diff --git a/run.json b/run.json
index 7f80ff245..7c989b0f3 100644
--- a/run.json
+++ b/run.json
@@ -492,7 +492,7 @@
     "kind": "running"
   },
   "status_updated_at": "2026-05-23T19:56:21.662602Z",
-  "last_event_at": "2026-05-23T19:56:23.484957Z",
+  "last_event_at": "2026-05-23T19:56:28.620746Z",
   "pending_control": null,
   "checkpoints": [
     {
@@ -533,34 +533,102 @@
       "diff": {}
     },
     {
-      "seq": 0,
+      "seq": 29,
       "checkpoint": {
-        "timestamp": "2026-05-23T19:56:24.908212Z",
+        "timestamp": "2026-05-23T19:56:28.619158Z",
         "current_node": "toolchain",
         "completed_nodes": [
           "start",
           "toolchain"
         ],
         "node_retries": {},
+        "context_values": {
+          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
+          "internal.retry_count.toolchain": 0,
+          "thread.start.current_node": "toolchain",
+          "current_node": "toolchain",
+          "graph.goal": "# Legacy Sandbox Config Auto-Migration Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Automatically rewrite confidently migratable legacy `[run.sandbox]` config files to the named-environments syntax during startup.\n\n**Architecture:** Keep legacy behavior isolated in a removable `fabro-config` module. The normal settings schema stays strict; only file-based loads get a temporary parse-failure recovery path that rewrites the file, writes a backup, warns, and then resumes normal parsing.\n\n**Tech Stack:** Rust, `toml_edit`, existing `fabro-config` settings builders, `tracing`, `tempfile` tests, public docs under `docs/public`.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n  - Owns detection, TOML rewriting, backup naming/writing, unsupported-key diagnostics, and tests for legacy mappings.\n- Modify `lib/crates/fabro-config/src/lib.rs`\n  - Register the module privately.\n- Modify `lib/crates/fabro-config/Cargo.toml`\n  - Add the existing workspace `toml_edit` dependency; current main does not depend on it from `fabro-config`.\n- Modify `lib/crates/fabro-config/src/load.rs`\n  - Add a small parse-failure hook that delegates to the migration module, then returns to normal parsing.\n- Modify docs:\n  - `docs/public/execution/environments.mdx`\n  - Create `docs/public/changelog/2026-05-23.mdx` because current main's latest public changelog is `2026-05-22.mdx`.\n\n## Migration Contract\n\nOnly migrate when all of these are true:\n\n- The file is valid TOML as a document.\n- `[run.sandbox]` exists.\n- `[run.environment]` does not exist.\n- `[environments.default]` does not exist.\n- Every legacy sandbox key is in the supported mapping below.\n- The migrated content parses successfully as `SettingsLayer`.\n\nThis is intentionally a file-load migration only. Current in-memory parsing behavior, including `legacy_run_sandbox_is_rejected` in `lib/crates/fabro-config/src/tests/resolve_run.rs`, should remain strict and unchanged.\n\nSupported mappings:\n\n| Legacy key | New key |\n|---|---|\n| `run.sandbox.provider` | `run.environment.id = \"default\"` and `environments.default.provider` |\n| `run.sandbox.preserve` | `environments.default.lifecycle.preserve` |\n| `run.sandbox.env` | `environments.default.env` |\n| `run.sandbox.daytona.skip_clone = true` | `run.clone.enabled = false` |\n| `run.sandbox.docker.skip_clone = true` | `run.clone.enabled = false` |\n| `run.sandbox.daytona.auto_stop_interval = N` | `environments.default.lifecycle.auto_stop = \"{N}m\"` |\n| `run.sandbox.daytona.labels` | `environments.default.labels` |\n| `run.sandbox.daytona.snapshot.name` | `environments.default.image.ref` |\n| `run.sandbox.daytona.snapshot.cpu` | `environments.default.resources.cpu` |\n| `run.sandbox.daytona.snapshot.memory` | `environments.default.resources.memory` |\n| `run.sandbox.daytona.snapshot.disk` | `environments.default.resources.disk` |\n| `run.sandbox.daytona.snapshot.dockerfile` | `environments.default.image.dockerfile` |\n| `run.sandbox.daytona.volumes[].volume_id` | `environments.default.volumes[].id` |\n| `run.sandbox.daytona.volumes[].mount_path` | `environments.default.volumes[].mount_path` |\n| `run.sandbox.daytona.volumes[].subpath` | `environments.default.volumes[].subpath` |\n| `run.sandbox.docker.image` | `environments.default.image.ref` |\n| `run.sandbox.docker.memory_limit` | `environments.default.resources.memory` |\n| `run.sandbox.docker.cpu_quota` | `environments.default.resources.cpu` when divisible by `100000` |\n\nUnsupported or ambiguous cases fail with a message shaped like:\n\n```text\nLegacy [run.sandbox] settings in <path> could not be auto-migrated.\n\nUnsupported keys:\n  - run.sandbox.daytona.foo\n  - run.sandbox.docker.cpu_quota\n\nRename legacy sandbox configuration to [run.environment] and [environments.<slug>].\nSee docs/public/execution/environments.mdx.\n```\n\nSuccessful migration writes a backup next to the original file:\n\n```text\nsettings.toml.legacy-sandbox-migration.bak\nsettings.toml.legacy-sandbox-migration.1.bak\nsettings.toml.legacy-sandbox-migration.2.bak\n```\n\nSuccessful migration emits:\n\n```text\nMigrated legacy [run.sandbox] settings in <path> to [run.environment] and [environments.default]. Backup written to <backup>. This temporary compatibility migration will be removed before v1.0.\n```\n\n## Task 1: Add the Migration Module Skeleton\n\n**Files:**\n- Create: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n- Modify: `lib/crates/fabro-config/src/lib.rs`\n- Modify: `lib/crates/fabro-config/Cargo.toml`\n\n- [ ] **Step 1: Add the `toml_edit` dependency**\n\nAdd this to `[dependencies]` in `lib/crates/fabro-config/Cargo.toml`:\n\n```toml\ntoml_edit.workspace = true\n```\n\n- [ ] **Step 2: Register the module privately**\n\nAdd this beside the other private modules in `lib/crates/fabro-config/src/lib.rs`:\n\n```rust\nmod legacy_sandbox_migration;\n```\n\n- [ ] **Step 3: Create the module API**\n\nCreate `lib/crates/fabro-config/src/legacy_sandbox_migration.rs` with this starting shape:\n\n```rust\n#![expect(\n    clippy::disallowed_methods,\n    reason = \"temporary startup config migration uses synchronous file I/O before config is loaded\"\n)]\n\nuse std::fmt;\nuse std::path::{Path, PathBuf};\n\nuse toml_edit::{DocumentMut, Item, Table, Value};\n\nuse crate::{Error, Result, SettingsLayer};\n\npub(crate) const REMOVAL_NOTE: &str =\n    \"This temporary compatibility migration will be removed before v1.0.\";\n\n#[derive(Debug, Clone, PartialEq, Eq)]\npub(crate) struct LegacySandboxMigrationReport {\n    pub(crate) contents:    String,\n    pub(crate) backup_path: PathBuf,\n    pub(crate) warning:     String,\n}\n\n#[derive(Debug, Clone, PartialEq, Eq)]\nstruct MigrationFailure {\n    unsupported_keys: Vec<String>,\n}\n\nimpl fmt::Display for MigrationFailure {\n    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n        writeln!(f, \"Legacy [run.sandbox] settings could not be auto-migrated.\")?;\n        writeln!(f)?;\n        writeln!(f, \"Unsupported keys:\")?;\n        for key in &self.unsupported_keys {\n            writeln!(f, \"  - {key}\")?;\n        }\n        writeln!(f)?;\n        write!(\n            f,\n            \"Rename legacy sandbox configuration to [run.environment] and [environments.<slug>]. See docs/public/execution/environments.mdx.\"\n        )\n    }\n}\n\npub(crate) fn migrate_settings_path(\n    path: &Path,\n    original_contents: &str,\n) -> Result<Option<LegacySandboxMigrationReport>> {\n    let Some(next_contents) = migrate_contents(original_contents, path)? else {\n        return Ok(None);\n    };\n\n    next_contents\n        .parse::<SettingsLayer>()\n        .map_err(|err| Error::parse_file(\"Migrated settings file is invalid\", path, err))?;\n\n    let backup_path = next_backup_path(path);\n    std::fs::write(&backup_path, original_contents).map_err(|source| {\n        Error::other(format!