@winspan/claude-forge 8.54.3 → 9.2.0

package/dist/daemon/index.js

@@ -8,29 +8,77 @@
  * 4. Create event handlers and start socket server
  * 5. Handle graceful shutdown
  */
+import { readFileSync } from 'node:fs';
 import { SocketServer } from './server.js';
-import { writePidFile, removePidFile, cleanSocket, getSocketPath, writeAuthToken, syncMcpToken, removeAuthToken, } from './lifecycle.js';
+import { writePidFile, removePidFile, cleanSocket, getSocketPath, writeAuthToken, syncMcpToken, removeAuthToken, isAnotherDaemonListening, } from './lifecycle.js';
 import { routeEvent } from './router.js';
-import { logger } from '../core/utils/logger.js';
+import { logger, enableFileLogging } from '../core/utils/logger.js';
 import { ConfigManager } from '../core/config.js';
 import { SQLiteStorage } from '../core/storage/sqlite.js';
 import { expandPath } from '../core/utils/path.js';
-import { ClaudeProvider } from '../core/ai/provider.js';
+// D R-A (2026-05-29): ClaudeProvider import removed — daemon no longer
+// instantiates ClaudeProvider at startup. SkillRegistry is now keyword-only
+// and takes no args. Provider file itself is deleted in D R-D.
+// See master spec 0902 §2.4.4 and src/skills/registry.ts (design rationale).
 import { TaskSegmenter } from './services/task-segmenter.js';
+import { TaskBoundaryClassifier } from './services/task-boundary-classifier.js';
+import { sweepIdleSessions } from './services/idle-session-sweeper.js';
+import { sweepInterceptTimeouts } from './services/intercept-timeout-sweeper.js';
+import { sweepEventTtl, resolveSweepConfig, DEFAULTS as TTL_DEFAULTS, } from './services/event-ttl-sweep.js';
 import { SkillRegistry } from '../skills/registry.js';
 import { InvocationGuard } from '../skills/invocation-guard.js';
 import { HistoryExporter } from './handlers/history-exporter.js';
 import { ResumeManager } from '../claudemd/resume-manager.js';
+import { ViolationsManager } from '../claudemd/violations-manager.js';
 import { ConventionExtractor } from '../claudemd/convention-extractor.js';
 import { UserPromptHandler } from './handlers/user-prompt.js';
 import { PostToolUseHandler } from './handlers/post-tool-use.js';
 import { StopHandler } from './handlers/stop.js';
+import { PreToolUseHandler } from './handlers/pre-tool-use.js';
+import { SpecApproval } from './services/spec-approval.js';
+import { RuleRegistry } from './rules/registry.js';
+import { assertWhitelistInvariants } from './rules/whitelist.js';
 import { syncHooks } from './hook-sync.js';
 import { syncSkills } from './skill-sync.js';
+import { syncAgents } from './agent-sync.js';
 import { replayQueue } from '../core/queue/index.js';
-import { DEFAULTS } from '../core/constants.js';
+import { DEFAULTS, FORGE_PATHS } from '../core/constants.js';
 import { getUserPrompt } from '../core/event-fields.js';
+// D-2: BuildManager is now lazy-loaded inside the `webEnabled` branch (L460-475)
+// so the daemon has zero static edges into `src/web/`. The previous
+// `import { buildManager } from '../web/services/build-manager.js'` lived here.
+import { ConfigStore } from './config-store.js';
+import { reviveInterceptIfStale } from './services/intercept-revive.js';
+import { startHeartbeat } from './services/heartbeat-writer.js';
+import { DECISION_MAKER_COOLDOWN_CONFIG_KEY, DEFAULT_DECISION_MAKER_COOLDOWN_SECONDS, MAX_DECISION_MAKER_COOLDOWN_SECONDS, } from './services/decision-hint.js';
+// F12: module-level mutex shared by all 3 maintenance setInterval handlers.
+// Prevents SQLite "database is locked" when sleep/wake fires multiple cron
+// timers in the same tick. Pure JS flag — single-threaded event loop keeps
+// check-and-set atomic.
+let isMaintenanceRunning = false;
 export async function startDaemon(foreground = false, options = {}) {
+    // ── 0pre. Anti-recursion guard ──────────────────────────────────────────────
+    // Refuse to boot a second daemon from inside an internal subprocess marked
+    // with CLAUDE_FORGE_INTERNAL=1. Guards against a misconfigured user hook
+    // accidentally invoking `cf daemon start` from a spawned child — otherwise
+    // we'd have two daemons fighting over the same socket. Defensive: nothing in
+    // the current codebase sets this env, but the check is cheap insurance.
