@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/roadmap-refresh-triggers.d.ts

@@ -29,4 +29,3 @@ export declare function shouldTriggerRefreshForCalendarEvent(input: CalendarEven
 export type TriggerRoadmapRefresh = (source: string) => void;
 export declare function maybeTriggerRefreshForTravelBooking(input: TravelBookingTriggerInput, trigger: TriggerRoadmapRefresh | null | undefined): void;
 export declare function maybeTriggerRefreshForCalendarEvent(input: CalendarEventTriggerInput, trigger: TriggerRoadmapRefresh | null | undefined): void;
-//# sourceMappingURL=roadmap-refresh-triggers.d.ts.map

package/dist/core/roadmap-refresh-triggers.js

@@ -48,4 +48,3 @@ export function maybeTriggerRefreshForCalendarEvent(input, trigger) {
         logger.warn({ err }, "triggerRoadmapRefresh threw — continuing");
     }
 }
-//# sourceMappingURL=roadmap-refresh-triggers.js.map

package/dist/core/roadmap-truncate.d.ts

@@ -46,4 +46,3 @@ export interface RoadmapTruncationOptions {
  * near-term window. Pass-through when the section is absent or empty.
  */
 export declare function truncateRoadmap(content: string, options?: RoadmapTruncationOptions): string;
-//# sourceMappingURL=roadmap-truncate.d.ts.map

package/dist/core/roadmap-truncate.js

@@ -149,4 +149,3 @@ function extractEntryYmd(entry) {
     const match = headerLine.match(YMD_RE);
     return match ? match[0] : null;
 }
-//# sourceMappingURL=roadmap-truncate.js.map

package/dist/core/roadmap-validate.d.ts

@@ -28,4 +28,8 @@ export interface NormalizeRoadmapForWriteResult {
 export declare function normalizeRoadmapForWrite(content: string, options?: NormalizeRoadmapForWriteOptions): NormalizeRoadmapForWriteResult;
 export declare function validateRoadmap(content: string): RoadmapValidationResult;
 export declare function validateRoadmapTransition(previousContent: string, nextContent: string, options?: RoadmapTransitionValidationOptions): RoadmapValidationResult;
-//# sourceMappingURL=roadmap-validate.d.ts.map
+export declare function findSectionLineBounds(lines: string[], sectionName: string): {
+    headerLine: number;
+    bodyStart: number;
+    bodyEnd: number;
+} | null;