(\n            \"writing legacy sandbox migration backup {}: {source}\",\n            backup_path.display()\n        ))\n    })?;\n    std::fs::write(path, &next_contents).map_err(|source| {\n        Error::other(format!(\n            \"writing migrated settings file {}: {source}\",\n            path.display()\n        ))\n    })?;\n\n    let warning = format!(\n        \"Migrated legacy [run.sandbox] settings in {} to [run.environment] and [environments.default]. Backup written to {}. {REMOVAL_NOTE}\",\n        path.display(),\n        backup_path.display()\n    );\n\n    Ok(Some(LegacySandboxMigrationReport {\n        contents: next_contents,\n        backup_path,\n        warning,\n    }))\n}\n\nfn migrate_contents(original_contents: &str, path: &Path) -> Result<Option<String>> {\n    let mut doc = match original_contents.parse::<DocumentMut>() {\n        Ok(doc) => doc,\n        Err(_) => return Ok(None),\n    };\n\n    if !has_legacy_run_sandbox(&doc) {\n        return Ok(None);\n    }\n    if has_new_environment_config(&doc) {\n        return Err(Error::other(format!(\n            \"Legacy [run.sandbox] settings in {} could not be auto-migrated because the file already contains [run.environment] or [environments.default]. Remove one config style and retry.\",\n            path.display()\n        )));\n    }\n\n    migrate_document(&mut doc).map_err(|failure| {\n        Error::other(format!(\n            \"Legacy [run.sandbox] settings in {} could not be auto-migrated.\\n\\n{}\",\n            path.display(),\n            failure\n        ))\n    })?;\n\n    Ok(Some(doc.to_string()))\n}\n\nfn has_legacy_run_sandbox(doc: &DocumentMut) -> bool {\n    doc.get(\"run\")\n        .and_then(Item::as_table)\n        .and_then(|run| run.get(\"sandbox\"))\n        .is_some()\n}\n\nfn has_new_environment_config(doc: &DocumentMut) -> bool {\n    let has_run_environment = doc\n        .get(\"run\")\n        .and_then(Item::as_table)\n        .and_then(|run| run.get(\"environment\"))\n        .is_some();\n    let has_default_environment = doc\n        .get(\"environments\")\n        .and_then(Item::as_table)\n        .and_then(|envs| envs.get(\"default\"))\n        .is_some();\n    has_run_environment || has_default_environment\n}\n\nfn next_backup_path(path: &Path) -> PathBuf {\n    let base = path.with_file_name(format!(\n        \"{}.legacy-sandbox-migration.bak\",\n        path.file_name()\n            .and_then(|name| name.to_str())\n            .unwrap_or(\"settings.toml\")\n    ));\n    if !base.exists() {\n        return base;\n    }\n\n    for index in 1.. {\n        let candidate = path.with_file_name(format!(\n            \"{}.legacy-sandbox-migration.{index}.bak\",\n            path.file_name()\n                .and_then(|name| name.to_str())\n                .unwrap_or(\"settings.toml\")\n        ));\n        if !candidate.exists() {\n            return candidate;\n        }\n    }\n    unreachable!(\"unbounded backup suffix search should return\")\n}\n```\n\n- [ ] **Step 4: Add placeholder-free private stubs that compile**\n\nAdd private helpers with `unimplemented!()` only inside tests disabled by `#[cfg(test)]` is not allowed. Instead, make `migrate_document` return the one known unsupported failure until Task 2 fills it:\n\n```rust\nfn migrate_document(_doc: &mut DocumentMut) -> std::result::Result<(), MigrationFailure> {\n    Err(MigrationFailure {\n        unsupported_keys: vec![\"run.sandbox\".to_string()],\n    })\n}\n```\n\n- [ ] **Step 5: Run the focused compile check**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: compiles; there may be zero tests in this module at this point.\n\n## Task 2: Implement Provider-Only Migration\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add tests for provider-only migration**\n\nAdd these tests inside `legacy_sandbox_migration.rs`:\n\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use fabro_types::settings::run::EnvironmentProvider;\n\n    fn migrate(source: &str) -> String {\n        migrate_contents(source, Path::new(\"settings.toml\"))\n            .expect(\"migration should not error\")\n            .expect(\"legacy sandbox should migrate\")\n    }\n\n    #[test]\n    fn provider_only_daytona_config_migrates_to_default_environment() {\n        let migrated = migrate(\n            r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#,\n        );\n\n        let settings = migrated\n            .parse::<SettingsLayer>()\n            .expect(\"migrated TOML should parse\");\n        let resolved = crate::WorkflowSettingsBuilder::from_layer(&settings)\n            .expect(\"migrated settings should resolve\")\n            .run;\n\n        assert_eq!(resolved.environment.id, \"default\");\n        assert_eq!(resolved.environment.provider, EnvironmentProvider::Daytona);\n        assert!(migrated.contains(\"[run.environment]\"));\n        assert!(migrated.contains(\"[environments.default]\"));\n        assert!(!migrated.contains(\"[run.sandbox]\"));\n    }\n\n    #[test]\n    fn non_legacy_config_is_not_migrated() {\n        let migrated = migrate_contents(\"_version = 1\\n\", Path::new(\"settings.toml\"))\n            .expect(\"non-legacy TOML should not error\");\n\n        assert!(migrated.is_none());\n    }\n}\n```\n\n- [ ] **Step 2: Run tests and confirm failure**\n\nRun:\n\n```bash\ncargo test -p fabro-config provider_only_daytona_config_migrates_to_default_environment --quiet\n```\n\nExpected: FAIL because `migrate_document` still returns unsupported `run.sandbox`.\n\n- [ ] **Step 3: Replace `migrate_document` with provider migration**\n\nImplement the initial migration:\n\n```rust\nfn migrate_document(doc: &mut DocumentMut) -> std::result::Result<(), MigrationFailure> {\n    let Some(sandbox_item) = doc\n        .get(\"run\")\n        .and_then(Item::as_table)\n        .and_then(|run| run.get(\"sandbox\"))\n    else {\n        return Ok(());\n    };\n    let Some(sandbox) = sandbox_item.as_table().cloned() else {\n        return Err(MigrationFailure {\n            unsupported_keys: vec![\"run.sandbox\".to_string()],\n        });\n    };\n\n    let mut unsupported = Vec::new();\n    for (key, _) in sandbox.iter() {\n        if key != \"provider\" {\n            unsupported.push(format!(\"run.sandbox.{key}\"));\n        }\n    }\n    if !unsupported.is_empty() {\n        return Err(MigrationFailure {\n            unsupported_keys: unsupported,\n        });\n    }\n\n    let Some(provider) = sandbox.get(\"provider\").and_then(Item::as_str) else {\n        return Err(MigrationFailure {\n            unsupported_keys: vec![\"run.sandbox.provider\".to_string()],\n        });\n    };\n\n    set_value(path_table(doc, &[\"run\", \"environment\"]), \"id\", Value::from(\"default\"));\n    set_value(\n        path_table(doc, &[\"environments\", \"default\"]),\n        \"provider\",\n        Value::from(provider),\n    );\n\n    remove_run_sandbox(doc);\n    Ok(())\n}\n\nfn path_table<'a>(doc: &'a mut DocumentMut, path: &[&str]) -> &'a mut Table {\n    let mut item = doc.as_item_mut();\n    for segment in path {\n        item = &mut item[segment];\n        if !item.is_table() {\n            *item = Item::Table(Table::new());\n        }\n    }\n    item.as_table_mut().expect(\"path item should be a table\")\n}\n\nfn set_value(table: &mut Table, key: &str, value: Value) {\n    table[key] = Item::Value(value);\n}\n\nfn remove_run_sandbox(doc: &mut DocumentMut) {\n    if let Some(run) = doc.get_mut(\"run\").and_then(Item::as_table_mut) {\n        run.remove(\"sandbox\");\n    }\n}\n```\n\n- [ ] **Step 4: Run focused tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS.