@jungjaehoon/mama-os 0.77.0 → 0.79.0

package/dist/cli/commands/daemon.js

@@ -1,13 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OWNER_PRINCIPAL_ID = void 0;
+exports.MESSENGER_SECRETS = exports.BOOT_STAGES = exports.StopDuringBootError = exports.OWNER_PRINCIPAL_ID = void 0;
+exports.pathsOverlap = pathsOverlap;
 exports.validateDeliveryRoutes = validateDeliveryRoutes;
+exports.upkeepCloseSince = upkeepCloseSince;
+exports.pathsFor = pathsFor;
 exports.ensureDaemonIsolation = ensureDaemonIsolation;
 exports.loggedOwnerIntake = loggedOwnerIntake;
 exports.bootDaemon = bootDaemon;
 exports.runDaemon = runDaemon;
-exports.daemonStatus = daemonStatus;
-exports.requestDaemonStop = requestDaemonStop;
+exports.installControlPaths = installControlPaths;
+exports.askDaemon = askDaemon;
+exports.launchdService = launchdService;
+exports.bootoutLaunchdService = bootoutLaunchdService;
 const mama_core_1 = require("@jungjaehoon/mama-core");
 const document_toolkit_js_1 = require("../../tools/document-toolkit.js");
 const node_fs_1 = require("node:fs");
@@ -24,6 +29,7 @@ const action_surface_js_1 = require("../../runtime/action-surface.js");
 const connectors_js_1 = require("../../runtime/connectors.js");
 const config_js_1 = require("../../runtime/config.js");
 const model_cache_js_1 = require("../../runtime/model-cache.js");
+const member_paths_js_1 = require("../../runtime/member-paths.js");
 const backend_security_js_1 = require("../../runtime/backend-security.js");
 const session_credential_js_1 = require("../../runtime/session-credential.js");
 const action_mcp_config_js_1 = require("../runtime/action-mcp-config.js");
@@ -35,10 +41,16 @@ const viewer_data_js_1 = require("../../api/viewer-data.js");
 const owner_authority_js_1 = require("../../runtime/owner-authority.js");
 const principal_access_js_1 = require("../../runtime/principal-access.js");
 const report_scheduler_js_1 = require("../../runtime/report-scheduler.js");
+const release_check_js_1 = require("../runtime/release-check.js");
+const install_kind_js_1 = require("../runtime/install-kind.js");
+const update_request_js_1 = require("../runtime/update-request.js");
+const systemd_service_js_1 = require("../runtime/systemd-service.js");
 const wiki_read_js_1 = require("../../wiki/wiki-read.js");
 const timezone_js_1 = require("../../runtime/timezone.js");
 const security_events_js_1 = require("../../api/security-events.js");
 const egress_proxy_js_1 = require("../../runtime/egress-proxy.js");
+const daemon_control_js_1 = require("../runtime/daemon-control.js");
+const update_journal_js_1 = require("../runtime/update-journal.js");
 exports.OWNER_PRINCIPAL_ID = 'owner';
 const OWNER_AGENT_ID = 'owner-agent';
 const OWNER_MEMORY_SCOPES = (0, action_surface_js_1.ownerMemoryScopes)(exports.OWNER_PRINCIPAL_ID, index_js_1.LOADABLE_CONNECTORS);
@@ -56,9 +68,49 @@ function errorName(error) {
     const name = error.name.trim() !== '' ? error.name : 'Error';
     return `${name}: ${error.message}`;
 }
-function stage(logger, name) {
+class StopDuringBootError extends Error {
+    constructor() {
+        super('Stopped during boot');
+        this.name = 'StopDuringBootError';
+    }
+}
+exports.StopDuringBootError = StopDuringBootError;
+/** Every stage boot logs as `boot stage=<name>`; `mama doctor` reports only these names. */
+exports.BOOT_STAGES = [
+    'config',
+    'isolation',
+    'owner_runtime',
+    'viewer',
+    'replay',
+    'connectors',
+    'messengers',
+    'telegram',
+    'telegram:disabled',
+    'discord',
+    'slack',
+    'report_scheduler',
+    'report_scheduler:route_unavailable',
+    'personal_job_scheduler',
+];
+function stage(logger, name, signal) {
+    if (signal?.aborted)
+        throw new StopDuringBootError();
     logger.info(`boot stage=${name}`);
 }
+/** The auth.env names each messenger needs before it starts; `mama doctor` checks the same. */
+exports.MESSENGER_SECRETS = {
+    telegram: ['MAMA_TELEGRAM_TOKEN'],
+    discord: ['MAMA_DISCORD_TOKEN'],
+    slack: ['MAMA_SLACK_TOKEN', 'MAMA_SLACK_APP_TOKEN'],
+};
+function messengerSecrets(messenger) {
+    return exports.MESSENGER_SECRETS[messenger].map((name) => {
+        const value = process.env[name];
+        if (!value?.trim())
+            throw new Error(`${name} is required`);
+        return value;
+    });
+}
 function stageFailed(logger, name, error) {
     logger.error(`boot stage=${name} failed error=${errorName(error)}`);
 }
@@ -107,6 +159,24 @@ function validateDeliveryRoutes(config) {
             throw new Error(`delivery.${purpose} targets ${messenger}, which is disabled or has no allowlisted owner channel`);
     }
 }
+/**
+ * The instant closing summaries start being ordered: written once, at the first start that runs
+ * upkeep, so items closed before it are left to the one-time summary script.
