@cohortapp/agent-sdk 2.18.16 → 2.18.17

package/lib/session/frontdoor.mjs

@@ -174,11 +174,29 @@ export function frontDoorServices(config) {
  * `sessionConsumed` (an older reader, a direct caller) never steals the item,
  * so behaviour without the field is exactly the pre-DM-latency gate.
  *
- * @param {{frontDoor?:string, sessionLive?:boolean, sessionConsumed?:boolean, service?:string, services?:string[]}} a
+ * PER-ITEM OVERRIDE — `itemHandled` (DM-LATENCY DOUBLE-ANSWER, 2026-09-27). The
+ * `sessionConsumed` clause is a SEAT-WIDE fact: a live door that has not stamped
+ * `last-consumed.json` looks not-consuming for EVERY item, so the daemon takes
+ * over the whole service. But a door that has already answered a SPECIFIC item
+ * left a marker on that item on disk — a terminal `.yaml.processed`, or a live
+ * `claimed_by: session` `.yaml.dispatched` — through `maestro inbox
+ * claim/reply/done`, which is OLD code every door already runs REGARDLESS of
+ * whether it restarted onto the stamp path. So when the caller has read that
+ * marker and passes `itemHandled:true`, the daemon must NOT re-take that item,
+ * even mid-takeover — this is what closes the double-answer without requiring a
+ * fleet restart. It short-circuits FIRST and unconditionally: an already-handled
+ * item is the door's whether the door is live, wedged or dead. Opt-in on an
+ * explicit `true`: an absent `itemHandled` is exactly the pre-fix gate.
+ *
+ * @param {{frontDoor?:string, sessionLive?:boolean, sessionConsumed?:boolean, itemHandled?:boolean, service?:string, services?:string[]}} a
  * @returns {{dispatch:boolean, reason:string}}
  */
 export function shouldDaemonDispatch(a) {
   const x = a && typeof a === "object" ? a : {};
+  // A specific item the door already holds on disk is never re-taken — not even
+  // when the seat-wide gate would open because a live door has not stamped
+  // last-consumed. See PER-ITEM OVERRIDE above.
+  if (x.itemHandled === true) return { dispatch: false, reason: "item-already-handled" };
   if (x.frontDoor !== "session") return { dispatch: true, reason: "front-door-daemon" };
   if (x.sessionLive !== true) return { dispatch: true, reason: "session-not-live" };
   const services = Array.isArray(x.services) && x.services.length ? x.services : DEFAULT_FRONT_DOOR_SERVICES;

package/lib/session/inbox-claims.mjs

@@ -210,6 +210,64 @@ export function findInboxFile(agentRoot, id, o = {}) {
   return looseIds.size === 1 ? loose : null;
 }
 
+/**
+ * Does the front door ALREADY hold this specific inbound item on disk? A
+ * terminal `.yaml.processed` / `.yaml.processed-bundled` marker (the door read
+ * it and ran `inbox done`), or a live `claimed_by: session` `.yaml.dispatched`
+ * claim, both mean the door has this item — so a daemon takeover must NOT answer
+ * it a second time in the seat's name (DM-LATENCY DOUBLE-ANSWER, 2026-09-27),
+ * even when `last-consumed.json` was never stamped because the door has not
+ * restarted onto the stamp path.
+ *
+ * Keyed on the inbound id / raw_ref across the WHOLE service dir, NOT on an
+ * exact filename — and that is the crux of the fix. `writeInboxItem`
+ * (scripts/poller/utils.mjs) dedups on the exact `<ts>-<id>` base, so a re-fetch
+ * that lands the SAME message under a different timestamp base slips its dedup
+ * and writes a fresh live `.yaml` beside the door's terminal file. The seat then
+ * carries two files for one message — one answered, one live — and the live one
+ * is what the daemon scans. An id-keyed sweep sees the answered sibling; the
+ * exact-path dedup structurally cannot.