+    if (process.env.CLAUDE_FORGE_INTERNAL === '1') {
+        console.error('[daemon] refusing to start under CLAUDE_FORGE_INTERNAL=1');
+        process.exit(0);
+    }
+    // ── 0a. File logging wire (Stage D, 2026-05-27) ────────────────────────────
+    // MUST be the first thing in startDaemon — before any logger.* call AND
+    // before the uncaughtException/unhandledRejection handlers (which log via
+    // `logger.error`). The default stderr-only sink is swallowed in detached
+    // production mode (stdout/stderr → /dev/null) and that's why subsystem
+    // startup lines (`[ConfigStore] Seeded N keys`, `[InterceptRevive] ...`,
+    // etc.) never landed on disk. The dev-daemon.sh wrapper hides this bug by
+    // shell-redirecting `2> daemon-dev.log` but real `cf daemon start` users
+    // see nothing. Skip when FORGE_DAEMON_DISABLE_FILE_LOG=1 (tests / CI).
+    if (process.env.FORGE_DAEMON_DISABLE_FILE_LOG !== '1') {
+        enableFileLogging(FORGE_PATHS.daemonLog());
+    }
     // ── 0. Global Exception Handlers ───────────────────────────────────────────
     process.on('uncaughtException', (err) => {
         logger.error(`[Daemon] Uncaught exception: ${err.message}`);
@@ -44,7 +92,55 @@ export async function startDaemon(foreground = false, options = {}) {
     // Log level is auto-parsed from LOG_LEVEL env var at logger module load time.
     const config = new ConfigManager().get();
     logger.info('Claude Forge daemon starting...');
+    // ── 1a. Deprecated env detection (spec 1851 R-A User Decisions Q7) ─────────
+    // The Phase B `CF_SKILL_DISTILLER_AGENT=1` toggle was removed in R-A; the
+    // env is now silently ignored. Warn users so they remove it from their rc
+    // / launchd plist before R-D removes the warning altogether.
+    if (process.env.CF_SKILL_DISTILLER_AGENT) {
+        logger.warn('[daemon] env CF_SKILL_DISTILLER_AGENT detected — this flag is deprecated ' +
+            'and has no effect. Distill now uses claude CLI shell-out unconditionally. ' +
+            'Please unset it from your shell rc / launchd plist.');
+    }
+    // ── 1.5. Whitelist self-test (Phase 2c safety-net) ────────────────────────
+    // Fail-fast at boot if the enforcement whitelist regresses — better than
+    // letting the user discover that `cf bypass` itself is denied on first use.
+    try {
+        assertWhitelistInvariants();
+        logger.debug('[Whitelist] self-test passed');
+    }
+    catch (err) {
+        logger.error(`[Whitelist] self-test FAILED: ${err}`);
+        throw err;
+    }
+    // ── 1.6. Global governance protocol injection (decision 7fa0f2ab) ─────────
+    // Idempotently write the DECISION HINT protocol contract into the global
+    // ~/.claude/CLAUDE.md so Claude in *other* projects knows to spawn
+    // decision-maker. Fail-silent: a write error here must never block daemon
+    // startup. Skip when FORGE_DAEMON_SKIP_GLOBAL_INJECT=1 (tests / CI).
+    if (process.env.FORGE_DAEMON_SKIP_GLOBAL_INJECT !== '1') {
+        try {
+            const { injectGlobalGovernance } = await import('../core/governance/global-inject.js');
+            const res = injectGlobalGovernance();
+            logger.debug(`[Governance] global inject ${res.action} (${res.path})`);
+        }
+        catch (err) {
+            logger.warn(`[Governance] global inject failed (continuing): ${err}`);
+        }
+    }
     // ── 2. Lifecycle (PID, socket, auth token) ─────────────────────────────────
+    // Single-instance guard (task-link orphan fix, 2026-06-02). MUST run BEFORE
+    // cleanSocket() — if a healthy daemon is already accepting on the socket, a
+    // second instance (typically launchd re-spawn after a prior EADDRINUSE crash)
+    // would otherwise unlink + re-bind the live socket, steal it, then die on the
+    // web port. That orphaned socket breaks every hook `nc` connect → events get
+    // queued instead of delivered and tasks freeze at "0 events". We exit 0
+    // (clean) so launchd's KeepAlive.SuccessfulExit=false does NOT immediately
+    // re-spawn us, breaking the 10s crash loop.
+    if (await isAnotherDaemonListening()) {
+        logger.warn('[Daemon] Another daemon is already listening on the socket — aborting ' +
+            'startup to avoid socket theft (single-instance guard). Exiting cleanly.');
+        process.exit(0);
+    }
     cleanSocket();
     writePidFile();
     const authToken = writeAuthToken();
@@ -54,6 +150,43 @@ export async function startDaemon(foreground = false, options = {}) {
     const dbPath = expandPath(config.storage.path);
     const storage = new SQLiteStorage(dbPath);
     logger.info(`Storage initialized: ${dbPath}`);
+    // ── 3.45. Seed feature-flag defaults (v9.x Phase 0) ───────────────────────
+    // Insert any missing flags from DEFAULT_FLAGS; user-edited values via
+    // `cf config set ...` are preserved (only writes when key is absent).
