mixdog 0.7.1

package/hooks/session-start.cjs

@@ -0,0 +1,1372 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const http = require('http');
+const net = require('net');
+const { spawn } = require('child_process');
+const { resolvePluginData } = require(path.join(__dirname, '..', 'lib', 'plugin-paths.cjs'));
+const { readSection } = require(path.join(__dirname, '..', 'lib', 'config-cjs.cjs'));
+
+// Mirror selected stderr lines to a plugin-data log file so cycle1 traces
+// remain inspectable after the host shell scrolls past. Best-effort: any
+// fs error is swallowed so logging never breaks the hook.
+let _SESSION_START_LOG_PATH = null;
+const SESSION_START_TRACE_ENABLED =
+  process.env.MIXDOG_DEBUG_SESSION_START === '1' ||
+  process.env.MIXDOG_DEBUG_SESSION_START === 'true';
+function sessionStartLogPath() {
+  if (_SESSION_START_LOG_PATH) return _SESSION_START_LOG_PATH;
+  const base = (typeof DATA_DIR === 'string' && DATA_DIR)
+    ? DATA_DIR
+    : path.join(os.homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin');
+  _SESSION_START_LOG_PATH = path.join(base, 'session-start.log');
+  return _SESSION_START_LOG_PATH;
+}
+// Always append to session-start.log so fail-open reasons (skip / cycle1
+// failure / missing-dirs / null dispatch) stay diagnosable without requiring
+// MIXDOG_DEBUG_SESSION_START to be pre-set. Stderr output remains gated by
+// the trace flag — log file is the durable record, stderr is the live tail.
+// Size-based rotation: when the log exceeds LOG_MAX_BYTES, head-trim down to
+// LOG_KEEP_BYTES so a long-running daemon doesn't grow it unbounded.
+const SESSION_START_LOG_MAX_BYTES = 256 * 1024;
+const SESSION_START_LOG_KEEP_BYTES = 64 * 1024;
+function teeStderr(line) {
+  try {
+    const p = sessionStartLogPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    try {
+      const st = fs.statSync(p);
+      if (st.size > SESSION_START_LOG_MAX_BYTES) {
+        const buf = fs.readFileSync(p);
+        fs.writeFileSync(p, buf.subarray(buf.length - SESSION_START_LOG_KEEP_BYTES));
+      }
+    } catch {}
+    fs.appendFileSync(p, line);
+  } catch {}
+  if (SESSION_START_TRACE_ENABLED) {
+    try { process.stderr.write(line); } catch {}
+  }
+}
+
+// ---------------------------------------------------------------------------
+// argv parsing — supports `--part rules`, `--part=rules`.
+// Invalid/unknown part falls back to `rules`.
+// ---------------------------------------------------------------------------
+function parseArgs(argv) {
+  const out = { part: 'rules' };
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a) continue;
+    let key = null;
+    let val = null;
+    if (a.startsWith('--') && a.includes('=')) {
+      const eq = a.indexOf('=');
+      key = a.slice(2, eq);
+      val = a.slice(eq + 1);
+    } else if (a.startsWith('--')) {
+      key = a.slice(2);
+      const next = argv[i + 1];
+      if (typeof next === 'string' && !next.startsWith('--')) {
+        val = next;
+        i++;
+      }
+    }
+    if (key === 'part' && typeof val === 'string') out.part = val;
+  }
+  if (!['rules', 'core', 'recap'].includes(out.part)) out.part = 'rules';
+  return out;
+}
+
+const ARGS = parseArgs(process.argv);
+let PART = ARGS.part;
+
+let _event = {};
+const IS_DAEMON_REQUIRE = !!process.env.MIXDOG_SKIP_TOP_STDIN;
+// In-daemon `require()` would otherwise read fd 0 (the daemon's MCP stdio
+// pipe), corrupting it. Skip the top-level stdin read when this env-var is
+// set by hook-pipe-server.mjs around the require boundary.
+if (!IS_DAEMON_REQUIRE) {
+  try {
+    const _input = fs.readFileSync(0, 'utf8');
+    if (_input) _event = JSON.parse(_input);
+  } catch {}
+}
+
+if (_event.isSidechain) {
+  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=isSidechain\n`);
+  process.exit(0);
+}
+if (_event.agentId) {
+  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=agentId=${_event.agentId}\n`);
+  process.exit(0);
+}
+if (_event.is_sidechain) {
+  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=is_sidechain\n`);
+  process.exit(0);
+}
+if (_event.agent_id) {
+  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=agent_id=${_event.agent_id}\n`);
+  process.exit(0);
+}
+if (_event.kind && _event.kind !== 'interactive') {
+  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=kind=${_event.kind}\n`);
+  process.exit(0);
+}
+
+const DATA_DIR = resolvePluginData();
+const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT;
+const SESSION_START_CYCLE1_TIMEOUT_MS = Number.parseInt(process.env.MIXDOG_SESSION_START_CYCLE1_TIMEOUT_MS || '110000', 10);
+const MIXDOG_RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
+  ? path.resolve(process.env.MIXDOG_RUNTIME_ROOT)
+  : path.join(os.tmpdir(), 'mixdog');
+const ACTIVE_INSTANCE_FILE = path.join(MIXDOG_RUNTIME_ROOT, 'active-instance.json');
+if (!DATA_DIR || !PLUGIN_ROOT) {
+  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=missing-dirs DATA_DIR=${!!DATA_DIR} PLUGIN_ROOT=${!!PLUGIN_ROOT}\n`);
+  process.exit(0);
+}
+
+if (!IS_DAEMON_REQUIRE) {
+  teeStderr(`[session-start] enter PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} sessionId=${_event.session_id || _event.sessionId || ''}\n`);
+}
+
+// ---------------------------------------------------------------------------
+// Common helpers (used by all parts).
+// ---------------------------------------------------------------------------
+function readJson(filePath) {
+  try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch { return {}; }
+}
+
+function parsePositiveNumber(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+
+function readAdvertisedMemoryPort() {
+  const active = JSON.parse(fs.readFileSync(ACTIVE_INSTANCE_FILE, 'utf8'));
+  const port = parsePositiveNumber(active && active.memory_port);
+  if (!port) return null;
+  const activeServerPid = parsePositiveNumber(active && active.server_pid);
+  const memoryServerPid = parsePositiveNumber(active && active.memory_server_pid);
+  if (activeServerPid && memoryServerPid && activeServerPid !== memoryServerPid) {
+    return { stale: true, port, activeServerPid, memoryServerPid };
+  }
+  return { stale: false, port, active };
+}
+
+function sleepMs(ms) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
+}
+
+function readOwnerSecretFor(ownerInstanceId) {
+  if (!ownerInstanceId) return '';
+  try {
+    const file = path.join(MIXDOG_RUNTIME_ROOT, `owner-secret-${String(ownerInstanceId)}.json`);
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return parsed && typeof parsed.secret === 'string' ? parsed.secret : '';
+  } catch {
+    return '';
+  }
+}
+
+function ownerAuthHeaders(active) {
+  const ownerInstanceId = active && active.instanceId;
+  const ownerSecret = readOwnerSecretFor(ownerInstanceId);
+  if (!ownerSecret) return null;
+  return { 'x-owner-token': ownerSecret, 'x-owner-instance': String(ownerInstanceId) };
+}
+
+let _emitSink = null;
+function setEmitSink(fn) { _emitSink = fn || null; }
+function emit(additionalContext) {
+  if (!additionalContext) {
+    teeStderr(`[session-start] emit skipped: falsy context (empty string or null)\n`);
+    return;
+  }
+  const byteLen = Buffer.byteLength(additionalContext, 'utf8');
+  teeStderr(`[session-start] emit PART=${PART} bytes=${byteLen}\n`);
+  const out = JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'SessionStart',
+      additionalContext,
+    },
+  });
+  if (_emitSink) _emitSink(out);
+  else process.stdout.write(out);
+}
+function setEvent(e) { _event = e || {}; }
+function setPart(part) {
+  if (['rules', 'core', 'recap'].includes(part)) PART = part;
+}
+
+// Memory-service HTTP port discovery. Single source of truth:
+// `<tmpdir>/mixdog/active-instance.json` `memory_port` field, written by
+// supervisor (server-main.mjs) on memory worker `ready` IPC. Throws when
+// missing — caller surfaces the failure rather than silently falling back
+// to a stale or default port.