+ *
+ * A daemon-owned `.dispatched` (no session marker) is NOT the door holding it —
+ * it is the daemon's own in-flight admission, and must never block the daemon's
+ * own reclaim — so only a `claimed_by` claim counts. Fail-open in the safe
+ * direction: an unreadable dir or claim body reads as NOT handled (the item is
+ * answered, never dropped), the same bias as the rest of the DM-latency
+ * contract; the assurance sweep releases a genuinely stale claim (>20 min) back
+ * to `.yaml`, so a dead door can never permanently hold an item this way.
+ *
+ * @param {string} agentRoot
+ * @param {string} service
+ * @param {{id?:string, raw_ref?:string}} item
+ * @returns {{handled:boolean, reason:string}}
+ */
+export function itemHandledByDoor(agentRoot, service, item) {
+  const needles = [item && item.id, item && item.raw_ref]
+    .filter(Boolean)
+    .map((n) => String(n).trim())
+    .filter((n) => n.length > 0);
+  if (!needles.length) return { handled: false, reason: "no-id" };
+  const dir = join(agentRoot, "state", "inbox", service);
+  let names;
+  try { names = readdirSync(dir); } catch { return { handled: false, reason: "no-dir" }; }
+  for (const file of names) {
+    if (!needles.some((n) => file.includes(n))) continue;
+    if (file.endsWith(".yaml.processed") || file.endsWith(".yaml.processed-bundled")) {
+      return { handled: true, reason: "processed" };
+    }
+    if (file.endsWith(".yaml.dispatched")) {
+      // Only a SESSION claim (`claimed_by`) is the door holding it; a
+      // daemon-owned `.dispatched` carries no marker and is the daemon's own.
+      try {
+        if (parseSessionMarkers(readFileSync(join(dir, file), "utf-8")).claimedBy) {
+          return { handled: true, reason: "claimed-by-session" };
+        }
+      } catch { /* unreadable claim body → not proven handled (fail-open to answering) */ }
+    }
+  }
+  return { handled: false, reason: "not-handled" };
+}
+
 /**
  * Claim an item for the session: `.yaml` → `.yaml.dispatched` (the shared
  * durable-admission marker) + `claimed_by: "session"`. Only a NEW item is
@@ -470,6 +528,7 @@ export default {
   parseSessionMarkers,
   stripSessionMarkers,
   stripMarkersInPlace,
+  itemHandledByDoor,
   findInboxFile,
   markSessionClaim,
   markSessionDeferral,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.18.16",
+  "version": "2.18.17",
   "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {

package/scripts/daemon/agent-daemon.mjs

@@ -163,9 +163,9 @@ import { processOne } from "../../lib/execution/pipeline.mjs";
 import { shouldReviveFrontDoor, reviveCommand, sessionJobLabelOnDisk, confirmRevived, isTerminalReviveFailure, detectUnrequestedRestart } from "../../lib/session/revive.mjs";
 import { budgetSpentNote } from "../../lib/telemetry/collect.mjs";
 import { checkLock as checkProcessLock } from "../../lib/singleton.js";
-import { makeFrontDoorGate, sessionLiveFromHeartbeat, readFrontDoorState, DEFAULT_STALE_MS } from "../../lib/session/frontdoor.mjs";
+import { makeFrontDoorGate, shouldDaemonDispatch, sessionLiveFromHeartbeat, readFrontDoorState, DEFAULT_STALE_MS } from "../../lib/session/frontdoor.mjs";
 import { CADENCE_REGISTRY } from "./cadence-handlers.mjs";
-import { sweepSessionInboxForDaemon } from "../../lib/session/inbox-claims.mjs";
+import { sweepSessionInboxForDaemon, itemHandledByDoor } from "../../lib/session/inbox-claims.mjs";
 import { defaultEffects, scheduleToQueue } from "../../lib/execution/effects.mjs";
 import { loadReactObligations } from "../../lib/execution/match.mjs";
 import { policyFor } from "../../lib/execution/surface-policy.mjs";
@@ -595,6 +595,25 @@ export async function pollService(svc, deps = {}) {
         return false;
       }
 
+      // DM-LATENCY DOUBLE-ANSWER GUARD (2026-09-27). Past the seat-wide front-door
+      // gate, this is the per-item check the gate cannot make: has the door
+      // ALREADY handled THIS item on disk? The gate opened for the service because
+      // a live door had not stamped last-consumed (reason `session-not-consuming`),
+      // but the door that read+closed a specific message left its marker
+      // (`.yaml.processed`, or a live `claimed_by: session` `.yaml.dispatched`) on
+      // that item regardless of whether it restarted onto the stamp path. Taking
+      // it here posts a SECOND reply in the seat owner's name and races the door's
+      // own queue writer — the exact regression (Hannah Brooks, James's 18:42Z DM).
