@ouro.bot/cli 0.1.0-alpha.772 → 0.1.0-alpha.774

package/changelog.json

@@ -1,6 +1,21 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.774",
+      "changes": [
+        "Make Sanctuary updates side-effect-safe, move Telegram acceptance to canonical vault credentials, and repair consumed event recoveries through a reviewed daemon command."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.773",
+      "changes": [
+        "Fail daemon startup closed until configured providers are live and their credentials are cached.",
+        "Surface provider startup failures immediately through a fresh redacted tombstone instead of waiting for a dead daemon or echoing raw logs.",
+        "Recover legacy provider dead letters from current-boot readiness once per generation without per-record alert noise.",
+        "Recover expired managed-runtime leases only after newer runtime liveness, with inspect-before-action turns and bounded batch wakeups."
+      ]
+    },
     {
       "version": "0.1.0-alpha.772",
       "changes": [

package/deploy/unraid/README.txt

@@ -1331,6 +1331,21 @@ NODE
       ! docker container inspect ouro-butler-provider-readiness >/dev/null 2>&1 || return 1
       validate_sanctuary_roots "$READINESS_RUNTIME_ROOT" "$READINESS_AGENT_ROOT" || return $?
     }
+    verify_sanctuary_telegram_readiness() {
+      TELEGRAM_READINESS_IMAGE_ID=$1
+      validate_exact_image_id "$TELEGRAM_READINESS_IMAGE_ID" || return $?
+      TELEGRAM_READINESS_RUNTIME_ROOT=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli
+      TELEGRAM_READINESS_AGENT_ROOT=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro
+      ! docker container inspect ouro-butler-telegram-readiness >/dev/null 2>&1 || return 1
+      docker run --rm --pull=never --network host --name ouro-butler-telegram-readiness --user 10001:10001 \
+        --read-only --cap-drop ALL --security-opt no-new-privileges \
+        --mount "type=bind,src=$TELEGRAM_READINESS_RUNTIME_ROOT,dst=/home/ouro/.ouro-cli" \
+        --mount "type=bind,src=$TELEGRAM_READINESS_AGENT_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly" \
+        --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh \
+        "$TELEGRAM_READINESS_IMAGE_ID" telegram-readiness >/dev/null || return $?
+      ! docker container inspect ouro-butler-telegram-readiness >/dev/null 2>&1 || return 1
+      validate_sanctuary_roots "$TELEGRAM_READINESS_RUNTIME_ROOT" "$TELEGRAM_READINESS_AGENT_ROOT" || return $?
+    }
     run_sanctuary_docker() {
       /usr/bin/timeout -s KILL 20 /usr/bin/docker "$@"
     }
@@ -1676,11 +1691,12 @@ Update:
     cleanup_event_asset_stage
     trap - EXIT
     if provision_sanctuary_sab_credential "$IMAGE_ID" \
-      && verify_sanctuary_sab_readiness "$IMAGE_ID"; then
+      && verify_sanctuary_sab_readiness "$IMAGE_ID" \
+      && verify_sanctuary_telegram_readiness "$IMAGE_ID"; then
       :
     else
-      SAB_READINESS_STATUS=$?
-      (exit "$SAB_READINESS_STATUS")
+      PRECUTOVER_READINESS_STATUS=$?
+      (exit "$PRECUTOVER_READINESS_STATUS")
     fi
   Guard the atomic autostart disable separately. If it fails, production has not
   been touched and the captured status is propagated:
@@ -1734,7 +1750,7 @@ ouro-butler-rollback
   readiness and autostart have passed, commit first durably renames the record;
   a kill then keeps target production in place and the next run validates its
   exact topology/readiness before finishing commit. Migration failure then enters the same exact container
-  rollback arm before staging starts:
+  rollback arm before target production starts:
     if docker stop ouro-butler \
       && remove_stopped_rollback_if_present "$ROLLBACK_IMAGE_ID" \
       && docker rename ouro-butler ouro-butler-rollback \
@@ -1778,52 +1794,13 @@ ouro-butler-rollback
   both recoveries revalidate, start, bounded-wait, atomically restore production-only
   autostart, and propagate the original failure. If neither exact container can
   be found, the failure propagates with Butler autostart disabled.
-  Put the entire post-rename staging phase in one explicit conditional so
-  `set -eu` cannot bypass rollback at the create, effective-audit, start, or
-  bounded-readiness boundary. Staging uses the exact image ID with no command,
-  environment, port, device, capability, privilege, or extra mount override.
-  A passing staging container is stopped and removed inside the same condition,
-  completing the poller handoff before production creation:
-    if docker create --name ouro-butler-staging --network host --restart unless-stopped --user 10001:10001 \
-      --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
-      --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
-      --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-      "$IMAGE_ID" \
-      && audit_effective ouro-butler-staging "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" \
-      && docker start ouro-butler-staging \
-      && assert_only_running_butler ouro-butler-staging \
-      && wait_butler_ready ouro-butler-staging \
-      && docker stop ouro-butler-staging \
-      && docker rm ouro-butler-staging \
-      && assert_only_running_butler -; then
-      :
-    else
-      STAGING_ACTIVATION_STATUS=$?
-      if docker container inspect ouro-butler-staging >/dev/null 2>&1; then
-        docker stop ouro-butler-staging >/dev/null 2>&1 || true