+function getMemoryServicePort() {
+  const advertised = readAdvertisedMemoryPort();
+  if (!advertised || advertised.stale) {
+    throw new Error(advertised && advertised.stale
+      ? 'active-instance.json stale memory_port owner'
+      : 'active-instance.json missing memory_port');
+  }
+  return advertised.port;
+}
+
+async function getLiveMemoryServicePort(probeMs = 200) {
+  try {
+    const advertised = readAdvertisedMemoryPort();
+    if (!advertised || advertised.stale) return null;
+    const port = advertised.port;
+    const alive = await probeTcpPort(port, Math.max(1, probeMs));
+    teeStderr(`[session-start] memoryDirect probePort=${port} probeMs=${probeMs} alive=${alive}\n`);
+    return alive ? port : null;
+  } catch {
+    return null;
+  }
+}
+
+async function memoryServicePost(urlPath, body, timeoutMs = 5000) {
+  const port = getMemoryServicePort();
+  const res = await httpPostJson({
+    hostname: '127.0.0.1',
+    port,
+    path: urlPath,
+    timeoutMs,
+    body: body || {},
+  });
+  if (res.statusCode !== 200) {
+    throw new Error(`memory-service ${urlPath} non-200 status=${res.statusCode}`);
+  }
+  try { return JSON.parse(res.body); }
+  catch (e) { throw new Error(`memory-service ${urlPath} invalid JSON: ${e.message}`); }
+}
+
+function formatTs(ts) {
+  const n = Number(ts);
+  if (Number.isFinite(n) && n > 1e12) {
+    return new Date(n).toLocaleString('sv-SE').slice(0, 16);
+  }
+  return String(ts ?? '').slice(0, 16);
+}
+
+// MM-DD HH:MM in local time for compact recap rendering.
+function formatTsShort(ts) {
+  const n = Number(ts);
+  if (!Number.isFinite(n) || n <= 1e12) return String(ts ?? '').slice(0, 16);
+  const full = new Date(n).toLocaleString('sv-SE');
+  return full.slice(5, 16);
+}
+
+// Single source of truth: lib/text-utils.cjs (also imported by memory-extraction.mjs).
+const { cleanMemoryText: cleanText } = require(path.join(PLUGIN_ROOT, 'lib', 'text-utils.cjs'));
+
+function resolveCwdScope(cwd) {
+  try {
+    let dir = path.resolve(cwd || process.cwd());
+    while (true) {
+      const candidate = path.join(dir, '.mixdog', 'project.id');
+      try {
+        const val = fs.readFileSync(candidate, 'utf8').trim();
+        if (val.toLowerCase() === 'common') return null;
+        if (val) {
+          // Validate slug before returning — reject path traversal attempts.
+          if (val.includes('..') || val.includes('\\')) return null;
+          return val;
+        }
+      } catch {}
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {}
+  return null;
+}
+
+async function buildContext(cwd) {
+  try {
+    const _t0 = Date.now();
+    const result = await memoryServicePost('/session-start/core-memory', {
+      cwd: cwd || process.cwd(),
+    });
+    const _elapsed = Date.now() - _t0;
+    if (!result || result.ok !== true) return '';
+    const dbLines = Array.isArray(result.dbLines) ? result.dbLines : [];
+    const userLines = Array.isArray(result.userLines) ? result.userLines : [];
+    teeStderr(`[session-start] buildContext POST /session-start/core-memory elapsed=${_elapsed}ms dbLines=${dbLines.length} userLines=${userLines.length}\n`);
+    const seen = new Set();
+    const lines = [];
+    // userLines (user-curated) and dbLines accumulate under the same char cap.
+    // userLines go first so they win the budget. Each line is already short
+    // (core_summary <=120, manual core <=120 at write time), so the cap is a
+    // safety net rather than the primary limiter.
+    const HEADER_LEN = '## Core Memory\n'.length;
+    // CAP = 5000 chars — documented host-preview envelope. This is a byte cap,
+    // not token-aware (adding a token counter would require a tokeniser dependency).
+    // Deferred: token-aware cap once a lightweight counter is available.
+    const CAP = 5000;
+    let total = HEADER_LEN;
+    for (const line of userLines) {
+      const key = line.toLowerCase().replace(/\s+/g, ' ').slice(0, 120);
+      if (seen.has(key)) continue;
+      const add = line.length + 1;
+      if (total + add > CAP) break;
+      seen.add(key);
+      lines.push(line);
+      total += add;
+    }
+    // dbLines: accumulate score-DESC rows until the char cap is reached.
+    for (const line of dbLines) {
+      const key = line.toLowerCase().replace(/\s+/g, ' ').slice(0, 120);
+      if (seen.has(key)) continue;
+      const add = line.length + 1;
+      if (total + add > CAP) break;
+      seen.add(key);
+      lines.push(line);
+      total += add;
+    }
+    if (lines.length === 0) return '';
+    return `## Core Memory\n${lines.join('\n')}`;
+  } catch (e) {
+    teeStderr(`[session-start] buildContext catch endpoint=/session-start/core-memory err=${e.message}\n`);
+    process.stderr.write(`[session-start] context build failed: ${e.message}\n`);
+    return '';
+  }
+}
+
+// Returns { lines } — chronological "[MM-DD HH:MM] <summary>" entries
+// (oldest → newest), trimmed from the front so the rendered block fits the
+// SessionStart hook output cap (10,000 chars total — leaves margin for the
+// JSON wrapper around additionalContext; header "## Recap\n" reserved).
+async function buildRecapData(cwd) {
+  const out = { lines: [] };
+  try {
+    const _t0 = Date.now();
+    const result = await memoryServicePost('/session-start/recap', {
+      cwd: cwd || process.cwd(),
+    });
+    const _elapsed = Date.now() - _t0;
+    if (!result || result.ok !== true) return out;
+    const rows = Array.isArray(result.rows) ? result.rows : [];
+    teeStderr(`[session-start] buildRecapData POST /session-start/recap elapsed=${_elapsed}ms rows=${rows.length}\n`);
+    if (rows.length === 0) return out;
+
+    const rendered = rows.map(r => {
+      const tsStr = formatTsShort(r.ts);
+      const summary = String(r.summary || '').trim().slice(0, 1000);
+      return summary ? `[${tsStr}] ${summary}` : '';
+    }).filter(Boolean);
+    if (rendered.length === 0) return out;
+
+    // Dedup by normalized summary — newest-first, so older repeats drop.
+    const seen = new Set();
+    const uniq = [];
+    for (const line of rendered) {
+      const key = line.replace(/^\[[^\]]+\]\s*/, '').toLowerCase().replace(/\s+/g, ' ').slice(0, 80);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      uniq.push(line);
+    }
+
+    // Newest → oldest; keep accumulating from the newest end until the
+    // running total would exceed the cap, then reverse to chronological.
