@telora/daemon 0.22.13 → 0.22.42

package/dist/shell/heartbeat-metadata.d.ts

@@ -0,0 +1,91 @@
+import type { DaemonConfig } from '../types/index.js';
+import { computeBranchStatus, type BranchStatusPayload } from './branch-status.js';
+import { type ProductBranchConfig } from '../queries/products.js';
+import { type VersionDistance } from '../update/version-check.js';
+/** Injectable seam for buildBranchStatusByProduct (unit tests inject fakes). */
+export interface BranchStatusProducerDeps {
+    computeBranchStatus: typeof computeBranchStatus;
+    getBranchConfig: (productId: string) => Promise<ProductBranchConfig>;
+}
+/**
+ * Publish branch status per product ({ [productId]: BranchStatusPayload }),
+ * mirroring the verificationPostures shape. Each product's payload is
+ * computed against ITS OWN repository (configForProduct) with ITS OWN
+ * mainBranch/branchMonitors resolved from its own product record — the root
+ * config always mirrors products[0] and must never be used to describe the
+ * others. One product failing is non-fatal to the rest (its entry is omitted).
+ *
+ * Exported (with injectable deps) so tests can pin the per-product claims
+ * without module mocks; doHeartbeat calls it with the real dependencies.
+ */
+export declare function buildBranchStatusByProduct(config: DaemonConfig, deps?: BranchStatusProducerDeps): Promise<Record<string, BranchStatusPayload>>;
+/** The versionLag heartbeat field shape (running-vs-latest lag). */
+export interface VersionLagField {
+    running: string;
+    latest: string;
+    /** The registry the `latest` reading was consulted from, or null when unknown
+     *  (no reading yet / legacy). Names WHICH registry the reading came from. */
+    registry: string | null;
+    /**
+     * True only when the reading is ATTRIBUTABLE to the registry npm resolves for
+     * an install -- only then are behind/distance a trustworthy measurement. When
+     * false the field is UNMEASURED: the platform must NOT read behind:false as
+     * "in sync" (it may be agreement against the wrong registry -- the mars
+     * false-negative). Silence (no field) means no reading yet; measured:false
+     * means a reading exists but cannot be attributed to the install registry.
+     */
+    measured: boolean;
+    /** True when `latest` is strictly newer than `running`. */
+    behind: boolean;
+    distance: VersionDistance;
+}
+/**
+ * Build the versionLag metadata field: the running daemon vs the install
+ * registry's latest. Returns null when it cannot be computed (latest unknown, or
+ * the running version unstamped) so the key is simply absent; `behind:false` when
+ * the daemon is current. Carries the registry the reading came from and whether
+ * it is attributable to `installRegistry` (the registry npm resolves for an
+ * install) -- an unattributable reading is measured:false (UNMEASURED), never a
+ * silent false "in sync". The fields make a fix that has SHIPPED but is not
+ * RUNNING distinguishable from one that is running -- the mars 0.22.4-vs-0.22.13
+ * incident, visible from the platform without host access. Pure + testable.
+ */
+export declare function buildVersionLagField(running: string, latest: string | null, readingRegistry: string | null, installRegistry: string): VersionLagField | null;
+/** Version-observability state performHeartbeat samples from the daemon module. */
+export interface HeartbeatVersionState {
+    daemonVersion: string;
+    daemonCommitSha: string;
+    latestAvailableVersion: string | null;
+    latestAvailableRegistry: string | null;
+    installRegistry: string;
+}
+/**
+ * Assemble the heartbeat metadata object (version observability, verification
+ * postures, available backends, branch status, focus-scoped fields, health
+ * events, read-only mode). Split out of heartbeat.ts (at its file-size floor);
+ * the daemon's volatile version state and the two heartbeat-internal helpers
+ * (focus-scoped fields, read-only field) are passed in so this stays a pure
+ * composer with no back-import into the hot-path module. No behavior change.