-        PARTIAL_STAGING_IMAGE_ID=$(docker inspect --format '{{.Image}}' ouro-butler-staging)
-        test "$PARTIAL_STAGING_IMAGE_ID" = "$IMAGE_ID"
-        docker rm --force ouro-butler-staging >/dev/null 2>&1 || true
-      fi
-      ! docker container inspect ouro-butler-staging >/dev/null 2>&1
-      CURRENT_ROLLBACK_IMAGE_ID=$(docker inspect --format '{{.Image}}' ouro-butler-rollback)
-      test "$CURRENT_ROLLBACK_IMAGE_ID" = "$ROLLBACK_IMAGE_ID"
-      migrate_sanctuary_package_managed_bundle "$IMAGE_ID" rollback
-      docker rename ouro-butler-rollback ouro-butler
-      assert_update_source "$ROLLBACK_IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID"
-      docker start ouro-butler
-      assert_only_running_butler ouro-butler
-      wait_butler_ready ouro-butler
-      enable_butler_autostart
-      migrate_sanctuary_package_managed_bundle "$IMAGE_ID" commit
-      (exit "$STAGING_ACTIVATION_STATUS")
-    fi
-  The failure arm safely handles staging that was never created, remains
-  stopped, is running, or exited: it force-removes any partial staging state,
-  verifies the name is absent, restores and revalidates the old production against
-  its exact pre-recorded image ID, starts and bounded-waits it, atomically
-  restores production-only autostart, and propagates the original failure.
-  At no point may production and staging run together against the same Telegram token.
+  Do not start a target-image daemon between the production rename and final
+  production activation. The exact-image static audit, SAB readiness, and
+  vault-backed Telegram identity check have already passed before autostart or
+  container mutation. Provider and complete daemon readiness are exercised only
+  by the transactional production activation below, whose failure arm restores
+  and revalidates the exact prior production. This prevents a disposable daemon
+  from reconciling or claiming live external-event state before cutover.
   Create and activate production from the same exact image ID and exact authority
   in one explicit conditional so `set -eu` cannot exit before rollback. Only a
   successful create, effective audit, start, stopped rollback assertion, and
@@ -2288,28 +2265,12 @@ Packaged Unit 16 acceptance execution:
   the config from the packaged fixed contract and requires byte-for-byte equality.
   Unit 16d-2 stops at the pre-model quarantine boundary: use a genuinely distinct private Telegram sender, confirm the fixed acknowledgement and owner admission card, and do not approve the contact during this scenario. The production-identical allow-to-one-turn continuation is covered by the Telegram admission integration suite when a second live account is unavailable. Unit 16h is acceptance-only: it exercises the delivery path against isolated state, restores exact health and cron bytes, and does not activate a production daily digest.
   The cursor snapshot is deliberately materialized and executed twice around the
-  live scenario. Telegram bootstrap reads the new bot token from host file
-  descriptor 3; callback injection reads the reviewed saved callback-update JSON
-  from the same descriptor. The launcher explicitly maps host fd 3 to Docker
-  stdin and then to in-container fd 3 only for those two commands. Neither value
-  belongs in argv, shell history, a config file, or an unrelated command's stdin.
-  Define this Bash helper in the root shell. It disables terminal echo while
-  reading the token, opens an anonymous descriptor for the launcher, and unsets
-  the short-lived shell value on either launcher success or failure:
-    run_unit16_telegram_bootstrap() {
-      local UNIT16_BOT_TOKEN UNIT16_BOT_STATUS
-      printf 'Telegram bot token: ' >&2
-      IFS= read -r -s UNIT16_BOT_TOKEN || return $?
-      printf '\n' >&2
-      if "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final telegram-bootstrap telegram-bootstrap.json \
-        3< <(printf '%s\n' "$UNIT16_BOT_TOKEN"); then
-        UNIT16_BOT_STATUS=0
-      else
-        UNIT16_BOT_STATUS=$?
-      fi
-      unset UNIT16_BOT_TOKEN
-      return "$UNIT16_BOT_STATUS"
-    }
+  live scenario. Telegram bootstrap refreshes the canonical agent vault
+  `runtime/config` and keeps the bot token inside the consuming harness process.
+  It never reads the retired container credential file or carries the token in a
+  descriptor, argument, environment variable, shell variable, config, evidence,
+  or output. Callback injection alone maps its reviewed saved callback-update
+  JSON from host fd 3 through Docker stdin to in-container fd 3.
   Stage the reviewed callback JSON at the fixed path below in the root-owned
   tmpfs inbox, then use this single fail-closed helper. It opens the input once,
   validates the opened descriptor and its original path refer to the same
@@ -2378,7 +2339,7 @@ Packaged Unit 16 acceptance execution:
       )
     }
     "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final materialize telegram-bootstrap
-    run_unit16_telegram_bootstrap
+    "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final telegram-bootstrap telegram-bootstrap.json
     "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final materialize cursor-snapshot before
     "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final cursor-snapshot cursor-snapshot.json
     # Perform the live scenario whose cursor movement is being measured.

