalSocket | null>(null);
+  const outputRef = useRef(onOutput);
+  outputRef.current = onOutput;
+
+  useEffect(() => {
+    if (!sessionId) return;
+    let ws: WebSocket | null = null;
+    let retry = 0;
+    let stopped = false;
+    let retryTimer: ReturnType<typeof setTimeout> | null = null;
+
+    const connect = () => {
+      const token = getBootstrapToken();
+      const url = `${location.protocol === 'https:' ? 'wss' : 'ws'}://${location.host}/api/terminal/ws`;
+      ws = new WebSocket(url, token ? [`deckent.${token}`] : []);
+      ws.onopen = () => {
+        retry = 0;
+        ws!.send(JSON.stringify({ t: 'attach', sessionId }));
+      };
+      ws.onmessage = (e) => {
+        try {
+          const raw = typeof e.data === 'string' ? e.data : '';
+          if (!raw) return;
+          const m = JSON.parse(raw) as { t?: string; data?: string };
+          if (m.t === 'output' && typeof m.data === 'string') outputRef.current(m.data);
+        } catch {
+          /* ignore non-JSON frames */
+        }
+      };
+      ws.onclose = () => {
+        if (stopped) return;
+        retry = Math.min(retry + 1, 5);
+        retryTimer = setTimeout(connect, retry * 1000);
+      };
+      api.current = {
+        send: (data) => {
+          if (ws?.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ t: 'input', data }));
+        },
+        resize: (cols, rows) => {
+          if (ws?.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ t: 'resize', cols, rows }));
+        },
+      };
+    };
+    connect();
+    return () => {
+      stopped = true;
+      if (retryTimer) clearTimeout(retryTimer);
+      ws?.close();
+    };
+  }, [sessionId]);
+  return api;
+}
diff --git a/src/dashboard/src/i18n/en.ts b/src/dashboard/src/i18n/en.ts
index 24136d4ba..213d814cb 100644
--- a/src/dashboard/src/i18n/en.ts
+++ b/src/dashboard/src/i18n/en.ts
@@ -91,6 +91,7 @@ export const en = {
   'config.category.routing': 'Routing',
   'config.category.rollback': 'Rollback',
   'config.category.project': 'Project',
+  'config.category.terminal': 'Terminal',
   'config.category.advanced': 'Advanced',
 
   // Activity Feed
@@ -263,6 +264,16 @@ export const en = {
   'config.field.version.desc': 'Project version',
   'config.field.auto_clean_locks.label': 'Auto Clean Locks',
   'config.field.auto_clean_locks.desc': 'Automatically clean stale lock files',
+  'config.field.terminal_enabled.label': 'Terminal Enabled',
+  'config.field.terminal_enabled.desc': 'Enable embedded terminal in dashboard',
+  'config.field.terminal_allowShellKind.label': 'Allow Shell',
+  'config.field.terminal_allowShellKind.desc': 'Allow generic shell sessions (not just AI tools)',
+  'config.field.terminal_maxSessions.label': 'Max Sessions',
+  'config.field.terminal_maxSessions.desc': 'Maximum number of concurrent terminal sessions',
+  'config.field.terminal_idleTimeoutMs.label': 'Idle Timeout (ms)',
+  'config.field.terminal_idleTimeoutMs.desc': 'Idle session timeout in milliseconds (0 = no timeout)',
+  'config.field.terminal_scrollbackBytes.label': 'Scrollback Buffer',
+  'config.field.terminal_scrollbackBytes.desc': 'Terminal scrollback buffer size in bytes',
   'config.none': '— none —',
   'config.true': 'true',
   'config.false': 'false',
diff --git a/src/dashboard/src/i18n/tr.ts b/src/dashboard/src/i18n/tr.ts
index 841e575de..59b6ee2a2 100644
--- a/src/dashboard/src/i18n/tr.ts
+++ b/src/dashboard/src/i18n/tr.ts
@@ -93,6 +93,7 @@ export const tr: Record<TranslationKey, string> = {
   'config.category.routing': 'Yönlendirme',
   'config.category.rollback': 'Geri Alma',
   'config.category.project': 'Proje',
+  'config.category.terminal': 'Terminal',
   'config.category.advanced': 'Gelişmiş',
 
   // Activity Feed
@@ -265,6 +266,16 @@ export const tr: Record<TranslationKey, string> = {
   'config.field.version.desc': 'Proje sürümü',
   'config.field.auto_clean_locks.label': 'Otomatik Kilit Temizleme',
   'config.field.auto_clean_locks.desc': 'Eski kilit dosyalarını otomatik temizle',
+  'config.field.terminal_enabled.label': 'Terminal Aktif',
+  'config.field.terminal_enabled.desc': "Dashboard'da gömülü terminali etkinleştir",
+  'config.field.terminal_allowShellKind.label': 'Shell İzni',
+  'config.field.terminal_allowShellKind.desc': 'Genel shell oturumlarına izin ver (sadece AI araçları değil)',
+  'config.field.terminal_maxSessions.label': 'Maksimum Oturum',
+  'config.field.terminal_maxSessions.desc': 'Eşzamanlı terminal oturumu maksimum sayısı',
+  'config.field.terminal_idleTimeoutMs.label': 'Boşta Zaman Aşımı (ms)',
+  'config.field.terminal_idleTimeoutMs.desc': 'Boşta oturum zaman aşımı milisaniye (0 = yok)',
+  'config.field.terminal_scrollbackBytes.label': 'Scrollback Tamponu',
+  'config.field.terminal_scrollbackBytes.desc': 'Terminal scrollback tamponu boyutu (bayt)',
   'config.none': '— yok —',
   'config.true': 'evet',
   'config.false': 'hayır',
diff --git a/src/dashboard/src/lib/terminal-api.ts b/src/dashboard/src/lib/terminal-api.ts
new file mode 100644
index 000000000..929dd84ea
--- /dev/null
+++ b/src/dashboard/src/lib/terminal-api.ts
@@ -0,0 +1,59 @@
+/**
+ * Terminal HTTP control + bootstrap token helpers.
+ *
+ * Token wire (spec §1c.2): the server injects `window.__DECKENT_TERMINAL_TOKEN__`
+ * into the served index.html for localhost callers only. The SPA reads it and
+ * passes it both:
+ *   - on the WebSocket `Sec-WebSocket-Protocol` subprotocol (see useTerminalSocket)
+ *   - on HTTP fetches via `Authorization: Bearer ${token}` (the server-side check
+ *     at `src/api/server.ts` terminal-routes block extracts via the same header).
+ *
+ * Without the Bearer header the terminal HTTP endpoint 401s every request — this
+ * holds regardless of `DECKENT_API_AUTH_DISABLED`, by deliberate design (bypass-
+ * independence: a dev convenience must never silently open a remote shell).
+ */
+
+export interface SessionMeta {
+  id: string;
+  kind: string;
+  status: string;
+}
+
+export function getBootstrapToken(): string | undefined {
+  return (window as unknown as { __DECKENT_TERMINAL_TOKEN__?: string }).__DECKENT_TERMINAL_TOKEN__;
+}
+
+/** Build a header map with the bootstrap token attached as Bearer when present. */
+function authHeaders(extra?: Record<string, string>): Record<string, string> {
+  const token = getBootstrapToken();
+  const base: Record<string, string> = {};
+  if (token) base['Authorization'] = `Bearer ${token}`;
+  if (extra) Object.assign(base, extra);
+  return base;
+}
+
+export async function createSession(input: {
+  kind: string;
+  tool?: string;
+  args?: string[];
+}): Promise<SessionMeta> {
+  const res = await fetch('/api/terminal/sessions', {
+    method: 'POST',
+    headers: authHeaders({ 'Content-Type': 'application/json' }),
+    body: JSON.stringify(input),
+  });
+  if (!res.ok) throw new Error(`createSession failed: ${res.status}`);
+  return res.json() as Promise<SessionMeta>;
+}
+
+export async function listSessions(): Promise<SessionMeta[]> {
+  const res = await fetch('/api/terminal/sessions', { headers: authHeaders() });
+  return res.ok ? (res.json() as Promise<SessionMeta[]>) : [];
+}
+
+export async function killSession(id: string): Promise<void> {
+  await fetch(`/api/terminal/sessions/${id}`, {
+    method: 'DELETE',
+    headers: authHeaders(),
+  });
+}
diff --git a/src/dashboard/src/pages/ConfigPage.tsx b/src/dashboard/src/pages/ConfigPage.tsx
index eb40fae7b..818197be5 100644
--- a/src/dashboard/src/pages/ConfigPage.tsx
+++ b/src/dashboard/src/pages/ConfigPage.tsx
@@ -113,6 +113,13 @@ const CONFIG_FIELDS: ConfigFieldMeta[] = [
   { key: "projectName", label: "Project Name", description: "Project display name", type: "text", category: "Project", defaultValue: null },
   { key: "version", label: "Version", description: "Project version", type: "text", category: "Project", defaultValue: null },
 
+  // ─── Terminal ─────────────────────────────────────────────
+  { key: "terminal.enabled", label: "Terminal Enabled", description: "Enable embedded terminal in dashboard", type: "boolean", category: "Terminal", defaultValue: true },
+  { key: "terminal.allowShellKind", label: "Allow Shell", description: "Allow generic shell sessions (not just AI tools)", type: "boolean", category: "Terminal", defaultValue: true },
+  { key: "terminal.maxSessions", label: "Max Sessions", description: "Maximum number of concurrent terminal sessions", type: "number", category: "Terminal", defaultValue: 10 },
+  { key: "terminal.idleTimeoutMs", label: "Idle Timeout (ms)", description: "Idle session timeout in milliseconds (0 = no timeout)", type: "number", category: "Terminal", defaultValue: 1800000 },
+  { key: "terminal.scrollbackBytes", label: "Scrollback Buffer", description: "Terminal scrollback buffer size in bytes", type: "number", category: "Terminal", defaultValue: 262144 },
+
   // ─── Advanced ─────────────────────────────────────────────
   { key: "auto_clean_locks", label: "Auto Clean Locks", description: "Automatically clean stale lock files", type: "boolean", category: "Advanced", defaultValue: false },
 
@@ -133,7 +140,7 @@ const CONFIG_FIELDS: ConfigFieldMeta[] = [
 const CATEGORIES = [
   "Provider", "Sprint", "Model Strategy", "Adaptive", "Auto Docs",
   "Memory", "Auditor", "Output", "Environment", "Skill Routing",
-  "Rollback", "Project", "Advanced", PLANNED_CATEGORY,
+  "Rollback", "Project", "Terminal", "Advanced", PLANNED_CATEGORY,
 ] as const;
 
