@aitne/daemon 0.1.8 → 0.1.10

package/dist/core/retention.js

@@ -2,9 +2,16 @@ import { readdirSync, readFileSync, rmSync, statSync, unlinkSync, writeFileSync,
 import { resolve, extname } from "node:path";
 import { getContextDir } from "../config.js";
 import { CONTEXT_RELATIVE_PATHS } from "./context-paths.js";
+import { expireStalePurchaseTokens, scrubRotatedPurchaseTokens, sweepOrphanedConsumedPurchaseTokens, } from "../db/browser-automation-purchase-tokens-store.js";
+import { deletePurchaseRepliesOlderThan } from "../db/browser-automation-purchase-replies-store.js";
+import { deleteWorkflowRunsOlderThan } from "../db/browser-automation-store.js";
+import { deleteTerminalBrowserTasksOlderThan } from "../db/browser-task-store.js";
+import { expireStaleLiteFinalConfirmTokens, scrubRotatedLiteFinalConfirmTokens, } from "../db/browser-task-final-confirm-tokens-store.js";
 import { cleanupConsumedObservations, getStalePendingObservationStats, } from "../db/observations.js";
 import { pruneOldMcpToolCalls } from "../services/mcp/tool-audit.js";
 import { AttachmentStore } from "../services/attachments/store.js";
+import { tracesRootDir } from "../services/browser-history/automation/trace-store-paths.js";
+import { TRACE_RETENTION_DAYS } from "../services/browser-history/automation/trace-store.js";
 import { createLogger } from "../logging.js";
 const logger = createLogger("retention");
 /** Retention policies — days to keep each data type */
@@ -21,6 +28,48 @@ const RETENTION_DAYS = {
     authTelemetryCounters: 90,
     mailMessagesIndex: 365,
     deletedMailMessagesIndex: 30,
+    /**
+     * Phase B-2 audit rows (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §8.14).
+     * The audit table mirrors `browser_automation_workflows`; the per-run
+     * `trace_path` references the FS trace dir below, so SQL deletes and
+     * trace prunes run with the SAME cutoff to keep the two side-by-side.
+     * Matches the design's §8.7 `TRACE_RETENTION_DAYS` (14 d).
+     */
+    browserAutomationWorkflows: TRACE_RETENTION_DAYS,
+    /**
+     * Phase B-4 (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.6 / §13 step
+     * 60). The raw `!~xxxxxxxx` string is rotated to NULL 1 day after
+     * the row reaches a terminal state — bounding the window in which a
+     * stale DM-history token could be replayed against a daemon bug.
+     * Reply audit rows live 90 days (longer than B-3 approvals because
+     * the spoofing / replay analysis surfaces the hashed history).
+     */
+    browserAutomationPurchaseTokenScrub: 1,
+    browserAutomationPurchaseReplies: 90,
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.5 deferred follow-up + §14.7.
+     * Terminal `browser_task` rows age out at 30 days — mirroring the
+     * trace-store screenshot window so a row never references missing
+     * screenshots. Children (`browser_task_action_log`,
+     * `browser_task_clarifications`, `browser_task_final_confirm_tokens`)
+     * cascade via FK ON DELETE CASCADE.
+     *
+     * Non-terminal rows (`pending` / `running` / `awaiting_user` /
+     * `final_confirm`) are NEVER deleted by retention — the boot-recovery
+     * sweep is the only path that mutates them past their owner's
+     * daemon-restart, so retention seeing one of them means the boot
+     * sweep itself is broken and we should not paper over it.
+     */
+    browserTask: TRACE_RETENTION_DAYS,
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §14.11 Q#6 — lite-final-confirm tokens
+     * carry the same `!~xxxxxxxx` shape as B-4 purchase tokens. Mirror the
+     * 1-day scrub window so a terminal row's raw token is rotated to NULL
+     * shortly after redemption / cancel / expiry. Reduces at-rest footprint
+     * without touching the row itself (which gets pruned via `browserTask`
+     * once the parent task ages out).
+     */
+    browserTaskFinalConfirmTokenScrub: 1,
     mailParseFailures: 30,
     managementParseFailures: 30,
     skillCurationSignals: 180,
@@ -51,7 +100,7 @@ const RETENTION_DAYS = {
     gitJournalMd: 365,
 };
 /**
- * Retention policy for `agent/journal.md` content-level rollup.
+ * Retention policy for `journal/agent.md` content-level rollup.