+      // `shouldDaemonDispatch` makes the call so the one predicate owns the whole
+      // gate; `itemHandledByDoor` is the id-keyed disk read it needs. Fail-open:
+      // an unreadable marker reads as not-handled, so a real ask is never dropped.
+      const handled = itemHandledByDoor(AGENT_REPO_DIR, svc.name, item);
+      const perItem = shouldDaemonDispatch({ ...(fd.state || {}), service: svc.name, itemHandled: handled.handled });
+      if (!perItem.dispatch) {
+        console.log(`[daemon] leaving ${item.id || item.raw_ref} to the front door on ${svc.name} (${perItem.reason}${handled.reason ? `: ${handled.reason}` : ""})`);
+        return false;
+      }
+
       const lockKey = item.raw_ref || item.id || `${svc.name}-${Date.now()}`;
       if (seenRefs.has(lockKey)) return false;
       seenRefs.add(lockKey);

package/scripts/daemon/deliver.mjs

@@ -714,6 +714,72 @@ export function scaffoldMarkerLeak(text) {
   return m ? m[0] : null;
 }
 
+// ── A REPLY IN THE SEAT'S VOICE NEVER CARRIES A MACHINE-LOCAL PATH ────────────
+// (DM-LATENCY, 2026-09-27.) When the daemon takeover composed a reply in the
+// seat owner's name, it leaked an absolute local filesystem path — a string no
+// one off this Mac mini can open, and one CLAUDE.md forbids in any outbound.
+// The absolute forms below (`/Users/…`, `/Volumes/…`, `/private/…`,
+// `/var/folders/…`, `/tmp/…`, `/home/…`) are unambiguously machine-local: unlike
+// a bare `lib/foo.mjs` a person might legitimately name in an engineering
+// channel, none of these is ever a shareable reference, so refusing them is
+// high-precision. Permanent refusal (no retry), the same shape as the scaffold
+// gate: the caller escalates rather than re-send, and the double-answer this
+// backstops should not have been composed at all (FIX 1 stops it upstream).
+const LOCAL_PATH_RE = /(?:\/(?:Users|Volumes|private|home)\/|\/var\/folders\/|\/tmp\/)[^\s`)"'<>|]+/;
+
+/**
+ * The first machine-local absolute path in `text`, or null when it carries none.
+ * @param {string} text
+ * @returns {string|null}
+ */
+export function localPathLeak(text) {
+  const m = typeof text === "string" ? text.match(LOCAL_PATH_RE) : null;
+  return m ? m[0] : null;
+}
+
+// ── STRIP A LEADING SEAT-FLUSH / RECOVERY FILLER OPENER ───────────────────────
+// The takeover posts the owner would never write opened with a flush apology —
+// "finished this but didn't get a reply out", "catching up on my last" and the
+// like (the Layla/Eli/Candace symptom, 2026-09-27). It is the daemon narrating
+// its OWN plumbing to a human who asked about something else. Unlike a leaked
+// path this is safely removable: only a LEADING filler sentence is stripped, and
+// the substantive answer beneath it is left byte-for-byte. Conservative by
+// design — it matches the flush family and a couple of generic recovery openers,
+// never an arbitrary first sentence, so a real answer that merely starts with
+// "I finished the audit…" is untouched (no reply/flush verb follows).