 const CATEGORY_KEY_MAP: Record<string, string> = {
@@ -149,6 +156,7 @@ const CATEGORY_KEY_MAP: Record<string, string> = {
   "Skill Routing": "config.category.routing",
   "Rollback": "config.category.rollback",
   "Project": "config.category.project",
+  "Terminal": "config.category.terminal",
   "Advanced": "config.category.advanced",
   [PLANNED_CATEGORY]: "config.category.planned",
 };
diff --git a/src/dashboard/tsconfig.tsbuildinfo b/src/dashboard/tsconfig.tsbuildinfo
deleted file mode 100644
index 8e9de0021..000000000
--- a/src/dashboard/tsconfig.tsbuildinfo
+++ /dev/null
@@ -1 +0,0 @@
-{"root":["./src/App.tsx","./src/main.tsx","./src/components/DebtTable.tsx","./src/components/Layout.tsx","./src/components/NewSprintModal.tsx","./src/components/SimpleMarkdown.tsx","./src/components/SprintChart.tsx","./src/components/ThemeProvider.tsx","./src/components/ui/badge.tsx","./src/components/ui/button.tsx","./src/components/ui/card.tsx","./src/components/ui/dialog.tsx","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/components/ui/progress.tsx","./src/components/ui/scroll-area.tsx","./src/components/ui/select.tsx","./src/components/ui/separator.tsx","./src/components/ui/sheet.tsx","./src/components/ui/table.tsx","./src/components/ui/tabs.tsx","./src/components/ui/textarea.tsx","./src/hooks/useApi.ts","./src/hooks/useSSE.ts","./src/lib/api.ts","./src/lib/utils.ts","./src/pages/DashboardPage.tsx","./src/pages/HistoryPage.tsx","./src/pages/MemoryPage.tsx","./src/pages/SettingsPage.tsx","./src/types/index.ts"],"version":"5.9.3"}
\ No newline at end of file
diff --git a/src/mcp/tools/audit.ts b/src/mcp/tools/audit.ts
index c40216f8f..6c078e38e 100644
--- a/src/mcp/tools/audit.ts
+++ b/src/mcp/tools/audit.ts
@@ -10,7 +10,7 @@ export function registerAuditTool(server: McpServer): void {
     'deckent_audit',
     {
       title: 'Sprint Audit',
-      description: 'Run Brain Self-Audit Gate for a sprint. Checks tsc, vitest, honesty violations, and observability. Returns gate result (PASS or GATE_FAILURE) and writes to .deckent/<sprint-id>-gate.json. Read-only: does not modify source code or sprint state.',
+      description: 'Run Brain Self-Audit Gate for a sprint. Checks tsc, vitest, honesty violations, and observability. Returns gate result (PASS or GATE_FAILURE) and writes to .deckent/{sprintId}-gate.json. Read-only: does not modify source code or sprint state.',
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true },
       inputSchema: z.object({
         sprintId: z.string().describe('Sprint ID to audit (e.g. "sprint-150")'),
diff --git a/src/mcp/tools/init.ts b/src/mcp/tools/init.ts
index 45ece0df3..f3f1d59b6 100644
--- a/src/mcp/tools/init.ts
+++ b/src/mcp/tools/init.ts
@@ -10,6 +10,12 @@ import {
   PATTERNS_FILE, RETRO_FILE, PROJECT_IDENTITY_FILE,
 } from '../../core/constants.js';
 import { analyzeProject } from '../../core/analyzer.js';
+import { detectAvailableProviders } from '../../core/provider.js';
+import {
+  provisionMissing,
+  collectMissingTools,
+  planInstall,
+} from '../../core/provisioner.js';
 import { generateProjectIdentity } from '../../orchestra/sprint-reporter.js';
 import { ensureDeckentImport } from '../../core/utils.js';
 import { enrichResponse } from '../helpers/enrich.js';
@@ -67,9 +73,10 @@ export function registerInitTool(server: McpServer): void {
         language: z.enum(['en', 'tr']).optional().default('en').describe('Language for agent prompt templates (en=English, tr=Turkish)'),
         force: z.boolean().optional().default(false).describe('Force re-initialization: overwrites existing config.json and workspace files. Does not delete .brain/ or .tasks/ data.'),
         auto: z.boolean().optional().default(false).describe('Auto-detection mode: skip interactive wizard, detect project stack automatically and apply defaults.'),
+        installMissing: z.boolean().optional().default(false).describe('Install missing provider CLIs (claude/codex/gemini) automatically. MCP has no interactive consent, so this is an explicit opt-in (equivalent to CLI `--yes`). When false, missing tools are only reported.'),
       }),
     },
-    async ({ projectName, mode, language, force, auto }) => {
+    async ({ projectName, mode, language, force, auto, installMissing }) => {
       const root = process.cwd();
       // auto: hint that project stack should be auto-detected (already default behavior in MCP)
       void auto;
@@ -253,13 +260,39 @@ Lint: tsc --noEmit
         created.push('.claude/settings.json');
       }
 
+      // Consent-based provisioning of missing provider CLIs (MCP parity).
+      let provisioning: Array<{ tool: string; status: string; detail?: string }> | undefined;
+      try {
+        const providers = await detectAvailableProviders();
+        const missing = collectMissingTools(providers, []);
+        if (missing.length > 0) {
+          if (installMissing) {
+            const results = await provisionMissing({ missing, mode: 'yes' });
+            provisioning = results.map(r => ({
+              tool: r.tool,
+              status: r.status,
+              detail: r.status === 'failed' ? r.error : planInstall(r.tool).instruction,
+            }));
+          } else {
+            provisioning = missing.map(t => ({
+              tool: t,
+              status: 'missing',
+              detail: planInstall(t).instruction,
+            }));
+          }
+        }
+      } catch { /* provider detection failure is non-fatal */ }
+
       const nextSteps = [
         '`deckent plan` — plan your first sprint',
         '`deckent start` — start the sprint',
         '`deckent status` — monitor progress',
       ];
+      if (provisioning && !installMissing) {
+        nextSteps.unshift(`Install missing prerequisites: ${provisioning.map(p => p.tool).join(', ')} (or re-run with installMissing:true)`);
+      }
 
-      const enriched = enrichResponse('init', { success: true, created, mode, language, projectName: resolvedProjectName, force, auto, nextSteps }, { lang: language });
+      const enriched = enrichResponse('init', { success: true, created, mode, language, projectName: resolvedProjectName, force, auto, nextSteps, provisioning }, { lang: language });
 
       return {
         content: [{
diff --git a/src/orchestra/sprint-docs-updater.ts b/src/orchestra/sprint-docs-updater.ts
index 65ee27064..b4183bcc3 100644
--- a/src/orchestra/sprint-docs-updater.ts
+++ b/src/orchestra/sprint-docs-updater.ts
@@ -107,6 +107,14 @@ export function updateProjectDocs(projectRoot: string, sprintResult: SprintResul
     adaptive_config: { min_samples: 3, no_go_threshold: 0.3, coverage_lookback: 3 },
     sprint_timeout_minutes: 0,
     deckent_style: 'sprint' as const,
+    terminal: {
+      enabled: true,
+      bind: '127.0.0.1',
+      maxSessions: 10,
+      idleTimeoutMs: 1_800_000,
+      scrollbackBytes: 262_144,
+      allowShellKind: true,
+    },
   };
   const ctx = { projectRoot, sprintResult, config: resolvedConfig, isInternalProject };
   const builtinResults = runAllUpdaters(ctx);
diff --git a/tests/api/chat-handler.test.ts b/tests/api/chat-handler.test.ts
new file mode 100644
index 000000000..9365a87c4
--- /dev/null
+++ b/tests/api/chat-handler.test.ts
@@ -0,0 +1,36 @@
+import { describe, it, expect } from 'vitest';
+
+import { buildChatReply } from '../../src/api/chat-handler.js';
+
+// /api/chat contract (ChatPage.tsx:273): POST { message } → { reply }.
+// Minimal but real: status/help commands + helpful default (never a stub).
+
+describe('buildChatReply', () => {
+  it('answers a status query with the provided sprint status', () => {
+    const reply = buildChatReply('status', { status: () => 'Sprint 175: 3/6 done, 0 blocked' });
+    expect(reply).toContain('Sprint 175');
+    expect(reply).toContain('3/6 done');
+  });
+
+  it('answers Turkish "durum" the same way', () => {
+    const reply = buildChatReply('durum nedir?', { status: () => 'idle — no active sprint' });
+    expect(reply).toContain('idle');
+  });
+
+  it('returns command guidance for help', () => {
+    const reply = buildChatReply('help', {});
+    expect(reply.toLowerCase()).toContain('status');
+  });
+
+  it('returns helpful guidance for an unrecognized message (not a stub error)', () => {
+    const reply = buildChatReply('build me a rocket', {});
+    expect(reply.length).toBeGreaterThan(0);
+    expect(reply.toLowerCase()).not.toContain('not implemented');
+    expect(reply.toLowerCase()).not.toContain('404');
+  });
+
+  it('handles empty message gracefully with guidance', () => {
+    const reply = buildChatReply('   ', {});
+    expect(reply.toLowerCase()).toContain('status');
+  });
+});
diff --git a/tests/api/server.test.ts b/tests/api/server.test.ts
index a6be7d698..2c1b3f61c 100644
--- a/tests/api/server.test.ts
+++ b/tests/api/server.test.ts
@@ -423,6 +423,27 @@ describe('createHttpServer', () => {
 
