@openrig/cli 0.5.0 → 0.5.1

package/daemon/dist/startup.d.ts

@@ -2,6 +2,7 @@ import type { Hono } from "hono";
 import type Database from "better-sqlite3";
 import type { ExecFn } from "./adapters/tmux.js";
 import type { CmuxTransportFactory } from "./adapters/cmux.js";
+import { type SlowOperationInstrumentation } from "./domain/slow-op-recorder.js";
 import { type AppDeps } from "./server.js";
 interface DaemonOptions {
     dbPath?: string;
@@ -9,6 +10,8 @@ interface DaemonOptions {
     cmuxExec?: ExecFn;
     cmuxFactory?: CmuxTransportFactory;
     cmuxTimeoutMs?: number;
+    tmuxOptionPlatform?: NodeJS.Platform;
+    slowOpRecorder?: SlowOperationInstrumentation;
     /**
      * PL-005 Phase B: bearer token for Mission Control write verbs.
      * When null, the auth-bearer-token middleware passes through (the

package/daemon/dist/startup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA4F/D,OAAO,EAA0B,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAuFnE,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,UAAU,YAAY;IACpB,GAAG,EAAE,IAAI,CAAC;IACV,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,6BAA6B,EAAE,cAAc,CAAC;IAErE,gBAAgB,EAAE,OAAO,gCAAgC,EAAE,gBAAgB,CAAC;IAE5E,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC;CACxC;AAqBD,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAm4C9E"}
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA0E/D,OAAO,EAAkB,KAAK,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AA8BjG,OAAO,EAA0B,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAgCnE,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACrC,cAAc,CAAC,EAAE,4BAA4B,CAAC;IAC9C;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,UAAU,YAAY;IACpB,GAAG,EAAE,IAAI,CAAC;IACV,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,6BAA6B,EAAE,cAAc,CAAC;IAErE,gBAAgB,EAAE,OAAO,gCAAgC,EAAE,gBAAgB,CAAC;IAE5E,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC;CACxC;AAqBD,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAklD9E"}

package/daemon/dist/startup.js

@@ -1,11 +1,13 @@
 import { createDb } from "./db/connection.js";
 import { migrate } from "./db/migrate.js";
-import { coreSchema } from "./db/migrations/001_core_schema.js";
-import { bindingsSessionsSchema } from "./db/migrations/002_bindings_sessions.js";
-import { eventsSchema } from "./db/migrations/003_events.js";
+// P8: apply the CANONICAL migration list — the single source of truth (db/all-migrations.ts),
+// never an inline copy that can drift out of sync with the daemon's schema.
+import { ALL_MIGRATIONS } from "./db/all-migrations.js";
 import { RigRepository } from "./domain/rig-repository.js";
 import { SessionRegistry } from "./domain/session-registry.js";
 import { isHumanSeatSessionRef, parseSessionName } from "./domain/session-name.js";
+import { resolveExternal } from "./domain/gateway/external-admission.js";
+import { loadHumanRegistry } from "./domain/gateway/human-registry.js";
 import { EventBus } from "./domain/event-bus.js";
 import { NodeLauncher } from "./domain/node-launcher.js";
 import { TmuxOptionDefaultsApplier } from "./domain/tmux-option-defaults.js";
@@ -50,7 +52,12 @@ import { LegacyBundleSourceResolver as BundleSourceResolver } from "./domain/bun
 import { PodBundleSourceResolver } from "./domain/bundle-source-resolver.js";
 import { PsProjectionService } from "./domain/ps-projection.js";
 import { SeatActivityService } from "./domain/seat-activity-service.js";
-import { SeatIdentityReconciler } from "./domain/seat-identity-reconciler.js";
+import { SeatStructuralActivityService } from "./domain/seat-structural-activity-service.js";
+import { SeatIdentityReconciler, reconcileSelfHostIdentity } from "./domain/seat-identity-reconciler.js";
+import { SelfHostIdentityStore } from "./domain/seat-identity-store.js";
+import { DaemonLifecycleStore } from "./domain/daemon-lifecycle-store.js";
+import { randomUUID } from "node:crypto";
+import { setSelfHostId } from "./domain/hosts/fanout-contract.js";
 import { UpCommandRouter } from "./domain/up-command-router.js";
 import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
 import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
@@ -60,8 +67,11 @@ import { SessionTransport } from "./domain/session-transport.js";
 import { AgentActivityStore } from "./domain/agent-activity-store.js";
 import { HistoryQuery } from "./domain/history-query.js";
 import { AskService } from "./domain/ask-service.js";
