mercury-agent 0.24.3-beta.3 → 0.24.3-beta.5

package/container/Dockerfile

@@ -113,6 +113,7 @@ COPY src/extensions/reserved.ts /app/src/extensions/reserved.ts
 COPY src/extensions/permission-guard.ts /app/src/extensions/permission-guard.ts
 COPY src/extensions/bash-timeout.ts /app/src/extensions/bash-timeout.ts
 COPY src/text/sanitize-text.ts /app/src/text/sanitize-text.ts
+COPY src/text/utf8-stream.ts /app/src/text/utf8-stream.ts
 COPY src/types.ts /app/src/types.ts
 COPY resources/ /app/resources/
 COPY examples/extensions/ /tmp/examples-extensions/

package/container/Dockerfile.base

@@ -82,6 +82,7 @@ COPY src/extensions/reserved.ts /app/src/extensions/reserved.ts
 COPY src/extensions/permission-guard.ts /app/src/extensions/permission-guard.ts
 COPY src/extensions/bash-timeout.ts /app/src/extensions/bash-timeout.ts
 COPY src/text/sanitize-text.ts /app/src/text/sanitize-text.ts
+COPY src/text/utf8-stream.ts /app/src/text/utf8-stream.ts
 COPY src/types.ts /app/src/types.ts
 COPY resources/ /app/resources/
 COPY examples/extensions/ /tmp/examples-extensions/

package/docs/behavior-layers.md

@@ -32,7 +32,8 @@ the repo, after a pi upgrade.
      ## Memory                            (MEMORY.md, <active_episodes>, <members>, member notes)
      ## Run budget                        (tools-capable models only)
      ## Destructive Operations — Confirmation Required
-     ## Presenting tool results           ("simple lists", "never show JSON/commands")
+     ## Presenting tool results           ("simple lists", "never show JSON/commands",
+                                           "a bot-check page is a block, never a pass")
      ## Delivery                          ("[reply] … [/reply] — only the span inside is sent";
                                            pi-jsonl-parser.ts extractReplyEnvelope honours it,
                                            a reply with no markers is sent whole)
@@ -204,6 +205,7 @@ Everything else is opt-in by instruction.
 | Voice that must hold across all spaces of one deployment | Bot Character | every space's `AGENTS.md` (drifts) |
 | Deterministic business logic, credentials, anything with numbers or dates | a capability / engine / extension, returning structured facts | prompt prose ("compute the day name yourself") |
 | What members may do | `role.member.permissions` / applicative `member_permissions` | prompt prose ("only admins may…") — the model is not the enforcement |
+| A Google Docs/Sheets/Slides link someone sent: read it through its public export first (`google-public-read.ts`, no credentials, every caller), `gws` only for a private doc and only for a caller holding it; a private doc is "not shared publicly", never "no permission" | the `gws` extension skill (top section of `examples/extensions/gws/skill/SKILL.md`; the reader prints the fact — content, `NOT-PUBLIC`, and whether this caller holds `gws`) | the permission-guard text or the platform block (they stay a hard boundary for `gws`: the export read is not an "alternative means", because it reads only what Google serves without a login); granting `gws` to members (on a shared box it is one box-wide Google credential) |
 | Knobs an extension reads (`feed-watch.*`, `longview.*`) | `extension_config` in the space profile (repo-owned, drift-checked) | hand edits on the box |
 | A fact the bot keeps getting wrong | a file the bot reads each turn (`MEMORY.md`, a notebook under `knowledge/`), written with source and date | a longer rule |
 

package/docs/configuration.md

@@ -24,7 +24,7 @@ These must be supplied via environment variables only; they are **not** read fro
 - `MERCURY_DISCORD_GATEWAY_SECRET`
 - `MERCURY_HEARTBEAT_URL` (see [Heartbeat](#heartbeat-mercury_heartbeat_url-mercury_heartbeat_tasks))
 
-Platform tokens, provider API keys, and extension keys (e.g. `MERCURY_TELEGRAM_BOT_TOKEN`, `MERCURY_BRAVE_API_KEY`) are also **env-only** today—they are not part of the YAML schema.
+Platform tokens, provider API keys, and extension keys (e.g. `MERCURY_TELEGRAM_BOT_TOKEN`, `MERCURY_BRAVE_API_KEY`, `MERCURY_TAVILY_API_KEY`) are also **env-only** today—they are not part of the YAML schema.
 
 ## YAML layout
 
@@ -521,7 +521,7 @@ agent:
 ```
 
 - **`claimed`** (default) — only variables an extension declared via `mercury.env()` are passed, and only when the triggering caller holds that extension's permission. Undeclared variables stay on the host.
-- **`all`** — every `MERCURY_*` var except a fixed blocklist is passed into the container with the prefix stripped (`MERCURY_BILLING_API_KEY` → `BILLING_API_KEY`). Convenient, but blunt: a secret added to `.env` for one purpose reaches **every space's container**, regardless of who triggered the turn or whether that space has anything to do with it. Vars an extension declares `hostOnly` are excluded even here — `MERCURY_BRAVE_API_KEY` stays on the host once `web-search` is installed, which brokers Brave queries through `mrctl capability web-search`.
+- **`all`** — every `MERCURY_*` var except a fixed blocklist is passed into the container with the prefix stripped (`MERCURY_BILLING_API_KEY` → `BILLING_API_KEY`). Convenient, but blunt: a secret added to `.env` for one purpose reaches **every space's container**, regardless of who triggered the turn or whether that space has anything to do with it. Vars an extension declares `hostOnly` are excluded even here — `MERCURY_BRAVE_API_KEY` and `MERCURY_TAVILY_API_KEY` stay on the host once `web-search` is installed, which brokers search queries through `mrctl capability web-search` (see `docs/web-search.md` for the provider chain and its `web-search.providers`, `monthly_budget` and `tavily_monthly_budget` keys).
 
 **Model-provider credentials are exempt** and pass in both modes (`MERCURY_ANTHROPIC_API_KEY`, `MERCURY_ANTHROPIC_OAUTH_TOKEN`, `MERCURY_GEMINI_API_KEY`, `MERCURY_GROQ_API_KEY`, and the rest of the provider list). pi reads them inside the container, and no extension declares them — without the exemption, `claimed` would leave the agent unable to reach any model. They remain subject to the blocklist.
 

package/docs/pending-verification.md

@@ -2402,9 +2402,9 @@ Image rebuild (`src/agent/container-entry.ts` is baked), then restart; verify th
 
 Image rebuild (`src/agent/container-entry.ts` is baked), then restart; the host hint and the drift metric are in `src/core/runtime.ts` and go live with the restart.
 
-- [ ] MANUAL-VERIFY(2026-10-10): `docker run --rm --entrypoint grep <derived ext image> -c "## Reply language" /app/src/agent/container-entry.ts` prints 1 (fix `reply-language-drifts-to-english-on-hebrew-input`).
-- [ ] MANUAL-VERIFY(2026-10-10): Send the bot a Hebrew question that takes many tool calls (for example a lookup across several sites). The reply is in Hebrew, and the run's trace shows the prompt ending in `<reply_language>he</reply_language>`.
-- [ ] MANUAL-VERIFY(2026-10-10): In `main`, write one message in English: the reply is in English and the journal has no `Reply language drifted` line for it.
+- [x] MANUAL-VERIFY(2026-10-10): `docker run --rm --entrypoint grep <derived ext image> -c "## Reply language" /app/src/agent/container-entry.ts` prints 1 (fix `reply-language-drifts-to-english-on-hebrew-input`). **PASSED 2026-10-10**: `mercury-agent-ext:9b669aa35969` printed 1.