+const REPLY_FILLER_OPENERS = [
+  // "(I've) finished/completed/did this, but the reply didn't get out / never came back / catching up …"
+  /^\s*(?:i(?:['’]ve|['’]m| have| am)?\s+)?(?:finished|completed|did|wrapped\s+up|ran)\s+this\b[^.!?\n]*?\b(?:repl(?:y|ies)|did(?:n['’]?t| not)|never|go(?:t)?\s+out|come\s+back|came\s+back|catch(?:ing)?\s+up|flush)[^.!?\n]*[.!?]+\s*/i,
+  // Generic flush / recovery openers.
+  /^\s*(?:heads[- ]up[—,\-: ]+)?(?:just\s+)?(?:flushing|catching\s+up|picking\s+this\s+back\s+up|circling\s+back|following\s+up\s+on\s+my\s+last|sorry[—,\-: ]+(?:for\s+)?the\s+(?:double|delay|resend))[^.!?\n]*[.!?]+\s*/i,
+];
+
+/**
+ * Remove a single leading seat-flush / recovery filler sentence, but ONLY when a
+ * real answer remains beneath it. Returns the input unchanged when there is no
+ * leading filler, when the input is not a string, OR when stripping the opener
+ * would leave nothing — because that last case cannot be told apart from a
+ * filler CLAUSE that runs into the answer on one line ("finished this but the
+ * reply didn't go out — the deploy is green"), and destroying a real answer is
+ * far worse than letting a bare filler line through. That bare-filler case is
+ * the double-post itself, which FIX 1 stops upstream; here the rule is simply
+ * "never eat content". Only the first matching opener is considered.
+ *
+ * @param {unknown} text
+ * @returns {string}
+ */
+export function stripReplyFiller(text) {
+  if (typeof text !== "string") return text;
+  for (const re of REPLY_FILLER_OPENERS) {
+    const m = text.match(re);
+    if (m) {
+      const rest = text.slice(m[0].length).trimStart();
+      return rest ? rest : text; // strip only when an answer survives; never eat content
+    }
+  }
+  return text;
+}
+
 /**
  * Deliver `text` to the human behind `item`. No generation, no model, no
  * budget — only transport.
@@ -805,6 +871,10 @@ export async function deliverReaction(item, emoji, o = {}) {
 
 export async function deliver(item, text, o = {}) {
   const kind = o.kind || "reply";
+  // FIX 2 (DM-LATENCY, 2026-09-27): strip a leading seat-flush / recovery filler
+  // opener the door would never write, BEFORE the empty check — a body that was
+  // nothing but filler then correctly falls through to "nothing to deliver".
+  text = stripReplyFiller(text);
   if (!item || !text || !String(text).trim()) {
     return { sent: false, via: null, error: "nothing to deliver" };
   }
@@ -859,6 +929,16 @@ export async function deliver(item, text, o = {}) {
     try { console.error(`[deliver] refused: raw scaffold marker ${JSON.stringify(leak)} in outbound body (permanent, not retrying)`); } catch { /* */ }
     return { sent: false, via: null, permanent: true, channel: item && item.channel_id, surface, code: "FORBIDDEN_SCOPE", error: `FORBIDDEN_SCOPE: raw scaffold marker ${leak} in outbound body — strip the marker; never send reasoning or transcript wrappers` };
   }
+  // FIX 2 (DM-LATENCY, 2026-09-27): a reply in the seat's voice must never carry a
+  // machine-local path — no one off this box can open it, and CLAUDE.md forbids
+  // it in any outbound. Permanent refusal, same shape as the scaffold gate: the
+  // caller escalates rather than leak the path in the seat owner's name.