+ */
+export declare function buildHeartbeatMetadata(args: {
+    cfg: DaemonConfig;
+    version: HeartbeatVersionState;
+    probeBackends: (cfg: DaemonConfig) => Promise<unknown>;
+    buildBranchStatus: (cfg: DaemonConfig) => Promise<Record<string, BranchStatusPayload>>;
+    applyFocusScopedMetadata: (metadata: Record<string, unknown>) => void;
+    readOnlyMetadataField: () => Record<string, unknown> | null;
+}): Promise<Record<string, unknown>>;
+/** One mechanism's heartbeat falsifiability reading. */
+export interface SupervisionFiringRate {
+    total: number;
+    falsePositives: number;
+    falsePositiveRate: number | null;
+    /** True when the mechanism is DEMOTED to observe-only (zero true positives over
+     *  a meaningful sample): it still records firings but its action sites no longer
+     *  kill/hold/respawn (enforced via isMechanismDemoted). The visible half of the
+     *  block-to-observe policy -- the demotion IS the reading (AC/FRT #10). */
+    demotionRecommended: boolean;
+}
+/** Per-mechanism falsifiability reading (rate + demotion recommendation) from the store. */
+export declare function buildSupervisionFiringRates(): Record<string, SupervisionFiringRate>;
+//# sourceMappingURL=heartbeat-metadata.d.ts.map

package/dist/shell/heartbeat-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat-metadata.d.ts","sourceRoot":"","sources":["../../src/shell/heartbeat-metadata.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAA4B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAA0D,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAoB1H,gFAAgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IAChD,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,wBAGL,GACA,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAc9C;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;iFAC6E;IAC7E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,eAAe,EAAE,MAAM,GACtB,eAAe,GAAG,IAAI,CAUxB;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,iBAAiB,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,qBAAqB,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC7D,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsEnC;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;+EAG2E;IAC3E,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,IAAI,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAYnF"}

package/dist/shell/heartbeat-metadata.js

@@ -0,0 +1,169 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/shell/heartbeat-per-product-branch-status.test.ts,
+//   packages/daemon/src/shell/heartbeat-version-lag.test.ts,
+//   packages/daemon/src/shell/supervision-firing-rates.test.ts
+// PINNED-BY-END
+/**
+ * Heartbeat metadata builders.
+ *
+ * Pure/near-pure producers of individual heartbeat metadata fields, split out of
+ * heartbeat.ts (which sits at its file-size floor) so a new field can be added
+ * without growing the hot-path module. Each builder is independently testable;
+ * doHeartbeat composes them into the metadata object.
+ */
+import { healthEvents } from '@telora/daemon-core';
+import { configForProduct } from './config.js';
+import { computeBranchStatus } from './branch-status.js';
+import { getProductBranchConfig } from '../queries/products.js';
+import { isNewerVersion, versionDistance, isReadingAttributable } from '../update/version-check.js';
+import { buildProductPostureMap } from '../verify/verification-config.js';
+import { firingMechanisms, firingStats, isDemotionRecommended } from '../completion/supervision-firing-record.js';
+// ── Product branch config cache (per product) ────────────────────────
+const branchConfigCache = new Map();
+const BRANCH_CONFIG_REFRESH_MS = 300_000; // 5 minutes
+/** Fetch (with 5-minute cache) the branch config for one product. */
+async function getCachedBranchConfig(productId) {
+    const now = Date.now();
+    const cached = branchConfigCache.get(productId);
+    if (cached && now - cached.fetchedAt <= BRANCH_CONFIG_REFRESH_MS) {
+        return cached.config;
+    }
+    const fresh = await getProductBranchConfig(productId);
+    branchConfigCache.set(productId, { config: fresh, fetchedAt: now });
+    return fresh;
+}
+/**
+ * Publish branch status per product ({ [productId]: BranchStatusPayload }),
+ * mirroring the verificationPostures shape. Each product's payload is
+ * computed against ITS OWN repository (configForProduct) with ITS OWN
+ * mainBranch/branchMonitors resolved from its own product record — the root
+ * config always mirrors products[0] and must never be used to describe the
+ * others. One product failing is non-fatal to the rest (its entry is omitted).
+ *
+ * Exported (with injectable deps) so tests can pin the per-product claims
+ * without module mocks; doHeartbeat calls it with the real dependencies.
+ */
+export async function buildBranchStatusByProduct(config, deps = {
+    computeBranchStatus,
+    getBranchConfig: getCachedBranchConfig,
+}) {
+    const branchStatusByProduct = {};
+    for (const product of config.products) {
+        try {
+            const productConfig = configForProduct(config, product);
+            const branchConfig = await deps.getBranchConfig(product.id);
+            const branchOpts = {
+                mainBranch: branchConfig.mainBranch,
+                branchMonitors: branchConfig.branchMonitors,
+            };
+            branchStatusByProduct[product.id] = deps.computeBranchStatus(productConfig, branchOpts);
+        }
+        catch { /* non-fatal — omit this product's entry */ }
+    }
+    return branchStatusByProduct;
+}
+/**
+ * Build the versionLag metadata field: the running daemon vs the install
+ * registry's latest. Returns null when it cannot be computed (latest unknown, or
+ * the running version unstamped) so the key is simply absent; `behind:false` when
+ * the daemon is current. Carries the registry the reading came from and whether
+ * it is attributable to `installRegistry` (the registry npm resolves for an
+ * install) -- an unattributable reading is measured:false (UNMEASURED), never a
+ * silent false "in sync". The fields make a fix that has SHIPPED but is not
+ * RUNNING distinguishable from one that is running -- the mars 0.22.4-vs-0.22.13
+ * incident, visible from the platform without host access. Pure + testable.