\n\n## Task 3: Add Daytona and Docker Field Mappings\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add tests for direct legacy field mappings**\n\nAdd tests that assert resolved behavior, not only string contents:\n\n```rust\n#[test]\nfn daytona_snapshot_labels_lifecycle_and_volumes_migrate() {\n    let migrated = migrate(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\npreserve = true\n\n[run.sandbox.env]\nNODE_ENV = \"development\"\n\n[run.sandbox.daytona]\nauto_stop_interval = 30\n\n[run.sandbox.daytona.labels]\nrepo = \"fabro-sh/fabro\"\n\n[run.sandbox.daytona.snapshot]\nname = \"fabro-v11\"\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\ndockerfile = { path = \"Dockerfile\" }\n\n[[run.sandbox.daytona.volumes]]\nvolume_id = \"vol_auth\"\nmount_path = \"/home/daytona/.config\"\nsubpath = \"agents\"\n\"#,\n    );\n\n    let settings = migrated.parse::<SettingsLayer>().expect(\"migrated TOML should parse\");\n    let resolved = crate::WorkflowSettingsBuilder::from_layer(&settings)\n        .expect(\"migrated settings should resolve\")\n        .run\n        .environment;\n\n    assert_eq!(resolved.image.reference.as_deref(), Some(\"fabro-v11\"));\n    assert_eq!(resolved.resources.cpu, Some(8));\n    assert_eq!(resolved.resources.memory.map(|size| size.as_bytes()), Some(16_000_000_000));\n    assert_eq!(resolved.resources.disk.map(|size| size.as_bytes()), Some(20_000_000_000));\n    assert!(resolved.lifecycle.preserve);\n    assert_eq!(resolved.lifecycle.auto_stop.map(|duration| duration.as_std().as_secs()), Some(1800));\n    assert_eq!(resolved.labels.get(\"repo\").map(String::as_str), Some(\"fabro-sh/fabro\"));\n    assert_eq!(resolved.env.get(\"NODE_ENV\").map(|value| value.as_source()).as_deref(), Some(\"development\"));\n    assert_eq!(resolved.volumes.len(), 1);\n    assert_eq!(resolved.volumes[0].id, \"vol_auth\");\n    assert_eq!(resolved.volumes[0].mount_path, \"/home/daytona/.config\");\n    assert_eq!(resolved.volumes[0].subpath.as_deref(), Some(\"agents\"));\n}\n\n#[test]\nfn docker_image_memory_and_cpu_quota_migrate() {\n    let migrated = migrate(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"docker\"\n\n[run.sandbox.docker]\nimage = \"buildpack-deps:noble\"\nmemory_limit = \"4GB\"\ncpu_quota = 200000\n\"#,\n    );\n\n    let settings = migrated.parse::<SettingsLayer>().expect(\"migrated TOML should parse\");\n    let resolved = crate::WorkflowSettingsBuilder::from_layer(&settings)\n        .expect(\"migrated settings should resolve\")\n        .run\n        .environment;\n\n    assert_eq!(resolved.provider, EnvironmentProvider::Docker);\n    assert_eq!(resolved.image.reference.as_deref(), Some(\"buildpack-deps:noble\"));\n    assert_eq!(resolved.resources.cpu, Some(2));\n    assert_eq!(resolved.resources.memory.map(|size| size.as_bytes()), Some(4_000_000_000));\n}\n```\n\n- [ ] **Step 2: Run tests and confirm failure**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: FAIL because the two new nested-mapping tests are not implemented yet.\n\n- [ ] **Step 3: Implement table copying and value transforms**\n\nExtend `migrate_document` so it:\n\n- Allows top-level legacy keys `provider`, `preserve`, `env`, `daytona`, and `docker`.\n- Copies `run.sandbox.env` into `environments.default.env`.\n- Sets `environments.default.lifecycle.preserve` from `run.sandbox.preserve`.\n- Handles provider-specific nested mappings only for the selected provider.\n- Removes `run.sandbox` after successful migration.\n\nUse helper functions with these signatures:\n\n```rust\nfn migrate_daytona(sandbox: &Table, env: &mut Table, unsupported: &mut Vec<String>);\nfn migrate_docker(sandbox: &Table, env: &mut Table, unsupported: &mut Vec<String>);\nfn copy_table(source: &Item, target: &mut Table);\nfn copy_array_of_tables_with_volume_id(source: &Item, target: &mut Table, unsupported: &mut Vec<String>);\nfn item_path_keys(prefix: &str, item: &Item, out: &mut Vec<String>);\n```\n\nImplementation rules:\n\n- `auto_stop_interval` must be an integer. Store `format!(\"{minutes}m\")`.\n- `docker.cpu_quota` must be an integer divisible by `100000`; otherwise add `run.sandbox.docker.cpu_quota` to unsupported keys.\n- For Daytona volumes, each array entry may contain only `volume_id`, `mount_path`, and `subpath`; rename `volume_id` to `id`.\n- `daytona.snapshot.dockerfile` must be copied as the existing TOML value, preserving inline string or `{ path = \"...\" }`.\n- When collecting unsupported nested keys, report full paths such as `run.sandbox.daytona.snapshot.foo`.\n\n- [ ] **Step 4: Run focused tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS.\n\n## Task 4: Add File Rewrite and Loader Hook\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add file rewrite tests**\n\nAdd tests:\n\n```rust\n#[test]\nfn migrate_settings_path_writes_backup_and_rewrites_original() {\n    let dir = tempfile::tempdir().expect(\"temp dir\");\n    let path = dir.path().join(\"settings.toml\");\n    let original = r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#;\n    std::fs::write(&path, original).expect(\"write fixture\");\n\n    let report = migrate_settings_path(&path, original)\n        .expect(\"migration should succeed\")\n        .expect(\"legacy config should migrate\");\n\n    let rewritten = std::fs::read_to_string(&path).expect(\"read rewritten settings\");\n    let backup = std::fs::read_to_string(&report.backup_path).expect(\"read backup\");\n\n    assert_eq!(backup, original);\n    assert!(rewritten.contains(\"[run.environment]\"));\n    assert!(rewritten.contains(\"[environments.default]\"));\n    assert!(report.warning.contains(\"temporary compatibility migration\"));\n}\n\n#[test]\nfn existing_backup_uses_numbered_suffix() {\n    let dir = tempfile::tempdir().expect(\"temp dir\");\n    let path = dir.path().join(\"settings.toml\");\n    std::fs::write(path.with_file_name(\"settings.toml.legacy-sandbox-migration.bak\"), \"old\")\n        .expect(\"write existing backup\");\n\n    let next = next_backup_path(&path);\n\n    assert!(next.ends_with(\"settings.toml.legacy-sandbox-migration.1.bak\"));\n}\n```\n\n- [ ] **Step 2: Run tests and confirm current state**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS if Task 1 file-writing code compiled; otherwise fix only the migration module.\n\n- [ ] **Step 3: Hook migration into file loading**\n\nChange `load_settings_path` in `lib/crates/fabro-config/src/load.rs` to this shape:\n\n```rust\npub(crate) fn load_settings_path(path: &Path) -> Result<SettingsLayer> {\n    let content = std::fs::read_to_string(path).map_err(|source| Error::read_file(path, source))?;\n    let mut layer = match content.parse::<SettingsLayer>() {\n        Ok(layer) => layer,\n        Err(err) => match crate::legacy_sandbox_migration::migrate_settings_path(path, &content)? {\n            Some(report) => {\n                tracing::warn!(\"{}\", report.warning);\n                eprintln!(\"{}\", report.warning);\n                report.contents.parse::<SettingsLayer>().map_err(|err| {\n                    Error::parse_file(\"Migrated settings file is invalid\", path, err)\n                })?\n            }\n            None => return Err(Error::parse_file(\"Failed to parse settings file\", path, err)),\n        },\n    };\n    let base_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n    resolve_goal_file_paths(&mut layer, base_dir);\n    Ok(layer)\n}\n```\n\n- [ ] **Step 4: Run loader-level verification**\n\nAdd a test in `load.rs` under `#[cfg(test)]` if the file does not already have a test module:\n\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use fabro_types::settings::run::EnvironmentProvider;\n\n    #[test]\n    fn load_settings_path_auto_migrates_legacy_sandbox_file() {\n        let dir = tempfile::tempdir().expect(\"temp dir\");\n        let path = dir.path().join(\"settings.toml\");\n        std::fs::write(\n            &path,\n            r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#,\n        )\n        .expect(\"write legacy settings\");\n\n        let layer = load_settings_path(&path).expect(\"legacy settings should auto-migrate\");\n        let resolved = crate::WorkflowSettingsBuilder::from_layer(&layer)\n            .expect(\"migrated settings should resolve\")\n            .run;\n\n        assert_eq!(resolved.environment.provider, EnvironmentProvider::Daytona);\n        assert!