+import { WakeResolveService } from "./domain/wake-resolve-service.js";
 import { ChatRepository } from "./domain/chat-repository.js";
 import { StreamStore } from "./domain/stream-store.js";
+import { SlowOpRecorder } from "./domain/slow-op-recorder.js";
+import { configureSyncSiteRecorder } from "./domain/sync-site-wrap.js";
 import { QueueRepository } from "./domain/queue-repository.js";
 import { createWorkflowFrontierPredicate } from "./domain/workflow-frontier-guard.js";
 import { InboxHandler } from "./domain/inbox-handler.js";
@@ -71,6 +81,7 @@ import { ClassifierLeaseManager } from "./domain/classifier-lease-manager.js";
 import { ViewProjector } from "./domain/view-projector.js";
 import { wireViewEventBridge } from "./domain/view-event-bridge.js";
 import { WatchdogJobsRepository } from "./domain/watchdog-jobs-repository.js";
+import { WatchdogAutoRegistration } from "./domain/watchdog-auto-registration.js";
 import { WatchdogHistoryLog } from "./domain/watchdog-history-log.js";
 import { WatchdogPolicyEngine } from "./domain/watchdog-policy-engine.js";
 import { WatchdogScheduler } from "./domain/watchdog-scheduler.js";
@@ -96,64 +107,9 @@ import { execFile } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import nodePath from "node:path";
-import { snapshotsSchema } from "./db/migrations/004_snapshots.js";
-import { checkpointsSchema } from "./db/migrations/005_checkpoints.js";
-import { resumeMetadataSchema } from "./db/migrations/006_resume_metadata.js";
-import { nodeSpecFieldsSchema } from "./db/migrations/007_node_spec_fields.js";
-import { packagesSchema } from "./db/migrations/008_packages.js";
-import { installJournalSchema } from "./db/migrations/009_install_journal.js";
-import { journalSeqSchema } from "./db/migrations/010_journal_seq.js";
-import { bootstrapSchema } from "./db/migrations/011_bootstrap.js";
-import { discoverySchema } from "./db/migrations/012_discovery.js";
-import { discoveryFkFix } from "./db/migrations/013_discovery_fk_fix.js";
-import { agentspecRebootSchema } from "./db/migrations/014_agentspec_reboot.js";
-import { startupContextSchema } from "./db/migrations/015_startup_context.js";
-import { chatMessagesSchema } from "./db/migrations/016_chat_messages.js";
-import { podNamespaceSchema } from "./db/migrations/017_pod_namespace.js";
-import { contextUsageSchema } from "./db/migrations/018_context_usage.js";
-import { externalCliAttachmentSchema } from "./db/migrations/019_external_cli_attachment.js";
-import { rigServicesSchema } from "./db/migrations/020_rig_services.js";
-import { seatHandoverObservabilitySchema } from "./db/migrations/021_seat_handover_observability.js";
-import { nodeCodexConfigProfileSchema } from "./db/migrations/022_node_codex_config_profile.js";
-import { streamItemsSchema } from "./db/migrations/023_stream_items.js";
-import { queueItemsSchema } from "./db/migrations/024_queue_items.js";
-import { queueTransitionsSchema } from "./db/migrations/025_queue_transitions.js";
-import { inboxEntriesSchema } from "./db/migrations/026_inbox_entries.js";
-import { outboxEntriesSchema } from "./db/migrations/027_outbox_entries.js";
-import { projectClassificationsSchema } from "./db/migrations/028_project_classifications.js";
-import { classifierLeasesSchema } from "./db/migrations/029_classifier_leases.js";
-import { viewsCustomSchema } from "./db/migrations/030_views_custom.js";
-import { watchdogJobsSchema } from "./db/migrations/031_watchdog_jobs.js";
-import { watchdogHistorySchema } from "./db/migrations/032_watchdog_history.js";
-import { workflowSpecsSchema } from "./db/migrations/033_workflow_specs.js";
-import { workflowInstancesSchema } from "./db/migrations/034_workflow_instances.js";
-import { workflowStepTrailsSchema } from "./db/migrations/035_workflow_step_trails.js";
-import { watchdogPolicyEnumExtensionSchema } from "./db/migrations/036_watchdog_policy_enum_extension.js";
-import { missionControlActionsSchema } from "./db/migrations/037_mission_control_actions.js";
-import { workspacePrimitiveSchema } from "./db/migrations/038_workspace_primitive.js";
-import { queueTargetRepoSchema } from "./db/migrations/039_queue_target_repo.js";
 // Slice 11 (release-0.3.1 workflow-spec-folder-discovery) — adds
 // status + error_message columns to workflow_specs so the scanner
 // can record diagnostic rows. SC-29 #10 declared verbatim in commit body.
