@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/dispatcher.js

@@ -1,4 +1,4 @@
-import { EventPriority, createEvent, getAgentDayBoundsUtc, isMessageEvent, isRoutineEvent, isAgentTaskEvent, isScheduledDmEvent, isKnowledgeImportEvent, parseSqliteUtcMs, } from "@aitne/shared";
+import { EventPriority, createEvent, getAgentDayBoundsUtc, isMessageEvent, isRoutineEvent, isAgentTaskEvent, isScheduledEvent, isScheduledBrowserTaskEvent, isScheduledDmEvent, isKnowledgeImportEvent, parseSqliteUtcMs, } from "@aitne/shared";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { CONTEXT_RELATIVE_PATHS } from "./context-paths.js";
@@ -24,7 +24,24 @@ import { PromptAssembler } from "./dispatcher-prompt.js";
 import { DispatcherErrorRouter } from "./dispatcher-error-handling.js";
 import { ResultProcessor } from "./dispatcher-result-processor.js";
 import { HourlyCheckCoordinator } from "./dispatcher-hourly-check.js";
+import { morningRoutineRanToday } from "../bootstrap/schedule-helpers.js";
+/**
+ * Routine names that depend on `routine.morning_routine` having completed
+ * successfully for the current agent-day. The pre-routine gate in
+ * `dispatch()` enqueues a morning_routine wake and skips the dependent
+ * routine when the predicate trips — hourly_check is gated separately
+ * inside `HourlyCheckCoordinator.trigger` because it has its own entry
+ * point (`triggerHourlyCheck`) before any event hits the bus.
+ */
+const REVIEW_ROUTINES_REQUIRING_MORNING = new Set([
+    "evening_review",
+    "weekly_review",
+    "monthly_review",
+]);
 import { MorningRoutineRunner } from "./dispatcher-morning-routine.js";
+import { MorningRoutinePipelineOrchestrator } from "./morning/orchestrator.js";
+import { DailyJournalComposer } from "./morning/daily-journal-composer.js";
+import { randomUUID } from "node:crypto";
 import { RoutineFetchWindowRunner } from "./routine-fetch-window-runner.js";
 import { ScheduledTaskRunner, SKILL_CURATION_OPTIMIZER_ALLOWED_TOOLS, } from "./dispatcher-scheduled-tasks.js";
 import { MessageHandler } from "./dispatcher-message-handler.js";
@@ -72,6 +89,45 @@ export class EventDispatcher {
      * Spec: docs/design/backlog/messaging-bang-commands.md
      */
     bangCommandRegistry = null;
+    /**
+     * Phase B-4 — DM-issued purchase confirmation handler. Wired at
+     * daemon startup from `index.ts` via `setPurchaseHandler`. Null
+     * when B-4 is not enabled at startup; the dispatcher's inbound
+     * classifier no-ops in that case and the workflow runner refuses
+     * `variant: "purchase"` calls with `purchase_b4_disabled`.
+     *
+     * Spec: MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17 / §13 step 50.
+     */
+    purchaseHandler = null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5 / §14.11 — lite-final-confirm
+     * handler. Wired at daemon startup from `bootstrap/event-pipeline.ts`
+     * via `setFinalConfirmHandler`. The inbound classifier (§14.11 Q#6)
+     * routes `!~xxxxxxxx` replies between this handler and
+     * `purchaseHandler` by querying both stores via `lookupByRaw` and
+     * dispatching to whichever returned a row.
+     */
+    finalConfirmHandler = null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — Phase 3 wiring. The
+     * dispatcher routes `scheduled.browser_task` events to the runner.
+     * Wired at daemon startup from `bootstrap/event-pipeline.ts` via
+     * `setBrowserTaskRunner`. Null when the runner factory has not yet
+     * landed (test harness or stripped-down boot path) — the dispatch
+     * branch flips the `agent_schedule` row to `failed
+     * (runner_unavailable)` in that case so the row doesn't park.
+     */
+    browserTaskRunner = null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §7 — "the user is DMed" on fire-time
+     * dispatch failure (`site_unregistered`, `allowlist_rejected`,
+     * `runner_unavailable`). The runner's own `notifier.notifyTerminal`
+     * only fires when the runner is reached, which is exactly NOT the
+     * case for these pre-runner failure paths. Wired from `event-pipeline.ts`
+     * alongside the runner factory so a fire-time failure DMs the owner
+     * instead of leaving the row silently flipped to `failed` in the DB.
