@pellux/goodvibes-daemon 1.28.19 → 1.28.21

package/src/runtime/legacy-daemon-migration.ts

@@ -3,13 +3,13 @@
  * CLI (`src/daemon/service-commands.ts`, the `migrate-service` subcommand)
  * and by this daemon's own boot-time reconcile (`legacy-daemon-reconcile.ts`).
  * The terminal app ships an independent implementation of the same
- * detect/migrate contract for its own onboarding guided UX — not shared
+ * detect/migrate contract for its own onboarding guided UX, not shared
  * code, but the two are meant to agree on what "legacy" means and how a
  * migration is carried out.
  *
  * NAMING, load-bearing: this module's identifiers say "legacy" because the
  * engine migrates AWAY from the `goodvibes-daemon.service` unit name toward
- * the runtime-managed unit — that name was used by an older install script/
+ * the runtime-managed unit, that name was used by an older install script/
  * release (scripts/install.sh now creates `goodvibes.service` and treats
  * `goodvibes-daemon.service` as the retired name it migrates existing hosts
  * away from; see migrate_legacy_installer_unit there). An already-installed
@@ -18,7 +18,7 @@
  * never labels it legacy or implies it should be removed unless the user is
  * explicitly migrating.
  *
- * This lives under `src/runtime/` — not `src/daemon/` — because both
+ * This lives under `src/runtime/`, not `src/daemon/`, because both
  * `src/daemon/service-commands.ts` (the CLI subcommand) and
  * `src/runtime/legacy-daemon-reconcile.ts` (the boot-time reconcile) need it,
  * and `src/runtime/**` is this repository's shared layer both can import.
@@ -37,11 +37,11 @@
  *   - ADOPT-OR-WARN, NEVER KILL. If the legacy unit file is simply absent but
  *     something is already listening on the configured host:port (this dev
  *     host's real case: a manually `nohup`'d daemon with no unit at all),
- *     that is an unidentified process, not a managed unit — nothing to stop
+ *     that is an unidentified process, not a managed unit, nothing to stop
  *     or disable, and this module never attempts to kill it.
  *   - Every action (legacy stop/disable, unit-file removal, daemon-reload)
  *     goes through the injectable `actionRunner`/`legacyUnitFileRemove` seams
- *     tests use — no code path here bypasses them, so the migration is
+ *     tests use, no code path here bypasses them, so the migration is
  *     exercised deterministically via fakes and never touches a real running
  *     service in tests.
  */
@@ -56,7 +56,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { runDaemonConfigMigration } from '../config/run-daemon-config-migration.ts';
 import { GOODVIBES_DAEMON_SURFACE_ROOT } from '../config/surface.ts';
 
-/** Structurally derived from `PlatformServiceManager`'s own constructor — the
+/** Structurally derived from `PlatformServiceManager`'s own constructor, the
  * SDK's public `platform/daemon` entry point only re-exports the class and
  * `ManagedServiceStatus`, not the options/definition/action-runner interfaces
  * by name, so we pull their shapes off the class itself rather than reaching
@@ -66,7 +66,7 @@ type ManagedServiceDefinition = NonNullable<ManagedServiceManagerOptions['defini
 export type ManagedServiceActionRunner = NonNullable<ManagedServiceManagerOptions['actionRunner']>;
 type ManagedServiceActionResult = ReturnType<ManagedServiceActionRunner>;
 
-// The one unit name/description this tool manages — used by the daemon CLI
+// The one unit name/description this tool manages, used by the daemon CLI
 // (`goodvibes-daemon install-service|uninstall-service|service-status|migrate-service`).
 // The terminal app's own onboarding UX builds the exact same service
 // definition independently, so a migration triggered from either surface
@@ -80,7 +80,7 @@ export const MANAGED_SERVICE_DESCRIPTION = 'GoodVibes daemon (shared session bro
 