-import { workflowSpecsDiagnosticSchema } from "./db/migrations/040_workflow_specs_diagnostic.js";
-import { rigPolicySchema } from "./db/migrations/041_rig_policy.js";
-import { rigArchiveSchema } from "./db/migrations/042_rig_archive.js";
-import { resumeProvenanceSchema } from "./db/migrations/043_resume_provenance.js";
-import { queueItemSummarySchema } from "./db/migrations/044_queue_item_summary.js";
-import { resumeVerificationSchema } from "./db/migrations/045_resume_verification.js";
-import { seatIdentityVerdictsSchema } from "./db/migrations/046_seat_identity_verdicts.js";
-import { eventsNodeTypeIndexSchema } from "./db/migrations/047_events_node_type_index.js";
-import { queueItemEvidenceRefSchema } from "./db/migrations/048_queue_item_evidence_ref.js";
-import { workflowInstanceVersionSchema } from "./db/migrations/049_workflow_instance_version.js";
-import { workflowSpecJsonSchema } from "./db/migrations/050_workflow_spec_json.js";
-import { workflowResumeSchema } from "./db/migrations/051_workflow_resume.js";
-import { workflowInstanceBoundRigSchema } from "./db/migrations/052_workflow_instance_bound_rig.js";
-import { sessionsNodeIdIndexSchema } from "./db/migrations/053_sessions_node_id_index.js";
-import { queueTransitionsArchiveSchema } from "./db/migrations/054_queue_transitions_archive.js";
-import { nodePermissionPolicySchema } from "./db/migrations/055_node_permission_policy.js";
-import { rigPermissionPolicySchema } from "./db/migrations/056_rig_permission_policy.js";
-import { nodePolicyProvenanceSchema } from "./db/migrations/057_node_policy_provenance.js";
-import { rigPolicyProvenanceSchema } from "./db/migrations/058_rig_policy_provenance.js";
 import { RigPolicyStore } from "./domain/rig-policy/rig-policy-store.js";
 import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
 import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
@@ -203,12 +159,68 @@ export function collectAllowlistedProviderAuthEnv(raw, env) {
     return out;
 }
 export async function createDaemon(opts) {
+    const daemonHome = os.homedir();
+    const configuredCodexHome = process.env.CODEX_HOME;
+    if (configuredCodexHome && !nodePath.isAbsolute(configuredCodexHome)) {
+        throw new Error(`CODEX_HOME must be an absolute path for managed seats: ${configuredCodexHome}`);
+    }
+    const codexHome = configuredCodexHome || nodePath.join(daemonHome, ".codex");
     const dbPath = opts?.dbPath ?? ":memory:";
     const db = createDb(dbPath);
-    migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, inboxEntriesSchema, outboxEntriesSchema, projectClassificationsSchema, classifierLeasesSchema, viewsCustomSchema, watchdogJobsSchema, watchdogHistorySchema, workflowSpecsSchema, workflowInstancesSchema, workflowStepTrailsSchema, watchdogPolicyEnumExtensionSchema, missionControlActionsSchema, workspacePrimitiveSchema, queueTargetRepoSchema, workflowSpecsDiagnosticSchema, rigPolicySchema, rigArchiveSchema, resumeProvenanceSchema, queueItemSummarySchema, resumeVerificationSchema, seatIdentityVerdictsSchema, eventsNodeTypeIndexSchema, queueItemEvidenceRefSchema, workflowInstanceVersionSchema, workflowSpecJsonSchema, workflowResumeSchema, workflowInstanceBoundRigSchema, sessionsNodeIdIndexSchema, queueTransitionsArchiveSchema, nodePermissionPolicySchema, rigPermissionPolicySchema, nodePolicyProvenanceSchema, rigPolicyProvenanceSchema]);
+    migrate(db, ALL_MIGRATIONS);
+    // 51-09 increment 1 — establish the daemon's durable self-host identity at
+    // boot (mint on first boot, reconcile thereafter). host.name is a display-only
+    // CANDIDATE SEED (arch ruling cb19867f / DP4). Boot proceeds on a host.name
+    // conflict (the stored id is kept and the conflict is surfaced loudly).
+    const selfHost = reconcileSelfHostIdentity(new SelfHostIdentityStore(db), {
+        nowIso: new Date().toISOString(),
+        hostNameCandidate: new ContextPackSettingsStore().resolveOne("host.name").value,
+    });
+    // 51-09 increment 2 — publish the resolved self-host id so the read-through
+    // (and, in increment 4, the queue-destination validator) resolve a request
+    // addressed to THIS host's own id HOME, instead of dialing/validating it as a
+    // remote/unknown host. Distinct spelling from the 'local' sentinel.
