@aitne/daemon 0.1.8 → 0.1.10

package/dist/core/morning/orchestrator.js

@@ -66,11 +66,16 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { EventPriority, getAgentDayBoundsUtc, getAgentDayDateStr, } from "@aitne/shared";
 import { getContextDir } from "../../config.js";
+import { BackendRouterHandledError, } from "../backends/backend-router.js";
+import { BackendQuotaError } from "../agent-core.js";
 import { parseHandoff } from "./handoff-parser.js";
 import { buildJournalSkeleton, gatherJournalSkeletonFacts, } from "./journal-skeleton-builder.js";
 import { buildRoadmapSkeleton, gatherRoadmapSkeletonFacts, } from "./roadmap-skeleton-builder.js";
 import { emitMorningRoutineParentAuditRow, } from "./parent-audit-emitter.js";
 import { appendMorningRoutineJournalEntry, STAGE_A_ACTION_TYPE, STAGE_B_ACTION_TYPE, } from "./agent-journal-appender.js";
+import { maybeEmitPartialExtractStreakDm, } from "./partial-extract-streak.js";
+import { readIntegrationState } from "../../db/integrations-store.js";
+import { buildPreMorningDigest, renderPreMorningDigestMarkdown, } from "../../services/browser-history/pipeline/pre-morning-digest.js";
 import { createLogger } from "../../logging.js";
 const logger = createLogger("morning-pipeline-orchestrator");
 const STAGE_A_PROCESS_KEY = "routine.morning_routine_today";
@@ -142,27 +147,71 @@ export class MorningRoutinePipelineOrchestrator {
         const stageAEvent = this.composeStageAEvent(parentEvent, correlationId, handoffParsedBlock, roadmapSkeletonBlock);
         const stageBEvent = stageBInputs === null
             ? null
-            : this.composeStageBEvent(parentEvent, correlationId, stageBInputs.block);
+            : this.composeStageBEvent(parentEvent, correlationId, stageBInputs.block, stageBInputs.yesterdayDateStr);
+        // Pre-resolve each stage's binding up front so the failure-path
+        // handler below can attribute the `result='failed'` row to the
+        // requested backend / model — `BackendQuotaError.backendId` covers
+        // the quota case, but other rejection shapes (context build error,
+        // an unrelated SDK throw) carry no binding info on the error itself.
+        // Resolving once at the top also matches the pattern `runStageA/B`
+        // already uses internally and keeps the binding observable from this
+        // scope. Wrapped in try/catch so a resolver throw still falls through
+        // to the stage dispatch (which would re-throw the same error and let
+        // the rejection path persist a failed row with a null binding).
+        const stageABinding = this.safeResolveBinding(stageAEvent, STAGE_A_PROCESS_KEY, inputs.requestedTier);
+        const stageBBinding = stageBEvent === null
+            ? null
+            : this.safeResolveBinding(stageBEvent, STAGE_B_PROCESS_KEY);
         // morning-routine-optimization.md Phase 6 — pre-insert the
         // `result='in_progress'` sentinel for Stage A so the agent's
         // `PATCH /api/agent-actions/self` resolves to a real row during the
-        // run. The eventual `logAction` call from `persistStageAuditRows`
-        // settles the same row (UPSERT path in `audit.ts.logAction`),
-        // preserving the metadata column the agent wrote. Stage B does NOT
-        // call PATCH self (it has no `agent-actions` skill in its policy
-        // set), so it gets no pre-insert.
+        // run. The eventual `logAction` / `logError` call from
+        // `persistStageAuditRows` settles the same row (UPSERT path in
+        // `audit.ts`), preserving the metadata column the agent wrote.
+        // Stage B does NOT call PATCH self (it has no `agent-actions` skill
+        // in its policy set), so it gets no pre-insert.
         this.preInsertStageAInProgressRow(correlationId);
+        // Capture per-stage timing INSIDE each promise so the failure path
+        // can backdate `started_at` honestly. A naïve `nowMs = Date.now()`
+        // taken AFTER `Promise.allSettled` returns would attribute Stage A's
+        // ~2h wall-clock to Stage B's `duration_ms` whenever Stage B
+        // finished early (e.g. 15s budget-cap failure followed by Stage A
+        // grinding for hours), inflating the failed row's reported runtime
+        // by an order of magnitude. `.finally()` captures the per-stage
+        // settle moment without altering the propagated value/reason that
+        // `Promise.allSettled` sees.