package/dist/core/roadmap-validate.js

@@ -11,8 +11,8 @@ const LAST_SYNCED_RE = /^> Last synced: (\d{4}-\d{2}-\d{2})$/;
 const EVENT_HEADING_RE = /^### \d{4}-\d{2}-\d{2}(?: ~ \d{2}-\d{2})?: .+$/;
 const SCHEDULED_HEADING_RE = /^### Scheduled: .+\s+\(task #\d+\)$/;
 const SCHEDULED_SOURCE_RE = /^Source: scheduled\.task \u2014 wake-up \d{4}-\d{2}-\d{2} \d{2}:\d{2}$/;
-const PREP_ROW_RE = /^- (?:\u2713 completed \d{4}-\d{2}-\d{2}: )?\d{4}-\d{2}-\d{2} \[(notify|today|check|schedule)\](?:\s*\[provisional[^\]]*\])?: .+$/;
-const COMPLETED_PREP_ROW_RE = /^- \u2713 completed \d{4}-\d{2}-\d{2}: \d{4}-\d{2}-\d{2} \[(notify|today|check|schedule)\](?:\s*\[provisional[^\]]*\])?: .+$/;
+const PREP_ROW_RE = /^- (?:completed \d{4}-\d{2}-\d{2}: )?\d{4}-\d{2}-\d{2} \[(notify|today|check|schedule)\](?:\s*\[provisional[^\]]*\])?: .+$/;
+const COMPLETED_PREP_ROW_RE = /^- completed \d{4}-\d{2}-\d{2}: \d{4}-\d{2}-\d{2} \[(notify|today|check|schedule)\](?:\s*\[provisional[^\]]*\])?: .+$/;
 const EVENT_DATE_FROM_HEADING_RE = /^### (\d{4}-\d{2}-\d{2})(?: ~ \d{2}-\d{2})?: /;
 const SCHEDULED_WAKE_UP_RE = /^Source: scheduled\.task \u2014 wake-up (\d{4}-\d{2}-\d{2}) \d{2}:\d{2}$/;
 export function normalizeRoadmapForWrite(content, options) {
@@ -49,8 +49,6 @@ export function validateRoadmap(content) {
         return failure("roadmap.md must start with `# Roadmap`.", 1);
     }
     const lastSynced = LAST_SYNCED_RE.exec(lines[1] ?? "");
-    const hasMalformedLastSyncedLine = (lines[1] ?? "").startsWith("> Last synced:") &&
-        (lastSynced === null || !isValidYmd(lastSynced[1]));
     const sections = collectTopLevelSections(lines);
     const entryIds = collectManagedEntryIds(lines);
     if (entryIds.malformed) {
@@ -59,9 +57,6 @@ export function validateRoadmap(content) {
     if (entryIds.duplicate) {
         return failure(`Duplicate roadmap entry id \`${entryIds.duplicate.id}\` (first seen on line ${entryIds.duplicate.firstLine}).`, entryIds.duplicate.duplicateLine);
     }
-    const legacyResult = validateLegacyRoadmapSkeleton(lines, sections, lastSynced !== null && isValidYmd(lastSynced[1]), hasMalformedLastSyncedLine, entryIds.refs.length > 0);
-    if (legacyResult)
-        return legacyResult;
     if (!lastSynced || !isValidYmd(lastSynced[1])) {
         return failure("roadmap.md line 2 must be `> Last synced: YYYY-MM-DD`.", 2);
     }
@@ -78,9 +73,6 @@ export function validateRoadmap(content) {
         }
     }
     const requireIds = entryIds.refs.length > 0;
-    if (!requireIds) {
-        warnings.push("legacy roadmap body accepted without stable entry ids");
-    }
     const longTermPlans = findSectionLineBounds(lines, "Long-term Plans");
     if (!longTermPlans) {
         return failure("Missing `## Long-term Plans` section.");
@@ -108,61 +100,6 @@ export function validateRoadmap(content) {
         return { ok: false, error: aapError, warnings };
     return { ok: true, warnings };
 }
-function validateLegacyRoadmapSkeleton(lines, sections, hasValidLastSynced, hasMalformedLastSyncedLine, hasManagedIds) {
-    if (hasMalformedLastSyncedLine)
-        return null;
-    const sectionNames = sections.map((section) => section.name);
-    const hasAllRequiredSections = REQUIRED_SECTIONS.every((section) => sectionNames.includes(section));
-    const needsLegacyMigration = !hasValidLastSynced || !hasAllRequiredSections;
-    if (!needsLegacyMigration)
-        return null;
-    if (hasManagedIds)
-        return null;
-    const coreSections = ["Annual Goals", "Quarterly Focus", "Recurring"];
-    const coreSectionIndexes = coreSections.map((section) => sectionNames.indexOf(section));
-    if (coreSectionIndexes.some((index) => index < 0))
-        return null;
-    if (!isStrictlyIncreasing(coreSectionIndexes))
-        return null;
-    const agentActionPlan = findSectionLineBounds(lines, "Agent Action Plan");
-    if (agentActionPlan && hasAgentActionPlanEntries(lines, agentActionPlan)) {
-        return null;
-    }
-    const longTermPlans = findSectionLineBounds(lines, "Long-term Plans");
-    const warnings = [
