@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/dist/src/wire.js

@@ -0,0 +1,1801 @@
+// Production assembly of quickreviewd: createDaemon() with the real pi session
+// manager, the round-template renderer, the agents build step, the EOD timer,
+// the overseer command executor, and the weekly overseer rotation. `npm run
+// daemon` runs this; createDaemon() alone (src/daemon.ts) stays the
+// stub-wired, test-friendly core.
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fsSecretReader, ingressHostnameFile, liveConfigPath, loadConfig, openVikingBaseUrl, sandboxRoot, slackTokenPath, validateSlackConfig, } from "./config.js";
+import { CommandWatcher, processOperatorSeal, } from "./commands.js";
+import { drainLever, pauseLever, resumeLever } from "./levers.js";
+import { CaseWriter } from "./cases.js";
+import { Archiver } from "./archive/archiver.js";
+import { piGlobalSessionsDir } from "./archive/piglobal.js";
+import { runDirOf, toolUidSplit } from "./ipc/capability.js";
+import { PermitBroker } from "./ipc/permits.js";
+import { LoginRefreshSupervisor } from "./loginrefresh/supervisor.js";
+import { pendingArchiveStatus } from "./archive/status.js";
+import { Learner, learnerKnobsOf } from "./learner/learner.js";
+import { renderNoPacketSection } from "./learner/packet.js";
+import { LessonLedger } from "./lessonledger.js";
+import { RoundLessonSelector } from "./lessonselect.js";
+import { lessonDeliveryStatus } from "./lessonshadow.js";
+import { RoundMemoryActivity } from "./memory/roundactivity.js";
+import { lessonFindClient, openVikingLessonEngine } from "./openviking/lessonfind.js";
+import { createDaemon } from "./daemon.js";
+import { reviewsInFlight } from "./dispatch.js";
+import { eventLoopPolicy } from "./eventloop.js";
+import { digestWritten, eodDigestContext, latestDigestHeadline } from "./digest.js";
+import { startHeartbeat } from "./anomalies.js";
+import { CompanionInbox } from "./companioninbox.js";
+import { opsDay, promptReader, startEodTimer } from "./eod.js";
+import { MutationGate } from "@quickchatai/pi-quickreview/src/gate.js";
+import { GitHubAdapter } from "./github.js";
+import { priorSidecarPath } from "@quickchatai/pi-quickreview/src/priorfindings.js";
+import { completeRecordedFindings } from "./recordedfindings.js";
+import { makePostingGuard } from "@quickchatai/pi-quickreview/src/guards.js";
+import { classifyCi, ciBlocksApproval } from "@quickchatai/pi-quickreview/src/cigate.js";
+import { TokenMinter } from "@quickchatai/pi-quickreview/src/githubAuth.js";
+import { FeedbackEngine, FeedbackMemoryPump, dayScopedRebuild, feedbackDayAddendum, ledgerFeedbackSignal, } from "./feedback.js";
+import { PASS_ADDENDA, buildAgents, configAddenda, lessonAddendaFor, identityVars, } from "@quickchatai/pi-quickreview/src/include.js";
+import { ecosystemFor } from "@quickchatai/pi-quickreview/src/ecosystem.js";
+import { lensTuningAddenda, roundAgentModels } from "@quickchatai/pi-quickreview/src/lenstuning.js";
+import { applyProfileOverlays, loadProfileAddenda, loadProfileEcosystem, loadProfileHeuristics, } from "@quickchatai/pi-quickreview/src/profiles.js";
+import { postingPolicyAddenda } from "@quickchatai/pi-quickreview/src/postingpolicy.js";
+import { prepareDependencySources, renderDependencyNote, } from "@quickchatai/pi-quickreview/src/depsources.js";
+import { fileImprovementPr, fileIssue, gitRunner } from "./improvements.js";
+import { homeProfileLookup } from "./install.js";
+import { hostFacts } from "./runhost.js";
+import { EMBEDDER_GATE_MAX_WAIT_MS, LocalEmbedderSupervisor, OpenVikingClient, OpenVikingSupervisor, ReembedDriver, keyFromFile, memoryServing, openVikingContextAssembler, openVikingStore, } from "./openviking/index.js";
+import { OV_REVIEWER_KEY_SECRET, keyChangeWatcher, openVikingSessionLifecycle, readOvcliKey, readRetiredUrisFile, writeRecallHint, writeRetiredUris, } from "./memory/ovsession.js";
+import { MEMORY_LAYOUT_NOTE, ROUND_SEARCH_AREAS } from "./memory/layout.js";
+import { MemoryHealthMonitor, disabledMemoryStatus, pendingMemoryStatus, } from "./memory/health.js";
+import { credentialProbe } from "./openviking/probe.js";
+import { provisionReportPath, raiseProvisionWake, readProvisionReport, } from "./openviking/provisionreport.js";
+import { countedGapSink } from "./openviking/gapsink.js";
+import { recoverPrForOperator } from "./operator-recovery.js";
+import { createWorkerLiveness, inFlightPrs } from "./workerliveness.js";
+import { resolveTerminalFailure } from "./terminal-failure.js";
+import { readPinnedFromSweep, startEodPinWatch } from "./eodpinwatch.js";
+import { reconcileOrphanedRounds } from "./reconcile.js";
+import { PiSessionManager, prSessionName } from "./sessions.js";
+import { SlackApiClient } from "./slack/api.js";
+import { makeAnnouncer } from "./slack/announce.js";
+import { clearOriginRecords, OriginStore } from "./slack/origin.js";
+import { makeSlackReply } from "./slack/reply.js";
+import { SlackRouter } from "./slack/router.js";
+import { SlackSocketClient } from "./slack/socket.js";
+import { StateStore } from "./state.js";
+import { deliverablePosting } from "./posting-outbox.js";
+import { readPostingReceipt } from "./posting-receipt.js";
+import { RECHECK_TEMPLATE_FILE, renderRecheckPrompt, renderRoundPrompt, templateFileForOrder, } from "@quickchatai/pi-quickreview/src/templates.js";
+import { assertOrderFitsHost } from "@quickchatai/pi-quickreview/src/launchvocab.js";
+import { nodeExec } from "./tmux.js";
+import { versionInfo } from "./version.js";
+import { WebhookHealer } from "./webhookheal.js";
+import { buildWorkerWorld } from "./workerworld.js";
+/** A configured engine refused before it could open partial migrated state. */
+export function migrationMemoryStatus(reason, at = new Date()) {
+    return {
+        ...pendingMemoryStatus(at),
+        state: "down",
+        down_cause: "unanswered",
+        last_error: {
+            at: at.toISOString(),
+            op: "boot",
+            status: 0,
+            code: "migration_incomplete",
+            message: reason,
+        },
+        serving: { ok: false, since: at.toISOString(), reason },
+    };
+}
+export function buildParts(root = sandboxRoot(), loaded = loadConfig(), 
+/** The entry point's view of its host (`hostFacts`); absent, nothing about
+ * the host changes the config. */
+host) {
+    // The profile's per-lens tuning overlays the parsed config once, here, so
+    // every consumer downstream (the plan, the agents build, the round row)
+    // reads the one resolved `cfg.lenses` — the profile wins over
+    // config.toml, the preset and the defaults. A malformed `[lenses]` table
+    // fails the boot loudly, like every other profile loader.
+    // The profile's `[posting]` policy rides the same overlay (packages/pi-plugin/src/postingpolicy.ts).
+    const overlaid = applyProfileOverlays(root, loaded, homeProfileLookup());
+    // A failed optional boot migration leaves its destination incomplete. No
+    // client, raw session or supervisor may open it until the next clean boot.
+    // Memory switched off for this host (no Docker outside the image) is the
+    // same clean off: no client, no supervisor, no probe to fail.
+    const memoryOff = overlaid.openviking.enabled ? host?.memoryOff : undefined;
+    const cfg = process.env.QCR_OPENVIKING_BOOT_DISABLED === "1" || memoryOff !== undefined
+        ? { ...overlaid, openviking: { ...overlaid.openviking, enabled: false } }
+        : overlaid;
+    const memoryBootFailure = process.env.QCR_OPENVIKING_BOOT_DISABLED === "1" && overlaid.openviking.enabled
+        ? "OpenViking state migration is incomplete; memory is unavailable for this boot — original files were retained; retry after correcting storage and restarting"
+        : undefined;
+    const minter = new TokenMinter(cfg.github.secrets_dir);
+    const gate = new MutationGate(cfg.dry_run, join(root, "state", "dryrun"), (intent) => adapter.executeMutation(intent));
+    const adapter = new GitHubAdapter(cfg, minter, gate);
+    // The PR's raw memory tier: the daemon owns create/delete of the
+    // OpenViking session a PR's pi attaches to. Its own client, on the reviewer
+    // user key — never ADMIN/ROOT. Both directions are total, so a store that is
+    // down or unkeyed costs the raw tier and never a session.
+    const memoryRequests = { sink: null };
+    const ovSessions = cfg.openviking.enabled
+        ? openVikingSessionLifecycle(new OpenVikingClient({
+            ...ovConnection(cfg.openviking),
+            apiKey: keyFromFile(join(cfg.github.secrets_dir, OV_REVIEWER_KEY_SECRET)),
+            // Counted with the daemon's other requests.
+            onRequest: (r) => memoryRequests.sink?.(r),
+        }), 
+        // The lifecycle logs a failed delete.
+        { log: (msg) => console.log(`[quickreviewd] ${msg}`) })
+        : undefined;
+    const sessions = new PiSessionManager({
+        cfg,
+        root,
+        ovSessions,
+        configPath: liveConfigPath(),
+    });
+    return {
+        cfg,
+        root,
+        minter,
+        gate,
+        adapter,
+        sessions,
+        ...(ovSessions ? { ovSessions } : {}),
+        memoryRequests,
+        ...(memoryBootFailure ? { memoryBootFailure } : {}),
+        ...(host ? { runHost: host.runHost } : {}),
+        ...(memoryOff !== undefined && memoryBootFailure === undefined ? { memoryOff } : {}),
+    };
+}
+// Exit-code checked, cwd mandatory: a runner that ignored git's exit or
+// defaulted to the daemon's own cwd (a repo with no remote) would leave the
+// improvement channel unable to push without saying so.
+const gitRun = gitRunner(nodeExec);
+/** The status.json a previous run left, or undefined (first boot, unreadable). */
+function readPreviousStatus(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** package.json version for the `daemon.up` line; never worth failing a boot. */
+function packageVersion(root) {
+    const version = versionInfo(root).image.version;
+    return version === "unknown" ? undefined : version;
+}
+// ---- the Slack concierge ---------------------------------------------------
+//
+// Everything Slack is assembled here and nowhere else, because this is the one
+// module allowed to read the two tokens off disk. Three properties the shape
+// enforces rather than documents:
+//
+//   * `[slack] enabled = false` ⇒ this function returns before it touches a
+//     secret reader, a socket or a clock. Nothing is constructed, so nothing
+//     can post.