 /**
  * Follow-up: resolve the unit name the SDK's `PlatformServiceManager`
- * would actually manage, from config alone — for callers that need the
+ * would actually manage, from config alone, for callers that need the
  * honest display name BEFORE any manager/status exists (the onboarding
  * wizard's detection banner resolves this at snapshot-collection time and
  * carries it on `OnboardingLegacyDaemonSnapshot.trackedServiceName`).
@@ -101,17 +101,17 @@ export function resolveConfiguredServiceName(config: { get(key: string): unknown
 export interface BuildManagedDaemonServiceManagerParams {
   readonly binaryPath: string;
   /**
-   * The GoodVibes tree home — GOODVIBES_HOME-overridable, used to root the
+   * The GoodVibes tree home, GOODVIBES_HOME-overridable, used to root the
    * ConfigManager and the daemon's own `--daemon-home` state directory. NEVER
    * used for unit-file path resolution: see `unitHomeDir` for that. A unit
    * path search rooted here would look for `~/.config/systemd/user/` under
    * whatever GOODVIBES_HOME points at instead of the real login home systemd
-   * actually reads — the same class of bug the boot-time reconcile in
+   * actually reads, the same class of bug the boot-time reconcile in
    * `src/daemon/cli.ts` already guards against with the identical split.
    */
   readonly homeDir: string;
   /**
-   * The LOGIN user's home — where `~/.config/systemd/user/` (or the launchd/
+   * The LOGIN user's home, where `~/.config/systemd/user/` (or the launchd/
    * Windows equivalent) actually lives, regardless of any GOODVIBES_HOME/
    * GOODVIBES_DAEMON_HOME override in effect. Threaded through to
    * `PlatformServiceManager`'s own `homeDirectory` option, which resolves the
@@ -122,7 +122,7 @@ export interface BuildManagedDaemonServiceManagerParams {
   readonly unitHomeDir: string;
   readonly host: string;
   readonly port: number;
-  /** Defaults to `homeDir` — overridable so tests can scope both to one tempdir. */
+  /** Defaults to `homeDir`, overridable so tests can scope both to one tempdir. */
   readonly workingDirectory?: string | undefined;
   /** Injected in tests; a real `ConfigManager` rooted at `homeDir` otherwise. */
   readonly configManager?: ConfigManager | undefined;
@@ -131,12 +131,12 @@ export interface BuildManagedDaemonServiceManagerParams {
 }
 
 /**
- * Build the ONE `PlatformServiceManager` this tool manages — the single
+ * Build the ONE `PlatformServiceManager` this tool manages, the single
  * source of truth, in this repository, for the unit's definition
  * (`ExecStart` command/args, name, description). Both
  * `src/daemon/service-commands.ts` (the CLI) and this daemon's own
  * boot-time reconcile call this so every path in this repository installs
- * the identical unit — no risk of consumers drifting apart.
+ * the identical unit, no risk of consumers drifting apart.
  */
 export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServiceManagerParams): PlatformServiceManager {
   const workingDirectory = params.workingDirectory ?? params.homeDir;
@@ -152,7 +152,7 @@ export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServi
   // already configured for hostMode=network / a non-default port) keeps its
   // endpoint without a unit rewrite. Baking endpoint values here is what
   // silently re-pinned custom-configured hosts back to the values current at
-  // install time. scripts/install.sh writes the same shape — the two paths
+  // install time. scripts/install.sh writes the same shape, the two paths
   // must produce the identical running daemon (see the installer parity test).
   // `params.host`/`params.port` remain inputs because the migration engine
   // still needs them for its read-only port-liveness probe.
@@ -161,15 +161,15 @@ export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServi
     description: MANAGED_SERVICE_DESCRIPTION,
     workingDirectory,
     command: params.binaryPath,
-    // `--daemon-home` names the daemon's own STATE directory — the one holding
-    // operator-tokens.json, auth-users.json and daemon-settings.json — which is
+    // `--daemon-home` names the daemon's own STATE directory, the one holding
+    // operator-tokens.json, auth-users.json and daemon-settings.json, which is
     // `<home>/.goodvibes/daemon`. This baked the USER HOME, so a serviced
     // daemon filed its identity a level above where every reader in this
     // repository looks: the SDK's platform/config goodvibes-home resolves the flag AS the state
     // directory, cli/service-posture.ts already writes the state directory into
     // GOODVIBES_DAEMON_HOME for the unit it installs, and runtime/bootstrap.ts
     // reads the companion token from the state directory. On a normal machine
-    // the mismatch is invisible from the outside — the daemon simply mints a
+    // the mismatch is invisible from the outside, the daemon simply mints a
     // second operator-tokens.json in the home directory and the client keeps
     // reading the empty one under .goodvibes/daemon.
     args: ['--daemon-home', join(params.homeDir, '.goodvibes', 'daemon')],
@@ -179,7 +179,7 @@ export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServi
   return new PlatformServiceManager(configManager, {
     workingDirectory,
     // Unit paths resolve from the LOGIN home, never the (possibly
-    // GOODVIBES_HOME-relocated) tree home above — see `unitHomeDir`'s doc.
+    // GOODVIBES_HOME-relocated) tree home above, see `unitHomeDir`'s doc.
     homeDirectory: params.unitHomeDir,
     definitionOverride: definition,
     defaultServiceName: MANAGED_SERVICE_NAME,
@@ -250,7 +250,7 @@ export function legacyUnitPath(homeDir: string): string {
 
