mixdog 0.7.18 → 0.8.0

package/hooks/session-start.cjs

@@ -1,1493 +0,0 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const http = require('http');
-const net = require('net');
-const { spawn } = require('child_process');
-const { resolvePluginData } = require(path.join(__dirname, '..', 'lib', 'plugin-paths.cjs'));
-const { readSection } = require(path.join(__dirname, '..', 'lib', 'config-cjs.cjs'));
-const {
-  isMixdogDebugEnabled,
-  pruneStalePluginDataLogSiblings,
-  appendSessionStartCriticalLog,
-  sessionStartCriticalFallback,
-  DEFAULT_STALE_LOG_SIBLING_MAX,
-} = require(path.join(__dirname, '..', 'lib', 'mixdog-debug.cjs'));
-
-// Verbose tracing → session-start.log (MIXDOG_DEBUG). Ship mode → critical
-// fail-open lines only in bounded session-start-critical.log.
-let _SESSION_START_LOG_PATH = null;
-let _SESSION_START_DATA_DIR = null;
-const MIXDOG_DEBUG_ENABLED = isMixdogDebugEnabled();
-let _sessionStartLogsPruned = false;
-
-function sessionStartDataDir() {
-  if (_SESSION_START_DATA_DIR) return _SESSION_START_DATA_DIR;
-  try {
-    if (typeof DATA_DIR === 'string' && DATA_DIR) {
-      _SESSION_START_DATA_DIR = DATA_DIR;
-      return _SESSION_START_DATA_DIR;
-    }
-  } catch { /* safe before DATA_DIR const init */ }
-  _SESSION_START_DATA_DIR = process.env.CLAUDE_PLUGIN_DATA
-    || path.join(os.homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin');
-  return _SESSION_START_DATA_DIR;
-}
-
-function sessionStartLogPath() {
-  if (_SESSION_START_LOG_PATH) return _SESSION_START_LOG_PATH;
-  _SESSION_START_LOG_PATH = path.join(sessionStartDataDir(), 'session-start.log');
-  return _SESSION_START_LOG_PATH;
-}
-const SESSION_START_LOG_MAX_BYTES = 256 * 1024;
-const SESSION_START_LOG_KEEP_BYTES = 64 * 1024;
-
-function appendVerboseSessionStartLog(line) {
-  try {
-    const dir = sessionStartDataDir();
-    const p = sessionStartLogPath();
-    fs.mkdirSync(dir, { recursive: true });
-    if (!_sessionStartLogsPruned) {
-      _sessionStartLogsPruned = true;
-      pruneStalePluginDataLogSiblings(dir, DEFAULT_STALE_LOG_SIBLING_MAX);
-    }
-    try {
-      const st = fs.statSync(p);
-      if (st.size > SESSION_START_LOG_MAX_BYTES) {
-        const buf = fs.readFileSync(p);
-        fs.writeFileSync(p, buf.subarray(buf.length - SESSION_START_LOG_KEEP_BYTES));
-      }
-    } catch {}
-    fs.appendFileSync(p, line);
-  } catch {}
-}
-
-function teeStderr(line, opts = {}) {
-  const critical = opts.critical === true
-    || (opts.critical !== false && sessionStartCriticalFallback(line));
-  if (!MIXDOG_DEBUG_ENABLED) {
-    if (!critical) return;
-    appendSessionStartCriticalLog(sessionStartDataDir(), line);
-    try { process.stderr.write(line); } catch {}
-    return;
-  }
-  appendVerboseSessionStartLog(line);
-  try { process.stderr.write(line); } catch {}
-}
-
-// ---------------------------------------------------------------------------
-// argv parsing — supports `--part rules`, `--part=rules`.
-// Invalid/unknown part falls back to `rules`.