  *
  * The journal is append-only — Weekly/Monthly Review routines add new
  * `## Weekly YYYY-Www` and `## Monthly YYYY-MM` sections over time. Without
@@ -137,6 +186,15 @@ export function runRetentionCleanup(db, config) {
         agentJournalOversizedSections: 0,
         integrationWrites: 0,
         imminentEventNotifications: 0,
+        browserAutomationWorkflows: 0,
+        browserAutomationTraceDirs: 0,
+        browserAutomationPurchaseTokensExpired: 0,
+        browserAutomationPurchaseTokensOrphaned: 0,
+        browserAutomationPurchaseTokensScrubbed: 0,
+        browserAutomationPurchaseRepliesDeleted: 0,
+        browserTask: 0,
+        browserTaskFinalConfirmTokensExpired: 0,
+        browserTaskFinalConfirmTokensScrubbed: 0,
         ftsOptimized: false,
         walCheckpointed: false,
     };
@@ -168,6 +226,14 @@ export function runRetentionCleanup(db, config) {
         skillCurationRunsAborted: 0,
         integrationWrites: 0,
         imminentEventNotifications: 0,
+        browserAutomationWorkflows: 0,
+        browserAutomationPurchaseTokensExpired: 0,
+        browserAutomationPurchaseTokensOrphaned: 0,
+        browserAutomationPurchaseTokensScrubbed: 0,
+        browserAutomationPurchaseRepliesDeleted: 0,
+        browserTask: 0,
+        browserTaskFinalConfirmTokensExpired: 0,
+        browserTaskFinalConfirmTokensScrubbed: 0,
     };
     db.transaction(() => {
         counts.mdFileSnapshots = deleteOlderThan(db, "md_file_snapshots", "created_at", RETENTION_DAYS.mdFileSnapshots);
@@ -241,12 +307,98 @@ export function runRetentionCleanup(db, config) {
             /* c8 ignore next 5 */
             logger.warn({ err }, "imminent_event_notifications prune skipped (table missing)");
         }
+        // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §8.7 / §8.14 — Phase B-2
+        // audit rows. Stays inside the transaction so the SQL prune lands
+        // atomically with the rest of the sweep; the paired FS prune runs
+        // outside the transaction once we know the SQL cutoff committed.
+        // try/catch mirrors the integration_writes / imminent_event_notifications
+        // pattern for hand-rolled test schemas that omit the table —
+        // production always has it.
+        try {
+            const cutoff = Date.now() - RETENTION_DAYS.browserAutomationWorkflows * 86_400_000;
+            counts.browserAutomationWorkflows = deleteWorkflowRunsOlderThan(db, cutoff);
+        }
+        catch (err) {
+            /* c8 ignore next 5 */
+            logger.warn({ err }, "browser_automation_workflows prune skipped (table missing)");
+        }
+        // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.6 / §13 step 60 —
+        // Phase B-4 purchase-tokens sweep. Four passes:
+        //   1. Expire PRE-consume pending tokens past their TTL (in case
+        //      the supervisor restart did not catch them at boot OR the
+        //      daemon ran past a token's 5-min window without the
+        //      workflow's `awaitReply` reaching its own deadline check).
+        //   2. Sweep POST-consume orphans — rows where the user typed the
+        //      token but the click never landed (workflow died, daemon
+        //      restarted mid-flight, post-consume Playwright stalled).
+        //      Cutoff is "consumed_at older than ORPHAN_CONSUME_GRACE_MS"
+        //      which is generous enough to never preempt a healthy
+        //      in-flight workflow (its perWorkflowTimeoutMs is 6 min) but
+        //      short enough to reap actual orphans on the next sweep.
+        //   3. Rotate `token` -> NULL on terminal rows older than
+        //      `browserAutomationPurchaseTokenScrub` days. Reduces at-rest
+        //      raw-token footprint.
+        //   4. Delete `_replies` rows older than the retention window.
+        try {
+            const now = Date.now();
+            const expired = expireStalePurchaseTokens(db, now);
+            counts.browserAutomationPurchaseTokensExpired = expired.length;
+            // 10 min — workflow's perWorkflowTimeoutMs is 6 min; the extra
+            // 4 min covers clock skew + a generous slack so an in-flight
