@aitne/daemon 0.1.8 → 0.1.9

package/dist/core/dispatcher.js

@@ -1,4 +1,4 @@
-import { EventPriority, createEvent, getAgentDayBoundsUtc, isMessageEvent, isRoutineEvent, isAgentTaskEvent, isScheduledDmEvent, isKnowledgeImportEvent, parseSqliteUtcMs, } from "@aitne/shared";
+import { EventPriority, createEvent, getAgentDayBoundsUtc, isMessageEvent, isRoutineEvent, isAgentTaskEvent, isScheduledEvent, isScheduledBrowserTaskEvent, isScheduledDmEvent, isKnowledgeImportEvent, parseSqliteUtcMs, } from "@aitne/shared";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { CONTEXT_RELATIVE_PATHS } from "./context-paths.js";
@@ -40,6 +40,8 @@ const REVIEW_ROUTINES_REQUIRING_MORNING = new Set([
 ]);
 import { MorningRoutineRunner } from "./dispatcher-morning-routine.js";
 import { MorningRoutinePipelineOrchestrator } from "./morning/orchestrator.js";
+import { DailyJournalComposer } from "./morning/daily-journal-composer.js";
+import { randomUUID } from "node:crypto";
 import { RoutineFetchWindowRunner } from "./routine-fetch-window-runner.js";
 import { ScheduledTaskRunner, SKILL_CURATION_OPTIMIZER_ALLOWED_TOOLS, } from "./dispatcher-scheduled-tasks.js";
 import { MessageHandler } from "./dispatcher-message-handler.js";
@@ -87,6 +89,45 @@ export class EventDispatcher {
      * Spec: docs/design/backlog/messaging-bang-commands.md
      */
     bangCommandRegistry = null;
+    /**
+     * Phase B-4 — DM-issued purchase confirmation handler. Wired at
+     * daemon startup from `index.ts` via `setPurchaseHandler`. Null
+     * when B-4 is not enabled at startup; the dispatcher's inbound
+     * classifier no-ops in that case and the workflow runner refuses
+     * `variant: "purchase"` calls with `purchase_b4_disabled`.
+     *
+     * Spec: MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17 / §13 step 50.
+     */
+    purchaseHandler = null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5 / §14.11 — lite-final-confirm
+     * handler. Wired at daemon startup from `bootstrap/event-pipeline.ts`
+     * via `setFinalConfirmHandler`. The inbound classifier (§14.11 Q#6)
+     * routes `!~xxxxxxxx` replies between this handler and
+     * `purchaseHandler` by querying both stores via `lookupByRaw` and
+     * dispatching to whichever returned a row.
+     */
+    finalConfirmHandler = null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — Phase 3 wiring. The
+     * dispatcher routes `scheduled.browser_task` events to the runner.
+     * Wired at daemon startup from `bootstrap/event-pipeline.ts` via
+     * `setBrowserTaskRunner`. Null when the runner factory has not yet
+     * landed (test harness or stripped-down boot path) — the dispatch
+     * branch flips the `agent_schedule` row to `failed
+     * (runner_unavailable)` in that case so the row doesn't park.
+     */
+    browserTaskRunner = null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §7 — "the user is DMed" on fire-time
+     * dispatch failure (`site_unregistered`, `allowlist_rejected`,
+     * `runner_unavailable`). The runner's own `notifier.notifyTerminal`
+     * only fires when the runner is reached, which is exactly NOT the
+     * case for these pre-runner failure paths. Wired from `event-pipeline.ts`
+     * alongside the runner factory so a fire-time failure DMs the owner
+     * instead of leaving the row silently flipped to `failed` in the DB.
+     */
+    browserTaskTerminalNotifier = null;
     /**
      * Current setup mode — scope-agnostic flag that survives internal
      * direct-message session refresh (day boundary, stale flag, etc). Previously this
@@ -210,6 +251,16 @@ export class EventDispatcher {
      * carried on the default `event` SSE channel.
      */
     eventBroadcaster = null;
+    /**
+     * AGENT_DEFINITIONS_DESIGN.md §8 — per-firing execution recorder. Wired
+     * post-construction via {@link setAgentExecutionTracker} (the recorder +
+     * contextDir + SSE deps only exist after the event-pipeline factory runs).
+     * `null` in tests / pre-wire → no execution rows are written, preserving the
+     * legacy dispatch shape. The ResultProcessor reaches it through a call-time
+     * closure (see the constructor's `recordExecutionOutcome` dep) so it stays
+     * live even though the tracker is set after the processor is built.
+     */
+    agentExecutionTracker = null;
     /**
      * Notify-dedup tracking — set of correlationIds for in-flight events
      * that have already invoked `POST /api/notify` from inside the agent
@@ -349,6 +400,11 @@ export class EventDispatcher {
