@openrig/cli 0.5.0 → 0.5.2

package/daemon/dist/startup.js

@@ -1,11 +1,13 @@
 import { createDb } from "./db/connection.js";
 import { migrate } from "./db/migrate.js";
-import { coreSchema } from "./db/migrations/001_core_schema.js";
-import { bindingsSessionsSchema } from "./db/migrations/002_bindings_sessions.js";
-import { eventsSchema } from "./db/migrations/003_events.js";
+// P8: apply the CANONICAL migration list — the single source of truth (db/all-migrations.ts),
+// never an inline copy that can drift out of sync with the daemon's schema.
+import { ALL_MIGRATIONS } from "./db/all-migrations.js";
 import { RigRepository } from "./domain/rig-repository.js";
 import { SessionRegistry } from "./domain/session-registry.js";
 import { isHumanSeatSessionRef, parseSessionName } from "./domain/session-name.js";
+import { resolveExternal } from "./domain/gateway/external-admission.js";
+import { loadHumanRegistry } from "./domain/gateway/human-registry.js";
 import { EventBus } from "./domain/event-bus.js";
 import { NodeLauncher } from "./domain/node-launcher.js";
 import { TmuxOptionDefaultsApplier } from "./domain/tmux-option-defaults.js";
@@ -50,7 +52,12 @@ import { LegacyBundleSourceResolver as BundleSourceResolver } from "./domain/bun
 import { PodBundleSourceResolver } from "./domain/bundle-source-resolver.js";
 import { PsProjectionService } from "./domain/ps-projection.js";
 import { SeatActivityService } from "./domain/seat-activity-service.js";
-import { SeatIdentityReconciler } from "./domain/seat-identity-reconciler.js";
+import { SeatStructuralActivityService } from "./domain/seat-structural-activity-service.js";
+import { deriveSelfHostIdSource, SeatIdentityReconciler, reconcileSelfHostIdentity } from "./domain/seat-identity-reconciler.js";
+import { SelfHostIdentityStore } from "./domain/seat-identity-store.js";
+import { DaemonLifecycleStore } from "./domain/daemon-lifecycle-store.js";
+import { randomUUID } from "node:crypto";
+import { setSelfHostId, setSelfHostIdSource } from "./domain/hosts/fanout-contract.js";
 import { UpCommandRouter } from "./domain/up-command-router.js";
 import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
 import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
@@ -60,8 +67,11 @@ import { SessionTransport } from "./domain/session-transport.js";
 import { AgentActivityStore } from "./domain/agent-activity-store.js";
 import { HistoryQuery } from "./domain/history-query.js";
 import { AskService } from "./domain/ask-service.js";
+import { WakeResolveService } from "./domain/wake-resolve-service.js";
 import { ChatRepository } from "./domain/chat-repository.js";
 import { StreamStore } from "./domain/stream-store.js";
+import { SlowOpRecorder } from "./domain/slow-op-recorder.js";
+import { configureSyncSiteRecorder } from "./domain/sync-site-wrap.js";
 import { QueueRepository } from "./domain/queue-repository.js";
 import { createWorkflowFrontierPredicate } from "./domain/workflow-frontier-guard.js";
 import { InboxHandler } from "./domain/inbox-handler.js";
@@ -71,6 +81,7 @@ import { ClassifierLeaseManager } from "./domain/classifier-lease-manager.js";
 import { ViewProjector } from "./domain/view-projector.js";
 import { wireViewEventBridge } from "./domain/view-event-bridge.js";
 import { WatchdogJobsRepository } from "./domain/watchdog-jobs-repository.js";
+import { WatchdogAutoRegistration } from "./domain/watchdog-auto-registration.js";
 import { WatchdogHistoryLog } from "./domain/watchdog-history-log.js";
 import { WatchdogPolicyEngine } from "./domain/watchdog-policy-engine.js";
 import { WatchdogScheduler } from "./domain/watchdog-scheduler.js";
@@ -96,65 +107,10 @@ import { execFile } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import nodePath from "node:path";
-import { snapshotsSchema } from "./db/migrations/004_snapshots.js";
-import { checkpointsSchema } from "./db/migrations/005_checkpoints.js";
-import { resumeMetadataSchema } from "./db/migrations/006_resume_metadata.js";
-import { nodeSpecFieldsSchema } from "./db/migrations/007_node_spec_fields.js";
-import { packagesSchema } from "./db/migrations/008_packages.js";
-import { installJournalSchema } from "./db/migrations/009_install_journal.js";
-import { journalSeqSchema } from "./db/migrations/010_journal_seq.js";
-import { bootstrapSchema } from "./db/migrations/011_bootstrap.js";
-import { discoverySchema } from "./db/migrations/012_discovery.js";
-import { discoveryFkFix } from "./db/migrations/013_discovery_fk_fix.js";
-import { agentspecRebootSchema } from "./db/migrations/014_agentspec_reboot.js";
-import { startupContextSchema } from "./db/migrations/015_startup_context.js";
-import { chatMessagesSchema } from "./db/migrations/016_chat_messages.js";
-import { podNamespaceSchema } from "./db/migrations/017_pod_namespace.js";
-import { contextUsageSchema } from "./db/migrations/018_context_usage.js";
-import { externalCliAttachmentSchema } from "./db/migrations/019_external_cli_attachment.js";
-import { rigServicesSchema } from "./db/migrations/020_rig_services.js";
-import { seatHandoverObservabilitySchema } from "./db/migrations/021_seat_handover_observability.js";
-import { nodeCodexConfigProfileSchema } from "./db/migrations/022_node_codex_config_profile.js";
-import { streamItemsSchema } from "./db/migrations/023_stream_items.js";
-import { queueItemsSchema } from "./db/migrations/024_queue_items.js";