+            // workflow we just don't have a reference to is never preempted.
+            const ORPHAN_CONSUME_GRACE_MS = 10 * 60 * 1000;
+            const orphaned = sweepOrphanedConsumedPurchaseTokens(db, now - ORPHAN_CONSUME_GRACE_MS);
+            counts.browserAutomationPurchaseTokensOrphaned = orphaned.length;
+            const purchaseScrubCutoff = now -
+                RETENTION_DAYS.browserAutomationPurchaseTokenScrub * 86_400_000;
+            counts.browserAutomationPurchaseTokensScrubbed =
+                scrubRotatedPurchaseTokens(db, purchaseScrubCutoff);
+            const replyCutoff = now - RETENTION_DAYS.browserAutomationPurchaseReplies * 86_400_000;
+            counts.browserAutomationPurchaseRepliesDeleted =
+                deletePurchaseRepliesOlderThan(db, replyCutoff);
+        }
+        catch (err) {
+            /* c8 ignore next 5 */
+            logger.warn({ err }, "browser_automation_purchase_tokens sweep skipped (table missing)");
+        }
+        // BROWSER_TASK_REDESIGN_PLAN.md §6.5 deferred follow-up — three
+        // passes on the new browser_task surface:
+        //   1. Expire pending lite-final-confirm tokens past their TTL.
+        //      A daemon-restart sweep handles the cold-start case; this
+        //      catches a daemon that ran past a token's 5-min window
+        //      without the runner's own deadline check firing.
+        //   2. Rotate `token` -> NULL on terminal lite-final-confirm rows
+        //      older than the 1-day scrub window (B-4 parity).
+        //   3. Delete terminal browser_task rows older than the
+        //      browserTask retention window. Children cascade via FK.
+        try {
+            const now = Date.now();
+            const expiredTokens = expireStaleLiteFinalConfirmTokens(db, now);
+            counts.browserTaskFinalConfirmTokensExpired = expiredTokens.length;
+            const tokenScrubCutoff = now - RETENTION_DAYS.browserTaskFinalConfirmTokenScrub * 86_400_000;
+            counts.browserTaskFinalConfirmTokensScrubbed =
+                scrubRotatedLiteFinalConfirmTokens(db, tokenScrubCutoff);
+            const browserTaskCutoff = now - RETENTION_DAYS.browserTask * 86_400_000;
+            counts.browserTask = deleteTerminalBrowserTasksOlderThan(db, browserTaskCutoff);
+        }
+        catch (err) {
+            /* c8 ignore next 5 */
+            logger.warn({ err }, "browser_task retention sweep skipped (tables missing)");
+        }
     })();
     // Transaction committed — safe to copy counts into result.
     result.mdFileSnapshots = counts.mdFileSnapshots;
     result.messages = counts.messages;
     result.agentActions = counts.agentActions;
     result.notificationLog = counts.notificationLog;
+    result.browserAutomationPurchaseTokensExpired =
+        counts.browserAutomationPurchaseTokensExpired ?? 0;
+    result.browserAutomationPurchaseTokensOrphaned =
+        counts.browserAutomationPurchaseTokensOrphaned ?? 0;
+    result.browserAutomationPurchaseTokensScrubbed =
+        counts.browserAutomationPurchaseTokensScrubbed ?? 0;
+    result.browserAutomationPurchaseRepliesDeleted =
+        counts.browserAutomationPurchaseRepliesDeleted ?? 0;
     result.dmConversationLog = counts.dmConversationLog;
     result.observations = counts.observations;
     result.conversationSessions = counts.conversationSessions;
@@ -262,6 +414,21 @@ export function runRetentionCleanup(db, config) {
     result.skillCurationRunsAborted = counts.skillCurationRunsAborted;
     result.integrationWrites = counts.integrationWrites;
     result.imminentEventNotifications = counts.imminentEventNotifications;
+    result.browserAutomationWorkflows = counts.browserAutomationWorkflows;
+    result.browserTask = counts.browserTask;
+    result.browserTaskFinalConfirmTokensExpired =
+        counts.browserTaskFinalConfirmTokensExpired;
+    result.browserTaskFinalConfirmTokensScrubbed =
+        counts.browserTaskFinalConfirmTokensScrubbed;
+    // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §8.7 — pair the SQL prune
+    // above with the FS prune of `<PA_DATA_DIR>/automation-traces/`.
+    // Runs AFTER the SQL transaction committed: a partial-failure that
