@pellux/goodvibes-daemon 1.28.0

package/src/runtime/cluster-group-composition.ts

@@ -0,0 +1,284 @@
+/**
+ * cluster-group-composition.ts — this machine's membership of a LAN group.
+ *
+ * Leader election answers "which of us reads the inbox". This answers the
+ * question underneath it: "which machines are US". Without a group, any daemon
+ * that happened to be on the same network — a neighbour's, a colleague's, a
+ * container someone left running — would join the same coordination and one of
+ * you would silently stop receiving messages.
+ *
+ * The group layer owns the socket and the election rides on it: every
+ * coordination datagram is wrapped in the group envelope and signed with the
+ * current group key, so a datagram from outside the group never reaches the
+ * election at all. That is why `createClusterComposition` is handed a transport
+ * from here instead of opening one of its own.
+ *
+ * Key material lives ONLY in the encrypted secrets store. Never in config,
+ * never in a log line, never in `/status`.
+ */
+import {
+  ClusterGroupRuntime,
+  createClusterGroupVerbs,
+  createSystemClusterClock,
+  readClusterSettings,
+  rejoinGroup,
+  resolveClusterGroupSettings,
+  resolveNodeIdentity,
+  stillOnRoster,
+  UdpClusterTransport,
+  type ClusterGroupVerbSurface,
+  type ClusterSurfaceHolding,
+  type GroupOperationsContext,
+} from '@pellux/goodvibes-sdk/platform/cluster';
+import type { ConfigManager, SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ClusterTransport } from '@pellux/goodvibes-sdk/platform/cluster';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import type { ShellPathService } from '@/runtime/index.ts';
+import { createClusterComposition } from './cluster-composition.ts';
+import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
+import { GOODVIBES_DAEMON_SURFACE_ROOT } from '../config/surface.ts';
+import { VERSION } from '../version.ts';
+
+export interface ClusterGroupComposition {
+  readonly runtime: ClusterGroupRuntime;
+  readonly verbs: ClusterGroupVerbSurface;
+  /** The transport the leader election must use, so its traffic is group-signed. */
+  readonly electionTransport: ClusterTransport;
+  /** Start the group layer. Safe to call more than once. */
+  start(): Promise<void>;
+  stop(): Promise<void>;
+}
+
+/**
+ * A label for THIS machine in the member list.
+ *
+ * Deliberately NOT the hostname. The roster replicates to every member and the
+ * group name reaches the network in a beacon, so defaulting to a hostname would
+ * quietly publish "mikes-laptop" to anything listening. A short slice of the
+ * node id is meaningless and safe, and `cluster nodes` shows it plainly so an
+ * operator who wants a real name can see there is one to set.
+ */
+function defaultNodeDisplayName(nodeId: string): string {
+  return `machine ${nodeId.slice(0, 8)}`;
+}
+
+/**
+ * Build the group layer.
+ *
+ * Constructing it is inert: no socket is opened and no key material is read
+ * until `start()`, so composing a runtime in a test never touches the network
+ * or the secrets store.
+ */
+export function createClusterGroupComposition(options: {
+  readonly configManager: ConfigManager;
+  readonly shellPaths: ShellPathService;
+  readonly secretsManager: SecretsManager;
+  /**
+   * The leader election's own answer to "am I the master".
+   *
+   * Config replication needs exactly one machine issuing revisions, and it must
+   * be the SAME machine leadership already picked — two notions of master in
+   * one process would disagree the moment one of them changed.
+   *
+   * Late-bound because the coordinator is built from this composition's
+   * transport: it does not exist yet when this function runs.
+   */
+  readonly isMaster?: (() => boolean) | undefined;
+  /**
+   * Which surfaces this machine currently holds, and why.
+   *
+   * The per-surface election establishes this; the group layer only reports it,
+   * in `cluster status` and in /status. Late-bound for the same reason
+   * `isMaster` is. Absent means the group layer reports that the information is
+   * unavailable rather than reporting an empty list as though this machine held
+   * nothing — a distinction an operator diagnosing a silent inbox depends on.
