@aitne/daemon 0.1.8 → 0.1.10

package/dist/api/routes/context/write.js

@@ -1,13 +1,15 @@
 import { existsSync, readFileSync, statSync, unlinkSync, } from "node:fs";
 import { contextPatchSchema, contextPutSchema, getAgentDayDateStr, localDateStr, } from "@aitne/shared";
 import { writeFileAtomically } from "../../../core/atomic-write.js";
-import { validateDailySkeletonFrontmatter } from "../../../core/context-frontmatter.js";
+import { serializeContextFileWrite } from "../../../core/context-file-serializer.js";
 import { clearEntriesBefore, findSection, getAvailableSections, isLegacyTodayContent, prepareContextContentForWrite, trimBulletEntries, } from "../../../core/context-validation/index.js";
 import { createLogger } from "../../../logging.js";
 import { composeIssue, respondWithAgentError, } from "../../helpers/agent-errors.js";
 import { readJsonBody } from "../../json-body.js";
-import { CREATE_ONLY_PUT, isWriteAllowed, notifyPromptContextChanged, shouldRefreshPromptContext, } from "./permissions.js";
+import { APPEND_ONLY_PATCH_MODES, CREATE_ONLY_PUT, isWriteAllowed, notifyPromptContextChanged, shouldRefreshPromptContext, } from "./permissions.js";
 import { normalizeContextPath, resolveContextTarget, safePath, } from "./path-resolve.js";
+import { performContextFileWrite } from "./write-step.js";
+import { mergeFrontmatter } from "./frontmatter-merge.js";
 const logger = createLogger("context-api");
 /**
  * Cap on the JSON body accepted by the Context PUT/PATCH endpoints.
@@ -33,8 +35,83 @@ const logger = createLogger("context-api");
  * `readOptionalJsonBody` whose payloads are tiny by construction.
  */
 const CONTEXT_BODY_MAX_BYTES = 1024 * 1024;
+const CONTEXT_PATCH_MODE_VALID_VALUES = [
+    "append",
+    "replace",
+    "clear",
+    "clear_before",
+    "append_to_file",
+];
+/**
+ * Decompose a failed Zod parse into actionable issues the agent can
+ * self-correct from. Each Zod issue becomes its own AgentErrorIssue with:
+ *   - `field`: dotted Zod path (e.g. "mode")
+ *   - `received`: the value that actually failed validation, so the agent
+ *     sees what it sent — not just the schema's expectation.
+ *   - `validValues`: for enum-like fields, surface the accepted list.
+ *
+ * When the top-level body is not an object (or is null/array), emit a
+ * single `context.body_not_object` issue so the existing hint kicks in.
+ * Otherwise each field-level failure is `context.invalid_body_field` —
+ * a new code introduced because the legacy `body_not_object` was emitted
+ * for both shapes and confused the agent (the prior hint said "wrap in
+ * {}" even when the body was already an object).
+ */
+function buildSchemaIssues(body, error) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return [
+            composeIssue("context.body_not_object", {
+                field: "body",
+                received: body === null
+                    ? "null"
+                    : Array.isArray(body)
+                        ? "array"
+                        : typeof body,
+            }),
+        ];
+    }
+    const seen = new Set();
+    const issues = [];
+    for (const issue of error.issues) {
+        const field = issue.path.length === 0 ? "body" : issue.path.join(".");
+        // Zod refinements emit duplicate path entries — dedupe so the response
+        // doesn't repeat the same row-level error.
+        const key = `${field}:${issue.message}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        // Zod 4 exposes the failing value on issue.input; fall back to walking
+        // the body by path so older issue shapes still surface something useful.
+        const received = readPath(body, issue.path);
+        const validValues = field === "mode" ? CONTEXT_PATCH_MODE_VALID_VALUES : undefined;
+        issues.push(composeIssue("context.invalid_body_field", {
+            field,
+            received,
+            expected: issue.message,
+            validValues,
+        }));
+    }
+    // If Zod produced no issues (unreachable from safeParse, but defensive),
+    // emit a single fallback so the agent still gets actionable output.
