crewly 1.20.194 → 1.20.196

package/dist/backend/backend/src/index.js

@@ -23,7 +23,7 @@ import { TerminalGateway, setTerminalGateway } from './websocket/terminal.gatewa
 import { initializeChatGateway } from './websocket/chat.gateway.js';
 import { LoggerService } from './services/core/logger.service.js';
 import { retryWithBackoff } from './services/core/retry.util.js';
-import { CREWLY_CONSTANTS, ORCHESTRATOR_SESSION_NAME, OWNER_MESSAGE_WATCHDOG_CONSTANTS, CLOUD_DISCONNECT_NOTICE_CONSTANTS, ORCHESTRATOR_ROLE, ORCHESTRATOR_WINDOW_NAME, MESSAGE_QUEUE_CONSTANTS, RUNTIME_TYPES, AUDITOR_CONSTANTS, AUDITOR_SCHEDULER_CONSTANTS, API_SECURITY_CONSTANTS, } from './constants.js';
+import { CREWLY_CONSTANTS, ORCHESTRATOR_SESSION_NAME, OWNER_MESSAGE_WATCHDOG_CONSTANTS, TURN_STATE_CONSTANTS, CLOUD_DISCONNECT_NOTICE_CONSTANTS, ORCHESTRATOR_ROLE, ORCHESTRATOR_WINDOW_NAME, MESSAGE_QUEUE_CONSTANTS, RUNTIME_TYPES, AUDITOR_CONSTANTS, AUDITOR_SCHEDULER_CONSTANTS, API_SECURITY_CONSTANTS, } from './constants.js';
 import { getSettingsService } from './services/settings/index.js';
 import { MemoryService } from './services/memory/memory.service.js';
 import { getImprovementStartupService } from './services/orchestrator/improvement-startup.service.js';
@@ -68,7 +68,7 @@ import { getSlackAutoWorkingService } from './services/slack/slack-auto-working.
 import { getSlackAgentDmService } from './services/slack/slack-agent-dm.service.js';
 import { sendBootAnnouncement, isFirstBoot, markBooted } from './services/boot/boot-announce.service.js';
 import { SubAgentMessageQueue } from './services/messaging/sub-agent-message-queue.service.js';
-import { SUB_AGENT_QUEUE_CONSTANTS, CHAT_CONTEXT_CONSTANTS, SAFE_RESTART, AUTO_UPDATE_CONSTANTS, PROCESS_EXIT_CODES, CLAUDE_STARTUP_CONSTANTS, WEB_CONSTANTS, TICKET_CONSTANTS, UNASSIGNED_ROUTE_CONSTANTS, CLOUD_TALK_CONSTANTS, STANDING_ANSWERS_CONSTANTS, TICKET_AUTOPILOT_CONSTANTS, EXPERIMENT_CONSTANTS, WORK_ITEM_DESTINATION_CONSTANTS, CODEX_USAGE_SYNC_CONSTANTS, ANTIGRAVITY_USAGE_SYNC_CONSTANTS } from './constants.js';
+import { SUB_AGENT_QUEUE_CONSTANTS, CHAT_CONTEXT_CONSTANTS, SAFE_RESTART, AUTO_UPDATE_CONSTANTS, PROCESS_EXIT_CODES, CLAUDE_STARTUP_CONSTANTS, WEB_CONSTANTS, TICKET_CONSTANTS, UNASSIGNED_ROUTE_CONSTANTS, CLOUD_TALK_CONSTANTS, STANDING_ANSWERS_CONSTANTS, TICKET_AUTOPILOT_CONSTANTS, EXPERIMENT_CONSTANTS, WORK_ITEM_DESTINATION_CONSTANTS, CODEX_USAGE_SYNC_CONSTANTS, ANTIGRAVITY_USAGE_SYNC_CONSTANTS, OWNER_AUTH_CONSTANTS } from './constants.js';
 import { PtyActivityTrackerService } from './services/agent/pty-activity-tracker.service.js';
 import { InFlightTurnTracker } from './services/restart/in-flight-turn-tracker.service.js';
 import { TicketIntakeService, setTicketIntakeService, resolveTicketIdForSession, } from './services/v3/ticket-intake.service.js';
@@ -79,8 +79,12 @@ import { activeAcceptance, formatTicketMarker, formatTicketNumber } from './type
 import { createWorkItem, TERMINAL_WORK_ITEM_STATUSES } from './types/v2/work-item.types.js';
 import { runPoolArchiveMigration } from './services/task-pool/pool-archive-migration.js';
 import { createPtyTurnProbe } from './services/restart/turn-probe.js';
-import { RestartDrainService, resolveRestartDrainMs } from './services/restart/restart-drain.service.js';
-import { interruptedTurnsPath, loadInterruptedTurns, saveInterruptedTurns, writeInterruptedTurns, resumeInterruptedTurns, } from './services/restart/interrupted-turns.js';
+import { RestartDrainService, resolveRestartDrainMs, resolveBackgroundDrainMs, } from './services/restart/restart-drain.service.js';
+import { interruptedTurnsPath, loadInterruptedTurns, saveInterruptedTurns, writeInterruptedTurns, resumeInterruptedTurns, planCommitmentNotes, } from './services/restart/interrupted-turns.js';
+import { AgentTurnStateService } from './services/monitoring/agent-turn-state.js';
+import { DeferredIdleSettle } from './services/monitoring/deferred-idle-settle.js';
+import { resolveSupervisorStopBudgetMs, capDrainToSupervisor } from './services/restart/supervisor-stop-budget.js';
+import { findClaudeTranscript, defaultClaudeHome } from './services/agent/runtime-session-recovery.js';
