@monoes/monomindcli 2.8.4 → 2.9.1

package/dist/src/orgrt/daemon.js

@@ -1,21 +1,32 @@
 // packages/@monomind/cli/src/orgrt/daemon.ts
 // monolean: single-process inter-org — upgrade path = daemon-to-daemon HTTP when multi-host is real
-import { readFileSync, mkdirSync, writeFileSync, existsSync, renameSync, unlinkSync } from 'node:fs';
+import { readFileSync, mkdirSync, existsSync, unlinkSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { join, isAbsolute } from 'node:path';
+import { writeJsonFileAtomic } from '../utils/json-file.js';
 import { reapOrphanedSdkProcesses } from '../utils/resource-governor.js';
 import { OrgBus } from './bus.js';
 import { PolicyEngine } from './policy.js';
 import { Mailbox } from './mailbox.js';
 import { runAgentSession } from './session.js';
 import { attachForwarder } from './forwarder.js';
-import { BrokerLease, lookupOrg, normalizeCredential } from './broker.js';
-import { queueMessage, drainInbox } from './inbox.js';
+import { BrokerLease, normalizeCredential } from './broker.js';
+import { drainInbox } from './inbox.js';
 import { OrgDefSchema, ORG_DIR } from './types.js';
+import { TaskDag } from './task-dag.js';
 import { summarizeRun, readRunEvents, readHistory, historyFile } from './reporting.js';
-import { checkResources, waitForCapacity, getResourceLimits, configureResourceLimits } from '../utils/resource-governor.js';
+import { getResourceLimits, configureResourceLimits } from '../utils/resource-governor.js';
 import { OpencodeAgentRunner } from './opencode-runner.js';
 import { KimiCodeAgentRunner } from './kimicode-runner.js';
-import { captureCheckpoint, validateCheckpoint, isCheckpointExpired, restoreMailboxQueue } from './checkpoint.js';
+import { captureCheckpoint } from './checkpoint.js';
+// ── Extracted module imports ────────────────────────────────────────────
+import * as approvalOps from './approvals.js';
+import * as questionOps from './questions.js';
+import * as decisionOps from './decisions.js';
+import * as crossOrg from './cross-org.js';
+import * as scheduler from './scheduler-integration.js';
+import * as orgMemory from './org-memory.js';
+import * as checkpointOps from './checkpoint-ops.js';
 /** OpenTelemetry tracing helper - creates spans for major operations */
 class OtelTracer {
     enabled = false;
@@ -46,35 +57,74 @@ class OtelTracer {
  *  for a sibling mid-build or mid-test to finish and flush its work. A hard
  *  stop keeps the short bound — see finishStop. */
 const COMPLETE_DRAIN_MS = 5 * 60_000;
-/** Bodies larger than this are digested to a .mail file (see mailBody). */
-const MAIL_BODY_MAX = 4096;
-/** How much of an oversized body stays inline in the digest. */
-const MAIL_DIGEST_CHARS = 1024;
+/** Resolve which AgentRunner hosts an org's role sessions.
+ *  Precedence: role `runtime` field > org def `runtime` field >
+ *  MONOMIND_RUNTIME env > undefined (the default path, where session.ts
+ *  falls back to ClaudeAgentRunner). Returning undefined for the default
+ *  path keeps Claude/Antigravity orgs byte-for-byte unchanged. Callers
+ *  pass `role.runtime ?? def.runtime` as `orgRuntime` (see resolveRoleRunner). */
+export function resolveRunner(orgRuntime) {
+    const selected = orgRuntime ?? process.env.MONOMIND_RUNTIME;
+    if (selected === 'opencode')
+        return new OpencodeAgentRunner();
+    if (selected === 'kimicode')
+        return new KimiCodeAgentRunner();
+    return undefined;
+}
+/** Per-session variant: a role's own `runtime` field wins over the org-level
+ *  one (and the env var) — including `role.runtime === 'claude'`, which forces
+ *  the default Claude path even when the org/env select another runtime.
+ *  Roles without a `runtime` inherit the org-level resolution unchanged. */
+export function resolveRoleRunner(roleRuntime, orgRuntime) {
+    return resolveRunner(roleRuntime ?? orgRuntime);
+}
+/** Per-role token budget: a role's own `budget_tokens` wins; otherwise the
+ *  even split of run_config.budget_tokens across all roles. */
+export function roleTokenBudget(role, def) {
+    return role.budget_tokens ?? Math.floor((def.run_config.budget_tokens ?? 1_000_000) / def.roles.length);
+}
+/** Bounded ring buffer for agent terminal scrollback. */
+export class ScrollbackBuffer {
+    maxLines;
+    lines = [];
+    constructor(maxLines = 500) {
+        this.maxLines = maxLines;
+    }
+    push(line) {
+        this.lines.push(line);
+        if (this.lines.length > this.maxLines)
+            this.lines.splice(0, this.lines.length - this.maxLines);
+    }
+    snapshot() { return [...this.lines]; }
+    clear() { this.lines.length = 0; }
+}
 export class OrgDaemon {
     root;
     opts;
-    orgs = new Map();
-    waking = new Set();
-    globalSubscribers = new Set();
-    leases = new Map();
-    forwarders = new Map();
-    watchdogs = new Map();
-    stopping = new Map();
-    otel = new OtelTracer();
-    approvals = new Map();
-    // Roles currently spawning — prevents duplicate lazy spawns from concurrent messages
-    spawning = new Map();
-    // #4: bounded whole-org restarts after the boss terminally crashes. A monotonic
-    // per-org counter so a crashing boss can never burn money in an infinite loop;
-    // reset only by an explicit (non-restart) startOrg.
+    /** @internal */ orgs = new Map();
+    /** @internal */ waking = new Set();
+    /** @internal */ globalSubscribers = new Set();
+    /** @internal */ leases = new Map();
+    /** @internal */ forwarders = new Map();
+    /** @internal */ watchdogs = new Map();
+    /** @internal */ stopping = new Map();
+    /** @internal */ otel = new OtelTracer();
+    /** @internal */ approvals = new Map();
+    /** @internal */ approvalLocks = new Map();
+    /** @internal */ gatesLocks = new Map();
+    /** @internal */ questionsLocks = new Map();
+    /** @internal */ spawning = new Map();
     static MAX_BOSS_RESTARTS = 2;
     static BOSS_RESTART_BACKOFF_MS = [10_000, 30_000];
-    bossRestartCounts = new Map();
-    restarting = new Set();
+    /** @internal */ bossRestartCounts = new Map();
+    /** @internal */ restarting = new Set();
     // #3: recognizes provider context-window-overflow errors so the boss can be told
     // to chunk the work instead of re-dispatching the same oversized task verbatim.
     static CONTEXT_LIMIT_RE = /context[- ]?(window|length|size|limit)|maximum context|exceeds?.{0,12}(context|token)|too many tokens|prompt is too long/i;
-    constructor(root, opts = {}) {
+    /** @internal */ recallUsage = new Map();
+    /** @internal */ orgLearnedRuns = new Set();
+    /** @internal */ abandoned = new Map();
+    constructor(/** @internal */ root, /** @internal */ opts = {}) {
         this.root = root;
         this.opts = opts;
     }
@@ -91,16 +141,84 @@ export class OrgDaemon {
     }
     listOrgs() { return [...this.orgs.values()]; }
     getOrg(name) { return this.orgs.get(name); }
+    /** Hot-reload an org definition from disk without stopping running sessions.
+     *  Applies: goal, run_config, schedule. New roles are added as pending (lazy-spawnable).
+     *  Removed roles are NOT killed — they finish their current work and won't be re-spawned.
+     *  Returns a summary of what changed. */
+    reloadOrgDef(name) {
+        const running = this.orgs.get(name);
+        if (!running)
+            throw new Error(`org ${name} is not running`);
+        const defPath = join(this.root, ORG_DIR, `${name}.json`);
+        const newDef = OrgDefSchema.parse(JSON.parse(readFileSync(defPath, 'utf8')));
+        const changed = [];
+        const newRoles = [];
+        const removedRoles = [];
+        if (newDef.goal !== running.def.goal) {
+            running.def.goal = newDef.goal;
+            changed.push('goal');
+        }
+        const oldRc = running.def.run_config;
+        const newRc = newDef.run_config;
+        for (const key of new Set([...Object.keys(oldRc), ...Object.keys(newRc)])) {
+            if (JSON.stringify(oldRc[key]) !== JSON.stringify(newRc[key])) {
+                oldRc[key] = newRc[key];
+                changed.push(`run_config.${key}`);
+            }
+        }
+        const existingRoleIds = new Set(running.def.roles.map(r => r.id));
+        const newRoleIds = new Set(newDef.roles.map(r => r.id));
+        for (const role of newDef.roles) {
+            if (!existingRoleIds.has(role.id)) {
+                running.def.roles.push(role);
+                if (!running.pendingRoles)
+                    running.pendingRoles = new Map();
+                running.pendingRoles.set(role.id, role);
+                newRoles.push(role.id);
+            }
+        }
+        for (const id of existingRoleIds) {
+            if (!newRoleIds.has(id))
+                removedRoles.push(id);
+        }
+        running.bus.emit({ type: 'audit', reason: 'hot-reload',
+            msg: `org def reloaded: ${changed.length} fields changed, ${newRoles.length} new roles, ${removedRoles.length} removed roles`,
+            data: { changed, newRoles, removedRoles } });
+        return { changed, newRoles, removedRoles };
+    }
     /** Names of the orgs this daemon currently has running. Snapshot — safe to
      *  iterate while stopOrg() mutates the underlying map. */
     listRunning() { return [...this.orgs.keys()]; }
+    /** Hook for the SSE server — registers a listener for all bus events across all orgs. */
+    onBusEvent = (fn) => { this.subscribe(fn); };
+    /** Snapshot of all running orgs for dashboard initial load. */
+    getStatusSnapshot = () => {
+        const orgs = [];
+        for (const [name, running] of this.orgs) {
+            const roles = [];
+            for (const [roleId, agent] of running.agents) {
+                roles.push({
+                    id: roleId, status: agent.status,
+                    worktree: agent.worktreePath ?? null,
+                    metrics: agent.metrics,
+                });
+            }
+            orgs.push({
+                name, run: running.run,
+                roles,
+                pendingRoles: running.pendingRoles ? [...running.pendingRoles.keys()] : [],
+                tasks: running.taskDag?.all() ?? [],
+            });
+        }
+        return { orgs };
+    };
     /** Resolve run_config.workspace to 'repo' | 'isolated' | an absolute path.