+ */
+export function buildVersionLagField(running, latest, readingRegistry, installRegistry) {
+    if (!latest || running === 'unknown')
+        return null;
+    return {
+        running,
+        latest,
+        registry: readingRegistry,
+        measured: isReadingAttributable(readingRegistry, installRegistry),
+        behind: isNewerVersion(latest, running),
+        distance: versionDistance(running, latest),
+    };
+}
+/**
+ * Assemble the heartbeat metadata object (version observability, verification
+ * postures, available backends, branch status, focus-scoped fields, health
+ * events, read-only mode). Split out of heartbeat.ts (at its file-size floor);
+ * the daemon's volatile version state and the two heartbeat-internal helpers
+ * (focus-scoped fields, read-only field) are passed in so this stays a pure
+ * composer with no back-import into the hot-path module. No behavior change.
+ */
+export async function buildHeartbeatMetadata(args) {
+    const { cfg, version, probeBackends, buildBranchStatus, applyFocusScopedMetadata, readOnlyMetadataField } = args;
+    const metadata = {};
+    if (version.daemonCommitSha !== 'unknown') {
+        metadata.commitSha = version.daemonCommitSha;
+    }
+    if (version.latestAvailableVersion) {
+        metadata.latestAvailableVersion = version.latestAvailableVersion;
+    }
+    // Version lag: the running daemon vs the install registry's latest, carried so
+    // a lagging host (a fix shipped but NOT running -- the mars 0.22.4-vs-0.22.13
+    // incident) is visible from the platform without host access. It names the
+    // registry the reading came from and marks measured:false (UNMEASURED) when the
+    // reading cannot be attributed to the install registry, so the platform never
+    // reads a false "in sync" against the wrong registry.
+    const versionLag = buildVersionLagField(version.daemonVersion, version.latestAvailableVersion, version.latestAvailableRegistry, version.installRegistry);
+    if (versionLag) {
+        metadata.versionLag = versionLag;
+    }
+    metadata.maxTotalSessions = cfg.maxTotalSessions;
+    // Publish per-product verification posture ({ [productId]: { posture, command } })
+    // so the web app's product settings can surface how each product's deliveries
+    // are gated -- posture is local daemon.json config the app cannot otherwise see.
+    // Declarative state, derived at read time; never an escalation.
+    metadata.verificationPostures = buildProductPostureMap(cfg.products, cfg.defaultVerification);
+    // Publish which engines are installed + authenticated on this host so the
+    // app's engine picker can grey out unavailable ones (probe is cached).
+    try {
+        metadata.availableBackends = await probeBackends(cfg);
+    }
+    catch { /* non-fatal -- omit availability rather than fail the heartbeat */ }
+    const branchStatusByProduct = await buildBranchStatus(cfg);
+    if (Object.keys(branchStatusByProduct).length > 0) {
+        metadata.branchStatus = branchStatusByProduct;
+    }
+    applyFocusScopedMetadata(metadata);
+    // Include health events in metadata for dashboard visibility
+    const events = healthEvents.getEvents();
+    if (events.length > 0) {
+        metadata.healthEvents = events;
+    }
+    // Surface read-only mode (schema-version gate, warn path) so the dashboard can
+    // mark stuck foci/deliveries and show the recovery path. The heartbeat is
+    // allowlisted in read-only mode, so this write always lands. Only emit when
+    // active -- in normal operation the key is absent.
+    const readOnlyField = readOnlyMetadataField();
+    if (readOnlyField) {
+        Object.assign(metadata, readOnlyField);
+    }
+    // Supervision falsifiability: the per-mechanism false-positive rate from the
+    // firing-record store, so a chronically-wrong kill/hold/respawn mechanism is a
+    // READING on the heartbeat -- not something a human hand-greps from the log
+    // after the cost is paid. Omitted (key absent) until a mechanism has fired.
