mercury-agent 0.24.3-beta.2 → 0.24.3-beta.5

package/container/Dockerfile

@@ -113,6 +113,7 @@ COPY src/extensions/reserved.ts /app/src/extensions/reserved.ts
 COPY src/extensions/permission-guard.ts /app/src/extensions/permission-guard.ts
 COPY src/extensions/bash-timeout.ts /app/src/extensions/bash-timeout.ts
 COPY src/text/sanitize-text.ts /app/src/text/sanitize-text.ts
+COPY src/text/utf8-stream.ts /app/src/text/utf8-stream.ts
 COPY src/types.ts /app/src/types.ts
 COPY resources/ /app/resources/
 COPY examples/extensions/ /tmp/examples-extensions/

package/container/Dockerfile.base

@@ -82,6 +82,7 @@ COPY src/extensions/reserved.ts /app/src/extensions/reserved.ts
 COPY src/extensions/permission-guard.ts /app/src/extensions/permission-guard.ts
 COPY src/extensions/bash-timeout.ts /app/src/extensions/bash-timeout.ts
 COPY src/text/sanitize-text.ts /app/src/text/sanitize-text.ts
+COPY src/text/utf8-stream.ts /app/src/text/utf8-stream.ts
 COPY src/types.ts /app/src/types.ts
 COPY resources/ /app/resources/
 COPY examples/extensions/ /tmp/examples-extensions/

package/docs/behavior-layers.md

@@ -32,10 +32,18 @@ the repo, after a pi upgrade.
      ## Memory                            (MEMORY.md, <active_episodes>, <members>, member notes)
      ## Run budget                        (tools-capable models only)
      ## Destructive Operations — Confirmation Required
-     ## Presenting tool results           ("simple lists", "never show JSON/commands")
+     ## Presenting tool results           ("simple lists", "never show JSON/commands",
+                                           "a bot-check page is a block, never a pass")
      ## Delivery                          ("[reply] … [/reply] — only the span inside is sent";
                                            pi-jsonl-parser.ts extractReplyEnvelope honours it,
                                            a reply with no markers is sent whole)
+     ## Staying silent                    ("asked not to reply → the whole reply is
+                                           NO_UPDATE; never explain the silence" — unconditional,
+                                           chat and scheduled runs; SILENCE_REPLY, pinned to the
+                                           host's NO_OUTPUT_SENTINEL by tests/mercury-additions.test.ts)
+     ## Reply language                    ("answer in the language of the message you are answering;
+                                           another only on request or when the space names one";
+                                           unconditional, explains the <reply_language> tag below)
      ## Character                         (heading + "Always follow it" + "only the owner can change it"
                                            — unconditional, it is the reader instruction for 3c;
                                            the mrctl character/prefs procedure under it
@@ -110,6 +118,9 @@ Built by `buildPrompt()` in `container-entry.ts`:
 <reply_anchor>…</reply_anchor>              swipe-replies only
 <the prompt>                                chat message, or the task prompt, plus any
                                             before_container promptAppend (e.g. a digest)
+<reply_language>he</reply_language>         host-detected language of what the person wrote
+                                            (runtime.ts, src/core/reply-language.ts); only for
+                                            a non-Latin script it can name, never stored
 ```
 
 A scheduled task uses exactly the same assembly; its prompt row is "the
@@ -187,11 +198,14 @@ Everything else is opt-in by instruction.
 | Kind of rule | Put it in | Not in |
 |---|---|---|
 | Who the bot is in this space, register, what it covers, sourcing and accuracy standard, formats, when it stays silent | space `AGENTS.md` | preferences (500-char blocks in the user prompt, no structure, easy to contradict) |
+| How the bot stays silent (the `NO_UPDATE` reply, and never explaining the silence) | the platform block (`## Staying silent`, layer 2) | space `AGENTS.md` (opt-in per space: the 26 spaces that never named it explained their silence to the group) |
 | A procedure: when it runs, what it produces, where it goes | the task prompt (`tasks/*.md` in a space profile) | `AGENTS.md` (a task prompt never repeats an editorial rule; `AGENTS.md` never describes a schedule) |
+| Which language a reply is written in by default (the message's own) | the platform block (`## Reply language`, layer 2) + the host's `<reply_language>` tag | the Bot Character (left out of `persona.exclusive` spaces and absent on a deployment with none: 0 of 392 Tagula prompts carried it) |
 | A one-line behavioural setting a space admin may change from chat (`language`, `timezone`) | preference | `AGENTS.md` (would need a deploy to change) |
 | Voice that must hold across all spaces of one deployment | Bot Character | every space's `AGENTS.md` (drifts) |
 | Deterministic business logic, credentials, anything with numbers or dates | a capability / engine / extension, returning structured facts | prompt prose ("compute the day name yourself") |
 | What members may do | `role.member.permissions` / applicative `member_permissions` | prompt prose ("only admins may…") — the model is not the enforcement |
+| A Google Docs/Sheets/Slides link someone sent: read it through its public export first (`google-public-read.ts`, no credentials, every caller), `gws` only for a private doc and only for a caller holding it; a private doc is "not shared publicly", never "no permission" | the `gws` extension skill (top section of `examples/extensions/gws/skill/SKILL.md`; the reader prints the fact — content, `NOT-PUBLIC`, and whether this caller holds `gws`) | the permission-guard text or the platform block (they stay a hard boundary for `gws`: the export read is not an "alternative means", because it reads only what Google serves without a login); granting `gws` to members (on a shared box it is one box-wide Google credential) |
 | Knobs an extension reads (`feed-watch.*`, `longview.*`) | `extension_config` in the space profile (repo-owned, drift-checked) | hand edits on the box |
 | A fact the bot keeps getting wrong | a file the bot reads each turn (`MEMORY.md`, a notebook under `knowledge/`), written with source and date | a longer rule |
 

package/docs/configuration.md

@@ -24,7 +24,7 @@ These must be supplied via environment variables only; they are **not** read fro
 - `MERCURY_DISCORD_GATEWAY_SECRET`
 - `MERCURY_HEARTBEAT_URL` (see [Heartbeat](#heartbeat-mercury_heartbeat_url-mercury_heartbeat_tasks))
 
-Platform tokens, provider API keys, and extension keys (e.g. `MERCURY_TELEGRAM_BOT_TOKEN`, `MERCURY_BRAVE_API_KEY`) are also **env-only** today—they are not part of the YAML schema.
+Platform tokens, provider API keys, and extension keys (e.g. `MERCURY_TELEGRAM_BOT_TOKEN`, `MERCURY_BRAVE_API_KEY`, `MERCURY_TAVILY_API_KEY`) are also **env-only** today—they are not part of the YAML schema.
 
 ## YAML layout
 
@@ -252,18 +252,28 @@ switch gates the missed-run reports described above.
 alerts:
   enabled: true              # default: true
   cooldown_ms: 21600000      # 60000 – 604800000 (default: 6h)
+  recipients:                # optional; extra audiences, in addition to the admins
+    - ops-team               # a space id: every conversation linked to it
 ```
 
-Env equivalents: **`MERCURY_ALERTS_ENABLED`**, **`MERCURY_ALERTS_COOLDOWN_MS`**.
-
-- **Recipients** are the ids already listed in `permissions.admins` (`MERCURY_ADMINS`)
-  and `dm_auto_space.admin_ids` (`MERCURY_DM_AUTO_SPACE_ADMIN_IDS`)
-  — there is no separate alert-recipient key. An id is alerted only when it
-  resolves to an existing space **with a linked conversation**, i.e. a chat
-  Mercury can actually send into; an alert never creates a space. With no
-  configured admin, or none that has ever messaged the bot, the alert has
-  nowhere to go — Mercury logs that fact at ERROR and leaves the cooldown
-  unclaimed, so the next failure tries again.