             notifiedEvents: this.notifiedEvents,
             isReactive: (event) => this.isReactive(event),
             hasMessageBackendMetadataColumns: this.hasMessageBackendMetadataColumns,
+            // AGENT_DEFINITIONS_DESIGN.md §8.2 — feed the terminal LLM-level outcome
+            // (cost / soft-error) to the execution tracker so the dispatch boundary
+            // settles the row with the accurate result. Call-time closure → live even
+            // though the tracker is wired after this processor is constructed.
+            recordExecutionOutcome: (event, outcome) => this.agentExecutionTracker?.recordOutcome(event.correlationId, outcome),
         });
         // docs/design/appendices/routine-data-acquisition.md Phase 4 / D1 — shared pre-pass
         // runner consumed by HourlyCheckCoordinator (D3), MorningRoutineRunner
@@ -428,6 +484,58 @@ export class EventDispatcher {
         // owns Stage A (today.md) + Stage B (daily journal). It is the only
         // dispatch path for `routine.morning_routine`; the legacy monolithic
         // executor was retired once the orchestrator stabilised.
+        // daily-journal-daemon-write.md §4.11 — wired daily-journal
+        // composer fed into the orchestrator. The composer shares its
+        // snapshot insert with the agent-journal-appender pattern: direct
+        // INSERT into `md_file_snapshots` (no debounce, no session id —
+        // morning-routine daemon-mediated writes aren't user-initiated so
+        // the per-request bookkeeping the HTTP route does is N/A).
+        const dailyJournalComposer = new DailyJournalComposer({
+            db: this.db,
+            contextDir: getContextDir(this.config, this.db),
+            saveSnapshot: (filePath, content, trigger) => {
+                try {
+                    const result = this.db
+                        .prepare("INSERT INTO md_file_snapshots (file_path, content, trigger, session_id) VALUES (?, ?, ?, ?)")
+                        .run(filePath, content, trigger, null);
+                    return Number(result.lastInsertRowid);
+                }
+                catch (err) {
+                    logger.warn({ err, filePath, trigger }, "DailyJournalComposer: failed to save md_file_snapshots row");
+                    return null;
+                }
+            },
+            ...(this.writeTracker ? { writeTracker: this.writeTracker } : {}),
+            // No `onIndexableContextChange` — Dispatcher doesn't carry the
+            // context-index reconciler hook today. Chokidar's fallback fs
+            // watch will detect the daemon-mediated PUT on its own. If we
+            // ever wire the reconciler through Dispatcher, daily/*.md is in
+            // the indexable set and should get the hint.
+        });
+        // daily-journal-daemon-write.md §4.7b — operator DM for the
+        // partial-extract streak. Synthesises a `routine.morning_routine_journal`
+        // event so it routes through `notificationMgr.send`'s existing
+        // proactive path (quiet hours, configured destinations, etc.).
+        const partialExtractStreakNotifier = {
+            notify: async (args) => {
+                const event = {
+                    type: "routine.morning_routine_journal",
+                    source: "daemon",
+                    priority: 1,
+                    timestamp: new Date(),
+                    correlationId: randomUUID(),
+                    data: {},
+                };
+                await this.notificationMgr.send(args.message, event, {
+                    priority: "normal",
+                    category: "agent",
+                });
+            },
+        };
+        // morning-routine-optimization.md Phase 5/6/7 — pipeline orchestrator
+        // owns Stage A (today.md) + Stage B (daily journal). It is the only
+        // dispatch path for `routine.morning_routine`; the legacy monolithic
+        // executor was retired once the orchestrator stabilised.
         const pipelineOrchestrator = new MorningRoutinePipelineOrchestrator({
             db: this.db,
             config: this.config,
@@ -440,10 +548,12 @@ export class EventDispatcher {
             // in_progress agent_actions row for Stage A so the agent's
             // `PATCH /api/agent-actions/self` can resolve mid-run, and feed
             // the write-tracker into ⑥ AgentJournalAppender so its atomic
-            // write to `agent/journal.md` does not get re-classified as a
+            // write to `journal/agent.md` does not get re-classified as a
