@pellux/goodvibes-daemon 1.28.19 → 1.28.21

package/src/daemon/service-commands.ts

@@ -1,5 +1,5 @@
 /**
- * Service-lifecycle subcommands — `goodvibes-daemon install-service |
+ * Service-lifecycle subcommands, `goodvibes-daemon install-service |
  * uninstall-service | service-status`.
  *
  * The daemon is a SYSTEM SERVICE. These subcommands install it as a durable host
@@ -9,8 +9,8 @@
  *
  * Drift note: the SDK's older `systemd-user-service.ts` (a Linux-only,
  * bespoke systemd shim) was dead code and got deleted from the SDK. The SDK's
- * REAL wired service machinery — reached in production by the daemon's own HTTP
- * `/api/service/*` routes via facade-composition.ts — is
+ * REAL wired service machinery, reached in production by the daemon's own HTTP
+ * `/api/service/*` routes via facade-composition.ts, is
  * `PlatformServiceManager` (`@pellux/goodvibes-sdk/platform/daemon`): a single
  * systemd/launchd/windows-aware manager with install/uninstall/status/start/
  * stop/restart and a `suggestedCommands` hint list. This module now rewires the
@@ -38,16 +38,16 @@
  *     honestly queries systemd via the injected actionRunner) BEFORE the
  *     legacy unit is stopped, disabled, or removed. A failed or unhealthy new
  *     unit rolls itself back (uninstalled) and never touches the legacy one
- *     — a botched takeover must never cost the user their working daemon.
+ *    , a botched takeover must never cost the user their working daemon.
  *   - ADOPT-OR-WARN, NEVER KILL. If the legacy unit file is simply absent but
  *     something is already listening on the configured host:port (Mike's real
  *     dev-host case: a manual `nohup`'d daemon with no unit at all), this is
- *     an unidentified process, not a managed unit — there is nothing to stop
+ *     an unidentified process, not a managed unit, there is nothing to stop
  *     or disable, and this module will not attempt to kill it. It warns and
  *     leaves the decision to the operator.
  *   - Every action (legacy stop/disable, unit-file removal, daemon-reload)
  *     goes through the SAME injectable `actionRunner`/`legacyUnitFileRemove`
- *     seams tests already use — this module never has a code path that bypasses
+ *     seams tests already use, this module never has a code path that bypasses
  *     them, so the migration is exercised deterministically via fakes and never
  *     touches a real running service in tests.
  */
@@ -67,7 +67,7 @@ import {
   type ManagedServiceActionRunner,
 } from '../runtime/legacy-daemon-migration.ts';
 