+    // leaves rows in the table but FS dirs gone is recoverable (the
+    // dashboard renders the row with a "trace missing" badge); the
+    // opposite — rows missing but FS bloat — silently fills disk.
+    // Same cutoff as the SQL side so the row + dir lifetimes match.
+    const traceCutoff = Date.now() - RETENTION_DAYS.browserAutomationWorkflows * 86_400_000;
+    result.browserAutomationTraceDirs = cleanAutomationTraceDirs(tracesRootDir(config.dataDir), traceCutoff);
     const attachmentCleanup = cleanupAttachments(db, config.dataDir);
     result.attachmentOrphanRows = attachmentCleanup.orphanRows;
     result.attachmentDanglingRows = attachmentCleanup.danglingRows;
@@ -356,7 +523,7 @@ export function runRetentionCleanup(db, config) {
  * newer, zero if equal. Suitable as a sort comparator.
  *
  * Why not a plain string comparison? The `## Weekly YYYY-Www` header in
- * `agent/journal.md` is written by an LLM following the review prompt.
+ * `journal/agent.md` is written by an LLM following the review prompt.
  * The prompt asks for zero-padded ISO week numbers, but compliance is
  * probabilistic — the model may emit `2026-W5` instead of `2026-W05`,
  * or a backfill may use a different convention. Lexicographic compare
@@ -571,7 +738,7 @@ function cleanupAttachments(db, dataDir) {
     }
 }
 /**
- * Roll up `agent/journal.md` in place. Three independent passes applied in
+ * Roll up `journal/agent.md` in place. Three independent passes applied in
  * order to a single parsed section list:
  *
  *   1. **Dedup (last-write-wins).** If the same `## Weekly YYYY-Www` or
@@ -803,7 +970,7 @@ onBeforeWrite) {
     return { weeklyPruned, monthlyPruned, duplicatesCollapsed, oversizedSections };
 }
 /**
- * Read-only health check for `agent/journal.md`. Returns section counts and
+ * Read-only health check for `journal/agent.md`. Returns section counts and
  * any oversized sections without modifying the file. Intended for the health
  * endpoint so the dashboard can surface journal bloat without requiring the
  * operator to watch structured logs.
@@ -984,6 +1151,53 @@ function cleanAtomicTempFilesInner(dir, cutoff, recursive) {
     }
     return deleted;
 }
+/**
+ * Sync prune of per-workflow trace directories under
+ * `<PA_DATA_DIR>/automation-traces/`. Mirrors the async
+ * `trace-store.ts:pruneTraceDirectory` (which the daily retention
+ * cron cannot await — `runRetentionCleanup` is sync, matching every
+ * sibling cleanup), but uses `fs` sync primitives so it slots into the
+ * existing sync sweep without a refactor.
+ *
+ * `cutoffEpochMs` is the same cutoff fed to
+ * `deleteWorkflowRunsOlderThan(db, ...)` above, so a workflow run's
+ * audit row and its on-disk trace dir age out together.
+ *
+ * Each per-workflow directory's mtime is the freshest screenshot or
+ * trace.zip the workflow wrote into it. Directories whose mtime is
+ * BEFORE the cutoff are eligible. Errors on a single entry are logged
+ * and skipped — the cron MUST NOT fail outright because one orphaned
+ * dir refuses to delete.
+ */
+function cleanAutomationTraceDirs(root, cutoffEpochMs) {
+    let entries;
+    try {
+        entries = readdirSync(root);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return 0;
+        logger.warn({ err, root }, "automation-traces readdir failed");
+        return 0;
+    }
+    let pruned = 0;
+    for (const entry of entries) {
+        const dir = resolve(root, entry);
+        try {
+            const stat = statSync(dir);
+            if (!stat.isDirectory())
+                continue;
+            if (stat.mtimeMs >= cutoffEpochMs)
+                continue;
+            rmSync(dir, { recursive: true, force: true });
+            pruned++;
+        }
+        catch (err) {
+            logger.warn({ err, dir }, "automation-traces entry prune failed — will retry next run");
+        }
+    }
+    return pruned;
+}
 /**
  * Walk `<contextDir>/git/<slug>/journal/` directories and prune `.md`
  * entries older than `days`. The `git/<slug>/overview.md` files are
@@ -1005,4 +1219,3 @@ function cleanGitJournals(gitDir, days) {
     }
     return deleted;
 }
-//# sourceMappingURL=retention.js.map