+ */
+function upkeepCloseSince(path, now = Date.now()) {
+    if ((0, node_fs_1.existsSync)(path)) {
+        const stored = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8')).closeSince;
+        if (typeof stored !== 'number' || !Number.isSafeInteger(stored))
+            throw new Error(`${path} has no closeSince epoch`);
+        return stored;
+    }
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+    // Written once and read at every start: a partial file would stop each boot, so it appears whole.
+    const temporary = `${path}.${process.pid}.tmp`;
+    (0, node_fs_1.writeFileSync)(temporary, `${JSON.stringify({ closeSince: now }, null, 2)}\n`, { mode: 0o600 });
+    (0, node_fs_1.renameSync)(temporary, path);
+    return now;
+}
 function pathsFor(configPath, config) {
     const mamaRoot = (0, node_path_1.dirname)(configPath);
     const runtimeRoot = (0, node_path_1.join)(mamaRoot, 'runtime');
@@ -129,6 +199,11 @@ function pathsFor(configPath, config) {
     if (pathsOverlap(workspaceDir, runtimeRoot)) {
         throw new Error(`agent.codex_cwd must not contain or sit inside ${runtimeRoot}`);
     }
+    // Backups are denied to the agents; a workspace there could not be read by its own agent.
+    const backupsRoot = (0, node_path_1.join)(mamaRoot, 'backups');
+    if (pathsOverlap(workspaceDir, backupsRoot)) {
+        throw new Error(`agent.codex_cwd must not contain or sit inside ${backupsRoot}`);
+    }
     return {
         mamaRoot,
         runtimeRoot,
@@ -148,6 +223,8 @@ function pathsFor(configPath, config) {
 /** Create only the native-process isolation files; never remove product state. */
 function ensureDaemonIsolation(options) {
     const { config, paths } = options;
+    // Member temp data under the old machine-wide parents is no longer under any session deny.
+    (0, member_paths_js_1.removeRetiredMemberTemp)();
     (0, node_fs_1.mkdirSync)(paths.downloadsDir, { recursive: true, mode: 0o700 });
     (0, node_fs_1.mkdirSync)(paths.workspaceDir, { recursive: true });
     const gitDir = (0, node_path_1.join)(paths.workspaceDir, '.git');
@@ -196,7 +273,15 @@ async function stopOne(logger, name, stop, errors) {
 }
 /** Open the W1 owner subject, then activate producers in their dependency order. */
 async function bootDaemon(options = {}) {
-    const logger = options.logger ?? defaultLogger;
+    const baseLogger = options.logger ?? defaultLogger;
+    let lastError = null;
+    const logger = {
+        info: (line) => baseLogger.info(line),
+        error: (line) => {
+            lastError = { at: Date.now(), line: line.slice(0, 500) };
+            baseLogger.error(line);
+        },
+    };
     const dependencies = options.dependencies ?? {};
     const configPath = options.configPath ?? (0, config_js_1.defaultConfigPath)(options.home ?? (0, node_os_1.homedir)());
     let config;
@@ -208,15 +293,94 @@ async function bootDaemon(options = {}) {
     let gateway = null;
     const gateways = new Map();
     let reportScheduler;
+    let releaseCheck;
     let egressProxy;
     let stopped = false;
     let deliveryReady = options.mode === 'replay';
     const startedAt = Date.now();
     let currentStage = 'config';
-    const stopResources = async () => {
+    let booted = false;
+    const command = options.command ?? (options.mode === 'replay' ? 'replay' : 'daemon');
+    // The install's one process: taken before anything opens the database or rewrites settings.
+    const control = (0, daemon_control_js_1.daemonControlPaths)((0, node_path_1.dirname)(configPath));
+    const lock = (0, daemon_control_js_1.acquireInstallLock)(control, command);
+    let controlServer = null;
+    // One per open drain connection; while any is open, nothing new is claimed.