+    const HEADER_LEN = '## Recap\n'.length;
+    const CAP = 5000;
+    let total = HEADER_LEN;
+    const kept = [];
+    for (const line of uniq) {
+      const add = line.length + 1;
+      if (total + add > CAP) break;
+      kept.push(line);
+      total += add;
+    }
+    out.lines = kept.reverse();
+    return out;
+  } catch (e) {
+    teeStderr(`[session-start] buildRecapData catch endpoint=/session-start/recap err=${e.message}\n`);
+    process.stderr.write(`[session-start] recap build failed: ${e.message}\n`);
+    return out;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Skip flag — resume / compact reuses the existing context, so re-injecting
+// memory just bloats tokens. Rules still flow through so any rule changes
+// since the last turn take effect.
+// ---------------------------------------------------------------------------
+function _skipMemoryInject() { return _event.source === 'resume' || _event.source === 'compact'; }
+if (!IS_DAEMON_REQUIRE) {
+  teeStderr(`[session-start] skipMemoryInject=${_skipMemoryInject()} PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()}\n`);
+}
+
+// ---------------------------------------------------------------------------
+// Part: rules (slot 1) — owns ALL one-shot session bootstrap work and emits
+// the rules block. Static .md content only; cycle1 is triggered by
+// core/recap slots (dedupe coalesces concurrent calls into one run).
+// ---------------------------------------------------------------------------
+
+function hasManagedClaudeMdBlock(targetPath) {
+  if (!targetPath) return false;
+  try {
+    const { expandHome, MARKER_START, MARKER_END } = require(path.join(PLUGIN_ROOT, 'lib', 'claude-md-writer.cjs'));
+    const resolved = expandHome(targetPath);
+    if (!resolved || !fs.existsSync(resolved)) return false;
+    const content = fs.readFileSync(resolved, 'utf8');
+    return content.includes(MARKER_START) && content.includes(MARKER_END);
+  } catch {
+    return false;
+  }
+}
+
+// Stable, NON-versioned launcher path in mixdog-owned plugin data — survives
+// cache cleanup and version rotation, so settings.json can point at it forever
+// (the launcher resolves the active install at runtime each tick).
+function stableLauncherPath() {
+  return path.join(DATA_DIR, 'statusline-launcher.mjs').replace(/\\/g, '/');
+}
+
+function injectStatusLine(pluginRoot) {
+  try {
+    // Refresh the stable launcher copy from the current install each session
+    // start so it tracks the latest committed launcher code.
+    const launcherDst = stableLauncherPath();
+    try {
+      const launcherSrc = path.join(pluginRoot, 'bin', 'statusline-launcher.mjs');
+      fs.mkdirSync(path.dirname(launcherDst), { recursive: true });
+      fs.copyFileSync(launcherSrc, launcherDst);
+    } catch (e) {
+      process.stderr.write(`[session-start] statusLine launcher copy failed: ${e.message}\n`);
+    }
+
+    const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
+    let raw;
+    try { raw = fs.readFileSync(settingsPath, 'utf8'); } catch { return; }
+    let settings;
+    try { settings = JSON.parse(raw); } catch { return; }
+    if (!settings || typeof settings !== 'object') return;
+
+    const desiredCommand = `bun "${launcherDst}"`;
+    // Launcher delegates to the fast native shim when present, so a constant
+    // short tick is fine and avoids cadence ping-pong across versions.
+    const desiredRefreshInterval = 5;
+    const existing = settings.statusLine;
+    // Recognize legacy mixdog-managed entries (versioned shim / statusline.mjs
+    // commands and the new stable launcher) so old pinned commands are MIGRATED
+    // to the stable launcher. A genuine user-custom statusLine is left alone.
+    const _cmd = (existing && typeof existing === 'object' && typeof existing.command === 'string')
+      ? existing.command : '';
+    // Normalize Windows backslashes once, then require a mixdog-SPECIFIC marker
+    // so a generic user command that merely mentions statusline.mjs is not
+    // hijacked. A bare statusline.mjs NOT under a mixdog path must NOT match.
+    const c = _cmd.replace(/\\/g, '/');
+    // No standalone --kind=statusline arm: the real mixdog shim command always
+    // carries the /mixdog-shim path (caught below), and a bare flag could be a
+    // genuine user command (e.g. `node user-tool.mjs --kind=statusline`).
+    const _looksMixdog = /\/mixdog-shim(?:\.exe)?/.test(c)
+      || c.includes('/trib-plugin/mixdog/')
+      || (c.includes('mixdog-trib-plugin') && c.includes('statusline-launcher.mjs'));
+    const isOurs = existing && typeof existing === 'object'
+      && (existing.source === 'mixdog-auto' || _looksMixdog);
+
+    if (existing && !isOurs) return;
+    if (
+      isOurs
+      && existing.command === desiredCommand
+      && existing.type === 'command'
+      && existing.refreshInterval === desiredRefreshInterval
+    ) return;
+
+    settings.statusLine = {
+      type: 'command',
+      command: desiredCommand,
+      refreshInterval: desiredRefreshInterval,
+      source: 'mixdog-auto',
+    };
+
+    const tmpPath = settingsPath + '.mixdog-tmp';
+    fs.writeFileSync(tmpPath, JSON.stringify(settings, null, 2) + '\n');
+    fs.renameSync(tmpPath, settingsPath);
+  } catch (e) {
+    process.stderr.write(`[session-start] statusLine inject failed: ${e.message}\n`);
+  }
+}
+
+function cwdToProjectSlug(cwd) {
+  return path.resolve(cwd).replace(/\\/g, '/').replace(/^([A-Za-z]):/, '$1-').replace(/\//g, '-');
+}
+function resolveTranscriptPath() {
+  const direct = _event.transcript_path || _event.transcriptPath;
+  if (typeof direct === 'string' && direct && fs.existsSync(direct)) return direct;
+  const sessionId = _event.session_id || _event.sessionId;
+  const cwd = _event.cwd || process.cwd();
+  if (typeof sessionId === 'string' && sessionId) {
+    const candidate = path.join(os.homedir(), '.claude', 'projects', cwdToProjectSlug(cwd), `${sessionId}.jsonl`);
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return '';
+}
+
+function rebindActiveInstance() {
+  try {
+    const activePath = ACTIVE_INSTANCE_FILE;
+    if (!fs.existsSync(activePath)) return;
+    const active = JSON.parse(fs.readFileSync(activePath, 'utf8'));
+    if (!active.httpPort) return;
+    const transcriptPath = resolveTranscriptPath();
+    const payload = transcriptPath ? JSON.stringify({ transcriptPath }) : '';
+    const authHeaders = ownerAuthHeaders(active);
+    if (!authHeaders) return;
+    const headers = { 'Content-Type': 'application/json', ...authHeaders };
+    if (payload) headers['Content-Length'] = Buffer.byteLength(payload);
+    const req2 = http.request({
+      hostname: '127.0.0.1',
+      port: active.httpPort,
+      path: '/rebind',
+      method: 'POST',
+      timeout: 3000,
+      headers,
+    });
+    req2.on('error', () => {});
+    req2.on('timeout', () => req2.destroy());
+    if (payload) req2.write(payload);
+    req2.end();
+  } catch {}
+}
+
+// TCP probe — resolves true if the port accepts a connection within probeMs,
+// false on ECONNREFUSED / EHOSTUNREACH / timeout / any other socket error.
+// Used by pollActiveInstance to skip stale active-instance.json entries left
+// over from a previous session whose channels owner is already dead.
+function probeTcpPort(port, probeMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (alive) => {
+      if (settled) return;
+      settled = true;
+      try { socket.destroy(); } catch {}
+      resolve(alive);
+    };
+    const socket = net.createConnection({ port, host: '127.0.0.1' });
+    socket.setTimeout(Math.max(1, probeMs));
+    socket.once('connect', () => done(true));
+    socket.once('error', () => done(false));
+    socket.once('timeout', () => done(false));
+  });
+}
+
+// Memory-runtime readiness probe. A promoted-but-uninitialized fork-proxy keeps
+// a live TCP listener while its `db` is still null (it short-circuited
+// _initRuntime), so a raw TCP accept does NOT prove the memory worker can serve
+// queries — recap/core would then 500 and silently drop context. GET /health
+// returns 200 only once the worker is _initialized with a live DB; 503 while
+// booting/promoting and 500 if the DB is broken. Gate awaitMemoryPort on a 200.