+    setSelfHostId(selfHost.hostId);
+    // P7 — the daemon's LIFECYCLE record (distinct from the 059 identity record).
+    // A new boot mints a fresh epoch, stamps started_at, and clears any prior run's
+    // stopped_at/heartbeat. The heartbeat (index.ts post-bind) advances last-seen
+    // while running; a clean shutdown (index.ts shutdown, AFTER stopping the timer)
+    // stamps stopped_at for THIS epoch.
+    const daemonLifecycleStore = new DaemonLifecycleStore(db);
+    const daemonBootEpoch = randomUUID();
+    daemonLifecycleStore.recordBoot(daemonBootEpoch, new Date().toISOString());
     const rigRepo = new RigRepository(db);
     const sessionRegistry = new SessionRegistry(db);
     const eventBus = new EventBus(db);
+    const streamStore = new StreamStore(db, eventBus);
+    const slowOpRecorder = opts?.slowOpRecorder ?? (dbPath === ":memory:"
+        ? undefined
+        : new SlowOpRecorder({
+            logPath: nodePath.join(OPENRIG_HOME, "logs", "slow-operations.jsonl"),
+        }));
+    configureSyncSiteRecorder(slowOpRecorder);
+    // Instrumentation wiring is observe-only: neither a throwing registration
+    // call nor a throwing callback body (streamStore.emit) may abort createDaemon
+    // or later wrapped work. Guard both boundaries.
+    try {
+        slowOpRecorder?.setDegradedHandler?.(({ reason, site }) => {
+            try {
+                streamStore.emit({
+                    sourceSession: "daemon@kernel",
+                    body: `slow-operation instrumentation degraded: ${reason} at ${site}`,
+                    hintType: "observation",
+                    hintUrgency: "high",
+                    hintTags: ["daemon", "slow-operation", "observability-degraded"],
+                });
+            }
+            catch (error) {
+                console.error("[slow-operation] degradation notification failed", error);
+            }
+        });
+    }
+    catch (error) {
+        console.error("[slow-operation] setDegradedHandler registration failed", error);
+    }
     // PL-004 Phase A revision (R1): topology-backed validateRig.
     // Reject `<member>@<unknown-rig>` shapes by checking the rig portion
     // against the rig registry. Bare ids without `@` are also rejected
@@ -218,9 +230,20 @@ export async function createDaemon(opts) {
     // greedy first-@ rig (so "member@rig@x" looks up rig "rig@x", misses,
     // and rejects with the same unknown_destination_rig as ever — BR-1).
     const topologyValidateRig = (sessionRef) => {
+        const parsed = parseSessionName(sessionRef);
+        // M1 A4b — @external entity-admission (checked BEFORE the human-CLASS bare-admit,
+        // which A2 also makes true for <local>@external): a queue row destinationed to
+        // <local>@external is admitted ONLY if the human is REGISTERED (or it is a literal
+        // scheme address); an unregistered entity is REFUSED (the 4b site carries the
+        // entity-level teaching via externalAdmissionTeaching). Admission is the gateway's
+        // job, never the classifier's (arch 8cd30094).
+        if (parsed.kind === "external") {
+            const reg = loadHumanRegistry();
+            const entities = reg.ok ? reg.entities.map((e) => ({ entityId: e.entityId, address: e.address })) : [];
+            return resolveExternal(parsed.local, entities).kind !== "unregistered";
+        }
         if (isHumanSeatSessionRef(sessionRef))
             return true;
-        const parsed = parseSessionName(sessionRef);
         if (parsed.kind !== "canonical")
             return false;
         return rigRepo.findRigsByName(parsed.rig).length > 0;
@@ -235,7 +258,16 @@ export async function createDaemon(opts) {
         // INJECTED here (arch layering pin: the queue never imports the
         // workflow domain; startup wires them — the validateRig precedent).
         workflowFrontierPredicate: createWorkflowFrontierPredicate(db),
+        // GHOST-STAGE (h): resolve the source seat's atom-B generation for the handoff-nudge Sent: line
+        // (same injected-predicate layering — the queue never imports the session domain).
+        resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
     });
+    // W1 (transactional closure): ONE OutboxHandler shared between the deps slot
+    // (sender-side audit surface) and the queue repo's durable wake-intent
+    // staging. Same `db`, so a stageWakeIntent() call inside a terminal
+    // db.transaction commits atomically with the close + successor create.