-// ---------------------------------------------------------------------------
-function parseArgs(argv) {
-  const out = { part: 'rules' };
-  for (let i = 2; i < argv.length; i++) {
-    const a = argv[i];
-    if (!a) continue;
-    let key = null;
-    let val = null;
-    if (a.startsWith('--') && a.includes('=')) {
-      const eq = a.indexOf('=');
-      key = a.slice(2, eq);
-      val = a.slice(eq + 1);
-    } else if (a.startsWith('--')) {
-      key = a.slice(2);
-      const next = argv[i + 1];
-      if (typeof next === 'string' && !next.startsWith('--')) {
-        val = next;
-        i++;
-      }
-    }
-    if (key === 'part' && typeof val === 'string') out.part = val;
-  }
-  if (!['rules', 'core', 'recap'].includes(out.part)) out.part = 'rules';
-  return out;
-}
-
-const ARGS = parseArgs(process.argv);
-let PART = ARGS.part;
-
-const DATA_DIR = resolvePluginData();
-const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT;
-
-let _event = {};
-const IS_DAEMON_REQUIRE = !!process.env.MIXDOG_SKIP_TOP_STDIN;
-// In-daemon `require()` would otherwise read fd 0 (the daemon's MCP stdio
-// pipe), corrupting it. Skip the top-level stdin read when this env-var is
-// set by hook-pipe-server.mjs around the require boundary.
-if (!IS_DAEMON_REQUIRE) {
-  try {
-    const _input = fs.readFileSync(0, 'utf8');
-    if (_input) _event = JSON.parse(_input);
-  } catch {}
-}
-
-if (_event.isSidechain) {
-  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=isSidechain\n`);
-  process.exit(0);
-}
-if (_event.agentId) {
-  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=agentId=${_event.agentId}\n`);
-  process.exit(0);
-}
-if (_event.is_sidechain) {
-  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=is_sidechain\n`);
-  process.exit(0);
-}
-if (_event.agent_id) {
-  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=agent_id=${_event.agent_id}\n`);
-  process.exit(0);
-}
-if (_event.kind && _event.kind !== 'interactive') {
-  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=kind=${_event.kind}\n`);
-  process.exit(0);
-}
-
-const SESSION_START_CYCLE1_TIMEOUT_MS = Number.parseInt(process.env.MIXDOG_SESSION_START_CYCLE1_TIMEOUT_MS || '110000', 10);
-const MIXDOG_RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
-  ? path.resolve(process.env.MIXDOG_RUNTIME_ROOT)
-  : path.join(os.tmpdir(), 'mixdog');
-const ACTIVE_INSTANCE_FILE = path.join(MIXDOG_RUNTIME_ROOT, 'active-instance.json');
-if (!DATA_DIR || !PLUGIN_ROOT) {
-  teeStderr(`[session-start] skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=missing-dirs DATA_DIR=${!!DATA_DIR} PLUGIN_ROOT=${!!PLUGIN_ROOT}\n`);
-  process.exit(0);
-}
-
-if (!IS_DAEMON_REQUIRE) {
-  teeStderr(`[session-start] enter PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} sessionId=${_event.session_id || _event.sessionId || ''}\n`);
-}
-
-// ---------------------------------------------------------------------------
-// Common helpers (used by all parts).
-// ---------------------------------------------------------------------------
-function readJson(filePath) {
-  try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch { return {}; }
-}
-
-function parsePositiveNumber(value) {
-  const n = Number(value);
-  return Number.isFinite(n) && n > 0 ? n : null;
-}
-
-function readAdvertisedMemoryPort() {
-  const active = JSON.parse(fs.readFileSync(ACTIVE_INSTANCE_FILE, 'utf8'));
-  const port = parsePositiveNumber(active && active.memory_port);
-  if (!port) return null;
-  const activeServerPid = parsePositiveNumber(active && active.server_pid);
-  const memoryServerPid = parsePositiveNumber(active && active.memory_server_pid);
-  if (activeServerPid && memoryServerPid && activeServerPid !== memoryServerPid) {
-    return { stale: true, port, activeServerPid, memoryServerPid };
-  }
-  return { stale: false, port, active };
-}
-
-function sleepMs(ms) {
-  return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
-}
-
-function readOwnerSecretFor(ownerInstanceId) {
