@aitne/daemon 0.1.7 → 0.1.9

package/dist/index.js

@@ -1,96 +1,40 @@
-import { serve } from "@hono/node-server";
 import { join, resolve } from "node:path";
-import { rmSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { loadConfig, getContextDir, isRoadmapStale, mergeRuntimeSettingsFromDb, runVaultHealthProbe, validateExternalObsidianVaultPath, } from "./config.js";
-import { getDegradedMode, isSetupCompleted, isUserPaused, isDegraded as readDegradedMode, } from "./db/runtime-state.js";
-import { createDefaultBangCommandRegistry } from "./core/bang-commands/index.js";
+import { loadConfig, getContextDir, runVaultHealthProbe, validateExternalObsidianVaultPath, } from "./config.js";
+import { getDegradedMode, getVaultRestructurePendingConsent, isSetupCompleted, isDegraded as readDegradedMode, } from "./db/runtime-state.js";
 import { initDirectories } from "./init.js";
-import { createDatabase } from "./db/client.js";
-import { applySchema } from "./db/schema.js";
-import { readIntegrations } from "./db/integrations-store.js";
-import { getRepositoryByGithub, getRepositoryByLocalPath, listRepositories, selectGithubRepoSlugs, selectGitWatchedRepos, } from "./db/repositories-store.js";
-import { dispatchMatchingTriggers } from "./core/trigger-dispatch.js";
 import { EventBus } from "./core/event-bus.js";
 import { AgentScheduler } from "./core/scheduler.js";
 import { CustomRoutineScheduler } from "./core/custom-routine-scheduler.js";
 import { HealthMonitor } from "./core/health-monitor.js";
 import { Heartbeat } from "./core/heartbeat.js";
 import { MessageHub } from "./adapters/message-hub.js";
-import { ObserverManager } from "./observers/manager.js";
-import { ObsidianWatcher } from "./observers/obsidian-watcher.js";
-import { PrimaryVaultWatcher } from "./observers/primary-vault-watcher.js";
-import { ContextIndexReconcilerObserver } from "./observers/context-index-reconciler-observer.js";
-import { EntityMirrorObserver } from "./observers/entity-mirror-observer.js";
-import { GitWatcher } from "./observers/git-watcher.js";
-import { GitHubPoller } from "./observers/github-poller.js";
-import { GitAccountRegistry } from "./services/git-account-registry.js";
-import { GitDelegatedCronObserver, hasActiveDelegatedGitLifecycleIntegration, } from "./observers/git-delegated-cron.js";
-import { RepositoryManagementCron } from "./observers/repository-management-cron.js";
-import { ObservationSummarizerWorker, AnthropicSummarizerClient, UnsupportedSummarizerClient, } from "./observers/observation-summarizer/index.js";
-import { CalendarPoller } from "./observers/calendar-poller.js";
-import { ImminentEventScheduler } from "./observers/imminent-event-scheduler.js";
-import { DelegatedSyncWorker, hasActiveDelegatedSyncIntegration, } from "./observers/delegated-sync-worker.js";
-import { applyIntegrationModeChange, shouldStartObserversFor, } from "./core/integration-lifecycle.js";
-import { NotionPoller } from "./observers/notion-poller.js";
+import { resolvePrimaryPlatform } from "./adapters/primary-platform-resolver.js";
 import { DiscordAdapter } from "./adapters/discord.js";
 import { SlackAdapter } from "./adapters/slack-adapter.js";
 import { TelegramAdapter } from "./adapters/telegram-adapter.js";
 import { DashboardAdapter } from "./adapters/dashboard-adapter.js";
 import { ObsidianService } from "./services/obsidian.js";
 import { createServiceRegistry } from "./services/service-registry.js";
-import { SignalDetector } from "./core/signal-detector.js";
-import { EventDispatcher } from "./core/dispatcher.js";
-import { ClaudeCodeCore } from "./core/backends/claude-code-core.js";
-import { BackendRouter } from "./core/backends/backend-router.js";
-import { ensureBackendMaterialized, syncAllUserSkills, buildConfiguredServices, refreshDmSessionWorkdirs, validateDelegatedStartup, } from "./core/workdir.js";
-import { setWikiWorkspaceTokenResolver } from "./core/skills-compiler.js";
-import { CodexCore } from "./core/backends/codex-core.js";
-import { GeminiCliCore } from "./core/backends/gemini-cli-core.js";
-import { PriceFetcher } from "./core/backends/price-fetcher.js";
-import { AuthTelemetry } from "./core/backends/auth-telemetry.js";
-import { AuthHealthMonitor, AUTH_PROBE_NOTIFICATION_CATEGORY } from "./core/backends/auth-health-monitor.js";
-import { AuthRecovery } from "./core/backends/auth-recovery.js";
-import { ContextBuilder } from "./core/context-builder.js";
-import { getTaskFlow, initTaskFlows } from "./core/prompts.js";
-import { listWikiWorkspaces, readDefaultWikiWorkspace, readWikiWorkspaceByName, } from "./core/wiki/workspaces.js";
-import { backfillWikiFulltext } from "./core/wiki/wiki-fts.js";
 import { ensureSkeletonFiles, resolveTemplatesRoot } from "./core/skeleton.js";
-import { normalizeGitWatchedRepos, queueGitProjectUpdate, queueMissingGitProjectInits, seedGitProjectDocTemplates, } from "./core/git-project-docs.js";
 import { reconcileTemplateAssets, recordInstructionAssetStatus, recordSkillAssetStatus, } from "./core/release-assets.js";
-import { SessionManager } from "./core/session-manager.js";
-import { MessageRecorder } from "./core/message-recorder.js";
-import { ScopedReadSensitiveTokenManager } from "./core/read-sensitive-token-manager.js";
-import { NotificationManager } from "./adapters/notification-manager.js";
-import { recordProactiveForwardDeliveries } from "./core/channel-timeline.js";
-import { continueDashboardSession as continueDashboardSessionFromHistory, endDashboardSession as endDashboardSessionFromChannel, markContextChanged, } from "./core/dashboard-session-controls.js";
-import { AuditLogger } from "./safety/audit.js";
+import { resolveUserSkillsRoot } from "./core/user-skills-root.js";
 import { bootstrapManagementMd, startManagementMdWatcher, } from "./core/management-md.js";
 import { bootstrapManagementRegistry, startManagementRegistryWatcher, } from "./core/management-registry.js";
-import { bootstrapManagedTaskSeq } from "./db/managed-tasks-store.js";
 import { startDocsIndexer, } from "./core/docs/indexer.js";
-import { makeDbLookup as makeDocsCitationLookup } from "./core/docs/citation-validator.js";
-import { createDocsRoutes } from "./api/routes/docs.js";
-import { DocsQAAdapter } from "./adapters/docs-qa-adapter.js";
-import { CompositeDashboardStream } from "./adapters/composite-dashboard-stream.js";
-import { createApp } from "./api/server.js";
-import { EventBroadcaster } from "./api/routes/sse.js";
 import { APP_NAME, EventPriority, getBackendIds, } from "@aitne/shared";
-import { getOwnerChannel } from "./messaging/owner-channels.js";
+import { getOwnerChannel, selectFirstPairedPlatform, } from "./messaging/owner-channels.js";
 import { SUPPORTED_MESSAGING_PLATFORMS, } from "./messaging/constants.js";
-import { sendSetupWelcomeDm } from "./messaging/setup-welcome-dm.js";
 import { AgentWriteTracker } from "./safety/agent-write-tracker.js";
-import { ContextWriteGate, InMemoryTodayWriteLockManager, MigrationLock, getTodayWriteLockTimeoutMs, } from "./core/today-write-lock.js";
-import { applyPromptContextStaleness, } from "./core/context-staleness.js";
+import { InMemoryTodayWriteLockManager, getTodayWriteLockTimeoutMs, } from "./core/today-write-lock.js";
 import { InMemoryRoadmapWriteLockManager, getRoadmapWriteLockTimeoutMs, } from "./core/roadmap-write-lock.js";
+import { runRoadmapMechanicalMaintenance } from "./core/roadmap-maintenance.js";
+import { fanoutResearchClusterUpdates } from "./core/browser-history/research-cluster-fanout.js";
+import { safeRunPreMorningDigestJob } from "./core/browser-history/pre-morning-digest-job.js";
+import { shouldStartObserversFor } from "./core/integration-lifecycle.js";
 import { sweepExpiredMigrationBackups } from "./api/routes/setup-migrate.js";
-import { createSettingsStore } from "./settings/settings-store.js";
 import { PlatformSecretStore } from "./secrets/platform-secret-store.js";
 import { FileEncryptedBlobStore } from "./secrets/encrypted-blob-store.js";
-import { AttachmentStore } from "./services/attachments/store.js";
-import { VoiceTranscriber } from "./services/voice/transcriber.js";
-import { DelegatedBackendInvoker, runDelegatedTaskOrphanJanitor, runProxyTempdirJanitor, } from "./services/delegated-backend-invoker.js";
-import { runSessionPoolTempdirJanitor } from "./services/delegated-task-session-pool.js";
 import { MailAccountRegistry } from "./services/mail/account-registry.js";
 import { loadOutlookClientConfig, OutlookClientConfigMissingError, } from "./services/mail/outlook/client-config.js";
 import { createRuntimeMsalApp } from "./services/mail/outlook/msal-app-factory.js";
@@ -99,15 +43,17 @@ import { parseImapAccountSecret } from "./services/mail/imap/app-password.js";
 import { ICloudImapProvider } from "./services/mail/imap/icloud-provider.js";
 import { YahooImapProvider } from "./services/mail/imap/yahoo-provider.js";
 import { GmailProvider } from "./services/mail/gmail/gmail-provider.js";
-import { MailPoller } from "./observers/mail-poller.js";
-import { MailReconciliationJob } from "./observers/mail-reconciliation.js";
 import { SecretBroker } from "./secrets/secret-broker.js";
 import { captureOriginalShellEnv, syncBackendApiKeyToEnv, } from "./secrets/backend-api-key-env.js";
 import { createLogger, toSafeErrorMessage } from "./logging.js";
 import { runCatchup, runPostMessagingCatchup, } from "./bootstrap/catchup.js";
-import { hasFreshAgentDayTodayMd, readSkillCurationCadence, } from "./bootstrap/schedule-helpers.js";
-import { createAdapterReloaders, whatsappQrResponseFromAdapter, } from "./bootstrap/adapters.js";
+import { createAdapterReloaders, } from "./bootstrap/adapters.js";
 import { createInitialSecretState, createServiceReloaders, } from "./bootstrap/services.js";
+import { initDatabase } from "./bootstrap/db.js";
+import { bootstrapAgents } from "./core/agents/loader-boot.js";
+import { createObservers } from "./bootstrap/observers.js";
+import { startApiServer } from "./bootstrap/api.js";
+import { createEventPipeline } from "./bootstrap/event-pipeline.js";
 const logger = createLogger("daemon", {
     transport: {
         target: "pino-pretty",
@@ -142,122 +88,48 @@ async function startup() {
     // ── 2. Directory structure ──
     initDirectories(config);
     // ── 3. Database ──
-    const db = createDatabase(config);
-    applySchema(db);
-    setWikiWorkspaceTokenResolver((processKey, workspaceName) => {
-        if (!processKey.startsWith("wiki."))
-            return null;
-        // Match `context-builder.ts`'s per-event lookup: prefer the named
-        // workspace, fall back to the default. Without this, multi-workspace
-        // installs would render the `<wiki_workspace>` XML against the target
-        // workspace while skill prose (`{{vault_path}}` etc.) referenced the
-        // default — the agent would then operate on the wrong vault.
-        const workspace = (workspaceName ? readWikiWorkspaceByName(db, workspaceName) : null)
-            ?? readDefaultWikiWorkspace(db);
-        if (!workspace)
-            return null;
-        return {
-            vault_path: workspace.root_path,
-            language: workspace.language,
-            workspace_name: workspace.name,
-            schema_version: String(workspace.schema_version),
-        };
+    // Schema apply + boot-time backfills + settings merge + delegated-task-mode
+    // default-correction. See `bootstrap/db.ts` for the per-step rationale.
+    const { db, settingsStore, persistedSettings, attachmentStore } = initDatabase({
+        config,
     });
-    // WIKI_BUILDER_DESIGN.md §P4.A — boot-time FTS backfill. The
-    // `fts_wiki` virtual table is content-less and lives outside the
-    // mail-style trigger chain (the source is the filesystem, not a SQL
-    // table), so a fresh DB or a workspace seeded before P4 landed needs
-    // a one-shot rebuild. Per-workspace gate inside `backfillWikiFulltext`
-    // keeps this near-free in steady state.
-    backfillWikiFulltext(db, listWikiWorkspaces(db));
-    // §12 ("managed_tasks.id collision after restore from backup") — ensure
-    // `managed_task_seq.next_id` is greater than the max existing mt id so a
-    // backup-restored DB cannot collide with the seq counter on the next
-    // POST. No-op when the table is empty (steady-state cost: one SELECT).
-    bootstrapManagedTaskSeq(db);
-    // Close any dashboard_chat sessions that were left `active` from before
-    // the daemon restart. They cannot be resumed cleanly: the SSE channel is
-    // gone, and `Dispatcher.currentSetupMode` is in-process state lost on
-    // restart, so a setup conversation half-way through would otherwise be
-    // re-adopted by `findActiveDashboardSessionId` and processed as regular
-    // chat against stale prompts. The setup wizard's resume path on the
-    // client-side checks active status; closing here flips the check so the
-    // wizard correctly falls through to a fresh /setup/start.
-    try {
-        const result = db
-            .prepare(`UPDATE conversation_sessions
-         SET status = 'closed'
-         WHERE scope = 'dashboard_chat' AND status = 'active'`)
-            .run();
-        if (result.changes > 0) {
-            logger.info({ closed: result.changes }, "Closed orphaned dashboard_chat sessions from previous run");
-        }
-    }
-    catch (err) {
-        logger.warn({ err }, "Failed to close orphaned dashboard_chat sessions");
-    }
-    // Chat attachment store — constructed early so adapter reload functions
-    // can reference it in closure without TypeScript "used before declaration" issues.