+    const firingRates = buildSupervisionFiringRates();
+    if (Object.keys(firingRates).length > 0) {
+        metadata.supervisionFiringRates = firingRates;
+    }
+    return metadata;
+}
+/** Per-mechanism falsifiability reading (rate + demotion recommendation) from the store. */
+export function buildSupervisionFiringRates() {
+    const rates = {};
+    for (const mechanism of firingMechanisms()) {
+        const s = firingStats(mechanism);
+        rates[mechanism] = {
+            total: s.total,
+            falsePositives: s.falsePositives,
+            falsePositiveRate: s.falsePositiveRate,
+            demotionRecommended: isDemotionRecommended(mechanism),
+        };
+    }
+    return rates;
+}
+//# sourceMappingURL=heartbeat-metadata.js.map

package/dist/shell/heartbeat-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat-metadata.js","sourceRoot":"","sources":["../../src/shell/heartbeat-metadata.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,oFAAoF;AACpF,6DAA6D;AAC7D,+DAA+D;AAC/D,gBAAgB;AAEhB;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAsD,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAwB,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAElH,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA8D,CAAC;AAChG,MAAM,wBAAwB,GAAG,OAAO,CAAC,CAAC,YAAY;AAEtD,qEAAqE;AACrE,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,wBAAwB,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACtD,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAoB,EACpB,OAAiC;IAC/B,mBAAmB;IACnB,eAAe,EAAE,qBAAqB;CACvC;IAED,MAAM,qBAAqB,GAAwC,EAAE,CAAC;IACtE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAwB;gBACtC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,cAAc,EAAE,YAAY,CAAC,cAAc;aAC5C,CAAC;YACF,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC,CAAC,2CAA2C,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,MAAqB,EACrB,eAA8B,EAC9B,eAAuB;IAEvB,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO;QACL,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,qBAAqB,CAAC,eAAe,EAAE,eAAe,CAAC;QACjE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;QACvC,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC;KAC3C,CAAC;AACJ,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAO5C;IACC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;IACjH,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACnC,QAAQ,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IACnE,CAAC;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,UAAU,GAAG,oBAAoB,CACrC,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,sBAAsB,EAC9B,OAAO,CAAC,uBAAuB,EAC/B,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACnC,CAAC;IACD,QAAQ,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IAEjD,mFAAmF;IACnF,8EAA8E;IAC9E,iFAAiF;IACjF,gEAAgE;IAChE,QAAQ,CAAC,oBAAoB,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAE9F,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC;QACH,QAAQ,CAAC,iBAAiB,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC,CAAC,mEAAmE,CAAC,CAAC;IAE/E,MAAM,qBAAqB,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,YAAY,GAAG,qBAAqB,CAAC;IAChD,CAAC;IAED,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEnC,6DAA6D;IAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,aAAa,GAAG,qBAAqB,EAAE,CAAC;IAC9C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzC,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,WAAW,GAAG,2BAA2B,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,sBAAsB,GAAG,WAAW,CAAC;IAChD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAcD,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,mBAAmB,EAAE,qBAAqB,CAAC,SAAS,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/shell/heartbeat.d.ts

@@ -3,8 +3,7 @@ import { sendHeartbeat, sendDisconnect } from '../queries/daemon-connection.js';
 import { type RetentionBeatObservation, type RetirementPreconditionVerdict } from '../drift/retention-observation.js';
 import { recordSessionCompleted, recordActivity, getLastActivityAt } from './agent-state.js';
 import type { ReadOnlyModeState } from '@telora/daemon-core';
-import { computeBranchStatus, type BranchStatusPayload } from './branch-status.js';
-import { type ProductBranchConfig } from '../queries/products.js';
+import { type BranchStatusPayload } from './branch-status.js';
 /**
  * Compute a stable, display-meaningful repo identity from a product set: the
  * sorted, deduplicated basenames of each product's repo path, joined by ', '.
@@ -55,10 +54,13 @@ export declare function getVersions(): {
     daemon: string;
 };
 /**
- * Store the latest available version from the npm registry.
- * Called by the version check module after a successful registry query.
+ * Store the latest available version from the npm registry, plus the registry it
+ * was read from. The registry lets the heartbeat ATTRIBUTE the reading to the
+ * install registry so a lagging host cannot publish a false "in sync" against the
+ * wrong registry (the mars false-negative). Called by the version check module
+ * after a successful registry query.
  */
-export declare function setLatestAvailableVersion(version: string): void;
+export declare function setLatestAvailableVersion(version: string, registry?: string): void;
 export { recordSessionCompleted };
 /**
  * Record a completed issue (called when an issue transitions to Done).