+    const holds = new Set();
+    // An update candidate's hold, from boot until the updater's `release` (update.md, steps 13-14).
+    let updateHold = null;
+    const claimsHeld = () => holds.size > 0 || updateHold !== null;
+    // What a drain waits for: this process's own work. Runs and claims of an earlier boot are left
+    // out: their process is gone, and such a claim (a dispatch the crash cut off) resolves only in
+    // reconciliation, which the hold suspends. A claim is stamped when it is taken and renewed only
+    // by this process's deliveries, so its time tells which boot owns it. A claimed input whose
+    // native dispatch is uncertain is parked until reconciliation too; nothing starts from it.
+    const drainCounts = () => {
         if (stopped)
-            return;
-        stopped = true;
+            throw new Error('MAMA is stopping');
+        if (!owner)
+            return { running: 0, claimed: 0, turns: 0 };
+        const adapter = owner.database.adapter;
+        const { running, unclaimed } = adapter
+            .prepare(`SELECT COUNT(*) AS running,
+                COUNT(CASE WHEN parent_model_run_id IS NULL
+                            AND json_extract(input_refs_json, '$.nativeInputId') IS NULL
+                           THEN 1 END) AS unclaimed
+           FROM model_runs WHERE status = 'running' AND created_at >= ?`)
+            .get(startedAt);
+        const { claimed } = adapter
+            .prepare(`SELECT COUNT(*) AS claimed FROM mailbox_inputs m
+          WHERE m.status = 'claimed' AND m.claimed_at >= ?
+            AND NOT EXISTS (SELECT 1 FROM native_input_deliveries n
+                             WHERE n.input_id = m.id AND n.state = 'uncertain')`)
+            .get(startedAt);
+        // A turn either runs a claimed input or is a top-level run without one (a probe); subagent
+        // runs belong to their parent's turn.
+        return { running, claimed, turns: claimed + unclaimed };
+    };
+    const statusReport = async () => {
+        const report = {
+            pid: process.pid,
+            command,
+            version: (0, package_version_js_1.resolvePackageVersion)(),
+            // What `mama update --node` confirms after it moves the managed Node.
+            node: process.version,
+            startedAt,
+            stage: stopped ? 'stopping' : booted ? 'running' : currentStage,
+            lastError,
+            drain: holds.size === 0
+                ? null
+                : { holds: holds.size, since: Math.min(...[...holds].map((hold) => hold.since)) },
+            update: updateHold,
+        };
+        // Stores close during a stop; what it reports then is that it is stopping.
+        if (stopped)
+            return report;
+        if (owner) {
+            const adapter = owner.database.adapter;
+            report.runningTurns = adapter
+                .prepare(`SELECT COALESCE(json_extract(input_refs_json, '$.sessionKey'), 'unknown') AS session,
+                  COUNT(*) AS count
+             FROM model_runs WHERE status = 'running' AND created_at >= ? GROUP BY 1 ORDER BY 1`)
+                .all(startedAt);
+            report.inputs = adapter
+                .prepare(`SELECT status, COUNT(*) AS count FROM mailbox_inputs
+            WHERE status IN ('pending', 'claimed') GROUP BY status ORDER BY status`)
+                .all();
+        }
+        if (connectors) {
+            const connectorRuntime = connectors;
+            const health = await connectorRuntime.registry.healthCheckAll();
+            report.connectors = connectorRuntime.enabledConnectorNames.map((name) => ({
+                name,
+                healthy: health[name]?.healthy === true,
+                lastPoll: health[name]?.lastPollTime?.toISOString() ?? null,
+                error: health[name]?.error ?? null,
+            }));
+        }
+        return report;
+    };
+    const stopOwned = async () => {
         const errors = [];
         owner?.beginStop?.();
         // Quiesce every producer before awaiting any one of them. Transports and the database
@@ -224,6 +388,8 @@ async function bootDaemon(options = {}) {
         const producerStops = [...gateways].map(([name, active]) => stopOne(logger, `${name}_intake`, () => active.beginStop?.(), errors));
         if (reportScheduler)
             producerStops.push(stopOne(logger, 'report_scheduler', () => reportScheduler.stop(), errors));
+        if (releaseCheck)
+            producerStops.push(stopOne(logger, 'release_check', () => releaseCheck.stop(), errors));
         if (connectors)
             producerStops.push(stopOne(logger, 'connectors', () => connectors.stop(), errors));
         if (viewer)
@@ -243,22 +409,101 @@ async function bootDaemon(options = {}) {
         if (errors.length > 0)
             throw new AggregateError(errors, 'Daemon shutdown failed');
     };
+    const stopResources = async () => {
+        if (stopped)
+            return;
+        stopped = true;
+        let closed = false;
+        try {
+            await stopOwned();
+            closed = true;
+        }
+        finally {
+            if (controlServer) {
+                await controlServer
+                    .close()
+                    .catch((error) => logger.error(`shutdown stage=control failed error=${errorName(error)}`));
+            }
+            // Released only once every store closed: after a failed stop something may still run, so
+            // the install stays held until this process ends and the operating system lets it go.