+   */
+  readonly surfaceHoldings?: (() => readonly ClusterSurfaceHolding[]) | undefined;
+}): ClusterGroupComposition {
+  const settings = readClusterSettings(options.configManager);
+  const groupSettings = resolveClusterGroupSettings(
+    (options.configManager as { getCategory?: (name: string) => unknown }).getCategory?.('cluster'),
+  );
+  // Surface-scoped, alongside the election's node identity and this surface's
+  // other durable state.
+  const stateDirectory = options.shellPaths.resolveProjectPath(GOODVIBES_DAEMON_SURFACE_ROOT, 'cluster');
+  const nodeId = resolveNodeIdentity({ stateDirectory, logger }).nodeId;
+
+  const runtime = new ClusterGroupRuntime({
+    settings: groupSettings,
+    transport: new UdpClusterTransport({
+      port: settings.port,
+      multicastGroup: settings.multicastGroup,
+      peers: settings.peers,
+      logger,
+    }),
+    // Narrower than the SecretsManager itself: the group layer gets get/set/
+    // delete on one key and nothing else.
+    secrets: {
+      get: (key) => options.secretsManager.get(key),
+      set: (key, value) => options.secretsManager.set(key, value),
+      delete: (key) => options.secretsManager.delete(key),
+    },
+    stateDirectory,
+    nodeId,
+    nodeDisplayName: defaultNodeDisplayName(nodeId),
+    version: VERSION,
+    clock: createSystemClusterClock(),
+    logger,
+    ...(options.isMaster ? { isMaster: options.isMaster } : {}),
+    ...(options.surfaceHoldings ? { surfaceHoldings: options.surfaceHoldings } : {}),
+    // Only daemon-owned, group-scoped keys ever reach this; the SDK's
+    // replication policy decides which, and refuses anything machine-specific.
+    config: {
+      get: (path) => (options.configManager as unknown as {
+        get(key: string): unknown;
+      }).get(path),
+      set: (path, value) => (options.configManager as unknown as {
+        set(key: string, value: unknown): void;
+      }).set(path, value),
+    },
+  });
+
+  const context: GroupOperationsContext = {
+    runtime,
+    secrets: {
+      get: (key) => options.secretsManager.get(key),
+      set: (key, value) => options.secretsManager.set(key, value),
+      delete: (key) => options.secretsManager.delete(key),
+    },
+    settings: groupSettings,
+    nodeId,
+    nodeDisplayName: defaultNodeDisplayName(nodeId),
+    version: VERSION,
+    now: () => Date.now(),
+  };
+
+  let started = false;
+  return {
+    runtime,
+    verbs: createClusterGroupVerbs(context),
+    electionTransport: runtime.electionTransport(),
+    start: async () => {
+      if (started) return;
+      started = true;
+      await runtime.start();
+      await announceReturn(runtime, context, nodeId);
+    },
+    stop: async () => {
+      started = false;
+      await runtime.stop();
+    },
+  };
+}
+
+/**
+ * Build both halves of the LAN cluster, wired to each other.
+ *
+ * They are mutually dependent and the dependency runs both ways, which is why
+ * this exists rather than two calls at the composition root: the election
+ * coordinates over the GROUP's transport, and the group's config replication
+ * needs the ELECTION's answer to "am I the master". The master signal is read
+ * through a closure because the coordinator does not exist yet when the group
+ * layer is constructed.
+ *
+ * Constructing either is inert — no socket, no key material read — until
+ * `startCluster` runs.
+ */
+export function createClusterServices(options: {
+  readonly configManager: ConfigManager;
+  readonly shellPaths: ShellPathService;
+  readonly secretsManager: SecretsManager;
+}): { readonly clusterGroup: ClusterGroupComposition; readonly clusterCoordinator: ClusterCoordinator } {
+  let coordinator: ClusterCoordinator | null = null;
+  const clusterGroup = createClusterGroupComposition({
+    ...options,
+    isMaster: () => coordinator?.isMaster ?? false,
+    // The elections actually running are the only honest source for this, so
+    // the group layer reads them rather than keeping a second tally that could
+    // disagree. Before the coordinator exists there is nothing to report, and
+    // an empty list is the truthful answer at that point: no election has been
+    // held, so this machine holds nothing.