+function probeMemoryHealthy(port, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (ok) => { if (settled) return; settled = true; resolve(ok); };
+    let req;
+    try {
+      req = http.request(
+        { host: '127.0.0.1', port, path: '/health', method: 'GET', timeout: Math.max(1, timeoutMs) },
+        (res) => {
+          const ok = res.statusCode === 200;
+          res.resume();
+          res.once('end', () => done(ok));
+          res.once('error', () => done(false));
+        },
+      );
+    } catch { done(false); return; }
+    req.once('error', () => done(false));
+    req.once('timeout', () => { try { req.destroy(); } catch {} done(false); });
+    req.end();
+  });
+}
+
+async function pollActiveInstance(graceMs) {
+  const activeDir = MIXDOG_RUNTIME_ROOT;
+  const activeFile = ACTIVE_INSTANCE_FILE;
+  const _pollStart = Date.now();
+  const deadline = _pollStart + Math.max(0, graceMs);
+  teeStderr(`[session-start] pollActiveInstance start graceMs=${graceMs}\n`);
+  try { fs.mkdirSync(activeDir, { recursive: true }); } catch {}
+
+  // Single read+probe attempt. Stale guard: file may be left by a dead owner,
+  // so TCP-probe httpPort before accepting. Returns null on any failure
+  // (missing file, missing httpPort, dead port, parse error, deadline hit).
+  const tryRead = async () => {
+    try {
+      if (!fs.existsSync(activeFile)) return null;
+      const active = JSON.parse(fs.readFileSync(activeFile, 'utf8'));
+      if (!active || !active.httpPort) return null;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) return null;
+      const probeMs = Math.min(200, remaining);
+      const alive = await probeTcpPort(active.httpPort, probeMs);
+      teeStderr(`[session-start] pollActiveInstance probePort=${active.httpPort} probeMs=${probeMs} alive=${alive}\n`);
+      return alive ? active : null;
+    } catch {
+      return null;
+    }
+  };
+
+  // Fast path: supervisor already up. Most sessions hit this — skips watch setup.
+  const initial = await tryRead();
+  if (initial) {
+    teeStderr(`[session-start] pollActiveInstance done elapsed=${Date.now() - _pollStart}ms port=${initial.httpPort} via=initial\n`);
+    return initial;
+  }
+
+  // Bounded poll loop. Windows fs.watch first-event latency averaged ~3.3s
+  // on this directory (measured over recent sessions), so a fixed 200ms
+  // tick is deterministic and faster on average. server.mjs writes
+  // active-instance.json atomically via .tmp + rename, so every poll sees
+  // either no file or a fully-written one — no torn-read window. setTimeout
+  // caps total wait at graceMs so the function honors its contract.
+  return new Promise((resolve) => {
+    let settled = false;
+    let inFlight = false;
+    let pollTimer = null;
+    let deadlineTimer = null;
+
+    const finish = (result, via) => {
+      if (settled) return;
+      settled = true;
+      if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
+      if (deadlineTimer) { clearTimeout(deadlineTimer); deadlineTimer = null; }
+      if (result) {
+        teeStderr(`[session-start] pollActiveInstance done elapsed=${Date.now() - _pollStart}ms port=${result.httpPort} via=${via}\n`);
+      } else {
+        teeStderr(`[session-start] pollActiveInstance end elapsed=${Date.now() - _pollStart}ms result=null\n`);
+      }
+      resolve(result);
+    };
+
+    const checkOnce = async () => {
+      if (settled || inFlight) return;
+      inFlight = true;
+      try {
+        const a = await tryRead();
+        if (a) finish(a, 'poll');
+      } finally {
+        inFlight = false;
+      }
+    };
+
+    // Node setInterval / setTimeout are ref'd by default, so they keep the
+    // event loop alive. The outer caller also awaits this Promise, which is
+    // itself a liveness guarantee.
+    pollTimer = setInterval(checkOnce, 200);
+    const remaining = Math.max(0, deadline - Date.now());
+    deadlineTimer = setTimeout(() => finish(null, null), remaining);
+  });
+}
+
+// Wait until memory_port appears in active-instance.json and /health is ready.
+// pollActiveInstance only proves channels httpPort;
+// memory_port is written later via memory worker `ready` IPC. Without this,
+// getMemoryServicePort throws on fast /clear paths and recap emits 0 lines.
+async function awaitMemoryPort(graceMs) {
+  const _t0 = Date.now();
+  const deadline = _t0 + Math.max(0, graceMs);
+  teeStderr(`[session-start] awaitMemoryPort start graceMs=${graceMs}\n`);
+
+  while (Date.now() < deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    try {
+      if (!fs.existsSync(ACTIVE_INSTANCE_FILE)) {
+        await sleepMs(Math.min(200, remaining));
+        continue;
+      }
+      const advertised = readAdvertisedMemoryPort();
+      if (!advertised) {
+        await sleepMs(Math.min(200, remaining));
+        continue;
+      }
+      if (advertised.stale) {
+        teeStderr(`[session-start] awaitMemoryPort stalePort=${advertised.port} activeServerPid=${advertised.activeServerPid} memoryServerPid=${advertised.memoryServerPid}\n`);
+        await sleepMs(Math.min(200, remaining));
+        continue;
+      }
+      const port = advertised.port;
+      const probeMs = Math.min(200, remaining);
+      const healthy = await probeMemoryHealthy(port, probeMs);
+      let supersededBy = null;
+      let staleAfterProbe = false;
+      try {
+        const latest = readAdvertisedMemoryPort();
+        if (latest && latest.stale) staleAfterProbe = true;
+        else if (latest && latest.port !== port) supersededBy = latest.port;
+      } catch {}
+      const suffix = `${staleAfterProbe ? ' staleAfterProbe=true' : ''}${supersededBy ? ` supersededBy=${supersededBy}` : ''}`;
+      teeStderr(`[session-start] awaitMemoryPort probePort=${port} probeMs=${probeMs} healthy=${healthy}${suffix}\n`);
+      if (staleAfterProbe || supersededBy) continue;
+      if (healthy) {
+        teeStderr(`[session-start] awaitMemoryPort done elapsed=${Date.now() - _t0}ms port=${port} via=poll\n`);
+        return port;
+      }
+    } catch {
+      // Re-read active-instance.json on the next tick; atomic rename can
+      // transiently hide the file on Windows.
