@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/backends/opencode-server-manager.js

@@ -0,0 +1,221 @@
+/**
+ * docs/design/appendices/opencode-backend.md §5.1 / §6.4 — server lifecycle manager.
+ *
+ * Phase 2 ships only the Managed implementation: one long-lived
+ * `opencode serve` child process per backend slot, with config-diff
+ * triggered bounce. The Remote implementation lands in Phase 5; Phase 2
+ * exposes the interface so wiring is stable.
+ *
+ * Concurrency model: a single `BackendRouter` slot is serialised by the
+ * router's per-backend in-flight gate. Within that gate `ensureConfig`
+ * may block on a bounce, then `client()` returns the live SDK client.
+ * `shutdown()` is wired into `ObserverManager` so graceful daemon exit
+ * stops the child process and releases the loopback port.
+ */
+import { createHash } from "node:crypto";
+import { createOpencode, } from "@opencode-ai/sdk";
+import { stableStringify } from "@aitne/shared";
+import { createLogger } from "../../logging.js";
+const logger = createLogger("opencode-server-manager");
+/** Default cold-start budget — V6 measured p95 ≈ 1222 ms; 15 s headroom
+ *  for slow CI hosts and the rare MCP-bound bounce. */
+const DEFAULT_SPAWN_TIMEOUT_MS = 15_000;
+/** Default loopback bind. Port 0 lets the OS pick a free port; the SDK
+ *  echoes the chosen URL back so we never need to probe externally. */
+const DEFAULT_HOSTNAME = "127.0.0.1";
+/**
+ * Hash a desired `OpencodeRuntimeConfig` deterministically so two
+ * equivalent configs (regardless of key ordering or undefined fields)
+ * produce the same hash. Reused for bounce-vs-noop decision.
+ */
+export function hashRuntimeConfig(config) {
+    // Drop `undefined` so { a: undefined } and {} canonicalise equal.
+    const canonical = stableStringify(stripUndefined(config));
+    return createHash("sha256").update(canonical).digest("hex");
+}
+function stripUndefined(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => stripUndefined(item));
+    }
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (v === undefined)
+                continue;
+            out[k] = stripUndefined(v);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Managed-mode lifecycle. Owns a single child process; bounces on
+ * config-diff.
+ *
+ * Crash recovery: V6 fixtures show `server.close()` is synchronous and
+ * does not throw on a stopped process. The manager treats a missing /
+ * already-stopped server as "respawn on next ensureConfig". We don't
+ * subscribe to `child_process` signals here because the SDK abstracts
+ * them away; the next inbound `ensureConfig` will pay the cost of
+ * detection if the server died.
+ */
+export class ManagedOpencodeServerManager {
+    mode = "managed";
+    state = null;
+    /** Coalesce concurrent ensureConfig / client calls onto a single spawn. */
+    inflight = null;
+    hostname;
+    port;
+    spawnTimeoutMs;
+    createOpencodeImpl;
+    shutdownRequested = false;
+    constructor(options = {}) {
+        this.hostname = options.hostname ?? DEFAULT_HOSTNAME;
+        this.port = options.port ?? 0;
+        this.spawnTimeoutMs = options.spawnTimeoutMs ?? DEFAULT_SPAWN_TIMEOUT_MS;
+        this.createOpencodeImpl = options.createOpencodeImpl ?? createOpencode;
+    }
+    async ensureConfig(desiredConfig) {
+        if (this.shutdownRequested) {
+            throw new Error("OpencodeServerManager has been shut down");
+        }
+        const desiredHash = hashRuntimeConfig(desiredConfig);
+        if (this.state && this.state.runningHash === desiredHash) {
+            return;
+        }
+        await this.spawn(desiredConfig, desiredHash);
+    }
+    async client() {
+        if (this.shutdownRequested) {
+            throw new Error("OpencodeServerManager has been shut down");
+        }
+        if (!this.state) {
+            // Lazy first-spawn with an empty config — callers that want
+            // specific config should call ensureConfig() first.
+            await this.spawn({}, hashRuntimeConfig({}));
+        }
+        return this.state.client;
+    }
+    async spawnEphemeral(config) {
+        if (this.shutdownRequested) {
+            throw new Error("OpencodeServerManager has been shut down");
+        }
+        const abortController = new AbortController();
+        const timeoutId = setTimeout(() => abortController.abort(new Error("opencode ephemeral spawn timeout")), this.spawnTimeoutMs);
+        const start = Date.now();
+        try {
+            const { client, server } = await this.createOpencodeImpl({
+                hostname: this.hostname,
+                port: 0,
+                signal: abortController.signal,
+                timeout: this.spawnTimeoutMs,
+                config: config,
+            });
+            logger.info({ url: server.url, spawnMs: Date.now() - start, ephemeral: true }, "opencode ephemeral server spawned");
+            return {
+                client,
+                close: async () => {
+                    try {
+                        server.close();
+                    }
+                    catch (err) {
+                        logger.warn({ err }, "opencode ephemeral server close threw");
+                    }
+                },
+            };
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    }
+    async shutdown() {
+        this.shutdownRequested = true;
+        if (this.state) {
+            const { server } = this.state;
+            try {
+                server.close();
+            }
+            catch (err) {
+                logger.warn({ err }, "opencode server close threw");
+            }
+            this.state = null;
+        }
+    }
+    /** Lifecycle introspection — useful for diagnostics and tests. */
+    get isRunning() {
+        return this.state !== null;
+    }
+    get currentHash() {
+        return this.state?.runningHash ?? null;
+    }
+    async spawn(config, hash) {
+        // Coalesce concurrent spawn attempts so a flurry of ensureConfig
+        // calls (e.g. on first boot) doesn't fire multiple child processes.
+        if (this.inflight) {
+            const state = await this.inflight;
+            if (state.runningHash === hash)
+                return state;
+            // Different hash — fall through to bounce.
+        }
+        const spawnPromise = this.doSpawn(config, hash);
+        this.inflight = spawnPromise;
+        try {
+            const state = await spawnPromise;
+            return state;
+        }
+        finally {
+            this.inflight = null;
+        }
+    }
+    async doSpawn(config, hash) {
+        if (this.state) {
+            const previousHash = this.state.runningHash;
+            const ageMs = Date.now() - this.state.spawnedAt;
+            try {
+                this.state.server.close();
+            }
+            catch (err) {
+                logger.warn({ err }, "opencode server close threw during bounce");
+            }
+            this.state = null;
+            logger.info({ previousHash: previousHash.slice(0, 12), newHash: hash.slice(0, 12), ageMs }, "opencode server bounced");
+        }
+        const abortController = new AbortController();
+        const timeoutId = setTimeout(() => abortController.abort(new Error("opencode spawn timeout")), this.spawnTimeoutMs);
+        const start = Date.now();
+        try {
+            const { client, server } = await this.createOpencodeImpl({
+                hostname: this.hostname,
+                port: this.port,
+                signal: abortController.signal,
+                timeout: this.spawnTimeoutMs,
+                config: config,
+            });
+            const next = {
+                client,
+                server,
+                runningHash: hash,
+                config,
+                spawnedAt: Date.now(),
+            };
+            this.state = next;
+            logger.info({
+                url: server.url,
+                hash: hash.slice(0, 12),
+                spawnMs: Date.now() - start,
+            }, "opencode server spawned");
+            return next;
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    }
+}
+/**
+ * Phase 2 factory: only the Managed variant exists today. Phase 5 adds
+ * a `RemoteOpencodeServerManager` branch keyed on a runtime setting.
+ * The factory contract keeps callers backend-shape-agnostic.
+ */
+export function createOpencodeServerManager(options = {}) {
+    return new ManagedOpencodeServerManager(options);
+}