             // user-actor change by the obsidian / git observers.
             audit: this.audit,
             ...(this.writeTracker ? { writeTracker: this.writeTracker } : {}),
+            dailyJournalComposer,
+            partialExtractStreakNotifier,
         });
         this.morningRoutine = new MorningRoutineRunner({
             db: this.db,
@@ -504,6 +614,8 @@ export class EventDispatcher {
             getAuthRecovery: () => this.authRecovery,
             getAuthHealthMonitor: () => this.authHealthMonitor,
             getBangCommandRegistry: () => this.bangCommandRegistry,
+            getPurchaseHandler: () => this.purchaseHandler,
+            getFinalConfirmHandler: () => this.finalConfirmHandler,
             getCurrentSetupMode: () => this.currentSetupMode,
             beginSetupMode: (mode) => this.beginSetupMode(mode),
             lookupCustomBangCommandForEvent: (event) => this.lookupCustomBangCommandForEvent(event),
@@ -531,6 +643,57 @@ export class EventDispatcher {
     setSignalDetector(detector) {
         this.signalDetector = detector;
     }
+    /**
+     * Wire the B-4 purchase-confirmation handler. Called once at startup
+     * from `index.ts` after the messaging hub is up — the handler's
+     * `sender` dependency requires a live MessageHub for outbound DMs.
+     * Calling more than once replaces the prior reference (used by the
+     * dashboard's "Disable B-4" flow which can later re-enable).
+     */
+    setPurchaseHandler(handler) {
+        this.purchaseHandler = handler;
+    }
+    /** Read accessor — used by the route layer's wiring to thread the
+     *  same instance into `ApiDependencies.purchaseHandler` without a
+     *  parallel construction path. */
+    getPurchaseHandler() {
+        return this.purchaseHandler;
+    }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5 / §14.11 — wire the lite-final-
+     * confirm handler. Mirrors `setPurchaseHandler` so the inbound `!~`
+     * classifier and the route layer share one instance via the
+     * dispatcher.
+     */
+    setFinalConfirmHandler(handler) {
+        this.finalConfirmHandler = handler;
+    }
+    getFinalConfirmHandler() {
+        return this.finalConfirmHandler;
+    }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — wire the browser-task
+     * runner so the `scheduled.browser_task` dispatch branch can hand
+     * fire-time events to it. Pairs with the `event-pipeline.ts`
+     * `createBrowserTaskRunner` factory call (Phase 3).
+     */
+    setBrowserTaskRunner(runner) {
+        this.browserTaskRunner = runner;
+    }
+    getBrowserTaskRunner() {
+        return this.browserTaskRunner;
+    }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §7 — wire the terminal-state DM
+     * emitter used by the `scheduled.browser_task` failure paths (see
+     * `browserTaskTerminalNotifier` field doc). `event-pipeline.ts` passes
+     * the same `BrowserTaskNotifier` instance that's threaded into the
+     * runner so a single DM-emission contract covers both pre-runner
+     * fire-time failures and the runner's own non-completed terminals.
+     */
+    setBrowserTaskTerminalNotifier(notifier) {
+        this.browserTaskTerminalNotifier = notifier;
+    }
     /** Set the dashboard stream adapter for real-time response streaming. */
     setDashboardStream(adapter) {
         this.dashboardStream = adapter;
@@ -594,6 +757,71 @@ export class EventDispatcher {
     setEventBroadcaster(broadcaster) {
         this.eventBroadcaster = broadcaster;
     }
+    /**
+     * Wire the per-firing execution tracker (AGENT_DEFINITIONS_DESIGN.md §8).
+     * Optional — when unset, no `agent_executions` rows are written and dispatch
+     * behaves exactly as before. Set once at boot from the event-pipeline factory.
+     */
+    setAgentExecutionTracker(tracker) {
+        this.agentExecutionTracker = tracker;
+    }
+    /**
+     * Open an execution row for an agent-resolvable firing (§8.1), called from
+     * `dispatchSafe` after the setup / cost gates pass so a skipped firing never
+     * records an execution. Reactive DMs resolve to no Agent (no routine / no
+     * schedule row / no `task_context.agent_id`) and are a near-free no-op.
+     */
+    beginAgentExecution(event) {
+        if (this.agentExecutionTracker === null)
+            return;
+        const taskContext = isScheduledEvent(event)
+            ? event.taskContext
+            : undefined;
+        const routineEvent = isRoutineEvent(event) ? event : null;