 export interface DetectLegacyUnitInput {
   /**
-   * The LOGIN user's home — where the legacy unit file would actually live
+   * The LOGIN user's home, where the legacy unit file would actually live
    * (`~/.config/systemd/user/goodvibes-daemon.service`), never the
    * GOODVIBES_HOME-overridable tree home. See
    * `BuildManagedDaemonServiceManagerParams.unitHomeDir` for the identical
@@ -266,7 +266,7 @@ export interface DetectLegacyUnitInput {
 /**
  * Read-only detection: does a legacy `goodvibes-daemon.service` unit file
  * exist, and if so, is it currently active? Never stops, disables, or
- * modifies anything — a file-existence check plus a read-only
+ * modifies anything, a file-existence check plus a read-only
  * `systemctl --user is-active` query through the injected actionRunner.
  */
 export function detectLegacyUnit(input: DetectLegacyUnitInput): LegacyUnitInfo {
@@ -283,8 +283,8 @@ export function detectLegacyUnit(input: DetectLegacyUnitInput): LegacyUnitInfo {
 /**
  * The unit name `PlatformServiceManager` is ACTUALLY about to mutate can
  * differ from `MANAGED_SERVICE_NAME` / `definitionOverride.name`. The SDK's
- * internal `resolveServiceName()` — used by `install()`, `uninstall()`, and
- * `status()` alike to compute the unit file PATH — resolves from the
+ * internal `resolveServiceName()`, used by `install()`, `uninstall()`, and
+ * `status()` alike to compute the unit file PATH, resolves from the
  * `service.serviceName` CONFIG key first, falling back to the
  * `defaultServiceName` this module passes only when that key is unset. It
  * never consults `definitionOverride.name` for the path. So if a host's
@@ -313,11 +313,11 @@ export function resolveManagedUnitName(status: ManagedServiceStatus): string {
   return basename(status.path).replace(/\.(service|plist)$/, '');
 }
 
