@aitne/daemon 0.1.0

package/dist/index.js

@@ -0,0 +1,2913 @@
+import { serve } from "@hono/node-server";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { loadConfig, getContextDir, isRoadmapStale, mergeRuntimeSettingsFromDb, runVaultHealthProbe, validateExternalObsidianVaultPath, } from "./config.js";
+import { getDegradedMode, isSetupCompleted, isUserPaused, isDegraded as readDegradedMode, } from "./db/runtime-state.js";
+import { createDefaultBangCommandRegistry } from "./core/bang-commands/index.js";
+import { initDirectories } from "./init.js";
+import { createDatabase } from "./db/client.js";
+import { applySchema } from "./db/schema.js";
+import { readIntegrations } from "./db/integrations-store.js";
+import { getRepositoryByGithub, getRepositoryByLocalPath, listRepositories, selectGithubRepoSlugs, selectGitWatchedRepos, } from "./db/repositories-store.js";
+import { dispatchMatchingTriggers } from "./core/trigger-dispatch.js";
+import { EventBus } from "./core/event-bus.js";
+import { AgentScheduler } from "./core/scheduler.js";
+import { CustomRoutineScheduler } from "./core/custom-routine-scheduler.js";
+import { HealthMonitor } from "./core/health-monitor.js";
+import { Heartbeat } from "./core/heartbeat.js";
+import { MessageHub } from "./adapters/message-hub.js";
+import { ObserverManager } from "./observers/manager.js";
+import { ObsidianWatcher } from "./observers/obsidian-watcher.js";
+import { PrimaryVaultWatcher } from "./observers/primary-vault-watcher.js";
+import { ContextIndexReconcilerObserver } from "./observers/context-index-reconciler-observer.js";
+import { EntityMirrorObserver } from "./observers/entity-mirror-observer.js";
+import { GitWatcher } from "./observers/git-watcher.js";
+import { GitHubPoller } from "./observers/github-poller.js";
+import { GitAccountRegistry } from "./services/git-account-registry.js";
+import { GitDelegatedCronObserver, hasActiveDelegatedGitLifecycleIntegration, } from "./observers/git-delegated-cron.js";
+import { RepositoryManagementCron } from "./observers/repository-management-cron.js";
+import { ObservationSummarizerWorker, AnthropicSummarizerClient, UnsupportedSummarizerClient, } from "./observers/observation-summarizer/index.js";
+import { CalendarPoller } from "./observers/calendar-poller.js";
+import { ImminentEventScheduler } from "./observers/imminent-event-scheduler.js";
+import { DelegatedSyncWorker, hasActiveDelegatedSyncIntegration, } from "./observers/delegated-sync-worker.js";
+import { applyIntegrationModeChange, shouldStartObserversFor, } from "./core/integration-lifecycle.js";
+import { NotionPoller } from "./observers/notion-poller.js";
+import { DiscordAdapter } from "./adapters/discord.js";
+import { SlackAdapter } from "./adapters/slack-adapter.js";
+import { TelegramAdapter } from "./adapters/telegram-adapter.js";
+import { DashboardAdapter } from "./adapters/dashboard-adapter.js";
+import { WhatsAppAdapter } from "./adapters/whatsapp-adapter.js";
+import { CalendarService } from "./services/calendar.js";
+import { AppleCalendarService } from "./services/apple-calendar/index.js";
+import { GmailService } from "./services/gmail.js";
+import { detectGoogleCredentialType } from "./services/google-auth.js";
+import { ObsidianService } from "./services/obsidian.js";
+import { NotionService } from "./services/notion.js";
+import { GitHubService } from "./services/github.js";
+import { createServiceRegistry } from "./services/service-registry.js";
+import { SignalDetector } from "./core/signal-detector.js";
+import { EventDispatcher } from "./core/dispatcher.js";
+import { ClaudeCodeCore } from "./core/backends/claude-code-core.js";
+import { BackendRouter } from "./core/backends/backend-router.js";
+import { ensureBackendMaterialized, syncAllUserSkills, buildConfiguredServices, refreshDmSessionWorkdirs, validateDelegatedStartup, } from "./core/workdir.js";
+import { CodexCore } from "./core/backends/codex-core.js";
+import { GeminiCliCore } from "./core/backends/gemini-cli-core.js";
+import { PriceFetcher } from "./core/backends/price-fetcher.js";
+import { AuthTelemetry } from "./core/backends/auth-telemetry.js";
+import { AuthHealthMonitor, AUTH_PROBE_NOTIFICATION_CATEGORY } from "./core/backends/auth-health-monitor.js";
+import { AuthRecovery } from "./core/backends/auth-recovery.js";
+import { ContextBuilder } from "./core/context-builder.js";
+import { getTaskFlow, initTaskFlows } from "./core/prompts.js";
+import { ensureSkeletonFiles, resolveTemplatesRoot } from "./core/skeleton.js";
+import { normalizeGitWatchedRepos, queueGitProjectUpdate, queueMissingGitProjectInits, seedGitProjectDocTemplates, } from "./core/git-project-docs.js";
+import { reconcileTemplateAssets, recordInstructionAssetStatus, recordSkillAssetStatus, } from "./core/release-assets.js";
+import { SessionManager } from "./core/session-manager.js";
+import { MessageRecorder } from "./core/message-recorder.js";
+import { ScopedReadSensitiveTokenManager } from "./core/read-sensitive-token-manager.js";
+import { NotificationManager } from "./adapters/notification-manager.js";
+import { recordProactiveForwardDeliveries } from "./core/channel-timeline.js";
+import { continueDashboardSession as continueDashboardSessionFromHistory, endDashboardSession as endDashboardSessionFromChannel, markContextChanged, } from "./core/dashboard-session-controls.js";
+import { AuditLogger } from "./safety/audit.js";
+import { bootstrapManagementMd, migrateLegacyManagementMd, startManagementMdWatcher, } from "./core/management-md.js";
+import { bootstrapManagementRegistry, startManagementRegistryWatcher, } from "./core/management-registry.js";
+import { bootstrapManagedTaskSeq } from "./db/managed-tasks-store.js";
+import { startDocsIndexer, } from "./core/docs/indexer.js";
+import { makeDbLookup as makeDocsCitationLookup } from "./core/docs/citation-validator.js";
+import { createDocsRoutes } from "./api/routes/docs.js";
+import { DocsQAAdapter } from "./adapters/docs-qa-adapter.js";
+import { CompositeDashboardStream } from "./adapters/composite-dashboard-stream.js";
+import { createApp } from "./api/server.js";
+import { EventBroadcaster } from "./api/routes/sse.js";
+import { APP_NAME, createEvent, EventPriority, formatSqliteDatetime, getAgentDayBoundsUtc, getAgentDayDateStr, getAgentDayProgressMinutes, getBackendIds, nowInTimezone, parseSqliteUtcMs, } from "@aitne/shared";
+import { getOwnerChannel } from "./messaging/owner-channels.js";
+import { SUPPORTED_MESSAGING_PLATFORMS, } from "./messaging/constants.js";
+import { AgentWriteTracker } from "./safety/agent-write-tracker.js";
+import { discardStalePendingSchedules, hasActionInWindow, recoverOrphanedRunningSchedules, } from "./core/schedule-maintenance.js";
+import { ContextWriteGate, InMemoryTodayWriteLockManager, MigrationLock, getTodayWriteLockTimeoutMs, } from "./core/today-write-lock.js";
+import { applyPromptContextStaleness, } from "./core/context-staleness.js";
+import { InMemoryRoadmapWriteLockManager, getRoadmapWriteLockTimeoutMs, } from "./core/roadmap-write-lock.js";
+import { sweepExpiredMigrationBackups } from "./api/routes/setup-migrate.js";
+import { createSettingsStore } from "./settings/settings-store.js";
+import { PlatformSecretStore } from "./secrets/platform-secret-store.js";
+import { FileEncryptedBlobStore } from "./secrets/encrypted-blob-store.js";
+import { AttachmentStore } from "./services/attachments/store.js";
+import { VoiceTranscriber } from "./services/voice/transcriber.js";
+import { DelegatedBackendInvoker, runDelegatedTaskOrphanJanitor, runProxyTempdirJanitor, } from "./services/delegated-backend-invoker.js";
+import { runSessionPoolTempdirJanitor } from "./services/delegated-task-session-pool.js";
+import { MailAccountRegistry } from "./services/mail/account-registry.js";
+import { loadOutlookClientConfig, OutlookClientConfigMissingError, } from "./services/mail/outlook/client-config.js";
+import { createRuntimeMsalApp } from "./services/mail/outlook/msal-app-factory.js";
+import { OutlookGraphProvider } from "./services/mail/outlook/outlook-provider.js";
+import { parseImapAccountSecret } from "./services/mail/imap/app-password.js";
+import { ICloudImapProvider } from "./services/mail/imap/icloud-provider.js";
+import { YahooImapProvider } from "./services/mail/imap/yahoo-provider.js";
+import { GmailProvider } from "./services/mail/gmail/gmail-provider.js";
+import { ensureLegacyGmailRow } from "./services/mail/gmail/legacy-row.js";
+import { syncLegacyGmailAccountState } from "./services/mail/gmail/legacy-row.js";
+import { MailPoller } from "./observers/mail-poller.js";
+import { MailReconciliationJob } from "./observers/mail-reconciliation.js";
+import { SecretBroker } from "./secrets/secret-broker.js";
+import { captureOriginalShellEnv, syncBackendApiKeyToEnv, } from "./secrets/backend-api-key-env.js";
+import { createLogger, toSafeErrorMessage } from "./logging.js";
+const logger = createLogger("daemon", {
+    transport: {
+        target: "pino-pretty",
+        options: { colorize: !process.env.PA_DAEMONIZED },
+    },
+});
+const startedAt = new Date();
+async function startup() {
+    logger.info({ logLevel: logger.level }, `${APP_NAME} Daemon starting...`);
+    // Snapshot the original shell-set values for ANTHROPIC_API_KEY /
+    // OPENAI_API_KEY / GEMINI_API_KEY+GOOGLE_API_KEY *before* any keychain
+    // mirroring runs. The capture is the source of truth for "fall back to
+    // shell env" when the operator clears the keychain entry via the
+    // dashboard. See `secrets/backend-api-key-env.ts` for precedence.
+    captureOriginalShellEnv();
+    // ── 1. Configuration ──
+    const config = loadConfig();
+    const secretBroker = new SecretBroker(new PlatformSecretStore());
+    const releaseAssetBackupRoot = join(config.dataDir, "backups", "release-assets");
+    // Tighten .env permissions BEFORE the first read/write so bootstrap
+    // values aren't world-readable between env-writer's later chmod calls.
+    // Best-effort: log and continue if chmod fails (some filesystems and
+    // CI sandboxes don't honor mode bits).
+    const { getEnvFilePath: getEnvFilePathEarly, ensureEnvFilePermissions: ensureEnvFilePermissionsEarly, } = await import("./api/env-writer.js");
+    try {
+        ensureEnvFilePermissionsEarly(getEnvFilePathEarly());
+    }
+    catch (err) {
+        logger.warn({ err }, "Could not chmod .env to 0o600 — secrets may be world-readable");
+    }
+    logger.info({ dataDir: config.dataDir, apiPort: config.apiPort }, "Config loaded");
+    // ── 2. Directory structure ──
+    initDirectories(config);
+    // ── 3. Database ──
+    const db = createDatabase(config);
+    applySchema(db);
+    // §12 ("managed_tasks.id collision after restore from backup") — ensure
+    // `managed_task_seq.next_id` is greater than the max existing mt id so a
+    // backup-restored DB cannot collide with the seq counter on the next
+    // POST. No-op when the table is empty (steady-state cost: one SELECT).
+    bootstrapManagedTaskSeq(db);
+    // Close any dashboard_chat sessions that were left `active` from before
+    // the daemon restart. They cannot be resumed cleanly: the SSE channel is
+    // gone, and `Dispatcher.currentSetupMode` is in-process state lost on
+    // restart, so a setup conversation half-way through would otherwise be
+    // re-adopted by `findActiveDashboardSessionId` and processed as regular
+    // chat against stale prompts. The setup wizard's resume path on the
+    // client-side checks active status; closing here flips the check so the
+    // wizard correctly falls through to a fresh /setup/start.
+    try {
+        const result = db
+            .prepare(`UPDATE conversation_sessions
+         SET status = 'closed'
+         WHERE scope = 'dashboard_chat' AND status = 'active'`)
+            .run();
+        if (result.changes > 0) {
+            logger.info({ closed: result.changes }, "Closed orphaned dashboard_chat sessions from previous run");
+        }
+    }
+    catch (err) {
+        logger.warn({ err }, "Failed to close orphaned dashboard_chat sessions");
+    }
+    // Chat attachment store — constructed early so adapter reload functions
+    // can reference it in closure without TypeScript "used before declaration" issues.
+    const attachmentStore = new AttachmentStore(db, config.dataDir);
+    attachmentStore.reapOrphans(24);
+    void new PriceFetcher(config.dataDir, db).refresh();
+    const settingsStore = createSettingsStore(db);
+    const persistedSettings = settingsStore.getAll();
+    mergeRuntimeSettingsFromDb(config, persistedSettings);
+    try {
+        seedGitProjectDocTemplates(config.dataDir, config.workspaceDir);
+    }
+    catch (err) {
+        logger.warn({ err }, "Failed to seed git project document templates");
+    }
+    // ── Default-correction for `delegatedTaskModeEnabled` ──
+    // The legacy `/integrations/:key/invoke` RPC was retired 2026-05-01
+    // and every delegated skill / task flow now goes through `/exec`,
+    // which is gated by this flag. Its Phase-1 canary default of `false`
+    // is now a footgun: any user with delegated integrations from before
+    // the runtime PATCH-time auto-enable landed will hit 503 on every
+    // /exec call.
+    //
+    // Heal once at boot, only when the operator never explicitly chose:
+    //   - `delegatedTaskModeEnabled` row is *absent* from settings (the
+    //     `in` check distinguishes "never set" from "explicitly false"),
+    //   - and at least one integration is currently in `delegated` mode.
+    //
+    // An explicit `false` row in `settings` is treated as operator intent
+    // and respected — emergency-disable still works.
+    if (!("delegatedTaskModeEnabled" in persistedSettings)
+        && !config.delegatedTaskModeEnabled) {
+        const integrationsAtBoot = readIntegrations(db);
+        const delegatedKeys = Object.entries(integrationsAtBoot)
+            .filter(([, state]) => state.mode === "delegated")
+            .map(([key]) => key);
+        if (delegatedKeys.length > 0) {
+            try {
+                settingsStore.set("delegatedTaskModeEnabled", true);
+                config.delegatedTaskModeEnabled = true;
+                logger.info({ delegatedKeys }, "auto-enabled delegatedTaskModeEnabled at startup — delegated integrations exist and the flag was never explicitly set");
+            }
+            catch (err) {
+                logger.error({ err, delegatedKeys }, "startup auto-enable of delegatedTaskModeEnabled failed; /exec calls may continue to 503 until PATCH /api/config sets the flag");
+            }
+        }
+    }
+    // ── Integration Delegation Framework (Phase 1) ──
+    // Reconcile `<dataDir>/integrations.md` with the DB integrations map.
+    // Creates the file on first run, parses hand-edits if present, and
+    // re-renders unconditionally so daemon-owned columns are canonical.
+    // The watcher is started later (after the observer manager) so fs-watch
+    // errors don't block boot.
+    let managementMdWatcher = null;
+    let managementRegistryWatcher = null;
+    try {
+        migrateLegacyManagementMd(config.dataDir);
+        await bootstrapManagementMd(config.dataDir, db, config.workspaceDir, {
+            externalObsidianVaultPath: config.externalObsidianVaultPath,
+            externalObsidianWatch: config.externalObsidianWatch,
+        });
+    }
+    catch (err) {
+        logger.error({ err, dataDir: config.dataDir }, "integrations.md bootstrap failed; continuing with DB state");
+    }
+    // ── Docs corpus indexer (DOCS_QA_DESIGN.md P1) ──
+    // Seeds `docs/user/` from `agent-assets/docs/` on first launch, then
+    // runs a boot-scan and starts a chokidar watcher with the same 300ms
+    // debounce window the management-md watcher uses. A startup failure
+    // is non-fatal — the daemon still serves but `/api/docs/health`
+    // surfaces `status: "degraded"`.