-import { queueTransitionsSchema } from "./db/migrations/025_queue_transitions.js";
-import { inboxEntriesSchema } from "./db/migrations/026_inbox_entries.js";
-import { outboxEntriesSchema } from "./db/migrations/027_outbox_entries.js";
-import { projectClassificationsSchema } from "./db/migrations/028_project_classifications.js";
-import { classifierLeasesSchema } from "./db/migrations/029_classifier_leases.js";
-import { viewsCustomSchema } from "./db/migrations/030_views_custom.js";
-import { watchdogJobsSchema } from "./db/migrations/031_watchdog_jobs.js";
-import { watchdogHistorySchema } from "./db/migrations/032_watchdog_history.js";
-import { workflowSpecsSchema } from "./db/migrations/033_workflow_specs.js";
-import { workflowInstancesSchema } from "./db/migrations/034_workflow_instances.js";
-import { workflowStepTrailsSchema } from "./db/migrations/035_workflow_step_trails.js";
-import { watchdogPolicyEnumExtensionSchema } from "./db/migrations/036_watchdog_policy_enum_extension.js";
-import { missionControlActionsSchema } from "./db/migrations/037_mission_control_actions.js";
-import { workspacePrimitiveSchema } from "./db/migrations/038_workspace_primitive.js";
-import { queueTargetRepoSchema } from "./db/migrations/039_queue_target_repo.js";
 // Slice 11 (release-0.3.1 workflow-spec-folder-discovery) — adds
 // status + error_message columns to workflow_specs so the scanner
 // can record diagnostic rows. SC-29 #10 declared verbatim in commit body.
-import { workflowSpecsDiagnosticSchema } from "./db/migrations/040_workflow_specs_diagnostic.js";
-import { rigPolicySchema } from "./db/migrations/041_rig_policy.js";
-import { rigArchiveSchema } from "./db/migrations/042_rig_archive.js";
-import { resumeProvenanceSchema } from "./db/migrations/043_resume_provenance.js";
-import { queueItemSummarySchema } from "./db/migrations/044_queue_item_summary.js";
-import { resumeVerificationSchema } from "./db/migrations/045_resume_verification.js";
-import { seatIdentityVerdictsSchema } from "./db/migrations/046_seat_identity_verdicts.js";
-import { eventsNodeTypeIndexSchema } from "./db/migrations/047_events_node_type_index.js";
-import { queueItemEvidenceRefSchema } from "./db/migrations/048_queue_item_evidence_ref.js";
-import { workflowInstanceVersionSchema } from "./db/migrations/049_workflow_instance_version.js";
-import { workflowSpecJsonSchema } from "./db/migrations/050_workflow_spec_json.js";
-import { workflowResumeSchema } from "./db/migrations/051_workflow_resume.js";
-import { workflowInstanceBoundRigSchema } from "./db/migrations/052_workflow_instance_bound_rig.js";
-import { sessionsNodeIdIndexSchema } from "./db/migrations/053_sessions_node_id_index.js";
-import { queueTransitionsArchiveSchema } from "./db/migrations/054_queue_transitions_archive.js";
-import { nodePermissionPolicySchema } from "./db/migrations/055_node_permission_policy.js";
-import { rigPermissionPolicySchema } from "./db/migrations/056_rig_permission_policy.js";
-import { nodePolicyProvenanceSchema } from "./db/migrations/057_node_policy_provenance.js";
-import { rigPolicyProvenanceSchema } from "./db/migrations/058_rig_policy_provenance.js";
-import { RigPolicyStore } from "./domain/rig-policy/rig-policy-store.js";
+import { RigModeStore } from "./domain/rig-mode/rig-mode-store.js";
 import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
 import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
 import { MissionControlReadLayer } from "./domain/mission-control/mission-control-read-layer.js";
@@ -203,12 +159,72 @@ export function collectAllowlistedProviderAuthEnv(raw, env) {
     return out;
 }
 export async function createDaemon(opts) {
+    const daemonHome = os.homedir();
+    const configuredCodexHome = process.env.CODEX_HOME;
+    if (configuredCodexHome && !nodePath.isAbsolute(configuredCodexHome)) {
+        throw new Error(`CODEX_HOME must be an absolute path for managed seats: ${configuredCodexHome}`);
+    }
+    const codexHome = configuredCodexHome || nodePath.join(daemonHome, ".codex");
     const dbPath = opts?.dbPath ?? ":memory:";
     const db = createDb(dbPath);
-    migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, inboxEntriesSchema, outboxEntriesSchema, projectClassificationsSchema, classifierLeasesSchema, viewsCustomSchema, watchdogJobsSchema, watchdogHistorySchema, workflowSpecsSchema, workflowInstancesSchema, workflowStepTrailsSchema, watchdogPolicyEnumExtensionSchema, missionControlActionsSchema, workspacePrimitiveSchema, queueTargetRepoSchema, workflowSpecsDiagnosticSchema, rigPolicySchema, rigArchiveSchema, resumeProvenanceSchema, queueItemSummarySchema, resumeVerificationSchema, seatIdentityVerdictsSchema, eventsNodeTypeIndexSchema, queueItemEvidenceRefSchema, workflowInstanceVersionSchema, workflowSpecJsonSchema, workflowResumeSchema, workflowInstanceBoundRigSchema, sessionsNodeIdIndexSchema, queueTransitionsArchiveSchema, nodePermissionPolicySchema, rigPermissionPolicySchema, nodePolicyProvenanceSchema, rigPolicyProvenanceSchema]);
+    migrate(db, ALL_MIGRATIONS);
+    // 51-09 increment 1 — establish the daemon's durable self-host identity at
+    // boot (mint on first boot, reconcile thereafter). host.name is a display-only
+    // CANDIDATE SEED (arch ruling cb19867f / DP4). Boot proceeds on a host.name
+    // conflict (the stored id is kept and the conflict is surfaced loudly).