+Env equivalents: **`MERCURY_ALERTS_ENABLED`**, **`MERCURY_ALERTS_COOLDOWN_MS`**,
+**`MERCURY_ALERTS_RECIPIENTS`** (comma-separated).
+
+- **Recipients** are the ids listed in `permissions.admins` (`MERCURY_ADMINS`)
+  and `dm_auto_space.admin_ids` (`MERCURY_DM_AUTO_SPACE_ADMIN_IDS`), plus every
+  entry of `alerts.recipients`. An `alerts.recipients` entry is a space id (the
+  alert goes to every conversation linked to that space, e.g. a staff group) or
+  a person id (resolved like an admin). Use it rather than adding a space id to
+  `permissions.admins`: that list also makes each entry an admin member of every
+  space. An id is alerted only when it resolves to an existing space **with a
+  linked conversation**, i.e. a chat Mercury can actually send into; an alert
+  never creates a space. An admin whose DM is also linked to a recipient space
+  is told once, through the space. With nothing reachable the alert has nowhere
+  to go — Mercury logs that fact at ERROR and leaves the cooldown unclaimed, so
+  the next failure tries again.
+- **Startup check.** At boot Mercury logs `Operator alerts will reach no one: …`
+  at ERROR when no configured admin or recipient resolves to a deliverable
+  conversation, so the gap shows up before the first outage rather than during it.
 - **Channel** is the ordinary adapter outbox, the same path scheduled-task
   failures use. It carries no agent run and no LLM, so it still works when the
   agent's own credential is what died.
@@ -511,7 +521,7 @@ agent:
 ```
 
 - **`claimed`** (default) — only variables an extension declared via `mercury.env()` are passed, and only when the triggering caller holds that extension's permission. Undeclared variables stay on the host.
-- **`all`** — every `MERCURY_*` var except a fixed blocklist is passed into the container with the prefix stripped (`MERCURY_BILLING_API_KEY` → `BILLING_API_KEY`). Convenient, but blunt: a secret added to `.env` for one purpose reaches **every space's container**, regardless of who triggered the turn or whether that space has anything to do with it. Vars an extension declares `hostOnly` are excluded even here — `MERCURY_BRAVE_API_KEY` stays on the host once `web-search` is installed, which brokers Brave queries through `mrctl capability web-search`.
+- **`all`** — every `MERCURY_*` var except a fixed blocklist is passed into the container with the prefix stripped (`MERCURY_BILLING_API_KEY` → `BILLING_API_KEY`). Convenient, but blunt: a secret added to `.env` for one purpose reaches **every space's container**, regardless of who triggered the turn or whether that space has anything to do with it. Vars an extension declares `hostOnly` are excluded even here — `MERCURY_BRAVE_API_KEY` and `MERCURY_TAVILY_API_KEY` stay on the host once `web-search` is installed, which brokers search queries through `mrctl capability web-search` (see `docs/web-search.md` for the provider chain and its `web-search.providers`, `monthly_budget` and `tavily_monthly_budget` keys).
 
 **Model-provider credentials are exempt** and pass in both modes (`MERCURY_ANTHROPIC_API_KEY`, `MERCURY_ANTHROPIC_OAUTH_TOKEN`, `MERCURY_GEMINI_API_KEY`, `MERCURY_GROQ_API_KEY`, and the rest of the provider list). pi reads them inside the container, and no extension declares them — without the exemption, `claimed` would leave the agent unable to reach any model. They remain subject to the blocklist.
 

package/docs/goals/whatsapp-bot-hardening/open-threads.md

@@ -423,3 +423,5 @@ carries) and the bridge forwards it — the two-line change this note predicted.
 The other `isMention` site (`discord-native.ts:346`) is history fetch, not
 ingress. 2 regression tests in `tests/discord-bridge.test.ts`. No Discord space
 is linked on this bot, so this is verified by test, not live.
+
+- **Deploy pending (2026-10-08):** the box runs `6ddb895`; `dev` carries `933dafa` (heartbeat locale). 118 English "⏳ Processing…" notices went out in Hebrew spaces this week. Sync with `~/sync-mercury.sh` in a gap, then confirm the next notice reads "⏳ עובד על זה…".

package/docs/pending-verification.md

@@ -2360,3 +2360,110 @@ The ⏳ heartbeat now uses the space's `messages.locale`; `main`, `tel-aviv-flat
 Host-only (`src/core/routes/links.ts`, not baked): it rides whatever restart deploys `mrctl-links-admin-commands`.
 
 - [ ] MANUAL-VERIFY(2026-10-05): On the box that runs M1.2, the global admin creates `mrctl links create <mgmt> '*' --level read --note "probe-note" --disclosure "probe-disclosure"`. Then, in another space, ask that space's admin's bot "who can access this space?": the reply names the management space and the disclosure, and never says "probe-note". The owner's own `mrctl links list` still shows `note: probe-note`. Revoke the probe link afterwards.
+
+## Plan tagula-client-1008 / S1
+
+Archive shadow fix (`shadow-rehearsal-archive-reconcile-deletes-live-drive-files`). Restart-only: `src/ops/shadow-snapshot.ts` is host code, and the archive extension reaches a box as the installed snapshot that a restart refreshes. Nothing is baked into the image.
+
+- [ ] MANUAL-VERIFY(2026-10-08): On the Tagula box after the restart, `grep -c orphansRefused /root/<project>/.mercury/extensions/archive/gc.ts` prints at least 1. That is the installed copy, not the repo.
+- [ ] MANUAL-VERIFY(2026-10-08): On the Tagula box, the next live `archive-reconcile` logs `missing=32` for `tagula-management` and no other space reports missing files. No `reconcile refused` line appears for any space; if one does, read its counts before anything else.
+- [ ] MANUAL-VERIFY(2026-10-08): The next shadow snapshot on a Drive-backed box: the last `MERCURY_ARCHIVE_BACKEND=` line of the shadow's `.env` is `local`, and the last `MERCURY_ARCHIVE_LOCAL_DIR=` points inside the snapshot. After `shadow up`, the shadow's journal shows `[archive] ready — backend=local (shadow: …`. The live space's Drive archive folder has the same file count before and after the rehearsal.
+- [ ] MANUAL-VERIFY(2026-10-08): Read the Drive activity log for the archive folder around 2026-10-08 01:21–01:26 IDT. Confirm that the deletes of the 32 `tagula-management` files came from the shadow runs. Write the result into the post-mortem.
+- [ ] MANUAL-VERIFY(2026-10-08): Recover the 32 lost `tagula-management` files on the box (read-only listing of the Drive folder against the manifest hashes, then rebuild from the space folder, `backups/` and other Drive copies by hash). Afterwards the live reconcile reports fewer than 32 missing.
+
+## Plan tagula-client-1008 / S3
+
+`oauth-token-handed-to-container-can-expire-or-be-rotated-mid-run`: restart only (`src/storage/pi-auth.ts` and `src/agent/container-runner.ts` are host-side, not baked).
+
+- [ ] MANUAL-VERIFY(2026-10-08): After the restart that deploys this, on each bot (both run on the long-lived `MERCURY_ANTHROPIC_OAUTH_TOKEN`): the next turn succeeds, and `journalctl --user -u mercury --since <restart>` has **no** `Refreshing anthropic oauth token ahead of expiry` and no `running consumer(s) still hold it` lines. The env token must bypass `auth.json` entirely.
+
+## Plan tagula-client-1008 / S5
+
+- [ ] MANUAL-VERIFY(2026-10-08): After the Tagula box runs this fix, the owner adds `alerts: { recipients: [tagula-management] }` to `mercury.yaml` (restart needed: config is read at startup). The journal after the restart has `Operator alerts have a delivery path recipients=1` (or more), not `Operator alerts will reach no one`.