-// `resolveInstalledDaemonBinary` lives in the runtime module — re-exported
+// `resolveInstalledDaemonBinary` lives in the runtime module, re-exported
 // here so this module stays the CLI's stable public surface (and so existing
 // test imports keep working).
 export {
@@ -83,7 +83,7 @@ export type { ManagedServiceActionRunner } from '../runtime/legacy-daemon-migrat
 // literal name `goodvibes-daemon.service`. This module (rewired onto
 // PlatformServiceManager, see the file banner above) manages a DIFFERENT
 // unit name (`goodvibes`, SERVICE_NAME). A host that still has the legacy
-// unit installed — this dev machine included — would otherwise see
+// unit installed, this dev machine included, would otherwise see
 // service-status honestly report installed:false/running:false for the
 // tracked name while the legacy unit keeps running untouched underneath it,
 // uninstall-service would silently leave the legacy unit orphaned with no
@@ -94,13 +94,13 @@ export type { ManagedServiceActionRunner } from '../runtime/legacy-daemon-migrat
 // migration engine (`runLegacyDaemonMigration`) both live in
 // `../runtime/legacy-daemon-migration.ts` rather than here, because this
 // daemon's own boot-time reconcile (`../runtime/legacy-daemon-reconcile.ts`)
-// needs them too — the entrypoint-agnostic `runtime` layer is what both of
+// needs them too, the entrypoint-agnostic `runtime` layer is what both of
 // this repository's consumers can import, so this CLI module is just one of
 // them. The terminal app's own onboarding guided UX solves the same problem
 // independently, under its own architecture constraints.
 //
 // This detection is entirely independent of PlatformServiceManager's own
-// status() — it does not rely on (or get invalidated by) the parallel SDK
+// status(), it does not rely on (or get invalidated by) the parallel SDK
 // fix that makes status().running itself query systemd honestly for the
 // TRACKED unit name.
 // ---------------------------------------------------------------------------
@@ -125,7 +125,7 @@ export function isDaemonServiceSubcommand(value: string | undefined): value is D
  * Exit codes `service-status` reports, so a script never parses prose.
  *
  * 0/3/4 are the three answers the question actually has; 1 stays what it has
- * always been — the platform refused the query and the error is printed.
+ * always been, the platform refused the query and the error is printed.
  */
 export const SERVICE_STATUS_EXIT_RUNNING = 0;
 export const SERVICE_STATUS_EXIT_INSTALLED_NOT_RUNNING = 3;
@@ -134,10 +134,10 @@ export const SERVICE_STATUS_EXIT_NOT_INSTALLED = 4;
 export interface DaemonServiceCliInput {
   readonly subcommand: DaemonServiceSubcommand;
   readonly binaryPath: string;
-  /** The GoodVibes tree home (GOODVIBES_HOME-overridable) — config/state root only, never unit-path resolution. See `unitHomeDir`. */
+  /** The GoodVibes tree home (GOODVIBES_HOME-overridable), config/state root only, never unit-path resolution. See `unitHomeDir`. */
   readonly homeDir: string;
   /**
-   * The LOGIN user's home — where the systemd/launchd/Windows unit actually
+   * The LOGIN user's home, where the systemd/launchd/Windows unit actually
    * lives, regardless of any GOODVIBES_HOME/GOODVIBES_DAEMON_HOME override.
    * Required (no default to `homeDir`) so a unit-management subcommand can
    * never silently search for its unit under a relocated tree home instead of
@@ -148,14 +148,14 @@ export interface DaemonServiceCliInput {
   readonly port: number;
   /**
    * Whether the invoking CLI line carried an explicit `--hostname`/`--port`
-   * flag (not merely whether `host`/`port` above are set — those are always
+   * flag (not merely whether `host`/`port` above are set, those are always
    * set, resolved from config either way). `install-service`/`migrate-service`
-   * refuse when either is true — see `validateServiceEndpointFlags`. Defaults
+   * refuse when either is true, see `validateServiceEndpointFlags`. Defaults
    * to false (no flag), matching every subcommand these two don't apply to.
    */
   readonly hostnameFlagProvided?: boolean | undefined;
   readonly portFlagProvided?: boolean | undefined;
-  /** Defaults to `homeDir` — overridable so tests can scope both to one tempdir. */
+  /** Defaults to `homeDir`, overridable so tests can scope both to one tempdir. */
   readonly workingDirectory?: string | undefined;
   /** Injected in tests; a real `ConfigManager` rooted at `homeDir` otherwise. */
   readonly configManager?: ConfigManager | undefined;
@@ -166,7 +166,7 @@ export interface DaemonServiceCliInput {
   /**
    * `migrate-service` only: explicit consent to actually execute the
    * migration (wired from the CLI's `-y`/`--yes` flag). Without it, the
-   * subcommand prints the exact plan and changes nothing — never auto-migrate.
+   * subcommand prints the exact plan and changes nothing, never auto-migrate.
    */
   readonly confirmMigration?: boolean | undefined;
   /**
@@ -183,7 +183,7 @@ export interface DaemonServiceCliInput {
   readonly legacyUnitFileRemove?: ((path: string) => void) | undefined;
   /**
    * `service-status` only: report one JSON document instead of prose. The exit
-   * code is the same either way — the codes are the machine-readable answer,
+   * code is the same either way, the codes are the machine-readable answer,
    * and JSON is for when a script wants the fields as well.
    */
   readonly json?: boolean | undefined;
@@ -200,7 +200,7 @@ export interface DaemonServiceCliResult {
 /**
  * The manager's definition (`ExecStart` command/args, name, description) is
  * built once, in `../runtime/legacy-daemon-migration.ts`, and shared with the
- * onboarding guided UX — see that module's doc comment for why.
+ * onboarding guided UX, see that module's doc comment for why.
  */
 function buildManager(input: DaemonServiceCliInput): PlatformServiceManager {
   return buildManagedDaemonServiceManager({
@@ -225,12 +225,12 @@ function statusLines(status: ManagedServiceStatus): string[] {
   if (status.pid !== undefined) lines.push(`pid: ${status.pid}`);
   if (status.platform !== 'manual' && status.installed && !status.running) {
     // W3 Finding 4: this used to assert "'running' here only reflects
-    // processes this tool started directly" — true for the pid-file-only
+    // processes this tool started directly", true for the pid-file-only
     // check the (currently linked) SDK still uses, but the parallel SDK
     // batch is making status().running query systemd honestly via
     // `is-active`, which would make that specific claim stale. Drop the