+    if (issues.length === 0) {
+        issues.push(composeIssue("context.invalid_body_field", {
+            field: "body",
+            received: "(see route schema)",
+        }));
+    }
+    return issues;
+}
+function readPath(root, path) {
+    let cur = root;
+    for (const seg of path) {
+        if (cur === null || typeof cur !== "object")
+            return undefined;
+        cur = cur[seg];
+    }
+    return cur;
+}
 export function registerWriteRoutes(app, ctx) {
-    const { deps, getCurrentContextDir, morningRoutineLock, roadmapWriteLock, saveSnapshot, withWriteLock, isRoadmapValidationDisabled, logRoadmapValidationBypass, roadmapDefaultLongTermPlanSource, } = ctx;
+    const { deps, getCurrentContextDir, morningRoutineLock, roadmapWriteLock, saveSnapshot, isRoadmapValidationDisabled, logRoadmapValidationBypass, roadmapDefaultLongTermPlanSource, } = ctx;
     const { config, writeTracker } = deps;
     // PUT /context/* — Full replace
     app.put("/context/*", async (c) => {
@@ -61,7 +138,7 @@ export function registerWriteRoutes(app, ctx) {
             ]);
         }
         // Morning Routine lock: reject writes to today while lock is held
-        if (morningRoutineLock.getHolder() && path === "today") {
+        if (morningRoutineLock.getHolder() && path === "state/today") {
             const lockId = c.req.header("X-Lock-Id");
             if (!morningRoutineLock.isHeldBy(lockId)) {
                 logger.info({ path }, "Context PUT rejected — morning routine lock held");
@@ -74,7 +151,7 @@ export function registerWriteRoutes(app, ctx) {
             }
         }
         // Roadmap write lock: reject writes to roadmap while another session holds it
-        if (roadmapWriteLock.getHolder() && path === "roadmap") {
+        if (roadmapWriteLock.getHolder() && path === "plans/roadmap") {
             const lockId = c.req.header("X-Lock-Id");
             if (!roadmapWriteLock.isHeldBy(lockId)) {
                 logger.info({ path }, "Context PUT rejected — roadmap write lock held");
@@ -92,18 +169,13 @@ export function registerWriteRoutes(app, ctx) {
         const body = parsedBody.body;
         const parsed = contextPutSchema.safeParse(body);
         if (!parsed.success) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.body_not_object", {
-                    field: "body",
-                    received: parsed.error.issues.map((i) => i.message).join("; "),
-                }),
-            ]);
+            return respondWithAgentError(c, 400, buildSchemaIssues(body, parsed.error));
         }
         const roadmapValidationOff = isRoadmapValidationDisabled(path, c.req.header("X-Roadmap-Validation"));
         if (roadmapValidationOff) {
             logRoadmapValidationBypass(c, "PUT", path);
         }
-        const expectedAgentDay = path === "today"
+        const expectedAgentDay = path === "state/today"
             ? getAgentDayDateStr(config.timezone || undefined, config.dayBoundaryHour ?? 4)
             : undefined;
         const preflight = prepareContextContentForWrite(target, parsed.data.content, {
@@ -125,31 +197,11 @@ export function registerWriteRoutes(app, ctx) {
                 },
             });
         }
-        // morning-routine-optimization.md §"PUT /api/context/daily/<date>
-        // skeleton-preservation validator" — only runs once generic
-        // frontmatter validation (type/owner/updated/H1) has passed.
-        // Returns per-field structured drift errors for the five
-        // skeleton-owned frontmatter fields (date, weekday,
-        // agent_generated, calendar_events, messages_handled) so Stage B
-        // can fix every missing/malformed field in a single retry rather
-        // than discovering them one at a time. Body is NOT validated —
-        // Stage B authors body per rules/journal-format.md.