+- [ ] MANUAL-VERIFY(2026-10-08): The next operator alert on the Tagula box (credential failure, extension task failure, partial delivery) arrives in the `tagula-management` WhatsApp group, and the journal shows `Operator alerted` / `Credential failure alerted to operators`, not `could not tell an operator`.
+- [ ] MANUAL-VERIFY(2026-10-08): On this box (`~/whatsapp-bot`), after the next restart the journal has `Operator alerts have a delivery path`. If it says `will reach no one` instead, the owner's DM is not linked to a space here either.
+
+## Plan tagula-client-1008 / S6
+
+`mrctl-recall-is-gated-on-the-compact-permission`: host-only (`src/core/routes/messages.ts`) plus the recall skill, which is re-copied at startup. A restart deploys it on each box.
+
+- [ ] MANUAL-VERIFY(2026-10-08): After the restart on the Tagula box, a client (a `member`) asks the bot about something from an earlier article. The host log for that run has no `Permission denied … permission=compact` (or `=prompt`) line, and the trace shows `mrctl recall` returning messages, not a 403. Grep the installed skill: `grep -c "Requires \`prompt\`" <project>/.mercury/global/skills/recall/SKILL.md` prints 1.
+
+## Plan tagula-client-1008 / S10
+
+Image rebuild (`src/agent/container-entry.ts` is baked), then restart; verify the derived image is built before testing.
+
+- [ ] MANUAL-VERIFY(2026-10-08): `docker run --rm --entrypoint grep <derived ext image> -c "## Staying silent" /app/src/agent/container-entry.ts` prints 1 (fix `chat-silence-sentinel-is-never-taught-so-the-model-explains-its-silence`).
+- [ ] MANUAL-VERIFY(2026-10-08): In a Tagula group whose `AGENTS.md` does not mention `NO_UPDATE`, one person writes to another and asks the bot not to answer: nothing is sent to the group, and the journal shows `Chat turn answered with silence` for that run.
+- [ ] MANUAL-VERIFY(2026-10-10): Same image: `docker run --rm --entrypoint grep <derived ext image> -c "nothing to add" /app/src/agent/container-entry.ts` prints 0, and `-c "Never use it in place of an answer"` prints 1 (fix `silence-rule-lets-the-model-drop-a-direct-answer`).
+- [ ] MANUAL-VERIFY(2026-10-10): In a DM, ask the bot a plain question ("did today's article go out?"): it answers, and the journal has no `Chat turn answered with silence` line for that run. Then read that line's daily count for a few days after the deploy: frequent silence means the model is dodging (D-018).
+
+## Plan tagula-client-1008 / S2
+
+Image rebuild (`src/agent/container-entry.ts` is baked), then restart; the host hint and the drift metric are in `src/core/runtime.ts` and go live with the restart.
+
+- [x] MANUAL-VERIFY(2026-10-10): `docker run --rm --entrypoint grep <derived ext image> -c "## Reply language" /app/src/agent/container-entry.ts` prints 1 (fix `reply-language-drifts-to-english-on-hebrew-input`). **PASSED 2026-10-10**: `mercury-agent-ext:9b669aa35969` printed 1.
+- [x] MANUAL-VERIFY(2026-10-10): Send the bot a Hebrew question that takes many tool calls (for example a lookup across several sites). The reply is in Hebrew, and the run's trace shows the prompt ending in `<reply_language>he</reply_language>`. **PASSED 2026-10-10**: weather + USD/ILS question in `main`, Hebrew reply with tool calls, trace `mercury-1791648092438-1.jsonl` carries the tag.
+- [x] MANUAL-VERIFY(2026-10-10): In `main`, write one message in English: the reply is in English and the journal has no `Reply language drifted` line for it. **FAILED 2026-10-10** (1 of 2 English messages answered in Hebrew; filed and fixed as `reply-language-english-drifts-to-hebrew`, `9597274`). **PASSED 2026-10-11** after that deploy: 4 of 4 English messages answered in English, each trace carries `<reply_language>en</reply_language>`, a Hebrew control answered in Hebrew, 0 drift lines.
+- [ ] MANUAL-VERIFY(2026-10-10): A week after the deploy, count `Reply language drifted` lines in the journal against the Hebrew-input runs. Close or act on `docs/bugs/reply-language-drift-gets-no-rewrite.md` from that number.
+- [ ] MANUAL-VERIFY(2026-10-10): On the Tagula box, after its next deploy: the same count, by space (aggregate only). Before the fix it was 25 of 168.
+
+## mrctl recall scoped to the run's conversation (`2f5b62b` + `mrctl-recall-scope-admits-legacy-and-departed-conversation-rows` + `mrctl-recall-space-level-rows-ignore-who-actually-received-them`, local `dev`, unpushed 2026-10-09)
+
+- [ ] MANUAL-VERIFY(2026-10-09): Push local `dev` to `origin/dev` once the owner approves. It carries `a1b11d9` (recall opened to members) together with its fixes `2f5b62b`, the `mrctl-recall-scope-admits-legacy-and-departed-conversation-rows` squash and the `mrctl-recall-space-level-rows-ignore-who-actually-received-them` squash; push all four together or not at all.
+- [ ] MANUAL-VERIFY(2026-10-09): Deploy is **not** restart-only. (1) `src/types.ts` is a baked file (a type-only edit, but release-gate §1 classes it as image): rebuild with `container/build.sh`, then restart. (2) `searchMessages` changed its positional signature, and `overview` is not in `src/extensions/catalog.ts`, so a restart does not refresh an installed copy. An old `actions.ts` passes `limit` as the scope: it fails closed, but the operator search quietly breaks. Wherever `overview` is installed (likely the Tagula box; not on this box), refresh it and check: `grep -c "q, null, limit" <project>/.mercury/extensions/overview/actions.ts` prints 1.
+- [ ] MANUAL-VERIFY(2026-10-09): After the deploy, in a space with a group and a **non-silent** task: let one scheduled post go out, then as a member in that group ask the bot to recall a word from it. It should find it. `SELECT count(*) FROM message_deliveries` is above 0.
+- [ ] MANUAL-VERIFY(2026-10-09): Same box, a space with a **silent** task that has run since the deploy: as a member, ask the bot to recall a word from that task's output. It should find nothing.
+- [ ] MANUAL-VERIFY(2026-10-09): Scheduled posts sent **before** this deploy have no delivery record, so members can no longer recall them. This is the accepted cost of failing closed, not a regression.
+- [ ] MANUAL-VERIFY(2026-10-09): After the deploy, in a space linking an admin DM and a group: the admin first writes a made-up word in the DM (it must be written **after** the deploy; a pre-2026-09-12 word would pass or fail for the wrong reason). Then, as a member in the group, ask the bot to recall that word. It should find nothing. Then ask for a word said in the group after the deploy; it should find it.
+- [ ] MANUAL-VERIFY(2026-10-09): Same space, as a member in the group, ask the bot to recall a word that appears only in the admin's DM from **before** 2026-09-12 (`SELECT content FROM messages WHERE space_id='<space>' AND conversation IS NULL AND role='user' LIMIT 5` finds one). It should find nothing.
+
+## Plan tagula-client-1008 / S7
+
+- [ ] MANUAL-VERIFY(2026-10-10): On a console box (Tagula), in a space whose Anthropic grant was revoked: send one message. The user should get the "session expired / reconnect" reply, not "Something went wrong", and the operator should get one 🚨 DM naming `MERCURY_ANTHROPIC_OAUTH_TOKEN (console credential blob)`. A second message within the cooldown should send no second DM.