+    }
+    await sleepMs(Math.min(200, Math.max(0, deadline - Date.now())));
+  }
+
+  teeStderr(`[session-start] awaitMemoryPort end elapsed=${Date.now() - _t0}ms result=null\n`);
+  return null;
+}
+
+function httpPostJson({ hostname, port, path: urlPath, timeoutMs, body, ownerActive, authHeaders: explicitAuthHeaders }) {
+  return new Promise((resolve, reject) => {
+    const _t0 = Date.now();
+    const payload = typeof body === 'string' ? body : JSON.stringify(body);
+    const authHeaders = explicitAuthHeaders || (ownerActive ? ownerAuthHeaders(ownerActive) : {});
+    if (ownerActive && !authHeaders) {
+      resolve({
+        statusCode: 0,
+        body: JSON.stringify({ ok: false, reason: 'owner-route-unavailable' }),
+        ownerRouteUnavailable: true,
+      });
+      return;
+    }
+    const req = http.request({
+      hostname,
+      port,
+      path: urlPath,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(payload),
+        ...authHeaders,
+      },
+      timeout: Math.max(1, timeoutMs),
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const _body = Buffer.concat(chunks).toString('utf8');
+        const _elapsed = Date.now() - _t0;
+        let _bodyReason = null;
+        try { const _p = JSON.parse(_body); if (_p && typeof _p.reason === 'string') _bodyReason = _p.reason; } catch {}
+        teeStderr(`[session-start] httpPostJson path=${urlPath} port=${port} timeoutMs=${timeoutMs} statusCode=${res.statusCode} bodyReason=${_bodyReason || ''} elapsed=${_elapsed}ms\n`);
+        resolve({ statusCode: res.statusCode, body: _body });
+      });
+    });
+    req.on('error', (e) => reject(e));
+    req.on('timeout', () => { req.destroy(new Error('timeout')); });
+    req.end(payload);
+  });
+}
+
+// Pull cycle1 signals from a cycle1 response. Memory worker returns an MCP
+// envelope { content:[{type:'text', text:'cycle1: chunks=N processed=M
+// skipped=K pending=P inFlight=B'}], isError }; channels owner returns
+// { ok, result } where result may carry the same text shape. Each field is
+// null when not parseable (treated downstream as "unknown / cannot verify").
+function extractCycleSignals(parsed) {
+  const empty = { processed: null, pendingRows: null, skippedInFlight: null };
+  if (!parsed) return empty;
+  let text = '';
+  if (Array.isArray(parsed.content) && parsed.content[0] && typeof parsed.content[0].text === 'string') {
+    text = parsed.content[0].text;
+  } else if (parsed.result && typeof parsed.result === 'object'
+             && Array.isArray(parsed.result.content)
+             && parsed.result.content[0]
+             && typeof parsed.result.content[0].text === 'string') {
+    // Channels owner wraps the memory worker's MCP envelope as
+    // { ok, result: { content:[{type:'text',text:'cycle1: ...'}], isError } },
+    // so the signal text lives at parsed.result.content[0].text.
+    text = parsed.result.content[0].text;
+  } else if (parsed.result && typeof parsed.result === 'object' && typeof parsed.result.text === 'string') {
+    text = parsed.result.text;
+  } else if (typeof parsed.result === 'string') {
+    text = parsed.result;
+  }
+  if (typeof text !== 'string') return empty;
+  const proc = text.match(/processed=(\d+)/);
+  const pend = text.match(/pending=(\d+)/);
+  const inflight = text.match(/inFlight=(true|false)/);
+  return {
+    processed: proc ? parseInt(proc[1], 10) : null,
+    pendingRows: pend ? parseInt(pend[1], 10) : null,
+    skippedInFlight: inflight ? inflight[1] === 'true' : null,
+  };
+}
+
+async function requestCycle1MemoryDirect(deadline, opts = {}, priorReason = '') {
+  const slot = opts.slot || 'unknown';
+  const start = Date.now();
+  const remainingForProbe = deadline - Date.now();
+  if (remainingForProbe <= 0) {
+    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=timeout-before-probe prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+    return null;
+  }
+  const port = await getLiveMemoryServicePort(Math.min(200, remainingForProbe));
+  if (!port) {
+    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=no-memory-port prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+    return null;
+  }
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) {
+    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=timeout-before-post prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+    return null;
+  }
+
+  try {
+    const ON_DEMAND_CYCLE1_ARGS = { min_batch: 1, session_cap: 5, batch_size: 20, concurrency: 5 };
+    const res = await httpPostJson({
+      hostname: '127.0.0.1',
+      port,
+      path: '/api/tool',
+      timeoutMs: remaining,
+      body: {
+        name: 'memory',
+        arguments: {
+          action: 'cycle1',
+          ...ON_DEMAND_CYCLE1_ARGS,
+          _callerDeadlineMs: remaining,
+        },
+      },
+    });
+    if (res.statusCode !== 200) {
+      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=non-200 statusCode=${res.statusCode} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+      return { ok: false, reason: 'memory-direct-non-200', statusCode: res.statusCode, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
+    }
+    let parsed;
+    try { parsed = JSON.parse(res.body); }
+    catch {
+      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=parse-error prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+      return { ok: false, reason: 'memory-direct-parse-error', statusCode: 200, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
+    }
+    if (parsed && parsed.isError) {
+      const sigText = Array.isArray(parsed.content) && parsed.content[0] ? parsed.content[0].text : '';
+      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=body-is-error text=${String(sigText || '').slice(0, 200)} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+      return { ok: false, reason: 'memory-direct-body-is-error', statusCode: 200, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
+    }
+    const sig = extractCycleSignals(parsed);
+    const procStr = sig.processed != null ? sig.processed : '?';
+    const pendStr = sig.pendingRows != null ? sig.pendingRows : '?';
+    const inFlightStr = sig.skippedInFlight === true ? 'true'
+      : sig.skippedInFlight === false ? 'false' : '?';
+    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=ok processed=${procStr} pending=${pendStr} inFlight=${inFlightStr} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+    return {
+      ok: true,
+      processed: sig.processed,
+      pendingRows: sig.pendingRows,
+      skippedInFlight: sig.skippedInFlight,
+      route: 'memory-direct',
+      elapsedMs: Date.now() - start,
+    };
+  } catch (e) {
+    const msg = (e && e.message) || e;
+    const reason = /timeout/i.test(String(msg)) ? 'memory-direct-timeout' : 'memory-direct-http-error';
+    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=${reason} err=${String(msg).slice(0, 200)} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
+    return { ok: false, reason, statusCode: null, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
+  }
+}
+
+async function waitCycle1MemoryDirect(deadline, opts = {}, waitMs = 1800) {
+  const slot = opts.slot || 'unknown';
+  const start = Date.now();
+  const waitUntil = Math.min(deadline, start + Math.max(0, waitMs));
+  const pollMs = 50;
+  let attempt = 0;
+  while (Date.now() < waitUntil) {
+    const sleepMs = Math.min(pollMs, waitUntil - Date.now());
+    if (sleepMs > 0) await new Promise((r) => setTimeout(r, sleepMs));
+    const direct = await requestCycle1MemoryDirect(deadline, opts, `pre-channels-wait-${attempt}`);
+    if (direct && direct.ok) {
+      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct wait-hit attempt=${attempt} elapsed=${Date.now() - start}ms\n`);
+      return direct;
+    }
+    if (direct && !direct.ok) {
+      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct wait-stop attempt=${attempt} reason=${direct.reason || 'unknown'} elapsed=${Date.now() - start}ms\n`);
+      return null;
+    }
+    attempt++;
+  }
+  teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct wait-miss attempts=${attempt} elapsed=${Date.now() - start}ms\n`);
+  return null;
+}
+
+// One full cycle1 attempt. Prefer the memory service when it is already
+// advertised and alive: channels /cycle1 is only a proxy to the same memory
+// action, while the channels owner can lag during session handoff. If memory
+// is not ready, fall back to the channels owner readiness path.