+        const stageAStartedAtMs = Date.now();
+        const stageBStartedAtMs = Date.now();
+        let stageACompletedAtMs = stageAStartedAtMs;
+        let stageBCompletedAtMs = stageBStartedAtMs;
         const [stageA, stageB] = await Promise.allSettled([
-            this.runStageA(stageAEvent, inputs.requestedTier),
-            stageBEvent === null
+            this.runStageA(stageAEvent, inputs.requestedTier, stageABinding)
+                .finally(() => { stageACompletedAtMs = Date.now(); }),
+            stageBEvent === null || stageBBinding === null
                 ? Promise.resolve(null)
-                : this.runStageB(stageBEvent),
+                : this.runStageB(stageBEvent, stageBBinding)
+                    .finally(() => { stageBCompletedAtMs = Date.now(); }),
         ]);
+        // daily-journal-daemon-write.md §4.11 — invoke the daemon-side
+        // daily-journal composer BEFORE persistStageAuditRows so the
+        // compose outcome lands on the same INSERT/UPSERT as the Stage B
+        // row's terminal result (no post-UPDATE race). When the composer
+        // dep is absent (Phase 5 test fixtures) or Stage B wasn't
+        // dispatched (retry path / first-run skip), we skip the call and
+        // the audit row lands without `detail.dailyWrite` — the appender
+        // falls back to file-presence detection in that case.
+        const stageBResultIfFulfilledForCompose = stageB.status === "fulfilled" ? stageB.value : null;
+        const dailyComposeOutcome = await this.composeDailyJournalIfPossible({
+            correlationId,
+            stageBEvent,
+            stageBInputs,
+            stageBResult: stageBResultIfFulfilledForCompose,
+        });
         // Land Stage A / Stage B `agent_actions` rows BEFORE deciding whether
         // to re-throw on Stage A failure. The rows are what
         // `parent-audit-emitter.readStageSummaries` reads via SQL, what the
         // autonomous-cost-cap SUM aggregates over, and what
-        // `agent-journal-appender` (Phase 6) will template-fill from. Without
+        // `agent-journal-appender` (Phase 6) template-fills from. Without
         // this call the orchestrator's parent-audit emit silently degrades to
         // `stage_a_row_missing` in production and Stage B's cost is dropped
         // from the budget tracker.
@@ -172,14 +221,64 @@ export class MorningRoutinePipelineOrchestrator {
         // won't fire on this attempt because Stage A failed, but a retry's
         // emit will read Stage B's prior-attempt row).
         //
-        // `processResult` is the unique writer of `agent_actions` for routine
-        // sessions; calling it per stage with the stage's RoutineEvent makes
-        // each row land with `action_type=<stage process key>` (the audit
-        // logger derives action_type from `event.type`). Routine events are
-        // silent-by-default in `shouldNotify`, so no user-facing notify side
-        // effect fires.
+        // Success path → `processResult` (which calls `audit.logAction`,
+        // settling the in_progress sentinel row to `success`).
+        // Failure path → `audit.logError` (which UPSERTs the same in_progress
+        // sentinel to `result='failed'`, preserving any agent-side
+        // `PATCH /api/agent-actions/self` metadata writes that landed before
+        // the throw). The failure-path write is what closes the
+        // "Stage B threw and audit was silently dropped" hole that masked
+        // Stage B budget-cap failures as `Journal synthesis: skipped (no
+        // prior-day data)` — indistinguishable from a legit first-run skip.
+        // Routine events are silent-by-default in `shouldNotify`, so no
+        // user-facing notify side effect fires on either path.
         const stageBResultIfFulfilled = stageB.status === "fulfilled" ? stageB.value : null;
-        await this.persistStageAuditRows(stageA.status === "fulfilled" ? stageA.value : null, stageAEvent, stageBResultIfFulfilled, stageBEvent);
+        await this.persistStageAuditRows({
+            stageA: {
+                event: stageAEvent,
+                binding: stageABinding,
+                startedAtMs: stageAStartedAtMs,
+                completedAtMs: stageACompletedAtMs,
+                ...(stageA.status === "fulfilled"
+                    ? { result: stageA.value }
+                    : { error: stageA.reason }),
+            },
+            stageB: stageBEvent === null
+                ? null
+                : {
+                    event: stageBEvent,
+                    binding: stageBBinding,
+                    startedAtMs: stageBStartedAtMs,
+                    completedAtMs: stageBCompletedAtMs,
+                    // §4.11 — plumb the dailyWrite outcome onto the Stage B
+                    // outcome so persistStageAuditRows can include it in the
+                    // single INSERT/UPSERT that lands the row.
+                    ...(dailyComposeOutcome
+                        ? { dailyWrite: toDailyWriteAuditDetail(dailyComposeOutcome) }
+                        : {}),
+                    ...(stageB.status === "fulfilled"
+                        ? { result: stageBResultIfFulfilled }
+                        : { error: stageB.reason }),
+                },
+        });
+        // §4.7b — after the Stage B row has landed (so its just-written
+        // `detail.dailyWrite` is visible to the streak query), check for
+        // a 3-day all-partial streak and emit the owner DM (subject to
+        // the 24h dedup window). Runs only when Stage B was attempted on
+        // this morning; first-run / retry skips don't add a row and the
+        // SQL filter excludes them naturally.