package/dist/core/review-context.d.ts

@@ -40,9 +40,18 @@ export interface LoadReviewContextOptions {
     } | null;
 }
 export declare function resolveReviewFlow(processKey: string): ReviewFlowConfig | null;
+/**
+ * Parse the rows table from the root `_index.md`. CONTEXT_VAULT_REDESIGN
+ * v4 V15 split the file into user-curated prose + a daemon-owned
+ * `<!-- reconciler-section -->` block. When the block is present its body
+ * is the authoritative slice; consumers must NOT mix in stale outer
+ * tables the user may have left from a pre-V15 hand-curated index.
+ * When no block exists (fresh install before first reconcile, or a user
+ * who has deleted it), fall back to the first table found anywhere in
+ * the file.
+ */
 export declare function parseContextIndexRows(content: string): ContextIndexRow[];
 export declare function loadReviewContextBlocks(opts: LoadReviewContextOptions): ReviewContextBlock[];
 export declare function renderReviewContextBlocks(processKey: string, blocks: ReviewContextBlock[]): string;
 export declare function appendReviewContextBlocks(basePrompt: string, opts: LoadReviewContextOptions): string;
 export {};
-//# sourceMappingURL=review-context.d.ts.map

package/dist/core/review-context.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { CONTEXT_RELATIVE_PATHS, dossierPath } from "./context-paths.js";
+import { aliasVaultPath } from "./context-vault-aliases.js";
 import { POLICY_FILE_MAX_BYTES, createPromptInjectionBudget, } from "./policy-files.js";
 import { createLogger } from "../logging.js";
 const logger = createLogger("review-context");
@@ -15,10 +16,10 @@ const REVIEW_FLOW_BY_PROCESS_KEY = {
         dossierPath: dossierPath("morning"),
         dossierLabel: "Morning dossier",
     },
-    // `routine.morning_routine_initial` retired by Phase 7 (2026-05-16);
-    // the first-run branch routes through `routine.morning_routine_today`
-    // below, which inherits the same dossier.
-    // morning-routine-optimization.md Phase 5 — Stage A inherits the
+    // `routine.morning_routine_initial` is retired; the first-run branch
+    // routes through `routine.morning_routine_today` below, which inherits
+    // the same dossier.
+    // Stage A inherits the
     // morning-routine review context (dossiers/morning.md + the morning
     // section of context-index.md). The task-flow body
     // (`routine.morning_routine_today.md`) refers to "the Vault review
@@ -58,8 +59,20 @@ const REVIEW_FLOW_BY_PROCESS_KEY = {
 export function resolveReviewFlow(processKey) {
     return REVIEW_FLOW_BY_PROCESS_KEY[processKey] ?? null;
 }
+/**
+ * Parse the rows table from the root `_index.md`. CONTEXT_VAULT_REDESIGN
+ * v4 V15 split the file into user-curated prose + a daemon-owned
+ * `<!-- reconciler-section -->` block. When the block is present its body
+ * is the authoritative slice; consumers must NOT mix in stale outer
+ * tables the user may have left from a pre-V15 hand-curated index.
+ * When no block exists (fresh install before first reconcile, or a user
+ * who has deleted it), fall back to the first table found anywhere in
+ * the file.
+ */
 export function parseContextIndexRows(content) {
-    const lines = content.split(/\r?\n/);
+    const blockMatch = /<!--\s*reconciler-section\s*-->([\s\S]*?)<!--\s*\/reconciler-section\s*-->/.exec(content);
+    const scope = blockMatch ? blockMatch[1] : content;
+    const lines = scope.split(/\r?\n/);
     const rows = [];
     for (let i = 0; i < lines.length; i++) {
         const header = splitMarkdownTableRow(lines[i]);
@@ -126,14 +139,19 @@ export function loadReviewContextBlocks(opts) {
                 for (const row of indexRows) {
                     if (!reviewFlowsMatch(row.reviewFlows, flowConfig.flow))
                         continue;
-                    if (row.path === CONTEXT_RELATIVE_PATHS.contextIndex ||
-                        row.path === flowConfig.dossierPath) {
+                    // Translate legacy spellings (e.g. `plans/projects/foo.md`) to their
+                    // canonical six-class form (`plans/projects/foo.md`) so older
+                    // context-index rows still resolve and dossier dedup matches
+                    // the new layout. Idempotent on already-canonical paths.
+                    const aliasedRowPath = aliasVaultPath(row.path).canonicalPath;
+                    if (aliasedRowPath === CONTEXT_RELATIVE_PATHS.contextIndex ||
+                        aliasedRowPath === flowConfig.dossierPath) {
                         continue;
                     }
                     /* c8 ignore start — cleanIndexPath already routes through
                        sanitizeContextIndexPath upstream, so this re-sanitize never
                        rejects a path that survived parsing. */
-                    const safePath = sanitizeContextIndexPath(row.path);
+                    const safePath = sanitizeContextIndexPath(aliasedRowPath);
                     if (!safePath)
                         continue;
                     /* c8 ignore stop */
@@ -307,4 +325,3 @@ function sanitizeContextIndexPath(rawPath) {
     }
     return normalized;
 }
-//# sourceMappingURL=review-context.js.map