   // ─── POST endpoints ────────────────────────────────────────
 
+  describe('POST /api/chat', () => {
+    it('returns 200 with a reply for a help message (no longer a 404 stub)', async () => {
+      api = createHttpServer(PROJECT_ROOT, 0);
+      await new Promise<void>((r) => api.server.once('listening', r));
+
+      const res = await request(api, '/api/chat', 'POST', { message: 'help' });
+      expect(res.status).toBe(200);
+      const body = JSON.parse(res.body) as { reply: string };
+      expect(typeof body.reply).toBe('string');
+      expect(body.reply.toLowerCase()).toContain('status');
+    });
+
+    it('returns 400 when message is missing', async () => {
+      api = createHttpServer(PROJECT_ROOT, 0);
+      await new Promise<void>((r) => api.server.once('listening', r));
+
+      const res = await request(api, '/api/chat', 'POST', {});
+      expect(res.status).toBe(400);
+    });
+  });
+
   describe('POST /api/start', () => {
     it('returns 202 and starts sprint', async () => {
       api = createHttpServer(PROJECT_ROOT, 0);
diff --git a/tests/api/terminal/audit.test.ts b/tests/api/terminal/audit.test.ts
new file mode 100644
index 000000000..868d6fc05
--- /dev/null
+++ b/tests/api/terminal/audit.test.ts
@@ -0,0 +1,179 @@
+import { describe, it, expect } from 'vitest';
+import { rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { TerminalAudit } from '../../../src/api/terminal/audit.js';
+import type { AuditEvent } from '../../../src/api/terminal/types.js';
+import { MemoryStore } from '../../../src/core/memory-store.js';
+
+describe('TerminalAudit', () => {
+  it('records a structured event and never stores raw output', () => {
+    const recorded: Array<Record<string, unknown>> = [];
+    const fakeStore = { insert: (e: Record<string, unknown>) => recorded.push(e) };
+    const audit = new TerminalAudit(fakeStore);
+
+    const ev: AuditEvent = {
+      action: 'session.create',
+      tenantId: 'local',
+      sessionId: 's1',
+      detail: 'kind=shell',
+      at: new Date().toISOString(),
+    };
+    audit.record(ev);
+
+    expect(recorded).toHaveLength(1);
+    const e = recorded[0] as {
+      type: string;
+      tenant_id: string;
+      content: string;
+      title: string;
+      decay_exempt: boolean;
+    };
+    expect(e.type).toBe('audit');
+    expect(e.tenant_id).toBe('local');
+    expect(e.title).toBe('terminal:session.create');
+    expect(e.decay_exempt).toBe(true);
+    // structured content carries action + detail, NOT raw bytes
+    expect(e.content).toContain('session.create');
+    expect(e.content).toContain('kind=shell');
+    // security invariant: no ANSI / raw PTY bytes
+    expect(e.content).not.toContain('\x1b[');
+    expect(e.content).not.toContain('\x07');
+  });
+
+  it('serializes structured fields only — drops anything not in AuditEvent shape', () => {
+    const recorded: Array<Record<string, unknown>> = [];
+    const fakeStore = { insert: (e: Record<string, unknown>) => recorded.push(e) };
+    const audit = new TerminalAudit(fakeStore);
+
+    audit.record({
+      action: 'session.kill',
+      tenantId: 'local',
+      sessionId: 'sess-42',
+      detail: 'reason=idle-reaper',
+      at: '2026-05-19T22:00:00.000Z',
+    });
+
+    const e = recorded[0] as { type: string; content: string };
+    expect(e.type).toBe('audit');
+    // content is JSON of {action, sessionId, detail, at} — no extra fields
+    const parsed = JSON.parse(e.content) as Record<string, unknown>;
+    expect(parsed['action']).toBe('session.kill');
+    expect(parsed['sessionId']).toBe('sess-42');
+    expect(parsed['detail']).toBe('reason=idle-reaper');
+    expect(parsed['at']).toBe('2026-05-19T22:00:00.000Z');
+    // not even the tenantId leaks into content — it's a column
+    expect(Object.keys(parsed).sort()).toEqual(['action', 'at', 'detail', 'sessionId']);
+  });
+
+  it('handles events without optional fields', () => {
+    const recorded: Array<Record<string, unknown>> = [];
+    const fakeStore = { insert: (e: Record<string, unknown>) => recorded.push(e) };
+    const audit = new TerminalAudit(fakeStore);
+
+    audit.record({
+      action: 'auth.deny',
+      tenantId: 'local',
+      at: '2026-05-19T22:00:00.000Z',
+    });
+
+    const e = recorded[0] as { type: string; tenant_id: string; title: string; content: string };
+    expect(e.type).toBe('audit');
+    expect(e.tenant_id).toBe('local');
+    expect(e.title).toBe('terminal:auth.deny');
+    const parsed = JSON.parse(e.content) as Record<string, unknown>;
+    expect(parsed['action']).toBe('auth.deny');
+    expect(parsed['sessionId']).toBeUndefined();
+    expect(parsed['detail']).toBeUndefined();
+  });
+
+  // Regression for the integration bug behind task 175-007-xfix:
+  // when TerminalAudit was wired to a *real* MemoryStore, `tenant_id` was
+  // silently dropped because the CreateEntryInput type did not surface it
+  // and the INSERT SQL omitted the column. This test exercises the round
+  // trip through SQLite so the contract cannot regress.
+  it('persists tenant_id round-trip through real MemoryStore', () => {
+    const store = new MemoryStore(':memory:');
+    try {
+      const audit = new TerminalAudit({
+        insert: (e: Record<string, unknown>) => {
+          store.insert({
+            id: `audit-${String(e['title']).replace(/[^a-z0-9]/gi, '-')}-${Date.now()}`,
+            type: 'audit',
+            title: String(e['title']),
+            content: String(e['content']),
+            tenant_id: e['tenant_id'] as string | undefined,
+            decay_exempt: e['decay_exempt'] === true,
+          });
+        },
+      });
+
+      audit.record({
+        action: 'session.create',
+        tenantId: 'tenant-alpha',
+        sessionId: 'sess-1',
+        detail: 'kind=shell',
+        at: '2026-05-19T22:05:00.000Z',
+      });
+      audit.record({
+        action: 'session.kill',
+        tenantId: 'tenant-beta',
+        sessionId: 'sess-2',
+        detail: 'reason=user',
+        at: '2026-05-19T22:06:00.000Z',
+      });
+
+      const rows = store.getByType('audit');
+      expect(rows).toHaveLength(2);
+
+      const alpha = rows.find(r => r.title === 'terminal:session.create');
+      const beta = rows.find(r => r.title === 'terminal:session.kill');
+      expect(alpha?.tenant_id).toBe('tenant-alpha');
+      expect(beta?.tenant_id).toBe('tenant-beta');
+      // structured content carries action + detail, never raw bytes
+      expect(alpha?.content).toContain('kind=shell');
+      expect(alpha?.content).not.toContain('\x1b[');
+    } finally {
+      store.close();
+    }
+  });
+
+  // Regression: opening the same DB path twice must be idempotent. Without
+  // the column-existence PRAGMA guard the second `new MemoryStore` would
+  // throw `duplicate column name: tenant_id` from ALTER TABLE.
+  //
+  // We need TWO handles to the SAME DB, so `:memory:` (per-handle isolated)
+  // is insufficient. Earlier revisions used a SQLite URI shared-cache trick
+  // (`file:NAME?mode=memory&cache=shared`) which silently leaked ~100KB
+  // phantom files to the repo root because `better-sqlite3` requires
+  // `{ uri: true }` to honor URI syntax (option absent from MemoryStore
+  // constructor + missing from @types/better-sqlite3, Sprint-175 audit).
+  // Using a real temp file with explicit cleanup is the robust replacement.
+  it('additive tenant_id migration is idempotent across reopens', () => {
+    const tmpFile = join(tmpdir(), `deckent-audit-idem-${Date.now()}-${process.pid}.db`);
+    const first = new MemoryStore(tmpFile);
+    try {
+      // Second open against the same on-disk DB MUST NOT throw.
+      const reopen = new MemoryStore(tmpFile);
+      try {
+        reopen.insert({
+          id: 'audit-second-open',
+          type: 'audit',
+          title: 'terminal:auth.ok',
+          content: '{"action":"auth.ok"}',
+          tenant_id: 'tenant-gamma',
+        });
+        const row = reopen.getById('audit-second-open');
+        expect(row?.tenant_id).toBe('tenant-gamma');
+      } finally {
+        reopen.close();
+      }
+    } finally {
+      first.close();
+      // WAL mode → sidecar files (-wal, -shm); force=true tolerates missing.
+      rmSync(tmpFile, { force: true });
+      rmSync(`${tmpFile}-wal`, { force: true });
+      rmSync(`${tmpFile}-shm`, { force: true });
+    }
+  });
+});
diff --git a/tests/api/terminal/auth-provider.test.ts b/tests/api/terminal/auth-provider.test.ts
new file mode 100644
index 000000000..06eb15df1
--- /dev/null
+++ b/tests/api/terminal/auth-provider.test.ts
@@ -0,0 +1,35 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { LocalTokenAuthProvider } from '../../../src/api/terminal/auth-provider.js';
+
+describe('LocalTokenAuthProvider', () => {
+  afterEach(() => {
+    delete process.env['DECKENT_API_AUTH_DISABLED'];
+  });
+
+  it('accepts the correct token', () => {
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify('secret-abc')).toBe(true);
+  });
+
+  it('rejects a wrong token', () => {
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify('nope')).toBe(false);
+  });
+
+  it('rejects empty/undefined', () => {
+    const p = new LocalTokenAuthProvider('secret-abc');
+    expect(p.verify(undefined)).toBe(false);
+    expect(p.verify('')).toBe(false);
+  });
+
+  it('is independent of DECKENT_API_AUTH_DISABLED', () => {
+    process.env['DECKENT_API_AUTH_DISABLED'] = '1';
+    const p = new LocalTokenAuthProvider('secret-abc');
+    // The global API auth bypass MUST NOT open a shell — spec §1c.2.
+    expect(p.verify('wrong')).toBe(false);
+    expect(p.verify(undefined)).toBe(false);
+    expect(p.verify('')).toBe(false);
+    // Correct token still works regardless of the bypass flag.
+    expect(p.verify('secret-abc')).toBe(true);
+  });
+});
diff --git a/tests/api/terminal/e2e-reattach.test.ts b/tests/api/terminal/e2e-reattach.test.ts
new file mode 100644
index 000000000..57a6652b8
--- /dev/null
+++ b/tests/api/terminal/e2e-reattach.test.ts
@@ -0,0 +1,200 @@
+import { describe, it, expect } from 'vitest';
+import { createServer, type Server } from 'node:http';
+import { WebSocket } from 'ws';
+import { attachTerminalGateway } from '../../../src/api/terminal/ws-gateway.js';
+import { PtySessionManager } from '../../../src/api/terminal/session-manager.js';
+import { LocalPtyBackend } from '../../../src/api/terminal/session-backend.js';
+import { LocalTokenAuthProvider } from '../../../src/api/terminal/auth-provider.js';
+
+/**
+ * Sprint 175 Task W4.1 — E2E reattach integration.
+ *
+ * Real `node-pty` (LocalPtyBackend) + real `ws` + real gateway + real manager.
+ * Validates the full pipeline contract (spec §1c, plan §Task 4.1):
+ *   1. ws1 attaches → sends input → disconnects.
+ *   2. While the client is absent, two markers are written directly to the
+ *      manager (mgr.write) — they reach the PTY and the resulting echoes
+ *      land in the bounded ring buffer.
+ *   3. ws2 reconnects with the same subprotocol token and re-attaches.
+ *   4. The replay frame (sent BEFORE the live listener is wired in the
+ *      bridge) contains BOTH markers — reattach is resilient to a client
+ *      disconnect (server-restart persistence is explicitly out of scope).
+ *
+ * Invariants asserted along the way:
+ *   - detach ≠ kill: `mgr.get(id)` still defined after ws1 closes.
+ *   - subprotocol auth path remains the only attach surface (no Authorization
+ *     header is used for WS upgrade).
+ */
+
+const TOKEN = 'e2e-token';
+const TEST_TIMEOUT_MS = 15_000;
+
+interface OutputFrame {
+  t: 'output';
+  data: string;
+}
+
+function isOutputFrame(v: unknown): v is OutputFrame {
+  if (typeof v !== 'object' || v === null) return false;
+  const o = v as { t?: unknown; data?: unknown };
+  return o.t === 'output' && typeof o.data === 'string';
+}
+
+interface Harness {
+  server: Server;
+  mgr: PtySessionManager;
+  port: number;
+}
+
+async function makeHarness(): Promise<Harness> {
+  const backend = new LocalPtyBackend();
+  const mgr = new PtySessionManager(backend, {
+    scrollbackBytes: 65_536,
+    idleTimeoutMs: 0,
+  });
+  const auth = new LocalTokenAuthProvider(TOKEN);
+  const audit = {
+    record: (): void => {
+      /* sink — audit content is covered by audit.test.ts */
+    },
+  };
+  const server = createServer();
+  attachTerminalGateway(server, { manager: mgr, auth, audit });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+  const addr = server.address();
+  if (addr === null || typeof addr === 'string') {
+    throw new Error('server address unavailable');
+  }
+  return { server, mgr, port: addr.port };
+}
+
+function closeServer(server: Server): Promise<void> {
+  return new Promise((resolve) => server.close(() => resolve()));
+}
+
+function openWs(port: number, token: string): Promise<WebSocket> {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(`ws://127.0.0.1:${port}/api/terminal/ws`, [`deckent.${token}`]);
+    ws.once('open', () => resolve(ws));
+    ws.once('error', (err) => reject(err));
+  });
+}
+
+function awaitClose(ws: WebSocket): Promise<void> {
+  return new Promise((resolve) => ws.once('close', () => resolve()));
+}
+
+function safeClose(ws: WebSocket | undefined): void {
+  if (!ws) return;
+  try {
+    ws.close();
+  } catch {
+    /* already closing */
+  }
+}
+
+/** Accumulates `output` frame `data` until the predicate matches or the timeout elapses. */
+function collectUntil(
+  ws: WebSocket,
+  predicate: (accumulated: string) => boolean,
+  timeoutMs: number,
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    const onMsg = (raw: unknown): void => {
+      const text = (raw as Buffer | string).toString();
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        return;
+      }
+      if (!isOutputFrame(parsed)) return;
+      buf += parsed.data;
+      if (predicate(buf)) {
+        clearTimeout(timer);
+        ws.off('message', onMsg);
+        resolve(buf);
+      }
+    };
+    const timer = setTimeout(() => {
+      ws.off('message', onMsg);
+      reject(new Error(`collectUntil timed out (${timeoutMs}ms). buffered=${JSON.stringify(buf)}`));
+    }, timeoutMs);
+    ws.on('message', onMsg);
+  });
+}
+
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+describe('terminal e2e — reattach with replay (real pty + real ws)', () => {
+  it(
+    'ws1 attach→input→disconnect → mgr.write MARKER_ONE+TWO while detached → ws2 reattach replays both',
+    async () => {
+      const { server, mgr, port } = await makeHarness();
+      let ws1: WebSocket | undefined;
+      let ws2: WebSocket | undefined;
+      let sessionId: string | undefined;
+      try {
+        const meta = mgr.create({ kind: 'shell' });
+        sessionId = meta.id;
+
+        // ── Phase A: ws1 attach + input ─────────────────────────────────
+        ws1 = await openWs(port, TOKEN);
+        ws1.send(JSON.stringify({ t: 'attach', sessionId: meta.id }));
+        // let the shell prompt + attach listener settle
+        await sleep(200);
+        ws1.send(JSON.stringify({ t: 'input', data: 'true\r' }));
+        await sleep(100);
+
+        // ── Phase B: client disconnect (detach ≠ kill) ──────────────────
+        const ws1Closed = awaitClose(ws1);
+        ws1.close();
+        await ws1Closed;
+        ws1 = undefined;
+        // give the server a beat to process its own 'close' → manager.detach
+        await sleep(50);
+
+        // Invariant: session survives the client disconnect.
+        expect(mgr.get(meta.id)).toBeDefined();
+
+        // ── Phase C: write markers WHILE no client is attached ──────────
+        mgr.write(meta.id, 'echo MARKER_ONE\r');
+        await sleep(80);
+        mgr.write(meta.id, 'echo MARKER_TWO\r');
+        // wait for pty echoes to settle into the bounded ring buffer
+        await sleep(500);
+
+        // Server-side sanity gate before pulling the same data through the wire
+        const ringSnapshot = mgr.replay(meta.id);
+        expect(ringSnapshot).toContain('MARKER_ONE');
+        expect(ringSnapshot).toContain('MARKER_TWO');
+
+        // ── Phase D: ws2 reconnect + reattach + replay ──────────────────
+        ws2 = await openWs(port, TOKEN);
+        const replayedBoth = collectUntil(
+          ws2,
+          (acc) => acc.includes('MARKER_ONE') && acc.includes('MARKER_TWO'),
+          3_000,
+        );
+        ws2.send(JSON.stringify({ t: 'attach', sessionId: meta.id }));
+        const collected = await replayedBoth;
+
+        expect(collected).toContain('MARKER_ONE');
+        expect(collected).toContain('MARKER_TWO');
+      } finally {
+        safeClose(ws1);
+        safeClose(ws2);
+        if (sessionId !== undefined) {
+          try {
+            mgr.kill(sessionId);