package/dist/core/backends/opencode-types.d.ts

@@ -0,0 +1,45 @@
+/**
+ * docs/design/appendices/opencode-backend.md §6.1.0 — local module augmentation + helper
+ * types for the four undeclared surfaces that V3/V4/V9 confirmed exist
+ * at runtime in opencode 1.14.50 but are missing from the SDK's
+ * generated types.
+ *
+ * The `declare module "@opencode-ai/sdk"` block adds the three runtime
+ * fields the SDK omits (format on the prompt body, structured on the
+ * assistant message, total on the token block). The helper types below
+ * widen the event union so we never compile against the SDK's
+ * incomplete `EventSubscribeResponse`.
+ */
+declare module "@opencode-ai/sdk" {
+    interface SessionPromptBodyAugmented {
+        format?: {
+            type: "json_schema";
+            schema: object;
+            retryCount?: number;
+        };
+    }
+    interface AssistantMessageAugmented {
+        structured?: unknown;
+    }
+    interface AssistantTokensAugmented {
+        total?: number;
+    }
+}
+/**
+ * V9-grounded event-input type. The SDK's generated
+ * `EventSubscribeResponse` union is **incomplete** (server.heartbeat,
+ * permission.asked emit but are not declared) and over-promises
+ * (permission.replied, message.part.updated declared but never observed).
+ * Defensive code therefore widens to a plain string-key dispatch.
+ */
+export type RawOpencodeEvent = {
+    type: string;
+    properties?: unknown;
+};
+/**
+ * Helper for callers that want to thread the structured-output (`format`)
+ * option through `client.session.prompt({ body: … })`. The SDK's body
+ * type does not list `format`, but the runtime accepts and honors it
+ * (V4). Pass the resulting object to the SDK call via a single cast.
+ */
+export type OpencodeAugmentedPromptBody = import("@opencode-ai/sdk").SessionPromptData["body"] & Partial<import("@opencode-ai/sdk").SessionPromptBodyAugmented>;