-  if (!ownerInstanceId) return '';
-  try {
-    const file = path.join(MIXDOG_RUNTIME_ROOT, `owner-secret-${String(ownerInstanceId)}.json`);
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return parsed && typeof parsed.secret === 'string' ? parsed.secret : '';
-  } catch {
-    return '';
-  }
-}
-
-function ownerAuthHeaders(active) {
-  const ownerInstanceId = active && active.instanceId;
-  const ownerSecret = readOwnerSecretFor(ownerInstanceId);
-  if (!ownerSecret) return null;
-  return { 'x-owner-token': ownerSecret, 'x-owner-instance': String(ownerInstanceId) };
-}
-
-let _emitSink = null;
-function setEmitSink(fn) { _emitSink = fn || null; }
-function emit(additionalContext) {
-  if (!additionalContext) {
-    teeStderr(`[session-start] emit skipped: falsy context (empty string or null)\n`);
-    return;
-  }
-  const byteLen = Buffer.byteLength(additionalContext, 'utf8');
-  teeStderr(`[session-start] emit PART=${PART} bytes=${byteLen}\n`);
-  const out = JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'SessionStart',
-      additionalContext,
-    },
-  });
-  if (_emitSink) _emitSink(out);
-  else process.stdout.write(out);
-}
-function setEvent(e) { _event = e || {}; }
-function setPart(part) {
-  if (['rules', 'core', 'recap'].includes(part)) PART = part;
-}
-
-// Memory-service HTTP port discovery. Single source of truth:
-// `<tmpdir>/mixdog/active-instance.json` `memory_port` field, written by
-// supervisor (server-main.mjs) on memory worker `ready` IPC. Throws when
-// missing — caller surfaces the failure rather than silently falling back
-// to a stale or default port.
-function getMemoryServicePort() {
-  const advertised = readAdvertisedMemoryPort();
-  if (!advertised || advertised.stale) {
-    throw new Error(advertised && advertised.stale
-      ? 'active-instance.json stale memory_port owner'
-      : 'active-instance.json missing memory_port');
-  }
-  return advertised.port;
-}
-
-async function getLiveMemoryServicePort(probeMs = 200) {
-  try {
-    const advertised = readAdvertisedMemoryPort();
-    if (!advertised || advertised.stale) return null;
-    const port = advertised.port;
-    const alive = await probeTcpPort(port, Math.max(1, probeMs));
-    teeStderr(`[session-start] memoryDirect probePort=${port} probeMs=${probeMs} alive=${alive}\n`);
-    return alive ? port : null;
-  } catch {
-    return null;
-  }
-}
-
-async function memoryServicePost(urlPath, body, timeoutMs = 5000) {
-  const port = getMemoryServicePort();
-  const res = await httpPostJson({
-    hostname: '127.0.0.1',
-    port,
-    path: urlPath,
-    timeoutMs,
-    body: body || {},
-  });
-  if (res.statusCode !== 200) {
-    throw new Error(`memory-service ${urlPath} non-200 status=${res.statusCode}`);
-  }
-  try { return JSON.parse(res.body); }
-  catch (e) { throw new Error(`memory-service ${urlPath} invalid JSON: ${e.message}`); }
-}
-
-function formatTs(ts) {
-  const n = Number(ts);
-  if (Number.isFinite(n) && n > 1e12) {
-    return new Date(n).toLocaleString('sv-SE').slice(0, 16);
-  }
-  return String(ts ?? '').slice(0, 16);
-}
-
-// MM-DD HH:MM in local time for compact recap rendering.
-function formatTsShort(ts) {
-  const n = Number(ts);
-  if (!Number.isFinite(n) || n <= 1e12) return String(ts ?? '').slice(0, 16);
-  const full = new Date(n).toLocaleString('sv-SE');
-  return full.slice(5, 16);
-}
-
-// Single source of truth: lib/text-utils.cjs (also imported by memory-extraction.mjs).
-const { cleanMemoryText: cleanText } = require(path.join(PLUGIN_ROOT, 'lib', 'text-utils.cjs'));
-
-function resolveCwdScope(cwd) {
-  try {
-    let dir = path.resolve(cwd || process.cwd());
-    while (true) {
-      const candidate = path.join(dir, '.mixdog', 'project.id');
-      try {
-        const val = fs.readFileSync(candidate, 'utf8').trim();
-        if (val.toLowerCase() === 'common') return null;
-        if (val) {
-          // Validate slug before returning — reject path traversal attempts.