(std::fs::read_to_string(&path)\n            .expect(\"read rewritten settings\")\n            .contains(\"[run.environment]\"));\n    }\n}\n```\n\nRun:\n\n```bash\ncargo test -p fabro-config load_settings_path_auto_migrates_legacy_sandbox_file --quiet\n```\n\nExpected: PASS.\n\n- [ ] **Step 5: Verify in-memory TOML parsing remains strict**\n\nRun the existing current-main rejection test:\n\n```bash\ncargo test -p fabro-config legacy_run_sandbox_is_rejected --quiet\n```\n\nExpected: PASS. Do not weaken `SettingsLayer` deserialization to accept `run.sandbox`; only `load_settings_path` should rewrite files from disk.\n\n## Task 5: Unsupported and Ambiguous Cases\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add failure tests**\n\nAdd tests:\n\n```rust\n#[test]\nfn existing_new_environment_config_is_ambiguous() {\n    let err = migrate_contents(\n        r#\"\n_version = 1\n\n[run.environment]\nid = \"default\"\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#,\n        Path::new(\"settings.toml\"),\n    )\n    .expect_err(\"mixed old and new config should fail\");\n\n    assert!(err.to_string().contains(\"already contains [run.environment]\"));\n}\n\n#[test]\nfn unsupported_keys_are_reported_with_full_paths() {\n    let err = migrate_contents(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\n[run.sandbox.daytona]\nunknown = true\n\"#,\n        Path::new(\"settings.toml\"),\n    )\n    .expect_err(\"unsupported keys should fail migration\");\n\n    let rendered = err.to_string();\n    assert!(rendered.contains(\"run.sandbox.daytona.unknown\"));\n    assert!(rendered.contains(\"docs/public/execution/environments.mdx\"));\n}\n\n#[test]\nfn unsupported_docker_cpu_quota_is_reported() {\n    let err = migrate_contents(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"docker\"\n\n[run.sandbox.docker]\ncpu_quota = 250000\n\"#,\n        Path::new(\"settings.toml\"),\n    )\n    .expect_err(\"non-divisible cpu quota should fail migration\");\n\n    assert!(err.to_string().contains(\"run.sandbox.docker.cpu_quota\"));\n}\n```\n\n- [ ] **Step 2: Run failure tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS.\n\n## Task 6: Documentation\n\n**Files:**\n- Modify: `docs/public/execution/environments.mdx`\n- Create: `docs/public/changelog/2026-05-23.mdx`\n\n- [ ] **Step 1: Document temporary auto-migration**\n\nAdd this note near the top of `docs/public/execution/environments.mdx`, after the initial environment/sandbox distinction:\n\n```mdx\n<Warning>\nOlder pre-v1.0 config files that still use `[run.sandbox]` are temporarily auto-migrated when Fabro loads them from disk. Fabro writes a sibling `*.legacy-sandbox-migration.bak` file, rewrites the config to `[run.environment]` plus `[environments.default]`, and then continues startup.\n\nThis compatibility rewrite only handles direct field mappings. Unsupported legacy fields fail with a migration message that lists the keys to edit manually. The rewrite path will be removed before v1.0.\n</Warning>\n```\n\n- [ ] **Step 2: Add a changelog note**\n\nCreate `docs/public/changelog/2026-05-23.mdx`:\n\n```mdx\n---\ntitle: \"Legacy sandbox config migration\"\ndate: \"2026-05-23\"\n---\n\n## Legacy sandbox config auto-migration\n\nFabro now temporarily rewrites confidently migratable pre-v1.0 `[run.sandbox]` config files to the named environment syntax. A backup is written next to the original file before rewriting. Ambiguous or unsupported legacy keys fail with a targeted migration message instead of the generic TOML unknown-field error.\n```\n\n- [ ] **Step 3: Check docs references**\n\nRun:\n\n```bash\nrg -n \"\\\\[run\\\\.sandbox\\\\]|legacy-sandbox-migration|run\\\\.environment\" docs/public/execution docs/public/changelog\n```\n\nExpected: remaining `[run.sandbox]` references are either historical changelog entries or explicit migration warnings.\n\n## Task 7: Full Verification\n\n**Files:**\n- All files touched above.\n\n- [ ] **Step 1: Run config crate tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config --quiet\n```\n\nExpected: PASS.\n\n- [ ] **Step 2: Run formatting check**\n\nRun:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\nExpected: PASS.\n\n- [ ] **Step 3: Optional workspace lint if formatting and tests pass**\n\nRun:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\nExpected: PASS. If this is slow, record that it was not run and include the reason in the handoff.\n\n## Acceptance Criteria\n\n- Boot-time config loading rewrites simple legacy `[run.sandbox]` files without user action.\n- The rewritten file uses `[run.environment] id = \"default\"` and `[environments.default]`.\n- The original file is preserved in a sibling backup before rewrite.\n- Unsupported legacy keys fail with a targeted migration message listing exact keys.\n- Normal strict schema behavior remains unchanged for in-memory `from_toml` calls.\n- All legacy migration code is isolated in `legacy_sandbox_migration.rs` and removable before v1.0.\n",
+          "failure_signature": "",
+          "internal.run_id": "01KSB6HFNMJ802AXGBAV5JP7ZS",
+          "graph.rankdir": "LR",
+          "internal.node_visit_count": 1,
+          "failure_class": "",
+          "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
+          "internal.fidelity": "compact",
+          "internal.retry_count.start": 0,
+          "internal.work_dir": "/home/daytona/workspace/fabro",
+          "internal.thread_id": "start",
+          "outcome": "succeeded"
+        },
+        "node_outcomes": {
+          "toolchain": {
+            "status": "succeeded",
+            "context_updates": {
+              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
+            },
+            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
+            "usage": null
+          },
+          "start": {
+            "status": "succeeded",
+            "usage": null
+          }
+        },
+        "next_node_id": "preflight_compile",
+        "git_commit_sha": "4a837d6de2f1cc38ccebc0cf7324008406e13f19",
+        "node_visits": {
+          "toolchain": 1,
+          "start": 1
+        }
+      },
+      "diff": {
+        "summary": {
+          "files_changed": 0,
+          "additions": 0,
+          "deletions": 0
+        }
+      }
+    },
+    {
+      "seq": 0,
+      "checkpoint": {
+        "timestamp": "2026-05-23T19:58:33.797980Z",
+        "current_node": "preflight_compile",
+        "completed_nodes": [
+          "start",
+          "toolchain",
+          "preflight_compile"
+        ],
+        "node_retries": {},
         "context_values": {
           "internal.run_id": "01KSB6HFNMJ802AXGBAV5JP7ZS",
           "internal.work_dir": "/home/daytona/workspace/fabro",
           "outcome": "succeeded",
           "thread.start.current_node": "toolchain",
-          "internal.thread_id": "start",
-          "current_node": "toolchain",
+          "internal.thread_id": "toolchain",
+          "internal.retry_count.preflight_compile": 0,
+          "current_node": "preflight_compile",
           "failure_class": "",
