@openrig/cli 0.5.16 → 0.5.17

package/node_modules/@openrig/daemon/dist/startup.js

@@ -1,2183 +0,0 @@
-import { queueRecoveryOwnsWake } from "./domain/queue-wake-ladder.js";
-import { HealthPolicyStore } from "./domain/health-policy.js";
-import { HealthCheckpointSource } from "./domain/health-checkpoints.js";
-import { PassiveCeremonySource } from "./domain/health-passive-ceremony.js";
-import { HealthDiagnosisService } from "./domain/health-diagnosis.js";
-import { readHealthArtifact, healthAuthority, healthHumanReadiness } from "./domain/health-context.js";
-import { createDb } from "./db/connection.js";
-import { migrate } from "./db/migrate.js";
-// P8: apply the CANONICAL migration list — the single source of truth (db/all-migrations.ts),
-// never an inline copy that can drift out of sync with the daemon's schema.
-import { ALL_MIGRATIONS } from "./db/all-migrations.js";
-import { RigRepository } from "./domain/rig-repository.js";
-import { SessionRegistry } from "./domain/session-registry.js";
-import { isHumanSeatSessionRef, parseSessionName } from "./domain/session-name.js";
-import { resolveExternal } from "./domain/gateway/external-admission.js";
-import { loadHumanRegistry } from "./domain/gateway/human-registry.js";
-import { EventBus } from "./domain/event-bus.js";
-import { NodeLauncher } from "./domain/node-launcher.js";
-import { TmuxOptionDefaultsApplier } from "./domain/tmux-option-defaults.js";
-import { TmuxAdapter } from "./adapters/tmux.js";
-import { CmuxAdapter } from "./adapters/cmux.js";
-import { execCommand } from "./adapters/tmux-exec.js";
-import { createCmuxCliTransport } from "./adapters/cmux-transport.js";
-import { SnapshotRepository } from "./domain/snapshot-repository.js";
-import { CheckpointStore } from "./domain/checkpoint-store.js";
-import { SnapshotCapture } from "./domain/snapshot-capture.js";
-import { RestoreOrchestrator } from "./domain/restore-orchestrator.js";
-import { ClaudeResumeAdapter } from "./adapters/claude-resume.js";
-import { CodexResumeAdapter } from "./adapters/codex-resume.js";
-import { PiResumeAdapter } from "./adapters/pi-resume.js";
-import { RigSpecExporter } from "./domain/rigspec-exporter.js";
-import { PodRepository } from "./domain/pod-repository.js";
-import { RigSpecPreflight } from "./domain/rigspec-preflight.js";
-import { RigInstantiator } from "./domain/rigspec-instantiator.js";
-import { Reconciler } from "./domain/reconciler.js";
-import { PackageRepository } from "./domain/package-repository.js";
-import { InstallRepository } from "./domain/install-repository.js";
-import { InstallEngine } from "./domain/install-engine.js";
-import { InstallVerifier } from "./domain/install-verifier.js";
-import { BootstrapRepository } from "./domain/bootstrap-repository.js";
-import { RuntimeVerifier } from "./domain/runtime-verifier.js";
-import { RequirementsProbeRegistry } from "./domain/requirements-probe.js";
-import { ExternalInstallPlanner } from "./domain/external-install-planner.js";
-import { ExternalInstallExecutor } from "./domain/external-install-executor.js";
-import { PackageInstallService } from "./domain/package-install-service.js";
-import { BootstrapOrchestrator } from "./domain/bootstrap-orchestrator.js";
-import { TmuxDiscoveryScanner } from "./domain/tmux-discovery-scanner.js";
-import { SessionFingerprinter } from "./domain/session-fingerprinter.js";
-import { SessionEnricher } from "./domain/session-enricher.js";
-import { DiscoveryRepository } from "./domain/discovery-repository.js";
-import { DiscoveryCoordinator } from "./domain/discovery-coordinator.js";
-import { ClaimService } from "./domain/claim-service.js";
-import { SelfAttachService } from "./domain/self-attach-service.js";
-import { RigLifecycleService } from "./domain/rig-lifecycle-service.js";
-import { RigExpansionService } from "./domain/rig-expansion-service.js";
-// TODO: AS-T12 — migrate to pod-aware bundle source resolver
-import { LegacyBundleSourceResolver as BundleSourceResolver } from "./domain/bundle-source-resolver.js";
-import { PodBundleSourceResolver } from "./domain/bundle-source-resolver.js";
-import { PsProjectionService } from "./domain/ps-projection.js";
-import { SeatActivityService } from "./domain/seat-activity-service.js";
-import { readClaudeSelfReportEvidence } from "./adapters/claude-code-adapter.js";
-import { SeatStructuralActivityService } from "./domain/seat-structural-activity-service.js";
-import { deriveSelfHostIdSource, SeatIdentityReconciler, reconcileSelfHostIdentity } from "./domain/seat-identity-reconciler.js";
-import { SeatIdentityStore, SelfHostIdentityStore } from "./domain/seat-identity-store.js";
-import { DaemonLifecycleStore } from "./domain/daemon-lifecycle-store.js";
-import { randomUUID } from "node:crypto";
-import { setSelfHostId, setSelfHostIdSource } from "./domain/hosts/fanout-contract.js";
-import { UpCommandRouter } from "./domain/up-command-router.js";
-import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
-import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
-import { TranscriptStore } from "./domain/transcript-store.js";
-import { resumeRunningTranscriptCaptures } from "./domain/transcript-capture.js";
-import { SessionTransport } from "./domain/session-transport.js";
-import { AgentActivityStore } from "./domain/agent-activity-store.js";
-import { HistoryQuery } from "./domain/history-query.js";
-import { AskService } from "./domain/ask-service.js";
-import { WakeResolveService } from "./domain/wake-resolve-service.js";
-import { ChatRepository } from "./domain/chat-repository.js";
-import { StreamStore } from "./domain/stream-store.js";
-import { SlowOpRecorder } from "./domain/slow-op-recorder.js";
-import { configureSyncSiteRecorder } from "./domain/sync-site-wrap.js";
-import { QueueRepository, isBlockerLive } from "./domain/queue-repository.js";
-import { createWorkflowFrontierPredicate } from "./domain/workflow-frontier-guard.js";
-import { InboxHandler } from "./domain/inbox-handler.js";
-import { OutboxHandler } from "./domain/outbox-handler.js";
-import { ProjectClassifier } from "./domain/project-classifier.js";
-import { ClassifierLeaseManager } from "./domain/classifier-lease-manager.js";
-import { ViewProjector } from "./domain/view-projector.js";
-import { wireViewEventBridge } from "./domain/view-event-bridge.js";
-import { WatchdogJobsRepository } from "./domain/watchdog-jobs-repository.js";
-import { WatchdogAutoRegistration } from "./domain/watchdog-auto-registration.js";
-import { WatchdogHistoryLog } from "./domain/watchdog-history-log.js";
-import { formatWatchdogDeliveryMessage, WatchdogPolicyEngine, } from "./domain/watchdog-policy-engine.js";
-import { WatchdogScheduler } from "./domain/watchdog-scheduler.js";
-import { ContinuityPolicyMaterializer, createContinuityCutoverBaton, findClaudeTranscriptByToken, recordManagedWidthReceipt, } from "./domain/continuity-policy-materializer.js";
-import { WorkflowRuntime } from "./domain/workflow-runtime.js";
-import { resolveWorkflowHumanDestination } from "./domain/workflow-human-destination.js";
-import { makeWorkflowKeepalivePolicy } from "./domain/policies/workflow-keepalive.js";
-import { makeIdleGateQitemPolicy } from "./domain/policies/idle-gate-qitem.js";
-import { makeParkedOwnerConsumerPolicy, makeRigAnchor, PARKED_OWNER_POLICY_NAME } from "./domain/policies/parked-owner-consumer.js";
-import { diagnoseRigParked } from "./domain/parked-query.js";
-import { SpecReviewService } from "./domain/spec-review-service.js";
-import { SpecLibraryService } from "./domain/spec-library-service.js";
-// Phase 3a slice 3.3 — plugin discovery service.
-import { PluginDiscoveryService } from "./domain/plugin-discovery-service.js";
-// Slice 28 Checkpoint C-3 — skill-library discovery (SC-29 #11 cumulative).
-import { SkillLibraryDiscoveryService } from "./domain/skill-library-discovery.js";
-import { ContextPackLibraryService } from "./domain/context-packs/context-pack-library-service.js";
-import { openRigContextLibraryRoots } from "./domain/instance-initialization.js";
-import { resolveSystemWorld } from "./domain/system-world.js";
-import { AgentImageLibraryService } from "./domain/agent-images/agent-image-library-service.js";
-import { SnapshotCapturer } from "./domain/agent-images/snapshot-capturer.js";
-import { SettingsStore as ContextPackSettingsStore } from "./domain/user-settings/settings-store.js";
-import { WhoamiService } from "./domain/whoami-service.js";
-import { NodeCmuxService } from "./domain/node-cmux-service.js";
-import { createAppWithWebSocket } from "./server.js";
-import { ProviderServiceImpl } from "./domain/provider/provider-service-impl.js";
-import { collectClaudeSignalsFromProviderUsageDirectory } from "./domain/provider/claude-usage-reader.js";
-import { legacyProviderUsageDirectory, providerUsageDirectory } from "./domain/telemetry-state-paths.js";
-import { execFile } from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import nodePath from "node:path";
-// Slice 11 (release-0.3.1 workflow-spec-folder-discovery) — adds
-// status + error_message columns to workflow_specs so the scanner
-// can record diagnostic rows. SC-29 #10 declared verbatim in commit body.
-import { RigModeStore } from "./domain/rig-mode/rig-mode-store.js";
-import { OperatingPostureService } from "./domain/rig-mode/operating-posture.js";
-import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
-import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
-import { MissionControlReadLayer } from "./domain/mission-control/mission-control-read-layer.js";
-import { MissionControlFleetCliCapability, makeLocalCliCapabilityProbe, } from "./domain/mission-control/mission-control-fleet-cli-capability.js";
-import { MissionControlAuditBrowse } from "./domain/mission-control/audit-browse.js";
-import { MissionControlNotificationDispatcher } from "./domain/mission-control/notification-dispatcher.js";
-import { NtfyNotificationAdapter } from "./domain/mission-control/notification-adapter-ntfy.js";
-import { WebhookNotificationAdapter } from "./domain/mission-control/notification-adapter-webhook.js";
-import { OPENRIG_HOME } from "./openrig-compat.js";
-import { materializeBuiltinPolicyReference } from "./domain/builtin-policy-reference.js";
-import { ensureActivityHookToken, writeActivityEndpointFile, deriveActivityUrl, readActivityEndpointFile } from "./domain/activity-endpoint.js";
-import { getCompatibleOpenRigPath, getDefaultOpenRigPath, readOpenRigEnv, } from "./openrig-compat.js";
-const KNOWN_PROVIDER_AUTH_ENV = new Set([
-    "ANTHROPIC_API_KEY",
-    "ANTHROPIC_AUTH_TOKEN",
-    "CLAUDE_CODE_OAUTH_TOKEN",
-    "OPENAI_API_KEY",
-    "OPENAI_BASE_URL",
-    "OPENAI_ORG_ID",
-    "OPENAI_PROJECT_ID",
-    // OPR.0.4.6.PI1 FR-7 — Pi seat providers. Without these in the KNOWN set,
-    // a daemon-launched Pi seat can never receive its provider key (the
-    // pi-runner's own deny-by-default allowlist then has nothing to pass
-    // through). Double opt-in preserved: the operator must still name each var
-    // in recovery.provider_auth_env_allowlist. OpenRouter is the founder-ruled
-    // preferred path (2026-07-06); zai/kimi-coding are the secondary natives.
-    "OPENROUTER_API_KEY",
-    "ZAI_API_KEY",
-    "KIMI_API_KEY",
-]);
-export function collectAllowlistedProviderAuthEnv(raw, env) {
-    const out = {};
-    for (const item of (raw ?? "").split(",")) {
-        const name = item.trim();
-        if (!name)
-            continue;
-        if (!/^[A-Z_][A-Z0-9_]*$/.test(name))
-            continue;
-        if (!KNOWN_PROVIDER_AUTH_ENV.has(name))
-            continue;
-        const value = env[name];
-        if (typeof value === "string" && value.length > 0) {
-            out[name] = value;
-        }
-    }
-    return out;
-}
-export async function createDaemon(opts) {
-    const daemonHome = os.homedir();
-    const configuredCodexHome = process.env.CODEX_HOME;
-    if (configuredCodexHome && !nodePath.isAbsolute(configuredCodexHome)) {
-        throw new Error(`CODEX_HOME must be an absolute path for managed seats: ${configuredCodexHome}`);
-    }
-    const codexHome = configuredCodexHome || nodePath.join(daemonHome, ".codex");
-    const dbPath = opts?.dbPath ?? ":memory:";
-    const db = createDb(dbPath);
-    migrate(db, ALL_MIGRATIONS);
-    // 51-09 increment 1 — establish the daemon's durable self-host identity at
-    // boot (mint on first boot, reconcile thereafter). host.name is a display-only
-    // CANDIDATE SEED (arch ruling cb19867f / DP4). Boot proceeds on a host.name
-    // conflict (the stored id is kept and the conflict is surfaced loudly).
-    const hostNameCandidate = new ContextPackSettingsStore().resolveOne("host.name").value;
-    const selfHost = reconcileSelfHostIdentity(new SelfHostIdentityStore(db), {
-        nowIso: new Date().toISOString(),
-        hostNameCandidate,
-    });
-    // 51-09 increment 2 — publish the resolved self-host id so the read-through
-    // (and, in increment 4, the queue-destination validator) resolve a request
-    // addressed to THIS host's own id HOME, instead of dialing/validating it as a
-    // remote/unknown host. Distinct spelling from the 'local' sentinel.
-    setSelfHostId(selfHost.hostId);
-    // Slice 14 §2c — derived from the SAME candidate the reconcile just used, so the two can never
-    // disagree, and computed here rather than per request (see fanout-contract).
-    setSelfHostIdSource(deriveSelfHostIdSource(selfHost.hostId, hostNameCandidate));
-    // P7 — the daemon's LIFECYCLE record (distinct from the 059 identity record).
-    // A new boot mints a fresh epoch, stamps started_at, and clears any prior run's
-    // stopped_at/heartbeat. The heartbeat (index.ts post-bind) advances last-seen
-    // while running; a clean shutdown (index.ts shutdown, AFTER stopping the timer)
-    // stamps stopped_at for THIS epoch.
-    const daemonLifecycleStore = new DaemonLifecycleStore(db);
-    const daemonBootEpoch = randomUUID();
-    daemonLifecycleStore.recordBoot(daemonBootEpoch, new Date().toISOString());
-    const rigRepo = new RigRepository(db);
-    const sessionRegistry = new SessionRegistry(db);
-    const eventBus = new EventBus(db);
-    const streamStore = new StreamStore(db, eventBus);
-    const slowOpRecorder = opts?.slowOpRecorder ?? (dbPath === ":memory:"
-        ? undefined
-        : new SlowOpRecorder({
-            logPath: nodePath.join(OPENRIG_HOME, "logs", "slow-operations.jsonl"),
-        }));
-    configureSyncSiteRecorder(slowOpRecorder);
-    // Instrumentation wiring is observe-only: neither a throwing registration
-    // call nor a throwing callback body (streamStore.emit) may abort createDaemon
-    // or later wrapped work. Guard both boundaries.