      *  A relative path is resolved against the project root rather than the
      *  daemon's cwd, which is not the same directory when `org serve` is started
      *  from a subdirectory. */
     workspaceSetting(def) {
         const ws = def.run_config.workspace ?? 'repo';
-        if (ws === 'repo' || ws === 'isolated' || ws === 'worktree')
+        if (ws === 'repo' || ws === 'isolated' || ws === 'worktree' || ws === 'worktree-per-role')
             return ws;
         return isAbsolute(ws) ? ws : join(this.root, ws);
     }
@@ -137,11 +255,13 @@ export class OrgDaemon {
             try {
                 // Remove stale worktree from a previous run
                 if (existsSync(worktreePath)) {
-                    execSync(`git worktree remove --force "${worktreePath}"`, { cwd: this.root, stdio: 'ignore' });
+                    // R4: bound the call — a wedged git hook (git-lfs, gc lock, gpg sign
+                    // prompt) would otherwise hang the whole daemon indefinitely.
+                    execSync(`git worktree remove --force "${worktreePath}"`, { cwd: this.root, stdio: 'ignore', timeout: 30_000 });
                 }
             }
             catch { /* best-effort cleanup */ }
-            execSync(`git worktree add "${worktreePath}" HEAD --detach`, { cwd: this.root, stdio: 'ignore' });
+            execSync(`git worktree add "${worktreePath}" HEAD --detach`, { cwd: this.root, stdio: 'ignore', timeout: 30_000 });
             cwd = worktreePath;
         }
         else {
@@ -159,6 +279,19 @@ export class OrgDaemon {
         if (!process.env.MONOMIND_MAX_SDK_PROCS && getResourceLimits().maxSdkProcesses < def.roles.length) {
             configureResourceLimits({ maxSdkProcesses: def.roles.length });
         }
+        // Validate per-role providers before spawning anything (fail-fast: a
+        // missing env var discovered 10 minutes into a run wastes the entire run).
+        const { resolveProviderEnv: validateProvider } = await import('./provider.js');
+        for (const role of def.roles) {
+            if (role.provider) {
+                try {
+                    validateProvider(role.provider);
+                }
+                catch (err) {
+                    throw new Error(`org ${name}: role "${role.id}" provider validation failed — ${err instanceof Error ? err.message : err}`);
+                }
+            }
+        }
         const bus = new OrgBus(name, run, dir);
         // Lightweight in-memory tail for busEvents() (test-loop, /api/history).
         // Full events (including Write content snapshots) live on disk in bus.jsonl;
@@ -220,6 +353,7 @@ export class OrgDaemon {
             this.forwarders.set(name, attachForwarder(bus, this.opts.controlJson ?? join(this.root, '.monomind/control.json')));
         const running = { def, run, bus, agents: new Map(), busEvents: () => [...collected], workdir: cwd };
         this.orgs.set(name, running);
+        // Even-split budget; a role's own budget_tokens overrides it (roleTokenBudget).
         const perRoleBudget = Math.floor((def.run_config.budget_tokens ?? 1_000_000) / def.roles.length);
         // Single boss-selection rule for kickoff AND org_complete gating — the
         // session layer previously keyed the tool on reports_to===null while the
@@ -250,21 +384,53 @@ export class OrgDaemon {
         // scheduleDeferredSpawn() once resources free up, without re-running the
         // gate logic or duplicating the session-wiring below.
         const spawnRole = (role) => {
+            let roleCwd = cwd;
+            if (ws === 'worktree-per-role' && role.id !== bossRole.id) {
+                const wtPath = join(this.root, ORG_DIR, name, `worktree-${role.id}`);
+                try {
+                    // Q7: top-level `import { execSync }` replaces the inlined
+                    // `require('node:child_process')` that broke ESM at runtime —
+                    // vitest's CJS shim masked it in tests but the built package
+                    // threw "require is not defined" in real Node ESM execution.
+                    if (existsSync(wtPath)) {
+                        try {
+                            execSync(`git worktree remove --force "${wtPath}"`, { cwd: this.root, stdio: 'ignore', timeout: 30_000 });
+                        }
+                        catch { /* best-effort */ }
+                    }
+                    execSync(`git worktree add "${wtPath}" HEAD --detach`, { cwd: this.root, stdio: 'ignore', timeout: 30_000 });
+                    roleCwd = wtPath;
+                }
+                catch { /* fallback to shared cwd if git worktree fails */ }
+            }
             const mailbox = new Mailbox();
-            const policy = new PolicyEngine(role.id, { maxTokens: perRoleBudget, ...(role.policy ?? {}) }, bus, cwd);
-            const runtime = { mailbox, policy, status: 'running', done: Promise.resolve(), metrics: { tokens: 0, costUsd: 0 } };
+            const policy = new PolicyEngine(role.id, { maxTokens: role.budget_tokens ?? perRoleBudget, ...(role.policy ?? {}) }, bus, roleCwd);
+            const runtime = { mailbox, policy, status: 'running', done: Promise.resolve(), metrics: { tokens: 0, costUsd: 0 }, worktreePath: roleCwd !== cwd ? roleCwd : undefined, scrollback: new ScrollbackBuffer() };
             const sessionOpts = {
-                org: name, role, bus, policy, mailbox, cwd, def,
+                org: name, role, bus, policy, mailbox, cwd: roleCwd, def,
                 maxTurns: role.max_turns_per_message ?? def.run_config.max_turns_per_message,
                 lastMessageId: () => runtime.lastMessageId,
+                onOutput: (line) => runtime.scrollback.push(line),
                 deliver: (from, to, subject, body) => this.deliver(name, from, to, subject, body),
                 askHuman: (r, question) => this.askHuman(name, r, question),
+                onGate: (r, gateName, gateDesc) => this.createGate(name, r, gateName, gateDesc),
+                circuitBreaker: (() => {
+                    const cb = def.run_config.circuit_breaker;
+                    if (!cb)
+                        return undefined;
+                    return { threshold: cb.failure_threshold ?? 5, state: { failures: 0, tripped: false } };
+                })(),
                 beforeTool: (r, toolName) => this.checkApproval(name, r, toolName),
                 onComplete: role.id === bossRole.id
                     ? (r, outcome, summary) => {
                         bus.emit({ type: 'status', from: r, reason: 'org-complete', msg: `run outcome: ${outcome}`, data: { outcome, summary } });
                     }
                     : undefined,
+                // #11: a boss that overflows its context window isn't a crash (it keeps
+                // returning +0-token errors forever), so without this the idle watchdog
+                // just nudges it for ~30 min before idle-stopping. Restart the whole org
+                // with fresh sessions instead — bounded by MAX_BOSS_RESTARTS.
+                onContextLimit: role.id === bossRole.id ? () => this.scheduleBossRestart(name) : undefined,
                 recall: async (r, q) => {
                     const answer = await this.recallOrgMemory(name, def, q, r);
                     bus.emit({ type: 'status', from: r, reason: 'org-recall', msg: `recall: ${q.slice(0, 80)}`, data: { hits: answer.hits } });
@@ -289,15 +455,24 @@ export class OrgDaemon {
                     });
                     return text;
                 },
+                createTask: (r, title, assignee, deps) => {
+                    return this.dagCreateTask(name, r, title, assignee, deps);
+                },
+                completeTask: (r, taskId, result) => {
+                    return this.dagCompleteTask(name, r, taskId, result);
+                },
+                listTasks: () => {
+                    const running = this.orgs.get(name);
+                    return JSON.stringify(running?.taskDag?.all() ?? [], null, 2);
+                },
                 queryFn: this.opts.queryFn,
-                // Runner resolution: explicit > opencode/kimicode (when MONOMIND_RUNTIME
-                // selects them) > undefined (session.ts falls back to ClaudeAgentRunner
-                // via queryFn). Leaving it undefined for the default path is what keeps
-                // Claude/Antigravity orgs byte-for-byte unchanged.
-                runner: this.opts.runner
-                    ?? (process.env.MONOMIND_RUNTIME === 'opencode' ? new OpencodeAgentRunner()
-                        : process.env.MONOMIND_RUNTIME === 'kimicode' ? new KimiCodeAgentRunner()
-                            : undefined),
+                // Runner resolution: explicit opts.runner > role `runtime` field >
+                // org def `runtime` field > MONOMIND_RUNTIME env (opencode/kimicode) >
+                // undefined (session.ts falls back to ClaudeAgentRunner via queryFn).
+                // Leaving it undefined for the default path is what keeps
+                // Claude/Antigravity orgs byte-for-byte unchanged. Session opts are
+                // built per role here in spawnRole, so each role gets its own runner.
+                runner: this.opts.runner ?? resolveRoleRunner(role.runtime, def.runtime),
             };
             // Supervised session: transient crashes (provider blips, network) restart
             // with backoff; a crash with the mailbox already closed, or one that
@@ -413,6 +588,7 @@ export class OrgDaemon {
         }
         running.pendingRoles = pendingRoles;
         running.spawnRole = spawnRole;
+        running.taskDag = new TaskDag();
         if (worktreePath)
             running.worktreePath = worktreePath;
         // Crash cleanup: reap SDK children if this process exits abnormally.
@@ -429,6 +605,25 @@ export class OrgDaemon {
         };
         process.on('exit', crashCleanup);
         running._crashCleanup = crashCleanup;
+        // Stale-base drift detection: if the working tree is too many commits behind
+        // its tracking branch, warn or refuse to start. Best-effort — git may not be
+        // available, or the repo may have no tracking branch.