+    const hostNameCandidate = new ContextPackSettingsStore().resolveOne("host.name").value;
+    const selfHost = reconcileSelfHostIdentity(new SelfHostIdentityStore(db), {
+        nowIso: new Date().toISOString(),
+        hostNameCandidate,
+    });
+    // 51-09 increment 2 — publish the resolved self-host id so the read-through
+    // (and, in increment 4, the queue-destination validator) resolve a request
+    // addressed to THIS host's own id HOME, instead of dialing/validating it as a
+    // remote/unknown host. Distinct spelling from the 'local' sentinel.
+    setSelfHostId(selfHost.hostId);
+    // Slice 14 §2c — derived from the SAME candidate the reconcile just used, so the two can never
+    // disagree, and computed here rather than per request (see fanout-contract).
+    setSelfHostIdSource(deriveSelfHostIdSource(selfHost.hostId, hostNameCandidate));
+    // P7 — the daemon's LIFECYCLE record (distinct from the 059 identity record).
+    // A new boot mints a fresh epoch, stamps started_at, and clears any prior run's
+    // stopped_at/heartbeat. The heartbeat (index.ts post-bind) advances last-seen
+    // while running; a clean shutdown (index.ts shutdown, AFTER stopping the timer)
+    // stamps stopped_at for THIS epoch.
+    const daemonLifecycleStore = new DaemonLifecycleStore(db);
+    const daemonBootEpoch = randomUUID();
+    daemonLifecycleStore.recordBoot(daemonBootEpoch, new Date().toISOString());
     const rigRepo = new RigRepository(db);
     const sessionRegistry = new SessionRegistry(db);
     const eventBus = new EventBus(db);
+    const streamStore = new StreamStore(db, eventBus);
+    const slowOpRecorder = opts?.slowOpRecorder ?? (dbPath === ":memory:"
+        ? undefined
+        : new SlowOpRecorder({
+            logPath: nodePath.join(OPENRIG_HOME, "logs", "slow-operations.jsonl"),
+        }));
+    configureSyncSiteRecorder(slowOpRecorder);
+    // Instrumentation wiring is observe-only: neither a throwing registration
+    // call nor a throwing callback body (streamStore.emit) may abort createDaemon
+    // or later wrapped work. Guard both boundaries.
+    try {
+        slowOpRecorder?.setDegradedHandler?.(({ reason, site }) => {
+            try {
+                streamStore.emit({
+                    sourceSession: "daemon@kernel",
+                    body: `slow-operation instrumentation degraded: ${reason} at ${site}`,
+                    hintType: "observation",
+                    hintUrgency: "high",
+                    hintTags: ["daemon", "slow-operation", "observability-degraded"],
+                });
+            }
+            catch (error) {
+                console.error("[slow-operation] degradation notification failed", error);
+            }
+        });
+    }
+    catch (error) {
+        console.error("[slow-operation] setDegradedHandler registration failed", error);
+    }
     // PL-004 Phase A revision (R1): topology-backed validateRig.
     // Reject `<member>@<unknown-rig>` shapes by checking the rig portion
     // against the rig registry. Bare ids without `@` are also rejected
@@ -218,9 +234,20 @@ export async function createDaemon(opts) {
     // greedy first-@ rig (so "member@rig@x" looks up rig "rig@x", misses,
     // and rejects with the same unknown_destination_rig as ever — BR-1).
     const topologyValidateRig = (sessionRef) => {
+        const parsed = parseSessionName(sessionRef);
+        // M1 A4b — @external entity-admission (checked BEFORE the human-CLASS bare-admit,
+        // which A2 also makes true for <local>@external): a queue row destinationed to
+        // <local>@external is admitted ONLY if the human is REGISTERED (or it is a literal
+        // scheme address); an unregistered entity is REFUSED (the 4b site carries the
+        // entity-level teaching via externalAdmissionTeaching). Admission is the gateway's
+        // job, never the classifier's (arch 8cd30094).
+        if (parsed.kind === "external") {
+            const reg = loadHumanRegistry();
+            const entities = reg.ok ? reg.entities.map((e) => ({ entityId: e.entityId, address: e.address })) : [];
+            return resolveExternal(parsed.local, entities).kind !== "unregistered";
+        }
         if (isHumanSeatSessionRef(sessionRef))
             return true;
-        const parsed = parseSessionName(sessionRef);
         if (parsed.kind !== "canonical")
             return false;
         return rigRepo.findRigsByName(parsed.rig).length > 0;
@@ -235,7 +262,16 @@ export async function createDaemon(opts) {
         // INJECTED here (arch layering pin: the queue never imports the
         // workflow domain; startup wires them — the validateRig precedent).
         workflowFrontierPredicate: createWorkflowFrontierPredicate(db),
+        // GHOST-STAGE (h): resolve the source seat's atom-B generation for the handoff-nudge Sent: line
+        // (same injected-predicate layering — the queue never imports the session domain).