-    try {
-        slowOpRecorder?.setDegradedHandler?.(({ reason, site }) => {
-            try {
-                streamStore.emit({
-                    sourceSession: "daemon@kernel",
-                    body: `slow-operation instrumentation degraded: ${reason} at ${site}`,
-                    hintType: "observation",
-                    hintUrgency: "high",
-                    hintTags: ["daemon", "slow-operation", "observability-degraded"],
-                });
-            }
-            catch (error) {
-                console.error("[slow-operation] degradation notification failed", error);
-            }
-        });
-    }
-    catch (error) {
-        console.error("[slow-operation] setDegradedHandler registration failed", error);
-    }
-    // PL-004 Phase A revision (R1): topology-backed validateRig.
-    // Reject `<member>@<unknown-rig>` shapes by checking the rig portion
-    // against the rig registry. Bare ids without `@` are also rejected
-    // (no canonical rig binding).
-    // OPR.0.4.6.MH1 FR-8: this gate is the ARCHETYPE consumer of the shared
-    // parse contract — human-seat classification BEFORE parse, then the
-    // greedy first-@ rig (so "member@rig@x" looks up rig "rig@x", misses,
-    // and rejects with the same unknown_destination_rig as ever — BR-1).
-    const topologyValidateRig = (sessionRef) => {
-        const parsed = parseSessionName(sessionRef);
-        // M1 A4b — @external entity-admission (checked BEFORE the human-CLASS bare-admit,
-        // which A2 also makes true for <local>@external): a queue row destinationed to
-        // <local>@external is admitted ONLY if the human is REGISTERED (or it is a literal
-        // scheme address); an unregistered entity is REFUSED (the 4b site carries the
-        // entity-level teaching via externalAdmissionTeaching). Admission is the gateway's
-        // job, never the classifier's (arch 8cd30094).
-        if (parsed.kind === "external") {
-            const reg = loadHumanRegistry();
-            const entities = reg.ok ? reg.entities.map((e) => ({ entityId: e.entityId, address: e.address })) : [];
-            return resolveExternal(parsed.local, entities).kind !== "unregistered";
-        }
-        if (isHumanSeatSessionRef(sessionRef))
-            return true;
-        if (parsed.kind !== "canonical")
-            return false;
-        return rigRepo.findRigsByName(parsed.rig).length > 0;
-    };
-    // PL-004 Phase A — shared coordination services. Constructed early so
-    // both the queueRepo dep slot and inboxHandler can share one instance.
-    // Transport is wired after SessionTransport instantiation below via
-    // attachTransport().
-    const queueRepoInstance = new QueueRepository(db, eventBus, {
-        validateRig: topologyValidateRig,
-        // OPR.0.4.6.WF3 FR-6 — the frontier close-path guard's predicate,
-        // INJECTED here (arch layering pin: the queue never imports the
-        // workflow domain; startup wires them — the validateRig precedent).
-        workflowFrontierPredicate: createWorkflowFrontierPredicate(db),
-        // GHOST-STAGE (h): resolve the source seat's atom-B generation for the handoff-nudge Sent: line
-        // (same injected-predicate layering — the queue never imports the session domain).
-        resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
-    });
-    // W1 (transactional closure): ONE OutboxHandler shared between the deps slot
-    // (sender-side audit surface) and the queue repo's durable wake-intent
-    // staging. Same `db`, so a stageWakeIntent() call inside a terminal
-    // db.transaction commits atomically with the close + successor create.
-    const outboxHandlerInstance = new OutboxHandler(db);
-    queueRepoInstance.attachOutbox(outboxHandlerInstance);
-    // PL-004 Phase B — classifier lease manager. Constructed early so both
-    // the leaseManager dep slot and project-classifier can share one instance.
-    // isAlive is post-attached after whoami-service is constructed.
-    const classifierLeaseManagerInstance = new ClassifierLeaseManager(db, eventBus);
-    // PL-004 Phase B — view-projector. Constructed early so both the
-    // viewProjector dep slot and the view-event-bridge can share one instance.
-    const viewProjectorInstance = new ViewProjector(db, eventBus);
-    // PL-004 Phase B R1 (closes guard BLOCKER 2): wire the view event bridge
-    // so queue/inbox/project mutations emit view.changed for affected built-in
-    // views. SSE consumers on /api/views/:name/sse now receive change events
-    // when underlying state mutates.
-    wireViewEventBridge(eventBus, viewProjectorInstance);
-    // PL-004 Phase C — watchdog supervision tree. Repository + history-log
-    // are constructed early; the policy engine + scheduler are constructed
-    // after SessionTransport is available so the engine can wire delivery.
-    const watchdogJobsRepoInstance = new WatchdogJobsRepository(db, undefined, // now (default clock)
-    // GHOST-STAGE (e/Class-B): stamp the arming occupant's generation so a swap can drop its armed jobs.
-    (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName));
-    queueRepoInstance.attachWatchdogJobsRepository(watchdogJobsRepoInstance);
-    const watchdogAutoRegistration = new WatchdogAutoRegistration({
-        db,
-        jobsRepo: watchdogJobsRepoInstance,
-        settingsStore: new ContextPackSettingsStore(),
-        warn: (message) => console.warn(message),
-    });
-    sessionRegistry.setWatchdogRegistrationObserver(watchdogAutoRegistration);
-    // Existing sessions predate the structural mint hook. Audit them at every
-    // boot without creating jobs: additive coverage stays loud, core boot stays live.
-    watchdogAutoRegistration.assertLiveSeatCoverage();
-    const watchdogHistoryLogInstance = new WatchdogHistoryLog(db);
-    const tmuxAdapter = new TmuxAdapter(opts?.tmuxExec ?? execCommand);
-    // Slice 15 — Seat-activity service for the `terminal-active` primitive.
-    // Lives at module scope so the projection chain (PsProjectionService,
-    // node-inventory enrichment) reads from one source. Default silence
-    // window: 3s per slice 15 README. Per-seat silenceWindowSeconds from
-    // AgentSpec.profile.activity is currently inert (the poller uses the
-    // global default; per-seat windows are not wired to the live poll).
-    const seatActivityService = new SeatActivityService({
-        tmux: tmuxAdapter,
-        defaultWindowSeconds: 3,
-        eventBus,
-        // S19 — the Claude self-report rung (pid.json), consulted per sweep for seats whose
-        // declared inventory staffs it; unreadable = null = the ladder falls, never errors.
-        selfReportReader: (sessionName, seatNodeId) => {
-            const sessionsDir = nodePath.join(process.env.CLAUDE_CONFIG_DIR ?? nodePath.join(os.homedir(), ".claude"), "sessions");
-            return readClaudeSelfReportEvidence({ sessionsDir, sessionName, seatNodeId });
-        },
-    });
-    // 5b82324b — the STRUCTURAL activity cache (sibling of SeatActivityService). Captures pane TEXT once
-    // per running seat per tick + classifies motion STRUCTURALLY, so the `rig ps` ACTIVITY column reflects
-    // real liveness for hook-less / stale-hook / turn-boundary seats WITHOUT a per-request capture storm.
-    const seatStructuralActivityService = new SeatStructuralActivityService(tmuxAdapter);
-    // OPR.0.4.3.19 — SeatIdentityReconciler owns the liveness identity verdict
-    // (the THIRD axis). Reconciles each running seat's pane PID/command against
-    // the registered binding and persists the verdict so node-inventory can gate
-    // the running/active green derivations. Started post-bind in index.ts.
-    const seatIdentityReconciler = new SeatIdentityReconciler({
-        db,
-        tmux: tmuxAdapter,
-    });
-    // cmuxFactory takes precedence (for tests), then cmuxExec-based CLI transport, then default
-    const cmuxFactory = opts?.cmuxFactory
-        ?? createCmuxCliTransport(opts?.cmuxExec ?? execCommand);
-    const cmuxAdapter = new CmuxAdapter(cmuxFactory, { timeoutMs: opts?.cmuxTimeoutMs ?? 5000 });
-    // Read transcript config from env (passed by CLI via PNS-T02 config surface)
-    const transcriptsEnabled = readOpenRigEnv("OPENRIG_TRANSCRIPTS_ENABLED", "RIGGED_TRANSCRIPTS_ENABLED") !== "false";
-    const transcriptsPath = readOpenRigEnv("OPENRIG_TRANSCRIPTS_PATH", "RIGGED_TRANSCRIPTS_PATH") || undefined;
-    const activityHookToken = readOpenRigEnv("OPENRIG_ACTIVITY_HOOK_TOKEN", "RIGGED_ACTIVITY_HOOK_TOKEN") || undefined;
-    const activityHookUrl = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL") || undefined;
-    const openRigPort = readOpenRigEnv("OPENRIG_PORT", "RIGGED_PORT") || undefined;
-    const openRigHost = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST") || undefined;
-    // OPR.0.4.3.28 B2 — self-provision a STABLE activity url+token so launched
-    // seats reach the ingest endpoint without operator shell seeding (the
-    // confirmed live break). The token persists across daemon restarts (matches
-    // already-launched seats' frozen env); the URL derives from the daemon's
-    // loopback + port (DEFAULT_PORT 7433 fallback). The SAME token becomes both
-    // the ingest expected-token (server dep below) and the seats' env value, so
-    // hook POSTs authenticate. Also snapshotted to activity-endpoint.json for the
-    // relay file-discovery fallback used by reconcile/restored seats (B3).
-    const resolvedActivityHookToken = activityHookToken ?? ensureActivityHookToken(OPENRIG_HOME);
-    // Derive from the daemon's OWN bound host+port (honors an explicit OPENRIG_HOST
-    // single-host bind; wildcard/absent → loopback) so seats post to a reachable
-    // address — a hardcoded 127.0.0.1 breaks an explicit tailnet/hostname bind.
-    const resolvedActivityHookUrl = activityHookUrl ?? deriveActivityUrl(openRigHost, openRigPort);
-    writeActivityEndpointFile(OPENRIG_HOME, { baseUrl: resolvedActivityHookUrl, token: resolvedActivityHookToken });
-    const startupSettings = new ContextPackSettingsStore().resolveConfig();
-    const providerAuthEnv = collectAllowlistedProviderAuthEnv(startupSettings.recoveryProviderAuthEnvAllowlistRaw, process.env);
-    const transcriptStore = new TranscriptStore({
-        enabled: transcriptsEnabled,
-        transcriptsRoot: transcriptsPath,
-    });
-    // Shared launch identity/activity env — used by NodeLauncher at launch AND
-    // by the seat-handover full-cycle composer when it creates a successor
-    // session (OPR.0.4.3.04), so a handed-over successor self-identifies +
-    // reports activity exactly like a launched seat.
-    const launchSessionEnv = {
-        PATH: process.env.PATH,
-        OPENRIG_HOME,
-        OPENRIG_PORT: openRigPort,
-        OPENRIG_HOST: openRigHost,
-        OPENRIG_URL: resolvedActivityHookUrl,
-        OPENRIG_ACTIVITY_HOOK_TOKEN: resolvedActivityHookToken,
-        ...providerAuthEnv,
-        HOME: daemonHome,
-        CODEX_HOME: codexHome,
-    };
-    // OPR.0.4.6.02 S1 — ONE shared tmux option-defaults applier, injected into
-    // BOTH NodeLauncher and (via AppDeps → the seat-handover route) the fresh
-    // successor launcher, so every fresh seat gets the same mouse/status/
-    // clipboard defaults and the server-scope defaults assert once per daemon
-    // lifetime (shared memo). The status-bar read resolves `terminal.status_bar`
-    // FRESH per launch (resolveOne re-reads the config file) so an operator flip
-    // applies to the NEXT launch without a daemon restart; a resolution failure
-    // falls back to off (bar hidden).
-    const tmuxOptionSettings = new ContextPackSettingsStore();
-    const tmuxOptionDefaults = new TmuxOptionDefaultsApplier({
-        tmuxAdapter,
-        platform: opts?.tmuxOptionPlatform,
-        readTmuxOptionDefaults: () => {
-            try {
-                return { statusBar: tmuxOptionSettings.resolveOne("terminal.status_bar").value === true };
-            }
-            catch {
-                return { statusBar: false };
-            }
-        },
-    });
-    const nodeLauncher = new NodeLauncher({
-        db,
-        rigRepo,
-        sessionRegistry,
-        eventBus,
-        tmuxAdapter,
-        transcriptStore,
-        sessionEnv: launchSessionEnv,
-        tmuxOptionDefaults,
-    });
-    const snapshotRepo = new SnapshotRepository(db);
-    const checkpointStore = new CheckpointStore(db);
-    const snapshotCapture = new SnapshotCapture({ db, rigRepo, sessionRegistry, eventBus, snapshotRepo, checkpointStore });
-    const claudeResume = new ClaudeResumeAdapter(tmuxAdapter);
-    const codexResume = new CodexResumeAdapter(tmuxAdapter, { launchPath: process.env.PATH });
-    // OPR.0.4.6.PI1 — the Pi seat-state root + the compiled runner entry (daemon
-    // dist). Shared by the Pi runtime adapter, the resume adapter, and the
-    // resume-token capture sidecar reader.
-    const piStateRoot = nodePath.join(OPENRIG_HOME, "state", "pi");
-    const piRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/pi-runner.js");
-    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
-    // Services infrastructure (RigEnv) — created early so restore/bootstrap can use it
-    const { ComposeServicesAdapter } = await import("./adapters/compose-services-adapter.js");
-    const { ServiceOrchestrator } = await import("./domain/service-orchestrator.js");
-    const composeAdapter = new ComposeServicesAdapter(opts?.tmuxExec ?? execCommand);
-    const serviceOrchestrator = new ServiceOrchestrator({ rigRepo, composeAdapter });
-    const restoreOrchestrator = new RestoreOrchestrator({
-        db, rigRepo, sessionRegistry, eventBus, snapshotRepo, snapshotCapture,
-        checkpointStore, nodeLauncher, tmuxAdapter, claudeResume, codexResume, piResume,
-        transcriptStore, serviceOrchestrator,
-    });
-    // Connect to cmux at startup — degrades gracefully if absent
-    await cmuxAdapter.connect();
-    // Reconcile all managed rigs — marks stale sessions as detached.
-    // Capture aggregate counts and log a compact summary so cold-start truth
-    // repair is visible in daemon output instead of silently swallowed.
-    const reconciler = new Reconciler({ db, sessionRegistry, eventBus, tmuxAdapter });
-    const rigs = rigRepo.listRigs();
-    let reconcileChecked = 0;
-    let reconcileDetached = 0;
-    let reconcileErrors = 0;
-    for (const rig of rigs) {
-        try {
-            const result = await reconciler.reconcile(rig.id);
-            reconcileChecked += result.checked;
-            reconcileDetached += result.detached;
-            reconcileErrors += result.errors.length;
-            for (const e of result.errors) {
-                try {
-                    // eslint-disable-next-line no-console
-                    console.warn(`startup reconcile warning: rig=${rig.id} session=${e.sessionId} error=${e.error}`);
-                }
-                catch { /* logging must never throw */ }
-            }
-        }
-        catch (err) {
-            reconcileErrors += 1;
-            try {
-                // eslint-disable-next-line no-console
-                console.warn(`startup reconcile warning: rig=${rig.id} error=${err instanceof Error ? err.message : String(err)}`);
-            }
-            catch { /* logging must never throw */ }
-        }
-    }
-    try {
-        // eslint-disable-next-line no-console
-        console.log(`startup reconcile: rigs=${rigs.length} checked=${reconcileChecked} detached=${reconcileDetached} errors=${reconcileErrors}`);
-    }
-    catch { /* logging must never throw */ }
-    // Transcript rotators are process-local. Reattach them after lifecycle
-    // reconciliation so surviving tmux sessions keep ingesting across daemon
-    // restarts while genuinely detached sessions stay excluded.