           "graph.goal": "# Legacy Sandbox Config Auto-Migration Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Automatically rewrite confidently migratable legacy `[run.sandbox]` config files to the named-environments syntax during startup.\n\n**Architecture:** Keep legacy behavior isolated in a removable `fabro-config` module. The normal settings schema stays strict; only file-based loads get a temporary parse-failure recovery path that rewrites the file, writes a backup, warns, and then resumes normal parsing.\n\n**Tech Stack:** Rust, `toml_edit`, existing `fabro-config` settings builders, `tracing`, `tempfile` tests, public docs under `docs/public`.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n  - Owns detection, TOML rewriting, backup naming/writing, unsupported-key diagnostics, and tests for legacy mappings.\n- Modify `lib/crates/fabro-config/src/lib.rs`\n  - Register the module privately.\n- Modify `lib/crates/fabro-config/Cargo.toml`\n  - Add the existing workspace `toml_edit` dependency; current main does not depend on it from `fabro-config`.\n- Modify `lib/crates/fabro-config/src/load.rs`\n  - Add a small parse-failure hook that delegates to the migration module, then returns to normal parsing.\n- Modify docs:\n  - `docs/public/execution/environments.mdx`\n  - Create `docs/public/changelog/2026-05-23.mdx` because current main's latest public changelog is `2026-05-22.mdx`.\n\n## Migration Contract\n\nOnly migrate when all of these are true:\n\n- The file is valid TOML as a document.\n- `[run.sandbox]` exists.\n- `[run.environment]` does not exist.\n- `[environments.default]` does not exist.\n- Every legacy sandbox key is in the supported mapping below.\n- The migrated content parses successfully as `SettingsLayer`.\n\nThis is intentionally a file-load migration only. Current in-memory parsing behavior, including `legacy_run_sandbox_is_rejected` in `lib/crates/fabro-config/src/tests/resolve_run.rs`, should remain strict and unchanged.\n\nSupported mappings:\n\n| Legacy key | New key |\n|---|---|\n| `run.sandbox.provider` | `run.environment.id = \"default\"` and `environments.default.provider` |\n| `run.sandbox.preserve` | `environments.default.lifecycle.preserve` |\n| `run.sandbox.env` | `environments.default.env` |\n| `run.sandbox.daytona.skip_clone = true` | `run.clone.enabled = false` |\n| `run.sandbox.docker.skip_clone = true` | `run.clone.enabled = false` |\n| `run.sandbox.daytona.auto_stop_interval = N` | `environments.default.lifecycle.auto_stop = \"{N}m\"` |\n| `run.sandbox.daytona.labels` | `environments.default.labels` |\n| `run.sandbox.daytona.snapshot.name` | `environments.default.image.ref` |\n| `run.sandbox.daytona.snapshot.cpu` | `environments.default.resources.cpu` |\n| `run.sandbox.daytona.snapshot.memory` | `environments.default.resources.memory` |\n| `run.sandbox.daytona.snapshot.disk` | `environments.default.resources.disk` |\n| `run.sandbox.daytona.snapshot.dockerfile` | `environments.default.image.dockerfile` |\n| `run.sandbox.daytona.volumes[].volume_id` | `environments.default.volumes[].id` |\n| `run.sandbox.daytona.volumes[].mount_path` | `environments.default.volumes[].mount_path` |\n| `run.sandbox.daytona.volumes[].subpath` | `environments.default.volumes[].subpath` |\n| `run.sandbox.docker.image` | `environments.default.image.ref` |\n| `run.sandbox.docker.memory_limit` | `environments.default.resources.memory` |\n| `run.sandbox.docker.cpu_quota` | `environments.default.resources.cpu` when divisible by `100000` |\n\nUnsupported or ambiguous cases fail with a message shaped like:\n\n```text\nLegacy [run.sandbox] settings in <path> could not be auto-migrated.\n\nUnsupported keys:\n  - run.sandbox.daytona.foo\n  - run.sandbox.docker.cpu_quota\n\nRename legacy sandbox configuration to [run.environment] and [environments.<slug>].\nSee docs/public/execution/environments.mdx.\n```\n\nSuccessful migration writes a backup next to the original file:\n\n```text\nsettings.toml.legacy-sandbox-migration.bak\nsettings.toml.legacy-sandbox-migration.1.bak\nsettings.toml.legacy-sandbox-migration.2.bak\n```\n\nSuccessful migration emits:\n\n```text\nMigrated legacy [run.sandbox] settings in <path> to [run.environment] and [environments.default]. Backup written to <backup>. This temporary compatibility migration will be removed before v1.0.\n```\n\n## Task 1: Add the Migration Module Skeleton\n\n**Files:**\n- Create: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n- Modify: `lib/crates/fabro-config/src/lib.rs`\n- Modify: `lib/crates/fabro-config/Cargo.toml`\n\n- [ ] **Step 1: Add the `toml_edit` dependency**\n\nAdd this to `[dependencies]` in `lib/crates/fabro-config/Cargo.toml`:\n\n```toml\ntoml_edit.workspace = true\n```\n\n- [ ] **Step 2: Register the module privately**\n\nAdd this beside the other private modules in `lib/crates/fabro-config/src/lib.rs`:\n\n```rust\nmod legacy_sandbox_migration;\n```\n\n- [ ] **Step 3: Create the module API**\n\nCreate `lib/crates/fabro-config/src/legacy_sandbox_migration.rs` with this starting shape:\n\n```rust\n#![expect(\n    clippy::disallowed_methods,\n    reason = \"temporary startup config migration uses synchronous file I/O before config is loaded\"\n)]\n\nuse std::fmt;\nuse std::path::{Path, PathBuf};\n\nuse toml_edit::{DocumentMut, Item, Table, Value};\n\nuse crate::{Error, Result, SettingsLayer};\n\npub(crate) const REMOVAL_NOTE: &str =\n    \"This temporary compatibility migration will be removed before v1.0.\";\n\n#[derive(Debug, Clone, PartialEq, Eq)]\npub(crate) struct LegacySandboxMigrationReport {\n    pub(crate) contents:    String,\n    pub(crate) backup_path: PathBuf,\n    pub(crate) warning:     String,\n}\n\n#[derive(Debug, Clone, PartialEq, Eq)]\nstruct MigrationFailure {\n    unsupported_keys: Vec<String>,\n}\n\nimpl fmt::Display for MigrationFailure {\n    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n        writeln!(f, \"Legacy [run.sandbox] settings could not be auto-migrated.\")?;\n        writeln!(f)?;\n        writeln!(f, \"Unsupported keys:\")?;\n        for key in &self.unsupported_keys {\n            writeln!(f, \"  - {key}\")?;\n        }\n        writeln!(f)?;\n        write!(\n            f,\n            \"Rename legacy sandbox configuration to [run.environment] and [environments.<slug>]. See docs/public/execution/environments.mdx.\"\n        )\n    }\n}\n\npub(crate) fn migrate_settings_path(\n    path: &Path,\n    original_contents: &str,\n) -> Result<Option<LegacySandboxMigrationReport>> {\n    let Some(next_contents) = migrate_contents(original_contents, path)? else {\n        return Ok(None);\n    };\n\n    next_contents\n        .parse::<SettingsLayer>()\n        .map_err(|err| Error::parse_file(\"Migrated settings file is invalid\", path, err))?;\n\n    let backup_path = next_backup_path(path);\n    std::fs::write(&backup_path, original_contents).map_err(|source| {\n        Error::other(format!(\n            \"writing legacy sandbox migration backup {}: {source}\",\n            backup_path.display()\n        ))\n    })?;\n    std::fs::write(path, &next_contents).map_err(|source| {\n        Error::other(format!(\n            \"writing migrated settings file {}: {source}\",\n            path.display()\n        ))\n    })?;\n\n    let warning = format!(\n        \"Migrated legacy [run.sandbox] settings in {} to [run.environment] and [environments.default]. Backup written to {}. {REMOVAL_NOTE}\",\n        path.display(),\n        backup_path.display()\n    );\n\n    Ok(Some(LegacySandboxMigrationReport {\n        contents: next_contents,\n        backup_path,\n        warning,\n    }))\n}\n\nfn migrate_contents(original_contents: &str, path: &Path) -> Result<Option<String>> {\n    let mut doc = match original_contents.parse::<DocumentMut>() {\n        Ok(doc) => doc,\n        Err(_) => return Ok(None),\n    };\n\n    if !has_legacy_run_sandbox(&doc) {\n        return Ok(None);\n    }\n    if has_new_environment_config(&doc) {\n        return Err(Error::other(format!(\n            \"Legacy [run.sandbox] settings in {} could not be auto-migrated because the file already contains [run.environment] or [environments.default]. Remove one config style and retry.\",\n            path.display()\n        )));\n    }\n\n    migrate_document(&mut doc).map_err(|failure| {\n        Error::other(format!(\n            \"Legacy [run.sandbox] settings in {} could not be auto-migrated.\\n\\n{}\",\n            path.display(),\n            failure\n        ))\n    })?;\n\n    Ok(Some(doc.to_string()))\n}\n\nfn has_legacy_run_sandbox(doc: &DocumentMut) -> bool {\n    doc.get(\"run\")\n        .and_then(Item::as_table)\n        .and_then(|run| run.get(\"sandbox\"))\n        .is_some()\n}\n\nfn has_new_environment_config(doc: &DocumentMut) -> bool {\n    let has_run_environment = doc\n        .get(\"run\")\n        .and_then(Item::as_table)\n        .and_then(|run| run.get(\"environment\"))\n        .is_some();\n    let has_default_environment = doc\n        .get(\"environments\")\n        .and_then(Item::as_table)\n        .and_then(|envs| envs.get(\"default\"))\n        .is_some();\n    has_run_environment || has_default_environment\n}\n\nfn next_backup_path(path: &Path) -> PathBuf {\n    let base = path.with_file_name(format!