+        const staleThreshold = def.run_config.stale_base_threshold;
+        if (staleThreshold && staleThreshold > 0 && cwd === this.root) {
+            try {
+                const { execSync } = await import('node:child_process');
+                const behind = execSync('git rev-list --count HEAD..@{upstream} 2>/dev/null', { cwd, encoding: 'utf8', timeout: 10_000 }).trim();
+                const count = parseInt(behind, 10);
+                if (!isNaN(count) && count > staleThreshold) {
+                    bus.emit({
+                        type: 'audit', reason: 'stale-base',
+                        msg: `working tree is ${count} commits behind upstream (threshold: ${staleThreshold}) — consider pulling before running`,
+                        data: { behind: count, threshold: staleThreshold },
+                    });
+                }
+            }
+            catch { /* no upstream tracking or git unavailable — skip silently */ }
+        }
         const boss = bossRole;
         // Cross-run memory: brief the coordinator on the previous run so scheduled
         // orgs accumulate instead of starting cold every interval.
@@ -462,6 +657,10 @@ export class OrgDaemon {
             const wd = setInterval(() => {
                 if (this.restarting.has(name))
                     return; // boss auto-restart in flight — don't nudge or stop
+                // A pending gate means the org is legitimately waiting for human input
+                const pendingGates = this.readGates(name).gates.filter(g => g.status === 'pending');
+                if (pendingGates.length > 0)
+                    return;
                 const idleFor = Date.now() - lastActivity;
                 if (idleFor < idleMs) {
                     nudgedAt = 0;
@@ -518,540 +717,12 @@ export class OrgDaemon {
             bus.emit({ type: 'status', msg: `drained ${queued.length} queued message(s) from inbox` });
         return running;
     }
-    /** A role that failed its resource gate at boot isn't abandoned — keep polling
-     *  for capacity in the background (bounded) and spawn it the moment resources
-     *  free up, instead of silently running the org shorthanded for its whole life.
-     *  Bails quietly if the org is stopped (or restarted under the same name)
-     *  before capacity returns; `running` is compared by identity, not `name`,
-     *  so a stale retry can never spawn into a different run. */
-    scheduleDeferredSpawn(name, running, role, spawnRole) {
-        const MAX_ATTEMPTS = 6; // ~30 min of retrying before giving up loudly
-        (async () => {
-            for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-                const waited = await waitForCapacity(5 * 60_000);
-                if (this.orgs.get(name) !== running)
-                    return; // org stopped/restarted — abandon quietly
-                if (waited.ok) {
-                    running.bus.emit({ type: 'audit', from: role.id, reason: 'resource-recovered',
-                        msg: `resources recovered after ${attempt} retr${attempt === 1 ? 'y' : 'ies'} — spawning deferred role "${role.id}"` });
-                    // Drain messages queued while the role was deferred BEFORE spawning
-                    // to prevent race condition where messages arrive during spawn window
-                    const queued = drainInbox(this.root, name);
-                    spawnRole(role);
-                    for (const msg of queued) {
-                        const agent = running.agents.get(msg.toRole);
-                        if (agent && !agent.mailbox.isClosed) {
-                            running.bus.emit({ type: 'xorg', from: msg.fromQualified, to: `${name}:${msg.toRole}`, subject: msg.subject, msg: msg.body });
-                            agent.mailbox.push(this.mailBody(name, running, `[message from ${msg.fromQualified}] subject: ${msg.subject}`, msg.body, `inbox-${msg.ts}-${Math.random().toString(36).slice(2, 8)}`));
-                        }
-                    }
-                    return;
-                }
-                running.bus.emit({ type: 'audit', from: role.id, reason: 'resource-pressure',
-                    msg: `still under pressure (attempt ${attempt}/${MAX_ATTEMPTS}) — retrying "${role.id}" spawn: ${waited.reason}` });
-            }
-            const missing = this.abandoned.get(name) ?? new Set();
-            missing.add(role.id);
-            this.abandoned.set(name, missing);
-            this.persistState(name, 'running', running.run);
-            running.bus.emit({ type: 'audit', from: role.id, reason: 'resource-abandoned',
-                msg: `giving up spawning "${role.id}" after ${MAX_ATTEMPTS} retries — org will run without this role until manually restarted` });
-        })().catch(err => console.error(`org ${name}: deferred spawn of "${role.id}" failed:`, err instanceof Error ? err.message : err));
-    }
-    /**
-     * Resolves an org_send `to` address ("role" for same-org, "org:role" for
-     * cross-org) into its parts. Centralizes the one addressing rule that
-     * matters (an "own-org:role" self-prefix is intra-org, not cross-org) so
-     * deliver()/deliverRemote() don't each re-derive it — the qualified `to`
-     * string returned is always the canonical display form for that address.
-     */
-    resolveAddress(fromOrg, to) {
-        const cross = to.includes(':');
-        if (!cross)
-            return { cross: false, orgName: fromOrg, role: to, qualified: to };
-        const [orgName, role] = to.split(':', 2);
-        if (orgName === fromOrg)
-            return { cross: false, orgName, role, qualified: role }; // self-prefixed — still intra-org
-        return { cross: true, orgName, role, qualified: to };
-    }
-    /** Mailbox bodies are unbounded — a pasted 20KB file would persist in the
-     *  recipient's context for the whole run. Bodies over MAIL_BODY_MAX are
-     *  written to <org workdir>/.mail/<message-id>.md and replaced with a ~1KB
-     *  digest plus a pointer; smaller messages stay byte-identical. */
-    mailBody(orgName, org, header, body, id) {
-        if (body.length <= MAIL_BODY_MAX)
-            return `${header}\n\n${body}`;
-        const mailDir = join(org?.workdir ?? join(this.root, ORG_DIR, orgName), '.mail');
-        const file = join(mailDir, `${id.replace(/[^a-zA-Z0-9_-]/g, '_')}.md`);
-        try {
-            mkdirSync(mailDir, { recursive: true });
-            writeFileSync(file, body);
-            return `${header}\n\n${body.slice(0, MAIL_DIGEST_CHARS)}\n\n[... truncated — full text at ${file} — Read it if needed]`;
-        }
-        catch {
-            return `${header}\n\n${body}`; // digest write failed — deliver in full rather than lose content
-        }
-    }
-    /** Route a message. to = "role" (same org) or "org:role" (cross-org). Returns a receipt string. */
-    async deliver(fromOrg, fromRole, to, subject, body) {
-        const { cross, orgName: targetOrgName, role: targetRole, qualified: toQualified } = this.resolveAddress(fromOrg, to);
-        const targetOrg = this.orgs.get(targetOrgName);
-        const src = this.orgs.get(fromOrg);
-        // Lazy spawn: if the role is pending (not yet spawned), spawn it now.
-        // ATOMIC GUARD: Check spawning Set to prevent duplicate spawns from concurrent messages
-        const spawning = this.spawning.get(targetOrgName) ?? new Set();
-        this.spawning.set(targetOrgName, spawning);
-        if (targetOrg && !targetOrg.agents.has(targetRole) && targetOrg.pendingRoles?.has(targetRole) && !spawning.has(targetRole)) {
-            const role = targetOrg.pendingRoles.get(targetRole);
-            targetOrg.pendingRoles.delete(targetRole);
-            spawning.add(targetRole); // Mark as spawning before async work
-            const check = checkResources();
-            if (!check.ok) {
-                const waited = await waitForCapacity(60_000);
-                spawning.delete(targetRole); // Clear spawning flag after check
-                if (!waited.ok) {
-                    targetOrg.bus.emit({ type: 'audit', from: targetRole, reason: 'resource-skip',
-                        msg: `deferring lazy spawn of "${targetRole}": ${waited.reason}` });
-                    // Queue the triggering message so it survives the deferred spawn — without
-                    // this the sender got "queued" but the message was silently lost.
-                    // B5 FIX: Queue FIRST, then schedule spawn only if queue succeeds.
-                    // If queueing fails, we return the error without modifying spawn state.
-                    const queued = queueMessage(this.root, targetOrgName, {
-                        fromQualified: cross ? `${fromOrg}:${fromRole}` : fromRole,
-                        toRole: targetRole, subject, body, ts: Date.now(),
-                    });
-                    if (!queued) {
-                        src?.bus.emit({ type: 'audit', from: fromRole, to: toQualified, msg: `queue failed: ${subject}`, reason: 'queue-failed' });
-                        return `ERROR: could not queue message for ${toQualified} (disk full or permissions)`;
-                    }
-                    this.scheduleDeferredSpawn(targetOrgName, targetOrg, role, targetOrg.spawnRole);
-                    return `queued for ${toQualified} (role starting — waiting for resources)`;
-                }
-            }
-            targetOrg.spawnRole(role);
-            spawning.delete(targetRole); // Clear spawning flag after spawn completes
-            targetOrg.bus.emit({ type: 'status', from: targetRole, msg: `lazy-spawned on first message from ${fromRole}` });
-        }
-        if (!targetOrg || !targetOrg.agents.has(targetRole)) {
-            if (cross && this.opts.crossProcess)
-                return this.deliverRemote(fromOrg, fromRole, targetOrgName, targetRole, toQualified, subject, body, src);
-            // Queue + auto-wake: if the org definition exists locally but isn't running, spool the message and start it
-            if (cross && this.hasOrgDef(targetOrgName)) {
-                const queued = queueMessage(this.root, targetOrgName, { fromQualified: `${fromOrg}:${fromRole}`, toRole: targetRole, subject, body, ts: Date.now() });
-                if (!queued) {
-                    src?.bus.emit({ type: 'audit', from: fromRole, to: toQualified, msg: `queue failed: ${subject}`, reason: 'queue-failed' });
-                    return `ERROR: could not queue message for ${toQualified} (disk full or permissions)`;
-                }
-                src?.bus.emit({ type: 'xorg', from: `${fromOrg}:${fromRole}`, to: toQualified, subject, msg: body, data: { queued: true } });
-                this.autoWake(targetOrgName);
-                return `queued for ${toQualified} (org starting)`;
-            }
-            src?.bus.emit({ type: 'audit', from: fromRole, to: toQualified, msg: `undeliverable: ${subject}`, reason: 'unknown recipient' });
-            return `ERROR: unknown recipient "${toQualified}" (known: ${[...(targetOrg?.agents.keys() ?? this.orgs.keys())].join(', ')})`;
-        }
-        const targetAgent = targetOrg.agents.get(targetRole);
-        if (targetAgent.status === 'crashed') {
-            src?.bus.emit({ type: 'audit', from: fromRole, to: toQualified, msg: `undeliverable: ${subject}`, reason: 'recipient crashed (retry budget exhausted)' });
-            return `ERROR: recipient "${toQualified}" crashed and will not recover this run — message not delivered (${targetAgent.error ?? 'unknown error'})`;
-        }
-        if (targetAgent.mailbox.isClosed) {
-            // Distinguish two cases that used to share one drop:
-            //  - org mid-shutdown: nothing will ever read the queue again — the
-            //    message genuinely can't be delivered, so report the real outcome.