 import { DeviceIdentityService } from './services/cloud/device-identity.service.js';
 import { CloudSyncService } from './services/cloud/cloud-sync.service.js';
 import { SlackThreadStoreService, setSlackThreadStore, getSlackThreadStore } from './services/slack/slack-thread-store.service.js';
@@ -95,9 +99,13 @@ import { setMessageQueueService as setMessagingControllerQueueService } from './
 import { SystemResourceAlertService } from './services/monitoring/system-resource-alert.service.js';
 import { TokenUsageService } from './services/monitoring/token-usage.service.js';
 import { agentHeartbeatMiddleware } from './middleware/agent-heartbeat.middleware.js';
-import { agentOriginMiddleware } from './middleware/agent-origin.middleware.js';
+import { agentOriginMiddleware, liveSessionPids } from './middleware/agent-origin.middleware.js';
+import { createCallerIdentityMiddleware } from './middleware/caller-identity.middleware.js';
+import { PeerProcessService } from './services/core/peer-process.service.js';
+import { createOwnerSessionPageMiddleware, createOwnerSessionRouter } from './controllers/auth/owner-session.controller.js';
+import { dashboardBuildHeader, dashboardBuildMessage, loadDashboardEntry } from './services/core/dashboard-build.js';
 import { apiTokenMiddleware, healthGateMiddleware, socketIoAllowRequest, installWebSocketGate, } from './middleware/api-token.middleware.js';
-import { resolveApiToken } from './services/core/api-token.service.js';
+import { getApiTokenFilePath, mirrorEnvTokenToFile, resolveApiToken } from './services/core/api-token.service.js';
 import { isHeadlessEnvironment, describeNetworkExposure } from './utils/network-exposure.utils.js';
 import { RedisCacheService } from './services/cache/redis-cache.service.js';
 import { OrchestratorRestartService } from './services/orchestrator/orchestrator-restart.service.js';
@@ -152,6 +160,7 @@ import { sessionsToRestore } from './services/agent/restore-filter.js';
 import { ProjectMemoryService } from './services/memory/project-memory.service.js';
 import { TaskHistorySubscriber } from './services/memory/task-history.subscriber.js';
 import { TeamHealthWatchdogService, LiveTeamHealthDataProvider, loadTeamHealthConfig, setTeamHealthWatchdogSingleton, getTeamHealthWatchdogSingleton, } from './services/team-health/index.js';
+import { traceTurnActivity } from './services/trace/trace-recorder.js';
 // ESM __dirname equivalent using import.meta.url
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -214,10 +223,33 @@ function cloudHealthBlock() {
         return { status: 'unknown' };
     }
 }
+/**
+ * Send an alert to the owner as a Slack notification. Shared by the disk
+ * janitor's low-disk notice, critical system alerts (#991) and repeated
+ * runtime startup exits (#989), so they all reach an away owner the same way.
+ *
+ * @param notice - Title, message and whether it is urgent
+ * @returns True when it was sent, false when Slack is not connected
+ */
+async function slackOwnerAlertNotifier(notice) {
+    const slack = getSlackService();
+    if (!slack.isConnected())
+        return false;
+    await slack.sendNotification({
+        type: 'alert',
+        title: notice.title,
+        message: notice.message,
+        urgency: notice.urgent ? 'critical' : 'normal',
+        timestamp: new Date().toISOString(),
+    });
+    return true;
+}
 export class CrewlyServer {
     app;
     httpServer;
     io;
+    /** Entry script of the dashboard build this backend serves (null: none built) */
+    dashboardEntry = null;
     config;
     logger = LoggerService.getInstance().createComponentLogger('CrewlyServer');
     /** Offline-replay summary from this boot, surfaced in the boot announcement. */
@@ -271,6 +303,21 @@ export class CrewlyServer {
     lastShutdownSignalAt = 0;
     /** Interrupted turns loaded at boot, resumed once their agents are back */
     interruptedTurnsAtBoot = [];
+    /** Supervisor's SIGTERM→SIGKILL budget (systemd TimeoutStopUSec), read at boot; null = none / unknown */
+    supervisorStopBudgetMs = null;
+    /**
+     * End-of-turn settling skipped while an agent still had background work,
+     * re-checked until that work is gone (specs/2026-10-02-restart-busy-and-resume.md).