-        "legacy roadmap skeleton accepted during migration; next roadmap refresh must rewrite canonical structure",
-        "legacy roadmap body accepted without stable entry ids",
-    ];
-    if (longTermPlans) {
-        for (let index = longTermPlans.bodyStart; index < longTermPlans.bodyEnd; index++) {
-            const line = lines[index];
-            if (line.trim() === "")
-                continue;
-            const result = normalizeLongTermPlanLine(line);
-            if (!result.ok) {
-                return failure(result.message, index + 1);
-            }
-            if (result.changed) {
-                warnings.push(`line ${index + 1}: legacy Long-term Plans entry accepted during migration; next writer must normalize it`);
-            }
-        }
-    }
-    return { ok: true, warnings };
-}
-function isStrictlyIncreasing(values) {
-    for (let index = 1; index < values.length; index++) {
-        if (values[index] <= values[index - 1])
-            return false;
-    }
-    return true;
-}
-function hasAgentActionPlanEntries(lines, bounds) {
-    for (let index = bounds.bodyStart; index < bounds.bodyEnd; index++) {
-        if (lines[index].startsWith("### "))
-            return true;
-    }
-    return false;
-}
 function collectManagedEntryIds(lines) {
     const refs = [];
     const longTermPlans = findSectionLineBounds(lines, "Long-term Plans");
@@ -271,18 +208,19 @@ function validateAgentActionPlan(lines, bounds, requireIds) {
             continue;
         }
         if (inPreparationTimeline && line.startsWith("- ") && !PREP_ROW_RE.test(line)) {
-            // 2026-05 cost-spike fix: the bare "Malformed Preparation Timeline
-            // row" message gave the agent zero signal about which part of the
-            // row was wrong, so a roadmap_refresh session retried the PUT 8x
-            // before timing out. Embed the canonical shape + the failing line
-            // verbatim so the agent can spot the diff on the next turn.
+            // Without a precise error envelope, the bare "Malformed Preparation
+            // Timeline row" message gives the agent zero signal about which
+            // part of the row was wrong, so a roadmap_refresh session retries
+            // the PUT until it times out. Embed the canonical shape + the
+            // failing line verbatim so the agent can spot the diff on the next
+            // turn.
             //
             // Truncate the received line at 200 chars so a pathological line
             // doesn't blow up the error response.
             const received = line.length > 200 ? `${line.slice(0, 200)}…` : line;
             return error("Malformed Preparation Timeline row. " +
                 "Expected `- YYYY-MM-DD [notify|today|check|schedule]: <description>` " +
-                "or `- ✓ completed YYYY-MM-DD: YYYY-MM-DD [notify|today|check|schedule]: <description>`. " +
+                "or `- completed YYYY-MM-DD: YYYY-MM-DD [notify|today|check|schedule]: <description>`. " +
                 `Received: \`${received}\``, lineNo);
         }
     }
@@ -376,8 +314,8 @@ function isEntryRemovalAllowed(entry, today) {
             entry.primaryDate > addDaysYmd(today, 180));
     }
     if (entry.kind === "scheduled" && entry.wakeUpDate && entry.status) {
-        const terminal = entry.status.includes("\u2713 completed") ||
-            entry.status.includes("\u2717 failed");
+        const terminal = entry.status.includes("completed") ||
+            entry.status.includes("failed");
         return terminal && entry.wakeUpDate < addDaysYmd(today, -1);
     }
     return false;
@@ -392,7 +330,7 @@ function collectTopLevelSections(lines) {
     }
     return sections;
 }
-function findSectionLineBounds(lines, sectionName) {
+export function findSectionLineBounds(lines, sectionName) {
     const header = `## ${sectionName}`;
     const headerIndex = lines.findIndex((line) => line === header);
     if (headerIndex < 0)
@@ -412,4 +350,3 @@ function failure(message, line) {
 function error(message, line) {
     return { message, line, path: "roadmap.md" };
 }
-//# sourceMappingURL=roadmap-validate.js.map