package/dist/core/roadmap-horizon.d.ts

@@ -45,4 +45,3 @@ export declare function bumpReviewCycle(args: {
     reviewCount: number;
 }): ReviewCycle;
 export declare function normalizeLongTermPlanLine(line: string, options?: NormalizeLongTermPlanLineOptions): NormalizeLongTermPlanLineResult;
-//# sourceMappingURL=roadmap-horizon.d.ts.map

package/dist/core/roadmap-horizon.js

@@ -210,4 +210,3 @@ export function normalizeLongTermPlanLine(line, options) {
         warning: "Long-term Plans entry normalized with missing schema fields",
     };
 }
-//# sourceMappingURL=roadmap-horizon.js.map

package/dist/core/roadmap-ids.d.ts

@@ -16,11 +16,10 @@ export declare function isRoadmapId(value: string): boolean;
  * fabrication rather than a daemon-minted random hex?
  *
  * `generateRoadmapId` produces uniformly random `[a-f0-9]{6}`. When
- * the agent is forced to invent IDs inline (e.g. because
- * `POST /api/context/roadmap/id` was misclassified as Approve and
- * 401'd — see incident 2026-04-28), Sonnet's typical fabrications
- * follow an obvious `[0-9][a-f][0-9][a-f][0-9][a-f]` digit-letter
- * alternation: `1a2b3c`, `4d5e6f`, `0d1e2f`, `7a8b9c`, etc.
+ * the agent has to invent IDs inline (e.g. the daemon-mint route is
+ * unreachable or misclassified), Sonnet's typical fabrications follow
+ * an obvious `[0-9][a-f][0-9][a-f][0-9][a-f]` digit-letter alternation:
+ * `1a2b3c`, `4d5e6f`, `0d1e2f`, `7a8b9c`, etc.
  *
  * The heuristic returns true only for that strict alternation. False
  * positive rate against uniformly random suffixes is ≈ 1.3% (per ID),
@@ -54,4 +53,3 @@ export declare function generateRoadmapId(args: {
     randomBytes?: (size: number) => Buffer;
     maxAttempts?: number;
 }): string;
-//# sourceMappingURL=roadmap-ids.d.ts.map

package/dist/core/roadmap-ids.js

@@ -17,11 +17,10 @@ export function isRoadmapId(value) {
  * fabrication rather than a daemon-minted random hex?
  *
  * `generateRoadmapId` produces uniformly random `[a-f0-9]{6}`. When
- * the agent is forced to invent IDs inline (e.g. because
- * `POST /api/context/roadmap/id` was misclassified as Approve and
- * 401'd — see incident 2026-04-28), Sonnet's typical fabrications
- * follow an obvious `[0-9][a-f][0-9][a-f][0-9][a-f]` digit-letter
- * alternation: `1a2b3c`, `4d5e6f`, `0d1e2f`, `7a8b9c`, etc.
+ * the agent has to invent IDs inline (e.g. the daemon-mint route is
+ * unreachable or misclassified), Sonnet's typical fabrications follow
+ * an obvious `[0-9][a-f][0-9][a-f][0-9][a-f]` digit-letter alternation:
+ * `1a2b3c`, `4d5e6f`, `0d1e2f`, `7a8b9c`, etc.
  *
  * The heuristic returns true only for that strict alternation. False
  * positive rate against uniformly random suffixes is ≈ 1.3% (per ID),
@@ -115,4 +114,3 @@ function isValidCreationDate(value) {
         date.getUTCMonth() === month - 1 &&
         date.getUTCDate() === day);
 }
-//# sourceMappingURL=roadmap-ids.js.map

package/dist/core/roadmap-maintenance.d.ts

@@ -110,7 +110,7 @@ export interface RoadmapMaintenanceResult {
  * went wrong. The caller (`scheduler.ts` cron callback) does NOT
  * propagate failure into `routine.evening_review` 15 minutes later.
  */
-export declare function runRoadmapMechanicalMaintenance(deps: RoadmapMaintenanceDeps): RoadmapMaintenanceResult;
+export declare function runRoadmapMechanicalMaintenance(deps: RoadmapMaintenanceDeps): Promise<RoadmapMaintenanceResult>;
 interface ScheduledStatusSyncResult {
     content: string;
     statusSynced: number;
@@ -204,10 +204,9 @@ interface LongTermPlansStaleMarkResult {
 export declare function applyLongTermPlansStaleMark(content: string, todayYmd: string): LongTermPlansStaleMarkResult;
 /**
  * Append `summary` to the `## Roadmap maintenance` section of
- * `agent/journal.md`, creating the section when absent. Exported for
+ * `journal/agent.md`, creating the section when absent. Exported for
  * unit tests so the fresh-file vs. existing-section vs. existing-file
  * branches can be pinned without standing up a sqlite + fs harness.
  */
 export declare function appendToJournalSection(original: string | null, summary: string): string;
 export {};
-//# sourceMappingURL=roadmap-maintenance.d.ts.map