package/deploy/unraid/sanctuary-acceptance-adapter.sh

@@ -6,6 +6,7 @@ VAULT_ENTRY='import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js
 REVOKED_ENTRY='import fs from "node:fs"; import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const result = await module.executeSanctuaryAcceptanceRevokedProbe(process.argv[1], process.argv[2], fs.readFileSync(3, "utf8")); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
 CALLBACK_ENTRY='import fs from "node:fs"; import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const result = await module.executeSanctuaryAcceptanceCallbackProbe(JSON.parse(fs.readFileSync(0, "utf8")), process.argv[1] === "replay"); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
 MATERIALIZE_ENTRY='import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const payload = { operation: "materialize_config", command: process.argv[1] }; if (process.argv[2]) payload.phase = process.argv[2]; const result = await module.executeSanctuaryAcceptanceAdapter(payload); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
+TELEGRAM_READINESS_ENTRY='import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const result = await module.executeSanctuaryAcceptanceAdapter({ operation: "telegram_readiness" }); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
 
 if test "${1:-}" = vault-probe; then
   test "$#" -eq 3 || exit 2
@@ -29,6 +30,11 @@ if test "${1:-}" = materialize-config; then
   exec node --input-type=module -e "$MATERIALIZE_ENTRY" "$2" "${3:-}"
 fi
 