+        if (dailyComposeOutcome !== null) {
+            try {
+                await maybeEmitPartialExtractStreakDm({
+                    db: this.deps.db,
+                    correlationId,
+                    notifier: this.deps.partialExtractStreakNotifier ?? null,
+                });
+            }
+            catch (err) {
+                logger.warn({ err, correlationId }, "Partial-extract streak check threw — continuing");
+            }
+        }
         if (stageA.status === "rejected") {
             // Re-throw so the runner's existing finally / retry path fires.
             // Log enough context that the operator can confirm the V2 path
@@ -202,20 +301,58 @@ export class MorningRoutinePipelineOrchestrator {
         };
     }
     /**
-     * Write per-stage `agent_actions` rows via `processResult`. Each stage
-     * is processed against its OWN `RoutineEvent` (carrying the stage's
-     * process-key event type), so the row's `action_type` lands as
-     * `routine.morning_routine_today` / `routine.morning_routine_journal`
-     * — exactly what `parent-audit-emitter.readStageSummaries` and the
-     * Phase 6 `agent-journal-appender` will read.
+     * Wrap `agentRouter.resolveBinding` so a resolver-side throw (e.g. a
+     * malformed `process_backend_config` row) doesn't abort the whole
+     * `run()` before either stage gets a chance to dispatch. A null
+     * binding signals "binding unknown" to the failure-path writer; the
+     * resulting `agent_actions(result='failed')` row will lack the
+     * backend / model columns but still pin the failure to a known
+     * stage event. The stage's own `runStage*` will re-throw the same
+     * resolution error on dispatch and that's what
+     * `persistStageAuditRows` records.
+     */
+    safeResolveBinding(event, processKey, requestedTier) {
+        try {
+            return this.deps.agentRouter.resolveBinding(event, {
+                processKey,
+                ...(requestedTier ? { requestedTier } : {}),
+            });
+        }
+        catch (err) {
+            logger.warn({ err, processKey, correlationId: event.correlationId }, "resolveBinding threw at the orchestrator's pre-resolve site — falling back to null binding");
+            return null;
+        }
+    }
+    /**
+     * Write per-stage `agent_actions` rows for both success and failure
+     * outcomes. Each stage's row lands keyed on its OWN `RoutineEvent`
+     * (carrying the stage's process-key event type), so the row's
+     * `action_type` is `routine.morning_routine_today` /
+     * `routine.morning_routine_journal` — exactly what
+     * `parent-audit-emitter.readStageSummaries` and the Phase 6
+     * `agent-journal-appender` will read.
      *
-     * Failures inside `processResult` (e.g. a notify hook misbehaving) do
-     * NOT propagate — losing audit rows is bad, but blocking the entire
+     * Success path → `processResult` (which calls `audit.logAction`,
+     * settling the in_progress sentinel row to `result='success'`).
+     *
+     * Failure path → `audit.logError` (which UPSERTs the same in_progress
+     * sentinel to `result='failed'`, preserving the agent-side metadata
+     * column intact). Without the failure-path write, Stage B rejections
+     * (most commonly `BackendQuotaError(max_budget_usd)` from a tight
+     * lite-tier envelope) leave the audit trail with NO Stage B row at
+     * all — `agent-journal-appender.formatJournalLine` then falls into
+     * the `stageB === null` branch and renders `Journal synthesis:
+     * skipped (no prior-day data)`, indistinguishable from a legitimate
+     * first-run skip. This is the structural bug the failure-path write
+     * closes.
+     *
+     * Failures inside `processResult` or `audit.logError` do NOT
+     * propagate — losing audit rows is bad, but blocking the entire
      * morning routine on a downstream telemetry hiccup is worse. In
-     * practice `audit.logAction` already swallows its own DB errors with
-     * an internal logger.error, so the catch here is a defence-in-depth
-     * guard against non-audit hooks (notify side effects we don't expect
-     * for routine events but might land later).
+     * practice `audit.logAction` / `audit.logError` already swallow their
+     * own DB errors with an internal logger.error, so the catches here
+     * are defence-in-depth guards against non-audit hooks (notify side
+     * effects we don't expect for routine events but might land later).
      *
      * Tail-risk acknowledgement: if a stage row truly fails to land
      * (audit's internal try/catch swallowed a real SQLite error AND
@@ -227,26 +364,139 @@ export class MorningRoutinePipelineOrchestrator {
      * shape because today.md health is independent. The day's automation
      * degrades silently for that day; it does not infinite-loop.