package/dist/core/roadmap-maintenance.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { localDateStr } from "@aitne/shared";
 import { writeFileAtomically } from "./atomic-write.js";
+import { serializeContextFileWrite } from "./context-file-serializer.js";
 import { CONTEXT_RELATIVE_PATHS } from "./context-paths.js";
 import { stripRoadmapIdComment } from "./roadmap-ids.js";
 import { findSectionLineBounds, validateRoadmap, validateRoadmapTransition, } from "./roadmap-validate.js";
@@ -100,7 +101,7 @@ const JOURNAL_SECTION_HEADER = "## Roadmap maintenance";
  * went wrong. The caller (`scheduler.ts` cron callback) does NOT
  * propagate failure into `routine.evening_review` 15 minutes later.
  */
-export function runRoadmapMechanicalMaintenance(deps) {
+export async function runRoadmapMechanicalMaintenance(deps) {
     const result = {
         status: "success",
         statusSynced: 0,
@@ -206,18 +207,30 @@ export function runRoadmapMechanicalMaintenance(deps) {
                     return result;
                 }
                 try {
-                    saveSnapshot(deps.db, "roadmap", original, "roadmap_maintenance");
-                    // Mark before the rename so FS-watch consumers attribute the
-                    // resulting event to the agent. Roll back on failure (C2).
-                    deps.writeTracker?.markWriting(roadmapPath, working);
-                    try {
-                        writeFileAtomically(roadmapPath, working);
-                    }
-                    catch (writeErr) {
-                        deps.writeTracker?.unmark(roadmapPath);
-                        throw writeErr;
-                    }
-                    deps.onIndexableContextChange?.(CONTEXT_RELATIVE_PATHS.roadmap);
+                    // Per-path serializer fences this write against the HTTP
+                    // context routes (PUT/PATCH /api/context/roadmap) and any
+                    // other in-process roadmap writer. Without it, an HTTP
+                    // PATCH on roadmap.md that arrives between this maintenance
+                    // run's read and rename could land its own write AFTER ours,
+                    // silently dropping the maintenance sweep's edits.
+                    // (`roadmapWriteLock` is the cross-session X-Lock-Id fence —
+                    // HTTP returns 409 when held by another session — but the
+                    // HTTP route only CHECKS the lock; this serializer is what
+                    // adds intra-process atomicity across all writers.)
+                    await serializeContextFileWrite(roadmapPath, () => {
+                        saveSnapshot(deps.db, "roadmap", original, "roadmap_maintenance");
+                        // Mark before the rename so FS-watch consumers attribute the
+                        // resulting event to the agent. Roll back on failure (C2).
+                        deps.writeTracker?.markWriting(roadmapPath, working);
+                        try {
+                            writeFileAtomically(roadmapPath, working);
+                        }
+                        catch (writeErr) {
+                            deps.writeTracker?.unmark(roadmapPath);
+                            throw writeErr;
+                        }
+                        deps.onIndexableContextChange?.(CONTEXT_RELATIVE_PATHS.roadmap);
+                    });
                 }
                 catch (err) {
                     logger.error({ err }, "Failed to persist roadmap maintenance write");
@@ -230,7 +243,7 @@ export function runRoadmapMechanicalMaintenance(deps) {
                 }
             }
             try {
-                appendJournalLine(deps, result, now, today);
+                await appendJournalLine(deps, result, now, today);
             }
             catch (err) {
                 logger.warn({ err }, "Failed to append maintenance journal line");
@@ -582,36 +595,50 @@ export function applyLongTermPlansStaleMark(content, todayYmd) {
     return { content: kept.join("\n"), staleMarked };
 }
 // ── Journal ────────────────────────────────────────────────────────────────
-function appendJournalLine(deps, result, now, today) {
+async function appendJournalLine(deps, result, now, today) {
     const journalPath = join(deps.contextDir, CONTEXT_RELATIVE_PATHS.agent.journal);
     const time = formatHm(now, deps.timezone);
     const summary = `- ${today} ${time}: status_synced=${result.statusSynced}, swept=${result.swept}, stale_marked=${result.staleMarked}` +
         (result.errors.length > 0
             ? `, errors=${result.errors.length} (${result.errors.map((e) => e.step).join(",")})`
             : "");
-    let original = null;
-    if (existsSync(journalPath)) {
-        original = readFileSync(journalPath, "utf-8");
-    }
-    const next = appendToJournalSection(original, summary);
-    if (original !== null) {
-        saveSnapshot(deps.db, "agent/journal", original, "roadmap_maintenance_journal");
-    }
-    // Mark before the rename so FS-watch consumers attribute the
-    // resulting event to the agent. Roll back on failure (C2).
-    deps.writeTracker?.markWriting(journalPath, next);
-    try {
-        writeFileAtomically(journalPath, next);
-    }
-    catch (writeErr) {
-        deps.writeTracker?.unmark(journalPath);
-        throw writeErr;
-    }
-    deps.onIndexableContextChange?.(CONTEXT_RELATIVE_PATHS.agent.journal);
+    // Per-path serializer fences this read-modify-write against the HTTP
+    // route's `PATCH /api/context/journal/agent` and the other in-process
+    // journal appenders (morning routine, weekly-interests). Without the
+    // fence, two writers reading the same pre-state would each rename
+    // their own "next" over the file, silently dropping one of the
+    // bullets.
+    //
+    // Awaited (not fire-and-forget) so the maintenance audit row's
+    // emit-on-failure semantics are preserved: a thrown write propagates
+    // to the caller's try/catch which pushes a "journal" error into
+    // `result.errors` (matches pre-fix behaviour where the write was
+    // synchronous and a throw bubbled up through the same path).
+    await serializeContextFileWrite(journalPath, () => {
+        let original = null;
+        if (existsSync(journalPath)) {
+            original = readFileSync(journalPath, "utf-8");
+        }
+        const next = appendToJournalSection(original, summary);
+        if (original !== null) {
+            saveSnapshot(deps.db, "journal/agent", original, "roadmap_maintenance_journal");
+        }
+        // Mark before the rename so FS-watch consumers attribute the
+        // resulting event to the agent. Roll back on failure (C2).
+        deps.writeTracker?.markWriting(journalPath, next);
+        try {
+            writeFileAtomically(journalPath, next);
+        }
+        catch (writeErr) {
+            deps.writeTracker?.unmark(journalPath);
+            throw writeErr;
+        }
+        deps.onIndexableContextChange?.(CONTEXT_RELATIVE_PATHS.agent.journal);
+    });
 }
 /**
  * Append `summary` to the `## Roadmap maintenance` section of
- * `agent/journal.md`, creating the section when absent. Exported for
+ * `journal/agent.md`, creating the section when absent. Exported for
  * unit tests so the fresh-file vs. existing-section vs. existing-file
  * branches can be pinned without standing up a sqlite + fs harness.
  */
@@ -703,4 +730,3 @@ function findEntryEnd(lines, start, bodyEnd) {
     }
     return bodyEnd;
 }
-//# sourceMappingURL=roadmap-maintenance.js.map