+- [x] MANUAL-VERIFY(2026-10-10): Send the bot a Hebrew question that takes many tool calls (for example a lookup across several sites). The reply is in Hebrew, and the run's trace shows the prompt ending in `<reply_language>he</reply_language>`. **PASSED 2026-10-10**: weather + USD/ILS question in `main`, Hebrew reply with tool calls, trace `mercury-1791648092438-1.jsonl` carries the tag.
+- [x] MANUAL-VERIFY(2026-10-10): In `main`, write one message in English: the reply is in English and the journal has no `Reply language drifted` line for it. **FAILED 2026-10-10** (1 of 2 English messages answered in Hebrew; filed and fixed as `reply-language-english-drifts-to-hebrew`, `9597274`). **PASSED 2026-10-11** after that deploy: 4 of 4 English messages answered in English, each trace carries `<reply_language>en</reply_language>`, a Hebrew control answered in Hebrew, 0 drift lines.
 - [ ] MANUAL-VERIFY(2026-10-10): A week after the deploy, count `Reply language drifted` lines in the journal against the Hebrew-input runs. Close or act on `docs/bugs/reply-language-drift-gets-no-rewrite.md` from that number.
 - [ ] MANUAL-VERIFY(2026-10-10): On the Tagula box, after its next deploy: the same count, by space (aggregate only). Before the fix it was 25 of 168.
 
@@ -2422,3 +2422,48 @@ Image rebuild (`src/agent/container-entry.ts` is baked), then restart; the host
 
 - [ ] MANUAL-VERIFY(2026-10-10): On a console box (Tagula), in a space whose Anthropic grant was revoked: send one message. The user should get the "session expired / reconnect" reply, not "Something went wrong", and the operator should get one 🚨 DM naming `MERCURY_ANTHROPIC_OAUTH_TOKEN (console credential blob)`. A second message within the cooldown should send no second DM.
 - [ ] MANUAL-VERIFY(2026-10-10): After reconnecting in the console, the next message should get a normal answer, and a later revoke should alert again without waiting for the cooldown.
+
+## Plan monitoring-1005 / S12
+
+- [ ] MANUAL-VERIFY(2026-10-11): Before re-rendering the unit, copy `~/.config/systemd/user/mercury.service` aside. Re-run `service install` from a script file with the old unit's `PATH` exported. `diff` old and new should show exactly two added lines, `NotifyAccess=all` and `WatchdogSec=120`, and the `PATH` line should be unchanged.
+- [ ] MANUAL-VERIFY(2026-10-11): After the restart (in a gap), `systemctl --user show mercury -p WatchdogUSec -p NotifyAccess` should print `2min` and `all`. The journal should have one `systemd watchdog: pinging … watchdogMs=120000 intervalMs=30000` line. Ten minutes later the unit should still be `active` with the same `MainPID` (pings are being accepted).
+- [ ] MANUAL-VERIFY(2026-10-11): Over the next days, `journalctl --user -u mercury | grep 'systemd watchdog'` should show no `ping failed` lines. Any `event loop was blocked` line names a stall worth a bug report.
+
+## Plan monitoring-1005 / S7 — a queued WhatsApp send is no longer reported as delivered (added 2026-10-11, deploy-gated: restart)
+
+- [ ] MANUAL-VERIFY(2026-10-11): After restart, with WhatsApp disconnected, call `POST /api/send` to the owner's DM. It should answer **202** with `{"queued":true}` (not `{"delivered":true}`), and the journal should show `Direct send queued, not delivered`. When WhatsApp reconnects, the message should arrive once.
+- [ ] MANUAL-VERIFY(2026-10-11): The next time WhatsApp is down while a task in `MERCURY_HEARTBEAT_TASKS` runs: the journal should show `Scheduled task output queued, not delivered` and **no** `Heartbeat pinged` line, the run is `error` in `task_runs`, there is no `Scheduled task will be retried` line, and healthchecks.io goes late for that task.
+
+## Bug fix pi-stdout-chunks-decoded-separately-split-utf8-in-replies (added 2026-10-11, deploy-gated: image rebuild)
+
+- [ ] MANUAL-VERIFY(2026-10-11): After `container/build.sh` and a restart in a gap, run `docker run --rm --entrypoint grep mercury-agent:latest -c onUtf8Data /app/src/agent/container-entry.ts` (should print 2 or more) and `… -c setEncoding /app/resources/pi-extensions/subagent/index.ts` (should print 2). On Tagula, check the same thing in the image tag the box runs.
+- [ ] MANUAL-VERIFY(2026-10-11): About two weeks after the deploy, `SELECT count(*) FROM messages WHERE role='assistant' AND created_at > '<deploy time>' AND content LIKE '%' || char(65533) || '%'` should be 0 on both boxes. Before the fix it was about 1 in 110 replies. A hit whose `��` shows up in pi's own `message_end` line, not on a chunk boundary, is the separate model-emitted case named in the post-mortem.
+
+## Plan monitoring-1005 / S8 — a logged-out WhatsApp device is loud, not mute (added 2026-10-11, deploy-gated: restart)
+
+- [x] MANUAL-VERIFY(2026-10-11): After the restart (in a gap), `curl -s http://127.0.0.1:8787/health` should contain `"whatsappNeedsRepair":false` and `"whatsapp":true` under `adapters`. **PASSED 2026-10-12**: box at `a454651` (restarted 2026-10-11 21:16), `/health` returned `"adapters":{"whatsapp":true},"whatsappNeedsRepair":false`.
+- [ ] MANUAL-VERIFY(2026-10-11): Do not unlink the live device to test this. The next time WhatsApp really logs the bot out, the journal should show exactly one `ERROR` line `WhatsApp logged out … mercury auth whatsapp …` and no `WhatsApp reconnecting` after it. `/health` should show `"whatsappNeedsRepair":true`, and `GET /auth/whatsapp` (with the API secret) should answer `{"status":"needs-repair","reason":"logged-out"}`.
+
+## search-provider-fallback-chain: keys and Tagula deploy (2026-10-11)
+
+- [ ] MANUAL-VERIFY(2026-10-11): Tagula (`tagula-assistant`) still runs 0.24.3-beta.3 without the Tavily provider; its `.env` already holds its own `MERCURY_TAVILY_API_KEY` (backup `.env.bak-2026-10-11-tavily` beside it). After it is deployed with `cdf7d09` or later and restarted in a gap, `ls /opt/tagula/assistants/tagula-assistant/.mercury/extensions/web-search/providers/` lists `tavily.ts` and one search in the management space logs `provider=tavily` (Tagula's Brave credit is gone until 2026-11-01).
+- [ ] MANUAL-VERIFY(2026-10-11): The local bot's Tavily key was only called directly, never through the chain. When Brave next runs out or is skipped, one search's journal line shows `provider=tavily`.
+
+## Plan monitoring-1005 / S9 — messages sent while the bot was offline are answered or noticed (added 2026-10-12, deploy-gated: restart)
+
+- [ ] MANUAL-VERIFY(2026-10-12): After the restart (in a gap), send the bot a DM from another phone within a minute of the restart. It should be answered, and the journal should show `WhatsApp offline message admitted` (or `WhatsApp inbound` if it arrived live).