+     */
+    deferredIdleSettle = new DeferredIdleSettle({
+        hasBackgroundWork: (sessionName) => AgentTurnStateService.getInstance().hasBackgroundWork(sessionName),
+        isMidTurn: (sessionName) => AgentTurnStateService.getInstance().getVerdict(sessionName).state === 'turn',
+        settle: (sessionName) => this.settleAfterTurn(sessionName),
+        intervalMs: TURN_STATE_CONSTANTS.SETTLE_RECHECK_MS,
+        maxWaitMs: TURN_STATE_CONSTANTS.OPEN_WORK_MAX_MS,
+    });
+    /** Owner promises past due and never nudged at boot; their agents are restored and reminded once */
+    openCommitmentsAtBoot = [];
     healthMonitoringInterval = null;
     constructor(config) {
         // Resolve ~ to actual home directory
@@ -535,7 +582,30 @@ export class CrewlyServer {
                     readIntakeLog: () => intakeOutcomeLog.read(),
                 });
                 setOwnerReceiptService(receipt);
-                startOwnerReceiptSchedule(receipt);
+                // #856 follow-up: while the receipt is off, show the owner one real
+                // sample on a decision card and let him choose (never turned on for him).
+                void (async () => {
+                    const [{ OwnerReceiptFormatAsk }, { DecisionService }] = await Promise.all([
+                        import('./services/v3/owner-receipt/owner-receipt-format-ask.js'),
+                        import('./services/decisions/decision.service.js'),
+                    ]);
+                    const formatAsk = new OwnerReceiptFormatAsk({
+                        receipt,
+                        decisions: () => DecisionService.getInstance(),
+                        logger: LoggerService.getInstance().createComponentLogger('OwnerReceiptFormat'),
+                    });
+                    DecisionService.registerKindHandler('owner_receipt_format', formatAsk);
+                    startOwnerReceiptSchedule({
+                        tick: async () => {
+                            const sent = await receipt.tick();
+                            await formatAsk.tick();
+                            return sent;
+                        },
+                    });
+                })().catch((err) => {
+                    this.logger.warn('Owner receipt format ask not wired; the receipt runs without it', { error: err instanceof Error ? err.message : String(err) });
+                    startOwnerReceiptSchedule(receipt);
+                });
             }
             TaskPoolService.getInstance().setTicketResolver((sessionName) => resolveTicketIdForSession(InFlightTurnTracker.getInstance(), sessionName));
             // Phase 2: answered → 待验收 → 验过了 / 打回 / silence accepts.
@@ -1224,27 +1294,23 @@ export class CrewlyServer {
                 // restart. The owner asked a second question while the agent
                 // was mid-answer and never got a reply; the message was still
                 // in the queue an hour later (2026-09-21, Ella).
-                setImmediate(() => void this.flushQueuedAgentMessages(event.sessionName));
-                // The turn ended: a "working on it" it never answered means it chose
-                // not to reply (an "ok", "好"). Take it down rather than leave a
-                // "still working — the reply will follow" that never follows.
-                void getSlackTypingPlaceholderService()
-                    ?.settleTurnWithoutReply(event.sessionName)
-                    .catch(() => undefined);
-                // Same rule for the DM threads it was owed an answer in: one it
-                // chose not to answer must not pull a later unattributed answer
-                // back into it (2026-09-28).
-                void getSlackAgentDmService()
-                    ?.settleOpenThreads(event.sessionName)
-                    .catch(() => undefined);
-                // Ticket loop Phase 2: an agent that finished its turn has answered
-                // the tickets it replied in — submit them (待验收 or done).
-                void getTicketReviewService()
-                    ?.onAgentIdle(event.sessionName)
-                    .catch(() => undefined);
+                //
+                // An agent whose turn ended with a subagent or background task
+                // still running is not done: the turn that delivers comes when
+                // that work finishes. Leave its placeholders and tickets alone
+                // (2026-10-02, Eve: "the data inventory is still running").
+                // A re-check settles later, once the background work is gone.
+                // An idle while the runtime still reports a turn (a silent
+                // screen, a forced reset) is not a turn end at all: settle
+                // nothing and flush nothing into the live turn; the turn's own
+                // end publishes agent:idle again (PR #1013 review).