-            //  - agent session ended but the org is alive (budget exhaustion,
-            //    turn limit, crash-restart in flight): the result is still
-            //    valuable, so persist it to the inbox. The boss-restart/next-run
-            //    drainInbox will deliver it instead of the work vanishing.
-            if (this.stopping.has(targetOrgName)) {
-                src?.bus.emit({ type: 'audit', from: fromRole, to: toQualified, msg: `undeliverable: ${subject}`, reason: 'target mailbox closed (org shutting down)' });
-                return `ERROR: recipient "${toQualified}" is shutting down — message not delivered`;
-            }
-            const q = queueMessage(this.root, targetOrgName, { fromQualified: `${fromOrg}:${fromRole}`, toRole: targetRole, subject, body, ts: Date.now() });
-            src?.bus.emit({ type: 'audit', from: fromRole, to: toQualified, msg: `recipient session closed — queued to inbox: ${subject}`, data: { queued: q } });
-            return `queued to inbox for ${toQualified} (recipient session closed; will be delivered on restart)`;
-        }
-        // Track message chain: link this message to the target's last message (the one being responded to)
-        const targetAgentSrc = targetOrg === src ? src?.agents.get(targetRole) : undefined;
-        const parentId = targetAgentSrc?.lastMessageId;
-        const evt = { from: cross ? `${fromOrg}:${fromRole}` : fromRole, to: toQualified, subject, msg: body, parentId };
-        const emitted = src?.bus.emit({ type: cross ? 'xorg' : 'message', ...evt });
-        if (cross && targetOrg !== src)
-            targetOrg.bus.emit({ type: 'xorg', ...evt });
-        // Store message ID for the target (so responses can link to it)
-        if (targetAgentSrc && emitted)
-            targetAgentSrc.lastMessageId = emitted.id;
-        // Also track the source agent's last sent message for cross-org visibility
-        const srcAgent = src?.agents.get(fromRole);
-        if (srcAgent && emitted)
-            srcAgent.lastMessageId = emitted.id;
-        targetAgent.mailbox.push(this.mailBody(targetOrgName, targetOrg, `[message from ${evt.from}] subject: ${subject}`, body, emitted?.id ?? `mail-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`));
-        return `delivered to ${toQualified}`;
-    }
-    /** Cross-process leg of deliver(): ask the machine-local broker who hosts targetOrgName, then POST over HTTP.
-     *  `to` here is always the fully-qualified "org:role" display form (resolveAddress already normalized it). */
-    async deliverRemote(fromOrg, fromRole, targetOrgName, targetRole, to, subject, body, src) {
-        const remote = lookupOrg(targetOrgName, this.opts.brokerDir);
-        if (!remote) {
-            // No remote host either — queue + auto-wake if the org def exists locally
-            if (this.hasOrgDef(targetOrgName)) {
-                const queued = queueMessage(this.root, targetOrgName, { fromQualified: `${fromOrg}:${fromRole}`, toRole: targetRole, subject, body, ts: Date.now() });
-                if (!queued) {
-                    src?.bus.emit({ type: 'audit', from: fromRole, to, msg: `queue failed: ${subject}`, reason: 'queue-failed' });
-                    return `ERROR: could not queue message for ${to} (disk full or permissions)`;
-                }
-                src?.bus.emit({ type: 'xorg', from: `${fromOrg}:${fromRole}`, to, subject, msg: body, data: { queued: true } });
-                this.autoWake(targetOrgName);
-                return `queued for ${to} (org starting)`;
-            }
-            src?.bus.emit({ type: 'audit', from: fromRole, to, msg: `undeliverable: ${subject}`, reason: 'unknown recipient' });
-            return `ERROR: unknown recipient "${to}" (no local org, and no process on this machine has org "${targetOrgName}" registered)`;
-        }
-        try {
-            const res = await fetch(`${remote.url}/api/xdeliver`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    ...(remote.credential ? { 'x-monomind-cred': remote.credential } : {}),
-                },
-                body: JSON.stringify({ fromOrg, fromRole, toOrg: targetOrgName, toRole: targetRole, subject, body }),
-                signal: AbortSignal.timeout(10_000),
-            });
-            const data = await res.json().catch(() => ({}));
-            if (res.ok && data.ok) {
-                src?.bus.emit({ type: 'xorg', from: `${fromOrg}:${fromRole}`, to, subject, msg: body });
-                return data.receipt ?? `delivered to ${to} (remote)`;
-            }
-            src?.bus.emit({ type: 'audit', from: fromRole, to, msg: `remote delivery rejected: ${data.error ?? res.status}`, reason: 'remote-delivery-rejected' });
-            return `ERROR: remote org "${to}" rejected delivery: ${data.error ?? res.status}`;
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            src?.bus.emit({ type: 'audit', from: fromRole, to, msg: `remote delivery failed: ${message}`, reason: 'remote-delivery-failed' });
-            return `ERROR: remote org "${targetOrgName}" unreachable: ${message}`;
-        }
-    }
-    /** Inbound handler for cross-process delivery — called by the server's POST /api/xdeliver route
-     *  when ANOTHER process's deliverRemote() reaches this daemon. Pushes straight into the target
-     *  agent's mailbox; the agent picks it up on its own next turn (see Mailbox — never interrupts). */
-    receiveRemote(toOrg, toRole, fromQualified, subject, body) {
-        const org = this.orgs.get(toOrg);
-        if (!org) {
-            // Org not running — queue the message and auto-wake if the def exists
-            if (this.hasOrgDef(toOrg)) {
-                const queued = queueMessage(this.root, toOrg, { fromQualified, toRole, subject, body, ts: Date.now() });
-                if (!queued) {
-                    return { ok: false, error: `could not queue message for ${toOrg}:${toRole} (disk full or permissions)` };
-                }
-                this.autoWake(toOrg);
-                return { ok: true, receipt: `queued for ${toOrg}:${toRole} (org waking)` };
-            }
-            return { ok: false, error: `org "${toOrg}" not hosted here` };
-        }
-        // Lazy-spawn pending roles on cross-process delivery (matches deliver/answerQuestion)
-        // ATOMIC GUARD: Check spawning Set to prevent duplicate spawns from concurrent messages
-        const spawning = this.spawning.get(toOrg) ?? new Set();
-        this.spawning.set(toOrg, spawning);
-        if (!org.agents.has(toRole) && org.pendingRoles?.has(toRole) && !spawning.has(toRole)) {
-            const role = org.pendingRoles.get(toRole);
-            org.pendingRoles.delete(toRole);
-            spawning.add(toRole); // Mark as spawning before async work
-            // Resource gate check before spawning (prevents bypass in cross-process delivery)
-            const check = checkResources();
-            if (!check.ok) {
-                spawning.delete(toRole); // Clear spawning flag after check
-                org.bus.emit({ type: 'audit', from: toRole, reason: 'resource-pressure',
-                    msg: `cross-process lazy spawn deferred: ${check.reason}` });
-                // B4 FIX: Queue the triggering message FIRST, then schedule spawn only if queue succeeds.
-                // This matches the pattern in deliver() and prevents message loss if queue fails.