-        if (target.base.startsWith("daily/")) {
-            const dailyRelativePath = `${target.base}${target.ext}`;
-            const driftErrors = validateDailySkeletonFrontmatter(preflight.content, dailyRelativePath);
-            if (driftErrors.length > 0) {
-                return respondWithAgentError(c, 422, driftErrors.map((drift) => composeIssue("context.daily_skeleton_field_drift", {
-                    field: drift.field,
-                    received: drift.received ?? "<missing>",
-                    expected: drift.expected,
-                })));
-            }
-        }
         const sessionId = c.req.header("X-Session-Id");
-        return withWriteLock(() => {
+        return serializeContextFileWrite(fullPath, () => {
             // Append-only files: PUT is only allowed for initial creation.
             // Once the file exists, all writes must go through PATCH to preserve
-            // the append-only contract. This check MUST be inside withWriteLock
+            // the append-only contract. This check MUST be inside the serializer
             // to prevent TOCTOU races where two concurrent PUTs both pass an
             // outer existsSync check and then sequentially overwrite.
             if (CREATE_ONLY_PUT.has(path) && existsSync(fullPath)) {
@@ -165,7 +217,6 @@ export function registerWriteRoutes(app, ctx) {
             // compare against the current file. On mismatch, return 409 with
             // the current state so the UI can surface a conflict dialog without
             // a second round-trip.
-            let snapshotId = null;
             let contentToWrite = preflight.content;
             if (existsSync(fullPath)) {
                 const currentStat = statSync(fullPath);
@@ -211,7 +262,6 @@ export function registerWriteRoutes(app, ctx) {
                     });
                 }
                 contentToWrite = prepared.content;
-                snapshotId = saveSnapshot(path, existing, "api_put", true, sessionId);
             }
             else if (parsed.data.expectedMtime !== undefined) {
                 // Client expected a specific mtime but the file is gone
@@ -230,30 +280,59 @@ export function registerWriteRoutes(app, ctx) {
                     currentContent: "",
                 }, 409);
             }
-            // Symlink-safe atomic write — protects against a TOCTOU swap of
-            // `fullPath` to a symlink between safePath validation and the write.
-            // Mark before the rename so FS-watch consumers attribute the
-            // resulting event to the agent. Roll back on failure (C2).
-            writeTracker?.markWriting(fullPath, contentToWrite);
-            try {
-                writeFileAtomically(fullPath, contentToWrite);
-            }
-            catch (writeErr) {
-                writeTracker?.unmark(fullPath);
-                throw writeErr;
+            // Shared write step — daily-skeleton frontmatter validation,
+            // atomic write, snapshot, writeTracker, indexable hint. See
+            // `write-step.ts:performContextFileWrite` for the contract.
+            const writeResult = performContextFileWrite({
+                saveSnapshot,
+                ...(writeTracker ? { writeTracker } : {}),
+                onIndexableContextChange: deps.onIndexableContextChange ?? undefined,
+            }, {
+                absolutePath: fullPath,
+                relativePath: `${path}${target.ext}`,
+                snapshotKey: path,
+                mode: "put",
+                content: contentToWrite,
+                trigger: "api_put",
+                forceSnapshot: true,
+                sessionId: sessionId ?? null,
+                validateDailySkeleton: true,
+            });
+            if (!writeResult.ok) {
+                if (writeResult.reason === "daily_skeleton_drift") {
+                    return respondWithAgentError(c, 422, writeResult.driftErrors.map((drift) => composeIssue("context.daily_skeleton_field_drift", {
+                        field: drift.field,
+                        received: drift.received ?? "<missing>",
+                        expected: drift.expected,
+                    })));
+                }
+                // `missing_for_append` is unreachable in the PUT branch — the
+                // helper only returns it for `mode = "append_block"`. Defensive
+                // fall-through keeps the type narrow.