+    // ConfigStore is instantiated once here and shared with handlers that need
+    // to probe flags at request time (e.g. PreToolUseHandler).
+    const configStore = new ConfigStore(storage);
+    try {
+        const seeded = configStore.seedDefaults();
+        if (seeded > 0) {
+            logger.info(`[ConfigStore] Seeded ${seeded} default feature flag(s)`);
+        }
+        else {
+            logger.debug('[ConfigStore] All default feature flags already present');
+        }
+    }
+    catch (err) {
+        logger.warn(`[ConfigStore] seedDefaults failed: ${err}`);
+    }
+    // ── 3.46. Intercept Revive (8-in-1 Phase D, 2026-05-27) ───────────────────
+    // If `InterceptRollbackGuard` auto-disabled `pre_tool_intercept.enabled`
+    // more than 24h ago and the user never manually re-enabled it, flip it back
+    // on. Without this, the rollback guard is a one-way trap — the user has
+    // to remember to run `cf config set ...` which (per spec § Problem
+    // statement) they never did. Manual disables (no `auto_disabled_at` audit
+    // key) are left alone.
+    try {
+        const outcome = reviveInterceptIfStale(configStore);
+        if (outcome.revived) {
+            logger.info(`[InterceptRevive] ${outcome.reason}`);
+        }
+        else {
+            logger.debug(`[InterceptRevive] no-op: ${outcome.reason}`);
+        }
+    }
+    catch (err) {
+        logger.warn(`[InterceptRevive] startup call failed (non-fatal): ${err}`);
+    }
     // ── 3.5. Auto-sync hooks ────────────────────────────────────────────────
     // npm upgrade 不会自动更新 ~/.claude-forge/hooks/，每次 daemon 启动
     // 用 SHA-256 比对源 dist/hooks 与本地副本，不一致则覆盖。
@@ -63,57 +196,195 @@ export async function startDaemon(foreground = false, options = {}) {
     catch (err) {
         logger.warn(`[HookSync] unexpected error: ${err}`);
     }
-    // ── 3.6. Auto-sync official skills ─────────────────────────────────────
+    // ── 3.6. Auto-sync built-in distilled skills ───────────────────────────
     // npm upgrade 不会自动更新 ~/.claude/skills/，每次 daemon 启动
-    // 用 SHA-256 比对 dist/skills/official 与本地副本，不一致则覆盖。
+    // 用 SHA-256 比对 dist/skills/distilled 与本地副本，不一致则覆盖。
     try {
         syncSkills();
     }
     catch (err) {
         logger.warn(`[SkillSync] unexpected error: ${err}`);
     }
-    // ── 4. AI Provider ─────────────────────────────────────────────────────────
-    const apiKey = config.ai.api_key || process.env.ANTHROPIC_API_KEY || '';
-    if (!apiKey) {
-        logger.warn('No API key configured — AI features disabled');
+    // ── 3.7. Auto-sync project-specific agent prompts ───────────────────────
+    // npm upgrade / fresh npm install 不会自动填充 ~/.claude/agents/。每次 daemon
+    // 启动用 SHA-256 比对 dist/daemon/templates/agents/ 与本地副本，不一致则覆盖。
+    // 用户自己加的 my-*.md 不在 source list → 始终保留。
+    try {
+        syncAgents();
     }
-    const ai = apiKey
-        ? new ClaudeProvider(apiKey, config.ai.model, config.ai.base_url)
-        : null;
-    // ── 5. Initialize services ─────────────────────────────────────────────────
-    const skillApiKey = config.skill_matching?.api_key || apiKey;
-    const skillRegistry = new SkillRegistry(skillApiKey, config.ai.model, config.ai.base_url);
-    const invocationGuard = new InvocationGuard();
-    if (skillApiKey) {
-        logger.info('[Skills] Registry loaded with semantic matching support');
+    catch (err) {
+        logger.warn(`[AgentSync] unexpected error: ${err}`);
     }
-    else {
-        logger.info('[Skills] Registry loaded (keyword matching)');
+    // ── 4. AI Provider (DELETED — D R-A → R-D, 2026-05-29) ────────────────────
+    // The daemon used to instantiate a ClaudeProvider here for two reasons:
+    //   (a) emit `[AI Stats]` on shutdown (dead log — no consumers, removed)
+    //   (b) hand model/base_url to the (now-deleted) semantic skill matcher
+    // Master spec 0902 §2.4.4 (decision f5a5b030 / Option B 彻底) eliminates
+    // both: distill / claudemd / knowledge / patch now shell out to the
+    // `claude` CLI (sub-specs A/B/C R-B already landed). SkillRegistry is
+    // keyword-only. D R-D (this commit) deleted `src/core/ai/provider.ts`
+    // outright and the `ai.*` / `skill_matching.*` config schema.