-    try {
-        await resumeRunningTranscriptCaptures(db, tmuxAdapter, transcriptStore);
-    }
-    catch (err) {
-        try {
-            // eslint-disable-next-line no-console
-            console.warn(`startup transcript capture warning: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        catch { /* logging must never throw */ }
-    }
-    const podRepo = new PodRepository(db);
-    const rigSpecExporter = new RigSpecExporter({ rigRepo, sessionRegistry, podRepo });
-    const rigSpecPreflight = new RigSpecPreflight({
-        rigRepo, tmuxAdapter, exec: opts?.tmuxExec ?? execCommand, cmuxExec: opts?.cmuxExec ?? execCommand,
-    });
-    const rigInstantiator = new RigInstantiator({
-        db, rigRepo, sessionRegistry, eventBus, nodeLauncher, preflight: rigSpecPreflight, tmuxAdapter,
-    });
-    // Phase 4: Package install services
-    const packageRepo = new PackageRepository(db);
-    const installRepo = new InstallRepository(db);
-    const engineFsOps = {
-        readFile: (p) => fs.readFileSync(p, "utf-8"),
-        writeFile: (p, content) => fs.writeFileSync(p, content, "utf-8"),
-        exists: (p) => fs.existsSync(p),
-        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-        copyFile: (src, dest) => fs.copyFileSync(src, dest),
-        deleteFile: (p) => fs.unlinkSync(p),
-    };
-    const installEngine = new InstallEngine(installRepo, engineFsOps);
-    const verifierFsOps = {
-        readFile: (p) => fs.readFileSync(p, "utf-8"),
-        exists: (p) => fs.existsSync(p),
-    };
-    const installVerifier = new InstallVerifier(installRepo, packageRepo, verifierFsOps);
-    // Phase 5: Bootstrap services
-    const bootstrapRepo = new BootstrapRepository(db);
-    const exec = opts?.tmuxExec ?? execCommand;
-    const runtimeVerifier = new RuntimeVerifier({ exec, db });
-    const probeRegistry = new RequirementsProbeRegistry(exec);
-    const externalInstallPlanner = new ExternalInstallPlanner();
-    const externalInstallExecutor = new ExternalInstallExecutor({ exec, db });
-    const packageInstallService = new PackageInstallService({ packageRepo, installRepo, installEngine, installVerifier });
-    const resolverFsOps = {
-        readFile: (p) => fs.readFileSync(p, "utf-8"),
-        exists: (p) => fs.existsSync(p),
-        listFiles: (dirPath) => {
-            const results = [];
-            function walk(dir, prefix) {
-                for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-                    if (entry.isDirectory())
-                        walk(nodePath.join(dir, entry.name), nodePath.join(prefix, entry.name));
-                    else
-                        results.push(prefix ? nodePath.join(prefix, entry.name) : entry.name);
-                }
-            }
-            walk(dirPath, "");
-            return results;
-        },
-    };
-    const bundleSourceResolver = new BundleSourceResolver({ fsOps: resolverFsOps });
-    // Pod-aware instantiator (AgentSpec reboot)
-    const { PodRigInstantiator } = await import("./domain/rigspec-instantiator.js");
-    const { reconcileSkillLoadout } = await import("./domain/skill-catalog.js");
-    const { StartupOrchestrator } = await import("./domain/startup-orchestrator.js");
-    const { ClaudeCodeAdapter } = await import("./adapters/claude-code-adapter.js");
-    // P20 — the projection manifest: record-at-apply so the projector can later
-    // discriminate a stale re-projection (safe overwrite) from an operator edit (protect).
-    const { ProjectionManifestStore } = await import("./domain/projection-manifest-store.js");
-    const { hashContent } = await import("./domain/conflict-detector.js");
-    const projectionManifestStore = new ProjectionManifestStore(db);
-    // atom-4b — probe the manifest's readability AT BOOT. A rare per-lookup throw protects that one
-    // target (conflict-detector: broken≠absent → operator_conflict); but a WHOLE-TABLE-unreadable
-    // manifest degrades EVERY projection to protect — no overwrite ever applies — a safe but otherwise
-    // SILENT systemic degrade. Warn loudly at boot so the operator knows projections are held pending a
-    // DB repair, rather than silently discovering nothing projects.
-    if (!projectionManifestStore.isReadable()) {
-        console.warn("projection-manifest UNREADABLE at boot — every projection will degrade to PROTECT (no overwrites apply) until the DB is repaired; investigate projection_manifest (migration 064).");
-    }
-    const { CodexRuntimeAdapter } = await import("./adapters/codex-runtime-adapter.js");
-    const { PiRuntimeAdapter } = await import("./adapters/pi-runtime-adapter.js");
-    const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
-    const runtimeSettings = new ContextPackSettingsStore().resolveConfig();
-    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
-                if (e.isDirectory())
-                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
-                else
-                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
-    const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
-                if (e.isDirectory())
-                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
-                else
-                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome, launchPath: process.env.PATH, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
-    // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
-    // shape as the Codex adapter; seat isolation roots under piStateRoot.
-    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
-                if (e.isDirectory())
-                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
-                else
-                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; } }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
-    // OPR.0.5.1.1 — the stub runtime adapter (Pi-shaped node-script runner in a pane).
-    // Same fsOps shape as Pi; the compiled runner entry lives in the daemon dist.
-    const { StubRuntimeAdapter } = await import("./adapters/stub-runtime-adapter.js");
-    const stubRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/stub-runner.js");
-    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
-                if (e.isDirectory())
-                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
-                else
-                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; } }, runnerEntryPath: stubRunnerEntryPath });
-    // plugin-primitive Phase 3a slice 3.5 — ensure Codex feature flag
-    // codex_hooks = true is set in ~/.codex/config.toml so plugin-shipped
-    // hooks fire on Codex runtime. Slice 27 also creates the default
-    // user-owned Claude compaction extra-instructions placeholder.
-    // Operator can disable Codex hooks via OPENRIG_RUNTIME_CODEX_HOOKS_ENABLED
-    // or rig config set runtime.codex.hooks_enabled false.
-    try {
-        const { SettingsStore, ensureDefaultClaudeCompactionFiles, } = await import("./domain/user-settings/settings-store.js");
-        ensureDefaultClaudeCompactionFiles(OPENRIG_HOME);
-        const settingsStore = new SettingsStore();
-        const enabled = settingsStore.resolveOne("runtime.codex.hooks_enabled").value;
-        let codexVersion;
-        const codexVersionRow = db.prepare("SELECT version FROM runtime_verifications WHERE runtime = 'codex' ORDER BY verified_at DESC LIMIT 1").get();
-        if (codexVersionRow?.version) {
-            codexVersion = codexVersionRow.version;
-        }
-        else {
-            try {
-                const verifyResult = await runtimeVerifier.verifyCodex();
-                codexVersion = verifyResult.version ?? undefined;
-            }
-            catch { /* codex not available — skip feature flag */ }
-        }
-        codexAdapter.ensureCodexFeatureFlag(enabled, { codexVersion });
-        // OPR.0.4.1.10 FR-A — project the OpenRig activity hooks into the Codex config
-        // layer so Codex seats are hook-PRIMARY for the rig-send prompt guard (and gain
-        // SessionStart/UserPromptSubmit/Stop observability) from clean shipped config.
-        // Same enable gate as the feature flag; trust is auto-cleared at launch.
-        if (enabled) {
-            codexAdapter.ensureCodexActivityHooks();
-        }
-        else {
-            // OPR.0.4.1.10 B3 — durable disable: strip any previously-written managed [hooks] block.
-            codexAdapter.removeCodexActivityHooks();
-        }
-    }
-    catch (err) {
-        console.error(`[openrig] runtime setup warning: ${err.message}`);
-    }
-    // plugin-primitive Phase 3a slice 3.2 — vendor openrig-core plugin to
-    // ~/.openrig/plugins/openrig-core/ on first launch. Auto-fetch from
-    // github.com/mvschwarz/openrig-plugins is best-effort + 404-tolerant
-    // (repo currently empty as of 2026-05-10; vendored
-    // copy is the source of truth at v0).
-    try {
-        const { PluginVendorService } = await import("./domain/plugin-vendor-service.js");
-        const vendoredAssetsDir = nodePath.resolve(import.meta.dirname, "../assets/plugins");
-        const userPluginsDir = getDefaultOpenRigPath("plugins");
-        const realFs = {
-            readFile: (p) => fs.readFileSync(p, "utf-8"),
-            writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
-            exists: (p) => fs.existsSync(p),
-            mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-            listFiles: (dir) => {
-                const r = [];
-                function w(d, pre) {
-                    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
-                        if (e.isDirectory())
-                            w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
-                        else
-                            r.push(pre ? nodePath.join(pre, e.name) : e.name);
-                    }
-                }
-                w(dir, "");
-                return r;
-            },
-            statMode: (p) => fs.statSync(p).mode,
-            chmod: (p, m) => fs.chmodSync(p, m),
-        };
-        const httpClient = async (url, opts) => {
-            const ctrl = new AbortController();
-            const timer = setTimeout(() => ctrl.abort(), opts?.timeoutMs ?? 5000);
-            try {
-                const resp = await fetch(url, { signal: ctrl.signal });
-                return { ok: resp.ok, status: resp.status };
-            }
-            finally {
-                clearTimeout(timer);
-            }
-        };
-        const vendorService = new PluginVendorService({
-            vendoredAssetsDir,
-            userPluginsDir,
-            fs: realFs,
-            httpClient,
-            logger: (...args) => console.log("[openrig]", ...args),
-        });
-        await vendorService.ensureLatest("openrig-core");
-        vendorService.ensureSkillGlobally("openrig-core", "openrig-skills", [
-            nodePath.join(os.homedir(), ".claude", "skills"),
-            nodePath.join(os.homedir(), ".agents", "skills"),
-        ]);
-    }
-    catch (err) {
-        console.error(`[openrig] plugin vendor setup warning: ${err.message}`);
-    }
-    // PL-014: one daemon-scoped ContextPackLibraryService backs the
-    // delivery-free /api/context-packs list/sync/compose/read/delete/preview/pieces
-    // routes. Startup context-pack expansion is intentionally unsupported;
-    // dedicated send/broadcast/walk/queue verbs own delivery.
-    const contextPackLibrary = (() => {
-        // OPR.0.5.9.5 Wave B — config-resolved canonical context library. The
-        // shared instance initializer normally creates both roots; the mkdirs keep
-        // direct createDaemon test harnesses compatible.
-        const userPacksRoot = new ContextPackSettingsStore().resolveOne("context.root").value;
-        const [contextRoot, systemPacksRoot] = openRigContextLibraryRoots(userPacksRoot);
-        try {
-            fs.mkdirSync(systemPacksRoot, { recursive: true });
-        }
-        catch { /* best-effort */ }
-        const roots = [
-            { path: contextRoot, sourceType: "user_file" },
-            { path: systemPacksRoot, sourceType: "user_file" },
-        ];
-        try {
-            const settingsStore = new ContextPackSettingsStore();
-            const cfg = settingsStore.resolveConfig();
-            const workspacePacksRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "context-packs");
-            if (workspacePacksRoot !== userPacksRoot && workspacePacksRoot !== systemPacksRoot && fs.existsSync(workspacePacksRoot)) {
-                roots.push({ path: workspacePacksRoot, sourceType: "workspace" });
-            }
-        }
-        catch { /* settings unavailable; fall through with user-file root only */ }
-        const builtinPacksRoot = nodePath.resolve(import.meta.dirname, "../context-packs");
-        if (fs.existsSync(builtinPacksRoot)) {
-            roots.unshift({ path: builtinPacksRoot, sourceType: "builtin" });
-        }
-        const lib = new ContextPackLibraryService({ roots });
-        lib.scan();
-        return lib;
-    })();
-    // PL-016 Item 2 + Item 4: hoist AgentImageLibraryService construction
-    // so the PodRigInstantiator can resolve `session_source: mode:
-    // agent_image` at materialize time. Same instance returned to deps
-    // below so /api/agent-images/* + the SnapshotCapturer share it.
-    const agentImageRootBuilder = () => {
-        const userImagesRoot = getDefaultOpenRigPath("agent-images");
-        try {
-            fs.mkdirSync(userImagesRoot, { recursive: true });
-        }
-        catch { /* best-effort */ }
-        const roots = [
-            { path: userImagesRoot, sourceType: "user_file" },
-        ];
-        try {
-            const settingsStore = new ContextPackSettingsStore();
-            const cfg = settingsStore.resolveConfig();
-            const workspaceImagesRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "agent-images");
-            if (workspaceImagesRoot !== userImagesRoot && fs.existsSync(workspaceImagesRoot)) {
-                roots.push({ path: workspaceImagesRoot, sourceType: "workspace" });
-            }
-        }
-        catch { /* settings unavailable */ }
-        return { userImagesRoot, roots };
-    };
-    const agentImageLibrary = (() => {
-        const { roots } = agentImageRootBuilder();
-        const lib = new AgentImageLibraryService({ roots });
-        lib.scan();
-        return lib;
-    })();
-    const snapshotCapturer = new SnapshotCapturer({
-        db,
-        rigRepo,
-        sessionRegistry,
-        agentImageLibrary,
-        targetRoot: getDefaultOpenRigPath("agent-images"),
-    });
-    const continuityPolicyMaterializer = new ContinuityPolicyMaterializer(watchdogJobsRepoInstance, ({ sessionId }) => {
-        const row = db.prepare("SELECT resume_token FROM sessions WHERE id = ?").get(sessionId);
-        const token = row?.resume_token;
-        if (!token)
-            return null;
-        const claudeRoot = process.env.CLAUDE_CONFIG_DIR ?? nodePath.join(os.homedir(), ".claude");
-        return findClaudeTranscriptByToken(nodePath.join(claudeRoot, "projects"), token);
-    });
-    const podInstantiator = new PodRigInstantiator({
-        db, rigRepo, podRepo,
-        sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
-        fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
-        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
-        tmuxAdapter,
-        agentImageLibrary,
-        continuityPolicyMaterializer,
-        exec,
-        // OPR.0.5.3.6 — shipped topology chain-file defaults install under the
-        // typed topology.root at materialization (copy-if-absent).
-        topologyRootResolver: () => String(new ContextPackSettingsStore().resolveOne("topology.root").value),
-        onboardingEnabledResolver: () => new ContextPackSettingsStore().resolveOne("onboarding.default_pack.enabled").value === true,
-        skillsRootResolver: () => String(new ContextPackSettingsStore().resolveOne("skills.root").value),
-        systemWorldResolver: () => {
-            const settings = new ContextPackSettingsStore();
-            const cfg = settings.resolveConfig();
-            const selected = settings.resolveOne("context.system_world");
-            return resolveSystemWorld({
-                contextRoot: cfg.contextRoot,
-                selection: String(selected.value),
-                source: selected.source,
-            });
-        },
-        skillReconciler: reconcileSkillLoadout,
-    });
-    const podBundleSourceResolver = new PodBundleSourceResolver();
-    const bootstrapOrchestrator = new BootstrapOrchestrator({
-        db, bootstrapRepo, runtimeVerifier, probeRegistry,
-        installPlanner: externalInstallPlanner, installExecutor: externalInstallExecutor,
-        packageInstallService, rigInstantiator, fsOps: resolverFsOps,
-        bundleSourceResolver, podInstantiator, podBundleSourceResolver,
-        serviceOrchestrator, rigRepo,
-    });
-    // V0.3.1 slice 05 kernel-rig-as-default — auto-boot the kernel rig
-    // on daemon-start. Forward-fix #3 architectural: the bootstrap is
-    // FIRED in the background, not awaited. createDaemon completes as
-    // soon as the tracker is created so server.ts can bind healthz
-    // independent of kernel-agent readiness. A broken kernel agent no
-    // longer keeps the daemon HTTP surface from starting.