+//   * A missing token, a malformed [slack] block or an auth.test that cannot
+//     name us is a hard boot error. A bot that cannot identify itself cannot
+//     filter its own echoes — running anyway is a loop risk, not a degraded
+//     mode.
+//   * Socket Mode is the only inbound transport. There is no HTTP route here
+//     and none in src/webhook.ts (tests/slack-no-route.test.ts makes that
+//     structural).
+/** How often the duplicate-consumer check reads `hello.num_connections`. The
+ * socket exposes the count, not an event; `noteConnections` only fires on a
+ * CHANGE, so polling it is equivalent to hooking the frame. */
+const SLACK_CONNECTIONS_TICK_MS = 60_000;
+/** The real transport: Web API out, Socket Mode in, composed into one object. */
+export function defaultTransport(opts) {
+    const { cfg, log } = opts;
+    // Both transports log to the daemon log: an auth failure, a reconnect, a
+    // ping timeout or a dropped post is what an operator reads to tell why the
+    // concierge went quiet.
+    const api = new SlackApiClient({
+        botToken: opts.botToken,
+        postMinIntervalMs: cfg.slack.post_min_interval_ms,
+        userCacheTtlSec: cfg.slack.name_cache_ttl_s,
+        log: (message, meta) => log(`slack: ${message}`, meta),
+    });
+    const socket = new SlackSocketClient({
+        appToken: opts.appToken,
+        backoffMs: cfg.slack.reconnect_backoff_ms,
+        serverPingTimeoutMs: cfg.slack.server_ping_timeout_ms,
+        log: (message, meta) => log(`slack: ${message}`, meta),
+    });
+    return {
+        postMessage: (a) => api.postMessage(a),
+        updateMessage: (a) => api.updateMessage(a),
+        usersInfo: (id) => api.usersInfo(id),
+        authTest: () => api.authTest(),
+        pinsAdd: (a) => api.pinsAdd(a),
+        startSocket: (h) => socket.startSocket(h),
+        stopSocket: () => socket.stopSocket(),
+        get numConnections() {
+            return socket.numConnections;
+        },
+    };
+}
+/**
+ * Build + start the concierge. Returns undefined when Slack is off — callers
+ * pass that straight through, which is why nothing downstream needs a flag.
+ */
+export async function startSlack(opts) {
+    const { cfg, root, store, log } = opts;
+    if (!cfg.slack.enabled)
+        return undefined;
+    const now = opts.now ?? (() => new Date());
+    const readSecret = opts.readSecret ?? fsSecretReader;
+    // Fail loud, at boot, on a missing token or a half-filled [slack] block.
+    validateSlackConfig(cfg, { readSecret });
+    const botToken = readSecret(slackTokenPath(cfg, "bot"));
+    const appToken = readSecret(slackTokenPath(cfg, "app"));
+    if (!botToken || !appToken)
+        throw new Error("slack: token files vanished between validation and read");
+    const transport = (opts.makeTransport ?? defaultTransport)({ cfg, botToken, appToken, log });
+    // Who are we? Resolved once, and required: the router's echo filter is built
+    // on this identity, and a bot that cannot recognise its own messages will
+    // answer itself forever.
+    const identity = await transport.authTest();
+    if (!identity) {
+        throw new Error("slack: auth.test failed — refusing to start (a bot that cannot identify itself will answer its own echoes)");
+    }
+    log(`slack: connected as ${identity.user_id} in ${cfg.slack.channel}`);
+    const origins = opts.origins ?? new OriginStore(join(root, "state", "slack", "origin"), now);
+    const announcer = makeAnnouncer({
+        cfg,
+        store,
+        slack: transport,
+        now,
+        log,
+        version: opts.version,
+        statusPath: join(root, "state", "status.json"),
+        ...(opts.previousStatus !== undefined ? { readStatus: () => opts.previousStatus } : {}),
+        onAnomalySignal: (message) => {
+            // Durable anomaly record beside the inbox item.
+            store.logAnomaly("slack_connections", null, null, message);
+            return opts.writeInbox(message, "anomaly");
+        },
+    });
+    if (!announcer)
+        throw new Error("slack: announcer not built despite enabled = true");
+    const router = new SlackRouter({
+        cfg,
+        store,
+        identity,
+    });
+    const slackReply = makeSlackReply({ cfg, store, api: transport, now, log: (line) => log(line) });
+    const commands = new CommandWatcher({
+        dir: join(root, "commands", "slack"),
+        scope: "slack",
+        tier: { dir: "slack", currentOrigin: () => origins.latest() },
+        deps: { ...opts.commandDeps, slackReply },
+        store,
+        log: (line) => log(line),
+    });
+    await commands.start();
+    await transport.startSocket((event) => {
+        void router
+            .handle(event)
+            .catch((err) => log(`slack: router threw (event ${event.event_id} dropped)`, err));
+    });
+    const timers = [];
+    const every = (ms, fn) => {
+        const t = setInterval(fn, ms);
+        t.unref?.();
+        timers.push(t);
+    };
+    // Half the grace window, so a PR is noticed roughly when it goes overdue.
+    every(Math.max(1, Math.round(cfg.slack.policy.pickup_grace_min / 2)) * 60_000, () => {
+        void announcer
+            .announceNotPickedUp()
+            .catch((err) => log("slack: not-picked-up sweep failed", err));
+    });
+    // Every timer body is its own try/catch: a throw inside setInterval is an
+    // uncaught exception, and a duplicate-consumer probe must never kill the daemon.
+    every(SLACK_CONNECTIONS_TICK_MS, () => {
+        try {
+            announcer.noteConnections(transport.numConnections);
+        }
+        catch (err) {
+            log("slack: connections probe failed", err);
+        }
+    });
+    await announcer.daemonUp();
+    announcer.startHeartbeat();
+    return {
+        announcer,
+        router,
+        origins,
+        transport,
+        commands,
+        slackReply,
+        async stop(reason) {
+            for (const t of timers)
+                clearInterval(t);
+            timers.length = 0;
+            announcer.stopHeartbeat();
+            commands.stop();
+            // The store is still open here (onStop runs before teardown), so the
+            // post is ledgered; `daemonStopping` is bounded internally, so awaiting
+            // it can never hold the exit open.
+            await announcer.daemonStopping(reason);
+            await transport.stopSocket().catch((err) => log("slack: socket stop failed", err));
+        },
+    };
+}
+/**
+ * The local Slack belt both daemon-side watchers install (`commands/` and
+ * `commands/operator/`): with Slack live, a file is refused while the turn
+ * being served was caused by a non-owner Slack message — read through
+ * `latestAny()`, which only a daemon wake's `local` origin supersedes, and
+ * `slack_reply` is executable there. Slack off ⇒ no tier gate at all and the
+ * handlers as given.
+ */
+function localSlackBelt(slack, deps) {
+    return slack
+        ? {
+            tier: { dir: "local", currentOrigin: () => slack.origins.latestAny() },
+            deps: { ...deps, slackReply: slack.slackReply },
+        }
+        : { deps };
+}
+/**
+ * The legacy `commands/` watcher. Two things change when Slack is live, and
+ * only those two: `slack_reply` becomes executable from this dir as well, and
+ * the belt gate is installed — when the turn being served was caused by a
+ * non-owner Slack message, the legacy dir refuses, so a tier-checked command
+ * cannot slip past by being written to the wrong place. Slack off ⇒ no tier
+ * gate at all.
+ *
+ * The gate reads `latestAny()`, not `latest()`: the belt must not lift merely
+ * because a turn ran past the 15-minute TTL (text in the channel can ask for
+ * exactly that — "take your time"). Slack inbound turns are retired and no
+ * wake stamps an origin (see `slackOriginStore`), so the belt stays lifted.
+ */
+export function buildLocalCommandWatcher(opts) {
+    const { slack } = opts;
+    return new CommandWatcher({
+        dir: join(opts.root, "commands"),
+        ...localSlackBelt(slack, opts.deps),
+        store: opts.store,
+        log: opts.log,
+    });
+}
+/**
+ * The operator's command watcher: `commands/operator/`, the directory
+ * `qcr drain`, the board's `u` and the deploy tab write as root.
+ * Same vocabulary, same handlers (`slack_reply` included while Slack is
+ * live); the difference is the issuer the watcher stamps, and only the real
+ * process seal decides it. The same local Slack
+ * belt as `commands/` is installed, and binds only files the seal does not
+ * vouch for: the overseer cannot write into a sealed directory, but the
+ * parent is the daemon's, so it can make or swap in an unsealed one — and a
+ * file there is a session's, so it must be refused exactly where `commands/`
+ * would refuse it. The daemon never creates the directory — see
+ * `CommandWatcherOptions`.
+ */
+export function buildOperatorCommandWatcher(opts) {
+    const { slack } = opts;
+    return new CommandWatcher({
+        dir: join(opts.root, "commands", "operator"),
+        operator: processOperatorSeal(),
+        ...localSlackBelt(slack, opts.deps),
+        store: opts.store,
+        log: opts.log,
+    });
+}
+/**
+ * Where the passive auth watch looks. PR sessions are spawned
+ * with `--session-dir <root>/<pi.session_dir>/<session>`, so THAT is where
+ * their expired-token errors land; pi's default store alone would miss every
+ * reviewer session. The default store under the container user's home (the
+ * pihome volume) stays covered for anything spawned without an explicit dir.
+ */
+export function piAuthWatchDirs(sessions) {
+    // pi's default global store — the same dir the archiver's pi-global store
+    // moves day-old files out of: one definition, `piGlobalSessionsDir`.
+    return [sessions.sessionsRoot(), piGlobalSessionsDir()];
+}
+/**
+ * Where the `eod-curation-receipt` command lands. With no learner on this
+ * daemon (memory switched off) the receipt is refused, with the reason —
+ * which is what the sweep prompt's "off" no-packet section
+ * (`renderNoPacketSection`) tells the curator: "the daemon would refuse
+ * one". tests/eod-seed-coherence.test.ts holds the two together.
+ */
+export function routeCurationReceipt(learner, receipt) {
+    if (!learner)
+        return {
+            ok: false,
+            reason: "the learner is not running on this daemon ([openviking] enabled = false)",
+        };
+    return learner.applyReceipt(receipt);
+}
+/**
+ * The daemon's round-memory seed, or none when memory is switched off: a
+ * round with no seed renders memory-less without a read, so a deliberate off
+ * never reads as degraded memory in the prompt or the round's record.
+ */
+export function roundMemorySeed(enabled, seed) {
+    return enabled ? { memory: seed } : {};
+}
+/** Where and as whom every daemon-side OpenViking client connects — the
+ * credential, the observers and the client instance stay each caller's own. */
+function ovConnection(ov) {
+    return {
+        baseUrl: openVikingBaseUrl(ov),
+        user: ov.user,
+        account: ov.account,
+        timeoutMs: ov.request_timeout_ms,
+    };
+}
+/**
+ * The startup orphan sweep's posting debt. Two rounds are no phantom:
+ *   - one whose outbox job is still pending owes its review, and the outbox
+ *     delivers it with no session. Only a job the outbox will actually process
+ *     counts — live mode, this repo (`outboxProcesses`): a pending dry-run
+ *     snapshot left over a flip to live is never delivered, so keeping its
+ *     round would hold it until the operator's `u`. A dry run never owes one;
+ *   - one whose review is already on GitHub (a `confirmed` receipt for exactly
+ *     this round and posting key) but whose verdict never landed: its stage
+ *     limit settles it from the receipt, where a cancel and requeue would run
+ *     the lenses again for a review already posted.