+- [ ] MANUAL-VERIFY(2026-10-12): Next real outage longer than 15 minutes (do not cause one): the journal should show one `WhatsApp offline message dropped: too old to answer` line per missed message and one `WhatsApp offline notice sent` per DM chat, and that chat should get one "I was offline…" (or Hebrew) message with the right time range.
+
+## Plan tagula-predeploy-1014 / S1 — public Google Docs links are read without gws (added 2026-10-14, deploy-gated: image rebuild)
+
+- [ ] MANUAL-VERIFY(2026-10-14): As a member without gws, send the bot a public Google Docs link, then a private one. The first should come back with the document's content, the second with "this document isn't shared publicly — set it to Anyone with the link, or paste it", and no permission message either time.
+
+## Plan tagula-predeploy-1014 / S2 — a bot-check page is reported as a block, never a pass (added 2026-10-14, deploy-gated: image rebuild)
+
+- [ ] MANUAL-VERIFY(2026-10-14): After the beta.4 image is built on the Tagula box (plan D1), `docker run --rm --entrypoint grep <the mercury-agent image> -c "Blocked pages" /app/src/agent/container-entry.ts` prints 1 (grep the image, not the repo).
+- [ ] MANUAL-VERIFY(2026-10-14): The next time a site blocks a fetch (for example passportnews.co.il from the Tagula box), the reply says it was blocked and quotes the page title ("Just a moment…" or "Performing security verification"). It must not say the check was passed or that the site "didn't respond after".
+
+## Plan tagula-predeploy-1014 / S3 — the first navigation waits for pinchtab's browser (added 2026-10-14, deploy-gated: image rebuild, rides beta.4)
+
+- [ ] MANUAL-VERIFY(2026-10-14): After beta.4 is deployed to the Tagula box, `docker run --rm --entrypoint grep <the derived mercury-agent-ext image> -c _pinchtab_await_instance /usr/local/bin/pinchtab_ensure` prints a number above 0. Grep the image, not the repo.
+- [ ] MANUAL-VERIFY(2026-10-14): Over the next week of Tagula traces, no `Error 409` `no_current_tab` right after a run's first `pinchtab_ensure`. If a navigation does fail, `pinchtab_nav` prints `the navigation to … FAILED`, not a silent exit 0.

package/docs/permissions.md

@@ -56,6 +56,7 @@ Custom roles can be created by assigning permissions to any role name.
 | `spaces.list` | View all spaces |
 | `spaces.rename` | Rename the current space |
 | `spaces.delete` | Delete current space and all related DB data |
+| `spaces.pause` | Run chat `/pause` and `/resume` in a group, where slash commands are otherwise admin-only. Not a member default — grant it with `mrctl permissions set member <current list>,spaces.pause`. In a DM, `/pause` needs only `prompt` |
 | `model.list` | List the configured model chain (`mrctl model list`, chat `/model list`) |
 | `model.switch` | Pin the space to one model leg (`mrctl model switch`, chat `/model switch`) or clear that pin (`mrctl model reset`, chat `/model reset`) — takes effect on the next agent run. A pinned space has no fallback; reset is refused while the space has an active scheduled task |
 | `links.list` | See the space links touching this space, which spaces reach it and at what level, and their audit (`mrctl links list/inspect/audit`). Admin-only by default: it names every space that reaches this one. Creating, changing or revoking a link (`mrctl links create/update/revoke`) is **not** a permission — those verbs are global-admin-only, and no role grant enables them |

package/docs/plans/{monitoring-1005 → archive/2026-10-12-monitoring-1005}/briefs/S7.md

@@ -24,8 +24,8 @@
 Apply CLAUDE.md "a flag sampled before an `await` is a guard": queue on the throw as well as on `!connected`. Ratchet B (bare-delivery-await) must not go up.
 
 **Siblings must know** (write these into your log):
-- the new outcome type and where it is exported, because S13 maps the scheduler outcome after you;
-- the exact `/api/send` 202 body, because the relay (S6) treats it as not yet delivered;
+- the new outcome type and where it is exported, because plan `tagula-client-1008` S9 (formerly S13 here) maps the scheduler outcome after you;
+- the exact `/api/send` 202 body, because the WhatsApp relay (`docs/backlog/healthchecks-whatsapp-relay.md`, plan `watchdog-1011`) treats it as not yet delivered;
 - any rename in `whatsapp.ts`, because S8 and S9 edit that file after you.
 
 **Related, not yours:** `general-0928`'s `whatsapp-outbound-queue-survives-restart` will *persist* the queue. Do not persist it here. Make "queued" visible, and leave the residual pointing at that idea.

package/docs/plans/{monitoring-1005 → archive/2026-10-12-monitoring-1005}/decisions.md

@@ -4,7 +4,7 @@
 
 | ID | Blocks | Question | Options | Answer | Answered |
 |----|--------|----------|---------|--------|----------|
-| Q1 | S1 | Do you approve the Goal of `docs/backlog/healthchecks-whatsapp-relay.md` (Phase 1: one DM per real up/down transition of a Tagula healthchecks.io check, sent through the home bot's `/api/send`; no reminders; the home project is not covered)? `/f-feature-planning` on a backlog doc goes straight to Architecture. | approve / feedback: … | | |
-| Q2 | S5 | Which Telegram bot does the daily digest send through: the one healthchecks.io already uses, or a new dedicated bot? A new token is a secret, and it must be mirrored into a gitignored local file in the same sitting (global secrets rule). | reuse / new | | |
+| Q1 | S1 | Do you approve the Goal of `docs/backlog/healthchecks-whatsapp-relay.md` (Phase 1: one DM per real up/down transition of a Tagula healthchecks.io check, sent through the home bot's `/api/send`; no reminders; the home project is not covered)? `/f-feature-planning` on a backlog doc goes straight to Architecture. | approve / feedback: … | approve — the rewritten Goal of 2026-10-07 (fleet-monitor Worker relay feed). Owner also wants every alert on all three channels: email, Telegram and WhatsApp, WhatsApp being the one most watched  **Moot 2026-10-11:** this approval was for the Worker-shape Goal, which was reverted the same day to healthchecks.io; S6 dropped, re-approval tracked in plan `watchdog-1011` | 2026-10-11 (owner; written by Claude) |
+| Q2 | S5 | Which Telegram bot does the daily digest send through: the one healthchecks.io already uses, or a new dedicated bot? A new token is a secret, and it must be mirrored into a gitignored local file in the same sitting (global secrets rule). | reuse / new | moot — S5 dropped 2026-10-11 (the digest waits for phase 3; its transport is re-decided then, `notes/2026-10-11-monitoring-rollout-order.md`) | 2026-10-11 (Claude, on the owner's instruction) |
 | Q3 | S13 | Lane: does Avishai Tsabari own `src/core/runtime.ts` (landed commits in the last 14 d, none in flight)? | ours / theirs / split | moot — S13 moved to plan tagula-client-1008 with `--drop`; the lane is measured there (no open PR, no live branch in the file; Avishai's last edits landed) | 2026-10-08 (Claude, on the owner's instruction to decide) |
 | Q4 | S11 | Lane: does Avishai Tsabari own `src/agent/container-entry.ts` (landed commits in the last 14 d, none in flight)? | ours / theirs / split | moot — S11 moved to plan tagula-client-1008 with `--drop`; the lane is measured there (no open PR, no live branch in the file; Avishai's last edits landed) | 2026-10-08 (Claude, on the owner's instruction to decide) |

package/docs/plans/{monitoring-1005 → archive/2026-10-12-monitoring-1005}/plan.md

@@ -1,10 +1,10 @@
 # Plan: monitoring-1005
 
-**Status**: Active
-**Created**: 2026-10-05   **Last updated**: 2026-10-08
+**Status**: Archived
+**Created**: 2026-10-05   **Last updated**: 2026-10-12
 **Landing mode**: pr
 **Max width**: 4
-**Inputs**: build monitoring — live-bot failure monitoring: healthchecks-whatsapp-relay, box-watchdog, run-outcome-counters, operator-alert-ping-mirror, daily-ops-digest-via-telegram, space-probe-harness addendum, and bugs whatsapp-messages-sent-while-offline-are-dropped-forever, queued-whatsapp-send-is-reported-as-delivered, health-reports-every-adapter-as-up, whatsapp-logged-out-socket-leaves-the-process-up-and-mute, console-oauth-invalid-grant-reaches-no-operator, third-party-apps-400-is-retried-and-shown-as-try-again, service-unit-never-restarts-a-hung-process, scheduled-run-over-cloud-quota-posts-the-quota-text-as-output
+**Inputs**: build monitoring — live-bot failure monitoring: healthchecks-whatsapp-relay, box-watchdog, run-outcome-counters, operator-alert-ping-mirror, daily-ops-digest-via-telegram, space-probe-harness addendum, and bugs whatsapp-messages-sent-while-offline-are-dropped-forever, queued-whatsapp-send-is-reported-as-delivered, health-reports-every-adapter-as-up, whatsapp-logged-out-socket-leaves-the-process-up-and-mute, console-oauth-invalid-grant-reaches-no-operator, third-party-apps-400-is-retried-and-shown-as-try-again, service-unit-never-restarts-a-hung-process, scheduled-run-over-cloud-quota-posts-the-quota-text-as-output; `--rebuild --drop S5 S6` (owner, 2026-10-11)
 **Me**: saharw01, Saharw01@gmail.com
 
 > Written by `/f-ops-plan` build (and `--rebuild`) and `archive` only. Nothing perishable lives here — no base sha, no other author's file list, no story counts; `next` measures those every time it runs. `plan-state.sh` parses the tables below by their header row, so keep the column order.