+    let docsIndexer = null;
+    try {
+        docsIndexer = await startDocsIndexer(db, {
+            workspaceDir: config.workspaceDir,
+            backupRoot: releaseAssetBackupRoot,
+        });
+    }
+    catch (err) {
+        logger.error({ err }, "docs indexer failed to start");
+    }
+    try {
+        recordInstructionAssetStatus(db, config.workspaceDir);
+        const skillStatus = recordSkillAssetStatus(db, config.dataDir, config.workspaceDir);
+        if (skillStatus.builtinShadowedUserSkills.length > 0) {
+            logger.warn({ slugs: skillStatus.builtinShadowedUserSkills }, "User skills are shadowed by newly-shipped built-in skills");
+        }
+    }
+    catch (err) {
+        logger.warn({ err }, "release asset status scan failed");
+    }
+    // ── Management Mode startup validation (plan §5.4) ──
+    // Delegated to `runVaultHealthProbe` so startup and the 30-second timer
+    // use identical logic. The probe internally handles:
+    //   - plain mode  → clear any stale degraded state
+    //   - obsidian mode + setup incomplete → clear (bootstrapping bypass so
+    //     the DM-driven setup flow is not blocked by 503)
+    //   - obsidian mode + primaryVaultPath null → degraded
+    //   - obsidian mode + path unreachable → degraded
+    //   - obsidian mode + path reachable → lift
+    const startupProbe = runVaultHealthProbe(config, db);
+    if (startupProbe.action === "entered") {
+        logger.warn({ reason: startupProbe.reason }, "Management Mode degraded at startup");
+    }
+    else if (startupProbe.action === "lifted") {
+        logger.info("Management Mode degraded state cleared at startup");
+    }
+    if (process.env.PA_VAULT_STRICT === "1" && readDegradedMode(db)) {
+        const state = getDegradedMode(db);
+        logger.fatal({ degradedState: state }, "PA_VAULT_STRICT=1 and degraded mode active — exiting");
+        process.exit(1);
+    }
+    if (isSetupCompleted(db) && !readDegradedMode(db)) {
+        const contextDir = getContextDir(config);
+        ensureSkeletonFiles(contextDir, config.workspaceDir);
+        // ── Management Registry boot reconcile (design 21 §7.2 / P2) ──
+        // Mirrors `bootstrapManagementMd` (which owns integrations.md). Reads
+        // `<contextDir>/rules/management.md` and reconciles its A-section with
+        // `settings.sot_bindings`; renders a fresh v3 file when the on-disk
+        // copy is v2 (no schema_version) or forward-incompat (>= v4). Run
+        // after `ensureSkeletonFiles` so the seeded template is the parse
+        // target on first install.
+        try {
+            await bootstrapManagementRegistry(contextDir, db);
+        }
+        catch (err) {
+            logger.error({ err, contextDir }, "rules/management.md bootstrap failed; continuing with DB state");
+        }
+        // Release asset reconcile (future-proofing for format changes).
+        // Missing templates are added, unedited versioned templates are
+        // refreshed from the shipped tree, and edited files are preserved and
+        // reported in `runtime_state.templates.pending` for review.
+        try {
+            const templatesRoot = resolveTemplatesRoot(config.workspaceDir);
+            const templateStatus = reconcileTemplateAssets({
+                db,
+                templatesRoot,
+                contextDir,
+                backupRoot: releaseAssetBackupRoot,
+            });
+            if (templateStatus.pending.length > 0) {
+                logger.warn({ pending: templateStatus.pending, count: templateStatus.pending.length }, "template upgrades pending — user-edited files were preserved (inspect via /api/health.templatesPending)");
+            }
+            if (templateStatus.autoUpdated > 0 || templateStatus.added > 0) {
+                logger.info({ added: templateStatus.added, autoUpdated: templateStatus.autoUpdated }, "release template assets reconciled");
+            }
+        }
+        catch (err) {
+            logger.warn({ err }, "template asset reconcile failed — continuing startup; pending snapshot unchanged");
+        }
+    }
+    if (config.externalObsidianVaultPath) {
+        const externalCheck = validateExternalObsidianVaultPath(config.externalObsidianVaultPath, config);
+        if (!externalCheck.ok) {
+            logger.warn({
+                path: config.externalObsidianVaultPath,
+                error: externalCheck.error,
+                message: externalCheck.message,
+            }, "externalObsidianVaultPath invalid — the Obsidian CLI skill will be degraded");
+        }
+    }
+    // Auto-generate API token if it does not exist in the secret store yet.
+    if (!(await secretBroker.getApiToken())) {
+        await secretBroker.set("apiToken", randomBytes(32).toString("hex"));
+        logger.info("Generated PA_API_TOKEN in secret store");
+    }
+    // Mirror keychain-stored backend API keys into process.env so the
+    // existing Claude SDK / Codex CLI / Gemini CLI subprocesses pick them
+    // up via the unchanged `process.env.ANTHROPIC_API_KEY` etc. read paths.
+    // Keychain values take precedence over shell env (the captured
+    // snapshot above acts as the fallback when the operator clears the
+    // dashboard entry).
+    for (const backendId of getBackendIds()) {
+        try {
+            const result = await syncBackendApiKeyToEnv(secretBroker, backendId, process.env, { dataDir: config.dataDir });
+            if (result.source === "keychain") {
+                logger.info({ backendId, source: result.source }, "Mirrored backend API key from keychain into process.env");
+            }
+        }
+        catch (err) {
+            logger.warn({ err, backendId }, "Failed to read backend API key from keychain — backend will fall back to existing env / CLI auth");
+        }
+    }
+    logger.info("Database initialized");
+    // ── 4. Core components ──
+    const eventBus = new EventBus();
+    const writeTracker = new AgentWriteTracker();
+    // Morning-routine and roadmap write locks are constructed here (earlier
+    // than their historical home at §11) so the reconciler observer can
+    // consult the morning-routine lock when its cron trigger fires. Both
+    // locks are passed into the dispatcher later without re-construction.
+    const morningRoutineLock = new InMemoryTodayWriteLockManager(getTodayWriteLockTimeoutMs(config.executeTimeoutMinutes));
+    const roadmapWriteLock = new InMemoryRoadmapWriteLockManager(getRoadmapWriteLockTimeoutMs(config.executeTimeoutMinutes));
+    // ── 5. Messaging adapters ──
+    const messageHub = new MessageHub(config, db);
+    /**
+     * Persist a freshly-detected owner ID into .env + in-memory config and
+     * send a welcome DM. Called by Slack/Telegram/Discord adapters when
+     * discovery (or a Telegram pair token) captures the owner from the first
+     * inbound DM.
+     *
+     * Why this lives in index.ts (not the adapter): the adapter must not
+     * import env-writer directly — that would couple the adapter layer to the
+     * config-persistence layer. The adapter just calls back; index.ts owns
+     * the wiring.
+     */
+    async function recordDetectedOwner(platform, ownerId) {
+        const fieldByPlatform = {
+            slack: "slackOwnerUserId",
+            telegram: "telegramOwnerChatId",
+            discord: "discordOwnerUserId",
+        };
+        const { applyConfigUpdates } = await import("./api/env-writer.js");
+        // No `db` option needed — owner-id pairing never touches Note Sources
+        // keys, so the §6.2 side-effect inside applyConfigUpdates is a no-op.
+        const result = await applyConfigUpdates(config, settingsStore, {
+            [fieldByPlatform[platform]]: ownerId,
+        });
+        if (Object.keys(result.errors).length > 0) {
+            logger.error({ platform, ownerId, errors: result.errors }, "Failed to persist detected owner ID to .env");
+            return;
+        }
+        logger.info({ platform, ownerId }, "auto-paired owner from discovery");
+        // Greet the user so they know pairing landed. Route this through the
+        // adapter's normal owner-channel resolution path ("user") rather than
+        // assuming the captured owner identifier is itself a channel id.
+        //
+        // Why: Telegram captures a chat id, but Slack/Discord capture a user id
+        // that must be resolved to a DM channel before sending.
+        try {
+            await messageHub.sendToPlatform(platform, "user", `Pairing successful — this channel is now linked as your owner DM.`);
+        }
+        catch (err) {
+            logger.warn({ err, platform }, "Failed to deliver welcome DM after auto-pairing");
+        }
+    }
+    let discordAdapter = null;
+    let slackAdapter = null;
+    let telegramAdapter = null;
+    let whatsappAdapter = null;
+    async function reloadDiscordAdapter(startNow) {
+        const botToken = await secretBroker.getDiscordBotToken();
+        const configured = !!botToken;
+        messageHub.setPlatformConfigured("discord", configured);
+        if (discordAdapter) {
+            try {
+                await discordAdapter.stop();
+            }
+            catch (err) {
+                logger.warn({ err }, "Failed to stop Discord adapter during reload");
+            }
+            messageHub.unregister("discord");
+            discordAdapter = null;
+        }
+        if (!botToken) {
+            return;
+        }
+        discordAdapter = new DiscordAdapter({
+            botToken,
+            ownerUserId: config.discordOwnerUserId,
+            onMessage: (event) => void eventBus.put(event),
+            onOwnerDetected: (userId) => recordDetectedOwner("discord", userId),
+            attachmentStore,
+        });
+        messageHub.register(discordAdapter);
+        if (startNow) {
+            // Mark as "connecting" while the websocket handshake is in flight so
+            // /health doesn't briefly report "ok" before the adapter actually
+            // comes up (register() defaults to "ok" to keep the notification
+            // pipeline usable in unit tests; this override is the real state).
+            messageHub.setPlatformRuntimeStatus("discord", { runtimeState: "connecting", error: null });
+            try {
+                await discordAdapter.start();
+                messageHub.setPlatformRuntimeStatus("discord", { runtimeState: "ok", error: null });
+            }
+            catch (err) {
+                const message = toSafeErrorMessage(err, "Discord adapter failed to start");
+                messageHub.setPlatformRuntimeStatus("discord", { runtimeState: "error", error: message });
+                logger.error({ err }, "Failed to start Discord adapter during reload");
+            }
+        }
+    }
+    async function reloadSlackAdapter(startNow) {
+        const [botToken, appToken] = await Promise.all([
+            secretBroker.getSlackBotToken(),
+            secretBroker.getSlackAppToken(),
+        ]);
+        const configured = !!(botToken && appToken);
+        messageHub.setPlatformConfigured("slack", configured);
+        if (slackAdapter) {
+            try {
+                await slackAdapter.stop();
+            }
+            catch (err) {
+                logger.warn({ err }, "Failed to stop Slack adapter during reload");
+            }
+            messageHub.unregister("slack");
+            slackAdapter = null;
+        }
+        if (!botToken || !appToken) {
+            return;
+        }
+        slackAdapter = new SlackAdapter({
+            botToken,
+            appToken,
+            ownerUserId: config.slackOwnerUserId,
+            onMessage: (event) => void eventBus.put(event),
+            onOwnerDetected: (userId) => recordDetectedOwner("slack", userId),
+            attachmentStore,
+        });
+        messageHub.register(slackAdapter);
+        if (startNow) {
+            messageHub.setPlatformRuntimeStatus("slack", { runtimeState: "connecting", error: null });
+            try {
+                await slackAdapter.start();
+                messageHub.setPlatformRuntimeStatus("slack", { runtimeState: "ok", error: null });
+            }
+            catch (err) {
+                const message = toSafeErrorMessage(err, "Slack adapter failed to start");
+                messageHub.setPlatformRuntimeStatus("slack", { runtimeState: "error", error: message });
+                logger.error({ err }, "Failed to start Slack adapter during reload");
+            }
+        }
+    }
+    async function reloadTelegramAdapter(startNow) {
+        const botToken = await secretBroker.getTelegramBotToken();
+        const configured = !!botToken;
+        messageHub.setPlatformConfigured("telegram", configured);
+        if (telegramAdapter) {
+            try {
+                await telegramAdapter.stop();
+            }
+            catch (err) {
+                logger.warn({ err }, "Failed to stop Telegram adapter during reload");
+            }
+            messageHub.unregister("telegram");
+            telegramAdapter = null;
+        }
+        if (!botToken) {
+            return;
+        }
+        telegramAdapter = new TelegramAdapter({
+            botToken,
+            ownerChatId: config.telegramOwnerChatId,
+            onMessage: (event) => void eventBus.put(event),
+            onOwnerDetected: (chatId) => recordDetectedOwner("telegram", chatId),
+            attachmentStore,
+        });
+        messageHub.register(telegramAdapter);
+        if (startNow) {
+            messageHub.setPlatformRuntimeStatus("telegram", { runtimeState: "connecting", error: null });
+            try {
+                await telegramAdapter.start();
+                messageHub.setPlatformRuntimeStatus("telegram", { runtimeState: "ok", error: null });
+            }
+            catch (err) {
+                const message = toSafeErrorMessage(err, "Telegram adapter failed to start");
+                messageHub.setPlatformRuntimeStatus("telegram", { runtimeState: "error", error: message });
+                logger.error({ err }, "Failed to start Telegram adapter during reload");
+            }
+        }
+    }
+    await Promise.all([
+        reloadDiscordAdapter(false),
+        reloadSlackAdapter(false),
+        reloadTelegramAdapter(false),
+    ]);
+    /**
+     * Build (or rebuild) the WhatsApp adapter from current config and register
+     * it with the MessageHub. Idempotent: returns the existing adapter if config
+     * is unchanged. Throws if whatsappOwnerPhone is missing.
+     */
+    function buildWhatsAppAdapter() {
+        if (!config.whatsappOwnerPhone) {
+            throw new Error("Cannot enable WhatsApp: PA_WHATSAPP_OWNER_PHONE is not set");
+        }
+        const existing = messageHub.getAdapter("whatsapp");
+        if (existing && whatsappAdapter && existing === whatsappAdapter) {
+            return whatsappAdapter;
+        }
+        const adapter = new WhatsAppAdapter({
+            ownerPhone: config.whatsappOwnerPhone,
+            authDir: config.whatsappAuthDir ?? join(config.dataDir, "whatsapp", "auth"),
+            onMessage: (event) => void eventBus.put(event),
+            attachmentStore,
+            onLoggedOut: async () => {
+                try {
+                    await messageHub.sendToUser("WhatsApp session logged out — re-run foreground pairing");
+                }
+                catch (err) {
+                    logger.error({ err }, "Failed to deliver WhatsApp logout notification via fallback channel");
+                }
+            },
+        });
+        messageHub.register(adapter);
+        whatsappAdapter = adapter;
+        return adapter;
+    }
+    /**
+     * Tear down the WhatsApp adapter completely. Used by the dashboard
+     * `whatsappEnabled=false` toggle so we don't keep a stale Baileys socket
+     * around. Logs but does not throw on socket close errors.
+     */
+    async function teardownWhatsAppAdapter() {
+        if (!whatsappAdapter)
+            return;
+        try {
+            await whatsappAdapter.stop();
+        }
+        catch (err) {
+            logger.warn({ err }, "Error stopping WhatsApp adapter during teardown");
+        }
+        messageHub.unregister("whatsapp");
+        whatsappAdapter = null;
+    }
+    if (config.whatsappEnabled) {
+        if (!config.whatsappOwnerPhone) {
+            throw new Error("PA_WHATSAPP_ENABLED=true but PA_WHATSAPP_OWNER_PHONE is not set");
+        }
+        buildWhatsAppAdapter();
+    }
+    /**
+     * Build the per-platform pairing helpers (`messagingControls`) for the
+     * dashboard API. Each block returns `undefined` when its adapter wasn't
+     * registered, so the dashboard route can branch on existence to render
+     * "not configured" messaging without 404'ing the user.
+     *
+     * Why a builder, not three separate consts: keeps the wiring co-located
+     * with the adapter declarations and short-circuits the cases where
+     * dynamic imports (e.g. `qrcode` for Telegram QR rendering) would
+     * otherwise be loaded for adapters the user never configured.
+     */
+    /**
+     * Refuse to start a pairing flow on an adapter that isn't actually
+     * connected to its upstream service. Without this gate the dashboard
+     * would happily display a QR or magic phrase even though the daemon's
+     * Slack/Telegram/Discord client failed to come up — the user would scan
+     * or type the phrase forever and nothing would arrive.
+     */
+    function assertAdapterReady(platform) {
+        const status = messageHub.getPlatformRuntimeStatus(platform);
+        if (status.runtimeState !== "ok") {
+            throw new Error(`${platform} adapter is not connected (${status.error ?? status.runtimeState}). `
+                + `Verify the token, then save and retry.`);
+        }
+    }
+    function buildTelegramControls() {
+        return {
+            testToken: async (candidate) => {
+                // Prefer the candidate token from the request body so the
+                // dashboard can validate an unsaved draft. Falls back to the
+                // currently-saved token if no candidate was supplied.
+                const tokenToTest = candidate ?? await secretBroker.getTelegramBotToken();
+                if (!tokenToTest) {
+                    throw new Error("No Telegram bot token provided.");
+                }
+                const info = await TelegramAdapter.fetchBotInfo(tokenToTest);
+                return {
+                    ok: true,
+                    id: info.id,
+                    username: info.username,
+                    firstName: info.firstName,
+                };
+            },
+            startPairing: async (ttlMs = 5 * 60_000) => {
+                assertAdapterReady("telegram");
+                const adapter = telegramAdapter;
+                if (!adapter) {
+                    throw new Error("Telegram adapter is not initialized. Save the token and retry.");
+                }
+                const savedToken = await secretBroker.getTelegramBotToken();
+                if (!savedToken) {
+                    throw new Error("No Telegram bot token provided.");
+                }
+                // Always re-fetch bot info on pair start. Caching it on adapter
+                // start meant a stale username (e.g. user renamed the bot via
+                // BotFather) would silently break the deep link.