+if test "${1:-}" = telegram-readiness; then
+  test "$#" -eq 1 || exit 2
+  exec node --input-type=module -e "$TELEGRAM_READINESS_ENTRY"
+fi
+
 test "$#" -eq 0 || exit 2
 
 if test -e /proc/self/fd/3; then

package/deploy/unraid/sanctuary-acceptance-contract.json

@@ -29,7 +29,6 @@
   },
   "adapters": {
     "telegram-poller-quiescence": { "operation": "quiesce_telegram_poller", "authority": "fixed-managed-telegram-poller-stop-and-count", "modelReachable": false, "timeoutMs": 15000 },
-    "telegram-vault-store": { "operation": "store_telegram_bootstrap", "authority": "fixed-runtime-vault-merge", "modelReachable": false, "timeoutMs": 15000 },
     "cursor-snapshot": { "operation": "snapshot", "authority": "fixed-telegram-state-read", "modelReachable": false, "timeoutMs": 15000 },
     "callback-live": { "operation": "callback_playback_preflight|inject_callbacks_concurrently|inject_callback_replay", "authority": "fixed-live-telegram-callback-probe", "modelReachable": false, "timeoutMs": 15000 },
     "key-inventory": { "operation": "inventory_keys", "authority": "fixed-unraid-key-directory-read", "modelReachable": false, "timeoutMs": 15000 },
@@ -91,12 +90,10 @@
         "offsetPath": "/evidence/telegram-bootstrap-offset.json",
         "noncePath": "/evidence/telegram-bootstrap-nonce.txt",
         "pollerAdapter": "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh",
-        "vaultAdapter": "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh",
         "deadlineMs": 600000,
         "pollTimeoutSeconds": 20
       },
-      "dynamic": ["expectedBotId:getMe.id", "expectedUsername:getMe.username", "currentOffset:fixed-cursor-read"],
-      "privateInputFd": 3
+      "dynamic": ["expectedBotId:getMe.id", "expectedUsername:getMe.username", "currentOffset:fixed-cursor-read"]
     },
     "cursor-snapshot": {
       "fixed": {

package/deploy/unraid/sanctuary-acceptance-harness.sh

@@ -17,7 +17,7 @@ elif test "$#" -gt 1; then
   exit 2
 fi
 
-if test -e /proc/self/fd/3; then
+if test "$COMMAND" = callback-inject && test -e /proc/self/fd/3; then
   exec node --input-type=module -e "$ENTRY" "$COMMAND" "$CONFIG_PATH" 3<&3
 fi
 exec node --input-type=module -e "$ENTRY" "$COMMAND" "$CONFIG_PATH"

package/deploy/unraid/sanctuary-unit16-run.sh

@@ -360,13 +360,13 @@ if test "$COMMAND" = cursor-snapshot; then
 fi
 materialize_config "$EXPECTED_CONFIG" "$SNAPSHOT_PHASE"
 cmp -s "$EXPECTED_CONFIG" "$CONFIG_PATH" || exit 1
-case "$COMMAND" in telegram-bootstrap|callback-inject) test -r /proc/self/fd/3 || exit 2 ;; esac
+case "$COMMAND" in callback-inject) test -r /proc/self/fd/3 || exit 2 ;; esac
 prepare_live_facts
 if test "$COMMAND" = telegram-bootstrap; then quiesce_production_telegram_poller; fi
 if test "$COMMAND" = unraid-key-rotate; then stop_exact_production_container; fi
 
 case "$COMMAND" in
-  telegram-bootstrap) TIME_LIMIT=900; NETWORK=host; INPUT=yes; BUNDLE_MODE=readonly; BROKER=no ;;
+  telegram-bootstrap) TIME_LIMIT=900; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=no ;;
   callback-inject) TIME_LIMIT=120; NETWORK=host; INPUT=yes; BUNDLE_MODE=rw; BROKER=no ;;
   unraid-key-rotate) TIME_LIMIT=600; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
   evidence-snapshot) TIME_LIMIT=4950; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
@@ -424,7 +424,7 @@ fi
 run_harness() {
   if test "$BUNDLE_MODE" = rw; then BUNDLE_SUFFIX=; else BUNDLE_SUFFIX=,readonly; fi
   if test "$COMMAND" = telegram-bootstrap; then
-    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm -i --pull=never --network "$NETWORK" \
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm --pull=never --network "$NETWORK" \
       --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
       --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
       --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
@@ -437,9 +437,8 @@ run_harness() {
       --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
       --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
       --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
-      --entrypoint /bin/sh "$IMAGE_ID" -ceu \
-      'exec 3<&0; exec /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh "$@" 3<&3' \
-      sanctuary-unit16 "$COMMAND" --config /run/ouro-acceptance/config.json <&3
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh "$IMAGE_ID" \
+      "$COMMAND" --config /run/ouro-acceptance/config.json
   elif test "$COMMAND" = callback-inject; then
     /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm -i --pull=never --network "$NETWORK" \
       --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.772",
+  "runtimeVersion": "0.1.0-alpha.774",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.772</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.774</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/cli-defaults.js