-    const attachmentStore = new AttachmentStore(db, config.dataDir);
-    attachmentStore.reapOrphans(24);
-    void new PriceFetcher(config.dataDir, db).refresh();
-    const settingsStore = createSettingsStore(db);
-    const persistedSettings = settingsStore.getAll();
-    mergeRuntimeSettingsFromDb(config, persistedSettings);
-    try {
-        seedGitProjectDocTemplates(config.dataDir, config.workspaceDir);
-    }
-    catch (err) {
-        logger.warn({ err }, "Failed to seed git project document templates");
-    }
-    // ── Default-correction for `delegatedTaskModeEnabled` ──
-    // The legacy `/integrations/:key/invoke` RPC was retired 2026-05-01
-    // and every delegated skill / task flow now goes through `/exec`,
-    // which is gated by this flag. Its Phase-1 canary default of `false`
-    // is now a footgun: any user with delegated integrations from before
-    // the runtime PATCH-time auto-enable landed will hit 503 on every
-    // /exec call.
-    //
-    // Heal once at boot, only when the operator never explicitly chose:
-    //   - `delegatedTaskModeEnabled` row is *absent* from settings (the
-    //     `in` check distinguishes "never set" from "explicitly false"),
-    //   - and at least one integration is currently in `delegated` mode.
-    //
-    // An explicit `false` row in `settings` is treated as operator intent
-    // and respected — emergency-disable still works.
-    if (!("delegatedTaskModeEnabled" in persistedSettings)
-        && !config.delegatedTaskModeEnabled) {
-        const integrationsAtBoot = readIntegrations(db);
-        const delegatedKeys = Object.entries(integrationsAtBoot)
-            .filter(([, state]) => state.mode === "delegated")
-            .map(([key]) => key);
-        if (delegatedKeys.length > 0) {
-            try {
-                settingsStore.set("delegatedTaskModeEnabled", true);
-                config.delegatedTaskModeEnabled = true;
-                logger.info({ delegatedKeys }, "auto-enabled delegatedTaskModeEnabled at startup — delegated integrations exist and the flag was never explicitly set");
-            }
-            catch (err) {
-                logger.error({ err, delegatedKeys }, "startup auto-enable of delegatedTaskModeEnabled failed; /exec calls may continue to 503 until PATCH /api/config sets the flag");
-            }
-        }
-    }
     // ── Integration Delegation Framework (Phase 1) ──
-    // Reconcile `<dataDir>/integrations.md` with the DB integrations map.
+    // Reconcile `<contextDir>/policies/integrations.md` with the DB integrations map.
     // Creates the file on first run, parses hand-edits if present, and
     // re-renders unconditionally so daemon-owned columns are canonical.
     // The watcher is started later (after the observer manager) so fs-watch
     // errors don't block boot.
     let managementMdWatcher = null;
     let managementRegistryWatcher = null;
-    try {
-        await bootstrapManagementMd(config.dataDir, db, config.workspaceDir, {
-            externalObsidianVaultPath: config.externalObsidianVaultPath,
-            externalObsidianWatch: config.externalObsidianWatch,
-        });
+    // CONTEXT_VAULT_REDESIGN V16 — when the consent gate deferred the vault
+    // restructure (Obsidian-mode user has not acknowledged the sidebar move
+    // yet), DO NOT write `policies/integrations.md` into the legacy vault.
+    // Doing so would create a stray `policies/` directory next to the
+    // legacy `rules/` / `user/` / etc., producing a mixed layout the user
+    // sees in Obsidian before they ever consented. The write resumes on
+    // the next boot after ack, where the migration runs first and the
+    // vault has a coherent post-restructure shape.
+    const vaultConsentPending = getVaultRestructurePendingConsent(db) !== null;
+    if (vaultConsentPending) {
+        logger.warn({
+            contextDir: getContextDir(config, db),
+            ackEnvVar: "PA_VAULT_RESTRUCTURE_ACK",
+        }, "Skipping integrations.md bootstrap: Obsidian-vault consent pending. Set PA_VAULT_RESTRUCTURE_ACK=1 (headless) or POST /api/setup/vault-restructure-ack (dashboard), then restart.");
     }
-    catch (err) {
-        logger.error({ err, dataDir: config.dataDir }, "integrations.md bootstrap failed; continuing with DB state");
+    else {
+        try {
+            // V18 — pass contextDir explicitly so `policies/integrations.md` lands
+            // at the right vault root in both plain and Obsidian-vault modes. The
+            // `initDirectories` step earlier created `<contextDir>/policies/`, which
+            // this bootstrap depends on existing.
+            await bootstrapManagementMd(config.dataDir, db, config.workspaceDir, {
+                externalObsidianVaultPath: config.externalObsidianVaultPath,
+                externalObsidianWatch: config.externalObsidianWatch,
+            }, getContextDir(config, db));
+        }
+        catch (err) {
+            logger.error({ err, dataDir: config.dataDir }, "integrations.md bootstrap failed; continuing with DB state");
+        }
     }
     // ── Docs corpus indexer (DOCS_QA_DESIGN.md P1) ──
     // Seeds `docs/user/` from `agent-assets/docs/` on first launch, then
@@ -277,7 +149,7 @@ async function startup() {
     }
     try {
         recordInstructionAssetStatus(db, config.workspaceDir);
-        const skillStatus = recordSkillAssetStatus(db, config.dataDir, config.workspaceDir);
+        const skillStatus = recordSkillAssetStatus(db, resolveUserSkillsRoot(config), config.workspaceDir);
         if (skillStatus.builtinShadowedUserSkills.length > 0) {
             logger.warn({ slugs: skillStatus.builtinShadowedUserSkills }, "User skills are shadowed by newly-shipped built-in skills");
         }
@@ -311,16 +183,16 @@ async function startup() {
         ensureSkeletonFiles(contextDir, config.workspaceDir);
         // ── Management Registry boot reconcile (design 21 §7.2 / P2) ──
         // Mirrors `bootstrapManagementMd` (which owns integrations.md). Reads
-        // `<contextDir>/rules/management.md` and reconciles its A-section with
-        // `settings.sot_bindings`; renders a fresh v3 file when the on-disk
-        // copy is v2 (no schema_version) or forward-incompat (>= v4). Run
-        // after `ensureSkeletonFiles` so the seeded template is the parse
-        // target on first install.
+        // `<contextDir>/policies/management.md` and reconciles its A-section with
+        // `settings.sot_bindings`; renders a fresh file when the on-disk
+        // schema_version does not match the current daemon's. Run after
+        // `ensureSkeletonFiles` so the seeded template is the parse target
+        // on first install.
         try {
             await bootstrapManagementRegistry(contextDir, db);
         }
         catch (err) {
-            logger.error({ err, contextDir }, "rules/management.md bootstrap failed; continuing with DB state");
+            logger.error({ err, contextDir }, "policies/management.md bootstrap failed; continuing with DB state");
         }
         // Release asset reconcile (future-proofing for format changes).
         // Missing templates are added, unedited versioned templates are
@@ -414,17 +286,58 @@ async function startup() {
         });
         if (Object.keys(result.errors).length > 0) {
             logger.error({ platform, ownerId, errors: result.errors }, "Failed to persist detected owner ID to .env");
-            return;
+            // Throw so the adapter's captureOwner rolls back mutableOwnerId.
+            // Without this, the adapter would silently accept owner DMs in
+            // memory while .env shows no pairing — and the next daemon restart
+            // would lose the binding. The user's matcher stays armed
+            // (cancelPairing was not called) so they can retry by resending
+            // the phrase once the underlying env-write issue is resolved.
+            const errorKeys = Object.keys(result.errors).join(", ");
+            throw new Error(`Failed to persist ${platform} owner ID to .env: ${errorKeys}`);
         }
         logger.info({ platform, ownerId }, "auto-paired owner from discovery");
-        // Greet the user so they know pairing landed. Route this through the
-        // adapter's normal owner-channel resolution path ("user") rather than
-        // assuming the captured owner identifier is itself a channel id.
+        // Greet the user so they know pairing landed. The consolidated
+        // welcome path (via sendSetupWelcomeDm / WELCOME_DM_TEXT) is preferred
+        // over emitting an inline "Pairing successful…" ack: pairing during
+        // setup would otherwise fire two greetings in quick succession.
+        //
+        // Three-way UX contract:
+        //
+        //   1. First-time pairing (no latch yet) — `sendSetupWelcomeDm` fires
+        //      the full WELCOME_DM_TEXT (includes ack + bang-command menu) and
+        //      sets the latch. No inline ack needed.
         //
-        // Why: Telegram captures a chat id, but Slack/Discord capture a user id
-        // that must be resolved to a DM channel before sending.
+        //   2. Re-pairing onto a DIFFERENT platform (latch set on a prior
+        //      platform) — the welcome path is latched globally and returns
+        //      null. Without a fallback the operator would hear nothing back
+        //      from the new platform, indistinguishable from a failed
+        //      pairing. We send a short per-platform "Pairing successful" ack
+        //      ONLY in this branch so the newly-paired platform confirms
+        //      pairing landed without re-firing the full menu.
+        //
+        //   3. Re-pairing the SAME platform — same as case 2 (welcome latched,
+        //      short ack fires). The ack is harmless even if the operator
+        //      remembers the menu from before.
+        //
+        // Best-effort throughout: env-write already succeeded so the pairing
+        // is durable; a transient send failure must NOT roll back the
+        // persisted owner ID.
         try {
-            await messageHub.sendToPlatform(platform, "user", `Pairing successful — this channel is now linked as your owner DM.`);
+            const { sendSetupWelcomeDm } = await import("./messaging/setup-welcome-dm.js");
+            const welcomeDeliveries = await sendSetupWelcomeDm({ db, messageHub });
+            if (welcomeDeliveries === null) {
+                // Latched or no eligible at the time of first run — fall back to
+                // the targeted ack so the newly-paired platform doesn't end up
+                // silent. Scoped to JUST the platform that paired (not fan-out)
+                // because the welcome ALREADY covered the other configured
+                // platforms on the original pairing event.
+                try {
+                    await messageHub.sendToPlatform(platform, "user", `Pairing successful — this channel is now linked as your owner DM.`);
+                }
+                catch (err) {
+                    logger.warn({ err, platform }, "Failed to deliver inline pairing ack (welcome was latched)");
+                }
+            }
         }
         catch (err) {
             logger.warn({ err, platform }, "Failed to deliver welcome DM after auto-pairing");
@@ -605,12 +518,15 @@ async function startup() {
                 // the normalized phrase) accepts only DMs containing it. Defeats
                 // the previous "first DM wins" race entirely because attackers
                 // who can't see the dashboard can't see the phrase.
-                const { generateMagicPhrase, buildPhraseMatcher } = await import("./messaging/magic-phrase.js");
+                const { generateMagicPhrase, buildPhraseMatcher, isPhraseWrappedInExtraText } = await import("./messaging/magic-phrase.js");
                 const phrase = generateMagicPhrase();
                 const expiresAt = Date.now() + ttlMs;
                 adapter.startPairing({
                     match: buildPhraseMatcher(phrase),
                     expiresAt,
+                    hintReply: (text) => isPhraseWrappedInExtraText(phrase, text)
+                        ? "Send the pairing phrase by itself, with no other text."
+                        : null,
                 });
                 return { phrase, expiresAt };
             },
@@ -646,12 +562,15 @@ async function startup() {
                 if (!adapter) {
                     throw new Error("Discord adapter is not initialized. Save the token and retry.");
                 }
-                const { generateMagicPhrase, buildPhraseMatcher } = await import("./messaging/magic-phrase.js");
+                const { generateMagicPhrase, buildPhraseMatcher, isPhraseWrappedInExtraText } = await import("./messaging/magic-phrase.js");
                 const phrase = generateMagicPhrase();
                 const expiresAt = Date.now() + ttlMs;
                 adapter.startPairing({
                     match: buildPhraseMatcher(phrase),
                     expiresAt,
+                    hintReply: (text) => isPhraseWrappedInExtraText(phrase, text)
+                        ? "Send the pairing phrase by itself, with no other text."
+                        : null,
                 });
                 return { phrase, expiresAt };
             },
@@ -739,22 +658,6 @@ async function startup() {
         services,
         secretState,
     });
-    // Google Maps (F-08: commute optimization)
-    {
-        const { GoogleMapsService } = await import("./services/google-maps.js");
-        const mapsService = new GoogleMapsService(secretBroker);
-        try {
-            await mapsService.init();
-            if (mapsService.available) {
-                services.googleMaps = mapsService;
-            }
-        }
-        catch (err) {
-            const msg = err.message;
-            logger.error({ error: msg }, "Google Maps service init failed, continuing without it");
-            services.errors.googleMaps = msg;
-        }
-    }
     // Obsidian
     if (config.externalObsidianVaultName) {
         const obsidianService = new ObsidianService(config);
@@ -842,13 +745,6 @@ async function startup() {
                         : null,
                 state: whatsappState,
             },
-            googleMaps: {
-                configured: services.googleMaps !== null,
-                connected: services.googleMaps !== null,
-                error: services.errors.googleMaps
-                    ? toSafeErrorMessage(services.errors.googleMaps)
-                    : null,
-            },
         };
     };
     const getMessagingStatus = () => {
@@ -880,466 +776,34 @@ async function startup() {
         }));
     };
     // ── 7. Observers ──
-    const observerManager = new ObserverManager();
-    // Mutable indirection: observers are constructed in this block, but the
-    // dispatcher (owner of `emitRoadmapRefresh`) is created later in §7.3.
-    // Pollers store this callback and only invoke it from their poll loops,
-    // which run after `observerManager.startAll()` — by then the dispatcher
-    // has been wired via the assignment in §7.3 and the indirection resolves.
+    // The §7 block (5 hot-register builders + secondary observer
+    // registrations + the entity-mirror / context-index / MCP-auto-probe /
+    // observation-summarizer chain) lives in `bootstrap/observers.ts`.
+    // Mutable indirection: observers are constructed inside the factory,
+    // but the dispatcher (owner of `emitRoadmapRefresh`) is created later
+    // in §10. Pollers store the `triggerRoadmapRefresh` callback below
+    // and only invoke it from their poll loops, which run after
+    // `observerManager.startAll()` — by then the dispatcher has been
+    // wired via the assignment in §13 and the indirection resolves.
