@askexenow/exe-os 0.9.362 → 0.9.365

package/dist/lib/exe-daemon.js

@@ -8,7 +8,7 @@ import {
 } from "../chunk-NOKJCF27.js";
 import {
   pushNotifyAsync
-} from "../chunk-Q2VQNAPU.js";
+} from "../chunk-EVPBYX2Z.js";
 import {
   isDbVerifyStampFresh
 } from "../chunk-SVFNWBLF.js";
@@ -23,15 +23,15 @@ import {
 import {
   shouldScheduleDaemonRestartHandoff
 } from "../chunk-PWRC5XZO.js";
-import {
-  readCloudSyncState,
-  writeCloudSyncState
-} from "../chunk-FUQ2OSDV.js";
 import {
   getMcpToolFamily,
   inferMcpRuntime,
   recordMcpHttpEvent
-} from "../chunk-RFKRCVGW.js";
+} from "../chunk-YYA5LXCT.js";
+import {
+  readCloudSyncState,
+  writeCloudSyncState
+} from "../chunk-L2VZBPJJ.js";
 import {
   deserializeArgs,
   serializeResultSet
@@ -43,52 +43,61 @@ import {
   findScopedDuplicate,
   governMemoryRecord,
   schedulePostWriteMemoryHygiene
-} from "../chunk-FIPUVCKC.js";
+} from "../chunk-7DMCAGSC.js";
 import "../chunk-5MOYSU5A.js";
 import "../chunk-4QCFFW2H.js";
 import "../chunk-76CJBM36.js";
 import {
   BUSY_PATTERN
-} from "../chunk-SQM4ZTL2.js";
-import "../chunk-5C6ZIJ7J.js";
-import "../chunk-SXKIGBNF.js";
-import "../chunk-BT2PUK3S.js";
+} from "../chunk-ORNCMRIX.js";
+import "../chunk-ESTR7QUP.js";
+import "../chunk-FXPAUDCZ.js";
+import "../chunk-QFIVK3G5.js";
+import "../chunk-WT4RI36X.js";
+import "../chunk-C3UAQ3JG.js";
 import {
   recordTimerPauseMs,
   runWithTimerPauseAccounting,
   sweepPauseTotalMs
 } from "../chunk-KI5PFRG6.js";
-import "../chunk-WT4RI36X.js";
-import "../chunk-Z67DIJKT.js";
+import "../chunk-EIKATSE4.js";
 import "../chunk-E23LNUWJ.js";
 import "../chunk-QAEWWYHL.js";
-import "../chunk-EIKATSE4.js";
-import "../chunk-D5CY4E7I.js";
+import "../chunk-EHHMNKOA.js";
+import "../chunk-GBNB4EWD.js";
 import "../chunk-UXLO7VHX.js";
 import "../chunk-DSOQUQTV.js";
-import "../chunk-GBNB4EWD.js";
-import "../chunk-PV5BIXT6.js";
+import "../chunk-WR75WUEP.js";
 import "../chunk-AJIXH5JF.js";
-import "../chunk-KDMVVHZH.js";
+import "../chunk-XTWHNLGD.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-CY5NVDTH.js";
+import "../chunk-2FYIMTQE.js";
 import "../chunk-CVYC6DUW.js";
-import "../chunk-4P2BFNSB.js";
-import "../chunk-MZYNW5OY.js";
-import "../chunk-OPU3NYOO.js";
+import "../chunk-ZVTKWWLV.js";
+import "../chunk-CDUB5Q6J.js";
 import {
   attributeSignalSource,
   consumeRestartIntentDetail,
   isRestartCooldownActive,
   logRestartEvent,
   noteRestartAttempt
-} from "../chunk-6EM6USV7.js";
+} from "../chunk-BNHAZ65R.js";
 import {
+  AGENT_IDENTITY_TOKEN_HEADER,
   assessInitialBindIdentity,
   ensureDaemonToken,
+  getDaemonAgentIdentityBroker,
+  readAgentIdentityTokenHeader,
   reconcileSessionAgentIdentity,
+  shouldEnforceAgentIdentity,
   shouldEnforceSessionIdentity
-} from "../chunk-HISFWAAK.js";
+} from "../chunk-RIECV7SR.js";
+import {
+  killAttributionLogPath,
+  killIfSameProcess,
+  processStartedAt,
+  recordKillIntent
+} from "../chunk-LNOS24GV.js";
 import {
   DAEMON_RSS_RESTART_DEBOUNCE,
   DAEMON_RSS_STARTUP_GRACE_MS,
@@ -105,10 +114,11 @@ import {
   resolveEmbedWorkerRssKillMb,
   shouldRestartForRss
 } from "../chunk-NLEW62VC.js";
+import "../chunk-W2IRQJ6R.js";
 import "../chunk-HYZV25LY.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
-import "../chunk-HLU52KTO.js";
+import "../chunk-BRLS5OLZ.js";
 import "../chunk-TKDITWDN.js";
 import {
   logBoot,
@@ -118,11 +128,11 @@ import {
   logShutdown
 } from "../chunk-BBMTVAE3.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-Q7J2SQJ6.js";
+import "../chunk-NO3M2AFM.js";
 import {
   isPostgresBackendEnabled
 } from "../chunk-YYB5PMTK.js";
-import "../chunk-BRZR76TS.js";
+import "../chunk-NJFJWQNN.js";
 import {
   getEventLoopLagMs,
   isEventLoopDegraded,
@@ -139,8 +149,9 @@ import {
   EMBEDDING_DIM
 } from "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-HSKABJE6.js";
-import "../chunk-3ICF4IAZ.js";
+import "../chunk-ZDUO6QBH.js";
+import "../chunk-A7XLR3K7.js";
+import "../chunk-VS4LPG66.js";
 import "../chunk-QILQ5FCG.js";
 import "../chunk-ARX6TAGN.js";
 import {
@@ -148,13 +159,13 @@ import {
   MODELS_DIR,
   loadConfigSync,
   resolveEmbedModelFile
-} from "../chunk-BRIZ6OZ3.js";
+} from "../chunk-QMSEL5YS.js";
 import "../chunk-HSGBZSCA.js";
 import "../chunk-JKKZGDLP.js";
 import "../chunk-MLKGABMK.js";
 
 // src/lib/exe-daemon.ts
-import os3 from "os";
+import os4 from "os";
 import net from "net";
 import v8 from "v8";
 import { createServer as createHttpServer, request as httpRequest } from "http";
@@ -691,6 +702,39 @@ function launchCloudSyncDaemonAttempt(options) {
   return true;
 }
 
+// src/lib/daemon-socket-response.ts
+var DAEMON_SOCKET_RESPONSE_BUFFER_CAP_ENV = "EXE_DAEMON_SOCKET_RESPONSE_BUFFER_CAP_BYTES";
+var DEFAULT_DAEMON_SOCKET_RESPONSE_BUFFER_CAP_BYTES = 96 * 1024 * 1024;
+var DAEMON_SOCKET_RESPONSE_BUFFER_CAP_ERROR = "EXE_DAEMON_SOCKET_RESPONSE_BUFFER_CAP_EXCEEDED";
+function daemonSocketResponseBufferCapBytes(env = process.env) {
+  const raw = env[DAEMON_SOCKET_RESPONSE_BUFFER_CAP_ENV];
+  const parsed = raw === void 0 || raw.trim() === "" ? NaN : Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : DEFAULT_DAEMON_SOCKET_RESPONSE_BUFFER_CAP_BYTES;
+}
+function writeDaemonSocketResponse(socket, data) {
+  if (socket.destroyed) return false;
+  try {
+    const wrote = socket.write(JSON.stringify(data) + "\n");
+    const capBytes = daemonSocketResponseBufferCapBytes();
+    const bufferedBytes = socket.writableLength;
+    if (Number.isFinite(bufferedBytes) && bufferedBytes > capBytes) {
+      const error = new Error(
+        `${DAEMON_SOCKET_RESPONSE_BUFFER_CAP_ERROR}: daemon client socket buffered ${bufferedBytes} bytes, exceeding cap ${capBytes} bytes while sending response id=${data.id}`
+      );
+      error.name = DAEMON_SOCKET_RESPONSE_BUFFER_CAP_ERROR;
+      process.stderr.write(
+        `[exed] ERROR ${DAEMON_SOCKET_RESPONSE_BUFFER_CAP_ERROR}: slow/stuck client socket buffered ${bufferedBytes} bytes > cap ${capBytes} bytes after response id=${data.id}; destroying that client. Normal socket.write backpressure below this cap remains buffered.
+`
+      );
+      socket.destroy(error);
+      return false;
+    }
+    return wrote;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/mcp-init-grace.ts
 var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function awaitPendingMcpInit(ownerKey, requestSessionId, deps, transientMatch) {
@@ -745,6 +789,40 @@ async function awaitPendingMcpInit(ownerKey, requestSessionId, deps, transientMa
   return null;
 }
 
+// src/lib/daemon-port-claim.ts
+var LIVE_DAEMON_HEALTH_STATUSES = ["ok", "degraded", "blocked"];
+function isLiveDaemonHealthResponse(statusCode, body) {
+  if (statusCode !== 200) return false;
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return false;
+  }
+  const status = parsed.status;
+  if (typeof status !== "string") return false;
+  return LIVE_DAEMON_HEALTH_STATUSES.includes(status);
+}
+var PORT_RELEASE_POLL_MS = 250;
+var PORT_RELEASE_TIMEOUT_MS = 3e4;
+async function waitForPortRelease(hasListener, opts) {
+  const now = opts.now ?? Date.now;
+  const pollMs = opts.pollMs ?? PORT_RELEASE_POLL_MS;
+  const timeoutMs = opts.timeoutMs ?? PORT_RELEASE_TIMEOUT_MS;
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    let held;
+    try {
+      held = await hasListener();
+    } catch {
+      return "released";
+    }
+    if (!held) return "released";
+    if (now() >= deadline) return "timeout";
+    await opts.sleep(pollMs);
+  }
+}
+
 // src/lib/daemon-coverage-gap.ts
 import { closeSync, existsSync as existsSync3, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, readSync, statSync as statSync3, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
@@ -1186,6 +1264,19 @@ function computeBootRetryAfterSeconds(nowMs, readyEtaMs, opts = {}) {
   return Math.min(maxS, Math.max(minS, Math.ceil((readyEtaMs - nowMs) / 1e3)));
 }
 
+// src/lib/daemon-sweep-gate.ts
+import os3 from "os";
+function readHostLoadSignal(env = process.env) {
+  return {
+    load1m: os3.loadavg()[0] ?? 0,
+    cpuCount: os3.cpus().length || 1,
+    starvationRatio: parseFloat(env.EXE_STARVATION_LOAD_RATIO ?? "1.5")
+  };
+}
+function decideSweepSkip(signal) {
+  return decideOrchestrationTickSkip(signal);
+}
+
 // src/lib/bootstrap-response.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -1316,7 +1407,7 @@ function stabilizeDaemonCwd() {
   } catch (err) {
     const moduleDir = path4.dirname(fileURLToPath(import.meta.url));
     const packageRoot = path4.resolve(moduleDir, "../..");
-    const fallback = existsSync7(path4.join(packageRoot, "package.json")) ? packageRoot : os3.homedir();
+    const fallback = existsSync7(path4.join(packageRoot, "package.json")) ? packageRoot : os4.homedir();
     try {
       process.chdir(fallback);
       process.stderr.write(
@@ -1469,6 +1560,37 @@ async function getSharedOrchestrationCaches() {
   }
   return refreshSharedOrchestrationCaches();
 }
+var MAINTENANCE_SWEEP_BUDGET_MS = Number(process.env.EXE_MAINTENANCE_SWEEP_BUDGET_MS) || 2e3;
+var _sweepSkipLogTs = /* @__PURE__ */ new Map();
+var SWEEP_SKIP_LOG_THROTTLE_MS = 5 * 60 * 1e3;
+function sweepStarved(name) {
+  const signal = readHostLoadSignal();
+  if (!decideSweepSkip(signal).skip) return false;
+  const now = Date.now();
+  if (now - (_sweepSkipLogTs.get(name) ?? 0) > SWEEP_SKIP_LOG_THROTTLE_MS) {
+    _sweepSkipLogTs.set(name, now);
+    process.stderr.write(
+      `[exed] Sweep ${name} SKIPPED: load=${signal.load1m.toFixed(2)} cpus=${signal.cpuCount} \u2014 CPU starved, deferring to avoid feeding the event-loop-block spiral.