+    const outboxHandlerInstance = new OutboxHandler(db);
+    queueRepoInstance.attachOutbox(outboxHandlerInstance);
     // PL-004 Phase B — classifier lease manager. Constructed early so both
     // the leaseManager dep slot and project-classifier can share one instance.
     // isAlive is post-attached after whoami-service is constructed.
@@ -251,7 +283,19 @@ export async function createDaemon(opts) {
     // PL-004 Phase C — watchdog supervision tree. Repository + history-log
     // are constructed early; the policy engine + scheduler are constructed
     // after SessionTransport is available so the engine can wire delivery.
-    const watchdogJobsRepoInstance = new WatchdogJobsRepository(db);
+    const watchdogJobsRepoInstance = new WatchdogJobsRepository(db, undefined, // now (default clock)
+    // GHOST-STAGE (e/Class-B): stamp the arming occupant's generation so a swap can drop its armed jobs.
+    (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName));
+    const watchdogAutoRegistration = new WatchdogAutoRegistration({
+        db,
+        jobsRepo: watchdogJobsRepoInstance,
+        settingsStore: new ContextPackSettingsStore(),
+        warn: (message) => console.warn(message),
+    });
+    sessionRegistry.setWatchdogRegistrationObserver(watchdogAutoRegistration);
+    // Existing sessions predate the structural mint hook. Audit them at every
+    // boot without creating jobs: additive coverage stays loud, core boot stays live.
+    watchdogAutoRegistration.assertLiveSeatCoverage();
     const watchdogHistoryLogInstance = new WatchdogHistoryLog(db);
     const tmuxAdapter = new TmuxAdapter(opts?.tmuxExec ?? execCommand);
     // Slice 15 — Seat-activity service for the `terminal-active` primitive.
@@ -265,6 +309,10 @@ export async function createDaemon(opts) {
         defaultWindowSeconds: 3,
         eventBus,
     });
+    // 5b82324b — the STRUCTURAL activity cache (sibling of SeatActivityService). Captures pane TEXT once
+    // per running seat per tick + classifies motion STRUCTURALLY, so the `rig ps` ACTIVITY column reflects
+    // real liveness for hook-less / stale-hook / turn-boundary seats WITHOUT a per-request capture storm.
+    const seatStructuralActivityService = new SeatStructuralActivityService(tmuxAdapter);
     // OPR.0.4.3.19 — SeatIdentityReconciler owns the liveness identity verdict
     // (the THIRD axis). Reconciles each running seat's pane PID/command against
     // the registered binding and persists the verdict so node-inventory can gate
@@ -316,6 +364,8 @@ export async function createDaemon(opts) {
         OPENRIG_URL: resolvedActivityHookUrl,
         OPENRIG_ACTIVITY_HOOK_TOKEN: resolvedActivityHookToken,
         ...providerAuthEnv,
+        HOME: daemonHome,
+        CODEX_HOME: codexHome,
     };
     // OPR.0.4.6.02 S1 — ONE shared tmux option-defaults applier, injected into
     // BOTH NodeLauncher and (via AppDeps → the seat-handover route) the fresh
@@ -328,6 +378,7 @@ export async function createDaemon(opts) {
     const tmuxOptionSettings = new ContextPackSettingsStore();
     const tmuxOptionDefaults = new TmuxOptionDefaultsApplier({
         tmuxAdapter,
+        platform: opts?.tmuxOptionPlatform,
         readTmuxOptionDefaults: () => {
             try {
                 return { statusBar: tmuxOptionSettings.resolveOne("terminal.status_bar").value === true };
@@ -474,6 +525,19 @@ export async function createDaemon(opts) {
     const { PodRigInstantiator } = await import("./domain/rigspec-instantiator.js");
     const { StartupOrchestrator } = await import("./domain/startup-orchestrator.js");
     const { ClaudeCodeAdapter } = await import("./adapters/claude-code-adapter.js");
+    // P20 — the projection manifest: record-at-apply so the projector can later
+    // discriminate a stale re-projection (safe overwrite) from an operator edit (protect).
+    const { ProjectionManifestStore } = await import("./domain/projection-manifest-store.js");
+    const { hashContent } = await import("./domain/conflict-detector.js");
+    const projectionManifestStore = new ProjectionManifestStore(db);
+    // atom-4b — probe the manifest's readability AT BOOT. A rare per-lookup throw protects that one
+    // target (conflict-detector: broken≠absent → operator_conflict); but a WHOLE-TABLE-unreadable
+    // manifest degrades EVERY projection to protect — no overwrite ever applies — a safe but otherwise
+    // SILENT systemic degrade. Warn loudly at boot so the operator knows projections are held pending a
+    // DB repair, rather than silently discovering nothing projects.