package/dist/core/roadmap-write-lock.d.ts

@@ -50,4 +50,3 @@ export declare class InMemoryRoadmapWriteLockManager implements RoadmapWriteLock
  * single long refresh session can never outlive its own lock.
  */
 export declare function getRoadmapWriteLockTimeoutMs(executeTimeoutMinutes: number): number;
-//# sourceMappingURL=roadmap-write-lock.d.ts.map

package/dist/core/roadmap-write-lock.js

@@ -56,4 +56,3 @@ export function getRoadmapWriteLockTimeoutMs(executeTimeoutMinutes) {
         : 60;
     return (normalizedMinutes * 2 + 10) * 60 * 1000;
 }
-//# sourceMappingURL=roadmap-write-lock.js.map

package/dist/core/routine-acquisition-plan.d.ts

@@ -1,15 +1,19 @@
 /**
  * `<acquisition-plan>` block assembly for the routine pre-pass fetcher.
  *
- * ROUTINE_DATA_ACQUISITION_DESIGN.md §6.4 / F5 — pure helper that the
+ * docs/design/appendices/routine-data-acquisition.md §6.4 / F5 — pure helper that the
  * routine dispatchers (Phase 4) call to render the XML block the
  * `routine.fetch_window` session reads. Stays I/O-free so it can be
  * tested in isolation against synthetic integration state.
  *
  * The block lists one `<fetch>` element per (integration × mode × account)
  * combination implied by `ROUTINE_WINDOWS[routine]` and the current
- * integration state. Disabled integrations, unmapped query cells, and
- * native bindings whose backend does not match the session are skipped.
+ * integration state. Disabled integrations and unmapped query cells are
+ * skipped; `native` bindings whose `nativeBackend` differs from the
+ * input `sessionBackend` are NOT skipped — `resolveIntegrationBackend`
+ * routes the row to its actual `nativeBackend` and the runner spawns
+ * each sub-session on its `requiredBackend` via the BackendRouter's
+ * backend-only override.
  *
  * Output shape (§6.4 example, but with substituted timestamps and the
  * resolved mode-suffix the partial filters on):
@@ -59,8 +63,17 @@ export interface AcquisitionTimestamps {
     day_plus_48h: string;
     /** Current instant + 2h. */
     day_plus_2h: string;
-    /** Agent-day start − 7 days. */
-    week_start_iso: string;
+    /**
+     * Current ISO week's Monday at 00:00 local-time, expressed as a UTC
+     * ISO instant. The "ISO week" follows ISO-8601 (Mon = week start,
+     * Sun = week end). `weekly_review`'s `cal_iso_week_to_now` window
+     * uses this as `timeMin` so the calendar retrospective and the
+     * archived `daily/YYYY-MM-DD.md` files (which are also keyed by the
+     * ISO week's Mon–Sun calendar dates) cover the same days. The
+     * anchor is **00:00 local**, not the agent-day boundary, because
+     * the `daily/*.md` cadence is also calendar-date-keyed.
+     */
+    iso_week_start_iso: string;
     /** Agent-day start + 7 days. */
     week_end_iso: string;
     /** Agent-day start + 30 days. */
@@ -75,8 +88,8 @@ export interface AcquisitionTimestamps {
      * parse the date in UTC.
      */
     day_start_date: string;
-    /** 7 days before `day_start_date`, calendar-date-only. */
-    week_start_date: string;
+    /** Current ISO week Monday in local time, as a `YYYY-MM-DD` slug. */
+    iso_week_start_date: string;
     /** Today's calendar date in UTC. */
     now_date: string;
 }
@@ -155,6 +168,29 @@ export interface AcquisitionSubPlan {
      * fan-out in dashboard progress envelopes.
      */
     rowsHaveAccount: boolean;
+    /**
+     * Backend this integration's sub-session MUST spawn on so the
+     * partial body's resolved `mode:` block has a working wire surface.
+     *
+     *  - `native`: equals `state.nativeBackend` (MCP only exists there).
+     *  - `userManagedConnector` delegated: equals `state.delegatedBackend`
+     *    (no daemon proxy — must use the bound backend's MCP).
+     *  - Other modes: equals the input `sessionBackend` (default
+     *    fetch_window backend).
+     *
+     * Consumed by `RoutineFetchWindowRunner.runOneIntegrationWithRetry`,
+     * which passes it as `requestedBackendId` to
+     * `BackendRouter.resolveBinding`. The router's
+     * `requestedBackendId`-only override path (added alongside this
+     * field) resolves the canonical model for that backend at the
+     * configured tier, preserving `routine.fetch_window`'s
+     * `process_backend_config` envelope (maxTurns / maxBudgetUsd).
+     *
+     * Within an integration's sub-plan every row carries the same
+     * `requiredBackend`, so the sub-plan stores one value instead of
+     * surfacing per-row variation that does not exist.
+     */
+    requiredBackend: BackendId;
 }
 /**
  * Partition a routine's acquisition plan into one sub-plan per active
@@ -179,4 +215,3 @@ export interface AcquisitionSubPlan {
  * `scoped="<key>"` attribute and the partition itself.
  */
 export declare function splitAcquisitionPlanByIntegration(input: BuildAcquisitionPlanInput): readonly AcquisitionSubPlan[];
-//# sourceMappingURL=routine-acquisition-plan.d.ts.map