@@ -13,6 +13,10 @@
 
 > **Session rules.** The owner is present, but no session deploys. Do not run `~/sync-mercury.sh`, restart the service, rebuild the image, or read `~/whatsapp-bot/.env`. Each session stops after its local commits and the check gate (CLAUDE.local.md "Push access"). The only push allowed is the docs-only claim push. Live checks go to `docs/pending-verification.md` under the session's heading.
 
+> **Rebuild 2026-10-11 (owner).** Monitoring stays on healthchecks.io and the fleet-monitor Worker is deferred (`docs/notes/2026-10-06-round0-plans-adversarial-review.md` § Handled so far). S5 (the digest) and S6 (the relay build) are dropped: the digest waits for phase 3, and the relay's Goal changed again, so it is re-planned in plan `watchdog-1011` together with box-watchdog. Q1 and Q2 are moot. This plan now carries the live bot's WhatsApp reliability fixes only.
+
+> **Cross-repo.** The order across mercury, tagula-agents and fleet-monitor is `docs/notes/2026-10-11-monitoring-rollout-order.md`. This plan runs in parallel with phases 1–2 there. It has no dependency on another repo, and none waits on it.
+
 ## Items
 
 | ID | Kind | Slug | Doc | Command | Round | Needs |
@@ -21,8 +25,6 @@
 | S2 | plan | box-watchdog | docs/ideas/box-watchdog.md | /f-feature-planning box-watchdog | 0 | — |
 | S3 | plan | run-outcome-counters | docs/ideas/run-outcome-counters.md | /f-feature-planning run-outcome-counters | 0 | — |
 | S4 | plan | operator-alert-ping-mirror | docs/ideas/operator-alert-ping-mirror.md | /f-feature-planning operator-alert-ping-mirror | 0 | — |
-| S5 | plan | daily-ops-digest-via-telegram | docs/ideas/daily-ops-digest-via-telegram.md | /f-feature-planning daily-ops-digest-via-telegram | 0 | Q2 |
-| S6 | feature | healthchecks-whatsapp-relay | docs/backlog/healthchecks-whatsapp-relay.md | /f-feature-dev healthchecks-whatsapp-relay | 4 | — |
 | S7 | bug | queued-whatsapp-send-is-reported-as-delivered | docs/bugs/queued-whatsapp-send-is-reported-as-delivered.md | /f-bug-fix queued-whatsapp-send-is-reported-as-delivered | 1 | — |
 | S8 | bug | whatsapp-logged-out-socket-leaves-the-process-up-and-mute | docs/bugs/whatsapp-logged-out-socket-leaves-the-process-up-and-mute.md | /f-bug-fix whatsapp-logged-out-socket-leaves-the-process-up-and-mute | 2 | — |
 | S9 | bug | whatsapp-messages-sent-while-offline-are-dropped-forever | docs/bugs/whatsapp-messages-sent-while-offline-are-dropped-forever.md | /f-bug-fix whatsapp-messages-sent-while-offline-are-dropped-forever | 3 | — |
@@ -38,11 +40,10 @@
 |------|----|------|-------|
 | S7 | S8 | start-after | file: src/adapters/whatsapp.ts (both predicted) |
 | S8 | S9 | start-after | file: src/adapters/whatsapp.ts (both predicted) |
-| S7 | S6 | merge-after | semantic: the relay treats a 2xx from /api/send as delivered, which holds only once a queued send answers 202 queued (user) |
 
 > Kind ∈ `start-after` (To may not launch until From is landed) | `merge-after` (To may launch now, may not land until From is landed).
 > Basis starts with `file:` (inferred from the collision map) or `semantic:` (asked) — never mixed in one row.
-> Semantic edges: asked 2026-10-05, answer `S6 after S7`.
+> Semantic edges: asked 2026-10-05, answer `S6 after S7`. S6 was dropped on 2026-10-11, so the edge went with it; the relay in plan `watchdog-1011` lands after this plan's S7 by its own edge.
 > Rebuild 2026-10-08 (`--drop S10 S11 S13`): the three moved to plan `tagula-client-1008`, which owns the files they share with its higher-priority sessions. That plan's S9 (formerly S13 here) now carries a cross-plan `start-after` edge onto this plan's S7 for `src/core/task-scheduler.ts`.
 > S7 → S9 is implied by the chain through S8 and is not written separately.
 
@@ -52,12 +53,11 @@
 
 | Session | Action | Clears |
 |---------|--------|--------|
-| S1 | plan healthchecks-whatsapp-relay: Architecture (Phase 2), after Q1 | S6 (via `--rebuild`) |
+| S1 | plan healthchecks-whatsapp-relay (Goal only; Architecture moved to plan `watchdog-1011`) | — |
 | S2 | plan box-watchdog | — |
 | S3 | plan run-outcome-counters | — |
 | S4 | plan operator-alert-ping-mirror | — |
-| S5 | plan daily-ops-digest-via-telegram, after Q2 | — |
-| — | owner answers decisions.md Q1–Q2 (Q3, Q4 moot since 2026-10-08) | S1, S5 |
+| — | decisions.md Q1–Q4 all closed (Q3, Q4 moot since 2026-10-08; Q1, Q2 moot since 2026-10-11) | — |
 
 > S2–S5 are ideas, so they get planning sessions only. Their implementation sessions are planned once their Architecture exists: `--add` them in a `--rebuild`, or put them in a follow-up plan.