     // claim about HOW running was computed and just offer the escape
-    // hatch — true and useful under either SDK version.
+    // hatch, true and useful under either SDK version.
     lines.push(
       `note: if this looks wrong, verify directly: ${status.suggestedCommands[status.suggestedCommands.length - 1] ?? 'the platform service-status command'}`,
     );
@@ -264,7 +264,7 @@ export function buildInstallResultLines(status: ManagedServiceStatus): string[]
  * Every line names the RESOLVED unit (`status.serviceName`, `status.path`) and
  * says what the platform reported afterwards, rather than asserting the verb
  * worked because it was dispatched without throwing. A verb aimed at a service
- * that is not installed says exactly that — installing it silently would be a
+ * that is not installed says exactly that, installing it silently would be a
  * different command than the one that was run.
  */
 export function buildLifecycleResultLines(
@@ -364,7 +364,7 @@ function ok(action: 'install' | 'uninstall' | 'status', status: ManagedServiceSt
     lines.push(`removed the ${status.platform} service at ${status.path}`);
     if (status.platform === 'systemd') {
       lines.push(
-        "note: this removes the unit file but does not run `disable` — run " +
+        "note: this removes the unit file but does not run `disable`; run " +
           "`systemctl --user daemon-reload` to clear any stale enablement symlink.",
       );
     }
@@ -388,12 +388,12 @@ function failed(action: 'install' | 'uninstall' | 'status', status: ManagedServi
  * `install-service` and `migrate-service` refuse an explicit
  * `--hostname`/`--port` flag rather than silently accepting it. Both flags are
  * RUNTIME-ONLY overrides applied to this one invocation's in-memory config
- * (`applyRuntimeEndpointFlagOverrides` in `src/daemon/cli.ts`) — but the unit
+ * (`applyRuntimeEndpointFlagOverrides` in `src/daemon/cli.ts`), but the unit
  * this subcommand writes carries no endpoint flags at all (see
  * `buildManagedDaemonServiceManager`'s ExecStart doc): the daemon always
  * re-resolves `controlPlane.host`/`port`/`hostMode` from PERSISTED settings at
  * boot. A flag accepted here would print/probe a binding the installed unit
- * will never actually have — an honest gap, not a cosmetic one, since the
+ * will never actually have, an honest gap, not a cosmetic one, since the
  * printed value is exactly what an operator would expect the running service
  * to bind to. Refusing with a pointer to the persistent config path is
  * strictly better than silently doing nothing with the flag.
@@ -408,7 +408,7 @@ export function validateServiceEndpointFlags(
     .filter((name): name is string => name !== null)
     .join('/');
   return [
-    `${subcommand} refused: ${flagNames} only override this process's runtime config — the installed unit carries ` +
+    `${subcommand} refused: ${flagNames} only override this process's runtime config; the installed unit carries ` +
       'no endpoint flags and re-resolves controlPlane.host/port/hostMode from persisted settings at boot, so the ' +
       'override would never take effect there.',
     `Set the persistent binding instead: goodvibes-daemon config set controlPlane.host / controlPlane.port (or ` +
@@ -419,7 +419,7 @@ export function validateServiceEndpointFlags(
 /**
  * `migrate-service`: the guided, consented takeover of the legacy
  * `goodvibes-daemon.service` unit. Thin wrapper over
- * `runLegacyDaemonMigration` (`../runtime/legacy-daemon-migration.ts`) — see
+ * `runLegacyDaemonMigration` (`../runtime/legacy-daemon-migration.ts`), see
  * that module for the design constraints (never auto-migrate,
  * new-up-then-old-down, adopt-or-warn/never kill an unrecognized process,
  * every action through an injectable seam) and the onboarding UX consumer.
@@ -461,7 +461,7 @@ export async function runDaemonServiceCli(input: DaemonServiceCliInput): Promise
     case 'install-service': {
       // W3 Finding 4: refuse rather than risk starting a second daemon
       // alongside an already-installed legacy unit. Refuses whenever the
-      // legacy unit is present at all (not just when currently active) —
+      // legacy unit is present at all (not just when currently active),
       // an installed-but-inactive legacy unit can still be enabled and
       // start competing for the same port later, and "never silently
       // start a second daemon" is the bar here, not "never right now."
@@ -483,7 +483,7 @@ export async function runDaemonServiceCli(input: DaemonServiceCliInput): Promise
       if (installed.actionError) return failed('install', installed);
       const started = manager.start();
       // start()'s actionError (e.g. a platform this manager can't dispatch
-      // actions for) doesn't undo the write — report install as ok, but surface
+      // actions for) doesn't undo the write, report install as ok, but surface
       // the follow-up problem honestly instead of claiming it is running.
       return started.actionError
         ? ok('install', { ...started, running: false }, [`could not start it automatically: ${started.actionError}`])
@@ -496,7 +496,7 @@ export async function runDaemonServiceCli(input: DaemonServiceCliInput): Promise
       const extra: string[] = [];
       if (stopped.actionError) extra.push(`(it may not have been running: ${stopped.actionError})`);
       // This command only ever touches the TRACKED unit (whatever name/path
-      // actually resolved — not necessarily the SERVICE_NAME constant) above —
+      // actually resolved, not necessarily the SERVICE_NAME constant) above,
       // say so explicitly when an install-script unit also exists, so its
       // continued presence is never a silent surprise.
       if (legacy.present) extra.push(legacyUnitNote(legacy, resolveManagedUnitName(uninstalled)));
@@ -520,8 +520,8 @@ export async function runDaemonServiceCli(input: DaemonServiceCliInput): Promise
         };
       }
       const result = ok('status', status, legacy.present ? [legacyUnitNote(legacy, resolveManagedUnitName(status))] : []);
-      // The status verb reports; it does not fail. `ok` is still true — the
-      // question was answered — while the exit code carries the answer itself
+      // The status verb reports; it does not fail. `ok` is still true, the
+      // question was answered, while the exit code carries the answer itself
       // (0 running / 3 installed-not-running / 4 not installed), so a script
       // never has to read the prose above.
       return { ...result, exitCode: serviceStatusExitCode(status) };