+    // Design rationale for the keyword-only switch lives in
+    // `src/skills/registry.ts` (single source of truth — decision 3baa0e7c).
+    //
+    // Migration warn: if the user still has `ai:` or `skill_matching:` in the
+    // raw yaml, or `ANTHROPIC_API_KEY` exported, tell them it's deprecated and
+    // has no effect. We re-read the raw yaml here (rather than the typed
+    // `config`) because the schema no longer holds those fields.
+    try {
+        const rawCfg = readFileSync(FORGE_PATHS.config(), 'utf-8');
+        const legacyAiKey = /^\s*ai\s*:/m.test(rawCfg);
+        const legacySkillMatchKey = /^\s*skill_matching\s*:/m.test(rawCfg);
+        const legacyApiKeyEnv = !!process.env.ANTHROPIC_API_KEY;
+        if (legacyAiKey || legacySkillMatchKey || legacyApiKeyEnv) {
+            const sources = [];
+            if (legacyAiKey)
+                sources.push('config.ai.api_key');
+            if (legacySkillMatchKey)
+                sources.push('config.skill_matching.api_key');
+            if (legacyApiKeyEnv)
+                sources.push('ANTHROPIC_API_KEY env');
+            logger.warn(`[daemon] ${sources.join(' + ')} detected — these are deprecated ` +
+                'and have no effect after spec 0902 (decision f5a5b030). Distill / ' +
+                'claudemd / knowledge build / patch now use claude CLI shell-out, ' +
+                'and SkillRegistry is keyword-only. Remove from config.yaml + ' +
+                'shell rc to silence this warning.');
+        }
+    }
+    catch {
+        // No config.yaml or read error → nothing to warn about.
+    }
+    // ── 4.7. decision 7aa0ec63 (2026-06-01) — cooldown config validation ────
+    // If forge_config.decision_maker_cooldown_seconds is present but holds an
+    // out-of-range value (≤ 0 or > MAX_DECISION_MAKER_COOLDOWN_SECONDS) or a
+    // non-number, the resolver silently falls back to the default. Warn once at
+    // boot so the user notices typos instead of wondering why their override
+    // had no effect.
+    try {
+        const raw = storage.readConfig(DECISION_MAKER_COOLDOWN_CONFIG_KEY);
+        if (raw !== undefined && raw !== null) {
+            const n = Number(raw);
+            const invalid = !Number.isFinite(n) ||
+                n <= 0 ||
+                n > MAX_DECISION_MAKER_COOLDOWN_SECONDS;
+            if (invalid) {
+                logger.warn(`[daemon] forge_config.${DECISION_MAKER_COOLDOWN_CONFIG_KEY}=${String(raw)} ` +
+                    `is out of range (0, ${MAX_DECISION_MAKER_COOLDOWN_SECONDS}]; ` +
+                    `falling back to default ${DEFAULT_DECISION_MAKER_COOLDOWN_SECONDS}s. ` +
+                    `Set a valid value via \`cf config set ${DECISION_MAKER_COOLDOWN_CONFIG_KEY} <seconds>\`.`);
+            }
+        }
     }
+    catch (err) {
+        logger.debug(`[daemon] cooldown config probe failed (non-fatal): ${err}`);
+    }
+    // ── 5. Initialize services ─────────────────────────────────────────────────
+    // D R-B (spec 0902): SkillRegistry is keyword-only — no args. The legacy
+    // `skill_matching.api_key` field is silently ignored (warned above) and
+    // will be removed from the JSON schema in D R-D.
+    const skillRegistry = new SkillRegistry();
+    const invocationGuard = new InvocationGuard();
+    logger.info('[Skills] Registry loaded (keyword matching)');
     logger.info('[Skills] InvocationGuard ready (idempotent + depth/total limits)');
     const exporter = new HistoryExporter(storage);
     const resume = new ResumeManager(storage);
+    const violationsManager = new ViolationsManager();
     const conventionExtractor = new ConventionExtractor();
     const taskSegmenter = new TaskSegmenter(storage);
-    logger.info('[Services] Initialized: ResumeManager, TaskSegmenter, SkillRegistry');
+    // decision 265f59d5 (2026-06-08): async LLM boundary classifier. Fire-and-
+    // forget — NEVER awaited on the UserPromptSubmit hot path. Only spawns claude
+    // for prompts the sync segmenter flagged ambiguous (~30%).