+- [ ] MANUAL-VERIFY(2026-10-10): After reconnecting in the console, the next message should get a normal answer, and a later revoke should alert again without waiting for the cooldown.
+
+## Plan monitoring-1005 / S12
+
+- [ ] MANUAL-VERIFY(2026-10-11): Before re-rendering the unit, copy `~/.config/systemd/user/mercury.service` aside. Re-run `service install` from a script file with the old unit's `PATH` exported. `diff` old and new should show exactly two added lines, `NotifyAccess=all` and `WatchdogSec=120`, and the `PATH` line should be unchanged.
+- [ ] MANUAL-VERIFY(2026-10-11): After the restart (in a gap), `systemctl --user show mercury -p WatchdogUSec -p NotifyAccess` should print `2min` and `all`. The journal should have one `systemd watchdog: pinging … watchdogMs=120000 intervalMs=30000` line. Ten minutes later the unit should still be `active` with the same `MainPID` (pings are being accepted).
+- [ ] MANUAL-VERIFY(2026-10-11): Over the next days, `journalctl --user -u mercury | grep 'systemd watchdog'` should show no `ping failed` lines. Any `event loop was blocked` line names a stall worth a bug report.
+
+## Plan monitoring-1005 / S7 — a queued WhatsApp send is no longer reported as delivered (added 2026-10-11, deploy-gated: restart)
+
+- [ ] MANUAL-VERIFY(2026-10-11): After restart, with WhatsApp disconnected, call `POST /api/send` to the owner's DM. It should answer **202** with `{"queued":true}` (not `{"delivered":true}`), and the journal should show `Direct send queued, not delivered`. When WhatsApp reconnects, the message should arrive once.
+- [ ] MANUAL-VERIFY(2026-10-11): The next time WhatsApp is down while a task in `MERCURY_HEARTBEAT_TASKS` runs: the journal should show `Scheduled task output queued, not delivered` and **no** `Heartbeat pinged` line, the run is `error` in `task_runs`, there is no `Scheduled task will be retried` line, and healthchecks.io goes late for that task.
+
+## Bug fix pi-stdout-chunks-decoded-separately-split-utf8-in-replies (added 2026-10-11, deploy-gated: image rebuild)
+
+- [ ] MANUAL-VERIFY(2026-10-11): After `container/build.sh` and a restart in a gap, run `docker run --rm --entrypoint grep mercury-agent:latest -c onUtf8Data /app/src/agent/container-entry.ts` (should print 2 or more) and `… -c setEncoding /app/resources/pi-extensions/subagent/index.ts` (should print 2). On Tagula, check the same thing in the image tag the box runs.
+- [ ] MANUAL-VERIFY(2026-10-11): About two weeks after the deploy, `SELECT count(*) FROM messages WHERE role='assistant' AND created_at > '<deploy time>' AND content LIKE '%' || char(65533) || '%'` should be 0 on both boxes. Before the fix it was about 1 in 110 replies. A hit whose `��` shows up in pi's own `message_end` line, not on a chunk boundary, is the separate model-emitted case named in the post-mortem.
+
+## Plan monitoring-1005 / S8 — a logged-out WhatsApp device is loud, not mute (added 2026-10-11, deploy-gated: restart)
+
+- [x] MANUAL-VERIFY(2026-10-11): After the restart (in a gap), `curl -s http://127.0.0.1:8787/health` should contain `"whatsappNeedsRepair":false` and `"whatsapp":true` under `adapters`. **PASSED 2026-10-12**: box at `a454651` (restarted 2026-10-11 21:16), `/health` returned `"adapters":{"whatsapp":true},"whatsappNeedsRepair":false`.
+- [ ] MANUAL-VERIFY(2026-10-11): Do not unlink the live device to test this. The next time WhatsApp really logs the bot out, the journal should show exactly one `ERROR` line `WhatsApp logged out … mercury auth whatsapp …` and no `WhatsApp reconnecting` after it. `/health` should show `"whatsappNeedsRepair":true`, and `GET /auth/whatsapp` (with the API secret) should answer `{"status":"needs-repair","reason":"logged-out"}`.
+
+## search-provider-fallback-chain: keys and Tagula deploy (2026-10-11)
+
+- [ ] MANUAL-VERIFY(2026-10-11): Tagula (`tagula-assistant`) still runs 0.24.3-beta.3 without the Tavily provider; its `.env` already holds its own `MERCURY_TAVILY_API_KEY` (backup `.env.bak-2026-10-11-tavily` beside it). After it is deployed with `cdf7d09` or later and restarted in a gap, `ls /opt/tagula/assistants/tagula-assistant/.mercury/extensions/web-search/providers/` lists `tavily.ts` and one search in the management space logs `provider=tavily` (Tagula's Brave credit is gone until 2026-11-01).
+- [ ] MANUAL-VERIFY(2026-10-11): The local bot's Tavily key was only called directly, never through the chain. When Brave next runs out or is skipped, one search's journal line shows `provider=tavily`.
+
+## Plan monitoring-1005 / S9 — messages sent while the bot was offline are answered or noticed (added 2026-10-12, deploy-gated: restart)
+
+- [ ] MANUAL-VERIFY(2026-10-12): After the restart (in a gap), send the bot a DM from another phone within a minute of the restart. It should be answered, and the journal should show `WhatsApp offline message admitted` (or `WhatsApp inbound` if it arrived live).
+- [ ] MANUAL-VERIFY(2026-10-12): Next real outage longer than 15 minutes (do not cause one): the journal should show one `WhatsApp offline message dropped: too old to answer` line per missed message and one `WhatsApp offline notice sent` per DM chat, and that chat should get one "I was offline…" (or Hebrew) message with the right time range.
+
+## Plan tagula-predeploy-1014 / S1 — public Google Docs links are read without gws (added 2026-10-14, deploy-gated: image rebuild)
+
+- [ ] MANUAL-VERIFY(2026-10-14): As a member without gws, send the bot a public Google Docs link, then a private one. The first should come back with the document's content, the second with "this document isn't shared publicly — set it to Anyone with the link, or paste it", and no permission message either time.
+
+## Plan tagula-predeploy-1014 / S2 — a bot-check page is reported as a block, never a pass (added 2026-10-14, deploy-gated: image rebuild)
+
+- [ ] MANUAL-VERIFY(2026-10-14): After the beta.4 image is built on the Tagula box (plan D1), `docker run --rm --entrypoint grep <the mercury-agent image> -c "Blocked pages" /app/src/agent/container-entry.ts` prints 1 (grep the image, not the repo).
+- [ ] MANUAL-VERIFY(2026-10-14): The next time a site blocks a fetch (for example passportnews.co.il from the Tagula box), the reply says it was blocked and quotes the page title ("Just a moment…" or "Performing security verification"). It must not say the check was passed or that the site "didn't respond after".
+
+## Plan tagula-predeploy-1014 / S3 — the first navigation waits for pinchtab's browser (added 2026-10-14, deploy-gated: image rebuild, rides beta.4)
+
+- [ ] MANUAL-VERIFY(2026-10-14): After beta.4 is deployed to the Tagula box, `docker run --rm --entrypoint grep <the derived mercury-agent-ext image> -c _pinchtab_await_instance /usr/local/bin/pinchtab_ensure` prints a number above 0. Grep the image, not the repo.
+- [ ] MANUAL-VERIFY(2026-10-14): Over the next week of Tagula traces, no `Error 409` `no_current_tab` right after a run's first `pinchtab_ensure`. If a navigation does fail, `pinchtab_nav` prints `the navigation to … FAILED`, not a silent exit 0.

package/docs/permissions.md

@@ -36,7 +36,7 @@ Custom roles can be created by assigning permissions to any role name.