+        const phase = routineEvent
+            ? routineEvent.data?.phase
+            : undefined;
+        // §8.1 step 3: `task_context.routine` → built-in registry slug. A
+        // `RoutineEvent` carries the routine on the event; a built-in fired via
+        // `queue_wake` (only `morning-routine`) arrives as a `scheduled.task`
+        // whose routine lives in `task_context` — without this fallback that
+        // flagship daily firing would resolve to no Agent and record no rollup.
+        const taskContextRoutine = typeof taskContext?.routine === "string" ? taskContext.routine : null;
+        const taskContextPhase = typeof taskContext?.phase === "string" ? taskContext.phase : null;
+        const resolution = {
+            taskContextAgentId: typeof taskContext?.agent_id === "string" ? taskContext.agent_id : null,
+            recurringScheduleId: typeof taskContext?.recurringScheduleId === "number"
+                ? taskContext.recurringScheduleId
+                : null,
+            routine: routineEvent ? routineEvent.routine : taskContextRoutine,
+            routinePhase: routineEvent
+                ? typeof phase === "string"
+                    ? phase
+                    : null
+                : taskContextPhase,
+        };
+        const scheduleRowId = isScheduledEvent(event) && event.scheduleId !== undefined
+            ? event.scheduleId
+            : null;
+        this.agentExecutionTracker.begin(event.correlationId, resolution, {
+            scheduleRowId,
+            trigger: this.resolveExecutionTrigger(event, taskContext),
+        });
+    }
+    /** Classify an execution's trigger for the rollup row (§5.2). */
+    resolveExecutionTrigger(event, taskContext) {
+        // run-now (§9.4) stamps `task_context.trigger='manual'` — honour it so the
+        // rollup records `manual`, not the `cron` the isScheduledEvent fallback
+        // would assign (the queued row IS a scheduled event). `triggeredBy` is a
+        // legacy alias kept for any dashboard-initiated flow that sets it.
+        if (taskContext?.trigger === "manual" || taskContext?.triggeredBy === "dashboard")
+            return "manual";
+        if (taskContext?.trigger === "self")
+            return "self";
+        if (isRoutineEvent(event) || isScheduledEvent(event))
+            return "cron";
+        return "event";
+    }
     /**
      * Internal helper: broadcast `routine_started` or `routine_completed` for
      * the given routine event. Centralised so the JSON shape and failure
@@ -818,7 +1046,7 @@ export class EventDispatcher {
      * scheduled wake tasks, startup catchup, calendar-poller reactive events).
      *
      * Two layers:
-     *  - **Cold gate**: `rules/management.md` must exist. Before initial setup
+     *  - **Cold gate**: `policies/management.md` must exist. Before initial setup
      *    there is no policy document, no user/profile.md, no today.md — running
      *    routines would produce garbage AND, crucially, any loud prompt-context
      *    write from such a routine can trigger
@@ -994,6 +1222,29 @@ export class EventDispatcher {
        LIMIT 1`).get();
         return !!row;
     }
+    /**
+     * Release a claimed `agent_schedule` row back to `pending` when an
+     * autonomous scheduled event is short-circuited before its dispatch
+     * branch can run (setup gate or autonomous cost cap). The ScheduleWatcher
+     * claims the row as `running` and hands the event to the EventBus before
+     * these gates are evaluated, so a silent skip would otherwise leave the
+     * row stuck in `running` forever — blocking both boot recovery (there is
+     * none for stuck `running` schedule rows) and the recurring
+     * `NOT EXISTS(status IN pending/running)` reconcile guard. Reverting to
+     * `pending` (rather than `failed`/`skipped`) is correct because the skip
+     * is transient: once the cost-cap window rolls over or setup completes,
+     * the next ScheduleWatcher tick should re-evaluate and fire the row. This
+     * matches the quiet-hours deferral precedent in the scheduler. The
+     * `WHERE ... status = 'running'` clause keeps it idempotent — a no-op for
+     * non-scheduled events or already-terminal rows.
+     */
+    releaseClaimedSchedule(event) {
+        if (isScheduledEvent(event) && event.scheduleId) {
+            this.db
+                .prepare("UPDATE agent_schedule SET status = 'pending' WHERE id = ? AND status = 'running'")
+                .run(event.scheduleId);
+        }