+`
+    );
+    logDaemonHealth({
+      event: "process_stats",
+      pid: process.pid,
+      message: `${name} skipped \u2014 CPU starved (load=${signal.load1m.toFixed(2)} / cpus=${signal.cpuCount})`,
+      data: {
+        type: "sweep_skipped_starvation",
+        timer: name,
+        load1m: signal.load1m,
+        cpuCount: signal.cpuCount,
+        loadPerCore: signal.load1m / signal.cpuCount
+      }
+    });
+  }
+  return true;
+}
+function maintenanceSweepOptions(label) {
+  return { label, budgetMs: MAINTENANCE_SWEEP_BUDGET_MS };
+}
 var _orchestrationSteps = {
   reviewPolling: null,
   taskEnforcement: null,
@@ -1482,16 +1604,16 @@ var TICK_SKIP_LOG_THROTTLE_MS = 5 * 60 * 1e3;
 async function runOrchestrationTick() {
   if (_orchestrationBusy) return;
   const tickSkip = decideOrchestrationTickSkip({
-    load1m: os3.loadavg()[0] ?? 0,
-    cpuCount: os3.cpus().length || 1,
+    load1m: os4.loadavg()[0] ?? 0,
+    cpuCount: os4.cpus().length || 1,
     starvationRatio: parseFloat(process.env.EXE_STARVATION_LOAD_RATIO ?? "1.5")
   });
   if (tickSkip.skip) {
     const now = Date.now();
     if (now - _lastTickSkipLogTs > TICK_SKIP_LOG_THROTTLE_MS) {
       _lastTickSkipLogTs = now;
-      const load1m = os3.loadavg()[0] ?? 0;
-      const cpuCount = os3.cpus().length || 1;
+      const load1m = os4.loadavg()[0] ?? 0;
+      const cpuCount = os4.cpus().length || 1;
       process.stderr.write(
         `[exed] Orchestration tick SKIPPED: load=${load1m.toFixed(2)} cpus=${cpuCount} \u2014 CPU starved, deferring per-session pass to avoid feeding the event-loop-block spiral.
 `
@@ -1783,7 +1905,7 @@ function scheduleRestartHandoff(exitCode, reason) {
     const daemonPath = fileURLToPath(import.meta.url);
     const logPath = path4.join(EXE_AI_DIR, "logs", "exed.log");
     const lockPath = path4.join(EXE_AI_DIR, "exed-spawn.lock");
-    const heapCapMb = computeDaemonHeapCapMb(os3.totalmem() / (1024 * 1024 * 1024));
+    const heapCapMb = computeDaemonHeapCapMb(os4.totalmem() / (1024 * 1024 * 1024));
     const config = {
       oldPid: process.pid,
       daemonPath,
@@ -1980,6 +2102,13 @@ async function traceDaemonTimer(name, fn) {
           type: "timer_duration",
           timer: name,
           durationMs,
+          // Bug 28e1e0a1: budgeted sweeps deliberately PAUSE with the event loop
+          // free. durationMs is wall time and includes those pauses; busyMs is
+          // the time the loop was actually held. The slow-timer leaderboard
+          // prefers busyMs so a well-behaved paused sweep is not mis-ranked as
+          // a blocker.
+          busyMs,
+          sweepPausedMs,
           wallMs: Math.round(span.wallMs),
           sleptMs: Math.round(span.sleptMs),
           clockJump: slept,
@@ -2004,9 +2133,9 @@ function enqueue(queue, entry) {
   }
   queue.push(entry);
 }
-var OOM_MARKER_PATH = path4.join(os3.homedir(), ".exe-os", "embedding-oom-marker");
-var EMBED_TIMEOUT_MARKER_PATH = path4.join(os3.homedir(), ".exe-os", "embedding-timeout-marker");
-var EMBEDDINGS_OPT_IN_PATH = path4.join(os3.homedir(), ".exe-os", "embeddings-enabled");
+var OOM_MARKER_PATH = path4.join(os4.homedir(), ".exe-os", "embedding-oom-marker");
+var EMBED_TIMEOUT_MARKER_PATH = path4.join(os4.homedir(), ".exe-os", "embedding-timeout-marker");
+var EMBEDDINGS_OPT_IN_PATH = path4.join(os4.homedir(), ".exe-os", "embeddings-enabled");
 var MIN_FREE_MEM_BYTES = 2 * 1024 ** 3;
 var EMBED_WORKER_HEAP_MB = resolveEmbedWorkerHeapMb(process.env.EXE_EMBED_WORKER_HEAP_MB);
 var EMBED_WORKER_RSS_KILL_MB = resolveEmbedWorkerRssKillMb(
@@ -2024,10 +2153,10 @@ function resolveEmbeddingsOptIn() {
 var MAX_SMALL_TOTAL_BYTES = 16 * 1024 ** 3;
 var OOM_MARKER_TTL_MS = 1 * 60 * 60 * 1e3;
 var EMBED_RESPAWN_RESET_UPTIME_MS = 60 * 60 * 1e3;
-var CRASH_LOOP_COUNTER_PATH = path4.join(os3.homedir(), ".exe-os", "daemon-crash-counter.json");
+var CRASH_LOOP_COUNTER_PATH = path4.join(os4.homedir(), ".exe-os", "daemon-crash-counter.json");
 var CRASH_LOOP_THRESHOLD = 3;
 var CRASH_LOOP_WINDOW_MS = 10 * 60 * 1e3;
-var CRASH_LOOP_BREAKER_PATH = path4.join(os3.homedir(), ".exe-os", "crash-loop-breaker");
+var CRASH_LOOP_BREAKER_PATH = path4.join(os4.homedir(), ".exe-os", "crash-loop-breaker");
 var CRASH_LOOP_BREAKER_TTL_MS = 30 * 60 * 1e3;
 function recordDaemonCrash() {
   const now = Date.now();
@@ -2133,7 +2262,7 @@ function touchEventLoopHeartbeat() {
 function checkLaunchdPlistHealth() {
   try {
     if (process.platform !== "darwin") return;
-    const plistPath = path4.join(os3.homedir(), "Library", "LaunchAgents", "com.askexe.exed.plist");
+    const plistPath = path4.join(os4.homedir(), "Library", "LaunchAgents", "com.askexe.exed.plist");
     if (!existsSync7(plistPath)) return;
     const plist = readFileSync6(plistPath, "utf8");
     const expectedHeap = computeDaemonHeapCapMb();
@@ -2241,14 +2370,14 @@ async function loadModel() {
     _embeddingsDisabledByDesign = true;
     return;
   }
-  const totalMem = os3.totalmem();
+  const totalMem = os4.totalmem();
   if (totalMem <= MAX_SMALL_TOTAL_BYTES) {
     process.stderr.write(`[exed] Skipping embeddings \u2014 total RAM ${(totalMem / 1024 ** 3).toFixed(1)} GB <= 16 GB (FTS+Graph only).
 `);
     _embeddingsDisabledByDesign = true;
     return;
   }
-  if (os3.freemem() < MIN_FREE_MEM_BYTES) {
+  if (os4.freemem() < MIN_FREE_MEM_BYTES) {
     process.stderr.write(`[exed] Skipping embeddings \u2014 free RAM < 2 GB.
 `);
     _embeddingsDisabledByDesign = true;
@@ -2259,8 +2388,8 @@ async function loadModel() {
   if (isCpuStarved()) {
     if (_embedLoadDeferrals < embedLoadMaxDefers) {
       _embedLoadDeferrals++;
-      const load1m = (os3.loadavg()[0] ?? 0).toFixed(2);
-      const cpuCount = os3.cpus().length || 1;
+      const load1m = (os4.loadavg()[0] ?? 0).toFixed(2);
+      const cpuCount = os4.cpus().length || 1;
       process.stderr.write(
         `[exed] Deferring embed model load \u2014 host CPU-starved (load=${load1m} / ${cpuCount} cpus). Loading the Metal model now would feed the starvation spiral. Retry ${_embedLoadDeferrals}/${embedLoadMaxDefers} in ${embedLoadDeferMs / 1e3}s.