 
@@ -80,12 +80,6 @@
 |---------|------|----------------------------|
 | S9 | whatsapp-messages-sent-while-offline-are-dropped-forever | 1 |
 
-### Round 4
-
-| Session | Item | Predicted surfaces (count) |
-|---------|------|----------------------------|
-| S6 | healthchecks-whatsapp-relay | 0 (stale until S1 lands — then `--rebuild`) |
-
 ## Collision map
 
 > Whole files, predicted. `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them. Nine such paths were ignored: the research note, cited once by each of the seven bugs, plus `ideas/run-outcome-counters.md` and `ideas/whatsapp-outbound-queue-survives-restart.md`. Line-range variants were collapsed to their file: `src/adapters/whatsapp.ts:380`, `:653-661` and `:358-376`, `src/agent/container-runner.ts:740-843`, and `src/core/runtime.ts:3285-3337`.
@@ -104,10 +98,6 @@
 
 ### S4
 
-### S5
-
-### S6
-
 ### S7
 
 - src/adapters/whatsapp.ts
@@ -157,6 +147,8 @@
 
 | Item | Reason | Home |
 |------|--------|------|
+| S5 daily-ops-digest-via-telegram | dropped by owner 2026-10-11: on hold until phase 3, transport to be re-decided (`notes/2026-10-11-monitoring-rollout-order.md`) | docs/ideas/daily-ops-digest-via-telegram.md |
+| S6 healthchecks-whatsapp-relay | dropped by owner 2026-10-11: the Goal reverted to healthchecks.io; re-planned in plan `watchdog-1011` | docs/backlog/healthchecks-whatsapp-relay.md |
 | health-reports-every-adapter-as-up | the WhatsApp half is fixed on local `dev` as `6cf4ea7` (`/health` reads `getQrStatus()`), but the bug doc is still `Open` and was never archived. The rest (`queuedOutbound`, `lastCloseReason`) needs its own decision: close the doc with those fields as residuals, or narrow it. The idea `dashboard-adapter-status-is-frozen-true` (`d426fb7`) is the sibling surface. | docs/bugs/health-reports-every-adapter-as-up.md |
 | space-probe-harness | the idea says "deliberately not now". It waits on rehearsal-bench M2.2 (`simulateIngress`) and on tagula-agents settling its probe shape. The 2026-10-05 cross-bot WhatsApp probe addendum also needs S2 (box-watchdog) to exist as the reader. | docs/ideas/space-probe-harness.md |
 | S10 console-oauth-invalid-grant-reaches-no-operator | dropped by user — moved to plan tagula-client-1008 (2026-10-08) | docs/bugs/console-oauth-invalid-grant-reaches-no-operator.md |

package/docs/plans/archive/2026-10-12-monitoring-1005/sessions/S12.md

@@ -0,0 +1,47 @@
+## Launched — 2026-10-11T11:14Z
+Branch: worktree-fix-service-unit-never-restarts-a-hung-process
+Session: 3e65697f-325c-4c1e-9d4f-1a70538134fb
+
+## Report — 2026-10-11T12:34Z
+Outcome: delivered
+Delivered: local
+Blocked-on: —
+Deploy needs: unit re-render (PATH-preserving, diff before/after) + restart in a gap
+Source: command
+Files changed:
+- docs/debug/moderate/2026-10-11-service-unit-never-restarts-a-hung-process.md
+- docs/debug/service-unit-never-restarts-a-hung-process.md
+- docs/pending-verification.md
+- src/cli/mercury.ts
+- src/cli/service-unit.ts
+- src/core/systemd-watchdog.ts
+- src/main.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/service-unit.test.ts
+- tests/systemd-watchdog.test.ts
+Siblings must know:
+- watchdog-1011/S1 (box-watchdog): the in-process watchdog catches a frozen event loop only. A wedged socket or a deadlocked await keeps the timer running and is still the external /health probe's job.
+- The unit now has NotifyAccess=all: any process in the unit's cgroup can send sd_notify messages. Nothing else uses it today.
+--- final report (verbatim) ---
+~~~
+Fixed service-unit-never-restarts-a-hung-process (moderate).
+Squash commit a80b7dd on local dev (on top of 65a260f, a parallel session's local docs(verify) tick that was replayed onto origin/dev to reconcile the divergence). NOT pushed: push needs owner approval.
+Files: src/cli/service-unit.ts (NotifyAccess=all, WatchdogSec=120), src/core/systemd-watchdog.ts (new: runtime pinger, wrapper startup raise + SIGABRT handler), src/main.ts, src/cli/mercury.ts, tests/systemd-watchdog.test.ts, tests/service-unit.test.ts, tests/fixtures/release-gate/regression-map.json, docs/pending-verification.md.
+Post-mortem: docs/debug/moderate/2026-10-11-service-unit-never-restarts-a-hung-process.md
+Proved on real systemd (transient user units): healthy stays active; frozen child -> Result=watchdog with the wrapper's log line; NotifyAccess=main negative control fails silently; an 8 s blocking pull survives only with the raise.
+Gate: ~/check-mercury.sh check — 16/16 links, 6928 pass / 0 fail.
+DELIVERED: local
+~~~
+
+## Exit — 2026-10-11T12:37Z
+Verdict: unattributed (2 files)
+Source: session-end-hook
+~~~
+EXIT-RECEIPT: unattributed (2 files)
+SHARED: /home/guysaha/projects/mercury with live session 17b2b227-e433-4924-b157-bc8594f320ea (since 2026-10-11T10:49:02Z)
+SHARED: /home/guysaha/projects/mercury with live session b85f6792-899d-4e1d-95ba-4917fe8fbb88 (since 2026-10-11T08:46:30Z)
+SHARED: /home/guysaha/projects/mercury with live session c9491da9-e77d-48a0-984a-ed8a7a779e97 (since 2026-10-11T11:14:08Z)
+UNATTRIBUTED: /home/guysaha/projects/mercury/docs/plans/monitoring-1005/sessions/ — 2 files (S12.md, S7.md): changed during this session, but live session 17b2b227-e433-4924-b157-bc8594f320ea b85f6792-899d-4e1d-95ba-4917fe8fbb88 c9491da9-e77d-48a0-984a-ed8a7a779e97 shares this checkout -> nothing records whose this is: ask the owner; never discard it
+DEFERRED: push 3 commit(s) on dev -> git (/f-status reports ahead=3)
+NOTE: remote state as of the last fetch (--no-fetch)
+~~~

package/docs/plans/archive/2026-10-12-monitoring-1005/sessions/S7.md

@@ -0,0 +1,75 @@
+## Launched — 2026-10-11T11:14Z
+Branch: worktree-fix-queued-whatsapp-send-is-reported-as-delivered
+Session: c9491da9-e77d-48a0-984a-ed8a7a779e97
+
+## Report — 2026-10-11T13:14Z
+Outcome: delivered
+Delivered: local
+Blocked-on: —
+Deploy needs: restart
+Source: command
+Files changed:
+- docs/backlog/box-watchdog.md
+- docs/backlog/healthchecks-whatsapp-relay.md
+- docs/backlog/operator-alert-ping-mirror.md
+- docs/backlog/run-outcome-counters.md
+- docs/bugs/queued-whatsapp-send-is-reported-as-delivered.md
+- docs/debug/major/2026-10-11-queued-whatsapp-send-is-reported-as-delivered.md
+- docs/debug/moderate/2026-10-11-service-unit-never-restarts-a-hung-process.md
+- docs/debug/service-unit-never-restarts-a-hung-process.md
+- docs/ideas/daily-ops-digest-via-telegram.md
+- docs/notes/2026-10-06-round0-plans-adversarial-review.md
+- docs/notes/2026-10-11-monitoring-rollout-order.md
+- docs/pending-verification.md
+- docs/plans/monitoring-1005/briefs/S5.md
+- docs/plans/monitoring-1005/briefs/S6.md
+- docs/plans/monitoring-1005/briefs/S7.md
+- docs/plans/monitoring-1005/decisions.md
+- docs/plans/monitoring-1005/plan.md
+- docs/plans/watchdog-1011/briefs/S1.md
+- docs/plans/watchdog-1011/decisions.md
+- docs/plans/watchdog-1011/plan.md
+- src/adapters/whatsapp.ts
+- src/bridges/whatsapp.ts
+- src/cli/mercury.ts
+- src/cli/service-unit.ts
+- src/core/routes/send.ts
+- src/core/systemd-watchdog.ts
+- src/core/task-scheduler.ts
+- src/core/task-sender.ts
+- src/main.ts
+- src/types.ts
+- tests/direct-send.test.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/scheduler-heartbeat.test.ts
+- tests/service-unit.test.ts
+- tests/systemd-watchdog.test.ts
+- tests/task-sender.test.ts
+- tests/whatsapp-outbound-queue.test.ts
+Siblings must know:
+- New outcome types: `OutboundDelivery` + optional `PlatformBridge.deliver` in src/types.ts; `OutboundQueuedError` / `QueuedDelivery` exported from src/core/task-sender.ts; `QueuedPostResult` / `WhatsAppPostResult` from src/adapters/whatsapp.ts. `TaskDeliveryError.queued` (src/core/task-scheduler.ts) is true when the cause is an OutboundQueuedError — tagula-client-1008 S9 maps the scheduler outcome after this: a queued run is ledgered `error`, no heartbeat, no retry, no failure report. Sent-to-one/queued-to-another is still a PartialDeliveryError, which runtime.ts counts as `posted` (pings) — S9's call.