+    }
     async dispatchSafe(event) {
         const trigger = this.isReactive(event) ? "reactive" : "autonomous";
         const startMs = Date.now();
@@ -1024,6 +1275,7 @@ export class EventDispatcher {
             if (!this.isReactive(event)) {
                 const setupBlock = this.isAutonomousAllowed();
                 if (setupBlock !== null) {
+                    this.releaseClaimedSchedule(event);
                     this.audit.logSkip(event, setupBlock, trigger);
                     logger.info({ eventType: event.type, source: event.source, reason: setupBlock }, "Event skipped — autonomous work paused for setup");
                     return;
@@ -1033,16 +1285,24 @@ export class EventDispatcher {
                 // Reactive sessions always pass. Degradation priority: hourly_check is
                 // skipped first, morning_routine last.
                 if (this.shouldSkipForCostCap(event)) {
+                    this.releaseClaimedSchedule(event);
                     this.audit.logSkip(event, "autonomous_cost_cap_exceeded", trigger);
                     logger.info({ eventType: event.type, source: event.source }, "Event skipped — autonomous daily cost cap exceeded");
                     return;
                 }
             }
+            // AGENT_DEFINITIONS_DESIGN.md §8.1 — open the execution row after the
+            // setup / cost gates pass (a gated firing records no execution) and
+            // before dispatch runs. Resolves to no Agent (→ no-op) for reactive DMs.
+            this.beginAgentExecution(event);
             if (broadcastRoutine) {
                 this.broadcastRoutineProgress("routine_started", broadcastRoutine);
                 routineStartBroadcast = true;
             }
             await this.dispatch(event);
+            // Settle the execution on the success side (the ResultProcessor has
+            // already fed the terminal cost / isError via `recordOutcome`). Idempotent.
+            this.agentExecutionTracker?.completeFromDispatch(event.correlationId);
             const durationMs = Date.now() - startMs;
             logger.info({ eventType: event.type, source: event.source, durationMs }, "Event processing completed");
             if (broadcastRoutine) {
@@ -1055,7 +1315,16 @@ export class EventDispatcher {
         catch (err) {
             const durationMs = Date.now() - startMs;
             logger.error({ err, eventType: event.type, source: event.source, durationMs }, "Event processing failed");
+            // Log the error row BEFORE settling the execution: the `agent_id`
+            // resolver reads the tracker's active-execution map, which
+            // `completeFromDispatch` consumes — so logError must run first to stamp
+            // this row with the owning Agent (AGENT_DEFINITIONS_DESIGN.md §8.1).
             this.audit.logError(event, err, trigger, buildLogErrorContext(err, durationMs));
+            // Settle the execution on the thrown-error side (§8.2). Idempotent — a
+            // no-op if the success path above already consumed the entry.
+            this.agentExecutionTracker?.completeFromDispatch(event.correlationId, {
+                thrown: err,
+            });
             // Only emit `routine_completed` if we previously emitted
             // `routine_started`; otherwise the dashboard would receive an
             // orphan completion for a routine that never started (e.g. error
@@ -1115,6 +1384,11 @@ export class EventDispatcher {
                         logger.warn({ routine, eventType: event.type }, "Review routine skipped — morning_routine not yet complete and queueMorningRoutineWake not wired");
                     }
                     this.audit.logSkip(event, "morning_routine_pending_for_today", "autonomous");
+                    // AGENT_DEFINITIONS_DESIGN.md §5.2 / §8 — settle the execution row
+                    // opened by `beginAgentExecution` as a deliberate skip rather than
+                    // letting `dispatchSafe`'s success path record a misleading empty
+                    // `success` for a review that never ran.
+                    this.agentExecutionTracker?.markSkipped(event.correlationId, "morning_routine_pending_for_today");
                     return;
                 }
             }
@@ -1135,6 +1409,8 @@ export class EventDispatcher {
                 // installation.
                 if (!this.materializeOptimizerWorkdir) {
                     this.audit.logSkip(event, "skill_curation_unwired", "autonomous");