+    surfaceHoldings: () => coordinator?.surfaceHoldings() ?? [],
+  });
+  coordinator = createClusterComposition({
+    configManager: options.configManager,
+    shellPaths: options.shellPaths,
+    transport: clusterGroup.electionTransport,
+  });
+  return { clusterGroup, clusterCoordinator: coordinator };
+}
+
+/**
+ * Start the LAN cluster, in the order it has to be started in.
+ *
+ * The group layer FIRST: it owns the socket the leader election coordinates
+ * over, and starting the election against a transport whose group is not yet
+ * loaded would sign its first datagrams with nothing. Both calls are
+ * idempotent, so a composition root that reaches this twice is fine.
+ */
+export async function startClusterServices(services: {
+  readonly clusterGroup: Pick<ClusterGroupComposition, 'start'>;
+  readonly clusterCoordinator: { start(): Promise<void> };
+}): Promise<void> {
+  await services.clusterGroup.start();
+  await services.clusterCoordinator.start();
+}
+
+/**
+ * Ask the group to take this machine back, on start.
+ *
+ * This is the zero-touch return. A machine that has been switched off for
+ * months — through many group-key rotations and possibly a join-key change —
+ * comes up holding stale keys, says "it is still me" with a key that never
+ * rotates, and is re-keyed to the current generation by whichever member
+ * answers. The operator does nothing.
+ *
+ * It runs only when this machine still believes it is on the roster. A machine
+ * that was REMOVED asks for nothing: it would be refused, and asking anyway
+ * would put a pointless refusal in everyone's logs every time it started.
+ */
+async function announceReturn(
+  runtime: ClusterGroupRuntime,
+  context: GroupOperationsContext,
+  nodeId: string,
+): Promise<void> {
+  if (runtime.membership !== 'member') return;
+  if (!stillOnRoster(runtime.groupState, nodeId)) return;
+  const result = await rejoinGroup(context);
+  if (result.ok) {
+    logger.info('cluster: rejoined the group and took the current group key', {
+      group: result.data.groupName,
+      members: result.data.memberCount,
+    });
+    return;
+  }
+  if (result.terminal) {
+    // A member refused this machine and proved it was a member when it did.
+    // Retrying will never succeed, so this is not a quiet debug line: without
+    // it the operator sees a healthy daemon that is simply never given any
+    // work, with nothing anywhere saying why. Stated at ERROR with the command
+    // that fixes it, the same standard a surface this node cannot serve is
+    // held to.
+    logger.error('cluster: this machine is no longer in its group and will not be given work', {
+      reason: result.error,
+      action: result.fix,
+    });
+    return;
+  }
+  if (result.failure === 'unverifiable-replies') {
+    // Something answered and none of it could be authenticated. This machine
+    // cannot tell a removal it slept through from a stranger making noise, so
+    // it says exactly that and does not assert either. WARN rather than ERROR
+    // for the same reason: anything on the network can produce this, and a
+    // machine that shouted "you were removed" on cue would be worse than one
+    // that stayed quiet.
+    logger.warn('cluster: replies to this machine\'s return could not be authenticated', {
+      reason: result.error,
+      action: result.fix,
+    });
+    return;
+  }
+  // Not an error. A machine that starts first, or is alone on the network, has
+  // nobody to answer it and carries on with the keys it already holds.
+  logger.debug('cluster: no other machine answered the return announcement', { reason: result.error });
+}

package/src/runtime/conversation-rewind-port.ts

@@ -0,0 +1,171 @@
+// ---------------------------------------------------------------------------
+// conversation-rewind-port.ts — the daemon's RewindConversationPort for the
+// SDK's unified rewind service.
+//
+// The SDK's UnifiedRewindService (platform/rewind) joins files rewind (workspace
+// checkpoints) with conversation rewind through two ports. The conversation port
+// is "a daemon-hosted mutable conversation store": preview() reports how many
+// messages would truncate to a recorded turn boundary, and rewind() performs the
+// truncation and captures the pre-/post-truncation snapshots so the reversal can
+// be undone and re-applied. The truncation boundary is the message count recorded
+// for the anchor's turnId at TURN_COMPLETED (the SDK's platform/rewind turn
+// anchors) — the same
+// join key files rewind uses against the workspace checkpoint.
+//
+// This module is the daemon's implementation of that port, for sessions THIS
+// process holds the conversation for. It resolves the live conversation per
+// anchor.sessionId from the registry below.