      */
-    async persistStageAuditRows(stageAResult, stageAEvent, stageBResult, stageBEvent) {
+    async persistStageAuditRows(args) {
         const tasks = [];
-        if (stageAResult !== null) {
-            tasks.push(this.deps.resultProcessor
-                .processResult(stageAResult, stageAEvent)
-                .catch((err) => {
-                logger.warn({ err, correlationId: stageAEvent.correlationId }, "Stage A processResult failed — audit row may be missing");
-            }));
-        }
-        if (stageBResult !== null && stageBEvent !== null) {
-            tasks.push(this.deps.resultProcessor
-                .processResult(stageBResult, stageBEvent)
-                .catch((err) => {
-                logger.warn({ err, correlationId: stageBEvent.correlationId }, "Stage B processResult failed — audit row may be missing");
-            }));
+        const outcomes = [
+            { label: "A", outcome: args.stageA },
+            ...(args.stageB === null
+                ? []
+                : [{ label: "B", outcome: args.stageB }]),
+        ];
+        for (const { label, outcome } of outcomes) {
+            if ("result" in outcome && outcome.result !== null) {
+                tasks.push(this.deps.resultProcessor
+                    .processResult(outcome.result, outcome.event, false, {
+                    // Thread dailyWrite into the result-processor's options
+                    // so its `audit.logAction` call lands `detail.dailyWrite`
+                    // on the same INSERT/UPSERT as the row's terminal result.
+                    ...(outcome.dailyWrite ? { dailyWrite: outcome.dailyWrite } : {}),
+                })
+                    .catch((err) => {
+                    logger.warn({ err, correlationId: outcome.event.correlationId, stage: label }, `Stage ${label} processResult failed — audit row may be missing`);
+                }));
+            }
+            else if ("error" in outcome) {
+                tasks.push(this.recordStageFailure(outcome).catch((err) => {
+                    logger.warn({ err, correlationId: outcome.event.correlationId, stage: label }, `Stage ${label} recordStageFailure threw — audit row may be missing`);
+                }));
+            }
+            // "result" in outcome with `result === null` is the Stage B
+            // first-run skip path: no execute call, no audit row to write.
         }
         if (tasks.length > 0) {
             await Promise.all(tasks);
         }
     }
+    /**
+     * Write a `result='failed'` agent_actions row for a rejected stage.
+     * Uses `audit.logError`, which UPSERTs the matching in_progress
+     * sentinel row when one exists (Stage A's pre-insert) and INSERTs a
+     * fresh row otherwise (Stage B). Both paths land a terminal-state
+     * row keyed on `(event_id=correlationId, action_type=event.type)` so
+     * the downstream readers — `loadMorningRoutineActionRows`,
+     * `parent-audit-emitter.readStageSummaries`,
+     * `agent-journal-appender.formatJournalLine` — see one consistent
+     * shape per stage regardless of which terminal state the stage
+     * reached.
+     *
+     * Backend / model attribution: pulled from the pre-resolved binding
+     * when available, with a fallback to `BackendQuotaError.backendId`
+     * if the binding was unresolvable but the error happens to carry
+     * that field. Other failure shapes leave backend/model unset; the
+     * audit logger's `context` schema tolerates absent values.
+     */
+    async recordStageFailure(outcome) {
+        if (this.deps.audit === undefined)
+            return;
+        const error = outcome.error instanceof Error
+            ? outcome.error
+            : new Error(String(outcome.error ?? "stage rejection with no message"));
+        const durationMs = Math.max(0, outcome.completedAtMs - outcome.startedAtMs);
+        const quotaError = extractQuotaError(outcome.error);
+        const context = { durationMs };
+        const backendId = outcome.binding?.main.backendId ?? quotaError?.backendId ?? undefined;
+        const modelId = outcome.binding?.main.modelId ?? undefined;
+        if (backendId !== undefined)
+            context.backendId = backendId;
+        if (modelId !== undefined)
+            context.modelId = modelId;
+        if (quotaError !== null) {
+            context.failureKind = "quota";
+            context.failureCode = quotaError.originalCode;
+        }
+        // §4.11 — Stage B's failure-path row also carries the dailyWrite
+        // outcome when one was computed. Useful for the streak detector
+        // when Stage B threw but `composeDailyJournalIfPossible` was
+        // dispatched anyway (e.g. session crashed AFTER emitting valid
+        // body / frontmatter tags in its final text — uncommon but
+        // representable).