package/dist/core/backends/opencode-types.js

@@ -0,0 +1,13 @@
+/**
+ * docs/design/appendices/opencode-backend.md §6.1.0 — local module augmentation + helper
+ * types for the four undeclared surfaces that V3/V4/V9 confirmed exist
+ * at runtime in opencode 1.14.50 but are missing from the SDK's
+ * generated types.
+ *
+ * The `declare module "@opencode-ai/sdk"` block adds the three runtime
+ * fields the SDK omits (format on the prompt body, structured on the
+ * assistant message, total on the token block). The helper types below
+ * widen the event union so we never compile against the SDK's
+ * incomplete `EventSubscribeResponse`.
+ */
+export {};

package/dist/core/backends/plan-presets.d.ts

@@ -14,8 +14,10 @@
  *   - Drives the seed model selection from each process key's default
  *     tier (`getDefaultTierForProcessKey`). Lite-tier keys seed Haiku
  *     (Claude) / gpt-5.4-mini (Codex) / flash-lite (Gemini); medium-tier
- *     keys seed Sonnet / gpt-5.4-mini / 3.1-flash-lite-preview; high-tier keys seed
- *     Opus / gpt-5.5 / 3.1-pro-preview.
+ *     keys seed Sonnet / gpt-5.4 / 3.1-flash-lite-preview; high-tier keys seed
+ *     Opus / gpt-5.4 / 3.1-pro-preview. (Codex's high tier collapses to
+ *     gpt-5.4 by default via `SEED_HIGH_TIER_OVERRIDE` in model-registry.ts
+ *     — gpt-5.5 is Opus-priced and operator-pinned, not the silent default.)
  *   - Exposes `setMainBackend(db, backendId)` — writes
  *     `backend_global_defaults.default_backend` only. No preset
  *     application, no per-process row mutation. The dashboard's main-
@@ -29,7 +31,16 @@
  * Tier-to-model resolution lives in `model-registry.ts:defaultModelForTier`.
  */
 import type Database from "better-sqlite3";
-import { type BackendId, type ProcessKey, type ProcessModelTier } from "@aitne/shared";
+import { type BackendId, type BackendModelTier, type ProcessKey, type ProcessModelTier } from "@aitne/shared";
+/**
+ * Scale a `maxBudgetUsd` for the given backend + tier. Exported so the
+ * cross-backend cascade in `process-config-cascade.ts` can apply the
+ * same factor to its INHERITOR_DEFAULTS when an operator edits
+ * `message.dm` on a non-Claude backend.
+ *
+ * Rounds to 2 decimals so the DB-stored cents-precision value is stable.
+ */
+export declare function applyBackendBudgetFactor(backendId: BackendId, tier: BackendModelTier, baseBudgetUsd: number): number;
 /**
  * Resolve the seed `(model, envelope)` for a configurable process key on
  * the given backend. The model is selected by the process key's default
@@ -79,8 +90,10 @@ export interface ApplyDefaultPresetsOptions {
  *     `backend_global_defaults.default_backend` (claude as last resort).
  *   - Seeds each row with a model resolved by `resolveDefaultBindingFor`
  *     (lite tier seeds Haiku on Claude / gpt-5.4-mini on Codex /
- *     flash-lite preview on Gemini; medium tier seeds Sonnet / gpt-5.4-mini
- *     / 3.1-flash-lite-preview; high tier seeds Opus / gpt-5.5 / 3.1-pro-preview).
+ *     flash-lite preview on Gemini; medium tier seeds Sonnet / gpt-5.4
+ *     / 3.1-flash-lite-preview; high tier seeds Opus / gpt-5.4 /
+ *     3.1-pro-preview — Codex's high tier intentionally collapses to
+ *     gpt-5.4, see `SEED_HIGH_TIER_OVERRIDE`).
  *   - Updates `default_lite_model` / `default_medium_model` /
  *     `default_high_model` / `default_backend` on the singleton row.
  *   - Skips rows whose `updated_by='user'` unless `force: true`.
@@ -122,4 +135,3 @@ export declare function previewMainSwitchImpact(db: Database.Database, targetBac
  * next to a pinned row. Returns `null` when the model is unknown.
  */
 export declare function inferTierForModel(backendId: BackendId, modelId: string): ProcessModelTier | null;
-//# sourceMappingURL=plan-presets.d.ts.map