+//
+// While conversation loops run in the surfaces, that registry is empty here, and
+// it used to answer an empty resolution with "0 messages to drop" — the same
+// answer a conversation already at the anchor gives, which is a confident wrong
+// answer rather than a missing one. It now reports the anchor as UNAVAILABLE
+// with the reason, which the SDK's rewind service turns into a plan warning.
+//
+// The surfaces reach conversation rewind a different way now: they offer their
+// live conversation over the control plane (rewind.conversation.*), and the
+// SDK's host broker asks them directly. This port is the fallback the broker
+// falls through to for sessions no surface has offered — which is exactly the
+// case where the daemon hosts the conversation itself. Files-scope rewind,
+// entirely daemon-owned, was never affected either way.
+//
+// The port is written against a structural conversation shape rather than any
+// one surface's conversation class, so nothing about it is terminal-specific.
+// ---------------------------------------------------------------------------
+
+import type {
+  RewindAnchor,
+  RewindConversationOutcome,
+  RewindConversationPort,
+  RewindConversationPreview,
+} from '@pellux/goodvibes-sdk/platform/rewind';
+import { resolveTurnAnchor } from '@pellux/goodvibes-sdk/platform/rewind';
+
+/** Whatever a conversation is serialized as by the process that owns it. */
+type ConversationJson = unknown;
+
+/**
+ * The five operations a rewind needs from a conversation. Any host that can
+ * count its messages, serialize them, truncate to a boundary and reload a
+ * snapshot satisfies this.
+ */
+export interface RewindableConversation {
+  getMessageCount(): number;
+  toJSON(): ConversationJson;
+  fromJSON(json: ConversationJson): void;
+  rebuildHistory(): void;
+  removeMessagesAfter(count: number): void;
+}
+
+/** The port plus the reversal accessors an undo/redo surface needs. */
+export interface ConversationRewindPort extends RewindConversationPort {
+  /** Restore the pre-truncation conversation (the /undo direction). */
+  restoreBefore(undoSnapshotId: string): boolean;
+  /** Restore the post-truncation conversation (the /redo direction). */
+  restoreAfter(undoSnapshotId: string): boolean;
+}
+
+/** One truncation's captured state — the target conversation and its snapshots. */
+interface SnapshotPair {
+  readonly conv: RewindableConversation;
+  readonly before: ConversationJson;
+  readonly after: ConversationJson;
+}
+
+/** What this port says when it holds no conversation for the session asked about. */
+const NO_LIVE_CONVERSATION =
+  'this daemon holds no live conversation for that session, so it cannot count or drop its messages';
+
+/**
+ * Build a conversation rewind port. `resolveConversation` maps an anchor's
+ * sessionId to the live conversation: the daemon looks the session up in the
+ * registry below. A null resolution is reported as unavailable with the reason
+ * — never as a count, because "nobody here is holding those messages" and
+ * "there are no messages to drop" are different facts and only one of them is
+ * true.