+- POST /api/send answers exactly `202` with body `{"queued": true}` when the send was parked (no spaceId); 200 `{delivered: true, spaceId}` is now only a real send. The WhatsApp relay must treat 202 as not delivered.
+- whatsapp.ts: no renames. `postMessage` return type is now `WhatsAppPostResult` (adds optional `queued`); `queueOutbound` returns `QueuedPostResult`. Bridge `sendReply` behaviour unchanged; new `deliver` and private `send` share one path.
+- Other sendDirect callers (routes/capability.ts, extension ctx.send) now get an OutboundQueuedError throw on a queued send, and runtime.sendDirect logs "Direct send failed" before /api/send answers 202 — runtime.ts was out of this lane.
+--- final report (verbatim) ---
+~~~
+Fixed: a queued WhatsApp send is reported as delivered (major).
+Squash commit 92615e7 on local dev (not pushed). Files: src/adapters/whatsapp.ts, src/bridges/whatsapp.ts, src/types.ts, src/core/task-sender.ts, src/core/task-scheduler.ts, src/core/routes/send.ts, + 4 test files and tests/fixtures/release-gate/regression-map.json.
+Post-mortem: docs/debug/major/2026-10-11-queued-whatsapp-send-is-reported-as-delivered.md
+Gate: ~/check-mercury.sh check — all 16 links passed, 6943 pass / 0 fail.
+Live checks: docs/pending-verification.md "## Plan monitoring-1005 / S7".
+DELIVERED: local (push not approved in this session). The claim push of the promotion commit was refused by the auto-mode classifier twice; not pushed.
+Rebase note: local dev had diverged from origin/dev (3 local, 2 origin docs-only commits); the branch was replayed onto local dev, so dev must be reconciled with origin/dev before the push.
+~~~
+
+## Exit — 2026-10-11T13:25Z
+Verdict: unattributed (2 files)
+Source: session-end-hook
+~~~
+EXIT-RECEIPT: unattributed (2 files)
+SHARED: /home/guysaha/projects/mercury with live session 17b2b227-e433-4924-b157-bc8594f320ea (since 2026-10-11T10:49:02Z)
+SHARED: /home/guysaha/projects/mercury with live session b85f6792-899d-4e1d-95ba-4917fe8fbb88 (since 2026-10-11T08:46:30Z)
+UNATTRIBUTED: /home/guysaha/projects/mercury/docs/plans/monitoring-1005/sessions/ — 2 files (S12.md, S7.md): changed during this session, but live session 17b2b227-e433-4924-b157-bc8594f320ea b85f6792-899d-4e1d-95ba-4917fe8fbb88 shares this checkout -> nothing records whose this is: ask the owner; never discard it
+DEFERRED: push 5 commit(s) on dev, which is also 2 behind origin/dev -> git pull --rebase first, then push (/f-status reports ahead=5)
+NOTE: remote state as of the last fetch (--no-fetch)
+~~~

package/docs/plans/archive/2026-10-12-monitoring-1005/sessions/S8.md

@@ -0,0 +1,66 @@
+## Launched — 2026-10-11T15:39Z
+Branch: worktree-fix-whatsapp-logged-out-socket-leaves-the-process-up-and-mute
+Session: a4d3146c-a1f3-445e-b709-1ee7fed3c4bf
+
+## Report — 2026-10-11T17:37Z
+Outcome: delivered
+Delivered: local
+Blocked-on: —
+Deploy needs: restart
+Source: command
+Files changed:
+- container/Dockerfile
+- container/Dockerfile.base
+- docs/bugs/mercury-auth-whatsapp-reports-already-authenticated-on-logged-out-creds.md
+- docs/debug/major/2026-10-11-whatsapp-logged-out-socket-leaves-the-process-up-and-mute.md
+- docs/debug/moderate/2026-10-11-pi-stdout-chunks-decoded-separately-split-utf8-in-replies.md
+- docs/debug/whatsapp-logged-out-socket-leaves-the-process-up-and-mute.md
+- docs/pending-verification.md
+- examples/extensions/longview/summarize.ts
+- examples/extensions/napkin/index.ts
+- resources/pi-extensions/subagent/index.ts
+- src/adapters/whatsapp.ts
+- src/agent/container-entry.ts
+- src/agent/container-runner.ts
+- src/agent/image-contract.ts
+- src/core/exec.ts
+- src/extensions/image-builder.ts
+- src/preflight/binary-version.ts
+- src/server.ts
+- src/text/utf8-stream.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/health.test.ts
+- tests/longview-summarize.test.ts
+- tests/utf8-stream.test.ts
+- tests/whatsapp-logged-out.test.ts
+Siblings must know:
+- S9: while WhatsApp is logged out, postMessage keeps appending to the in-memory outgoingQueue with no bound and nothing will ever flush it. getQrStatus().status === "needs-repair" is the signal to stop queueing (or to persist instead).
+- operator-alert-ping-mirror: alert source is /health `whatsappNeedsRepair: true` or getQrStatus().status === "needs-repair".
+- The connection.update listener body is now the private method handleConnectionUpdate(update) in src/adapters/whatsapp.ts.
+--- final report (verbatim) ---
+~~~
+Fixed whatsapp-logged-out-socket-leaves-the-process-up-and-mute (major).
+- src/adapters/whatsapp.ts: connection.update body is now handleConnectionUpdate(). A 401 loggedOut close sets needs-repair on getQrStatus() ({status:"needs-repair",reason:"logged-out"}), logs one error naming the repair (stop, move auth dir aside, `mercury auth whatsapp`, start), no reconnect, process stays up. `open` clears it.