package/dist/core/backends/plan-presets.js

@@ -14,8 +14,10 @@
  *   - Drives the seed model selection from each process key's default
  *     tier (`getDefaultTierForProcessKey`). Lite-tier keys seed Haiku
  *     (Claude) / gpt-5.4-mini (Codex) / flash-lite (Gemini); medium-tier
- *     keys seed Sonnet / gpt-5.4-mini / 3.1-flash-lite-preview; high-tier keys seed
- *     Opus / gpt-5.5 / 3.1-pro-preview.
+ *     keys seed Sonnet / gpt-5.4 / 3.1-flash-lite-preview; high-tier keys seed
+ *     Opus / gpt-5.4 / 3.1-pro-preview. (Codex's high tier collapses to
+ *     gpt-5.4 by default via `SEED_HIGH_TIER_OVERRIDE` in model-registry.ts
+ *     — gpt-5.5 is Opus-priced and operator-pinned, not the silent default.)
  *   - Exposes `setMainBackend(db, backendId)` — writes
  *     `backend_global_defaults.default_backend` only. No preset
  *     application, no per-process row mutation. The dashboard's main-
@@ -40,26 +42,147 @@ const logger = createLogger("default-presets");
  * are short-shaped tool sequences, not free-form chat. The "high"
  * envelope is generous because a high-tier seed implies the task is
  * one-shot, generative, and benefits from extra reasoning room.
+ *
+ * Values are sized for the Claude SDK / OpenCode (Anthropic-backed)
+ * runtime: both abort mid-turn when the running cost crosses
+ * `maxBudgetUsd`. Codex and Gemini have no in-flight cost enforcement
+ * (Codex CLI / Gemini CLI run to completion, then the daemon checks the
+ * actual cost), so an identical $0.20 ceiling fails sessions that a
+ * Claude run would have truncated and returned partially. `applyBackendBudgetFactor`
+ * raises the post-hoc ceiling for those backends so equivalent work
+ * lands inside the cap.
  */
 const ENVELOPE_BY_TIER = {
     lite: { maxTurns: 20, maxBudgetUsd: 0.2 },
     medium: { maxTurns: 50, maxBudgetUsd: 1.0 },
     high: { maxTurns: 80, maxBudgetUsd: 3.0 },
 };
+/**
+ * Per-backend post-hoc budget multipliers. Applied to every envelope's
+ * `maxBudgetUsd` (tier nominal AND per-process override) by
+ * `applyBackendBudgetFactor`. `maxTurns` is unaffected — turns are about
+ * shape, not cost.
+ *
+ * Claude / OpenCode = 1.0 (SDK aborts mid-turn at the cap, so the
+ * nominal value also bounds the actual). Codex / Gemini are scaled up so
+ * the post-hoc check matches the *effective* spend a Claude session
+ * lands on after mid-turn abort, rather than rejecting any single turn
+ * that would have been truncated.
+ *
+ * Targets: lite $0.20 → $0.50, medium $1.00 → $1.50, high $3.00 → $5.00.
+ */
+const BACKEND_BUDGET_FACTOR = {
+    codex: { lite: 2.5, medium: 1.5, high: 5 / 3 },
+    gemini: { lite: 2.5, medium: 1.5, high: 5 / 3 },
+};
+/**
+ * Scale a `maxBudgetUsd` for the given backend + tier. Exported so the
+ * cross-backend cascade in `process-config-cascade.ts` can apply the
+ * same factor to its INHERITOR_DEFAULTS when an operator edits
+ * `message.dm` on a non-Claude backend.
+ *
+ * Rounds to 2 decimals so the DB-stored cents-precision value is stable.
+ */
+export function applyBackendBudgetFactor(backendId, tier, baseBudgetUsd) {
+    const factor = BACKEND_BUDGET_FACTOR[backendId]?.[tier] ?? 1;
+    if (factor === 1)
+        return baseBudgetUsd;
+    return Math.round(baseBudgetUsd * factor * 100) / 100;
+}
 /**
  * Per-process envelope overrides. Layered on top of `ENVELOPE_BY_TIER` so
  * a process key whose worst-case cost is structurally heavier (or lighter)
  * than its tier's nominal envelope can be sized correctly without burning
  * a whole tier on the difference.
  *
- * The schema-seed row in `schema.ts` MUST keep `(maxTurns, maxBudgetUsd)`
- * in lock-step with the entry here; otherwise a "Reset to defaults" or
- * main-backend switch with `force: true` would silently overwrite the
- * schema-seeded envelope with the bare tier default and re-introduce the
- * regression this map exists to prevent.
+ * **Lock-step invariant.** Every entry here MUST equal the corresponding
+ * `(max_turns, max_budget_usd)` in the schema-seed row in `schema.ts`.
+ * `applyDefaultPresets` is the only writer of these envelopes after