+                    // §5.2 / §8 — settle as a skip (see the review-gate site above).
+                    this.agentExecutionTracker?.markSkipped(event.correlationId, "skill_curation_unwired");
                     return;
                 }
                 await this.scheduledTasks.executeSkillCurationRoutine(event);
@@ -1189,10 +1465,76 @@ export class EventDispatcher {
             // behavior. (scheduled.dm subtype is handled above.)
             await this.scheduledTasks.executeScheduledTask(event);
         }
+        else if (isScheduledBrowserTaskEvent(event)) {
+            // BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — fire-time row
+            // creation + runner handoff. The helper module
+            // `dispatcher-scheduled-browser-task.ts` owns the decision
+            // logic; here we wire it into the agent_schedule lifecycle.
+            await this.handleScheduledBrowserTaskDispatch(event);
+        }
         else {
             await this.scheduledTasks.executeDefault(event);
         }
     }
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §7 — dispatch branch for
+     * `scheduled.browser_task`. Defers the heavy lifting to
+     * `handleScheduledBrowserTask` (validation + row creation + runner
+     * handoff) and translates the discriminated outcome into the
+     * `agent_schedule.status` write so the row lifecycle stays in sync.
+     *
+     * Outcomes map to:
+     *   - `dispatched` / `row_already_exists` → `agent_schedule` row
+     *     `completed` (the dispatch itself succeeded; the `browser_task`
+     *     row's own state machine tracks the long-running outcome).
+     *   - `site_unregistered` / `allowlist_rejected` / `task_context_invalid`
+     *     / `runner_unavailable` → `agent_schedule` row `failed` (the
+     *     dispatch could not proceed).
+     *
+     * A throw escapes upward into the `dispatch()` try/catch, where
+     * `errorRouter.handleError` flips the schedule row to `failed` via
+     * the existing `isScheduledEvent(event) && event.scheduleId` branch
+     * (defence-in-depth — the explicit `failed` writes here cover every
+     * normal-path failure so the error route never has to).
+     */
+    async handleScheduledBrowserTaskDispatch(event) {
+        const { handleScheduledBrowserTask } = await import("./dispatcher-scheduled-browser-task.js");
+        const outcome = await handleScheduledBrowserTask({
+            db: this.db,
+            runner: this.browserTaskRunner,
+            notifier: this.browserTaskTerminalNotifier,
+        }, event);
+        const succeeded = outcome.kind === "dispatched" || outcome.kind === "row_already_exists";
+        const newStatus = succeeded ? "completed" : "failed";
+        this.db
+            .prepare("UPDATE agent_schedule SET status = ? WHERE id = ? AND status = 'running'")
+            .run(newStatus, event.scheduleId);
+        // Audit row so the operator can grep the audit log for non-trivial
+        // dispatch outcomes (registry drift, runner misconfiguration). The
+        // happy path is intentionally NOT audited at this layer — the
+        // runner's own `agent_actions.browser_task.queue.*` rows cover the
+        // post-dispatch lifecycle.
+        if (!succeeded) {
+            try {
+                this.db
+                    .prepare(`INSERT INTO agent_actions
+               (action_type, detail, result, started_at, completed_at)
+             VALUES (?, ?, 'failure', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`)
+                    .run("browser_task.scheduled_dispatch_failed", JSON.stringify({
+                    scheduleId: event.scheduleId,
+                    kind: outcome.kind,
+                    ...("taskId" in outcome ? { taskId: outcome.taskId } : {}),
+                    ...("siteKey" in outcome ? { siteKey: outcome.siteKey } : {}),
+                    ...("reason" in outcome ? { reason: outcome.reason } : {}),
+                }));
+            }
+            catch (auditErr) {
+                /* c8 ignore start -- defensive */
+                logger.warn({ err: auditErr, scheduleId: event.scheduleId, kind: outcome.kind }, "failed to record browser_task.scheduled_dispatch_failed audit row");
+                /* c8 ignore stop */
+            }
+        }
+    }
     getMessageExecutionKey(event) {
         const { scope, scopeKey } = getConversationScope({
             platform: event.platform,
@@ -1354,4 +1696,3 @@ export class EventDispatcher {
         });
     }
 }
-//# sourceMappingURL=dispatcher.js.map