@@ -77,23 +79,6 @@ export declare function recordIssueCompleted(): void;
 export declare function readOnlyMetadataField(): {
     readOnlyMode: ReadOnlyModeState;
 } | null;
-/** Injectable seam for buildBranchStatusByProduct (unit tests inject fakes). */
-export interface BranchStatusProducerDeps {
-    computeBranchStatus: typeof computeBranchStatus;
-    getBranchConfig: (productId: string) => Promise<ProductBranchConfig>;
-}
-/**
- * Publish branch status per product ({ [productId]: BranchStatusPayload }),
- * mirroring the verificationPostures shape. Each product's payload is
- * computed against ITS OWN repository (configForProduct) with ITS OWN
- * mainBranch/branchMonitors resolved from its own product record — the root
- * config always mirrors products[0] and must never be used to describe the
- * others. One product failing is non-fatal to the rest (its entry is omitted).
- *
- * Exported (with injectable deps) so tests can pin the per-product claims
- * without module mocks; doHeartbeat calls it with the real dependencies.
- */
-export declare function buildBranchStatusByProduct(config: DaemonConfig, deps?: BranchStatusProducerDeps): Promise<Record<string, BranchStatusPayload>>;
 /**
  * Pure presence-gap detector for the heartbeat.
  *

package/dist/shell/heartbeat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../src/shell/heartbeat.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAIL,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAA0C,sBAAsB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAOrI,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAA4B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAsF1F;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAC5C,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAErD;AAOD;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEhE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpD;AAGD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAmB7C;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAcD;;GAEG;AACH,wBAAgB,eAAe,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAuBxE;AA2CD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7E;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAEhD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE/D;AAGD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,IAAI;IAAE,YAAY,EAAE,iBAAiB,CAAA;CAAE,GAAG,IAAI,CAGlF;AAiGD,gFAAgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IAChD,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,wBAGL,GACA,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAc9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,UAAU,EAAE,MAAM,GACjB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI1B;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,IAAI,SAAS,wBAAwB,EAAE,CAEnF;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,IAAI,6BAA6B,CAEhF;AAED,kEAAkE;AAClE,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,iBAAiB,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CACzB,IAAI,GAAE,eAIL,GACA,OAAO,CAAC,IAAI,CAAC,CAMf;AAyKD;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAiBpD;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,OAAO,cAAc,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,IAAI,GAAE,iBAAsC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../src/shell/heartbeat.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAIL,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAA0C,sBAAsB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAOrI,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAyF9D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAC5C,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAErD;AAOD;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEhE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpD;AAGD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAmB7C;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAcD;;GAEG;AACH,wBAAgB,eAAe,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAuBxE;AA2CD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7E;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAGlF;AAGD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,IAAI;IAAE,YAAY,EAAE,iBAAiB,CAAA;CAAE,GAAG,IAAI,CAGlF;AA4GD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,UAAU,EAAE,MAAM,GACjB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI1B;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,IAAI,SAAS,wBAAwB,EAAE,CAEnF;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,IAAI,6BAA6B,CAEhF;AAED,kEAAkE;AAClE,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,iBAAiB,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CACzB,IAAI,GAAE,eAIL,GACA,OAAO,CAAC,IAAI,CAAC,CAMf;AAsJD;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAiBpD;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,OAAO,cAAc,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,IAAI,GAAE,iBAAsC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/dist/shell/heartbeat.js

@@ -1,9 +1,7 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
 // Pinned by: packages/daemon/src/shell/activity-watchdog.test.ts,
 //   packages/daemon/src/shell/heartbeat-draining-status.test.ts,
-//   packages/daemon/src/shell/heartbeat-gap.test.ts,