 `
@@ -2399,7 +2528,7 @@ async function loadModel() {
         void (async () => {
           try {
             if (_storeInitialized) {
-              const { writeNotification } = await import("../notifications-56TP36IK.js");
+              const { writeNotification } = await import("../notifications-UXJUAP3C.js");
               await writeNotification({
                 agentId: "exe",
                 agentRole: "system",
@@ -2518,7 +2647,7 @@ function disableEmbeddingsForInferenceTimeouts() {
   void (async () => {
     try {
       if (_storeInitialized) {
-        const { writeNotification } = await import("../notifications-56TP36IK.js");
+        const { writeNotification } = await import("../notifications-UXJUAP3C.js");
         await writeNotification({
           agentId: "exe",
           agentRole: "system",
@@ -2658,14 +2787,7 @@ async function processQueue() {
   }
 }
 function sendResponse(socket, data) {
-  if (socket.destroyed) return;
-  try {
-    const ok = socket.write(JSON.stringify(data) + "\n");
-    if (!ok) {
-      socket.destroy(new Error("Write backpressure \u2014 client too slow"));
-    }
-  } catch {
-  }
+  writeDaemonSocketResponse(socket, data);
 }
 function resetIdleTimer() {
   if (_idleTimer) {
@@ -2692,7 +2814,7 @@ async function shutdown(exitCode = 0, reason = null, restartKind) {
   _shuttingDown = true;
   _drainingWrites = true;
   try {
-    const { stopOrgPartnerRuntime } = await import("../org-partner-runtime-RNNUL5IN.js");
+    const { stopOrgPartnerRuntime } = await import("../org-partner-runtime-WLZAZJIY.js");
     stopOrgPartnerRuntime();
   } catch {
   }
@@ -2775,7 +2897,7 @@ async function shutdown(exitCode = 0, reason = null, restartKind) {
         dbBytes = dbPath ? statSync4(dbPath).size : 0;
       } catch {
       }
-      const { getAvailableMemoryBytesSync } = await import("../memory-pressure-watchdog-COJC3OYS.js");
+      const { getAvailableMemoryBytesSync } = await import("../memory-pressure-watchdog-ZI3TH2OF.js");
       const freeBytes = getAvailableMemoryBytesSync();
       if (shouldSkipBackupUnderMemoryPressure(freeBytes, dbBytes)) {
         memoryGateSkip = true;
@@ -2828,12 +2950,12 @@ async function shutdown(exitCode = 0, reason = null, restartKind) {
 `);
   }
   try {
-    const { stopProjectionWorker } = await import("../projection-worker-MBWUPB5O.js");
+    const { stopProjectionWorker } = await import("../projection-worker-GMRC6SBH.js");
     stopProjectionWorker();
   } catch {
   }
   try {
-    const { disposeShards } = await import("../shard-manager-YEOHEOHL.js");
+    const { disposeShards } = await import("../shard-manager-UROHZE46.js");
     disposeShards();
   } catch {
   }
@@ -2891,7 +3013,7 @@ async function handleHealthCheck(socket, requestId) {
   let pipelineStatus = "unknown";
   if (dbConnected) {
     try {
-      await import("../pipeline-router-IUENNTAY.js");
+      await import("../pipeline-router-UEVXDUHR.js");
       pipelineStatus = "ok";
     } catch {
       pipelineStatus = "unavailable";
@@ -3334,7 +3456,7 @@ async function _writeMemoryRecordInner(entry, syncOnly = false) {
   const vRow = await client.execute({ sql: "SELECT version FROM memories WHERE id = ?", args: [id] });
   const version = Number(vRow.rows[0]?.version) || 0;
   try {
-    const { insertOntologyForMemory } = await import("../agentic-ontology-RCVCJ6WB.js");
+    const { insertOntologyForMemory } = await import("../agentic-ontology-CARDCG37.js");
     await insertOntologyForMemory({
       id,
       agent_id: record.agent_id,
@@ -3364,7 +3486,7 @@ function startMemoryQueueDrain() {
     fired("memory_queue_drain");
     if (!await ensureStoreForPolling()) return;
     try {
-      const { ackQueue, claimQueue, retryQueueEntries, processQueueEntries } = await import("../memory-queue-4VN3DTOE.js");
+      const { ackQueue, claimQueue, retryQueueEntries, processQueueEntries } = await import("../memory-queue-QJNWKWKG.js");
       const lease = claimQueue();
       if (!lease || lease.entries.length === 0) return;
       acted("memory_queue_drain");
@@ -3451,7 +3573,7 @@ function startMessageQueueDrain() {
     fired("message_queue_drain");
     if (!await ensureStoreForPolling()) return;
     try {
-      const { claimMessageQueue, ackMessageQueue } = await import("../message-queue-client-5XW7ZOK2.js");
+      const { claimMessageQueue, ackMessageQueue } = await import("../message-queue-client-PL2POQOV.js");
       const lease = claimMessageQueue();
       if (!lease || lease.entries.length === 0) return;
       acted("message_queue_drain");
@@ -3726,12 +3848,7 @@ async function resolveAndClaimPort() {
             body += chunk;
           });
           res.on("end", () => {
-            try {
-              const parsed = JSON.parse(body);
-              resolve(res.statusCode === 200 && parsed.status === "ok");
-            } catch {
-              resolve(false);
-            }
+            resolve(isLiveDaemonHealthResponse(res.statusCode, body));
           });
         }
       );
@@ -3744,9 +3861,9 @@ async function resolveAndClaimPort() {
     });
   };
   try {
-    const isHealthy = await probeHealth() || await probeHealth();
-    if (isHealthy) {
-      process.stderr.write(`[exed] Port ${targetPort} has a healthy daemon \u2014 exiting (not a duplicate)
+    const isLive = await probeHealth() || await probeHealth();
+    if (isLive) {
+      process.stderr.write(`[exed] Port ${targetPort} has a live daemon \u2014 exiting (not a duplicate)
 `);
       recordExitBreadcrumb("clean", 0, "port-owned-by-healthy-daemon", { restartKind: "clean_stop" });
       process.exit(0);
@@ -3757,7 +3874,8 @@ async function resolveAndClaimPort() {
     const { execFileSync } = await import("child_process");
     const selfPid = process.pid;
     const parentPid = process.ppid;
-    const pids = execFileSync("lsof", ["-ti", `:${targetPort}`, "-sTCP:LISTEN"], { encoding: "utf8" }).trim();
+    const listeners = () => execFileSync("lsof", ["-ti", `:${targetPort}`, "-sTCP:LISTEN"], { encoding: "utf8" }).trim();
+    const pids = listeners();
     if (pids) {
       for (const pid of pids.split("\n").filter(Boolean)) {
         const numericPid = parseInt(pid, 10);
@@ -3776,12 +3894,28 @@ async function resolveAndClaimPort() {
           } else if (action === "kill-stale-daemon") {
             process.stderr.write(`[exed] Port ${targetPort} held by stale daemon PID ${pid} \u2014 SIGTERM
 `);
+            recordKillIntent({
+              targetPid: numericPid,
+              signal: "SIGTERM",
+              sender: "port-claim",
+              reason: `stale daemon holding MCP port ${targetPort}: ${command.slice(0, 120)}`
+            });
             process.kill(numericPid, "SIGTERM");
           }
         } catch {
         }
       }
-      await new Promise((r) => setTimeout(r, 500));
+      const outcome = await waitForPortRelease(() => listeners().length > 0, {
+        sleep: (ms) => new Promise((r) => {
+          setTimeout(r, ms);
+        })
+      });
+      if (outcome === "timeout") {
+        process.stderr.write(
+          `[exed] Port ${targetPort} still has a LISTEN holder after ${PORT_RELEASE_TIMEOUT_MS / 1e3}s \u2014 proceeding to bind anyway
+`
+        );
+      }
     }
   } catch {
   }
@@ -4070,8 +4204,8 @@ async function startMcpHttpServer() {
       }
       let loggedClientsWaitingBackoff = false;
       for (let attempt = 0; ; attempt++) {
-        const load1m = os3.loadavg()[0] ?? 0;
-        const cpuCount = os3.cpus().length || 1;
+        const load1m = os4.loadavg()[0] ?? 0;
+        const cpuCount = os4.cpus().length || 1;
         const decision = decideBootBackoff({
           load1m,
           cpuCount,
@@ -4146,7 +4280,7 @@ async function startMcpHttpServer() {
     clearBootstrapFailureMarker();
     setBootPhase("db_ready");
     _storeInitialized = true;
-    const { initLicenseGate, getCachedLicenseGate } = await import("../license-gate-6R3F3NQR.js");
+    const { initLicenseGate, getCachedLicenseGate } = await import("../license-gate-HMSMUIAU.js");
     const gateResult = await initLicenseGate();
     if (!gateResult.hasKey) {
       process.stderr.write(
@@ -4161,13 +4295,13 @@ async function startMcpHttpServer() {
     let _cachedWrapTelemetry = null;
     async function getWrapTelemetry() {
       if (!_cachedWrapTelemetry) {
-        const { wrapServerWithTelemetry } = await import("../tool-telemetry-PALAZUXT.js");
+        const { wrapServerWithTelemetry } = await import("../tool-telemetry-VKMRS6MP.js");
         _cachedWrapTelemetry = wrapServerWithTelemetry;
       }
       return _cachedWrapTelemetry;
     }
     Promise.all([
-      import("../tool-capability-index-WZWVBI2R.js"),
+      import("../tool-capability-index-BT2GGLLI.js"),
       import("../tool-gates-3IC7DK4R.js")
     ]).then(async ([{ getToolCapabilityIndex }, { TOOL_CATEGORIES }]) => {
       const gateState = getCachedLicenseGate();
@@ -4233,7 +4367,7 @@ async function startMcpHttpServer() {
       const expectedBuf = Buffer.from(_daemonToken);
       if (tokenBuf.length === expectedBuf.length && timingSafeEqual(tokenBuf, expectedBuf)) return true;
       try {
-        const { verifyAccessToken } = await import("../oauth-server-KW5M437C.js");
+        const { verifyAccessToken } = await import("../oauth-server-NP7KGF7N.js");
         const result = verifyAccessToken(token);
         return result.valid;
       } catch {
@@ -4436,7 +4570,7 @@ async function startMcpHttpServer() {
       }
       res.setHeader("Access-Control-Allow-Origin", "http://127.0.0.1");
       res.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Agent-Id, X-Agent-Role, X-Exe-Session, X-Exe-Session-Name, X-Project-Name, Mcp-Session-Id");
+      res.setHeader("Access-Control-Allow-Headers", `Content-Type, Authorization, X-Agent-Id, X-Agent-Role, X-Exe-Session, X-Exe-Session-Name, ${AGENT_IDENTITY_TOKEN_HEADER}, X-Project-Name, Mcp-Session-Id`);
       res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, X-Exe-Correlation-Id");
       const url = new URL(req.url || "/", `http://${MCP_HTTP_HOST}:${MCP_HTTP_PORT}`);
       if (req.method === "GET" && url.pathname === "/health") {
@@ -4486,7 +4620,7 @@ async function startMcpHttpServer() {
         return;
       }
       try {
-        const { handleOAuthRoute } = await import("../oauth-server-KW5M437C.js");
+        const { handleOAuthRoute } = await import("../oauth-server-NP7KGF7N.js");
         const handled = await handleOAuthRoute(req, res, url, MCP_HTTP_PORT);
         if (handled) return;
       } catch (err) {
@@ -4518,7 +4652,7 @@ async function startMcpHttpServer() {
         for await (const chunk of req) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
         const rawBody = Buffer.concat(chunks);
         try {
-          const { loadWebhookConfig, verifyHmac, processWebhook } = await import("../webhook-pipe-QJRFZVKA.js");
+          const { loadWebhookConfig, verifyHmac, processWebhook } = await import("../webhook-pipe-UQSEHFPO.js");
           const webhookConfig = await loadWebhookConfig();
           const serviceConfig = webhookConfig[serviceName];
           if (!serviceConfig) {
@@ -4614,7 +4748,7 @@ async function startMcpHttpServer() {
             contextPct: body.context_pct
           });
           if (body.context_pct !== void 0 && body.context_pct > 70) {
-            void import("../orchestration-events-CKQ756NA.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
+            void import("../orchestration-events-GMRGGBMN.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
               recordOE({
                 eventType: "context.pressure",
                 source: "exe-daemon.heartbeat",
@@ -4683,6 +4817,33 @@ async function startMcpHttpServer() {
       let agentRole = req.headers["x-agent-role"] || "employee";
       const shellMatch2 = agentRole.match(shellDefault);
       if (shellMatch2) agentRole = shellMatch2[1];
+      {
+        const enforceIdentity = shouldEnforceAgentIdentity();
+        const { token: identityToken, duplicate: dupIdentityHeader } = readAgentIdentityTokenHeader(req.headers[AGENT_IDENTITY_TOKEN_HEADER.toLowerCase()]);
+        const identityCheck = dupIdentityHeader ? { ok: false, reason: "duplicate-header" } : getDaemonAgentIdentityBroker().verify({
+          token: identityToken,
+          // Only cross-check the header claim when it is a concrete name; a
+          // missing/"default" header makes no claim and defers to the token.