-    //
-    // Tracker state is exposed via /api/kernel/status (route below) and
-    // the CLI's `rig daemon start --wait-for-kernel` flag polls it.
-    // After the configurable degraded-timer window (default 90s; env
-    // override OPENRIG_KERNEL_DEGRADED_MS for ops + test fixtures), the
-    // tracker emits a single `kernel.agent.degraded` event for
-    // observability. The kernel rig is still the only rig the daemon
-    // auto-boots; other rigs require explicit operator-initiated
-    // `rig up` / `rig restore` per amended IMPL-PRD §16.2.
-    let kernelBootTracker;
-    try {
-        const { bootKernelIfNeeded } = await import("./domain/kernel-boot.js");
-        const degradedRaw = readOpenRigEnv("OPENRIG_KERNEL_DEGRADED_MS");
-        const degradedTimeoutMs = degradedRaw && /^\d+$/.test(degradedRaw)
-            ? parseInt(degradedRaw, 10)
-            : undefined;
-        kernelBootTracker = await bootKernelIfNeeded({
-            rigRepo,
-            sessionRegistry,
-            eventBus,
-            bootstrapOrchestrator,
-            specsDir: nodePath.resolve(nodePath.dirname(new URL(import.meta.url).pathname), "..", "specs"),
-            // V0.3.1 slice 05 — kernel members run against the operator's
-            // workspace, not the daemon installation tree. Without this
-            // cwdOverride, BootstrapOrchestrator refuses with
-            // "cwd is inside the OpenRig installation". Use the resolved
-            // workspace.root setting as the per-operator default.
-            cwdOverride: runtimeSettings.workspaceRoot,
-            degradedTimeoutMs,
-        });
-        try {
-            // eslint-disable-next-line no-console
-            console.log(`kernel-boot: tracker-state=${kernelBootTracker.getStatus().kernelState}`);
-        }
-        catch { /* logging must never throw */ }
-    }
-    catch (err) {
-        try {
-            // eslint-disable-next-line no-console
-            console.warn(`kernel-boot: skipped due to error: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        catch { /* logging must never throw */ }
-    }
-    // Discovery services
-    const tmuxScanner = new TmuxDiscoveryScanner({ tmuxAdapter });
-    const sessionFingerprinter = new SessionFingerprinter({
-        cmuxAdapter, tmuxAdapter, fsExists: (p) => fs.existsSync(p),
-    });
-    const sessionEnricher = new SessionEnricher({
-        fsExists: (p) => fs.existsSync(p),
-        fsReaddir: (p) => fs.readdirSync(p),
-    });
-    const discoveryRepo = new DiscoveryRepository(db);
-    const discoveryCoordinator = new DiscoveryCoordinator({
-        scanner: tmuxScanner, fingerprinter: sessionFingerprinter, enricher: sessionEnricher,
-        discoveryRepo, sessionRegistry, eventBus,
-    });
-    // Context usage store — constructed ahead of the refresher + ClaimService so the
-    // Claude status-line sidecar reader can be injected into BOTH: FR-3
-    // adoption-boundary capture (ClaimService) and FR-4 snapshot null-fill (refresher).
-    // Also threaded through WhoamiService + routes below (same single instance).
-    const { ContextUsageStore } = await import("./domain/context-usage-store.js");
-    const contextUsageStore = new ContextUsageStore(db, {
-        stateDir: OPENRIG_HOME,
-        // GHOST-STAGE (c-id): reject context readings from before the live occupant booted (prior
-        // generation) so a frozen pre-handover sample can't drive the threshold. null = UNKNOWN (inert).
-        resolveOccupantBootAt: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.bootAt ?? null,
-    });
-    const { HealthProjectionService, LiveContextHealthSource } = await import("./domain/health-detectors.js");
-    const healthSettingsStore = new ContextPackSettingsStore();
-    const contextHealthSource = new LiveContextHealthSource({
-        db,
-        rigRepo,
-        sessionRegistry,
-        contextUsageStore,
-        resolveContextPressurePolicy: () => healthSettingsStore.resolveContextPressurePolicy(),
-    });
-    const healthPolicy = new HealthPolicyStore(OPENRIG_HOME, () => healthSettingsStore.resolveContextPressurePolicy());
-    const healthCheckpoints = new HealthCheckpointSource(OPENRIG_HOME, queueRepoInstance, healthPolicy, undefined, healthSettingsStore.resolveOne("workspace.root").value);
-    const rigModeStore = new RigModeStore(db);
-    const operatingPosture = new OperatingPostureService(db, rigModeStore, () => healthSettingsStore.resolveOne("workspace.root").value);
-    const passiveCeremony = new PassiveCeremonySource(healthSettingsStore.resolveOne("workspace.root").value, queueRepoInstance, healthPolicy, undefined, healthCheckpoints, { reader: operatingPosture, instanceId: OPENRIG_HOME });
-    const healthProjection = new HealthProjectionService({ read: () => [...contextHealthSource.read(), ...healthCheckpoints.read(), ...passiveCeremony.read()] }, () => healthPolicy.read(), (record) => operatingPosture.forHealth(record));
-    const healthDiagnosis = new HealthDiagnosisService({ queue: queueRepoInstance, projection: healthProjection, policy: healthPolicy,
-        authority: (record) => healthAuthority(healthSettingsStore.resolveOne("workspace.root").value, healthCheckpoints, record),
-        resolveEvidence: (path, finding) => readHealthArtifact(finding.operatingPosture?.context?.paths?.project ?? healthSettingsStore.resolveOne("workspace.root").value, path),
-        humanReadiness: (address) => healthHumanReadiness(OPENRIG_HOME, address, deps.gatewaySubsystem?.status().state === "active"), });
-    // OPR.0.4.3.20 FR-4 — inject contextUsageStore so refresh() can null-fill a
-    // Claude token from the sidecar during periodic/manual snapshot refresh.
-    const resumeMetadataRefresher = new ResumeMetadataRefresher({ sessionRegistry, tmuxAdapter, contextUsageStore });
-    const claimService = new ClaimService({
-        db, rigRepo, sessionRegistry, discoveryRepo, eventBus, tmuxAdapter, transcriptStore,
-        claudeContextProvisioner: claudeAdapter,
-        // OPR.0.4.3.20 FR-3 — adoption-boundary resume-token capture deps
-        // (Claude sidecar reader + Codex thread-id capturer, both reuse).
-        contextUsageStore,
-        resumeTokenCapturer: resumeMetadataRefresher,
-        // OPR.0.4.6.PI1 FR-6 — pi-runner sidecar reader (the adapter exposes it).
-        piRunnerStateStore: piAdapter,
-    });
-    const selfAttachService = new SelfAttachService({
-        db, rigRepo, podRepo, sessionRegistry, eventBus, tmuxAdapter, transcriptStore,
-        claudeContextProvisioner: claudeAdapter,
-        // OPR.0.4.3.28 B3 — echo the resolved activity url+token into the self-attach
-        // response env so the caller's shell can produce activity signal.
-        activityEnv: { url: resolvedActivityHookUrl, token: resolvedActivityHookToken },
-    });
-    const rigLifecycleService = new RigLifecycleService({
-        db, rigRepo, sessionRegistry, discoveryRepo, eventBus, queueRepo: queueRepoInstance, tmuxAdapter,
-    });
-    const rigExpansionService = new RigExpansionService({ db, rigRepo, eventBus, nodeLauncher, podInstantiator, sessionRegistry });
-    const specReviewService = new SpecReviewService();
-    // (ContextUsageStore is constructed above, ahead of ClaimService, for FR-3.)
-    const whoamiService = new WhoamiService({ db, rigRepo, sessionRegistry, transcriptStore, contextUsageStore });
-    const nodeCmuxService = new NodeCmuxService(rigRepo, sessionRegistry, cmuxAdapter, tmuxAdapter);
-    // W2a-1 — producer wiring: the live occupant generation resolves synchronously from the shipped
-    // occupant-tenure ledger. generation_uuid CHANGES for a new occupant and persists only within one
-    // tenure (a same-session relaunch is a continuation with no new generation); node_id is the stable-
-    // across-handover key, not this. null = UNKNOWN, honored by the store as abstain (never a stale claim
-    // rendered live). No tmux exec — a better-sqlite3 read on the hot path.
-    const agentActivityStore = new AgentActivityStore({
-        db,
-        eventBus,
-        resolveOccupantGeneration: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.generationUuid ?? null,
-        isRegisteredOccupantGeneration: (nodeId, generation) => sessionRegistry.isOccupantGenerationRegistered(nodeId, generation),
-    });
-    const { SeatAttentionReconciler } = await import("./domain/seat-attention-reconciler.js");
-    const seatAttentionReconciler = new SeatAttentionReconciler({
-        sessionRegistry, eventBus, agentActivityStore, db, tmux: tmuxAdapter,
-        reconcileRestoreOutcome: (rigId, nodeId) => restoreOrchestrator.reconcileNodeRuntimeTruth(rigId, nodeId),
-        sendVerify: async (session, text, opts) => {
-            const transport = deps.sessionTransport;
-            if (!transport)
-                return { ok: false, outcome: "failed" };
-            return transport.send(session, text, { verify: opts?.verify });
-        },
-        capture: async (session, opts) => {
-            const transport = deps.sessionTransport;
-            if (!transport)
-                return { ok: false, sessionName: session, error: "transport_unavailable" };
-            return transport.capture(session, opts);
-        },
-    });
-    const deps = {
-        rigRepo,
-        sessionRegistry,
-        daemonLifecycleStore,
-        daemonBootEpoch,
-        eventBus,
-        nodeLauncher,
-        startupOrchestrator,
-        tmuxAdapter,
-        tmuxOptionDefaults,
-        sessionEnv: launchSessionEnv,
-        cmuxAdapter,
-        snapshotCapture,
-        snapshotRepo,
-        // Slice-04 OPR.0.5.0.4: production provider service — getReadModel over the codex-auth reader
-        // + node-inventory across rigs; precheck via the pure gate; switch honest-interim (D seam).
-        // C3: the Claude statusline provider_usage cache lane. Cache files are seat-keyed and the
-        // reader normalizes valid subscription windows. Live-seat fallback is owned by provider-collect.
-        providerService: new ProviderServiceImpl({
-            db,
-            listRigs: () => rigRepo.listRigs(),
-            collectClaudeSignals: () => collectClaudeSignalsFromProviderUsageDirectory(providerUsageDirectory(OPENRIG_HOME), undefined, legacyProviderUsageDirectory(OPENRIG_HOME)),
-            agentActivityStore,
-        }),
-        restoreOrchestrator,
-        resumeMetadataRefresher, // OPR.0.4.3.20 FR-4 — manual snapshot refresh-before-serialize
-        rigSpecExporter,
-        rigSpecPreflight,
-        rigInstantiator,
-        packageRepo,
-        installRepo,
-        installEngine,
-        installVerifier,
-        bootstrapOrchestrator,
-        bootstrapRepo,
-        discoveryCoordinator,
-        discoveryRepo,
-        claimService,
-        selfAttachService,
-        rigLifecycleService,
-        rigExpansionService,
-        // Slice 15 — SeatActivityService owns the `terminal-active` primitive
-        // (tmux byte-stream). Wired into PsProjectionService so `rig ps`
-        // + UI surfaces read the latest observation per seat. NEVER reads
-        // queue/assignment state (non-inference contract; see slice 15 IMPL-PRD §2.3).
-        seatActivityService,
-        seatStructuralActivityService,
-        seatIdentityReconciler,
-        // OPR.0.4.4.21 — agentActivity feeds the rig-rollup attention
-        // predicate's needs_input signal (synchronous events lookup only).
-        psProjectionService: new PsProjectionService({ db, seatActivity: seatActivityService, agentActivity: agentActivityStore }),
-        upRouter: new UpCommandRouter({
-            fsOps: {
-                exists: (p) => fs.existsSync(p),
-                readFile: (p) => fs.readFileSync(p, "utf-8"),
-                readHead: (p, bytes) => { const fd = fs.openSync(p, "r"); const buf = Buffer.alloc(bytes); fs.readSync(fd, buf, 0, bytes, 0); fs.closeSync(fd); return buf; },
-            },
-        }),
-        teardownOrchestrator: new RigTeardownOrchestrator({
-            db, rigRepo, sessionRegistry, tmuxAdapter, snapshotCapture, eventBus, resumeMetadataRefresher, serviceOrchestrator,
-        }),
-        podInstantiator,
-        podBundleSourceResolver,
-        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
-        transcriptStore,
-        sessionTransport: (() => {
-            const t = new SessionTransport({
-                db,
-                rigRepo,
-                sessionRegistry,
-                tmuxAdapter,
-                agentActivityStore,
-                eventBus,
-                slowOpRecorder,
-                activityEndpointFile: () => readActivityEndpointFile(OPENRIG_HOME),
-            });
-            // PL-004 Phase A revision (R1): wire QueueRepository's wake-path so
-            // create / handoff / handoff-and-complete nudge by default.
-            queueRepoInstance.attachTransport(t);
-            // PL-004 Phase B: wire classifier-lease-manager liveness check from
-            // the sessions table. Lease holder is "alive" iff there is at least
-            // one row in `sessions` with session_name == classifierSession AND
-            // status == 'running'.
-            classifierLeaseManagerInstance.attachIsAlive((classifierSession) => {
-                try {
-                    const row = db
-                        .prepare(`SELECT 1 FROM sessions WHERE session_name = ? AND status = 'running' LIMIT 1`)
-                        .get(classifierSession);
-                    return row !== undefined;
-                }
-                catch {
-                    // Conservative: on lookup error, treat as alive (do not falsely
-                    // trigger deadness-based lease expiry).
-                    return true;
-                }
-            });
-            return t;
-        })(),
-        chatRepo: new ChatRepository(db),
-        streamStore,
-        slowOpRecorder,
-        queueRepo: queueRepoInstance,
-        inboxHandler: new InboxHandler(db, eventBus, queueRepoInstance),
-        outboxHandler: outboxHandlerInstance,
-        classifierLeaseManager: classifierLeaseManagerInstance,
-        projectClassifier: new ProjectClassifier(db, eventBus, classifierLeaseManagerInstance),
-        viewProjector: viewProjectorInstance,
-        watchdogJobsRepo: watchdogJobsRepoInstance,
-        watchdogHistoryLog: watchdogHistoryLogInstance,
-        wakeResolveService: new WakeResolveService({
-            listSessionsBySeat: (seat) => db
-                .prepare(`SELECT s.id AS id, s.session_name AS sessionName, s.resume_token AS resumeToken,
-                    n.runtime AS runtime, s.created_at AS createdAt
-               FROM sessions s JOIN nodes n ON s.node_id = n.id
-              WHERE s.session_name = ? ORDER BY s.id DESC`)
-                .all(seat),
-        }),
-        askService: (() => {
-            // P19 A5 (finding graduated): inject seatActivity like the attention path
-            // (line ~919) — one terminalActive truth, never two divergent projections.