+ */
+export function orphanPostingOwed(receiptDir, dryRun, repo) {
+    return (round) => {
+        if (round.posting_key === null)
+            return false;
+        const receipt = readPostingReceipt(receiptDir, round.pr, round.round_no);
+        if (receipt?.status === "confirmed" &&
+            receipt.posting_key === round.posting_key &&
+            receipt.pr === round.pr &&
+            receipt.round_no === round.round_no)
+            return true;
+        return (!dryRun && deliverablePosting(receiptDir, round.pr, round.round_no, round.posting_key, repo));
+    };
+}
+/**
+ * The daemon's origin store. It has no accepted-wake view, so the newest
+ * record is in force at once.
+ *
+ * Slack inbound turns are retired, so no record can describe a live turn any
+ * more, and no daemon wake stamps a superseding `local` one. A guest's record
+ * left by the previous run would therefore hold the legacy-dir belt on for
+ * good: the records are dropped at boot, before the store reads them.
+ */
+export function slackOriginStore(root, now) {
+    clearOriginRecords(join(root, "state", "slack", "origin"));
+    return new OriginStore(join(root, "state", "slack", "origin"), now);
+}
+export function createProductionDaemon(parts = buildParts()) {
+    const { cfg, root, gate, adapter, sessions } = parts;
+    const memoryBootAt = new Date();
+    const log = (msg, extra) => console.log(`[quickreviewd] ${msg}`, extra ?? "");
+    // The last run's heartbeat, read before start() writes this boot's first
+    // status.json over it: the Slack `daemon.up` downtime is measured from it.
+    const previousStatus = readPreviousStatus(join(root, "state", "status.json"));
+    // The daemon's one memory store, built in onStart once secrets are readable.
+    // Everything that needs it is late-bound through this holder: the round
+    // assembler and the EOD pinned-area watchdog are constructed before it
+    // exists, and both degrade to "no memory" rather than to an error.
+    let memoryStore = null;
+    /** The same store, as the sweep that keeps what it could not read (the
+     * pinned watchdog must tell an outage from an empty pinned area). */
+    let memorySweep = null;
+    let memoryAssembler = null;
+    const notBuiltYet = {
+        status: "unreadable",
+        reason: "memory store not built yet (daemon still starting)",
+    };
+    const lateAssembler = {
+        pinnedHead: () => memoryAssembler ? memoryAssembler.pinnedHead() : Promise.resolve(notBuiltYet),
+        contextBlock: (q, o) => memoryAssembler ? memoryAssembler.contextBlock(q, o) : Promise.resolve(notBuiltYet),
+    };
+    // The profile-selected ecosystem seam, loaded once at assembly (a
+    // malformed profile.toml fails the boot loudly). It decides the tier-forcing
+    // migration gate, the round pre-check and the prompt's migration-gate prose;
+    // "none" (no profile, no file, no key) runs none of that machinery.
+    const ecosystem = ecosystemFor(loadProfileEcosystem(root, cfg.review.profile, homeProfileLookup()));
+    log(`profile ${cfg.review.profile || "(none)"}: ecosystem ${ecosystem.name}`);
+    // The identity variable map every prompt render and agent build
+    // resolves {{owner_name}}/{{repo}}/{{bot_login}} against.
+    const identity = identityVars(cfg);
+    // The prompt is bound to the host's lens tools (packages/pi-plugin/src/launchvocab.ts). The worker
+    // host's sessions have `lens` and `lens_wave`; the tmux host's have `subagent`
+    // and `launch_plan`. Dispatch writes the host's names into every order it builds
+    // (`SessionHooks.lensRuntime`), whatever `[engine] runtime`, `[pi] lens_runtime` or
+    // `engine_wave` say, and this refuses an order written for the other pair.
+    // The central lens permit broker (src/ipc/permits.ts): one count of lens
+    // sessions across every worker. The WorkerSupervisor serves its ops on the worker
+    // socket and status.json shows it.
+    const lensPermits = new PermitBroker({
+        ceiling: cfg.daemon.lens_permits,
+        staggerMs: cfg.daemon.lens_grant_stagger_ms,
+        log: (m) => log(m),
+    });
+    // The daemon's one store, built here so the worker world (the host the daemon's
+    // state machine speaks to) can exist before the daemon does.
+    const store = new StateStore(join(root, "state", "state.db"));
+    // The bot login's single refresher (src/loginrefresh/), spawned by
+    // path so this process imports neither pi nor src/engine/. Only built when
+    // `[login_refresh] enabled`.
+    let loginRefresh = null;
+    // Workers are the bot's ONLY host: the IPC server,
+    // the supervisor and its spec builder, the leases and the controls, assembled in
+    // src/workerworld.ts. No config key picks the tmux route, and nothing births a
+    // `pr-<n>` tmux session any more; `sessions` serves paths, worktrees and the replay harness.
+    const agentDir = process.env["PI_CODING_AGENT_DIR"]?.trim() || join(homedir(), ".pi", "agent");
+    const workerWorld = buildWorkerWorld({
+        cfg,
+        root,
+        store,
+        adapter,
+        reader: adapter,
+        // The entrypoint names the tool uid (docker/entrypoint.sh): the model's
+        // shims then dial the socket as another uid of this group.
+        toolUid: toolUidSplit(),
+        sessions,
+        ...(parts.ovSessions ? { ovSessions: parts.ovSessions } : {}),
+        permits: lensPermits,
+        agentDir,
+        pump: () => daemon.pump(),
+        loginGate: {
+            paused: () => loginRefresh?.paused() ?? false,
+            whenResumed: (ms) => loginRefresh?.whenResumed(ms) ?? Promise.resolve(true),
+        },
+        log,
+    });
+    const botHost = workerWorld.host;
+    const renderPrompt = (order, memory) => {
+        assertOrderFitsHost(botHost, order);
+        return renderRoundPrompt(readFileSync(join(root, "prompts", templateFileForOrder(order)), "utf8"), order, memory, cfg.owner.name, ecosystem, identity);
+    };
+    // The recheck's own template — a nudge, not a round order.
+    const renderRecheck = (order) => renderRecheckPrompt(readFileSync(join(root, "prompts", RECHECK_TEMPLATE_FILE), "utf8"), order, identity);
+    let eod = null;
+    let pinWatch = null;
+    let heartbeat = null;
+    let commands = null;
+    let operatorCommands = null;
+    let slack = null;
+    // onStart's own intervals (the overseer rotation, the agents day check),
+    // cleared at stop like every other timer.
+    const intervals = [];
+    // The [feedback] engine, built in onStart (it needs the memory store). A
+    // signal arriving in the boot gap between the webhook binding and onStart
+    // is ledgered, never dropped: its row starts `pending`, the backfill pump
+    // writes its memory entry, and the agents rebuild once the engine exists so
+    // a same-day [feedback] comment still reaches the validator.
+    let feedback = null;
+    let feedbackLedgeredEarly = false;
+    // The [feedback] ledger's backfill pump — writes what memory still owes
+    // while memory health reads healthy, and wakes `memory_write_backlog` when
+    // an owed signal ages past the threshold.
+    let feedbackPump = null;
+    // The finding-case writer — one document per posted finding a human
+    // answered or whose fate is known, into reviewer memory's `finding-cases/`,
+    // through the same store; backfills `[memory] cases_backfill_days`. Writes
+    // only while memory health reads healthy.
+    let caseWriter = null;
+    // Is a review round reading memory right now? Dispatch opens a window
+    // around each round's seed (through to its lesson selection), the selector
+    // one around each prefetch, and the case writer starts no batch while any
+    // is open — every case is a multi-second embedding on the one-thread
+    // embedder those reads wait on.
+    const roundActivity = new RoundMemoryActivity();
+    // The learner — mines the human outcomes into lesson candidates at
+    // EOD − `lessons_mine_lead_min`, hands the EOD sweep its outcomes packet
+    // (`dayContext`), takes the `eod-curation-receipt`, checks every adoption
+    // against memory, and wakes `eod_curation_missing` /
+    // `eod_lessons_not_persisted`. Only where memory is switched on: with it off
+    // there is nowhere a lesson could land.
+    let learner = null;
+    // The closed-PR archiver — daemon bookkeeping on its own timer (never a
+    // reconcile step), started beside the case writer and the learner whatever
+    // memory does. It starts no work before the first healthy reconcile plus
+    // `[archive] start_delay_min`, and holds while draining, stalled, starved or
+    // short of disk. Every tick plans (status.json `archive` says what a pass
+    // would move); in mode `on` it also restores reopened PRs, moves the old
+    // reader-less event rows and webhook deliveries into archive/db/, moves
+    // closed PRs' files into archive/pr-<n>/ and seals finished months.
+    let archiver = null;
+    // The lesson shadow ledger — every round's selection through OpenViking
+    // (bounded, `[memory] delivery`), the marks a delivered dont-raise lesson
+    // would have left on its posted findings, and the operator's kill switch.
+    // Built in onStart (it needs the state store); the selector only where
+    // memory is on. Under `shadow` nothing here changes a prompt; under `on`
+    // dispatch awaits `select` beside the seed and renders the round's lessons,
+    // and `repoFacts` reaches the recheck nudge and the ping-pong wake.
+    let lessonLedger = null;
+    let lessonSelector = null;
+    const lateLessons = {
+        start: (order, files) => lessonSelector?.start(order, files),
+        delivering: () => lessonSelector?.delivering() ?? false,
+        select: (order, files, opts) => lessonSelector?.select(order, files, opts) ?? Promise.resolve(null),
+        repoFacts: (q) => lessonSelector?.repoFacts(q) ?? Promise.resolve(""),
+        // A round discarded before its handoff: its selection record goes (with
+        // no selector nothing was ever recorded).
+        discard: (roundId) => lessonSelector?.discard(roundId),
+    };
+    /** The status headline, recomputed at most once a minute (the heartbeat
+     * runs far more often, and the report reads several tables). */
+    let lessonStatusCache = null;
+    // The OpenViking server, supervised as a child of this process. Started
+    // first in onStart so it warms up while the agents build — but never
+    // awaited: there is deliberately no boot ordering, and rounds run
+    // memory-less until `/ready` passes.
+    let openviking = null;
+    // The local English embedder the server embeds through — a second
+    // supervised child, started first; the server's first start waits (bounded)
+    // for it to serve. Off unless the rendered ov.conf routes to it.
+    let localEmbedder = null;
+    // The embedder migration's daemon half — resumes the re-embed of reviewer
+    // memory the entrypoint's `prepare` journalled, once /ready passes.
+    // Timer-armed, never awaited; its block rides inside the heartbeat's
+    // `openviking` entry.