 
 | Permission | Description |
 |------------|-------------|
-| `prompt` | Send messages to the assistant |
+| `prompt` | Send messages to the assistant, and let it search the stored history its run already sees (`mrctl recall`, `GET /api/messages/search`): in a space linking several conversations, the run's own conversation plus the space's own rows, never another conversation or a scheduled-task prompt |
 | `stop` | Abort running agent and clear queue |
 | `compact` | Reset session boundary (fresh context) |
 | `tasks.list` | View scheduled tasks |
@@ -56,6 +56,7 @@ Custom roles can be created by assigning permissions to any role name.
 | `spaces.list` | View all spaces |
 | `spaces.rename` | Rename the current space |
 | `spaces.delete` | Delete current space and all related DB data |
+| `spaces.pause` | Run chat `/pause` and `/resume` in a group, where slash commands are otherwise admin-only. Not a member default — grant it with `mrctl permissions set member <current list>,spaces.pause`. In a DM, `/pause` needs only `prompt` |
 | `model.list` | List the configured model chain (`mrctl model list`, chat `/model list`) |
 | `model.switch` | Pin the space to one model leg (`mrctl model switch`, chat `/model switch`) or clear that pin (`mrctl model reset`, chat `/model reset`) — takes effect on the next agent run. A pinned space has no fallback; reset is refused while the space has an active scheduled task |
 | `links.list` | See the space links touching this space, which spaces reach it and at what level, and their audit (`mrctl links list/inspect/audit`). Admin-only by default: it names every space that reaches this one. Creating, changing or revoking a link (`mrctl links create/update/revoke`) is **not** a permission — those verbs are global-admin-only, and no role grant enables them |

package/docs/plans/{monitoring-1005 → archive/2026-10-12-monitoring-1005}/briefs/S7.md

@@ -24,8 +24,8 @@
 Apply CLAUDE.md "a flag sampled before an `await` is a guard": queue on the throw as well as on `!connected`. Ratchet B (bare-delivery-await) must not go up.
 
 **Siblings must know** (write these into your log):
-- the new outcome type and where it is exported, because S13 maps the scheduler outcome after you;
-- the exact `/api/send` 202 body, because the relay (S6) treats it as not yet delivered;
+- the new outcome type and where it is exported, because plan `tagula-client-1008` S9 (formerly S13 here) maps the scheduler outcome after you;
+- the exact `/api/send` 202 body, because the WhatsApp relay (`docs/backlog/healthchecks-whatsapp-relay.md`, plan `watchdog-1011`) treats it as not yet delivered;
 - any rename in `whatsapp.ts`, because S8 and S9 edit that file after you.
 
 **Related, not yours:** `general-0928`'s `whatsapp-outbound-queue-survives-restart` will *persist* the queue. Do not persist it here. Make "queued" visible, and leave the residual pointing at that idea.

package/docs/plans/{monitoring-1005 → archive/2026-10-12-monitoring-1005}/decisions.md

@@ -4,7 +4,7 @@
 
 | ID | Blocks | Question | Options | Answer | Answered |
 |----|--------|----------|---------|--------|----------|
-| Q1 | S1 | Do you approve the Goal of `docs/backlog/healthchecks-whatsapp-relay.md` (Phase 1: one DM per real up/down transition of a Tagula healthchecks.io check, sent through the home bot's `/api/send`; no reminders; the home project is not covered)? `/f-feature-planning` on a backlog doc goes straight to Architecture. | approve / feedback: … | | |
-| Q2 | S5 | Which Telegram bot does the daily digest send through: the one healthchecks.io already uses, or a new dedicated bot? A new token is a secret, and it must be mirrored into a gitignored local file in the same sitting (global secrets rule). | reuse / new | | |
-| Q3 | S13 | Lane: does Avishai Tsabari own `src/core/runtime.ts` (landed commits in the last 14 d, none in flight)? | ours / theirs / split | | |
-| Q4 | S11 | Lane: does Avishai Tsabari own `src/agent/container-entry.ts` (landed commits in the last 14 d, none in flight)? | ours / theirs / split | | |
+| Q1 | S1 | Do you approve the Goal of `docs/backlog/healthchecks-whatsapp-relay.md` (Phase 1: one DM per real up/down transition of a Tagula healthchecks.io check, sent through the home bot's `/api/send`; no reminders; the home project is not covered)? `/f-feature-planning` on a backlog doc goes straight to Architecture. | approve / feedback: … | approve — the rewritten Goal of 2026-10-07 (fleet-monitor Worker relay feed). Owner also wants every alert on all three channels: email, Telegram and WhatsApp, WhatsApp being the one most watched  **Moot 2026-10-11:** this approval was for the Worker-shape Goal, which was reverted the same day to healthchecks.io; S6 dropped, re-approval tracked in plan `watchdog-1011` | 2026-10-11 (owner; written by Claude) |
+| Q2 | S5 | Which Telegram bot does the daily digest send through: the one healthchecks.io already uses, or a new dedicated bot? A new token is a secret, and it must be mirrored into a gitignored local file in the same sitting (global secrets rule). | reuse / new | moot — S5 dropped 2026-10-11 (the digest waits for phase 3; its transport is re-decided then, `notes/2026-10-11-monitoring-rollout-order.md`) | 2026-10-11 (Claude, on the owner's instruction) |
+| Q3 | S13 | Lane: does Avishai Tsabari own `src/core/runtime.ts` (landed commits in the last 14 d, none in flight)? | ours / theirs / split | moot — S13 moved to plan tagula-client-1008 with `--drop`; the lane is measured there (no open PR, no live branch in the file; Avishai's last edits landed) | 2026-10-08 (Claude, on the owner's instruction to decide) |
+| Q4 | S11 | Lane: does Avishai Tsabari own `src/agent/container-entry.ts` (landed commits in the last 14 d, none in flight)? | ours / theirs / split | moot — S11 moved to plan tagula-client-1008 with `--drop`; the lane is measured there (no open PR, no live branch in the file; Avishai's last edits landed) | 2026-10-08 (Claude, on the owner's instruction to decide) |

package/docs/plans/{monitoring-1005 → archive/2026-10-12-monitoring-1005}/plan.md

@@ -1,10 +1,10 @@
 # Plan: monitoring-1005
 
-**Status**: Active
-**Created**: 2026-10-05   **Last updated**: 2026-10-05
+**Status**: Archived
+**Created**: 2026-10-05   **Last updated**: 2026-10-12
 **Landing mode**: pr
 **Max width**: 4
-**Inputs**: build monitoring — live-bot failure monitoring: healthchecks-whatsapp-relay, box-watchdog, run-outcome-counters, operator-alert-ping-mirror, daily-ops-digest-via-telegram, space-probe-harness addendum, and bugs whatsapp-messages-sent-while-offline-are-dropped-forever, queued-whatsapp-send-is-reported-as-delivered, health-reports-every-adapter-as-up, whatsapp-logged-out-socket-leaves-the-process-up-and-mute, console-oauth-invalid-grant-reaches-no-operator, third-party-apps-400-is-retried-and-shown-as-try-again, service-unit-never-restarts-a-hung-process, scheduled-run-over-cloud-quota-posts-the-quota-text-as-output
+**Inputs**: build monitoring — live-bot failure monitoring: healthchecks-whatsapp-relay, box-watchdog, run-outcome-counters, operator-alert-ping-mirror, daily-ops-digest-via-telegram, space-probe-harness addendum, and bugs whatsapp-messages-sent-while-offline-are-dropped-forever, queued-whatsapp-send-is-reported-as-delivered, health-reports-every-adapter-as-up, whatsapp-logged-out-socket-leaves-the-process-up-and-mute, console-oauth-invalid-grant-reaches-no-operator, third-party-apps-400-is-retried-and-shown-as-try-again, service-unit-never-restarts-a-hung-process, scheduled-run-over-cloud-quota-posts-the-quota-text-as-output; `--rebuild --drop S5 S6` (owner, 2026-10-11)
 **Me**: saharw01, Saharw01@gmail.com
 
 > Written by `/f-ops-plan` build (and `--rebuild`) and `archive` only. Nothing perishable lives here — no base sha, no other author's file list, no story counts; `next` measures those every time it runs. `plan-state.sh` parses the tables below by their header row, so keep the column order.