+  const pathLeak = localPathLeak(text);
+  if (pathLeak) {
+    const surface = (item && item.channel_id) ? "room" : "unknown";
+    try { console.error(`[deliver] refused: machine-local path ${JSON.stringify(pathLeak)} in outbound body (permanent, not retrying)`); } catch { /* */ }
+    return { sent: false, via: null, permanent: true, channel: item && item.channel_id, surface, code: "FORBIDDEN_SCOPE", error: `FORBIDDEN_SCOPE: machine-local path ${pathLeak} in outbound body — no one off this machine can open it; a reply must not carry a local path` };
+  }
   // `permanent` says retrying changes nothing. A caller that cannot tell the
   // difference between "hq blipped" and "there is no transport for telegram"
   // retries both at the same cadence, which is how an impossible send becomes an

package/scripts/local-triggers/autoupdate.sh

@@ -65,9 +65,20 @@
 #       and the running daemon's own boot marker — "[DAEMON] boot pid=<pid>"
 #       (maestro-daemon.mjs, from the release that added this gate), else the last "[daemon] Running" /
 #       "org-mesh connected" line. A crash earlier the same day that launchd
-#       (or an operator) already recovered from is history, not health. A
-#       missing log file has no fatal lines (fail-open here — (a) and (c)
-#       carry the gate).
+#       (or an operator) already recovered from is history, not health.
+#       The log is NOT always under $AGENT_DIR: launchd-wrapper.sh redirects it
+#       to an external SSD ($SSD_VOLUME/maestro/<agent>/logs/daemon) when one is
+#       mounted+writable. This scan resolves that same path (daemon_log_base,
+#       mirroring the wrapper's own SSD derivation) so a redirected seat is gated
+#       on its REAL log — not a fixed $AGENT_DIR path that never exists there,
+#       which silently disabled this whole check (and, on gates before the
+#       missing-log fail-open, rolled EVERY upgrade back on SSD seats). When even
+#       the resolved log cannot be read, the gate does NOT blindly fail-open:
+#       it falls back to the path-independent cadence heartbeat
+#       state/cadence-bus/health.json (lib/cadence-bus.mjs writeHealth, every
+#       ~15s, under the symlinked state/ tree) — fresh (< HEALTH_FRESH_S, 120s)
+#       proves the daemon loop is cycling → pass; stale/absent → no log AND no
+#       heartbeat is genuine unhealth → fail (checks (a)+(c) still corroborate).
 #   (c) A SERVER-ACKNOWLEDGED BEAT — state/org/last-beat.json {at, ok, code?,
 #       sdkVersion?}, which lib/org/mesh.mjs overwrites on EVERY presence beat
 #       (ok:true only when the org answered 2xx; a rejected or unreachable beat
@@ -147,7 +158,10 @@
 # (default 600) and MAESTRO_AUTOUPDATE_HEALTH_WAIT (default 30), both seconds;
 # MAESTRO_AUTOUPDATE_STABLE_S (default 90; MAESTRO_AUTOUPDATE_STABLE_GAP_S is the
 # sleep between the two pid samples, default = STABLE_S, zeroed by the test) and
-# MAESTRO_AUTOUPDATE_BEAT_FRESH_S (default 300); MAESTRO_AUTOUPDATE_RETRY_SLEEP
+# MAESTRO_AUTOUPDATE_BEAT_FRESH_S (default 300); MAESTRO_AUTOUPDATE_HEALTH_FRESH_S
+# (default 120 — the cadence-heartbeat staleness bar for the log-absent fallback);
+# MAESTRO_SSD_VOLUME (the daemon-log SSD volume, mirroring launchd-wrapper.sh; the
+# test points it at a fixture dir); MAESTRO_AUTOUPDATE_RETRY_SLEEP
 # (default 20 s, ×attempt);
 # MAESTRO_AUTOUPDATE_LOCK_STALE_S (default 7200); MAESTRO_AUTOUPDATE_FAILED_HOLD_S
 # (default 86400); MAESTRO_AUTOUPDATE_PATH_PREFIX (a stub-binary dir that wins
@@ -264,6 +278,42 @@ DAEMON_PATTERN="$AGENT_DIR/scripts/daemon/maestro-daemon.mjs"