+    let reembed = null;
+    // Worker liveness: the archiver, the startup orphan sweep and operator
+    // recovery read the supervisor's lease files, never a tmux listing.
+    const workerLive = createWorkerLiveness({ runDir: runDirOf(join(root, "state")) });
+    // The webhook-URL self-heal. Only ever constructed when [ingress]
+    // shape = "tunnel-file".
+    let webhookHeal = null;
+    // Reviewer-memory health — the authenticated probe of each credential in
+    // use, fed by the daemon's own requests and round seeds, and the one source
+    // of the status.json `memory` block every person-facing surface reads.
+    // Built in onStart (it needs the store and the server's config); until then
+    // the block reads `unknown` — never healthy, never off.
+    let memoryHealth = null;
+    /** Why memory is NOT monitored on this daemon; null while still deciding. */
+    let memoryUnmonitored = null;
+    if (parts.memoryRequests)
+        parts.memoryRequests.sink = (r) => memoryHealth?.recordRequest(r);
+    // The origin store the Slack belt reads. Slack inbound turns are retired, so
+    // nothing writes an origin any more.
+    const origins = slackOriginStore(root);
+    // The companion inbox: everything that used to wake the overseer (anomalies,
+    // the heartbeat, authwatch's and the login refresher's alerts, the EOD sweep,
+    // the self-requeue notice, the Slack connection signal) is an item here.
+    const inbox = new CompanionInbox({ root, log });
+    const writeInbox = inbox.writer();
+    // The profile's lens-heuristics extension, loaded once here so a
+    // malformed heuristics.toml fails the assembly loudly (same contract as the
+    // addenda pack below) and every dispatch selects with the same predicates.
+    const profileHeuristics = loadProfileHeuristics(root, cfg.review.profile, homeProfileLookup());
+    // The gate's loud line (app-self-config executions) goes to the
+    // daemon log; the default console fallback covers any unwired gate.
+    gate.setLog(log);
+    const daemon = createDaemon({
+        cfg,
+        root,
+        store,
+        adapter,
+        ...(parts.runHost ? { runHost: parts.runHost } : {}),
+        postingDelivery: {
+            createReview: async (pr, payload) => {
+                // An approval queued by approve-pr.sh keeps that route's green-CI
+                // precondition. Do not silently turn an old approval verdict into a
+                // COMMENT that its session never marked approval_withheld.
+                if (payload.event === "APPROVE" && cfg.guards.block_approve_on_red_ci) {
+                    try {
+                        if (ciBlocksApproval(classifyCi(await adapter.listChecks(payload.commit_id)), {
+                            noChecksIsRed: cfg.guards.no_checks_is_red,
+                        }))
+                            return { executed: false, blocked: "ci-not-green" };
+                    }
+                    catch {
+                        return { executed: false, blocked: "pr-unreadable" };
+                    }
+                }
+                return adapter.createReview(pr, payload);
+            },
+            listReviewsFull: (pr) => adapter.listReviewsFull(pr),
+            // The deferred-posting retry: straight through the gate, whose guards
+            // bind as on any review (guard 4 softens a red-CI approval to a
+            // COMMENT there); only guard 5 is exempt, via `postingRetry`.
+            createDeferredReview: (pr, payload, postingKey) => adapter.createReview(pr, payload, { postingRetry: postingKey }),
+        },
+        hooks: botHost,
+        writeInbox,
+        renderPrompt,
+        ecosystem,
+        heuristics: profileHeuristics,
+        // Pinned head + one budgeted context block per round. Past the
+        // deadline the round dispatches memory-less and logs the gap — memory
+        // never blocks or delays a round. Memory switched off
+        // (`[openviking] enabled = false`) seeds nothing: no read, no
+        // "memory unavailable" note, nothing counted as degraded.
+        ...roundMemorySeed(cfg.openviking.enabled, {
+            assembler: lateAssembler,
+            maxTokens: cfg.memory.context_tokens,
+            timeoutMs: cfg.memory.context_timeout_ms,
+            // Every seed, after the round was built, feeds memory health — a seed
+            // that timed out reaches no client observer, so this is the only place
+            // it is seen.
+            onSeeded: (mem) => memoryHealth?.recordRoundSeed({
+                degraded: mem.degraded,
+                reasons: mem.gaps.map((g) => `${g.part}: ${g.reason}`),
+            }),
+            // The PR session's own recall (vendored openviking-pi patch 0008)
+            // searches with the round's query and the round's areas, not the round
+            // order.
+            publishQuery: (pr, query) => {
+                writeRecallHint(sessions.ovRecallHintPath(prSessionName(pr)), { query, areas: ROUND_SEARCH_AREAS }, { log: (msg) => log(msg) });
+            },
+            // The round's memory window — the case writer starts no
+            // batch from the seed until the lesson selection has taken over.
+            activity: roundActivity,
+        }),
+        // The round's lesson selection (shadow ledger; awaited by dispatch only
+        // under `delivery = "on"`); and the matcher, told when a round's findings
+        // record lands.
+        lessons: lateLessons,
+        onFindingsRecorded: (target) => completeRecordedFindings({
+            store: daemon.store,
+            ledger: lessonLedger,
+            adapter,
+            sidecarPath: (n, k) => priorSidecarPath(join(root, "state"), n, k),
+            log,
+        }, target),
+        renderRecheckPrompt: renderRecheck,
+        // Conflict resolutions are never trivial: git-level auto-merge comparison
+        // in the base clone names the hand-resolved files.
+        // A degraded merge-verify is logged with its reason here (the failed git
+        // command and its stderr when one failed); the callers record the
+        // degradation itself.
+        resolvedFilesInMerges: async (from, to, pr) => {
+            const res = await sessions.worktrees.resolvedFilesInMerges(from, to, pr);
+            if (res.degraded)
+                log(`merge-verify degraded${pr !== undefined ? ` #${pr}` : ""} ${from.slice(0, 7)}→${to.slice(0, 7)}: ${res.reason ?? "unknown"}`);
+            return res;
+        },
+        // Outcome capture: did the code at a posted finding's anchor
+        // change? Read-only git in the same base clone, no fetch, memoised.
+        outcomeGit: sessions.worktrees,
+        // One network fetch per round, before the order is built: the PR head and
+        // the branch it targets, together. Everything downstream (prompt, session,
+        // passes) then works from the shas this returns.
+        prepareWorktree: (pr, baseRef, expectedHead) => sessions.worktrees.ensureWorktree(pr, { baseRef, expectedHead }),
+        // Follow-up rounds: the PR-owned change since the last reviewed
+        // head (the reviewed head replayed onto the round's merge base, read-only
+        // git in the base clone), and the pin that keeps a reviewed head
+        // replayable after a force-push.
+        prOwnedDelta: (q) => sessions.worktrees.prOwnedDelta(q),
+        pinReviewedHead: (pr, sha) => sessions.worktrees.pinReviewedHead(pr, sha),
+        // Third-party sources at the PR's locked versions, unpacked into a cache
+        // on the state volume for the passes to read (`[review]
+        // dependency_sources`). Download and unpack only;
+        // total — a dead registry yields an empty note.
+        dependencySources: async (worktreePath, files) => renderDependencyNote(await prepareDependencySources(worktreePath, files, {
+            cacheDir: join(root, "state", "depcache"),
+            log: (line) => log(`deps: ${line}`),
+        })),
+        // Migration-number pre-check input: the base branch's migrations
+        // at the sha the round pinned. Local git in the just-fetched base clone.
+        listBaseMigrations: (baseSha) => sessions.worktrees.listMigrationFiles(baseSha),
+        // Escalation-mention pick: most recent human author of the
+        // touched first-party directive files at the round's merge base, read from
+        // the base clone; the daemon's own bot identity never qualifies.
+        directiveAuthor: (sha, paths) => sessions.worktrees.lastHumanAuthor(sha, paths, {
+            botLogins: [cfg.github.bot_login, cfg.github.app_slug],
+        }),
+        log,
+        // Lazy on purpose: the Slack subsystem is built in onStart, after the
+        // store exists. Off ⇒ this resolves undefined forever and dispatch/verdicts
+        // never see an announcer.
+        announce: () => slack?.announcer,
+        digestHeadline: () => latestDigestHeadline(join(root, "digest")),
+        // Passive pi auth-failure watch: the JSONLs pi actually writes.
+        piSessionsDir: piAuthWatchDirs(sessions),
+        // The memory engine's heartbeat block — a cached, synchronous
+        // read of the supervisor's last health + /proc sample, plus the reembed
+        // journal (one small synchronous file read per heartbeat) and the local
+        // embedder's status.
+        openvikingStatus: () => {
+            const status = openviking?.status();
+            if (!status)
+                return status;
+            return {
+                ...status,
+                ...(reembed ? { reembed: reembed.status() } : {}),
+                ...(localEmbedder ? { embedder: localEmbedder.status() } : {}),
+            };
+        },
+        // The archiver's block — a cached synchronous read. Before
+        // onStart builds it the mode is known and nothing else: `unknown`, a
+        // null backlog, never 0.
+        archiveStatus: () => (archiver ? archiver.status() : pendingArchiveStatus(cfg.archive.mode)),
+        // The login refresher's block — a cached synchronous read; absent when the
+        // refresher is not configured.
+        loginRefreshStatus: () => loginRefresh?.status(),
+        // The lens permit broker's use and queue.
+        permitStatus: () => lensPermits.status(),
+        // What hosts each PR's session, for status.json's per-PR `runtime`.
+        runtimeOf: workerWorld.runtimeOf,
+        // Whether memory works, beside whether the server is up — and what memory
+        // still owes the [feedback] ledger.
+        memoryStatus: () => {
+            const base = memoryHealth
+                ? memoryHealth.status()
+                : parts.memoryBootFailure
+                    ? migrationMemoryStatus(parts.memoryBootFailure, memoryBootAt)
+                    : memoryUnmonitored !== null
+                        ? disabledMemoryStatus(memoryUnmonitored)
+                        : pendingMemoryStatus();
+            // The finding-case ledger, when a case writer runs (the block is a
+            // fresh object each call). Unread is unknown (null), never
+            // "nothing owed".
+            if (caseWriter) {
+                let cases;
+                try {
+                    cases = caseWriter.status();
+                }
+                catch (err) {
+                    log("memory status: could not read the finding-case ledger", err);
+                    cases = null;
+                }
+                base.case_writes = cases;
+            }
+            // The lesson shadow ledger's headline. Unread is unknown (null), never
+            // "nothing happened".
+            if (lessonLedger) {
+                const nowMs = Date.now();
+                if (!lessonStatusCache || nowMs - lessonStatusCache.at >= 60_000) {
+                    let value;
+                    try {
+                        value = lessonDeliveryStatus(lessonLedger, cfg.memory.delivery, {
+                            selecting: lessonSelector !== null,
+                        });
+                    }
+                    catch (err) {
+                        log("memory status: could not read the lesson ledger", err);
+                        value = null;
+                    }
+                    lessonStatusCache = { at: nowMs, value };
+                }
+                base.lessons = lessonStatusCache.value;
+            }
+            // The day's EOD curation and the lessons' balance. Unread is unknown
+            // (null), never "all well".