-            const psProjectionService = new PsProjectionService({ db, seatActivity: seatActivityService, agentActivity: agentActivityStore });
-            const execDep = (cmd, args) => new Promise((resolve) => {
-                execFile(cmd, args, { maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
-                    if (err && typeof err.code === "string" && err.code === "ENOENT") {
-                        resolve({ stdout: "", exitCode: 2 });
-                        return;
-                    }
-                    const exitCode = err ? err.code ?? 1 : 0;
-                    resolve({ stdout: stdout ?? "", exitCode: typeof exitCode === "number" ? exitCode : 1 });
-                });
-            });
-            const chatRepoForAsk = new ChatRepository(db);
-            const historyQuery = new HistoryQuery({
-                transcriptsRoot: transcriptStore.enabled
-                    ? (transcriptsPath ?? getCompatibleOpenRigPath("transcripts"))
-                    : getCompatibleOpenRigPath("transcripts"),
-                exec: execDep,
-                chatSearchFn: (rigId, pattern) => chatRepoForAsk.searchChat(rigId, pattern).map((m) => ({
-                    sender: m.sender,
-                    body: m.body,
-                    createdAt: m.createdAt,
-                })),
-            });
-            return new AskService({
-                psProjectionService,
-                rigRepo,
-                historyQuery,
-                transcriptsEnabled: transcriptStore.enabled,
-                whoamiService,
-            });
-        })(),
-        whoamiService,
-        nodeCmuxService,
-        agentActivityStore,
-        seatAttentionReconciler,
-        activityHookToken: resolvedActivityHookToken,
-        contextUsageStore,
-        healthProjection,
-        healthDiagnosis,
-        healthPolicy,
-        healthCheckpoints,
-        serviceOrchestrator,
-        composeAdapter,
-        kernelBootTracker,
-        specReviewService,
-        specLibraryService: (() => {
-            const userSpecsRoot = getDefaultOpenRigPath("specs");
-            const legacySpecsRoot = getCompatibleOpenRigPath("specs");
-            try {
-                fs.mkdirSync(userSpecsRoot, { recursive: true });
-            }
-            catch { /* best-effort */ }
-            // From src/ or dist/, ../specs points to packages/daemon/specs/
-            const builtinSpecsRoot = nodePath.resolve(import.meta.dirname, "../specs");
-            const roots = [
-                { path: userSpecsRoot, sourceType: "user_file" },
-            ];
-            if (legacySpecsRoot !== userSpecsRoot && fs.existsSync(legacySpecsRoot)) {
-                roots.push({ path: legacySpecsRoot, sourceType: "user_file" });
-            }
-            // Only add builtin root if it exists
-            if (fs.existsSync(builtinSpecsRoot)) {
-                roots.unshift({ path: builtinSpecsRoot, sourceType: "builtin" });
-            }
-            const lib = new SpecLibraryService({ roots, specReviewService });
-            lib.scan();
-            return lib;
-        })(),
-        // Phase 3a slice 3.3 — plugin discovery service.
-        // SC-29 EXCEPTION #8 verbatim: see packages/daemon/src/routes/plugins.ts
-        // header. Filesystem-scan over 3 source roots + agent.yaml-parse for
-        // used-by reverse query. No SQL; no mutation. Spec library directory
-        // for used-by uses the same default user spec root as SpecLibraryService
-        // above; one root at v0 (multi-root expansion deferred to a later slice
-        // when spec library hooks its full root list through to discovery).
-        // bug-fix slice plugin-discovery-respects-openrig-home: route the
-        // openrigPluginsDir through the OPENRIG_HOME-aware resolver so
-        // discovery + vendor (which already uses the helper at line 428)
-        // resolve to the same root. Operator-level test isolation + the
-        // slice 22 populated-VM-env story both depend on this symmetry.
-        // claudeCacheDir / codexCacheDir remain homedir-anchored because
-        // those cache locations belong to the runtime tools, not to the
-        // OpenRig state root.
-        pluginDiscoveryService: new PluginDiscoveryService({
-            openrigPluginsDir: getDefaultOpenRigPath("plugins"),
-            claudeCacheDir: nodePath.join(os.homedir(), ".claude", "plugins", "cache"),
-            codexCacheDir: nodePath.join(os.homedir(), ".codex", "plugins", "cache"),
-            specLibraryDir: getDefaultOpenRigPath("specs"),
-        }),
-        // Slice 28 Checkpoint C-3 — skillLibraryDiscoveryService is constructed
-        // AFTER filesAllowlist resolution below (deps.skillLibraryDiscoveryService
-        // assignment near filesAllowlist binding).
-        // Shared context library backing the delivery-free context routes.
-        contextPackLibrary,
-        // PL-016 — agent_image typed primitive. Shared library + capturer
-        // + spec-roots supplier across /api/agent-images/* and the
-        // PodRigInstantiator's session_source: mode: agent_image dispatch.
-        agentImageLibrary,
-        snapshotCapturer,
-        // Slice 09 (OPR.0.3.2.9) — operator-context-mode bindings store
-        // (typed primitive on the shared db handle; HG-5: no parallel store).
-        rigModeStore,
-        operatingPosture,
-        agentImageSpecRoots: () => {
-            // Spec-library roots scanned by the evidence guard. v0: user
-            // specs under ~/.openrig/specs + workspace-local specs root
-            // (from the SettingsStore-resolved workspace.specsRoot).
-            const userSpecsRoot = getDefaultOpenRigPath("specs");
-            const roots = [userSpecsRoot];
-            try {
-                const settingsStore = new ContextPackSettingsStore();
-                const cfg = settingsStore.resolveConfig();
-                if (cfg.workspaceSpecsRoot && cfg.workspaceSpecsRoot !== userSpecsRoot) {
-                    roots.push(cfg.workspaceSpecsRoot);
-                }
-            }
-            catch { /* settings unavailable */ }
-            return roots;
-        },
-    };
-    Object.assign(deps, { watchdogAutoRegistration });
-    // Copy bundled reference docs to ~/.openrig/reference/ so agents can find them at a stable path
-    try {
-        const bundledDocsDir = nodePath.resolve(import.meta.dirname, "../docs/reference");
-        if (fs.existsSync(bundledDocsDir)) {
-            const referenceDir = getDefaultOpenRigPath("reference");
-            fs.mkdirSync(referenceDir, { recursive: true });
-            for (const file of fs.readdirSync(bundledDocsDir)) {
-                if (file.endsWith(".md")) {
-                    fs.copyFileSync(nodePath.join(bundledDocsDir, file), nodePath.join(referenceDir, file));
-                }
-            }
-        }
-    }
-    catch { /* best-effort — reference docs are not critical to daemon operation */ }
-    // OPR.0.4.8.3 — materialize the packaged built-in policies as read-only
-    // inspection copies at $OPENRIG_HOME/reference/policies/builtin/ (same
-    // best-effort posture as the reference docs above; ../policies/builtin
-    // resolves from the compiled dist in BOTH the repo-run and assembled layouts)
-    try {
-        materializeBuiltinPolicyReference({
-            bundledDir: nodePath.resolve(import.meta.dirname, "../policies/builtin"),
-            targetDir: getDefaultOpenRigPath(nodePath.join("reference", "policies", "builtin")),
-        });
-    }
-    catch { /* best-effort — inspection copies are not critical to daemon operation */ }
-    // PL-004 Phase C — watchdog policy engine + scheduler. Wired here
-    // (after deps construction) so the engine can dispatch deliveries
-    // through the live SessionTransport. Scheduler is started by
-    // index.ts after listen() so the daemon's HTTP surface is ready
-    // before the scheduler's first tick.
-    // PL-004 Phase D — workflow runtime + workflow-keepalive policy.
-    // Workflow runtime is constructed first; then the watchdog policy
-    // engine is constructed with workflow-keepalive injected via
-    // additionalPolicies (orch-ratified Phase D extension point per
-    // slice IMPL § Write Set / § Driver Handoff Contract).
-    const queueRepoForWorkflow = deps.queueRepo;
-    let workflowRuntime;
-    let workflowExceptionEnsurer;
-    if (queueRepoForWorkflow) {
-        workflowRuntime = new WorkflowRuntime({
-            guidanceLibrary: contextPackLibrary,
-            db,
-            eventBus,
-            queueRepo: queueRepoForWorkflow,
-            // OPR.0.4.6.WF1 FR-3: instantiate/handoff auto-arm the
-            // per-instance workflow-keepalive job in-txn; terminal disarms.
-            watchdogJobsRepo: watchdogJobsRepoInstance,
-            // OPR.0.4.6.WF5 FR-2: the maturity dial — host default read LIVE
-            // per exception from the settings twin (dial flips affect future
-            // items only, never retroactive re-routing).
-            exceptionDial: {
-                hostDefault: () => {
-                    const v = new ContextPackSettingsStore().resolveOne("workflow.exception_routing")
-                        .value;
-                    return v === "orchestrator" || v === "human_only" ? v : null;
-                },
-                humanFallbackSeat: resolveWorkflowHumanDestination,
-            },
-        });
-        deps.workflowRuntime = workflowRuntime;
-        // OPR.0.4.6.WF5 FR-2 class (b): the shared detection-time exception
-        // ensurer — sweep + keepalive both call it; dedup by occurrence tags.
-        {
-            const { makeEnsureStuckExceptionItem } = await import("./domain/workflow-exception-escalation.js");
-            workflowExceptionEnsurer = makeEnsureStuckExceptionItem({
-                db,
-                queueRepo: queueRepoForWorkflow,
-                resolveRoute: (name, version, cls, boundRig) => workflowRuntime.resolveExceptionRouteFor(name, version, cls, boundRig),
-                humanFallbackSeat: resolveWorkflowHumanDestination,
-                log: (line) => console.log(line),
-            });
-        }
-        // Seed built-in starter workflow_specs into the cache. Idempotent
-        // + workspace-surface-respecting — operator
-        // overrides at workspace paths are preserved (skip-if-cached).
-        // Errors are collected into the result for diagnostic logging but
-        // do NOT block startup; a malformed bundled spec should not bring
-        // the daemon down.
-        const { loadStarterWorkflowSpecs, defaultBuiltinSpecsDir } = await import("./domain/workflow/starter-spec-loader.js");
-        const builtinSpecsDir = defaultBuiltinSpecsDir();
-        const starterResult = loadStarterWorkflowSpecs({
-            cache: workflowRuntime.specCache,
-            builtinDir: builtinSpecsDir,
-        });
-        // Surface the resolved path to the routes layer so
-        // GET /api/workflow/specs can compute the per-row isBuiltIn flag.
-        deps.workflowBuiltinSpecsDir = builtinSpecsDir;
-        // Slice 11 (workflow-spec-folder-discovery) — expose the shared
-        // WorkflowSpecCache + the resolved workspace workflows folder so
-        // GET /api/specs/library can opportunistically discover operator-
-        // dropped YAML on each list request. Folder path is
-        // `<workspace.specs_root>/workflows`; SettingsStore resolves
-        // workspaceSpecsRoot from env > config > workspace-default.
-        deps.workflowSpecCache = workflowRuntime.specCache;
-        // OPR.0.3.2.22 Bug 4 — one-time prune of cache rows whose source_path
-        // lives in noise directories (.worktrees, node_modules, etc.). The
-        // post-Bug-4 walkYamlFiles SKIP_DIRS guard prevents NEW rows from
-        // those locations, but legacy rows from prior daemon versions (or
-        // operators who hand-imported a spec via path-form before SKIP_DIRS
-        // shipped) would persist without this prune. Cheap (single DELETE
-        // with bounded LIKE patterns) and safe (matches only the same
-        // directories the walker now refuses to enter).
-        //
-        // installRoot guard: shipped built-in workflow specs live at
-        // `<pkg>/dist/builtins/workflow-specs/` in production. Without the
-        // install-root preservation clause, the `%/dist/%` pattern would
-        // delete them on every boot (then loadStarterWorkflowSpecs re-seeds
-        // — wasteful at best, broken if the loader ever skips re-seeding).
-        // Pass the resolved install root so rows under it are preserved.
-        const { getOpenRigInstallRoot } = await import("./domain/cwd-resolution.js");
-        workflowRuntime.specCache.pruneNoiseDirRows(getOpenRigInstallRoot());
-        try {
-            const settingsStore = new ContextPackSettingsStore();
-            const cfg = settingsStore.resolveConfig();
-            if (cfg.workspaceSpecsRoot) {
-                deps.workflowsFolderDir = nodePath.join(cfg.workspaceSpecsRoot, "workflows");
-            }
-        }
-        catch { /* settings unavailable — folder scan stays disabled */ }
-        if (starterResult.errors.length > 0) {
-            console.warn(`[starter-spec-loader] ${starterResult.errors.length} spec(s) failed to load:`, starterResult.errors);
-        }
-    }
-    // PL-005 Phase A: Mission Control / Queue Observability services.
-    // Wired AFTER WorkflowRuntime so all PL-004 daemon-backed coordination
-    // surfaces are available. Mission Control reads from queue/view/stream
-    // surfaces and writes through the atomic 7-verb contract.
-    if (deps.queueRepo && deps.viewProjector) {
-        const mcActionLog = new MissionControlActionLog(db);
-        const mcWriteContract = new MissionControlWriteContract({
-            db,
-            eventBus,
-            queueRepo: deps.queueRepo,
-            actionLog: mcActionLog,
-        });
-        const mcFleetCliCapability = new MissionControlFleetCliCapability({
-            db,
-            eventBus,
-            rigRepo,
-            // R1 fix per guard PL-005 Phase A review: wire the production
-            // capability probe so /api/mission-control/cli-capabilities
-            // honestly reports drift when MISSION_CONTROL_DESIRED_FIELDS
-            // are missing from the local CLI's allow-list. Without this
-            // probe injection, the production path defaulted to a no-op
-            // that always reported staleCliCount=0 even when the audit-
-            // row-5 case (recoveryGuidance not in CLI allow-list) was
-            // present.
-            probeRig: makeLocalCliCapabilityProbe(),
-        });
-        // V0.3.1 slice 05 kernel-rig-as-default — cascade the resolved
-        // workspace.operator_seat_name setting into the mission-control
-        // read layer so my-queue routes to the operator's configured seat
-        // (default `operator-${USER}@kernel`) instead of the legacy
-        // hardcoded constant. The setting reads OPENRIG_WORKSPACE_OPERATOR_SEAT_NAME
-        // env var first, then ~/.openrig/config.json, then the derived
-        // default — same cascade as every other typed setting.
-        const mcReadLayer = new MissionControlReadLayer({
-            db,
-            queueRepo: deps.queueRepo,
-            viewProjector: deps.viewProjector,
-            streamStore: deps.streamStore,
-            fleetCliCapability: mcFleetCliCapability,
-            defaultOperatorSession: runtimeSettings.workspaceOperatorSeatName,
-        });
-        deps.missionControlActionLog = mcActionLog;
-        deps.missionControlWriteContract = mcWriteContract;
-        deps.missionControlFleetCliCapability = mcFleetCliCapability;
-        deps.missionControlReadLayer = mcReadLayer;
-        // PL-005 Phase B: audit-history browse layer (read-only) +
-        // notification dispatcher + bearer-token plumbing.
-        const mcAuditBrowse = new MissionControlAuditBrowse(db);
-        deps.missionControlAuditBrowse = mcAuditBrowse;
-        // Bearer token from createDaemon options is propagated to the
-        // routes constructor via deps so the auth middleware is mounted
-        // at route mount time (not per-request).
-        deps.missionControlBearerToken = opts?.bearerToken ?? null;
-        const terminalTokenEnv = process.env.OPENRIG_TERMINAL_BEARER_TOKEN?.trim();
-        deps.terminalBearerToken =
-            opts && Object.prototype.hasOwnProperty.call(opts, "terminalBearerToken")
-                ? opts.terminalBearerToken ?? null
-                : terminalTokenEnv || null;
-        // Notification dispatcher: chosen mechanism via env config.
-        // OPENRIG_NOTIFICATIONS_MECHANISM=ntfy|webhook|none (default none).