package/dist/core/roadmap-refresh-triggers.d.ts

@@ -29,4 +29,3 @@ export declare function shouldTriggerRefreshForCalendarEvent(input: CalendarEven
 export type TriggerRoadmapRefresh = (source: string) => void;
 export declare function maybeTriggerRefreshForTravelBooking(input: TravelBookingTriggerInput, trigger: TriggerRoadmapRefresh | null | undefined): void;
 export declare function maybeTriggerRefreshForCalendarEvent(input: CalendarEventTriggerInput, trigger: TriggerRoadmapRefresh | null | undefined): void;
-//# sourceMappingURL=roadmap-refresh-triggers.d.ts.map

package/dist/core/roadmap-refresh-triggers.js

@@ -48,4 +48,3 @@ export function maybeTriggerRefreshForCalendarEvent(input, trigger) {
         logger.warn({ err }, "triggerRoadmapRefresh threw — continuing");
     }
 }
-//# sourceMappingURL=roadmap-refresh-triggers.js.map

package/dist/core/roadmap-truncate.d.ts

@@ -46,4 +46,3 @@ export interface RoadmapTruncationOptions {
  * near-term window. Pass-through when the section is absent or empty.
  */
 export declare function truncateRoadmap(content: string, options?: RoadmapTruncationOptions): string;
-//# sourceMappingURL=roadmap-truncate.d.ts.map