+            if (learner) {
+                try {
+                    base.curation = learner.status();
+                }
+                catch (err) {
+                    log("memory status: could not read the learner's ledger", err);
+                    base.curation = null;
+                }
+            }
+            try {
+                const b = daemon.store.feedbackMemoryBacklog();
+                return {
+                    ...base,
+                    feedback_writes: {
+                        pending: b.pending,
+                        failed: b.failed,
+                        oldest_pending_at: b.oldest_pending_at,
+                    },
+                };
+            }
+            catch (err) {
+                // Unread is unknown, never "nothing owed".
+                log("memory status: could not read the [feedback] memory backlog", err);
+                return { ...base, feedback_writes: null };
+            }
+        },
+        // The [feedback] tuning loop.
+        onFeedback: async (e) => {
+            if (!feedback) {
+                // Before the engine exists the signal is ledgered, never dropped: its
+                // row waits `pending` for the backfill pump.
+                const res = ledgerFeedbackSignal(daemon.store, e, {
+                    timezone: cfg.ops.timezone,
+                    memoryEnabled: cfg.openviking.enabled,
+                });
+                if (res.result === "recorded")
+                    feedbackLedgeredEarly = true;
+                log(`feedback: signal before engine ready — ledgered (${res.result}); memory is written by the backfill`, e.kind);
+                return;
+            }
+            await feedback.ingest(e);
+        },
+        async onStart(d) {
+            // OpenViking first and unawaited: the server takes seconds to become
+            // ready, so it starts warming while everything below builds. A missing
+            // binary (any dev PC) is reported once and never retried; a crash is
+            // respawned on a capped backoff ladder, forever.
+            //
+            // The local English embedder starts before it — the server's /ready
+            // probes it — and the server's first start waits for it
+            // to serve, bounded (EMBEDDER_GATE_MAX_WAIT_MS). Neither is awaited here.
+            localEmbedder = new LocalEmbedderSupervisor({ cfg: cfg.openviking, repoRoot: root, log });
+            localEmbedder.start();
+            const embedderForGate = localEmbedder;
+            openviking = new OpenVikingSupervisor({
+                cfg: cfg.openviking,
+                log,
+                startGate: {
+                    open: () => embedderForGate.gateOpen(),
+                    maxWaitMs: EMBEDDER_GATE_MAX_WAIT_MS,
+                    what: "the local embedder",
+                },
+                // The reviewer's memory root does not exist on a fresh server until
+                // something creates it. The TUI does this for the companion's sake;
+                // the daemon does it here for its own, each time the server comes up,
+                // so the round path's first sweep lists a real (empty) tree instead
+                // of leaning on how the server spells a missing one.
+                onReady: () => {
+                    // Memory health re-measures at once rather than at its next tick:
+                    // a server that just came up should read healthy (or say why not)
+                    // in seconds, not minutes.
+                    void memoryHealth?.probeNow();
+                    const store = memoryStore;
+                    if (!store?.ensureWritable)
+                        return;
+                    void store.ensureWritable().then((res) => log(`openviking ready: memory root ${res.ok ? "ready" : "NOT ready"} — ${res.message}`), (err) => log("openviking ready: memory root check failed", err));
+                },
+            });
+            openviking.start();
+            const supervisor = openviking;
+            // Under the memory sidecar (endpoint = remote) the store, its journal
+            // and the re-embed migration live in the sidecar, which runs its own
+            // driver at its boot: this daemon has neither the journal nor ov.conf.
+            if (cfg.openviking.endpoint === "local") {
+                reembed = new ReembedDriver({
+                    cfg: cfg.openviking,
+                    repoRoot: root,
+                    keyPath: join(cfg.github.secrets_dir, OV_REVIEWER_KEY_SECRET),
+                    ready: () => supervisor.status().ready,
+                    log,
+                });
+                reembed.start();
+            }
+            // Lens agents: expand {{include:...}} + per-pass model overrides into
+            // the build dir (state/agents) the native subagent extension discovers
+            // through its "user" scope — the container entrypoint symlinks
+            // ~/.pi/agent/agents at it.
+            //
+            // The build composes in the same-day feedback addendum when today
+            // carries [feedback] comments — validator-scoped, demotion-only,
+            // regenerated on every ingest and expired on ops-day change (the
+            // 5-minute day check below), so a mid-day restart picks today's
+            // feedback up and yesterday's never leaks into a new day.
+            // The repo-profile addenda pack is loaded once at assembly so a
+            // malformed pack fails the boot loudly (never a silent skip) and every
+            // rebuild composes the same bytes. Composition order is fixed in the
+            // `addenda` list below, with the same-day feedback addendum last.
+            const profileAddenda = loadProfileAddenda(root, cfg.review.profile, homeProfileLookup());
+            if (cfg.review.profile !== "") {
+                log(`profile ${cfg.review.profile}: ${profileAddenda.length} addenda loaded`);
+                const tuned = Object.keys(cfg.lenses ?? {});
+                if (tuned.length)
+                    log(`profile ${cfg.review.profile}: lens tuning for ${tuned.join(", ")}`);
+            }
+            // The day is marked built only once the build LANDS (dayScopedRebuild):
+            // a throw on the day-change tick is retried by the next tick instead of
+            // leaving yesterday's feedback addendum in force all day.
+            // The lesson ledger holds the operator's kill switch,
+            // which decides (with `[memory] delivery`) whether the validator's
+            // lesson addendum is composed — so it exists before the first build.
+            lessonLedger = new LessonLedger(d.store);
+            const agentsDay = dayScopedRebuild(() => opsDay(cfg.ops.timezone), (buildDay) => {
+                const fb = feedbackDayAddendum(d.store.feedbackCommentsForDay(buildDay), buildDay);
+                const lessonAdd = lessonAddendaFor(cfg.memory.delivery, lessonLedger);
+                const built = buildAgents(join(root, "agents"), join(root, "state", "agents"), {
+                    root,
+                    tiers: cfg.models.tiers,
+                    riskPasses: cfg.models.risk_passes,
+                    validateTier: cfg.models.validate_tier,
+                    vars: identity,
+                    // Ecosystem-gated addenda follow the profile's selection.
+                    ecosystem: ecosystem.name,
+                    // A lens's profile `effort` rides the per-variant hook;
+                    // `[models.pass_tiers]` pins move a lens's tier on top of it.
+                    models: roundAgentModels(cfg),
+                    addenda: [
+                        ...PASS_ADDENDA,
+                        ...configAddenda(cfg.review),
+                        ...profileAddenda,
+                        // The profile's `emphasis` / `max_severity`, compiled.
+                        ...lensTuningAddenda(cfg.lenses),
+                        // The profile's `[posting]` policy, compiled for the validator.
+                        ...postingPolicyAddenda(cfg.posting),
+                        // The validator's lesson authority, beside the
+                        // same-day feedback addendum (never in place of it) — only
+                        // while `[memory] delivery = "on"` and the kill switch is on.
+                        ...lessonAdd,
+                        ...(fb ? [fb] : []),
+                    ],
+                });
+                log(`built ${built.length} pass agents into state/agents${lessonAdd.length ? " (+ lesson addendum)" : ""}${fb ? " (+ same-day feedback addendum)" : ""}`);
+            });
+            const rebuildAgents = agentsDay.rebuild;
+            rebuildAgents();
+            // Reviewer memory: the one daemon-side `MemoryStore`, over the
+            // supervised OpenViking server on loopback. The reviewer user key is
+            // read from the secrets mount lazily (`keyFromFile` re-checks on a TTL),
+            // so a key that lands after boot is picked up without a restart — and an
+            // absent key degrades exactly like a dead server, which is the correct
+            // behaviour on a dev PC. Never an ADMIN or ROOT key.
+            // One key source for the client, the health probe and the key-change
+            // watcher: it re-stats the file every TTL and the client drops its
+            // cache on a 401, so a rotated key is re-read rather than a dead one
+            // held forever.
+            const reviewerKey = keyFromFile(join(cfg.github.secrets_dir, OV_REVIEWER_KEY_SECRET));
+            // The counted `openviking_gap`: every gap counted into the memory
+            // block, and a quiet anomaly row at most once an hour per op:code that
+            // carries the running count (src/openviking/gapsink.ts).
+            const countedGap = countedGapSink({
+                record: (gap) => memoryHealth?.recordGap(gap),
+                logAnomaly: (kind, pr, roundNo, detail) => d.store.logAnomaly(kind, pr, roundNo, detail),
+                log,
+            });
+            const memoryClient = new OpenVikingClient({
+                ...ovConnection(cfg.openviking),
+                apiKey: reviewerKey,
+                log,
+                onGap: countedGap,
+                onRequest: (r) => memoryHealth?.recordRequest(r),
+            });
+            const memory = openVikingStore(memoryClient, {
+                defaultCategory: cfg.openviking.default_category,
+                cacheTtlMs: cfg.openviking.read_cache_ttl_ms,
+                log,
+                // The sessions' own recall (vendored openviking-pi patch 0007) excludes
+                // retired entries by this list, published beside their ovcli.conf
+                // whenever the store's sweep sees it change.
+                onRetired: (uris) => writeRetiredUris(sessions.ovRetiredPath(), uris, {
+                    log: (msg) => log(msg),
+                }),
+                // …starting from the list the last daemon published, so a first sweep
+                // that cannot read everything (the server still warming up) adds to
+                // the sessions' exclusions and never wipes them.
+                initialRetired: readRetiredUrisFile(sessions.ovRetiredPath()),
+            });
+            feedback = new FeedbackEngine({
+                store: d.store,
+                timezone: cfg.ops.timezone,
+                rebuildAgents,
+                memory,
+                // Memory switched off: signals are ledgered `skipped`, never owed.
+                memoryEnabled: cfg.openviking.enabled,
+                log,
+            });
+            // Same-day [feedback] comments ledgered in the boot gap reach the
+            // validator's addendum now (the boot build above may predate them).
+            if (feedbackLedgeredEarly) {
+                try {
+                    rebuildAgents();
+                }
+                catch (err) {
+                    log("feedback: agents rebuild for boot-gap signals failed", err);
+                }
+            }
+            // Memory switched off leaves the holders empty: the round seeds
+            // nothing (above) and the EOD pinned-area watchdog is not built, so a
+            // deliberate off never reads as an outage.
+            if (cfg.openviking.enabled) {
+                memoryStore = memory;
+                memorySweep = memory;
+                memoryAssembler = openVikingContextAssembler({
+                    client: memoryClient,
+                    store: memory,
+                    // Without quotas the server balances the block across every scope it
+                    // holds and a round gets about one memory entry beside two built-in
+                    // scope blurbs. The quotas name the corpus;
+                    // `context_tokens` stays the budget. See [memory] in config.toml.