+          claimedAgentId: agentId && agentId !== "default" ? agentId : void 0
+        });
+        if (identityCheck.ok) {
+          agentId = identityCheck.identity.agentId;
+          agentRole = identityCheck.identity.role;
+        } else if (enforceIdentity) {
+          process.stderr.write(
+            `[exed] SECURITY: rejecting MCP request \u2014 invalid agent identity credential (reason=${identityCheck.reason}, claimed_agent=${agentId})
+`
+          );
+          sendJsonRpcError2(
+            res,
+            403,
+            `Agent identity credential verification failed: ${identityCheck.reason}. Under EXE_ENFORCE_AGENT_IDENTITY every MCP caller must present the bound credential the daemon minted at spawn (re-spawn the session via the daemon after a daemon restart).`,
+            "unknown",
+            { agentId, agentRole, identityReason: identityCheck.reason }
+          );
+          return;
+        }
+      }
       try {
         const { loadEmployeesSync } = await import("./employees.js");
         const roster = loadEmployeesSync();
@@ -4699,7 +4860,7 @@ async function startMcpHttpServer() {
       let sessionHint = req.headers["x-exe-session-name"] || req.headers["x-exe-session"] || "";
       if (sessionHint) {
         try {
-          const { sanitizeSessionHintHeader, rejectForgedSessionHint } = await import("../mcp-session-identity-GOBGICLI.js");
+          const { sanitizeSessionHintHeader, rejectForgedSessionHint } = await import("../mcp-session-identity-QLUVYWPR.js");
           const rawHint = sessionHint;
           sessionHint = sanitizeSessionHintHeader(sessionHint);
           if (!sessionHint) {
@@ -4738,7 +4899,7 @@ async function startMcpHttpServer() {
         try {
           const liveSessions = await getTmuxSessionsAsync();
           const paneCommands = await getPaneCommandsAsync();
-          const { resolveMcpSessionHint } = await import("../mcp-session-identity-GOBGICLI.js");
+          const { resolveMcpSessionHint } = await import("../mcp-session-identity-QLUVYWPR.js");
           let registrySessions = [];
           try {
             const { listSessions: listRegistrySessions } = await import("./session-registry.js");
@@ -4875,7 +5036,7 @@ async function startMcpHttpServer() {
               bindLive = await getTmuxSessionsAsync();
             } catch {
             }
-            const { isLauncherCorroboratedIdentity } = await import("../mcp-session-identity-GOBGICLI.js");
+            const { isLauncherCorroboratedIdentity } = await import("../mcp-session-identity-QLUVYWPR.js");
             const corroborated = isLauncherCorroboratedIdentity({
               agentId,
               registrySessions: bindRegistry,
@@ -5118,7 +5279,7 @@ async function startMcpHttpServer() {
         }
       }
       try {
-        const { reconcileHintWithRegistryIdentity } = await import("../mcp-session-identity-GOBGICLI.js");
+        const { reconcileHintWithRegistryIdentity } = await import("../mcp-session-identity-QLUVYWPR.js");
         const { listSessions: listRegistrySessions } = await import("./session-registry.js");
         const recon = reconcileHintWithRegistryIdentity({
           agentId,
@@ -5331,9 +5492,9 @@ async function ensureStoreForPolling() {
       await initDatabase({ dbPath: config.dbPath, encryptionKey: masterKey.toString("hex") });
       await ensureSchema();
       try {
-        const { isLedgerEnabled } = await import("../notification-ledger-J6Q2GAYU.js");
+        const { isLedgerEnabled } = await import("../notification-ledger-4REL6M3T.js");
         if (isLedgerEnabled()) {
-          const { bumpBootGeneration } = await import("../boot-generation-XABYKF5P.js");
+          const { bumpBootGeneration } = await import("../boot-generation-X45BSVZY.js");
           const { setDaemonReadyGeneration } = await import("../daemon-ready-signal-CKXPUMJ2.js");
           const generation = await bumpBootGeneration();
           setDaemonReadyGeneration(generation);
@@ -5373,13 +5534,13 @@ async function ensureStoreForPolling() {
   }
 }
 async function startReviewPolling() {
-  const polling = await import("../review-polling-CYBCBHZA.js");
+  const polling = await import("../review-polling-MU47NQ2N.js");
   const state = {
     lastIntercomSent: /* @__PURE__ */ new Map(),
     lastNudgeSent: /* @__PURE__ */ new Map(),
     intervalMs: REVIEW_POLL_INTERVAL_MS
   };
-  const { pollReviewNudge, createReviewNudgeRealDeps, loadNudgeState } = await import("../daemon-orchestration-7425ZVNH.js");
+  const { pollReviewNudge, createReviewNudgeRealDeps, loadNudgeState } = await import("../daemon-orchestration-Q3GJA2JJ.js");
   const nudgeState = loadNudgeState();
   const tick = async () => traceDaemonTimer("review_polling", async () => {
     fired("review_polling");
@@ -5387,7 +5548,7 @@ async function startReviewPolling() {
     try {
       const { getClient } = await import("./database.js");
       const deps = polling.createRealDeps(getClient);
-      const { strictSessionScopeFilter } = await import("../task-scope-ERHPHLUM.js");
+      const { strictSessionScopeFilter } = await import("../task-scope-GDLFE26E.js");
       const { getCoordinatorName, DEFAULT_COORDINATOR_TEMPLATE_NAME } = await import("./employees.js");
       deps.findOrphanedDoneTasks = async (sessionScope) => {
         const coordinatorName = getCoordinatorName();
@@ -5407,7 +5568,7 @@ async function startReviewPolling() {
       deps.findTieredReviewCandidates = async (sessionScope) => {
         let project = null;
         try {
-          const { getProjectName } = await import("../project-name-EWG5KAZP.js");
+          const { getProjectName } = await import("../project-name-ILJTETUE.js");
           project = getProjectName() || null;
         } catch {
           project = null;
@@ -5466,7 +5627,7 @@ function startSessionTTL() {
       if (!await ensureStoreForPolling()) return;
       if (inPostRestartDestructiveGrace("session_ttl")) return;
       const { getClient } = await import("./database.js");
-      const { checkSessionTTL, createSessionTTLRealDeps } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { checkSessionTTL, createSessionTTLRealDeps } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const deps = createSessionTTLRealDeps(getClient);
       const killed = await checkSessionTTL(deps, _wedgeObservations);
       if (killed.length > 0) acted("session_ttl");
@@ -5491,7 +5652,7 @@ function startIdleKill() {
     if (!await ensureStoreForPolling()) return;
     if (inPostRestartDestructiveGrace("idle_kill")) return;
     try {
-      const signalDir = path4.join(os3.homedir(), ".exe-os", "task-signals");
+      const signalDir = path4.join(os4.homedir(), ".exe-os", "task-signals");
       try {
         await access(signalDir);
       } catch {
@@ -5526,7 +5687,7 @@ function startIdleKill() {
       const cfg = await getCachedConfig();
       if (!cfg) return;
       const { getClient } = await import("./database.js");
-      const { pollIdleKill, createIdleKillRealDeps } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { pollIdleKill, createIdleKillRealDeps } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const { sessions: liveSessions, paneCache, aliveSessions } = await getSharedOrchestrationCaches();
       const realDeps = createIdleKillRealDeps(
         getClient,
@@ -5870,7 +6031,8 @@ function startSkillSweep() {
       const { loadConfig: lc } = await import("./config.js");
       const config = await lc();
       if (!config.skillLearning) return;
-      if (!process.env.ANTHROPIC_API_KEY) return;
+      const { resolveAnthropicAuth } = await import("../anthropic-auth-S7HEBGUG.js");
+      if (!resolveAnthropicAuth()) return;
       if (!await ensureStoreForPolling()) return;
       const { sweepTrajectories } = await import("./skill-learning.js");
       const result = await sweepTrajectories(config.skillThreshold, config.skillModel);
@@ -5899,7 +6061,7 @@ function startSkillRefinement() {
     if (!shouldRunHeavyJob("skill_refinement")) return;
     try {
       if (!await ensureStoreForPolling()) return;
-      const { runSkillRefinement } = await import("../skill-refinement-VDR5OT4V.js");
+      const { runSkillRefinement } = await import("../skill-refinement-NLYDSFEH.js");
       const result = await runSkillRefinement();
       if (result.reviewed > 0) {
         acted("skill_refinement");
@@ -5924,20 +6086,22 @@ var _staleBranchAlertedToday = /* @__PURE__ */ new Set();
 function startStaleBranchSweep() {
   const tick = async () => {
     fired("stale_branch_sweep");
+    if (sweepStarved("stale_branch_sweep")) return;
     try {
-      const { discoverRepoPaths } = await import("../worktree-sweep-5LCVT46V.js");
-      const { scanUnmergedBranchesCached } = await import("../branch-hygiene-Z4IBWAOX.js");
+      const { discoverRepoPathsAsync } = await import("../worktree-sweep-4EDLLQ2E.js");
+      const { scanUnmergedBranchesCached } = await import("../branch-hygiene-HFJ3HA62.js");
+      const { runBudgetedSweep } = await import("../sweep-budget-KMPJ7O5Z.js");
       const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
       for (const k of _staleBranchAlertedToday) {
         if (!k.endsWith(today)) _staleBranchAlertedToday.delete(k);
       }
       let repos = [];
       try {