-/** Honest one-line disclosure of the install-script unit's presence/state plus a manual migration hint — never auto-acted-on. */
+/** Honest one-line disclosure of the install-script unit's presence/state plus a manual migration hint, never auto-acted-on. */
 export function legacyUnitNote(legacy: LegacyUnitInfo, trackedServiceName: string): string {
   const stateWord = legacy.active ? 'installed and RUNNING' : 'installed (not currently active)';
   return (
-    `note: a separate service named ${LEGACY_SERVICE_UNIT_NAME}.service is ${stateWord} at ${legacy.path} — ` +
+    `note: a separate service named ${LEGACY_SERVICE_UNIT_NAME}.service is ${stateWord} at ${legacy.path}; ` +
     `that unit name was used by an older install script/release, while this tool manages ` +
     `${trackedServiceName}.service and will not touch the other unit automatically. Keep whichever one you use; running ` +
     `both would start two daemons competing for the same port. To retire the install-script unit in favor of this ` +
@@ -329,7 +329,7 @@ export function legacyUnitNote(legacy: LegacyUnitInfo, trackedServiceName: strin
  * Hard ceiling on every systemctl invocation made through a DEFAULT action
  * runner in this module. The reconcile below runs on the daemon's own startup
  * path, and `spawnSync` without a timeout blocks the single JS event loop for
- * as long as the child runs — a wedged user D-Bus (a real incident class on
+ * as long as the child runs, a wedged user D-Bus (a real incident class on
  * this host) would freeze an already-listening daemon indefinitely. A timed-out
  * call reports `status: null`, which every status check in this module treats
  * as failure, so a wedge degrades to an honest refusal instead of a hang.
@@ -353,7 +353,7 @@ export function parseMainPid(result: { status?: number | null; stdout?: string |
  * Read-only, best-effort TCP connect probe used ONLY by the legacy-absent
  * branch to tell "nothing is listening on this port" apart from "an
  * unmanaged process (e.g. a manual `nohup`) already owns it." Never used to
- * identify or act on that process — a positive result only produces a
+ * identify or act on that process, a positive result only produces a
  * warning, never a kill. Tests always inject a fake `portProbe`; this default
  * is never exercised against a real host in this repo's test suite.
  */
@@ -376,11 +376,11 @@ export function defaultPortProbe(host: string, port: number, timeoutMs = 750): P
 export interface RunLegacyDaemonMigrationParams {
   readonly host: string;
   readonly port: number;
-  /** The unit name this tool manages (e.g. 'goodvibes') — distinct from LEGACY_SERVICE_UNIT_NAME. */
+  /** The unit name this tool manages (e.g. 'goodvibes'), distinct from LEGACY_SERVICE_UNIT_NAME. */
   readonly trackedServiceName: string;
   /**
    * Explicit consent to actually execute the migration. Without it, the
-   * result is a printed plan only — never auto-migrate.
+   * result is a printed plan only, never auto-migrate.
    */
   readonly confirmMigration?: boolean | undefined;
   /** Injectable port-liveness check for the legacy-absent branch. Defaults to `defaultPortProbe`. */
@@ -396,7 +396,7 @@ export interface RunLegacyDaemonMigrationParams {
  * legacy unit. Called immediately before the two mutation calls
  * (`manager.install()`, and `manager.uninstall()` on the failed-health
  * rollback path) that would otherwise write to or remove that path. This is
- * an internal invariant check, not a normal user-facing error path — the
+ * an internal invariant check, not a normal user-facing error path, the
  * pre-flight collision check in `runLegacyDaemonMigration` already returns
  * before either call site is reached whenever this would trip, so tripping
  * here means that earlier check regressed, not that the user did anything
@@ -406,7 +406,7 @@ function assertUnitIsNotLegacy(status: ManagedServiceStatus, legacy: LegacyUnitI
   if (status.path === legacy.path || resolveManagedUnitName(status) === LEGACY_SERVICE_UNIT_NAME) {
     throw new Error(
       `refusing to ${action}: the resolved managed unit (${resolveManagedUnitName(status)} at ${status.path}) is the ` +
-        `install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit — this should already have been caught by the pre-flight ` +
+        `install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit; this should already have been caught by the pre-flight ` +
         'collision check in runLegacyDaemonMigration',
     );
   }
@@ -431,7 +431,7 @@ export async function runLegacyDaemonMigration(
 ): Promise<LegacyDaemonMigrationResult> {
   const { trackedServiceName } = params;
   // Computed once, up front, and reused for every branch below (this is the
-  // exact same single call each branch made individually before — see the
+  // exact same single call each branch made individually before, see the
   // fix note on `resolveManagedUnitName` for why the name/path it reports
   // can differ from `trackedServiceName`).
   const currentStatus = manager.status();
@@ -448,9 +448,9 @@ export async function runLegacyDaemonMigration(
           `migrate-service: no install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was found, but something is already ` +
             `listening on ${params.host}:${params.port}.`,
           "That looks like a process this tool doesn't manage (for example, a manually-started `nohup` daemon) rather " +
-            'than a systemd unit — there is nothing here to stop or disable, and this tool will not attempt to kill an ' +
+            'than a systemd unit; there is nothing here to stop or disable, and this tool will not attempt to kill an ' +
             'unrecognized process.',
-          'Stop that process yourself, then re-run migrate-service or install-service once the port is free — or, if ' +
+          'Stop that process yourself, then re-run migrate-service or install-service once the port is free; or, if ' +
             "it's already the daemon you want running, leave it alone: a client surface can still reach it at this " +
             "host:port directly, with no service unit required for this tool to manage.",
         ],
@@ -462,7 +462,7 @@ export async function runLegacyDaemonMigration(
       exitCode: 0,
       lines: [
         `migrate-service: no install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was found and ${params.host}:${params.port} ` +
-          'is free — there is nothing to migrate.',
+          'is free; there is nothing to migrate.',
         `Run install-service to set up the managed ${resolvedUnitName}.service directly.`,
       ],
       status: currentStatus,
@@ -476,7 +476,7 @@ export async function runLegacyDaemonMigration(
       lines: [
         `migrate-service: this host's detected service platform is '${currentStatus.platform}', not systemd, but a ` +
           `unit file with the install-script name exists at ${legacy.path}.`,
-        'That unit is systemd-specific and this tool only knows how to migrate a systemd unit today — ' +
+        'That unit is systemd-specific and this tool only knows how to migrate a systemd unit today; ' +
           'nothing was changed.',
       ],
       status: currentStatus,
@@ -486,7 +486,7 @@ export async function runLegacyDaemonMigration(
   // Before any mutation, confirm the unit PlatformServiceManager is
   // actually about to install/uninstall isn't the legacy unit itself. This
   // happens when the host's `service.serviceName` config key is set to the
-  // legacy unit's own name — see `resolveManagedUnitName`'s doc comment for
+  // legacy unit's own name, see `resolveManagedUnitName`'s doc comment for
   // why the SDK resolves mutation paths from that config key rather than
   // from the definition this engine passes. Without this check, `install()`
   // below would overwrite the legacy unit file, a failed-health rollback
@@ -516,12 +516,12 @@ export async function runLegacyDaemonMigration(
       exitCode: 0,
       lines: [
         legacyUnitNote(legacy, resolvedUnitName),
-        'migrate-service (dry run — re-run with confirmation to execute): this would',
+        'migrate-service (dry run, re-run with confirmation to execute): this would',
         `  1. install and start the new ${resolvedUnitName}.service unit`,
         '  2. verify it comes up healthy (a fresh, honest systemd is-active check)',
         `  3. only if that succeeds, stop, disable, and remove the install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit ` +
           'and run `systemctl --user daemon-reload`',
-        'Nothing has been changed. Nothing is migrated automatically — re-run with explicit confirmation ' +
+        'Nothing has been changed. Nothing is migrated automatically; re-run with explicit confirmation ' +
           "(the CLI's -y/--yes flag) to execute this plan.",
       ],
       status: currentStatus,
@@ -531,7 +531,7 @@ export async function runLegacyDaemonMigration(
   // Consented: new-up-then-old-down. The legacy unit is not touched until the
   // new unit is verified healthy.
   // Belt-and-braces: the collision check above already returns before
-  // reaching here whenever the resolved unit is the legacy one — this
+  // reaching here whenever the resolved unit is the legacy one, this
   // re-asserts the same invariant right at the mutation site so a future
   // change to the check above can never silently reopen the hole.
   assertUnitIsNotLegacy(currentStatus, legacy, 'install the new unit');
@@ -554,7 +554,7 @@ export async function runLegacyDaemonMigration(
     assertUnitIsNotLegacy(installed, legacy, 'roll back (uninstall) the new unit');
     const rollback = manager.uninstall();
     const rollbackNote = rollback.actionError
-      ? `rolling back the new unit ALSO hit an error (${rollback.actionError}) — remove ${installed.path} by hand.`
+      ? `rolling back the new unit ALSO hit an error (${rollback.actionError}); remove ${installed.path} by hand.`
       : 'the newly-written unit has been rolled back (removed).';
     return {
       ok: false,
@@ -569,7 +569,7 @@ export async function runLegacyDaemonMigration(
     };
   }
 