+                const info = await TelegramAdapter.fetchBotInfo(savedToken);
+                if (!info.username) {
+                    throw new Error("Telegram bot has no username — set one via @BotFather (/setname or /newbot) before pairing.");
+                }
+                // 96 bits of entropy in the pair token. The QR encodes a deep link
+                // of the form `https://t.me/<bot>?start=<token>`; when the user
+                // taps START in Telegram, the bot receives `/start <token>` and
+                // the matcher below promotes them to owner. WITHOUT a separate
+                // discovery fallback — that combination was unsafe (any DM during
+                // the window would claim the role even without the token).
+                const pairToken = randomBytes(12).toString("base64url");
+                const expiresAt = Date.now() + ttlMs;
+                // Matcher rules:
+                //   - The `/start` and optional `@<botname>` prefix are matched
+                //     case-INSENSITIVELY. Telegram bot usernames are case-
+                //     insensitive in URLs and mentions, and clients normalize
+                //     differently — `MyBot`, `mybot`, `MYBOT` must all work.
+                //   - The token itself is matched case-SENSITIVELY (base64url
+                //     uses both cases) so we keep the full 96-bit search space.
+                //   - Anything after the token (extra args, trailing whitespace
+                //     beyond what trim() handles) rejects, so we can't be tricked
+                //     into matching a longer payload that happens to start with
+                //     `/start <token>`.
+                const escapedUsername = info.username.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+                const prefixRe = new RegExp(`^/start(?:@${escapedUsername})?\\s+`, "i");
+                adapter.startPairing({
+                    match: (text) => {
+                        const trimmed = text.trim();
+                        const prefixMatch = trimmed.match(prefixRe);
+                        if (!prefixMatch)
+                            return false;
+                        const remainder = trimmed.slice(prefixMatch[0].length);
+                        return remainder === pairToken;
+                    },
+                    expiresAt,
+                });
+                const deepLink = `https://t.me/${info.username}?start=${pairToken}`;
+                const qrcodeMod = await import("qrcode");
+                const toDataURL = (qrcodeMod.default ?? qrcodeMod).toDataURL;
+                const qrDataUrl = await toDataURL(deepLink, { width: 320, margin: 2 });
+                return {
+                    pairToken,
+                    deepLink,
+                    qrDataUrl,
+                    expiresAt,
+                    botUsername: info.username,
+                };
+            },
+            getPairingStatus: () => ({
+                paired: telegramAdapter?.getOwnerChatId() !== null,
+                ownerChatId: telegramAdapter?.getOwnerChatId() ?? null,
+                pairingActive: telegramAdapter?.isPairingActive() ?? false,
+            }),
+            cancelPairing: () => {
+                telegramAdapter?.cancelPairing();
+            },
+        };
+    }
+    function buildSlackControls() {
+        return {
+            testToken: async (candidate) => {
+                const tokenToTest = candidate ?? await secretBroker.getSlackBotToken();
+                if (!tokenToTest) {
+                    throw new Error("No Slack bot token provided.");
+                }
+                const info = await SlackAdapter.fetchBotInfo(tokenToTest);
+                return {
+                    ok: true,
+                    botUserId: info.botUserId,
+                    botName: info.botName,
+                    team: info.team,
+                    url: info.url,
+                };
+            },
+            startPairing: async (ttlMs = 5 * 60_000) => {
+                assertAdapterReady("slack");
+                const adapter = slackAdapter;
+                if (!adapter) {
+                    throw new Error("Slack adapter is not initialized. Save the tokens and retry.");
+                }
+                // Magic-phrase pairing: the dashboard displays the phrase, the
+                // user copies/types it into their bot DM, the matcher (closed over
+                // the normalized phrase) accepts only DMs containing it. Defeats
+                // the previous "first DM wins" race entirely because attackers
+                // who can't see the dashboard can't see the phrase.
+                const { generateMagicPhrase, buildPhraseMatcher } = await import("./messaging/magic-phrase.js");
+                const phrase = generateMagicPhrase();
+                const expiresAt = Date.now() + ttlMs;
+                adapter.startPairing({
+                    match: buildPhraseMatcher(phrase),
+                    expiresAt,
+                });
+                return { phrase, expiresAt };
+            },
+            cancelPairing: () => {
+                slackAdapter?.cancelPairing();
+            },
+            getPairingStatus: () => ({
+                paired: slackAdapter?.getOwnerUserId() !== null,
+                ownerUserId: slackAdapter?.getOwnerUserId() ?? null,
+                pairingActive: slackAdapter?.isPairingActive() ?? false,
+            }),
+        };
+    }
+    function buildDiscordControls() {
+        return {
+            testToken: async (candidate) => {
+                const tokenToTest = candidate ?? await secretBroker.getDiscordBotToken();
+                if (!tokenToTest) {
+                    throw new Error("No Discord bot token provided.");
+                }
+                const info = await DiscordAdapter.fetchBotInfo(tokenToTest);
+                return {
+                    ok: true,
+                    id: info.id,
+                    username: info.username,
+                    discriminator: info.discriminator,
+                    avatarUrl: info.avatarUrl,
+                };
+            },
+            startPairing: async (ttlMs = 5 * 60_000) => {
+                assertAdapterReady("discord");
+                const adapter = discordAdapter;
+                if (!adapter) {
+                    throw new Error("Discord adapter is not initialized. Save the token and retry.");
+                }
+                const { generateMagicPhrase, buildPhraseMatcher } = await import("./messaging/magic-phrase.js");
+                const phrase = generateMagicPhrase();
+                const expiresAt = Date.now() + ttlMs;
+                adapter.startPairing({
+                    match: buildPhraseMatcher(phrase),
+                    expiresAt,
+                });
+                return { phrase, expiresAt };
+            },
+            cancelPairing: () => {
+                discordAdapter?.cancelPairing();
+            },
+            getPairingStatus: () => ({
+                paired: discordAdapter?.getOwnerUserId() !== null,
+                ownerUserId: discordAdapter?.getOwnerUserId() ?? null,
+                pairingActive: discordAdapter?.isPairingActive() ?? false,
+            }),
+        };
+    }
+    function whatsappQrResponseFromAdapter(adapter, snapshotOverride) {
+        if (!adapter) {
+            return {
+                dataUrl: null,
+                payload: null,
+                generatedAt: null,
+                expiresAt: null,
+                state: "not_initialized",
+                error: "WhatsApp adapter not enabled",
+            };
+        }
+        const snapshot = snapshotOverride !== undefined
+            ? snapshotOverride
+            : adapter.getQrSnapshot();
+        return {
+            dataUrl: snapshot?.dataUrl ?? null,
+            payload: snapshot?.payload ?? null,
+            generatedAt: snapshot?.generatedAt ?? null,
+            expiresAt: snapshot?.expiresAt ?? null,
+            state: adapter.getStatus(),
+            error: adapter.getStatusError(),
+        };
+    }
+    // Dashboard adapter — always registered (activates on SSE connect)
+    const dashboardAdapter = new DashboardAdapter((event) => void eventBus.put(event));
+    messageHub.register(dashboardAdapter);
+    dashboardAdapter.setAttachmentStore(attachmentStore);
+    // ── 6. External services (mutable registry for hot-reload) ──
+    const services = createServiceRegistry();
+    const blobStore = new FileEncryptedBlobStore(resolve(config.dataDir, "secrets", "blobs"), new PlatformSecretStore());
+    // Forward-declared so the registry constructor can wire its scope-change
+    // observer before `sessionManager` / `eventBroadcaster` exist. The real
+    // implementation is assigned below once those deps are live — until then,
+    // `onMailScopeChanged` is a no-op (which is correct: no DM sessions can
+    // exist pre-dispatcher).
+    let onMailScopeChanged = () => undefined;
+    services.mail = new MailAccountRegistry({
+        db,
+        blobStore: blobStore,
+        getEnabledKinds: () => config.enabledMailProviders,
+        onScopeChanged: (reason) => onMailScopeChanged(reason),
+        providerFactories: {
+            // Gmail credentials remain on the shared Google OAuth path, so the
+            // row stores a sentinel in `secret_blob_name` and the factory reads
+            // the live GmailService from the registry instead of the blob store.
+            gmail: (account) => {
+                const service = services.gmail;
+                if (!service || !service.available) {
+                    throw new Error(`Gmail service not initialized for account ${account.id}. Complete Google OAuth in the dashboard.`);
+                }
+                return new GmailProvider({ account, service });
+            },
+            outlook: async (account, ctx) => {
+                const clientConfig = await loadOutlookClientConfig(blobStore);
+                if (!clientConfig)
+                    throw new OutlookClientConfigMissingError();
+                const msalApp = createRuntimeMsalApp(clientConfig, account.id, blobStore);
+                return new OutlookGraphProvider({
+                    account,
+                    msalApp,
+                    abortSignal: ctx.signal,
+                });
+            },
+            yahoo: async (account) => {
+                const raw = await blobStore.readUtf8(`mail:${account.kind}:${account.id}`);
+                if (!raw)
+                    throw new Error(`Missing IMAP secret for ${account.id}`);
+                return new YahooImapProvider({
+                    account,
+                    secret: parseImapAccountSecret(raw),
+                    onCapabilitiesProbed: (id, caps) => {
+                        services.mail?.updateCapabilities(id, caps);
+                    },
+                });
+            },
+            icloud: async (account) => {
+                const raw = await blobStore.readUtf8(`mail:${account.kind}:${account.id}`);
+                if (!raw)
+                    throw new Error(`Missing IMAP secret for ${account.id}`);
+                return new ICloudImapProvider({
+                    account,
+                    secret: parseImapAccountSecret(raw),
+                    onCapabilitiesProbed: (id, caps) => {
+                        services.mail?.updateCapabilities(id, caps);
+                    },
+                });
+            },
+        },
+    });
+    const secretState = {
+        googleCredentialsConfigured: false,
+        googleTokenConfigured: false,
+        googleCredentialType: null,
+        notionConfigured: false,
+        githubConfigured: false,
+        githubWebhookConfigured: false,
+    };
+    async function refreshGoogleSecretState() {
+        const [credentialsRaw, tokenRaw] = await Promise.all([
+            secretBroker.getGoogleCredentialsJson(),
+            secretBroker.getGoogleTokenJson(),
+        ]);
+        secretState.googleCredentialsConfigured = !!credentialsRaw;
+        secretState.googleTokenConfigured = !!tokenRaw;
+        secretState.googleCredentialType = detectGoogleCredentialType(credentialsRaw);
+    }
+    async function reloadGoogleServices() {
+        await refreshGoogleSecretState();
+        services.calendar = null;
+        services.gmail = null;
+        delete services.errors.googleCalendar;
+        delete services.errors.gmail;
+        if (!secretState.googleCredentialsConfigured) {
+            if (services.mail) {
+                syncLegacyGmailAccountState(db, services.mail, {
+                    available: false,
+                    error: "Google credentials are not configured.",
+                });
+            }
+            return;
+        }
+        // OAuth2 pre-auth: credentials uploaded but the user has not completed the
+        // browser flow yet (no token in the keychain). Initializing the services
+        // would fail with a "missing token" error that the dashboard would then
+        // render as red "Error" under the Google card — but this is the expected
+        // mid-setup state, not a failure. Skip init and leave services.errors
+        // unset so /health reports error: null until the user finishes OAuth or a
+        // real init error occurs.
+        const oauth2PreAuth = secretState.googleCredentialType === "oauth2"
+            && !secretState.googleTokenConfigured;
+        if (oauth2PreAuth) {
+            if (services.mail) {
+                syncLegacyGmailAccountState(db, services.mail, {
+                    available: false,
+                    error: "Awaiting Google OAuth authorization.",
+                });
+            }
+            return;
+        }
+        const calendarService = new CalendarService(config, secretBroker);
+        try {
+            await calendarService.init();
+            services.calendar = calendarService;
+        }
+        catch (err) {
+            const msg = err.message;
+            logger.error({ error: msg }, "Calendar service init failed, continuing without it");
+            services.errors.googleCalendar = msg;
+        }
+        const gmailService = new GmailService(secretBroker);
+        try {
+            await gmailService.init();
+            services.gmail = gmailService;
+        }
+        catch (err) {
+            const msg = err.message;
+            logger.error({ error: msg }, "Gmail service init failed, continuing without it");
+            services.errors.gmail = msg;
+        }
+        // Ensure the shared-Google-OAuth Gmail identity exists as a unified
+        // mail account (idempotent; returns `exists` on subsequent boots).
+        if (services.gmail?.available) {
+            try {
+                await ensureLegacyGmailRow(db, services.gmail);
+            }
+            catch (err) {
+                logger.error({ err }, "Failed to ensure shared-Google-OAuth Gmail mail_accounts row");
+            }
+            if (services.mail) {
+                syncLegacyGmailAccountState(db, services.mail, { available: true });
+            }
+        }
+        else if (services.mail) {
+            syncLegacyGmailAccountState(db, services.mail, {
+                available: false,
+                error: services.errors.gmail ?? "Gmail is not configured.",
+            });
+        }
+    }
+    // Google Maps (F-08: commute optimization)
+    {
+        const { GoogleMapsService } = await import("./services/google-maps.js");
+        const mapsService = new GoogleMapsService(secretBroker);
+        try {
+            await mapsService.init();
+            if (mapsService.available) {
+                services.googleMaps = mapsService;
+            }
+        }
+        catch (err) {
+            const msg = err.message;
+            logger.error({ error: msg }, "Google Maps service init failed, continuing without it");
+            services.errors.googleMaps = msg;
+        }
+    }
+    // Obsidian
+    if (config.externalObsidianVaultName) {
+        const obsidianService = new ObsidianService(config);
+        if (obsidianService.available) {
+            logger.info({ vaultName: config.externalObsidianVaultName }, "Probing Obsidian CLI...");
+            const running = await obsidianService.isRunning();
+            if (running) {
+                services.obsidian = obsidianService;
+                logger.info({ vaultName: config.externalObsidianVaultName }, "Obsidian service available");
+            }
+            else {
+                services.errors.obsidian = "Obsidian CLI not accessible — is Obsidian running?";
+                logger.warn("Obsidian CLI not accessible — is Obsidian running?");
+            }
+        }
+    }
+    else if (config.externalObsidianVaultPath && !config.externalObsidianVaultName) {
+        services.errors.obsidian = "externalObsidianVaultName is required for the Obsidian CLI service (externalObsidianVaultPath alone enables file watching only)";
+    }
+    async function reloadAppleCalendarService() {
+        const raw = await secretBroker.getAppleCalendarCredentialsJson();
+        services.appleCalendar = null;
+        delete services.errors.appleCalendar;
+        if (!raw) {
+            return;
+        }
+        const service = new AppleCalendarService(secretBroker);
+        try {
+            await service.init();
+            if (service.available) {
+                services.appleCalendar = service;
+            }
+            else {
+                // Surface the underlying iCloud error verbatim — the dashboard
+                // shows it on the Connections card so the user can act
+                // (`401 Unauthorized` → regenerate password; network error →
+                // retry; etc.). Falls back to a generic placeholder only if
+                // init() failed without recording a message.
+                services.errors.appleCalendar =
+                    service.initError
+                        ?? "Apple Calendar credentials present but iCloud discovery did not return a usable calendar — verify the app-specific password.";
+            }
+        }
+        catch (err) {
+            const msg = err.message;
+            logger.error({ error: msg }, "Apple Calendar service init failed, continuing without it");
+            services.errors.appleCalendar = msg;
+        }
+    }
+    async function reloadNotionService() {
+        const apiKey = await secretBroker.getNotionApiKey();
+        secretState.notionConfigured = !!apiKey;
+        services.notion = null;
+        delete services.errors.notion;
+        if (!apiKey) {
+            return;
+        }
+        const notionService = new NotionService(config, secretBroker);
+        try {
+            await notionService.init();
+            services.notion = notionService;
+        }
+        catch (err) {
+            const msg = err.message;
+            logger.error({ error: msg }, "Notion service init failed, continuing without it");
+            services.errors.notion = msg;
+        }
+    }
+    async function reloadGitHubService() {
+        const [token, webhookSecret] = await Promise.all([
+            secretBroker.getGitHubToken(),
+            secretBroker.getGitHubWebhookSecret(),
+        ]);
+        secretState.githubConfigured = !!token;
+        secretState.githubWebhookConfigured = !!webhookSecret;
+        services.github = null;
+        delete services.errors.github;
+        if (!token) {
+            return;
+        }
+        const githubService = new GitHubService(token, webhookSecret);
+        try {
+            await githubService.init();
+            services.github = githubService;
+        }
+        catch (err) {
+            const msg = err.message;
+            logger.error({ error: msg }, "GitHub service init failed, continuing without it");
+            services.errors.github = msg;
+        }
+    }
+    await Promise.all([
+        reloadGoogleServices(),
+        reloadAppleCalendarService(),
+        reloadNotionService(),
+        reloadGitHubService(),
+    ]);
+    /** Build integration status snapshot for /api/health */
+    const getIntegrationStatus = () => {
+        const whatsappState = config.whatsappEnabled
+            ? (whatsappAdapter?.getStatus() ?? "disabled")
+            : "not_configured";
+        return {
+            google: {
+                configured: secretState.googleCredentialsConfigured,
+                connected: services.calendar !== null || services.gmail !== null,
+                error: services.errors.googleCalendar
+                    ? toSafeErrorMessage(services.errors.googleCalendar)
+                    : null,
+                services: {
+                    calendar: {
+                        connected: services.calendar !== null,
+                        error: services.errors.googleCalendar
+                            ? toSafeErrorMessage(services.errors.googleCalendar)
+                            : null,
+                    },
+                    gmail: {
+                        connected: services.gmail !== null,
+                        error: services.errors.gmail
+                            ? toSafeErrorMessage(services.errors.gmail)
+                            : null,
+                    },
+                },
+            },
+            appleCalendar: {
+                // `configured` reflects whether credentials are stored in the
+                // keychain; `connected` reflects whether last principal-discovery
+                // succeeded. The Overview's "Apple selected but not connected"
+                // banner reads `appleCalendar.configured && !appleCalendar.connected`.