+async function requestCycle1Once(deadline, opts) {
+  const slot = opts.slot || 'unknown';
+  const graceMs = Number.isFinite(opts.graceMs) ? opts.graceMs : 5000;
+  const start = Date.now();
+
+  const finish = (payload) => {
+    const elapsedMs = Date.now() - start;
+    if (payload.ok) {
+      const procStr = payload.processed != null ? payload.processed : '?';
+      const pendStr = payload.pendingRows != null ? payload.pendingRows : '?';
+      const inFlightStr = payload.skippedInFlight === true ? 'true'
+        : payload.skippedInFlight === false ? 'false' : '?';
+      teeStderr(`[session-start] cycle1 slot=${slot} route=channels reason=ok processed=${procStr} pending=${pendStr} inFlight=${inFlightStr} elapsed=${elapsedMs}ms\n`);
+      return {
+        ok: true,
+        processed: payload.processed,
+        pendingRows: payload.pendingRows,
+        skippedInFlight: payload.skippedInFlight,
+        route: 'channels',
+        elapsedMs,
+      };
+    }
+    const sc = payload.statusCode != null ? ` statusCode=${payload.statusCode}` : '';
+    teeStderr(`[session-start] cycle1 slot=${slot} route=channels reason=${payload.reason}${sc} elapsed=${elapsedMs}ms\n`);
+    return { ok: false, reason: payload.reason, statusCode: payload.statusCode, bodyReason: payload.bodyReason || null, elapsedMs, route: 'channels' };
+  };
+
+  const classifyError = (e) => {
+    const msg = (e && e.message) || '';
+    if (/timeout/i.test(msg)) return 'timeout';
+    if ((e && e.code === 'ECONNREFUSED') || /ECONNREFUSED/i.test(msg)) return 'connect-refused';
+    return 'http-error';
+  };
+
+  const directFirst = await requestCycle1MemoryDirect(deadline, opts, 'pre-channels');
+  if (directFirst && directFirst.ok) return directFirst;
+  if (!directFirst) {
+    const directAfterWait = await waitCycle1MemoryDirect(deadline, opts, Math.min(graceMs, 1800));
+    if (directAfterWait && directAfterWait.ok) return directAfterWait;
+  }
+
+  const remainingForGrace = deadline - Date.now();
+  if (remainingForGrace <= 0) return finish({ ok: false, reason: 'timeout' });
+  const active = await pollActiveInstance(Math.min(graceMs, remainingForGrace));
+  const tPollEnd = Date.now();
+  if (!active) {
+    const direct = await requestCycle1MemoryDirect(deadline, opts, 'no-active-instance');
+    if (direct && direct.ok) return direct;
+    const reason = (Date.now() >= deadline) ? 'timeout' : 'no-active-instance';
+    return finish({ ok: false, reason });
+  }
+  const port = active.httpPort;
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) return finish({ ok: false, reason: 'timeout' });
+  const authHeaders = ownerAuthHeaders(active);
+  if (!authHeaders) return finish({ ok: false, reason: 'owner-route-unavailable' });
+
+  try {
+    const tPostStart = Date.now();
+    // On-demand cycle1 (SessionStart hook path): min_batch=1 triggers on a
+    // single pending row; session_cap=5 × batch_size=20 caps a single hook
+    // pass at 100 rows so wallclock stays low. Use modest 2-way fan-out when
+    // multiple windows are ready; periodic path also runs 2×50 in parallel.
+    const ON_DEMAND_CYCLE1_ARGS = { min_batch: 1, session_cap: 5, batch_size: 20, concurrency: 5 };
+    const res = await httpPostJson({
+      hostname: '127.0.0.1',
+      port,
+      path: '/cycle1',
+      timeoutMs: remaining,
+      ownerActive: active,
+      authHeaders,
+      body: { timeout_ms: remaining, args: ON_DEMAND_CYCLE1_ARGS },
+    });
+    teeStderr(`[session-start] cycle1 slot=${slot} timing pollMs=${tPollEnd - start} postMs=${Date.now() - tPostStart}\n`);
+    if (res.ownerRouteUnavailable) {
+      return finish({ ok: false, reason: 'owner-route-unavailable' });
+    }
+    if (res.statusCode !== 200) {
+      // Surface the channels endpoint's body `reason` (memory-not-ready,
+      // worker-unavailable, ipc-error, memory-timeout, ...) so downstream
+      // retry logic and operators can see the precise transient class.
+      let bodyReason = null;
+      try {
+        const parsed = JSON.parse(res.body);
+        if (parsed && typeof parsed.reason === 'string') bodyReason = parsed.reason;
+      } catch {}
+      const reason = bodyReason ? `non-200/${bodyReason}` : 'non-200';
+      return finish({ ok: false, reason, statusCode: res.statusCode, bodyReason });
+    }
+    try {
+      const parsed = JSON.parse(res.body);
+      if (parsed && parsed.ok) {
+        const sig = extractCycleSignals(parsed);
+        return finish({
+          ok: true,
+          processed: sig.processed,
+          pendingRows: sig.pendingRows,
+          skippedInFlight: sig.skippedInFlight,
+        });
+      }
+      return finish({ ok: false, reason: 'body-not-ok', statusCode: 200 });
+    } catch {
+      return finish({ ok: false, reason: 'parse-error', statusCode: 200 });
+    }
+  } catch (e) {
+    const reason = classifyError(e);
+    if (reason === 'connect-refused' || reason === 'timeout') {
+      const direct = await requestCycle1MemoryDirect(deadline, opts, reason);
+      if (direct && direct.ok) return direct;
+    }
+    return finish({ ok: false, reason });
+  }
+}
+
+// Public entry point. Single in-flight call — server-main.callWorker now
+// awaits the worker's first 'ready' IPC, so a pre-ready /cycle1 holds until
+// memory is up instead of bouncing 503. Keep one follow-up retry for the
+// processed=0 case: that means either an in-flight dedup hit (server
+// returned the prior run's empty result) or a pre-ingest race
+// (transcript-watch had not yet ingested pending raw entries). A short sleep
+// + second call covers both. If the second pass also returns 0, genuinely
+// empty.
+async function requestCycle1(timeoutMs, opts = {}) {
+  const slot = opts.slot || 'unknown';
+  const graceMs = Number.isFinite(opts.graceMs) ? opts.graceMs : 5000;
+  const start = Date.now();
+  const deadline = start + Math.max(0, timeoutMs);
+  teeStderr(`[session-start] cycle1 slot=${slot} start graceMs=${graceMs} timeoutMs=${timeoutMs}\n`);
+  teeStderr(`[boot-time] tag=cycle1-entry slot=${slot} tMs=${start}\n`);
+
+  // Boot-race transient classifier: a fresh session can fire cycle1 while the
+  // new owner's channels worker is still binding 3462 (connect-refused), the
+  // active-instance.json is briefly empty (no-active-instance), or channels is
+  // up but the parent's memory worker hasn't sent its first 'ready' IPC yet
+  // (503 with bodyReason in {memory-not-ready, worker-unavailable, ipc-error,
+  // memory-timeout}). Warm peer boots often clear in 1–3s; cold first-boot
+  // runtime init (PG attach + embedding warmup under multi-instance contention)
+  // can take longer, so retry with backoff up to a wider budget rather than
+  // skipping recap entirely.
+  const TRANSIENT_BOOT_BODY_REASONS = new Set([
+    'memory-not-ready',
+    'worker-unavailable',
+    'ipc-error',
+    'memory-timeout',
+    'backend-not-ready',
+    'beacon-booting',
+  ]);
+  // memory-degraded is NOT transient: restart cap exceeded or PG PANIC.
+  // Retrying it within the transient budget (~45s) would only delay the
+  // session with no benefit, so it is excluded before transient classification.
+  const NON_TRANSIENT_BOOT_BODY_REASONS = new Set([
+    'memory-degraded',
+  ]);
+  const TRANSIENT_TOP_REASONS = new Set([
+    'connect-refused',
+    'no-active-instance',
+  ]);
+  const isTransientBootFailure = (r) => {
+    if (!r || r.ok) return false;
+    if (r.bodyReason && NON_TRANSIENT_BOOT_BODY_REASONS.has(r.bodyReason)) return false;
+    if (r.bodyReason && TRANSIENT_BOOT_BODY_REASONS.has(r.bodyReason)) return true;
+    if (TRANSIENT_TOP_REASONS.has(r.reason)) return true;
+    // 5xx + missing body — boot/restart race: a worker socket closed
+    // mid-request surfaces as a channels /cycle1 500 (bodyReason empty), and
+    // a pre-stub 503 looks the same. Both resolve once the worker finishes
+    // (re)starting, so retry within the boot budget instead of aborting
+    // recap/core. Known degraded states carry a bodyReason and are filtered
+    // by NON_TRANSIENT_BOOT_BODY_REASONS above before reaching here.