-  // New unit verified healthy — now, and only now, retire the legacy unit.
+  // New unit verified healthy, now, and only now, retire the legacy unit.
   const run: ManagedServiceActionRunner = params.actionRunner ?? defaultActionRunner(SYSTEMCTL_TIMEOUT_MS);
   const stopResult = run('systemctl', ['--user', 'stop', `${LEGACY_SERVICE_UNIT_NAME}.service`]);
   const disableResult = run('systemctl', ['--user', 'disable', `${LEGACY_SERVICE_UNIT_NAME}.service`]);
@@ -596,7 +596,7 @@ export async function runLegacyDaemonMigration(
     );
   }
   if (removeError) {
-    lines.push(`note: could not remove the install-script unit file at ${legacy.path}: ${removeError} — remove it by hand.`);
+    lines.push(`note: could not remove the install-script unit file at ${legacy.path}: ${removeError}; remove it by hand.`);
   } else {
     lines.push(`the install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit has been stopped, disabled, and removed.`);
   }

package/src/runtime/legacy-daemon-reconcile.ts

@@ -1,6 +1,6 @@
 /**
  * The unattended startup reconcile for the redundant install-script
- * `goodvibes-daemon.service` unit — split out of `legacy-daemon-migration.ts`
+ * `goodvibes-daemon.service` unit, split out of `legacy-daemon-migration.ts`
  * (which owns the shared unit definition, detection, and the CONSENTED
  * `migrate-service` engine) so each module stays within the architecture
  * gate's file-size cap. Same layer (`src/runtime/`), same injectable-seam
@@ -24,8 +24,8 @@ type ManagedServiceActionResult = ReturnType<ManagedServiceActionRunner>;
 /**
  * The exact marker string scripts/install.sh writes into every unit it
  * creates (as a `# managed by goodvibes install.sh` comment). The reconcile
- * check below keys on it to tell an installer-created legacy unit — safe to
- * auto-retire — apart from a hand-written one that must only ever be reported.
+ * check below keys on it to tell an installer-created legacy unit, safe to
+ * auto-retire, apart from a hand-written one that must only ever be reported.
  * Kept in lockstep with `INSTALLER_MARKER` in scripts/install.sh.
  */
 export const INSTALLER_UNIT_MARKER = 'managed by goodvibes install.sh';
@@ -35,7 +35,7 @@ export const INSTALLER_UNIT_MARKER = 'managed by goodvibes install.sh';
 /**
  * CUMULATIVE ceiling on the reconcile's whole boot-path pass. Per-call
  * timeouts alone still allow ~5 sequential slow-but-completing calls to stack
- * up (a degraded — not wedged — user bus), blocking the already-listening
+ * up (a degraded, not wedged, user bus), blocking the already-listening
  * daemon's event loop for tens of seconds. One overall deadline covers the
  * pass: once it is exceeded, every remaining call is skipped (reported as
  * `status: null`, which the guards treat as unknown → refusal) and the result
@@ -48,7 +48,7 @@ export const RECONCILE_DEADLINE_MS = 8_000;
 /**
  * Wrap a runner with the reconcile's cumulative deadline: calls after the
  * deadline are skipped outright; calls near it get only the remaining budget
- * as their per-call timeout (default runner only — injected runners are test
+ * as their per-call timeout (default runner only, injected runners are test
  * fakes that answer instantly).
  */
 function makeDeadlineBoundRunner(
@@ -62,7 +62,7 @@ function makeDeadlineBoundRunner(
     const remaining = deadlineMs - (Date.now() - startedAt);
     if (remaining <= 0) {
       hit = true;
-      return { status: null, stdout: '', stderr: 'reconcile time budget exceeded — call skipped' } as ManagedServiceActionResult;
+      return { status: null, stdout: '', stderr: 'reconcile time budget exceeded; call skipped' } as ManagedServiceActionResult;
     }
     if (injected) return injected(command, args);
     return defaultActionRunner(Math.min(perCallTimeoutMs, remaining))(command, args);
@@ -167,7 +167,7 @@ function defaultReadOwnCgroup(): string {
  * This runs on daemon startup (no user invocation needed) and, guard-railed:
  *   - Only acts when the canonical unit is CONFIRMED serving: `is-active`
  *     reports active AND its MainPID resolves to a live process. `is-active`
- *     alone is not proof — a Type=simple unit reports active from fork onward,
+ *     alone is not proof, a Type=simple unit reports active from fork onward,
  *     including the pre-bind window of a daemon that is about to crash-loop.
  *   - NEVER acts from inside the legacy unit itself: if this process IS the
  *     legacy unit's MainPID, or /proc/self/cgroup names the legacy unit,
@@ -175,20 +175,20 @@ function defaultReadOwnCgroup(): string {
  *     code (mid-boot, from inside a blocking spawnSync). Refuses instead.
  *   - NEVER stops a RUNNING legacy daemon: if the legacy unit's MainPID is a
  *     live process, it may be the daemon serving the endpoint clients are
- *     configured to reach (the wrong-port two-daemon state) — the unattended
+ *     configured to reach (the wrong-port two-daemon state), the unattended
  *     path only retires enabled-but-NOT-running legacy units; a running one
  *     gets a notice pointing at the consented migrate-service.
  *   - Requires the CONFIGURED endpoint (the one clients resolve from
- *     settings.json, no runtime overrides) to be answering before retiring —
+ *     settings.json, no runtime overrides) to be answering before retiring,
  *     a canonical daemon alive on some other port proves nothing about the
  *     endpoint clients use.
  *   - AUTO-RETIRES only an installer-MARKER-managed legacy unit, and only
  *     removes its unit file AFTER `disable --now` reports success. A NONZERO
  *     exit leaves everything in place and says so; a TIMED-OUT disable
- *     (status null) has an UNKNOWN outcome — the enablement state is
+ *     (status null) has an UNKNOWN outcome, the enablement state is
  *     re-inspected before anything is printed, and the receipt states what
  *     was actually confirmed, never a blanket claim.
- *   - A hand-written legacy unit (no marker) is never touched — a one-line
+ *   - A hand-written legacy unit (no marker) is never touched, a one-line
  *     actionable notice. An UNREADABLE unit file is reported as unreadable,
  *     never misdiagnosed as hand-written.
  *   - The whole pass shares ONE cumulative time budget (RECONCILE_DEADLINE_MS)
@@ -214,11 +214,11 @@ export async function reconcileRedundantLegacyUnit(
   const legacyUnit = `${LEGACY_SERVICE_UNIT_NAME}.service`;
   const deadlineNote = (): string[] =>
     deadlineHit()
-      ? ['note: the reconcile hit its overall time budget — remaining checks were skipped; it will re-run at the next daemon start.']
+      ? ['note: the reconcile hit its overall time budget: remaining checks were skipped; it will re-run at the next daemon start.']
       : [];
 