+                const idleOutcome = this.deferredIdleSettle.onIdle(event.sessionName);
+                if (idleOutcome !== 'turn') {
+                    setImmediate(() => void this.flushQueuedAgentMessages(event.sessionName));
+                }
                 // V3: Auto-close open Requests when the orchestrator goes idle
                 // Handles direct responses (no WorkItem delegation)
-                if (event.sessionName === ORCHESTRATOR_SESSION_NAME) {
+                if (event.sessionName === ORCHESTRATOR_SESSION_NAME && idleOutcome !== 'turn') {
                     setImmediate(() => this.autoCloseOpenRequests());
                 }
             }
@@ -1493,12 +1559,24 @@ export class CrewlyServer {
         // and the SPA shell are outside `/api` and stay open; `/health` has its
         // own gate below (#825).
         this.app.use('/api', apiTokenMiddleware);
+        // Which dashboard build is served: a still-open tab running an older
+        // bundle can tell it should reload (#1010 review).
+        this.dashboardEntry = this.config.headless ? null : loadDashboardEntry(path.join(findPackageRoot(__dirname), 'frontend/dist/index.html'));
+        this.app.use('/api', dashboardBuildHeader(this.dashboardEntry));
         // A skill's X-Agent-Session is checked against the agent PTY its process
         // really runs under (X-Agent-Pid) and corrected when it names another
         // agent — before the heartbeat and every controller read it.
         this.app.use('/api', agentOriginMiddleware);
+        // Who is calling, from credentials (#999, specs/2026-10-03-owner-auth.md):
+        // agent badge, owner session (+ CSRF), owner API token (checked against
+        // the process tree when it comes from this machine), relay credential.
+        // A request with none of these is anonymous — never the owner.
+        const peerProcesses = new PeerProcessService({ listSessionPids: liveSessionPids });
+        this.app.use('/api', createCallerIdentityMiddleware(peerProcesses));
         // Agent heartbeat middleware - any API call with X-Agent-Session header updates heartbeat
         this.app.use('/api', agentHeartbeatMiddleware);
+        // The dashboard's owner session + CSRF token (GET /api/auth/session).
+        this.app.use('/api', createOwnerSessionRouter(peerProcesses));
         // API routes
         this.app.use('/api', createApiRoutes(this.apiController));
         // Health check (enhanced with mode and agent info).
@@ -1609,6 +1687,8 @@ export class CrewlyServer {
             // and in compiled/npm-installed mode (dist/backend/backend/src/)
             const projectRoot = findPackageRoot(__dirname);
             const frontendPath = path.join(projectRoot, 'frontend/dist');
+            // A page load from the owner's browser gets the owner session cookie (#999).
+            this.app.use(createOwnerSessionPageMiddleware(peerProcesses));
             this.app.use(express.static(frontendPath));
             // Serve frontend for all other routes (SPA)
             // Skip /api/ and /health paths so addon-registered API routes are reachable
@@ -1649,6 +1729,9 @@ export class CrewlyServer {
     configureWebSocket() {
         this.io.on('connection', (socket) => {
             this.logger.info('Client connected', { socketId: socket.id });
+            // Tell the tab which dashboard build is served now (#1010 review).
+            if (this.dashboardEntry)
+                socket.emit(OWNER_AUTH_CONSTANTS.BUILD_EVENT, dashboardBuildMessage(this.dashboardEntry));
             socket.on('disconnect', () => {
                 this.logger.info('Client disconnected', { socketId: socket.id });
             });
@@ -1797,6 +1880,11 @@ export class CrewlyServer {
             }
             // Start activity monitoring
             this.logger.info('Starting activity monitoring...');
+            // Turn busy periods for the autonomy metrics (#984): one `turn.ended`
+            // trace event per PTY turn, from the undelayed status listener.
+            this.activityMonitorService.onWorkingStatusChange((session, status) => {
+                traceTurnActivity(session, status === 'in_progress', 'pty');
+            });
             this.activityMonitorService.startPolling();
             // Start idle detection for agent suspension
             this.logger.info('Starting idle detection service...');
@@ -2034,6 +2122,8 @@ export class CrewlyServer {
                 const runtimeExitMonitor = RuntimeExitMonitorService.getInstance();
                 runtimeExitMonitor.setAgentRegistrationService(this.apiController.agentRegistrationService);
                 runtimeExitMonitor.setEventBusService(this.eventBusService);
+                // #989: a runtime that keeps dying at start is told to the owner once.
+                runtimeExitMonitor.setOwnerNotifier(slackOwnerAlertNotifier);
             }
             catch (error) {
                 this.logger.warn('Failed to wire RuntimeExitMonitorService dependencies (non-critical)', {
@@ -3014,14 +3104,15 @@ export class CrewlyServer {
                         const slack = getSlackService();
                         if (!slack.isConnected())
                             return false;
-                        await slack.sendNotification({
+                        // Only a delivered notice counts: sendNotification resolves
+                        // false when there was no channel to send it to.