+                /* c8 ignore next 6 */
+                return respondWithAgentError(c, 500, [
+                    composeIssue("context.write_failed", {
+                        field: "path",
+                        received: path,
+                    }),
+                ]);
             }
             if (shouldRefreshPromptContext(path, "PUT")) {
                 notifyPromptContextChanged(deps, path, `context_put:${path}`, { path, method: "PUT" });
             }
-            if (path.startsWith("routines/custom/")) {
+            if (path.startsWith("policies/routines/custom/")) {
                 deps.onCustomRoutinesChanged?.();
             }
-            deps.onIndexableContextChange?.(`${path}${target.ext}`);
             const writtenStat = statSync(fullPath);
-            logger.info({ path, method: "PUT", bytesWritten: writtenStat.size, snapshotId: snapshotId ?? undefined }, "Context file updated");
+            logger.info({
+                path,
+                method: "PUT",
+                bytesWritten: writeResult.bytesWritten,
+                snapshotId: writeResult.snapshotId ?? undefined,
+            }, "Context file updated");
             return c.json({
                 status: "updated",
-                snapshotId: snapshotId ?? 0,
+                snapshotId: writeResult.snapshotId ?? 0,
                 lastModified: writtenStat.mtime.toISOString(),
             });
         });
@@ -283,7 +362,7 @@ export function registerWriteRoutes(app, ctx) {
             ]);
         }
         // Morning Routine lock: reject writes to today while lock is held
-        if (morningRoutineLock.getHolder() && path === "today") {
+        if (morningRoutineLock.getHolder() && path === "state/today") {
             const lockId = c.req.header("X-Lock-Id");
             if (!morningRoutineLock.isHeldBy(lockId)) {
                 logger.info({ path }, "Context PATCH rejected — morning routine lock held");
@@ -296,7 +375,7 @@ export function registerWriteRoutes(app, ctx) {
             }
         }
         // Roadmap write lock: reject writes to roadmap while another session holds it
-        if (roadmapWriteLock.getHolder() && path === "roadmap") {
+        if (roadmapWriteLock.getHolder() && path === "plans/roadmap") {
             const lockId = c.req.header("X-Lock-Id");
             if (!roadmapWriteLock.isHeldBy(lockId)) {
                 logger.info({ path }, "Context PATCH rejected — roadmap write lock held");
@@ -314,12 +393,7 @@ export function registerWriteRoutes(app, ctx) {
         const body = parsedBody.body;
         const parsed = contextPatchSchema.safeParse(body);
         if (!parsed.success) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.body_not_object", {
-                    field: "body",
-                    received: parsed.error.issues.map((i) => i.message).join("; "),
-                }),
-            ]);
+            return respondWithAgentError(c, 400, buildSchemaIssues(body, parsed.error));
         }
         if (target.ext === ".base") {
             return respondWithAgentError(c, 400, [
@@ -329,16 +403,38 @@ export function registerWriteRoutes(app, ctx) {
                 }),
             ]);
         }
-        const { section, mode, content: newContent, cutoff, maxEntries } = parsed.data;
+        const { section, mode, content: newContent, cutoff, maxEntries, frontmatter } = parsed.data;
+        // Append-only enforcement — see `permissions.ts:CREATE_ONLY_PUT` /
+        // `APPEND_ONLY_PATCH_MODES`. The PUT-side gate at line ~267 rejects
+        // re-creates of these files; this gate is the PATCH-side half. Without
+        // it, a prompt-injected agent could PATCH `agent/journal` with
+        // `mode:"replace"` (or `"clear"` / `"clear_before"`) and silently erase
+        // historical entries. We check OUTSIDE the per-path serializer
+        // because the decision is body-only and we want to fail fast before
+        // queueing behind any in-flight write to the same file.