+                configured: services.appleCalendar !== null || !!services.errors.appleCalendar,
+                connected: services.appleCalendar?.available ?? false,
+                error: services.errors.appleCalendar
+                    ? toSafeErrorMessage(services.errors.appleCalendar)
+                    : null,
+            },
+            obsidian: {
+                configured: !!(config.externalObsidianVaultPath || config.externalObsidianVaultName),
+                connected: services.obsidian !== null,
+                error: services.errors.obsidian
+                    ? toSafeErrorMessage(services.errors.obsidian)
+                    : null,
+            },
+            notion: {
+                configured: secretState.notionConfigured,
+                connected: services.notion !== null,
+                error: services.errors.notion
+                    ? toSafeErrorMessage(services.errors.notion)
+                    : null,
+            },
+            whatsapp: {
+                configured: config.whatsappEnabled,
+                connected: whatsappState === "ok",
+                error: whatsappState === "disconnected"
+                    ? "WhatsApp disconnected"
+                    : whatsappState === "logged_out"
+                        ? "WhatsApp logged out"
+                        : null,
+                state: whatsappState,
+            },
+            googleMaps: {
+                configured: services.googleMaps !== null,
+                connected: services.googleMaps !== null,
+                error: services.errors.googleMaps
+                    ? toSafeErrorMessage(services.errors.googleMaps)
+                    : null,
+            },
+        };
+    };
+    const getMessagingStatus = () => {
+        return Object.fromEntries(SUPPORTED_MESSAGING_PLATFORMS.map((platform) => {
+            const ownerChannel = getOwnerChannel(db, platform);
+            const configured = messageHub.isPlatformConfigured(platform);
+            const ownerConfigured = messageHub.isOwnerConfigured(platform);
+            const { runtimeState, error } = messageHub.getPlatformRuntimeStatus(platform);
+            const ownerChannelKnown = platform === "dashboard"
+                ? dashboardAdapter.getActiveChannels().length > 0 || !!ownerChannel
+                : platform === "telegram"
+                    ? !!config.telegramOwnerChatId
+                    : platform === "whatsapp"
+                        ? !!config.whatsappOwnerPhone
+                        : !!ownerChannel;
+            const notificationEligible = messageHub.isPlatformNotificationEligible(platform);
+            return [
+                platform,
+                {
+                    configured,
+                    runtimeState,
+                    ownerConfigured,
+                    ownerChannelKnown,
+                    notificationEligible,
+                    lastInboundAt: ownerChannel?.last_inbound_at ?? null,
+                    error,
+                },
+            ];
+        }));
+    };
+    // ── 7. Observers ──
+    const observerManager = new ObserverManager();
+    // Mutable indirection: observers are constructed in this block, but the
+    // dispatcher (owner of `emitRoadmapRefresh`) is created later in §7.3.
+    // Pollers store this callback and only invoke it from their poll loops,
+    // which run after `observerManager.startAll()` — by then the dispatcher
+    // has been wired via the assignment in §7.3 and the indirection resolves.
+    // ROADMAP-REDESIGN §3.4 RFC-C.
+    let emitRoadmapRefreshSink = null;
+    const triggerRoadmapRefresh = (source) => {
+        emitRoadmapRefreshSink?.(source);
+    };
+    const getNormalizedGitRepos = () => normalizeGitWatchedRepos({ gitWatchedRepos: selectGitWatchedRepos(db) });
+    // P5 multi-account — registry resolves `gitAccounts[<alias>]` to a
+    // `{GH_TOKEN, GIT_ASKPASS, ...}` env overlay each observer applies
+    // per-call. The `getAccounts` thunk reads `config.gitAccounts` lazily
+    // so a `PATCH /api/config` that mutates `config` in place via
+    // `applyConfigUpdates`'s `Object.assign(config, runtimeUpdates)`
+    // flows through to the next resolver call without re-instantiation
+    // — which is why `gitAccounts` is NOT in `RESTART_REQUIRED_KEY_TUPLE`.
+    // Per-repo PAT secrets live in the OS keychain at
+    // `git.account.<alias>` (see secret-names.ts ScopedSecretName).
+    const gitAccountRegistry = new GitAccountRegistry({
+        dataDir: config.dataDir,
+        secretBroker,
+        getAccounts: () => config.gitAccounts,
+    });
+    // One-time info note: github-side rows without a local clone always
+    // poll under the default `gh` profile when the row's `github_account`
+    // is null. Surface this if both `gitAccounts` and github-only rows
+    // exist so a user staring at unaccounted-for traffic from "the wrong
+    // account" sees it in `aitne logs` rather than guessing.
+    const githubOnlyRows = selectGithubRepoSlugs(db).length;
+    if (Object.keys(config.gitAccounts ?? {}).length > 0
+        && githubOnlyRows > 0) {
+        logger.info({
+            gitAccounts: Object.keys(config.gitAccounts).length,
+            githubRepos: githubOnlyRows,
+        }, "GitHub-side repository rows fall back to the default gh profile when github_account is unset. Set the row's account alias from /api/repositories or the dashboard.");
+    }
+    const lookupRepoAlias = (repoPath, fullName) => {
+        const repos = getNormalizedGitRepos();
+        if (repoPath) {
+            const byPath = repos.find((r) => r.path === repoPath);
+            if (byPath?.accountAlias)
+                return byPath.accountAlias;
+        }
+        if (fullName) {
+            const byOrgRepo = repos.find((r) => {
+                if (!r.org)
+                    return false;
+                // Repos resolved from `githubRepos` (not local paths) match by full name.
+                return fullName.toLowerCase() === `${r.org}/${r.slug}`.toLowerCase();
+            });
+            if (byOrgRepo?.accountAlias)
+                return byOrgRepo.accountAlias;
+        }
+        return undefined;
+    };
+    const queueGitProjectInitsForCurrentConfig = (source) => {
+        if (!isSetupCompleted(db) || readDegradedMode(db))
+            return;
+        const repos = getNormalizedGitRepos();
+        if (repos.length === 0)
+            return;
+        try {
+            const inserted = queueMissingGitProjectInits({
+                db,
+                contextDir: getContextDir(config, db),
+                dataDir: config.dataDir,
+                workspaceDir: config.workspaceDir,
+                repos,
+            });
+            if (inserted > 0) {
+                logger.info({ inserted, source }, "Queued missing git project documentation init tasks");
+            }
+        }
+        catch (err) {
+            logger.warn({ err, source }, "Failed to queue git project documentation init tasks");
+        }
+    };
+    const gitWatchedRepos = getNormalizedGitRepos();
+    const gitRepoPaths = gitWatchedRepos.map((repo) => repo.path);
+    let gitWatcher = null;
+    const buildGitWatcher = () => {
+        if (gitRepoPaths.length === 0)
+            return null;
+        // Per-row poll cadence (unified-repositories §5). Sourced from each
+        // row's `poll_interval_sec` column; rows with null fall through to
+        // the global `gitPollIntervalSeconds`.
+        const repoIntervals = new Map(gitWatchedRepos.map((row) => [row.path, row.pollIntervalSec ?? null]));
+        const watcher = new GitWatcher(gitRepoPaths, db, config.gitPollIntervalSeconds, {
+            eventBus,
+            pushOverdueMinutes: config.gitPushOverdueMinutes,
+            repoIntervals,
+            repoEnvResolver: async (repoPath) => {
+                const alias = lookupRepoAlias(repoPath);
+                if (!alias)
+                    return undefined;
+                return (await gitAccountRegistry.buildSpawnEnv(alias)) ?? undefined;
+            },
+            onRepoBaseline: (repoPath) => {
+                const repo = getNormalizedGitRepos().find((item) => item.path === repoPath);
+                if (!repo)
+                    return;
+                queueGitProjectInitsForCurrentConfig("git-baseline");
+            },
+            onLifecycleObservation: (classification) => {
+                if (!isSetupCompleted(db) || readDegradedMode(db))
+                    return;
+                const repoPath = typeof classification.payload.repoPath === "string"
+                    ? classification.payload.repoPath
+                    : classification.source.replace(/^git:/, "");
+                const repo = getNormalizedGitRepos().find((item) => item.path === repoPath);
+                if (!repo)
+                    return;
+                const result = queueGitProjectUpdate({
+                    db,
+                    dataDir: config.dataDir,
+                    workspaceDir: config.workspaceDir,
+                    repo,
+                    event: classification,
+                    debounceMinutes: config.gitProjectUpdateDebounceMinutes,
+                });
+                if (result === "queued" || result === "merged") {
+                    logger.info({
+                        repo: repo.path,
+                        eventType: classification.eventType,
+                        result,
+                    }, "Queued git project documentation update");
+                }
+                // Unified-repositories §4.4 — fire any per-repo triggers
+                // configured for this lifecycle event. Triggers ride alongside
+                // the task-flow pipeline above; they do not consume the event.
+                const repositoryRow = getRepositoryByLocalPath(db, repoPath);
+                if (repositoryRow) {
+                    void dispatchMatchingTriggers({ db, eventBus }, repositoryRow.id, classification.eventType, classification.payload);
+                }
+            },
+        });
+        gitWatcher = watcher;
+        return watcher;
+    };
+    if (shouldStartObserversFor(db, "git")) {
+        const watcher = buildGitWatcher();
+        if (watcher)
+            observerManager.register(watcher);
+    }
+    // GitHubPoller — daemon-side notification + workflow_run polling via the
+    // user's `gh auth login` keychain entry. Replaces the webhook receiver
+    // for local-first installs where exposing a public URL is impractical.
+    // Registered only while github.mode === "direct" now that GitHub is a
+    // first-class integration. Direct remains the default, preserving the
+    // historical "notifications on when gh is authenticated" behaviour.
+    const buildGithubPoller = () => {
+        // Per-row poll cadence (unified-repositories §5). The map is keyed by
+        // `owner/repo` to match `RepoBinding.fullName`; rows are sourced from
+        // the unified table. Local-only rows have no `owner/repo` and fall
+        // out of the map naturally.
+        const repoIntervals = new Map();
+        for (const row of listRepositories(db, { hasGithub: true })) {
+            if (row.githubOwner && row.githubRepo) {
+                repoIntervals.set(`${row.githubOwner}/${row.githubRepo}`, row.pollIntervalSec ?? null);
+            }
+        }
+        return new GitHubPoller({
+            db,
+            eventBus,
+            repoPaths: gitRepoPaths,
+            repoFullNames: selectGithubRepoSlugs(db),
+            pollIntervalSeconds: config.githubPollIntervalSeconds,
+            repoIntervals,
+            repoAccountAliasResolver: ({ localPath, fullName }) => lookupRepoAlias(localPath, fullName),
+            accountResolver: async (binding) => {
+                if (!binding.accountAlias)
+                    return undefined;
+                return ((await gitAccountRegistry.buildSpawnEnv(binding.accountAlias)) ?? undefined);
+            },
+            // Unified-repositories §4.4 — resolve the binding's owner/repo to a
+            // repositories.id and fire any per-repo triggers configured for
+            // this event type. Failures are logged inside dispatch and do not
+            // bubble out so a misconfigured trigger cannot stall the poll loop.
+            onTriggerableEvent: async (event) => {
+                if (!isSetupCompleted(db) || readDegradedMode(db))
+                    return;
+                let repoRow = null;
+                if (event.binding) {
+                    repoRow = getRepositoryByGithub(db, event.binding.owner, event.binding.repo);
+                }
+                if (!repoRow) {
+                    // Notifications without a `directNotificationRepos` match still
+                    // arrive here when a `repository.full_name` is in the payload.
+                    const fullName = typeof event.payload.repository === "string"
+                        ? event.payload.repository
+                        : null;
+                    if (fullName) {
+                        const [owner, repo] = fullName.split("/");
+                        if (owner && repo) {
+                            repoRow = getRepositoryByGithub(db, owner, repo);
+                        }
+                    }
+                }
+                if (!repoRow)
+                    return;
+                await dispatchMatchingTriggers({ db, eventBus }, repoRow.id, event.eventType, event.payload);
+            },
+        });
+    };
+    if (shouldStartObserversFor(db, "github")) {
+        observerManager.register(buildGithubPoller());
+    }
+    // Each call returns a fresh observer so the integration-lifecycle helper
+    // re-registers a new instance after a mode flip — picking up any
+    // gitPollIntervalSeconds / gitPushOverdueMinutes / hourlyCheckEnabled
+    // PATCH that landed while the cron was idle.
+    const buildGitDelegatedCronObserver = () => new GitDelegatedCronObserver({
+        db,
+        eventBus,
+        repoPaths: gitRepoPaths,
+        githubRepos: selectGithubRepoSlugs(db),
+        cadenceSeconds: config.gitPollIntervalSeconds,
+        pushOverdueMinutes: config.gitPushOverdueMinutes,
+        hourlyCheckEnabled: config.hourlyCheckEnabled,
+    });
+    if (hasActiveDelegatedGitLifecycleIntegration(db)) {
+        observerManager.register(buildGitDelegatedCronObserver());
+    }
+    // Unified-repositories daily management cron — see
+    // docs/design/appendices/unified-repositories.md §4.5. Iterates rows
+    // whose `repository_management.enabled = 1` and writes the required
+    // journal/overview markdown for each row that's due.
+    observerManager.register(new RepositoryManagementCron({
+        db,
+        eventBus,
+        contextDir: () => getContextDir(config, db),
+        timezone: config.timezone || undefined,
+        writeTracker,
+    }));
+    // Coexistence note: the legacy /webhook/github handler also calls
+    // recordObservation + EventBus.put, so a user with both webhooks AND
+    // the poller live will receive two events per `review_requested`. This
+    // is a low-probability scenario (webhooks need a public URL most users
+    // don't expose), so we log a one-time warning rather than disabling
+    // either path automatically.
+    if (secretState.githubWebhookConfigured && shouldStartObserversFor(db, "github")) {
+        logger.warn("GitHub webhook secret configured AND GitHubPoller running — "
+            + "duplicate events possible. Remove the webhook secret or unregister "
+            + "the GitHub webhook on github.com to silence.");
+    }
+    // SETUP-FLOW-REDESIGN-PLAN §6.3 — `externalObsidianWatch` is a kill
+    // switch for the external-vault branch of the watcher. When false the
+    // path is preserved (the Obsidian CLI skill still sees it via
+    // `config.externalObsidianVaultPath`) but no chokidar instance is
+    // registered. Sized for power users with very large vaults that would
+    // otherwise produce noisy observation churn (§13 open question).
+    if (config.externalObsidianVaultPath && config.externalObsidianWatch) {
+        observerManager.register(new ObsidianWatcher(config.externalObsidianVaultPath, db, config.obsidianDebounceSeconds, writeTracker, { source: "obsidian:external", name: "obsidian:external" }));
+    }
+    // Primary-vault watcher — registered unconditionally. Stays dormant
+    // until `setVaultPath` points it at a real directory. The migration
+    // endpoint's `onPrimaryVaultPathChange` callback calls setVaultPath
+    // explicitly after every commit, so plain → obsidian transitions
+    // and obsidian-path changes both re-target without dynamic
+    // register/unregister plumbing.
+    const primaryVaultWatcher = new PrimaryVaultWatcher(db, config.obsidianDebounceSeconds, writeTracker);
+    await primaryVaultWatcher.setVaultPath(config.vaultMode === "obsidian" ? config.primaryVaultPath : null);
+    observerManager.register(primaryVaultWatcher);
+    // Build CalendarPoller from current services. Returns null when
+    // `services.calendar` is unavailable so the integration-lifecycle
+    // module can no-op (for example: integration flips to direct before
+    // OAuth is set up). The §4.5.1 gate `google_calendar.mode === "direct"`
+    // is checked BEFORE invoking the builder.
+    const buildCalendarPoller = () => {
+        if (!services.calendar)
+            return null;
+        return new CalendarPoller(services.calendar, db, config.calendarPollIntervalSeconds, config.googleCalendarId, writeTracker, triggerRoadmapRefresh, morningRoutineLock, config.timezone);
+    };
+    if (services.calendar && shouldStartObserversFor(db, "google_calendar")) {
+        const poller = buildCalendarPoller();
+        if (poller)
+            observerManager.register(poller);
+    }
+    observerManager.register(new ImminentEventScheduler(db, eventBus, config.googleCalendarId));
+    // Build NotionPoller from current services + config. Returns null when
+    // `services.notion` is unavailable or no databases are configured so
+    // the integration-lifecycle module can no-op (e.g. integration flips
+    // to direct before the API key is set up). The §4.5.1 gate
+    // `notion.mode === "direct"` is checked BEFORE invoking the builder.