-          if (val.includes('..') || val.includes('\\')) return null;
-          return val;
-        }
-      } catch {}
-      const parent = path.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  } catch {}
-  return null;
-}
-
-async function buildContext(cwd) {
-  try {
-    const _t0 = Date.now();
-    const result = await memoryServicePost('/session-start/core-memory', {
-      cwd: cwd || process.cwd(),
-    });
-    const _elapsed = Date.now() - _t0;
-    if (!result || result.ok !== true) return '';
-    const dbLines = Array.isArray(result.dbLines) ? result.dbLines : [];
-    const userLines = Array.isArray(result.userLines) ? result.userLines : [];
-    teeStderr(`[session-start] buildContext POST /session-start/core-memory elapsed=${_elapsed}ms dbLines=${dbLines.length} userLines=${userLines.length}\n`);
-    const seen = new Set();
-    const lines = [];
-    // userLines (user-curated) and dbLines accumulate under the same char cap.
-    // userLines go first so they win the budget. Each line is already short
-    // (core_summary <=120, manual core <=120 at write time), so the cap is a
-    // safety net rather than the primary limiter.
-    const HEADER_LEN = '## Core Memory\n'.length;
-    // CAP = 5000 chars — documented host-preview envelope. This is a byte cap,
-    // not token-aware (adding a token counter would require a tokeniser dependency).
-    // Deferred: token-aware cap once a lightweight counter is available.
-    const CAP = 5000;
-    let total = HEADER_LEN;
-    for (const line of userLines) {
-      const key = line.toLowerCase().replace(/\s+/g, ' ').slice(0, 120);
-      if (seen.has(key)) continue;
-      const add = line.length + 1;
-      if (total + add > CAP) break;
-      seen.add(key);
-      lines.push(line);
-      total += add;
-    }
-    // dbLines: accumulate score-DESC rows until the char cap is reached.
-    for (const line of dbLines) {
-      const key = line.toLowerCase().replace(/\s+/g, ' ').slice(0, 120);
-      if (seen.has(key)) continue;
-      const add = line.length + 1;
-      if (total + add > CAP) break;
-      seen.add(key);
-      lines.push(line);
-      total += add;
-    }
-    if (lines.length === 0) return '';
-    return `## Core Memory\n${lines.join('\n')}`;
-  } catch (e) {
-    teeStderr(`[session-start] buildContext catch endpoint=/session-start/core-memory err=${e.message}\n`);
-    process.stderr.write(`[session-start] context build failed: ${e.message}\n`);
-    return '';
-  }
-}
-
-// Returns { lines } — chronological "[MM-DD HH:MM] <summary>" entries
-// (oldest → newest), trimmed from the front so the rendered block fits the
-// SessionStart hook output cap (10,000 chars total — leaves margin for the
-// JSON wrapper around additionalContext; header "## Recap\n" reserved).
-async function buildRecapData(cwd) {
-  const out = { lines: [] };
-  try {
-    const _t0 = Date.now();
-    const result = await memoryServicePost('/session-start/recap', {
-      cwd: cwd || process.cwd(),
-    });
-    const _elapsed = Date.now() - _t0;
-    if (!result || result.ok !== true) return out;
-    const rows = Array.isArray(result.rows) ? result.rows : [];
-    teeStderr(`[session-start] buildRecapData POST /session-start/recap elapsed=${_elapsed}ms rows=${rows.length}\n`);
-    if (rows.length === 0) return out;
-
-    const rendered = rows.map(r => {
-      const tsStr = formatTsShort(r.ts);
-      const summary = String(r.summary || '').trim().slice(0, 1000);
-      return summary ? `[${tsStr}] ${summary}` : '';
-    }).filter(Boolean);
-    if (rendered.length === 0) return out;
-
-    // Dedup by normalized summary — newest-first, so older repeats drop.
-    const seen = new Set();
-    const uniq = [];
-    for (const line of rendered) {
-      const key = line.replace(/^\[[^\]]+\]\s*/, '').toLowerCase().replace(/\s+/g, ' ').slice(0, 80);
-      if (seen.has(key)) continue;
-      seen.add(key);
-      uniq.push(line);
-    }
-
-    // Newest → oldest; keep accumulating from the newest end until the
-    // running total would exceed the cap, then reverse to chronological.