@@ -13,6 +13,10 @@
 
 > **Session rules.** The owner is present, but no session deploys. Do not run `~/sync-mercury.sh`, restart the service, rebuild the image, or read `~/whatsapp-bot/.env`. Each session stops after its local commits and the check gate (CLAUDE.local.md "Push access"). The only push allowed is the docs-only claim push. Live checks go to `docs/pending-verification.md` under the session's heading.
 
+> **Rebuild 2026-10-11 (owner).** Monitoring stays on healthchecks.io and the fleet-monitor Worker is deferred (`docs/notes/2026-10-06-round0-plans-adversarial-review.md` § Handled so far). S5 (the digest) and S6 (the relay build) are dropped: the digest waits for phase 3, and the relay's Goal changed again, so it is re-planned in plan `watchdog-1011` together with box-watchdog. Q1 and Q2 are moot. This plan now carries the live bot's WhatsApp reliability fixes only.
+
+> **Cross-repo.** The order across mercury, tagula-agents and fleet-monitor is `docs/notes/2026-10-11-monitoring-rollout-order.md`. This plan runs in parallel with phases 1–2 there. It has no dependency on another repo, and none waits on it.
+
 ## Items
 
 | ID | Kind | Slug | Doc | Command | Round | Needs |
@@ -21,15 +25,10 @@
 | S2 | plan | box-watchdog | docs/ideas/box-watchdog.md | /f-feature-planning box-watchdog | 0 | — |
 | S3 | plan | run-outcome-counters | docs/ideas/run-outcome-counters.md | /f-feature-planning run-outcome-counters | 0 | — |
 | S4 | plan | operator-alert-ping-mirror | docs/ideas/operator-alert-ping-mirror.md | /f-feature-planning operator-alert-ping-mirror | 0 | — |
-| S5 | plan | daily-ops-digest-via-telegram | docs/ideas/daily-ops-digest-via-telegram.md | /f-feature-planning daily-ops-digest-via-telegram | 0 | Q2 |
-| S6 | feature | healthchecks-whatsapp-relay | docs/backlog/healthchecks-whatsapp-relay.md | /f-feature-dev healthchecks-whatsapp-relay | 4 | — |
 | S7 | bug | queued-whatsapp-send-is-reported-as-delivered | docs/bugs/queued-whatsapp-send-is-reported-as-delivered.md | /f-bug-fix queued-whatsapp-send-is-reported-as-delivered | 1 | — |
 | S8 | bug | whatsapp-logged-out-socket-leaves-the-process-up-and-mute | docs/bugs/whatsapp-logged-out-socket-leaves-the-process-up-and-mute.md | /f-bug-fix whatsapp-logged-out-socket-leaves-the-process-up-and-mute | 2 | — |
 | S9 | bug | whatsapp-messages-sent-while-offline-are-dropped-forever | docs/bugs/whatsapp-messages-sent-while-offline-are-dropped-forever.md | /f-bug-fix whatsapp-messages-sent-while-offline-are-dropped-forever | 3 | — |
-| S10 | bug | console-oauth-invalid-grant-reaches-no-operator | docs/bugs/console-oauth-invalid-grant-reaches-no-operator.md | /f-bug-fix console-oauth-invalid-grant-reaches-no-operator | 1 | — |
-| S11 | bug | third-party-apps-400-is-retried-and-shown-as-try-again | docs/bugs/third-party-apps-400-is-retried-and-shown-as-try-again.md | /f-bug-fix third-party-apps-400-is-retried-and-shown-as-try-again | 1 | Q4 |
 | S12 | bug | service-unit-never-restarts-a-hung-process | docs/bugs/service-unit-never-restarts-a-hung-process.md | /f-bug-fix service-unit-never-restarts-a-hung-process | 1 | — |
-| S13 | bug | scheduled-run-over-cloud-quota-posts-the-quota-text-as-output | docs/bugs/scheduled-run-over-cloud-quota-posts-the-quota-text-as-output.md | /f-bug-fix scheduled-run-over-cloud-quota-posts-the-quota-text-as-output | 2 | Q3 |
 
 > Kind ∈ `feature` | `bug` | `refactor` | `plan` (a Round 0 planning session) | `story` (from `--goal`; runs `/f-feature-dev`).
 > Needs = decision IDs from `decisions.md` that must be answered before this session may launch, or `—`.
@@ -41,12 +40,11 @@
 |------|----|------|-------|
 | S7 | S8 | start-after | file: src/adapters/whatsapp.ts (both predicted) |
 | S8 | S9 | start-after | file: src/adapters/whatsapp.ts (both predicted) |
-| S7 | S13 | start-after | file: src/core/task-scheduler.ts (both predicted) |
-| S7 | S6 | merge-after | semantic: the relay treats a 2xx from /api/send as delivered, which holds only once a queued send answers 202 queued (user) |
 
 > Kind ∈ `start-after` (To may not launch until From is landed) | `merge-after` (To may launch now, may not land until From is landed).
 > Basis starts with `file:` (inferred from the collision map) or `semantic:` (asked) — never mixed in one row.
-> Semantic edges: asked 2026-10-05, answer `S6 after S7`.
+> Semantic edges: asked 2026-10-05, answer `S6 after S7`. S6 was dropped on 2026-10-11, so the edge went with it; the relay in plan `watchdog-1011` lands after this plan's S7 by its own edge.
+> Rebuild 2026-10-08 (`--drop S10 S11 S13`): the three moved to plan `tagula-client-1008`, which owns the files they share with its higher-priority sessions. That plan's S9 (formerly S13 here) now carries a cross-plan `start-after` edge onto this plan's S7 for `src/core/task-scheduler.ts`.
 > S7 → S9 is implied by the chain through S8 and is not written separately.
 
 ## Rounds
@@ -55,12 +53,11 @@
 
 | Session | Action | Clears |
 |---------|--------|--------|
-| S1 | plan healthchecks-whatsapp-relay: Architecture (Phase 2), after Q1 | S6 (via `--rebuild`) |
+| S1 | plan healthchecks-whatsapp-relay (Goal only; Architecture moved to plan `watchdog-1011`) | — |
 | S2 | plan box-watchdog | — |
 | S3 | plan run-outcome-counters | — |
 | S4 | plan operator-alert-ping-mirror | — |
-| S5 | plan daily-ops-digest-via-telegram, after Q2 | — |
-| — | owner answers decisions.md Q1–Q4 | S1, S5, S11, S13 |
+| — | decisions.md Q1–Q4 all closed (Q3, Q4 moot since 2026-10-08; Q1, Q2 moot since 2026-10-11) | — |
 
 > S2–S5 are ideas, so they get planning sessions only. Their implementation sessions are planned once their Architecture exists: `--add` them in a `--rebuild`, or put them in a follow-up plan.