+ * install — both `force:false` (main-backend cascade) and `force:true`
+ * (Reset) take their values from this map. If schema and override
+ * diverge, the override wins on any apply-defaults call and silently
+ * reshapes the envelope. The `preserves every schema-seed envelope`
+ * regression test in `plan-presets.test.ts` walks every row and pins
+ * this for all configurable process keys.
+ *
+ * Inclusion rule: a process key needs an entry here iff its schema-seed
+ * envelope differs from `ENVELOPE_BY_TIER[<its default tier>]`. Process
+ * keys whose schema seed matches the bare tier envelope (e.g.
+ * `message.mention` / `dashboard.chat` = medium 50/$1.00) do not need
+ * an entry. (`message.dm` USED to be such a key, but now carries a
+ * wider $5.00 ceiling — see its entry below.)
  */
 const ENVELOPE_OVERRIDES_BY_PROCESS_KEY = {
-    // `routine.roadmap_refresh` is not in `ROUTINE_WINDOWS`, so its
+    // ── Medium-tier WIDER envelope ────────────────────────────────────────
+    //
+    // `message.dm` is the operator's primary conversational surface. Each
+    // turn re-processes the full DM history (which can carry prior
+    // browser-task reports + screenshots) and routinely runs $0.70-0.80 on
+    // Sonnet, hugging the old $1.00 medium nominal. Legitimate multi-step
+    // turns (dispatch a browser task, answer a follow-up, do real tool
+    // work) tipped over $1.00 mid-turn and surfaced a
+    // BackendQuotaError(max_budget_usd) to the user even when the work
+    // itself succeeded. $5.00 is a per-turn CEILING, not a target. Kept in
+    // lock-step with the schema-seed row; bumped for upgrading installs by
+    // migration 0006. (message.mention / dashboard.chat stay on the bare
+    // medium nominal and need no entry.)
+    "message.dm": { maxTurns: 50, maxBudgetUsd: 5.0 },
+    // ── Medium-tier tighter envelopes ────────────────────────────────────
+    //
+    // `routine.today_refresh` is drift-triggered. A typical refresh on
+    // Sonnet runs ~$0.10 in 4 turns; the $0.30 cap is 3x observed cost,
+    // matching the headroom convention used by dashboard.docs_qa.
+    "routine.today_refresh": { maxTurns: 20, maxBudgetUsd: 0.3 },
+    // Above medium nominal: V2-disabled monolithic path absorbs fetch +
+    // synthesis in one session and tripped $1 on Sonnet. Lock-step with
+    // the schema-seed row.
+    "routine.morning_routine": { maxTurns: 50, maxBudgetUsd: 2.0 },
+    // morning-routine-optimization.md Phase 5 — Stage A of the split
+    // pipeline. Originally seeded at $0.50 on the projection that the
+    // Stage A task-flow would shrink to 6-8 KB (~40-50% off the
+    // monolithic session) once Step 5 daily-journal prose and Step 1
+    // handoff parsing moved off the agent. The handoff/journal moves
+    // shipped but the task-flow body did not shrink: the file is still
+    // ~34 KB and Stage A loads 9 skills, so even the design's own
+    // typical-day p95 ($0.52) and initial-day worst case ($0.70) sit
+    // at/above the $0.50 cap. Anthropic SDK enforces max_budget_usd by
+    // aborting mid-turn — production runs hit BackendQuotaError(max_budget_usd)
+    // mid-session. Realigned to $1.50: 3x the typical p95 (matching the
+    // headroom convention used by routine.today_refresh), above the
+    // initial-day worst case, and below the parent envelope ($2.00)
+    // so Stage A still can't silently consume the parent's headroom.
+    // Keep in lock-step with the corresponding schema-seed row.
+    "routine.morning_routine_today": { maxTurns: 50, maxBudgetUsd: 1.5 },
+    // morning-routine-optimization.md Phase 5 — Stage B is template-
+    // driven daily-journal authoring on lite tier. The original $0.10 cap
+    // was sized to a 15 KB prompt projection; production showed Stage B's
+    // assembled prompt at ~21 KB and Haiku cache_creation alone (charged
+    // at 1.25x input) consumes ~$0.06 on cold start. A single Bash
+    // tool round-trip then tipped over $0.10 mid-turn, producing
+    // BackendQuotaError(max_budget_usd) before Stage B could PUT
+    // `daily/<yesterday>.md` — the user-facing journal was silently