+    const buildNotionPoller = () => {
+        if (!services.notion)
+            return null;
+        if (Object.keys(config.notionDatabaseIds).length === 0)
+            return null;
+        return new NotionPoller({
+            notionService: services.notion,
+            databaseIds: config.notionDatabaseIds,
+            pollIntervalSeconds: config.notionPollIntervalSeconds,
+            db,
+            writeTracker,
+        });
+    };
+    if (services.notion
+        && Object.keys(config.notionDatabaseIds).length > 0
+        && shouldStartObserversFor(db, "notion")) {
+        const poller = buildNotionPoller();
+        if (poller)
+            observerManager.register(poller);
+    }
+    if (services.mail) {
+        observerManager.register(new MailPoller({
+            registry: services.mail,
+            db,
+            writeTracker,
+            pollIntervalSeconds: config.mailPollIntervalSeconds,
+            maxMessagesPerPoll: config.mailMaxMessagesPerPoll,
+            authFailureRetryHours: config.mailAuthFailureRetryHours,
+            providerPollIntervalsSeconds: {
+                gmail: config.gmailPollIntervalSeconds,
+            },
+            notifyOwner: async (message) => {
+                await messageHub.sendToUser(message);
+            },
+            triggerRoadmapRefresh,
+        }));
+        observerManager.register(new MailReconciliationJob({
+            registry: services.mail,
+            db,
+        }));
+    }
+    // ── 7.04 Skill-curation observers (P22 — appendix p22-skill-self-optimization.md) ──
+    // Hourly walker accumulates `structure_diff` signals for the curation
+    // cohort. Outcomes/feedback collection was dropped from the Preview scope
+    // — the feature optimizes silently in the background, no metrics surface.
+    {
+        const { SkillCurationWalker } = await import("./observers/skill-curation-walker.js");
+        observerManager.register(new SkillCurationWalker(db, getContextDir(config), join(config.workspaceDir, "agent-assets", "skills"), config.dataDir));
+        // §5.4 — boot-time orphan-overlay scan. Emits one log line per orphan
+        // and seeds `runtime_state.skill_curation.orphan_overlays` so the
+        // dashboard banner can read it without re-walking the FS.
+        try {
+            const { scanAndRecordOrphanOverlays } = await import("./core/skill-curation/orphan-overlay.js");
+            scanAndRecordOrphanOverlays(db, config.dataDir, join(config.workspaceDir, "agent-assets", "skills"));
+        }
+        catch (err) {
+            logger.warn({ err }, "Skill-curation orphan-overlay scan failed at boot");
+        }
+    }
+    // ── 7.05 Context-index reconciler (B-004 Phase 2a) ──
+    // Keeps `context/context-index.md` in sync with the filesystem so the
+    // per-flow review-context loader can treat the index as authoritative.
+    // Combines: startup one-shot (30 s after boot), internal chokidar
+    // watcher on contextDir (10 s debounce), cron nightly (wired via
+    // `AgentScheduler.setContextIndexReconcilerCallback`), and API-route
+    // hints via `onIndexableContextChange` below.
+    let contextIndexReconcilerPromptSink = null;
+    const contextIndexReconciler = new ContextIndexReconcilerObserver({
+        db,
+        contextDir: getContextDir(config),
+        writeTracker,
+        onPromptContextChanged: (path, reason, tier, metadata) => {
+            // The reconciler writes one path (`context-index.md`) — route the
+            // prompt-cache invalidation through the same handler every other
+            // context write uses. The real handler is installed in §11
+            // (`onPromptContextChanged` ApiDependency); this indirection lets
+            // the observer start at §7 before the handler exists.
+            contextIndexReconcilerPromptSink?.(path, reason, tier, metadata);
+        },
+        morningRoutineLock,
+        timezone: config.timezone || undefined,
+    });
+    observerManager.register(contextIndexReconciler);
+    // docs/design/21-management-registry-and-entities.md §7.6 P5 —
+    // entity-mirror watcher. Owns its own chokidar watcher (independent
+    // of the context-index reconciler's debounce path) so single-file
+    // L2 writes converge into the SQLite mirror within NFR-9's 500 ms
+    // budget — the §7.6 lookup contract relies on this freshness at
+    // scheduled-task fire time. Boot pass + watcher lifecycle handled
+    // by the observer wrapper.
+    //
+    // §7.2 chain — fan an L2 entity delta out to the context-index
+    // observer's `requestReconcile` so the rendered domain-index +
+    // activity-view files refresh on the same 10 s debounce as other
+    // fs_event triggers. Without this, those views only converged on
+    // the nightly cron + 30 s startup pass because `shouldIndexPath`
+    // filters L2 paths out of the context-index's own watcher
+    // (followups item 7).
+    observerManager.register(new EntityMirrorObserver({
+        db,
+        contextDir: getContextDir(config),
+        writeTracker,
+        onEntityChanged: () => contextIndexReconciler.requestReconcile("fs_event"),
+    }));
+    // ── 7.1 MCP auto-probe (B-003 Phase 4.3) ──
+    // Walks enabled mcp_servers rows every `mcpAutoProbeIntervalMinutes` and
+    // re-runs the probe sandbox. Set the interval to 0 to disable. The
+    // observer never flips `enabled` on its own — failure surfaces through
+    // the dashboard card's status dot, user decides whether to disable.
+    {
+        const { McpAutoProbe } = await import("./services/mcp/auto-probe.js");
+        observerManager.register(new McpAutoProbe({
+            db,
+            blobStore,
+            dataDir: config.dataDir,
+            intervalMinutes: config.mcpAutoProbeIntervalMinutes,
+        }));
+    }
+    // ── 7.2 Observation summarizer (cost-reduction-structural §A) ──
+    // Drains pending observation rows asynchronously: pre-filter → per-
+    // source LLM call → `summary_text` + `novelty_score` written back to
+    // the row. The hourly_check skill consumes summaries instead of
+    // re-fetching raw content. Disabled cleanly via
+    // `observationSummarizerEnabled` — when off, observations stay
+    // pending and the skill drops to legacy fetch-on-doubt.
+    if (config.observationSummarizerEnabled) {
+        const summarizerBinding = (() => {
+            try {
+                const row = db
+                    .prepare(`SELECT main_backend, main_model FROM process_backend_config WHERE process_key = 'observation.summarize'`)
+                    .get();
+                if (!row?.main_backend || !row.main_model)
+                    return null;
+                return { backendId: row.main_backend, modelId: row.main_model };
+            }
+            catch (err) {
+                logger.debug({ err }, "Failed to read observation.summarize binding; using fallback");
+                return null;
+            }
+        })();
+        const summarizerClient = (() => {
+            const fallbackBackend = summarizerBinding?.backendId ?? "claude";
+            const fallbackModel = summarizerBinding?.modelId ?? "claude-haiku-4-5-20251001";
+            if (fallbackBackend === "claude") {
+                return new AnthropicSummarizerClient({
+                    modelId: fallbackModel,
+                    getApiKey: async () => {
+                        const direct = await secretBroker.getBackendApiKey("claude");
+                        if (direct)
+                            return direct;
+                        // Fall back to env (matches the daemon's API-key bridging policy).
+                        return process.env.ANTHROPIC_API_KEY ?? null;
+                    },
+                });
+            }
+            // Codex / Gemini summarizer support is not yet implemented; the
+            // worker translates `unsupported_backend` into a 'skipped' row so
+            // the hourly_check skill drops to its legacy fetch path.
+            return new UnsupportedSummarizerClient(fallbackBackend, fallbackModel);
+        })();
+        observerManager.register(new ObservationSummarizerWorker({
+            db,
+            client: summarizerClient,
+            concurrency: config.observationSummarizerConcurrency,
+            perCallTimeoutMs: config.observationSummarizerTimeoutMs,
+            maxLlmCallsPerMinute: config.observationSummarizerMaxCallsPerMinute,
+            queueDepthLimit: config.observationSummarizerQueueLimit,
+            preFilter: { vipMailSenders: config.vipMailSenders },
+        }));
+    }
+    else {
+        logger.info("Observation summarizer disabled — pending rows stay pending");
+    }
+    // ── 8. Health Monitor ──
+    const healthMonitor = new HealthMonitor({
+        db,
+        config,
+        eventBus,
+        messageHub,
+        observerManager,
+        startedAt,
+    });
+    // Notifications Center heartbeat (see docs/design/20-notifications-center.md).
+    // Updates an in-memory tick timestamp every 30s; surfaced via /api/health
+    // so the dashboard can detect a frozen event loop.
+    const heartbeat = new Heartbeat();
+    // ── 9. Scheduler ──
+    const scheduler = new AgentScheduler(eventBus, db, config);
+    // ── 9.1 Custom routine scheduler (B-007 §5.8) ──
+    // Reads `routines/custom/*.md` from the context dir and registers a
+    // cron job per enabled routine. Reloaded from the context API whenever
+    // the agent or dashboard edits a file under that directory.
+    const customRoutineScheduler = new CustomRoutineScheduler({
+        contextDir: getContextDir(config),
+        eventBus,
+        timezone: config.timezone || undefined,
+    });
+    // ── 9.5 Signal Detector ──
+    const signalDetector = new SignalDetector(config);
+    // ── 10. Event Processing Pipeline ──
+    const agentCore = new ClaudeCodeCore(config, writeTracker);
+    const codexCore = new CodexCore(config);
+    const geminiCore = new GeminiCliCore(config, writeTracker, undefined, db);
+    // B-003 Phase 3 — wire the MCP session context so per-session workdirs pick
+    // up the current DB + keychain state at spawn time. Each core stays
+    // backward-compatible: without this call it simply runs without MCP.
+    const mcpContext = { db, blobStore };
+    agentCore.setMcpContext(mcpContext);
+    codexCore.setMcpContext(mcpContext);
+    geminiCore.setMcpContext(mcpContext);
+    // DELEGATED-PROXY-API-DESIGN.md Phase A — boot janitor sweeps stale
+    // `agent-sessions/proxy-*` tempdirs left by SIGKILL'd proxy invocations,
+    // then construct the invoker so /api/mail/* and /api/calendar/* route
+    // handlers can dispatch through it once Phase B wires the route shims.
+    const janitorRemoved = runProxyTempdirJanitor(config.dataDir);
+    if (janitorRemoved > 0) {
+        logger.info({ removed: janitorRemoved }, "Boot janitor cleared stale delegated-proxy tempdirs");
+    }
+    const poolJanitorRemoved = runSessionPoolTempdirJanitor(join(config.dataDir, "agent-sessions"));
+    if (poolJanitorRemoved > 0) {
+        logger.info({ removed: poolJanitorRemoved }, "Boot janitor cleared stale delegated-task pool tempdirs");
+    }
+    // DELEGATED-TASK-MODE-DESIGN.md §11.1 — close `delegated_task.exec`
+    // rows that were `in_progress` when the daemon last crashed. Without
+    // this, the dashboard's in-flight counter and audit views drift forever.
+    const taskOrphansClosed = runDelegatedTaskOrphanJanitor(db);
+    if (taskOrphansClosed > 0) {
+        logger.info({ closed: taskOrphansClosed }, "Boot janitor closed orphaned delegated_task in-progress rows");
+    }
+    const delegatedBackendInvoker = new DelegatedBackendInvoker({
+        db,
+        config,
+        cores: { claude: agentCore, codex: codexCore, gemini: geminiCore },
+    });
+    let delegatedSyncWorker = null;
+    const buildDelegatedSyncWorker = () => {
+        if (!delegatedSyncWorker) {
+            delegatedSyncWorker = new DelegatedSyncWorker({
+                db,
+                invoker: delegatedBackendInvoker,
+                calendarId: config.googleCalendarId,
+                timezone: config.timezone,
+                todayWriteLock: morningRoutineLock,
+                triggerRoadmapRefresh,
+            });
+        }
+        return delegatedSyncWorker;
+    };
+    if (hasActiveDelegatedSyncIntegration(db)) {
+        observerManager.register(buildDelegatedSyncWorker());
+    }
+    // ── Delegated probe observer (DELEGATED-MODE-V2 §7.1) ──
+    // Hourly re-probe of delegated integrations' connector tools so the
+    // `integration_probes` cache reflects current sign-in state. Without
+    // this, `consultDelegatedConnectorHealth` (§4.5) has no signal to fire
+    // on after the wizard's first probe — the §10 "user signed out hours
+    // ago" risk row would stay silent.
+    //
+    // Registered here (mid-§10) rather than in §7 because it depends on the
+    // three agent cores constructed at the top of this section. The
+    // observerManager.startAll() call further down picks it up unchanged.
+    {
+        const { DelegatedProbeObserver } = await import("./observers/delegated-probe-observer.js");
+        observerManager.register(new DelegatedProbeObserver({
+            db,
+            agentBackends: [agentCore, codexCore, geminiCore],
+            intervalMinutes: config.delegatedProbeIntervalMinutes,
+        }));
+    }
+    const notificationManager = new NotificationManager(messageHub, db, config);
+    const authTelemetry = new AuthTelemetry(db);
+    // Shared notifier factory for auth-health-monitor and auth-recovery (D3 fix).
+    // Maps `kind` to notification_type + category so both callers share the
+    // same routing / quiet-hours-bypass logic without duplicating 30+ lines.
+    //
+    // Probe-failure and recovery DMs bypass NotificationManager's own quiet-hours
+    // + rate-limit gates via `category: "error"` (SAFETY_CATEGORIES member).
+    // Keepalive DMs stay on the standard path. See Phase 4 self-critique B2 for
+    // the anti-spam reasoning (clock-driven, ≤1 DM per cron tick).
+    const makeAuthNotifier = (source) => ({
+        send: async (message, options) => {
+            const kind = options?.kind ?? "keepalive";
+            const typeMap = {
+                probe_failure: "auth.probe_failure",
+                recovery: "auth.recovery",
+                keepalive: "auth.keepalive_reminder",
+            };
+            const notificationType = typeMap[kind] ?? "auth.keepalive_reminder";
+            // probe_failure and recovery bypass quiet-hours; keepalive does not.
+            const category = kind === "keepalive" ? "auth-health" : AUTH_PROBE_NOTIFICATION_CATEGORY;
+            await notificationManager.send(message, {
+                type: notificationType,
+                source,
+                priority: EventPriority.NORMAL,
+                timestamp: new Date(),
+                data: {},
+                correlationId: randomBytes(8).toString("hex"),
+            }, {
+                priority: "normal",
+                category,
+                destinationMode: "configured_only",
+            });
+        },
+    });
+    const authHealthMonitor = new AuthHealthMonitor(db, {
+        claude: agentCore,
+        codex: codexCore,
+        gemini: geminiCore,
+    }, authTelemetry, {
+        notifier: makeAuthNotifier("auth-health-monitor"),
+        // Forward references — these gate closures are registered here
+        // but only fire once `scheduler.start()` ticks the hourly cron,
+        // by which time `dispatcher` is fully constructed (see the
+        // declaration further down in this file). Calling any of these
+        // before then would hit TDZ; in practice the constructor and
+        // `reconcilePendingRecoveries` / `runKeepaliveSweep` never do.
+        isMorningRoutineActive: () => dispatcher.isMorningRoutineActive(),
+        isQuietHours: () => notificationManager.isQuietHours(),
+        probeDisabled: () => config.authProbeDisabled,
+    });
+    // Reset any recoveries that were in-flight when the daemon was last killed.
+    const recovered = authHealthMonitor.reconcilePendingRecoveries();
+    if (recovered > 0) {
+        logger.info({ count: recovered }, "Reconciled stuck auth recoveries on startup");
+    }
+    // Run the 60-day keepalive sweep once on startup. Hourly probe is
+    // registered via scheduler.setAuthProbeCallback — see §9.5.4.
+    void authHealthMonitor.runKeepaliveSweep().catch((err) => {
+        logger.warn({ err }, "Initial auth keepalive sweep failed");
+    });
+    const keepaliveTimer = setInterval(() => {
+        void authHealthMonitor.runKeepaliveSweep().catch((err) => {
+            logger.warn({ err }, "Periodic auth keepalive sweep failed");
+        });
+    }, 24 * 60 * 60 * 1000);
+    keepaliveTimer.unref?.();
+    // Phase 5/6: Interactive auth recovery manager. Uses the same notifier
+    // sink as the AuthHealthMonitor so recovery DMs flow through the same
+    // notification pipeline with the same anti-spam guarantees.
+    const authRecovery = new AuthRecovery(db, authTelemetry, authHealthMonitor, makeAuthNotifier("auth-recovery"), {
+        claudeRecoveryTimeoutMin: 10,
+        codexRecoveryTimeoutMin: 15,
+        geminiRecoveryTimeoutMin: 5,
+    });
+    // ── Scoped read tokens for ReadSensitive API endpoints ──
+    // Tokens rotate per session/workdir execution and are only injected into
+    // backend subprocess env, never into prompt-visible instruction files.