+     */
+    browserTaskTerminalNotifier = null;
     /**
      * Current setup mode — scope-agnostic flag that survives internal
      * direct-message session refresh (day boundary, stale flag, etc). Previously this
@@ -102,6 +158,37 @@ export class EventDispatcher {
     lastRoadmapRefreshEmitMs = 0;
     morningRoutineInProgress = false;
     hourlyCheckInProgress = false;
+    /**
+     * Wall-clock timestamp (ms since epoch) of the most recent flip of
+     * `hourlyCheckInProgress` to `true`, or `null` when the flag is false.
+     *
+     * Paired with `HOURLY_CHECK_FLAG_MAX_AGE_MS` to break the silent-stall
+     * pattern where the flag is set true at enqueue time but the matching
+     * `dispatchSafe` finally never runs — currently possible when the
+     * EventBus evicts/drops the queued routine event under `put()` pressure
+     * (heap-js drops the lowest-priority entry silently when `heap.size() >=
+     * maxSize=1000`). Without the timestamp the flag stays `true` until
+     * process restart and every subsequent hourly tick short-circuits with
+     * `hourly_check_in_progress`.
+     *
+     * Read side (`isHourlyCheckInProgress` callback below) checks the age
+     * and auto-clears when it exceeds the bound, surfacing the recovery via
+     * a warn log so the operator sees the EventBus pressure event.
+     */
+    hourlyCheckInProgressAt = null;
+    /**
+     * Upper bound for how long `hourlyCheckInProgress=true` can plausibly
+     * be valid before we treat it as stuck and force-clear.
+     *
+     * Sized generously above the realistic Stage-3 hourly_check ceiling
+     * (fetch_window pre-pass ~30–60 s + Sonnet hourly_check session
+     * ~1–3 min) so a slow but normal run is never falsely cleared. Sized
+     * well below an entire agent-day so a stuck flag recovers within a
+     * single hourly cron cycle's worst case (default cadence 60 min).
+     * The 30-minute window is comfortably outside any plausible "still
+     * running" interpretation and inside one full hourly slot.
+     */
+    static HOURLY_CHECK_FLAG_MAX_AGE_MS = 30 * 60 * 1000;
     /**
      * P22 §3.4 — wired by `index.ts` after the daemon's data dir + skills root
      * are known. Returns a `{runId, runToken, workdirPath, targetSkills}` tuple
@@ -136,6 +223,14 @@ export class EventDispatcher {
      *  `docs/design/appendices/delegated-sync-opt-in.md` and the worker's
      *  `runDisabledCadencesForHourlyCheck` method. */
     delegatedSyncRefresh = null;
+    /**
+     * Injected lazily via `setQueueMorningRoutineWake` (wired in `index.ts`
+     * after `AgentScheduler` is constructed). The pre-routine morning_routine
+     * gate uses this to enqueue a recovery wake when the current agent-day's
+     * morning_routine has not run yet — typical cause: macOS App Nap / sleep
+     * suspended node-cron through the 04:00 tick. See `morningRoutineRanToday`
+     * in `bootstrap/schedule-helpers.ts` for the authoritative predicate. */
+    queueMorningRoutineWake = null;
     /** Injected lazily via `setVoiceTranscriber` — optional. When null,
      *  inbound audio attachments fall back to the path-only prompt block
      *  exactly as they did before the local-Whisper layer landed. See
@@ -156,6 +251,16 @@ export class EventDispatcher {
      * carried on the default `event` SSE channel.
      */
     eventBroadcaster = null;
+    /**
+     * AGENT_DEFINITIONS_DESIGN.md §8 — per-firing execution recorder. Wired
+     * post-construction via {@link setAgentExecutionTracker} (the recorder +
+     * contextDir + SSE deps only exist after the event-pipeline factory runs).
+     * `null` in tests / pre-wire → no execution rows are written, preserving the
+     * legacy dispatch shape. The ResultProcessor reaches it through a call-time
+     * closure (see the constructor's `recordExecutionOutcome` dep) so it stays
+     * live even though the tracker is set after the processor is built.
+     */
+    agentExecutionTracker = null;
     /**
      * Notify-dedup tracking — set of correlationIds for in-flight events
      * that have already invoked `POST /api/notify` from inside the agent
@@ -218,7 +323,7 @@ export class EventDispatcher {
      * pre-existing C1 atomic check-and-set semantics survive the split.
      */
     /**
-     * ROUTINE_DATA_ACQUISITION_DESIGN.md Phase 4 / D1 — shared pre-pass
+     * docs/design/appendices/routine-data-acquisition.md Phase 4 / D1 — shared pre-pass
      * runner for `routine.fetch_window`. Injected into HourlyCheckCoordinator
      * (D3), MorningRoutineRunner (D2), and ScheduledTaskRunner (D4) so
      * every routine that has rows in `ROUTINE_WINDOWS` gets the same
@@ -295,8 +400,13 @@ export class EventDispatcher {
             notifiedEvents: this.notifiedEvents,
             isReactive: (event) => this.isReactive(event),
             hasMessageBackendMetadataColumns: this.hasMessageBackendMetadataColumns,
+            // AGENT_DEFINITIONS_DESIGN.md §8.2 — feed the terminal LLM-level outcome
+            // (cost / soft-error) to the execution tracker so the dispatch boundary
+            // settles the row with the accurate result. Call-time closure → live even
+            // though the tracker is wired after this processor is constructed.