   // Guard 1: the canonical unit must report active. (A timed-out, skipped, or
-  // failed probe — e.g. a wedged user bus — lands here too and refuses.)
+  // failed probe, e.g. a wedged user bus, lands here too and refuses.)
   const probe = run(systemctl, ['--user', 'is-active', canonicalUnit]);
   const canonicalActive = (probe.status ?? 1) === 0 && (probe.stdout ?? '').trim() === 'active';
   if (!canonicalActive) {
@@ -226,7 +226,7 @@ export async function reconcileRedundantLegacyUnit(
       action: 'noop',
       reason: 'canonical-not-active',
       lines: [
-        `legacy-unit reconcile: a ${legacyUnit} unit file exists at ${path} but ${canonicalUnit} is not confirmably active — ` +
+        `legacy-unit reconcile: a ${legacyUnit} unit file exists at ${path} but ${canonicalUnit} is not confirmably active; ` +
           'left untouched (it may be the only daemon).',
         ...deadlineNote(),
       ],
@@ -243,7 +243,7 @@ export async function reconcileRedundantLegacyUnit(
       action: 'noop',
       reason: 'canonical-mainpid-not-alive',
       lines: [
-        `legacy-unit reconcile: ${canonicalUnit} reports active but its MainPID could not be confirmed alive — ` +
+        `legacy-unit reconcile: ${canonicalUnit} reports active but its MainPID could not be confirmed alive; ` +
           `left the ${legacyUnit} unit untouched.`,
         ...deadlineNote(),
       ],
@@ -256,7 +256,7 @@ export async function reconcileRedundantLegacyUnit(
   //
   // The legacy MainPID probe is TRI-STATE, exactly like guards 1-2: a reply
   // whose status is non-zero or null (bus flap, timeout, skipped-by-deadline)
-  // does NOT mean "MainPID=0, unit affirmatively stopped" — reading it that
+  // does NOT mean "MainPID=0, unit affirmatively stopped", reading it that
   // way let one transient systemctl failure on exactly this call authorize
   // `disable --now` against a LIVE legacy daemon (and guard 5 cannot catch
   // it: in the wrong-port state the legacy daemon itself answers the
@@ -271,7 +271,7 @@ export async function reconcileRedundantLegacyUnit(
       action: 'noop',
       reason: 'self-supervised-by-legacy',
       lines: [
-        `legacy-unit reconcile: this daemon appears to be running UNDER ${legacyUnit} itself — refusing to disable ` +
+        `legacy-unit reconcile: this daemon appears to be running UNDER ${legacyUnit} itself; refusing to disable ` +
           `the unit supervising the current process. Migrate from the canonical side instead: goodvibes-daemon migrate-service`,
       ],
     };
@@ -282,14 +282,14 @@ export async function reconcileRedundantLegacyUnit(
       reason: 'legacy-state-unknown',
       lines: [
         `legacy-unit reconcile: could not determine whether ${legacyUnit} has a running daemon (the MainPID query ` +
-          'failed or timed out) — refusing to act on a guess; it will be re-checked at the next daemon start.',
+          'failed or timed out), refusing to act on a guess; it will be re-checked at the next daemon start.',
         ...deadlineNote(),
       ],
     };
   }
 