+                        return slack.sendNotification({
                             type: 'project_update',
                             title,
                             message,
                             urgency: urgent ? 'high' : 'normal',
                             timestamp: new Date().toISOString(),
                         });
-                        return true;
                     });
                     TicketAutopilotService.getInstance()?.stop();
                     TicketAutopilotService.setInstance(autopilot);
@@ -3034,6 +3125,16 @@ export class CrewlyServer {
                 else {
                     this.logger.info('Ticket autopilot off (CREWLY_TICKET_AUTOPILOT=0)');
                 }
+                // The one owner card per retro that approves its harness-gap tickets
+                // (specs/2026-10-03-autopilot-experiments.md §4). Registered even with
+                // the autopilot switched off, so a card answered later still lands.
+                {
+                    const { DecisionService: RetroDecisions } = await import('./services/decisions/decision.service.js');
+                    const { ticketAutopilot } = await import('./controllers/project-tickets/project-tickets.controller.js');
+                    RetroDecisions.registerKindHandler(TICKET_AUTOPILOT_CONSTANTS.RETRO_DECISION_KIND, {
+                        onSettled: (d) => ticketAutopilot().onRetroDecision(d),
+                    });
+                }
                 // Experiment cards (specs/experiment-cards.md, issue #986): measure each
                 // shipped experiment at the end of its window, label it, log it to the
                 // wiki and tell the owner. Kill switch: CREWLY_EXPERIMENTS=0.
@@ -3045,14 +3146,15 @@ export class CrewlyServer {
                             const slack = getSlackService();
                             if (!slack.isConnected())
                                 return false;
-                            await slack.sendNotification({
+                            // Only a delivered notice counts: sendNotification resolves
+                            // false when there was no channel to send it to.
+                            return slack.sendNotification({
                                 type: 'project_update',
                                 title,
                                 message,
                                 urgency: urgent ? 'high' : 'normal',
                                 timestamp: new Date().toISOString(),
                             });
-                            return true;
                         });
                         ExperimentService.getInstance()?.stop();
                         ExperimentService.setInstance(experiments);
@@ -3137,7 +3239,10 @@ export class CrewlyServer {
             // Start NOTIFY reconciliation service (retries failed Slack deliveries)
             this.notifyReconciliationService = new NotifyReconciliationService();
             this.notifyReconciliationService.start();
-            // Start system resource alert monitoring (proactive disk/memory/CPU alerts)
+            // Start system resource alert monitoring (proactive disk/memory/CPU alerts).
+            // Critical disk/memory alerts and auto-stopped agents also reach the
+            // owner over Slack (#991), through the same path as the low-disk notice.
+            this.systemResourceAlertService.setOwnerNotifier(slackOwnerAlertNotifier);
             this.systemResourceAlertService.startMonitoring();
             // Fire-and-forget background version check (populates cache for /health)
             VersionCheckService.getInstance().checkForUpdate().catch(() => {
@@ -3372,19 +3477,7 @@ export class CrewlyServer {
             // the usual Slack owner-notification path. Kill switch:
             // CREWLY_WORKTREE_JANITOR=0.
             try {
-                WorktreeJanitorService.getInstance().setLowDiskNotifier(async ({ title, message, urgent }) => {
-                    const slack = getSlackService();
-                    if (!slack.isConnected())
-                        return false;
-                    await slack.sendNotification({
-                        type: 'alert',
-                        title,
-                        message,
-                        urgency: urgent ? 'critical' : 'normal',
-                        timestamp: new Date().toISOString(),
-                    });
-                    return true;
-                });
+                WorktreeJanitorService.getInstance().setLowDiskNotifier(slackOwnerAlertNotifier);
                 if (WorktreeJanitorService.getInstance().start()) {
                     this.logger.info('WorktreeJanitorService scheduled');
                 }
@@ -3848,11 +3941,17 @@ export class CrewlyServer {
                 const allItems = await TaskPoolService.getInstance().getAllItems();
                 // Work in hand only: active statuses, touched recently (see restore-filter),
                 // plus agents whose turn the last restart cut off.
+                const owed = await this.loadOwedWorkAtBoot();
                 targets = sessionsToRestore(allItems, [
                     ...this.interruptedTurnsAtBoot.map((t) => t.sessionName),
                     // Agents with messages still waiting for them (restored from
                     // disk by the queue) — someone is owed an answer.
                     ...SubAgentMessageQueue.getInstance().sessionsWithPending(),
+                    // Agents whose owner promise is past due and was never
+                    // nudged: idle or not, they come back to be reminded once
+                    // (2026-10-02, Eve). Not-yet-due and already-nudged
+                    // promises are left to the open-items sweep.