package/dist/core/routine-acquisition-plan.js

@@ -1,15 +1,19 @@
 /**
  * `<acquisition-plan>` block assembly for the routine pre-pass fetcher.
  *
- * ROUTINE_DATA_ACQUISITION_DESIGN.md §6.4 / F5 — pure helper that the
+ * docs/design/appendices/routine-data-acquisition.md §6.4 / F5 — pure helper that the
  * routine dispatchers (Phase 4) call to render the XML block the
  * `routine.fetch_window` session reads. Stays I/O-free so it can be
  * tested in isolation against synthetic integration state.
  *
  * The block lists one `<fetch>` element per (integration × mode × account)
  * combination implied by `ROUTINE_WINDOWS[routine]` and the current
- * integration state. Disabled integrations, unmapped query cells, and
- * native bindings whose backend does not match the session are skipped.
+ * integration state. Disabled integrations and unmapped query cells are
+ * skipped; `native` bindings whose `nativeBackend` differs from the
+ * input `sessionBackend` are NOT skipped — `resolveIntegrationBackend`
+ * routes the row to its actual `nativeBackend` and the runner spawns
+ * each sub-session on its `requiredBackend` via the BackendRouter's
+ * backend-only override.
  *
  * Output shape (§6.4 example, but with substituted timestamps and the
  * resolved mode-suffix the partial filters on):
@@ -22,7 +26,7 @@
  * </acquisition-plan>
  * ```
  */
-import { INTEGRATION_KEYS, getAgentDayBoundsUtc, getIntegrationDescriptor, parseSqliteUtcMs, } from "@aitne/shared";
+import { INTEGRATION_KEYS, getAgentDayBoundsUtc, getIntegrationDescriptor, nowInTimezone, parseSqliteUtcMs, } from "@aitne/shared";
 import { ROUTINE_WINDOWS, WINDOW_QUERIES, } from "./routine-windows.js";
 /**
  * Compute the timestamp set the assembly helper uses. Anchors to the
@@ -41,12 +45,29 @@ export function buildAcquisitionTimestamps(now, timezone, dayBoundaryHour) {
     const dayStartMs = parseSqliteUtcMs(bounds.start);
     const dayEndMs = dayStartMs + 24 * 60 * 60 * 1000;
     const day48Ms = dayStartMs + 48 * 60 * 60 * 1000;
-    const weekStartMs = dayStartMs - 7 * 24 * 60 * 60 * 1000;
     const weekEndMs = dayStartMs + 7 * 24 * 60 * 60 * 1000;
     const monthEndMs = dayStartMs + 30 * 24 * 60 * 60 * 1000;
     const nowMs = now.getTime();
     const hourStartMs = nowMs - (nowMs % (60 * 60 * 1000));
     const plus2hMs = nowMs + 2 * 60 * 60 * 1000;
+    // ISO week anchor — Monday 00:00 in the configured local timezone,
+    // expressed as a UTC instant. Computed in two steps:
+    //   1. Walk back from today (local) to this ISO week's Monday in
+    //      local-calendar space (TZ-naive at the date level).
+    //   2. Resolve "Monday 00:00 local" to its UTC instant via
+    //      getAgentDayBoundsUtc with `dayBoundaryHour=0`, which already
+    //      handles DST transitions correctly for non-UTC zones.
+    // The local-calendar walk is intentionally separate from the
+    // agent-day boundary anchor — `weekly_review`'s `daily/YYYY-MM-DD.md`
+    // archive is keyed by local calendar date, so the ISO week must be
+    // anchored at midnight local even when `dayBoundaryHour ≠ 0`.
+    const local = nowInTimezone(timezone, now);
+    const noonUtcAnchor = new Date(Date.UTC(local.year, local.month - 1, local.day, 12));
+    const dayNrFromMon = (noonUtcAnchor.getUTCDay() + 6) % 7; // Mon=0, Sun=6
+    const mondayAnchorUtc = new Date(noonUtcAnchor);
+    mondayAnchorUtc.setUTCDate(noonUtcAnchor.getUTCDate() - dayNrFromMon);
+    const mondayBounds = getAgentDayBoundsUtc(timezone, 0, mondayAnchorUtc);
+    const isoWeekStartMs = parseSqliteUtcMs(mondayBounds.start);