+ */
+export function createConversationRewindPort(
+  resolveConversation: (sessionId: string) => RewindableConversation | null,
+): ConversationRewindPort {
+  const snapshots = new Map<string, SnapshotPair>();
+
+  function keepFor(anchor: RewindAnchor): { conv: RewindableConversation | null; keep: number; total: number } {
+    const conv = resolveConversation(anchor.sessionId);
+    if (!conv) return { conv: null, keep: 0, total: 0 };
+    const total = conv.getMessageCount();
+    const rec = anchor.turnId ? resolveTurnAnchor(anchor.sessionId, anchor.turnId) : null;
+    const keep = rec ? Math.min(rec.messageCount, total) : total;
+    return { conv, keep, total };
+  }
+
+  function restore(snapshot: SnapshotPair | undefined, which: 'before' | 'after'): boolean {
+    if (!snapshot) return false;
+    snapshot.conv.fromJSON(snapshot[which]);
+    snapshot.conv.rebuildHistory();
+    return true;
+  }
+
+  return {
+    async preview(anchor: RewindAnchor): Promise<RewindConversationPreview> {
+      const { conv, keep, total } = keepFor(anchor);
+      if (!conv) {
+        return { messagesToDrop: 0, messagesRemaining: 0, available: false, unavailableReason: NO_LIVE_CONVERSATION };
+      }
+      return { messagesToDrop: Math.max(0, total - keep), messagesRemaining: keep };
+    },
+
+    async rewind(anchor: RewindAnchor): Promise<RewindConversationOutcome> {
+      const { conv, keep, total } = keepFor(anchor);
+      const undoSnapshotId = `rwc_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+      if (!conv) {
+        return { droppedMessages: 0, undoSnapshotId: '', available: false, unavailableReason: NO_LIVE_CONVERSATION };
+      }
+      const before = conv.toJSON();
+      conv.removeMessagesAfter(keep);
+      conv.rebuildHistory();
+      const after = conv.toJSON();
+      snapshots.set(undoSnapshotId, { conv, before, after });
+      return { droppedMessages: Math.max(0, total - keep), undoSnapshotId };
+    },
+
+    restoreBefore(undoSnapshotId: string): boolean {
+      return restore(snapshots.get(undoSnapshotId), 'before');
+    },
+
+    restoreAfter(undoSnapshotId: string): boolean {
+      return restore(snapshots.get(undoSnapshotId), 'after');
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Live per-session conversation registry — the daemon-hosted mutable store the
+// composed daemon's rewind.plan/apply verbs fall back to. A process INSIDE this
+// daemon that runs a conversation registers it here; a surface in another
+// process offers its conversation over the control plane instead
+// (rewind.conversation.host.register), and that offer is consulted first.
+// A session in neither reports conversation rewind as unavailable, with the
+// reason, rather than as a count.
+// ---------------------------------------------------------------------------
+
+const liveConversations = new Map<string, RewindableConversation>();
+
+/** Register a session's live conversation so the daemon rewind verbs can serve it. */
+export function registerSessionConversation(sessionId: string, conversation: RewindableConversation): void {
+  if (sessionId) liveConversations.set(sessionId, conversation);
+}
+
+/** Drop a session's conversation registration. */
+export function unregisterSessionConversation(sessionId: string): void {
+  liveConversations.delete(sessionId);
+}
+
+/**
+ * The conversation rewind port the composed daemon threads into
+ * registerGatewayVerbGroups — it resolves each anchor's live conversation from
+ * the registry above, so the daemon's own rewind verbs serve conversation scope
+ * live in this process.
+ */
+export function createSessionConversationRewindPort(): ConversationRewindPort {
+  return createConversationRewindPort((sessionId) => liveConversations.get(sessionId) ?? null);
+}

package/src/runtime/credential-composition.ts

@@ -0,0 +1,54 @@
+/**
+ * credential-composition.ts
+ *
+ * The credential and identity seam: the secret store, the step-up ceremony
+ * service that verifies against it, and the per-device pairing tokens.
+ *
+ * These are grouped because they share one fact, and it is the fact this round
+ * had to fix: WHERE the daemon's own credentials live. `daemonHome` is threaded
+ * rather than defaulted, because without it a daemon told to run out of a temp
+ * tree moved its identity directory and nothing else — the credential store
+ * stayed in the real home, so an "isolated" test daemon held live credentials
+ * and long-polled a real account. A default here would silently restore that.
+ *
+ * Extracted from services.ts because that file sits at the 800-line
+ * architecture cap. Moving a coherent seam out is what the cap is for; trimming
+ * unrelated comments to buy headroom is the thing it exists to prevent.
+ */
+
+import { SecretsManager } from '../config/secrets.ts';
+import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+
+interface CredentialCompositionInput {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /**
+   * The daemon's state root when the host was told one. Absent means "not
+   * overridden" and must stay absent rather than being defaulted — see above.
+   */
+  readonly daemonHomeDirectory?: string | undefined;
+  readonly configManager: ConstructorParameters<typeof SecretsManager>[0]['configManager'];
+  readonly pairingTokenPath: string;
+}
+
+export function composeCredentialServices(input: CredentialCompositionInput): {
+  readonly secretsManager: SecretsManager;
+  readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager;
+} {
+  const secretsManager = new SecretsManager({
+    projectRoot: input.workingDirectory,
+    globalHome: input.homeDirectory,
+    // Threaded, not defaulted: else an isolated daemon reads the real store.