     // ROADMAP-REDESIGN §3.4 RFC-C.
     let emitRoadmapRefreshSink = null;
     const triggerRoadmapRefresh = (source) => {
         emitRoadmapRefreshSink?.(source);
     };
-    const getNormalizedGitRepos = () => normalizeGitWatchedRepos({ gitWatchedRepos: selectGitWatchedRepos(db) });
-    // P5 multi-account — registry resolves `gitAccounts[<alias>]` to a
-    // `{GH_TOKEN, GIT_ASKPASS, ...}` env overlay each observer applies
-    // per-call. The `getAccounts` thunk reads `config.gitAccounts` lazily
-    // so a `PATCH /api/config` that mutates `config` in place via
-    // `applyConfigUpdates`'s `Object.assign(config, runtimeUpdates)`
-    // flows through to the next resolver call without re-instantiation
-    // — which is why `gitAccounts` is NOT in `RESTART_REQUIRED_KEY_TUPLE`.
-    // Per-repo PAT secrets live in the OS keychain at
-    // `git.account.<alias>` (see secret-names.ts ScopedSecretName).
-    const gitAccountRegistry = new GitAccountRegistry({
-        dataDir: config.dataDir,
-        secretBroker,
-        getAccounts: () => config.gitAccounts,
-    });
-    // One-time info note: github-side rows without a local clone always
-    // poll under the default `gh` profile when the row's `github_account`
-    // is null. Surface this if both `gitAccounts` and github-only rows
-    // exist so a user staring at unaccounted-for traffic from "the wrong
-    // account" sees it in `aitne logs` rather than guessing.
-    const githubOnlyRows = selectGithubRepoSlugs(db).length;
-    if (Object.keys(config.gitAccounts ?? {}).length > 0
-        && githubOnlyRows > 0) {
-        logger.info({
-            gitAccounts: Object.keys(config.gitAccounts).length,
-            githubRepos: githubOnlyRows,
-        }, "GitHub-side repository rows fall back to the default gh profile when github_account is unset. Set the row's account alias from /api/repositories or the dashboard.");
-    }
-    const lookupRepoAlias = (repoPath, fullName) => {
-        const repos = getNormalizedGitRepos();
-        if (repoPath) {
-            const byPath = repos.find((r) => r.path === repoPath);
-            if (byPath?.accountAlias)
-                return byPath.accountAlias;
-        }
-        if (fullName) {
-            const byOrgRepo = repos.find((r) => {
-                if (!r.org)
-                    return false;
-                // Repos resolved from `githubRepos` (not local paths) match by full name.
-                return fullName.toLowerCase() === `${r.org}/${r.slug}`.toLowerCase();
-            });
-            if (byOrgRepo?.accountAlias)
-                return byOrgRepo.accountAlias;
-        }
-        return undefined;
-    };
-    const queueGitProjectInitsForCurrentConfig = (source) => {
-        if (!isSetupCompleted(db) || readDegradedMode(db))
-            return;
-        const repos = getNormalizedGitRepos();
-        if (repos.length === 0)
-            return;
-        try {
-            const inserted = queueMissingGitProjectInits({
-                db,
-                contextDir: getContextDir(config, db),
-                dataDir: config.dataDir,
-                workspaceDir: config.workspaceDir,
-                repos,
-            });
-            if (inserted > 0) {
-                logger.info({ inserted, source }, "Queued missing git project documentation init tasks");
-            }
-        }
-        catch (err) {
-            logger.warn({ err, source }, "Failed to queue git project documentation init tasks");
-        }
-    };
-    const gitWatchedRepos = getNormalizedGitRepos();
-    const gitRepoPaths = gitWatchedRepos.map((repo) => repo.path);
-    let gitWatcher = null;
-    const buildGitWatcher = () => {
-        if (gitRepoPaths.length === 0)
-            return null;
-        // Per-row poll cadence (unified-repositories §5). Sourced from each
-        // row's `poll_interval_sec` column; rows with null fall through to
-        // the global `gitPollIntervalSeconds`.
-        const repoIntervals = new Map(gitWatchedRepos.map((row) => [row.path, row.pollIntervalSec ?? null]));
-        const watcher = new GitWatcher(gitRepoPaths, db, config.gitPollIntervalSeconds, {
-            eventBus,
-            pushOverdueMinutes: config.gitPushOverdueMinutes,
-            repoIntervals,
-            repoEnvResolver: async (repoPath) => {
-                const alias = lookupRepoAlias(repoPath);
-                if (!alias)
-                    return undefined;
-                return (await gitAccountRegistry.buildSpawnEnv(alias)) ?? undefined;
-            },
-            onRepoBaseline: (repoPath) => {
-                const repo = getNormalizedGitRepos().find((item) => item.path === repoPath);
-                if (!repo)
-                    return;
-                queueGitProjectInitsForCurrentConfig("git-baseline");
-            },
-            onLifecycleObservation: (classification) => {
-                if (!isSetupCompleted(db) || readDegradedMode(db))
-                    return;
-                const repoPath = typeof classification.payload.repoPath === "string"
-                    ? classification.payload.repoPath
-                    : classification.source.replace(/^git:/, "");
-                const repo = getNormalizedGitRepos().find((item) => item.path === repoPath);
-                if (!repo)
-                    return;
-                const result = queueGitProjectUpdate({
-                    db,
-                    dataDir: config.dataDir,
-                    workspaceDir: config.workspaceDir,
-                    repo,
-                    event: classification,
-                    debounceMinutes: config.gitProjectUpdateDebounceMinutes,
-                });
-                if (result === "queued" || result === "merged") {
-                    logger.info({
-                        repo: repo.path,
-                        eventType: classification.eventType,
-                        result,
-                    }, "Queued git project documentation update");
-                }
-                // Unified-repositories §4.4 — fire any per-repo triggers
-                // configured for this lifecycle event. Triggers ride alongside
-                // the task-flow pipeline above; they do not consume the event.
-                const repositoryRow = getRepositoryByLocalPath(db, repoPath);
-                if (repositoryRow) {
-                    void dispatchMatchingTriggers({ db, eventBus }, repositoryRow.id, classification.eventType, classification.payload);
-                }
-            },
-        });
-        gitWatcher = watcher;
-        return watcher;
-    };
-    if (shouldStartObserversFor(db, "git")) {
-        const watcher = buildGitWatcher();
-        if (watcher)
-            observerManager.register(watcher);
-    }
-    // GitHubPoller — daemon-side notification + workflow_run polling via the
-    // user's `gh auth login` keychain entry. Replaces the webhook receiver
-    // for local-first installs where exposing a public URL is impractical.
-    // Registered only while github.mode === "direct" now that GitHub is a
-    // first-class integration. Direct remains the default, preserving the
-    // historical "notifications on when gh is authenticated" behaviour.
-    const buildGithubPoller = () => {
-        // Per-row poll cadence (unified-repositories §5). The map is keyed by
-        // `owner/repo` to match `RepoBinding.fullName`; rows are sourced from
-        // the unified table. Local-only rows have no `owner/repo` and fall
-        // out of the map naturally.
-        const repoIntervals = new Map();
-        for (const row of listRepositories(db, { hasGithub: true })) {
-            if (row.githubOwner && row.githubRepo) {
-                repoIntervals.set(`${row.githubOwner}/${row.githubRepo}`, row.pollIntervalSec ?? null);
-            }
-        }
-        return new GitHubPoller({
-            db,
-            eventBus,
-            repoPaths: gitRepoPaths,
-            repoFullNames: selectGithubRepoSlugs(db),
-            pollIntervalSeconds: config.githubPollIntervalSeconds,
-            repoIntervals,
-            repoAccountAliasResolver: ({ localPath, fullName }) => lookupRepoAlias(localPath, fullName),
-            accountResolver: async (binding) => {
-                if (!binding.accountAlias)
-                    return undefined;
-                return ((await gitAccountRegistry.buildSpawnEnv(binding.accountAlias)) ?? undefined);
-            },
-            // Unified-repositories §4.4 — resolve the binding's owner/repo to a
-            // repositories.id and fire any per-repo triggers configured for
-            // this event type. Failures are logged inside dispatch and do not
-            // bubble out so a misconfigured trigger cannot stall the poll loop.
-            onTriggerableEvent: async (event) => {
-                if (!isSetupCompleted(db) || readDegradedMode(db))
-                    return;
-                let repoRow = null;
-                if (event.binding) {
-                    repoRow = getRepositoryByGithub(db, event.binding.owner, event.binding.repo);
-                }
-                if (!repoRow) {
-                    // Notifications without a `directNotificationRepos` match still
-                    // arrive here when a `repository.full_name` is in the payload.
-                    const fullName = typeof event.payload.repository === "string"
-                        ? event.payload.repository
-                        : null;
-                    if (fullName) {
-                        const [owner, repo] = fullName.split("/");
-                        if (owner && repo) {
-                            repoRow = getRepositoryByGithub(db, owner, repo);
-                        }
-                    }
-                }
-                if (!repoRow)
-                    return;
-                await dispatchMatchingTriggers({ db, eventBus }, repoRow.id, event.eventType, event.payload);
-            },
-        });
-    };
-    if (shouldStartObserversFor(db, "github")) {
-        observerManager.register(buildGithubPoller());
-    }
-    // Each call returns a fresh observer so the integration-lifecycle helper
-    // re-registers a new instance after a mode flip — picking up any
-    // gitPollIntervalSeconds / gitPushOverdueMinutes / hourlyCheckEnabled
-    // PATCH that landed while the cron was idle.
-    const buildGitDelegatedCronObserver = () => new GitDelegatedCronObserver({
-        db,
-        eventBus,
-        repoPaths: gitRepoPaths,
-        githubRepos: selectGithubRepoSlugs(db),
-        cadenceSeconds: config.gitPollIntervalSeconds,
-        pushOverdueMinutes: config.gitPushOverdueMinutes,
-        hourlyCheckEnabled: config.hourlyCheckEnabled,
-    });
-    if (hasActiveDelegatedGitLifecycleIntegration(db)) {
-        observerManager.register(buildGitDelegatedCronObserver());
-    }
-    // Unified-repositories daily management cron — see
-    // docs/design/appendices/unified-repositories.md §4.5. Iterates rows
-    // whose `repository_management.enabled = 1` and writes the required
-    // journal/overview markdown for each row that's due.
-    observerManager.register(new RepositoryManagementCron({
+    const observers = await createObservers({
         db,
+        config,
         eventBus,
-        contextDir: () => getContextDir(config, db),
-        timezone: config.timezone || undefined,
-        writeTracker,
-    }));
-    // Coexistence note: the legacy /webhook/github handler also calls
-    // recordObservation + EventBus.put, so a user with both webhooks AND
-    // the poller live will receive two events per `review_requested`. This
-    // is a low-probability scenario (webhooks need a public URL most users
-    // don't expose), so we log a one-time warning rather than disabling
-    // either path automatically.
-    if (secretState.githubWebhookConfigured && shouldStartObserversFor(db, "github")) {
-        logger.warn("GitHub webhook secret configured AND GitHubPoller running — "
-            + "duplicate events possible. Remove the webhook secret or unregister "
-            + "the GitHub webhook on github.com to silence.");
-    }
-    // SETUP-FLOW-REDESIGN-PLAN §6.3 — `externalObsidianWatch` is a kill
-    // switch for the external-vault branch of the watcher. When false the
-    // path is preserved (the Obsidian CLI skill still sees it via
-    // `config.externalObsidianVaultPath`) but no chokidar instance is
-    // registered. Sized for power users with very large vaults that would
-    // otherwise produce noisy observation churn (§13 open question).
-    if (config.externalObsidianVaultPath && config.externalObsidianWatch) {
-        observerManager.register(new ObsidianWatcher(config.externalObsidianVaultPath, db, config.obsidianDebounceSeconds, writeTracker, { source: "obsidian:external", name: "obsidian:external" }));
-    }
-    // Primary-vault watcher — registered unconditionally. Stays dormant
-    // until `setVaultPath` points it at a real directory. The migration
-    // endpoint's `onPrimaryVaultPathChange` callback calls setVaultPath
-    // explicitly after every commit, so plain → obsidian transitions
-    // and obsidian-path changes both re-target without dynamic
-    // register/unregister plumbing.
-    const primaryVaultWatcher = new PrimaryVaultWatcher(db, config.obsidianDebounceSeconds, writeTracker);
-    await primaryVaultWatcher.setVaultPath(config.vaultMode === "obsidian" ? config.primaryVaultPath : null);
-    observerManager.register(primaryVaultWatcher);
-    // Build CalendarPoller from current services. Returns null when
-    // `services.calendar` is unavailable so the integration-lifecycle
-    // module can no-op (for example: integration flips to direct before
-    // OAuth is set up). The §4.5.1 gate `google_calendar.mode === "direct"`
-    // is checked BEFORE invoking the builder.
-    const buildCalendarPoller = () => {
-        if (!services.calendar)
-            return null;
-        return new CalendarPoller(services.calendar, db, config.calendarPollIntervalSeconds, config.googleCalendarId, writeTracker, triggerRoadmapRefresh, morningRoutineLock, config.timezone);
-    };
-    if (services.calendar && shouldStartObserversFor(db, "google_calendar")) {
-        const poller = buildCalendarPoller();
-        if (poller)
-            observerManager.register(poller);
-    }
-    observerManager.register(new ImminentEventScheduler(db, eventBus, config.googleCalendarId));
-    // Build NotionPoller from current services + config. Returns null when
-    // `services.notion` is unavailable or no databases are configured so
-    // the integration-lifecycle module can no-op (e.g. integration flips
-    // to direct before the API key is set up). The §4.5.1 gate
-    // `notion.mode === "direct"` is checked BEFORE invoking the builder.