-        // OPENRIG_NOTIFICATIONS_TARGET=<topic url | webhook url>.
-        // OPENRIG_NOTIFICATIONS_INCLUDE_VERB_COMPLETION=1 to opt into the
-        // verb-completion trigger (default off; only human-gate arrivals
-        // trigger by default per planner brief).
-        // No legacy alias for these env vars (new in Phase B).
-        const mechanism = process.env.OPENRIG_NOTIFICATIONS_MECHANISM ?? "none";
-        const target = process.env.OPENRIG_NOTIFICATIONS_TARGET ?? "";
-        const missionControlBaseUrl = process.env.OPENRIG_MISSION_CONTROL_BASE_URL ??
-            process.env.OPENRIG_URL ??
-            process.env.RIGGED_URL;
-        const includeVerbCompletion = process.env.OPENRIG_NOTIFICATIONS_INCLUDE_VERB_COMPLETION === "1";
-        if (mechanism !== "none" && target.length > 0) {
-            let adapter;
-            if (mechanism === "ntfy") {
-                adapter = new NtfyNotificationAdapter({ topicUrl: target });
-            }
-            else if (mechanism === "webhook") {
-                adapter = new WebhookNotificationAdapter({ endpointUrl: target });
-            }
-            else {
-                throw new Error(`OPENRIG_NOTIFICATIONS_MECHANISM='${mechanism}' is not recognized; supported: ntfy | webhook | none`);
-            }
-            const dispatcher = new MissionControlNotificationDispatcher({
-                db,
-                eventBus,
-                adapter,
-                includeVerbCompletion,
-                missionControlBaseUrl,
-            });
-            dispatcher.start();
-            deps.missionControlNotificationDispatcher = dispatcher;
-        }
-    }
-    // Slice Story View v0 — slice indexer + per-tab projector.
-    //
-    // User Settings v0 graduates `OPENRIG_SLICES_ROOT` env-var into the
-    // typed `workspace.slices_root` setting (resolution chain: env >
-    // config-file > default `<workspace.root>/missions`). Backward-compat:
-    // operators with OPENRIG_SLICES_ROOT set continue to work because the
-    // settings store reads env in the same resolution slot. Operators
-    // setting via `rig config set workspace.slices_root <path>` or via the
-    // System drawer Settings panel UI now flow through the indexer too —
-    // closes the PRD § Scenario B requirement that wasn't wired in v0.
-    //
-    //   OPENRIG_SLICES_ROOT             legacy short env var (still honored
-    //                                   if set; preferred route is settings)
-    //   OPENRIG_WORKSPACE_SLICES_ROOT   typed-key env override
-    //   workspace.slices_root           typed setting in ~/.openrig/config.json
-    //   workspace.root                  cascade fallback (default ~/.openrig/workspace)
-    //   OPENRIG_DOGFOOD_EVIDENCE_ROOT   legacy proof-packet relocation override
-    //
-    // When the resolved slicesRoot path doesn't exist on disk, the indexer
-    // is still constructed but isReady() returns false — the routes return
-    // a clear "slices_root_not_configured" 503 with a setup hint.
-    {
-        // Prefer the legacy short env var if explicitly set (existing
-        // dogfood / test daemons rely on it). Otherwise fall back to the
-        // settings-resolved path (env > file > default cascade inside
-        // SettingsStore). The SettingsStore is constructed locally here
-        // so the slices block doesn't depend on the User Settings v0 wiring
-        // block ordering further below.
-        const legacyEnvSlicesRoot = readOpenRigEnv("OPENRIG_SLICES_ROOT", "RIGGED_SLICES_ROOT") ?? "";
-        let resolvedSlicesRoot = "";
-        let resolvedWorkspaceRoot = "";
-        try {
-            const { SettingsStore: SettingsStoreCtor } = await import("./domain/user-settings/settings-store.js");
-            const resolvedConfig = new SettingsStoreCtor().resolveConfig();
-            if (!legacyEnvSlicesRoot) {
-                resolvedSlicesRoot = resolvedConfig.workspaceSlicesRoot;
-            }
-            resolvedWorkspaceRoot = resolvedConfig.workspaceRoot;
-        }
-        catch {
-            // SettingsStore unavailable — keep roots empty; routes return 503.
-        }
-        const slicesRoot = legacyEnvSlicesRoot || resolvedSlicesRoot;
-        // `workspace.dogfood_evidence_root` was retired with the eager legacy
-        // scaffold. Keep the existing proof-packet reader usable for old
-        // workspaces and explicit legacy relocations without exposing a second
-        // project-workspace setting.
-        const resolvedDogfoodRoot = readOpenRigEnv("OPENRIG_DOGFOOD_EVIDENCE_ROOT")
-            || (resolvedWorkspaceRoot ? nodePath.join(resolvedWorkspaceRoot, "dogfood-evidence") : "");
-        const additionalSliceRoots = resolvedWorkspaceRoot
-            ? [
-                nodePath.join(resolvedWorkspaceRoot, "missions"),
-                nodePath.join(resolvedWorkspaceRoot, "slices"),
-            ].filter((root) => root !== slicesRoot)
-            : [];
-        // S27 (OPR.0.5.6.27) — wire the execution view once the slices root is
-        // resolved; the thunk re-reads nothing (path resolution stays startup's).
-        viewProjectorInstance.setExecutionDeps({
-            db,
-            slicesRoot: () => slicesRoot || null,
-            // S19's locked one-oracle contract: the ARBITRATED seat-keyed read every
-            // surface (rig ps, node inventory, parked-query) consumes — never
-            // sessions.status, never the parallel AgentActivityStore ingest.
-            seatActivity: seatActivityService,
-        });
-        const { SliceIndexer } = await import("./domain/slices/slice-indexer.js");
-        const { SliceDetailProjector } = await import("./domain/slices/slice-detail-projector.js");
-        const sliceIndexer = new SliceIndexer({
-            slicesRoot,
-            additionalSliceRoots,
-            dogfoodEvidenceRoot: resolvedDogfoodRoot || null,
-            db,
-        });
-        // Slice Story View v1: pass workflowRuntime.specCache so the
-        // projector can resolve a bound workflow_instance's spec for
-        // spec-graph + phase + current-step projection. When the workflow
-        // runtime is not constructed (queueRepo absent — same condition
-        // already guards the workflowRuntime block above), the projector
-        // silently degrades to v0 behavior (workflowBinding=null,
-        // specGraph=null, phaseDefinitions=null, currentStep=null).
-        const sliceDetailProjector = new SliceDetailProjector({
-            db,
-            indexer: sliceIndexer,
-            workflowSpecCache: workflowRuntime?.specCache,
-        });
-        deps.sliceIndexer = sliceIndexer;
-        if (sliceIndexer.isReady()) {
-            const { watchProofSources } = await import("./domain/proof/source-watch.js");
-            deps.proofSourceWatch = watchProofSources(sliceIndexer.slicesRoot, () => sliceIndexer.invalidate(), eventBus);
-        }
-        deps.sliceDetailProjector = sliceDetailProjector;
-        // Living Notes Packet 2 (OPR.0.4.4.20): the composed-review gatherer.
-        // Git lineage facts come from OPENRIG_REVIEW_GIT_REPO when set; else
-        // lineage degrades honestly to unknown.
-        const { ReviewGatherer } = await import("./domain/review/gather.js");
-        deps.reviewGatherer = new ReviewGatherer({
-            db,
-            indexer: sliceIndexer,
-            gitRepoPath: process.env["OPENRIG_REVIEW_GIT_REPO"] ?? null,
-            // OPR.0.4.4.22 FR-2: the agent state glyph reads recorded hook
-            // activity (honest-unknown when absent) - synchronous, never polls.
-            activityStore: agentActivityStore,
-        });
-    }
-    // OPR.0.4.6.02 C3 — the terminal-provider-ride service (ONE composer for
-    // every view kind). Built here (post-hoc) so it can read the lazily-built
-    // reviewGatherer for derived mission/slice views; if the gatherer never
-    // built, those scopes honestly return not-found rather than throwing.
-    {
-        const { TerminalService } = await import("./domain/terminal/terminal-service.js");
-        const { HerdrAdapter } = await import("./domain/terminal/herdr-adapter.js");
-        const { createHerdrSocketRpc, createHerdrSocketTransport } = await import("./domain/terminal/herdr-transport.js");
-        const { CmuxProviderAdapter } = await import("./domain/terminal/cmux-provider-adapter.js");
-        const { CmuxLayoutService } = await import("./domain/cmux-layout-service.js");
-        const { TerminalViewsStore } = await import("./domain/terminal/terminal-views-store.js");
-        const { getNodeInventory, getNodeInventoryForRigs } = await import("./domain/node-inventory.js");
-        const { loadHostRegistry, resolveHost: resolveHostInRegistry } = await import("./domain/hosts/hosts-registry-reader.js");
-        // NodeInventoryEntry → the composer's minimal LiveSeatRow (single-host
-        // inventory: the canonical session name IS the tmux session; no host field).
-        const toLiveSeatRow = (e) => ({
-            canonicalSessionName: e.canonicalSessionName,
-            attachmentType: e.attachmentType ?? null,
-            tmuxSession: e.canonicalSessionName,
-            rigName: e.rigName,
-            logicalId: e.logicalId,
-        });
-        const herdrProvider = new HerdrAdapter({
-            // FB4: herdr speaks its unix control socket (there is no `layout` CLI).
-            transportFactory: createHerdrSocketTransport(createHerdrSocketRpc()),
-        });
-        const cmuxProvider = new CmuxProviderAdapter({
-            cmuxAdapter,
-            // One gridded workspace per composed page — the same grid machinery as
-            // the rig-scope /cmux/launch endpoint, never one window per seat.
-            layoutService: new CmuxLayoutService(cmuxAdapter),
-        });
-        const providerMap = {
-            herdr: herdrProvider,
-            cmux: cmuxProvider,
-        };
-        deps.terminalService = new TerminalService({
-            resolveProvider: (name) => providerMap[name] ?? null,
-            viewsStore: new TerminalViewsStore(),
-            listRigSeatsBatch: (names) => {
-                const rigs = rigRepo.listRigs();
-                // Match listRigSeats' first-name resolution, including duplicate names.
-                const selected = new Map(names.flatMap(name => {
-                    const rig = rigs.find(rig => rig.name === name);
-                    return rig ? [[name, rig]] : [];
-                }));
-                const inventory = getNodeInventoryForRigs(db, new Set([...selected.values()].map(rig => rig.id)));
-                return new Map([...selected].map(([name, rig]) => [name, (inventory.get(rig.id) ?? []).map(toLiveSeatRow)]));
-            },
-            listRigSeats: (rigArg) => {
-                const rigs = rigRepo.listRigs();
-                const rig = rigs.find((r) => r.name === rigArg) ?? rigs.find((r) => r.id === rigArg);
-                if (!rig)
-                    return null;
-                return getNodeInventory(db, rig.id).map(toLiveSeatRow);
-            },
-            listPodSeats: (rigArg, pod) => {
-                const rigs = rigRepo.listRigs();
-                const rig = rigs.find((r) => r.name === rigArg) ?? rigs.find((r) => r.id === rigArg);
-                if (!rig)
-                    return null;
-                const rows = getNodeInventory(db, rig.id)
-                    .filter((e) => e.podNamespace === pod)
-                    .map(toLiveSeatRow);
-                // No node carries that pod namespace → an unknown pod (not an empty view).
-                return rows.length > 0 ? rows : null;
-            },
-            listScopeSeats: (scope) => {
-                const gatherer = deps.reviewGatherer;
-                if (!gatherer)
-                    return null;
-                // N1 (dev44-driver2 pre-guard): cast to the real AgentsScope union (not
-                // `never`) so the compile guard on the scope grammar is restored.
-                const band = gatherer.composeAgents(scope);
-                if (!band)
-                    return null;
-                const wanted = new Set(band.rows.map((r) => r.sessionName));
-                const rows = [];
-                for (const rig of rigRepo.listRigs()) {
-                    for (const e of getNodeInventory(db, rig.id)) {
-                        if (e.canonicalSessionName && wanted.has(e.canonicalSessionName))
-                            rows.push(toLiveSeatRow(e));
-                    }
-                }
-                return rows;
-            },
-            listRigNames: () => rigRepo.listRigs().map((r) => r.name),
-            resolveHost: (id) => {
-                const res = loadHostRegistry();
-                if (!res.ok)
-                    return null;
-                const r = resolveHostInRegistry(res.registry, id);
-                return r.ok ? r.host : null;
-            },
-            hasSession: (session) => tmuxAdapter.hasSession(session),
-        });
-    }
-    // UI Enhancement Pack v0:
-    //   - file allowlist (item 3) from OPENRIG_FILES_ALLOWLIST
-    //   - atomic write service (item 4) wired only when allowlist non-empty
-    //   - progress scan-roots (item 1B) from OPENRIG_PROGRESS_SCAN_ROOTS
-    //
-    // Empty env → empty allowlist / no-roots indexer; routes return 503
-    // with structured config hints so the UI can surface a setup message
-    // instead of a generic error.
-    {
-        const { decodeAllowlist } = await import("./domain/files/path-safety.js");
-        const { FileWriteService } = await import("./domain/files/file-write-service.js");
-        const { ProgressIndexer, decodeProgressScanRoots } = await import("./domain/progress/progress-indexer.js");
-        // User Settings v0 — UEP env-vars graduated to typed settings.
-        // Resolution: env > settings file > empty. SettingsStore handles
-        // the env > file > default precedence; we just decode the raw
-        // string into structured roots.
-        const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
-        const settingsStore = new SettingsStore();
-        deps.settingsStore = settingsStore;
-        const cfg = settingsStore.resolveConfig();
-        // Preview Terminal v0 (PL-018) — per-session rate limiter for the
-        // /preview route. 1-second window per (session, lines) cache key:
-        // short enough that legitimate polling at the operator's refresh
-        // interval (`ui.preview.refresh_interval_seconds`, default 3s) always
-        // sees fresh content, but multiple pinned-pane requests for the same
-        // seat within a single second collapse to one tmux capture.
-        const { PreviewRateLimiter } = await import("./domain/preview/preview-rate-limiter.js");
-        deps.previewRateLimiter = new PreviewRateLimiter(1000);
-        const filesAllowlist = decodeAllowlist(cfg.filesAllowlistRaw);
-        deps.filesAllowlist = filesAllowlist;
-        deps.fileWriteService = filesAllowlist.length > 0
-            ? new FileWriteService({
-                allowlist: filesAllowlist,
-                auditFilePath: nodePath.join(OPENRIG_HOME, "file-edit-audit.jsonl"),
-            })
-            : null;
-        // Slice 28 Checkpoint C-3 — SkillLibraryDiscoveryService. sharedSkillsDir
-        // resolves to the daemon's bundled `specs/agents/shared/skills/`
-        // directory via import.meta.url (independent of operator allowlist
-        // configuration; closes HG-5 on the founder-walk VM where the operator
-        // allowlist doesn't include the daemon source tree). filesAllowlist
-        // is also passed so workspace `.openrig/skills/` skills surface via
-        // the same daemon endpoint.
-        deps.skillLibraryDiscoveryService = new SkillLibraryDiscoveryService({
-            sharedSkillsDir: nodePath.resolve(nodePath.dirname(new URL(import.meta.url).pathname), "..", "specs", "agents", "shared", "skills"),
-            filesAllowlist,
-        });
-        deps.progressIndexer = new ProgressIndexer({ roots: decodeProgressScanRoots(cfg.progressScanRootsRaw) });
-        // Operator Surface Reconciliation v0 — steering composer (item 1).
-        // Reads typed workspace settings by default while preserving the
-        // OPENRIG_STEERING_* env override family for non-canonical layouts.