+    // missing for every recurring run. Realigned to $0.30: 3x the
+    // observed typical spend (matching the headroom convention also
+    // used by routine.today_refresh) and below the lite-tier nominal
+    // ceiling so the cap still binds in pathological cases. Keep in
+    // lock-step with the corresponding schema-seed row.
+    "routine.morning_routine_journal": { maxTurns: 20, maxBudgetUsd: 0.3 },
+    // `dashboard.docs_qa` is a focused QA panel, hard-clamped to medium
+    // tier per §10.1. INHERITOR_DEFAULTS in process-config-cascade.ts
+    // mirrors this envelope so cascade writes from message.dm don't bleed
+    // the source's caps into the inheritor.
+    "dashboard.docs_qa": { maxTurns: 20, maxBudgetUsd: 0.5 },
+    // `git.project.update` is an operator-driven update pass — narrower
+    // than the medium-tier nominal. `retemplate` is wider because re-template
+    // work is structurally unbounded by shape. init stays on the medium
+    // default 50/$1.00 (no override needed).
+    "git.project.update": { maxTurns: 30, maxBudgetUsd: 0.5 },
+    "git.project.retemplate": { maxTurns: 100, maxBudgetUsd: 2.0 },
+    // P22 skill self-optimization. Read-only workdir besides curation API;
+    // wider turn count (60) for survey work, tighter $ cap ($0.5) since
+    // proposals are bounded by per-run rate limit (max 20).
+    "routine.skill_curation": { maxTurns: 60, maxBudgetUsd: 0.5 },
+    // `routine.roadmap_refresh` is NOT in `ROUTINE_WINDOWS`, so its
     // dispatcher does not attach a `routine.fetch_window` pre-pass. In
     // `native` integration mode the synthesis session itself drives the
     // Calendar (90d) / Mail / Notion MCP fan-out — that fan-out blew past
@@ -67,22 +190,65 @@ const ENVELOPE_OVERRIDES_BY_PROCESS_KEY = {
     // BackendQuotaError(max_budget_usd) on Sonnet 4.6. 60 turns / $3.00
     // matches the high-tier envelope ceiling, sized so the cap still
     // binds well before runaway but accommodates a native-mode session
-    // that does both fetch and synthesise in one run. Keep in lock-step
-    // with the seed row in schema.ts.
+    // that does both fetch and synthesise in one run.
     "routine.roadmap_refresh": { maxTurns: 60, maxBudgetUsd: 3.0 },
-    // WIKI_BUILDER_DESIGN.md Phase 1. Ingestion is bounded like a focused
-    // importer; compile can fan in many raw notes and intentionally gets a
-    // larger synthesis envelope. Keep in lock-step with schema.ts seeds.
-    "wiki.ingest_url": { maxTurns: 30, maxBudgetUsd: 0.5 },
+    // ── WIKI_BUILDER_DESIGN.md Phase 1 ────────────────────────────────────
+    //
+    // `ingest_url` is bounded like a focused importer (note: schema seed
+    // says $1.00; align here so apply-defaults reproduces the install
+    // value rather than silently shrinking it). `compile` can fan in many
+    // raw notes and intentionally gets a larger synthesis envelope.
+    "wiki.ingest_url": { maxTurns: 30, maxBudgetUsd: 1.0 },
     "wiki.compile": { maxTurns: 100, maxBudgetUsd: 5.0 },
     // WIKI_BUILDER_DESIGN.md Phase 3 — lint is a structured pass over the
-    // index + recent log entries; its envelope is intentionally tighter than
-    // the medium-tier default (50/$1.00). Without an explicit override here,
-    // a "Reset to defaults" or main-backend switch with `force: true` would
-    // silently widen the seeded 40/$0.50 row back to 50/$1.00. wiki.ask,
-    // wiki.trace, and wiki.connect deliberately sit on the medium tier
-    // default and are NOT listed here.
+    // index + recent log entries; its envelope is intentionally tighter
+    // than the medium-tier default (50/$1.00). wiki.ask, wiki.trace, and
+    // wiki.connect deliberately sit on the medium tier default and are
+    // NOT listed here.
     "wiki.lint": { maxTurns: 40, maxBudgetUsd: 0.5 },
+    // ── Lite-tier tighter envelopes ──────────────────────────────────────
+    //
+    // cost-reduction-structural §A — per-observation summarizer. Single
+    // non-tool model call per observation; 1 turn / $0.05 is the absolute
+    // ceiling. The dispatcher clamps allowedToolsOverride to [] so this