     const dateOnly = (ms) => new Date(ms).toISOString().slice(0, 10);
     return {
         now_iso: new Date(nowMs).toISOString(),
@@ -56,11 +77,11 @@ export function buildAcquisitionTimestamps(now, timezone, dayBoundaryHour) {
         day_plus_24h: new Date(dayEndMs).toISOString(),
         day_plus_48h: new Date(day48Ms).toISOString(),
         day_plus_2h: new Date(plus2hMs).toISOString(),
-        week_start_iso: new Date(weekStartMs).toISOString(),
+        iso_week_start_iso: new Date(isoWeekStartMs).toISOString(),
         week_end_iso: new Date(weekEndMs).toISOString(),
         month_end_iso: new Date(monthEndMs).toISOString(),
         day_start_date: dateOnly(dayStartMs),
-        week_start_date: dateOnly(weekStartMs),
+        iso_week_start_date: dateOnly(isoWeekStartMs),
         now_date: dateOnly(nowMs),
     };
 }
@@ -125,6 +146,57 @@ function resolveFetchMode(integration, state, sessionBackend) {
             return null;
     }
 }
+/**
+ * Resolve the backend the sub-session for this integration MUST run on
+ * so that the partial body's resolved `mode:` block has a working wire
+ * surface (MCP tools, daemon REST, or daemon proxy).
+ *
+ * Semantics:
+ *  - `native`: the MCP tools only exist on the `nativeBackend`; the
+ *    sub-session has to spawn there. This is the case the previous
+ *    single-backend pre-pass model silently dropped via `resolveFetchMode`
+ *    returning `null` when `nativeBackend !== sessionBackend` — fixed
+ *    structurally by routing the sub-session to `nativeBackend` instead.
+ *  - `delegated` + `userManagedConnector`: there is no daemon
+ *    `/api/integrations/<key>/exec` proxy for these descriptors (Outlook
+ *    today), so cross-backend delegated collapses to delegated-same. The
+ *    sub-session must spawn on `delegatedBackend` to reach the user's
+ *    own MCP.
+ *  - `delegated` + non-userManaged + same-backend
+ *    (`delegatedBackend === defaultBackend`): MCP on the default backend
+ *    — sub-session stays on `defaultBackend` (no change).
+ *  - `delegated` + non-userManaged + cross-backend: the partial uses the
+ *    daemon proxy via curl — sub-session can spawn anywhere, default
+ *    backend keeps the pre-pass tier predictable.
+ *  - `direct`: REST via curl to the daemon — sub-session stays on
+ *    `defaultBackend`.
+ *  - `disabled` / no state: irrelevant (`resolveFetchMode` returns
+ *    `null` and the row is dropped before backend matters); returning
+ *    `defaultBackend` is a no-op safety default.
+ *
+ * The function is intentionally `null`-free — every call site benefits
+ * from a guaranteed backend so the per-integration spawn path never has
+ * to short-circuit on missing data.
+ */
+function resolveIntegrationBackend(integration, state, defaultBackend) {
+    if (!state)
+        return defaultBackend;
+    if (state.mode === "native" && state.nativeBackend) {
+        return state.nativeBackend;
+    }
+    if (state.mode === "delegated" && state.delegatedBackend) {
+        if (getIntegrationDescriptor(integration).userManagedConnector === true) {
+            return state.delegatedBackend;
+        }
+        // Non-userManaged delegated: same-backend uses the default's MCP
+        // (delegatedBackend == defaultBackend by definition); cross-backend
+        // uses the daemon proxy from any session. Either way, returning
+        // `defaultBackend` keeps the spawn on the configured fetch_window
+        // backend, which is the right tier-cost-predictable choice.
+        return defaultBackend;
+    }