package/src/daemon/sessions-command.ts

@@ -1,14 +1,14 @@
 /**
- * sessions-command.ts — `goodvibes-daemon sessions list|kill <id>`.
+ * sessions-command.ts, `goodvibes-daemon sessions list|kill <id>`.
  *
  * The sessions this daemon HOSTS: conversation loops running inside it, which
  * outlive the client that started them. That is the whole reason they need a
- * command — a terminal's own session dies with the terminal and never needs
+ * command, a terminal's own session dies with the terminal and never needs
  * listing from outside, while a hosted one can be running on a headless box
  * with nothing attached to it at all.
  *
  * The verbs are `sessions.hosted.list` and `sessions.hosted.kill`, and both are
- * declared ws-only in the method catalog — they have no REST binding, so they
+ * declared ws-only in the method catalog, they have no REST binding, so they
  * go through `callDaemonWsVerb` rather than `callDaemonVerb`. Same target, same
  * operator token, same --host/--port/--token convention; only the transport is
  * different. A daemon built without hosted sessions answers "does not know the
@@ -62,7 +62,7 @@ export interface SessionsCommandFlags extends RemoteCommandFlags {
 
 export interface RunSessionsCommandInput extends RemoteCommandDeps {
   readonly flags: SessionsCommandFlags;
-  /** Positional words after `sessions` — the subcommand and its argument. */
+  /** Positional words after `sessions`, the subcommand and its argument. */
   readonly args: readonly string[];
 }
 
@@ -119,7 +119,7 @@ function renderSession(session: HostedSessionRecord, now: number): string[] {
  *
  * Exit 0 when the daemon answered, 1 when it refused or could not be reached,
  * 2 when the command line was wrong. A `kill` with no id is a usage refusal
- * rather than a "kill everything" — there is no shape of this command that ends
+ * rather than a "kill everything", there is no shape of this command that ends
  * more than the one session named.
  */
 export async function runSessionsCommand(input: RunSessionsCommandInput): Promise<DaemonCommandResult> {
@@ -129,11 +129,11 @@ export async function runSessionsCommand(input: RunSessionsCommandInput): Promis
     return refusal('name what to do with the sessions.', flags.json);
   }
   if (!isSessionsSubcommand(subcommand)) {
-    return refusal(`'${subcommand}' is not a sessions command — try list or kill.`, flags.json);
+    return refusal(`'${subcommand}' is not a sessions command; try list or kill.`, flags.json);
   }
   const sessionId = args[1];
   if (subcommand === 'kill' && sessionId === undefined) {
-    return refusal('kill needs the session to end — run `sessions list` to see them.', flags.json);
+    return refusal('kill needs the session to end; run `sessions list` to see them.', flags.json);
   }
   if (args.length > (subcommand === 'kill' ? 2 : 1)) {
     return refusal(`'${args[subcommand === 'kill' ? 2 : 1]}' is one argument too many.`, flags.json);