+    if (r.statusCode >= 500 && !r.bodyReason) return true;
+    return false;
+  };
+  const TRANSIENT_RETRY_DELAY_MS = 250;
+  const TRANSIENT_RETRY_BUDGET_MS = 45000;
+  const transientDeadline = start + TRANSIENT_RETRY_BUDGET_MS;
+
+  try {
+    let r1 = await requestCycle1Once(deadline, opts);
+    let transientAttempt = 0;
+    while (
+      isTransientBootFailure(r1)
+      && Date.now() < transientDeadline
+      && (deadline - Date.now()) > TRANSIENT_RETRY_DELAY_MS + 500
+    ) {
+      transientAttempt++;
+      teeStderr(`[session-start] cycle1 slot=${slot} transient-retry attempt=${transientAttempt} bodyReason=${r1.bodyReason || ''} statusCode=${r1.statusCode != null ? r1.statusCode : ''} elapsed=${r1.elapsedMs}ms nextDelay=${TRANSIENT_RETRY_DELAY_MS}ms reason=${r1.reason}\n`);
+      await new Promise((r) => setTimeout(r, TRANSIENT_RETRY_DELAY_MS));
+      r1 = await requestCycle1Once(deadline, { ...opts, slot: `${slot}:t${transientAttempt}` });
+    }
+    if (!r1.ok) return r1;
+    if (r1.processed != null && r1.processed > 0) return r1;
+    // Genuine empty (no pending raw rows AND no in-flight dedup hit) — retry
+    // would do nothing useful, skip the second pass.
+    if (r1.pendingRows === 0 && r1.skippedInFlight === false) return r1;
+    const RETRY_DELAY_MS = 800;
+    const remaining = deadline - Date.now();
+    if (remaining <= RETRY_DELAY_MS + 200) return r1;
+    await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+    const r2 = await requestCycle1Once(deadline, { ...opts, slot: `${slot}:r` });
+    if (!r2.ok) {
+      teeStderr(`[session-start] cycle1 slot=${slot} r2-failed stale-fallback r1.pendingRows=${r1.pendingRows != null ? r1.pendingRows : '?'} r1.skippedInFlight=${r1.skippedInFlight != null ? r1.skippedInFlight : '?'}\n`);
+    }
+    return r2.ok ? r2 : r1;
+  } catch (e) {
+    teeStderr(`[session-start] cycle1 slot=${slot} exception=${(e && e.message) || e}\n`);
+    return { ok: false, reason: 'exception', elapsedMs: Date.now() - start };
+  }
+}
+
+// Best-effort POST /recap/reset to the channels owner. Used on `/clear` so
+// the forked status server's recapState (which lives in a child process the
+// hook can't reach via IPC) drops the prior session's badge. Bounded by
+// graceMs and silent on failure — recap reset is cosmetic, never block
+// SessionStart on it.
+async function requestRecapReset(graceMs) {
+  try {
+    const active = await pollActiveInstance(Math.max(0, graceMs));
+    if (!active || !active.httpPort) {
+      teeStderr('[session-start] recap-reset skipped: no active instance\n');
+      return;
+    }
+    const authHeaders = ownerAuthHeaders(active);
+    if (!authHeaders) {
+      teeStderr('[session-start] recap-reset skipped: owner route unavailable in this session\n');
+      return;
+    }
+    const res = await httpPostJson({
+      hostname: '127.0.0.1',
+      port: active.httpPort,
+      path: '/recap/reset',
+      timeoutMs: 2000,
+      ownerActive: active,
+      authHeaders,
+      body: {},
+    });
+    if (res.statusCode !== 200) {
+      teeStderr(`[session-start] recap-reset non-200 status=${res.statusCode}\n`);
+    }
+  } catch (e) {
+    teeStderr(`[session-start] recap-reset failed: ${(e && e.message) || e}\n`);
+  }
+}
+
+async function runRulesPart() {
+  teeStderr(`[session-start] runRulesPart enter PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()}\n`);
+  // First-boot one-shot work — only slot 1 (rules) runs this. Other slots
+  // skip it entirely so they stay read-only and side-effect free.
+  try {
+    const flagPath = path.join(DATA_DIR, '.first-boot-seen');
+    if (!fs.existsSync(flagPath)) {
+      // No first-boot config-window open here: it double-booted the
+      // setup-server against the unconditional every-session `--prewarm`
+      // below (both racing to bind the port). The server is warmed by the
+      // prewarm; the window opens only on an explicit `/mixdog:config`.
+      fs.writeFileSync(flagPath, '');
+    }
+  } catch {}
+
+  // Every-session pre-warm: boot the config-UI setup-server in the
+  // background (window-free) so the first `/mixdog:config` open is instant.
+  // Fire-and-forget + hidden; `--prewarm` makes launch-core boot the server
+  // only when it is not already alive and never opens a browser window, so
+  // this is a cheap no-op once the server is running.
+  try {
+    spawn('bun', [path.join(PLUGIN_ROOT, 'setup', 'launch.mjs'), '--prewarm'], {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+    }).unref();
+  } catch {}
+
+  try {
+    const asp = path.join(DATA_DIR, 'active-session.txt');
+    if (fs.existsSync(asp)) fs.unlinkSync(asp);
+  } catch {}
+
+  // Persist user cwd so the MCP server (spawned from cache dir) can resolve
+  // the correct sandbox root. Atomic rename prevents partial reads.
+  try {
+    const eventCwd = typeof _event.cwd === 'string' ? _event.cwd.trim() : '';
+    if (eventCwd) {
+      const cwdTxtPath = path.join(DATA_DIR, 'user-cwd.txt');
+      const cwdTmpPath = cwdTxtPath + '.tmp';
+      fs.writeFileSync(cwdTmpPath, eventCwd);
+      fs.renameSync(cwdTmpPath, cwdTxtPath);
+    }
+  } catch {}
+
+  try {
+    const stalePending = path.join(DATA_DIR, 'recap-pending.json');
+    if (fs.existsSync(stalePending)) fs.unlinkSync(stalePending);
+  } catch {}
+
+  injectStatusLine(PLUGIN_ROOT);
+  rebindActiveInstance();
+
+  let _channelsConfig = {};
+  try { _channelsConfig = readSection('channels'); } catch {}
+  const injection = _channelsConfig && typeof _channelsConfig.promptInjection === 'object' ? _channelsConfig.promptInjection : {};
+  const claudeMdMode = injection.mode === 'claude_md';
+  const claudeMdTargetPath = typeof injection.targetPath === 'string' && injection.targetPath
+    ? injection.targetPath
+    : '~/.claude/CLAUDE.md';
+  const needsBootstrapInjection = claudeMdMode && !hasManagedClaudeMdBlock(claudeMdTargetPath);
+
+  let additionalContext = '';
+  if (!claudeMdMode || needsBootstrapInjection) {
+    try {
+      const { buildInjectionContent } = require(path.join(PLUGIN_ROOT, 'lib', 'rules-builder.cjs'));
+      additionalContext = buildInjectionContent({ PLUGIN_ROOT, DATA_DIR }) || '';
+    } catch {}
+  }
+
+  // claude_md mode + missing managed block: persist the file alongside emit so the
+  // next session boots from the managed block instead of the inline fallback.