+        if (CREATE_ONLY_PUT.has(path) && !APPEND_ONLY_PATCH_MODES.has(mode)) {
+            logger.warn({ path, mode }, "Context PATCH rejected — append-only path requires append mode");
+            return respondWithAgentError(c, 409, [
+                composeIssue("context.append_only_violation", {
+                    field: "mode",
+                    received: {
+                        path,
+                        mode,
+                        hint: `${path} is append-only. Use mode:"append" or "append_to_file" — existing sections cannot be replaced or cleared.`,
+                        validModes: Array.from(APPEND_ONLY_PATCH_MODES),
+                    },
+                }),
+            ]);
+        }
         const sessionId = c.req.header("X-Session-Id");
         const roadmapValidationOff = isRoadmapValidationDisabled(path, c.req.header("X-Roadmap-Validation"));
         if (roadmapValidationOff) {
             logRoadmapValidationBypass(c, "PATCH", path);
         }
-        const expectedAgentDay = path === "today"
+        const expectedAgentDay = path === "state/today"
             ? getAgentDayDateStr(config.timezone || undefined, config.dayBoundaryHour ?? 4)
             : undefined;
-        return withWriteLock(() => {
+        return serializeContextFileWrite(fullPath, () => {
             if (!existsSync(fullPath)) {
                 return respondWithAgentError(c, 404, [
                     composeIssue("context.path_not_found", {
@@ -354,15 +450,26 @@ export function registerWriteRoutes(app, ctx) {
             // an existing one. Avoids the hack of targeting the last section's
             // body and injecting H2 headers inside it.
             if (mode === "append_to_file") {
-                const separator = fileContent.endsWith("\n") ? "" : "\n";
-                const updated = fileContent + separator + (newContent ?? "") + "\n";
+                // Preserve the existing file's line-ending convention: a CRLF-bodied
+                // vault file (Windows / Obsidian on Windows) must get CRLF separators
+                // and terminator, not LF, or the file ends up with mixed endings that
+                // round-trip dirty under git autocrlf. LF files (macOS/Linux) keep "\n".
+                const eol = /\r\n/.test(fileContent) ? "\r\n" : "\n";
+                const separator = fileContent.endsWith("\n") ? "" : eol;
+                const updated = fileContent + separator + (newContent ?? "") + eol;
+                // Run the same content-validation chain as before — this is
+                // call-site-specific (allowLegacyToday flag, previousRoadmapContent)
+                // and intentionally lives on the HTTP route. The shared helper
+                // then performs the raw atomic-write step against the already-
+                // validated byte stream so HTTP and the in-process daemon
+                // composer share one snapshot/writeTracker/indexable invariant.
                 const prepared = prepareContextContentForWrite(target, updated, {
                     timezone: config.timezone || undefined,
                     disableRoadmapValidation: roadmapValidationOff,
                     previousRoadmapContent: fileContent,
                     today: localDateStr(new Date(), config.timezone || undefined),
                     defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
-                    allowLegacyToday: path === "today" && isLegacyTodayContent(fileContent),
+                    allowLegacyToday: path === "state/today" && isLegacyTodayContent(fileContent),
                     expectedAgentDay,
                 });
                 if (!prepared.ok) {
@@ -378,16 +485,40 @@ export function registerWriteRoutes(app, ctx) {
                         },
                     });
                 }
-                saveSnapshot(path, fileContent, "api_patch", false, sessionId);
-                // Mark before the rename so FS-watch consumers attribute the
-                // resulting event to the agent. Roll back on failure (C2).
-                writeTracker?.markWriting(fullPath, prepared.content);
-                try {
-                    writeFileAtomically(fullPath, prepared.content);
-                }
-                catch (writeErr) {
-                    writeTracker?.unmark(fullPath);
-                    throw writeErr;
+                // The validator may rewrite content; PUT the rewritten bytes
+                // directly rather than re-running the append through the helper
+                // (which would otherwise double-append). The PATCH-side caller
+                // ALREADY did the read-modify-write — we just need the atomic-
+                // replace at this point. Hence `mode: "put"` even though this is
+                // the PATCH route — what's atomic from the helper's perspective
+                // is the disk-replace step, not the source operation.