+            if (closed)
+                lock.release();
+        }
+    };
     try {
         currentStage = 'config';
-        stage(logger, 'config');
+        // A half-switched install is neither the old one nor the restored one.
+        (0, daemon_control_js_1.refuseWhileRestoring)((0, node_path_1.dirname)(configPath));
+        controlServer = await (0, daemon_control_js_1.startDaemonControl)(control, {
+            status: statusReport,
+            stop: () => {
+                if (!options.requestStop)
+                    throw new Error(`${command} stops when it finishes`);
+                options.requestStop();
+            },
+            probe: async () => {
+                if (!booted || stopped || !owner)
+                    throw new Error('MAMA has not finished starting');
+                // After the drain is idle the stop comes next, and it would cut the probe's turn off.
+                if (holds.size > 0)
+                    throw new Error('A drain holds new work; probe after the restart');
+                try {
+                    const probed = await owner.probeBackend();
+                    logger.info(`backend probe: ${config.agent.backend} answered in ${probed.ms} ms (model run ${probed.modelRunId ?? 'none'})`);
+                    return { backend: config.agent.backend, model: config.agent.model, ...probed };
+                }
+                catch (error) {
+                    // The turn's own failure is wrapped by the dispatch layer; its causes name what failed.
+                    const reason = (0, stimulus_delivery_js_1.stimulusFailureReason)(error);
+                    logger.error(`backend probe: ${config.agent.backend} failed: ${reason}`);
+                    throw new Error(reason);
+                }
+            },
+            hold: () => {
+                const at = drainCounts();
+                // Each turn that may still run takes at most max_turn_ms; nothing new starts.
+                const perTurn = owner ? config.agent.max_turn_ms : 0;
+                const hold = { since: Date.now() };
+                holds.add(hold);
+                logger.info(`drain: claims held running=${at.running} claimed=${at.claimed}`);
+                return {
+                    boundMs: at.turns * perTurn + 60_000,
+                    counts: () => {
+                        const { running, claimed } = drainCounts();
+                        return { running, claimed };
+                    },
+                    release: () => {
+                        holds.delete(hold);
+                        logger.info('drain: claims released');
+                    },
+                };
+            },
+            release: () => {
+                const held = updateHold !== null;
+                if (held)
+                    logger.info(`update: ${updateHold.to} confirmed; claims released`);
+                updateHold = null;
+                return { held };
+            },
+        });
+        if (options.signal?.aborted)
+            throw new StopDuringBootError();
         config = options.config ?? (0, config_js_1.loadConfig)({ path: configPath, home: options.home });
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(config.logging.file), { recursive: true });
+        // The service manager redirects only what comes before this point, to the crash log. From here
+        // on the daemon's own log holds everything, from the first boot stage on.
+        options.captureOutput?.(config.logging.file);
+        stage(logger, 'config', options.signal);
+        // An update candidate runs nothing until the updater has seen it boot and confirmed it: its
+        // boot recovery claims nothing, so a rollback finds every input as it was (update.md step 13).
+        const update = (0, update_journal_js_1.readUpdateJournal)((0, update_journal_js_1.updatePaths)((0, node_path_1.dirname)(configPath)).journal);
+        if (update?.phase === 'candidate') {
+            updateHold = { since: Date.now(), to: update.to };
+            logger.info(`update: booted as the candidate for ${update.to}; claims held until confirmed`);
+        }
         logger.info(`document toolkit: ${(0, document_toolkit_js_1.readDocumentToolkit)(config.tools_root, (error) => logger.error(error.message)) ? 'present' : 'absent (run mama tools install)'}`);
         const timeZone = (0, timezone_js_1.createTimeZoneSetting)(config.timezone);
         validateDeliveryRoutes(config);
-        // launchd may have created the redirected log already; preserve its contents and tighten it.