-    const HEADER_LEN = '## Recap\n'.length;
-    const CAP = 5000;
-    let total = HEADER_LEN;
-    const kept = [];
-    for (const line of uniq) {
-      const add = line.length + 1;
-      if (total + add > CAP) break;
-      kept.push(line);
-      total += add;
-    }
-    out.lines = kept.reverse();
-    return out;
-  } catch (e) {
-    teeStderr(`[session-start] buildRecapData catch endpoint=/session-start/recap err=${e.message}\n`);
-    process.stderr.write(`[session-start] recap build failed: ${e.message}\n`);
-    return out;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Skip flag — resume / compact reuses the existing context, so re-injecting
-// memory just bloats tokens. Rules still flow through so any rule changes
-// since the last turn take effect.
-// ---------------------------------------------------------------------------
-// Memoized: the memory module is enabled unless modules.memory.enabled === false
-// (mirrors server-main's isModuleEnabled). When disabled, server-main never
-// spawns the memory worker, so it never advertises a port — awaitMemoryPort would
-// otherwise burn its full ~8s grace every session-start before aborting. Detect
-// the disabled case up front and skip the inject entirely.
-let _memModuleEnabledCache;
-function _isMemoryModuleEnabled() {
-  if (_memModuleEnabledCache !== undefined) return _memModuleEnabledCache;
-  try {
-    const mods = readSection('modules');
-    _memModuleEnabledCache = !(mods && mods.memory && mods.memory.enabled === false);
-  } catch { _memModuleEnabledCache = true; } // unreadable config → assume enabled (prior behavior)
-  return _memModuleEnabledCache;
-}
-function _skipMemoryInject() { return _event.source === 'resume' || _event.source === 'compact' || !_isMemoryModuleEnabled(); }
-if (!IS_DAEMON_REQUIRE) {
-  teeStderr(`[session-start] skipMemoryInject=${_skipMemoryInject()} PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()}\n`);
-}
-
-// ---------------------------------------------------------------------------
-// Part: rules (slot 1) — owns ALL one-shot session bootstrap work and emits
-// the rules block. Static .md content only; cycle1 is triggered by
-// core/recap slots (dedupe coalesces concurrent calls into one run).
-// ---------------------------------------------------------------------------
-
-function hasManagedClaudeMdBlock(targetPath) {
-  if (!targetPath) return false;
-  try {
-    const { expandHome, MARKER_START, MARKER_END } = require(path.join(PLUGIN_ROOT, 'lib', 'claude-md-writer.cjs'));
-    const resolved = expandHome(targetPath);
-    if (!resolved || !fs.existsSync(resolved)) return false;
-    const content = fs.readFileSync(resolved, 'utf8');
-    return content.includes(MARKER_START) && content.includes(MARKER_END);
-  } catch {
-    return false;
-  }
-}
-
-// Stable, NON-versioned launcher path in mixdog-owned plugin data — survives
-// cache cleanup and version rotation, so settings.json can point at it forever
-// (the launcher resolves the active install at runtime each tick).
-function stableLauncherPath() {
-  return path.join(DATA_DIR, 'statusline-launcher.mjs').replace(/\\/g, '/');
-}
-
-function injectStatusLine(pluginRoot) {
-  try {
-    // Refresh the stable launcher copy from the current install each session
-    // start so it tracks the latest committed launcher code.
-    const launcherDst = stableLauncherPath();
-    try {
-      const launcherSrc = path.join(pluginRoot, 'bin', 'statusline-launcher.mjs');
-      fs.mkdirSync(path.dirname(launcherDst), { recursive: true });
-      fs.copyFileSync(launcherSrc, launcherDst);
-    } catch (e) {
-      process.stderr.write(`[session-start] statusLine launcher copy failed: ${e.message}\n`);
-    }
-
-    const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
-    let raw;
-    try { raw = fs.readFileSync(settingsPath, 'utf8'); } catch { return; }
-    let settings;
-    try { settings = JSON.parse(raw); } catch { return; }
-    if (!settings || typeof settings !== 'object') return;
-
-    const desiredCommand = `bun "${launcherDst}"`;
-    // Launcher delegates to the fast native shim when present, so a constant
-    // short tick is fine and avoids cadence ping-pong across versions.