package/src/daemon/status-command.ts

@@ -1,9 +1,9 @@
 /**
- * status-command.ts — `goodvibes-daemon status` and `goodvibes-daemon update`.
+ * status-command.ts, `goodvibes-daemon status` and `goodvibes-daemon update`.
  *
  * The question a headless box's operator asks first: is it up, what version, on
  * what address, is anything unhealthy, and what did it do to itself while I was
- * not looking. Before this, the binary answered none of that — `status` fell
+ * not looking. Before this, the binary answered none of that, `status` fell
  * through the parser and started a SECOND daemon in the foreground.
  *
  * WHERE EACH LINE COMES FROM
@@ -13,11 +13,11 @@
  * established: `/status` for identity, `/api/health` for the health roll-up and
  * the address it actually bound, `/api/channels/status` for the channels, and
  * `/api/cluster/status` for this machine's place in its group. Hosted sessions
- * are a ws-only verb family, so they go through `callDaemonWsVerb` — same
+ * are a ws-only verb family, so they go through `callDaemonWsVerb`, same
  * target, same token, different transport.
  *
- * Everything about the daemon's own HISTORY — uptime, the receipts it wrote,
- * the version an automatic rollback rejected — comes from files on the daemon's
+ * Everything about the daemon's own HISTORY, uptime, the receipts it wrote,
+ * the version an automatic rollback rejected, comes from files on the daemon's
  * host, because no verb reports them. That makes those lines local-only, and
  * they say so for a remote target instead of being guessed at.
  *
@@ -76,8 +76,8 @@ export interface RemoteCommandDeps {
  *
  * It carries a `cluster` block the operator contract does not list, and that
  * block is where this daemon's ROLE in its group comes from. `cluster.uptimeMs`
- * is the coordinator's, not the daemon's — it reads 0 on a daemon that has been
- * up for hours — so the uptime line comes from the lifecycle marker instead.
+ * is the coordinator's, not the daemon's, it reads 0 on a daemon that has been
+ * up for hours, so the uptime line comes from the lifecycle marker instead.
  */
 interface ControlStatusPayload {
   readonly status?: string;
@@ -179,7 +179,7 @@ function optionalLine(label: string, value: string | undefined): string[] {
  *
  * `/status` reports `version` from the platform package while the cluster block
  * it carries reports the DAEMON build's version, and against a live daemon
- * those disagreed — 1.21.0 against 1.28.0. Printing one of them silently would
+ * those disagreed, 1.21.0 against 1.28.0. Printing one of them silently would
  * put a number on this page that is wrong for whichever question the reader had
  * in mind, so both are printed and labelled until the daemon states one.
  */
@@ -210,7 +210,7 @@ function localStateLines(state: LocalDaemonState): string[] {
   }
   if (state.marker?.rejectedVersion !== undefined) {
     lines.push(
-      `  rejected: ${state.marker.rejectedVersion} crash looped and was rolled back — `
+      `  rejected: ${state.marker.rejectedVersion} crash looped and was rolled back; `
       + 'the update loop will not install that version again',
     );
   }
@@ -229,7 +229,7 @@ function localStateLines(state: LocalDaemonState): string[] {
 }
 