+        if (outcome.dailyWrite) {
+            context.dailyWrite = outcome.dailyWrite;
+        }
+        // Morning routine fires from cron — never reactive — same trigger
+        // shape as `preInsertStageAInProgressRow`. Keeping the trigger value
+        // consistent with the pre-insert row also keeps the UPSERT idempotent
+        // (Stage A's in_progress row has `trigger='autonomous'`; we don't
+        // want the UPSERT to flip it).
+        this.deps.audit.logError(outcome.event, error, "autonomous", context);
+    }
+    /**
+     * daily-journal-daemon-write.md §4.11 — invoke the daily-journal
+     * composer when (a) the orchestrator has a composer dep, (b) Stage B
+     * was actually dispatched (event built), and (c) `buildStageBInputs`
+     * produced the skeleton facts the composer needs. Otherwise return
+     * `null` and let the appender fall back to file-presence detection.
+     *
+     * Reuses the SAME skeleton + counts cached on `stageBInputs` (the
+     * exact byte stream Stage B's prompt saw) rather than re-deriving
+     * against the live DB. Re-deriving was the previous behaviour and
+     * introduced a drift class: if a new DM or calendar observation
+     * landed during Stage A's wall-clock window, the LLM authored against
+     * Skeleton-V1 while the daemon wrote Skeleton-V2 frontmatter; ditto
+     * `updated:` if the agent day rolled over between the two reads.
+     *
+     * Stage B's `AgentResult` may be `null` even when the event was
+     * dispatched (the SDK threw mid-stream); the composer handles that
+     * explicitly via its `stage_b_null` reason.
+     */
+    async composeDailyJournalIfPossible(args) {
+        if (this.deps.dailyJournalComposer === undefined)
+            return null;
+        if (args.stageBEvent === null)
+            return null;
+        if (args.stageBInputs === null)
+            return null;
+        try {
+            const outcome = await this.deps.dailyJournalComposer.compose({
+                correlationId: args.correlationId,
+                yesterdayDateStr: args.stageBInputs.yesterdayDateStr,
+                skeleton: args.stageBInputs.skeleton,
+                calendarEvents: args.stageBInputs.calendarEventsCount,
+                messagesHandled: args.stageBInputs.messagesHandled,
+                stageBResult: args.stageBResult,
+            });
+            return outcome;
+        }
+        catch (err) {
+            // The composer's own try/catch returns `ok: false, reason:
+            // "write_failed"` for write errors — anything that escapes is a
+            // construction bug. Surface it as a structured `write_failed`
+            // outcome so the audit row still carries a discriminated reason
+            // rather than going silent.
+            logger.error({ err, correlationId: args.correlationId }, "Daily journal composer threw past its own catch — recording as write_failed");
+            return { ok: false, reason: "write_failed" };
+        }
+    }
     /**
      * ⑥b parent audit emit — the row keyed `action_type='routine.morning_routine'`
      * that `morningRoutineRanToday` in `schedule-helpers.ts` SELECTs on.
@@ -276,7 +526,7 @@ export class MorningRoutinePipelineOrchestrator {
     /**
      * morning-routine-optimization.md Phase 6 — ⑥ AgentJournalAppender.
      * Assembles the one-paragraph English audit-trail entry for
-     * `agent/journal.md` from `agent_actions` rows (stage results +
+     * `journal/agent.md` from `agent_actions` rows (stage results +
      * the metadata column Stage A wrote via `PATCH /api/agent-actions/self`)
      * plus `daily/<yesterday>.md` frontmatter. No LLM final-text parsing.
      *
@@ -291,7 +541,7 @@ export class MorningRoutinePipelineOrchestrator {
      * orchestrator was constructed without the deps the appender needs
      * (Phase 5-only test fixtures) — caller treats `null` as a no-op.
      */
-    appendAgentJournalEntry(args) {
+    async appendAgentJournalEntry(args) {
         const contextDir = getContextDir(this.deps.config, this.deps.db);
         const now = new Date();
         const yesterdayNow = new Date(now.getTime() - 24 * 60 * 60 * 1000);
@@ -299,7 +549,7 @@ export class MorningRoutinePipelineOrchestrator {
         const yesterdayDateStr = getAgentDayDateStr(this.deps.config.timezone || undefined, this.deps.config.dayBoundaryHour, yesterdayNow);
         // Yesterday's agent-day UTC window — same shape `buildStageBInputs`
         // derives for the skeleton facts. The appender uses it to aggregate
-        // the agent-action breakdown into the `agent/journal.md` footprint
+        // the agent-action breakdown into the `journal/agent.md` footprint
         // line. Recomputed here (rather than threaded from `buildStageBInputs`)
         // because Stage B is dispatched async and the orchestrator does not
         // retain its inputs between phases.