package/dist/core/dm-freshness-metrics.d.ts

@@ -71,4 +71,3 @@ export interface DmFreshnessAggregate {
  * rows over 7 days at the maintainer's traffic) so this is fine.
  */
 export declare function computeDmFreshnessAggregate(db: Database.Database, windowDays?: number): DmFreshnessAggregate;
-//# sourceMappingURL=dm-freshness-metrics.d.ts.map

package/dist/core/dm-freshness-metrics.js

@@ -136,4 +136,3 @@ function percentile(sortedAsc, p) {
     const rank = Math.min(sortedAsc.length - 1, Math.max(0, Math.ceil(p * sortedAsc.length) - 1));
     return sortedAsc[rank];
 }
-//# sourceMappingURL=dm-freshness-metrics.js.map

package/dist/core/dm-token-router.d.ts

@@ -0,0 +1,58 @@
+/**
+ * DM-token router — BROWSER_TASK_REDESIGN_PLAN.md §14.11 Q#6.
+ *
+ * Pure decision module shared between the messaging adapter's inbound
+ * `!~xxxxxxxx` classifier and any future programmatic caller that
+ * needs to know "given a token reply, which handler owns it?".
+ *
+ * Two stores share the `!~xxxxxxxx` envelope on the same primary
+ * channels:
+ *
+ *  - B-4 purchase tokens (`browser_automation_purchase_tokens`)
+ *  - lite-final-confirm tokens (`browser_task_final_confirm_tokens`)
+ *
+ * Both jtis are uuid v4 so a colliding-raw-string match is bounded by
+ * uuid uniqueness — but the surface still has to deterministically
+ * resolve the rare case where both stores return a row for the same
+ * raw inbound. This module's `decideTokenReplyRoute` is the single
+ * source of truth for that decision:
+ *
+ *   - exactly one row → route to that handler
+ *   - both rows present → older `issuedAt` wins (deterministic;
+ *     prevents the surface from oscillating between handlers on retries)
+ *   - neither → `none` (caller fans strict-cancel-on-non-token-reply
+ *     to both handlers if wired)
+ *
+ * Pure — no DB, no clock. 100% covered per §13 testing table extension.
+ */
+/** The minimal row shape the router needs from either store. Both
+ *  `PurchaseTokenRow` and `LiteFinalConfirmTokenRow` carry these fields
+ *  with identical semantics so the router can read either. */
+export interface TokenIssueRowView {
+    issuedAt: number;
+}
+export type TokenReplyRoute = {
+    kind: "none";
+} | {
+    kind: "purchase";
+} | {
+    kind: "lite_final_confirm";
+};
+/**
+ * Decide which handler should consume an inbound `!~xxxxxxxx` reply.
+ *
+ * The caller passes the result of `purchaseHandler.lookupByRaw(token)`
+ * and `finalConfirmHandler.lookupByRaw(token)` (either may be null when
+ * the corresponding handler isn't wired OR when the store has no
+ * matching row). The router does NOT call into either store — it is
+ * pure decision logic over the two views.
+ *
+ * Tie-break: when both rows exist, prefer the older `issuedAt`. If the
+ * two are tied to the millisecond (cosmically unlikely), prefer
+ * `purchase` — picking a stable left-hand side keeps the decision
+ * reproducible without an external nonce.
+ */
+export declare function decideTokenReplyRoute(input: {
+    purchaseRow: TokenIssueRowView | null;
+    liteRow: TokenIssueRowView | null;
+}): TokenReplyRoute;