+            recordExecutionOutcome: (event, outcome) => this.agentExecutionTracker?.recordOutcome(event.correlationId, outcome),
         });
-        // ROUTINE_DATA_ACQUISITION_DESIGN.md Phase 4 / D1 — shared pre-pass
+        // docs/design/appendices/routine-data-acquisition.md Phase 4 / D1 — shared pre-pass
         // runner consumed by HourlyCheckCoordinator (D3), MorningRoutineRunner
         // (D2), and ScheduledTaskRunner.executeDefault (D4). Constructed
         // before all three so it can be injected as a dep rather than
@@ -330,10 +440,33 @@ export class EventDispatcher {
             getDelegatedSyncRefresh: () => this.delegatedSyncRefresh,
             setHourlyCheckInProgress: (value) => {
                 this.hourlyCheckInProgress = value;
+                this.hourlyCheckInProgressAt = value ? Date.now() : null;
+            },
+            isHourlyCheckInProgress: () => {
+                if (!this.hourlyCheckInProgress)
+                    return false;
+                // Stale-flag recovery — see `hourlyCheckInProgressAt` doc-comment.
+                // The branch fires only when an enqueued event never reached
+                // `dispatchSafe`'s finally (EventBus eviction is the realistic
+                // cause; a future code path that forgets to reset the flag would
+                // also self-heal here within one cron cycle).
+                if (this.hourlyCheckInProgressAt !== null) {
+                    const ageMs = Date.now() - this.hourlyCheckInProgressAt;
+                    if (ageMs > EventDispatcher.HOURLY_CHECK_FLAG_MAX_AGE_MS) {
+                        logger.warn({
+                            ageMs,
+                            maxAgeMs: EventDispatcher.HOURLY_CHECK_FLAG_MAX_AGE_MS,
+                        }, "hourlyCheckInProgress flag exceeded max age — auto-clearing (likely EventBus drop or missed dispatchSafe finally)");
+                        this.hourlyCheckInProgress = false;
+                        this.hourlyCheckInProgressAt = null;
+                        return false;
+                    }
+                }
+                return true;
             },
-            isHourlyCheckInProgress: () => this.hourlyCheckInProgress,
             isMorningRoutineActive: () => this.isMorningRoutineActive(),
             isAutonomousAllowed: () => this.isAutonomousAllowed(),
+            getQueueMorningRoutineWake: () => this.queueMorningRoutineWake,
         });
         this.errorRouter = new DispatcherErrorRouter({
             db: this.db,
@@ -347,17 +480,87 @@ export class EventDispatcher {
             onRetemplateFinalize: (event, opts) => this.resultProcessor.finalizeRetemplateRunIfApplicable(event, opts),
             onManagementScanFinalize: (event, opts) => this.resultProcessor.finalizeManagementScanIfApplicable(event, opts),
         });
-        this.morningRoutine = new MorningRoutineRunner({
+        // morning-routine-optimization.md Phase 5/6/7 — pipeline orchestrator
+        // owns Stage A (today.md) + Stage B (daily journal). It is the only
+        // dispatch path for `routine.morning_routine`; the legacy monolithic
+        // executor was retired once the orchestrator stabilised.
+        // daily-journal-daemon-write.md §4.11 — wired daily-journal
+        // composer fed into the orchestrator. The composer shares its
+        // snapshot insert with the agent-journal-appender pattern: direct
+        // INSERT into `md_file_snapshots` (no debounce, no session id —
+        // morning-routine daemon-mediated writes aren't user-initiated so
+        // the per-request bookkeeping the HTTP route does is N/A).
+        const dailyJournalComposer = new DailyJournalComposer({
+            db: this.db,
+            contextDir: getContextDir(this.config, this.db),
+            saveSnapshot: (filePath, content, trigger) => {
+                try {
+                    const result = this.db
+                        .prepare("INSERT INTO md_file_snapshots (file_path, content, trigger, session_id) VALUES (?, ?, ?, ?)")