@@ -332,7 +582,7 @@ export class MorningRoutinePipelineOrchestrator {
     // ── ② HandoffParser plumbing ─────────────────────────────────────────
     buildHandoffParsedBlock() {
         const contextDir = getContextDir(this.deps.config, this.deps.db);
-        const yesterdayPath = join(contextDir, "yesterday.md");
+        const yesterdayPath = join(contextDir, "state", "yesterday.md");
         if (!existsSync(yesterdayPath))
             return null;
         let body;
@@ -363,7 +613,7 @@ export class MorningRoutinePipelineOrchestrator {
         // renders the daemon-emitted `Journal synthesis: skipped (no
         // prior-day data)` line whenever `daily/<yesterday>.md` is absent on
         // disk, so the audit-trail entry stays correct without Stage B.
-        const yesterdayPath = join(contextDir, "yesterday.md");
+        const yesterdayPath = join(contextDir, "state", "yesterday.md");
         if (!existsSync(yesterdayPath))
             return null;
         // Yesterday's agent-day window = today's window shifted by -24h.
@@ -391,7 +641,7 @@ export class MorningRoutinePipelineOrchestrator {
         const yesterdayMd = readFileSync(yesterdayPath, "utf-8");
         const facts = gatherJournalSkeletonFacts(this.deps.db, window);
         const calendarEvents = this.readYesterdayCalendarEvents(window);
-        const skeleton = buildJournalSkeleton({
+        const skeletonInputs = {
             dateStr,
             weekday,
             updatedDateStr,
@@ -400,10 +650,26 @@ export class MorningRoutinePipelineOrchestrator {
             ...(this.deps.config.timezone
                 ? { timezone: this.deps.config.timezone }
                 : {}),
-        }, facts);
+        };
+        const skeletonBody = buildJournalSkeleton(skeletonInputs, facts);
         return {
-            block: `<journal_skeleton>\n${skeleton}\n</journal_skeleton>`,
+            block: `<journal_skeleton>\n${skeletonBody}\n</journal_skeleton>`,
             yesterdayDateStr: dateStr,
+            // daily-journal-daemon-write.md §4.11 (drift fix) — cache the
+            // skeleton inputs + pre-aggregated counts here so the post-
+            // `Promise.allSettled` composer can reuse the SAME byte stream
+            // Stage B's prompt saw. Re-deriving on the composer side (as the
+            // initial implementation did via `buildStageBSkeletonInputs`)
+            // re-runs `gatherJournalSkeletonFacts` + `readYesterdayCalendar
+            // Events` against the live DB; if a new DM or calendar observation
+            // landed during Stage A's wall-clock window, or the agent day rolled
+            // over, the LLM authored against Skeleton-V1 while the daemon wrote
+            // Skeleton-V2 frontmatter (`messages_handled` / `calendar_events`
+            // count drift, `updated:` date drift across the 04:00 boundary).
+            // One canonical snapshot eliminates the drift class entirely.
+            skeleton: skeletonInputs,
+            calendarEventsCount: calendarEvents.length,
+            messagesHandled: facts.messagesHandled,
         };
     }
     readYesterdayCalendarEvents(window) {
@@ -482,7 +748,7 @@ export class MorningRoutinePipelineOrchestrator {
      */
     buildRoadmapSkeletonBlock() {
         const contextDir = getContextDir(this.deps.config, this.deps.db);
-        const yesterdayPath = join(contextDir, "yesterday.md");
+        const yesterdayPath = join(contextDir, "state", "yesterday.md");
         if (existsSync(yesterdayPath))
             return null; // recurring branch
         try {
@@ -569,12 +835,18 @@ export class MorningRoutinePipelineOrchestrator {
         });
         return out;
     }
-    async runStageA(event, requestedTier) {
+    async runStageA(event, requestedTier, preResolvedBinding) {
         const context = await this.deps.contextBuilder.build(event);
-        const binding = this.deps.agentRouter.resolveBinding(event, {
-            processKey: STAGE_A_PROCESS_KEY,
-            ...(requestedTier ? { requestedTier } : {}),
-        });
+        // The orchestrator pre-resolves the binding so the failure-path
+        // handler can attribute the audit row to the requested backend/model.
+        // When the pre-resolve threw (binding === null), fall back to a
+        // resolve here — the throw will propagate normally and persist via
+        // `recordStageFailure` with a null binding.