-                const queued = queueMessage(this.root, toOrg, { fromQualified, toRole, subject, body, ts: Date.now() });
-                if (!queued) {
-                    return { ok: false, error: `could not queue message for ${toOrg}:${toRole} (disk full or permissions)` };
-                }
-                this.scheduleDeferredSpawn(toOrg, org, role, org.spawnRole);
-                return { ok: true, receipt: `queued for ${toOrg}:${toRole} (role starting — waiting for resources)` };
-            }
-            org.spawnRole?.(role);
-            spawning.delete(toRole); // Clear spawning flag after spawn completes
-            org.bus.emit({ type: 'status', from: toRole, msg: `lazy-spawned on remote delivery from ${fromQualified}` });
-        }
-        const agent = org.agents.get(toRole);
-        if (!agent)
-            return { ok: false, error: `role "${toRole}" not found in org "${toOrg}"` };
-        if (agent.status === 'crashed')
-            return { ok: false, error: `role "${toRole}" in org "${toOrg}" crashed and will not recover this run` };
-        if (agent.mailbox.isClosed)
-            return { ok: false, error: `role "${toRole}" in org "${toOrg}" is shutting down` };
-        const messageEvent = org.bus.emit({ type: 'xorg', from: fromQualified, to: `${toOrg}:${toRole}`, subject, msg: body });
-        agent.lastMessageId = messageEvent.id; // Track last message ID for response threading
-        agent.mailbox.push(this.mailBody(toOrg, org, `[message from ${fromQualified}] subject: ${subject}`, body, messageEvent.id));
-        return { ok: true, receipt: `delivered to ${toOrg}:${toRole} (remote)` };
-    }
+    /** @internal */
     hasOrgDef(name) {
         if (!/^[a-z0-9][a-z0-9_-]{0,63}$/i.test(name))
             return false;
         return existsSync(join(this.root, ORG_DIR, `${name}.json`));
     }
-    questionsPath(org) {
-        return join(this.root, ORG_DIR, org, 'questions.json');
-    }
-    readQuestions(org) {
-        try {
-            return JSON.parse(readFileSync(this.questionsPath(org), 'utf8'));
-        }
-        catch {
-            return { questions: [] };
-        }
-    }
-    writeQuestions(org, data) {
-        const dest = this.questionsPath(org);
-        mkdirSync(join(this.root, ORG_DIR, org), { recursive: true });
-        const tmp = `${dest}.${process.pid}.tmp`;
-        writeFileSync(tmp, JSON.stringify(data, null, 2));
-        renameSync(tmp, dest);
-    }
-    /** Check if an action requires human approval (beforeTool hook for guardrails). Returns
-     *  the approval decision: true = approved, false = denied, null = pending (requires human input). */
-    async checkApproval(org, role, action) {
-        const approvalKey = `${org}:${role}:${action}`;
-        const pending = this.approvals.get(org) ?? [];
-        const existing = pending.find(a => a.roleId === role && a.action === action);
-        // If already approved/denied, return that decision
-        if (existing && existing.approved !== null)
-            return existing.approved;
-        // Require human approval for sensitive actions
-        const sensitiveActions = ['Bash', 'WebFetch', 'WebSearch', 'org_complete'];
-        if (sensitiveActions.includes(action)) {
-            // Queue for approval
-            if (!existing) {
-                pending.push({ roleId: role, action, question: `Approve ${action} tool call?`, ts: Date.now(), approved: null });
-                this.approvals.set(org, pending);
-            }
-            // Persist to approvals.json
-            const approvalsPath = join(this.root, ORG_DIR, org, 'approvals.json');
-            mkdirSync(join(this.root, ORG_DIR, org), { recursive: true });
-            writeFileSync(approvalsPath, JSON.stringify({ approvals: pending }, null, 2));
-            // Emit a question event for the dashboard
-            const running = this.orgs.get(org);
-            running?.bus.emit({ type: 'question', from: role, data: { question: `Approval required for ${action}`, action } });
-            return null; // Pending human approval
-        }
-        return true; // Auto-approved for non-sensitive actions
-    }
-    /** Approve or deny a pending action (called by dashboard or CLI). */
-    async setApproval(org, role, action, approved) {
-        const pending = this.approvals.get(org) ?? [];
-        const item = pending.find(a => a.roleId === role && a.action === action);
-        if (!item)
-            return { ok: false, error: `No pending approval found for ${role} action ${action}` };
-        item.approved = approved;
-        item.ts = Date.now();
-        // Persist updated approval state
-        const approvalsPath = join(this.root, ORG_DIR, org, 'approvals.json');
-        writeFileSync(approvalsPath, JSON.stringify({ approvals: pending }, null, 2));
-        // Notify the waiting agent via its mailbox
-        const running = this.orgs.get(org);
-        const agent = running?.agents.get(role);
-        if (agent && !agent.mailbox.isClosed) {
-            agent.mailbox.push(`[approval] ${action}: ${approved ? 'APPROVED' : 'DENIED'}`);
-        }
-        running?.bus.emit({ type: 'status', from: role, msg: `Approval ${approved ? 'granted' : 'denied'} for ${action}` });
-        return { ok: true };
-    }
-    /** Time-travel debugging: replay from a specific checkpoint by run ID.
-     *  Creates a fresh daemon instance and replays events from the target run's bus.jsonl. */
-    async replayFrom(name, run) {
-        const runDir = join(this.root, ORG_DIR, name, run);
-        if (!existsSync(runDir))
-            return null;
-        const busFile = join(runDir, 'bus.jsonl');
-        if (!existsSync(busFile))
-            return null;
-        // Create a replay org with a fresh run ID
-        const replayRun = `replay-${new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14)}-${Math.random().toString(36).slice(2, 6)}`;
-        const replayDir = join(this.root, ORG_DIR, name, replayRun);
-        mkdirSync(replayDir, { recursive: true });
-        // Read original events
-        const events = readFileSync(busFile, 'utf8').split('\n').filter(Boolean)
-            .map(l => { try {
-            return JSON.parse(l);
-        }
-        catch {
-            return null;
-        } })
-            .filter((e) => e !== null);
-        if (!events.length)
-            return null;
-        // Load org definition
-        const defPath = join(this.root, ORG_DIR, `${name}.json`);
-        if (!existsSync(defPath))
-            return null;
-        const def = OrgDefSchema.parse(JSON.parse(readFileSync(defPath, 'utf8')));
-        // Create replay bus
-        const bus = new OrgBus(name, replayRun, replayDir);
-        const MAX_COLLECTED = 1000;
-        const collected = [];
-        bus.subscribe(e => {
-            const slim = e.data?.content != null
-                ? { ...e, data: { ...e.data, content: undefined } }
-                : e;
-            collected.push(slim);
-            if (collected.length > MAX_COLLECTED)
-                collected.splice(0, collected.length - MAX_COLLECTED);
-            for (const fn of this.globalSubscribers)
-                fn(e);
-        });
-        const running = { def, run: replayRun, bus, agents: new Map(), busEvents: () => [...collected] };
-        // Reemit events into the replay bus with updated timestamps
-        const startTime = Date.now();
-        for (const e of events) {
-            const replayEvent = { ...e, org: name, run: replayRun, ts: startTime };
-            bus.emit(replayEvent);
-        }
-        this.orgs.set(name, running);
-        bus.emit({ type: 'status', msg: `replay started from ${run} (${events.length} events replayed)` });
-        this.persistState(name, 'running', replayRun);
-        return running;
-    }
-    /** Agent-initiated human question (ask_human tool). Persists to questions.json (survives
-     *  process/dashboard restarts) and emits a 'question' BusEvent so the dashboard's SSE
-     *  stream and global inbox pick it up in real time. Returns a receipt string for the tool call. */
-    async askHuman(org, role, question) {
-        const running = this.orgs.get(org);
-        const questionId = `q-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-        const data = this.readQuestions(org);
-        data.questions.push({ questionId, role, question, ts: Date.now(), answer: null, answeredAt: null });
-        this.writeQuestions(org, data);
-        running?.bus.emit({ type: 'question', from: role, data: { questionId, question } });
-        return `Question recorded (id ${questionId}) — a human will answer it; you'll receive the answer as a new message.`;
-    }
-    /** Delivers a human's answer to a pending ask_human question. If the org is still
-     *  running, pushes straight into the role's live mailbox (picked up on its very next
-     *  generator tick — see Mailbox.stream()). If the org has since stopped, queues the
-     *  answer via the same offline fallback deliver()/receiveRemote() already use
-     *  (inbox.ts + autoWake) and it's delivered when the org next starts.
-     *
-     *  PERSIST-AFTER-DELIVERY: questions.json is only marked answered once delivery has
-     *  actually happened (mailbox push, or the message landing in inbox.jsonl). Marking it
-     *  first meant a rejected delivery — unknown role, mailbox closed mid-shutdown, a
-     *  queueMessage that threw on a full/read-only disk — left the question recorded as
-     *  answered while nobody ever received the answer, and the `already answered` guard
-     *  then refused every retry. The answer was simply gone. The inverse failure (crash
-     *  between delivery and the write) merely re-shows the question as pending, which a
-     *  human can act on; a silently swallowed answer is not recoverable. */
-    async answerQuestion(org, role, questionId, answer) {
-        const data = this.readQuestions(org);
-        const idx = data.questions.findIndex(q => q.questionId === questionId);
-        if (idx === -1)
-            return { ok: false, error: `question "${questionId}" not found for org "${org}"` };
-        if (data.questions[idx].answer !== null)
-            return { ok: false, error: `question "${questionId}" already answered` };
-        const question = data.questions[idx].question;
-        // Applied to questions.json ONLY after the delivery below succeeds.
-        const markAnswered = () => {
-            // Re-read so a question the daemon appended (or answered) meanwhile isn't
-            // clobbered by this stale snapshot — merge by questionId, never replace.
-            const fresh = this.readQuestions(org);
-            const fIdx = fresh.questions.findIndex(q => q.questionId === questionId);
-            if (fIdx === -1)
-                fresh.questions.push({ ...data.questions[idx], answer, answeredAt: Date.now() });
-            else
-                fresh.questions[fIdx] = { ...fresh.questions[fIdx], answer, answeredAt: Date.now() };
-            this.writeQuestions(org, fresh);
-        };
-        const running = this.orgs.get(org);
-        if (running) {
-            // Org IS running — deliver or report a real error, but never fall through to the
-            // offline queue+autoWake path below: autoWake() no-ops when this.orgs already has
-            // the org (see its own guard), so a role-specific delivery failure here (mailbox
-            // closed, role unknown) would otherwise queue the answer forever with no real error
-            // and no delivery. Mirrors deliver()'s existing "shutting down" error for the same
-            // mid-shutdown-mailbox-closed race.
-            // Spawn a lazily-deferred role before giving up on it. Roles are no longer
-            // all spawned at boot, so `agents` legitimately lacks a role that simply
-            // has not been needed yet — and rejecting on that dropped the human's
-            // answer with "role not found" for a role that exists and is about to
-            // run. deliver() does the same lookup; a human answer must not be the one
-            // delivery path that cannot wake a role.
-            if (!running.agents.has(role) && running.pendingRoles?.has(role)) {
-                const pending = running.pendingRoles.get(role);
-                running.pendingRoles.delete(role);
-                running.spawnRole?.(pending);
-            }
-            const agent = running.agents.get(role);
-            if (!agent)
-                return { ok: false, error: `role "${role}" not found in org "${org}"` };
-            if (agent.mailbox.isClosed)
-                return { ok: false, error: `role "${role}" in org "${org}" is shutting down — answer not delivered` };
-            try {
-                agent.mailbox.push(`[answer from human] question: ${question}\n\nanswer: ${answer}`);
-            }
-            catch (err) {
-                return { ok: false, error: `delivery to "${role}" in org "${org}" failed — answer not recorded (${err instanceof Error ? err.message : String(err)})` };
-            }
-            markAnswered();
-            running.bus.emit({ type: 'status', from: role, msg: 'question answered', data: { questionId } });
-            return { ok: true };
-        }
-        // Org not running at all — queue for delivery on next start, matching deliver()'s
-        // existing offline fallback exactly (inbox.ts + autoWake).