+    const readTokenManager = new ScopedReadSensitiveTokenManager();
+    const agentRouter = new BackendRouter(db, config, [agentCore, codexCore, geminiCore], notificationManager, authTelemetry, 
+    // Callback to materialize instruction files for a fallback backend in an
+    // existing session workdir. Without this, a Claude→Codex heavy-tier
+    // fallback would leave the dir with only CLAUDE.md and no AGENTS.md.
+    // After materializing built-in files, re-sync user-authored skills so
+    // the newly created backend-specific dir (e.g. .codex/skills/) also
+    // receives user skills. The dispatcher's syncAllUserSkills ran BEFORE
+    // router.execute(), so the fallback dir didn't exist at that point.
+    (sessionDir, backendId, eventType, processKey) => {
+        // services is the mutable ServiceRegistry — reading .calendar here
+        // picks up the current availability (e.g. after mid-flight OAuth).
+        // GitHub presence is read fresh from the unified `repositories` table
+        // (rows with a github side); legacy `githubRepos` config is gone.
+        const cfgServices = buildConfiguredServices(config, {
+            ...services,
+            github: selectGithubRepoSlugs(db).length > 0,
+        });
+        const mailAccounts = services.mail?.listActiveAccounts() ?? [];
+        ensureBackendMaterialized(config.workspaceDir, sessionDir, backendId, eventType, processKey, cfgServices, mailAccounts, readIntegrations(db), config.character);
+        syncAllUserSkills(sessionDir, join(config.dataDir, "skills"));
+    });
+    // Startup validation — warn if any delegated-mode variant files are
+    // missing. Now checks both skill and task-flow variants for every
+    // currently-delegated integration against its configured `delegatedBackend`
+    // (not the union of all possible backends — see validateDelegatedStartup
+    // docstring). Never throws; the PATCH route + /health do the hard-
+    // rejection and user-surfacing downstream.
+    {
+        const startupIntegrations = readIntegrations(db);
+        const missing = validateDelegatedStartup(config.workspaceDir, startupIntegrations);
+        if (missing.skills.length > 0 || missing.taskFlows.length > 0) {
+            logger.warn({ missingSkills: missing.skills, missingTaskFlows: missing.taskFlows }, "Delegated-mode variant files missing — agent will fall back to SKILL.md / direct task-flow for affected entries; surface in /health.integrationModes");
+        }
+    }
+    const contextBuilder = new ContextBuilder(config, db, services);
+    // Task flows are simple code constants — no file system, no hot-reload needed
+    const sessionManager = new SessionManager(db, config);
+    const messageRecorder = new MessageRecorder(db);
+    const eventBroadcaster = new EventBroadcaster();
+    const auditLogger = new AuditLogger(db, {
+        // `/api/events/stream` is defined in terms of persisted agent_actions rows,
+        // not raw EventBus payloads, so the broadcaster subscribes at the audit layer.
+        onRowInserted: (row) => eventBroadcaster.broadcastEvent(row),
+    });
+    // Shared body for "something changed that affects what's baked into
+    // active DM workdirs — refresh them in place." Used by:
+    //   - `onMailScopeChanged` (MailAccountRegistry scope-change hook)
+    //   - the integration-mode lifecycle (DELEGATED-PROXY-API-DESIGN.md
+    //     Phase F §4.8 — every mode flip re-materializes so the unified
+    //     skill body and per-backend instruction file reflect the new
+    //     state on the next turn without tearing down the SDK session)
+    //
+    // Returns null when there's no active DM session to refresh; otherwise
+    // the per-session summary so callers can attach it to a broadcast or
+    // structured log. Per-session failures stay inside the helper.
+    const rematerializeActiveDmWorkdirs = (reason) => {
+        const sessions = sessionManager.listActiveDmSessions();
+        if (sessions.length === 0) {
+            logger.debug({ reason }, "DM workdir refresh requested — no active DM sessions");
+            return null;
+        }
+        const cfgServices = buildConfiguredServices(config, {
+            ...services,
+            github: selectGithubRepoSlugs(db).length > 0,
+        });
+        const mailAccounts = services.mail?.listActiveAccounts() ?? [];
+        // Read integration state fresh inside the closure so a Phase F mode
+        // flip's pre-`writeIntegrations` row is not what gets baked. The
+        // `SkillsCompiler` uses this for variant resolution (non-proxy
+        // integrations like Notion need `SKILL.delegated.<backend>.md`) and
+        // to re-emit `applyAllDeniedToolsForSkill` soft-deny prose. Passing
+        // an empty object would silently regress to the latent staleness bug
+        // that Phase F surfaced.
+        const integrations = readIntegrations(db);
+        const summary = refreshDmSessionWorkdirs({
+            projectRoot: config.workspaceDir,
+            dataDir: config.dataDir,
+            sessions,
+            configuredServices: cfgServices,
+            mailAccounts,
+            integrations,
+            character: config.character,
+        });
+        return { summary, mailAccounts };
+    };
+    // Real implementation of the mail-scope-changed hook. Wired by the
+    // MailAccountRegistry constructor above through a forward-reference so the
+    // registry can be built before sessionManager / eventBroadcaster exist.
+    // Re-materializes every active DM session workdir so `accounts.md` and the
+    // `external-services` skill reflect the new scope on the next turn without
+    // tearing down the SDK session.
+    onMailScopeChanged = (reason) => {
+        const result = rematerializeActiveDmWorkdirs(reason);
+        if (!result)
+            return;
+        logger.info({ reason, ...result.summary }, "Mail scope changed — DM session workdirs re-materialized");
+        eventBroadcaster.broadcastEvent({
+            kind: "mail_scope_changed",
+            reason,
+            activeAccounts: result.mailAccounts.length,
+            ...result.summary,
+        });
+    };
+    // Management Mode Phase 2 — shared migration primitives. Long timeout
+    // because cross-fs copies of large vaults may legitimately run
+    // multiple minutes; the lock itself is cheap and only blocks a
+    // second concurrent /api/setup/migrate-context call.
+    const migrationLock = new MigrationLock(60 * 60 * 1000);
+    const contextWriteGate = new ContextWriteGate();
+    initTaskFlows(config.workspaceDir, config.dataDir);
+    const dispatcher = new EventDispatcher(eventBus, agentRouter, contextBuilder, getTaskFlow, notificationManager, sessionManager, messageRecorder, auditLogger, db, config, morningRoutineLock, services, roadmapWriteLock, writeTracker);
+    dispatcher.setSignalDetector(signalDetector);
+    // DOCS_QA_B7_DESIGN.md §11.1 — persistence-side citation validator
+    // for docs_qa sessions. Lookup runs over fts_docs (indexed by the
+    // docs indexer); the dispatcher only consults it when
+    // `isDocsQAMessage(event)` is true, so this hook is inert for
+    // chat/DM/routine flows and for installs that haven't ingested docs.
+    const docsCitationLookup = makeDocsCitationLookup(db);
+    dispatcher.setDocsCitationLookup(docsCitationLookup);
+    // Docs-QA SSE adapter — DOCS_QA_B7_DESIGN.md §S4 / §S8. Sits
+    // alongside `dashboardAdapter` on the same `platform="dashboard"`
+    // surface; the `intent: "docs_qa"` discriminator on inbound events
+    // forks dispatch into the docs-qa task flow + skill set + light
+    // tier clamp. The adapter is exposed to `createDocsRoutes` for the
+    // QA POST/SSE endpoints; outbound text reaches it via the dispatcher's
+    // `IDashboardStream` slot fanned out by `CompositeDashboardStream`.
+    //
+    // It is intentionally NOT registered with `messageHub`: the hub keys
+    // adapters by `platformName`, and both `DashboardAdapter` and this
+    // adapter declare `platformName="dashboard"`. A second registration
+    // would silently replace `dashboardAdapter` in the hub map (only a
+    // warn-log), breaking `getAdapter("dashboard")`, the
+    // start/stop lifecycle for the chat adapter, and any
+    // `sendToPlatform("dashboard", ...)` caller (DocsQAAdapter.sendMessage
+    // throws — it's streaming-only). DocsQAAdapter's lifecycle is owned
+    // by the SSE route itself: clients register on `GET /docs/qa/stream`
+    // and unregister on the request's `onAbort`.
+    const docsQAAdapter = new DocsQAAdapter((event) => void eventBus.put(event), docsCitationLookup);
+    // Fan-out: the dispatcher's single `IDashboardStream` slot drives
+    // both the chat and docs-QA adapters. Each adapter no-ops on
+    // unknown channelIds (per F3.2), so only the adapter that owns
+    // the destination channelId actually emits — fan-out is naturally
+    // safe (DOCS_QA_B7_DESIGN.md §9 F3.4 / §11.4).
+    dispatcher.setDashboardStream(new CompositeDashboardStream([dashboardAdapter, docsQAAdapter]));
+    dispatcher.setAttachmentStore(attachmentStore);
+    // Local-Whisper voice transcription for inbound audio attachments.
+    // See docs/design/appendices/voice-transcription.md.
+    //
+    // `enabled` is driven by the `voiceTranscriptionEnabled` runtime setting
+    // (default `false`). The flag is opt-in via the dashboard's Voice Mode
+    // card, which goes through `POST /api/voice/install` so the model
+    // download and the daemon restart happen atomically — the constructor
+    // here observes the persisted flag on the next boot.
+    //
+    // Env vars stay live for advanced operators who want to override the
+    // model id, language, or duration cap without a settings round-trip.
+    // `PA_VOICE_TRANSCRIPTION_ENABLED` is honoured as a fallback when the
+    // setting is unset (legacy behaviour for installs predating the flag).
+    const voiceTranscriberMaxDuration = Number(process.env.PA_VOICE_TRANSCRIPTION_MAX_DURATION_SEC ?? "600");
+    const voiceEnvOverride = process.env.PA_VOICE_TRANSCRIPTION_ENABLED;
+    // When `PA_VOICE_TRANSCRIPTION_ENABLED` is set, env wins (operator
+    // override). Otherwise read live from `config` so the dashboard's
+    // voice install flow — which mutates `config.voiceTranscriptionEnabled`
+    // and persists the setting in the same boot — takes effect on the
+    // next inbound audio attachment without waiting for a daemon restart.
+    const voiceTranscriberEnabled = voiceEnvOverride !== undefined
+        ? voiceEnvOverride.toLowerCase() !== "false"
+        : () => config.voiceTranscriptionEnabled;
+    dispatcher.setVoiceTranscriber(new VoiceTranscriber({
+        db,
+        modelDir: join(config.dataDir, "models", "whisper"),
+        enabled: voiceTranscriberEnabled,
+        model: process.env.PA_VOICE_TRANSCRIPTION_MODEL,
+        language: process.env.PA_VOICE_TRANSCRIPTION_LANGUAGE ?? null,
+        maxDurationSec: Number.isFinite(voiceTranscriberMaxDuration)
+            ? voiceTranscriberMaxDuration
+            : 600,
+    }));
+    dispatcher.setAuthRecovery(authRecovery);
+    dispatcher.setAuthHealthMonitor(authHealthMonitor);
+    // Wire the delegated-sync refresh callback. The thunk reads the live
+    // `delegatedSyncWorker` reference each call so the dispatcher tracks
+    // re-registration when an integration mode flips. When no delegated
+    // integration is present, the worker is null and the call is a no-op
+    // — the hourly check proceeds without extra latency.
+    // See `docs/design/appendices/delegated-sync-opt-in.md` and the
+    // worker's `runDisabledCadencesForHourlyCheck` doc-comment.
+    dispatcher.setDelegatedSyncRefresh(async () => {
+        await delegatedSyncWorker?.runDisabledCadencesForHourlyCheck();
+    });
+    // Messaging bang-commands (`!stop`/`!start`/`!cost`/`!report`) — owner DM
+    // chokepoint that runs ahead of every other interceptor in handleMessage.
+    // See docs/design/backlog/messaging-bang-commands.md.
+    dispatcher.setBangCommandRegistry(createDefaultBangCommandRegistry());
+    // P22 — wire the optimizer-workdir hooks. The `materialize` callback
+    // captures `db`, `dataDir`, `workspaceDir`, `contextDir`, and `secretStore`
+    // so the dispatcher branch can invoke it without importing the workdir
+    // module directly. `teardown` cleans up under PA_DATA_DIR/optimizer-workdir/.
+    {
+        const { materializeOptimizerWorkdir, teardownOptimizerWorkdir } = await import("./core/skill-curation/workdir.js");
+        dispatcher.setSkillCurationHooks({
+            materialize: (opts) => materializeOptimizerWorkdir({
+                db,
+                dataDir: config.dataDir,
+                workspaceDir: config.workspaceDir,
+                contextDir: getContextDir(config),
+                secretStore: secretBroker,
+                cadence: readSkillCurationCadence(db),
+                ...(opts?.manual ? { manual: true } : {}),
+                ...(opts?.targetSkillsOverride ? { targetSkillsOverride: opts.targetSkillsOverride } : {}),
+            }),
+            teardown: teardownOptimizerWorkdir,
+        });
+    }
+    if (isUserPaused(db)) {
+        logger.info("Restored user-paused state, autonomous work remains paused");
+    }
+    emitRoadmapRefreshSink = (source) => dispatcher.emitRoadmapRefresh(source);
+    agentCore.setReadTokenManager?.(readTokenManager);
+    geminiCore.setReadTokenManager?.(readTokenManager);
+    notificationManager.setSignalDetector(signalDetector);
+    let startupComplete = false;
+    let pendingGoogleServicesReady = false;
+    const handleGoogleServicesReady = () => {
+        // Start CalendarPoller if calendar was just hot-loaded AND the
+        // google_calendar integration is in `direct` mode. When the integration
+        // is `delegated`/`disabled` we keep the poller dormant — OAuth is wired
+        // up but the user has explicitly chosen not to poll.
+        if (services.calendar
+            && !observerManager.has("calendar")
+            && shouldStartObserversFor(db, "google_calendar")) {
+            const poller = buildCalendarPoller();
+            if (poller) {
+                observerManager.register(poller);
+                void poller.start();
+                logger.info("CalendarPoller started via hot-reload");
+            }
+        }
+        // Trigger morning_routine catchup if today.md is stale or missing
+        // (same logic as runCatchup, ensures schedule generation after first auth)
+        const contextDir = getContextDir(config);
+        const todayMdPath = join(contextDir, "today.md");
+        let needsMorning = false;
+        if (existsSync(todayMdPath)) {
+            const firstLine = readFileSync(todayMdPath, "utf-8").split("\n")[0];
+            const today = getAgentDayDateStr(config.timezone || undefined, config.dayBoundaryHour);
+            if (!firstLine.includes(today)) {
+                needsMorning = true;
+            }
+        }
+        else {
+            needsMorning = true;
+        }
+        if (needsMorning) {
+            // Morning routine's post-completion hook will also check roadmap staleness.
+            logger.info("Google services ready — today.md stale, queueing morning_routine wake");
+            scheduler.queueMorningRoutineWake("google_auth_ready");
+            return;
+        }
+        // Only refresh roadmap independently when today.md is already current.
+        // If morning_routine is needed, its post-completion hook will handle stale
+        // roadmap regeneration after the day context has been rebuilt.
+        if (isRoadmapStale(contextDir)) {
+            logger.info("Google services ready — roadmap stale, emitting roadmap_refresh");
+            dispatcher.emitRoadmapRefresh("google_auth_ready");
+        }
+    };
+    const handleSecretChange = async (scope) => {
+        switch (scope) {
+            case "slack":
+                await reloadSlackAdapter(true);
+                return;
+            case "telegram":
+                await reloadTelegramAdapter(true);
+                return;
+            case "discord":
+                await reloadDiscordAdapter(true);
+                return;
+            case "notion":
+                await reloadNotionService();
+                // Hot-reload: if the user just added the Notion API key while
+                // the integration is already in `direct` mode, register the
+                // poller now so they don't have to restart the daemon.
+                // Mirrors the calendar-side `handleGoogleServicesReady` path —
+                // the mode-flip route covers `delegated→direct`, and this
+                // covers the orthogonal "key arrives after direct was set"
+                // case. Idempotent via observerManager.has().