+    const boundaryClassifier = new TaskBoundaryClassifier();
+    // Orphan-event robustness fix (2026-06-01): proactively rebuild the
+    // in-memory currentTasks map from the DB so events arriving right after a
+    // daemon restart (buffered + replayed) hit the fast currentTasks path
+    // instead of relying on per-event lazy recovery. Idempotent + fault-tolerant.
+    taskSegmenter.hydrateActiveTasks();
+    logger.info('[Services] Initialized: ResumeManager, ViolationsManager, TaskSegmenter, SkillRegistry');
+    // ── 5.45. Heartbeat writer (watchdog spec 0843) ───────────────────────────
+    // Writes ~/.claude-forge/daemon.heartbeat every 60s via atomic rename.
+    // Removed on graceful shutdown so ensure-running detects the gap.
+    let daemonVersion = 'unknown';
+    try {
+        const pkgUrl = new URL('../../package.json', import.meta.url);
+        const { createRequire } = await import('node:module');
+        const req = createRequire(import.meta.url);
+        const pkg = req(pkgUrl.pathname);
+        daemonVersion = pkg.version;
+    }
+    catch { /* version string is nice-to-have, not critical */ }
+    const heartbeatHandle = startHeartbeat({ version: daemonVersion });
+    logger.info('[Heartbeat] writer started (60s interval)');
     // ── 5.5. Schedule daily maintenance ────────────────────────────────────────
-    // Clean old fact-table data every 24 hours (events / routing / skills / tokens).
+    // Clean old fact-table data every 24 hours (events / routing / skills).
     const MAINTENANCE_INTERVAL = 24 * 60 * 60 * 1000; // 24 hours
     const maintenanceInterval = setInterval(() => {
-        logger.info('[Daemon] Running daily maintenance: cleaning old fact-table data');
+        if (isMaintenanceRunning) {
+            logger.warn('[Daemon] maintenance already running, skipping daily cron');
+            return;
+        }
+        isMaintenanceRunning = true;
         try {
-            const r = storage.cleanOldData(30);
-            logger.info(`[Daemon] cleanOldData: events=${r.events}, routing=${r.routing}, skills=${r.skills}, tokens=${r.tokens}`);
+            logger.info('[Daemon] Running daily maintenance: cleaning old fact-table data');
+            try {
+                const r = storage.cleanOldData(30);
+                logger.info(`[Daemon] cleanOldData: events=${r.events}, taskEvents=${r.taskEvents}, routing=${r.routing}, skills=${r.skills}`);
+            }
+            catch (err) {
+                logger.error(`[Daemon] Maintenance failed: ${err}`);
+            }
+            // Phase 9.5: sweep idle un-classified sessions (no Stop hook fired).
+            // Logs only when something actually moves, so the steady-state daily line
+            // stays quiet.
+            try {
+                const s = sweepIdleSessions(storage);
+                if (s.swept > 0 || s.errors > 0) {
+                    logger.info(`[Daemon] idleSweeper: scanned=${s.scanned} swept=${s.swept} errors=${s.errors}`);
+                }
+            }
+            catch (err) {
+                logger.error(`[Daemon] idleSweeper failed: ${err}`);
+            }
         }
-        catch (err) {
-            logger.error(`[Daemon] Maintenance failed: ${err}`);
+        finally {
+            isMaintenanceRunning = false;
         }
     }, MAINTENANCE_INTERVAL);
     logger.info('[Daemon] Scheduled daily maintenance (clean fact-table data older than 30 days)');
+    // Run initial cleanup 60s after startup (covers frequent-restart scenarios)
+    const initialCleanupTimeout = setTimeout(() => {
+        try {
+            const r = storage.cleanOldData(30);
+            const total = r.events + r.taskEvents + r.routing + r.skills;
+            if (total > 0) {
+                logger.info(`[Daemon] Initial cleanup: events=${r.events}, taskEvents=${r.taskEvents}, routing=${r.routing}, skills=${r.skills}`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[Daemon] Initial cleanup failed: ${err}`);
+        }
+        // Phase 9.5: also run an initial sweep at startup so frequent daemon
+        // restarts don't let abandoned sessions accumulate for a full day.