-//   packages/daemon/src/shell/heartbeat-per-product-branch-status.test.ts,
-//   packages/daemon/src/shell/heartbeat-read-only.test.ts,
+//   packages/daemon/src/shell/heartbeat-gap.test.ts, packages/daemon/src/shell/heartbeat-read-only.test.ts,
 //   packages/daemon/src/shell/heartbeat-shutdown-guard.test.ts,
 //   packages/daemon/src/shell/heartbeat-stable-identity.test.ts,
 //   packages/daemon/src/shell/heartbeat-team-phases.test.ts,
@@ -31,16 +29,16 @@ import { sendHeartbeat, sendDisconnect } from '../queries/daemon-connection.js';
 import { getCompletedSessionAggregates } from '../queries/sessions.js';
 import { observeRetentionBeat, recordRetentionObservation, evaluateRetirementPrecondition, } from '../drift/retention-observation.js';
 import { getSessionCounters, setSessionCounters, recordSessionCompleted, recordActivity, getLastActivityAt } from './agent-state.js';
-import { getActiveTeamCount, buildTeamClockMap } from '../focus/focus-team-state.js';
+import { getActiveTeamCount, buildTeamClockMap, hasActiveTeam } from '../focus/focus-team-state.js';
+import { observeLivenessBadge } from '../completion/liveness-firing.js';
 import { checkClockDivergence } from './activity-clock-registry.js';
 import { buildTeamPhaseMap } from '../completion/team-phase.js';
 import { safeInterval, healthEvents, getReadOnlyModeState } from '@telora/daemon-core';
 import { isIntakeDraining } from './intake-control.js';
-import { buildProductPostureMap } from '../verify/verification-config.js';
-import { computeBranchStatus } from './branch-status.js';
-import { getProductBranchConfig } from '../queries/products.js';
-import { configForProduct } from './config.js';
 import { probeAllBackends } from '../backends/index.js';
+import { buildBranchStatusByProduct, buildHeartbeatMetadata } from './heartbeat-metadata.js';
+import { sweepAgedFirings, FIRING_SETTLE_WINDOW_MS } from '../completion/supervision-firing-record.js';
+import { resolveInstallRegistryUrl } from '../update/version-check.js';
 import { createLogger } from './log.js';
 const log = createLogger({ module: 'watchdog' });
 const HEARTBEAT_INTERVAL_MS = 60_000; // 60 seconds
@@ -82,21 +80,23 @@ let retentionObservationWindow = [];
 let daemonVersion = 'unknown';
 let daemonCommitSha = 'unknown';
 let latestAvailableVersion = null;
-const daemonStartedAt = new Date().toISOString();
-// ── Product branch config cache (per product) ────────────────────────
-const branchConfigCache = new Map();
-const BRANCH_CONFIG_REFRESH_MS = 300_000; // 5 minutes
-/** Fetch (with 5-minute cache) the branch config for one product. */
-async function getCachedBranchConfig(productId) {
+// The registry the latestAvailableVersion reading came from, for attribution.
+let latestAvailableRegistry = null;
+// Memoized install-registry resolution (npm config shells out): refreshed on a
+// long TTL so the 60s heartbeat does not spawn `npm config get` every beat.
+let installRegistryCache = null;
+const INSTALL_REGISTRY_TTL_MS = 300_000; // 5 minutes
+/** The registry npm resolves for an install, memoized for INSTALL_REGISTRY_TTL_MS. */
+function getInstallRegistryCached() {
     const now = Date.now();
-    const cached = branchConfigCache.get(productId);
-    if (cached && now - cached.fetchedAt <= BRANCH_CONFIG_REFRESH_MS) {
-        return cached.config;
+    if (installRegistryCache && now - installRegistryCache.at <= INSTALL_REGISTRY_TTL_MS) {
+        return installRegistryCache.url;
     }
-    const fresh = await getProductBranchConfig(productId);
-    branchConfigCache.set(productId, { config: fresh, fetchedAt: now });
-    return fresh;
+    const url = resolveInstallRegistryUrl();
+    installRegistryCache = { url, at: now };
+    return url;
 }
+const daemonStartedAt = new Date().toISOString();
 // ── Stable daemon repo identity ──────────────────────────────────────
 //
 // The heartbeat's `repo_path` field doubles as the key the edge handler
@@ -271,11 +271,15 @@ export function getVersions() {
     return { daemon: daemonVersion };
 }
 /**
- * Store the latest available version from the npm registry.
- * Called by the version check module after a successful registry query.
+ * Store the latest available version from the npm registry, plus the registry it
+ * was read from. The registry lets the heartbeat ATTRIBUTE the reading to the
+ * install registry so a lagging host cannot publish a false "in sync" against the
+ * wrong registry (the mars false-negative). Called by the version check module
+ * after a successful registry query.
  */
-export function setLatestAvailableVersion(version) {
+export function setLatestAvailableVersion(version, registry) {
     latestAvailableVersion = version;
+    latestAvailableRegistry = registry ?? null;
 }
 // Re-export recordSessionCompleted from agent-state for backward compatibility
 export { recordSessionCompleted };
@@ -323,6 +327,10 @@ function applyFocusScopedMetadata(metadata) {
     if (Object.keys(teamClocks).length > 0) {
         metadata.teamClocks = teamClocks;
     }
+    // Liveness-badge falsifiability: record when a team is executing+stale (the
+    // "unresponsive" signal) and classify it FP on recovery -- so the badge's known
+    // false positive (a legit park painted unresponsive) is a measured rate.