   // Guard 4: never stop a RUNNING legacy daemon from the unattended path. A
-  // live legacy MainPID means a second daemon is actually serving something —
+  // live legacy MainPID means a second daemon is actually serving something,
   // possibly the endpoint clients resolve from settings.json (the wrong-port
   // two-daemon state). Retiring an enabled-but-idle unit needs no --now kill;
   // stopping a serving one needs consent. (A KNOWN reply of MainPID=0 is the
@@ -299,7 +299,7 @@ export async function reconcileRedundantLegacyUnit(
       action: 'noop',
       reason: 'legacy-running',
       lines: [
-        `legacy-unit reconcile: ${legacyUnit} has a live main process (pid ${legacyPid}) — a second daemon is ` +
+        `legacy-unit reconcile: ${legacyUnit} has a live main process (pid ${legacyPid}); a second daemon is ` +
           'actually running, and it may be the one serving the endpoint your clients are configured to reach. ' +
           'Refusing to stop it unattended; migrate deliberately with: goodvibes-daemon migrate-service',
       ],
@@ -308,7 +308,7 @@ export async function reconcileRedundantLegacyUnit(
 
   // Guard 5: the endpoint clients resolve from settings.json must be answered
   // before anything is retired. The canonical daemon being alive proves only
-  // that A daemon runs — not that the configured endpoint is served (its unit
+  // that A daemon runs, not that the configured endpoint is served (its unit
   // may pin different launch args).
   if (input.configuredEndpoint) {
     const endpointProbe = input.endpointProbe ?? defaultPortProbe;
@@ -319,7 +319,7 @@ export async function reconcileRedundantLegacyUnit(
         reason: 'configured-endpoint-unserved',
         lines: [
           `legacy-unit reconcile: nothing is answering on the CONFIGURED endpoint ` +
-            `${input.configuredEndpoint.host}:${input.configuredEndpoint.port} — the canonical daemon is alive but not ` +
+            `${input.configuredEndpoint.host}:${input.configuredEndpoint.port}; the canonical daemon is alive but not ` +
             `provably serving what clients resolve from settings. Left the ${legacyUnit} unit untouched; check the ` +
             "canonical unit's launch arguments against the controlPlane settings.",
         ],
@@ -345,7 +345,7 @@ export async function reconcileRedundantLegacyUnit(
       reason: 'marker-unreadable',
       lines: [
         `note: ${canonicalUnit} is active and a separate ${legacyUnit} exists at ${path}, but its unit file could not ` +
-          `be read (${readError}) — left untouched. Inspect it yourself; if it is redundant, retire it with: ` +
+          `be read (${readError}). Left untouched. Inspect it yourself; if it is redundant, retire it with: ` +
           `systemctl --user disable --now ${legacyUnit} && rm ${path} && systemctl --user daemon-reload`,
       ],
     };
@@ -365,14 +365,14 @@ export async function reconcileRedundantLegacyUnit(
   }
 