+    // envelope is defense-in-depth on top of the prompt's "no tools"
+    // contract.
+    "observation.summarize": { maxTurns: 1, maxBudgetUsd: 0.05 },
+    // cost-reduction-structural §B — Stage 2 lite-tier triage. Strict
+    // JSON-only output (~2K input / ~50 output) decides log_only vs
+    // escalate. 1 turn / $0.05 mirrors observation.summarize.
+    "routine.hourly_check.triage": { maxTurns: 1, maxBudgetUsd: 0.05 },
+    // docs/design/appendices/routine-data-acquisition.md §6.2 / §6.9 pre-pass fetcher.
+    // The lite-tier nominal ($0.20) under-provisioned the morning fan-out
+    // (2 mail providers × N accounts + calendar + notion) and tripped
+    // BackendQuotaError(max_budget_usd) mid-fetch — widened to $0.50 so
+    // the cap still binds well before runaway but accommodates the real
+    // worst-case fan-out. 20-turn turn count is unchanged. Keep in
+    // lock-step with the corresponding schema-seed row.
+    "routine.fetch_window": { maxTurns: 20, maxBudgetUsd: 0.5 },
+    // BROWSER_HISTORY_INTEGRATION_PLAN P3 — keep these in lock-step with
+    // the schema seed rows. cluster_update is a tiny dispatcher (1 PUT
+    // + a list call), so the absolute floor of 5/$0.05 is the right
+    // envelope. research_offer_dm is even tighter — a single DM
+    // composition (GET /research-clusters/<slug> + POST /api/notify),
+    // 5/$0.02 leaves no room for runaway. research_dispatch carries the
+    // WebFetch fan-out; mirrors evening_review (50/$1.00).
+    // research_wiki_summary is tighter (30/$0.50) — it reads the cluster
+    // journal the agent already wrote and composes from it, with
+    // bounded external work.
+    "routine.research_cluster_update": { maxTurns: 5, maxBudgetUsd: 0.05 },
+    "routine.research_offer_dm": { maxTurns: 5, maxBudgetUsd: 0.02 },
+    "routine.research_dispatch": { maxTurns: 50, maxBudgetUsd: 1.0 },
+    "routine.research_wiki_summary": { maxTurns: 30, maxBudgetUsd: 0.5 },
+    // BROWSER_TASK_REDESIGN_PLAN.md §5 — open-ended browser sub-agent.
+    // Medium-tier nominal is 50/$1.00; the §5 envelope picks a tighter
+    // 30-turn cap because the per-turn cost rises with multimodal
+    // screenshot input (one PNG ≤ 1MB per visual confirmation, and the
+    // typical sub-agent loop captures 4-5 over its lifetime). 30 turns
+    // keeps the upper bound bounded while $1.00 absorbs the screenshot
+    // cost without tripping BackendQuotaError. Lock-step with the
+    // schema-seed row.
+    "browser_task": { maxTurns: 30, maxBudgetUsd: 1.0 },
 };
 /**
  * Resolve the seed `(model, envelope)` for a configurable process key on
@@ -98,7 +264,7 @@ export function resolveDefaultBindingFor(backendId, processKey) {
     return {
         model: defaultModelForTier(backendId, tier),
         maxTurns: envelope.maxTurns,
-        maxBudgetUsd: envelope.maxBudgetUsd,
+        maxBudgetUsd: applyBackendBudgetFactor(backendId, tier, envelope.maxBudgetUsd),
     };
 }
 /**
@@ -111,8 +277,10 @@ export function resolveDefaultBindingFor(backendId, processKey) {
  *     `backend_global_defaults.default_backend` (claude as last resort).
  *   - Seeds each row with a model resolved by `resolveDefaultBindingFor`
  *     (lite tier seeds Haiku on Claude / gpt-5.4-mini on Codex /
- *     flash-lite preview on Gemini; medium tier seeds Sonnet / gpt-5.4-mini
- *     / 3.1-flash-lite-preview; high tier seeds Opus / gpt-5.5 / 3.1-pro-preview).
+ *     flash-lite preview on Gemini; medium tier seeds Sonnet / gpt-5.4
+ *     / 3.1-flash-lite-preview; high tier seeds Opus / gpt-5.4 /
+ *     3.1-pro-preview — Codex's high tier intentionally collapses to
+ *     gpt-5.4, see `SEED_HIGH_TIER_OVERRIDE`).
  *   - Updates `default_lite_model` / `default_medium_model` /
  *     `default_high_model` / `default_backend` on the singleton row.
  *   - Skips rows whose `updated_by='user'` unless `force: true`.
@@ -272,4 +440,3 @@ function highModelFor(backendId) {
         return DEFAULT_CLAUDE_HIGH_MODEL;
     return defaultModelForTier(backendId, "high");
 }
-//# sourceMappingURL=plan-presets.js.map