 # a pid-set change, i.e. "crash loop".
 DAEMON_ARGV_RE="^[^ ]*/node $(printf '%s' "$DAEMON_PATTERN" | sed 's/[][\.*^$]/\\&/g')\$"
 DLOG_DIR="$AGENT_DIR/logs/daemon"
+# The daemon log does NOT always live under $AGENT_DIR. launchd-wrapper.sh
+# redirects the daemon's stdout/stderr to an external SSD when one is mounted
+# and writable — $SSD_VOLUME/maestro/<agent>/logs/daemon/ — falling back to
+# $AGENT_DIR/logs/daemon only when that write is denied. is_healthy reads the
+# daemon log for its fatal scan (b); keyed to a fixed $AGENT_DIR path it reads a
+# file that never exists on a redirected seat, which SILENTLY DISABLES the fatal
+# scan there (and, on gates older than the missing-log fail-open, rolled EVERY
+# upgrade back — 2026-09 SSD seats). Resolve the SSD dir the SAME way the wrapper
+# does (its own MAESTRO_SSD_VOLUME / /Volumes/*-SSD derivation) — this is the
+# real path, not a widened guess — and, as a path-independent backstop robust to
+# ANY redirect, cross-check the cadence heartbeat state/cadence-bus/health.json
+# (written under the symlinked state/ tree every ~15s by lib/cadence-bus.mjs
+# writeHealth) whenever the resolved log still cannot be read.
+ssd_daemon_log_dir(){ # echo the SSD daemon-log dir the wrapper would have opened, or nothing when no SSD is mounted (mirrors launchd-wrapper.sh)
+  local vol name v
+  vol="${MAESTRO_SSD_VOLUME:-}"
+  if [ -z "$vol" ]; then
+    for v in /Volumes/*-SSD /Volumes/*SSD* /Volumes/maestro-data; do
+      if [ -d "$v" ] && [ "$v" != "/Volumes/Macintosh HD" ]; then vol="$v"; break; fi
+    done
+  fi
+  [ -n "$vol" ] && [ -d "$vol" ] || return 0
+  name="$(basename "$AGENT_DIR" | sed 's/-ai$//')"
+  echo "$vol/maestro/$name/logs/daemon"
+}
+DLOG_DIR_SSD="$(ssd_daemon_log_dir)"
+daemon_log_base(){ # $1 = YYYY-MM-DD → the dir holding that day's daemon log: the SSD copy when the wrapper wrote it there, else $AGENT_DIR. Resolves by where the file IS (the wrapper picks per-boot and can fall back), so a redirected AND a fallback seat both read the right file.
+  if [ -n "$DLOG_DIR_SSD" ] && [ -f "$DLOG_DIR_SSD/daemon-$1.log" ]; then echo "$DLOG_DIR_SSD"; else echo "$DLOG_DIR"; fi
+}
+# The cadence heartbeat: state/cadence-bus/health.json {version,ts,pid,...},
+# overwritten every ~15s by the consumer (lib/cadence-bus.mjs writeHealth). It
+# lives under the symlinked state/ tree, so it is readable at a fixed path no
+# matter where the daemon LOG went — the path-independent liveness signal the
+# gate falls back to when the resolved daemon log cannot be read.