+          } catch {
+            /* already gone */
+          }
+        }
+        await closeServer(server);
+      }
+    },
+    TEST_TIMEOUT_MS,
+  );
+});
diff --git a/tests/api/terminal/server-routes.test.ts b/tests/api/terminal/server-routes.test.ts
new file mode 100644
index 000000000..7b2e93c22
--- /dev/null
+++ b/tests/api/terminal/server-routes.test.ts
@@ -0,0 +1,212 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  createHttpServer,
+  type HttpApi,
+} from '../../../src/api/server.js';
+import type {
+  SessionBackend,
+  BackendHandle,
+} from '../../../src/api/terminal/session-backend.js';
+
+/**
+ * Sprint 175 Task W2.2 — HTTP control + localhost bootstrap inject.
+ *
+ * Verifies:
+ *  - POST /api/terminal/sessions creates (201) + GET lists + DELETE removes (200)
+ *  - api.terminalToken is exposed for tests (no env var coupling)
+ *  - terminal token is auto-generated even when API auth is disabled (spec §1c.2)
+ *  - localhost-only index.html bootstrap script injection (127.0.0.1 / ::1)
+ *
+ * Test injects a fake SessionBackend so node-pty native binary is NOT required
+ * (CI compatibility — session-backend's own integration test covers real PTY).
+ */
+
+// ─── fakeBackend: no real PTY, no native binding ────────────────────
+function fakeBackend(): SessionBackend {
+  const handle: BackendHandle = {
+    write: vi.fn(),
+    resize: vi.fn(),
+    kill: vi.fn(),
+  };
+  return {
+    spawn: (_spec, _onData, _onExit) => handle,
+  };
+}
+
+let tmpRoot: string;
+let api: HttpApi | undefined;
+
+beforeEach(() => {
+  // Clean DECKENT_* env so resolveAuthToken / DECKENT_API_AUTH_DISABLED
+  // do not bleed across tests.
+  delete process.env['DECKENT_API_TOKEN'];
+  delete process.env['DECKENT_API_AUTH_DISABLED'];
+
+  tmpRoot = mkdtempSync(join(tmpdir(), 'deckent-server-routes-'));
+});
+
+afterEach(async () => {
+  if (api) {
+    await api.close();
+    api = undefined;
+  }
+  rmSync(tmpRoot, { recursive: true, force: true });
+});
+
+async function port(a: HttpApi): Promise<number> {
+  if (!a.server.listening) {
+    await new Promise<void>((resolve, reject) => {
+      a.server.once('listening', () => resolve());
+      a.server.once('error', reject);
+    });
+  }
+  const addr = a.server.address();
+  if (addr === null || typeof addr === 'string') {
+    throw new Error('server address unavailable');
+  }
+  return addr.port;
+}
+
+describe('terminal HTTP control routes', () => {
+  it('POST /api/terminal/sessions → 201; GET lists; DELETE → 200', async () => {
+    api = createHttpServer(tmpRoot, {
+      port: 0,
+      autoGenerateToken: true,
+      terminalBackend: fakeBackend(),
+    });
+    expect(api.terminalToken).toBeDefined();
+    expect(typeof api.terminalToken).toBe('string');
+    expect(api.terminalToken!.length).toBeGreaterThan(8);
+
+    const base = `http://127.0.0.1:${await port(api)}`;
+    const tok = api.terminalToken!;
+    const headers = { Authorization: `Bearer ${tok}` };
+
+    // Create
+    const createRes = await fetch(`${base}/api/terminal/sessions`, {
+      method: 'POST',
+      headers: { ...headers, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ kind: 'shell' }),
+    });
+    expect(createRes.status).toBe(201);
+    const created = (await createRes.json()) as { id: string; kind: string };
+    expect(created.id).toMatch(/[0-9a-f-]/i);
+    expect(created.kind).toBe('shell');
+
+    // List
+    const listRes = await fetch(`${base}/api/terminal/sessions`, { headers });
+    expect(listRes.status).toBe(200);
+    const list = (await listRes.json()) as Array<{ id: string }>;
+    expect(list.some((s) => s.id === created.id)).toBe(true);
+
+    // Delete
+    const delRes = await fetch(`${base}/api/terminal/sessions/${created.id}`, {
+      method: 'DELETE',
+      headers,
+    });
+    expect(delRes.status).toBe(200);
+
+    // After delete, list no longer includes it
+    const list2Res = await fetch(`${base}/api/terminal/sessions`, { headers });
+    const list2 = (await list2Res.json()) as Array<{ id: string }>;
+    expect(list2.some((s) => s.id === created.id)).toBe(false);
+  });
+
+  it('terminal token is generated even when API auth is disabled (spec §1c.2)', async () => {
+    // Simulate read-only dashboard dev bypass — API auth disabled,
+    // but terminal MUST still mint its own token.
+    process.env['DECKENT_API_AUTH_DISABLED'] = '1';
+    api = createHttpServer(tmpRoot, {
+      port: 0,
+      // No autoGenerateToken → no API token; terminal must still mint one
+      terminalBackend: fakeBackend(),
+    });
+    expect(api.terminalToken).toBeDefined();
+    expect(api.terminalToken!.length).toBeGreaterThan(8);
+  });
+
+  it('disables terminal routes when cfg.terminal.enabled === false', async () => {
+    // Write project config disabling terminal
+    mkdirSync(join(tmpRoot, '.deckent'), { recursive: true });
+    writeFileSync(
+      join(tmpRoot, '.deckent', 'config.json'),
+      JSON.stringify({ terminal: { enabled: false } }),
+      'utf-8',
+    );
+
+    api = createHttpServer(tmpRoot, {
+      port: 0,
+      autoGenerateToken: true,
+      terminalBackend: fakeBackend(),
+    });
+    expect(api.terminalToken).toBeUndefined();
+
+    const base = `http://127.0.0.1:${await port(api)}`;
+    const tok = (api as unknown as { _apiToken?: string })._apiToken;
+    // Use a header that satisfies the bearer middleware via env var lookup,
+    // or just expect 404 regardless of auth status by hitting a known-non-route.
+    const res = await fetch(`${base}/api/terminal/sessions`, {
+      headers: tok ? { Authorization: `Bearer ${tok}` } : {},
+    });
+    // Terminal disabled → routes are not registered → 401 (auth fail) or 404.
+    expect([401, 403, 404]).toContain(res.status);
+  });
+});
+
+describe('localhost-only bootstrap token injection', () => {
+  function makeStaticDir(html: string): string {
+    const staticDir = join(tmpRoot, 'static');
+    mkdirSync(staticDir, { recursive: true });
+    writeFileSync(join(staticDir, 'index.html'), html, 'utf-8');
+    return staticDir;
+  }
+
+  it('injects window.__DECKENT_TERMINAL_TOKEN__ into index.html for 127.0.0.1', async () => {
+    const html = '<!DOCTYPE html><html><head><title>x</title></head><body></body></html>';
+    const staticDir = makeStaticDir(html);
+    api = createHttpServer(tmpRoot, {
+      port: 0,
+      staticDir,
+      autoGenerateToken: true,
+      terminalBackend: fakeBackend(),
+    });
+    expect(api.terminalToken).toBeDefined();
+
+    const res = await fetch(`http://127.0.0.1:${await port(api)}/`);
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    // Token injected before </head>
+    expect(body).toContain('window.__DECKENT_TERMINAL_TOKEN__');
+    expect(body).toContain(JSON.stringify(api.terminalToken));
+    // Order: script comes BEFORE </head>, not after
+    const tokenIdx = body.indexOf('__DECKENT_TERMINAL_TOKEN__');
+    const headEndIdx = body.indexOf('</head>');
+    expect(tokenIdx).toBeGreaterThan(-1);
+    expect(headEndIdx).toBeGreaterThan(-1);
+    expect(tokenIdx).toBeLessThan(headEndIdx);
+  });
+
+  it('does NOT inject when terminal is disabled', async () => {
+    mkdirSync(join(tmpRoot, '.deckent'), { recursive: true });
+    writeFileSync(
+      join(tmpRoot, '.deckent', 'config.json'),
+      JSON.stringify({ terminal: { enabled: false } }),
+      'utf-8',
+    );
+    const html = '<!DOCTYPE html><html><head><title>x</title></head><body></body></html>';
+    const staticDir = makeStaticDir(html);
+    api = createHttpServer(tmpRoot, {
+      port: 0,
+      staticDir,
+      autoGenerateToken: true,
+      terminalBackend: fakeBackend(),
+    });
+
+    const res = await fetch(`http://127.0.0.1:${await port(api)}/`);
+    const body = await res.text();
+    expect(body).not.toContain('__DECKENT_TERMINAL_TOKEN__');
+  });
+});
diff --git a/tests/api/terminal/session-backend.test.ts b/tests/api/terminal/session-backend.test.ts
new file mode 100644
index 000000000..565dc333d
--- /dev/null
+++ b/tests/api/terminal/session-backend.test.ts
@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { LocalPtyBackend } from '../../../src/api/terminal/session-backend.js';
+
+describe('LocalPtyBackend', () => {
+  it('spawns a process, streams output, and reports exit', async () => {
+    const be = new LocalPtyBackend();
+    const chunks: string[] = [];
+    let exitCode: number | undefined;
+    const h = be.spawn(
+      { file: 'bash', args: ['-c', 'echo hello-pty'], cwd: process.cwd() },
+      (d) => chunks.push(d),
+      (code) => {
+        exitCode = code;
+      },
+    );
+    await new Promise<void>((r) => {
+      const t = setInterval(() => {
+        if (exitCode !== undefined) {
+          clearInterval(t);
+          r();
+        }
+      }, 20);
+    });
+    expect(chunks.join('')).toContain('hello-pty');
+    expect(exitCode).toBe(0);
+    h.kill();
+  });
+});
diff --git a/tests/api/terminal/session-manager.test.ts b/tests/api/terminal/session-manager.test.ts
new file mode 100644
index 000000000..b298d47f0
--- /dev/null
+++ b/tests/api/terminal/session-manager.test.ts
@@ -0,0 +1,57 @@
+import { describe, it, expect, vi } from 'vitest';
+import { PtySessionManager } from '../../../src/api/terminal/session-manager.js';
+import type { SessionBackend, BackendHandle } from '../../../src/api/terminal/session-backend.js';
+
+function fakeBackend() {
+  let onDataCb: (d: string) => void = () => {};
+  let onExitCb: (c: number) => void = () => {};
+  const handle: BackendHandle = { write: vi.fn(), resize: vi.fn(), kill: vi.fn() };
+  const be: SessionBackend = {
+    spawn: (_s, onData, onExit) => {
+      onDataCb = onData;
+      onExitCb = onExit;
+      return handle;
+    },
+  };
+  return { be, handle, emit: (d: string) => onDataCb(d), exit: (c: number) => onExitCb(c) };
+}
+
+describe('PtySessionManager', () => {
+  it('creates a session and buffers output (bounded ring)', () => {
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 8, idleTimeoutMs: 0 });
+    const s = m.create({ kind: 'shell' });
+    f.emit('ABCDEFGHIJ'); // 10 bytes into an 8-byte ring
+    expect(m.replay(s.id)).toBe('CDEFGHIJ'); // last 8 bytes only
+  });
+
+  it('detach does NOT kill; kill is explicit', () => {
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 1024, idleTimeoutMs: 0 });
+    const s = m.create({ kind: 'shell' });
+    m.detach(s.id);
+    expect(f.handle.kill).not.toHaveBeenCalled();
+    m.kill(s.id);
+    expect(f.handle.kill).toHaveBeenCalledOnce();
+  });
+
+  it('enforces maxSessions', () => {
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 16, idleTimeoutMs: 0, maxSessions: 1 });
+    m.create({ kind: 'shell' });
+    expect(() => m.create({ kind: 'shell' })).toThrow(/max/i);
+  });
+
+  it('idle reaper kills idle shell but exempts deckent kind', () => {
+    vi.useFakeTimers();
+    const f = fakeBackend();
+    const m = new PtySessionManager(f.be, { scrollbackBytes: 16, idleTimeoutMs: 1000 });
+    const shell = m.create({ kind: 'shell' });
+    const dk = m.create({ kind: 'deckent' });
+    vi.advanceTimersByTime(1500);
+    m.reapIdle();
+    expect(m.get(shell.id)).toBeUndefined();
+    expect(m.get(dk.id)).toBeDefined();
+    vi.useRealTimers();
+  });
+});
diff --git a/tests/api/terminal/ws-gateway.test.ts b/tests/api/terminal/ws-gateway.test.ts
new file mode 100644
index 000000000..14d2c1a4d
--- /dev/null
+++ b/tests/api/terminal/ws-gateway.test.ts
@@ -0,0 +1,130 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { createServer, type Server } from 'node:http';
+import { WebSocket } from 'ws';
+import { attachTerminalGateway } from '../../../src/api/terminal/ws-gateway.js';
+import { PtySessionManager } from '../../../src/api/terminal/session-manager.js';
+import type { SessionBackend, BackendHandle, SpawnSpec } from '../../../src/api/terminal/session-backend.js';
+import { LocalTokenAuthProvider } from '../../../src/api/terminal/auth-provider.js';
+
+class FakeBackend implements SessionBackend {
+  public spawned: SpawnSpec[] = [];
+  public handles: BackendHandle[] = [];
+  public lastOnData: ((d: string) => void) | undefined;
+  spawn(spec: SpawnSpec, onData: (d: string) => void, _onExit: (code: number) => void): BackendHandle {
+    this.spawned.push(spec);
+    this.lastOnData = onData;
+    const handle: BackendHandle = {
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+    };
+    this.handles.push(handle);
+    return handle;
+  }
+}
+
+interface Setup {
+  server: Server;
+  mgr: PtySessionManager;
+  backend: FakeBackend;
+  audit: { record: ReturnType<typeof vi.fn> };
+  port: number;
+}
+
+async function setup(token: string): Promise<Setup> {
+  const backend = new FakeBackend();
+  const mgr = new PtySessionManager(backend, { scrollbackBytes: 65536, idleTimeoutMs: 0 });
+  const audit = { record: vi.fn() };
+  const server = createServer();
+  attachTerminalGateway(server, {
+    manager: mgr,
+    auth: new LocalTokenAuthProvider(token),
+    audit,
+  });
+  await new Promise<void>((r) => server.listen(0, '127.0.0.1', () => r()));
+  const port = (server.address() as { port: number }).port;
+  return { server, mgr, backend, audit, port };
+}
+
+function closeServer(server: Server): Promise<void> {
+  return new Promise((res) => server.close(() => res()));
+}
+
+const ctx: { server?: Server } = {};
+
+afterEach(async () => {
+  if (ctx.server) {
+    await closeServer(ctx.server);
+    ctx.server = undefined;
+  }
+});
+
+describe('terminal ws gateway', () => {
+  it('rejects upgrade with invalid subprotocol token — no session spawned', async () => {
+    const s = await setup('good');
+    ctx.server = s.server;
+
+    const ws = new WebSocket(`ws://127.0.0.1:${s.port}/api/terminal/ws`, ['deckent.bad']);
+    const closed = await new Promise<number>((res) => {
+      ws.on('close', (code) => res(code));
+      ws.on('error', () => res(-1)); // tolerate transport-level error to keep test deterministic
+    });
+
+    expect(closed).toBe(4401);
+    // Security invariant: no session was created on the manager
+    expect(s.backend.spawned.length).toBe(0);
+    expect(s.mgr.list().length).toBe(0);
+    // auth.deny recorded; auth.ok NOT recorded
+    const actions = s.audit.record.mock.calls.map((c) => (c[0] as { action: string }).action);
+    expect(actions).toContain('auth.deny');
+    expect(actions).not.toContain('auth.ok');
+  });
+
+  it('accepts valid token, attaches a session, replays buffer + streams output', async () => {
+    const s = await setup('good');
+    ctx.server = s.server;
+
+    // pre-seed a session with some buffered output
+    const meta = s.mgr.create({ kind: 'shell' });
+    // simulate prior PTY output that should be replayed on attach
+    s.backend.lastOnData?.('hello-prior\n');
+
+    const ws = new WebSocket(`ws://127.0.0.1:${s.port}/api/terminal/ws`, ['deckent.good']);
+    await new Promise<void>((res, rej) => {
+      ws.on('open', () => res());
+      ws.on('error', (e) => rej(e));
+    });
+
+    // collect first two frames after attach (expect replay + new output)
+    const frames: string[] = [];
+    const got = new Promise<string[]>((res) => {
+      ws.on('message', (m) => {
+        frames.push(m.toString());
+        if (frames.length >= 2) res(frames.slice());
+      });
+    });
+
+    ws.send(JSON.stringify({ t: 'attach', sessionId: meta.id }));
+    // drive a live output through the backend to ensure attach listener fires
+    await new Promise((r) => setTimeout(r, 20));
+    s.backend.lastOnData?.('live-output\n');
+
+    const collected = await got;
+    // first frame after attach should be the replay buffer
+    const replay = JSON.parse(collected[0]) as { t: string; data: string };
+    expect(replay.t).toBe('output');
+    expect(replay.data).toContain('hello-prior');
+    // second frame should be the live output streamed through the bridge
+    const live = JSON.parse(collected[1]) as { t: string; data: string };
+    expect(live.t).toBe('output');
+    expect(live.data).toContain('live-output');
+
+    // audit ok recorded, session.attach recorded
+    const actions = s.audit.record.mock.calls.map((c) => (c[0] as { action: string }).action);
+    expect(actions).toContain('auth.ok');
+    expect(actions).toContain('session.attach');
+
+    ws.close();
+    await new Promise((r) => setTimeout(r, 20));
+  });
+});
diff --git a/tests/cli/bin-entry-validation.test.ts b/tests/cli/bin-entry-validation.test.ts
index a8c9c1295..402db061d 100644
--- a/tests/cli/bin-entry-validation.test.ts
+++ b/tests/cli/bin-entry-validation.test.ts
@@ -32,9 +32,9 @@ describe('bin entry — package.json validation', () => {
     expect(pkg['type']).toBe('module');
   });
 