+    return defaultBackend;
+}
 /**
  * Resolve the WINDOW_QUERIES cell for a (symbol, integration, mode)
  * tuple. delegated-same / delegated-cross both look up "delegated" in
@@ -226,7 +298,18 @@ function collectFetchRows(input) {
         const integrations = integrationsForWindow(spec.window);
         for (const integration of integrations) {
             const state = input.integrations[integration];
-            const fetchMode = resolveFetchMode(integration, state, input.sessionBackend);
+            // Per-integration backend resolution. Was: `input.sessionBackend`
+            // (single backend for the whole plan), which caused `resolveFetchMode`
+            // to return `null` for native bindings on a different backend —
+            // silently dropping the row. With `resolveIntegrationBackend` the
+            // sub-session is routed to the integration's actual bound backend
+            // (`nativeBackend`, or `delegatedBackend` for userManagedConnector),
+            // and `resolveFetchMode` then matches on the correct backend so the
+            // row survives. The runner uses `requiredBackend` (bubbled up via
+            // `FetchRow`) to spawn each sub-session on the right backend via
+            // `BackendRouter.resolveBinding({ requestedBackendId })`.
+            const requiredBackend = resolveIntegrationBackend(integration, state, input.sessionBackend);
+            const fetchMode = resolveFetchMode(integration, state, requiredBackend);
             if (fetchMode === null)
                 continue;
             const queryTemplate = lookupQuery(spec.window, integration, fetchMode);
@@ -257,6 +340,7 @@ function collectFetchRows(input) {
                         accountId: account.accountId,
                         label: account.label,
                         query,
+                        requiredBackend,
                     });
                 }
             }
@@ -266,6 +350,7 @@ function collectFetchRows(input) {
                     mode: fetchMode,
                     window: spec.window,
                     query,
+                    requiredBackend,
                 });
             }
         }
@@ -355,13 +440,18 @@ export function splitAcquisitionPlanByIntegration(input) {
         const groupRows = groups.get(key);
         if (!groupRows || groupRows.length === 0)
             continue;
+        // Every row in a group shares the same `requiredBackend` (it's a
+        // per-integration property derived from the integration's state, not
+        // per-row). Take the first row's value — `collectFetchRows` writes
+        // the same backend onto every row of an integration.
+        const requiredBackend = groupRows[0].requiredBackend;
         out.push({
             integrationKey: key,
             block: renderAcquisitionPlanBlock(input.routine, input.agentDay, groupRows, key),
             fetchRowCount: groupRows.length,
             rowsHaveAccount: groupRows.some((r) => r.accountId !== undefined),
+            requiredBackend,
         });
     }
     return out;
 }
-//# sourceMappingURL=routine-acquisition-plan.js.map

package/dist/core/routine-fetch-window-retry.d.ts

@@ -1,7 +1,7 @@
 /**
  * Retry-policy helpers for the pre-pass fan-out coordinator.
  *
- * PRE_PASS_FAN_OUT_DESIGN.md §4.4 — the coordinator spawns a fresh Haiku
+ * docs/design/appendices/pre-pass-fan-out.md §4.4 — the coordinator spawns a fresh Haiku
  * sub-session per attempt and consults `defaultRetryDecision` (or any
  * `RetryDecisionFn`) between attempts to choose whether to spawn the