-    const desiredRefreshInterval = 5;
-    const existing = settings.statusLine;
-    // Recognize legacy mixdog-managed entries (versioned shim / statusline.mjs
-    // commands and the new stable launcher) so old pinned commands are MIGRATED
-    // to the stable launcher. A genuine user-custom statusLine is left alone.
-    const _cmd = (existing && typeof existing === 'object' && typeof existing.command === 'string')
-      ? existing.command : '';
-    // Normalize Windows backslashes once, then require a mixdog-SPECIFIC marker
-    // so a generic user command that merely mentions statusline.mjs is not
-    // hijacked. A bare statusline.mjs NOT under a mixdog path must NOT match.
-    const c = _cmd.replace(/\\/g, '/');
-    // No standalone --kind=statusline arm: the real mixdog shim command always
-    // carries the /mixdog-shim path (caught below), and a bare flag could be a
-    // genuine user command (e.g. `node user-tool.mjs --kind=statusline`).
-    const _looksMixdog = /\/mixdog-shim(?:\.exe)?/.test(c)
-      || c.includes('/trib-plugin/mixdog/')
-      || (c.includes('mixdog-trib-plugin') && c.includes('statusline-launcher.mjs'));
-    const isOurs = existing && typeof existing === 'object'
-      && (existing.source === 'mixdog-auto' || _looksMixdog);
-
-    if (existing && !isOurs) return;
-    if (
-      isOurs
-      && existing.command === desiredCommand
-      && existing.type === 'command'
-      && existing.refreshInterval === desiredRefreshInterval
-    ) return;
-
-    settings.statusLine = {
-      type: 'command',
-      command: desiredCommand,
-      refreshInterval: desiredRefreshInterval,
-      source: 'mixdog-auto',
-    };
-
-    const tmpPath = settingsPath + '.mixdog-tmp';
-    fs.writeFileSync(tmpPath, JSON.stringify(settings, null, 2) + '\n');
-    fs.renameSync(tmpPath, settingsPath);
-  } catch (e) {
-    process.stderr.write(`[session-start] statusLine inject failed: ${e.message}\n`);
-  }
-}
-
-function cwdToProjectSlug(cwd) {
-  return path.resolve(cwd).replace(/\\/g, '/').replace(/^([A-Za-z]):/, '$1-').replace(/\//g, '-');
-}
-function resolveTranscriptPath() {
-  const direct = _event.transcript_path || _event.transcriptPath;
-  if (typeof direct === 'string' && direct && fs.existsSync(direct)) return direct;
-  const sessionId = _event.session_id || _event.sessionId;
-  const cwd = _event.cwd || process.cwd();
-  if (typeof sessionId === 'string' && sessionId) {
-    const candidate = path.join(os.homedir(), '.claude', 'projects', cwdToProjectSlug(cwd), `${sessionId}.jsonl`);
-    if (fs.existsSync(candidate)) return candidate;
-  }
-  return '';
-}
-
-// Prior-session transcript for the ingest-watermark barrier on `/clear`.
-// SessionStart carries the NEW session_id; rules-part rebind records the
-// outgoing path in active-instance.json `priorTranscriptPath` before updating
-// `transcriptPath`. Resolution is deterministic (no mtime scan).
-function resolvePriorTranscriptPath() {
-  const sessionId = String(_event.session_id || _event.sessionId || '').trim();
-  const active = readJson(ACTIVE_INSTANCE_FILE);
-  const tp = active && active.transcriptPath;
-  if (typeof tp === 'string' && tp && fs.existsSync(tp)) {
-    const base = path.basename(tp, '.jsonl');
-    if (sessionId && base !== sessionId) return tp;
-  }
-  const prior = active && active.priorTranscriptPath;
-  if (typeof prior === 'string' && prior && fs.existsSync(prior)) {
-    const base = path.basename(prior, '.jsonl');
-    if (sessionId && base !== sessionId) return prior;
-  }
-  return '';
-}
-
-// Poll memory-service until offsetBytes >= fileSize for the prior transcript,
-// bounded by a dedicated sub-budget so cycle1 keeps a floor of the grace window.