-  it('engines.node is >= 18 (matches entry.ts runtime guard)', () => {
+  it('engines.node is >= 24 (Active LTS — Node 18/20/22 EOL by May 2026)', () => {
     const engines = pkg['engines'] as Record<string, string>;
-    expect(engines['node']).toMatch(/^>=\s*18/);
+    expect(engines['node']).toMatch(/^>=\s*24/);
   });
 
   it('files array contains dist so bin target is published', () => {
@@ -77,8 +77,8 @@ describe('bin entry — src/cli/entry.ts source validation', () => {
     expect(source).toContain("'SIGTERM'");
   });
 
-  it('has Node version guard requiring >= 18', () => {
-    expect(source).toContain('< 18');
+  it('has Node version guard requiring >= 24 (Active LTS)', () => {
+    expect(source).toContain('< 24');
   });
 
   it('imports handleCliError from helpers/process', () => {
diff --git a/tests/cli/commands/serve-overhaul.test.ts b/tests/cli/commands/serve-overhaul.test.ts
index 61415ef21..4948d97f7 100644
--- a/tests/cli/commands/serve-overhaul.test.ts
+++ b/tests/cli/commands/serve-overhaul.test.ts
@@ -123,7 +123,16 @@ describe('serve command — registerServe', () => {
     registerServe(program);
     const cmd = program.commands.find(c => c.name() === 'serve')!;
     await cmd.parseAsync([], { from: 'user' });
-    expect(createHttpServer).toHaveBeenCalledWith('/test/project', 3100);
+    // serve wires the bundled dashboard staticDir, host, and terminalBackend
+    // through an opts object (Sprint 175 W2.3 added the embedded terminal +
+    // host binding; createHttpServer signature became (root, opts)).
+    expect(createHttpServer).toHaveBeenCalledWith(
+      '/test/project',
+      expect.objectContaining({
+        port: 3100,
+        staticDir: expect.stringContaining('dashboard'),
+      }),
+    );
   });
 
   it('rejects invalid port', async () => {
diff --git a/tests/cli/dashboard-dir.test.ts b/tests/cli/dashboard-dir.test.ts
new file mode 100644
index 000000000..e4cd5e07b
--- /dev/null
+++ b/tests/cli/dashboard-dir.test.ts
@@ -0,0 +1,22 @@
+import { describe, it, expect } from 'vitest';
+
+import { dashboardDirFromModuleUrl } from '../../src/cli/helpers/dashboard-dir.js';
+
+// The dashboard is built to <pkg>/dist/dashboard (vite --outDir ../../dist/dashboard).
+// This helper lives at <pkg>/dist/cli/helpers/dashboard-dir.js at runtime, so it
+// must resolve ../../dashboard relative to its own module URL — correct both in
+// the repo and in an installed npm package (where `root` = user's project ≠ pkg).
+
+describe('dashboardDirFromModuleUrl', () => {
+  it('resolves to the package dist/dashboard from a dist/cli/helpers module url', () => {
+    const out = dashboardDirFromModuleUrl('file:///opt/app/dist/cli/helpers/dashboard-dir.js');
+    expect(out).toBe('/opt/app/dist/dashboard');
+  });
+
+  it('is independent of the user project cwd (installed-package safe)', () => {
+    const out = dashboardDirFromModuleUrl(
+      'file:///home/u/.npm/_npx/abc/node_modules/deckent/dist/cli/helpers/dashboard-dir.js',
+    );
+    expect(out).toBe('/home/u/.npm/_npx/abc/node_modules/deckent/dist/dashboard');
+  });
+});
diff --git a/tests/cli/npx-compat.test.ts b/tests/cli/npx-compat.test.ts
index 65dc7cb95..43174d769 100644
--- a/tests/cli/npx-compat.test.ts
+++ b/tests/cli/npx-compat.test.ts
@@ -44,9 +44,9 @@ describe('npx deckent compatibility', () => {
     expect(pkg.type).toBe('module');
   });
 
-  it('package.json engines requires node >= 18', () => {
+  it('package.json engines requires node >= 24 (Active LTS)', () => {
     const pkg = JSON.parse(readFileSync(join(PROJECT_ROOT, 'package.json'), 'utf-8'));
-    expect(pkg.engines.node).toMatch(/>=\s*18/);
+    expect(pkg.engines.node).toMatch(/>=\s*24/);
   });
 
   it('package.json files includes dist', () => {
diff --git a/tests/cli/serve-terminal.test.ts b/tests/cli/serve-terminal.test.ts
new file mode 100644
index 000000000..434030552
--- /dev/null
+++ b/tests/cli/serve-terminal.test.ts
@@ -0,0 +1,80 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { Command } from 'commander';
+
+// ─── Mocks ──────────────────────────────────────────────────────────
+const mockClose = vi.fn().mockResolvedValue(undefined);
+const mockCreateHttpServer = vi.fn(() => ({ close: mockClose }));
+
+vi.mock('../../src/api/server.js', () => ({
+  createHttpServer: (...args: unknown[]) => mockCreateHttpServer(...args),
+}));
+
+vi.mock('../../src/cli/helpers/process.js', () => ({
+  resolveProjectRoot: vi.fn(() => '/tmp/test-project'),
+}));
+
+vi.mock('../../src/cli/helpers/output.js', () => ({
+  print: vi.fn(),
+  printError: vi.fn(),
+}));
+
+vi.mock('../../src/cli/helpers/dashboard-dir.js', () => ({
+  getDashboardStaticDir: vi.fn(() => '/fake/dashboard/dist'),
+}));
+
+import { registerServe } from '../../src/cli/commands/serve.js';
+
+// ─── Tests ──────────────────────────────────────────────────────────
+describe('serve CLI terminal options', () => {
+  it('exposes --host and --no-terminal', () => {
+    const program = new Command();
+    registerServe(program);
+    const serve = program.commands.find((c) => c.name() === 'serve')!;
+    const opts = serve.options.map((o) => o.long);
+    expect(opts).toContain('--host');
+    expect(opts).toContain('--no-terminal');
+  });
+
+  describe('non-localhost host', () => {
+    let program: Command;
+    const savedSigint: NodeJS.SignalsListener[] = [];
+    const savedSigterm: NodeJS.SignalsListener[] = [];
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      savedSigint.splice(0, savedSigint.length, ...(process.listeners('SIGINT') as NodeJS.SignalsListener[]));
+      savedSigterm.splice(0, savedSigterm.length, ...(process.listeners('SIGTERM') as NodeJS.SignalsListener[]));
+      program = new Command();
+      program.exitOverride();
+      registerServe(program);
+    });
+
+    afterEach(() => {
+      for (const l of process.listeners('SIGINT') as NodeJS.SignalsListener[]) {
+        if (!savedSigint.includes(l)) process.removeListener('SIGINT', l);
+      }
+      for (const l of process.listeners('SIGTERM') as NodeJS.SignalsListener[]) {
+        if (!savedSigterm.includes(l)) process.removeListener('SIGTERM', l);
+      }
+    });
+
+    it('warns via stderr when host is non-localhost and terminal is not explicitly disabled', async () => {
+      const stderrSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+      await program.parseAsync(['node', 'test', 'serve', '--host', '0.0.0.0']);
+      expect(stderrSpy).toHaveBeenCalledWith(
+        expect.stringContaining('terminal disabled'),
+      );
+      stderrSpy.mockRestore();
+    });
+
+    it('does not warn when --no-terminal is explicitly set with non-localhost host', async () => {
+      const stderrSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+      await program.parseAsync(['node', 'test', 'serve', '--host', '0.0.0.0', '--no-terminal']);
+      const terminalWarningCalls = stderrSpy.mock.calls.filter(([msg]) =>
+        typeof msg === 'string' && msg.includes('terminal disabled'),
+      );
+      expect(terminalWarningCalls).toHaveLength(0);
+      stderrSpy.mockRestore();
+    });
+  });
+});
diff --git a/tests/cli/serve.test.ts b/tests/cli/serve.test.ts
index a0a5ed226..5967c8ffd 100644
--- a/tests/cli/serve.test.ts
+++ b/tests/cli/serve.test.ts
@@ -63,15 +63,29 @@ describe('registerServe', () => {
 
   it('starts server with default port', async () => {
     await program.parseAsync(['node', 'test', 'serve']);
-    expect(mockCreateHttpServer).toHaveBeenCalledWith('/tmp/test-project', 3100);
+    // Sprint 175 W2.3: createHttpServer signature became (root, opts) with
+    // host + terminalBackend wired through. Default host is 127.0.0.1.
+    expect(mockCreateHttpServer).toHaveBeenCalledWith(
+      '/tmp/test-project',
+      expect.objectContaining({
+        port: 3100,
+        staticDir: expect.stringContaining('dashboard'),
+      }),
+    );
     expect(vi.mocked(print)).toHaveBeenCalledWith(
-      expect.stringContaining('listening on http://localhost:3100'),
+      expect.stringContaining('listening on http://127.0.0.1:3100'),
     );
   });
 