-    const buildNotionPoller = () => {
-        if (!services.notion)
-            return null;
-        if (Object.keys(config.notionDatabaseIds).length === 0)
-            return null;
-        return new NotionPoller({
-            notionService: services.notion,
-            databaseIds: config.notionDatabaseIds,
-            pollIntervalSeconds: config.notionPollIntervalSeconds,
-            db,
-            writeTracker,
-        });
-    };
-    if (services.notion
-        && Object.keys(config.notionDatabaseIds).length > 0
-        && shouldStartObserversFor(db, "notion")) {
-        const poller = buildNotionPoller();
-        if (poller)
-            observerManager.register(poller);
-    }
-    if (services.mail) {
-        observerManager.register(new MailPoller({
-            registry: services.mail,
-            db,
-            writeTracker,
-            pollIntervalSeconds: config.mailPollIntervalSeconds,
-            maxMessagesPerPoll: config.mailMaxMessagesPerPoll,
-            authFailureRetryHours: config.mailAuthFailureRetryHours,
-            providerPollIntervalsSeconds: {
-                gmail: config.gmailPollIntervalSeconds,
-            },
-            notifyOwner: async (message) => {
-                await messageHub.sendToUser(message);
-            },
-            triggerRoadmapRefresh,
-        }));
-        observerManager.register(new MailReconciliationJob({
-            registry: services.mail,
-            db,
-        }));
-    }
-    // ── 7.04 Skill-curation observers (P22 — appendix p22-skill-self-optimization.md) ──
-    // Hourly walker accumulates `structure_diff` signals for the curation
-    // cohort. Outcomes/feedback collection was dropped from the Preview scope
-    // — the feature optimizes silently in the background, no metrics surface.
-    {
-        const { SkillCurationWalker } = await import("./observers/skill-curation-walker.js");
-        observerManager.register(new SkillCurationWalker(db, getContextDir(config), join(config.workspaceDir, "agent-assets", "skills"), config.dataDir));
-        // §5.4 — boot-time orphan-overlay scan. Emits one log line per orphan
-        // and seeds `runtime_state.skill_curation.orphan_overlays` so the
-        // dashboard banner can read it without re-walking the FS.
-        try {
-            const { scanAndRecordOrphanOverlays } = await import("./core/skill-curation/orphan-overlay.js");
-            scanAndRecordOrphanOverlays(db, config.dataDir, join(config.workspaceDir, "agent-assets", "skills"));
-        }
-        catch (err) {
-            logger.warn({ err }, "Skill-curation orphan-overlay scan failed at boot");
-        }
-    }
-    // ── 7.05 Context-index reconciler (B-004 Phase 2a) ──
-    // Keeps `context/context-index.md` in sync with the filesystem so the
-    // per-flow review-context loader can treat the index as authoritative.
-    // Combines: startup one-shot (30 s after boot), internal chokidar
-    // watcher on contextDir (10 s debounce), cron nightly (wired via
-    // `AgentScheduler.setContextIndexReconcilerCallback`), and API-route
-    // hints via `onIndexableContextChange` below.
-    let contextIndexReconcilerPromptSink = null;
-    const contextIndexReconciler = new ContextIndexReconcilerObserver({
-        db,
-        contextDir: getContextDir(config),
+        secretBroker,
+        services,
         writeTracker,
-        onPromptContextChanged: (path, reason, tier, metadata) => {
-            // The reconciler writes one path (`context-index.md`) — route the
-            // prompt-cache invalidation through the same handler every other
-            // context write uses. The real handler is installed in §11
-            // (`onPromptContextChanged` ApiDependency); this indirection lets
-            // the observer start at §7 before the handler exists.
-            contextIndexReconcilerPromptSink?.(path, reason, tier, metadata);
-        },
+        blobStore,
+        messageHub,
         morningRoutineLock,
-        timezone: config.timezone || undefined,
+        secretState,
+        triggerRoadmapRefresh,
     });
-    observerManager.register(contextIndexReconciler);
-    // docs/design/21-management-registry-and-entities.md §7.6 P5 —
-    // entity-mirror watcher. Owns its own chokidar watcher (independent
-    // of the context-index reconciler's debounce path) so single-file
-    // L2 writes converge into the SQLite mirror within NFR-9's 500 ms
-    // budget — the §7.6 lookup contract relies on this freshness at
-    // scheduled-task fire time. Boot pass + watcher lifecycle handled
-    // by the observer wrapper.
-    //
-    // §7.2 chain — fan an L2 entity delta out to the context-index
-    // observer's `requestReconcile` so the rendered domain-index +
-    // activity-view files refresh on the same 10 s debounce as other
-    // fs_event triggers. Without this, those views only converged on
-    // the nightly cron + 30 s startup pass because `shouldIndexPath`
-    // filters L2 paths out of the context-index's own watcher
-    // (followups item 7).
-    observerManager.register(new EntityMirrorObserver({
-        db,
-        contextDir: getContextDir(config),
-        writeTracker,
-        onEntityChanged: () => contextIndexReconciler.requestReconcile("fs_event"),
-    }));
-    // ── 7.1 MCP auto-probe (B-003 Phase 4.3) ──
-    // Walks enabled mcp_servers rows every `mcpAutoProbeIntervalMinutes` and
-    // re-runs the probe sandbox. Set the interval to 0 to disable. The
-    // observer never flips `enabled` on its own — failure surfaces through
-    // the dashboard card's status dot, user decides whether to disable.
-    {
-        const { McpAutoProbe } = await import("./services/mcp/auto-probe.js");
-        observerManager.register(new McpAutoProbe({
-            db,
-            blobStore,
-            dataDir: config.dataDir,
-            intervalMinutes: config.mcpAutoProbeIntervalMinutes,
-        }));
-    }
-    // ── 7.2 Observation summarizer (cost-reduction-structural §A) ──
-    // Drains pending observation rows asynchronously: pre-filter → per-
-    // source LLM call → `summary_text` + `novelty_score` written back to
-    // the row. The hourly_check skill consumes summaries instead of
-    // re-fetching raw content. Disabled cleanly via
-    // `observationSummarizerEnabled` — when off, observations stay
-    // pending and the skill drops to legacy fetch-on-doubt.
-    if (config.observationSummarizerEnabled) {
-        const summarizerBinding = (() => {
-            try {
-                const row = db
-                    .prepare(`SELECT main_backend, main_model FROM process_backend_config WHERE process_key = 'observation.summarize'`)
-                    .get();
-                if (!row?.main_backend || !row.main_model)
-                    return null;
-                return { backendId: row.main_backend, modelId: row.main_model };
-            }
-            catch (err) {
-                logger.debug({ err }, "Failed to read observation.summarize binding; using fallback");
-                return null;
-            }
-        })();
-        const summarizerClient = (() => {
-            const fallbackBackend = summarizerBinding?.backendId ?? "claude";
-            const fallbackModel = summarizerBinding?.modelId ?? "claude-haiku-4-5-20251001";
-            if (fallbackBackend === "claude") {
-                return new AnthropicSummarizerClient({
-                    modelId: fallbackModel,
-                    getApiKey: async () => {
-                        const direct = await secretBroker.getBackendApiKey("claude");
-                        if (direct)
-                            return direct;
-                        // Fall back to env (matches the daemon's API-key bridging policy).
-                        return process.env.ANTHROPIC_API_KEY ?? null;
-                    },
-                });
-            }
-            // Codex / Gemini summarizer support is not yet implemented; the
-            // worker translates `unsupported_backend` into a 'skipped' row so
-            // the hourly_check skill drops to its legacy fetch path.
-            return new UnsupportedSummarizerClient(fallbackBackend, fallbackModel);
-        })();
-        observerManager.register(new ObservationSummarizerWorker({
-            db,
-            client: summarizerClient,
-            concurrency: config.observationSummarizerConcurrency,
-            perCallTimeoutMs: config.observationSummarizerTimeoutMs,
-            maxLlmCallsPerMinute: config.observationSummarizerMaxCallsPerMinute,
-            queueDepthLimit: config.observationSummarizerQueueLimit,
-            preFilter: { vipMailSenders: config.vipMailSenders },
-        }));
-    }
-    else {
-        logger.info("Observation summarizer disabled — pending rows stay pending");
-    }
+    const { observerManager, primaryVaultWatcher, contextIndexReconciler, gitAccountRegistry, buildGitWatcher, buildGithubPoller, buildGitDelegatedCronObserver, buildCalendarPoller, buildNotionPoller, queueGitProjectInitsForCurrentConfig, } = observers;
     // ── 8. Health Monitor ──
     const healthMonitor = new HealthMonitor({
         db,
@@ -1356,7 +820,7 @@ async function startup() {
     // ── 9. Scheduler ──
     const scheduler = new AgentScheduler(eventBus, db, config);
     // ── 9.1 Custom routine scheduler (B-007 §5.8) ──
-    // Reads `routines/custom/*.md` from the context dir and registers a
+    // Reads `policies/routines/custom/*.md` from the context dir and registers a
     // cron job per enabled routine. Reloaded from the context API whenever
     // the agent or dashboard edits a file under that directory.
     const customRoutineScheduler = new CustomRoutineScheduler({
@@ -1364,613 +828,140 @@ async function startup() {
         eventBus,
         timezone: config.timezone || undefined,
     });
-    // ── 9.5 Signal Detector ──
-    const signalDetector = new SignalDetector(config);
     // ── 10. Event Processing Pipeline ──
-    const agentCore = new ClaudeCodeCore(config, writeTracker);
-    const codexCore = new CodexCore(config);
-    const geminiCore = new GeminiCliCore(config, writeTracker, undefined, db);
-    // B-003 Phase 3 — wire the MCP session context so per-session workdirs pick
-    // up the current DB + keychain state at spawn time. Each core stays
-    // backward-compatible: without this call it simply runs without MCP.
-    const mcpContext = { db, blobStore };
-    agentCore.setMcpContext(mcpContext);
-    codexCore.setMcpContext(mcpContext);
-    geminiCore.setMcpContext(mcpContext);
-    // DELEGATED-PROXY-API-DESIGN.md Phase A — boot janitor sweeps stale
-    // `agent-sessions/proxy-*` tempdirs left by SIGKILL'd proxy invocations,
-    // then construct the invoker so /api/mail/* and /api/calendar/* route
-    // handlers can dispatch through it once Phase B wires the route shims.
-    const janitorRemoved = runProxyTempdirJanitor(config.dataDir);
-    if (janitorRemoved > 0) {
-        logger.info({ removed: janitorRemoved }, "Boot janitor cleared stale delegated-proxy tempdirs");
-    }
-    const poolJanitorRemoved = runSessionPoolTempdirJanitor(join(config.dataDir, "agent-sessions"));
-    if (poolJanitorRemoved > 0) {
-        logger.info({ removed: poolJanitorRemoved }, "Boot janitor cleared stale delegated-task pool tempdirs");
-    }
-    // DELEGATED-TASK-MODE-DESIGN.md §11.1 — close `delegated_task.exec`
-    // rows that were `in_progress` when the daemon last crashed. Without
-    // this, the dashboard's in-flight counter and audit views drift forever.
-    const taskOrphansClosed = runDelegatedTaskOrphanJanitor(db);
-    if (taskOrphansClosed > 0) {
-        logger.info({ closed: taskOrphansClosed }, "Boot janitor closed orphaned delegated_task in-progress rows");
-    }
-    const delegatedBackendInvoker = new DelegatedBackendInvoker({
+    // §9.5 SignalDetector + §10 event-processing pipeline (agent cores,
+    // BackendRouter, dispatcher + setters, NotificationManager,
+    // AuthHealthMonitor + recovery, DelegatedBackendInvoker / sync worker,
+    // VoiceTranscriber, DocsQAAdapter, rematerializeActiveDmWorkdirs,
+    // handleSecretChange, handleGoogleServicesReady) live in
+    // `bootstrap/event-pipeline.ts`. The factory closes over the existing
+    // adapter + service reloaders and observer builders so secret-change
+    // hot-reload routing remains a single dispatch table.
+    //
+    // The factory also installs the real `onMailScopeChanged` handler and
+    // the roadmap-refresh sink via the setter callbacks below — both are
+    // forward-references kept open by `let` slots above (mail) and at the
+    // observers factory call (roadmap).
+    // Declared BEFORE the event-pipeline factory call so the
+    // `isStartupComplete` getter passed below closes over the live latch.
+    // The latch flips to `true` at the end of §13 once every subsystem is
+    // started; until then `handleSecretChange("notion")` defers calling
+    // `poller.start()` to avoid double-starting the timer that
+    // `observerManager.startAll()` is about to start (see the matching
+    // comment in event-pipeline.ts:SecretChangeHandlerDeps).
+    let startupComplete = false;
+    let pendingGoogleServicesReady = false;
+    const eventPipeline = await createEventPipeline({
         db,
         config,
-        cores: { claude: agentCore, codex: codexCore, gemini: geminiCore },
-    });
-    let delegatedSyncWorker = null;
-    const buildDelegatedSyncWorker = () => {
-        if (!delegatedSyncWorker) {
-            delegatedSyncWorker = new DelegatedSyncWorker({
-                db,
-                invoker: delegatedBackendInvoker,
-                calendarId: config.googleCalendarId,
-                timezone: config.timezone,
-                todayWriteLock: morningRoutineLock,
-                triggerRoadmapRefresh,
-            });
-        }
-        return delegatedSyncWorker;
-    };
-    if (hasActiveDelegatedSyncIntegration(db)) {
-        observerManager.register(buildDelegatedSyncWorker());
-    }
-    // ── Delegated probe observer (DELEGATED-MODE-V2 §7.1) ──
-    // Hourly re-probe of delegated integrations' connector tools so the
-    // `integration_probes` cache reflects current sign-in state. Without
-    // this, `consultDelegatedConnectorHealth` (§4.5) has no signal to fire
-    // on after the wizard's first probe — the §10 "user signed out hours
-    // ago" risk row would stay silent.
-    //
-    // Registered here (mid-§10) rather than in §7 because it depends on the
-    // three agent cores constructed at the top of this section. The
-    // observerManager.startAll() call further down picks it up unchanged.
-    {
-        const { DelegatedProbeObserver } = await import("./observers/delegated-probe-observer.js");
-        observerManager.register(new DelegatedProbeObserver({
-            db,
-            agentBackends: [agentCore, codexCore, geminiCore],
-            intervalMinutes: config.delegatedProbeIntervalMinutes,
-        }));
-    }
-    const notificationManager = new NotificationManager(messageHub, db, config);
-    const authTelemetry = new AuthTelemetry(db);
-    // Shared notifier factory for auth-health-monitor and auth-recovery (D3 fix).