-        const { SteeringComposer, steeringOptsFromSettings } = await import("./domain/steering/steering-composer.js");
-        deps.steeringComposer = new SteeringComposer(steeringOptsFromSettings({
-            workspaceRoot: cfg.workspaceRoot,
-            workspaceSteeringPath: cfg.workspaceSteeringPath,
-        }));
-        // Workflows in Spec Library + Activation Lens v0 — active lens
-        // persistence under OPENRIG_HOME/active-workflow-lens.json. Same
-        // file-backed pattern as UI Enhancement Pack v0's audit JSONL —
-        // honors OPENRIG_HOME so isolated test/dogfood daemons keep their
-        // own lens state instead of bleeding into the operator's host.
-        const { ActiveLensStore } = await import("./domain/active-lens-store.js");
-        deps.activeLensStore = new ActiveLensStore({
-            filePath: nodePath.join(OPENRIG_HOME, "active-workflow-lens.json"),
-        });
-    }
-    // OPR.0.5.6.1 — late-bound gateway dispatch for the delivery policies (the
-    // gateway subsystem is constructed after the watchdog engine; the ref fills
-    // at activation below, which is OUTSIDE the sessionTransport block — hence
-    // function scope). Registry loads through the shipped loader.
-    const lateGatewayDispatch = {};
-    const { loadHumanRegistry: loadHumanRegistryForDelivery } = await import("./domain/gateway/human-registry.js");
-    void loadHumanRegistryForDelivery; // consumed inside the sessionTransport block below
-    const sessionTransport = deps.sessionTransport;
-    if (sessionTransport) {
-        queueRepoInstance.attachActivityReader((session) => {
-            const node = db.prepare("SELECT node_id FROM sessions WHERE session_name = ? ORDER BY id DESC LIMIT 1").get(session);
-            return node ? seatActivityService.getSeatState(node.node_id) : null;
-        });
-        const watchdogPolicyEngine = new WatchdogPolicyEngine({
-            jobsRepo: watchdogJobsRepoInstance,
-            historyLog: watchdogHistoryLogInstance,
-            eventBus,
-            deliver: async ({ targetSession, message, continuityAction }, source) => {
-                let continuityActionCompleted = false;
-                try {
-                    if (continuityAction) {
-                        await createContinuityCutoverBaton(continuityAction, queueRepoInstance);
-                        continuityActionCompleted = true;
-                    }
-                    const result = await sessionTransport.send(targetSession, formatWatchdogDeliveryMessage(source, message));
-                    return result.ok
-                        ? { status: "ok", continuityActionCompleted }
-                        : { status: "failed", error: result.error, continuityActionCompleted };
-                }
-                catch (err) {
-                    return {
-                        status: "failed",
-                        error: err instanceof Error ? err.message : String(err),
-                        continuityActionCompleted,
-                    };
-                }
-            },
-            // (i-c) fire-time target-generation gate: resolve the target's LIVE occupant-generation (P12
-            // occupant_tenures) so a generation-bound wake is refused once the target has handed over.
-            // UNKNOWN (null) fails open → deliver. A drop of this line disables the gate silently (gen-bound
-            // wakes would fire at the successor) — pinned in watchdog-target-gen-wiring.test.ts.
-            resolveTargetGeneration: (s) => sessionRegistry.currentOccupantGenerationForSession(s),
-            resolvePreDeliveryTerminalReason: ({ jobId }) => queueRepoInstance.resolveWatchdogPreDeliveryTerminalReason(jobId),
-            resolveQueueWait: (input) => queueRepoInstance.evaluateWaitReminder(input),
-            onWakeAttempt: ({ jobId, deliveryStatus }) => {
-                queueRepoInstance.recordWatchdogWakeAttempt(jobId, deliveryStatus);
-            },
-            // PL-004 Phase D: register workflow-keepalive policy alongside
-            // Phase C's three built-in policies. workflow-keepalive reads
-            // SQLite workflow_instances directly via the new Phase D tables
-            // (audit row 18: SQLite-source-only, no markdown read).
-            // OPR.0.4.3.16: register idle-gate-qitem — joins pending gate:*
-            // qitems (queue_items) with the shared arbitrated activity verdict
-            // rendered by public surfaces
-            // into one bounded wake. Wakes/flags only; cooldown via engine throttle.
-            additionalPolicies: [
-                makeWorkflowKeepalivePolicy({
-                    db,
-                    // OPR.0.4.6.WF5 FR-2 class (b): detection-time exception items,
-                    // dedup by occurrence; dial resolved via the runtime's cached
-                    // spec (registered-human selection inside the helper).
-                    ensureStuckExceptionItem: workflowExceptionEnsurer,
-                    reconcileStuckExceptions: (id) => workflowRuntime?.reconcileStuckExceptions(id) ?? 0,
-                }),
-                makeIdleGateQitemPolicy({ db, seatActivity: seatActivityService }),
-                // OPR.0.5.6.24 F-14: the parked-owner consumer — the WHOLE shipped
-                // parked diagnosis (diagnoseRigParked over the arbitrated oracle +
-                // destination-scoped obligations + wake status; the same derivation
-                // `rig parked` serves) consumed by one rig-level supervisor job.
-                // Episode receipts are TRANSITIONS on the obligation row, written
-                // reserve-before-deliver (the retention active-frontier invariant is
-                // the durability proof); watchdog history is telemetry only.
-                makeParkedOwnerConsumerPolicy({
-                    diagnoseRig: (rigName) => {
-                        const seats = db
-                            .prepare(`SELECT n.id AS node_id, s.session_name AS session_name
-                   FROM nodes n
-                   JOIN rigs r ON r.id = n.rig_id
-                   JOIN sessions s ON s.node_id = n.id
-                    AND s.id = (SELECT s2.id FROM sessions s2 WHERE s2.node_id = n.id ORDER BY s2.id DESC LIMIT 1)
-                  WHERE s.status = 'running' AND s.session_name IS NOT NULL AND r.name = ?`)
-                            .all(rigName);
-                        const parkedDeps = {
-                            getSeatState: (seatNodeId) => seatActivityService.getSeatState(seatNodeId),
-                            listOpenObligations: (destinationSession, limit) => ({
-                                rows: queueRepoInstance
-                                    .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit })
-                                    .map((r) => ({
-                                    qitemId: r.qitemId,
-                                    state: r.state,
-                                    summary: r.summary ?? null,
-                                })),
-                                limit,
-                            }),
-                            getParkWake: (qitemId) => queueRepoInstance.getParkWakeStatus(qitemId),
-                        };
-                        return diagnoseRigParked(parkedDeps, seats.map((s) => ({ seatNodeId: s.node_id, sessionName: s.session_name })));
-                    },
-                    history: {
-                        listForJob: (jobId, limit) => watchdogHistoryLogInstance.listForJob(jobId, limit),
-                        countForJob: (jobId) => watchdogHistoryLogInstance.countForJob(jobId),
-                    },
-                    // R2 repair: the durable row-side surfaces. Receipts are transitions on
-                    // the obligation row (reserve-before-deliver); failures land in the
-                    // ladder's native last_nudge_result vocabulary.
-                    rows: {
-                        recoveryOwnsWake: (qitemId) => queueRecoveryOwnsWake(db, queueRepoInstance.getById(qitemId)),
-                        listTransitions: (qitemId) => queueRepoInstance
-                            .listTransitions(qitemId)
-                            .map((t) => ({ ts: t.ts, transitionNote: t.transitionNote ?? null })),
-                        appendNote: (qitemId, note) => {
-                            const row = queueRepoInstance.getById(qitemId);
-                            if (!row || !isBlockerLive(row.state))
-                                return { ok: false };
-                            queueRepoInstance.update({
-                                qitemId,
-                                actorSession: "watchdog@system",
-                                transitionNote: note,
-                            });
-                            return { ok: true };
-                        },
-                        recordNudgeResult: (qitemId, result) => queueRepoInstance.recordNudgeAttempt(qitemId, result),
-                        listOpenIds: (destinationSession) => queueRepoInstance
-                            .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit: 500 })
-                            .map((r) => r.qitemId),
-                    },
-                }),
-                // OPR.0.5.6.1 AM-F1 — the delivery engine's two timing legs on THIS
-                // substrate. The gateway dispatch binds late (the subsystem is built
-                // after this engine): the ref below is populated at gateway activation.
-                (await import("./domain/policies/delivery-deferral.js")).makeDeliveryDeferralPolicy({
-                    jobsRepo: watchdogJobsRepoInstance,
-                    queueRepo: queueRepoInstance,
-                    deliverInterrupt: async (qitemId, notificationKey) => {
-                        const dispatch = lateGatewayDispatch.fn;
-                        const row = queueRepoInstance.getById(qitemId);
-                        if (!dispatch || !row)
-                            return { ok: false };
-                        // R2/R1 B-1+B-3: the ADVERTISED op, the shared payload builder, and
-                        // the EPISODE key riding through to the Slice 14 receipt.
-                        const { buildDeferralFirePayload } = await import("./domain/gateway/operator-delivery-engine.js");
-                        const { OUTBOUND_OP } = await import("./domain/gateway/slack/outbound-driver.js");
-                        const payload = buildDeferralFirePayload(row, notificationKey);
-                        // v3: durable episode-stable identity — replay and re-dispatch converge.
-                        const res = dispatch(OUTBOUND_OP, String(payload["destinationSession"] ?? ""), payload, { decisionId: `deferral:${notificationKey}` });
-                        return { ok: res.ok };
-                    },
-                }),
-                (await import("./domain/policies/delivery-digest-flush.js")).makeDeliveryDigestFlushPolicy({
-                    queueRepo: queueRepoInstance,
-                    registry: { loadHumanRegistry: (home) => loadHumanRegistryForDelivery(home) },
-                    home: OPENRIG_HOME,
-                    // v3: the digest posts THROUGH THE GATEWAY on its stable decision id —
-                    // one transport, one redrive/reconcile machinery, receipts after truth.
-                    dispatch: (op, ref, payload, opts) => {
-                        const fn = lateGatewayDispatch.fn;
-                        if (!fn)
-                            return { ok: false, error: "gateway not yet active" };
-                        return fn(op, ref, payload, opts);
-                    },
-                }),
-            ],
-        });
-        queueRepoInstance.startWaitReminders();
-        const watchdogScheduler = new WatchdogScheduler({
-            jobsRepo: watchdogJobsRepoInstance,
-            policyEngine: watchdogPolicyEngine,
-            beforeTick: () => queueRepoInstance.reconcileWaitReminders(),
-        });
-        deps.watchdogPolicyEngine = watchdogPolicyEngine;
-        deps.watchdogScheduler = watchdogScheduler;
-        // OPR.0.5.6.24 F-14 — ONE parked-owner supervisor job per rig (mini-req 1):
-        // ensured idempotently on the (policy, target_session) tuple; the anchor is
-        // `parked-owner-consumer@<rigName>` (member@rig shape, policy name as the
-        // member slug). activeWakeIntervalSeconds stays NULL so the engine never
-        // throttles one seat's wake because another fired — per-seat dedup lives in
-        // the durable episode receipts. Rigs created after startup are BORN ARMED:
-        // rigRepo.onRigCreated (wired below) runs the same ensure in the creation
-        // act itself (the birth-property ruling) — no restart wait, no watcher.
-        {
-            const ensureParkedOwnerJob = (rigName) => {
-                const anchor = makeRigAnchor(rigName);
-                watchdogJobsRepoInstance.ensureAutoRegistration({
-                    policy: PARKED_OWNER_POLICY_NAME,
-                    targetSession: anchor,
-                    registeredBySession: "daemon@kernel",
-                    intervalSeconds: 120,
-                    activeWakeIntervalSeconds: null,
-                    scanIntervalSeconds: null,
-                    specYaml: `policy: ${PARKED_OWNER_POLICY_NAME}\ntarget:\n  session: ${anchor}\ncontext:\n  rig: ${rigName}\n`,
-                });
-            };
-            const rigRows = db.prepare("SELECT name FROM rigs ORDER BY name").all();
-            for (const r of rigRows)
-                ensureParkedOwnerJob(r.name);
-            // R2 repair — born-armed (advisor-ruled): a rig created after startup gets
-            // its supervisor job in the same act that creates it, never at the next
-            // daemon restart.
-            rigRepo.onRigCreated = (rig) => ensureParkedOwnerJob(rig.name);
-        }
-        // OPR.0.5.6.1 — the two digest windows as idempotent watchdog jobs (AM-F1:
-        // the flush rides the same named substrate; restart-durable by the same
-        // SQLite schedule; a daemon down across a window flushes on the next tick).
-        {
-            const ensureDigestJob = (window, intervalSeconds) => {
-                watchdogJobsRepoInstance.ensureAutoRegistration({
-                    policy: "delivery-digest-flush",
-                    targetSession: `delivery-digest-${window}@kernel`,
-                    registeredBySession: "daemon@kernel",
-                    intervalSeconds,
-                    activeWakeIntervalSeconds: null,
-                    scanIntervalSeconds: null,
-                    specYaml: `policy: delivery-digest-flush\ntarget:\n  session: delivery-digest-${window}@kernel\ncontext:\n  window: ${window}\n`,
-                });
-            };
-            ensureDigestJob("4h", 4 * 60 * 60);
-            ensureDigestJob("daily", 24 * 60 * 60);
-        }
-        // B8 / slice-07 A3 — the MODEL-DIVERGENCE MONITOR: cause-agnostic effective-vs-pinned
-        // comparison at the earliest reliable per-runtime read, one verdict per occupant generation,
-        // LOUD four-channel proclamation on divergence (orch seats + operator + oversight + the named
-        // Slack deferral per DS2). Channel targets per the desk ruling 2026-08-21: orch = the seat's
-        // own rig's orch.* seats; operator = derived from workspace.operator_seat_name (never
-        // hardcoded); oversight = the fleet judgment seat, locally resolvable or a NAMED deferral
-        // (no daemon-side cross-host send seam exists yet — the deferral names that, never silence).
-        {
-            const { ModelDivergenceMonitor } = await import("./domain/model-divergence/model-divergence-monitor.js");
-            const { readClaudeEffectiveModel, readCodexEffectiveModel } = await import("./domain/model-divergence/effective-model-readers.js");
-            const { resolveIdentityVerifiedClaudeRecord, resolveLiveCodexThreadId } = await import("./domain/model-divergence/current-generation-record.js");
-            const { defaultListProcesses } = await import("./domain/resume-metadata-refresher.js");
-            const { readCodexThreadIdFromCandidateHomes, defaultResolveHomeDirByPid } = await import("./domain/codex-thread-id.js");
-            const nodeOs = await import("node:os");
-            const nodeFs = await import("node:fs");
-            const seatIdentityStore = new SeatIdentityStore(db);
-            // OPR.0.5.3.10 — ONE shared census + ONE PID-home resolver for the whole
-            // divergence surface: no more `ps -Ao` per seat per poll, no more `ps eww`
-            // per pid (default-home-first + bounded PID cache).
-            const { ProcessCensus } = await import("./domain/process-census.js");
-            const { CodexThreadIdResolver } = await import("./domain/codex-thread-id.js");
-            const divergenceCensus = new ProcessCensus();
-            const codexThreadIdResolver = new CodexThreadIdResolver({ defaultHome: nodeOs.homedir() });
-            const currentGenDeps = {
-                getPanePid: async (sessionTarget) => tmuxAdapter.getPanePid ? tmuxAdapter.getPanePid(sessionTarget) : null,
-                listProcesses: () => divergenceCensus.list(),
-                // S10 follow-on: identity REQUIRED on resolve(); the identity-less case routes EXPLICITLY
-                // through the named ungated escape hatch — never a silent fallback (r1 owed item 3).