+                if (services.notion
+                    && !observerManager.has("notion-poller")
+                    && Object.keys(config.notionDatabaseIds).length > 0
+                    && shouldStartObserversFor(db, "notion")) {
+                    const poller = buildNotionPoller();
+                    if (poller) {
+                        observerManager.register(poller);
+                        void poller.start();
+                        logger.info("NotionPoller started via hot-reload");
+                    }
+                }
+                return;
+            case "github":
+                await reloadGitHubService();
+                if (gitWatcher && secretState.githubWebhookConfigured) {
+                    gitWatcher.enableWebhookMode();
+                }
+                return;
+            case "google":
+                await reloadGoogleServices();
+                return;
+            case "apple_calendar":
+                await reloadAppleCalendarService();
+                return;
+            case "apiToken":
+            default:
+                return;
+        }
+    };
+    // ── 11. Hono HTTP Server ──
+    // Enable webhook fallback: when GitHub webhook is configured, reduce GitWatcher frequency
+    const startupGitWatcher = gitWatcher;
+    if (startupGitWatcher && secretState.githubWebhookConfigured) {
+        startupGitWatcher.enableWebhookMode();
+    }
+    const handlePromptContextChanged = (path, reason, tier, metadata) => {
+        const setupMode = dispatcher.getCurrentSetupMode();
+        const decision = applyPromptContextStaleness({ path, reason, tier, metadata }, {
+            dmStalenessStrict: config.dmStalenessStrict,
+            setupInProgress: setupMode !== null,
+            markContextChanged: () => markContextChanged(db),
+            markActiveDmSessionsStale: (staleReason) => sessionManager.markActiveDmSessionsStale(staleReason),
+        });
+        logger.debug({
+            path,
+            reason,
+            tier_decided: decision.effectiveTier,
+            tier_requested: decision.requestedTier,
+            tier_reason: metadata?.tierReason,
+            dmStalenessStrict: config.dmStalenessStrict,
+            mode: setupMode,
+            invalidatesDmSessions: decision.invalidatesDmSessions,
+            skippedForSetup: decision.skippedForSetup,
+        }, "Prompt context staleness classified");
+        if (decision.skippedForSetup) {
+            logger.info({ path, reason, mode: setupMode }, "Skipping DM session stale flag - setup in progress");
+        }
+    };
+    const app = createApp({
+        db,
+        config,
+        secretBroker,
+        readTokenValidator: (token) => readTokenManager.isValid(token),
+        enforceReadToken: config.enforceReadToken,
+        agentBackends: [agentCore, codexCore, geminiCore],
+        authHealthMonitor,
+        authRecovery,
+        authTelemetry,
+        eventBus,
+        morningRoutineLock,
+        roadmapWriteLock,
+        migrationLock,
+        contextWriteGate,
+        observerManager,
+        delegatedInvoker: delegatedBackendInvoker,
+        gitAccountRegistry,
+        onPrimaryVaultPathChange: (newPath) => primaryVaultWatcher.setVaultPath(newPath),
+        onGitReposChanged: () => queueGitProjectInitsForCurrentConfig("config-patch"),
+        getInFlightExecutions: () => dispatcher.getInFlightExecutions(),
+        getHealthData: () => {
+            const status = healthMonitor.getStatus();
+            return {
+                uptime: status.daemonUptime,
+                eventBusSize: status.eventBusSize,
+                activeSessions: status.activeSessions,
+                connectedPlatforms: status.connectedPlatforms,
+                registeredObservers: status.registeredObservers,
+                missingContextFiles: status.missingContextFiles,
+                contextFilesOk: status.contextFilesOk,
+            };
+        },
+        getLastTickAt: () => heartbeat.getLastTickAt(),
+        services,
+        isStartupComplete: () => startupComplete,
+        getIntegrationStatus,
+        getMessagingStatus,
+        // Bang-commands `/api/health` surface — messaging-bang-commands.md §6.1.
+        // Returns `"ok"` for the unblocked case so dashboards never have to
+        // null-check, while preserving the original gate enum for the blocked
+        // states.
+        getAutonomousState: () => dispatcher.isAutonomousAllowed() ?? "ok",
+        getNotificationDestinations: () => ({
+            defaultPlatforms: config.defaultNotificationPlatforms,
+            effectiveFallbackPlatforms: messageHub.getEffectiveFallbackPlatforms(),
+        }),
+        getIntegrationDriftSyncStatus: () => delegatedSyncWorker?.getStatus() ?? {
+            workerRunning: false,
+            lastSuccessAt: null,
+            circuitState: "ok",
+            activeHours: { startHour: 4, endHour: 24 },
+            withinActiveHours: false,
+            cadences: {},
+            unrecognizedIntervalKeys: [],
+            ttlContractViolations: [],
+        },
+        // delegated-sync opt-in routes consume the live worker reference for
+        // cadence Run Now + status snapshot. When no integration is in
+        // delegated mode the worker is null and the routes report a
+        // worker_unavailable / empty-status response — see
+        // `docs/design/appendices/delegated-sync-opt-in.md`.
+        get delegatedSyncWorker() {
+            return delegatedSyncWorker ?? undefined;
+        },
+        sendNotification: async ({ message, platforms, priority, notificationType, originSessionId, }) => {
+            const dispatchId = randomBytes(16).toString("hex");
+            const deliveries = await messageHub.sendToUser(message, platforms, {
+                dispatchId,
+                notificationType: notificationType ?? "agent",
+                priority: priority ?? "normal",
+                contentSummary: message.slice(0, 200),
+            });
+            if (deliveries.length > 0) {
+                const insert = db.prepare(`INSERT INTO notification_log (
+             dispatch_id,
+             notification_type,
+             priority,
+             platform,
+             delivery_channel,
+             delivery_message_id,
+             content_summary,
+             status,
+             delivered_at
+           )
+           VALUES (?, ?, ?, ?, ?, ?, ?, 'delivered', CURRENT_TIMESTAMP)`);
+                for (const delivery of deliveries) {
+                    insert.run(dispatchId, notificationType ?? "agent", priority ?? "normal", delivery.platform, delivery.channel, delivery.messageId ?? null, message.slice(0, 200));
+                }
+                recordProactiveForwardDeliveries({
+                    db,
+                    config,
+                    deliveries,
+                    content: message,
+                    dispatchId,
+                    dispatchIds: [dispatchId],
+                    originSessionIds: originSessionId !== undefined ? [originSessionId] : [],
+                    notificationType: "proactive_forward",
+                });
+            }
+            return { dispatchId, deliveries };
+        },
+        markEventNotified: (correlationId) => {
+            dispatcher.markEventNotified(correlationId);
+        },
+        onGoogleServicesReady: () => {
+            if (!startupComplete) {
+                pendingGoogleServicesReady = true;
+                logger.info("Google services ready during bootstrap — deferring startup-sensitive actions");
+                return;
+            }
+            handleGoogleServicesReady();
+        },
+        onScheduleConfigChanged: () => scheduler.reloadCrons(),
+        onIntegrationModeChange: async (key, prev, next) => {
+            const buildObserver = (observerName) => {
+                // Registry-gated direct observers. Mail's multi-provider poller is a
+                // deferred follow-up — gmail.observersTouched is empty, so that
+                // branch remains unreachable today.
+                if (observerName === "calendar")
+                    return buildCalendarPoller();
+                if (observerName === "notion-poller")
+                    return buildNotionPoller();
+                if (observerName === "git")
+                    return buildGitWatcher();
+                if (observerName === "github")
+                    return buildGithubPoller();
+                return null;
+            };
+            await applyIntegrationModeChange({
+                db,
+                observerManager,
+                buildObserver,
+                buildDelegatedSyncWorker,
+                buildGitDelegatedCronObserver,
+                // DELEGATED-PROXY-API-DESIGN.md Phase F (§4.8) — every mode
+                // change re-materializes active DM workdirs so the next turn
+                // picks up the new skill body / accounts.md / instruction file
+                // without tearing down the SDK session.
+                rematerializeDmSessions: (reason) => {
+                    const result = rematerializeActiveDmWorkdirs(reason);
+                    if (!result)
+                        return;
+                    logger.info({ reason, ...result.summary }, "Integration mode changed — DM session workdirs re-materialized");
+                },
+            }, key, prev, next);
+            if (key === "git" && next.mode !== "direct") {
+                gitWatcher = null;
+            }
+        },
+        onMainBackendChange: (reason) => {
+            // DELEGATED-MODE-V2-DESIGN.md §4.4 — every main-backend flip
+            // re-materializes active DM workdirs so the next turn's skill
+            // variant and instruction file reflect the new same- vs.
+            // cross-backend topology. Mirrors the `onMailScopeChanged`
+            // pattern: helper handles the "no active sessions" no-op + per-
+            // session failure containment, and we broadcast a structured
+            // event so the dashboard can refresh without polling.
+            const result = rematerializeActiveDmWorkdirs(reason);
+            if (!result)
+                return;
+            logger.info({ reason, ...result.summary }, "Main backend changed — DM session workdirs re-materialized");
+            eventBroadcaster.broadcastEvent({
+                kind: "main_backend_changed",
+                reason,
+                ...result.summary,
+            });
+        },
+        onSetupStart: (mode) => {
+            dispatcher.beginSetupMode(mode);
+        },
+        onSecretChanged: handleSecretChange,
+        onSetupComplete: () => {
+            dispatcher.clearSetupMode();
+            // Kick off an immediate morning routine so today.md is generated
+            // right away — otherwise the user completes setup mid-day and sits
+            // without a populated today.md until 04:00 next morning. We go
+            // through the scheduler's queueMorningRoutineWake so:
+            //   - the dedup check prevents a double-run if startup catchup was
+            //     about to kick off the same routine (race on first boot after
+            //     setup completes)
+            //   - the wake task is durable: if the daemon crashes before the
+            //     routine runs, it replays on restart via ScheduleWatcher
+            //   - ScheduleWatcher obeys the autonomous-work gate, so in the
+            //     unlikely case clearSetupMode fails to persist, the gate
+            //     still prevents the routine from running mid-setup.
+            // Don't emit roadmap_refresh here — skeleton has "(Not yet configured)"
+            // which isRoadmapStale() detects. The refresh will be triggered by:
+            // - morning_routine's post-completion hook, or
+            // - onGoogleServicesReady (once calendar auth completes)
+            // This avoids generating a roadmap before calendar data is available.
+            try {
+                scheduler.queueMorningRoutineWake("setup_complete");
+            }
+            catch (err) {
+                logger.error({ err }, "Failed to queue post-setup morning routine — today.md will not be generated until next 04:00");
+            }
+        },
+        onPromptContextChanged: (path, reason, tier, metadata) => {
+            // Layer-3 defense for the Customize Your Rules bug: even if the
+            // setup conversation's own agent writes to today/roadmap/management-
+            // rules mid-flight (not typical, but possible via skills), we must
+            // NOT mark the owner-DM session stale. Marking stale would refresh
+            // the conversation_sessions row on the next turn, drop the stored
+            // Claude SDK session_id, and force a fresh `setup.initial` execute
+            // that loses prior Q&A history. Layers 1 (autonomous-work gate)
+            // and 2 (scope-agnostic currentSetupMode) keep prompt selection
+            // correct, but only layer 3 preserves in-conversation continuity.
+            // For loud-tier changes, persist the change moment FIRST so a crash
+            // between the DB write and stale-flag update still leaves the durable
+            // signal in place — the in-memory flag on SessionManager is lost on
+            // restart, so if it were written before the DB write we could lose
+            // the signal entirely on a process crash mid-hook.
+            //
+            // The persisted `dashboard_context_changed_at` is consulted by both
+            // `continueDashboardSession` (resume path) and `getOrCreateDm`
+            // (every DM turn) to decide whether the stored SDK session has gone
+            // stale and must be discarded before resume.
+            handlePromptContextChanged(path, reason, tier, metadata);
+        },
+        onIndexableContextChange: (_path) => {
+            // API-route hint: any successful PUT/PATCH/DELETE under `/context/*`
+            // queues a reconcile. The observer's own chokidar watcher already
+            // catches manual edits the API bypasses (e.g. the user editing via
+            // Obsidian when contextDir *is* the Obsidian vault) — this hint
+            // shortens reconcile latency for API-origin writes from chokidar
+            // debounce + stabilityThreshold to the observer's 10s debounce. The
+            // reconciler short-circuits when nothing changed, so firing for
+            // non-indexed paths is harmless.
+            contextIndexReconciler.requestReconcile("manual");
+        },
+        onCustomRoutinesChanged: () => {
+            try {
+                customRoutineScheduler.reload();
+            }
+            catch (err) {
+                logger.error({ err }, "Custom routine reload failed");
+            }
+        },
+        triggerHourlyCheck: (source, options) => dispatcher.triggerHourlyCheck(source, options),
+        triggerRoadmapRefresh: (source, options) => dispatcher.emitRoadmapRefresh(source, options),
+        endDashboardSession: (channelId) => endDashboardSessionFromChannel({
+            sessionManager,
+            channelId,
+        }),
+        continueDashboardSession: async (sessionId) => continueDashboardSessionFromHistory({
+            db,
+            dataDir: config.dataDir,
+            sessionManager,
+            sessionId,
+        }),
+        writeTracker,
+        blobStore,
+        dashboardAdapter,
+        eventBroadcaster,
+        attachmentStore,
+        auditLogger,
+        validateAttachmentTurnToken: (token) => dispatcher.validateAttachmentTurnToken(token),
+        whatsappControls: {
+            isInitialized: () => whatsappAdapter !== null,
+            enable: async () => {
+                const adapter = buildWhatsAppAdapter();
+                if (adapter.getStatus() === "disabled") {
+                    await adapter.start();
+                }
+            },
+            disable: async () => {
+                await teardownWhatsAppAdapter();
+            },
+            requestQr: async () => {
+                if (!whatsappAdapter) {
+                    await whatsappControls_enable();
+                }
+                await whatsappAdapter.requestQR();
+            },
+            waitForQr: async (timeoutMs = 10_000) => {
+                if (!whatsappAdapter) {
+                    await whatsappControls_enable();
+                }
+                const snapshot = await whatsappAdapter.waitForQr(timeoutMs);
+                return whatsappQrResponseFromAdapter(whatsappAdapter, snapshot);
+            },
+            getQrResponse: () => whatsappQrResponseFromAdapter(whatsappAdapter),
+        },
+        messagingControls: {
+            telegram: buildTelegramControls(),
+            slack: buildSlackControls(),
+            discord: buildDiscordControls(),
+        },
+    });
+    // Local helper avoiding circular reference inside the object literal above.
+    async function whatsappControls_enable() {
+        const adapter = buildWhatsAppAdapter();
+        if (adapter.getStatus() === "disabled") {
+            await adapter.start();
+        }
+    }
+    // Mount /api/docs/* (DOCS_QA_DESIGN.md §10.4 + DOCS_QA_B7_DESIGN.md
+    // §S5–S6) after createApp so the indexer handle and the QA SSE
+    // adapter can be threaded in without extending ApiDependencies. The
+    // read endpoints don't need messaging/dispatcher deps; the QA
+    // POST/SSE pair leans on `docsQAAdapter` to register clients and
+    // enqueue docs_qa events.
+    app.route("/api", createDocsRoutes({
+        db,
+        ...(docsIndexer ? { indexer: docsIndexer } : {}),
+        docsQAAdapter,
+    }));
+    const server = serve({
+        fetch: app.fetch,
+        hostname: "127.0.0.1",
+        port: config.apiPort,
+    });
+    logger.info({ port: config.apiPort }, "API server listening");
+    void dispatcher.run(); // Start consuming dashboard events as soon as the API is live
+    // Notifications Center heartbeat (docs/design/20-notifications-center.md
+    // §"Daemon heartbeat"). MUST start immediately after the API server is
+    // listening — i.e. before any awaited startup work below (catchup,
+    // observers, etc.). `/api/health.lastTickAt` is exposed the moment the
+    // server accepts requests, so any window in which the heartbeat is
+    // constructed but not yet ticking shows the dashboard a stale timestamp
+    // and trips the client-side `system.daemon_frozen` alert (90s threshold).
+    // Startup catchup that runs a morning_routine inline can take several
+    // minutes, so this ordering is load-bearing, not cosmetic.
+    heartbeat.start();
+    // ── 12. Catchup (recover missed actions after restart) ──
+    // Register day boundary callback: summarize DM sessions at 4 AM before morning routine
+    scheduler.setDayBoundaryCallback(async () => {
+        await dispatcher.summarizeDmSessions();
+    });
+    // Register direct DM callback: sends scheduled messages without running an agent
+    scheduler.setSendDmCallback(async (message, platforms) => {
+        if (platforms && platforms.length > 0) {
+            const deliveries = [];
+            for (const platform of platforms) {
+                deliveries.push(await messageHub.sendToPlatform(platform, "user", message));
+            }
+            return deliveries;
+        }
+        return messageHub.sendToUser(message);
+    });
+    scheduler.setHourlyCheckCallback((source) => dispatcher.triggerHourlyCheck(source));
+    // B-004 Phase 2a — nightly context-index reconciler. The design doc
+    // (§4.1, §5.3) originally proposed an `agent_schedule` row with
+    // `task_type: "internal.reconcile_context_index"`, but the dispatcher's
+    // non-"dm" scheduled-task path runs a model-backed task flow. A direct
+    // scheduler-owned cron callback keeps all scheduled work visible in
+    // `AgentScheduler` — the intent of the design — without dispatching a
+    // backend for an internal daemon job.
+    scheduler.setContextIndexReconcilerCallback(() => contextIndexReconciler.requestReconcile("cron"));
+    // Reconciler writes go through the same prompt-cache invalidation path as
+    // API-origin context writes. Installing the sink here (post-dispatcher)
+    // means a reconcile during setup.initial does not destroy in-flight
+    // setup session state — see the matching `onPromptContextChanged`
+    // handler in the createApp dependencies above for the layered guards.
+    contextIndexReconcilerPromptSink = handlePromptContextChanged;
+    // Phase 4 auth probe — runs BEFORE the hourly check on each cron
+    // tick so auth health detection happens independently of the
+    // observation-threshold gate. checkAll() owns its own kill switch
+    // (authProbeDisabled), morning-routine skip, and in-flight dedupe.