-        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(config.logging.file), { recursive: true });
-        const logDescriptor = (0, node_fs_1.openSync)(config.logging.file, 'a', 0o600);
-        try {
-            (0, node_fs_1.fchmodSync)(logDescriptor, 0o600);
-        }
-        finally {
-            (0, node_fs_1.closeSync)(logDescriptor);
-        }
         (0, model_cache_js_1.declareModelCache)();
         paths = pathsFor(configPath, config);
         currentStage = 'isolation';
@@ -268,7 +513,7 @@ async function bootDaemon(options = {}) {
             paths,
             ...(options.mcpServerPath ? { mcpServerPath: options.mcpServerPath } : {}),
         });
-        stage(logger, 'isolation');
+        stage(logger, 'isolation', options.signal);
         currentStage = 'owner_runtime';
         const ownerPolicyProvider = (0, owner_policy_js_1.createOwnerPolicyProvider)(paths.mamaRoot);
         const ownerPolicy = ownerPolicyProvider();
@@ -445,6 +690,7 @@ async function bootDaemon(options = {}) {
             },
             ownerPolicyProvider,
             deliveryReady: () => deliveryReady,
+            claimsHeld,
             onPersonalJobError: (error) => logger.error(`personal job scheduler failed reason=${(0, stimulus_delivery_js_1.stimulusFailureReason)(error)}`),
             ...(options.mode === 'replay'
                 ? {}
@@ -458,7 +704,9 @@ async function bootDaemon(options = {}) {
                         const selected = gateways.get(sourceForRef(row.stimulusId));
                         if (!selected)
                             throw new Error('Owner messenger is not available for an interrupted response');
-                        await selected.recoverPendingResponses();
+                        // Only this message: a sweep would tell messages still in flight that they were
+                        // interrupted, and their answers would then be dropped as already delivered.
+                        await selected.recoverResponse(row.stimulusId);
                     },
                     closeUncertain: {
                         ownerAnswered: (row) => gateways.get(sourceForRef(row.stimulusId))?.answered(row.stimulusId) ?? false,
@@ -491,10 +739,26 @@ async function bootDaemon(options = {}) {
                 else
                     logger.info(line);
             },
+            // Upkeep orders write the ledger from live state: a replay places none, but still serves an
+            // order a live run left in the mailbox.
+            upkeep: {
+                closeSince: upkeepCloseSince((0, node_path_1.join)(paths.runtimeRoot, 'upkeep-state.json')),
+                fullReportHours: () => config.reports.full_report_hours,
+                scan: options.mode !== 'replay',
+                onEvent: (event) => {
+                    const line = `upkeep ${event.kind} ${event.type}${event.type === 'ordered'
+                        ? ` order=${event.order} subjects=${event.subjects}`
+                        : ` subject=${event.subject}`}${'attempt' in event ? ` attempt=${event.attempt}` : ''}${'reason' in event ? ` reason=${(0, stimulus_delivery_js_1.stimulusFailureReason)(event.reason)}` : ''}`;
+                    if (event.type === 'lost')
+                        logger.error(line);
+                    else
+                        logger.info(line);
+                },
+            },
             onStimulusDelivered: (row, modelRunId) => stimulusDelivered(logger, row, modelRunId),
             onStimulusFailed: (row, reason, modelRunId) => stimulusFailed(logger, row.kind ?? 'unknown', row.stimulusId, reason, modelRunId),
         });
-        stage(logger, 'owner_runtime');
+        stage(logger, 'owner_runtime', options.signal);
         currentStage = 'viewer';
         const viewerFactory = dependencies.createViewerServer ?? viewer_server_js_1.createViewerServer;
         viewer = viewerFactory({
@@ -545,14 +809,14 @@ async function bootDaemon(options = {}) {
         });
         await viewer.start();
         logger.info(`viewer server listening on port=${String(viewer.port)}`);
-        stage(logger, 'viewer');
+        stage(logger, 'viewer', options.signal);
         if (options.mode === 'replay') {
             logger.info('replay collectors: disabled');
             currentStage = 'replay';
             if (!options.replay)
                 throw new Error('Replay mode requires a replay feeder');
             await options.replay({ config, paths, owner, logger, timeZone });
-            stage(logger, 'replay');
+            stage(logger, 'replay', options.signal);
             return {
                 config,
                 paths,
@@ -589,16 +853,14 @@ async function bootDaemon(options = {}) {
             coreAdapter: owner.database?.adapter,
             acceptSourceDelta,
         });
-        stage(logger, 'connectors');
+        stage(logger, 'connectors', options.signal);
         currentStage = 'messengers';
         const intake = loggedOwnerIntake(owner.intake, logger);
         const ledgerPath = paths.ownerMessageLedgerPath;
         messageLedger = new telegram_message_ledger_js_1.OwnerMessageLedger(ledgerPath, { log: (line) => logger.info(line) });
         const filesRoot = (0, node_path_1.join)(paths.workspaceDir, 'files');
         if (config.telegram.enabled) {
-            const token = process.env.MAMA_TELEGRAM_TOKEN;
-            if (!token?.trim())
-                throw new Error('MAMA_TELEGRAM_TOKEN is required');
+            const [token] = messengerSecrets('telegram');
             const factory = dependencies.createTelegramGateway ?? ((options) => new telegram_js_1.TelegramGateway(options));
             gateway = factory({
                 token,
@@ -612,6 +874,59 @@ async function bootDaemon(options = {}) {
                 principalPaths: (principalId, room) => owner.principalPaths(principalId, room),
                 onMemberSelection: (selection) => owner.completeMemberEnrollment(selection),
                 recordMemberSelection: (exchange) => owner.recordHostExchange(exchange),
+                hostCommands: {
+                    status: async (target, ownerView) => {
+                        const report = await statusReport();
+                        const adapter = owner.database.adapter;
+                        // A group reads the reply, so a member's count there is that group's inputs only.