+    if (!projectionManifestStore.isReadable()) {
+        console.warn("projection-manifest UNREADABLE at boot — every projection will degrade to PROTECT (no overwrites apply) until the DB is repaired; investigate projection_manifest (migration 064).");
+    }
     const { CodexRuntimeAdapter } = await import("./adapters/codex-runtime-adapter.js");
     const { PiRuntimeAdapter } = await import("./adapters/pi-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
@@ -483,13 +547,13 @@ export async function createDaemon(opts) {
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json") });
+            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
     const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
     // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
     // shape as the Codex adapter; seat isolation roots under piStateRoot.
     const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
@@ -498,6 +562,16 @@ export async function createDaemon(opts) {
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
             } } w(dir, ""); return r; } }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+    // OPR.0.5.1.1 — the stub runtime adapter (Pi-shaped node-script runner in a pane).
+    // Same fsOps shape as Pi; the compiled runner entry lives in the daemon dist.
+    const { StubRuntimeAdapter } = await import("./adapters/stub-runtime-adapter.js");
+    const stubRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/stub-runner.js");
+    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                if (e.isDirectory())
+                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
+                else
+                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
+            } } w(dir, ""); return r; } }, runnerEntryPath: stubRunnerEntryPath });
     // plugin-primitive Phase 3a slice 3.5 — ensure Codex feature flag
     // codex_hooks = true is set in ~/.codex/config.toml so plugin-shipped
     // hooks fire on Codex runtime. Slice 27 also creates the default
@@ -665,7 +739,7 @@ export async function createDaemon(opts) {
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
-        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         tmuxAdapter,
         agentImageLibrary,
         exec,
@@ -746,7 +820,12 @@ export async function createDaemon(opts) {
     // adoption-boundary capture (ClaimService) and FR-4 snapshot null-fill (refresher).
     // Also threaded through WhoamiService + routes below (same single instance).
     const { ContextUsageStore } = await import("./domain/context-usage-store.js");
-    const contextUsageStore = new ContextUsageStore(db, { stateDir: OPENRIG_HOME });
+    const contextUsageStore = new ContextUsageStore(db, {
+        stateDir: OPENRIG_HOME,
+        // GHOST-STAGE (c-id): reject context readings from before the live occupant booted (prior
+        // generation) so a frozen pre-handover sample can't drive the threshold. null = UNKNOWN (inert).
+        resolveOccupantBootAt: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.bootAt ?? null,
+    });
     // OPR.0.4.3.20 FR-4 — inject contextUsageStore so refresh() can null-fill a
     // Claude token from the sidecar during periodic/manual snapshot refresh.
     const resumeMetadataRefresher = new ResumeMetadataRefresher({ sessionRegistry, tmuxAdapter, contextUsageStore });
@@ -773,7 +852,17 @@ export async function createDaemon(opts) {
     // (ContextUsageStore is constructed above, ahead of ClaimService, for FR-3.)
     const whoamiService = new WhoamiService({ db, rigRepo, sessionRegistry, transcriptStore, contextUsageStore });
     const nodeCmuxService = new NodeCmuxService(rigRepo, sessionRegistry, cmuxAdapter, tmuxAdapter);
-    const agentActivityStore = new AgentActivityStore({ db, eventBus });
+    // W2a-1 — producer wiring: the live occupant generation resolves synchronously from the shipped
+    // occupant-tenure ledger. generation_uuid CHANGES for a new occupant and persists only within one
+    // tenure (a same-session relaunch is a continuation with no new generation); node_id is the stable-
+    // across-handover key, not this. null = UNKNOWN, honored by the store as abstain (never a stale claim
+    // rendered live). No tmux exec — a better-sqlite3 read on the hot path.
+    const agentActivityStore = new AgentActivityStore({
+        db,
+        eventBus,
+        resolveOccupantGeneration: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.generationUuid ?? null,
+        isRegisteredOccupantGeneration: (nodeId, generation) => sessionRegistry.isOccupantGenerationRegistered(nodeId, generation),
+    });
     const { SeatAttentionReconciler } = await import("./domain/seat-attention-reconciler.js");
     const seatAttentionReconciler = new SeatAttentionReconciler({
         sessionRegistry, eventBus, agentActivityStore, db,
@@ -793,6 +882,8 @@ export async function createDaemon(opts) {
     const deps = {
         rigRepo,
         sessionRegistry,
+        daemonLifecycleStore,
+        daemonBootEpoch,
         eventBus,
         nodeLauncher,
         tmuxAdapter,
@@ -833,6 +924,7 @@ export async function createDaemon(opts) {
         // + UI surfaces read the latest observation per seat. NEVER reads
         // queue/assignment state (non-inference contract; see slice 15 IMPL-PRD §2.3).
         seatActivityService,
+        seatStructuralActivityService,
         seatIdentityReconciler,
         // OPR.0.4.4.21 — agentActivity feeds the rig-rollup attention
         // predicate's needs_input signal (synchronous events lookup only).