+                    quotas: cfg.memory.context_quotas,
+                    searchTimeoutMs: cfg.openviking.search_timeout_ms,
+                    log,
+                });
+            }
+            // The lesson shadow ledger and the round's selection. The
+            // ledger (and so the operator's kill switch) always; the selector only
+            // where memory is on — with it off there is nothing to select from.
+            // (Built before the first agents build — the kill switch decides the
+            // validator's lesson addendum; this keeps that same ledger.)
+            lessonLedger = lessonLedger ?? new LessonLedger(d.store);
+            if (cfg.openviking.enabled && cfg.memory.delivery !== "off") {
+                // Its own client — no health observer, no counted gap — so a find
+                // the round's budget aborts never reads as memory failing (the
+                // health window would otherwise call a slow-but-working server
+                // degraded and pause the case writer, the pump and the learner).
+                const lessonEngine = openVikingLessonEngine(lessonFindClient({
+                    ...ovConnection(cfg.openviking),
+                    apiKey: reviewerKey,
+                    log,
+                }), memory);
+                lessonSelector = new RoundLessonSelector({
+                    ledger: lessonLedger,
+                    mode: () => cfg.memory.delivery,
+                    engine: () => lessonEngine,
+                    budgetMs: cfg.memory.delivery_budget_ms,
+                    // The budget follows the mode — `shadow` runs after the
+                    // handoff and blocks nothing, so it gets its own, looser one.
+                    shadowBudgetMs: cfg.memory.shadow_budget_ms,
+                    activity: roundActivity,
+                    repo: cfg.github.repo,
+                    log,
+                });
+            }
+            log(`lessons: [memory] delivery = ${cfg.memory.delivery}` +
+                (cfg.memory.delivery === "on"
+                    ? lessonSelector
+                        ? " — DELIVERING: each round awaits its selection beside the memory seed (≤ " +
+                            `${cfg.memory.delivery_budget_ms} ms); lessons reach the lens task files, the lessons files of the validator and the lenses a session adds, the main session's index and past-review cases, and the recheck/ping-pong repo facts; the validator carries the lesson-shape addendum` +
+                            (cfg.review.task_files
+                                ? ""
+                                : " — but `[review] task_files = false`: the planned lenses have no task file, so THEY get no lessons")
+                        : " — but memory is off ([openviking] enabled = false): nothing to select, nothing delivered"
+                    : cfg.memory.delivery === "shadow"
+                        ? ` — selection and the shadow ledger only (after each round's handoff, ≤ ${cfg.memory.shadow_budget_ms} ms); no prompt, task file or agent changes`
+                        : " — nothing selected, nothing recorded") +
+                (lessonLedger.lessonsOff() ? "; the operator's kill switch is OFF" : ""));
+            // Reviewer-memory health. "Not monitored" is reserved for memory
+            // switched off — `[openviking] enabled = false`, which is what
+            // declining memory in onboarding writes. Memory configured on whose
+            // server cannot run (a binary missing after a rebuild, a venv path
+            // drifted from `[openviking] bin`) is monitored: its probes go
+            // unreachable and it reads `down` after `[memory] down_after_min`,
+            // because that is an outage, not a choice, and must not be painted
+            // like a deliberate off.
+            if (!cfg.openviking.enabled) {
+                memoryUnmonitored = parts.memoryOff ?? "[openviking] enabled = false";
+                if (parts.memoryOff)
+                    log(`${parts.memoryOff}: the memory engine runs as the Docker sidecar outside the release image, and no Docker answers here — memory stays off for this boot`);
+            }
+            else {
+                // A rotated daemon key reaches the sessions too: their ovcli.conf is
+                // rewritten the moment the key changes, not at the next session birth.
+                const watchKey = keyChangeWatcher(() => {
+                    const res = sessions.provisionOvCredentials();
+                    log(`openviking: the reviewer key changed — sessions' ovcli.conf ${res.written ? "rewritten" : "NOT rewritten"}${res.keyed ? "" : ` (${res.reason || "no key"})`}`);
+                    d.store.logEvent("openviking_key_changed", null, {
+                        ovcli_written: res.written,
+                        keyed: res.keyed,
+                        reason: res.reason,
+                    });
+                    // A failed rewrite stays owed: the next probe tick tries again.
+                    return res.written;
+                });
+                const probeBase = {
+                    ...ovConnection(cfg.openviking),
+                };
+                memoryHealth = new MemoryHealthMonitor({
+                    probes: {
+                        daemon: credentialProbe({
+                            ...probeBase,
+                            key: () => ({ state: "key", key: reviewerKey() ?? "" }),
+                        }),
+                        sessions: credentialProbe({
+                            ...probeBase,
+                            key: () => readOvcliKey(sessions.ovcliConfPath()),
+                        }),
+                    },
+                    beforeProbe: () => {
+                        watchKey(reviewerKey());
+                    },
+                    wake: (kind, detail, message) => d.store.logAnomaly(kind, null, null, detail, message),
+                    draining: () => d.store.drainState().draining,
+                    // Whether memory serves search — the server's /ready (it runs an
+                    // embedding probe) and the local embedder. The fs/ls probe needs no
+                    // embedding, so without this a dead embedder would read healthy
+                    // while every search failed. Cached, synchronous reads.
+                    serving: () => memoryServing(cfg.openviking.embedding_provider, openviking?.status(), localEmbedder?.status()),
+                    incidents: {
+                        load: () => d.store.memoryIncident(),
+                        save: (incident) => d.store.recordMemoryIncident(incident),
+                    },
+                    where: {
+                        daemon: `secrets/${OV_REVIEWER_KEY_SECRET}`,
+                        sessions: "ovcli.conf in the pi HOME",
+                    },
+                    log,
+                    // Floors: a mistyped 0 must not become a tight probe loop or a
+                    // wake on every probe.
+                    intervalMs: Math.max(10, cfg.memory.probe_interval_s) * 1000,
+                    downAfterMs: Math.max(1, cfg.memory.down_after_min) * 60_000,
+                    bootGraceMs: Math.max(0, cfg.memory.boot_grace_min) * 60_000,
+                    rewakeMs: Math.max(1, cfg.memory.rewake_h) * 3_600_000,
+                });
+                // This boot's provisioning report (the entrypoint ran the script
+                // before us): into the block, and one wake per report when it says
+                // anything is wrong — keyed by the report's fingerprint, so a daemon
+                // restart inside the same container does not repeat it.
+                const prov = readProvisionReport(provisionReportPath(root));
+                memoryHealth.setProvision(prov);
+                raiseProvisionWake(d.store, prov);
+                memoryHealth.start();
+                // The backfill pump. It writes owed [feedback] signals through the
+                // same `note` op on the same store — a retry on the one route, never
+                // a second channel — only while health reads healthy, and wakes
+                // `memory_write_backlog` past the threshold. Legacy rows (older than the
+                // store's legacy cutoff, written under random names) are checked against a complete sweep
+                // first (an entry whose write timed out may have landed after all).
+                const health = memoryHealth;
+                feedbackPump = new FeedbackMemoryPump({
+                    store: d.store,
+                    memory,
+                    healthy: () => health.currentState() === "healthy",
+                    healthState: () => health.currentState(),
+                    // Retired entries count as "landed": a legacy signal whose entry was
+                    // retired since — by the operator, or by the
+                    // relayout — was written once and must not be written again into
+                    // events/. (A relayout MOVE leaves the copy live in events/, so it
+                    // is found among the live entries.)
+                    readEntries: async () => {
+                        const sweep = await memory.sweep();
+                        return {
+                            entries: [...sweep.entries, ...sweep.retired],
+                            complete: sweep.unread.length === 0,
+                        };
+                    },
+                    wake: (kind, detail, message) => d.store.logAnomaly(kind, null, null, detail, message),
+                    log,
+                    intervalMs: Math.max(10, cfg.memory.backfill_interval_s) * 1000,
+                    backlogAfterMs: Math.max(1, cfg.memory.write_backlog_after_min) * 60_000,
+                    rewakeMs: Math.max(1, cfg.memory.rewake_h) * 3_600_000,
+                });
+                feedbackPump.start();
+                // Finding cases: the learner's context. Rendered from state.db
+                // (round_findings, the outcome capture's tables, the human replies,
+                // the feedback ledger) and written through the same store's
+                // `putDocuments` — one batch-write under `finding-cases/` a tick, every case
+                // under its own precondition — only while memory reads healthy. Its
+                // backfill reads a PR's inline comments through the adapter (a read:
+                // never the gate) and runs the outcome capture for PRs nothing
+                // captured. Never in a round's search scope; only the daemon's lesson
+                // selection reads cases.
+                caseWriter = new CaseWriter({
+                    store: d.store,
+                    outcomes: d.outcomes,
+                    memory,
+                    repo: cfg.github.repo,
+                    botLogin: cfg.github.bot_login,
+                    healthy: () => health.currentState() === "healthy",
+                    // No case batch starts while a review round reads memory (its seed,
+                    // its lesson selection); every batch sent reports its embedding
+                    // tail there, which a seed that starts inside it waits out (within
+                    // its own budget).
+                    rounds: roundActivity,
+                    embedTailMsPerCase: cfg.memory.case_embed_tail_ms,
+                    // While a review round runs or is queued to dispatch,
+                    // the backfill, the late activity and history cases wait.
+                    reviews: () => reviewsInFlight(d.store),
+                    read: adapter,
+                    log,
+                    intervalMs: Math.max(10, cfg.memory.cases_interval_s) * 1000,
+                    backfillDays: Math.max(0, cfg.memory.cases_backfill_days),
+                });
+                caseWriter.start();
+                // The learner: state.db and the base clone's git in,
+                // candidates and the EOD packet out; it reads the lessons in force
+                // through the same store (only while memory reads healthy) and never
+                // writes memory — the curator does, with `viking_write`'s typed
+                // `lesson` (vendored patch 0010).
+                learner = new Learner({
+                    store: d.store,
+                    root,
+                    eodTime: cfg.eod.time,
+                    timeZone: cfg.eod.timezone,
+                    botLogin: cfg.github.bot_login,
+                    baseBranch: cfg.github.base_branch,
+                    config: learnerKnobsOf(cfg.memory),
+                    git: sessions.worktrees,
+                    lessons: memory,
+                    healthy: () => health.currentState() === "healthy",
+                    wake: (kind, detail, message) => d.store.logAnomaly(kind, null, null, detail, message),
+                    log,
+                });
+                learner.start();
+            }
+            // The archiver. Its eligibility asks which workers run (leases the
+            // process table confirms; unknown holds, never "none") and the session
+            // manager which births are in flight; its holds read the daemon's own
+            // load watch.
+            archiver = new Archiver({
+                store: d.store,
+                cfg: cfg.archive,
+                root,
+                sessionsRoot: sessions.sessionsRoot(),
+                firstHealthyReconcileAt: () => d.firstHealthyReconcileAt(),
+                load: () => d.load.status(),
+                starvedRatio: eventLoopPolicy(cfg.daemon).starvedRatio,
+                liveSessions: async () => workerLive.liveSessions(),
+                birthInFlight: (pr) => workerWorld.host.birthInFlight(pr),
+                // The stores that belong to no PR. The overseer is gone, so its
+                // transcripts have no current file to protect and no birth record
+                // (unknown = nothing moves); pi's global store lies under the
+                // container user's home.