+                const writeResult = performContextFileWrite({
+                    saveSnapshot,
+                    ...(writeTracker ? { writeTracker } : {}),
+                    onIndexableContextChange: deps.onIndexableContextChange ?? undefined,
+                }, {
+                    absolutePath: fullPath,
+                    relativePath: `${path}${target.ext}`,
+                    snapshotKey: path,
+                    mode: "put",
+                    content: prepared.content,
+                    trigger: "api_patch",
+                    forceSnapshot: false,
+                    sessionId: sessionId ?? null,
+                    // append_to_file is used for agent/journal.md and other
+                    // non-daily files; the daily-skeleton validator is not
+                    // applicable. (The composer's daily-file revision branch
+                    // calls the helper with `mode: "append_block"` directly.)
+                    validateDailySkeleton: false,
+                });
+                if (!writeResult.ok) {
+                    /* c8 ignore next 6 — defensive guard for unreachable branches */
+                    return respondWithAgentError(c, 500, [
+                        composeIssue("context.write_failed", {
+                            field: "path",
+                            received: path,
+                        }),
+                    ]);
                 }
                 if (shouldRefreshPromptContext(path, "PATCH")) {
                     notifyPromptContextChanged(deps, path, `context_patch:${path}`, {
@@ -399,13 +530,90 @@ export function registerWriteRoutes(app, ctx) {
                         previousContent: fileContent,
                     });
                 }
-                if (path.startsWith("routines/custom/")) {
+                if (path.startsWith("policies/routines/custom/")) {
                     deps.onCustomRoutinesChanged?.();
                 }
-                deps.onIndexableContextChange?.(`${path}${target.ext}`);
                 logger.info({ path, method: "PATCH", mode }, "Content appended to file");
                 return c.json({ status: "appended" });
             }
+            // ── frontmatterMerge: deep-merge a partial frontmatter object ──
+            // (docs/design/21-management-registry-and-entities.md §10.4 step 4b —
+            // entity sources.<app>.<id> linkage + last_synced_at). The schema
+            // guarantees `frontmatter` is a non-empty object for this mode and no
+            // section is needed; the body is preserved verbatim. Runs the same
+            // content-validation + atomic-write chain as the other modes.
+            if (mode === "frontmatterMerge") {
+                const merged = mergeFrontmatter(fileContent, frontmatter);
+                if (!merged.ok) {
+                    return respondWithAgentError(c, 400, [
+                        composeIssue("context.content_validation_failed", {
+                            field: "frontmatter",
+                            received: merged.message,
+                        }),
+                    ]);
+                }
+                const prepared = prepareContextContentForWrite(target, merged.content, {
+                    timezone: config.timezone || undefined,
+                    disableRoadmapValidation: roadmapValidationOff,
+                    previousRoadmapContent: fileContent,
+                    today: localDateStr(new Date(), config.timezone || undefined),
+                    defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
+                    allowLegacyToday: path === "state/today" && isLegacyTodayContent(fileContent),
+                    expectedAgentDay,
+                });
+                if (!prepared.ok) {
+                    return respondWithAgentError(c, prepared.status, [
+                        composeIssue("context.content_validation_failed", {
+                            field: prepared.path ?? "content",
+                            received: prepared.message,
+                        }),
+                    ], {
+                        legacyFields: {
+                            message: prepared.message,
+                            path: prepared.path,
+                        },
+                    });
+                }
+                const writeResult = performContextFileWrite({
+                    saveSnapshot,
+                    ...(writeTracker ? { writeTracker } : {}),