   it('starts server with custom port', async () => {
     await program.parseAsync(['node', 'test', 'serve', '--port', '4000']);
-    expect(mockCreateHttpServer).toHaveBeenCalledWith('/tmp/test-project', 4000);
+    expect(mockCreateHttpServer).toHaveBeenCalledWith(
+      '/tmp/test-project',
+      expect.objectContaining({
+        port: 4000,
+        staticDir: expect.stringContaining('dashboard'),
+      }),
+    );
   });
 
   it('registers SIGINT and SIGTERM handlers', async () => {
diff --git a/tests/cli/web.test.ts b/tests/cli/web.test.ts
index 01c7574d8..c827193ed 100644
--- a/tests/cli/web.test.ts
+++ b/tests/cli/web.test.ts
@@ -65,7 +65,7 @@ describe('registerWeb', () => {
     expect(mockCreateHttpServer).toHaveBeenCalledWith(
       '/tmp/test-project',
       3100,
-      expect.stringContaining('src/dashboard/dist'),
+      expect.stringContaining('dashboard'),
     );
     expect(vi.mocked(print)).toHaveBeenCalledWith(
       expect.stringContaining('Deckent Web Dashboard on http://localhost:3100'),
@@ -77,7 +77,7 @@ describe('registerWeb', () => {
     expect(mockCreateHttpServer).toHaveBeenCalledWith(
       '/tmp/test-project',
       4000,
-      expect.stringContaining('src/dashboard/dist'),
+      expect.stringContaining('dashboard'),
     );
     expect(vi.mocked(print)).toHaveBeenCalledWith(
       expect.stringContaining('http://localhost:4000'),
@@ -103,7 +103,8 @@ describe('registerWeb', () => {
   it('passes staticDir in production mode', async () => {
     await program.parseAsync(['node', 'test', 'web']);
     const callArgs = mockCreateHttpServer.mock.calls[0]!;
-    expect(callArgs[2]).toContain('src/dashboard/dist');
+    // Bundled dashboard dir (built: dist/dashboard; source/test: src/dashboard).
+    expect(callArgs[2]).toContain('dashboard');
   });
 
   it('registers SIGINT and SIGTERM handlers', async () => {
diff --git a/tests/core/config-terminal.test.ts b/tests/core/config-terminal.test.ts
new file mode 100644
index 000000000..e826bb538
--- /dev/null
+++ b/tests/core/config-terminal.test.ts
@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest';
+import {
+  createDefaultConfig,
+  mergeConfigs,
+  loadConfig,
+  DEFAULT_TERMINAL_CONFIG,
+} from '../../src/core/config.js';
+import type { DeckentConfig, ResolvedConfig, TerminalConfig } from '../../src/core/types.js';
+
+/**
+ * Sprint 175 Task W0.3 — TerminalConfig contract.
+ * Locks the secure defaults for the embedded web terminal and the
+ * per-key project override merge (mirrors model_strategy nested merge).
+ *
+ * ResolvedConfig.terminal is typed optional (matching the
+ * model_strategy?: ModelStrategy pattern) but is always populated at
+ * runtime by loadConfig/mergeConfigs from DEFAULT_TERMINAL_CONFIG.
+ * Tests use non-null assertion to assert the runtime guarantee.
+ */
+describe('terminal config', () => {
+  it('createDefaultConfig() provides secure terminal defaults', () => {
+    const cfg = createDefaultConfig();
+    expect(cfg.terminal).toBeDefined();
+    const terminal = cfg.terminal!;
+    expect(terminal.enabled).toBe(true);
+    expect(terminal.bind).toBe('127.0.0.1');
+    expect(terminal.allowShellKind).toBe(true);
+    expect(terminal.maxSessions).toBe(10);
+    expect(terminal.idleTimeoutMs).toBe(1_800_000);
+    expect(terminal.scrollbackBytes).toBe(262_144);
+  });
+
+  it('DEFAULT_TERMINAL_CONFIG exposes the canonical secure defaults', () => {
+    const expected: TerminalConfig = {
+      enabled: true,
+      bind: '127.0.0.1',
+      maxSessions: 10,
+      idleTimeoutMs: 1_800_000,
+      scrollbackBytes: 262_144,
+      allowShellKind: true,
+    };
+    expect(DEFAULT_TERMINAL_CONFIG).toEqual(expected);
+  });
+
+  it('loadConfig() exposes terminal defaults on ResolvedConfig', async () => {
+    const cfg = await loadConfig(process.cwd(), { force: true });
+    expect(cfg.terminal).toBeDefined();
+    const terminal = cfg.terminal!;
+    expect(terminal.enabled).toBe(true);
+    expect(terminal.bind).toBe('127.0.0.1');
+    expect(terminal.allowShellKind).toBe(true);
+    expect(terminal.maxSessions).toBe(10);
+    expect(terminal.idleTimeoutMs).toBe(1_800_000);
+    expect(terminal.scrollbackBytes).toBe(262_144);
+  });
+
+  it('mergeConfigs() applies project overrides per-key (nested merge)', () => {
+    const override: Partial<DeckentConfig> = {
+      terminal: {
+        // Partial override — only two keys touched; the rest must fall back to defaults.
+        // Cast through Partial because DeckentConfig.terminal is the full interface;
+        // deepMerge handles partial nested writes the same way as model_strategy.
+        maxSessions: 25,
+        bind: '0.0.0.0',
+      } as DeckentConfig['terminal'],
+    };
+    const resolved = mergeConfigs(null, override) as ResolvedConfig;
+    expect(resolved.terminal).toBeDefined();
+    const terminal = resolved.terminal!;
+    // Overridden keys win
+    expect(terminal.maxSessions).toBe(25);
+    expect(terminal.bind).toBe('0.0.0.0');
+    // Unspecified keys inherit defaults
+    expect(terminal.enabled).toBe(true);
+    expect(terminal.allowShellKind).toBe(true);
+    expect(terminal.idleTimeoutMs).toBe(1_800_000);
+    expect(terminal.scrollbackBytes).toBe(262_144);
+  });
+
+  it('mergeConfigs(null, null) preserves all default terminal values', () => {
+    const resolved = mergeConfigs(null, null) as ResolvedConfig;
+    expect(resolved.terminal).toEqual(DEFAULT_TERMINAL_CONFIG);
+  });
+});
diff --git a/tests/core/nervous-enabled-integration.test.ts b/tests/core/nervous-enabled-integration.test.ts
index 5ea9e84ea..94097c813 100644
--- a/tests/core/nervous-enabled-integration.test.ts
+++ b/tests/core/nervous-enabled-integration.test.ts
@@ -4,17 +4,21 @@
 // and that new-project defaults remain safely disabled.
 
 import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDefaultConfig } from '../../src/core/config.js';
 
 // ─── Test 1: .deckent/config.json loads with enabled=true ──────────────────
 
 describe('nervous_system enabled=true pivot (Sprint 148 T-006)', () => {
-  it('project config .deckent/config.json has nervous_system.enabled === true', () => {
-    // Load the project config directly — simulates what loadConfig() does
-    const projectRoot = join(process.cwd());
-    const configPath = join(projectRoot, '.deckent', 'config.json');
+  // PR #16 made .deckent/config.json gitignored (it's a runtime file, not
+  // a tracked fixture). Skip the dogfood assertion when the file is absent
+  // (clean checkout / CI without a deckent init).
+  const projectRoot = join(process.cwd());
+  const configPath = join(projectRoot, '.deckent', 'config.json');
+  const hasProjectConfig = existsSync(configPath);
+
+  it.skipIf(!hasProjectConfig)('project config .deckent/config.json has nervous_system.enabled === true', () => {
     const raw = readFileSync(configPath, 'utf-8');
     const projectConfig = JSON.parse(raw) as { nervous_system?: { enabled?: boolean; mode?: string } };
 