+  if (claudeMdMode && needsBootstrapInjection && additionalContext) {
+    try {
+      const { upsertManagedBlock } = require(path.join(PLUGIN_ROOT, 'lib', 'claude-md-writer.cjs'));
+      upsertManagedBlock(claudeMdTargetPath, additionalContext);
+      teeStderr(`[session-start] claude_md: regenerated ${claudeMdTargetPath} after missing managed block\n`);
+    } catch (e) {
+      teeStderr(`[session-start] claude_md regenerate failed: ${e && e.message || e}\n`);
+    }
+  }
+
+  // On `/clear`, drop the prior session's recap badge from the forked status
+  // server. Hook runs in a separate cjs process with no IPC handle to that
+  // child, so we POST /recap/reset to the channels owner instead. Best
+  // effort, short grace — channels owner is usually already up on /clear.
+  if (_event.source === 'clear') {
+    // Fire-and-forget — recap reset is cosmetic, never block response path.
+    requestRecapReset(3000).catch(() => {});
+  }
+
+  // Surface the session-entry working directory so the Lead knows where
+  // relative paths resolve before any `cwd set`. Reads the user-cwd.txt seed
+  // written just above (mirrors the host's _event.cwd). Best-effort — never
+  // let it break rule injection.
+  let _startDir = '';
+  try {
+    _startDir = fs.readFileSync(path.join(DATA_DIR, 'user-cwd.txt'), 'utf8').trim();
+    if (_startDir) {
+      const _startBlock = `## Starting directory\n${_startDir}`;
+      additionalContext = additionalContext ? `${additionalContext}\n\n${_startBlock}` : _startBlock;
+    }
+  } catch {}
+
+  // Other owned directories — full paths (the cwd tool's background scan
+  // persists them to cwd-projects.json). Best-effort — never let it break
+  // rule injection. Dynamic, so it lives here not in static rules.
+  try {
+    const _projParsed = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'cwd-projects.json'), 'utf8'));
+    const _projects = Array.isArray(_projParsed && _projParsed.projects) ? _projParsed.projects : [];
+    const _paths = _projects
+      .map((p) => String(p.path || '').trim())
+      .filter((p) => p && p !== _startDir);
+    if (_paths.length) {
+      const _otherBlock = `## Other directories\n${_paths.map((p) => `- ${p}`).join('\n')}`;
+      additionalContext = additionalContext ? `${additionalContext}\n\n${_otherBlock}` : _otherBlock;
+    }
+  } catch {}
+
+  emit(additionalContext);
+  teeStderr(`[session-start] runRulesPart done\n`);
+}
+
+// ---------------------------------------------------------------------------
+// Part: core (slot 2) — Core Memory only. Runs in its own process so each
+// SessionStart additionalContext is sized independently against the host
+// preview cap. Pairs with recap (slot 3); both are spawned in parallel by
+// the host and share the cycle1 await on the server side.
+// ---------------------------------------------------------------------------
+async function runCorePart() {
+  if (_skipMemoryInject()) {
+    teeStderr(`[session-start] runCorePart skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=skipMemoryInject\n`);
+    return;
+  }
+  // graceMs=8000 covers supervisor cold-start ceiling. fs.watch unblocks
+  // immediately on active-instance.json creation, so normal boots pay only
+  // the actual startup time (no extra wait). Without this, first attempt
+  // timed out at 3000ms before supervisor finished spawning, forcing a
+  // transient-retry round-trip that added ~3s to wall-clock.
+  const r = await requestCycle1(SESSION_START_CYCLE1_TIMEOUT_MS, { graceMs: 8000, slot: 'core' });
+  if (r.ok !== true) {
+    if (r.reason === 'owner-route-unavailable') {
+      teeStderr('[session-start] core cycle1 skipped: owner route unavailable in this session\n');
+    } else {
+      teeStderr(`[session-start] core aborted: cycle1 await failed reason=${r.reason}\n`);
+      return;
+    }
+  }
+  // cycle1 ok guarantees channels owner liveness only; memory_port lands
+  // later via worker `ready` IPC. Wait so getMemoryServicePort below does
+  // not throw on fast /clear paths.
+  const memPort = await awaitMemoryPort(8000);
+  if (!memPort) {
+    teeStderr(`[session-start] core aborted: memory_port unavailable within graceMs\n`);
+    return;
+  }
+  const tStart = Date.now();
+  try {
+    const tCtxStart = Date.now();
+    const ctx = await buildContext(_event.cwd || process.cwd());
+    teeStderr(`[session-start] core stage=buildContext elapsed=${Date.now() - tCtxStart}ms hasCtx=${!!ctx}\n`);
+    if (ctx) {
+      const tEmitStart = Date.now();
+      emit(ctx);
+      teeStderr(`[session-start] core stage=emit elapsed=${Date.now() - tEmitStart}ms\n`);
+    }
+  } catch (e) {
+    process.stderr.write(`[session-start] core build failed: ${e.message}\n`);
+  }
+  teeStderr(`[session-start] core done totalElapsed=${Date.now() - tStart}ms\n`);
+}
+
+// ---------------------------------------------------------------------------
+// Part: recap (slot 3) — Recap entries only. Spawned in parallel with core.
+// ---------------------------------------------------------------------------
+async function runRecapPart() {
+  if (_skipMemoryInject()) {
+    teeStderr(`[session-start] runRecapPart skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=skipMemoryInject\n`);
+    return;
+  }
+  // graceMs=8000: see runCorePart for invariant rationale.
+  const r = await requestCycle1(SESSION_START_CYCLE1_TIMEOUT_MS, { graceMs: 8000, slot: 'recap' });
+  if (r.ok !== true) {
+    if (r.reason === 'owner-route-unavailable') {
+      teeStderr('[session-start] recap cycle1 skipped: owner route unavailable in this session\n');
+    } else {
+      teeStderr(`[session-start] recap aborted: cycle1 await failed reason=${r.reason}\n`);
+      return;
+    }
+  }
+  // See runCorePart: cycle1 success does not imply memory_port readiness.
+  const memPort = await awaitMemoryPort(8000);
+  if (!memPort) {
+    teeStderr(`[session-start] recap aborted: memory_port unavailable within graceMs\n`);
+    return;
+  }
+  const tStart = Date.now();
+  try {
+    const tRecapStart = Date.now();
+    const recapData = await buildRecapData(_event.cwd || process.cwd());
+    const lines = (recapData && recapData.lines) || [];
+    teeStderr(`[session-start] recap stage=buildRecapData elapsed=${Date.now() - tRecapStart}ms lines=${lines.length}\n`);
+    if (lines.length > 0) {
+      const tEmitStart = Date.now();
+      emit(`## Recap\n${lines.join('\n')}`);
+      teeStderr(`[session-start] recap stage=emit elapsed=${Date.now() - tEmitStart}ms\n`);
+    }
+  } catch (e) {
+    process.stderr.write(`[session-start] recap build failed: ${e.message}\n`);
+  }
+  teeStderr(`[session-start] recap done totalElapsed=${Date.now() - tStart}ms\n`);
+}
+
+// ---------------------------------------------------------------------------
+// Exports for in-process daemon use (mixdog-shim → hook-pipe-server.mjs).
+// ---------------------------------------------------------------------------
+module.exports = { runRulesPart, runCorePart, runRecapPart, setEvent, setEmitSink, setPart };
+
+// ---------------------------------------------------------------------------
+// Main IIFE — dispatch on PART. Only runs when invoked as the entry script;
+// require'd from the daemon stays a no-op (PART is undefined).
+// ---------------------------------------------------------------------------
+if (require.main === module) {
+  (async () => {
+    if (PART === 'rules') {
+      await runRulesPart();
+    } else if (PART === 'core') {
+      await runCorePart();
+    } else if (PART === 'recap') {
+      await runRecapPart();
+    }
+  })();
+}