+        resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
     });
+    // W1 (transactional closure): ONE OutboxHandler shared between the deps slot
+    // (sender-side audit surface) and the queue repo's durable wake-intent
+    // staging. Same `db`, so a stageWakeIntent() call inside a terminal
+    // db.transaction commits atomically with the close + successor create.
+    const outboxHandlerInstance = new OutboxHandler(db);
+    queueRepoInstance.attachOutbox(outboxHandlerInstance);
     // PL-004 Phase B — classifier lease manager. Constructed early so both
     // the leaseManager dep slot and project-classifier can share one instance.
     // isAlive is post-attached after whoami-service is constructed.
@@ -251,7 +287,19 @@ export async function createDaemon(opts) {
     // PL-004 Phase C — watchdog supervision tree. Repository + history-log
     // are constructed early; the policy engine + scheduler are constructed
     // after SessionTransport is available so the engine can wire delivery.
-    const watchdogJobsRepoInstance = new WatchdogJobsRepository(db);
+    const watchdogJobsRepoInstance = new WatchdogJobsRepository(db, undefined, // now (default clock)
+    // GHOST-STAGE (e/Class-B): stamp the arming occupant's generation so a swap can drop its armed jobs.
+    (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName));
+    const watchdogAutoRegistration = new WatchdogAutoRegistration({
+        db,
+        jobsRepo: watchdogJobsRepoInstance,
+        settingsStore: new ContextPackSettingsStore(),
+        warn: (message) => console.warn(message),
+    });
+    sessionRegistry.setWatchdogRegistrationObserver(watchdogAutoRegistration);
+    // Existing sessions predate the structural mint hook. Audit them at every
+    // boot without creating jobs: additive coverage stays loud, core boot stays live.
+    watchdogAutoRegistration.assertLiveSeatCoverage();
     const watchdogHistoryLogInstance = new WatchdogHistoryLog(db);
     const tmuxAdapter = new TmuxAdapter(opts?.tmuxExec ?? execCommand);
     // Slice 15 — Seat-activity service for the `terminal-active` primitive.
@@ -265,6 +313,10 @@ export async function createDaemon(opts) {
         defaultWindowSeconds: 3,
         eventBus,
     });
+    // 5b82324b — the STRUCTURAL activity cache (sibling of SeatActivityService). Captures pane TEXT once
+    // per running seat per tick + classifies motion STRUCTURALLY, so the `rig ps` ACTIVITY column reflects
+    // real liveness for hook-less / stale-hook / turn-boundary seats WITHOUT a per-request capture storm.
+    const seatStructuralActivityService = new SeatStructuralActivityService(tmuxAdapter);
     // OPR.0.4.3.19 — SeatIdentityReconciler owns the liveness identity verdict
     // (the THIRD axis). Reconciles each running seat's pane PID/command against
     // the registered binding and persists the verdict so node-inventory can gate
@@ -316,6 +368,8 @@ export async function createDaemon(opts) {
         OPENRIG_URL: resolvedActivityHookUrl,
         OPENRIG_ACTIVITY_HOOK_TOKEN: resolvedActivityHookToken,
         ...providerAuthEnv,
+        HOME: daemonHome,
+        CODEX_HOME: codexHome,
     };
     // OPR.0.4.6.02 S1 — ONE shared tmux option-defaults applier, injected into
     // BOTH NodeLauncher and (via AppDeps → the seat-handover route) the fresh
@@ -328,6 +382,7 @@ export async function createDaemon(opts) {
     const tmuxOptionSettings = new ContextPackSettingsStore();
     const tmuxOptionDefaults = new TmuxOptionDefaultsApplier({
         tmuxAdapter,
+        platform: opts?.tmuxOptionPlatform,
         readTmuxOptionDefaults: () => {
             try {
                 return { statusBar: tmuxOptionSettings.resolveOne("terminal.status_bar").value === true };
@@ -474,6 +529,19 @@ export async function createDaemon(opts) {
     const { PodRigInstantiator } = await import("./domain/rigspec-instantiator.js");
     const { StartupOrchestrator } = await import("./domain/startup-orchestrator.js");
     const { ClaudeCodeAdapter } = await import("./adapters/claude-code-adapter.js");
+    // P20 — the projection manifest: record-at-apply so the projector can later
+    // discriminate a stale re-projection (safe overwrite) from an operator edit (protect).
+    const { ProjectionManifestStore } = await import("./domain/projection-manifest-store.js");
+    const { hashContent } = await import("./domain/conflict-detector.js");
+    const projectionManifestStore = new ProjectionManifestStore(db);
+    // atom-4b — probe the manifest's readability AT BOOT. A rare per-lookup throw protects that one
+    // target (conflict-detector: broken≠absent → operator_conflict); but a WHOLE-TABLE-unreadable
+    // manifest degrades EVERY projection to protect — no overwrite ever applies — a safe but otherwise
+    // SILENT systemic degrade. Warn loudly at boot so the operator knows projections are held pending a
+    // DB repair, rather than silently discovering nothing projects.
+    if (!projectionManifestStore.isReadable()) {
+        console.warn("projection-manifest UNREADABLE at boot — every projection will degrade to PROTECT (no overwrites apply) until the DB is repaired; investigate projection_manifest (migration 064).");
+    }
     const { CodexRuntimeAdapter } = await import("./adapters/codex-runtime-adapter.js");
     const { PiRuntimeAdapter } = await import("./adapters/pi-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
@@ -483,13 +551,13 @@ export async function createDaemon(opts) {
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json") });
+            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
     const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
     // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
     // shape as the Codex adapter; seat isolation roots under piStateRoot.
     const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
@@ -498,6 +566,16 @@ export async function createDaemon(opts) {
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
             } } w(dir, ""); return r; } }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+    // OPR.0.5.1.1 — the stub runtime adapter (Pi-shaped node-script runner in a pane).