 function healthLines(outcome: DaemonVerbOutcome<HealthPayload>): string[] {
-  if (!outcome.ok) return [`  health:   could not read — ${outcome.error}`];
+  if (!outcome.ok) return [`  health:   could not read: ${outcome.error}`];
   const health = outcome.data;
   const lines = [`  health:   ${health.overall ?? 'unknown'}`];
   const binding = health.network?.controlPlane;
@@ -250,12 +250,12 @@ function healthLines(outcome: DaemonVerbOutcome<HealthPayload>): string[] {
  *
  * Only a channel that is switched ON and not healthy is named. Every channel
  * the daemon knows about appears in this payload, and a daemon with one
- * configured channel ships sixteen more in state `disabled` — listing those as
+ * configured channel ships sixteen more in state `disabled`, listing those as
  * problems produced a seventeen-line wall under a healthy daemon and buried the
  * one line that meant something.
  */
 function channelLines(outcome: DaemonVerbOutcome<ChannelsPayload>): string[] {
-  if (!outcome.ok) return [`  channels: could not read — ${outcome.error}`];
+  if (!outcome.ok) return [`  channels: could not read: ${outcome.error}`];
   const channels = outcome.data.channels ?? [];
   if (channels.length === 0) return ['  channels: none configured'];
   const on = channels.filter((channel) => channel.enabled !== false);
@@ -276,7 +276,7 @@ function channelLines(outcome: DaemonVerbOutcome<ChannelsPayload>): string[] {
  * Two sources, because neither answers the whole question: `/status` carries
  * the ROLE this node currently holds, and `/api/cluster/status` carries the
  * GROUP it holds that role in. A daemon with sharing switched off says so and
- * stops — a role inside no group is not information.
+ * stops, a role inside no group is not information.
  */
 function clusterLines(
   identity: ControlStatusPayload,
@@ -284,18 +284,18 @@ function clusterLines(
 ): string[] {
   const role = identity.cluster?.role;
   if (identity.cluster?.enabled === false) {
-    return ['  cluster:  off — this machine handles its own inbound work'];
+    return ['  cluster:  off, this machine handles its own inbound work'];
   }
   if (!outcome.ok) {
     return [
       role === undefined
-        ? `  cluster:  could not read — ${outcome.error}`
-        : `  cluster:  ${role} (the group view could not be read — ${outcome.error})`,
+        ? `  cluster:  could not read: ${outcome.error}`
+        : `  cluster:  ${role} (the group view could not be read: ${outcome.error})`,
     ];
   }
   const cluster = outcome.data;
   if (cluster.membership === 'no-group') {
-    return ['  cluster:  in no group yet — `goodvibes-daemon cluster create` starts one'];
+    return ['  cluster:  in no group yet, `goodvibes-daemon cluster create` starts one'];
   }
   const group = cluster.groupName ?? cluster.groupId ?? 'its group';
   const members = cluster.memberCount === undefined ? '' : ` of ${cluster.memberCount}`;
@@ -303,7 +303,7 @@ function clusterLines(
 }
 
 function hostedSessionLines(outcome: DaemonVerbOutcome<HostedSessionsPayload>): string[] {
-  if (!outcome.ok) return [`  sessions: could not read — ${outcome.error}`];
+  if (!outcome.ok) return [`  sessions: could not read: ${outcome.error}`];
   const sessions = outcome.data.sessions ?? [];
   return [`  sessions: ${sessions.length} hosted by this daemon`];
 }
@@ -317,7 +317,7 @@ export interface RunStatusCommandInput extends RemoteCommandDeps {
  *
  * Exit 0 when the daemon answered its identity call, 1 when it could not be
  * reached. Every other sub-question that fails is one line inside a successful
- * report — a daemon with a broken channel is up, and saying otherwise would be
+ * report, a daemon with a broken channel is up, and saying otherwise would be
  * the kind of wrong that makes an operator distrust the whole page.
  */
 export async function runStatusCommand(input: RunStatusCommandInput): Promise<DaemonCommandResult> {
@@ -407,8 +407,8 @@ export interface RunUpdateCommandInput extends RemoteCommandDeps {
  * rejected, and whether a rollback is in force.
  *
  * --check is honest about a gap. The daemon runs the whole self-update loop
- * itself — it checks hourly, swaps at an idle moment and keeps the outgoing
- * binary — but the control plane publishes NO verb to trigger that check early:
+ * itself, it checks hourly, swaps at an idle moment and keeps the outgoing
+ * binary, but the control plane publishes NO verb to trigger that check early:
  * the operator contract this build was written against has no update method of
  * any kind (no `update.*`, no `admin.update`, nothing under `control.` that
  * checks). Rather than invent a verb this daemon does not answer, --check says
@@ -439,7 +439,7 @@ export async function runUpdateCommand(input: RunUpdateCommandInput): Promise<Da
       '',
       'update --check: this daemon publishes no verb to trigger an update check early.',
       '  It checks once an hour on its own and swaps only at an idle moment.',
-      '  To make it check now, restart it — it checks on the way up:',
+      '  To make it check now, restart it; it checks on the way up:',
       '    goodvibes-daemon restart-service',
     ]
     : [];