+                        .run(filePath, content, trigger, null);
+                    return Number(result.lastInsertRowid);
+                }
+                catch (err) {
+                    logger.warn({ err, filePath, trigger }, "DailyJournalComposer: failed to save md_file_snapshots row");
+                    return null;
+                }
+            },
+            ...(this.writeTracker ? { writeTracker: this.writeTracker } : {}),
+            // No `onIndexableContextChange` — Dispatcher doesn't carry the
+            // context-index reconciler hook today. Chokidar's fallback fs
+            // watch will detect the daemon-mediated PUT on its own. If we
+            // ever wire the reconciler through Dispatcher, daily/*.md is in
+            // the indexable set and should get the hint.
+        });
+        // daily-journal-daemon-write.md §4.7b — operator DM for the
+        // partial-extract streak. Synthesises a `routine.morning_routine_journal`
+        // event so it routes through `notificationMgr.send`'s existing
+        // proactive path (quiet hours, configured destinations, etc.).
+        const partialExtractStreakNotifier = {
+            notify: async (args) => {
+                const event = {
+                    type: "routine.morning_routine_journal",
+                    source: "daemon",
+                    priority: 1,
+                    timestamp: new Date(),
+                    correlationId: randomUUID(),
+                    data: {},
+                };
+                await this.notificationMgr.send(args.message, event, {
+                    priority: "normal",
+                    category: "agent",
+                });
+            },
+        };
+        // morning-routine-optimization.md Phase 5/6/7 — pipeline orchestrator
+        // owns Stage A (today.md) + Stage B (daily journal). It is the only
+        // dispatch path for `routine.morning_routine`; the legacy monolithic
+        // executor was retired once the orchestrator stabilised.
+        const pipelineOrchestrator = new MorningRoutinePipelineOrchestrator({
             db: this.db,
             config: this.config,
-            eventBus: this.eventBus,
             contextBuilder: this.contextBuilder,
             agentRouter: this.agentRouter,
-            notificationMgr: this.notificationMgr,
-            todayWriteLock: this.todayWriteLock,
             prompt: this.prompt,
             errorRouter: this.errorRouter,
             resultProcessor: this.resultProcessor,
+            // morning-routine-optimization.md Phase 6 — pre-insert the
+            // in_progress agent_actions row for Stage A so the agent's
+            // `PATCH /api/agent-actions/self` can resolve mid-run, and feed
+            // the write-tracker into ⑥ AgentJournalAppender so its atomic
+            // write to `journal/agent.md` does not get re-classified as a
+            // user-actor change by the obsidian / git observers.
+            audit: this.audit,
+            ...(this.writeTracker ? { writeTracker: this.writeTracker } : {}),
+            dailyJournalComposer,
+            partialExtractStreakNotifier,
+        });
+        this.morningRoutine = new MorningRoutineRunner({
+            db: this.db,
+            config: this.config,
+            eventBus: this.eventBus,
+            notificationMgr: this.notificationMgr,
+            todayWriteLock: this.todayWriteLock,
             fetchWindowRunner: this.fetchWindowRunner,
             setMorningRoutineInProgress: (value) => {
                 this.morningRoutineInProgress = value;
@@ -371,6 +574,7 @@ export class EventDispatcher {
             isRoadmapStale: () => this.isRoadmapStale(),
             emitRoadmapRefresh: (source) => this.emitRoadmapRefresh(source),
             triggerHourlyCheck: (source) => this.triggerHourlyCheck(source),
+            pipelineOrchestrator,
         });
         this.scheduledTasks = new ScheduledTaskRunner({
             db: this.db,
@@ -402,6 +606,7 @@ export class EventDispatcher {
             prompt: this.prompt,
             errorRouter: this.errorRouter,
             resultProcessor: this.resultProcessor,
+            writeTracker: this.writeTracker,
             getSignalDetector: () => this.signalDetector,
             getDashboardStream: () => this.dashboardStream,
             getAttachmentStore: () => this.attachmentStore,
@@ -409,6 +614,8 @@ export class EventDispatcher {
             getAuthRecovery: () => this.authRecovery,
             getAuthHealthMonitor: () => this.authHealthMonitor,
             getBangCommandRegistry: () => this.bangCommandRegistry,
+            getPurchaseHandler: () => this.purchaseHandler,
+            getFinalConfirmHandler: () => this.finalConfirmHandler,
             getCurrentSetupMode: () => this.currentSetupMode,
             beginSetupMode: (mode) => this.beginSetupMode(mode),
             lookupCustomBangCommandForEvent: (event) => this.lookupCustomBangCommandForEvent(event),
@@ -436,6 +643,57 @@ export class EventDispatcher {
     setSignalDetector(detector) {
         this.signalDetector = detector;
     }
+    /**
+     * Wire the B-4 purchase-confirmation handler. Called once at startup
+     * from `index.ts` after the messaging hub is up — the handler's
+     * `sender` dependency requires a live MessageHub for outbound DMs.