package/dist/core/dm-token-router.js

@@ -0,0 +1,58 @@
+/**
+ * DM-token router — BROWSER_TASK_REDESIGN_PLAN.md §14.11 Q#6.
+ *
+ * Pure decision module shared between the messaging adapter's inbound
+ * `!~xxxxxxxx` classifier and any future programmatic caller that
+ * needs to know "given a token reply, which handler owns it?".
+ *
+ * Two stores share the `!~xxxxxxxx` envelope on the same primary
+ * channels:
+ *
+ *  - B-4 purchase tokens (`browser_automation_purchase_tokens`)
+ *  - lite-final-confirm tokens (`browser_task_final_confirm_tokens`)
+ *
+ * Both jtis are uuid v4 so a colliding-raw-string match is bounded by
+ * uuid uniqueness — but the surface still has to deterministically
+ * resolve the rare case where both stores return a row for the same
+ * raw inbound. This module's `decideTokenReplyRoute` is the single
+ * source of truth for that decision:
+ *
+ *   - exactly one row → route to that handler
+ *   - both rows present → older `issuedAt` wins (deterministic;
+ *     prevents the surface from oscillating between handlers on retries)
+ *   - neither → `none` (caller fans strict-cancel-on-non-token-reply
+ *     to both handlers if wired)
+ *
+ * Pure — no DB, no clock. 100% covered per §13 testing table extension.
+ */
+/**
+ * Decide which handler should consume an inbound `!~xxxxxxxx` reply.
+ *
+ * The caller passes the result of `purchaseHandler.lookupByRaw(token)`
+ * and `finalConfirmHandler.lookupByRaw(token)` (either may be null when
+ * the corresponding handler isn't wired OR when the store has no
+ * matching row). The router does NOT call into either store — it is
+ * pure decision logic over the two views.
+ *
+ * Tie-break: when both rows exist, prefer the older `issuedAt`. If the
+ * two are tied to the millisecond (cosmically unlikely), prefer
+ * `purchase` — picking a stable left-hand side keeps the decision
+ * reproducible without an external nonce.
+ */
+export function decideTokenReplyRoute(input) {
+    const { purchaseRow, liteRow } = input;
+    if (!purchaseRow && !liteRow)
+        return { kind: "none" };
+    if (purchaseRow && !liteRow)
+        return { kind: "purchase" };
+    if (liteRow && !purchaseRow)
+        return { kind: "lite_final_confirm" };
+    // Both present — deterministic tie-break by oldest issuance, with
+    // `purchase` winning a hard tie (both rows would represent a
+    // sub-millisecond collision on a 40-bit shared token space — already
+    // implausible; the rule preserves replayability for the case it
+    // happens anyway).
+    return purchaseRow.issuedAt <= liteRow.issuedAt
+        ? { kind: "purchase" }
+        : { kind: "lite_final_confirm" };
+}

package/dist/core/docs/citation-validator.d.ts

@@ -70,4 +70,3 @@ export declare function logInvalidCitations(db: Database.Database, result: Pick<
     sessionId?: number | null;
     turnNumber?: number | null;
 }): void;
-//# sourceMappingURL=citation-validator.d.ts.map

package/dist/core/docs/citation-validator.js

@@ -192,4 +192,3 @@ export function logInvalidCitations(db, result, context = {}) {
         logger.debug({ err }, "Failed to log qa_invalid_citation audit row");
     }
 }
-//# sourceMappingURL=citation-validator.js.map

package/dist/core/docs/extract-terms.d.ts

@@ -75,4 +75,3 @@ export declare function iterateHeadings(body: string): HeadingRef[];
  * heading text itself is searchable as a `term`).
  */
 export declare function extractTerms(fm: DocsFrontmatter, body: string): ExtractedTerm[];
-//# sourceMappingURL=extract-terms.d.ts.map

package/dist/core/docs/extract-terms.js

@@ -144,4 +144,3 @@ function collectSectionLead(lines, start, end) {
         return joined;
     return joined.slice(0, LEADING_PARAGRAPH_MAX_LEN);
 }
-//# sourceMappingURL=extract-terms.js.map

package/dist/core/docs/indexer.d.ts

@@ -101,4 +101,3 @@ export declare const _internal: {
     joinTokens: typeof joinTokens;
 };
 export {};
-//# sourceMappingURL=indexer.d.ts.map

package/dist/core/docs/indexer.js

@@ -337,4 +337,3 @@ async function listMarkdownFiles(root) {
 // Small re-export so tests that need to compose a path-style slug do not
 // need to re-implement the OS-separator rewrite.
 export const _internal = { sep, joinTokens };
-//# sourceMappingURL=indexer.js.map

package/dist/core/drift-effects.d.ts

@@ -27,4 +27,3 @@ export declare const __driftEffectsTestExports: {
     TODAY_REFRESH_AUTO_AT_KEY: string;
     TODAY_REFRESH_PENDING_KEY: string;
 };
-//# sourceMappingURL=drift-effects.d.ts.map