package/dist/core/backends/price-fetcher.d.ts

@@ -45,4 +45,3 @@ export declare class PriceFetcher {
     private writeStatus;
 }
 export {};
-//# sourceMappingURL=price-fetcher.d.ts.map

package/dist/core/backends/price-fetcher.js

@@ -245,4 +245,3 @@ function isUsageFullyCoveredByPriceEntry(entry, usage) {
 function readOptionalNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
-//# sourceMappingURL=price-fetcher.js.map

package/dist/core/backends/process-config-cascade.d.ts

@@ -42,6 +42,12 @@ export declare const INHERITANCE_CASCADE_MAP: ReadonlyArray<{
     /** Tier the inheritor's model is re-resolved for, regardless of source. */
     inheritorTier: ProcessModelTier;
 }>;
+interface BackendDefaultsRow {
+    default_backend: BackendId;
+    default_lite_model: string;
+    default_medium_model: string;
+    default_high_model: string;
+}
 export interface ProcessConfigWrite {
     processKey: ProcessKey;
     mainBackend: BackendId;
@@ -65,4 +71,32 @@ export interface ProcessConfigWrite {
 export declare function setProcessBackendConfig(db: Database.Database, write: ProcessConfigWrite): {
     cascaded: ProcessKey[];
 };
-//# sourceMappingURL=process-config-cascade.d.ts.map
+declare function readUpdatedBy(db: Database.Database, processKey: ProcessKey): string | null;
+/**
+ * Resolve a canonical model id for `(backendId, tier)`. Mirrors the
+ * priority chain inside `BackendRouter.resolveDefaultModelId` so cascade
+ * writes pick the same model the router would default to if no row
+ * existed at all.
+ *
+ * Priority:
+ *   1. `backend_global_defaults` row (when its backend matches AND the
+ *      configured default-tier model is actually that tier in the
+ *      registry).
+ *   2. First registered, available model on (backendId, tier).
+ *   3. Hardcoded Claude Sonnet/Opus fallback (only when backend=claude).
+ *   4. As a last resort, the source's pinned model — better to keep a
+ *      working binding than to write `null` and crash dispatch.
+ */
+declare function resolveTierModel(db: Database.Database, backendId: BackendId, tier: ProcessModelTier): string;
+declare function readDefaults(db: Database.Database): BackendDefaultsRow | null;
+/**
+ * Internal helpers exposed for unit testing. Production code should
+ * call `setProcessBackendConfig` instead — these are private to the
+ * cascade-write chokepoint.
+ */
+export declare const _internals: {
+    resolveTierModel: typeof resolveTierModel;
+    readDefaults: typeof readDefaults;
+    readUpdatedBy: typeof readUpdatedBy;
+};
+export {};