-    // Maps `kind` to notification_type + category so both callers share the
-    // same routing / quiet-hours-bypass logic without duplicating 30+ lines.
-    //
-    // Probe-failure and recovery DMs bypass NotificationManager's own quiet-hours
-    // + rate-limit gates via `category: "error"` (SAFETY_CATEGORIES member).
-    // Keepalive DMs stay on the standard path. See Phase 4 self-critique B2 for
-    // the anti-spam reasoning (clock-driven, ≤1 DM per cron tick).
-    const makeAuthNotifier = (source) => ({
-        send: async (message, options) => {
-            const kind = options?.kind ?? "keepalive";
-            const typeMap = {
-                probe_failure: "auth.probe_failure",
-                recovery: "auth.recovery",
-                keepalive: "auth.keepalive_reminder",
-            };
-            const notificationType = typeMap[kind] ?? "auth.keepalive_reminder";
-            // probe_failure and recovery bypass quiet-hours; keepalive does not.
-            const category = kind === "keepalive" ? "auth-health" : AUTH_PROBE_NOTIFICATION_CATEGORY;
-            await notificationManager.send(message, {
-                type: notificationType,
-                source,
-                priority: EventPriority.NORMAL,
-                timestamp: new Date(),
-                data: {},
-                correlationId: randomBytes(8).toString("hex"),
-            }, {
-                priority: "normal",
-                category,
-                destinationMode: "configured_only",
-            });
+        eventBus,
+        secretBroker,
+        blobStore,
+        writeTracker,
+        services,
+        messageHub,
+        dashboardAdapter,
+        attachmentStore,
+        morningRoutineLock,
+        roadmapWriteLock,
+        secretState,
+        observerManager,
+        buildCalendarPoller,
+        buildNotionPoller,
+        getGitWatcher: observers.getGitWatcher,
+        reloadDiscordAdapter,
+        reloadSlackAdapter,
+        reloadTelegramAdapter,
+        reloadGoogleServices,
+        reloadAppleCalendarService,
+        reloadNotionService,
+        reloadGitHubService,
+        scheduler,
+        isStartupComplete: () => startupComplete,
+        setMailScopeChangedHandler: (cb) => {
+            onMailScopeChanged = cb;
+        },
+        setRoadmapRefreshSink: (cb) => {
+            emitRoadmapRefreshSink = cb;
         },
     });
-    const authHealthMonitor = new AuthHealthMonitor(db, {
-        claude: agentCore,
-        codex: codexCore,
-        gemini: geminiCore,
-    }, authTelemetry, {
-        notifier: makeAuthNotifier("auth-health-monitor"),
-        // Forward references — these gate closures are registered here
-        // but only fire once `scheduler.start()` ticks the hourly cron,
-        // by which time `dispatcher` is fully constructed (see the
-        // declaration further down in this file). Calling any of these
-        // before then would hit TDZ; in practice the constructor and
-        // `reconcilePendingRecoveries` / `runKeepaliveSweep` never do.
-        isMorningRoutineActive: () => dispatcher.isMorningRoutineActive(),
-        isQuietHours: () => notificationManager.isQuietHours(),
-        probeDisabled: () => config.authProbeDisabled,
-    });
-    // Reset any recoveries that were in-flight when the daemon was last killed.
-    const recovered = authHealthMonitor.reconcilePendingRecoveries();
-    if (recovered > 0) {
-        logger.info({ count: recovered }, "Reconciled stuck auth recoveries on startup");
-    }
-    // Run the 60-day keepalive sweep once on startup. Hourly probe is
-    // registered via scheduler.setAuthProbeCallback — see §9.5.4.
-    void authHealthMonitor.runKeepaliveSweep().catch((err) => {
-        logger.warn({ err }, "Initial auth keepalive sweep failed");
-    });
-    const keepaliveTimer = setInterval(() => {
-        void authHealthMonitor.runKeepaliveSweep().catch((err) => {
-            logger.warn({ err }, "Periodic auth keepalive sweep failed");
-        });
-    }, 24 * 60 * 60 * 1000);
-    keepaliveTimer.unref?.();
-    // Phase 5/6: Interactive auth recovery manager. Uses the same notifier
-    // sink as the AuthHealthMonitor so recovery DMs flow through the same
-    // notification pipeline with the same anti-spam guarantees.
-    const authRecovery = new AuthRecovery(db, authTelemetry, authHealthMonitor, makeAuthNotifier("auth-recovery"), {
-        claudeRecoveryTimeoutMin: 10,
-        codexRecoveryTimeoutMin: 15,
-        geminiRecoveryTimeoutMin: 5,
-    });
-    // ── Scoped read tokens for ReadSensitive API endpoints ──
-    // Tokens rotate per session/workdir execution and are only injected into
-    // backend subprocess env, never into prompt-visible instruction files.
-    const readTokenManager = new ScopedReadSensitiveTokenManager();
-    const agentRouter = new BackendRouter(db, config, [agentCore, codexCore, geminiCore], notificationManager, authTelemetry, 
-    // Callback to materialize instruction files for a fallback backend in an
-    // existing session workdir. Without this, a Claude→Codex heavy-tier
-    // fallback would leave the dir with only CLAUDE.md and no AGENTS.md.
-    // After materializing built-in files, re-sync user-authored skills so
-    // the newly created backend-specific dir (e.g. .codex/skills/) also
-    // receives user skills. The dispatcher's syncAllUserSkills ran BEFORE
-    // router.execute(), so the fallback dir didn't exist at that point.
-    (sessionDir, backendId, eventType, processKey, wikiWorkspaceName) => {
-        // services is the mutable ServiceRegistry — reading .calendar here
-        // picks up the current availability (e.g. after mid-flight OAuth).
-        // GitHub presence is read fresh from the unified `repositories` table
-        // (rows with a github side); legacy `githubRepos` config is gone.
-        const cfgServices = buildConfiguredServices(config, {
-            ...services,
-            github: selectGithubRepoSlugs(db).length > 0,
-        });
-        const mailAccounts = services.mail?.listActiveAccounts() ?? [];
-        ensureBackendMaterialized(config.workspaceDir, sessionDir, backendId, eventType, processKey, cfgServices, mailAccounts, readIntegrations(db), config.character, wikiWorkspaceName);
-        syncAllUserSkills(sessionDir, join(config.dataDir, "skills"));
-    });
-    // Startup validation — warn if any delegated-mode variant files are
-    // missing. Now checks both skill and task-flow variants for every
-    // currently-delegated integration against its configured `delegatedBackend`
-    // (not the union of all possible backends — see validateDelegatedStartup
-    // docstring). Never throws; the PATCH route + /health do the hard-
-    // rejection and user-surfacing downstream.
-    {
-        const startupIntegrations = readIntegrations(db);
-        const missing = validateDelegatedStartup(config.workspaceDir, startupIntegrations);
-        if (missing.skills.length > 0 || missing.taskFlows.length > 0) {
-            logger.warn({ missingSkills: missing.skills, missingTaskFlows: missing.taskFlows }, "Delegated-mode variant files missing — agent will fall back to SKILL.md / direct task-flow for affected entries; surface in /health.integrationModes");
-        }
-    }
-    const contextBuilder = new ContextBuilder(config, db, services);
-    // Task flows are simple code constants — no file system, no hot-reload needed
-    const sessionManager = new SessionManager(db, config);
-    const messageRecorder = new MessageRecorder(db);
-    const eventBroadcaster = new EventBroadcaster();
-    const auditLogger = new AuditLogger(db, {
-        // `/api/events/stream` is defined in terms of persisted agent_actions rows,
-        // not raw EventBus payloads, so the broadcaster subscribes at the audit layer.
-        onRowInserted: (row) => eventBroadcaster.broadcastEvent(row),
-    });
-    // Shared body for "something changed that affects what's baked into
-    // active DM workdirs — refresh them in place." Used by:
-    //   - `onMailScopeChanged` (MailAccountRegistry scope-change hook)
-    //   - the integration-mode lifecycle (DELEGATED-PROXY-API-DESIGN.md
-    //     Phase F §4.8 — every mode flip re-materializes so the unified
-    //     skill body and per-backend instruction file reflect the new
-    //     state on the next turn without tearing down the SDK session)
-    //
-    // Returns null when there's no active DM session to refresh; otherwise
-    // the per-session summary so callers can attach it to a broadcast or
-    // structured log. Per-session failures stay inside the helper.
-    const rematerializeActiveDmWorkdirs = (reason) => {
-        const sessions = sessionManager.listActiveDmSessions();
-        if (sessions.length === 0) {
-            logger.debug({ reason }, "DM workdir refresh requested — no active DM sessions");
-            return null;
-        }
-        const cfgServices = buildConfiguredServices(config, {
-            ...services,
-            github: selectGithubRepoSlugs(db).length > 0,
-        });
-        const mailAccounts = services.mail?.listActiveAccounts() ?? [];
-        // Read integration state fresh inside the closure so a Phase F mode
-        // flip's pre-`writeIntegrations` row is not what gets baked. The
-        // `SkillsCompiler` uses this for variant resolution (non-proxy
-        // integrations like Notion need `SKILL.delegated.<backend>.md`) and
-        // to re-emit `applyAllDeniedToolsForSkill` soft-deny prose. Passing
-        // an empty object would silently regress to the latent staleness bug
-        // that Phase F surfaced.
-        const integrations = readIntegrations(db);
-        const summary = refreshDmSessionWorkdirs({
-            projectRoot: config.workspaceDir,
-            dataDir: config.dataDir,
-            sessions,
-            configuredServices: cfgServices,
-            mailAccounts,
-            integrations,
-            character: config.character,
-        });
-        return { summary, mailAccounts };
-    };
-    // Real implementation of the mail-scope-changed hook. Wired by the
-    // MailAccountRegistry constructor above through a forward-reference so the
-    // registry can be built before sessionManager / eventBroadcaster exist.
-    // Re-materializes every active DM session workdir so `accounts.md` and the
-    // `external-services` skill reflect the new scope on the next turn without
-    // tearing down the SDK session.
-    onMailScopeChanged = (reason) => {
-        const result = rematerializeActiveDmWorkdirs(reason);
-        if (!result)
-            return;
-        logger.info({ reason, ...result.summary }, "Mail scope changed — DM session workdirs re-materialized");
-        eventBroadcaster.broadcastEvent({
-            kind: "mail_scope_changed",
-            reason,
-            activeAccounts: result.mailAccounts.length,
-            ...result.summary,
-        });
-    };
-    // Management Mode Phase 2 — shared migration primitives. Long timeout
-    // because cross-fs copies of large vaults may legitimately run
-    // multiple minutes; the lock itself is cheap and only blocks a
-    // second concurrent /api/setup/migrate-context call.
-    const migrationLock = new MigrationLock(60 * 60 * 1000);
-    const contextWriteGate = new ContextWriteGate();
-    initTaskFlows(config.workspaceDir, config.dataDir);
-    const dispatcher = new EventDispatcher(eventBus, agentRouter, contextBuilder, getTaskFlow, notificationManager, sessionManager, messageRecorder, auditLogger, db, config, morningRoutineLock, services, roadmapWriteLock, writeTracker);
-    dispatcher.setSignalDetector(signalDetector);
-    // DOCS_QA_B7_DESIGN.md §11.1 — persistence-side citation validator
-    // for docs_qa sessions. Lookup runs over fts_docs (indexed by the
-    // docs indexer); the dispatcher only consults it when
-    // `isDocsQAMessage(event)` is true, so this hook is inert for
-    // chat/DM/routine flows and for installs that haven't ingested docs.
-    const docsCitationLookup = makeDocsCitationLookup(db);
-    dispatcher.setDocsCitationLookup(docsCitationLookup);
-    // Docs-QA SSE adapter — DOCS_QA_B7_DESIGN.md §S4 / §S8. Sits
-    // alongside `dashboardAdapter` on the same `platform="dashboard"`
-    // surface; the `intent: "docs_qa"` discriminator on inbound events
-    // forks dispatch into the docs-qa task flow + skill set + light
-    // tier clamp. The adapter is exposed to `createDocsRoutes` for the
-    // QA POST/SSE endpoints; outbound text reaches it via the dispatcher's
-    // `IDashboardStream` slot fanned out by `CompositeDashboardStream`.
-    //
-    // It is intentionally NOT registered with `messageHub`: the hub keys
-    // adapters by `platformName`, and both `DashboardAdapter` and this
-    // adapter declare `platformName="dashboard"`. A second registration
-    // would silently replace `dashboardAdapter` in the hub map (only a
-    // warn-log), breaking `getAdapter("dashboard")`, the
-    // start/stop lifecycle for the chat adapter, and any
-    // `sendToPlatform("dashboard", ...)` caller (DocsQAAdapter.sendMessage
-    // throws — it's streaming-only). DocsQAAdapter's lifecycle is owned
-    // by the SSE route itself: clients register on `GET /docs/qa/stream`
-    // and unregister on the request's `onAbort`.
-    const docsQAAdapter = new DocsQAAdapter((event) => void eventBus.put(event), docsCitationLookup);
-    // Fan-out: the dispatcher's single `IDashboardStream` slot drives
-    // both the chat and docs-QA adapters. Each adapter no-ops on
-    // unknown channelIds (per F3.2), so only the adapter that owns
-    // the destination channelId actually emits — fan-out is naturally
-    // safe (DOCS_QA_B7_DESIGN.md §9 F3.4 / §11.4).
-    dispatcher.setDashboardStream(new CompositeDashboardStream([dashboardAdapter, docsQAAdapter]));
-    dispatcher.setAttachmentStore(attachmentStore);
-    // Real-time routine progress for the dashboard. `dispatchSafe` emits
-    // `kind: "routine_started"` / `"routine_completed"` on the default
-    // SSE `event` channel — same pipe as `kind: "main_backend_changed"`
-    // — so the setup wizard's "今日の状況を生成中…" indicator can render
-    // without waiting on `/api/events` REST polling. Failure containment
-    // lives in `broadcastRoutineProgress` (swallows + warns).
-    dispatcher.setEventBroadcaster(eventBroadcaster);
-    // Local-Whisper voice transcription for inbound audio attachments.