+        const binding = preResolvedBinding
+            ?? this.deps.agentRouter.resolveBinding(event, {
+                processKey: STAGE_A_PROCESS_KEY,
+                ...(requestedTier ? { requestedTier } : {}),
+            });
         const reassemblePrompt = (bid) => this.deps.prompt.assemble(event.type, STAGE_A_PROCESS_KEY, bid);
         const prompt = reassemblePrompt(binding.main.backendId);
         return this.deps.errorRouter.executeWithRetry(() => this.deps.agentRouter.execute({
@@ -588,7 +860,7 @@ export class MorningRoutinePipelineOrchestrator {
         }), event);
     }
     // ── ⑤B Stage B dispatch ──────────────────────────────────────────────
-    composeStageBEvent(parent, correlationId, journalSkeletonBlock) {
+    composeStageBEvent(parent, correlationId, journalSkeletonBlock, yesterdayDateStr) {
         // Stage B does NOT inherit the parent's `todayWriteLockId` or
         // `fetchReportBlock`. The lock gates today.md only (Stage B never
         // touches it); the fetch report describes data Stage A consumes
@@ -607,6 +879,15 @@ export class MorningRoutinePipelineOrchestrator {
         }
         stripped.morningPipelineStage = "journal";
         stripped.journalSkeletonBlock = journalSkeletonBlock;
+        // daily-journal-daemon-write.md §4.10 — browser-history digest now
+        // fetched daemon-side and injected as `<browser_digest>` (Stage B
+        // has zero tool requirement so it cannot fetch it itself). The
+        // four-step chain in `buildBrowserDigestBlock` mirrors the LLM
+        // logic the task-flow used to perform.
+        const browserDigestBlock = this.buildBrowserDigestBlock(yesterdayDateStr);
+        if (browserDigestBlock !== null) {
+            stripped.browserDigestBlock = browserDigestBlock;
+        }
         return {
             type: STAGE_B_PROCESS_KEY,
             source: parent.source,
@@ -617,11 +898,83 @@ export class MorningRoutinePipelineOrchestrator {
             routine: STAGE_B_ROUTINE_SLUG,
         };
     }
-    async runStageB(event) {
+    /**
+     * Resolve the `<browser_digest>` block Stage B used to fetch via
+     * `GET /api/context/browser/yesterday-<date>.md`. Now daemon-driven
+     * since Stage B has no tools:
+     *
+     *  1. Gate on integration mode — `browser_history` `disabled` →
+     *     return `null` (no block injection).
+     *  2. File-first — `<contextDir>/browser/yesterday-<date>.md` written
+     *     by the 03:00 cron is the primary surface.
+     *  3. In-process JSON fallback — if the file is absent (daemon was
+     *     down at 03:00 or the file was purged), call
+     *     `runPreMorningDigestJob` in-process to rebuild from SQLite +
+     *     render the markdown shape (no HTTP loopback).
+     *  4. Both unavailable → return `null` (silent skip; the task-flow
+     *     omits the block).
+     *
+     * The block is wrapped in `<browser_digest>...</browser_digest>` to
+     * match the inbound-XML idiom every other ContextBuilder injection
+     * uses (`<fetch_report>`, `<journal_skeleton>`, etc.).
+     */
+    buildBrowserDigestBlock(yesterdayDateStr) {
+        try {
+            const integrationState = readIntegrationState(this.deps.db, "browser_history");
+            if (integrationState.mode === "disabled")
+                return null;
+        }
+        catch (err) {
+            // Read failure on the integration registry is rare (corrupt
+            // settings JSON). Log + skip — Stage B should still author the
+            // journal without browser-history context if the registry is in
+            // a bad state.
+            logger.warn({ err }, "browser_history integration state read failed — omitting <browser_digest>");
+            return null;
+        }
+        const contextDir = getContextDir(this.deps.config, this.deps.db);
+        // §10.6 / §5.F2 — the cron writes `browser/yesterday-<date>.md`.
+        const filePath = join(contextDir, "browser", `yesterday-${yesterdayDateStr}.md`);
+        if (existsSync(filePath)) {
+            try {
+                const body = readFileSync(filePath, "utf-8");
+                return `<browser_digest>\n${body}\n</browser_digest>`;
+            }
+            catch (err) {
+                logger.warn({ err, filePath }, "browser digest file read failed — falling back to in-process rebuild");
+            }
+        }
+        // In-process fallback — rebuild the digest from SQLite using the
+        // same pure builder the cron uses. Avoids the HTTP loopback that
+        // hits the `@hono/node-server` globalThis.Response pitfall
+        // (`project_hono_global_response_pitfall` memory). The result is
+        // rendered into the same markdown shape the file-first path would
+        // have produced.
+        try {
+            const boundary = {
+                timezone: this.deps.config.timezone || undefined,
+                dayBoundaryHour: this.deps.config.dayBoundaryHour ?? 4,
+            };
+            const digest = buildPreMorningDigest({
+                db: this.deps.db,
+                date: yesterdayDateStr,
+                boundary,
+            });
+            const markdown = renderPreMorningDigestMarkdown(digest);
+            return `<browser_digest>\n${markdown}\n</browser_digest>`;
+        }
+        catch (err) {
+            logger.warn({ err, yesterdayDateStr }, "browser digest in-process rebuild failed — omitting <browser_digest>");
+            return null;
+        }
+    }
+    async runStageB(event, preResolvedBinding) {
         const context = await this.deps.contextBuilder.build(event);
-        const binding = this.deps.agentRouter.resolveBinding(event, {
-            processKey: STAGE_B_PROCESS_KEY,
-        });
+        // Same pre-resolve fallback as Stage A — see `runStageA`'s comment.