diff --git a/tests/core/provisioner.test.ts b/tests/core/provisioner.test.ts
new file mode 100644
index 000000000..7fa8c0725
--- /dev/null
+++ b/tests/core/provisioner.test.ts
@@ -0,0 +1,247 @@
+import { describe, it, expect, vi } from 'vitest';
+
+import {
+  planInstall,
+  installTool,
+  provisionMissing,
+  resolveProvisionMode,
+  collectMissingTools,
+  PROVISIONER_BIN_WHITELIST,
+  type InstallPlan,
+  type InstallResult,
+  type SpawnFn,
+} from '../../src/core/provisioner.js';
+
+// ─── planInstall — deterministic, OS-aware mapping ───────────────────────
+
+describe('planInstall', () => {
+  it('maps claude CLI to npm-global install', () => {
+    const plan = planInstall('claude');
+    expect(plan).toMatchObject<Partial<InstallPlan>>({
+      tool: 'claude',
+      method: 'npm-global',
+      command: 'npm',
+      args: ['install', '-g', '@anthropic-ai/claude-code'],
+    });
+    expect(plan.instruction).toContain('@anthropic-ai/claude-code');
+  });
+
+  it('maps codex CLI to npm-global install', () => {
+    expect(planInstall('codex')).toMatchObject({
+      tool: 'codex',
+      method: 'npm-global',
+      command: 'npm',
+      args: ['install', '-g', '@openai/codex'],
+    });
+  });
+
+  it('maps gemini CLI to npm-global install', () => {
+    expect(planInstall('gemini')).toMatchObject({
+      tool: 'gemini',
+      method: 'npm-global',
+      command: 'npm',
+      args: ['install', '-g', '@google/gemini-cli'],
+    });
+  });
+
+  it('plans tmux via apt on Debian/Ubuntu linux (pkg manager hint)', () => {
+    const plan = planInstall('tmux', { platform: 'linux', linuxPkgManager: 'apt' });
+    expect(plan.tool).toBe('tmux');
+    expect(plan.method).toBe('os-package');
+    expect(plan.instruction).toContain('tmux');
+    // sudo OS-package install is surfaced as an instruction the user runs,
+    // never auto-executed silently.
+    expect(plan.instruction).toMatch(/apt(-get)?/);
+  });
+
+  it('plans tmux via brew on macOS', () => {
+    const plan = planInstall('tmux', { platform: 'darwin' });
+    expect(plan.method).toBe('os-package');
+    expect(plan.instruction).toContain('brew');
+  });
+
+  it('treats node as manual (never auto-installs a runtime)', () => {
+    const plan = planInstall('node');
+    expect(plan.method).toBe('manual');
+    expect(plan.instruction.toLowerCase()).toContain('node');
+  });
+
+  it('treats docker as manual (no safe silent auto-install)', () => {
+    const plan = planInstall('docker');
+    expect(plan.method).toBe('manual');
+    expect(plan.instruction).toMatch(/docker/i);
+  });
+});
+
+// ─── installTool — consent gate + injected spawn (no real install) ───────
+
+describe('installTool', () => {
+  it('does NOT spawn when consent is false (returns skipped/no-consent)', async () => {
+    const spawn = vi.fn();
+    const res = await installTool('claude', { consent: false, spawn: spawn as unknown as SpawnFn });
+    expect(spawn).not.toHaveBeenCalled();
+    expect(res).toEqual({ tool: 'claude', status: 'skipped', reason: 'no-consent' });
+  });
+
+  it('spawns npm with array args and shell:false when consent is true', async () => {
+    const spawn = vi.fn().mockReturnValue({ status: 0, stdout: '', stderr: '' });
+    const res = await installTool('claude', {
+      consent: true,
+      spawn: spawn as unknown as SpawnFn,
+      platform: 'linux',
+    });
+    expect(spawn).toHaveBeenCalledTimes(1);
+    const [cmd, args, opts] = spawn.mock.calls[0];
+    expect(cmd).toBe('npm');
+    expect(args).toEqual(['install', '-g', '@anthropic-ai/claude-code']);
+    expect(opts).toMatchObject({ shell: false });
+    expect(res).toEqual({ tool: 'claude', status: 'installed' });
+  });
+
+  it('manual-method tools are never spawned, returned as skipped/manual', async () => {
+    const spawn = vi.fn();
+    const res = await installTool('docker', { consent: true, spawn: spawn as unknown as SpawnFn });
+    expect(spawn).not.toHaveBeenCalled();
+    expect(res).toEqual({ tool: 'docker', status: 'skipped', reason: 'manual' });
+  });
+
+  it('reports failed (not throw) when spawn exits non-zero', async () => {
+    const spawn = vi.fn().mockReturnValue({ status: 1, stdout: '', stderr: 'EACCES' });
+    const res = await installTool('codex', {
+      consent: true,
+      spawn: spawn as unknown as SpawnFn,
+      platform: 'linux',
+    });
+    expect(res.tool).toBe('codex');
+    expect(res.status).toBe('failed');
+    if (res.status === 'failed') expect(res.error).toContain('EACCES');
+  });
+
+  it('rejects a command outside the provisioner whitelist (defense-in-depth)', () => {
+    expect(PROVISIONER_BIN_WHITELIST).toContain('npm');
+    expect(PROVISIONER_BIN_WHITELIST).not.toContain('sh');
+    expect(PROVISIONER_BIN_WHITELIST).not.toContain('bash');
+  });
+});
+
+// ─── provisionMissing — orchestration init.ts wires into ─────────────────
+
+describe('provisionMissing', () => {
+  it('no-install mode: never prompts, never installs, returns skipped', async () => {
+    const confirm = vi.fn();
+    const install = vi.fn();
+    const res = await provisionMissing({
+      missing: ['claude', 'tmux'],
+      mode: 'no-install',
+      confirm,
+      install,
+    });
+    expect(confirm).not.toHaveBeenCalled();
+    expect(install).not.toHaveBeenCalled();
+    expect(res.every(r => r.status === 'skipped')).toBe(true);
+  });
+
+  it('yes mode: installs npm tools without prompting', async () => {
+    const confirm = vi.fn();
+    const install = vi
+      .fn<(t: string) => Promise<InstallResult>>()
+      .mockImplementation(async t => ({ tool: t, status: 'installed' }) as InstallResult);
+    const res = await provisionMissing({
+      missing: ['claude', 'gemini'],
+      mode: 'yes',
+      confirm,
+      install: install as never,
+    });
+    expect(confirm).not.toHaveBeenCalled();
+    expect(install).toHaveBeenCalledTimes(2);
+    expect(res.map(r => r.status)).toEqual(['installed', 'installed']);
+  });
+
+  it('prompt mode: installs only consented tools, skips declined', async () => {
+    const confirm = vi
+      .fn<(t: string) => Promise<boolean>>()
+      .mockImplementation(async t => t === 'claude'); // yes to claude, no to codex
+    const install = vi
+      .fn<(t: string) => Promise<InstallResult>>()
+      .mockImplementation(async t => ({ tool: t, status: 'installed' }) as InstallResult);
+    const res = await provisionMissing({
+      missing: ['claude', 'codex'],
+      mode: 'prompt',
+      confirm: confirm as never,
+      install: install as never,
+    });
+    expect(confirm).toHaveBeenCalledTimes(2);
+    expect(install).toHaveBeenCalledTimes(1);
+    const claude = res.find(r => r.tool === 'claude');
+    const codex = res.find(r => r.tool === 'codex');
+    expect(claude?.status).toBe('installed');
+    expect(codex).toEqual({ tool: 'codex', status: 'skipped', reason: 'no-consent' });
+  });
+
+  it('empty missing list returns empty result', async () => {
+    const res = await provisionMissing({ missing: [], mode: 'prompt' });
+    expect(res).toEqual([]);
+  });
+});
+
+// ─── resolveProvisionMode — CLI flag → mode ──────────────────────────────
+
+describe('resolveProvisionMode', () => {
+  it('defaults to prompt', () => {
+    expect(resolveProvisionMode({})).toBe('prompt');
+  });
+  it('--yes → yes', () => {
+    expect(resolveProvisionMode({ yes: true })).toBe('yes');
+  });
+  it('--no-install → no-install', () => {
+    expect(resolveProvisionMode({ noInstall: true })).toBe('no-install');
+  });
+  it('--no-install wins over --yes (conservative)', () => {
+    expect(resolveProvisionMode({ yes: true, noInstall: true })).toBe('no-install');
+  });
+});
+
+// ─── collectMissingTools — provider + doctor → ToolId[] ──────────────────
+
+describe('collectMissingTools', () => {
+  it('returns provider CLIs that are unavailable', () => {
+    const missing = collectMissingTools(
+      [
+        { name: 'claude', available: false },
+        { name: 'codex', available: true },
+        { name: 'gemini', available: false },
+      ],
+      [],
+    );
+    expect(missing).toContain('claude');
+    expect(missing).toContain('gemini');
+    expect(missing).not.toContain('codex');
+  });
+
+  it('adds failed required doctor checks (tmux, node, docker) mapped to ToolId', () => {
+    const missing = collectMissingTools(
+      [],
+      [
+        { name: 'tmux', passed: false, required: true },
+        { name: 'Node.js', passed: false, required: true },
+        { name: 'Docker', passed: false, required: true },
+        { name: 'git', passed: false, required: true },
+      ],
+    );
+    expect(missing).toEqual(expect.arrayContaining(['tmux', 'node', 'docker']));
+    // git is not a provisionable ToolId
+    expect(missing).not.toContain('git');
+  });
+
+  it('skips passing checks and dedupes claude across provider+doctor', () => {
+    const missing = collectMissingTools(
+      [{ name: 'claude', available: false }],
+      [
+        { name: 'Claude CLI', passed: false, required: true },
+        { name: 'tmux', passed: true, required: true },
+      ],
+    );
+    expect(missing.filter(t => t === 'claude')).toHaveLength(1);
+    expect(missing).not.toContain('tmux');
+  });
+});
diff --git a/tests/dashboard/dashboard-build-smoke.test.ts b/tests/dashboard/dashboard-build-smoke.test.ts
index f5f24aa40..3fe33fce4 100644
--- a/tests/dashboard/dashboard-build-smoke.test.ts
+++ b/tests/dashboard/dashboard-build-smoke.test.ts
@@ -23,8 +23,14 @@ describe('dashboard build smoke', () => {
         scripts?: Record<string, string>;
       };
       const cmd = pkg.scripts?.['build:dashboard'] ?? '';
-      expect(cmd).toMatch(/vite build/);
-      expect(cmd).toMatch(/src\/dashboard/);
+      // build:dashboard may delegate to a wrapper script that internally calls vite build
+      const wrapsVite = cmd.includes('vite build') || cmd.includes('build-dashboard.mjs');
+      expect(wrapsVite).toBe(true);
+      // dashboard source is always src/dashboard — verify via script content or path reference
+      const scriptContent = cmd.includes('build-dashboard.mjs')
+        ? readFileSync(join(ROOT, 'scripts', 'build-dashboard.mjs'), 'utf-8')
+        : cmd;
+      expect(scriptContent).toMatch(/src[/\\]dashboard/);
     });
 
     it('build:all chains tsc and build:dashboard', () => {
diff --git a/tests/dashboard/dashboard-page.test.ts b/tests/dashboard/dashboard-page.test.ts
index 3aafb689e..1fd6f3637 100644
--- a/tests/dashboard/dashboard-page.test.ts
+++ b/tests/dashboard/dashboard-page.test.ts
@@ -206,7 +206,7 @@ describe("dashboard page — ConfigPage.tsx", () => {
     expect(content).toContain('max_fix_retries');
   });
 
-  it("CATEGORIES array has 13 categories", () => {
+  it("CATEGORIES array has 14 categories", () => {
     const content = readFileSync(filePath, "utf-8");
     const categoriesMatch = content.match(/const CATEGORIES\s*=\s*\[([\s\S]*?)\]\s*as\s*const/);
     expect(categoriesMatch).not.toBeNull();
@@ -214,7 +214,7 @@ describe("dashboard page — ConfigPage.tsx", () => {
     // Count quoted strings
     const categories = categoriesBlock.match(/"[^"]+"/g);
     expect(categories).not.toBeNull();
-    expect(categories!.length).toBe(13);
+    expect(categories!.length).toBe(14);
   });
 