-async function awaitPriorTranscriptIngested(deadline, opts = {}) {
-  const slot = opts.slot || 'unknown';
-  const start = Date.now();
-  const windowMs = Math.max(0, deadline - start);
-  // ~4s cap on the 8s graceMs case; smaller windows get half — cycle1 retains the rest.
-  const BARRIER_BUDGET_MS = Math.min(4000, windowMs / 2);
-  const barrierDeadline = Math.min(deadline, start + BARRIER_BUDGET_MS);
-  const priorPath = resolvePriorTranscriptPath();
-  if (!priorPath) {
-    teeStderr(`[session-start] ingest-barrier slot=${slot} skip reason=no-prior-transcript source=${_event.source || ''}\n`);
-    return;
-  }
-  teeStderr(`[session-start] ingest-barrier slot=${slot} priorPath=${priorPath}\n`);
-  const pollMs = 200;
-  while (Date.now() < barrierDeadline) {
-    const remaining = barrierDeadline - Date.now();
-    if (remaining <= 0) break;
-    const port = await getLiveMemoryServicePort(Math.min(200, remaining));
-    if (!port) {
-      await sleepMs(Math.min(pollMs, remaining));
-      continue;
-    }
-    try {
-      const res = await httpPostJson({
-        hostname: '127.0.0.1',
-        port,
-        path: '/transcript/ingest-sync',
-        timeoutMs: Math.min(5000, remaining),
-        body: { path: priorPath, cwd: _event.cwd || process.cwd() },
-      });
-      if (res.statusCode === 200) {
-        let parsed;
-        try { parsed = JSON.parse(res.body); } catch { parsed = null; }
-        if (parsed && parsed.ok === true && parsed.complete === true) {
-          teeStderr(`[session-start] ingest-barrier slot=${slot} complete offsetBytes=${parsed.offsetBytes} fileSize=${parsed.fileSize} elapsed=${Date.now() - start}ms\n`);
-          return;
-        }
-        if (parsed && parsed.ok === true) {
-          teeStderr(`[session-start] ingest-barrier slot=${slot} pending offsetBytes=${parsed.offsetBytes} fileSize=${parsed.fileSize}\n`);
-        }
-      }
-    } catch (e) {
-      teeStderr(`[session-start] ingest-barrier slot=${slot} err=${(e && e.message) || e}\n`);
-    }
-    await sleepMs(Math.min(pollMs, Math.max(0, barrierDeadline - Date.now())));
-  }
-  teeStderr(`[session-start] ingest-barrier slot=${slot} deadline-reached proceed elapsed=${Date.now() - start}ms\n`);
-}
-
-function rebindActiveInstance() {
-  try {
-    const activePath = ACTIVE_INSTANCE_FILE;
-    if (!fs.existsSync(activePath)) return;
-    const active = JSON.parse(fs.readFileSync(activePath, 'utf8'));
-    if (!active.httpPort) return;
-    const transcriptPath = resolveTranscriptPath();
-    const payload = transcriptPath ? JSON.stringify({ transcriptPath }) : '';
-    const authHeaders = ownerAuthHeaders(active);
-    if (!authHeaders) return;
-    const headers = { 'Content-Type': 'application/json', ...authHeaders };
-    if (payload) headers['Content-Length'] = Buffer.byteLength(payload);
-    const req2 = http.request({
-      hostname: '127.0.0.1',
-      port: active.httpPort,
-      path: '/rebind',
-      method: 'POST',
-      timeout: 3000,
-      headers,
-    });
-    req2.on('error', () => {});
-    req2.on('timeout', () => req2.destroy());
-    if (payload) req2.write(payload);
-    req2.end();
-  } catch {}
-}
-
-// TCP probe — resolves true if the port accepts a connection within probeMs,
-// false on ECONNREFUSED / EHOSTUNREACH / timeout / any other socket error.
-// Used by pollActiveInstance to skip stale active-instance.json entries left
-// over from a previous session whose channels owner is already dead.