-        if (!this.hasOrgDef(org))
-            return { ok: false, error: `org "${org}" not found (no saved definition)` };
-        const queued = queueMessage(this.root, org, {
-            fromQualified: 'human', toRole: role,
-            subject: `answer:${questionId}`,
-            body: `question: ${question}\n\nanswer: ${answer}`,
-            ts: Date.now(),
-        });
-        if (!queued) {
-            return { ok: false, error: `could not queue answer for org "${org}" — answer not recorded (disk full or permissions)` };
-        }
-        markAnswered();
-        this.autoWake(org);
-        return { ok: true };
-    }
-    /** Start an offline org in the background so queued messages get drained.
-     *  Fire-and-forget — errors are logged but don't propagate to the sender. */
-    autoWake(name) {
-        if (this.orgs.has(name) || this.waking.has(name))
-            return;
-        this.waking.add(name);
-        this.startOrg(name)
-            .catch(err => { console.error(`auto-wake org "${name}" failed:`, err instanceof Error ? err.message : err); })
-            .finally(() => { this.waking.delete(name); });
-    }
-    /** #4: bounded whole-org restart after the boss terminally crashes. Stops the
-     *  dead run and re-launches it with fresh sessions (shedding any bloated
-     *  context). Capped at MAX_BOSS_RESTARTS per explicit start so a crashing boss
-     *  can't loop forever; beyond the cap it gives up and lets the idle watchdog
-     *  shut the run down for a human. */
-    scheduleBossRestart(name) {
-        if (this.stopping.has(name) || this.restarting.has(name))
-            return;
-        const count = this.bossRestartCounts.get(name) ?? 0;
-        const bus = this.orgs.get(name)?.bus;
-        if (count >= OrgDaemon.MAX_BOSS_RESTARTS) {
-            bus?.emit({ type: 'audit', reason: 'boss-restart-exhausted',
-                msg: `boss crashed again after ${count} auto-restart(s) — giving up; manual restart required` });
-            return;
-        }
-        const backoffSchedule = this.opts.bossRestartBackoffMs ?? OrgDaemon.BOSS_RESTART_BACKOFF_MS;
-        const backoff = backoffSchedule[Math.min(count, backoffSchedule.length - 1)];
-        this.bossRestartCounts.set(name, count + 1);
-        this.restarting.add(name);
-        bus?.emit({ type: 'audit', reason: 'boss-restart',
-            msg: `boss crashed — auto-restarting org with fresh sessions in ${Math.round(backoff / 1000)}s (attempt ${count + 1}/${OrgDaemon.MAX_BOSS_RESTARTS})` });
-        const t = setTimeout(() => {
-            if (this.stopping.has(name)) {
-                this.restarting.delete(name);
-                return;
-            } // a manual stop won
-            this.stopOrg(name)
-                .then(() => (this.stopping.has(name) ? null : this.startOrg(name)))
-                .then(() => { this.restarting.delete(name); })
-                .catch(err => { this.restarting.delete(name); console.error(`org ${name}: boss auto-restart failed:`, err instanceof Error ? err.message : err); });
-        }, backoff);
-        t.unref?.();
-    }
     /** @param opts.drainMs how long to let in-flight agent sessions finish before
      *  reaping. Defaults to the short abort bound; the planned-completion path
      *  passes a far longer window (see COMPLETE_DRAIN_MS). */
@@ -1175,406 +846,33 @@ export class OrgDaemon {
         // Pass the org directly since we already removed it from the map.
         if (!this.orgs.has(name))
             this.persistState(name, 'stopped', org.run, org, stopCheckpoint);
-        // Clean up git worktree if one was created for this run.
-        if (org.worktreePath) {
-            try {
-                const { execSync } = await import('node:child_process');
-                execSync(`git worktree remove --force "${org.worktreePath}"`, { cwd: this.root, stdio: 'ignore' });
-            }
-            catch { /* best-effort — stale worktree can be cleaned up manually */ }
-        }
-    }
-    async stopAll() {
-        await Promise.all([
-            ...[...this.orgs.keys()].map(n => this.stopOrg(n)),
-            ...this.stopping.values(), // detached self-stops still flushing
-        ]);
-    }
-    orgMemoryNamespace(name, def) {
-        return def.run_config.memory_namespace ?? `org:${name}`;
-    }
-    /** Store dir for org cross-run memory — inside the org root so the bridge's
-     *  path guard accepts it when the daemon runs from the project (the normal
-     *  case) and test roots stay isolated. */
-    orgMemoryDbPath() {
-        return join(this.root, '.monomind', 'org-memory');
-    }
-    /** The memory bridge's traversal guard silently redirects out-of-tree paths
-     *  to the per-project default store. For an org rooted outside cwd (tests,
-     *  unusual daemon setups) that redirect would write into the WRONG project's
-     *  memory — verify the guard kept our path, and skip org memory otherwise. */
-    async orgMemoryUsable() {
+        // Clean up git worktrees — shared (workspace: 'worktree') and per-role.
         try {
-            const { bridgeGetDbPath } = await import('../memory/memory-bridge.js');
-            const want = this.orgMemoryDbPath();
-            const got = bridgeGetDbPath(want);
-            const { realpathSync } = await import('node:fs');
-            const real = (p) => { try {
-                return realpathSync(p);
-            }
-            catch {
-                return p;
-            } };
-            return real(got) === real(want);
-        }
-        catch {
-            return false;
-        }
-    }
-    /** Namespace for a role's PRIVATE memories, inside the org memory DB. */
-    agentMemoryNamespace(name, def, role) {
-        return `agent:${this.orgMemoryNamespace(name, def)}:${role}`;
-    }
-    /** org_remember implementation: a deliberate write to org-shared or
-     *  role-private memory (both in the org memory DB, split by namespace). */
-    async rememberOrgMemory(name, def, role, content, scope, run) {
-        try {
-            if (!(await this.orgMemoryUsable()))
-                return 'org memory is not available in this environment.';
-            const { bridgeStoreEntry } = await import('../memory/memory-bridge.js');
-            const namespace = scope === 'agent' ? this.agentMemoryNamespace(name, def, role) : this.orgMemoryNamespace(name, def);
-            const res = await bridgeStoreEntry({
-                key: `mem-${run}-${Date.now().toString(36)}`,
-                value: content.slice(0, 20_000),
-                namespace,
-                dbPath: this.orgMemoryDbPath(),
-                tags: [scope, role],
-                metadata: { origin_refs: [`run:${run}`], by: role },
-            });
-            if (res?.duplicate)
-                return `Already remembered (near-duplicate exists) — reinforced instead.`;
-            return res?.success ? `Remembered (${scope} scope).` : `Could not store memory${res?.error ? `: ${res.error}` : ''}.`;
-        }
-        catch (err) {
-            return `org_remember failed (${err instanceof Error ? err.message : 'error'})`;
-        }
-    }
-    /** Entry IDs served by org_recall during the current run, per org. This is
-     *  the usage record the run-outcome auto-rating consumes (cognee's
-     *  used_graph_element_ids pattern) — recall renders text to the agent, so
-     *  the IDs must be captured here or they're gone. */
-    recallUsage = new Map();
-    /** org_recall implementation: search the org's memory namespace via the
-     *  memory bridge (semantic when the local model is available, tokenized
-     *  keyword otherwise). Failures return a message, never throw into the tool. */
-    async recallOrgMemory(name, def, query, role) {
-        try {
-            if (!(await this.orgMemoryUsable()))
-                return { text: 'org memory is not available in this environment.', hits: 0 };
-            const bridge = await import('../memory/memory-bridge.js');
-            // Shared org memory plus the caller's private agent scope, merged by score.
-            const [shared, priv] = await Promise.all([
-                bridge.bridgeSearchEntries({
-                    query, namespace: this.orgMemoryNamespace(name, def), limit: 5, dbPath: this.orgMemoryDbPath(),
-                }),
-                role ? bridge.bridgeSearchEntries({
-                    query, namespace: this.agentMemoryNamespace(name, def, role), limit: 3, dbPath: this.orgMemoryDbPath(),
-                }) : null,
-            ]);
-            const results = [
-                ...(shared?.results ?? []),
-                ...(priv?.results ?? []).map(r => ({ ...r, key: `${r.key} (private)` })),
-            ].sort((a, b) => b.score - a.score).slice(0, 6);
-            if (!results.length)
-                return { text: 'No matching org memory found — this may be the first run covering this topic.', hits: 0 };
-            const ids = results.map(r => r.id).filter(Boolean);
-            let used = this.recallUsage.get(name);
-            if (!used) {
-                used = new Set();
-                this.recallUsage.set(name, used);
-            }
-            for (const id of ids)
-                used.add(id);
-            // Frequency reinforcement is immediate; the feedback rating waits for the
-            // run outcome (positive-only — see storeRunMemory).
-            bridge.bridgeRecordUsage({ entryIds: ids, dbPath: this.orgMemoryDbPath() }).catch(() => { });
-            let text = results.map((r, i) => `${i + 1}. [${r.key}] ${r.content.slice(0, 500)}`).join('\n\n');
-            // Structured knowledge: relationship triplets from the org KG, when any.