+                    onIndexableContextChange: deps.onIndexableContextChange ?? undefined,
+                }, {
+                    absolutePath: fullPath,
+                    relativePath: `${path}${target.ext}`,
+                    snapshotKey: path,
+                    mode: "put",
+                    content: prepared.content,
+                    trigger: "api_patch",
+                    forceSnapshot: false,
+                    sessionId: sessionId ?? null,
+                    validateDailySkeleton: false,
+                });
+                if (!writeResult.ok) {
+                    /* c8 ignore next 6 — defensive guard for unreachable branches */
+                    return respondWithAgentError(c, 500, [
+                        composeIssue("context.write_failed", {
+                            field: "path",
+                            received: path,
+                        }),
+                    ]);
+                }
+                if (shouldRefreshPromptContext(path, "PATCH")) {
+                    notifyPromptContextChanged(deps, path, `context_patch:${path}`, {
+                        path,
+                        method: "PATCH",
+                        mode,
+                        section,
+                        content: newContent,
+                        previousContent: fileContent,
+                    });
+                }
+                if (path.startsWith("policies/routines/custom/")) {
+                    deps.onCustomRoutinesChanged?.();
+                }
+                logger.info({ path, method: "PATCH", mode }, "Frontmatter merged");
+                return c.json({ status: "merged" });
+            }
             // ── Section-based modes: require section lookup ──
             const sectionBounds = findSection(fileContent, section);
             if (!sectionBounds) {
@@ -428,11 +636,15 @@ export function registerWriteRoutes(app, ctx) {
             const currentBody = fileContent.slice(sectionBounds.start, sectionBounds.end);
             let removedCount;
             let trimmedCount;
+            // Preserve the existing file's line-ending convention (see append_to_file
+            // above): emit CRLF separators/terminators for a CRLF-bodied file so we
+            // don't produce mixed endings. LF files (macOS/Linux) keep "\n".
+            const eol = /\r\n/.test(fileContent) ? "\r\n" : "\n";
             switch (mode) {
                 case "append": {
                     // Ensure a single newline separator without destroying existing content
-                    const separator = currentBody.endsWith("\n") ? "" : "\n";
-                    let appendedBody = currentBody + separator + (newContent ?? "") + "\n";
+                    const separator = currentBody.endsWith("\n") ? "" : eol;
+                    let appendedBody = currentBody + separator + (newContent ?? "") + eol;
                     // maxEntries: trim oldest bullet entries from the top
                     if (maxEntries !== undefined) {
                         const trimResult = trimBulletEntries(appendedBody, maxEntries);
@@ -443,10 +655,10 @@ export function registerWriteRoutes(app, ctx) {
                     break;
                 }
                 case "replace":
-                    updated = before + (newContent ?? "") + "\n" + after;
+                    updated = before + (newContent ?? "") + eol + after;
                     break;
                 case "clear":
-                    updated = before + "\n" + after;
+                    updated = before + eol + after;
                     break;
                 case "clear_before": {
                     // Schema refinements validate format, but defense-in-depth for
@@ -472,7 +684,7 @@ export function registerWriteRoutes(app, ctx) {
                 previousRoadmapContent: fileContent,
                 today: localDateStr(new Date(), config.timezone || undefined),
                 defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
-                allowLegacyToday: path === "today" && isLegacyTodayContent(fileContent),
+                allowLegacyToday: path === "state/today" && isLegacyTodayContent(fileContent),
                 expectedAgentDay,
             });
             if (!prepared.ok) {
@@ -512,7 +724,7 @@ export function registerWriteRoutes(app, ctx) {
                     previousContent: fileContent,
                 });
             }