+    // Same fsOps shape as Pi; the compiled runner entry lives in the daemon dist.
+    const { StubRuntimeAdapter } = await import("./adapters/stub-runtime-adapter.js");
+    const stubRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/stub-runner.js");
+    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                if (e.isDirectory())
+                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
+                else
+                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
+            } } w(dir, ""); return r; } }, runnerEntryPath: stubRunnerEntryPath });
     // plugin-primitive Phase 3a slice 3.5 — ensure Codex feature flag
     // codex_hooks = true is set in ~/.codex/config.toml so plugin-shipped
     // hooks fire on Codex runtime. Slice 27 also creates the default
@@ -665,7 +743,7 @@ export async function createDaemon(opts) {
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
-        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         tmuxAdapter,
         agentImageLibrary,
         exec,
@@ -746,7 +824,12 @@ export async function createDaemon(opts) {
     // adoption-boundary capture (ClaimService) and FR-4 snapshot null-fill (refresher).
     // Also threaded through WhoamiService + routes below (same single instance).
     const { ContextUsageStore } = await import("./domain/context-usage-store.js");
-    const contextUsageStore = new ContextUsageStore(db, { stateDir: OPENRIG_HOME });
+    const contextUsageStore = new ContextUsageStore(db, {
+        stateDir: OPENRIG_HOME,
+        // GHOST-STAGE (c-id): reject context readings from before the live occupant booted (prior
+        // generation) so a frozen pre-handover sample can't drive the threshold. null = UNKNOWN (inert).
+        resolveOccupantBootAt: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.bootAt ?? null,
+    });
     // OPR.0.4.3.20 FR-4 — inject contextUsageStore so refresh() can null-fill a
     // Claude token from the sidecar during periodic/manual snapshot refresh.
     const resumeMetadataRefresher = new ResumeMetadataRefresher({ sessionRegistry, tmuxAdapter, contextUsageStore });
@@ -773,7 +856,17 @@ export async function createDaemon(opts) {
     // (ContextUsageStore is constructed above, ahead of ClaimService, for FR-3.)
     const whoamiService = new WhoamiService({ db, rigRepo, sessionRegistry, transcriptStore, contextUsageStore });
     const nodeCmuxService = new NodeCmuxService(rigRepo, sessionRegistry, cmuxAdapter, tmuxAdapter);
-    const agentActivityStore = new AgentActivityStore({ db, eventBus });
+    // W2a-1 — producer wiring: the live occupant generation resolves synchronously from the shipped
+    // occupant-tenure ledger. generation_uuid CHANGES for a new occupant and persists only within one
+    // tenure (a same-session relaunch is a continuation with no new generation); node_id is the stable-
+    // across-handover key, not this. null = UNKNOWN, honored by the store as abstain (never a stale claim
+    // rendered live). No tmux exec — a better-sqlite3 read on the hot path.
+    const agentActivityStore = new AgentActivityStore({
+        db,
+        eventBus,
+        resolveOccupantGeneration: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.generationUuid ?? null,
+        isRegisteredOccupantGeneration: (nodeId, generation) => sessionRegistry.isOccupantGenerationRegistered(nodeId, generation),
+    });
     const { SeatAttentionReconciler } = await import("./domain/seat-attention-reconciler.js");
     const seatAttentionReconciler = new SeatAttentionReconciler({
         sessionRegistry, eventBus, agentActivityStore, db,
@@ -793,6 +886,8 @@ export async function createDaemon(opts) {
     const deps = {
         rigRepo,
         sessionRegistry,
+        daemonLifecycleStore,
+        daemonBootEpoch,
         eventBus,
         nodeLauncher,
         tmuxAdapter,
@@ -833,6 +928,7 @@ export async function createDaemon(opts) {
         // + UI surfaces read the latest observation per seat. NEVER reads
         // queue/assignment state (non-inference contract; see slice 15 IMPL-PRD §2.3).
         seatActivityService,
+        seatStructuralActivityService,
         seatIdentityReconciler,
         // OPR.0.4.4.21 — agentActivity feeds the rig-rollup attention
         // predicate's needs_input signal (synchronous events lookup only).
@@ -849,10 +945,10 @@ export async function createDaemon(opts) {
         }),
         podInstantiator,
         podBundleSourceResolver,
-        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         transcriptStore,
         sessionTransport: (() => {
-            const t = new SessionTransport({ db, rigRepo, sessionRegistry, tmuxAdapter, agentActivityStore, eventBus });
+            const t = new SessionTransport({ db, rigRepo, sessionRegistry, tmuxAdapter, agentActivityStore, eventBus, slowOpRecorder });
             // PL-004 Phase A revision (R1): wire QueueRepository's wake-path so
             // create / handoff / handoff-and-complete nudge by default.