-            try {
-                const kg = await import('../memory/memory-kg.js');
-                const graph = await kg.kgSearch({ query, dbPath: this.orgMemoryDbPath(), limit: 5 });
-                if (graph.context)
-                    text += `\n\nKnowledge graph:\n${graph.context.slice(0, 1024)}`;
-            }
-            catch { /* best effort */ }
-            return { text, hits: results.length };
-        }
-        catch (err) {
-            return { text: `org memory unavailable (${err instanceof Error ? err.message : 'error'})`, hits: 0 };
-        }
-    }
-    /** knowledge_search implementation for org agents: the user's Second Brain
-     *  (this project's documents + the personal global brain), merged with the
-     *  same project-first ranking every other surface uses. Failures return a
-     *  message, never throw into the tool call. */
-    async searchProjectKnowledge(query) {
-        try {
-            const { searchKnowledge } = await import('../knowledge/document-pipeline.js');
-            const excerpts = await searchKnowledge(query, { rootDir: this.root, limit: 3, store: 'all' });
-            if (!excerpts.length)
-                return { text: 'No matching documents in the Second Brain for that query.', hits: 0 };
-            const text = excerpts.map((e, i) => `${i + 1}. [${e.filePath || 'unknown'}${e.scope === 'global' ? ' · global' : ''}] (${e.similarity.toFixed(2)})\n${e.text.slice(0, 400)}`).join('\n\n');
-            return { text, hits: excerpts.length };
-        }
-        catch (err) {
-            return { text: `knowledge search unavailable (${err instanceof Error ? err.message : 'error'})`, hits: 0 };
-        }
-    }
-    /** org_learn implementation: merge coordinator-extracted entities/relations/
-     *  rules into the org's knowledge graph (LLM extraction happens inside the
-     *  agent's own subscription-auth SDK session — no separate LLM call here). */
-    orgLearnedRuns = new Set();
-    async learnOrgKnowledge(name, run, payload) {
-        try {
-            if (!(await this.orgMemoryUsable()))
-                return 'org memory is not available in this environment.';
-            const kg = await import('../memory/memory-kg.js');
-            const dbPath = this.orgMemoryDbPath();
-            const originRef = `run:${run}`;
-            const graph = await kg.kgIngest({
-                nodes: (payload.nodes ?? []),
-                edges: (payload.edges ?? []),
-                originRef, dbPath,
-            });
-            const rules = Array.isArray(payload.rules) && payload.rules.length
-                ? await kg.kgIngestRules({ rules: payload.rules, originRef, dbPath })
-                : null;
-            this.orgLearnedRuns.add(`${name}:${run}`);
-            const parts = [
-                `entities: +${graph.nodesAdded} new, ${graph.nodesMerged} merged`,
-                `relations: +${graph.edgesAdded} new, ${graph.edgesMerged} merged`,
-            ];
-            if (rules)
-                parts.push(`rules: ${rules.accepted} accepted, ${rules.verdicts.filter(v => v.verdict === 'already_known').length} already known`);
-            return `Recorded in org knowledge graph — ${parts.join('; ')}. Rollback ref: ${originRef}.`;
-        }
-        catch (err) {
-            return `org_learn failed (${err instanceof Error ? err.message : 'error'})`;
-        }
-    }
-    /** Persist the run's outcome into cross-run org memory so org_recall (and
-     *  future runs) can find it by meaning, not just recency. Best-effort. */
-    async storeRunMemory(name, def, run, summary) {
-        try {
-            if (!(await this.orgMemoryUsable()))
-                return;
-            const { bridgeStoreEntry } = await import('../memory/memory-bridge.js');
-            const when = summary.endedAt ? new Date(summary.endedAt).toISOString().slice(0, 10) : '';
-            const lines = [
-                `Org run ${run}${when ? ` (${when})` : ''} — goal: ${def.goal}`,
-                summary.outcome
-                    ? `Outcome: ${summary.outcome.status} — ${summary.outcome.summary}`
-                    : `Outcome: not recorded (${summary.messages} messages exchanged)`,
-                summary.assets.length ? `Assets produced: ${summary.assets.slice(0, 10).join(', ')}` : '',
-                summary.crashes.length ? `Crashed agents: ${summary.crashes.join(', ')}` : '',
-            ].filter(Boolean);
-            await bridgeStoreEntry({
-                key: `run-${run}`,
-                value: lines.join('\n'),
-                namespace: this.orgMemoryNamespace(name, def),
-                dbPath: this.orgMemoryDbPath(),
-                upsert: true,
-            });
-            // Heuristic KG fallback: if the coordinator never called org_learn this
-            // run, extract lower-trust entities from the outcome summary so the
-            // graph still accumulates something. LLM-quality extraction only comes
-            // from org_learn (the agent's own session).
-            if (!this.orgLearnedRuns.delete(`${name}:${run}`)) {
+            const { execSync } = await import('node:child_process');
+            if (org.worktreePath) {
                 try {
-                    const kg = await import('../memory/memory-kg.js');
-                    const extracted = kg.heuristicExtract(lines.join('\n'), { sourceName: `run:${run}` });
-                    if (extracted.nodes.length) {
-                        await kg.kgIngest({ ...extracted, originRef: `run:${run}`, dbPath: this.orgMemoryDbPath() });
-                    }
+                    execSync(`git worktree remove --force "${org.worktreePath}"`, { cwd: this.root, stdio: 'ignore', timeout: 30_000 });
                 }
-                catch { /* best effort */ }
-            }
-            // Auto-rate the memories this run recalled — POSITIVE-ONLY: a failed run
-            // proves nothing about the recalled memories (the failure may be entirely
-            // unrelated), so failure never rates them down. Idempotent per run via
-            // the feedback ledger, so a retried stopOrg can't double-apply.
-            const used = this.recallUsage.get(name);
-            this.recallUsage.delete(name);
-            if (used?.size && summary.outcome?.status === 'achieved') {
-                const { bridgeApplyFeedback } = await import('../memory/memory-bridge.js');
-                await bridgeApplyFeedback({
-                    entryIds: [...used],
-                    score: 0.9,
-                    ledgerKey: `org-${name}-${run}`,
-                    dbPath: this.orgMemoryDbPath(),
-                }).catch(() => { });
+                catch { /* best-effort */ }
             }
-        }
-        catch (err) {
-            if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-                console.error(`org ${name}: run memory store failed:`, err instanceof Error ? err.message : err);
-        }
-    }
-    /** Resume a previous run from its checkpoint (runtime.json state). Reconstructs
-     *  the org's agents and mailboxes from the persisted state, enabling time-travel
-     *  debugging and run recovery after crashes. Returns the resumed RunningOrg or null.
-     *  Pattern 3: Full state restoration including mailbox queues, policy counters,
-     *  and session state with TTL and validation. */
-    async resumeOrg(name) {
-        const rtPath = join(this.root, ORG_DIR, name, 'runtime.json');
-        if (!existsSync(rtPath)) {
-            console.error('resumeOrg failed: runtime.json missing for', name);
-            return null;
-        }
-        let rt;
-        try {
-            rt = JSON.parse(readFileSync(rtPath, 'utf8'));
-        }
-        catch (err) {
-            console.error('resumeOrg failed: invalid JSON in runtime.json for', name, err instanceof Error ? err.message : err);
-            return null;
-        }
-        // Allow resume from 'stopped' orgs - the checkpoint contains the running state to restore
-        if (!rt?.run || !rt?.checkpoint) {
-            console.error('resumeOrg failed: invalid runtime state for', name, 'status:', rt?.status, 'run:', rt?.run, 'checkpoint:', !!rt?.checkpoint);
-            return null;
-        }
-        // Pattern 3: Checkpoint TTL validation - expire stale checkpoints
-        if (rt.checkpoint && isCheckpointExpired(rt.checkpoint)) {
-            console.error('resumeOrg failed: checkpoint expired for', name, 'updated:', rt.checkpoint.updated);
-            return null;
-        }
-        // Pattern 3: Checksum validation - detect corrupted state
-        if (rt.checkpoint && !validateCheckpoint(rt.checkpoint)) {
-            console.error('resumeOrg failed: checkpoint validation failed for', name);
-            return null;
-        }
-        // Load the org definition
-        const defPath = join(this.root, ORG_DIR, `${name}.json`);
-        if (!existsSync(defPath)) {
-            console.error('resumeOrg failed: org definition missing for', name);
-            return null;
-        }
-        const def = OrgDefSchema.parse(JSON.parse(readFileSync(defPath, 'utf8')));
-        const dir = join(this.root, ORG_DIR, name, rt.run);
-        // Check if run directory exists
-        if (!existsSync(dir)) {
-            console.error('resumeOrg failed: run directory missing', dir);
-            return null;
-        }
-        // Reconstruct the bus from history
-        const bus = new OrgBus(name, rt.run, dir);
-        const MAX_COLLECTED = 1000;
-        const collected = [];
-        bus.subscribe(e => {
-            const slim = e.data?.content != null
-                ? { ...e, data: { ...e.data, content: undefined } }
-                : e;
-            collected.push(slim);
-            if (collected.length > MAX_COLLECTED)
-                collected.splice(0, collected.length - MAX_COLLECTED);
-            for (const fn of this.globalSubscribers)
-                fn(e);
-        });
-        const running = { def, run: rt.run, bus, agents: new Map(), busEvents: () => [...collected] };
-        // Pattern 3: Full checkpoint restoration - reconstruct agents with complete state
-        if (rt.checkpoint) {
-            const checkpoint = rt.checkpoint;
-            // Reconstruct each role from checkpoint state
-            for (const [roleId, roleState] of Object.entries(checkpoint.roleState)) {
-                const role = def.roles.find(r => r.id === roleId);
-                if (!role)
-                    continue; // Role no longer exists in org definition
-                const mailbox = new Mailbox();
-                const perRoleBudget = Math.floor((def.run_config.budget_tokens ?? 1_000_000) / def.roles.length);
-                const policy = new PolicyEngine(roleId, { maxTokens: perRoleBudget, ...(role.policy ?? {}) }, bus, this.root);
-                const runtime = {
-                    mailbox,
-                    policy,
-                    status: roleState.status,