-        repos = discoverRepoPaths();
+        repos = await discoverRepoPathsAsync();
       } catch {
         repos = [];
       }
-      for (const repo of repos) {
+      await runBudgetedSweep(repos, async (repo) => {
         await yieldToEventLoop();
         let scan;
         try {
@@ -5947,17 +6111,17 @@ function startStaleBranchSweep() {
             { forceRefresh: true }
           );
         } catch {
-          continue;
+          return;
         }
-        if (scan.staleCount <= 0) continue;
+        if (scan.staleCount <= 0) return;
         const repoName = repo.split("/").pop() || repo;
         const guardKey = `${repoName}:${today}`;
-        if (_staleBranchAlertedToday.has(guardKey)) continue;
+        if (_staleBranchAlertedToday.has(guardKey)) return;
         _staleBranchAlertedToday.add(guardKey);
-        if (!_storeInitialized) continue;
+        if (!_storeInitialized) return;
         const stale = scan.branches.filter((b) => b.ageHours >= STALE_BRANCH_HOURS).slice(0, 5).map((b) => `${b.name} (+${b.ahead} commits, ${(b.ageHours / 24).toFixed(1)}d)`).join("; ");
         try {
-          const { writeNotification } = await import("../notifications-56TP36IK.js");
+          const { writeNotification } = await import("../notifications-UXJUAP3C.js");
           await writeNotification({
             agentId: "exe",
             agentRole: "system",
@@ -5973,7 +6137,7 @@ function startStaleBranchSweep() {
           );
         } catch {
         }
-      }
+      }, maintenanceSweepOptions("stale_branch_sweep"));
     } catch (err) {
       process.stderr.write(`[exed] Stale-branch sweep error: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -6012,7 +6176,7 @@ function startWorkStateHeartbeat() {
       const { getClient } = await import("./database.js");
       const { listSessions } = await import("./session-registry.js");
       const { isCoordinatorName } = await import("./employees.js");
-      const { runWorkStateTick } = await import("../work-state-heartbeat-O7UMB6SE.js");
+      const { runWorkStateTick } = await import("../work-state-heartbeat-4LDF6DSM.js");
       let liveTmux = null;
       const loadLiveTmux = async () => {
         if (!liveTmux) liveTmux = await listTmuxSessionNamesAsync();
@@ -6073,11 +6237,12 @@ function startGraphExtraction() {
       const { loadConfig: lc } = await import("./config.js");
       const config = await lc();
       if (config.graphRagEnabled === false) return;
-      if (!process.env.ANTHROPIC_API_KEY) return;
+      const { resolveAnthropicAuth } = await import("../anthropic-auth-S7HEBGUG.js");
+      if (!resolveAnthropicAuth()) return;
       if (!await ensureStoreForPolling()) return;
       const { getClient } = await import("./database.js");
       const client = getClient();
-      const { extractBatch } = await import("../graph-rag-EOGPZOYI.js");
+      const { extractBatch } = await import("../graph-rag-LSJLWGXV.js");
       const result = await extractBatch(client, 50, config.selfQueryModel);
       if (result.processed > 0) {
         acted("graph_extraction");
@@ -6351,6 +6516,7 @@ var AGENT_STATS_REFRESH_INTERVAL_MS = 60 * 60 * 1e3;
 var _agentRefreshInFlight = false;
 var _lastSpendCapLevel = null;
 async function refreshAgentData() {
+  if (sweepStarved("agent_data_refresh")) return;
   if (_agentRefreshInFlight) return;
   _agentRefreshInFlight = true;
   const started = Date.now();
@@ -6378,19 +6544,28 @@ async function refreshAgentData() {
       });
     }
     await yieldToEventLoop();
-    let spend24h = /* @__PURE__ */ new Map();
-    let spend7d = /* @__PURE__ */ new Map();
-    let spend30d = /* @__PURE__ */ new Map();
+    let spend24h = new Map(_cachedAgentData?.spend24h ?? []);
+    let spend7d = new Map(_cachedAgentData?.spend7d ?? []);
+    let spend30d = new Map(_cachedAgentData?.spend30d ?? []);
     try {
       const { getAgentSpend } = await import("./token-spend.js");
-      const r24 = await getAgentSpend("24h");
-      spend24h = new Map(r24.map((s) => [s.agentId, { inputTokens: s.inputTokens, outputTokens: s.outputTokens, costUSD: s.costUSD, sessions: s.sessions }]));
-      await yieldToEventLoop();
-      const r7 = await getAgentSpend("7d");
-      spend7d = new Map(r7.map((s) => [s.agentId, { inputTokens: s.inputTokens, outputTokens: s.outputTokens, costUSD: s.costUSD, sessions: s.sessions }]));
-      await yieldToEventLoop();
-      const r30 = await getAgentSpend("30d");
-      spend30d = new Map(r30.map((s) => [s.agentId, { inputTokens: s.inputTokens, outputTokens: s.outputTokens, costUSD: s.costUSD, sessions: s.sessions }]));
+      const { runBudgetedSweep } = await import("../sweep-budget-KMPJ7O5Z.js");
+      let r24 = [];
+      const windows = [
+        async () => {
+          r24 = await getAgentSpend("24h");
+          spend24h = new Map(r24.map((s) => [s.agentId, { inputTokens: s.inputTokens, outputTokens: s.outputTokens, costUSD: s.costUSD, sessions: s.sessions }]));
+        },
+        async () => {
+          const r7 = await getAgentSpend("7d");
+          spend7d = new Map(r7.map((s) => [s.agentId, { inputTokens: s.inputTokens, outputTokens: s.outputTokens, costUSD: s.costUSD, sessions: s.sessions }]));
+        },
+        async () => {
+          const r30 = await getAgentSpend("30d");
+          spend30d = new Map(r30.map((s) => [s.agentId, { inputTokens: s.inputTokens, outputTokens: s.outputTokens, costUSD: s.costUSD, sessions: s.sessions }]));
+        }
+      ];
+      await runBudgetedSweep(windows, (w) => w(), maintenanceSweepOptions("agent_data_refresh"));
       try {
         const { evaluateGlobalSpendCap, evaluateSpendCapAlert } = await import("./token-spend.js");
         const total24hCost = r24.reduce((sum, s) => sum + s.costUSD, 0);
@@ -6398,7 +6573,7 @@ async function refreshAgentData() {
         const decision = evaluateSpendCapAlert(_lastSpendCapLevel, capStatus);
         _lastSpendCapLevel = decision.level;
         if (decision.shouldAlert && decision.summary) {
-          const { writeNotification } = await import("../notifications-56TP36IK.js");
+          const { writeNotification } = await import("../notifications-UXJUAP3C.js");
           await writeNotification({
             agentId: "system",
             agentRole: "system",
@@ -6520,7 +6695,7 @@ function startReflectionSweep() {
       );
       let runReflection;
       try {
-        ({ runReflection } = await import("../memory-reflection-V2SNAUIB.js"));
+        ({ runReflection } = await import("../memory-reflection-ZKVRU3NT.js"));
       } catch (importErr) {
         _reflectionImportFailed = true;
         process.stderr.write(`[exed] Reflection module unavailable (stale chunk hash?) \u2014 disabled until daemon restart: ${importErr instanceof Error ? importErr.message : String(importErr)}
@@ -6561,7 +6736,7 @@ function startReflectionSweep() {
       if (memories > 100 && cards < memories * 0.1) {
         process.stderr.write(`[exed] Memory cards sparse (${cards} cards / ${memories} memories) \u2014 running backfill...
 `);
-        const { insertMemoryCardsForBatch } = await import("../memory-cards-4EXX3BQS.js");
+        const { insertMemoryCardsForBatch } = await import("../memory-cards-K2OSX4AW.js");
         const batchSize = 500;
         let offset = 0;
         let totalCards = 0;
@@ -6642,7 +6817,7 @@ function startDatabaseBackup() {
 `
         );
         try {
-          const { maybeVerifyDailyBackup } = await import("../backup-verify-TZPPUCLU.js");
+          const { maybeVerifyDailyBackup } = await import("../backup-verify-F7BHVEF7.js");
           const verdict = await maybeVerifyDailyBackup(backupPath);
           if (verdict && !verdict.ok) {
             process.stderr.write(
@@ -6718,7 +6893,7 @@ function startSessionEventsRetention() {
     fired("session_events_retention");
     if (!await ensureStoreForPolling()) return;
     try {
-      const { DEFAULT_SESSION_EVENTS_RETENTION_DAYS } = await import("../session-events-X33W4JNA.js");
+      const { DEFAULT_SESSION_EVENTS_RETENTION_DAYS } = await import("../session-events-YMQ3VGBJ.js");
       const days = SESSION_EVENTS_RETENTION_DAYS ?? DEFAULT_SESSION_EVENTS_RETENTION_DAYS;
       if (!isWriteWorkerEnabled() || !isDbWriteWorkerReady()) {
         process.stderr.write(
@@ -6764,7 +6939,7 @@ function startIntercomQueueDrain() {
   const tick = async () => traceDaemonTimer("intercom_queue_drain", async () => {
     fired("intercom_queue_drain");
     try {
-      const { drainQueueAsync, readQueue } = await import("../intercom-queue-R5LSXD3V.js");
+      const { drainQueueAsync, readQueue } = await import("../intercom-queue-6DZPHHQ2.js");
       const {
         sendIntercomAsync: centralSendIntercomAsync,
         countScopedPendingReviews,
@@ -6896,7 +7071,7 @@ function startLedgerDrain() {
   const tick = async () => traceDaemonTimer("ledger_drain", async () => {
     fired("ledger_drain");
     try {
-      const { isLedgerEnabled, drainLedger } = await import("../notification-ledger-J6Q2GAYU.js");
+      const { isLedgerEnabled, drainLedger } = await import("../notification-ledger-4REL6M3T.js");
       if (!isLedgerEnabled()) return;
       const result = await drainLedger({
         // Shadow "would-deliver": idle target = would-deliver, busy = retry.