+     * Calling more than once replaces the prior reference (used by the
+     * dashboard's "Disable B-4" flow which can later re-enable).
+     */
+    setPurchaseHandler(handler) {
+        this.purchaseHandler = handler;
+    }
+    /** Read accessor — used by the route layer's wiring to thread the
+     *  same instance into `ApiDependencies.purchaseHandler` without a
+     *  parallel construction path. */
+    getPurchaseHandler() {
+        return this.purchaseHandler;
+    }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5 / §14.11 — wire the lite-final-
+     * confirm handler. Mirrors `setPurchaseHandler` so the inbound `!~`
+     * classifier and the route layer share one instance via the
+     * dispatcher.
+     */
+    setFinalConfirmHandler(handler) {
+        this.finalConfirmHandler = handler;
+    }
+    getFinalConfirmHandler() {
+        return this.finalConfirmHandler;
+    }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — wire the browser-task
+     * runner so the `scheduled.browser_task` dispatch branch can hand
+     * fire-time events to it. Pairs with the `event-pipeline.ts`
+     * `createBrowserTaskRunner` factory call (Phase 3).
+     */
+    setBrowserTaskRunner(runner) {
+        this.browserTaskRunner = runner;
+    }
+    getBrowserTaskRunner() {
+        return this.browserTaskRunner;
+    }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §7 — wire the terminal-state DM
+     * emitter used by the `scheduled.browser_task` failure paths (see
+     * `browserTaskTerminalNotifier` field doc). `event-pipeline.ts` passes
+     * the same `BrowserTaskNotifier` instance that's threaded into the
+     * runner so a single DM-emission contract covers both pre-runner
+     * fire-time failures and the runner's own non-completed terminals.
+     */
+    setBrowserTaskTerminalNotifier(notifier) {
+        this.browserTaskTerminalNotifier = notifier;
+    }
     /** Set the dashboard stream adapter for real-time response streaming. */
     setDashboardStream(adapter) {
         this.dashboardStream = adapter;
@@ -478,6 +736,17 @@ export class EventDispatcher {
     setDelegatedSyncRefresh(fn) {
         this.delegatedSyncRefresh = fn;
     }
+    /**
+     * Wire the scheduler's `queueMorningRoutineWake` so the pre-routine
+     * gate (hourly_check + evening/weekly/monthly review) can self-recover
+     * after a missed 04:00 cron fire. Wired once in `index.ts` after both
+     * the dispatcher and scheduler are constructed; passing `null` detaches.
+     * When unset, the gate logs a warning and still skips the dependent
+     * routine — the daemon does not "silently" run a stale review.
+     */
+    setQueueMorningRoutineWake(fn) {
+        this.queueMorningRoutineWake = fn;
+    }
     /**
      * Wire the dashboard SSE broadcaster so routine-start / routine-complete
      * progress events flow to subscribed clients. Optional — when unset,
@@ -488,6 +757,71 @@ export class EventDispatcher {
     setEventBroadcaster(broadcaster) {
         this.eventBroadcaster = broadcaster;
     }
+    /**
+     * Wire the per-firing execution tracker (AGENT_DEFINITIONS_DESIGN.md §8).
+     * Optional — when unset, no `agent_executions` rows are written and dispatch
+     * behaves exactly as before. Set once at boot from the event-pipeline factory.
+     */
+    setAgentExecutionTracker(tracker) {
+        this.agentExecutionTracker = tracker;
+    }
+    /**
+     * Open an execution row for an agent-resolvable firing (§8.1), called from
+     * `dispatchSafe` after the setup / cost gates pass so a skipped firing never
+     * records an execution. Reactive DMs resolve to no Agent (no routine / no
+     * schedule row / no `task_context.agent_id`) and are a near-free no-op.
+     */
+    beginAgentExecution(event) {
+        if (this.agentExecutionTracker === null)
+            return;
+        const taskContext = isScheduledEvent(event)
+            ? event.taskContext
+            : undefined;
+        const routineEvent = isRoutineEvent(event) ? event : null;
+        const phase = routineEvent
+            ? routineEvent.data?.phase
+            : undefined;
+        // §8.1 step 3: `task_context.routine` → built-in registry slug. A
+        // `RoutineEvent` carries the routine on the event; a built-in fired via
+        // `queue_wake` (only `morning-routine`) arrives as a `scheduled.task`
+        // whose routine lives in `task_context` — without this fallback that
+        // flagship daily firing would resolve to no Agent and record no rollup.