-    // See docs/design/appendices/voice-transcription.md.
-    //
-    // `enabled` is driven by the `voiceTranscriptionEnabled` runtime setting
-    // (default `false`). The flag is opt-in via the dashboard's Voice Mode
-    // card, which goes through `POST /api/voice/install` so the model
-    // download and the daemon restart happen atomically — the constructor
-    // here observes the persisted flag on the next boot.
-    //
-    // Env vars stay live for advanced operators who want to override the
-    // model id, language, or duration cap without a settings round-trip.
-    // `PA_VOICE_TRANSCRIPTION_ENABLED` is honoured as a fallback when the
-    // setting is unset (legacy behaviour for installs predating the flag).
-    const voiceTranscriberMaxDuration = Number(process.env.PA_VOICE_TRANSCRIPTION_MAX_DURATION_SEC ?? "600");
-    const voiceEnvOverride = process.env.PA_VOICE_TRANSCRIPTION_ENABLED;
-    // When `PA_VOICE_TRANSCRIPTION_ENABLED` is set, env wins (operator
-    // override). Otherwise read live from `config` so the dashboard's
-    // voice install flow — which mutates `config.voiceTranscriptionEnabled`
-    // and persists the setting in the same boot — takes effect on the
-    // next inbound audio attachment without waiting for a daemon restart.
-    const voiceTranscriberEnabled = voiceEnvOverride !== undefined
-        ? voiceEnvOverride.toLowerCase() !== "false"
-        : () => config.voiceTranscriptionEnabled;
-    // Primary-language fallback: env override → runtime setting → null.
-    // The getter form is essential — operators can pick a language from the
-    // dashboard at any time and the next inbound voice attachment honours
-    // it without requiring a daemon restart, mirroring the `enabled` knob.
-    const voicePrimaryEnvOverride = process.env.PA_VOICE_TRANSCRIPTION_PRIMARY_LANGUAGE;
-    const voiceTranscriberPrimaryLanguage = voicePrimaryEnvOverride !== undefined
-        ? voicePrimaryEnvOverride.trim() || null
-        : () => config.voiceTranscriptionPrimaryLanguage;
-    dispatcher.setVoiceTranscriber(new VoiceTranscriber({
-        db,
-        modelDir: join(config.dataDir, "models", "whisper"),
-        enabled: voiceTranscriberEnabled,
-        model: process.env.PA_VOICE_TRANSCRIPTION_MODEL,
-        language: process.env.PA_VOICE_TRANSCRIPTION_LANGUAGE ?? null,
-        primaryLanguage: voiceTranscriberPrimaryLanguage,
-        maxDurationSec: Number.isFinite(voiceTranscriberMaxDuration)
-            ? voiceTranscriberMaxDuration
-            : 600,
-    }));
-    dispatcher.setAuthRecovery(authRecovery);
-    dispatcher.setAuthHealthMonitor(authHealthMonitor);
-    // Wire the delegated-sync refresh callback. The thunk reads the live
-    // `delegatedSyncWorker` reference each call so the dispatcher tracks
-    // re-registration when an integration mode flips. When no delegated
-    // integration is present, the worker is null and the call is a no-op
-    // — the hourly check proceeds without extra latency.
-    // See `docs/design/appendices/delegated-sync-opt-in.md` and the
-    // worker's `runDisabledCadencesForHourlyCheck` doc-comment.
-    dispatcher.setDelegatedSyncRefresh(async () => {
-        await delegatedSyncWorker?.runDisabledCadencesForHourlyCheck();
-    });
-    // Messaging bang-commands (`!stop`/`!start`/`!cost`/`!report`) — owner DM
-    // chokepoint that runs ahead of every other interceptor in handleMessage.
-    // See docs/design/backlog/messaging-bang-commands.md.
-    dispatcher.setBangCommandRegistry(createDefaultBangCommandRegistry());
-    // P22 — wire the optimizer-workdir hooks. The `materialize` callback
-    // captures `db`, `dataDir`, `workspaceDir`, `contextDir`, and `secretStore`
-    // so the dispatcher branch can invoke it without importing the workdir
-    // module directly. `teardown` cleans up under PA_DATA_DIR/optimizer-workdir/.
+    const { dispatcher, sessionManager, notificationManager, signalDetector, eventBroadcaster, auditLogger, docsQAAdapter, agentBackends, opencodeServerManager, delegatedBackendInvoker, authHealthMonitor, authRecovery, authTelemetry, readTokenManager, migrationLock, contextWriteGate, buildDelegatedSyncWorker, getDelegatedSyncWorker, rematerializeActiveDmWorkdirs, handleSecretChange, handleGoogleServicesReady, handlePromptContextChanged, keepaliveTimer, browserTaskDeadlineTimer, } = eventPipeline;
+    // ── 10.5 Agent Definitions load (AGENT_DEFINITIONS_DESIGN.md §6.1 / §7.1) ──
+    // Runs AFTER `runMigrations` (inside `initDatabase`) and BEFORE
+    // `scheduler.start()`: scans the built-in + user `agent.md` roots into the
+    // `agents` table, builds the live enabled cache the scheduler's per-built-in
+    // gate consults, and starts the user-root watcher for live dashboard edits.
+    // Crash-proof by contract — a bad YAML never aborts boot.
+    const { enabledCache: agentEnabledCache, watcher: agentsWatcher } = bootstrapAgents({ db, config, eventBroadcaster });
+    scheduler.setAgentEnabledCache(agentEnabledCache);
+    // ── 11. Hono HTTP Server ──
+    // Enable webhook fallback: when GitHub webhook is configured at boot,
+    // upgrade the existing GitWatcher to webhook mode. (The runtime
+    // `handleSecretChange("github")` branch handles the post-boot case.)
     {
-        const { materializeOptimizerWorkdir, teardownOptimizerWorkdir } = await import("./core/skill-curation/workdir.js");
-        dispatcher.setSkillCurationHooks({
-            materialize: (opts) => materializeOptimizerWorkdir({
-                db,
-                dataDir: config.dataDir,
-                workspaceDir: config.workspaceDir,
-                contextDir: getContextDir(config),
-                secretStore: secretBroker,
-                cadence: readSkillCurationCadence(db),
-                ...(opts?.manual ? { manual: true } : {}),
-                ...(opts?.targetSkillsOverride ? { targetSkillsOverride: opts.targetSkillsOverride } : {}),
-            }),
-            teardown: teardownOptimizerWorkdir,
-        });
-    }
-    if (isUserPaused(db)) {
-        logger.info("Restored user-paused state, autonomous work remains paused");
-    }
-    emitRoadmapRefreshSink = (source) => dispatcher.emitRoadmapRefresh(source);
-    agentCore.setReadTokenManager?.(readTokenManager);
-    geminiCore.setReadTokenManager?.(readTokenManager);
-    notificationManager.setSignalDetector(signalDetector);
-    let startupComplete = false;
-    let pendingGoogleServicesReady = false;
-    const handleGoogleServicesReady = () => {
-        // Start CalendarPoller if calendar was just hot-loaded AND the
-        // google_calendar integration is in `direct` mode. When the integration
-        // is `delegated`/`disabled` we keep the poller dormant — OAuth is wired
-        // up but the user has explicitly chosen not to poll.
-        if (services.calendar
-            && !observerManager.has("calendar")
-            && shouldStartObserversFor(db, "google_calendar")) {
-            const poller = buildCalendarPoller();
-            if (poller) {
-                observerManager.register(poller);
-                void poller.start();
-                logger.info("CalendarPoller started via hot-reload");
-            }
-        }
-        // Trigger morning_routine catchup if today.md is stale or missing
-        // (same logic as runCatchup, ensures schedule generation after first auth)
-        const contextDir = getContextDir(config);
-        const todayMdPath = join(contextDir, "today.md");
-        const needsMorning = !hasFreshAgentDayTodayMd(todayMdPath, config.timezone || undefined, config.dayBoundaryHour);
-        if (needsMorning) {
-            // Morning routine's post-completion hook will also check roadmap staleness.
-            logger.info("Google services ready — today.md stale, queueing morning_routine wake");
-            scheduler.queueMorningRoutineWake("google_auth_ready");
-            return;
-        }
-        // Only refresh roadmap independently when today.md is already current.
-        // If morning_routine is needed, its post-completion hook will handle stale
-        // roadmap regeneration after the day context has been rebuilt.
-        if (isRoadmapStale(contextDir)) {
-            logger.info("Google services ready — roadmap stale, emitting roadmap_refresh");
-            dispatcher.emitRoadmapRefresh("google_auth_ready");
+        const startupGitWatcher = observers.getGitWatcher();
+        if (startupGitWatcher && secretState.githubWebhookConfigured) {
+            startupGitWatcher.enableWebhookMode();
         }
-    };
-    const handleSecretChange = async (scope) => {
-        switch (scope) {
-            case "slack":
-                await reloadSlackAdapter(true);
-                return;
-            case "telegram":
-                await reloadTelegramAdapter(true);
-                return;
-            case "discord":
-                await reloadDiscordAdapter(true);
-                return;
-            case "notion":
-                await reloadNotionService();
-                // Hot-reload: if the user just added the Notion API key while
-                // the integration is already in `direct` mode, register the
-                // poller now so they don't have to restart the daemon.
-                // Mirrors the calendar-side `handleGoogleServicesReady` path —
-                // the mode-flip route covers `delegated→direct`, and this
-                // covers the orthogonal "key arrives after direct was set"
-                // case. Idempotent via observerManager.has().
-                if (services.notion
-                    && !observerManager.has("notion-poller")
-                    && Object.keys(config.notionDatabaseIds).length > 0
-                    && shouldStartObserversFor(db, "notion")) {
-                    const poller = buildNotionPoller();
-                    if (poller) {
-                        observerManager.register(poller);
-                        void poller.start();
-                        logger.info("NotionPoller started via hot-reload");
-                    }
-                }
-                return;
-            case "github":
-                await reloadGitHubService();
-                if (gitWatcher && secretState.githubWebhookConfigured) {
-                    gitWatcher.enableWebhookMode();
-                }
-                return;
-            case "google":
-                await reloadGoogleServices();
-                return;
-            case "apple_calendar":
-                await reloadAppleCalendarService();
-                return;
-            case "apiToken":
-            default:
-                return;
-        }
-    };
-    // ── 11. Hono HTTP Server ──
-    // Enable webhook fallback: when GitHub webhook is configured, reduce GitWatcher frequency
-    const startupGitWatcher = gitWatcher;
-    if (startupGitWatcher && secretState.githubWebhookConfigured) {
-        startupGitWatcher.enableWebhookMode();
     }
-    const handlePromptContextChanged = (path, reason, tier, metadata) => {
-        const setupMode = dispatcher.getCurrentSetupMode();
-        const decision = applyPromptContextStaleness({ path, reason, tier, metadata }, {
-            dmStalenessStrict: config.dmStalenessStrict,
-            setupInProgress: setupMode !== null,
-            markContextChanged: () => markContextChanged(db),
-            markActiveDmSessionsStale: (staleReason) => sessionManager.markActiveDmSessionsStale(staleReason),
-        });
-        logger.debug({
-            path,
-            reason,
-            tier_decided: decision.effectiveTier,
-            tier_requested: decision.requestedTier,
-            tier_reason: metadata?.tierReason,
-            dmStalenessStrict: config.dmStalenessStrict,
-            mode: setupMode,
-            invalidatesDmSessions: decision.invalidatesDmSessions,
-            skippedForSetup: decision.skippedForSetup,
-        }, "Prompt context staleness classified");
-        if (decision.skippedForSetup) {
-            logger.info({ path, reason, mode: setupMode }, "Skipping DM session stale flag - setup in progress");
-        }
-    };
-    const app = createApp({
+    // §11 Hono server — composed via `bootstrap/api.ts` per
+    // `docs/design/appendices/index-bootstrap-stage-split.md` Phase B-3.
+    // The factory assembles `ApiDependencies` from the live subsystem
+    // refs + the cross-stage closures (`handleSecretChange`,
+    // `handleGoogleServicesReady`, `handlePromptContextChanged`,
+    // `rematerializeActiveDmWorkdirs`, `fireRoadmapMaintenance`) that
+    // remain in this scope until Phase B-4 lifts them into
+    // `bootstrap/event-pipeline.ts`. The `overrideGlobalObjects: false`
+    // workaround for `@huggingface/transformers`'s cache-put path stays
+    // wired inside the factory — see the inline comment there.
+    const { server } = startApiServer({
         db,
         config,
         secretBroker,
-        readTokenValidator: (token) => readTokenManager.isValid(token),
-        enforceReadToken: config.enforceReadToken,
-        agentBackends: [agentCore, codexCore, geminiCore],
+        services,
+        blobStore,
+        agentBackends,
         authHealthMonitor,
         authRecovery,
         authTelemetry,
         eventBus,
+        readTokenManager,
         morningRoutineLock,
         roadmapWriteLock,
         migrationLock,
         contextWriteGate,
+        dispatcher,
+        sessionManager,
+        scheduler,
+        agentEnabledCache,
+        customRoutineScheduler,
+        healthMonitor,
+        heartbeat,
+        messageHub,
         observerManager,
-        delegatedInvoker: delegatedBackendInvoker,
+        contextIndexReconciler,
+        primaryVaultWatcher,
+        delegatedBackendInvoker,
         gitAccountRegistry,
-        onPrimaryVaultPathChange: (newPath) => primaryVaultWatcher.setVaultPath(newPath),
-        onGitReposChanged: () => queueGitProjectInitsForCurrentConfig("config-patch"),
-        getInFlightExecutions: () => dispatcher.getInFlightExecutions(),
-        getHealthData: () => {
-            const status = healthMonitor.getStatus();
-            return {
-                uptime: status.daemonUptime,
-                eventBusSize: status.eventBusSize,
-                activeSessions: status.activeSessions,
-                connectedPlatforms: status.connectedPlatforms,
-                registeredObservers: status.registeredObservers,
-                missingContextFiles: status.missingContextFiles,
-                contextFilesOk: status.contextFilesOk,
-            };
-        },
-        getLastTickAt: () => heartbeat.getLastTickAt(),
-        services,
-        isStartupComplete: () => startupComplete,
+        // BROWSER_TASK_REDESIGN_PLAN.md §5 / §5.1 — runner + shared slot
+        // state. Constructed in event-pipeline; threaded through here so
+        // the API surface's POST / GET / cancel routes operate on the
+        // same in-memory state as the runner's promote/release cascade.