+    observeLivenessBadge({ teamPhases, teamClocks, isActive: hasActiveTeam, now: Date.now() });
     // Compare the in-memory activity clock (teamClocks, the clock the daemon acts
     // on) against the last SUCCESSFULLY-published clock per focus; a focus whose
     // in-memory clock has led the published one past the threshold surfaces an
@@ -331,36 +339,74 @@ function applyFocusScopedMetadata(metadata) {
     // metadata key is added here. Edge-triggered + quiet within threshold.
     checkClockDivergence(teamClocks);
 }
-/**
- * Publish branch status per product ({ [productId]: BranchStatusPayload }),
- * mirroring the verificationPostures shape. Each product's payload is
- * computed against ITS OWN repository (configForProduct) with ITS OWN
- * mainBranch/branchMonitors resolved from its own product record — the root
- * config always mirrors products[0] and must never be used to describe the
- * others. One product failing is non-fatal to the rest (its entry is omitted).
+/*
+ * HEARTBEAT METADATA CLASSIFICATION (audited 2026-07-26; full audit in
+ * docs/heartbeat-metadata-audit.md).
+ *
+ * THE RULE: every NEW metadata key or counter added here must be declared
+ * product-invariant or product-scoped. Product-scoped keys MUST be published
+ * as { [productId]: ... } maps (or carry per-entry product attribution) --
+ * the app matches a connection to a product via productIds.includes(productId)
+ * (src/hooks/queries/useDaemonConnections.ts), so ANY flat value is served
+ * verbatim to EVERY product this daemon manages. A flat product-scoped value
+ * is exactly the branchStatus misattribution bug, reborn under a new key.
+ *
+ * Classification of every key currently emitted:
  *
- * Exported (with injectable deps) so tests can pin the per-product claims
- * without module mocks; doHeartbeat calls it with the real dependencies.
+ *   metadata.commitSha              invariant  daemon build fact (one binary)
+ *   metadata.latestAvailableVersion invariant  npm registry fact about @telora/daemon
+ *   metadata.versionLag             invariant  running-vs-latest lag + the registry
+ *                                              the reading came from + measured
+ *                                              (attributed to the install registry);
+ *                                              the running daemon is one binary, so
+ *                                              its version lag is a process-global
+ *                                              fact (like commitSha /
+ *                                              latestAvailableVersion)
+ *   metadata.maxTotalSessions       invariant BY DESIGN  shared ResourceGovernor
+ *                                              spans all products; not a defect
+ *   metadata.verificationPostures   SCOPED     { [productId]: posture } map
+ *   metadata.availableBackends      invariant  host-level engine install+auth probe
+ *   metadata.branchStatus           SCOPED     { [productId]: BranchStatusPayload }
+ *                                              map, each computed via configForProduct
+ *   metadata.narrations             SCOPED     keyed by focusId (globally unique;
+ *                                              product attribution flows through
+ *                                              the focus) -- finer key than productId
+ *   metadata.teamPhases             SCOPED     { [focusId]: FocusLifecyclePhase }
+ *                                              map (same focusId key as narrations;
+ *                                              product attribution flows through
+ *                                              the focus)
+ *   metadata.teamClocks             SCOPED     { [focusId]: epochMs } map of the
+ *                                              per-team last-activity clock (same
+ *                                              focusId key as teamPhases; product
+ *                                              attribution flows through the focus)
+ *   metadata.healthEvents           MIXED      process events + product events;
+ *                                              product-scoped entries MUST set the
+ *                                              per-entry productId field
+ *   metadata.readOnlyMode           invariant  schema gate parks the whole process;
+ *                                              every product it serves is read-only
+ *
+ *   counters.activeSessions         invariant  active team count across all products
+ *   counters.inProgressIssues       invariant  same aggregate as activeSessions
+ *   counters.completedSessions      invariant BY CHOICE  bootstrapCountersFromDb
+ *   counters.completedIssues        invariant BY CHOICE  deliberately SUMS across
+ *   counters.totalTokensUsed        invariant BY CHOICE  products -- an aggregate,
+ *   counters.totalCost              invariant BY CHOICE  not a misattribution
+ *   counters.plannedIssues          invariant  placeholder (always 0)
+ *   counters.productId              legacy     mirrors products[0].id only; kept as
+ *                                              a matcher fallback for old rows
+ *   counters.productIds             invariant  the daemon's product scope -- this IS
+ *                                              the per-product match mechanism
+ *   counters.healthStatus           invariant  scalar derived from healthEvents;
+ *                                              note: product-scoped events fold into
+ *                                              it, so one product's warn degrades the
+ *                                              daemon-wide status (see audit doc)
+ *   counters.daemonStartedAt        invariant  process fact
+ *   counters.lastActivityAt         invariant  process fact
+ *   counters.eventLoopLagMs         invariant  process fact
+ *
+ * Known wart (documented, not fixed here): the repoPath positional arg to
+ * sendHeartbeat is basename(config.repoPath), i.e. products[0]'s repo only.