+        const taskContextRoutine = typeof taskContext?.routine === "string" ? taskContext.routine : null;
+        const taskContextPhase = typeof taskContext?.phase === "string" ? taskContext.phase : null;
+        const resolution = {
+            taskContextAgentId: typeof taskContext?.agent_id === "string" ? taskContext.agent_id : null,
+            recurringScheduleId: typeof taskContext?.recurringScheduleId === "number"
+                ? taskContext.recurringScheduleId
+                : null,
+            routine: routineEvent ? routineEvent.routine : taskContextRoutine,
+            routinePhase: routineEvent
+                ? typeof phase === "string"
+                    ? phase
+                    : null
+                : taskContextPhase,
+        };
+        const scheduleRowId = isScheduledEvent(event) && event.scheduleId !== undefined
+            ? event.scheduleId
+            : null;
+        this.agentExecutionTracker.begin(event.correlationId, resolution, {
+            scheduleRowId,
+            trigger: this.resolveExecutionTrigger(event, taskContext),
+        });
+    }
+    /** Classify an execution's trigger for the rollup row (§5.2). */
+    resolveExecutionTrigger(event, taskContext) {
+        // run-now (§9.4) stamps `task_context.trigger='manual'` — honour it so the
+        // rollup records `manual`, not the `cron` the isScheduledEvent fallback
+        // would assign (the queued row IS a scheduled event). `triggeredBy` is a
+        // legacy alias kept for any dashboard-initiated flow that sets it.
+        if (taskContext?.trigger === "manual" || taskContext?.triggeredBy === "dashboard")
+            return "manual";
+        if (taskContext?.trigger === "self")
+            return "self";
+        if (isRoutineEvent(event) || isScheduledEvent(event))
+            return "cron";
+        return "event";
+    }
     /**
      * Internal helper: broadcast `routine_started` or `routine_completed` for
      * the given routine event. Centralised so the JSON shape and failure
@@ -712,7 +1046,7 @@ export class EventDispatcher {
      * scheduled wake tasks, startup catchup, calendar-poller reactive events).
      *
      * Two layers:
-     *  - **Cold gate**: `rules/management.md` must exist. Before initial setup
+     *  - **Cold gate**: `policies/management.md` must exist. Before initial setup
      *    there is no policy document, no user/profile.md, no today.md — running
      *    routines would produce garbage AND, crucially, any loud prompt-context
      *    write from such a routine can trigger
@@ -888,12 +1222,35 @@ export class EventDispatcher {
        LIMIT 1`).get();
         return !!row;
     }
+    /**
+     * Release a claimed `agent_schedule` row back to `pending` when an
+     * autonomous scheduled event is short-circuited before its dispatch
+     * branch can run (setup gate or autonomous cost cap). The ScheduleWatcher
+     * claims the row as `running` and hands the event to the EventBus before
+     * these gates are evaluated, so a silent skip would otherwise leave the
+     * row stuck in `running` forever — blocking both boot recovery (there is
+     * none for stuck `running` schedule rows) and the recurring
+     * `NOT EXISTS(status IN pending/running)` reconcile guard. Reverting to
+     * `pending` (rather than `failed`/`skipped`) is correct because the skip
+     * is transient: once the cost-cap window rolls over or setup completes,
+     * the next ScheduleWatcher tick should re-evaluate and fire the row. This
+     * matches the quiet-hours deferral precedent in the scheduler. The
+     * `WHERE ... status = 'running'` clause keeps it idempotent — a no-op for
+     * non-scheduled events or already-terminal rows.
+     */
+    releaseClaimedSchedule(event) {
+        if (isScheduledEvent(event) && event.scheduleId) {
+            this.db
+                .prepare("UPDATE agent_schedule SET status = 'pending' WHERE id = ? AND status = 'running'")
+                .run(event.scheduleId);
+        }
+    }
     async dispatchSafe(event) {
         const trigger = this.isReactive(event) ? "reactive" : "autonomous";
         const startMs = Date.now();
         logger.info({ eventType: event.type, source: event.source, trigger }, "Event processing started");
         // SSE-progress hook (file-relative to A2): announce routine start so the
-        // dashboard can render "今日の状況を生成中…" before the first turn
+        // dashboard can render "Generating today's status…" before the first turn
         // executes. Fires AFTER the setup-gate / cost-cap short-circuits below
         // would have skipped — so a skipped routine never emits a phantom
         // `routine_started` without a matching `routine_completed`. Routine
@@ -918,6 +1275,7 @@ export class EventDispatcher {
             if (!this.isReactive(event)) {
                 const setupBlock = this.isAutonomousAllowed();
                 if (setupBlock !== null) {
+                    this.releaseClaimedSchedule(event);
                     this.audit.logSkip(event, setupBlock, trigger);
                     logger.info({ eventType: event.type, source: event.source, reason: setupBlock }, "Event skipped — autonomous work paused for setup");
                     return;
@@ -927,16 +1285,24 @@ export class EventDispatcher {
                 // Reactive sessions always pass. Degradation priority: hourly_check is
                 // skipped first, morning_routine last.