+    ...(input.daemonHomeDirectory === undefined ? {} : { daemonHome: input.daemonHomeDirectory }),
+    configManager: input.configManager,
+  });
+  return {
+    secretsManager,
+    // Shared between the ceremony gateway verbs and the relay gate's verifier,
+    // so both check a step-up against the same store.
+    stepUpService: new StepUpService({ secrets: secretsManager }),
+    pairingTokens: new PairingTokenManager(input.pairingTokenPath),
+  };
+}

package/src/runtime/daemon-handler-composition.ts

@@ -0,0 +1,76 @@
+/**
+ * daemon-handler-composition.ts — the daemon's HOST-side handler surfaces.
+ *
+ * Attaches this repository's handlers to the SDK-auto-registered builtin
+ * gateway descriptors (channels.* / email.* / calendar.*) via
+ * catalog.register(descriptor, handler, { replace: true }) — the SDK owns
+ * every id, descriptor and schema; only the behaviour is ours. The remote
+ * surface reuses the SAME DistributedRuntimeManager the SDK facade injects.
+ *
+ * Split out of services.ts for the 800-line file cap, the same reason
+ * the SDK's channel composition exists.
+ *
+ * The one behavioural decision that lives here: the inbox poller is handed to
+ * the cluster coordinator instead of being started eagerly. It is this
+ * product's own inbound consumer — the SDK facade does not know it exists —
+ * so if it is not gated here it is not gated anywhere, and two goodvibes nodes
+ * on one network each read the shared inbox and answer the same message twice.
+ */
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { SecretsManager } from '@pellux/goodvibes-sdk/platform/config';
+import { registerDaemonHandlers, type DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
+import type { HandlerContext, HandlerLogger } from '../daemon/handlers/context.ts';
+import { createDaemonCredentialStore } from '../daemon/handlers/credentials.ts';
+import { registerRouting } from '../daemon/handlers/routing/index.ts';
+import { registerInboxMethods } from '../daemon/handlers/inbox/index.ts';
+import { registerTriagedInbox } from '../daemon/handlers/triage/index.ts';
+import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
+import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
+import { inboxPollerGate } from './cluster-composition.ts';
+
+export interface DaemonHandlerCompositionOptions {
+  readonly gatewayMethods: GatewayMethodCatalog;
+  readonly secretsManager: SecretsManager;
+  readonly configManager: ConfigManager;
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  readonly distributedRuntime: NonNullable<Parameters<typeof registerRemoteSurface>[1]>['manager'];
+  /**
+   * Decides whether THIS node polls the shared inbox. Always supplied by the
+   * composition root; the poller is never started outside it.
+   */
+  readonly clusterCoordinator: ClusterCoordinator;
+}
+
+export function createDaemonHandlerComposition(
+  options: DaemonHandlerCompositionOptions,
+): DaemonHandlerSurfaces {
+  const handlerLogger: HandlerLogger = {
+    info: (message, meta) => console.info(message, meta ?? ''),
+    warn: (message, meta) => console.warn(message, meta ?? ''),
+    error: (message, meta) => console.error(message, meta ?? ''),
+  };
+  const handlerContext: HandlerContext = {
+    catalog: options.gatewayMethods,
+    credentials: createDaemonCredentialStore(options.secretsManager),
+    configManager: options.configManager,
+    workingDirectory: options.workingDirectory,
+    homeDirectory: options.homeDirectory,
+    logger: handlerLogger,
+  };
+  return registerDaemonHandlers(handlerContext, {
+    registerRouting,
+    registerInbox: (ctx, routing) =>
+      registerTriagedInbox(ctx, (inboxCtx) => registerInboxMethods(inboxCtx, routing, {
+        // Hands polling to leadership. The `channels.inbox.list` read stays
+        // available on every node — a standby still SERVES the persisted feed,
+        // it just does not FETCH into it.
+        gatePolling: (providerId, control) =>
+          options.clusterCoordinator.register(inboxPollerGate(providerId, control)),
+      })).unregister,
+    registerDrafts: (ctx) => registerDraftMethods(ctx),
+    registerRemote: (ctx) => registerRemoteSurface(ctx, { manager: options.distributedRuntime }),
+  });
+}