  * next one. Keeping the policy as pure data (decision matrix in
@@ -70,6 +70,31 @@ export declare const RETRY_REASONS: {
     readonly FAILED_STATUS: "failed-status";
     readonly UPSTREAM_5XX: "upstream-5xx";
     readonly PARTIAL_NO_POST: "partial-no-post";
+    /**
+     * Errors whose cause is structural rather than transient — retrying with
+     * the same source data will reproduce them byte-for-byte. Today's only
+     * surface:
+     *
+     *   - `{type:"fetch-failed", status:"permission-denied"}` — SDK Bash
+     *     parser rejected the POST command (e.g., Unicode whitespace in a
+     *     mail subject triggered Anthropic's `Ae6` "too-complex" gate, the
+     *     SDK fell through to ask-mode, dontAsk denied). The agent will
+     *     re-emit the same bytes on retry and re-trip the same gate.
+     *
+     * Distinct from `auth-failed` (401/403 — upstream credentials) and from
+     * `upstream-5xx` (transient infra). Only the status=failed and
+     * partial-no-post branches of rule 4 consult this — a `partial-with-
+     * progress` report (`posted > 0`) already doesn't retry by rule 5, so
+     * tagging it with deterministic-failure would misrepresent the audit
+     * trail.
+     *
+     * `validation-error` is intentionally NOT in this class: per-item Zod
+     * rejections from `/observations/batch` are exactly the §1.1 motivating
+     * case — the agent receives `detail` in the prior-attempt-hint and can
+     * correct the payload shape on retry. Classifying them as deterministic
+     * would suppress that recovery path.
+     */
+    readonly DETERMINISTIC_FAILURE: "deterministic-failure";
     readonly SUCCESS: "success";
     readonly PARTIAL_WITH_POST: "partial-with-progress";
     readonly SKIPPED: "skipped";
@@ -88,11 +113,24 @@ export declare function cumulativeAttemptCost(report: SubAttemptRecord, priorAtt
  *  2. Per-integration cumulative budget cap.
  *  3. Terminal error classes — flip-lock, budget-exhausted, auth (401/403).
  *  4. Retry-worthy outcomes — failed status, upstream 5xx, partial-no-post.
+ *     Each of these branches consults `isDeterministicError` BEFORE
+ *     emitting its retry decision: when the report carries a
+ *     `permission-denied` error and no 5xx is present, the branch
+ *     short-circuits to `deterministic-failure` instead of looping.
  *  5. Non-retry-by-default — success, partial-with-progress, skipped, no-progress.
  *
  * The motivating §1.1 failure ("Unknown name "limit"") lands
  * as `status="partial"` with `fetched > 0`, `posted === 0` and a
- * `fetch-failed` error — rule (4)'s `partial-no-post` branch catches it.
+ * `fetch-failed` error — rule (4)'s `partial-no-post` branch catches it
+ * and retries (the agent fixes the arg name on retry via the
+ * prior-attempt-hint).
+ *
+ * A Unicode-whitespace-in-mail-body failure lands as `status="partial"`
+ * with `posted === 0` and a `{type:"fetch-failed",
+ * status:"permission-denied", message:"Bash tool blocked..."}` —
+ * rule (4)'s partial-no-post branch sees the deterministic error and
+ * short-circuits to `deterministic-failure` instead of burning two more
+ * attempts on bytes the SDK will keep rejecting.
  */
 export declare const defaultRetryDecision: RetryDecisionFn;
 /**
@@ -106,4 +144,3 @@ export declare const defaultRetryDecision: RetryDecisionFn;
  * page; deeper history is context-only.
  */
 export declare function buildPriorAttemptHintBlock(attempts: readonly SubAttemptRecord[], integrationKey?: IntegrationKey): string;
-//# sourceMappingURL=routine-fetch-window-retry.d.ts.map