+                        const waiting = (0, owner_runtime_js_1.countInputsNotDone)(adapter, ownerView
+                            ? {}
+                            : target.kind === 'common'
+                                ? { principalId: exports.OWNER_PRINCIPAL_ID }
+                                : {
+                                    principalId: target.principalId,
+                                    ...(target.room === undefined ? {} : { channel: target.room }),
+                                });
+                        const turns = (report.runningTurns ?? []);
+                        const sources = (report.connectors ?? []);
+                        return {
+                            version: String(report.version),
+                            since: (0, timezone_js_1.localNow)(startedAt, timeZone.get()),
+                            conversationRunning: owner.turnRunning(target),
+                            inputsWaiting: waiting,
+                            ...(ownerView
+                                ? {
+                                    owner: {
+                                        turnsRunning: turns.reduce((sum, turn) => sum + turn.count, 0),
+                                        sources: sources.map(({ name, healthy }) => ({ name, healthy })),
+                                    },
+                                }
+                                : {}),
+                        };
+                    },
+                    startOver: (target) => owner.startOver(target),
+                    stopTurn: (target) => owner.stopTurn(target),
+                    update: async (origin) => {
+                        const result = (0, update_request_js_1.requestUpdate)({
+                            mamaRoot: paths.mamaRoot,
+                            home: options.home ?? (0, node_os_1.homedir)(),
+                            origin,
+                            version: (0, package_version_js_1.resolvePackageVersion)(),
+                            platform: process.platform,
+                            run: systemd_service_js_1.defaultServiceRun,
+                            uid: process.getuid(),
+                            log: (line) => logger.info(line),
+                        });
+                        logger.info(`update requested result=${result.kind}`);
+                        if (result.kind !== 'busy')
+                            return result;
+                        return {
+                            kind: 'busy',
+                            source: result.source,
+                            since: result.since === null ? 'an unknown time' : (0, timezone_js_1.localNow)(result.since, timeZone.get()),
+                        };
+                    },
+                },
                 config: {
                     enabled: true,
                     allowedChats: config.telegram.allowed_chats,
@@ -633,14 +948,12 @@ async function bootDaemon(options = {}) {
             });
             gateways.set('telegram', gateway);
             await gateway.start();
-            stage(logger, 'telegram');
+            stage(logger, 'telegram', options.signal);
         }
         else
-            stage(logger, 'telegram:disabled');
+            stage(logger, 'telegram:disabled', options.signal);
         if (config.discord?.enabled) {
-            const token = process.env.MAMA_DISCORD_TOKEN;
-            if (!token?.trim())
-                throw new Error('MAMA_DISCORD_TOKEN is required');
+            const [token] = messengerSecrets('discord');
             const factory = dependencies.createDiscordGateway ?? ((options) => new discord_js_1.DiscordGateway(options));
             const active = factory({
                 token,
@@ -662,15 +975,10 @@ async function bootDaemon(options = {}) {
             });
             gateways.set('discord', active);
             await active.start();
-            stage(logger, 'discord');
+            stage(logger, 'discord', options.signal);
         }
         if (config.slack?.enabled) {
-            const token = process.env.MAMA_SLACK_TOKEN;
-            const appToken = process.env.MAMA_SLACK_APP_TOKEN;
-            if (!token?.trim())
-                throw new Error('MAMA_SLACK_TOKEN is required');
-            if (!appToken?.trim())
-                throw new Error('MAMA_SLACK_APP_TOKEN is required');
+            const [token, appToken] = messengerSecrets('slack');
             const factory = dependencies.createSlackGateway ?? ((options) => new slack_js_1.SlackGateway(options));
             const active = factory({
                 token,
@@ -693,7 +1001,7 @@ async function bootDaemon(options = {}) {
             });
             gateways.set('slack', active);