+                    ...owed.map((c) => c.sessionName),
                 ]);
             }
             catch (poolErr) {
@@ -4018,6 +4117,14 @@ export class CrewlyServer {
      */
     logNetworkExposure() {
         try {
+            // A token pinned in the service environment is mirrored to the token
+            // file, so the CLI on this machine can present it (#1010 review).
+            const mirrored = mirrorEnvTokenToFile();
+            if (mirrored === 'written' || mirrored === 'updated' || mirrored === 'failed') {
+                this.logger[mirrored === 'failed' ? 'warn' : 'info'](`API token from ${API_SECURITY_CONSTANTS.ENV.API_TOKEN}: token file ${mirrored}`, {
+                    file: getApiTokenFilePath(),
+                });
+            }
             const token = resolveApiToken();
             const summary = describeNetworkExposure({
                 bindHost: this.config.bindHost,
@@ -4207,6 +4314,32 @@ export class CrewlyServer {
         }
         this.logger.info(`Received ${signal} while shutdown is already past the drain; continuing`);
     }
+    /**
+     * End-of-turn settling: take down "working on it" placeholders the agent
+     * never answered, settle its open DM threads, and submit the tickets it
+     * replied in. Never throws.
+     *
+     * @param sessionName - Agent whose turn ended
+     */
+    settleAfterTurn(sessionName) {
+        // The turn ended: a "working on it" it never answered means it chose
+        // not to reply (an "ok", "好"). Take it down rather than leave a
+        // "still working — the reply will follow" that never follows.
+        void getSlackTypingPlaceholderService()
+            ?.settleTurnWithoutReply(sessionName)
+            .catch(() => undefined);
+        // Same rule for the DM threads it was owed an answer in: one it
+        // chose not to answer must not pull a later unattributed answer
+        // back into it (2026-09-28).
+        void getSlackAgentDmService()
+            ?.settleOpenThreads(sessionName)
+            .catch(() => undefined);
+        // Ticket loop Phase 2: an agent that finished its turn has answered
+        // the tickets it replied in — submit them (待验收 or done).
+        void getTicketReviewService()
+            ?.onAgentIdle(sessionName)
+            .catch(() => undefined);
+    }
     /**
      * Wire the safe-restart pieces: the turn probe, idle-event re-probing,
      * readiness queue counting, and the graceful-shutdown hook used by
@@ -4215,11 +4348,68 @@ export class CrewlyServer {
     wireSafeRestart() {
         const tracker = InFlightTurnTracker.getInstance();
         const activity = PtyActivityTrackerService.getInstance();
+        const turnState = AgentTurnStateService.getInstance();
+        const persistence = getSessionStatePersistence();
+        const metaOf = (sessionName) => {
+            try {
+                return persistence.getSessionMetadata(sessionName);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        // The runtime's own turn state (specs/2026-10-02-restart-busy-and-resume.md):
+        // Claude Code transcripts as the fallback behind its hooks.
+        turnState.setTranscriptLocator((sessionName) => {
+            const meta = metaOf(sessionName);
+            if (!meta || meta.runtimeType !== RUNTIME_TYPES.CLAUDE_CODE || !meta.claudeSessionId || !meta.cwd)
+                return null;
+            const homes = [meta.env?.CLAUDE_CONFIG_DIR, defaultClaudeHome()].filter((h) => typeof h === 'string' && h.length > 0);
+            return findClaudeTranscript({ sessionId: meta.claudeSessionId, cwd: meta.cwd, claudeHomes: homes });
+        });
         tracker.setProbe(createPtyTurnProbe({
             getBackend: () => getSessionBackendSync(),
             getIdleTimeMs: (sessionName) => (activity.hasActivity(sessionName) ? activity.getIdleTimeMs(sessionName) : null),
+            getRuntimeVerdict: (sessionName) => turnState.getVerdict(sessionName),
+            getLastHookEventAt: (sessionName) => turnState.lastHookEventAt(sessionName),
+            getRuntimeType: (sessionName) => metaOf(sessionName)?.runtimeType ?? null,
         }));
+        // Turns no delivery started (a background subagent finishing) and
+        // background work after a turn count as mid-turn too (2026-10-02, Eve).
+        tracker.setRuntimeBusySource((now) => {
+            const backend = getSessionBackendSync();
+            const out = [];
+            for (const sessionName of turnState.knownSessions()) {
+                if (!backend?.sessionExists(sessionName))
+                    continue;
+                // An exited runtime is not working, whatever its last hook said.