+HEALTH_JSON="$AGENT_DIR/state/cadence-bus/health.json"
+HEALTH_FRESH_S="${MAESTRO_AUTOUPDATE_HEALTH_FRESH_S:-120}"   # 8× the 15s heartbeat cadence, well under the 300s org-offline bar
 HEALTH_WAIT="${MAESTRO_AUTOUPDATE_HEALTH_WAIT:-30}"
 STABLE_S="${MAESTRO_AUTOUPDATE_STABLE_S:-90}"
 STABLE_GAP_S="${MAESTRO_AUTOUPDATE_STABLE_GAP_S:-$STABLE_S}"   # the gap between the two pid samples; the test zeroes it (its stub changes per CALL)
@@ -311,8 +361,22 @@ pid_uptime_s(){ # $1 = pid → seconds since it started, "" when ps cannot say
 day_of_epoch(){ # $1 = epoch seconds → YYYY-MM-DD in local time (the wrapper's `date +%Y-%m-%d` basis)
   date -r "$1" +%Y-%m-%d 2>/dev/null || date -d "@$1" +%Y-%m-%d 2>/dev/null
 }
-daemon_log_for(){ # $1 = uptime seconds → the log file the wrapper opened for THIS incarnation (named for its start day)
-  echo "$DLOG_DIR/daemon-$(day_of_epoch $(( $(date +%s) - $1 ))).log"
+daemon_log_for(){ # $1 = uptime seconds → the log file the wrapper opened for THIS incarnation (named for its start day, in the dir it actually writes — SSD or $AGENT_DIR)
+  local day; day="$(day_of_epoch $(( $(date +%s) - $1 )))"
+  echo "$(daemon_log_base "$day")/daemon-$day.log"
+}
+cadence_heartbeat_stale(){ # prints WHY the cadence heartbeat is not a fresh proof of a live daemon loop, or nothing when it is (state/cadence-bus/health.json, path-independent)
+  node -e '
+    const [file, freshS] = process.argv.slice(1);
+    const out = (s) => process.stdout.write(s);
+    let j;
+    try { j = JSON.parse(require("fs").readFileSync(file, "utf8")); }
+    catch (e) { out(`daemon log unreadable at the resolved path and no cadence heartbeat (${e && e.code === "ENOENT" ? "state/cadence-bus/health.json absent" : "state/cadence-bus/health.json unreadable"})`); process.exit(0); }
+    const at = Date.parse(j && j.ts);
+    if (!Number.isFinite(at)) { out("daemon log unreadable at the resolved path and cadence health.json carries no parseable ts"); process.exit(0); }
+    const ageS = Math.round((Date.now() - at) / 1000);
+    if (ageS > Number(freshS)) out(`daemon log unreadable at the resolved path and the cadence heartbeat is ${ageS}s old (> ${freshS}s) — the daemon loop is not cycling`);
+  ' "$HEALTH_JSON" "$HEALTH_FRESH_S" 2>/dev/null
 }
 first_fatal_after(){ # $1 = log file, $2 = line offset (lines up to it predate this daemon) → the first fatal line, or nothing
   [ -f "$1" ] || return 0
@@ -424,11 +488,26 @@ is_healthy(){ # (a)+(b)+(c) above. Sets HEALTH_REASON on failure.
     [ -n "$oldest" ] && [ "$oldest" -ge "$up" ] || { oldest="$up"; oldest_pid="$pid"; }
   done
   dlog="$(daemon_log_for "$oldest")"
-  offset=0; [ "$dlog" = "$PRE_LOG" ] && offset="$PRE_LOG_LINES"
-  boot="$(boot_offset "$dlog" "$oldest_pid")"
-  [ "$boot" -gt "$offset" ] && offset="$boot"
-  fatal="$(first_fatal_after "$dlog" "$offset")"
-  [ -z "$fatal" ] || { HEALTH_REASON="fatal in $(basename "$dlog") since this daemon booted (scanned from line $(( offset + 1 ))): $(printf '%s' "$fatal" | tr -d '"\\' | cut -c1-160)"; return 1; }
+  if [ -f "$dlog" ]; then
+    # The daemon log is readable (at $AGENT_DIR or the SSD path the wrapper
+    # redirected it to): scan it for a fatal line since this daemon booted.