@@ -77,6 +77,8 @@ const provider_models_1 = require("../provider-models");
 const cli_parse_1 = require("./cli-parse");
 const provider_discovery_1 = require("./provider-discovery");
 const provider_credentials_1 = require("../provider-credentials");
+const startup_tui_1 = require("./startup-tui");
+const daemon_tombstone_1 = require("./daemon-tombstone");
 // ── Default implementations ──
 async function defaultStartDaemonProcess(socketPath) {
     const launchdStarted = await startDaemonProcessViaLaunchd(socketPath);
@@ -724,6 +726,7 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         readHealthState: daemon_health_1.readHealth,
         readHealthUpdatedAt: defaultReadHealthUpdatedAt,
         readRecentDaemonLogLines: defaultReadRecentDaemonLogLines,
+        readDaemonStartupTombstone: daemon_tombstone_1.readDaemonTombstone,
         sleep: defaultSleep,
         spawnBackgroundCli: defaultSpawnBackgroundCli,
         now: () => Date.now(),
@@ -732,6 +735,7 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         startupStabilityWindowMs: 1_500,
         startupTimeoutMs: 60_000,
         startupRetryLimit: 1,
+        isProcessAlive: startup_tui_1.defaultIsProcessAlive,
         listDiscoveredAgents: defaultListDiscoveredAgents,
         runHatchFlow: hatch_flow_1.runHatchFlow,
         promptInput: defaultPromptInput,