+                if (backend.isChildProcessAlive?.(sessionName) === false) {
+                    turnState.forget(sessionName);
+                    continue;
+                }
+                const v = turnState.getVerdict(sessionName, now);
+                if (v.state === 'turn' || v.state === 'background')
+                    out.push({ sessionName, since: v.since, longRunning: v.longRunning });
+            }
+            return out;
+        });
         tracker.attachEventSource(this.eventBusService);
+        // Under systemd, TimeoutStopSec decides when we are SIGKILLed: the drain
+        // must end before it, or the interrupted turns are never saved.
+        this.supervisorStopBudgetMs = resolveSupervisorStopBudgetMs();
+        if (this.supervisorStopBudgetMs !== null) {
+            const wanted = resolveBackgroundDrainMs(process.env);
+            const capped = capDrainToSupervisor(wanted, this.supervisorStopBudgetMs, SAFE_RESTART.SHUTDOWN_MARGIN_MS);
+            const log = capped < wanted ? this.logger.warn.bind(this.logger) : this.logger.info.bind(this.logger);
+            log('Restart drain capped by the systemd stop timeout', {
+                timeoutStopMs: this.supervisorStopBudgetMs,
+                drainCapMs: capped,
+                wantedMs: wanted,
+                ...(capped < wanted ? { fix: 'run "crewly service upgrade" (or "crewly service install --force") to regenerate the unit' } : {}),
+            });
+        }
+        // A silent screen is not idle while the runtime reports a turn.
+        this.activityMonitorService.setRuntimeTurnCheck((sessionName) => turnState.getVerdict(sessionName).state === 'turn');
         const drain = RestartDrainService.getInstance();
         drain.setQueueCounter(() => this.messageQueueService.pendingCount + SubAgentMessageQueue.getInstance().getTotalQueued());
         drain.setShutdownHandler((request) => this.shutdown({ reason: request.reason, exitCode: request.exitCode }));
@@ -4554,6 +4744,85 @@ export class CrewlyServer {
             });
         }
     }
+    /**
+     * Owner promises and owed answers left by the previous run. Their agents
+     * are restored on boot even when idle (specs/2026-10-02-restart-busy-and-resume.md).
+     * Never throws.
+     *
+     * @returns Open commitments and the agents owing an answer
+     */
+    async loadOwedWorkAtBoot() {
+        let commitments = [];
+        try {
+            const { owedCommitments } = await import('./services/open-items/open-items.service.js');
+            commitments = owedCommitments(await RequestService.getInstance().listAll(), new Date());
+        }
+        catch (error) {
+            this.logger.warn('Could not read open owner promises at boot (non-fatal)', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+        this.openCommitmentsAtBoot = commitments;
+        if (commitments.length > 0) {
+            this.logger.info('Owner promises past due and never nudged; their agents will be restored and reminded once', {
+                commitments: commitments.map((c) => ({ session: c.sessionName, ticket: c.ticket, due: c.due })),
+            });
+        }
+        return commitments;
+    }
+    /**
+     * Remind restored agents of the owner promises they still owe, once each,
+     * skipping agents that already get an interrupted-turn note.
+     *
+     * @param interrupted - The interrupted entries being resumed
+     */
+    async remindOpenCommitmentsAfterBoot(interrupted) {
+        const commitments = this.openCommitmentsAtBoot;
+        this.openCommitmentsAtBoot = [];
+        if (commitments.length === 0)
+            return;
+        const registration = this.apiController.agentRegistrationService;
+        const isRunning = (name) => Boolean(getSessionBackendSync()?.sessionExists(name)) || Boolean(registration.getInProcessRuntime(name));
+        // One reminder per promise, ever: recorded (as the nudge) before it is
+        // sent, so neither the next boot nor the sweep sends another.
+        const { markRestartReminded, OpenItemsService } = await import('./services/open-items/open-items.service.js');
+        // Through the service's queue when it runs: the sweep may be nudging the same promise.
+        const openItems = OpenItemsService.getInstance();
+        const markReminded = (requestId, itemId) => openItems ? openItems.markRestartReminded(requestId, itemId) : markRestartReminded(RequestService.getInstance(), requestId, itemId);
+        const covered = new Set(interrupted.map((e) => e.sessionName));
+        const marked = [];
+        for (const c of commitments) {
+            if (covered.has(c.sessionName) || !isRunning(c.sessionName))
+                continue;
+            try {
+                if (await markReminded(c.requestId, c.itemId))
+                    marked.push(c);
+            }
+            catch (error) {
+                this.logger.warn('Could not record a restart reminder; not sending it', {
+                    sessionName: c.sessionName,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const notes = planCommitmentNotes(marked, interrupted, isRunning);
+        for (const note of notes) {
+            try {
+                const result = await registration.sendMessageToAgent(note.sessionName, note.text);
+                this.logger.info('Reminded a restored agent of the owner promise it still owes', {
+                    sessionName: note.sessionName,
+                    delivered: result.success,
+                    queuedUntilRegistered: result.queued === true,
+                });
+            }
+            catch (error) {
+                this.logger.warn('Could not remind a restored agent of its owner promise', {
+                    sessionName: note.sessionName,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+    }
     /**
      * Re-deliver the turns the previous shutdown cut off, then clear the file.