-            if (path.startsWith("routines/custom/")) {
+            if (path.startsWith("policies/routines/custom/")) {
                 deps.onCustomRoutinesChanged?.();
             }
             deps.onIndexableContextChange?.(`${path}${target.ext}`);
@@ -546,7 +758,7 @@ export function registerWriteRoutes(app, ctx) {
                 }),
             ]);
         }
-        return withWriteLock(() => {
+        return serializeContextFileWrite(fullPath, () => {
             if (!existsSync(fullPath)) {
                 return respondWithAgentError(c, 404, [
                     composeIssue("context.path_not_found", {
@@ -558,7 +770,7 @@ export function registerWriteRoutes(app, ctx) {
             const existing = readFileSync(fullPath, "utf-8");
             const snapshotId = saveSnapshot(path, existing, "api_delete", true);
             unlinkSync(fullPath);
-            if (path.startsWith("routines/custom/")) {
+            if (path.startsWith("policies/routines/custom/")) {
                 deps.onCustomRoutinesChanged?.();
             }
             deps.onIndexableContextChange?.(path);
@@ -567,4 +779,3 @@ export function registerWriteRoutes(app, ctx) {
         });
     });
 }
-//# sourceMappingURL=write.js.map

package/dist/api/routes/dashboard/config.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerConfigRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=config.d.ts.map

package/dist/api/routes/dashboard/config.js

@@ -11,7 +11,7 @@ import { upsertManagementRulesAgentIdentity } from "../../../management-rules.js
 import { DEFAULT_DISALLOWED_TOOLS, runtimeSettingsSchema } from "../../../settings/runtime-settings.js";
 import { createSettingsStore } from "../../../settings/settings-store.js";
 import { getSessionWorkdirPath } from "../../../core/workdir.js";
-import { rewriteCharacterBlock } from "../../../core/skills-compiler.js";
+import { rewriteCharacterBlock } from "../../../core/skills-compiler-cli-renderer.js";
 import { readJsonBody } from "../../json-body.js";
 import { getSecretConfigSummary } from "./secrets.js";
 const PUBLIC_CONFIG_RUNTIME_KEYS = [
@@ -81,10 +81,29 @@ const PUBLIC_CONFIG_RUNTIME_KEYS = [
     "notionPollIntervalSeconds",
     "calendarPollIntervalSeconds",
     "gmailPollIntervalSeconds",
+    "browserHistoryConsentAccepted",
+    "browserHistoryBrowserOverrides",
+    "browserHistoryCategories",
+    "browserHistoryRetentionDays",
+    "browserHistorySearchQueryRetentionDays",
+    "browserHistoryLifecycle",
+    "browserHistoryResearchDomainAllowlist",
+    "browserHistoryResearchDomainDenylist",
+    "browserTaskHostnameDenylist",
     "mcpAutoProbeIntervalMinutes",
     "delegatedProbeIntervalMinutes",
     "autonomousDailyCostCapUsd",
     "autonomousMonthlyCostCapUsd",
+    // Feedback Learning Loop (FEEDBACK_LEARNING_LOOP_DESIGN.md §9 Phase 5) —
+    // surfaced so the Lessons settings page can read + tune the master toggle,
+    // promotion threshold, per-scope byte caps, staleness horizon, and signal
+    // retention via the deferred-save EditableField flow.
+    "feedbackLearningEnabled",
+    "feedbackPromotionThreshold",
+    "feedbackLessonMaxBytesGlobal",
+    "feedbackLessonMaxBytesPerAgent",
+    "feedbackLessonStaleDays",
+    "feedbackSignalRetentionDays",
     "primaryLanguage",
     "vaultMode",
 ];
@@ -496,4 +515,3 @@ export function registerConfigRoutes(app, deps) {
         return c.json({ status: "reset", disallowedTools: defaults, ...result });
     });
 }
-//# sourceMappingURL=config.js.map

package/dist/api/routes/dashboard/conversations.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerConversationsRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=conversations.d.ts.map

package/dist/api/routes/dashboard/conversations.js

@@ -306,4 +306,3 @@ export function registerConversationsRoutes(app, deps) {
         return c.json({ actions, messages });
     });
 }
-//# sourceMappingURL=conversations.js.map

package/dist/api/routes/dashboard/cost-approvals.d.ts

@@ -26,4 +26,3 @@ export declare function aggregateByBilledModel(rows: ReadonlyArray<{
     session_count: number;
 }>;
 export declare function registerCostApprovalsRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=cost-approvals.d.ts.map

package/dist/api/routes/dashboard/cost-approvals.js

@@ -256,4 +256,3 @@ export function registerCostApprovalsRoutes(app, deps) {
         return c.json({ status: "denied", id });
     });
 }
-//# sourceMappingURL=cost-approvals.js.map