package/src/daemon/webui-command.ts

@@ -1,5 +1,5 @@
 // ---------------------------------------------------------------------------
-// webui-command.ts — `goodvibes-daemon webui enable|disable|status`.
+// webui-command.ts, `goodvibes-daemon webui enable|disable|status`.
 //
 // WHAT THIS IS FOR
 //
@@ -8,7 +8,7 @@
 // serve such a directory: with `controlPlane.webui.serve` on, its own HTTP
 // router answers `/` from `controlPlane.webui.bundleDir` and falls back to
 // index.html for app routes. So installing the web UI is two config writes and
-// a directory on disk — and this is the command that makes those writes, so the
+// a directory on disk, and this is the command that makes those writes, so the
 // curl installer does not have to know the key names, the file format, or which
 // of the three settings tiers a daemon-owned key belongs in. Same reason
 // `provision-wake-model` exists: the installer runs the binary it just placed
@@ -17,12 +17,12 @@
 // WHERE IT IS SERVED, AND WHY THE URL SAYS WHAT IT SAYS
 //
 // The bundle is served BY THE CONTROL-PLANE LISTENER, same origin as the API
-// (that is the whole point — a same-origin bundle makes the browser's
+// (that is the whole point, a same-origin bundle makes the browser's
 // same-origin policy a non-issue and needs no CORS allowlist). So the URL that
 // opens the web UI is the control-plane origin: `http://<host>:<controlPlane.port>`,
 // not `web.port`. `web.port` is the surface's DECLARED endpoint, used for links
-// and for `tailscale serve`; nothing binds it. This command therefore reports —
-// and, when it is still sitting on the shipped placeholder, writes —
+// and for `tailscale serve`; nothing binds it. This command therefore reports,
+// and, when it is still sitting on the shipped placeholder, writes,
 // `web.publicBaseUrl` as the origin that actually answers, so the printed URL,
 // the pairing deep link and the running server all agree.
 //
@@ -41,7 +41,7 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { resolveRuntimeEndpointBinding } from '@pellux/goodvibes-terminal-shell';
 import { probeStableHostInputs, stableUrlHostForBindHost, type StableHostInputs } from '@pellux/goodvibes-sdk/platform/pairing';
 
-/** The shipped `web.publicBaseUrl` placeholder — a port nothing binds. */
+/** The shipped `web.publicBaseUrl` placeholder, a port nothing binds. */
 const SHIPPED_PUBLIC_BASE_URL = 'http://127.0.0.1:3423';
 
 export interface WebuiCommandResult {
@@ -175,13 +175,13 @@ function postureLines(origin: string, loopback: boolean): string[] {
     ];
   }
   return [
-    `  reachable from your network at ${origin} — the control-plane listener is bound to all interfaces.`,
+    `  reachable from your network at ${origin}; the control-plane listener is bound to all interfaces.`,
     '  To take it back to this machine only:  goodvibes-daemon webui enable --loopback',
   ];
 }
 
 /**
- * Run the command and report it. Never throws for an ordinary refusal — a bad
+ * Run the command and report it. Never throws for an ordinary refusal, a bad
  * argument, a missing bundle, an unwritable settings file all come back as an
  * exit code and lines, because the caller is often an installer reading both.
  */
@@ -212,14 +212,14 @@ export function runWebuiCommand(argv: readonly string[], deps: WebuiCommandDeps)
     try {
       config.set('controlPlane.webui.serve', false);
     } catch (error) {
-      return { exitCode: 1, lines: [`webui: could not write settings — ${message(error)}`] };
+      return { exitCode: 1, lines: [`webui: could not write settings: ${message(error)}`] };
     }
     const kept = readString(config, 'controlPlane.webui.bundleDir');
     return {
       exitCode: 0,
       lines: [
         'web UI: no longer served by the daemon.',
-        ...(kept ? [`  the bundle is left on disk at ${kept} — 'goodvibes-daemon webui enable' serves it again`] : []),
+        ...(kept ? [`  the bundle is left on disk at ${kept}; 'goodvibes-daemon webui enable' serves it again`] : []),
         '  Restart the daemon for this to take effect on a running process.',
       ],
     };
@@ -242,7 +242,7 @@ export function runWebuiCommand(argv: readonly string[], deps: WebuiCommandDeps)
     return {
       exitCode: 1,
       lines: [
-        `webui: refusing to serve ${bundleDir} — ${problem}.`,
+        `webui: refusing to serve ${bundleDir}: ${problem}.`,
         '  Nothing was changed.',
       ],
     };
@@ -260,7 +260,7 @@ export function runWebuiCommand(argv: readonly string[], deps: WebuiCommandDeps)
       config.set('web.hostMode', 'local');
     }
   } catch (error) {
-    return { exitCode: 1, lines: [`webui: could not write settings — ${message(error)}`] };
+    return { exitCode: 1, lines: [`webui: could not write settings: ${message(error)}`] };
   }
 
   const serving = servingOrigin(config, probe);
@@ -284,7 +284,7 @@ export function runWebuiCommand(argv: readonly string[], deps: WebuiCommandDeps)
   }
 