(\n        \"{}.legacy-sandbox-migration.bak\",\n        path.file_name()\n            .and_then(|name| name.to_str())\n            .unwrap_or(\"settings.toml\")\n    ));\n    if !base.exists() {\n        return base;\n    }\n\n    for index in 1.. {\n        let candidate = path.with_file_name(format!(\n            \"{}.legacy-sandbox-migration.{index}.bak\",\n            path.file_name()\n                .and_then(|name| name.to_str())\n                .unwrap_or(\"settings.toml\")\n        ));\n        if !candidate.exists() {\n            return candidate;\n        }\n    }\n    unreachable!(\"unbounded backup suffix search should return\")\n}\n```\n\n- [ ] **Step 4: Add placeholder-free private stubs that compile**\n\nAdd private helpers with `unimplemented!()` only inside tests disabled by `#[cfg(test)]` is not allowed. Instead, make `migrate_document` return the one known unsupported failure until Task 2 fills it:\n\n```rust\nfn migrate_document(_doc: &mut DocumentMut) -> std::result::Result<(), MigrationFailure> {\n    Err(MigrationFailure {\n        unsupported_keys: vec![\"run.sandbox\".to_string()],\n    })\n}\n```\n\n- [ ] **Step 5: Run the focused compile check**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: compiles; there may be zero tests in this module at this point.\n\n## Task 2: Implement Provider-Only Migration\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add tests for provider-only migration**\n\nAdd these tests inside `legacy_sandbox_migration.rs`:\n\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use fabro_types::settings::run::EnvironmentProvider;\n\n    fn migrate(source: &str) -> String {\n        migrate_contents(source, Path::new(\"settings.toml\"))\n            .expect(\"migration should not error\")\n            .expect(\"legacy sandbox should migrate\")\n    }\n\n    #[test]\n    fn provider_only_daytona_config_migrates_to_default_environment() {\n        let migrated = migrate(\n            r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#,\n        );\n\n        let settings = migrated\n            .parse::<SettingsLayer>()\n            .expect(\"migrated TOML should parse\");\n        let resolved = crate::WorkflowSettingsBuilder::from_layer(&settings)\n            .expect(\"migrated settings should resolve\")\n            .run;\n\n        assert_eq!(resolved.environment.id, \"default\");\n        assert_eq!(resolved.environment.provider, EnvironmentProvider::Daytona);\n        assert!(migrated.contains(\"[run.environment]\"));\n        assert!(migrated.contains(\"[environments.default]\"));\n        assert!(!migrated.contains(\"[run.sandbox]\"));\n    }\n\n    #[test]\n    fn non_legacy_config_is_not_migrated() {\n        let migrated = migrate_contents(\"_version = 1\\n\", Path::new(\"settings.toml\"))\n            .expect(\"non-legacy TOML should not error\");\n\n        assert!(migrated.is_none());\n    }\n}\n```\n\n- [ ] **Step 2: Run tests and confirm failure**\n\nRun:\n\n```bash\ncargo test -p fabro-config provider_only_daytona_config_migrates_to_default_environment --quiet\n```\n\nExpected: FAIL because `migrate_document` still returns unsupported `run.sandbox`.\n\n- [ ] **Step 3: Replace `migrate_document` with provider migration**\n\nImplement the initial migration:\n\n```rust\nfn migrate_document(doc: &mut DocumentMut) -> std::result::Result<(), MigrationFailure> {\n    let Some(sandbox_item) = doc\n        .get(\"run\")\n        .and_then(Item::as_table)\n        .and_then(|run| run.get(\"sandbox\"))\n    else {\n        return Ok(());\n    };\n    let Some(sandbox) = sandbox_item.as_table().cloned() else {\n        return Err(MigrationFailure {\n            unsupported_keys: vec![\"run.sandbox\".to_string()],\n        });\n    };\n\n    let mut unsupported = Vec::new();\n    for (key, _) in sandbox.iter() {\n        if key != \"provider\" {\n            unsupported.push(format!(\"run.sandbox.{key}\"));\n        }\n    }\n    if !unsupported.is_empty() {\n        return Err(MigrationFailure {\n            unsupported_keys: unsupported,\n        });\n    }\n\n    let Some(provider) = sandbox.get(\"provider\").and_then(Item::as_str) else {\n        return Err(MigrationFailure {\n            unsupported_keys: vec![\"run.sandbox.provider\".to_string()],\n        });\n    };\n\n    set_value(path_table(doc, &[\"run\", \"environment\"]), \"id\", Value::from(\"default\"));\n    set_value(\n        path_table(doc, &[\"environments\", \"default\"]),\n        \"provider\",\n        Value::from(provider),\n    );\n\n    remove_run_sandbox(doc);\n    Ok(())\n}\n\nfn path_table<'a>(doc: &'a mut DocumentMut, path: &[&str]) -> &'a mut Table {\n    let mut item = doc.as_item_mut();\n    for segment in path {\n        item = &mut item[segment];\n        if !item.is_table() {\n            *item = Item::Table(Table::new());\n        }\n    }\n    item.as_table_mut().expect(\"path item should be a table\")\n}\n\nfn set_value(table: &mut Table, key: &str, value: Value) {\n    table[key] = Item::Value(value);\n}\n\nfn remove_run_sandbox(doc: &mut DocumentMut) {\n    if let Some(run) = doc.get_mut(\"run\").and_then(Item::as_table_mut) {\n        run.remove(\"sandbox\");\n    }\n}\n```\n\n- [ ] **Step 4: Run focused tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS.\n\n## Task 3: Add Daytona and Docker Field Mappings\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add tests for direct legacy field mappings**\n\nAdd tests that assert resolved behavior, not only string contents:\n\n```rust\n#[test]\nfn daytona_snapshot_labels_lifecycle_and_volumes_migrate() {\n    let migrated = migrate(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\npreserve = true\n\n[run.sandbox.env]\nNODE_ENV = \"development\"\n\n[run.sandbox.daytona]\nauto_stop_interval = 30\n\n[run.sandbox.daytona.labels]\nrepo = \"fabro-sh/fabro\"\n\n[run.sandbox.daytona.snapshot]\nname = \"fabro-v11\"\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\ndockerfile = { path = \"Dockerfile\" }\n\n[[run.sandbox.daytona.volumes]]\nvolume_id = \"vol_auth\"\nmount_path = \"/home/daytona/.config\"\nsubpath = \"agents\"\n\"#,\n    );\n\n    let settings = migrated.parse::<SettingsLayer>().expect(\"migrated TOML should parse\");\n    let resolved = crate::WorkflowSettingsBuilder::from_layer(&settings)\n        .expect(\"migrated settings should resolve\")\n        .run\n        .environment;\n\n    assert_eq!(resolved.image.reference.as_deref(), Some(\"fabro-v11\"));\n    assert_eq!(resolved.resources.cpu, Some(8));\n    assert_eq!(resolved.resources.memory.map(|size| size.as_bytes()), Some(16_000_000_000));\n    assert_eq!(resolved.resources.disk.map(|size| size.as_bytes()), Some(20_000_000_000));\n    assert!(resolved.lifecycle.preserve);\n    assert_eq!(resolved.lifecycle.auto_stop.map(|duration| duration.as_std().as_secs()), Some(1800));\n    assert_eq!(resolved.labels.get(\"repo\").map(String::as_str), Some(\"fabro-sh/fabro\"));\n    assert_eq!(resolved.env.get(\"NODE_ENV\").map(|value| value.as_source()).as_deref(), Some(\"development\"));\n    assert_eq!(resolved.volumes.len(), 1);\n    assert_eq!(resolved.volumes[0].id, \"vol_auth\");\n    assert_eq!(resolved.volumes[0].mount_path, \"/home/daytona/.config\");\n    assert_eq!(resolved.volumes[0].subpath.as_deref(), Some(\"agents\"));\n}\n\n#[test]\nfn docker_image_memory_and_cpu_quota_migrate() {\n    let migrated = migrate(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"docker\"\n\n[run.sandbox.docker]\nimage = \"buildpack-deps:noble\"\nmemory_limit = \"4GB\"\ncpu_quota = 200000\n\"#,\n    );\n\n    let settings = migrated.parse::<SettingsLayer>().expect(\"migrated TOML should parse\");\n    let resolved = crate::WorkflowSettingsBuilder::from_layer(&settings)\n        .expect(\"migrated settings should resolve\")\n        .run\n        .environment;\n\n    assert_eq!