package/dist/heart/daemon/cli-exec.js

@@ -113,6 +113,7 @@ const readiness_repair_1 = require("./readiness-repair");
 const human_readiness_1 = require("./human-readiness");
 const human_command_screens_1 = require("./human-command-screens");
 const startup_tui_1 = require("./startup-tui");
+const daemon_bootstrap_startup_1 = require("./daemon-bootstrap-startup");
 const stale_bundle_prune_1 = require("./stale-bundle-prune");
 const up_progress_1 = require("./up-progress");
 const provider_ping_progress_1 = require("./provider-ping-progress");
@@ -1192,6 +1193,7 @@ async function ensureDaemonRunning(deps, options = {}) {
             writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
             /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
             isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+            isProcessAlive: deps.isProcessAlive,
             /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
             now: deps.now ?? (() => Date.now()),
             /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
@@ -1240,6 +1242,7 @@ async function ensureDaemonRunning(deps, options = {}) {
                 writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
                 /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
                 isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+                isProcessAlive: deps.isProcessAlive,
                 /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
                 now: deps.now ?? (() => Date.now()),
                 /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
@@ -1295,7 +1298,9 @@ function formatDaemonStartupFailureMessage(pid, failure, deps) {
     const lines = [
         `background service started (pid ${pid ?? "unknown"}) but did not finish booting: ${failure.reason}`,
     ];
-    const recentLogLines = deps.readRecentDaemonLogLines?.(DEFAULT_DAEMON_STARTUP_LOG_LINES) ?? [];
+    const recentLogLines = failure.includeRecentLogs === false
+        ? []
+        : deps.readRecentDaemonLogLines?.(DEFAULT_DAEMON_STARTUP_LOG_LINES) ?? [];
     if (recentLogLines.length > 0) {
         lines.push("recent daemon logs:");
         lines.push(...recentLogLines.map((line) => `  ${line}`));
@@ -1303,6 +1308,19 @@ function formatDaemonStartupFailureMessage(pid, failure, deps) {
     lines.push("Run `ouro logs` to watch live startup logs or `ouro doctor` for a deeper diagnosis.");
     return lines.join("\n");
 }
+function readFreshDaemonStartupFailure(deps, options) {
+    const tombstone = deps.readDaemonStartupTombstone?.() ?? null;
+    if (!tombstone || (tombstone.reason !== daemon_bootstrap_startup_1.PUBLIC_DAEMON_STARTUP_FAILURE_REASON && tombstone.reason !== "startupFailure"))
+        return null;
+    const timestampMs = Date.parse(tombstone.timestamp);
+    if (!Number.isFinite(timestampMs) || timestampMs < options.bootStartedAtMs)
+        return null;
+    if (options.pid !== null && tombstone.pid !== options.pid)
+        return null;
+    return tombstone.reason === daemon_bootstrap_startup_1.PUBLIC_DAEMON_STARTUP_FAILURE_REASON
+        ? tombstone.message
+        : "background service failed during startup; run `ouro doctor` for diagnosis";
+}
 async function waitForDaemonStartup(deps, options) {
     const now = deps.now ?? Date.now;
     const sleep = deps.sleep ?? defaultSleep;
@@ -1316,6 +1334,16 @@ async function waitForDaemonStartup(deps, options) {
     if (!useHealthMonitor) {
         while (now() < deadline) {
             await sleep(pollIntervalMs);
+            const startupFailure = readFreshDaemonStartupFailure(deps, options);
+            if (startupFailure)
+                return { reason: startupFailure, retryable: false, includeRecentLogs: false };
+            if (options.pid !== null && deps.isProcessAlive && !deps.isProcessAlive(options.pid)) {
+                return {
+                    reason: `${options.serviceLabel} exited before answering`,
+                    retryable: false,
+                    includeRecentLogs: false,
+                };
+            }
             const latestEvent = options.readLatestDaemonEvent?.() ?? null;
             deps.reportDaemonStartupPhase?.(formatDaemonStartupProgressLine(options.serviceLabel, "waiting", latestEvent));
             if (await deps.checkSocketAlive(deps.socketPath))
@@ -1328,8 +1356,18 @@ async function waitForDaemonStartup(deps, options) {
     }
     while (now() < deadline) {
         await sleep(pollIntervalMs);
+        const startupFailure = readFreshDaemonStartupFailure(deps, options);
+        if (startupFailure)
+            return { reason: startupFailure, retryable: false, includeRecentLogs: false };
         const aliveNow = await deps.checkSocketAlive(deps.socketPath);
         if (!aliveNow) {
+            if (options.pid !== null && deps.isProcessAlive && !deps.isProcessAlive(options.pid)) {
+                return {
+                    reason: `${options.serviceLabel} exited before answering`,
+                    retryable: false,
+                    includeRecentLogs: false,
+                };
+            }
             if (sawSocket) {
                 return {
                     reason: `${options.serviceLabel} answered once and then disappeared during startup`,

package/dist/heart/daemon/cli-help.js

@@ -127,10 +127,10 @@ exports.COMMAND_REGISTRY = {
     },
     event: {
         category: "Tasks",
-        description: "Submit a verified external event to an owning agent and optionally wake its private runtime",
-        usage: "ouro event submit --agent <agent> --source <source> --type <event-type> --id <provider-id> [--summary <text>] [--evidence <path>] [--payload <path>] [--priority high|normal|low] [--no-wake]",
+        description: "Submit an external event or apply a reviewed receipt-repair manifest through the owning daemon",
+        usage: "ouro event submit --agent <agent> --source <source> --type <event-type> --id <provider-id> [--summary <text>] [--evidence <path>] [--payload <path>] [--priority high|normal|low] [--no-wake] | ouro event repair --manifest <path>",
         example: "ouro event submit --agent slugger --source app-store-connect --type feedback.created --id evt_123 --evidence /tmp/feedback",
-        subcommands: ["submit"],
+        subcommands: ["submit", "repair"],
     },
     poke: {
         category: "Tasks",