+- src/server.ts: one readWhatsAppState() feeds isAdapterUp() and new isWhatsAppNeedsRepair(); /health gains always-emitted boolean `whatsappNeedsRepair` (only booleans leave /health).
+- tests/whatsapp-logged-out.test.ts (6, negative-tested), tests/health.test.ts (+2), regression-map row.
+- Follow-up bug filed: docs/bugs/mercury-auth-whatsapp-reports-already-authenticated-on-logged-out-creds.md
+- Post-mortem: docs/debug/major/2026-10-11-whatsapp-logged-out-socket-leaves-the-process-up-and-mute.md
+- Live checks: docs/pending-verification.md "## Plan monitoring-1005 / S8".
+- Gate on the rebased tree: 15/16 links pass; test 6964 pass / 1 fail. The one fail is release-gate-map on moderate/2026-10-11-pi-stdout-chunks-decoded-separately-split-utf8-in-replies.md (another session's post-mortem, already on local dev at 4d00843/a062eab, missing its regression-map row) - not this fix.
+DELIVERED: local (squash 0623fc9 on local dev; push not approved yet)
+~~~
+
+## Note — 2026-10-11
+The Report block's "Files changed" list was derived against origin/dev and also lists the three unpushed split-utf8 commits (7add681, 4d00843, a062eab) that sat under this branch on local dev. This fix's own files are exactly the 9 in `git show --stat 0623fc9`: src/adapters/whatsapp.ts, src/server.ts, tests/whatsapp-logged-out.test.ts, tests/health.test.ts, tests/fixtures/release-gate/regression-map.json, docs/pending-verification.md, the post-mortem rename, and the new follow-up bug doc.
+
+## Exit — 2026-10-11T17:45Z
+Verdict: unattributed (1 file)
+Source: session-end-hook
+~~~
+EXIT-RECEIPT: unattributed (1 file)
+SHARED: /home/guysaha/projects/mercury with live session 181f2d41-4ebb-4b25-a5f4-a95bc6f4bde2 (since 2026-10-11T14:20:13Z)
+SHARED: /home/guysaha/projects/mercury with live session bb84df0a-4857-479f-9250-3f332e211581 (since 2026-10-11T16:18:18Z)
+UNATTRIBUTED: /home/guysaha/projects/mercury/docs/plans/monitoring-1005/sessions/S8.md — changed during this session, but live session 181f2d41-4ebb-4b25-a5f4-a95bc6f4bde2 bb84df0a-4857-479f-9250-3f332e211581 shares this checkout -> nothing records whose this is: ask the owner; never discard it
+DEFERRED: push 4 commit(s) on dev -> git (/f-status reports ahead=4)
+NOTE: remote state as of the last fetch (--no-fetch)
+~~~

package/docs/plans/archive/2026-10-12-monitoring-1005/sessions/S9.md

@@ -0,0 +1,42 @@
+## Launched — 2026-10-12T09:50Z
+Branch: worktree-fix-whatsapp-messages-sent-while-offline-are-dropped-forever
+Session: 863a3268-442a-4142-9d6f-909bb250947c
+
+## Report — 2026-10-12T13:39Z
+Outcome: delivered
+Delivered: local
+Blocked-on: —
+Deploy needs: restart
+Source: command
+Files changed:
+- docs/debug/major/2026-10-12-whatsapp-messages-sent-while-offline-are-dropped-forever.md
+- docs/debug/whatsapp-messages-sent-while-offline-are-dropped-forever.md
+- docs/pending-verification.md
+- src/adapters/whatsapp-offline.ts
+- src/adapters/whatsapp.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/whatsapp-offline-backlog.test.ts
+Siblings must know:
+- New module src/adapters/whatsapp-offline.ts (pure: offlineVerdict, offlineNoticeAddressed, offlineNoticeLanguage, offlineNoticeText, OFFLINE_ANSWER_WINDOW_MS).
+- WhatsAppAdapter.offlineIngressStats() returns { admitted, dropped, noticesSent, noticesFailed } (in memory, reset on restart) for run-outcome-counters / the watchdog to read; no route was built.
+- The upsert listener is now the method handleMessagesUpsert(type, messages); handleIncomingMessage takes an upsertType argument.
+--- final report (verbatim) ---
+~~~
+Fixed: WhatsApp messages sent while the bot was offline were dropped silently (messages.upsert "append" was discarded, and a 10 s backlog cutoff logged at debug).
+Squash commit b22597f5 `fix(whatsapp): answer or notice messages sent while the bot was offline` on local dev (7 files, +1114/-97): src/adapters/whatsapp.ts, src/adapters/whatsapp-offline.ts (new), tests/whatsapp-offline-backlog.test.ts (27 tests), tests/fixtures/release-gate/regression-map.json, docs/pending-verification.md.
+Policy (owner, 2026-10-12): backlog ≤ 15 min is answered; older is counted, logged at info, and gets one resend notice per chat (every DM; groups only on @-mention/reply), in the majority detected language of the dropped messages, English by default.
+Post-mortem: docs/debug/major/2026-10-12-whatsapp-messages-sent-while-offline-are-dropped-forever.md
+Gate: ~/check-mercury.sh check on the rebased tree, all 16 links passed, 7048 tests.
+DELIVERED: local — not pushed; the push waits for the owner's approval (CLAUDE.local.md).
+Deploy: restart (no baked file changed). Manual checks under "## Plan monitoring-1005 / S9" in docs/pending-verification.md.
+~~~
+
+## Exit — 2026-10-12T13:42Z
+Verdict: nothing-lost (measured-only)
+Source: session-end-hook
+~~~
+EXIT-RECEIPT: nothing-lost (measured-only)
+SHARED: /home/guysaha/projects/mercury with live session 181f2d41-4ebb-4b25-a5f4-a95bc6f4bde2 (since 2026-10-11T14:20:13Z)
+DEFERRED: push 2 commit(s) on dev -> git (/f-status reports ahead=2)
+NOTE: remote state as of the last fetch (--no-fetch)
+~~~

package/docs/plans/archive/2026-10-14-tagula-predeploy-1014/briefs/D1.md

@@ -0,0 +1,64 @@
+# Brief D1 — Cut 0.24.3-beta.4 and deploy it to the Tagula box (final step, not an item)
+
+**Plan**: docs/plans/tagula-predeploy-1014/plan.md   **Task**: D1   **Kind**: release + deploy (no branch, no workflow command)
+
+> The plan's last step. It is not in the Items table: `plan-state.sh` derives "landed" from a merged branch, and a release plus a box deploy has none. Launch it by opening a fresh session in `~/projects/mercury` and saying: *"Run docs/plans/tagula-predeploy-1014/briefs/D1.md"*. Two steps below need the **owner's explicit yes in that session**: the push of the bump and tag, and the restart of the client box. Approval given in an earlier session does not carry over.
+
+## Why (decided 2026-10-14)
+
+- The Tagula box runs `0.24.3-beta.3`, pinned by hand. Its nightly `tagula-box-upgrade` logs `holding` every night (the box is ahead of `:latest` = `0.24.2`), so it **never** takes a beta by itself. A beta reaches the box only through this manual deploy.
+- **The reason for the deploy:** Brave ran out of credit on the box on 2026-10-11 (402 after 574 searches this month). There has been no web search on the box since, for every space: `guy-pishkin` told Avishai so on 10-14 08:03Z. The provider chain on `dev` (`cdf7d09`, Brave → Tavily, plus `f896e0e`) fails over on out-of-credit. `beta.3` was cut before it (`ed33f99`, 10-11 11:25), and no published version has it.