+        browserTaskRunner: eventPipeline.browserTaskRunner,
+        browserTaskSlotStateRef: eventPipeline.browserTaskSlotStateRef,
+        writeTracker,
+        auditLogger,
+        attachmentStore,
+        dashboardAdapter,
+        docsQAAdapter,
+        docsIndexer,
+        eventBroadcaster,
         getIntegrationStatus,
         getMessagingStatus,
-        // Bang-commands `/api/health` surface — messaging-bang-commands.md §6.1.
-        // Returns `"ok"` for the unblocked case so dashboards never have to
-        // null-check, while preserving the original gate enum for the blocked
-        // states.
-        getAutonomousState: () => dispatcher.isAutonomousAllowed() ?? "ok",
-        getNotificationDestinations: () => ({
-            defaultPlatforms: config.defaultNotificationPlatforms,
-            effectiveFallbackPlatforms: messageHub.getEffectiveFallbackPlatforms(),
-        }),
-        getIntegrationDriftSyncStatus: () => delegatedSyncWorker?.getStatus() ?? {
-            workerRunning: false,
-            lastSuccessAt: null,
-            circuitState: "ok",
-            activeHours: { startHour: 4, endHour: 24 },
-            withinActiveHours: false,
-            cadences: {},
-            unrecognizedIntervalKeys: [],
-            ttlContractViolations: [],
-        },
-        // delegated-sync opt-in routes consume the live worker reference for
-        // cadence Run Now + status snapshot. When no integration is in
-        // delegated mode the worker is null and the routes report a
-        // worker_unavailable / empty-status response — see
-        // `docs/design/appendices/delegated-sync-opt-in.md`.
-        get delegatedSyncWorker() {
-            return delegatedSyncWorker ?? undefined;
-        },
-        sendNotification: async ({ message, platforms, priority, notificationType, originSessionId, }) => {
-            const dispatchId = randomBytes(16).toString("hex");
-            const deliveries = await messageHub.sendToUser(message, platforms, {
-                dispatchId,
-                notificationType: notificationType ?? "agent",
-                priority: priority ?? "normal",
-                contentSummary: message.slice(0, 200),
-            });
-            if (deliveries.length > 0) {
-                const insert = db.prepare(`INSERT INTO notification_log (
-             dispatch_id,
-             notification_type,
-             priority,
-             platform,
-             delivery_channel,
-             delivery_message_id,
-             content_summary,
-             status,
-             delivered_at
-           )
-           VALUES (?, ?, ?, ?, ?, ?, ?, 'delivered', CURRENT_TIMESTAMP)`);
-                for (const delivery of deliveries) {
-                    insert.run(dispatchId, notificationType ?? "agent", priority ?? "normal", delivery.platform, delivery.channel, delivery.messageId ?? null, message.slice(0, 200));
-                }
-                recordProactiveForwardDeliveries({
-                    db,
-                    config,
-                    deliveries,
-                    content: message,
-                    dispatchId,
-                    dispatchIds: [dispatchId],
-                    originSessionIds: originSessionId !== undefined ? [originSessionId] : [],
-                    notificationType: "proactive_forward",
-                });
-            }
-            return { dispatchId, deliveries };
-        },
-        markEventNotified: (correlationId) => {
-            dispatcher.markEventNotified(correlationId);
-        },
+        isStartupComplete: () => startupComplete,
+        getDelegatedSyncWorker,
+        handleSecretChange,
+        handlePromptContextChanged,
         onGoogleServicesReady: () => {
             if (!startupComplete) {
                 pendingGoogleServicesReady = true;
@@ -1979,261 +970,24 @@ async function startup() {
             }
             handleGoogleServicesReady();
         },
-        onScheduleConfigChanged: () => scheduler.reloadCrons(),
-        onIntegrationModeChange: async (key, prev, next) => {
-            const buildObserver = (observerName) => {
-                // Registry-gated direct observers. Mail's multi-provider poller is a
-                // deferred follow-up — gmail.observersTouched is empty, so that
-                // branch remains unreachable today.
-                if (observerName === "calendar")
-                    return buildCalendarPoller();
-                if (observerName === "notion-poller")
-                    return buildNotionPoller();
-                if (observerName === "git")
-                    return buildGitWatcher();
-                if (observerName === "github")
-                    return buildGithubPoller();
-                return null;
-            };
-            await applyIntegrationModeChange({
-                db,
-                observerManager,
-                buildObserver,
-                buildDelegatedSyncWorker,
-                buildGitDelegatedCronObserver,
-                // DELEGATED-PROXY-API-DESIGN.md Phase F (§4.8) — every mode
-                // change re-materializes active DM workdirs so the next turn
-                // picks up the new skill body / accounts.md / instruction file
-                // without tearing down the SDK session.
-                rematerializeDmSessions: (reason) => {
-                    const result = rematerializeActiveDmWorkdirs(reason);
-                    if (!result)
-                        return;
-                    logger.info({ reason, ...result.summary }, "Integration mode changed — DM session workdirs re-materialized");
-                },
-            }, key, prev, next);
-            if (key === "git" && next.mode !== "direct") {
-                gitWatcher = null;
-            }
-        },
-        onMainBackendChange: (reason) => {
-            // DELEGATED-MODE-V2-DESIGN.md §4.4 — every main-backend flip
-            // re-materializes active DM workdirs so the next turn's skill
-            // variant and instruction file reflect the new same- vs.
-            // cross-backend topology. Mirrors the `onMailScopeChanged`
-            // pattern: helper handles the "no active sessions" no-op + per-
-            // session failure containment, and we broadcast a structured
-            // event so the dashboard can refresh without polling.
-            const result = rematerializeActiveDmWorkdirs(reason);
-            if (!result)
-                return;
-            logger.info({ reason, ...result.summary }, "Main backend changed — DM session workdirs re-materialized");
-            eventBroadcaster.broadcastEvent({
-                kind: "main_backend_changed",
-                reason,
-                ...result.summary,
-            });
-        },
-        onSetupStart: (mode) => {
-            dispatcher.beginSetupMode(mode);
-        },
-        onSecretChanged: handleSecretChange,
-        onSetupComplete: () => {
-            dispatcher.clearSetupMode();
-            // Kick off an immediate morning routine so today.md is generated
-            // right away — otherwise the user completes setup mid-day and sits
-            // without a populated today.md until 04:00 next morning. We go
-            // through the scheduler's queueMorningRoutineWake so:
-            //   - the dedup check prevents a double-run if startup catchup was
-            //     about to kick off the same routine (race on first boot after
-            //     setup completes)
-            //   - the wake task is durable: if the daemon crashes before the
-            //     routine runs, it replays on restart via ScheduleWatcher
-            //   - ScheduleWatcher obeys the autonomous-work gate, so in the
-            //     unlikely case clearSetupMode fails to persist, the gate
-            //     still prevents the routine from running mid-setup.
-            // Don't emit roadmap_refresh here — skeleton has "(Not yet configured)"
-            // which isRoadmapStale() detects. The refresh will be triggered by:
-            // - morning_routine's post-completion hook, or
-            // - onGoogleServicesReady (once calendar auth completes)
-            // This avoids generating a roadmap before calendar data is available.
-            try {
-                scheduler.queueMorningRoutineWake("setup_complete");
-            }
-            catch (err) {
-                logger.error({ err }, "Failed to queue post-setup morning routine — today.md will not be generated until next 04:00");
-            }
-            // Fire-and-forget: greet the user on every connected messaging
-            // platform exactly once. The runtime_state latch inside the helper
-            // makes this idempotent across repeated setup completions.
-            void sendSetupWelcomeDm({ db, messageHub }).catch((err) => {
-                logger.error({ err }, "Welcome DM dispatch crashed");
-            });
-        },
-        onPromptContextChanged: (path, reason, tier, metadata) => {
-            // Layer-3 defense for the Customize Your Rules bug: even if the
-            // setup conversation's own agent writes to today/roadmap/management-
-            // rules mid-flight (not typical, but possible via skills), we must
-            // NOT mark the owner-DM session stale. Marking stale would refresh
-            // the conversation_sessions row on the next turn, drop the stored
-            // Claude SDK session_id, and force a fresh `setup.initial` execute
-            // that loses prior Q&A history. Layers 1 (autonomous-work gate)
-            // and 2 (scope-agnostic currentSetupMode) keep prompt selection
-            // correct, but only layer 3 preserves in-conversation continuity.
-            // For loud-tier changes, persist the change moment FIRST so a crash
-            // between the DB write and stale-flag update still leaves the durable
-            // signal in place — the in-memory flag on SessionManager is lost on
-            // restart, so if it were written before the DB write we could lose
-            // the signal entirely on a process crash mid-hook.
-            //
-            // The persisted `dashboard_context_changed_at` is consulted by both
-            // `continueDashboardSession` (resume path) and `getOrCreateDm`
-            // (every DM turn) to decide whether the stored SDK session has gone
-            // stale and must be discarded before resume.
-            handlePromptContextChanged(path, reason, tier, metadata);
-        },
-        onIndexableContextChange: (_path) => {
-            // API-route hint: any successful PUT/PATCH/DELETE under `/context/*`
-            // queues a reconcile. The observer's own chokidar watcher already
-            // catches manual edits the API bypasses (e.g. the user editing via
-            // Obsidian when contextDir *is* the Obsidian vault) — this hint
-            // shortens reconcile latency for API-origin writes from chokidar
-            // debounce + stabilityThreshold to the observer's 10s debounce. The
-            // reconciler short-circuits when nothing changed, so firing for
-            // non-indexed paths is harmless.
-            contextIndexReconciler.requestReconcile("manual");
-        },
-        onCustomRoutinesChanged: () => {
-            try {
-                customRoutineScheduler.reload();
-            }
-            catch (err) {
-                logger.error({ err }, "Custom routine reload failed");
-            }
-        },
-        triggerHourlyCheck: (source, options) => dispatcher.triggerHourlyCheck(source, options),
-        triggerRoadmapRefresh: (source, options) => dispatcher.emitRoadmapRefresh(source, options),
-        endDashboardSession: (channelId) => endDashboardSessionFromChannel({
-            sessionManager,
-            channelId,
-        }),
-        continueDashboardSession: async (sessionId) => continueDashboardSessionFromHistory({
-            db,
-            dataDir: config.dataDir,
-            sessionManager,
-            sessionId,
-        }),
-        writeTracker,
-        blobStore,
-        dashboardAdapter,
-        eventBroadcaster,
-        attachmentStore,
-        auditLogger,
-        validateAttachmentTurnToken: (token) => dispatcher.validateAttachmentTurnToken(token),
-        whatsappControls: {
-            isInitialized: () => adapterState.whatsapp !== null,
-            enable: async () => {
-                const adapter = buildWhatsAppAdapter();
-                if (adapter.getStatus() === "disabled") {
-                    await adapter.start();
-                }
-            },
-            disable: async () => {
-                await teardownWhatsAppAdapter();
-            },
-            requestQr: async () => {
-                if (!adapterState.whatsapp) {
-                    await enableWhatsAppAdapter();
-                }
-                await adapterState.whatsapp.requestQR();
-            },
-            waitForQr: async (timeoutMs = 10_000) => {
-                if (!adapterState.whatsapp) {
-                    await enableWhatsAppAdapter();
-                }
-                const snapshot = await adapterState.whatsapp.waitForQr(timeoutMs);
-                return whatsappQrResponseFromAdapter(adapterState.whatsapp, snapshot);
-            },
-            getQrResponse: () => whatsappQrResponseFromAdapter(adapterState.whatsapp),
-            reset: async (timeoutMs = 10_000) => {
-                // 1. Stop + unregister any live adapter so no Baileys callbacks fire
-                //    against the auth dir while we delete it.
-                await teardownWhatsAppAdapter();
-                // 2. Wipe Baileys' multi-file auth state. Without this, a fresh
-                //    enable() would re-load the stale creds and never emit a QR —
-                //    which is exactly the "前のデータが残っているのか pair できない"
-                //    failure mode the dashboard's "Reset connection" button exists
-                //    to recover from. Recursive + force so a partially-written dir
-                //    (e.g. only qr.txt present, no creds.json yet) still wipes
-                //    cleanly. `force: true` also no-ops if the dir is already gone.
-                const authDir = config.whatsappAuthDir ?? join(config.dataDir, "whatsapp", "auth");
-                try {
-                    rmSync(authDir, { recursive: true, force: true });
-                }
-                catch (err) {
-                    logger.warn({ err, authDir }, "Failed to wipe WhatsApp auth directory during reset");
-                }
-                // 3. Drop the cached owner_channels mapping so a freshly-paired
-                //    session re-discovers the channel id from the inbound auth
-                //    handshake rather than reusing the prior LID alias.
-                try {
-                    db
-                        .prepare("DELETE FROM owner_channels WHERE platform = ?")
-                        .run("whatsapp");
-                }
-                catch (err) {
-                    logger.warn({ err }, "Failed to clear WhatsApp owner_channels row during reset");
-                }
-                // 4. If the integration is still enabled, rebuild the adapter and
-                //    await the first scannable QR so the dashboard can render it
-                //    in the same request that triggered the reset.
-                if (!config.whatsappEnabled) {
-                    return whatsappQrResponseFromAdapter(null);
-                }
-                await enableWhatsAppAdapter();
-                const snapshot = await adapterState.whatsapp.waitForQr(timeoutMs);
-                return whatsappQrResponseFromAdapter(adapterState.whatsapp, snapshot);
-            },
-        },
-        messagingControls: {
-            telegram: buildTelegramControls(),
-            slack: buildSlackControls(),
-            discord: buildDiscordControls(),
-        },
+        rematerializeActiveDmWorkdirs,
+        fireRoadmapMaintenance,
+        buildCalendarPoller,
+        buildNotionPoller,
+        buildGitWatcher,
+        buildGithubPoller,
+        buildDelegatedSyncWorker,
+        buildGitDelegatedCronObserver,
+        clearGitWatcher: observers.clearGitWatcher,
+        adapterState,
+        buildWhatsAppAdapter,
+        teardownWhatsAppAdapter,
+        enableWhatsAppAdapter,
+        buildTelegramControls,
+        buildSlackControls,
+        buildDiscordControls,
+        queueGitProjectInitsForCurrentConfig,
     });
-    // Mount /api/docs/* (DOCS_QA_DESIGN.md §10.4 + DOCS_QA_B7_DESIGN.md
-    // §S5–S6) after createApp so the indexer handle and the QA SSE
-    // adapter can be threaded in without extending ApiDependencies. The
-    // read endpoints don't need messaging/dispatcher deps; the QA
-    // POST/SSE pair leans on `docsQAAdapter` to register clients and
-    // enqueue docs_qa events.