(resolved.provider, EnvironmentProvider::Docker);\n    assert_eq!(resolved.image.reference.as_deref(), Some(\"buildpack-deps:noble\"));\n    assert_eq!(resolved.resources.cpu, Some(2));\n    assert_eq!(resolved.resources.memory.map(|size| size.as_bytes()), Some(4_000_000_000));\n}\n```\n\n- [ ] **Step 2: Run tests and confirm failure**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: FAIL because the two new nested-mapping tests are not implemented yet.\n\n- [ ] **Step 3: Implement table copying and value transforms**\n\nExtend `migrate_document` so it:\n\n- Allows top-level legacy keys `provider`, `preserve`, `env`, `daytona`, and `docker`.\n- Copies `run.sandbox.env` into `environments.default.env`.\n- Sets `environments.default.lifecycle.preserve` from `run.sandbox.preserve`.\n- Handles provider-specific nested mappings only for the selected provider.\n- Removes `run.sandbox` after successful migration.\n\nUse helper functions with these signatures:\n\n```rust\nfn migrate_daytona(sandbox: &Table, env: &mut Table, unsupported: &mut Vec<String>);\nfn migrate_docker(sandbox: &Table, env: &mut Table, unsupported: &mut Vec<String>);\nfn copy_table(source: &Item, target: &mut Table);\nfn copy_array_of_tables_with_volume_id(source: &Item, target: &mut Table, unsupported: &mut Vec<String>);\nfn item_path_keys(prefix: &str, item: &Item, out: &mut Vec<String>);\n```\n\nImplementation rules:\n\n- `auto_stop_interval` must be an integer. Store `format!(\"{minutes}m\")`.\n- `docker.cpu_quota` must be an integer divisible by `100000`; otherwise add `run.sandbox.docker.cpu_quota` to unsupported keys.\n- For Daytona volumes, each array entry may contain only `volume_id`, `mount_path`, and `subpath`; rename `volume_id` to `id`.\n- `daytona.snapshot.dockerfile` must be copied as the existing TOML value, preserving inline string or `{ path = \"...\" }`.\n- When collecting unsupported nested keys, report full paths such as `run.sandbox.daytona.snapshot.foo`.\n\n- [ ] **Step 4: Run focused tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS.\n\n## Task 4: Add File Rewrite and Loader Hook\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add file rewrite tests**\n\nAdd tests:\n\n```rust\n#[test]\nfn migrate_settings_path_writes_backup_and_rewrites_original() {\n    let dir = tempfile::tempdir().expect(\"temp dir\");\n    let path = dir.path().join(\"settings.toml\");\n    let original = r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#;\n    std::fs::write(&path, original).expect(\"write fixture\");\n\n    let report = migrate_settings_path(&path, original)\n        .expect(\"migration should succeed\")\n        .expect(\"legacy config should migrate\");\n\n    let rewritten = std::fs::read_to_string(&path).expect(\"read rewritten settings\");\n    let backup = std::fs::read_to_string(&report.backup_path).expect(\"read backup\");\n\n    assert_eq!(backup, original);\n    assert!(rewritten.contains(\"[run.environment]\"));\n    assert!(rewritten.contains(\"[environments.default]\"));\n    assert!(report.warning.contains(\"temporary compatibility migration\"));\n}\n\n#[test]\nfn existing_backup_uses_numbered_suffix() {\n    let dir = tempfile::tempdir().expect(\"temp dir\");\n    let path = dir.path().join(\"settings.toml\");\n    std::fs::write(path.with_file_name(\"settings.toml.legacy-sandbox-migration.bak\"), \"old\")\n        .expect(\"write existing backup\");\n\n    let next = next_backup_path(&path);\n\n    assert!(next.ends_with(\"settings.toml.legacy-sandbox-migration.1.bak\"));\n}\n```\n\n- [ ] **Step 2: Run tests and confirm current state**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS if Task 1 file-writing code compiled; otherwise fix only the migration module.\n\n- [ ] **Step 3: Hook migration into file loading**\n\nChange `load_settings_path` in `lib/crates/fabro-config/src/load.rs` to this shape:\n\n```rust\npub(crate) fn load_settings_path(path: &Path) -> Result<SettingsLayer> {\n    let content = std::fs::read_to_string(path).map_err(|source| Error::read_file(path, source))?;\n    let mut layer = match content.parse::<SettingsLayer>() {\n        Ok(layer) => layer,\n        Err(err) => match crate::legacy_sandbox_migration::migrate_settings_path(path, &content)? {\n            Some(report) => {\n                tracing::warn!(\"{}\", report.warning);\n                eprintln!(\"{}\", report.warning);\n                report.contents.parse::<SettingsLayer>().map_err(|err| {\n                    Error::parse_file(\"Migrated settings file is invalid\", path, err)\n                })?\n            }\n            None => return Err(Error::parse_file(\"Failed to parse settings file\", path, err)),\n        },\n    };\n    let base_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n    resolve_goal_file_paths(&mut layer, base_dir);\n    Ok(layer)\n}\n```\n\n- [ ] **Step 4: Run loader-level verification**\n\nAdd a test in `load.rs` under `#[cfg(test)]` if the file does not already have a test module:\n\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use fabro_types::settings::run::EnvironmentProvider;\n\n    #[test]\n    fn load_settings_path_auto_migrates_legacy_sandbox_file() {\n        let dir = tempfile::tempdir().expect(\"temp dir\");\n        let path = dir.path().join(\"settings.toml\");\n        std::fs::write(\n            &path,\n            r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#,\n        )\n        .expect(\"write legacy settings\");\n\n        let layer = load_settings_path(&path).expect(\"legacy settings should auto-migrate\");\n        let resolved = crate::WorkflowSettingsBuilder::from_layer(&layer)\n            .expect(\"migrated settings should resolve\")\n            .run;\n\n        assert_eq!(resolved.environment.provider, EnvironmentProvider::Daytona);\n        assert!(std::fs::read_to_string(&path)\n            .expect(\"read rewritten settings\")\n            .contains(\"[run.environment]\"));\n    }\n}\n```\n\nRun:\n\n```bash\ncargo test -p fabro-config load_settings_path_auto_migrates_legacy_sandbox_file --quiet\n```\n\nExpected: PASS.\n\n- [ ] **Step 5: Verify in-memory TOML parsing remains strict**\n\nRun the existing current-main rejection test:\n\n```bash\ncargo test -p fabro-config legacy_run_sandbox_is_rejected --quiet\n```\n\nExpected: PASS. Do not weaken `SettingsLayer` deserialization to accept `run.sandbox`; only `load_settings_path` should rewrite files from disk.\n\n## Task 5: Unsupported and Ambiguous Cases\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/legacy_sandbox_migration.rs`\n\n- [ ] **Step 1: Add failure tests**\n\nAdd tests:\n\n```rust\n#[test]\nfn existing_new_environment_config_is_ambiguous() {\n    let err = migrate_contents(\n        r#\"\n_version = 1\n\n[run.environment]\nid = \"default\"\n\n[run.sandbox]\nprovider = \"daytona\"\n\"#,\n        Path::new(\"settings.toml\"),\n    )\n    .expect_err(\"mixed old and new config should fail\");\n\n    assert!(err.to_string().contains(\"already contains [run.environment]\"));\n}\n\n#[test]\nfn unsupported_keys_are_reported_with_full_paths() {\n    let err = migrate_contents(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"daytona\"\n\n[run.sandbox.daytona]\nunknown = true\n\"#,\n        Path::new(\"settings.toml\"),\n    )\n    .expect_err(\"unsupported keys should fail migration\");\n\n    let rendered = err.to_string();\n    assert!(rendered.contains(\"run.sandbox.daytona.unknown\"));\n    assert!(rendered.contains(\"docs/public/execution/environments.mdx\"));\n}\n\n#[test]\nfn unsupported_docker_cpu_quota_is_reported() {\n    let err = migrate_contents(\n        r#\"\n_version = 1\n\n[run.sandbox]\nprovider = \"docker\"\n\n[run.sandbox.docker]\ncpu_quota = 250000\n\"#,\n        Path::new(\"settings.toml\"),\n    )\n    .expect_err(\"non-divisible cpu quota should fail migration\");\n\n    assert!