   // Installer-marker-managed and redundant: disable first, and only remove the
-  // unit file if the disable actually succeeded — otherwise the enablement
+  // unit file if the disable actually succeeded, otherwise the enablement
   // symlink dangles at a deleted file and this tool can never repair it (the
   // next pass no-ops at the file-exists check).
   const disableResult = run(systemctl, ['--user', 'disable', '--now', legacyUnit]);
   const disableStatus = disableResult.status ?? 1;
   if (disableStatus !== 0) {
     if (disableResult.status === null) {
-      // TIMED OUT: the outcome is UNKNOWN, not failed — `disable --now`
+      // TIMED OUT: the outcome is UNKNOWN, not failed, `disable --now`
       // removes the enablement symlinks synchronously BEFORE waiting on the
       // stop job, so the disable may well have taken effect even though the
       // client was killed. Re-inspect instead of printing a blanket denial.
@@ -393,11 +393,11 @@ export async function reconcileRedundantLegacyUnit(
         run(systemctl, ['--user', 'daemon-reload']);
         const lines = [
           `reconciled: the disable command timed out waiting on the stop job, but re-inspection confirms the ` +
-            `installer-managed ${legacyUnit} is no longer enabled${removeErrorAfterTimeout ? '' : ` — its unit file was removed (${path})`}. ` +
+            `installer-managed ${legacyUnit} is no longer enabled${removeErrorAfterTimeout ? '' : `, its unit file was removed (${path})`}. ` +
             'Its stop may still be completing.',
         ];
         if (removeErrorAfterTimeout) {
-          lines.push(`note: could not remove ${path}: ${removeErrorAfterTimeout} — remove it by hand.`);
+          lines.push(`note: could not remove ${path}: ${removeErrorAfterTimeout}; remove it by hand.`);
         }
         lines.push(...deadlineNote());
         return { action: 'removed', reason: 'retired', lines };
@@ -406,7 +406,7 @@ export async function reconcileRedundantLegacyUnit(
         action: 'failed',
         reason: 'disable-timeout',
         lines: [
-          `legacy-unit reconcile: the disable of ${legacyUnit} timed out and its outcome is UNKNOWN — the enablement ` +
+          `legacy-unit reconcile: the disable of ${legacyUnit} timed out and its outcome is UNKNOWN; the enablement ` +
             `state could not be re-confirmed. This tool removed nothing; the unit file at ${path} was left in place ` +
             'and will be re-checked at the next daemon start.',
           `Verify it yourself: systemctl --user is-enabled ${legacyUnit}`,
@@ -420,7 +420,7 @@ export async function reconcileRedundantLegacyUnit(
       reason: 'disable-failed',
       lines: [
         `legacy-unit reconcile: the disable of the redundant installer-managed ${legacyUnit} reported failure ` +
-          `(${detail}) — this tool removed nothing; the unit file at ${path} was left in place.`,
+          `(${detail}); this tool removed nothing; the unit file at ${path} was left in place.`,
         `Verify its state and retire it yourself: systemctl --user is-enabled ${legacyUnit} ; ` +
           `systemctl --user disable --now ${legacyUnit} && rm ${path} && systemctl --user daemon-reload`,
       ],
@@ -441,7 +441,7 @@ export async function reconcileRedundantLegacyUnit(
       `was disabled${removeError ? '' : ` and removed (${path})`}.`,
   ];
   if (removeError) {
-    lines.push(`note: could not remove ${path}: ${removeError} — remove it by hand.`);
+    lines.push(`note: could not remove ${path}: ${removeError}; remove it by hand.`);
   }
   lines.push(...deadlineNote());
   return { action: 'removed', reason: 'retired', lines };

package/src/runtime/mail-composition.ts

@@ -4,7 +4,7 @@
  * The deps that let the platform register this daemon's `email.*` verbs.
  *
  * `calendar.*` and `email.*` are served by the platform now, not by handlers in
- * this repository — those were deleted when the platform gained an
+ * this repository, those were deleted when the platform gained an
  * implementation the daemon could call. What is left for a product to supply is
  * the wiring, and it is not optional: without `homeDirectory` the calendar
  * composition returns null, without these deps the mail one does, and either way
@@ -27,7 +27,7 @@ import { nodeEmailTransport } from '@pellux/goodvibes-sdk/platform/email/node';
 
 /** The narrow slices this composition needs; the real managers satisfy them. */
 interface MailCompositionInput {
-  readonly configManager: { get(key: never): unknown };
+  readonly configManager: { get(key: string): unknown };
   readonly secretsManager: { get(key: string): Promise<string | null> };
 }
 
@@ -36,8 +36,8 @@ interface MailCompositionInput {
  * `registerGatewayVerbGroups`.
  *
  * The settings come from the daemon's own `surfaces.email.*` keys through
- * `withSurfaceEmailConfig`, so the keys an operator has already set — and that
- * the settings modal now shows — keep working unchanged, and a not-configured
+ * `withSurfaceEmailConfig`, so the keys an operator has already set, and that
+ * the settings modal now shows, keep working unchanged, and a not-configured
  * answer names the keys THIS operator actually has rather than the ones the
  * service validates internally.
  */
@@ -45,7 +45,7 @@ export function composeMailDeps(input: MailCompositionInput): {
   readonly emailServiceDeps: EmailServiceDeps;
   readonly describeEmailConfigProblem: () => Promise<SurfaceEmailConfigProblem | null>;
 } {
-  const getConfig = (key: string): unknown => input.configManager.get(key as never);
+  const getConfig = (key: string): unknown => input.configManager.get(key);
   const emailServiceDeps = withSurfaceEmailConfig({
     getConfig,
     secretsManager: input.secretsManager,
@@ -56,7 +56,7 @@ export function composeMailDeps(input: MailCompositionInput): {
     // raises display confidence only, and commandAuthority is the literal
     // 'none'.
     describeSenderClaim: describeSenderClaimNeutrally,
-  } as never);
+  });
   return {
     emailServiceDeps,
     describeEmailConfigProblem: () =>