             queueRepoInstance.attachTransport(t);
@@ -876,17 +972,28 @@ export async function createDaemon(opts) {
             return t;
         })(),
         chatRepo: new ChatRepository(db),
-        streamStore: new StreamStore(db, eventBus),
+        streamStore,
+        slowOpRecorder,
         queueRepo: queueRepoInstance,
         inboxHandler: new InboxHandler(db, eventBus, queueRepoInstance),
-        outboxHandler: new OutboxHandler(db),
+        outboxHandler: outboxHandlerInstance,
         classifierLeaseManager: classifierLeaseManagerInstance,
         projectClassifier: new ProjectClassifier(db, eventBus, classifierLeaseManagerInstance),
         viewProjector: viewProjectorInstance,
         watchdogJobsRepo: watchdogJobsRepoInstance,
         watchdogHistoryLog: watchdogHistoryLogInstance,
+        wakeResolveService: new WakeResolveService({
+            listSessionsBySeat: (seat) => db
+                .prepare(`SELECT s.id AS id, s.session_name AS sessionName, s.resume_token AS resumeToken,
+                    n.runtime AS runtime, s.created_at AS createdAt
+               FROM sessions s JOIN nodes n ON s.node_id = n.id
+              WHERE s.session_name = ? ORDER BY s.id DESC`)
+                .all(seat),
+        }),
         askService: (() => {
-            const psProjectionService = new PsProjectionService({ db, agentActivity: agentActivityStore });
+            // P19 A5 (finding graduated): inject seatActivity like the attention path
+            // (line ~919) — one terminalActive truth, never two divergent projections.
+            const psProjectionService = new PsProjectionService({ db, seatActivity: seatActivityService, agentActivity: agentActivityStore });
             const execDep = (cmd, args) => new Promise((resolve) => {
                 execFile(cmd, args, { maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
                     if (err && typeof err.code === "string" && err.code === "ENOENT") {
@@ -983,7 +1090,7 @@ export async function createDaemon(opts) {
         snapshotCapturer,
         // Slice 09 (OPR.0.3.2.9) — operator-context-mode bindings store
         // (typed primitive on the shared db handle; HG-5: no parallel store).
-        rigPolicyStore: new RigPolicyStore(db),
+        rigModeStore: new RigModeStore(db),
         agentImageSpecRoots: () => {
             // Spec-library roots scanned by the evidence guard. v0: user
             // specs under ~/.openrig/specs + workspace-local specs root
@@ -1001,6 +1108,7 @@ export async function createDaemon(opts) {
             return roots;
         },
     };
+    Object.assign(deps, { watchdogAutoRegistration });
     // Copy bundled reference docs to ~/.openrig/reference/ so agents can find them at a stable path
     try {
         const bundledDocsDir = nodePath.resolve(import.meta.dirname, "../docs/reference");
@@ -1481,6 +1589,11 @@ export async function createDaemon(opts) {
                     return { status: "failed", error: err instanceof Error ? err.message : String(err) };
                 }
             },
+            // (i-c) fire-time target-generation gate: resolve the target's LIVE occupant-generation (P12
+            // occupant_tenures) so a generation-bound wake is refused once the target has handed over.
+            // UNKNOWN (null) fails open → deliver. A drop of this line disables the gate silently (gen-bound
+            // wakes would fire at the successor) — pinned in watchdog-target-gen-wiring.test.ts.
+            resolveTargetGeneration: (s) => sessionRegistry.currentOccupantGenerationForSession(s),
             // PL-004 Phase D: register workflow-keepalive policy alongside
             // Phase C's three built-in policies. workflow-keepalive reads
             // SQLite workflow_instances directly via the new Phase D tables
@@ -1506,6 +1619,131 @@ export async function createDaemon(opts) {
         });
         deps.watchdogPolicyEngine = watchdogPolicyEngine;
         deps.watchdogScheduler = watchdogScheduler;
+        // B8 / slice-07 A3 — the MODEL-DIVERGENCE MONITOR: cause-agnostic effective-vs-pinned
+        // comparison at the earliest reliable per-runtime read, one verdict per occupant generation,
+        // LOUD four-channel proclamation on divergence (orch seats + operator + oversight + the named
+        // Slack deferral per DS2). Channel targets per the desk ruling 2026-08-21: orch = the seat's
+        // own rig's orch.* seats; operator = derived from workspace.operator_seat_name (never
+        // hardcoded); oversight = the fleet judgment seat, locally resolvable or a NAMED deferral
+        // (no daemon-side cross-host send seam exists yet — the deferral names that, never silence).
+        {
+            const { ModelDivergenceMonitor } = await import("./domain/model-divergence/model-divergence-monitor.js");
+            const { readClaudeEffectiveModel, readCodexEffectiveModel } = await import("./domain/model-divergence/effective-model-readers.js");
+            const { paneClaudeSessionIdArgument, LiveClaudeRecordSelector, resolveLiveCodexThreadId } = await import("./domain/model-divergence/current-generation-record.js");
+            const liveClaudeRecordSelector = new LiveClaudeRecordSelector();
+            const { defaultListProcesses } = await import("./domain/resume-metadata-refresher.js");
+            const { readCodexThreadIdFromCandidateHomes, defaultResolveHomeDirByPid } = await import("./domain/codex-thread-id.js");
+            const nodeOs = await import("node:os");
+            const nodePathMod = await import("node:path");
+            const nodeFs = await import("node:fs");
+            const currentGenDeps = {
+                getPanePid: async (sessionTarget) => tmuxAdapter.getPanePid ? tmuxAdapter.getPanePid(sessionTarget) : null,
+                listProcesses: defaultListProcesses,
+                readThreadIdByPid: async (pid) => readCodexThreadIdFromCandidateHomes(pid, [await defaultResolveHomeDirByPid(pid), nodeOs.homedir()]),
+            };
+            const OVERSIGHT_SEAT = "watch-lead@oversight";
+            const modelDivergenceMonitor = new ModelDivergenceMonitor({
+                listPinnedSeats: () => {
+                    const rows = db.prepare(`
+            SELECT n.id AS nodeId, r.id AS rigId, r.name AS rigName, n.runtime AS runtime, n.model AS pinnedModel,
+                   (SELECT s.session_name FROM sessions s
+                     WHERE s.node_id = n.id AND s.status = 'running'
+                     ORDER BY s.created_at DESC, s.id DESC LIMIT 1) AS sessionName
+              FROM nodes n JOIN rigs r ON r.id = n.rig_id
+             WHERE n.model IS NOT NULL AND n.model <> ''
+          `).all();
+                    return rows
+                        .filter((row) => row.sessionName !== null)
+                        .map((row) => ({ ...row, generation: sessionRegistry.currentOccupantGenerationForSession(row.sessionName) }));
+                },
+                // D-a — the CURRENT GENERATION's record via the live pane process, never a name/token
+                // lookup alone: on the live specimen (dev.planner) the name-keyed sidecar AND the newest
+                // registry row were stale TOGETHER while the pane ran a different session — the old wiring
+                // read the old generation's transcript and MASKED a real divergence. The stored records are
+                // now only corroboration; the pane process is the join. Every no-answer is a named reason.