+    scheduler.setAuthProbeCallback(() => authHealthMonitor.checkAll());
+    // Wire the autonomous-work gate: when rules/management.md is missing
+    // or a setup conversation is active, the scheduler pauses cron routines
+    // and ScheduleWatcher claims. This prevents any autonomous turn from
+    // racing with the dashboard setup flow and triggering the stale-session
+    // bug that killed setup mode mid-conversation.
+    scheduler.setAutonomousGate(() => dispatcher.isAutonomousAllowed());
+    const startupCatchup = await runCatchup(db, dispatcher, config);
+    // ── 13. Start all components ──
+    await messageHub.startAll();
+    scheduler.start();
+    customRoutineScheduler.start();
+    signalDetector.start();
+    const registeredPlatforms = messageHub.getPlatforms();
+    if (registeredPlatforms.length > 0 && !messageHub.getAdapter(config.primaryPlatform)) {
+        const fallbackPlatform = messageHub.getEffectiveFallbackPlatforms()[0]
+            ?? registeredPlatforms[0];
+        logger.error({
+            requestedPrimary: config.primaryPlatform,
+            fallbackPrimary: fallbackPlatform,
+        }, "Primary platform is not registered, falling back");
+        messageHub.setPrimaryPlatform(fallbackPlatform);
+        config.primaryPlatform = fallbackPlatform;
+    }
+    await observerManager.startAll();
+    // Start the integrations.md fs-watcher after the observer manager is up so
+    // a chokidar initialization error surfaces alongside the main observer
+    // lifecycle instead of during boot critical path.
+    try {
+        managementMdWatcher = startManagementMdWatcher(config.dataDir, db, {
+            workspaceDir: config.workspaceDir,
+            // SETUP-FLOW-REDESIGN-PLAN §6.2 — supply live external-vault state
+            // each reconcile so the Note Sources section tracks
+            // `PATCH /api/config` edits that don't touch integrations.md
+            // directly.
+            getNoteSources: () => ({
+                externalObsidianVaultPath: config.externalObsidianVaultPath,
+                externalObsidianWatch: config.externalObsidianWatch,
+            }),
+            sendNotification: async (params) => {
+                await notificationManager.send(params.message, {
+                    type: params.notificationType ?? "integration.variant_missing",
+                    source: "management-md-watcher",
+                    priority: EventPriority.NORMAL,
+                    timestamp: new Date(),
+                    data: {},
+                    correlationId: randomBytes(8).toString("hex"),
+                }, {
+                    priority: params.priority ?? "normal",
+                    destinationMode: "configured_only",
+                });
+            },
+        });
+    }
+    catch (err) {
+        logger.error({ err }, "integrations.md watcher failed to start");
+    }
+    // Start the rules/management.md fs-watcher alongside its integrations.md
+    // sibling so hand-edits to A-section bindings flow back into the DB. The
+    // watcher is a no-op when the post-setup branch above did not run
+    // (contextDir absent), since chokidar against a missing path is silent.
+    if (isSetupCompleted(db) && !readDegradedMode(db)) {
+        try {
+            managementRegistryWatcher = startManagementRegistryWatcher(getContextDir(config), db);
+        }
+        catch (err) {
+            logger.error({ err }, "rules/management.md watcher failed to start");
+        }
+    }
+    healthMonitor.start();
+    // heartbeat.start() ran earlier — see the comment near the API listen
+    // call. Keeping it there is required so the dashboard's frozen-alert
+    // does not fire during a long startup catchup.
+    // ── Management Mode health probe (plan §5.4) ──
+    // Poll every 30s. Probe is read-only (no mkdir) so a user deleting their
+    // vault directory flips us to degraded instead of silently re-creating.
+    // Timer runs in all modes so `vaultMode: plain ↔ obsidian` flips via
+    // PATCH /api/config are picked up without restart.
+    const vaultHealthTimer = setInterval(() => {
+        try {
+            const probe = runVaultHealthProbe(config, db);
+            if (probe.action === "entered") {
+                logger.warn({ reason: probe.reason }, "Vault health probe entered degraded mode");
+            }
+            else if (probe.action === "lifted") {
+                logger.info("Vault health probe lifted degraded mode");
+            }
+        }
+        catch (err) {
+            logger.error({ err }, "vault health probe failed");
+        }
+    }, 30_000);
+    vaultHealthTimer.unref();
+    // Management Mode Phase 2 — daily backup retention sweep. Runs once
+    // per day to remove completed `migration-backups/*` directories whose
+    // 7-day retention has expired. An initial tick fires shortly after
+    // startup so a daemon that runs for less than a full day still sweeps
+    // old backups left from a previous session.
+    const migrationBackupSweepInitial = setTimeout(() => {
+        try {
+            sweepExpiredMigrationBackups(db);
+        }
+        catch (err) {
+            logger.error({ err }, "Initial migration-backup sweep failed");
+        }
+    }, 60_000);
+    migrationBackupSweepInitial.unref();
+    const migrationBackupSweepTimer = setInterval(() => {
+        try {
+            sweepExpiredMigrationBackups(db);
+        }
+        catch (err) {
+            logger.error({ err }, "Daily migration-backup sweep failed");
+        }
+    }, 24 * 60 * 60 * 1000);
+    migrationBackupSweepTimer.unref();
+    startupComplete = true;
+    if (pendingGoogleServicesReady) {
+        pendingGoogleServicesReady = false;
+        handleGoogleServicesReady();
+    }
+    logger.info("All components started");
+    void runPostMessagingCatchup(dispatcher, startupCatchup).catch((err) => {
+        logger.error({ err }, "Post-messaging catchup failed");
+    });
+    // ── 15. Graceful shutdown ──
+    const shutdown = async (signal) => {
+        logger.info({ signal }, "Shutdown signal received");
+        dispatcher.stop(); // Signals dispatcher to exit run() loop
+        scheduler.stop();
+        customRoutineScheduler.stop();
+        healthMonitor.stop();
+        heartbeat.stop();
+        signalDetector.stop();
+        notificationManager.stop(); // Clear pending batch-flush timer
+        authRecovery.shutdown(); // Kill any active recovery subprocesses
+        clearInterval(vaultHealthTimer);
+        clearTimeout(migrationBackupSweepInitial);
+        clearInterval(migrationBackupSweepTimer);
+        if (managementMdWatcher) {
+            await managementMdWatcher.stop().catch((err) => {
+                logger.warn({ err }, "integrations.md watcher stop failed");
+            });
+        }
+        if (managementRegistryWatcher) {
+            await managementRegistryWatcher.stop().catch((err) => {
+                logger.warn({ err }, "rules/management.md watcher stop failed");
+            });
+        }
+        if (docsIndexer) {
+            await docsIndexer.stop().catch((err) => {
+                logger.warn({ err }, "docs indexer stop failed");
+            });
+        }
+        await observerManager.stopAll();
+        await messageHub.stopAll();
+        eventBus.close();
+        // Close HTTP server
+        if ("close" in server) {
+            server.close();
+        }
+        db.close();
+        logger.info("Daemon stopped");
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    if (process.platform === "win32") {
+        process.on("SIGBREAK", () => void shutdown("SIGBREAK"));
+    }
+    logger.info(`${APP_NAME} Daemon ready`);
+}
+async function runCatchup(db, dispatcher, config) {
+    // Setup gate — on first boot (before rules/management.md exists) we must
+    // NOT run the morning routine. Without user/profile.md / rules/management.md
+    // the generated today.md is meaningless AND it fires
+    // onPromptContextChanged → markActiveDmSessionsStale, which destroys the
+    // dashboard setup conversation on the user's next turn. Autonomous
+    // catchup will run on the first normal boot *after* setup completes.
+    const gateReason = dispatcher.isAutonomousAllowed();
+    if (gateReason !== null) {
+        logger.info({ reason: gateReason }, "Skipping startup catchup — autonomous work paused for setup");
+        return {
+            postMessagingRoadmapRefresh: false,
+            postMessagingRoutines: [],
+            postMessagingHourlyCheck: false,
+        };
+    }
+    const now = new Date();
+    const tz = config.timezone || undefined;
+    const contextDir = getContextDir(config);
+    const todayMdPath = join(contextDir, "today.md");
+    const { start: agentDayStartUtc, end: agentDayEndUtc } = getAgentDayBoundsUtc(tz, config.dayBoundaryHour, now);
+    const skippedPending = discardStalePendingSchedules(db, agentDayStartUtc);
+    if (skippedPending > 0) {
+        logger.warn({ count: skippedPending }, "Discarded stale pending schedules at startup");
+    }
+    const runningRecovery = recoverOrphanedRunningSchedules(db, agentDayStartUtc);
+    if (runningRecovery.skipped > 0 || runningRecovery.failed > 0) {
+        logger.warn(runningRecovery, "Recovered orphaned running schedules without replay");
+    }
+    // Check if morning routine is needed
+    let needsMorning = false;
+    if (existsSync(todayMdPath)) {
+        const firstLine = readFileSync(todayMdPath, "utf-8").split("\n")[0];
+        const today = getAgentDayDateStr(tz, config.dayBoundaryHour, now);
+        if (!firstLine.includes(today)) {
+            needsMorning = true;
+        }
+    }
+    else {
+        needsMorning = true;
+    }
+    const dueCatchupRoutines = getDueCatchupRoutines(db, config, agentDayStartUtc, agentDayEndUtc, now);
+    const needsHourlyCheckCatchup = shouldCatchUpHourlyCheck(db, config, now);
+    let ranMorningCatchup = false;
+    if (needsMorning) {
+        try {
+            await dispatcher.summarizeDmSessions();
+        }
+        catch (err) {
+            logger.error({ err }, "DM summarization catchup failed before morning routine");
+        }
+        logger.info("Stale today.md detected, running morning_routine catchup inline");
+        await dispatcher.processInline({
+            ...createEvent({
+                type: "routine.morning_routine",
+                source: "catchup",
+                priority: EventPriority.HIGH,
+                data: {
+                    postCatchupRoutines: dueCatchupRoutines,
+                    postCatchupHourlyCheck: needsHourlyCheckCatchup,
+                    deferPostMorningCatchupsUntilStartupReady: true,
+                },
+            }),
+            routine: "morning_routine",
+        });
+        ranMorningCatchup = true;
+        if (!hasFreshAgentDayTodayMd(todayMdPath, tz, config.dayBoundaryHour)) {
+            logger.warn("Startup morning catchup did not produce a fresh today.md — deferring remaining catchup work");
+            return {
+                postMessagingRoadmapRefresh: false,
+                postMessagingRoutines: [],
+                postMessagingHourlyCheck: false,
+            };
+        }
+        return {
+            postMessagingRoadmapRefresh: isRoadmapStale(contextDir),
+            postMessagingRoutines: dueCatchupRoutines,
+            postMessagingHourlyCheck: needsHourlyCheckCatchup,
+        };
+    }
+    if (!ranMorningCatchup && isRoadmapStale(contextDir)) {
+        logger.info("Roadmap stale at startup, running roadmap_refresh catchup inline");
+        await processRoutineCatchup(dispatcher, "roadmap_refresh");
+    }
+    return {
+        postMessagingRoadmapRefresh: false,
+        postMessagingRoutines: dueCatchupRoutines,
+        postMessagingHourlyCheck: needsHourlyCheckCatchup,
+    };
+}
+async function runPostMessagingCatchup(dispatcher, catchup) {
+    if (catchup.postMessagingRoadmapRefresh) {
+        logger.info("Running roadmap_refresh catchup after messaging startup");
+        await processRoutineCatchup(dispatcher, "roadmap_refresh");
+    }
+    for (const routine of catchup.postMessagingRoutines) {
+        logger.info({ routine }, "Running same-day routine catchup after messaging startup");
+        await processRoutineCatchup(dispatcher, routine);
+    }
+    if (catchup.postMessagingHourlyCheck) {
+        logger.info("Triggering hourly_check catchup after messaging startup");
+        await dispatcher.triggerHourlyCheck("catchup_startup", { force: false });
+    }
+}
+async function processRoutineCatchup(dispatcher, routine) {
+    await dispatcher.processInline({
+        ...createEvent({
+            type: `routine.${routine}`,
+            source: "catchup",
+            priority: routine === "hourly_check" ? EventPriority.NORMAL : EventPriority.HIGH,
+        }),
+        routine,
+    });
+}
+function getDueCatchupRoutines(db, config, agentDayStartUtc, agentDayEndUtc, now) {
+    const tz = config.timezone || undefined;
+    const progressMinutes = getAgentDayProgressMinutes(tz, config.dayBoundaryHour, now);
+    const dueAt18 = getProgressMinutesForHour(18, config.dayBoundaryHour);
+    if (progressMinutes < dueAt18) {
+        return [];
+    }
+    const routines = [];
+    const agentDayStartMs = parseSqliteUtcMs(agentDayStartUtc);
+    const agentDayLocal = nowInTimezone(tz, new Date(agentDayStartMs));
+    const tomorrowLocal = nowInTimezone(tz, new Date(agentDayStartMs + 24 * 60 * 60 * 1000));
+    if (!hasActionInWindow(db, "routine.evening_review", agentDayStartUtc, agentDayEndUtc)) {
+        routines.push("evening_review");
+    }
+    if (agentDayLocal.dayOfWeek === 5 &&
+        !hasActionInWindow(db, "routine.weekly_review", agentDayStartUtc, agentDayEndUtc)) {
+        routines.push("weekly_review");
+    }
+    if (tomorrowLocal.day === 1 &&
+        !hasActionInWindow(db, "routine.monthly_review", agentDayStartUtc, agentDayEndUtc)) {
+        routines.push("monthly_review");
+    }
+    return routines;
+}
+function shouldCatchUpHourlyCheck(db, config, now) {
+    if (!config.hourlyCheckEnabled) {
+        return false;
+    }
+    const tz = config.timezone || undefined;
+    const local = nowInTimezone(tz, now);
+    if (local.hours < config.hourlyCheckActiveStartHour ||
+        local.hours >= config.hourlyCheckActiveEndHour ||
+        local.hours === config.dayBoundaryHour) {
+        return false;
+    }
+    // Slot anchors to `activeStartHour`, mirroring shouldFireHourlyTickAt
+    // in scheduler.ts so the catch-up function picks the same slot the
+    // cron callback would have fired at. The earlier branch already
+    // returned false when local.hours < activeStartHour, so the offset is
+    // always non-negative here.
+    const anchorMinutes = config.hourlyCheckActiveStartHour * 60;
+    const offsetFromAnchor = local.hours * 60 + local.minutes - anchorMinutes;
+    const slotOffsetFromAnchor = Math.floor(offsetFromAnchor / config.hourlyCheckIntervalMinutes) *
+        config.hourlyCheckIntervalMinutes;
+    const slotMinutesSinceMidnight = anchorMinutes + slotOffsetFromAnchor;
+    const dayStartUtc = getAgentDayBoundsUtc(tz, 0, now).start;
+    const slotStartMs = parseSqliteUtcMs(dayStartUtc) + slotMinutesSinceMidnight * 60 * 1000;
+    const slotStartUtc = formatSqliteDatetime(new Date(slotStartMs));
+    return !hasActionInWindow(db, "routine.hourly_check", slotStartUtc, formatSqliteDatetime(now));
+}
+function getProgressMinutesForHour(hour, dayBoundaryHour) {
+    const scheduledMinutes = hour * 60;
+    const boundaryMinutes = dayBoundaryHour * 60;
+    return scheduledMinutes >= boundaryMinutes
+        ? scheduledMinutes - boundaryMinutes
+        : 24 * 60 - boundaryMinutes + scheduledMinutes;
+}
+function hasFreshAgentDayTodayMd(todayMdPath, timezone, dayBoundaryHour) {
+    if (!existsSync(todayMdPath)) {
+        return false;
+    }
+    const firstLine = readFileSync(todayMdPath, "utf-8").split("\n")[0] ?? "";
+    const today = getAgentDayDateStr(timezone, dayBoundaryHour);
+    return firstLine.includes(today);
+}
+// P22 — read the operator's chosen cadence for skill curation runs.
+// Mirrors the helper in `core/scheduler.ts` so the dispatcher hook here can
+// resolve cadence at runtime without crossing module boundaries.
+function readSkillCurationCadence(db) {
+    const row = db
+        .prepare(`SELECT value_json FROM runtime_state WHERE key = 'skill_curation.config'`)
+        .get();
+    if (!row)
+        return "weekly";
+    try {
+        const v = JSON.parse(row.value_json);
+        return v.cadence ?? "weekly";
+    }
+    catch {
+        return "weekly";
+    }
+}
+// ── Global safety net ──
+// Catch unhandled rejections from fire-and-forget patterns (void async calls)
+// so they are logged before Node.js 22+ terminates the process.
+process.on("unhandledRejection", (reason) => {
+    const err = reason instanceof Error ? reason : new Error(String(reason));
+    logger.fatal({ error: err.message, stack: err.stack }, "Unhandled promise rejection — this is a bug");
+});
+process.on("uncaughtException", (err) => {
+    logger.fatal({ error: err.message, stack: err.stack }, "Uncaught exception — process will exit");
+    process.exit(1);
+});
+// ── Entry point ──
+startup().catch((err) => {
+    const e = err;
+    logger.fatal({ error: e?.message, code: e?.code, stack: e?.stack }, "Daemon startup failed");
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map