@@ -6935,7 +7110,7 @@ function startOrphanReaper() {
   const tick = async () => traceDaemonTimer("orphan_reaper", async () => {
     fired("orphan_reaper");
     try {
-      const { reapOrphanedMcpProcesses, createOrphanReaperRealDepsAsync } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { reapOrphanedMcpProcesses, createOrphanReaperRealDepsAsync } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const deps = await createOrphanReaperRealDepsAsync();
       const reaped = await reapOrphanedMcpProcesses(deps);
       if (reaped.length > 0) acted("orphan_reaper");
@@ -6960,7 +7135,7 @@ function startZombieAgentReaper() {
   const tick = async () => traceDaemonTimer("zombie_agent_reaper", async () => {
     fired("zombie_agent_reaper");
     try {
-      const { reapZombieAgentProcesses, createZombieAgentReaperRealDepsAsync } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { reapZombieAgentProcesses, createZombieAgentReaperRealDepsAsync } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const deps = await createZombieAgentReaperRealDepsAsync();
       const reaped = reapZombieAgentProcesses(deps);
       if (reaped.length > 0) acted("zombie_agent_reaper");
@@ -6984,7 +7159,7 @@ async function startDaemonMemoryPressureWatchdog() {
   try {
     const cfg = await getCachedConfig();
     if (!cfg) return;
-    const { startMemoryPressureWatchdog: startWatchdog, MEMORY_PRESSURE_WATCHDOG_DEFAULTS } = await import("../memory-pressure-watchdog-COJC3OYS.js");
+    const { startMemoryPressureWatchdog: startWatchdog, MEMORY_PRESSURE_WATCHDOG_DEFAULTS } = await import("../memory-pressure-watchdog-ZI3TH2OF.js");
     const watchdogCfg = {
       ...MEMORY_PRESSURE_WATCHDOG_DEFAULTS,
       ...cfg.memoryPressureWatchdog ?? {}
@@ -7014,8 +7189,9 @@ async function startDaemonMemoryPressureWatchdog() {
 function startWorktreeReaper() {
   const tick = async () => traceDaemonTimer("worktree_reaper", async () => {
     fired("worktree_reaper");
+    if (sweepStarved("worktree_reaper")) return;
     try {
-      const { reapOrphanedWorktrees, createWorktreeReaperRealDeps } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { reapOrphanedWorktrees, createWorktreeReaperRealDeps } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const deps = await createWorktreeReaperRealDeps();
       const result = await reapOrphanedWorktrees(deps);
       if (result.pruned.length > 0) {
@@ -7041,7 +7217,8 @@ function startWorktreeReaper() {
       }
       {
         const files = (await readdir(signalDir)).filter((f) => f.endsWith(".json"));
-        for (const file of files) {
+        const { runBudgetedSweep } = await import("../sweep-budget-KMPJ7O5Z.js");
+        await runBudgetedSweep(files, async (file) => {
           try {
             const fullPath = path4.join(signalDir, file);
             const signal = JSON.parse(await readFile(fullPath, "utf8"));
@@ -7056,10 +7233,10 @@ function startWorktreeReaper() {
 `
                 );
               }
-              continue;
+              return;
             }
-            const { cleanupAgentWorktree } = await import("../worktree-sweep-5LCVT46V.js");
-            const { getMainRepoRootAsync } = await import("../worktree-ZWA35PKW.js");
+            const { cleanupAgentWorktree } = await import("../worktree-sweep-4EDLLQ2E.js");
+            const { getMainRepoRootAsync } = await import("../worktree-H3YFJ3NU.js");
             const repoRoot = await getMainRepoRootAsync(signal.worktreePath);
             if (repoRoot && signal.agentId) {
               const notes = await cleanupAgentWorktree(repoRoot, signal.agentId);
@@ -7073,7 +7250,7 @@ function startWorktreeReaper() {
             }
           } catch {
           }
-        }
+        }, maintenanceSweepOptions("worktree_reaper_signals"));
       }
     } catch {
     }
@@ -7085,6 +7262,10 @@ function startWorktreeReaper() {
 `);
 }
 var AUTO_WAKE_INTERVAL_MS = 60 * 1e3;
+var AUTO_WAKE_SIGNALS_PER_TICK = Math.max(
+  1,
+  Number(process.env.EXE_AUTO_WAKE_SIGNALS_PER_TICK) || 10
+);
 function startAutoWake() {
   const tick = async () => traceDaemonTimer("auto_wake", async () => {
     fired("auto_wake");
@@ -7092,7 +7273,7 @@ function startAutoWake() {
     if (!await ensureStoreForPolling()) return;
     try {
       const { getClient } = await import("./database.js");
-      const { pollOrphanedTasks, createAutoWakeRealDeps } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { pollOrphanedTasks, createAutoWakeRealDeps } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const deps = createAutoWakeRealDeps(getClient, process.cwd(), getTmuxSessionsAsync);
       const woken = await pollOrphanedTasks(deps);
       if (woken.length > 0) acted("auto_wake");
@@ -7100,8 +7281,9 @@ function startAutoWake() {
         process.stderr.write(`[exed] Auto-wake: spawned ${agent}
 `);
       }
+      if (sweepStarved("auto_wake_signals")) return;
       try {
-        const signalBase = path4.join(os3.homedir(), ".exe-os", "task-signals");
+        const signalBase = path4.join(os4.homedir(), ".exe-os", "task-signals");
         try {
           await access(signalBase);
         } catch {
@@ -7109,7 +7291,8 @@ function startAutoWake() {
         }
         {
           const { sendIntercomAsync, extractRootExe } = await import("./tmux-routing.js");
-          const sessionCache = path4.join(os3.homedir(), ".exe-os", "session-cache");
+          const { runBudgetedSweep } = await import("../sweep-budget-KMPJ7O5Z.js");
+          const sessionCache = path4.join(os4.homedir(), ".exe-os", "session-cache");
           const sessions = await getTmuxSessionsAsync();
           const signalDirs = [];
           for (const entry of await readdir(signalBase, { withFileTypes: true })) {
@@ -7137,6 +7320,7 @@ function startAutoWake() {
               return "claude";
             }
           };
+          const signalWork = [];
           for (const { dir, scope } of signalDirs) {
             let files = [];
             try {
@@ -7144,26 +7328,35 @@ function startAutoWake() {
             } catch {
               continue;
             }
-            for (const file of files) {
+            for (const file of files) signalWork.push({ dir, scope, file });
+          }
+          const signalDeadline = Date.now() + MAINTENANCE_SWEEP_BUDGET_MS;
+          let signalsHandled = 0;
+          await runBudgetedSweep(signalWork, async ({ dir, scope, file }) => {
+            if (signalsHandled >= AUTO_WAKE_SIGNALS_PER_TICK || Date.now() >= signalDeadline) {
+              return false;
+            }
+            signalsHandled++;
+            {
               const signalPath = path4.join(dir, file);
               let age;
               try {
                 age = Date.now() - (await stat(signalPath)).mtimeMs;
               } catch {
-                continue;
+                return;
               }
               if (age > 60 * 60 * 1e3) {
                 try {
                   await unlink(signalPath);
-                  void import("../orchestration-events-CKQ756NA.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
+                  void import("../orchestration-events-GMRGGBMN.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
                     recordOE({ eventType: "signal.stale", source: "exe-daemon.autoWake", severity: "warn", payload: { file, ageMinutes: Math.round(age / 6e4) } });
                   }).catch(() => {
                   });
                 } catch {
                 }
-                continue;
+                return;
               }
-              if (age > 5 * 60 * 1e3) continue;
+              if (age > 5 * 60 * 1e3) return;
               const agentId = file.includes(".") ? file.split(".")[0] : file.replace(".pending", "");
               const match = sessions.find((s) => {
                 const agentPart = s.split("-")[0] ?? s;
@@ -7172,9 +7365,9 @@ function startAutoWake() {
                 if (!scope) return true;
                 return s.endsWith(`-${scope}`);
               });
-              if (!match) continue;
+              if (!match) return;
               const state = classifyPaneState(await capturePaneAsync(match, 5));
-              if (state !== "idle") continue;
+              if (state !== "idle") return;
               const runtime = await runtimeFor(match);
               if (runtime === "codex" || runtime === "opencode" || runtime === "exe-agent") {
                 await killTmuxSessionAsync(match);
@@ -7197,7 +7390,7 @@ function startAutoWake() {
                 }
               }
             }
-          }
+          }, { ...maintenanceSweepOptions("auto_wake_signals"), rescheduleDelayMs: 0 });
         }
       } catch (err) {
         process.stderr.write(`[exed] Signal-wake error: ${err instanceof Error ? err.message : String(err)}
@@ -7292,6 +7485,7 @@ var STUCK_TASK_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function startStuckTaskRelease() {
   const tick = async () => traceDaemonTimer("stuck_task_release", async () => {
     fired("stuck_task_release");
+    if (sweepStarved("stuck_task_release")) return;
     if (!await ensureStoreForPolling()) return;
     if (inPostRestartDestructiveGrace("stuck_task_release")) return;
     try {
@@ -7303,28 +7497,47 @@ function startStuckTaskRelease() {
         createStaleClaimRealDeps,
         escalateStuckBlockedTasks,
         createStuckBlockedRealDeps
-      } = await import("../daemon-orchestration-7425ZVNH.js");
-      const deps = createStuckTaskRealDeps(getClient);
-      const released = await releaseStuckTasks(deps);
-      if (released.length > 0) {
-        acted("stuck_task_release");
-        process.stderr.write(`[exed] Stuck-release: ${released.length} task(s) moved to blocked
+      } = await import("../daemon-orchestration-Q3GJA2JJ.js");
+      const { runBudgetedSweep } = await import("../sweep-budget-KMPJ7O5Z.js");
+      const steps = [
+        async () => {
+          const deps = createStuckTaskRealDeps(getClient);
+          const released = await releaseStuckTasks(deps);
+          if (released.length > 0) {
+            acted("stuck_task_release");
+            process.stderr.write(`[exed] Stuck-release: ${released.length} task(s) moved to blocked
 `);
-      }
-      const claimsReleased = await releaseStaleClaims(createStaleClaimRealDeps(getClient));
-      if (claimsReleased.length > 0) {
-        acted("stuck_task_release");
-        process.stderr.write(`[exed] Stale-claim release: ${claimsReleased.length} dead-holder claim(s) cleared
+          }
+        },
+        // Bugs 784ebe98 + 31a59ab2: on the same scan, clear stale claim BINDINGS
+        // whose holder session is gone (e.g. a dead subagent that claimed the
+        // parent's task). releaseStuckTasks routes dead-session in_progress tasks to
+        // 'blocked' but never clears the claim columns, so the lock outlives the
+        // holder and strands the task; this releases only that lock (status
+        // untouched) so the legitimate owner can re-claim. Reuses this timer.