+        try {
+            const s = sweepIdleSessions(storage);
+            if (s.swept > 0 || s.errors > 0) {
+                logger.info(`[Daemon] Initial idleSweeper: scanned=${s.scanned} swept=${s.swept} errors=${s.errors}`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[Daemon] Initial idleSweeper failed: ${err}`);
+        }
+    }, 60_000);
+    initialCleanupTimeout.unref?.();
     // ── 5.5.1. Schedule weekly VACUUM (every 7 days) ───────────────────────────
     // VACUUM 重写整库，释放页空间。频率 7 天足以应对一般负载。
     const VACUUM_INTERVAL = 7 * 24 * 60 * 60 * 1000;
     const vacuumInterval = setInterval(() => {
+        if (isMaintenanceRunning) {
+            logger.warn('[Daemon] maintenance already running, skipping weekly VACUUM');
+            return;
+        }
+        isMaintenanceRunning = true;
         try {
             // 500 MB 阈值：低于此值不 VACUUM（避免空转的 fsync 抖动）。
             storage.runMaintenance(500);
@@ -121,28 +392,135 @@ export async function startDaemon(foreground = false, options = {}) {
         catch (err) {
             logger.error(`[Daemon] VACUUM failed: ${err}`);
         }
+        finally {
+            isMaintenanceRunning = false;
+        }
     }, VACUUM_INTERVAL);
     logger.info('[Daemon] Scheduled weekly VACUUM (threshold: 500MB)');
+    // ── 5.5.2. Event TTL sweep (db-size optimization 2026-05-26) ─────────────
+    // Two-tier sweep: warm = NULL `tool_input`, cold = DELETE row. Both bounds
+    // are configurable via forge_config (events.warm_ttl_days /
+    // events.cold_ttl_days / events.sweep_interval_hours). See
+    // src/daemon/services/event-ttl-sweep.ts for full design.
+    const ttlSweepCfg = resolveSweepConfig(configStore);
+    const ttlSweepIntervalHours = (() => {
+        const raw = configStore.get('events.sweep_interval_hours');
+        const n = raw === undefined ? TTL_DEFAULTS.sweepIntervalHours : Number(raw);
+        return Number.isFinite(n) && n > 0 ? n : TTL_DEFAULTS.sweepIntervalHours;
+    })();
+    const EVENT_TTL_INTERVAL = ttlSweepIntervalHours * 60 * 60 * 1000;
+    const eventTtlInterval = setInterval(() => {
+        if (isMaintenanceRunning) {
+            logger.warn('[Daemon] maintenance already running, skipping event TTL sweep');
+            return;
+        }
+        isMaintenanceRunning = true;
+        try {
+            const r = sweepEventTtl(storage, configStore);
+            if (r.warmedNull > 0 || r.coldDeleted > 0) {
+                logger.info(`[EventTTL] sweep: warmedNull=${r.warmedNull} coldDeleted=${r.coldDeleted} taskEventsPruned=${r.taskEventsPruned} morePending=${r.morePending}`);
+            }
+        }
+        catch (err) {
+            logger.error(`[EventTTL] sweep failed: ${err}`);
+        }
+        finally {
+            isMaintenanceRunning = false;
+        }
+    }, EVENT_TTL_INTERVAL);
+    logger.info(`[Daemon] Scheduled event TTL sweep every ${ttlSweepIntervalHours}h (warm=${ttlSweepCfg.warmTtlDays}d, cold=${ttlSweepCfg.coldTtlDays}d)`);
+    // Initial event TTL sweep ~90s after startup so frequent daemon restarts
+    // don't sit on backlog for a full interval. Skipped when isMaintenanceRunning
+    // is set (rare in practice but defensive).
+    const initialEventTtlTimeout = setTimeout(() => {
+        if (isMaintenanceRunning)
+            return;
+        isMaintenanceRunning = true;
+        try {
+            const r = sweepEventTtl(storage, configStore);
+            if (r.warmedNull > 0 || r.coldDeleted > 0) {
+                logger.info(`[EventTTL] initial sweep: warmedNull=${r.warmedNull} coldDeleted=${r.coldDeleted} taskEventsPruned=${r.taskEventsPruned}`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[EventTTL] initial sweep failed: ${err}`);
+        }
+        finally {
+            isMaintenanceRunning = false;
+        }
+    }, 90_000);
+    initialEventTtlTimeout.unref?.();
     // ── 5.6. Stale task GC (every 5 minutes) ──────────────────────────────────
     const STALE_TASK_GC_INTERVAL = 5 * 60 * 1000; // 5 分钟
     const STALE_TASK_IDLE_MINUTES = 10; // idle 超 10 分钟视为滞留
     const staleTaskGcInterval = setInterval(() => {
+        if (isMaintenanceRunning) {
+            logger.warn('[Maintenance] maintenance already running, skipping stale task GC');
+            return;
+        }
+        isMaintenanceRunning = true;
         try {
             const closed = storage.completeStaleActiveTasks(STALE_TASK_IDLE_MINUTES);
-            if (closed > 0) {
-                logger.info(`[Maintenance] Auto-completed ${closed} stale active task(s)`);
+            if (closed.length > 0) {
+                // decision c6613590 P0 缺陷 B: evict GC'd tasks from the segmenter's
+                // in-memory currentTasks map so no dangling pointer keeps dragging a
+                // closed task's end_time forward (which merged independent prompts).