                 if (this.shouldSkipForCostCap(event)) {
+                    this.releaseClaimedSchedule(event);
                     this.audit.logSkip(event, "autonomous_cost_cap_exceeded", trigger);
                     logger.info({ eventType: event.type, source: event.source }, "Event skipped — autonomous daily cost cap exceeded");
                     return;
                 }
             }
+            // AGENT_DEFINITIONS_DESIGN.md §8.1 — open the execution row after the
+            // setup / cost gates pass (a gated firing records no execution) and
+            // before dispatch runs. Resolves to no Agent (→ no-op) for reactive DMs.
+            this.beginAgentExecution(event);
             if (broadcastRoutine) {
                 this.broadcastRoutineProgress("routine_started", broadcastRoutine);
                 routineStartBroadcast = true;
             }
             await this.dispatch(event);
+            // Settle the execution on the success side (the ResultProcessor has
+            // already fed the terminal cost / isError via `recordOutcome`). Idempotent.
+            this.agentExecutionTracker?.completeFromDispatch(event.correlationId);
             const durationMs = Date.now() - startMs;
             logger.info({ eventType: event.type, source: event.source, durationMs }, "Event processing completed");
             if (broadcastRoutine) {
@@ -949,7 +1315,16 @@ export class EventDispatcher {
         catch (err) {
             const durationMs = Date.now() - startMs;
             logger.error({ err, eventType: event.type, source: event.source, durationMs }, "Event processing failed");
+            // Log the error row BEFORE settling the execution: the `agent_id`
+            // resolver reads the tracker's active-execution map, which
+            // `completeFromDispatch` consumes — so logError must run first to stamp
+            // this row with the owning Agent (AGENT_DEFINITIONS_DESIGN.md §8.1).
             this.audit.logError(event, err, trigger, buildLogErrorContext(err, durationMs));
+            // Settle the execution on the thrown-error side (§8.2). Idempotent — a
+            // no-op if the success path above already consumed the entry.
+            this.agentExecutionTracker?.completeFromDispatch(event.correlationId, {
+                thrown: err,
+            });
             // Only emit `routine_completed` if we previously emitted
             // `routine_started`; otherwise the dashboard would receive an
             // orphan completion for a routine that never started (e.g. error
@@ -965,6 +1340,7 @@ export class EventDispatcher {
         finally {
             if (isRoutineEvent(event) && event.routine === "hourly_check") {
                 this.hourlyCheckInProgress = false;
+                this.hourlyCheckInProgressAt = null;
             }
         }
     }
@@ -983,6 +1359,39 @@ export class EventDispatcher {
         }
         else if (isRoutineEvent(event)) {
             const routine = event.routine;
+            // Pre-routine morning_routine gate for review routines. The
+            // evening / weekly / monthly review prompts all read today.md +
+            // dossiers + agent-journal — without a completed morning_routine
+            // for the current agent-day these files are stale or missing,
+            // and the review would synthesise nonsense from yesterday's data.
+            // Spec: enqueue a morning_routine wake (recovery) and skip the
+            // review for this tick. The next scheduled review tick will see
+            // a completed morning_routine and proceed normally.
+            //
+            // Why agent_actions (not today.md): today.md can be edited by the
+            // user (manual rollover, DM-driven writes). The 2026-05-14
+            // sleep-skip incident hit this exact failure mode — today.md
+            // showed the new date while morning_routine had never run. See
+            // `morningRoutineRanToday` in `bootstrap/schedule-helpers.ts`.
+            if (REVIEW_ROUTINES_REQUIRING_MORNING.has(routine)) {
+                if (!morningRoutineRanToday(this.db, this.config)) {
+                    const queueWake = this.queueMorningRoutineWake;
+                    if (queueWake) {
+                        const queueResult = queueWake(`review_dependency:${routine}`);
+                        logger.info({ routine, eventType: event.type, queueResult }, "Review routine skipped — morning_routine not yet complete for current agent-day; enqueued morning_routine wake");
+                    }
+                    else {
+                        logger.warn({ routine, eventType: event.type }, "Review routine skipped — morning_routine not yet complete and queueMorningRoutineWake not wired");
+                    }
+                    this.audit.logSkip(event, "morning_routine_pending_for_today", "autonomous");
+                    // AGENT_DEFINITIONS_DESIGN.md §5.2 / §8 — settle the execution row
+                    // opened by `beginAgentExecution` as a deliberate skip rather than
+                    // letting `dispatchSafe`'s success path record a misleading empty
+                    // `success` for a review that never ran.