+                readEffectiveModel: async (seat) => {
+                    if (seat.runtime === "codex") {
+                        const live = await resolveLiveCodexThreadId(seat.sessionName, currentGenDeps);
+                        if (!live.ok)
+                            return { ok: false, reason: live.reason };
+                        const rollout = contextUsageStore.readCodexAndNormalize({ threadId: live.id, sessionName: seat.sessionName }).transcriptPath;
+                        if (!rollout)
+                            return { ok: false, reason: `live thread ${live.id.slice(0, 8)}… has no readable rollout` };
+                        const model = readCodexEffectiveModel(rollout);
+                        return model ? { ok: true, model } : { ok: false, reason: `no model signal in the bounded read of ${rollout}` };
+                    }
+                    if (seat.runtime === "claude-code") {
+                        // D-a — RECORD-LIVENESS selection: no single pointer (sidecar, registry row, pane
+                        // argument) is generation-true; the transcript being WRITTEN is. Gather all candidate
+                        // ids, anchor paths beside the sidecar's project dir, pick the freshest-mtime record.
+                        const usage = contextUsageStore.readAndNormalize(seat.sessionName);
+                        const projectDir = usage.transcriptPath ? nodePathMod.dirname(usage.transcriptPath) : null;
+                        const pathFor = (id) => id && projectDir ? nodePathMod.join(projectDir, `${id}.jsonl`) : null;
+                        const tokenRow = db.prepare("SELECT resume_token FROM sessions WHERE node_id = ? AND session_name = ? ORDER BY id DESC LIMIT 1")
+                            .get(seat.nodeId, seat.sessionName);
+                        const paneArg = await paneClaudeSessionIdArgument(seat.sessionName, currentGenDeps);
+                        const selection = liveClaudeRecordSelector.select(`${seat.nodeId}:${seat.generation ?? seat.sessionName}`, [
+                            // every path variant rides per id — a dead sidecar path must not mask a readable
+                            // derived one (r2 round-4 adjacent pin)
+                            { source: "sidecar", id: usage.sessionId ?? "", path: usage.transcriptPath ?? null },
+                            { source: "sidecar", id: usage.sessionId ?? "", path: pathFor(usage.sessionId) },
+                            { source: "registry", id: tokenRow?.resume_token ?? "", path: pathFor(tokenRow?.resume_token) },
+                            { source: "pane-argument", id: paneArg.ok ? paneArg.id : "", path: pathFor(paneArg.ok ? paneArg.id : null) },
+                        ], (path) => { try {
+                            const st = nodeFs.statSync(path);
+                            return { mtimeMs: st.mtimeMs, size: st.size };
+                        }
+                        catch {
+                            return null;
+                        } });
+                        if (!selection.ok)
+                            return { ok: false, reason: selection.reason };
+                        const model = readClaudeEffectiveModel(selection.path);
+                        return model
+                            ? { ok: true, model }
+                            : { ok: false, reason: `no assistant turn yet in the live record ${selection.path} (selected by liveness from ${selection.source})` };
+                    }
+                    return { ok: false, reason: `runtime ${seat.runtime ?? "unknown"} has no effective-model reader yet` };
+                },
+                sendToSession: async (target, message) => {
+                    try {
+                        const result = await sessionTransport.send(target, message);
+                        return result.ok ? { ok: true } : { ok: false, error: result.error };
+                    }
+                    catch (err) {
+                        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+                    }
+                },
+                resolveOrchSeats: (rigName) => db.prepare(`
+          SELECT s.session_name AS sessionName
+            FROM sessions s JOIN nodes n ON n.id = s.node_id JOIN rigs r ON r.id = n.rig_id
+           WHERE r.name = ? AND s.status = 'running' AND n.logical_id LIKE 'orch.%'
+        `).all(rigName).map((row) => row.sessionName),
+                resolveOperatorSeat: () => {
+                    const value = deps.settingsStore?.resolveOne("workspace.operator_seat_name").value;
+                    return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+                },
+                resolveOversightSeat: () => {
+                    const row = db.prepare("SELECT session_name FROM sessions WHERE session_name = ? AND status = 'running' LIMIT 1").get(OVERSIGHT_SEAT);
+                    return row ? OVERSIGHT_SEAT : null;
+                },
+                recordProclamation: (proclamation) => {
+                    eventBus.emit({
+                        type: "seat.model_divergence",
+                        rigId: proclamation.rigId,
+                        nodeId: proclamation.nodeId,
+                        sessionName: proclamation.sessionName,
+                        runtime: proclamation.runtime,
+                        pinnedModel: proclamation.pinnedModel,
+                        effectiveModel: proclamation.effectiveModel,
+                        diagnosis: proclamation.diagnosis,
+                        channels: proclamation.channels,
+                    });
+                },
+            });
+            modelDivergenceMonitor.startPolling(60_000);
+            deps.modelDivergenceMonitor = modelDivergenceMonitor;
+        }
         // OPR.0.4.6.WF1 FR-4: the workflow startup resume sweep — re-arm
         // keepalives, reissue lost post-commit nudges (pending frontier
         // packets never nudged), surface stuck instances. Runs after the
@@ -1528,6 +1766,26 @@ export async function createDaemon(opts) {
                 console.warn(`workflow boot sweep: failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        // W1 (transactional closure) FR — the wake-intent RECOVERY SWEEP. Deliver
+        // any wake intents a crash left committed-but-undelivered (the terminal txn
+        // committed, so the intent is durable, but the process died before the
+        // post-commit deliver). Runs after transport is wired so the re-deliveries
+        // actually land. Non-fatal — a sweep failure must not bring the daemon down.