@@ -849,10 +941,10 @@ export async function createDaemon(opts) {
         }),
         podInstantiator,
         podBundleSourceResolver,
-        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         transcriptStore,
         sessionTransport: (() => {
-            const t = new SessionTransport({ db, rigRepo, sessionRegistry, tmuxAdapter, agentActivityStore, eventBus });
+            const t = new SessionTransport({ db, rigRepo, sessionRegistry, tmuxAdapter, agentActivityStore, eventBus, slowOpRecorder });
             // PL-004 Phase A revision (R1): wire QueueRepository's wake-path so
             // create / handoff / handoff-and-complete nudge by default.
             queueRepoInstance.attachTransport(t);
@@ -876,17 +968,28 @@ export async function createDaemon(opts) {
             return t;
         })(),
         chatRepo: new ChatRepository(db),
-        streamStore: new StreamStore(db, eventBus),
+        streamStore,
+        slowOpRecorder,
         queueRepo: queueRepoInstance,
         inboxHandler: new InboxHandler(db, eventBus, queueRepoInstance),
-        outboxHandler: new OutboxHandler(db),
+        outboxHandler: outboxHandlerInstance,
         classifierLeaseManager: classifierLeaseManagerInstance,
         projectClassifier: new ProjectClassifier(db, eventBus, classifierLeaseManagerInstance),
         viewProjector: viewProjectorInstance,
         watchdogJobsRepo: watchdogJobsRepoInstance,
         watchdogHistoryLog: watchdogHistoryLogInstance,
+        wakeResolveService: new WakeResolveService({
+            listSessionsBySeat: (seat) => db
+                .prepare(`SELECT s.id AS id, s.session_name AS sessionName, s.resume_token AS resumeToken,
+                    n.runtime AS runtime, s.created_at AS createdAt
+               FROM sessions s JOIN nodes n ON s.node_id = n.id
+              WHERE s.session_name = ? ORDER BY s.id DESC`)
+                .all(seat),
+        }),
         askService: (() => {
-            const psProjectionService = new PsProjectionService({ db, agentActivity: agentActivityStore });
+            // P19 A5 (finding graduated): inject seatActivity like the attention path
+            // (line ~919) — one terminalActive truth, never two divergent projections.
+            const psProjectionService = new PsProjectionService({ db, seatActivity: seatActivityService, agentActivity: agentActivityStore });
             const execDep = (cmd, args) => new Promise((resolve) => {
                 execFile(cmd, args, { maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
                     if (err && typeof err.code === "string" && err.code === "ENOENT") {
@@ -1001,6 +1104,7 @@ export async function createDaemon(opts) {
             return roots;
         },
     };
+    Object.assign(deps, { watchdogAutoRegistration });
     // Copy bundled reference docs to ~/.openrig/reference/ so agents can find them at a stable path
     try {
         const bundledDocsDir = nodePath.resolve(import.meta.dirname, "../docs/reference");
@@ -1481,6 +1585,11 @@ export async function createDaemon(opts) {
                     return { status: "failed", error: err instanceof Error ? err.message : String(err) };
                 }
             },
+            // (i-c) fire-time target-generation gate: resolve the target's LIVE occupant-generation (P12
+            // occupant_tenures) so a generation-bound wake is refused once the target has handed over.
+            // UNKNOWN (null) fails open → deliver. A drop of this line disables the gate silently (gen-bound
+            // wakes would fire at the successor) — pinned in watchdog-target-gen-wiring.test.ts.
+            resolveTargetGeneration: (s) => sessionRegistry.currentOccupantGenerationForSession(s),
             // PL-004 Phase D: register workflow-keepalive policy alongside
             // Phase C's three built-in policies. workflow-keepalive reads
             // SQLite workflow_instances directly via the new Phase D tables
@@ -1528,6 +1637,26 @@ export async function createDaemon(opts) {
                 console.warn(`workflow boot sweep: failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        // W1 (transactional closure) FR — the wake-intent RECOVERY SWEEP. Deliver
+        // any wake intents a crash left committed-but-undelivered (the terminal txn
+        // committed, so the intent is durable, but the process died before the
+        // post-commit deliver). Runs after transport is wired so the re-deliveries
+        // actually land. Non-fatal — a sweep failure must not bring the daemon down.