+                    this.agentExecutionTracker?.markSkipped(event.correlationId, "morning_routine_pending_for_today");
+                    return;
+                }
+            }
             if (routine === "morning_routine") {
                 await this.morningRoutine.executeMorningRoutine(event);
             }
@@ -1000,6 +1409,8 @@ export class EventDispatcher {
                 // installation.
                 if (!this.materializeOptimizerWorkdir) {
                     this.audit.logSkip(event, "skill_curation_unwired", "autonomous");
+                    // §5.2 / §8 — settle as a skip (see the review-gate site above).
+                    this.agentExecutionTracker?.markSkipped(event.correlationId, "skill_curation_unwired");
                     return;
                 }
                 await this.scheduledTasks.executeSkillCurationRoutine(event);
@@ -1054,10 +1465,76 @@ export class EventDispatcher {
             // behavior. (scheduled.dm subtype is handled above.)
             await this.scheduledTasks.executeScheduledTask(event);
         }
+        else if (isScheduledBrowserTaskEvent(event)) {
+            // BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — fire-time row
+            // creation + runner handoff. The helper module
+            // `dispatcher-scheduled-browser-task.ts` owns the decision
+            // logic; here we wire it into the agent_schedule lifecycle.
+            await this.handleScheduledBrowserTaskDispatch(event);
+        }
         else {
             await this.scheduledTasks.executeDefault(event);
         }
     }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — dispatch branch for
+     * `scheduled.browser_task`. Defers the heavy lifting to
+     * `handleScheduledBrowserTask` (validation + row creation + runner
+     * handoff) and translates the discriminated outcome into the
+     * `agent_schedule.status` write so the row lifecycle stays in sync.
+     *
+     * Outcomes map to:
+     *   - `dispatched` / `row_already_exists` → `agent_schedule` row
+     *     `completed` (the dispatch itself succeeded; the `browser_task`
+     *     row's own state machine tracks the long-running outcome).
+     *   - `site_unregistered` / `allowlist_rejected` / `task_context_invalid`
+     *     / `runner_unavailable` → `agent_schedule` row `failed` (the
+     *     dispatch could not proceed).
+     *
+     * A throw escapes upward into the `dispatch()` try/catch, where
+     * `errorRouter.handleError` flips the schedule row to `failed` via
+     * the existing `isScheduledEvent(event) && event.scheduleId` branch
+     * (defence-in-depth — the explicit `failed` writes here cover every
+     * normal-path failure so the error route never has to).
+     */
+    async handleScheduledBrowserTaskDispatch(event) {
+        const { handleScheduledBrowserTask } = await import("./dispatcher-scheduled-browser-task.js");
+        const outcome = await handleScheduledBrowserTask({
+            db: this.db,
+            runner: this.browserTaskRunner,
+            notifier: this.browserTaskTerminalNotifier,
+        }, event);
+        const succeeded = outcome.kind === "dispatched" || outcome.kind === "row_already_exists";
+        const newStatus = succeeded ? "completed" : "failed";
+        this.db
+            .prepare("UPDATE agent_schedule SET status = ? WHERE id = ? AND status = 'running'")
+            .run(newStatus, event.scheduleId);
+        // Audit row so the operator can grep the audit log for non-trivial
+        // dispatch outcomes (registry drift, runner misconfiguration). The
+        // happy path is intentionally NOT audited at this layer — the
+        // runner's own `agent_actions.browser_task.queue.*` rows cover the
+        // post-dispatch lifecycle.
+        if (!succeeded) {
+            try {
+                this.db
+                    .prepare(`INSERT INTO agent_actions
+               (action_type, detail, result, started_at, completed_at)
+             VALUES (?, ?, 'failure', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`)
+                    .run("browser_task.scheduled_dispatch_failed", JSON.stringify({
+                    scheduleId: event.scheduleId,
+                    kind: outcome.kind,
+                    ...("taskId" in outcome ? { taskId: outcome.taskId } : {}),
+                    ...("siteKey" in outcome ? { siteKey: outcome.siteKey } : {}),
+                    ...("reason" in outcome ? { reason: outcome.reason } : {}),
+                }));
+            }
+            catch (auditErr) {
+                /* c8 ignore start -- defensive */
+                logger.warn({ err: auditErr, scheduleId: event.scheduleId, kind: outcome.kind }, "failed to record browser_task.scheduled_dispatch_failed audit row");
+                /* c8 ignore stop */
+            }
+        }
+    }
     getMessageExecutionKey(event) {
         const { scope, scopeKey } = getConversationScope({
             platform: event.platform,
@@ -1219,4 +1696,3 @@ export class EventDispatcher {
         });
     }
 }
-//# sourceMappingURL=dispatcher.js.map