      * The file is rewritten after each entry so a restart during this pass
@@ -4561,6 +4830,7 @@ export class CrewlyServer {
      */
     async resumeInterruptedTurnsAfterBoot() {
         const entries = this.interruptedTurnsAtBoot;
+        await this.remindOpenCommitmentsAfterBoot(entries);
         if (entries.length === 0)
             return;
         this.interruptedTurnsAtBoot = [];
@@ -4615,8 +4885,11 @@ export class CrewlyServer {
         try {
             const drain = RestartDrainService.getInstance();
             drain.pauseDelivery(reason);
-            const timeoutMs = drainEnabled ? resolveRestartDrainMs(process.env) : 0;
-            const result = await drain.drain({ timeoutMs });
+            const budget = this.supervisorStopBudgetMs;
+            const margin = SAFE_RESTART.SHUTDOWN_MARGIN_MS;
+            const timeoutMs = drainEnabled ? capDrainToSupervisor(resolveRestartDrainMs(process.env), budget, margin) : 0;
+            const backgroundTimeoutMs = drainEnabled ? capDrainToSupervisor(resolveBackgroundDrainMs(process.env), budget, margin) : 0;
+            const result = await drain.drain({ timeoutMs, backgroundTimeoutMs });
             if (result.remaining.length > 0) {
                 const saved = saveInterruptedTurns(interruptedTurnsPath(this.config.crewlyHome), result.remaining, `${reason}: ${result.outcome}`);
                 this.logger.warn('Persisted interrupted agent turns for resume after restart', {
@@ -4834,24 +5107,25 @@ export class CrewlyServer {
             const { createDecisionService, attachDecisionSlackListeners, attachSkipAllCommand } = await import('./services/decisions/decision.wiring.js');
             const { DecisionService } = await import('./services/decisions/decision.service.js');
             const RUNNING = new Set(['running', 'accepted', 'proposed']);
+            const sendToAgent = async (session, text) => {
+                let exists = false;
+                try {
+                    exists = getSessionBackendSync()?.sessionExists(session) ?? false;
+                }
+                catch {
+                    exists = false;
+                }
+                if (!exists) {
+                    const { activateAgentBySession } = await import('./controllers/team/team.controller.js');
+                    await activateAgentBySession(this.apiController, session).catch(() => undefined);
+                }
+                const result = await this.apiController.agentRegistrationService.sendMessageToAgent(session, text);
+                return result.success;
+            };
             const decisions = createDecisionService({
                 crewlyHome: this.config.crewlyHome,
                 getTeams: () => this.storageService.getTeams(),
-                sendToAgent: async (session, text) => {
-                    let exists = false;
-                    try {
-                        exists = getSessionBackendSync()?.sessionExists(session) ?? false;
-                    }
-                    catch {
-                        exists = false;
-                    }
-                    if (!exists) {
-                        const { activateAgentBySession } = await import('./controllers/team/team.controller.js');
-                        await activateAgentBySession(this.apiController, session).catch(() => undefined);
-                    }
-                    const result = await this.apiController.agentRegistrationService.sendMessageToAgent(session, text);
-                    return result.success;
-                },
+                sendToAgent,
                 sendToOrchestrator: async (text) => {
                     this.messageQueueService.enqueue({ content: text, conversationId: 'system', source: 'system_event' });
                     return true;
@@ -4880,6 +5154,13 @@ export class CrewlyServer {
             await attachSkipAllCommand(decisions).catch((err) => this.logger.warn('Skip-all command not wired (non-critical)', { error: err instanceof Error ? err.message : String(err) }));
             decisions.start();
             this.logger.info('Decision cards started');
+            // Daily signal digest (#987, specs/2026-10-03-signal-digest.md): Do / Skip
+            // per action on one card; Do opens an experiment ticket.
+            const { createSignalDigestService, attachSignalDigestSlackListeners } = await import('./services/signal-digest/signal-digest.wiring.js');
+            const { SignalDigestService } = await import('./services/signal-digest/signal-digest.service.js');
+            const signalDigests = createSignalDigestService({ crewlyHome: this.config.crewlyHome, getTeams: () => this.storageService.getTeams(), sendToAgent });
+            SignalDigestService.setInstance(signalDigests);
+            attachSignalDigestSlackListeners(signalDigests);
             // Runtime Terms consent (specs/2026-10-01-runtime-terms-consent.md): the
             // owner agrees to a runtime's first-run Terms from a Slack card.
             const { startRuntimeTerms } = await import('./services/runtime-terms/runtime-terms.wiring.js');