  */
-export async function buildBranchStatusByProduct(config, deps = {
-    computeBranchStatus,
-    getBranchConfig: getCachedBranchConfig,
-}) {
-    const branchStatusByProduct = {};
-    for (const product of config.products) {
-        try {
-            const productConfig = configForProduct(config, product);
-            const branchConfig = await deps.getBranchConfig(product.id);
-            const branchOpts = {
-                mainBranch: branchConfig.mainBranch,
-                branchMonitors: branchConfig.branchMonitors,
-            };
-            branchStatusByProduct[product.id] = deps.computeBranchStatus(productConfig, branchOpts);
-        }
-        catch { /* non-fatal — omit this product's entry */ }
-    }
-    return branchStatusByProduct;
-}
 /**
  * Pure presence-gap detector for the heartbeat.
  *
@@ -438,6 +484,11 @@ async function performHeartbeat(deps) {
     if (!config)
         return;
     const activeTeamCount = getActiveTeamCount();
+    // Settle sweep: a supervision firing that has stood past the settle window with
+    // no falsifying event (a re-ready focus for a teardown) is classified a true
+    // positive -- the prediction held. Runs on the beat cadence so the FP rate the
+    // heartbeat then publishes reflects a settled reading.
+    sweepAgedFirings({ olderThanMs: FIRING_SETTLE_WINDOW_MS });
     // Event loop watchdog: measure and check lag
     const eventLoopLagMs = getEventLoopLagMs();
     checkEventLoopLag(eventLoopLagMs);
@@ -449,44 +500,24 @@ async function performHeartbeat(deps) {
             `Active teams: ${activeTeamCount}. ` +
             `Last activity: ${lastActivity.toISOString()}`);
     }
-    // Build metadata with version observability fields
-    const metadata = {};
-    if (daemonCommitSha !== 'unknown') {
-        metadata.commitSha = daemonCommitSha;
-    }
-    if (latestAvailableVersion) {
-        metadata.latestAvailableVersion = latestAvailableVersion;
-    }
-    metadata.maxTotalSessions = config.maxTotalSessions;
-    // Publish per-product verification posture ({ [productId]: { posture, command } })
-    // so the web app's product settings can surface how each product's deliveries
-    // are gated -- posture is local daemon.json config the app cannot otherwise see.
-    // Declarative state, derived at read time; never an escalation.
-    metadata.verificationPostures = buildProductPostureMap(config.products, config.defaultVerification);
-    // Publish which engines are installed + authenticated on this host so the
-    // app's engine picker can grey out unavailable ones (probe is cached).
-    try {
-        metadata.availableBackends = await deps.probeBackends(config);
-    }
-    catch { /* non-fatal -- omit availability rather than fail the heartbeat */ }
-    const branchStatusByProduct = await deps.buildBranchStatus(config);
-    if (Object.keys(branchStatusByProduct).length > 0) {
-        metadata.branchStatus = branchStatusByProduct;
-    }
-    applyFocusScopedMetadata(metadata);
-    // Include health events in metadata for dashboard visibility
-    const events = healthEvents.getEvents();
-    if (events.length > 0) {
-        metadata.healthEvents = events;
-    }
-    // Surface read-only mode (schema-version gate, warn path) so the dashboard
-    // can mark stuck foci/deliveries and show the recovery path. The heartbeat
-    // is allowlisted in read-only mode, so this write always lands. Only emit
-    // when active -- in normal operation the key is absent.
-    const readOnlyField = readOnlyMetadataField();
-    if (readOnlyField) {
-        Object.assign(metadata, readOnlyField);
-    }
+    // Build metadata (version observability, postures, backends, branch status,
+    // focus-scoped fields, health events, read-only mode). Lives in
+    // heartbeat-metadata.ts; the version state and the two heartbeat-internal
+    // helpers (focus-scoped fields, read-only field) are passed in.
+    const metadata = await buildHeartbeatMetadata({
+        cfg: config,
+        version: {
+            daemonVersion,
+            daemonCommitSha,
+            latestAvailableVersion,
+            latestAvailableRegistry,
+            installRegistry: getInstallRegistryCached(),
+        },
+        probeBackends: deps.probeBackends,
+        buildBranchStatus: deps.buildBranchStatus,
+        applyFocusScopedMetadata,
+        readOnlyMetadataField,
+    });
     // Derive health_status from event buffer severity
     const healthStatus = healthEvents.getUnresolvedCount('error') > 0
         ? 'error'