+                piGlobalDir: piGlobalSessionsDir(),
+                log,
+            });
+            archiver.start();
+            if (cfg.login_refresh.enabled) {
+                loginRefresh = new LoginRefreshSupervisor({
+                    repoRoot: root,
+                    agentDir,
+                    marginMin: cfg.login_refresh.margin_min,
+                    log,
+                    // One anomaly per failure episode, through the one durable funnel.
+                    raiseAnomaly: (detail) => d.store.logAnomaly("login_refresh_failed", null, null, detail),
+                });
+                loginRefresh.start();
+            }
+            // A reopened PR's archive comes back before its session is born:
+            // both birth paths await this, bounded, and never refuse the birth.
+            const archiveRef = archiver;
+            workerWorld.host.setBeforeBirth((pr) => archiveRef.beforeBirth(pr));
+            // The worker world comes up before anything asks which workers run: the socket,
+            // then whatever a previous daemon left reaped and requeued (a worker's round is
+            // resumed from its JSONL by a fresh one), then the timers. Nothing is adopted.
+            await workerWorld.start();
+            // Sweep stale worktrees. No tmux session is adopted: a PR with no worker
+            // is idle with its JSONL, and one a worker still runs for keeps its tree.
+            const active = d.store
+                .allPrs()
+                .filter((p) => p.state !== "closed")
+                .map((p) => p.number);
+            const inFlight = inFlightPrs(d.store, workerLive);
+            const pre = await sessions.preflight([...active, ...inFlight]);
+            log(`preflight: workers=${inFlight.join(",") || "none"} swept-worktrees=${pre.sweptWorktrees.join(",") || "none"}`);
+            // Rounds still marked running whose worker did not survive the restart
+            // are phantoms: cancel them, requeue the ones whose work was truly lost.
+            // A round whose finished review the outbox still owes GitHub is not one,
+            // nor is one whose round command still waits for the next worker.
+            const orphans = reconcileOrphanedRounds(d.store, inFlight, {
+                log,
+                postingOwed: orphanPostingOwed(join(root, "state", "posting-receipts"), cfg.dry_run, cfg.github.repo),
+            });
+            if (orphans.cancelled.length) {
+                log(`startup: cancelled orphaned rounds on #${orphans.cancelled.join(", #")}; requeued ${orphans.requeued.length}`);
+            }
+            // Overseer command files → validated execution (whitelist + caps).
+            const leverDeps = {
+                store: d.store,
+                levers: cfg.levers,
+                timezone: cfg.ops.timezone,
+            };
+            const commandDeps = {
+                async rerunRound(pr) {
+                    return recoverPrForOperator({ store: d.store, pump: () => d.pump(), workerRuns: (n) => workerLive.runs(n) }, pr, "rerun-round");
+                },
+                async restartSession(target, deliveryKey) {
+                    return recoverPrForOperator({
+                        store: d.store,
+                        deliveryKey,
+                        pump: () => d.pump(),
+                        // Returns only once the worker is reaped; one that outlives the kill
+                        // throws, which leaves ownership unchanged.
+                        killSession: (pr) => workerWorld.host.killSession(pr),
+                        workerRuns: (pr) => workerLive.runs(pr),
+                        // A fresh worker resumes the newest JSONL: rotate it away first.
+                        rotateSession: (pr) => workerWorld.host.rotateSession(pr),
+                    }, target, "restart-session");
+                },
+                resolveTerminalFailure(payload) {
+                    return resolveTerminalFailure({
+                        store: d.store,
+                        getPrDisposition: (pr) => adapter.getPrDisposition(pr),
+                    }, payload);
+                },
+                // The operator's round controls on a worker-hosted PR: steer, follow-up,
+                // abort, takeover, debug-round, release and the idle-PR message.
+                operatorControl: workerWorld.operatorControl,
+                // The two bounded levers: who is asking comes from the
+                // watcher's channel, and a session's hold is capped, budgeted and
+                // expiring in src/levers.ts — an operator's is not.
+                pausePr(pr, reason, issuer, forMin, deliveryKey) {
+                    return pauseLever({ ...leverDeps, deliveryKey }, pr, reason, issuer, forMin);
+                },
+                resumePr(pr, issuer) {
+                    return resumeLever(leverDeps, pr, issuer, () => d.pump());
+                },
+                flagOwner(message) {
+                    const flags = join(root, "state", "flags");
+                    mkdirSync(flags, { recursive: true });
+                    // owner.log; older entries live on in the legacy owner-legacy.log,
+                    // which nothing writes.
+                    appendFileSync(join(flags, "owner.log"), `${new Date().toISOString()} ${message}\n`);
+                    d.store.logEvent("flag_owner", null, { message });
+                    return { ok: true };
+                },
+                fileImprovementPr(payload, deliveryKey) {
+                    return fileImprovementPr(payload, {
+                        deliveryKey,
+                        cfg,
+                        adapter,
+                        gate,
+                        store: d.store,
+                        run: gitRun,
+                        // The reviewed repo's base clone — the one tree with `origin`
+                        // pointing at the reviewed repo and the session's branch in it.
+                        ensureRepoDir: () => sessions.worktrees.ensureBaseClone(),
+                    });
+                },
+                fileIssue(payload, deliveryKey) {
+                    return fileIssue(payload, { cfg, adapter, gate, store: d.store, deliveryKey });
+                },
+                retryThreadDecision(commentId) {
+                    return d.retryThreadDecision(commentId);
+                },
+                // The operator's lesson kill switch — reached only for a command the
+                // sealed commands/operator/ channel delivered (commands.ts refuses
+                // every other issuer, twice). State in state.db.
+                lessonSwitch(change, file) {
+                    if (!lessonLedger)
+                        return { ok: false, reason: "the lesson ledger is not built on this daemon yet" };
+                    const r = lessonLedger.apply(change, file);
+                    lessonStatusCache = null;
+                    // The validator's lesson addendum is composed only
+                    // while the kill switch is on — so flipping it rebuilds the agents,
+                    // the way a [feedback] comment does for its addendum. Suppressing
+                    // one lesson needs no rebuild: the selector reads it every round.
+                    // A rebuild that throws leaves the build stale: the 5-minute agents
+                    // tick retries it, and the answer says so rather than reading as
+                    // a validator already rebuilt.
+                    let rebuildFailed = false;
+                    if (r.changed && (change.action === "off" || change.action === "on")) {
+                        try {
+                            rebuildAgents();
+                        }
+                        catch (err) {
+                            rebuildFailed = true;
+                            log("lessons: agents rebuild after the kill switch flipped failed — the agents tick retries it", err);
+                        }
+                    }
+                    return {
+                        ok: true,
+                        changed: r.changed,
+                        ...(rebuildFailed
+                            ? { agents_rebuild: "failed — the 5-minute agents tick retries it" }
+                            : {}),
+                        lessons_off: r.lessons_off,
+                        suppressed: r.suppressed.length,
+                        ...("uri" in change ? { uri: change.uri } : {}),
+                    };
+                },
+                // The operator's archive verbs — reached only for a
+                // command the sealed commands/operator/ channel delivered (commands.ts
+                // refuses every other issuer, twice). Each runs under the archiver's
+                // strict mutex and answers within OPERATOR_WAIT_MS; `archiver` is read
+                // at call time, never captured at wiring.
+                archiveRun() {
+                    if (!archiver)
+                        return { ok: false, reason: "the archiver is not built on this daemon yet" };
+                    return archiver.operatorRun();
+                },
+                archiveRestore(pr) {
+                    if (!archiver)
+                        return { ok: false, reason: "the archiver is not built on this daemon yet" };
+                    return archiver.operatorRestore(pr);
+                },
+                // The EOD curator's receipt for the day's outcomes packet.
+                // `learner` is read at call time, never captured at wiring.
+                curationReceipt(receipt) {
+                    return routeCurationReceipt(learner, receipt);
+                },
+                // Deploy-window drain. On = the webhook answers 200 and drops, the
+                // pump starts nothing, recheck/ping-pong/EOD hold — in-flight rounds
+                // finish naturally. Off is the manual lift; the automatic one is the
+                // next boot's first healthy reconcile pass (daemon.ts) — except for
+                // the operator's HOLD, which only an explicit off lifts. Never touches
+                // GitHub, never goes near the gate.
+                drain(on, issuer, forMin, deliveryKey, hold) {
+                    return drainLever({ ...leverDeps, deliveryKey }, on, issuer, forMin, async () => {
+                        d.wakeThreadDecisions();
+                        await d.pump();
+                    }, hold === true);
+                },
+            };
+            // The Slack concierge. Off by default; when on it owns its own
+            // tier-checked command dir, the socket, and every unprompted post. It is
+            // started before the legacy watcher because that watcher borrows two
+            // things from it: the reply handler and the origin lookup.
+            slack =
+                (await startSlack({
+                    cfg,
+                    root,
+                    store: d.store,
+                    commandDeps,
+                    writeInbox,
+                    origins,
+                    log,
+                    version: packageVersion(root),
+                    ...(previousStatus !== undefined ? { previousStatus } : {}),
+                })) ?? null;
+            if (slack)
+                log("slack: concierge live (socket mode; commands/slack tier-checked)");
+            commands = buildLocalCommandWatcher({
+                root,
+                deps: commandDeps,
+                store: d.store,
+                slack,
+                log: (l) => log(l),
+            });
+            await commands.start();
+            operatorCommands = buildOperatorCommandWatcher({
+                root,
+                deps: commandDeps,
+                store: d.store,
+                slack,
+                log: (l) => log(l),
+            });
+            await operatorCommands.start();
+            // Webhook-URL self-heal: only under the tunnel-file ingress shape. The
+            // gated PATCH rides the app-self-config class, so it executes even in
+            // dry-run (AGENTS.md invariant 6) — loudly.
+            if (cfg.ingress.shape === "tunnel-file") {
+                webhookHeal = new WebhookHealer({
+                    hostnameFile: ingressHostnameFile(cfg, root),
+                    readConfig: () => adapter.getAppWebhookConfig(),
+                    updateUrl: (newUrl, oldUrl) => adapter.updateOwnWebhookUrl(newUrl, oldUrl),
+                    logEvent: (kind, payload) => d.store.logEvent(kind, null, payload),
+                    anomaly: (detail) => d.store.logAnomaly("webhook_heal", null, null, detail, detail),
+                    log,
+                    debounceMs: cfg.ingress.debounce_ms,
+                    sweepIntervalMs: cfg.ingress.sweep_interval_s * 1000,
+                });
+                webhookHeal.start();
+                log(`webhookheal: watching ${ingressHostnameFile(cfg, root)} (ingress shape tunnel-file)`);
+            }
+            // Daemon-clock EOD ([eod]-timezone wall time; pi schedulers deliberately unused).