   if (!serving.recognized) {
-    lines.push('  note: controlPlane.hostMode is not one of local|network|custom — the daemon cannot bind until that is corrected.');
+    lines.push('  note: controlPlane.hostMode is not one of local|network|custom; the daemon cannot bind until that is corrected.');
   }
   lines.push(...postureLines(serving.origin, serving.loopback));
   lines.push('  Restart the daemon for this to take effect on a running process.');
@@ -324,7 +324,7 @@ function renderStatus(
   } else {
     const absoluteDir = deps.absolute(directory);
     const problem = describeBundleProblem(absoluteDir, deps.directoryExists, deps.fileExists);
-    lines.push(problem ? `  bundle (${source}): ${absoluteDir} — UNUSABLE: ${problem}` : `  bundle (${source}): ${absoluteDir}`);
+    lines.push(problem ? `  bundle (${source}): ${absoluteDir} (UNUSABLE: ${problem})` : `  bundle (${source}): ${absoluteDir}`);
   }
   const currentPublic = readString(config, 'web.publicBaseUrl');
   if (currentPublic && currentPublic !== serving.origin) {

package/src/runtime/boot-tasks.ts

@@ -98,7 +98,7 @@ export async function runDaemonBootTasks(services: RuntimeServices): Promise<voi
 
   // Load the plugins this host can serve. The manager was constructed by the
   // graph and never initialised, so it could list a plugin directory and never
-  // load anything out of it — `enable` persisted a flag that turned nothing on.
+  // load anything out of it, `enable` persisted a flag that turned nothing on.
   // Both hosts read the same directories; each takes the registrations it can
   // serve (plugin-composition.ts). Best-effort like everything else here: a
   // plugin that will not load is not a reason for the daemon not to start.

package/src/runtime/browser-checkout-seam-holder.ts

@@ -0,0 +1,55 @@
+/**
+ * browser-checkout-seam-holder.ts, holding a seam that arrives after its
+ * first reader is constructed.
+ *
+ * ── Why a holder, and not a constructor argument ──────────────────────────
+ *
+ * The SDK hands out a `BrowserCheckoutSeam` through `onBrowserCheckout`, a
+ * callback `composeDaemonBrowser` invokes once, synchronously, at the moment
+ * IT composes the browser. In this daemon that composition runs inside
+ * `attachWsOnlyGatewayVerbHandlers` (services.ts), which is called AFTER
+ * `createDaemonHandlerComposition` builds the payments handlers, because the
+ * ws-only verb groups need managers (disposal scope, workspace checkpoint
+ * manager, ...) that do not exist yet at the point payments is composed.
+ * Reordering the two would ripple across every other verb group that call
+ * builds, for one capability's benefit.
+ *
+ * So the payments composition cannot receive the seam as a constructor
+ * argument; it receives a GETTER, closed over this holder, and reads it at
+ * CALL time rather than at registration time. By the time any real invocation
+ * reaches `payments.checkout.begin`, the daemon has finished booting and
+ * `onBrowserCheckout` has already fired (or the composition is one where the
+ * browser was never buildable at all, `composeDaemonBrowser` returned null,
+ * homeDirectory absent, and the getter honestly keeps returning undefined
+ * forever, which the checkout handler already refuses on cleanly).
+ */
+import type { BrowserCheckoutSeam } from '@pellux/goodvibes-sdk/platform/control-plane';
+
+export interface BrowserCheckoutSeamHolder {
+  readonly get: () => BrowserCheckoutSeam | undefined;
+  readonly set: (seam: BrowserCheckoutSeam) => void;
+  /**
+   * Forgets the held seam. Call this from the browser's own disposal path
+   * (services.ts, registered on the SAME disposal scope the browser sessions
+   * teardown runs on), so a daemon that has started shutting its browser down
+   * cannot hand a checkout call a seam whose `driverFor`/`cardFieldGuard` point
+   * at an engine that is being (or has been) torn down. After this, `get()`
+   * returns `undefined` again, and `payments.checkout.begin`/`.fillCard` fall
+   * back to their ordinary "checkout is not available right now" 409 refusal,
+   * see checkout-handlers.ts, rather than reaching into a disposed engine.
+   */
+  readonly clear: () => void;
+}
+
+export function createBrowserCheckoutSeamHolder(): BrowserCheckoutSeamHolder {
+  let seam: BrowserCheckoutSeam | undefined;
+  return {
+    get: () => seam,
+    set: (received) => {
+      seam = received;
+    },
+    clear: () => {
+      seam = undefined;
+    },
+  };
+}