   it("CATEGORIES includes all required category names", () => {
diff --git a/tests/dashboard/terminal/DockPanel.test.tsx b/tests/dashboard/terminal/DockPanel.test.tsx
new file mode 100644
index 000000000..d30073e3b
--- /dev/null
+++ b/tests/dashboard/terminal/DockPanel.test.tsx
@@ -0,0 +1,47 @@
+// @vitest-environment happy-dom
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+import { DockPanel } from '../../../src/dashboard/src/components/DockPanel';
+
+describe('DockPanel', () => {
+  it('starts collapsed and toggles open via the terminal toggle button', () => {
+    render(
+      <DockPanel>
+        <div>PANELBODY</div>
+      </DockPanel>,
+    );
+
+    expect(screen.queryByText('PANELBODY')).not.toBeVisible();
+
+    fireEvent.click(screen.getByRole('button', { name: /terminal/i }));
+
+    expect(screen.getByText('PANELBODY')).toBeVisible();
+  });
+
+  it('toggles back to collapsed on a second click', () => {
+    render(
+      <DockPanel>
+        <div>PANELBODY2</div>
+      </DockPanel>,
+    );
+
+    const toggle = screen.getByRole('button', { name: /terminal/i });
+    fireEvent.click(toggle);
+    expect(screen.getByText('PANELBODY2')).toBeVisible();
+    fireEvent.click(toggle);
+    expect(screen.getByText('PANELBODY2')).not.toBeVisible();
+  });
+
+  it('exposes a resize separator only when expanded', () => {
+    render(
+      <DockPanel>
+        <div>PANELBODY3</div>
+      </DockPanel>,
+    );
+
+    expect(screen.queryByRole('separator', { name: /resize terminal/i })).toBeNull();
+    fireEvent.click(screen.getByRole('button', { name: /terminal/i }));
+    expect(screen.getByRole('separator', { name: /resize terminal/i })).toBeInTheDocument();
+  });
+});
diff --git a/tests/dashboard/terminal/TerminalPanel.test.tsx b/tests/dashboard/terminal/TerminalPanel.test.tsx
new file mode 100644
index 000000000..54612351d
--- /dev/null
+++ b/tests/dashboard/terminal/TerminalPanel.test.tsx
@@ -0,0 +1,48 @@
+// @vitest-environment happy-dom
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+
+vi.mock('../../../src/dashboard/src/components/terminal/TerminalView', () => ({
+  TerminalView: ({ sessionId }: { sessionId: string }) => <div>{`view:${sessionId}`}</div>,
+}));
+
+const apiMocks = vi.hoisted(() => ({
+  createSession: vi.fn(async () => ({ id: 's-new', kind: 'shell', status: 'running' })),
+  listSessions: vi.fn(async () => [] as Array<{ id: string; kind: string; status: string }>),
+  killSession: vi.fn(async () => {}),
+}));
+
+vi.mock('../../../src/dashboard/src/lib/terminal-api', () => apiMocks);
+
+import { TerminalPanel } from '../../../src/dashboard/src/components/terminal/TerminalPanel';
+
+describe('TerminalPanel', () => {
+  beforeEach(() => {
+    apiMocks.createSession.mockClear();
+    apiMocks.listSessions.mockClear();
+    apiMocks.killSession.mockClear();
+    apiMocks.listSessions.mockImplementation(async () => []);
+    apiMocks.createSession.mockImplementation(async () => ({
+      id: 's-new',
+      kind: 'shell',
+      status: 'running',
+    }));
+  });
+
+  it('opens a new shell tab on quick-launch', async () => {
+    render(<TerminalPanel />);
+    fireEvent.click(screen.getByRole('button', { name: /\+shell/i }));
+    await waitFor(() => expect(screen.getByText('view:s-new')).toBeInTheDocument());
+  });
+
+  it('invokes killSession when the close button is clicked', async () => {
+    apiMocks.listSessions.mockImplementationOnce(async () => [
+      { id: 's-existing', kind: 'shell', status: 'running' },
+    ]);
+    render(<TerminalPanel />);
+    const closeBtn = await screen.findByLabelText('close s-existing');
+    fireEvent.click(closeBtn);
+    await waitFor(() => expect(apiMocks.killSession).toHaveBeenCalledWith('s-existing'));
+  });
+});
diff --git a/tests/dashboard/terminal/TerminalView.test.tsx b/tests/dashboard/terminal/TerminalView.test.tsx
new file mode 100644
index 000000000..4e54b9eb7
--- /dev/null
+++ b/tests/dashboard/terminal/TerminalView.test.tsx
@@ -0,0 +1,67 @@
+// @vitest-environment happy-dom
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '@testing-library/react';
+
+vi.mock('@xterm/xterm', () => ({
+  Terminal: class {
+    cols = 80;
+    rows = 24;
+    open = vi.fn();
+    write = vi.fn();
+    onData = vi.fn();
+    loadAddon = vi.fn();
+    dispose = vi.fn();
+  },
+}));
+vi.mock('@xterm/addon-fit', () => ({
+  FitAddon: class {
+    fit = vi.fn();
+  },
+}));
+vi.mock('@xterm/xterm/css/xterm.css', () => ({}));
+
+class FakeWS {
+  static OPEN = 1;
+  static CLOSED = 3;
+  onopen?: () => void;
+  onmessage?: (e: { data: string }) => void;
+  onclose?: () => void;
+  onerror?: () => void;
+  readyState = 1;
+  sent: string[] = [];
+  constructor(public url: string, public protocols?: string[] | string) {}
+  send(d: string) {
+    this.sent.push(d);
+  }
+  close() {
+    this.readyState = 3;
+    this.onclose?.();
+  }
+}
+
+class FakeResizeObserver {
+  observe = vi.fn();
+  unobserve = vi.fn();
+  disconnect = vi.fn();
+  constructor(public cb: ResizeObserverCallback) {}
+}
+
+vi.stubGlobal('WebSocket', FakeWS as unknown as typeof WebSocket);
+vi.stubGlobal('ResizeObserver', FakeResizeObserver as unknown as typeof ResizeObserver);
+(window as unknown as Record<string, unknown>).__DECKENT_TERMINAL_TOKEN__ = 'tk';
+
+import { TerminalView } from '../../../src/dashboard/src/components/terminal/TerminalView';
+
+describe('TerminalView', () => {
+  it('renders a container for the given session', () => {
+    const { container } = render(<TerminalView sessionId="s1" />);
+    expect(container.querySelector('[data-terminal="s1"]')).toBeTruthy();
+  });
+
+  it('cleans up xterm + ResizeObserver on unmount', () => {
+    const { unmount, container } = render(<TerminalView sessionId="s2" />);
+    expect(container.querySelector('[data-terminal="s2"]')).toBeTruthy();
+    unmount();
+    // No throw on unmount = dispose + disconnect ran.
+  });
+});
diff --git a/tests/dashboard/terminal/terminal-api.test.ts b/tests/dashboard/terminal/terminal-api.test.ts
new file mode 100644
index 000000000..b6d7bfb42
--- /dev/null
+++ b/tests/dashboard/terminal/terminal-api.test.ts
@@ -0,0 +1,16 @@
+import { describe, it, expect, vi } from 'vitest';
+import { getBootstrapToken, createSession } from '../../../src/dashboard/src/lib/terminal-api.js';
+
+describe('terminal-api', () => {
+  it('reads the injected bootstrap token', () => {
+    (window as unknown as Record<string, unknown>).__DECKENT_TERMINAL_TOKEN__ = 'tok-1';
+    expect(getBootstrapToken()).toBe('tok-1');
+  });
+  it('POSTs a session create', async () => {
+    const fetchMock = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ id: 's1' }) });
+    vi.stubGlobal('fetch', fetchMock);
+    const r = await createSession({ kind: 'shell' });
+    expect(r.id).toBe('s1');
+    expect(fetchMock).toHaveBeenCalledWith('/api/terminal/sessions', expect.objectContaining({ method: 'POST' }));
+  });
+});
diff --git a/tests/dashboard/terminal/useTerminalSocket.test.tsx b/tests/dashboard/terminal/useTerminalSocket.test.tsx
new file mode 100644
index 000000000..dfda7f1f2
--- /dev/null
+++ b/tests/dashboard/terminal/useTerminalSocket.test.tsx
@@ -0,0 +1,115 @@
+// @vitest-environment happy-dom
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { renderHook, act } from '@testing-library/react';
+import { useTerminalSocket } from '../../../src/dashboard/src/components/terminal/useTerminalSocket.js';
+
+class FakeWS {
+  static instances: FakeWS[] = [];
+  static OPEN = 1;
+  static CLOSED = 3;
+  static readonly CONNECTING = 0;
+  static readonly OPEN_CONST = 1;
+  onopen?: () => void;
+  onmessage?: (e: { data: string }) => void;
+  onclose?: () => void;
+  onerror?: () => void;
+  sent: string[] = [];
+  protocol: string;
+  readyState: number = 1;
+  constructor(public url: string, public protocols?: string[] | string) {
+    const protoList = Array.isArray(protocols) ? protocols : protocols ? [protocols] : [];
+    this.protocol = protoList[0] ?? '';
+    FakeWS.instances.push(this);
+  }
+  send(d: string) {
+    this.sent.push(d);
+  }
+  close() {
+    this.readyState = 3;
+    this.onclose?.();
+  }
+}
+
+describe('useTerminalSocket', () => {
+  beforeEach(() => {
+    FakeWS.instances.length = 0;
+    vi.stubGlobal('WebSocket', FakeWS as unknown as typeof WebSocket);
+    (window as unknown as Record<string, unknown>).__DECKENT_TERMINAL_TOKEN__ = 'tk';
+  });
+
+  it('opens WS with deckent.<token> subprotocol and sends attach on open', () => {
+    const onOutput = vi.fn();
+    renderHook(() => useTerminalSocket('sess-1', onOutput));
+    const ws = FakeWS.instances.at(-1);
+    expect(ws).toBeDefined();
+    expect(ws!.protocols).toEqual(['deckent.tk']);
+    act(() => ws!.onopen?.());
+    expect(
+      ws!.sent.some((m) => m.includes('"t":"attach"') && m.includes('sess-1')),
+    ).toBe(true);
+  });
+
+  it('forwards output frames to onOutput callback', () => {
+    const onOutput = vi.fn();
+    renderHook(() => useTerminalSocket('sess-2', onOutput));
+    const ws = FakeWS.instances.at(-1)!;
+    act(() => ws.onopen?.());
+    act(() => ws.onmessage?.({ data: JSON.stringify({ t: 'output', data: 'hello\r\n' }) }));
+    expect(onOutput).toHaveBeenCalledWith('hello\r\n');
+  });
+
+  it('returns an api ref that sends input + resize JSON frames', () => {
+    const { result } = renderHook(() => useTerminalSocket('sess-3', vi.fn()));
+    const ws = FakeWS.instances.at(-1)!;
+    act(() => ws.onopen?.());
+    act(() => {
+      result.current.current?.send('echo hi\r');
+      result.current.current?.resize(80, 24);
+    });
+    expect(ws.sent.some((m) => m.includes('"t":"input"') && m.includes('echo hi'))).toBe(true);
+    expect(ws.sent.some((m) => m.includes('"t":"resize"') && m.includes('80') && m.includes('24'))).toBe(true);
+  });
+
+  it('skips connect when sessionId is null (no WS instance)', () => {
+    renderHook(() => useTerminalSocket(null, vi.fn()));
+    expect(FakeWS.instances.length).toBe(0);
+  });
+
+  it('does NOT recreate the WS when onOutput changes across re-renders and routes output to the latest callback', () => {
+    const first = vi.fn();
+    const second = vi.fn();
+    const { rerender } = renderHook(({ cb }) => useTerminalSocket('sess-stable', cb), {
+      initialProps: { cb: first },
+    });
+    expect(FakeWS.instances.length).toBe(1);
+    rerender({ cb: second });
+    rerender({ cb: second });
+    expect(FakeWS.instances.length).toBe(1);
+    const ws = FakeWS.instances[0]!;
+    act(() => ws.onopen?.());
+    act(() => ws.onmessage?.({ data: JSON.stringify({ t: 'output', data: 'xyz' }) }));
+    expect(second).toHaveBeenCalledWith('xyz');
+    expect(first).not.toHaveBeenCalled();
+  });
+
+  it('reconnects and re-sends attach after onclose (tmux-like reattach)', () => {
+    vi.useFakeTimers();
+    try {
+      renderHook(() => useTerminalSocket('sess-reconnect', vi.fn()));
+      const first = FakeWS.instances.at(-1)!;
+      act(() => first.onopen?.());
+      act(() => first.close());
+      act(() => {
+        vi.advanceTimersByTime(2000);
+      });
+      const second = FakeWS.instances.at(-1)!;
+      expect(second).not.toBe(first);
+      act(() => second.onopen?.());
+      expect(
+        second.sent.some((m) => m.includes('"t":"attach"') && m.includes('sess-reconnect')),
+      ).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
diff --git a/tests/github/ci-workflow.test.ts b/tests/github/ci-workflow.test.ts
index 22ab23dcf..c5fbc3898 100644
--- a/tests/github/ci-workflow.test.ts
+++ b/tests/github/ci-workflow.test.ts
@@ -176,7 +176,7 @@ describe('CI Workflow (.github/workflows/ci.yml)', () => {
     });
 
     it('should still use matrix strategy for node versions', () => {
-      expect(content).toContain('node-version: [18.x, 20.x, 22.x]');
+      expect(content).toContain('node-version: [24.x, 26.x]');
     });
   });
 
diff --git a/tests/github/workflows/ci.test.ts b/tests/github/workflows/ci.test.ts
index d2432b2bf..860072d2f 100644
--- a/tests/github/workflows/ci.test.ts
+++ b/tests/github/workflows/ci.test.ts
@@ -39,14 +39,14 @@ describe('CI Workflow (.github/workflows/ci.yml)', () => {
       expect(workflowContent).toContain('npm run lint')
     })
 
-    it('should use Node.js 22.x', () => {
-      expect(workflowContent).toContain("node-version: '22.x'")
+    it('should use Node.js 24.x (Active LTS)', () => {
+      expect(workflowContent).toContain("node-version: '24.x'")
     })
   })
 
   describe('Test Jobs', () => {
     it('should test across multiple Node.js versions', () => {
-      expect(workflowContent).toContain('[18.x, 20.x, 22.x]')
+      expect(workflowContent).toContain('[24.x, 26.x]')
     })
 
     it('should depend on typecheck', () => {
diff --git a/tests/github/workflows/release.test.ts b/tests/github/workflows/release.test.ts
index ca44c1c30..bc5a8ae7f 100644
--- a/tests/github/workflows/release.test.ts
+++ b/tests/github/workflows/release.test.ts
@@ -66,8 +66,8 @@ describe('Release Workflow (.github/workflows/release.yml)', () => {
       expect(workflowContent).toContain("uses: actions/setup-node@v4")
     })
 
-    it('should specify node-version 22.x', () => {
-      expect(workflowContent).toMatch(/Setup Node\.js[\s\S]*?node-version: '22\.x'/)
+    it('should specify node-version 24.x (Active LTS)', () => {
+      expect(workflowContent).toMatch(/Setup Node\.js[\s\S]*?node-version: '24\.x'/)
     })
 
     it('should enable npm cache', () => {
diff --git a/tests/monitor/alert-emitter.test.ts b/tests/monitor/alert-emitter.test.ts
index a1f2c53da..24c252603 100644
--- a/tests/monitor/alert-emitter.test.ts
+++ b/tests/monitor/alert-emitter.test.ts
@@ -96,6 +96,11 @@ describe('emitAlert', () => {
       await vi.importActual<typeof import('node:path')>('node:path');
 
     const projectRoot = process.cwd();
+    // rule-generator.ts:77-113 intentionally omits the `paths:` frontmatter
+    // for .codex / .gemini / .cursor — Claude is the only provider whose
+    // rule loader honours the frontmatter scope hint. The other three just
+    // get plain markdown. Parity here means "file exists with the AUTO-START
+    // marker", not "identical frontmatter". (Sprint 175 PR #16 CI dogfood.)
     const providers = ['.codex', '.gemini', '.cursor'] as const;
     const ruleFiles = ['brain.md', 'auditor.md', 'worker-default.md'] as const;
 
@@ -108,8 +113,8 @@ describe('emitAlert', () => {
         const content = realRead(fullPath, 'utf-8') as string;
         expect(
           content,
-          `${provider}/rules/${file} must contain paths: frontmatter`,
-        ).toMatch(/^paths:/m);
+          `${provider}/rules/${file} must contain the AUTO-START marker`,
+        ).toContain('<!-- AUTO-START -->');
       }
     }
   });
diff --git a/tests/security/shell-injection.test.ts b/tests/security/shell-injection.test.ts
index fd6c29ec0..41539c23e 100644
--- a/tests/security/shell-injection.test.ts
+++ b/tests/security/shell-injection.test.ts
@@ -46,8 +46,9 @@ describe('shell injection prevention', () => {
     expect(cmdArg).toBeDefined();
     // The prompt text should NOT appear in the command
     expect(cmdArg).not.toContain('This is a normal prompt');
-    // Instead it should use stdin redirect from a file
-    expect(cmdArg).toContain('< /project/.tasks/.prompt-deadbeef12345678.txt');
+    // Instead it should use stdin redirect from a file. Sprint 170 P0-3
+    // made the prompt filename taskId-aware: .prompt-{taskId}-{randomId}.txt
+    expect(cmdArg).toContain('< /project/.tasks/.prompt-task-001-deadbeef12345678.txt');
   });
 
   it('$() subshell syntax in prompt does not appear in command args', () => {
@@ -113,7 +114,8 @@ describe('shell injection prevention', () => {
       (c) => String(c[0]).includes('.prompt-'),
     );
     expect(writeCall).toBeDefined();
-    expect(String(writeCall![0])).toContain('.prompt-deadbeef12345678.txt');
+    // Sprint 170 P0-3: prompt filename now includes taskId prefix.
+    expect(String(writeCall![0])).toContain('.prompt-task-007-deadbeef12345678.txt');
   });
 });