             await active.start();
-            stage(logger, 'slack');
+            stage(logger, 'slack', options.signal);
         }
         const reportRoute = config.delivery?.reports ?? 'telegram';
         if (gateways.has(reportRoute)) {
@@ -717,25 +1025,40 @@ async function bootDaemon(options = {}) {
                         return receipt;
                     },
                 },
-                hasPendingReport: () => Boolean(owner.database.adapter
-                    .prepare(`SELECT 1 FROM mailbox_inputs m LEFT JOIN native_input_deliveries n ON n.input_id = m.id WHERE m.principal_id = ? AND m.kind = 'scheduled' AND m.channel_key = 'schedule' AND m.status IN ('pending', 'claimed') AND (n.state IS NULL OR n.state != 'uncertain') LIMIT 1`)
-                    .get(exports.OWNER_PRINCIPAL_ID)),
+                hasPendingReport: (report, hourKey) => Boolean(owner.database.adapter
+                    .prepare(`SELECT 1 FROM mailbox_inputs m LEFT JOIN native_input_deliveries n ON n.input_id = m.id WHERE m.principal_id = ? AND m.kind = 'scheduled' AND m.channel_key = 'schedule' AND m.status IN ('pending', 'claimed') AND (n.state IS NULL OR n.state != 'uncertain' OR (json_extract(m.payload_json, '$.report') = ? AND json_extract(m.payload_json, '$.hourKey') = ? AND EXISTS (SELECT 1 FROM native_turn_results r WHERE r.receipt_json = n.receipt_json AND r.principal_id = m.principal_id))) LIMIT 1`)
+                    .get(exports.OWNER_PRINCIPAL_ID, report, hourKey)),
                 sendToOwner: (text, key) => gateways.get(reportRoute).sendToOwner(text, key),
+                // Every messenger keys outbound text the same way in the one shared ledger.
+                retireUndelivered: (key) => messageLedger.retireUndelivered((0, telegram_message_ledger_js_1.outboundLedgerKey)(key)),
+                log: (line) => logger.info(line),
                 onError: (error) => logger.error(`report scheduler failed reason=${(0, stimulus_delivery_js_1.stimulusFailureReason)(error)}`),
             });
             reportScheduler.start();
-            stage(logger, 'report_scheduler');
+            stage(logger, 'report_scheduler', options.signal);
         }
         else
-            stage(logger, 'report_scheduler:route_unavailable');
+            stage(logger, 'report_scheduler:route_unavailable', options.signal);
         if (gateway?.sendMemberText) {
             owner.personalJobs.start();
             await owner.personalJobs
                 .tick()
                 .catch((error) => logger.error(`personal job scheduler failed reason=${(0, stimulus_delivery_js_1.stimulusFailureReason)(error)}`));
-            stage(logger, 'personal_job_scheduler');
+            stage(logger, 'personal_job_scheduler', options.signal);
         }
+        // Live only: a replay or backfill returned above, and never asks the registry.
+        releaseCheck = (dependencies.createReleaseCheck ?? release_check_js_1.createReleaseCheck)({
+            statePath: (0, release_check_js_1.releaseCheckPath)(paths.mamaRoot),
+            current: (0, package_version_js_1.resolvePackageVersion)(),
+            packageKind: (0, install_kind_js_1.packageKind)((0, install_kind_js_1.runningPackageRoot)()),
+            npmPath: (0, release_check_js_1.npmBesideNode)(),
+            timeZone,
+            log: (line) => logger.info(line),
+            onError: (error) => logger.error(`release check failed error=${errorName(error)}`),
+        });
+        releaseCheck.start();
         deliveryReady = true;
+        booted = true;
         return {
             config,
             paths,
@@ -748,7 +1071,16 @@ async function bootDaemon(options = {}) {
         };
     }
     catch (error) {
-        stageFailed(logger, currentStage, error);
+        if (error instanceof StopDuringBootError) {
+            logger.info(`boot stopped before stage=${currentStage}`);
+        }
+        else {
+            stageFailed(logger, currentStage, error);
+            // A frozen error keeps its own shape; the stage is still in the log line above.
+            if (error !== null && typeof error === 'object' && Object.isExtensible(error)) {
+                Object.defineProperty(error, 'bootStage', { value: currentStage, enumerable: false });
+            }
+        }
         try {
             await stopResources();
         }
@@ -758,48 +1090,92 @@ async function bootDaemon(options = {}) {
         throw error;
     }
 }
-/** Foreground launchd entry: wait until SIGTERM/SIGINT, then close reverse-order stages. */
+/**
+ * Foreground entry for launchd, systemd, Docker or a terminal. Signals are taken before boot, so a
+ * stop during boot unwinds what has started; `mama stop` asks through the control socket.