 
@@ -69,8 +66,6 @@
 | Session | Item | Predicted surfaces (count) |
 |---------|------|----------------------------|
 | S7 | queued-whatsapp-send-is-reported-as-delivered | 4 |
-| S10 | console-oauth-invalid-grant-reaches-no-operator | 1 |
-| S11 | third-party-apps-400-is-retried-and-shown-as-try-again | 2 |
 | S12 | service-unit-never-restarts-a-hung-process | 2 |
 
 ### Round 2
@@ -78,7 +73,6 @@
 | Session | Item | Predicted surfaces (count) |
 |---------|------|----------------------------|
 | S8 | whatsapp-logged-out-socket-leaves-the-process-up-and-mute | 1 |
-| S13 | scheduled-run-over-cloud-quota-posts-the-quota-text-as-output | 2 |
 
 ### Round 3
 
@@ -86,12 +80,6 @@
 |---------|------|----------------------------|
 | S9 | whatsapp-messages-sent-while-offline-are-dropped-forever | 1 |
 
-### Round 4
-
-| Session | Item | Predicted surfaces (count) |
-|---------|------|----------------------------|
-| S6 | healthchecks-whatsapp-relay | 0 (stale until S1 lands — then `--rebuild`) |
-
 ## Collision map
 
 > Whole files, predicted. `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them. Nine such paths were ignored: the research note, cited once by each of the seven bugs, plus `ideas/run-outcome-counters.md` and `ideas/whatsapp-outbound-queue-survives-restart.md`. Line-range variants were collapsed to their file: `src/adapters/whatsapp.ts:380`, `:653-661` and `:358-376`, `src/agent/container-runner.ts:740-843`, and `src/core/runtime.ts:3285-3337`.
@@ -99,7 +87,6 @@
 | File | Sessions |
 |------|----------|
 | src/adapters/whatsapp.ts | S7, S8, S9 |
-| src/core/task-scheduler.ts | S7, S13 |
 
 ## Predicted surfaces
 
@@ -111,10 +98,6 @@
 
 ### S4
 
-### S5
-
-### S6
-
 ### S7
 
 - src/adapters/whatsapp.ts
@@ -130,25 +113,11 @@
 
 - src/adapters/whatsapp.ts
 
-### S10
-
-- src/agent/container-runner.ts
-
-### S11
-
-- src/agent/container-entry.ts
-- src/agent/pi-failure-class.ts
-
 ### S12
 
 - src/cli/service-unit.ts
 - src/main.ts
 
-### S13
-
-- src/core/runtime.ts
-- src/core/task-scheduler.ts
-
 ## Adjudicated overlaps
 
 > Pre-answers for the execution commands' preflight overlap prompt. Scoped to exact branch + file pairs on branches that belong to NO active plan (a hand-opened worktree, another contributor). A branch of a sibling plan's session is never listed here — it becomes a cross-plan edge instead.
@@ -168,8 +137,8 @@
 
 | File / area | Author | Basis |
 |-------------|--------|-------|
-| src/core/runtime.ts | Avishai Tsabari | landed commits in 14 d (`21ea163` 09-28, `b866976` 10-01, `a6aa018` 10-05); lane Q3 (S13) |
-| src/agent/container-entry.ts | Avishai Tsabari | landed commits in 14 d; lane Q4 (S11) |
+| src/core/runtime.ts | Avishai Tsabari | landed commits in 14 d (`21ea163` 09-28, `b866976` 10-01, `a6aa018` 10-05); lane Q3 (S13; moved to plan tagula-client-1008 on 2026-10-08) |
+| src/agent/container-entry.ts | Avishai Tsabari | landed commits in 14 d; lane Q4 (S11; moved to plan tagula-client-1008 on 2026-10-08) |
 | src/core/operator-alerts.ts | Avishai Tsabari | landed commits in 14 d. No session predicts it yet; S4's implementation will, so re-measure at `--rebuild` |
 
 > Avishai's live item at build time was `host-notices-are-english-in-hebrew-spaces` (promoted to debug on `origin/dev` `200cd25`; it names `src/core/handler.ts` and `src/core/system-messages.ts`). Neither intersects this plan.
@@ -178,5 +147,10 @@
 
 | Item | Reason | Home |
 |------|--------|------|
+| S5 daily-ops-digest-via-telegram | dropped by owner 2026-10-11: on hold until phase 3, transport to be re-decided (`notes/2026-10-11-monitoring-rollout-order.md`) | docs/ideas/daily-ops-digest-via-telegram.md |
+| S6 healthchecks-whatsapp-relay | dropped by owner 2026-10-11: the Goal reverted to healthchecks.io; re-planned in plan `watchdog-1011` | docs/backlog/healthchecks-whatsapp-relay.md |
 | health-reports-every-adapter-as-up | the WhatsApp half is fixed on local `dev` as `6cf4ea7` (`/health` reads `getQrStatus()`), but the bug doc is still `Open` and was never archived. The rest (`queuedOutbound`, `lastCloseReason`) needs its own decision: close the doc with those fields as residuals, or narrow it. The idea `dashboard-adapter-status-is-frozen-true` (`d426fb7`) is the sibling surface. | docs/bugs/health-reports-every-adapter-as-up.md |
 | space-probe-harness | the idea says "deliberately not now". It waits on rehearsal-bench M2.2 (`simulateIngress`) and on tagula-agents settling its probe shape. The 2026-10-05 cross-bot WhatsApp probe addendum also needs S2 (box-watchdog) to exist as the reader. | docs/ideas/space-probe-harness.md |
+| S10 console-oauth-invalid-grant-reaches-no-operator | dropped by user — moved to plan tagula-client-1008 (2026-10-08) | docs/bugs/console-oauth-invalid-grant-reaches-no-operator.md |
+| S11 third-party-apps-400-is-retried-and-shown-as-try-again | dropped by user — moved to plan tagula-client-1008 (2026-10-08) | docs/bugs/third-party-apps-400-is-retried-and-shown-as-try-again.md |
+| S13 scheduled-run-over-cloud-quota-posts-the-quota-text-as-output | dropped by user — moved to plan tagula-client-1008 (2026-10-08) | docs/bugs/scheduled-run-over-cloud-quota-posts-the-quota-text-as-output.md |

package/docs/plans/archive/2026-10-12-monitoring-1005/sessions/S12.md

@@ -0,0 +1,47 @@
+## Launched — 2026-10-11T11:14Z
+Branch: worktree-fix-service-unit-never-restarts-a-hung-process
+Session: 3e65697f-325c-4c1e-9d4f-1a70538134fb
+
+## Report — 2026-10-11T12:34Z
+Outcome: delivered
+Delivered: local
+Blocked-on: —
+Deploy needs: unit re-render (PATH-preserving, diff before/after) + restart in a gap
+Source: command
+Files changed:
+- docs/debug/moderate/2026-10-11-service-unit-never-restarts-a-hung-process.md
+- docs/debug/service-unit-never-restarts-a-hung-process.md
+- docs/pending-verification.md
+- src/cli/mercury.ts
+- src/cli/service-unit.ts
+- src/core/systemd-watchdog.ts
+- src/main.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/service-unit.test.ts
+- tests/systemd-watchdog.test.ts
+Siblings must know:
+- watchdog-1011/S1 (box-watchdog): the in-process watchdog catches a frozen event loop only. A wedged socket or a deadlocked await keeps the timer running and is still the external /health probe's job.
+- The unit now has NotifyAccess=all: any process in the unit's cgroup can send sd_notify messages. Nothing else uses it today.
+--- final report (verbatim) ---
+~~~
+Fixed service-unit-never-restarts-a-hung-process (moderate).
+Squash commit a80b7dd on local dev (on top of 65a260f, a parallel session's local docs(verify) tick that was replayed onto origin/dev to reconcile the divergence). NOT pushed: push needs owner approval.
+Files: src/cli/service-unit.ts (NotifyAccess=all, WatchdogSec=120), src/core/systemd-watchdog.ts (new: runtime pinger, wrapper startup raise + SIGABRT handler), src/main.ts, src/cli/mercury.ts, tests/systemd-watchdog.test.ts, tests/service-unit.test.ts, tests/fixtures/release-gate/regression-map.json, docs/pending-verification.md.