+                const evicted = taskSegmenter.evictTasks(closed);
+                logger.info(`[Maintenance] Auto-completed ${closed.length} stale active task(s)` +
+                    ` (evicted ${evicted} from in-memory map)`);
             }
         }
         catch (err) {
             logger.error(`[Maintenance] Stale task GC failed: ${err}`);
         }
+        // C4 hotfix (2026-05-26): backfill NULL-outcome deny/dry_run rows that
+        // aged past the 1h grace beyond the 30s PostToolUse window. "Passive
+        // obey" — main thread saw the hint, stopped to think, never re-invoked
+        // any tool inside the classification window. Without this sweep the
+        // NULL rows persist forever, pinning the C4 numerator to 0.
+        try {
+            const s = sweepInterceptTimeouts(storage);
+            if (s.swept > 0) {
+                logger.info(`[Maintenance] InterceptTimeoutSweeper: swept ${s.swept} NULL → obeyed (passive obey)`);
+            }
+        }
+        catch (err) {
+            logger.error(`[Maintenance] InterceptTimeoutSweeper failed: ${err}`);
+        }
+        finally {
+            isMaintenanceRunning = false;
+        }
     }, STALE_TASK_GC_INTERVAL);
     // ── 6. Create handlers ─────────────────────────────────────────────────────
-    const userPromptHandler = new UserPromptHandler(resume, conventionExtractor, storage, skillRegistry);
+    // Phase 5: shared RuleRegistry so PreToolUse sees the same rule set.
+    const ruleRegistry = new RuleRegistry();
+    // ── 6.2. v9.x Phase 2b — Spec Approval ─────────────────────────────────
+    // SpecGenerator removed (Spec 1702: 0% real-world acceptance → dead code).
+    // SpecApproval retained for the hand-written path: planner agent calls
+    // `cf spec register`, user replies "批准 <token>" → daemon short-circuits.
+    const specApproval = new SpecApproval(storage);
+    // Spec 1200 (2026-05-28): IntentEngine + WorkflowRecommender removed.
+    // Decision 3baa0e7c Batch 1 (2026-06-01): deprecated `_workflowRecommender`
+    // and `_intentEngine` ctor positions cleaned up; specApproval now arg 5.
+    const userPromptHandler = new UserPromptHandler(resume, conventionExtractor, storage, skillRegistry, specApproval);
+    // Phase 1: PreToolUseHandler runs in dry_run mode unless
+    // `pre_tool_intercept.enabled` is flipped on via `cf config set`.
+    // Phase 5: same registry is shared so the workflow-recommendation-mismatch
+    // deny rule + pending_workflow_rec lookup work end-to-end.
+    //
+    // Constructed BEFORE StopHandler so the latter can receive it as its 8th
+    // arg for the D-1 clearSession wiring (memory-leak fix).
+    const preToolUseHandler = new PreToolUseHandler(storage, configStore, ruleRegistry);
     const handlers = {
         UserPromptSubmit: userPromptHandler,
-        PostToolUse: new PostToolUseHandler(storage),
-        Stop: new StopHandler(exporter, resume, taskSegmenter, storage, invocationGuard, userPromptHandler),
+        // Phase 6: configStore wired so agent_writeback.enabled flag is probed
+        // on every Write/Edit (default OFF; opt-in via `cf config set`).
+        PostToolUse: new PostToolUseHandler(storage, configStore),
+        Stop: new StopHandler(exporter, resume, taskSegmenter, storage, invocationGuard, userPromptHandler, violationsManager, 
+        // D-1: clearSession on PreToolUseHandler.editedFilesCache at Stop time
+        // (fixes per-session Set leak across long-running daemons).
+        preToolUseHandler),
+        PreToolUse: preToolUseHandler,
     };
     // ── 7. Event handler ───────────────────────────────────────────────────────
     const handleEvent = async (event) => {
@@ -165,15 +543,27 @@ export async function startDaemon(foreground = false, options = {}) {
             // Task segmentation: UserPromptSubmit starts/continues tasks
             const prompt = getUserPrompt(event);
             if (event.hook_type === 'UserPromptSubmit' && prompt) {
-                taskSegmenter.processPrompt(event.session_id, prompt, event.timestamp, event.event_id);
+                const decision = taskSegmenter.processPromptWithBoundary(event.session_id, prompt, event.timestamp, event.event_id);
+                // decision 265f59d5: ambiguous merge → hand off to the async LLM
+                // classifier. fire-and-forget: NOT awaited, never blocks the hook
+                // response. The classifier internally re-checks idempotency + the
+                // event's current FK before any re-attribution.
+                if (decision.ambiguous) {
+                    void boundaryClassifier.classify(decision.ambiguous, storage);
+                }
             }
             else if (event.event_id) {
-                taskSegmenter.linkEvent(event.session_id, event.event_id);
-            }
-            // PreToolUse: always allow (governance removed)
-            if (event.hook_type === 'PreToolUse') {
-                return { allow: true };
+                // Spec 1713 §10.3: forward hookType / toolName so the segmenter can
+                // detect sub-agent return (PostToolUse Task/Agent) and arm the
+                // "next prompt = new task" flag.