+ */
 async function runDaemon(options = {}) {
-    const daemon = await bootDaemon(options);
-    await new Promise((resolve, reject) => {
-        let finished = false;
-        const finish = async () => {
-            if (finished)
+    const controller = new AbortController();
+    // A stop asked for through `mama stop` exits 0; one by a signal exits 128 + its number, as an
+    // unhandled signal would, so a service that restarts only after a failure brings back a daemon
+    // that was killed (a service manager's own stop does not restart it whatever the code).
+    let signalExit;
+    const requestStop = () => controller.abort();
+    const onSigterm = () => {
+        signalExit = 143;
+        controller.abort();
+    };
+    const onSigint = () => {
+        signalExit = 130;
+        controller.abort();
+    };
+    // Once each: a second signal falls to Node's default and ends the process at once, a force stop;
+    // the operating system releases the install lock with it.
+    process.once('SIGTERM', onSigterm);
+    process.once('SIGINT', onSigint);
+    try {
+        let daemon;
+        try {
+            daemon = await bootDaemon({ ...options, signal: controller.signal, requestStop });
+        }
+        catch (error) {
+            if (error instanceof StopDuringBootError) {
+                if (signalExit !== undefined)
+                    process.exitCode = signalExit;
                 return;
-            finished = true;
-            try {
-                await daemon.stop();
-                resolve();
-            }
-            catch (error) {
-                reject(error);
             }
-        };
-        process.once('SIGTERM', () => void finish());
-        process.once('SIGINT', () => void finish());
-    });
+            throw error;
+        }
+        if (!controller.signal.aborted) {
+            await new Promise((resolve) => controller.signal.addEventListener('abort', () => resolve(), { once: true }));
+        }
+        await daemon.stop();
+        if (signalExit !== undefined)
+            process.exitCode = signalExit;
+    }
+    finally {
+        process.off('SIGTERM', onSigterm);
+        process.off('SIGINT', onSigint);
+    }
 }
-function launchdService(command) {
-    const result = (0, node_child_process_1.spawnSync)('launchctl', [command, `gui/${process.getuid()}/com.mama.server`], {
+/** The install's control paths from its config path, as boot derives them. */
+function installControlPaths(options = {}) {
+    const configPath = options.configPath ?? (0, config_js_1.defaultConfigPath)(options.home ?? (0, node_os_1.homedir)());
+    return (0, daemon_control_js_1.daemonControlPaths)((0, node_path_1.dirname)(configPath));
+}
+async function askDaemon(op, options = {}) {
+    return await (0, daemon_control_js_1.requestDaemonControl)(installControlPaths(options), op, options.timeoutMs);
+}
+/** macOS only: this user's LaunchAgent (`launchctl print` exits 113 when it is not loaded). */
+function launchdService() {
+    if (process.platform !== 'darwin')
+        return { loaded: false, pid: null };
+    const result = (0, node_child_process_1.spawnSync)('launchctl', ['print', `gui/${process.getuid()}/com.mama.server`], {
         encoding: 'utf8',
     });
     if (result.error)
         throw result.error;
-    // launchctl print exits 113 when this user's service is not registered.
-    if (result.status !== 0 && !(command === 'print' && result.status === 113)) {
-        throw Object.assign(new Error(`launchctl ${command} failed`), {
+    if (result.status === 113)
+        return { loaded: false, pid: null };
+    if (result.status !== 0) {
+        throw Object.assign(new Error('launchctl print failed'), {
             code: `LAUNCHCTL_${result.status ?? result.signal ?? 'UNKNOWN'}`,
         });
     }
-    return result;
-}
-function daemonStatus() {
-    const result = launchdService('print');
-    return result.status === 0 && /^\s*state = running\s*$/m.test(result.stdout)
-        ? 'running'
-        : 'stopped';
+    const pid = /^\s*pid = (\d+)\s*$/m.exec(result.stdout)?.[1];
+    return { loaded: true, pid: pid === undefined ? null : Number(pid) };
 }
-function requestDaemonStop() {
-    launchdService('bootout');
+/** Unload the LaunchAgent so KeepAlive cannot restart it; launchd sends the stop signal. */
+function bootoutLaunchdService() {
+    const result = (0, node_child_process_1.spawnSync)('launchctl', ['bootout', `gui/${process.getuid()}/com.mama.server`], {
+        encoding: 'utf8',
+    });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw Object.assign(new Error('launchctl bootout failed'), {
+            code: `LAUNCHCTL_${result.status ?? result.signal ?? 'UNKNOWN'}`,
+        });
+    }
 }
 //# sourceMappingURL=daemon.js.map