+        // No periodic timer (ruled out of scope): a transient failure lands the row
+        // in a VISIBLE state and is retried on the next start.
+        try {
+            // BLOCKING 1: reconcile abandoned `sending` claims (a prior crash) FIRST,
+            // then drain committed `pending` intents. Reconcile is a one-time boundary
+            // step, separate from the drain.
+            const reconciled = queueRepoInstance.reconcileAbandonedWakeIntents();
+            const drained = await queueRepoInstance.drainPendingWakeIntents();
+            if (drained.delivered || drained.indeterminate || drained.failed || reconciled) {
+                console.log(`wake-intent recovery sweep: delivered=${drained.delivered} indeterminate=${drained.indeterminate} failed=${drained.failed} reconciled=${reconciled}`);
+            }
+        }
+        catch (err) {
+            console.warn(`wake-intent recovery sweep: failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
     // Context monitor — constructed before createApp so routes can access pollOnce for refresh.
     // Caller (index.ts) starts polling after listen.
@@ -1537,18 +1795,41 @@ export async function createDaemon(opts) {
     const { ContextMonitor } = await import("./domain/context-monitor.js");
     const { ClaudeCompactionEnforcer } = await import("./domain/claude-compaction-enforcer.js");
     const compactionEnforcer = deps.sessionTransport
-        ? new ClaudeCompactionEnforcer(new ContextPackSettingsStore(), deps.sessionTransport)
+        ? new ClaudeCompactionEnforcer(new ContextPackSettingsStore(), deps.sessionTransport, 
+        // GHOST-STAGE (b): resolve the LIVE occupant generation (atom-B tenure ledger) for a session
+        // so a stage minted by a retired generation is refused for the successor. null = UNKNOWN → the
+        // gate is inert (never compares a stale generation as if live).
+        { resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName) })
         : undefined;
+    // 51-08 A1 — the over-time series rides the SAME 30s tick (PM decision 1):
+    // context lane appends beside the existing persist; the provider-window lane
+    // drains the same statusline cache directory the read model scans.
+    const { UsageSamplesStore, providerWindowSamplesFromSignals } = await import("./domain/usage-samples-store.js");
+    const usageSamplesStore = new UsageSamplesStore(db);
     const contextMonitor = new ContextMonitor(db, contextUsageStore, claudeAdapter, compactionEnforcer, {
         "claude-code": claudeAdapter,
         codex: codexAdapter,
         pi: piAdapter,
-    });
+    }, usageSamplesStore, () => providerWindowSamplesFromSignals(collectClaudeSignalsFromProviderUsageDirectory(nodePath.join(OPENRIG_HOME, "provider-usage"))));
     deps.contextMonitor = contextMonitor;
     // OPR.0.4.3.14 — expose the SAME enforcer instance to routes for the manual
     // compaction trigger. Sharing one instance with ContextMonitor is what makes
     // the manual back-half drain through the auto poll loop (no second path).
     deps.compactionEnforcer = compactionEnforcer;
+    // GHOST-STAGE (e/Class-B) — construct the canonical OccupantInvalidator now that both Class-A deps
+    // exist (the enforcer's in-mem maps 1a-1f + the context sidecar 2a). Injected into SeatHandoverService
+    // via the app context so commit()'s re-key call FIRES (it was a no-op until wired). An absent enforcer
+    // (degraded boot, no sessionTransport) falls back to a sidecar-only invalidator — never throws.
+    const { DefaultOccupantInvalidator } = await import("./domain/occupant-invalidator.js");
+    deps.occupantInvalidator = new DefaultOccupantInvalidator({
+        enforcer: compactionEnforcer ?? { invalidateOccupant: () => { } },
+        contextUsage: contextUsageStore,
+        // (e/Class-B) watchdog store — armed jobs registered by the retiring generation stop at swap.
+        watchdog: watchdogJobsRepoInstance,
+        // (e/Class-B) queue store — in-progress items claimed by the retiring generation release to pending.
+        queue: queueRepoInstance,
+        log: (msg) => console.warn(msg),
+    });
     // OPR.0.3.4.9 — periodic snapshot scheduler (crash-insurance floor).
     const { PeriodicSnapshotScheduler } = await import("./domain/periodic-snapshot-scheduler.js");
     const periodicSnapshotScheduler = new PeriodicSnapshotScheduler({