+        async () => {
+          const claimsReleased = await releaseStaleClaims(createStaleClaimRealDeps(getClient));
+          if (claimsReleased.length > 0) {
+            acted("stuck_task_release");
+            process.stderr.write(`[exed] Stale-claim release: ${claimsReleased.length} dead-holder claim(s) cleared
 `);
-      }
-      const blockedResult = await escalateStuckBlockedTasks(createStuckBlockedRealDeps(getClient));
-      if (blockedResult.escalated.length > 0 || blockedResult.cancelled.length > 0) {
-        acted("stuck_task_release");
-        process.stderr.write(
-          `[exed] Stuck-blocked: escalated ${blockedResult.escalated.length}, auto-cancelled ${blockedResult.cancelled.length}
+          }
+        },
+        // Feature 638f8611: on the same scan, escalate + auto-cancel tasks that
+        // have been 'blocked' too long (intercom at >48h, auto-cancel at >72h).
+        // Reuses this timer — no new always-on timer is added.
+        async () => {
+          const blockedResult = await escalateStuckBlockedTasks(createStuckBlockedRealDeps(getClient));
+          if (blockedResult.escalated.length > 0 || blockedResult.cancelled.length > 0) {
+            acted("stuck_task_release");
+            process.stderr.write(
+              `[exed] Stuck-blocked: escalated ${blockedResult.escalated.length}, auto-cancelled ${blockedResult.cancelled.length}
 `
-        );
-      }
+            );
+          }
+        }
+      ];
+      await runBudgetedSweep(steps, (step) => step(), maintenanceSweepOptions("stuck_task_release"));
     } catch (err) {
       process.stderr.write(`[exed] Stuck-release error: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -7370,8 +7583,8 @@ function startExternalRssWatchdog() {
   try {
     const workerSource = `
       import { workerData } from "node:worker_threads";
-      import { execFile } from "node:child_process";
-      import { mkdirSync, writeFileSync, statSync } from "node:fs";
+      import { execFile, execFileSync } from "node:child_process";
+      import { mkdirSync, writeFileSync, statSync, appendFileSync } from "node:fs";
       import { dirname } from "node:path";
       import { loadavg, cpus } from "node:os";
 
@@ -7380,6 +7593,7 @@ function startExternalRssWatchdog() {
       const checkMs = Number(workerData.checkMs);
       const markerPath = String(workerData.markerPath);
       const safeCwd = String(workerData.cwd || "/");
+      const killLedgerPath = String(workerData.killLedgerPath || "");
       // Bug 9fc1e69e: debounce + startup grace so a single transient RSS spike that
       // GC reclaims does NOT terminate the daemon. The external watchdog cannot run
       // GC on the daemon, so it requires MORE consecutive over-threshold samples than
@@ -7408,6 +7622,34 @@ function startExternalRssWatchdog() {
         });
       }
 
+      // This worker is built from a template literal and evaluated as a data: URL,
+      // so it cannot import daemon-kill-attribution.ts. It appends the SAME JSON
+      // line shape with the plain node:fs calls it already has; the ledger path is
+      // resolved on the main thread and passed in via workerData.
+      function recordKillIntent(targetPid, signal, reason) {
+        if (!killLedgerPath) return;
+        try { mkdirSync(dirname(killLedgerPath), { recursive: true }); } catch {}
+        try {
+          appendFileSync(killLedgerPath, JSON.stringify({
+            ts: new Date().toISOString(),
+            senderPid: pid,
+            senderArgv: String(process.argv.join(" ")).slice(0, 300),
+            sender: "external-watchdog",
+            targetPid: targetPid,
+            signal: signal,
+            reason: reason,
+          }) + "\\n");
+        } catch {}
+      }
+
+      // Raw \`ps -o lstart=\` string \u2014 compared verbatim, so the worker needs no
+      // date parsing. Second granularity is exactly what the guard tolerates.
+      function startedAtRaw(targetPid) {
+        try {
+          return String(execFileSync("ps", ["-o", "lstart=", "-p", String(targetPid)], { cwd: safeCwd, encoding: "utf8", timeout: 2000 })).trim() || null;
+        } catch { return null; }
+      }
+
       function terminateDaemon(reason) {
         if (terminating) return;
         terminating = true;
@@ -7415,8 +7657,22 @@ function startExternalRssWatchdog() {
         // A wedged loop cannot run its SIGTERM handler, so escalate to SIGKILL after
         // a short grace (the in-process self-heal already WAL-checkpoints when it can;
         // this external path is the last resort precisely because the loop is stuck).
+        const startedAt = startedAtRaw(pid);
+        recordKillIntent(pid, "SIGTERM", reason);
         try { process.kill(pid, "SIGTERM"); } catch {}
-        setTimeout(() => { try { process.kill(pid, "SIGKILL"); } catch {} }, 5000).unref();
+        setTimeout(() => {
+          // Identity re-check: 5s is ample time for this PID to be recycled onto the
+          // SUCCESSOR daemon that launchd just spawned. SIGKILLing that is how a
+          // healthy new daemon dies at ~5s of age with no explanation.
+          const now = startedAtRaw(pid);
+          if (startedAt && now !== startedAt) {
+            try { process.stderr.write("[exed-watchdog] REFUSING SIGKILL to PID " + pid + ": start time changed (" + startedAt + " -> " + (now || "UNREADABLE") + ") \u2014 PID was RECYCLED\\n"); } catch {}
+            recordKillIntent(pid, "SIGKILL:REFUSED", "pid-identity-mismatch expected=" + startedAt + " actual=" + (now || "null"));
+            return;
+          }
+          recordKillIntent(pid, "SIGKILL", "SIGTERM grace expired :: " + reason);
+          try { process.kill(pid, "SIGKILL"); } catch {}
+        }, 5000).unref();
       }
 
       // --- Event-loop stall watchdog (independent of RSS) ---
@@ -7469,7 +7725,9 @@ function startExternalRssWatchdog() {
         restartBytes: RSS_RESTART_BYTES,
         checkMs: RSS_CHECK_INTERVAL_MS,
         markerPath: OOM_MARKER_PATH,
-        cwd: os3.homedir(),
+        cwd: os4.homedir(),
+        // Resolved on the main thread — the worker cannot import config.ts.
+        killLedgerPath: killAttributionLogPath(),
         // External path can't GC the daemon → require one extra consecutive sample
         // beyond the in-process debounce before terminating.
         debounceN: DAEMON_RSS_RESTART_DEBOUNCE + 1,
@@ -7504,12 +7762,12 @@ function startTaskEnforcementScanner() {
   const tick = async () => traceDaemonTimer("task_enforcement", async () => {
     fired("task_enforcement");
     try {
-      const { runTaskEnforcementTick } = await import("../task-enforcement-GQDUTIFY.js");
+      const { runTaskEnforcementTick } = await import("../task-enforcement-LXW45H5Z.js");
       const { getTransport } = await import("./transport.js");
       const { loadAgentConfig } = await import("./agent-config.js");
       const { getClient } = await import("./database.js");
       const { loadEmployeesSync } = await import("./employees.js");
-      const { sessionScopeFilter } = await import("../task-scope-ERHPHLUM.js");
+      const { sessionScopeFilter } = await import("../task-scope-GDLFE26E.js");
       const transport = getTransport();
       const { sessions: allSessions, paneCache, aliveSessions } = await getSharedOrchestrationCaches();
       await yieldToEventLoop();
@@ -7520,10 +7778,10 @@ function startTaskEnforcementScanner() {
         sendKeysLiteral: transport.sendKeysLiteral?.bind(transport),
         isAlive: (session) => aliveSessions.has(session)
       };
-      const { checkAutoWakeGates } = await import("../daemon-orchestration-7425ZVNH.js");
+      const { checkAutoWakeGates } = await import("../daemon-orchestration-Q3GJA2JJ.js");
       const { ensureEmployeeAsync, employeeSessionName, sendIntercomAsync } = await import("./tmux-routing.js");
       const { shouldAutoInstance } = await import("./employees.js");
-      const { recordOrchestrationEventBestEffort } = await import("../orchestration-events-CKQ756NA.js");
+      const { recordOrchestrationEventBestEffort } = await import("../orchestration-events-GMRGGBMN.js");
       const projectDir = process.cwd();
       await runTaskEnforcementTick({
         transport: enforcementTransport,
@@ -7814,7 +8072,7 @@ function startBackgroundJobGuardrails() {
   const tick = async () => traceDaemonTimer("background_job_guardrails", async () => {
     fired("background_job_guardrails");
     try {
-      const { enforceBackgroundJobGuardrailsAsync } = await import("../background-jobs-Z6KHCWES.js");
+      const { enforceBackgroundJobGuardrailsAsync } = await import("../background-jobs-LTPWCMA3.js");
       const actions = await enforceBackgroundJobGuardrailsAsync();
       if (actions.length > 0) {
         acted("background_job_guardrails");
@@ -7849,7 +8107,7 @@ async function sweepExpiredTracesFromDaemonTimer() {
   const memoryIds = idsResult.rows.map((r) => String(r.id)).filter(Boolean);
   if (memoryIds.length === 0) return 0;
   const { getClient } = await import("./database.js");
-  const { cleanupGraphLinksForMemories, cleanupCardsForMemories } = await import("../graph-rag-EOGPZOYI.js");
+  const { cleanupGraphLinksForMemories, cleanupCardsForMemories } = await import("../graph-rag-LSJLWGXV.js");
   const client = getClient();
   await cleanupGraphLinksForMemories(client, memoryIds);
   await cleanupCardsForMemories(client, memoryIds);
@@ -8159,22 +8417,31 @@ function killOrphanDaemons() {
   try {