+                taskSegmenter.linkEvent(event.session_id, event.event_id, event.timestamp, {
+                    hookType: event.hook_type,
+                    toolName: event.tool_name,
+                });
             }
+            // PreToolUse / PostToolUse / UserPromptSubmit / Stop all routed via routeEvent.
+            // PreToolUse now goes through PreToolUseHandler (Phase 1 rule engine),
+            // which honors `pre_tool_intercept.enabled` flag (dry_run when OFF).
             const result = await routeEvent(event, handlers);
             if (result) {
                 const handlerName = event.hook_type + 'Handler';
@@ -217,7 +607,21 @@ export async function startDaemon(foreground = false, options = {}) {
     // setImmediate ensures the event loop has had a chance to process the listen
     // callback before we touch storage (not strictly required, but defensive).
     setImmediate(() => {
-        replayQueue(storage).then(({ replayed, skipped, dead }) => {
+        replayQueue(storage, {
+            // Mirror handleEvent line 480-484: feed replayed UserPromptSubmit events
+            // into TaskSegmenter so the tasks table gets populated. We do NOT route
+            // through full handleEvent — KB inject / decision-hint / skill-match
+            // would all be stale (no live hook is waiting on the response).
+            onReplayed: (event) => {
+                const prompt = getUserPrompt(event);
+                if (event.hook_type === 'UserPromptSubmit' && prompt) {
+                    taskSegmenter.processPrompt(event.session_id, prompt, event.timestamp, event.event_id);
+                }
+                else if (event.event_id) {
+                    taskSegmenter.linkEvent(event.session_id, event.event_id, event.timestamp);
+                }
+            },
+        }).then(({ replayed, skipped, dead }) => {
             if (replayed > 0 || skipped > 0 || dead > 0) {
                 logger.info(`[Queue] Replay: ${replayed} replayed, ${skipped} skipped (dup), ${dead} dead-lettered`);
             }
@@ -230,6 +634,13 @@ export async function startDaemon(foreground = false, options = {}) {
     const webEnabled = options.web ?? (process.env.FORGE_DAEMON_NO_WEB === '1' ? false : config.web.enabled);
     let webServer = null;
     if (webEnabled) {
+        // D-2: lazy-load BuildManager + WebServer so the daemon has zero static
+        // edges into `src/web/` (matches the documented core ← {daemon, web}
+        // peer-layering). BuildManager's storage injection is safe to defer
+        // because the only consumer is `web/routes/knowledge.ts`, which runs
+        // only after `WebServer.start()` returns (post-setStorage).
+        const { buildManager } = await import('../web/services/build-manager.js');
+        buildManager.setStorage(storage);
         const { WebServer } = await import('../web/server.js');
         webServer = new WebServer({
             port: config.web.port,
@@ -237,7 +648,19 @@ export async function startDaemon(foreground = false, options = {}) {
             skillRegistry,
             invocationGuard,
         });
-        await webServer.start();
+        // Defense-in-depth (task-link orphan fix, 2026-06-02): a failed web-server
+        // start (most commonly EADDRINUSE on port 3721 when another daemon already
+        // holds it) MUST NOT propagate to `process.exit(1)`. The core daemon job is
+        // the socket event pipeline, which is already listening by now; killing the
+        // process here is what previously created the launchd crash loop + socket
+        // theft. Log and continue with web disabled.
+        try {
+            await webServer.start();
+        }
+        catch (err) {
+            logger.error(`[Web] Server failed to start (continuing without web UI): ${err instanceof Error ? err.message : err}`);
+            webServer = null;
+        }
     }
     else {
         logger.info('[Web] Server disabled (--no-web or config.web.enabled=false)');
@@ -249,11 +672,16 @@ export async function startDaemon(foreground = false, options = {}) {
             return;
         shuttingDown = true;
         logger.info('Shutting down...');
-        if (ai)
-            logger.info(`[AI Stats] ${ai.formatStats()}`);
+        // D R-A (2026-05-29): removed `[AI Stats]` shutdown line — there was no
+        // consumer (dead log), and the only producer (ClaudeProvider instance)
+        // was deleted with the §4 block above. Master spec 0902 §2.4.4.
+        heartbeatHandle.stop();
         clearInterval(maintenanceInterval);
         clearInterval(vacuumInterval);
         clearInterval(staleTaskGcInterval);
+        clearInterval(eventTtlInterval);
+        clearTimeout(initialCleanupTimeout);
+        clearTimeout(initialEventTtlTimeout);
         if (webServer)
             await webServer.stop();
         await server.close();