-                    done: Promise.resolve(),
-                    metrics: { tokens: roleState.tokensUsed, costUsd: roleState.costUsd },
-                    lastMessageId: roleState.lastMessageId,
-                    error: roleState.error,
-                };
-                // Pattern 3: Restore mailbox queue content (not just closed state)
-                if (roleState.mailboxQueue.length > 0) {
-                    restoreMailboxQueue(runtime, roleState.mailboxQueue);
-                }
-                // Pattern 3: Restore mailbox closed state
-                if (roleState.mailboxClosed) {
-                    mailbox.close();
-                }
-                // Pattern 3: Restore policy usage counters
-                if (roleState.tokensUsed > 0) {
-                    policy.setUsage(roleState.tokensUsed);
-                }
-                running.agents.set(roleId, runtime);
-            }
-            // Set up pending roles for lazy spawn (roles not in checkpoint)
-            const reconstructedRoles = new Set(Object.keys(checkpoint.roleState));
-            const pendingRoles = new Map();
-            for (const role of def.roles) {
-                if (!reconstructedRoles.has(role.id)) {
-                    pendingRoles.set(role.id, role);
+            for (const agent of org.agents.values()) {
+                if (agent.worktreePath) {
+                    try {
+                        execSync(`git worktree remove --force "${agent.worktreePath}"`, { cwd: this.root, stdio: 'ignore', timeout: 30_000 });
+                    }
+                    catch { /* best-effort */ }
                 }
             }
-            if (pendingRoles.size > 0) {
-                running.pendingRoles = pendingRoles;
-            }
         }
-        // Restore abandoned roles tracking
-        if (rt.abandonedRoles) {
-            this.abandoned.set(name, new Set(rt.abandonedRoles));
-        }
-        this.orgs.set(name, running);
-        bus.emit({ type: 'status', msg: `org resumed from checkpoint (${rt.run})` });
-        this.persistState(name, 'running', rt.run);
-        return running;
+        catch { /* node:child_process unavailable — skip */ }
     }
-    /** Create a branch from a checkpoint for "what-if" experiments */
-    branchCheckpoint(name, run, branchName) {
-        const runDir = join(this.root, ORG_DIR, name, run);
-        if (!existsSync(runDir)) {
-            return { ok: false, error: `run ${run} not found for org ${name}` };
-        }
-        const branchRun = `branch-${new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14)}-${Math.random().toString(36).slice(2, 6)}`;
-        const branchDir = join(this.root, ORG_DIR, name, branchRun);
-        try {
-            mkdirSync(branchDir, { recursive: true });
-            // Copy bus.jsonl to branch
-            const busFile = join(runDir, 'bus.jsonl');
-            if (existsSync(busFile)) {
-                const busContent = readFileSync(busFile, 'utf8');
-                writeFileSync(join(branchDir, 'bus.jsonl'), busContent);
-            }
-            // Create branch marker file
-            writeFileSync(join(branchDir, '.branch-source'), JSON.stringify({ from: run, branchedAt: new Date().toISOString() }));
-            return { ok: true, branchRun };
-        }
-        catch (err) {
-            return { ok: false, error: `failed to create branch: ${err instanceof Error ? err.message : String(err)}` };
-        }
-    }
-    /** Record a structured decision trace for Rifft-style debugging */
-    recordDecision(org, role, decision) {
-        const running = this.orgs.get(org);
-        if (!running)
-            return;
-        running.bus.emit({
-            type: 'audit',
-            from: role,
-            reason: 'decision-trace',
-            data: {
-                decisionType: decision.type,
-                context: decision.context,
-                reasoning: decision.reasoning,
-                alternatives: decision.alternatives,
-                outcome: decision.outcome,
-                ts: new Date().toISOString()
-            },
-        });
+    async stopAll() {
+        await Promise.all([
+            ...[...this.orgs.keys()].map(n => this.stopOrg(n)),
+            ...this.stopping.values(), // detached self-stops still flushing
+        ]);
     }
-    /** Roles that never spawned, per org. An org missing a role is still reported
-     *  `running` by every status path, so the absence was visible only as one
-     *  audit line in the log — a run went 40 minutes with no tester and nothing
-     *  said so. Persisted to runtime.json so `org status` can say it out loud. */
-    abandoned = new Map();
+    /** @internal */
     persistState(name, status, run, org, checkpointOverride) {
         const p = join(this.root, ORG_DIR, name, 'runtime.json');
         const missing = [...(this.abandoned.get(name) ?? [])];
@@ -1586,11 +884,15 @@ export class OrgDaemon {
         if (running) {
             checkpoint = captureCheckpoint(running);
         }
-        writeFileSync(p, JSON.stringify({
+        // C4: writeJsonFileAtomic (tmp + rename) — a direct writeFileSync here
+        // could leave runtime.json truncated on Ctrl-C during `org stop`, which
+        // would brick every subsequent `org status` / isOrgRunning / scheduler
+        // call. The state files in 6 other daemon paths already use this helper.
+        writeJsonFileAtomic(p, {
             status, run, pid: process.pid, updated: new Date().toISOString(),
             ...(missing.length ? { abandonedRoles: missing } : {}),
             ...(checkpoint ? { checkpoint } : {}),
-        }, null, 2));
+        });
     }
     /** Mark every currently-running org as crashed in runtime.json.
      *  Called from process-level crash handlers — must be synchronous and best-effort. */
@@ -1598,10 +900,12 @@ export class OrgDaemon {
         for (const [name, org] of this.orgs) {
             try {
                 const p = join(this.root, ORG_DIR, name, 'runtime.json');
-                writeFileSync(p, JSON.stringify({
+                // C4: atomic write — crash handler is the most likely place to hit
+                // a partial write since the process is mid-teardown.
+                writeJsonFileAtomic(p, {
                     status: 'crashed', run: org.run, pid: process.pid,
                     updated: new Date().toISOString(), closedBy: 'crash-handler',
-                }, null, 2));
+                });
             }
             catch { /* best effort — filesystem may be unavailable */ }
         }
@@ -1615,10 +919,12 @@ export class OrgDaemon {
         try {
             const p = this.heartbeatPath();
             mkdirSync(join(this.root, '.monomind'), { recursive: true });
-            writeFileSync(p, JSON.stringify({
+            // C4: atomic write — heartbeat corruption is how `org status` reports
+            // a phantom daemon after a crash.
+            writeJsonFileAtomic(p, {
                 pid: process.pid, updatedAt: new Date().toISOString(),
                 running: this.listRunning(),
-            }, null, 2));
+            });
         }
         catch { /* best effort */ }
     }
@@ -1628,5 +934,89 @@ export class OrgDaemon {
         }
         catch { /* already gone or never written */ }
     }
+    // ── Delegated methods — extracted to focused modules ──────────────────
+    // approvals.ts
+    checkApproval(org, role, action) {
+        return approvalOps.checkApproval(this, org, role, action);
+    }
+    async setApproval(org, role, action, approved) {
+        return approvalOps.setApproval(this, org, role, action, approved);
+    }
+    // questions.ts
+    async askHuman(org, role, question) {
+        return questionOps.askHuman(this, org, role, question);
+    }
+    async answerQuestion(org, role, questionId, answer) {
+        return questionOps.answerQuestion(this, org, role, questionId, answer);
+    }
+    // decisions.ts
+    readGates(org) {
+        return decisionOps.readGates(this.root, org);
+    }
+    async createGate(org, role, name, description) {
+        return decisionOps.createGate(this, org, role, name, description);
+    }
+    async resolveGate(org, gateId, approved, resolution, resolvedBy) {
+        return decisionOps.resolveGate(this, org, gateId, approved, resolution, resolvedBy);
+    }
+    listGates(org, status) {
+        return decisionOps.listGates(this, org, status);
+    }
+    dagCreateTask(org, role, title, assignee, deps) {
+        return decisionOps.dagCreateTask(this, org, role, title, assignee, deps);
+    }
+    dagCompleteTask(org, role, taskId, result) {
+        return decisionOps.dagCompleteTask(this, org, role, taskId, result);
+    }
+    recordDecision(org, role, decision) {
+        decisionOps.recordDecision(this, org, role, decision);
+    }
+    // cross-org.ts
+    async deliver(fromOrg, fromRole, to, subject, body) {
+        return crossOrg.deliver(this, fromOrg, fromRole, to, subject, body);
+    }
+    receiveRemote(toOrg, toRole, fromQualified, subject, body) {
+        return crossOrg.receiveRemote(this, toOrg, toRole, fromQualified, subject, body);
+    }
+    mailBody(orgName, org, header, body, id) {
+        return crossOrg.mailBody(this.root, orgName, org, header, body, id);
+    }
+    // scheduler-integration.ts
+    /** @internal */
+    autoWake(name) { scheduler.autoWake(this, name); }
+    scheduleBossRestart(name) { scheduler.scheduleBossRestart(this, name); }
+    /** @internal */
+    scheduleDeferredSpawn(name, running, role, spawnRole) {
+        scheduler.scheduleDeferredSpawn(this, name, running, role, spawnRole);
+    }
+    // org-memory.ts
+    orgMemoryNamespace(name, def) { return orgMemory.orgMemoryNamespace(name, def); }
+    orgMemoryDbPath() { return orgMemory.orgMemoryDbPath(this.root); }
+    orgMemoryUsable() { return orgMemory.orgMemoryUsable(this.root); }
+    async rememberOrgMemory(name, def, role, content, scope, run) {
+        return orgMemory.rememberOrgMemory(this.root, name, def, role, content, scope, run);
+    }
+    async recallOrgMemory(name, def, query, role) {
+        return orgMemory.recallOrgMemory(this, name, def, query, role);
+    }
+    async searchProjectKnowledge(query) {
+        return orgMemory.searchProjectKnowledge(this.root, query);
+    }
+    async learnOrgKnowledge(name, run, payload) {
+        return orgMemory.learnOrgKnowledge(this, name, run, payload);
+    }
+    async storeRunMemory(name, def, run, summary) {
+        return orgMemory.storeRunMemory(this, name, def, run, summary);
+    }
+    // checkpoint-ops.ts
+    async replayFrom(name, run) {
+        return checkpointOps.replayFrom(this, name, run);
+    }
+    async resumeOrg(name) {
+        return checkpointOps.resumeOrg(this, name);
+    }
+    branchCheckpoint(name, run, branchName) {
+        return checkpointOps.branchCheckpoint(this, name, run, branchName);
+    }
 }
 //# sourceMappingURL=daemon.js.map