(err.to_string().contains(\"run.sandbox.docker.cpu_quota\"));\n}\n```\n\n- [ ] **Step 2: Run failure tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config legacy_sandbox_migration --quiet\n```\n\nExpected: PASS.\n\n## Task 6: Documentation\n\n**Files:**\n- Modify: `docs/public/execution/environments.mdx`\n- Create: `docs/public/changelog/2026-05-23.mdx`\n\n- [ ] **Step 1: Document temporary auto-migration**\n\nAdd this note near the top of `docs/public/execution/environments.mdx`, after the initial environment/sandbox distinction:\n\n```mdx\n<Warning>\nOlder pre-v1.0 config files that still use `[run.sandbox]` are temporarily auto-migrated when Fabro loads them from disk. Fabro writes a sibling `*.legacy-sandbox-migration.bak` file, rewrites the config to `[run.environment]` plus `[environments.default]`, and then continues startup.\n\nThis compatibility rewrite only handles direct field mappings. Unsupported legacy fields fail with a migration message that lists the keys to edit manually. The rewrite path will be removed before v1.0.\n</Warning>\n```\n\n- [ ] **Step 2: Add a changelog note**\n\nCreate `docs/public/changelog/2026-05-23.mdx`:\n\n```mdx\n---\ntitle: \"Legacy sandbox config migration\"\ndate: \"2026-05-23\"\n---\n\n## Legacy sandbox config auto-migration\n\nFabro now temporarily rewrites confidently migratable pre-v1.0 `[run.sandbox]` config files to the named environment syntax. A backup is written next to the original file before rewriting. Ambiguous or unsupported legacy keys fail with a targeted migration message instead of the generic TOML unknown-field error.\n```\n\n- [ ] **Step 3: Check docs references**\n\nRun:\n\n```bash\nrg -n \"\\\\[run\\\\.sandbox\\\\]|legacy-sandbox-migration|run\\\\.environment\" docs/public/execution docs/public/changelog\n```\n\nExpected: remaining `[run.sandbox]` references are either historical changelog entries or explicit migration warnings.\n\n## Task 7: Full Verification\n\n**Files:**\n- All files touched above.\n\n- [ ] **Step 1: Run config crate tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config --quiet\n```\n\nExpected: PASS.\n\n- [ ] **Step 2: Run formatting check**\n\nRun:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\nExpected: PASS.\n\n- [ ] **Step 3: Optional workspace lint if formatting and tests pass**\n\nRun:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\nExpected: PASS. If this is slow, record that it was not run and include the reason in the handoff.\n\n## Acceptance Criteria\n\n- Boot-time config loading rewrites simple legacy `[run.sandbox]` files without user action.\n- The rewritten file uses `[run.environment] id = \"default\"` and `[environments.default]`.\n- The original file is preserved in a sibling backup before rewrite.\n- Unsupported legacy keys fail with a targeted migration message listing exact keys.\n- Normal strict schema behavior remains unchanged for in-memory `from_toml` calls.\n- All legacy migration code is isolated in `legacy_sandbox_migration.rs` and removable before v1.0.\n",
           "internal.node_visit_count": 1,
           "failure_signature": "",
           "internal.retry_count.start": 0,
-          "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
+          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
           "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
           "internal.fidelity": "compact",
           "internal.retry_count.toolchain": 0,
+          "thread.toolchain.current_node": "preflight_compile",
           "graph.rankdir": "LR"
         },
         "node_outcomes": {
+          "preflight_compile": {
+            "status": "succeeded",
+            "context_updates": {
+              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
+            },
+            "notes": "Script completed: cargo check -q --workspace 2>&1",
+            "usage": null
+          },
           "start": {
             "status": "succeeded",
             "usage": null
@@ -574,8 +642,9 @@
             "usage": null
           }
         },
-        "next_node_id": "preflight_compile",
+        "next_node_id": "preflight_lint",
         "node_visits": {
+          "preflight_compile": 1,
           "toolchain": 1,
           "start": 1
         }
@@ -641,7 +710,12 @@
       "first_event_seq": 22,
       "prompt": null,
       "response": null,
-      "completion": null,
+      "completion": {
+        "outcome": "succeeded",
+        "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
+        "failure_reason": null,
+        "timestamp": "2026-05-23T19:56:24.907697Z"
+      },
       "provider_used": null,
       "diff": null,
       "script_invocation": {
@@ -649,10 +723,53 @@
         "command": "exec 2>&1\ncommand -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
         "language": "shell"
       },
+      "script_timing": {
+        "output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
+        "exit_code": 0,
+        "duration_ms": 1412,
+        "termination": "exited",
+        "output_bytes": 36,
+        "live_streaming": true
+      },
+      "parallel_results": null,
+      "output": null,
+      "output_bytes": 36,
+      "live_streaming": true,
+      "termination": "exited",
+      "started_at": "2026-05-23T19:56:23.484931Z",
+      "handler": "command",
+      "timing": {
+        "wall_time_ms": 1422,
+        "inference_time_ms": 0,
+        "tool_time_ms": 0,
+        "active_time_ms": 0
+      },
+      "usage": {
+        "input_tokens": 0,
+        "output_tokens": 0,
+        "total_tokens": 0,
+        "reasoning_tokens": 0,
+        "cache_read_tokens": 0,
+        "cache_write_tokens": 0
+      },
+      "state": "succeeded"
+    },
+    "preflight_compile@1": {
+      "first_event_seq": 32,
+      "prompt": null,
+      "response": null,
+      "completion": null,
+      "provider_used": null,
+      "diff": null,
+      "script_invocation": {
+        "script": "cargo check -q --workspace 2>&1",
+        "command": "exec 2>&1\ncargo check -q --workspace 2>&1",
+        "language": "shell"
+      },
       "script_timing": null,
       "parallel_results": null,
       "output": null,
-      "started_at": "2026-05-23T19:56:23.484931Z",
+      "started_at": "2026-05-23T19:56:28.620390Z",
       "handler": "command",
       "usage": {
         "input_tokens": 0,
diff --git a/stages/002-toolchain@1/output.log b/stages/002-toolchain@1/output.log
new file mode 100644
index 000000000..4e86d161d
--- /dev/null
+++ b/stages/002-toolchain@1/output.log
@@ -0,0 +1 @@
+blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c
\ No newline at end of file
diff --git a/stages/002-toolchain@1/script_timing.json b/stages/002-toolchain@1/script_timing.json
new file mode 100644
index 000000000..0e9d2f359
--- /dev/null
+++ b/stages/002-toolchain@1/script_timing.json
@@ -0,0 +1,8 @@
+{
+  "output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
+  "exit_code": 0,
+  "duration_ms": 1412,
+  "termination": "exited",
+  "output_bytes": 36,
+  "live_streaming": true
+}
\ No newline at end of file
diff --git a/stages/002-toolchain@1/status.json b/stages/002-toolchain@1/status.json
new file mode 100644
index 000000000..6a68b4358
--- /dev/null
+++ b/stages/002-toolchain@1/status.json
@@ -0,0 +1,6 @@
+{
+  "outcome": "succeeded",
+  "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
+  "failure_reason": null,
+  "timestamp": "2026-05-23T19:56:24.907697Z"
+}
\ No newline at end of file
diff --git a/stages/003-preflight_compile@1/script_invocation.json b/stages/003-preflight_compile@1/script_invocation.json
new file mode 100644
index 000000000..d3abb832f
--- /dev/null
+++ b/stages/003-preflight_compile@1/script_invocation.json
@@ -0,0 +1,5 @@
+{
+  "script": "cargo check -q --workspace 2>&1",
+  "command": "exec 2>&1\ncargo check -q --workspace 2>&1",
+  "language": "shell"
+}
\ No newline at end of file