+    offset=0; [ "$dlog" = "$PRE_LOG" ] && offset="$PRE_LOG_LINES"
+    boot="$(boot_offset "$dlog" "$oldest_pid")"
+    [ "$boot" -gt "$offset" ] && offset="$boot"
+    fatal="$(first_fatal_after "$dlog" "$offset")"
+    [ -z "$fatal" ] || { HEALTH_REASON="fatal in $(basename "$dlog") since this daemon booted (scanned from line $(( offset + 1 ))): $(printf '%s' "$fatal" | tr -d '"\\' | cut -c1-160)"; return 1; }
+  else
+    # The daemon log is not readable even at the SSD-resolved path (a redirect
+    # this gate could not resolve, or a brand-new start-day file the daemon has
+    # not written yet). Do NOT fail-open blindly (that silently drops check (b)
+    # on every such seat) and do NOT roll a healthy release back on a path
+    # artefact. Fall back to the path-independent cadence heartbeat: fresh →
+    # the daemon's main loop is demonstrably cycling, so the missing log is a
+    # path artefact, not death → pass; stale/absent → no log AND no heartbeat is
+    # genuine unhealth → fail.
+    why="$(cadence_heartbeat_stale)"
+    [ -z "$why" ] || { HEALTH_REASON="$why"; return 1; }
+  fi
   if org_enrolled; then
     why="$(beat_not_acknowledged $(( $(date +%s) - oldest - 2 )) "$(installed_version)")"
     [ -z "$why" ] || { HEALTH_REASON="$why"; return 1; }
@@ -463,8 +542,9 @@ label_loaded(){ # $1 = label — measured in the gui domain (right from ssh too)
 restart_daemon(){
   resolve_labels
   # Mark "since the restart" for the fatal scan: the new process appends to
-  # today's file (the wrapper names it for its start day), after these lines.
-  PRE_LOG="$DLOG_DIR/daemon-$(date +%Y-%m-%d).log"
+  # today's file (the wrapper names it for its start day), after these lines —
+  # in the dir the wrapper actually writes (SSD when redirected, else $AGENT_DIR).
+  PRE_LOG="$(daemon_log_base "$(date +%Y-%m-%d)")/daemon-$(date +%Y-%m-%d).log"
   PRE_LOG_LINES=0
   [ -f "$PRE_LOG" ] && PRE_LOG_LINES="$(wc -l < "$PRE_LOG" 2>/dev/null | tr -d ' ')"
   PRE_LOG_LINES="${PRE_LOG_LINES:-0}"
@@ -619,7 +699,7 @@ revive_daemon(){ # the daemon-DOWN backstop. A daemon cannot restart ITSELF —
   # saw: the launchctl list line and the tail of the daemon's own log.
   local lc_line dlog_tail evidence
   lc_line="$(launchctl list 2>/dev/null | awk -v l="$DAEMON_LABEL" 'NR>1 && $3==l { print; exit }')"
-  dlog_tail="$(tail -n 3 "$DLOG_DIR/daemon-$(date +%Y-%m-%d).log" 2>/dev/null | tr '\n' '|')"
+  dlog_tail="$(tail -n 3 "$(daemon_log_base "$(date +%Y-%m-%d)")/daemon-$(date +%Y-%m-%d).log" 2>/dev/null | tr '\n' '|')"
   evidence="assert=${ok:-unknown} samples=${samples} launchctl=[${lc_line:-none}] dlog=[${dlog_tail:-none}]"
   log "daemon $DAEMON_LABEL kickstart did NOT revive it (${ok:-unknown}) — a helper's exit code is not a revive; this seat needs a person (failure to escalate). ${evidence}"
   write_revive_note "daemon-revive-failed" "$DAEMON_LABEL" "$evidence"