+        const binding = preResolvedBinding
+            ?? this.deps.agentRouter.resolveBinding(event, {
+                processKey: STAGE_B_PROCESS_KEY,
+            });
         const reassemblePrompt = (bid) => this.deps.prompt.assemble(event.type, STAGE_B_PROCESS_KEY, bid);
         const prompt = reassemblePrompt(binding.main.backendId);
         return this.deps.errorRouter.executeWithRetry(() => this.deps.agentRouter.execute({
@@ -631,6 +984,30 @@ export class MorningRoutinePipelineOrchestrator {
             processKey: STAGE_B_PROCESS_KEY,
             preResolvedBinding: binding,
             reassemblePrompt,
+            // daily-journal-daemon-write.md §3 corollary — Stage B's
+            // session must have zero tool requirement. The empty
+            // `skills-manifest.ts` entry suppresses `.claude/skills/*` from
+            // being registered, but the SDK still ships its default
+            // `CLAUDE_DEFAULT_ALLOWED_TOOLS` (Read / Write / Edit /
+            // Bash(curl *) / …). Without this per-execute clamp, Haiku
+            // could still call `Write` on `daily/<date>.md` directly —
+            // bypassing the daemon-side `DailyJournalComposer` chokepoint
+            // and racing it. Mirrors the precedent at
+            // `dispatcher-hourly-check.ts:1003` (`routine.hourly_check.triage`).
+            //
+            // Activation requires the clamp gate in `claude-code-core.ts`
+            // to honour an empty array as "no tools" — fixed in the same
+            // PR as this addition (the prior `length > 0` gate silently
+            // dropped `[]` to the default surface).
+            //
+            // Codex / Gemini have no per-spawn `allowedTools` surface —
+            // the Stage B process key routes to Claude (lite tier / Haiku)
+            // by default, so this clamp is effective on the production
+            // binding. On a Claude→Codex/Gemini fallback the clamp is
+            // not honoured; the `max_turns: 20` / `max_budget_usd: 0.30`
+            // envelope on `routine.morning_routine_journal` remains the
+            // safety floor on those backends.
+            allowedToolsOverride: [],
         }), event);
     }
     // ── ⑥b helpers — read DB-side stage summaries for parent-audit ──────
@@ -668,7 +1045,34 @@ export class MorningRoutinePipelineOrchestrator {
         return { stageA, stageB };
     }
 }
-// ── module-level helpers ────────────────────────────────────────────────
+/**
+ * Extract the underlying `BackendQuotaError` from a stage rejection so
+ * `recordStageFailure` can tag the audit row with `failureKind='quota'`
+ * + `failureCode=originalCode` (e.g. `max_budget_usd`). Mirrors the
+ * `DispatcherErrorRouter.extractQuotaError` logic — kept module-local
+ * here so the orchestrator is not coupled to the dispatcher's private
+ * extraction surface.
+ */
+function extractQuotaError(error) {
+    if (error instanceof BackendQuotaError)
+        return error;
+    if (error instanceof BackendRouterHandledError) {
+        if (error.cause instanceof BackendQuotaError)
+            return error.cause;
+    }
+    return null;
+}
+/**
+ * Map the composer's `DailyJournalComposeResult` to the
+ * `agent_actions.detail.dailyWrite` JSON shape audit persists. The two
+ * types are structurally identical today — but the mapper localises
+ * the coupling so a future schema change to the audit shape doesn't
+ * silently drift from the composer's API. Inlined at the call site
+ * via `import type` would also work but loses the assertion site.
+ */
+function toDailyWriteAuditDetail(result) {
+    return result;
+}
 function renderHandoffParsedBlock(parsed) {
     // XML over JSON: the rest of the daemon's prompt-injection payloads
     // (`<fetch_report>`, `<acquisition-plan>`, `<integration_modes>`) use
@@ -824,4 +1228,3 @@ function pickString(value) {
 // continue to import them from one path even after Phase 6 moves
 // more responsibilities into the orchestrator.
 export { STAGE_A_PROCESS_KEY, STAGE_B_PROCESS_KEY, STAGE_A_ROUTINE_SLUG, STAGE_B_ROUTINE_SLUG, };
-//# sourceMappingURL=orchestrator.js.map