-                readThreadIdByPid: (pid, identity) => identity === undefined ? codexThreadIdResolver.resolveUngatedLegacy(pid) : codexThreadIdResolver.resolve(pid, identity),
-            };
-            const OVERSIGHT_SEAT = "watch-lead@oversight";
-            const modelDivergenceMonitor = new ModelDivergenceMonitor({
-                processCensus: divergenceCensus,
-                listPinnedSeats: () => {
-                    const rows = db.prepare(`
-            SELECT n.id AS nodeId, r.id AS rigId, r.name AS rigName, n.runtime AS runtime, n.model AS pinnedModel,
-                   (SELECT s.session_name FROM sessions s
-                     WHERE s.node_id = n.id AND s.status = 'running'
-                     ORDER BY s.created_at DESC, s.id DESC LIMIT 1) AS sessionName
-              FROM nodes n JOIN rigs r ON r.id = n.rig_id
-             WHERE n.model IS NOT NULL AND n.model <> ''
-          `).all();
-                    return rows
-                        .filter((row) => row.sessionName !== null)
-                        .map((row) => ({ ...row, generation: sessionRegistry.currentOccupantGenerationForSession(row.sessionName) }));
-                },
-                // D-a / OPR.0.5.9.13 — the CURRENT GENERATION's record through the canonical binding and
-                // verified pane identity, never a name, registry token, or transcript recency lookup. A
-                // retained predecessor may keep writing under the canonical launch-time name forever.
-                // Every missing or ambiguous identity join is an explicit no-answer.
-                readEffectiveModel: async (seat, cycle) => {
-                    // OPR.0.5.3.10 mini-req 1 — the poll-scoped census (one ps per pass) when the
-                    // monitor threads it; the shared coalescing census otherwise.
-                    const genDeps = cycle ? { ...currentGenDeps, listProcesses: cycle.listProcesses } : currentGenDeps;
-                    if (seat.runtime === "codex") {
-                        const live = await resolveLiveCodexThreadId(seat.sessionName, genDeps);
-                        if (!live.ok)
-                            return { ok: false, reason: live.reason };
-                        const rollout = contextUsageStore.readCodexAndNormalize({ threadId: live.id, sessionName: seat.sessionName }).transcriptPath;
-                        if (!rollout)
-                            return { ok: false, reason: `live thread ${live.id.slice(0, 8)}… has no readable rollout` };
-                        const model = readCodexEffectiveModel(rollout);
-                        return model ? { ok: true, model } : { ok: false, reason: `no model signal in the bounded read of ${rollout}` };
-                    }
-                    if (seat.runtime === "claude-code") {
-                        const tenure = sessionRegistry.currentOccupantTenure(seat.nodeId);
-                        const sidecar = contextUsageStore.readSidecar(seat.sessionName);
-                        const binding = sessionRegistry.getBindingForNode(seat.nodeId);
-                        const selection = await resolveIdentityVerifiedClaudeRecord({
-                            sessionName: seat.sessionName,
-                            generation: seat.generation,
-                            occupantBootAt: tenure?.bootAt ?? null,
-                            binding: binding ? { tmuxSession: binding.tmuxSession, tmuxPane: binding.tmuxPane } : null,
-                            identity: seatIdentityStore.getForNode(seat.nodeId),
-                            sidecar: sidecar.ok ? sidecar.data : null,
-                        }, genDeps, (path) => {
-                            try {
-                                return nodeFs.statSync(path).isFile();
-                            }
-                            catch {
-                                return false;
-                            }
-                        });
-                        if (!selection.ok)
-                            return { ok: false, reason: selection.reason };
-                        const model = readClaudeEffectiveModel(selection.path);
-                        return model
-                            ? { ok: true, model }
-                            : { ok: false, reason: `no assistant turn yet in the current occupant record ${selection.path} (selected from ${selection.source})` };
-                    }
-                    return { ok: false, reason: `runtime ${seat.runtime ?? "unknown"} has no effective-model reader yet` };
-                },
-                sendToSession: async (target, message) => {
-                    try {
-                        const result = await sessionTransport.send(target, message);
-                        return result.ok ? { ok: true } : { ok: false, error: result.error };
-                    }
-                    catch (err) {
-                        return { ok: false, error: err instanceof Error ? err.message : String(err) };
-                    }
-                },
-                resolveOrchSeats: (rigName) => db.prepare(`
-          SELECT s.session_name AS sessionName
-            FROM sessions s JOIN nodes n ON n.id = s.node_id JOIN rigs r ON r.id = n.rig_id
-           WHERE r.name = ? AND s.status = 'running' AND n.logical_id LIKE 'orch.%'
-        `).all(rigName).map((row) => row.sessionName),
-                resolveOperatorSeat: () => {
-                    const value = deps.settingsStore?.resolveOne("workspace.operator_seat_name").value;
-                    return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-                },
-                resolveOversightSeat: () => {
-                    const row = db.prepare("SELECT session_name FROM sessions WHERE session_name = ? AND status = 'running' LIMIT 1").get(OVERSIGHT_SEAT);
-                    return row ? OVERSIGHT_SEAT : null;
-                },
-                recordProclamation: (proclamation) => {
-                    eventBus.emit({
-                        type: "seat.model_divergence",
-                        rigId: proclamation.rigId,
-                        nodeId: proclamation.nodeId,
-                        sessionName: proclamation.sessionName,
-                        runtime: proclamation.runtime,
-                        pinnedModel: proclamation.pinnedModel,
-                        effectiveModel: proclamation.effectiveModel,
-                        diagnosis: proclamation.diagnosis,
-                        channels: proclamation.channels,
-                    });
-                },
-            });
-            modelDivergenceMonitor.startPolling(60_000);
-            deps.modelDivergenceMonitor = modelDivergenceMonitor;
-        }
-        // OPR.0.4.6.WF1 FR-4: the workflow startup resume sweep — re-arm
-        // keepalives, reissue lost post-commit nudges (pending frontier
-        // packets never nudged), surface stuck instances. Runs after the
-        // watchdog + transport are wired so re-nudges actually deliver.
-        // Failures are logged, never fatal: a sweep problem must not
-        // bring the daemon down.
-        if (workflowRuntime && queueRepoForWorkflow) {
-            try {
-                const { runWorkflowBootSweep } = await import("./domain/workflow-boot-sweep.js");
-                await runWorkflowBootSweep({
-                    instanceStore: workflowRuntime.instanceStore,
-                    queueRepo: queueRepoForWorkflow,
-                    watchdogJobsRepo: watchdogJobsRepoInstance,
-                    log: (line) => console.log(line),
-                    // OPR.0.4.6.WF5 FR-2 class (b): the sweep leg of detection.
-                    ensureStuckExceptionItem: workflowExceptionEnsurer,
-                    reconcileStuckExceptions: () => workflowRuntime?.reconcileStuckExceptions() ?? 0,
-                });
-            }
-            catch (err) {
-                console.warn(`workflow boot sweep: failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        // W1 (transactional closure) FR — the wake-intent RECOVERY SWEEP. Deliver
-        // any wake intents a crash left committed-but-undelivered (the terminal txn
-        // committed, so the intent is durable, but the process died before the
-        // post-commit deliver). Runs after transport is wired so the re-deliveries
-        // actually land. Non-fatal — a sweep failure must not bring the daemon down.
-        // No periodic timer (ruled out of scope): a transient failure lands the row
-        // in a VISIBLE state and is retried on the next start.
-        try {
-            // BLOCKING 1: reconcile abandoned `sending` claims (a prior crash) FIRST,
-            // then drain committed `pending` intents. Reconcile is a one-time boundary
-            // step, separate from the drain.
-            const reconciled = queueRepoInstance.reconcileAbandonedWakeIntents();
-            const drained = await queueRepoInstance.drainPendingWakeIntents();
-            if (drained.delivered || drained.indeterminate || drained.failed || reconciled) {
-                console.log(`wake-intent recovery sweep: delivered=${drained.delivered} indeterminate=${drained.indeterminate} failed=${drained.failed} reconciled=${reconciled}`);
-            }
-        }
-        catch (err) {
-            console.warn(`wake-intent recovery sweep: failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    // Context monitor — constructed before createApp so routes can access pollOnce for refresh.
-    // Caller (index.ts) starts polling after listen.
-    // Slice 27: wire ClaudeCompactionEnforcer when sessionTransport is
-    // available (it always is in the assembled deps; the conditional keeps
-    // the type narrow for downstream consumers).
-    const { ContextMonitor } = await import("./domain/context-monitor.js");
-    const { ClaudeCompactionEnforcer } = await import("./domain/claude-compaction-enforcer.js");
-    const compactionEnforcer = deps.sessionTransport
-        ? new ClaudeCompactionEnforcer(new ContextPackSettingsStore(), deps.sessionTransport, 
-        // GHOST-STAGE (b): resolve the LIVE occupant generation (atom-B tenure ledger) for a session
-        // so a stage minted by a retired generation is refused for the successor. null = UNKNOWN → the
-        // gate is inert (never compares a stale generation as if live).
-        {
-            resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
-            onPostRestoreComplete: (receipt) => {
-                recordManagedWidthReceipt(receipt, watchdogJobsRepoInstance, watchdogHistoryLogInstance);
-            },
-        })
-        : undefined;
-    // 51-08 A1 — the over-time series rides the SAME 30s tick (PM decision 1):
-    // context lane appends beside the existing persist; the provider-window lane
-    // drains the same statusline cache directory the read model scans.
-    const { UsageSamplesStore, providerWindowSamplesFromSignals } = await import("./domain/usage-samples-store.js");
-    const usageSamplesStore = new UsageSamplesStore(db);
-    const contextMonitor = new ContextMonitor(db, contextUsageStore, claudeAdapter, compactionEnforcer, {
-        "claude-code": claudeAdapter,
-        codex: codexAdapter,
-        pi: piAdapter,
-    }, usageSamplesStore, () => providerWindowSamplesFromSignals(collectClaudeSignalsFromProviderUsageDirectory(providerUsageDirectory(OPENRIG_HOME), undefined, legacyProviderUsageDirectory(OPENRIG_HOME))));
-    deps.contextMonitor = contextMonitor;
-    // OPR.0.4.3.14 — expose the SAME enforcer instance to routes for the manual
-    // compaction trigger. Sharing one instance with ContextMonitor is what makes
-    // the manual back-half drain through the auto poll loop (no second path).
-    deps.compactionEnforcer = compactionEnforcer;
-    // GHOST-STAGE (e/Class-B) — construct the canonical OccupantInvalidator now that both Class-A deps
-    // exist (the enforcer's in-mem maps 1a-1f + the context sidecar 2a). Injected into SeatHandoverService
-    // via the app context so commit()'s re-key call FIRES (it was a no-op until wired). An absent enforcer
-    // (degraded boot, no sessionTransport) falls back to a sidecar-only invalidator — never throws.
-    const { DefaultOccupantInvalidator } = await import("./domain/occupant-invalidator.js");
-    deps.occupantInvalidator = new DefaultOccupantInvalidator({
-        enforcer: compactionEnforcer ?? { invalidateOccupant: () => { } },
-        contextUsage: contextUsageStore,
-        // (e/Class-B) watchdog store — armed jobs registered by the retiring generation stop at swap.
-        watchdog: watchdogJobsRepoInstance,
-        // (e/Class-B) queue store — in-progress items claimed by the retiring generation release to pending.
-        queue: queueRepoInstance,
-        log: (msg) => console.warn(msg),
-    });
-    // OPR.0.3.4.9 — periodic snapshot scheduler (crash-insurance floor).
-    const { PeriodicSnapshotScheduler } = await import("./domain/periodic-snapshot-scheduler.js");
-    // OPR.0.5.3.10 — the snapshot tick shares ONE census across all rigs/seats.
-    const { ProcessCensus: SnapshotProcessCensus } = await import("./domain/process-census.js");
-    const snapshotProcessCensus = new SnapshotProcessCensus();
-    const periodicSnapshotScheduler = new PeriodicSnapshotScheduler({
-        db, snapshotCapture, snapshotRepo,
-        // OPR.0.4.3.20 FR-4 — refresh live tokens before each periodic snapshot serializes.
-        sessionRegistry, resumeMetadataRefresher,
-        processCensus: snapshotProcessCensus,
-    });
-    deps.periodicSnapshotScheduler = periodicSnapshotScheduler;
-    // OPR.0.4.3.21 — daemon event-loop health instrumentation. Constructed once
-    // per daemon and wired into deps so `/healthz` can surface wedge evidence
-    // (loop lag / last-tick age) and the expensive topology routes are timed.
-    const { EventLoopMonitor } = await import("./domain/event-loop-monitor.js");
-    const { RouteTimingRecorder } = await import("./domain/route-timing-recorder.js");
-    const eventLoopMonitor = new EventLoopMonitor();
-    const routeTimingRecorder = new RouteTimingRecorder();
-    deps.eventLoopMonitor = eventLoopMonitor;
-    deps.routeTimingRecorder = routeTimingRecorder;
-    // S20 — bind provenance rides the health surface (absent = legacy healthz body).
-    deps.bindPlan = opts?.bindPlan;
-    // Hermeticity (hotfix qitem-20260822230440-da0d2ad6 FIX 2): the REAL daemon
-    // constructs the drift observer here with an eagerly-warmed mode cache — the
-    // boot-time warm the observer's constructor used to do. Constructing it at
-    // the boot boundary (not inside createApp) is what keeps test-built apps
-    // from ever shelling `claude --help`.
-    const { PermissionDriftObserver, ClaudePermissionModeCache } = await import("./domain/permission-drift-observer.js");
-    const permissionModes = new ClaudePermissionModeCache();
-    permissionModes.warm();
-    deps.permissionDriftObserver = new PermissionDriftObserver({ db, permissionModes });
-    // S10 (OPR.0.5.5.10) — activate the gateway as an IN-DAEMON SUBSYSTEM at boot (M1 §3 as
-    // amended: no child process, no connector wire — the shipped dispatcher + durable buffer
-    // composed in-process, the Slack delivery/inbound services wired from config + secrets).
-    // start() never throws: a wiring failure surfaces as state=failed on the health surface and
-    // boot proceeds. An unconfigured connector is an INERT wire (honest refusal class, no ops,
-    // no drivers) — `rig slack status` names what is missing.
-    const { GatewaySubsystem } = await import("./domain/gateway/gateway-subsystem.js");
-    const { buildSlackGatewayWire, makeHumanReplyResolver } = await import("./domain/gateway/slack/slack-subsystem.js");
-    const gatewaySubsystem = new GatewaySubsystem({
-        home: OPENRIG_HOME,
-        wire: () => buildSlackGatewayWire({
-            home: OPENRIG_HOME,
-            queueRepo: queueRepoInstance,
-            resolveHumanReply: makeHumanReplyResolver(queueRepoInstance, deps.missionControlWriteContract),
-            log: (m) => console.log(`[gateway] ${m}`),
-        }),
-        log: (m) => console.log(`[gateway] ${m}`),
-    });
-    gatewaySubsystem.start();
-    deps.gatewaySubsystem = gatewaySubsystem;
-    // OPR.0.5.6.1 — bind the delivery policies' late gateway ref.
-    lateGatewayDispatch.fn = (op, ref, payload, opts) => gatewaySubsystem.dispatch(op, ref, payload, opts);
-    const { app, injectWebSocket } = createAppWithWebSocket(deps);
-    return { app, db, deps, contextMonitor, eventLoopMonitor, injectWebSocket };
-}
-//# sourceMappingURL=startup.js.map