+            // Curation must never touch the owner's pinned entries. The watchdog
+            // fingerprints the pinned area around the sweep and raises an anomaly on
+            // any change. It wraps the inject rather than hooking inside
+            // the timer, so a broken watchdog can never skip the sweep.
+            const sweepSource = memorySweep;
+            pinWatch =
+                cfg.eod.pinned_watchdog && sweepSource
+                    ? startEodPinWatch({
+                        readPinned: readPinnedFromSweep(sweepSource),
+                        logAnomaly: (kind, pr, reason, detail, injectMessage) => d.store.logAnomaly(kind, pr, reason, detail, injectMessage),
+                        timeZone: cfg.eod.timezone,
+                        digestReady: (date) => digestWritten(date, join(root, "digest")),
+                        windowMin: cfg.eod.pinned_watchdog_window_min,
+                        log,
+                    })
+                    : null;
+            // The sweep is one inbox item per day: the companion's TUI pulls it and
+            // runs it, so with the companion off it runs late, never not at all.
+            const injectEod = inbox.eodWriter();
+            eod = startEodTimer({
+                timeHHMM: cfg.eod.time,
+                timeZone: cfg.eod.timezone,
+                readPrompt: promptReader(join(root, "prompts", "eod-sweep.md")),
+                identity,
+                // The day's cancellation summary rides the sweep prompt so the
+                // digest actually mentions cancellations (grouped, loud first, "none"
+                // explicit) — and the learner's outcomes packet, built here, at the
+                // fire (a mine first when the day's has not run) — whose pointer the
+                // digest carries and whose curation instructions render after the
+                // seed. A learner that throws costs the packet, never the sweep.
+                dayContext: async (date) => {
+                    const cancelled = eodDigestContext(d.store, date, cfg.eod.timezone);
+                    if (!learner)
+                        return cancelled;
+                    try {
+                        const prep = await learner.prepareEod(date);
+                        return { lines: `${cancelled}\n${prep.lines}`, curation: prep.curation };
+                    }
+                    catch (err) {
+                        log(`learner: the outcomes packet for ${date} failed`, err);
+                        return cancelled;
+                    }
+                },
+                onContextMissing: (date, why) => log(`EOD sweep for ${date}: its day context is missing — it goes out without it`, why),
+                // The curator learns the memory layout here — the seed is frozen and
+                // names only some areas.
+                ...(cfg.openviking.enabled ? { memoryLayout: MEMORY_LAYOUT_NOTE } : {}),
+                // The seed starts §1 from "Outcomes to curate" and closes it with the
+                // receipt, so a sweep the packet did not reach says why in that
+                // section instead of dropping it: no learner on this daemon, or a
+                // packet that failed or missed the wait.
+                noCuration: (date) => renderNoPacketSection(date, learner ? "unavailable" : "off"),
+                // Deploy-window drain: the sweep does not fire into a board being
+                // drained for a deploy — it is deferred: the day is persisted in
+                // state.db and fires once the drain lifts, across a restart too.
+                shouldHold: () => d.store.drainState().draining,
+                // One sweep at a time: while the pinned-area watch window of the
+                // last sweep is open, the next day (a deferred one above all — they
+                // queue back to back after a drain) waits behind it, so each window
+                // judges its own day's work under its own date.
+                sweepInFlight: () => pinWatch?.isOpen() === true,
+                deferred: {
+                    load: () => d.store.eodDeferredDates(),
+                    save: (dates) => d.store.recordEodDeferred(dates),
+                },
+                onDeferredStoreFailed: (op, dates, err) => log(`EOD owed-day ${op} failed${dates ? ` (owed: ${dates.join(", ") || "none"})` : ""} — scheduling continues in memory`, err),
+                onHeld: (date, why) => {
+                    d.store.logEvent(why === "draining" ? "eod_deferred_draining" : "eod_deferred_behind_sweep", null, { date });
+                    log(why === "draining"
+                        ? `EOD sweep for ${date} deferred — draining; it fires once the drain lifts`
+                        : `EOD sweep for ${date} deferred — an earlier sweep is still in flight; it fires after`);
+                },
+                onDeferredFire: (date) => {
+                    d.store.logEvent("eod_deferred_fired", null, { date });
+                    // An owed day — deferred behind a drain or an earlier sweep, or one
+                    // whose fire a restart interrupted — fires only once neither holds;
+                    // the timer does not say which owed it.
+                    log(`EOD sweep for ${date} firing — owed from a deferral or an interrupted fire; no drain or sweep holds it now`);
+                },
+                writeInbox: pinWatch ? pinWatch.wrapInject(injectEod) : injectEod,
+                onFire: (date) => {
+                    log(`EOD sweep written to the companion inbox for ${date}`);
+                    // The receipt for the day's packet is owed from now.
+                    learner?.eodFired(date);
+                },
+                onError: (err) => log("EOD inbox write failed (retried with backoff)", err),
+                // Three retries failed too: the day's curation did not happen.
+                onInjectFailed: (date, err, attempts) => {
+                    const why = err instanceof Error ? err.message : String(err);
+                    d.store.logAnomaly("eod_inject_failed", null, null, `EOD sweep for ${date} not written to the inbox after ${attempts} attempts: ${why.slice(0, 200)}`, [
+                        `EOD INBOX WRITE FAILED — the EOD sweep for ${date} could not be written to the companion inbox (${attempts} attempts, backed off).`,
+                        `Last error: ${why.slice(0, 300)}`,
+                        "That day's curation did not run: no digest, no lessons. Check the companion inbox directory and the state volume's free space, then re-run the sweep by hand if the day matters.",
+                    ].join("\n"));
+                },
+            });
+            log(`EOD timer armed for ${eod.nextFire().toISOString()}`);
+            // Daily heartbeat inbox item — same wall-clock machinery,
+            // morning slot. At most one boot catch-up if the daemon was down at the
+            // hour; the fired-date lives in the store, so restarts never double-fire.
+            heartbeat = startHeartbeat({
+                timeHHMM: cfg.eod.heartbeat_time,
+                timeZone: cfg.eod.timezone,
+                lastFired: () => d.store.lastHeartbeatDate(),
+                recordFired: (date) => d.store.recordHeartbeat(date),
+                writeInbox: inbox.heartbeatWriter(),
+                log,
+                onError: (err) => log("heartbeat injection failed", err),
+            });
+            log(`heartbeat armed for ${heartbeat.nextFire().toISOString()}`);
+            // Expire a stale same-day feedback addendum promptly on the
+            // ops-day change — a 5-minute string compare, so yesterday's items
+            // bite at most minutes into a new day, not an hour — and retries a
+            // rebuild that threw (a stale build) on the same day.
+            const dayCheck = setInterval(() => {
+                try {
+                    agentsDay.tick();
+                }
+                catch (err) {
+                    log("feedback: day-change agents rebuild failed", err);
+                }
+            }, 300_000);
+            dayCheck.unref?.();
+            intervals.push(dayCheck);
+        },
+        async onStop(reason = "shutdown") {
+            memoryHealth?.stop();
+            feedbackPump?.stop();
+            caseWriter?.stop();
+            learner?.stop();
+            archiver?.stop();
+            // Workers end and their commands requeue; the socket closes.
+            try {
+                await workerWorld.stop();
+            }
+            catch (err) {
+                log("workers: shutdown failed", err);
+            }
+            if (loginRefresh) {
+                try {
+                    await loginRefresh.stop();
+                }
+                catch (err) {
+                    log("login refresh: shutdown failed", err);
+                }
+                loginRefresh = null;
+            }
+            // The lesson selections in flight. A shadow one is cut now and records
+            // nothing (`stop`): its budget — `shadow_budget_ms`, up to 20 s — does
+            // not fit docker's 10 s stop grace beside the server's own 5 s, and a
+            // record cut short by our stop would read as the engine's. An awaited
+            // one (`on`) is not cut: it settles within `delivery_budget_ms`
+            // (≤ 2 s); let it record before the server and the store go. The wait
+            // follows that budget, never the shadow one.
+            if (lessonSelector) {
+                const selector = lessonSelector;
+                lessonSelector = null;
+                selector.stop();
+                await Promise.race([
+                    selector.idle(),
+                    new Promise((r) => setTimeout(r, cfg.memory.delivery_budget_ms + 500).unref?.()),
+                ]);
+            }
+            for (const t of intervals)
+                clearInterval(t);
+            intervals.length = 0;
+            eod?.stop();
+            // Its open window polls the pinned area; drop it before the server goes.
+            pinWatch?.stop();
+            heartbeat?.stop();
+            commands?.stop();
+            operatorCommands?.stop();
+            webhookHeal?.stop();
+            webhookHeal = null;
+            reembed?.stop();
+            reembed = null;
+            // SIGTERM then SIGKILL after a bounded grace — a memory engine must not
+            // be able to hold the daemon's exit open.
+            if (openviking) {
+                try {
+                    await openviking.stop();
+                }
+                catch (err) {
+                    log("openviking: shutdown failed", err);
+                }
+                openviking = null;
+            }
+            // After the server: it may still be vectorizing on its way down.
+            if (localEmbedder) {
+                try {
+                    await localEmbedder.stop();
+                }
+                catch (err) {
+                    log("openviking: local embedder shutdown failed", err);
+                }
+                localEmbedder = null;
+            }
+            // Runs before the store closes, so the goodbye is ledgered; bounded by
+            // the announcer itself, so it can never delay the exit.
+            if (slack) {
+                try {
+                    await slack.stop(reason);
+                }
+                catch (err) {
+                    log("slack: shutdown failed", err);
+                }
+                slack = null;
+            }
+        },
+    });
+    // Posting-time guards live on the gate, so every posting route in
+    // the daemon — session review, approval path, migration pre-check comment —
+    // passes through them. They need the store, which only exists once the
+    // daemon has been built; hence the setter here rather than in buildParts().
+    gate.setGuard(makePostingGuard({
+        store: daemon.store,
+        adapter,
+        botLogin: cfg.github.bot_login,
+        guards: cfg.guards,
+        log,
+    }));
+    return daemon;
+}
+async function main() {
+    // Where this daemon runs, asked once before anything is assembled: outside
+    // the release image it warns, and with no Docker its memory is off.
+    const root = sandboxRoot();
+    const loaded = loadConfig();
+    const daemon = createProductionDaemon(buildParts(root, loaded, hostFacts(root, loaded.openviking.enabled)));
+    const shutdown = (sig) => {
+        void (async () => {
+            console.log(`[quickreviewd] ${sig} — shutting down`);
+            await daemon.stop(sig);
+            process.exit(0);
+        })();
+    };
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    try {
+        await daemon.start();
+    }
+    catch (err) {
+        // A failed boot (onStart is fatal — daemon.ts) exits non-zero after an
+        // orderly stop, so the container's restart policy retries it rather than
+        // leaving a half-assembled daemon serving reviews without its watchers.
+        console.error("[quickreviewd] startup failed — exiting", err);
+        await daemon.stop("startup failed").catch(() => { });
+        process.exit(1);
+    }
+}
+if (process.argv[1]?.endsWith("wire.js")) {
+    void main();
+}
+//# sourceMappingURL=wire.js.map