     const pids = execSyncNode("pgrep -f 'exe-daemon\\.js' 2>/dev/null || true", { encoding: "utf8", timeout: 3e3 }).trim().split("\n").filter(Boolean).map(Number).filter((n) => !isNaN(n) && isSameDaemonInstance(n));
     if (pids.length === 0) return;
+    const identities = /* @__PURE__ */ new Map();
     for (const pid of pids) {
       try {
+        identities.set(pid, processStartedAt(pid));
         process.stderr.write(`[exed] Killing orphan daemon from same instance (PID ${pid})
 `);
+        recordKillIntent({
+          targetPid: pid,
+          signal: "SIGTERM",
+          sender: "orphan-daemon-reaper",
+          reason: "orphan exe-daemon.js proven to belong to this install"
+        });
         process.kill(pid, "SIGTERM");
       } catch {
       }
     }
     setTimeout(() => {
       for (const pid of pids) {
-        try {
-          process.kill(pid, 0);
-          process.stderr.write(`[exed] Orphan PID ${pid} survived SIGTERM \u2014 escalating to SIGKILL
+        const outcome = killIfSameProcess(pid, identities.get(pid) ?? null, "SIGKILL", {
+          sender: "orphan-daemon-reaper",
+          reason: "orphan survived 2s SIGTERM grace"
+        });
+        if (outcome === "sent") {
+          process.stderr.write(`[exed] Orphan PID ${pid} survived SIGTERM \u2014 escalated to SIGKILL
 `);
-          process.kill(pid, "SIGKILL");
-        } catch {
         }
       }
     }, 2e3).unref();
@@ -8357,7 +8624,7 @@ try {
 process.env.EXE_IS_DAEMON = "1";
 if (process.platform === "darwin") {
   try {
-    const oldPlist = path4.join(os3.homedir(), "Library", "LaunchAgents", "com.askexe.exed-keepalive.plist");
+    const oldPlist = path4.join(os4.homedir(), "Library", "LaunchAgents", "com.askexe.exed-keepalive.plist");
     if (existsSync7(oldPlist)) {
       try {
         execSyncNode(`launchctl unload "${oldPlist}" 2>/dev/null`, { timeout: 5e3 });
@@ -8383,8 +8650,8 @@ void (async () => {
 })();
 function isCpuStarved() {
   const ratio = parseFloat(process.env.EXE_STARVATION_LOAD_RATIO ?? "1.5");
-  const load1m = os3.loadavg()[0] ?? 0;
-  const cpuCount = os3.cpus().length || 1;
+  const load1m = os4.loadavg()[0] ?? 0;
+  const cpuCount = os4.cpus().length || 1;
   return isHostCpuStarved(load1m, cpuCount, ratio);
 }
 async function runSmokeTests() {
@@ -8528,7 +8795,7 @@ function startEventLoopLagDetector() {
     touchEventLoopHeartbeat();
     const wallElapsedMs = monotonicElapsedMs(lastTick);
     const lag = wallElapsedMs - 2e3;
-    const sampledLoad1m = os3.loadavg()[0] ?? 0;
+    const sampledLoad1m = os4.loadavg()[0] ?? 0;
     const loadWindow = updateLoadWindow(loadSamples, Date.now(), sampledLoad1m, wallElapsedMs, LOAD_SAMPLE_KEEP_MS);
     loadSamples = loadWindow.samples;
     const cpuDelta = process.cpuUsage(lastCpu);
@@ -8551,7 +8818,7 @@ function startEventLoopLagDetector() {
       const msg = `[exed] EVENT LOOP BLOCKED ${(lag / 1e3).toFixed(1)}s \u2014 MCP UNRESPONSIVE. Sessions will die.`;
       process.stderr.write(msg + "\n");
       logDaemonHealth({ event: "event_loop_blocked", pid: process.pid, message: msg, data: { lagMs: lag } });
-      void import("../orchestration-events-CKQ756NA.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
+      void import("../orchestration-events-GMRGGBMN.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
         recordOE({ eventType: "daemon.event_loop_blocked", source: "exe-daemon.lagDetector", severity: "error", durationMs: lag });
       }).catch(() => {
       });
@@ -8564,8 +8831,8 @@ function startEventLoopLagDetector() {
       }
       clearDaemonReady();
       try {
-        const load1m2 = os3.loadavg()[0] ?? 0;
-        const cpuCount2 = os3.cpus().length || 1;
+        const load1m2 = os4.loadavg()[0] ?? 0;
+        const cpuCount2 = os4.cpus().length || 1;
         logDaemonHealth({
           event: "orchestration_health",
           pid: process.pid,
@@ -8576,7 +8843,7 @@ function startEventLoopLagDetector() {
       }
       const load1m = sampledLoad1m;
       const maxLoad1mOverWindow = loadWindow.maxLoad1mOverWindow;
-      const cpuCount = os3.cpus().length || 1;
+      const cpuCount = os4.cpus().length || 1;
       const starvationRatio = resolveSelfHealThresholds().starvationRatio;
       const catchUpActive = inBootCatchUpGrace();
       const decision = decideDaemonSelfHeal({
@@ -8702,7 +8969,7 @@ function startTaskFileResync() {
       const { getClient } = await import("./database.js");
       const { runBudgetedSweep } = await import("../sweep-budget-KMPJ7O5Z.js");
       const client = getClient();
-      const tasksRoot = path4.join(os3.homedir(), ".exe-os", "tasks");
+      const tasksRoot = path4.join(os4.homedir(), ".exe-os", "tasks");
       let synced = 0;
       const paths = [];
       let fileCount = 0;
@@ -8745,7 +9012,7 @@ function startTaskFileResync() {
               });
               if (Number(res.rowsAffected ?? 0) > 0) {
                 synced++;
-                void import("../orchestration-events-CKQ756NA.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
+                void import("../orchestration-events-GMRGGBMN.js").then(({ recordOrchestrationEventBestEffort: recordOE }) => {
                   recordOE({
                     eventType: "task_file.resynced",
                     source: "exe-daemon.taskFileResync",
@@ -8779,7 +9046,7 @@ function startTaskGroupBarriers() {
       fired("task_group_barriers");
       if (!await ensureStoreForPolling()) return;
       try {
-        const { pollTaskGroupBarriers } = await import("../daemon-orchestration-7425ZVNH.js");
+        const { pollTaskGroupBarriers } = await import("../daemon-orchestration-Q3GJA2JJ.js");
         const firedCount = await pollTaskGroupBarriers();
         if (firedCount > 0) {
           acted("task_group_barriers");
@@ -8801,7 +9068,7 @@ function startCheckpointGc() {
       fired("checkpoint_gc");
       if (!await ensureStoreForPolling()) return;
       try {
-        const { gcStaleCheckpoints } = await import("../daemon-orchestration-7425ZVNH.js");
+        const { gcStaleCheckpoints } = await import("../daemon-orchestration-Q3GJA2JJ.js");
         const cleared = await gcStaleCheckpoints();
         if (cleared > 0) {
           acted("checkpoint_gc");
@@ -8841,14 +9108,14 @@ function startDispatchAckCleanup() {
 function startProjectionWorkerDeferred() {
   setTimeout(async () => {
     try {
-      const { startProjectionWorker } = await import("../projection-worker-MBWUPB5O.js");
+      const { startProjectionWorker } = await import("../projection-worker-GMRC6SBH.js");
       startProjectionWorker();
     } catch {
     }
   }, 2e4);
 }
 async function startToolTelemetry() {
-  const { startToolTelemetryFlush } = await import("../tool-telemetry-PALAZUXT.js");
+  const { startToolTelemetryFlush } = await import("../tool-telemetry-VKMRS6MP.js");
   startToolTelemetryFlush();
   process.stderr.write("[exed] Tool telemetry started (flush every 5m)\n");
 }
@@ -8971,7 +9238,7 @@ function startLocalFirstTimers() {
     fired("intercom_dedup_cleanup");
     if (_intercomDedupCompleted) return;
     try {
-      const markerPath = path4.join(os3.homedir(), ".exe-os", ".intercom-dedup-done");
+      const markerPath = path4.join(os4.homedir(), ".exe-os", ".intercom-dedup-done");
       try {
         await access(markerPath);
         _intercomDedupCompleted = true;
@@ -9016,7 +9283,7 @@ function startLocalFirstTimers() {
     fired("orphan_task_cleanup");
     try {
       if (!await ensureStoreForPolling()) return;
-      const { cleanOrphanedTaskFiles } = await import("../tasks-crud-NVNF3NRA.js");
+      const { cleanOrphanedTaskFiles } = await import("../tasks-crud-W7VGWRUV.js");
       const count = await cleanOrphanedTaskFiles();
       if (count > 0) {
         acted("orphan_task_cleanup");
@@ -9032,7 +9299,7 @@ function startLocalFirstTimers() {
     fired("task_file_consistency");
     try {
       if (!await ensureStoreForPolling()) return;
-      const { checkTaskFileConsistency } = await import("../tasks-crud-NVNF3NRA.js");
+      const { checkTaskFileConsistency } = await import("../tasks-crud-W7VGWRUV.js");
       const mismatches = await checkTaskFileConsistency();
       if (mismatches > 0) {
         acted("task_file_consistency");
@@ -9051,7 +9318,7 @@ function startLocalFirstTimers() {
   const TELEMETRY_DAILY_MS = 24 * 60 * 60 * 1e3;
   const telemetryDaily = async () => {
     try {
-      const { sendTelemetry, isTelemetryEnabled } = await import("../telemetry-upload-NY3EKOGY.js");
+      const { sendTelemetry, isTelemetryEnabled } = await import("../telemetry-upload-FK5WKXVB.js");
       if (!isTelemetryEnabled()) return;
       const { upstream } = await sendTelemetry(24);
       if (upstream.startsWith("sent")) {
@@ -9232,7 +9499,7 @@ try {
   try {
     coverageGapNowMs = Date.now();
     coverageGapLastHeartbeatTs = readLastHeartbeatTsMs();
-    coverageGapHostBootTs = hostBootTimeMs(coverageGapNowMs, os3.uptime());
+    coverageGapHostBootTs = hostBootTimeMs(coverageGapNowMs, os4.uptime());
     const rawThreshold = Number(process.env.EXE_COVERAGE_GAP_THRESHOLD_MS);
     coverageGap = assessCoverageGap({
       lastHeartbeatTs: coverageGapLastHeartbeatTs,
@@ -9289,7 +9556,7 @@ try {
     });
   }
   try {
-    const { initOrgPartnerRuntime } = await import("../org-partner-runtime-RNNUL5IN.js");
+    const { initOrgPartnerRuntime } = await import("../org-partner-runtime-WLZAZJIY.js");
     await initOrgPartnerRuntime();
   } catch (err) {
     process.stderr.write(