+- The box's `.env` already has `MERCURY_TAVILY_API_KEY` (name checked, value not). **Whether that key is valid and has credit is unverified.**
+- The WSL bot already runs everything on `origin/dev` as of 10-14 (`~/mercury-src` @ `8407fdb6`). Its 6 searches in 3 days all went to Brave, so failover to Tavily has **not** been seen live anywhere yet.
+- Besides web-search, `beta.4` carries everything on `dev` since `beta.3`:
+  - the WhatsApp fixes (offline messages, logged-out socket, queued send, media reset);
+  - stream decoding of child output;
+  - the reply-language tag;
+  - office-365 meeting invites;
+  - **the systemd watchdog** (`3231203`);
+  - whatever S1–S3 of this plan landed.
+
+## Preconditions
+
+1. S1, S2 and S3 are landed on `origin/dev` (`/f-ops-plan next tagula-predeploy-1014`), or the owner says to deploy without the ones that are not. T1 is not a precondition.
+2. `git fetch origin` and `git log v0.24.3-beta.3..origin/dev --oneline` shows what will ship. Read it to the owner in one paragraph.
+3. Nobody else cut a `beta.4` meanwhile: `git ls-remote --tags origin 'v0.24.3-beta.*'` and `npm view mercury-agent versions --json | tail`. **Tell Avishai first: he cut `beta.3`.**
+
+## A — Cut the release (owner yes #1)
+
+`docs/runbooks/publish-checklist.md` is the procedure. A prerelease is tagged on `dev`, and `release.yml` refuses one whose commit is not on `dev`.
+
+- Work in a scratch worktree from `origin/dev`, **not** local `dev`. Local `dev` carries unpushed docs commits (Petel/egress notes) that must not ride along. Use literal absolute paths (see memory `worktree-remove-absolute-paths`).
+- `npm version 0.24.3-beta.4 --no-git-tag-version` → commit `chore: bump version to 0.24.3-beta.4` → tag `v0.24.3-beta.4` → push the commit to `dev` and the tag.
+- Watch `release.yml`. It must produce npm `mercury-agent@0.24.3-beta.4` (dist-tag `beta`) and `ghcr.io/avishai-tsabari/mercury-agent:0.24.3-beta.4` with label `com.mercury.version=0.24.3-beta.4`, and `:latest` must **not** move. If `publish-image` fails, npm is ahead of GHCR, which is the safe direction: stop, nothing on the box moves.
+
+## B — Deploy to the box (owner yes #2, for the restart)
+
+Box: `ssh -i ~/.ssh/tagula_fleet_ed25519 root@46.225.180.66`, assistant dir `/opt/tagula/assistants/tagula-assistant`, port 8787, `export XDG_RUNTIME_DIR=/run/user/0`. Procedure: tagula-agents `docs/runbooks/run-box-upgrade.md` §4, read **from `origin/dev`** (`git -C ~/projects/tagula-agents fetch && git show origin/dev:docs/runbooks/run-box-upgrade.md`; the local checkout lags). There is no `sqlite3` on the box: use the runbook's `bun -e` one-liners.
+
+1. **Disk first.** It needs **at least 8 GB free** (`df -h /`): the base pull is about 3.6 GB and the derived ext build about 4.1 GB. On 2026-10-08 a pull into a full disk broke Kulmus (every article `submit` → HTTP 500, 09:51–10:40 IDT), and that is the failure this step prevents. On 2026-10-14 the box was freed to 12 GB (the `beta.2` image and 847 MB of `type=regular` build cache removed). **The disk tooling belongs to tagula-agents `box-disk-management`** (step 8 retrofits this box). If `tagula-box-disk` exists by then, use `tagula-box-disk status` and `room`. If not, and space is short, ask the owner; never delete on your own beyond the runbook.
+2. **Idle gap.** `/health` must show `queue.active + queue.pending + containers.active == 0`, and the last `messages` row must not be an unanswered user turn. Check the cron of active tasks (`SELECT id, cron, timezone, next_run_at FROM tasks WHERE active=1`). In `guy-pishkin`, 216 and 320 run `0 5 * * 0` (no timezone) and 406 runs `30 8 * * 0` Asia/Jerusalem. Guy works through the day, so prefer a night or early-morning gap. The updater timer (around 04:30–05:30 IDT) only logs `holding`, which is harmless.
+3. Unit file: copy `/root/.config/systemd/user/mercury.service` aside **before** anything. On 10-14 it was `Type=simple`, `Restart=on-failure`, `RestartSec=10`, with no watchdog.
+4. §4 in order:
+   - snapshot `state.db` (`VACUUM INTO`);
+   - `docker login` with `/etc/tagula/registry-token` → pull `:0.24.3-beta.4` → check its label and `image-manifest.json`;
+   - pin `MERCURY_AGENT_IMAGE` and `MERCURY_VERSION` in `.env` (atomic `sed`; read `.env` key names only, never print values);
+   - `mercury upgrade 0.24.3-beta.4` (the npm prerelease exists, so no tarball);
+   - journal: `Building derived` then `Built derived agent image`;
+   - `/health`: version `0.24.3-beta.4`, `status: ok`.
+5. **Unit diff.** `beta.4`'s watchdog adds `NotifyAccess=all` + `WatchdogSec=120` to the unit that `mercury service install` renders. Check whether `mercury upgrade` re-rendered it (diff against the saved copy). If not, ask the owner whether to re-render now. Re-rendering bakes the invoking shell's `PATH` into the unit (CLAUDE.local.md Gotchas), so carry the old unit's `PATH` over and diff again.
+
+## C — Verify (content inside the running artifact, never the repo)
+
+- **Web search:** one real search in a test space (`tagula-management`, never a client space). The journal must show `web-search: query … provider=tavily` (Brave is still out of credit until its monthly reset or a top-up). A rejected Tavily key shows as failover plus an operator alert: report it to the owner, who then has to fix the key.
+- **S1 (if landed):** in a space where you hold only the `member` role, a public Google Doc **you own** (never the client's) reads with no `gws`. A private one gives the "not shared publicly" wording.
+- **S2/S3 (if landed):** grep the **derived** image for the new pinchtab skill rule and the helper change: `docker run --rm --entrypoint grep mercury-agent-ext-tagula:<new> …`.
+- A round trip per §4 step 4 (`mercury chat` with a probe caller in a non-client space).
+- Paste the `docs/release-gate.md` §4 evidence block into `sessions/D1.md`. An empty cell is a gate not passed.
+
+## D — After
+
+- Old derived image `mercury-agent-ext-tagula:c5463f8de0fc` (4.08 GB): the derived build normally prunes it (`Pruned stale ext image`). Confirm it's gone with `docker images`.
+- Keep the `beta.3` base as the rollback (§4 Rollback). Leave `0.24.2` alone. Image retention is `box-disk-management`'s policy, not this task's.
+- Rollback, if needed: `mercury upgrade 0.24.3-beta.3`, re-pin `.env` to `:0.24.3-beta.3`, restore the saved unit, and restart. Restore `state.db` only if a migration ran (read the journal).
+- Append the report to `docs/plans/tagula-predeploy-1014/sessions/D1.md`: the version live, the evidence block, the unit diff, the Tavily verdict and disk free after. Then `/f-ops-plan archive tagula-predeploy-1014` once S1–S3 are landed.