-    app.route("/api", createDocsRoutes({
-        db,
-        ...(docsIndexer ? { indexer: docsIndexer } : {}),
-        docsQAAdapter,
-    }));
-    const server = serve({
-        fetch: app.fetch,
-        hostname: "127.0.0.1",
-        port: config.apiPort,
-        // @hono/node-server's getRequestListener defaults to replacing
-        // `globalThis.Request` / `globalThis.Response` with its own lazy
-        // wrapper classes (named `_Request` / `_Response`) for response-
-        // body materialization performance. The wrappers are prototype-
-        // chained to the native classes — fine for Hono's own response
-        // path — but they break `instanceof Response` checks for objects
-        // returned by native `fetch()`, because a native Response's
-        // prototype chain doesn't include `_Response.prototype`. This
-        // makes `@huggingface/transformers`'s `toCacheResponse` check
-        // (`response instanceof Response && response.status === 200`)
-        // evaluate to false on fresh fetches, which silently skips
-        // `cache.put` and then throws "Unable to get model file path or
-        // buffer." Disabling the override keeps the native globals
-        // intact and costs us nothing — we don't construct Hono's
-        // `Response` instances directly anywhere in the daemon.
-        overrideGlobalObjects: false,
-    });
-    logger.info({ port: config.apiPort }, "API server listening");
     void dispatcher.run(); // Start consuming dashboard events as soon as the API is live
     // Notifications Center heartbeat (docs/design/20-notifications-center.md
     // §"Daemon heartbeat"). MUST start immediately after the API server is
@@ -2246,9 +1000,24 @@ async function startup() {
     // minutes, so this ordering is load-bearing, not cosmetic.
     heartbeat.start();
     // ── 12. Catchup (recover missed actions after restart) ──
-    // Register day boundary callback: summarize DM sessions at 4 AM before morning routine
+    // Register day boundary callback: summarize DM sessions at 4 AM before
+    // morning routine. Then fan out one
+    // `routine.research_cluster_update` event per active browser-history
+    // research cluster with new activity in the last 24h
+    // (BROWSER_HISTORY_INTEGRATION_PLAN §10.6 step 3). The fan-out is
+    // bounded at 25 clusters / cycle; backlog clusters surface on the
+    // next day-boundary tick.
     scheduler.setDayBoundaryCallback(async () => {
         await dispatcher.summarizeDmSessions();
+        try {
+            const result = await fanoutResearchClusterUpdates(db, eventBus);
+            if (result.enqueuedSlugs.length > 0) {
+                logger.info({ enqueuedSlugs: result.enqueuedSlugs }, "Research cluster updates enqueued at day boundary");
+            }
+        }
+        catch (err) {
+            logger.error({ err }, "Research cluster update fan-out failed; will retry next day boundary");
+        }
     });
     // Register direct DM callback: sends scheduled messages without running an agent
     scheduler.setSendDmCallback(async (message, platforms) => {
@@ -2275,18 +1044,76 @@ async function startup() {
     // means a reconcile during setup.initial does not destroy in-flight
     // setup session state — see the matching `onPromptContextChanged`
     // handler in the createApp dependencies above for the layered guards.
-    contextIndexReconcilerPromptSink = handlePromptContextChanged;
+    observers.setPromptContextChangedSink(handlePromptContextChanged);
+    // Evening-review slimdown §2.2 — daily mechanical roadmap.md
+    // maintenance at 17:45 local. The pass acquires the same
+    // `roadmapWriteLock` singleton the dispatcher uses for
+    // `routine.roadmap_refresh` so a refresh mid-flight (rare at that
+    // time of day) defers the maintenance to the next tick instead of
+    // racing. `writeTracker.markWriting` tags the resulting fs event as
+    // agent-originated so the Obsidian / Git observers do not loop on
+    // their own output.
+    // Shared closure used by both the 17:45 cron callback above and the
+    // `triggerRoadmapMaintenance` API dependency wired into `createApp`.
+    // Keeping a single fire site means the cron path and the
+    // `aitne run-now roadmap_maintenance` path operate on identical deps
+    // — no drift between the scheduled and the manual surface.
+    //
+    // Async because the runner now wraps its roadmap.md write in the
+    // per-path serializer (avoids HTTP-vs-direct clobbers). Callers
+    // must await or fire-and-forget through `.catch`.
+    function fireRoadmapMaintenance() {
+        return runRoadmapMechanicalMaintenance({
+            db,
+            contextDir: getContextDir(config, db),
+            roadmapWriteLock,
+            writeTracker,
+            timezone: config.timezone || undefined,
+            onIndexableContextChange: () => contextIndexReconciler.requestReconcile("manual"),
+        });
+    }
+    scheduler.setRoadmapMaintenanceCallback(() => {
+        fireRoadmapMaintenance().catch((err) => {
+            logger.error({ err }, "runRoadmapMechanicalMaintenance threw");
+        });
+    });
+    // BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 P4a — pre-morning digest
+    // job. Fires at `dayBoundaryHour − 1` local, gated by the same
+    // integration-state check that hides the rest of the browser-history
+    // surface when the user has set `browser_history` to `disabled`.
+    // The callback owns its own try/catch (`safeRunPreMorningDigestJob`)
+    // so a transient SQL or fs failure never crashes the cron tick.
+    scheduler.setBrowserHistoryPreMorningDigestCallback(() => {
+        if (!shouldStartObserversFor(db, "browser_history"))
+            return;
+        safeRunPreMorningDigestJob({
+            db,
+            contextDir: getContextDir(config, db),
+            boundary: {
+                timezone: config.timezone || undefined,
+                dayBoundaryHour: config.dayBoundaryHour,
+            },
+        });
+    });
     // Phase 4 auth probe — runs BEFORE the hourly check on each cron
     // tick so auth health detection happens independently of the
     // observation-threshold gate. checkAll() owns its own kill switch
     // (authProbeDisabled), morning-routine skip, and in-flight dedupe.
     scheduler.setAuthProbeCallback(() => authHealthMonitor.checkAll());
-    // Wire the autonomous-work gate: when rules/management.md is missing
+    // Wire the autonomous-work gate: when policies/management.md is missing
     // or a setup conversation is active, the scheduler pauses cron routines
     // and ScheduleWatcher claims. This prevents any autonomous turn from
     // racing with the dashboard setup flow and triggering the stale-session
     // bug that killed setup mode mid-conversation.
     scheduler.setAutonomousGate(() => dispatcher.isAutonomousAllowed());
+    // Pre-routine morning_routine gate (sleep-skip recovery). When the
+    // current agent-day's morning_routine has not completed yet — typical
+    // cause: Mac slept through the 04:00 cron tick — hourly_check and the
+    // review routines enqueue a wake row instead of running on stale state.
+    // Wired here after both `dispatcher` and `scheduler` exist so the
+    // binding is a single, stable function reference for the duration of
+    // the process.
+    dispatcher.setQueueMorningRoutineWake((source, options) => scheduler.queueMorningRoutineWake(source, options));
     const startupCatchup = await runCatchup(db, dispatcher, config);
     // ── 13. Start all components ──
     await messageHub.startAll();
@@ -2294,15 +1121,58 @@ async function startup() {
     customRoutineScheduler.start();
     signalDetector.start();
     const registeredPlatforms = messageHub.getPlatforms();
-    if (registeredPlatforms.length > 0 && !messageHub.getAdapter(config.primaryPlatform)) {
-        const fallbackPlatform = messageHub.getEffectiveFallbackPlatforms()[0]
-            ?? registeredPlatforms[0];
-        logger.error({
-            requestedPrimary: config.primaryPlatform,
-            fallbackPrimary: fallbackPlatform,
-        }, "Primary platform is not registered, falling back");
-        messageHub.setPrimaryPlatform(fallbackPlatform);
-        config.primaryPlatform = fallbackPlatform;
+    // Single-app installs (Telegram-only / Discord-only / etc.) would
+    // otherwise log "Primary platform is not registered, falling back" on
+    // every boot because the schema default is "slack" and the fallback was
+    // never persisted. The resolver checks whether the operator ever made
+    // an explicit choice (DB settings row or `PA_PRIMARY_PLATFORM` env);
+    // when they didn't, we adopt and persist the first eligible adapter so
+    // the next boot is silent.
+    //
+    // "First set up" semantics for the multi-adapter case (spec: when
+    // multiple adapters are configured, the first one paired wins) come from
+    // `selectFirstPairedPlatform`, which reads `owner_channels.rowid` ASC —
+    // a chronological proxy that captures the first platform to complete
+    // the cred+pairing loop. The single-adapter case (the common one)
+    // collapses to "the only eligible adapter" without touching the DB.
+    const explicitEnvPrimary = process.env.PA_PRIMARY_PLATFORM?.trim();
+    const action = resolvePrimaryPlatform({
+        configuredPrimary: config.primaryPlatform,
+        primaryAdapterRegistered: !!messageHub.getAdapter(config.primaryPlatform),
+        registeredPlatforms,
+        effectiveFallback: selectFirstPairedPlatform(db, messageHub.getEffectiveFallbackPlatforms()),
+        userExplicitlySetPrimary: "primaryPlatform" in persistedSettings
+            || (explicitEnvPrimary !== undefined && explicitEnvPrimary.length > 0),
+    });
+    if (action.kind === "switch") {
+        if (action.reason === "auto-resolve") {
+            logger.info({
+                previousPrimary: config.primaryPlatform,
+                autoResolvedPrimary: action.newPrimary,
+            }, "Primary platform unset; auto-resolving to first configured messaging app");
+        }
+        else {
+            logger.warn({
+                requestedPrimary: config.primaryPlatform,
+                fallbackPrimary: action.newPrimary,
+            }, "Primary platform is not registered, falling back (preference kept; restore the adapter to revert)");
+        }
+        messageHub.setPrimaryPlatform(action.newPrimary);
+        config.primaryPlatform = action.newPrimary;
+        if (action.persist) {
+            try {
+                settingsStore.set("primaryPlatform", action.newPrimary);
+            }
+            catch (err) {
+                logger.warn({ err }, "Failed to persist auto-resolved primaryPlatform; next boot will repeat the resolution");
+            }
+        }
+    }
+    else if (action.kind === "no-fallback") {
+        logger.warn({
+            configuredPrimary: config.primaryPlatform,
+            registeredPlatforms,
+        }, "Primary platform adapter not registered and no eligible messaging fallback found");
     }
     await observerManager.startAll();
     // Start the integrations.md fs-watcher after the observer manager is up so
@@ -2332,12 +1202,15 @@ async function startup() {
                     destinationMode: "configured_only",
                 });
             },
-        });
+        }, 
+        // V18 — chokidar must watch the post-restructure path under contextDir
+        // (Obsidian-mode users have a non-default vault root).
+        getContextDir(config, db));
     }
     catch (err) {
         logger.error({ err }, "integrations.md watcher failed to start");
     }
-    // Start the rules/management.md fs-watcher alongside its integrations.md
+    // Start the policies/management.md fs-watcher alongside its integrations.md
     // sibling so hand-edits to A-section bindings flow back into the DB. The
     // watcher is a no-op when the post-setup branch above did not run
     // (contextDir absent), since chokidar against a missing path is silent.
@@ -2346,7 +1219,7 @@ async function startup() {
             managementRegistryWatcher = startManagementRegistryWatcher(getContextDir(config), db);
         }
         catch (err) {
-            logger.error({ err }, "rules/management.md watcher failed to start");
+            logger.error({ err }, "policies/management.md watcher failed to start");
         }
     }
     healthMonitor.start();
@@ -2416,7 +1289,16 @@ async function startup() {
         signalDetector.stop();
         notificationManager.stop(); // Clear pending batch-flush timer
         authRecovery.shutdown(); // Kill any active recovery subprocesses
+        // docs/design/appendices/opencode-backend.md Phase 2 — stop the loopback opencode
+        // server (if any) so the spawned child releases its port. shutdown()
+        // is idempotent; lazy-spawned managers that never booted no-op.
+        await opencodeServerManager.shutdown().catch((err) => {
+            logger.warn({ err }, "opencode server manager shutdown failed");
+        });
         clearInterval(vaultHealthTimer);
+        clearInterval(keepaliveTimer);
+        // BROWSER_TASK_REDESIGN_PLAN.md §5 / §5.1 — 30 s deadline tick.
+        clearInterval(browserTaskDeadlineTimer);
         clearTimeout(migrationBackupSweepInitial);
         clearInterval(migrationBackupSweepTimer);
         if (managementMdWatcher) {
@@ -2426,7 +1308,7 @@ async function startup() {
         }
         if (managementRegistryWatcher) {
             await managementRegistryWatcher.stop().catch((err) => {
-                logger.warn({ err }, "rules/management.md watcher stop failed");
+                logger.warn({ err }, "policies/management.md watcher stop failed");
             });
         }
         if (docsIndexer) {
@@ -2434,6 +1316,11 @@ async function startup() {
                 logger.warn({ err }, "docs indexer stop failed");
             });
         }
+        if (agentsWatcher) {
+            await agentsWatcher.stop().catch((err) => {
+                logger.warn({ err }, "agent definitions watcher stop failed");
+            });
+        }
         await observerManager.stopAll();
         await messageHub.stopAll();
         eventBus.close();
@@ -2475,4 +1362,3 @@ startup().catch((err) => {
     logger.fatal({ error: e?.message, code: e?.code, stack: e?.stack }, "Daemon startup failed");
     process.exit(1);
 });
-//# sourceMappingURL=index.js.map