+Post-mortem: docs/debug/moderate/2026-10-11-service-unit-never-restarts-a-hung-process.md
+Proved on real systemd (transient user units): healthy stays active; frozen child -> Result=watchdog with the wrapper's log line; NotifyAccess=main negative control fails silently; an 8 s blocking pull survives only with the raise.
+Gate: ~/check-mercury.sh check — 16/16 links, 6928 pass / 0 fail.
+DELIVERED: local
+~~~
+
+## Exit — 2026-10-11T12:37Z
+Verdict: unattributed (2 files)
+Source: session-end-hook
+~~~
+EXIT-RECEIPT: unattributed (2 files)
+SHARED: /home/guysaha/projects/mercury with live session 17b2b227-e433-4924-b157-bc8594f320ea (since 2026-10-11T10:49:02Z)
+SHARED: /home/guysaha/projects/mercury with live session b85f6792-899d-4e1d-95ba-4917fe8fbb88 (since 2026-10-11T08:46:30Z)
+SHARED: /home/guysaha/projects/mercury with live session c9491da9-e77d-48a0-984a-ed8a7a779e97 (since 2026-10-11T11:14:08Z)
+UNATTRIBUTED: /home/guysaha/projects/mercury/docs/plans/monitoring-1005/sessions/ — 2 files (S12.md, S7.md): changed during this session, but live session 17b2b227-e433-4924-b157-bc8594f320ea b85f6792-899d-4e1d-95ba-4917fe8fbb88 c9491da9-e77d-48a0-984a-ed8a7a779e97 shares this checkout -> nothing records whose this is: ask the owner; never discard it
+DEFERRED: push 3 commit(s) on dev -> git (/f-status reports ahead=3)
+NOTE: remote state as of the last fetch (--no-fetch)
+~~~

package/docs/plans/archive/2026-10-12-monitoring-1005/sessions/S7.md

@@ -0,0 +1,75 @@
+## Launched — 2026-10-11T11:14Z
+Branch: worktree-fix-queued-whatsapp-send-is-reported-as-delivered
+Session: c9491da9-e77d-48a0-984a-ed8a7a779e97
+
+## Report — 2026-10-11T13:14Z
+Outcome: delivered
+Delivered: local
+Blocked-on: —
+Deploy needs: restart
+Source: command
+Files changed:
+- docs/backlog/box-watchdog.md
+- docs/backlog/healthchecks-whatsapp-relay.md
+- docs/backlog/operator-alert-ping-mirror.md
+- docs/backlog/run-outcome-counters.md
+- docs/bugs/queued-whatsapp-send-is-reported-as-delivered.md
+- docs/debug/major/2026-10-11-queued-whatsapp-send-is-reported-as-delivered.md
+- docs/debug/moderate/2026-10-11-service-unit-never-restarts-a-hung-process.md
+- docs/debug/service-unit-never-restarts-a-hung-process.md
+- docs/ideas/daily-ops-digest-via-telegram.md
+- docs/notes/2026-10-06-round0-plans-adversarial-review.md
+- docs/notes/2026-10-11-monitoring-rollout-order.md
+- docs/pending-verification.md
+- docs/plans/monitoring-1005/briefs/S5.md
+- docs/plans/monitoring-1005/briefs/S6.md
+- docs/plans/monitoring-1005/briefs/S7.md
+- docs/plans/monitoring-1005/decisions.md
+- docs/plans/monitoring-1005/plan.md
+- docs/plans/watchdog-1011/briefs/S1.md
+- docs/plans/watchdog-1011/decisions.md
+- docs/plans/watchdog-1011/plan.md
+- src/adapters/whatsapp.ts
+- src/bridges/whatsapp.ts
+- src/cli/mercury.ts
+- src/cli/service-unit.ts
+- src/core/routes/send.ts
+- src/core/systemd-watchdog.ts
+- src/core/task-scheduler.ts
+- src/core/task-sender.ts
+- src/main.ts
+- src/types.ts
+- tests/direct-send.test.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/scheduler-heartbeat.test.ts
+- tests/service-unit.test.ts
+- tests/systemd-watchdog.test.ts
+- tests/task-sender.test.ts
+- tests/whatsapp-outbound-queue.test.ts
+Siblings must know:
+- New outcome types: `OutboundDelivery` + optional `PlatformBridge.deliver` in src/types.ts; `OutboundQueuedError` / `QueuedDelivery` exported from src/core/task-sender.ts; `QueuedPostResult` / `WhatsAppPostResult` from src/adapters/whatsapp.ts. `TaskDeliveryError.queued` (src/core/task-scheduler.ts) is true when the cause is an OutboundQueuedError — tagula-client-1008 S9 maps the scheduler outcome after this: a queued run is ledgered `error`, no heartbeat, no retry, no failure report. Sent-to-one/queued-to-another is still a PartialDeliveryError, which runtime.ts counts as `posted` (pings) — S9's call.
+- POST /api/send answers exactly `202` with body `{"queued": true}` when the send was parked (no spaceId); 200 `{delivered: true, spaceId}` is now only a real send. The WhatsApp relay must treat 202 as not delivered.
+- whatsapp.ts: no renames. `postMessage` return type is now `WhatsAppPostResult` (adds optional `queued`); `queueOutbound` returns `QueuedPostResult`. Bridge `sendReply` behaviour unchanged; new `deliver` and private `send` share one path.
+- Other sendDirect callers (routes/capability.ts, extension ctx.send) now get an OutboundQueuedError throw on a queued send, and runtime.sendDirect logs "Direct send failed" before /api/send answers 202 — runtime.ts was out of this lane.
+--- final report (verbatim) ---
+~~~
+Fixed: a queued WhatsApp send is reported as delivered (major).
+Squash commit 92615e7 on local dev (not pushed). Files: src/adapters/whatsapp.ts, src/bridges/whatsapp.ts, src/types.ts, src/core/task-sender.ts, src/core/task-scheduler.ts, src/core/routes/send.ts, + 4 test files and tests/fixtures/release-gate/regression-map.json.
+Post-mortem: docs/debug/major/2026-10-11-queued-whatsapp-send-is-reported-as-delivered.md
+Gate: ~/check-mercury.sh check — all 16 links passed, 6943 pass / 0 fail.
+Live checks: docs/pending-verification.md "## Plan monitoring-1005 / S7".
+DELIVERED: local (push not approved in this session). The claim push of the promotion commit was refused by the auto-mode classifier twice; not pushed.
+Rebase note: local dev had diverged from origin/dev (3 local, 2 origin docs-only commits); the branch was replayed onto local dev, so dev must be reconciled with origin/dev before the push.
+~~~
+
+## Exit — 2026-10-11T13:25Z
+Verdict: unattributed (2 files)
+Source: session-end-hook
+~~~
+EXIT-RECEIPT: unattributed (2 files)
+SHARED: /home/guysaha/projects/mercury with live session 17b2b227-e433-4924-b157-bc8594f320ea (since 2026-10-11T10:49:02Z)
+SHARED: /home/guysaha/projects/mercury with live session b85f6792-899d-4e1d-95ba-4917fe8fbb88 (since 2026-10-11T08:46:30Z)
+UNATTRIBUTED: /home/guysaha/projects/mercury/docs/plans/monitoring-1005/sessions/ — 2 files (S12.md, S7.md): changed during this session, but live session 17b2b227-e433-4924-b157-bc8594f320ea b85f6792-899d-4e1d-95ba-4917fe8fbb88 shares this checkout -> nothing records whose this is: ask the owner; never discard it
+DEFERRED: push 5 commit(s) on dev, which is also 2 behind origin/dev -> git pull --rebase first, then push (/f-status reports ahead=5)
+NOTE: remote state as of the last fetch (--no-fetch)
+~~~