package/dist/heart/daemon/cli-parse.js

@@ -201,6 +201,11 @@ function parseMessageCommand(args) {
 }
 function parseEventCommand(args) {
     const sub = args[0];
+    if (sub === "repair") {
+        if (args.length !== 3 || args[1] !== "--manifest" || !args[2])
+            throw new Error(`Usage\n${usage()}`);
+        return { kind: "external.event.repair", manifestPath: args[2] };
+    }
     if (sub !== "submit")
         throw new Error(`Usage\n${usage()}`);
     let agent;

package/dist/heart/daemon/daemon-bootstrap-startup.js

@@ -1,14 +1,37 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PUBLIC_DAEMON_STARTUP_FAILURE_REASON = void 0;
+exports.createProviderReadinessPreparationFailure = createProviderReadinessPreparationFailure;
 exports.failFastContainerCredentialBootstrapStartup = failFastContainerCredentialBootstrapStartup;
 exports.startDaemonAfterContainerCredentialBootstrap = startDaemonAfterContainerCredentialBootstrap;
 const runtime_1 = require("../../nerves/runtime");
 const daemon_tombstone_1 = require("./daemon-tombstone");
 const REDACTED_BOOTSTRAP_STARTUP_ERROR = "container credential bootstrap rejected; recoverable claim retained for reconciliation";
+const REDACTED_DAEMON_PREPARATION_ERROR = "provider runtime preparation failed before startup; run `ouro doctor` for diagnosis";
+exports.PUBLIC_DAEMON_STARTUP_FAILURE_REASON = "startupFailurePublic";
+class DaemonPreparationFailure extends Error {
+    name = "DaemonPreparationFailure";
+}
+function createProviderReadinessPreparationFailure(issues) {
+    const lines = ["Provider checks need attention"];
+    for (const issue of issues) {
+        lines.push(issue.summary);
+        lines.push(...issue.actions.map((action) => `  ${action.actor}: ${action.command}`));
+    }
+    return new DaemonPreparationFailure(lines.join("\n"));
+}
 function failFastContainerCredentialBootstrapStartup(input) {
-    const error = new Error(REDACTED_BOOTSTRAP_STARTUP_ERROR);
+    failFastDaemonStartup({
+        exit: input.exit,
+        errorMessage: REDACTED_BOOTSTRAP_STARTUP_ERROR,
+        eventMessage: "daemon entrypoint failed before server startup",
+    });
+}
+function failFastDaemonStartup(input) {
+    const errorMessage = input.errorMessage;
+    const error = new Error(errorMessage);
     try {
-        (0, daemon_tombstone_1.writeDaemonTombstone)("startupFailure", error);
+        (0, daemon_tombstone_1.writeDaemonTombstone)(exports.PUBLIC_DAEMON_STARTUP_FAILURE_REASON, error);
     }
     catch {
         // Exit remains mandatory even if best-effort tombstone reporting fails.
@@ -18,8 +41,8 @@ function failFastContainerCredentialBootstrapStartup(input) {
             level: "error",
             component: "daemon",
             event: "daemon.entry_error",
-            message: "daemon entrypoint failed before server startup",
-            meta: { error: REDACTED_BOOTSTRAP_STARTUP_ERROR },
+            message: input.eventMessage,
+            meta: { error: errorMessage },
         });
     }
     catch {
@@ -36,6 +59,19 @@ async function startDaemonAfterContainerCredentialBootstrap(input) {
         failFastContainerCredentialBootstrapStartup({ exit: input.exit });
         return false;
     }
+    try {
+        await input.prepareDaemon?.();
+    }
+    catch (error) {
+        input.markStartupFailure();
+        const controlledMessage = error instanceof DaemonPreparationFailure ? error.message : null;
+        failFastDaemonStartup({
+            exit: input.exit,
+            errorMessage: controlledMessage ?? REDACTED_DAEMON_PREPARATION_ERROR,
+            eventMessage: controlledMessage ?? REDACTED_DAEMON_PREPARATION_ERROR,
+        });
+        return false;
+    }
     await input.startDaemon();
     return true;
 }