+        // No periodic timer (ruled out of scope): a transient failure lands the row
+        // in a VISIBLE state and is retried on the next start.
+        try {
+            // BLOCKING 1: reconcile abandoned `sending` claims (a prior crash) FIRST,
+            // then drain committed `pending` intents. Reconcile is a one-time boundary
+            // step, separate from the drain.
+            const reconciled = queueRepoInstance.reconcileAbandonedWakeIntents();
+            const drained = await queueRepoInstance.drainPendingWakeIntents();
+            if (drained.delivered || drained.indeterminate || drained.failed || reconciled) {
+                console.log(`wake-intent recovery sweep: delivered=${drained.delivered} indeterminate=${drained.indeterminate} failed=${drained.failed} reconciled=${reconciled}`);
+            }
+        }
+        catch (err) {
+            console.warn(`wake-intent recovery sweep: failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
     // Context monitor — constructed before createApp so routes can access pollOnce for refresh.
     // Caller (index.ts) starts polling after listen.
@@ -1537,18 +1666,41 @@ export async function createDaemon(opts) {
     const { ContextMonitor } = await import("./domain/context-monitor.js");
     const { ClaudeCompactionEnforcer } = await import("./domain/claude-compaction-enforcer.js");
     const compactionEnforcer = deps.sessionTransport
-        ? new ClaudeCompactionEnforcer(new ContextPackSettingsStore(), deps.sessionTransport)
+        ? new ClaudeCompactionEnforcer(new ContextPackSettingsStore(), deps.sessionTransport, 
+        // GHOST-STAGE (b): resolve the LIVE occupant generation (atom-B tenure ledger) for a session
+        // so a stage minted by a retired generation is refused for the successor. null = UNKNOWN → the
+        // gate is inert (never compares a stale generation as if live).
+        { resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName) })
         : undefined;
+    // 51-08 A1 — the over-time series rides the SAME 30s tick (PM decision 1):
+    // context lane appends beside the existing persist; the provider-window lane
+    // drains the same statusline cache directory the read model scans.
+    const { UsageSamplesStore, providerWindowSamplesFromSignals } = await import("./domain/usage-samples-store.js");
+    const usageSamplesStore = new UsageSamplesStore(db);
     const contextMonitor = new ContextMonitor(db, contextUsageStore, claudeAdapter, compactionEnforcer, {
         "claude-code": claudeAdapter,
         codex: codexAdapter,
         pi: piAdapter,
-    });
+    }, usageSamplesStore, () => providerWindowSamplesFromSignals(collectClaudeSignalsFromProviderUsageDirectory(nodePath.join(OPENRIG_HOME, "provider-usage"))));
     deps.contextMonitor = contextMonitor;
     // OPR.0.4.3.14 — expose the SAME enforcer instance to routes for the manual
     // compaction trigger. Sharing one instance with ContextMonitor is what makes
     // the manual back-half drain through the auto poll loop (no second path).
     deps.compactionEnforcer = compactionEnforcer;
+    // GHOST-STAGE (e/Class-B) — construct the canonical OccupantInvalidator now that both Class-A deps
+    // exist (the enforcer's in-mem maps 1a-1f + the context sidecar 2a). Injected into SeatHandoverService
+    // via the app context so commit()'s re-key call FIRES (it was a no-op until wired). An absent enforcer
+    // (degraded boot, no sessionTransport) falls back to a sidecar-only invalidator — never throws.
+    const { DefaultOccupantInvalidator } = await import("./domain/occupant-invalidator.js");
+    deps.occupantInvalidator = new DefaultOccupantInvalidator({
+        enforcer: compactionEnforcer ?? { invalidateOccupant: () => { } },
+        contextUsage: contextUsageStore,
+        // (e/Class-B) watchdog store — armed jobs registered by the retiring generation stop at swap.
+        watchdog: watchdogJobsRepoInstance,
+        // (e/Class-B) queue store — in-progress items claimed by the retiring generation release to pending.
+        queue: queueRepoInstance,
+        log: (msg) => console.warn(msg),
+    });
     // OPR.0.3.4.9 — periodic snapshot scheduler (crash-insurance floor).
     const { PeriodicSnapshotScheduler } = await import("./domain/periodic-snapshot-scheduler.js");
     const periodicSnapshotScheduler = new PeriodicSnapshotScheduler({