-function probeTcpPort(port, probeMs) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (alive) => {
-      if (settled) return;
-      settled = true;
-      try { socket.destroy(); } catch {}
-      resolve(alive);
-    };
-    const socket = net.createConnection({ port, host: '127.0.0.1' });
-    socket.setTimeout(Math.max(1, probeMs));
-    socket.once('connect', () => done(true));
-    socket.once('error', () => done(false));
-    socket.once('timeout', () => done(false));
-  });
-}
-
-// Memory-runtime readiness probe. A promoted-but-uninitialized fork-proxy keeps
-// a live TCP listener while its `db` is still null (it short-circuited
-// _initRuntime), so a raw TCP accept does NOT prove the memory worker can serve
-// queries — recap/core would then 500 and silently drop context. GET /health
-// returns 200 only once the worker is _initialized with a live DB; 503 while
-// booting/promoting and 500 if the DB is broken. Gate awaitMemoryPort on a 200.
-function probeMemoryHealthy(port, timeoutMs) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (ok) => { if (settled) return; settled = true; resolve(ok); };
-    let req;
-    try {
-      req = http.request(
-        { host: '127.0.0.1', port, path: '/health', method: 'GET', timeout: Math.max(1, timeoutMs) },
-        (res) => {
-          const ok = res.statusCode === 200;
-          res.resume();
-          res.once('end', () => done(ok));
-          res.once('error', () => done(false));
-        },
-      );
-    } catch { done(false); return; }
-    req.once('error', () => done(false));
-    req.once('timeout', () => { try { req.destroy(); } catch {} done(false); });
-    req.end();
-  });
-}
-
-async function pollActiveInstance(graceMs) {
-  const activeDir = MIXDOG_RUNTIME_ROOT;
-  const activeFile = ACTIVE_INSTANCE_FILE;
-  const _pollStart = Date.now();
-  const deadline = _pollStart + Math.max(0, graceMs);
-  teeStderr(`[session-start] pollActiveInstance start graceMs=${graceMs}\n`);
-  try { fs.mkdirSync(activeDir, { recursive: true }); } catch {}
-
-  // Single read+probe attempt. Stale guard: file may be left by a dead owner,
-  // so TCP-probe httpPort before accepting. Returns null on any failure
-  // (missing file, missing httpPort, dead port, parse error, deadline hit).
-  const tryRead = async () => {
-    try {
-      if (!fs.existsSync(activeFile)) return null;
-      const active = JSON.parse(fs.readFileSync(activeFile, 'utf8'));
-      if (!active || !active.httpPort) return null;
-      const remaining = deadline - Date.now();
-      if (remaining <= 0) return null;
-      const probeMs = Math.min(200, remaining);
-      const alive = await probeTcpPort(active.httpPort, probeMs);
-      teeStderr(`[session-start] pollActiveInstance probePort=${active.httpPort} probeMs=${probeMs} alive=${alive}\n`);
-      return alive ? active : null;
-    } catch {
-      return null;
-    }
-  };
-
-  // Fast path: supervisor already up. Most sessions hit this — skips watch setup.
-  const initial = await tryRead();
-  if (initial) {
-    teeStderr(`[session-start] pollActiveInstance done elapsed=${Date.now() - _pollStart}ms port=${initial.httpPort} via=initial\n`);
-    return initial;
-  }
-
-  // Bounded poll loop. Windows fs.watch first-event latency averaged ~3.3s
-  // on this directory (measured over recent sessions), so a fixed 200ms
-  // tick is deterministic and faster on average. server.mjs writes
-  // active-instance.json atomically via .tmp + rename, so every poll sees
-  // either no file or a fully-written one — no torn-read window. setTimeout
-  // caps total wait at graceMs so the function honors its contract.
-  return new Promise((resolve) => {
-    let settled = false;
-    let inFlight = false;
-    let pollTimer = null;
-    let deadlineTimer = null;
-
-    const finish = (result, via) => {
-      if (settled) return;
-      settled = true;
-      if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
-      if (deadlineTimer) { clearTimeout(deadlineTimer); deadlineTimer = null; }
-      if (result) {
-        teeStderr(`[session-start] pollActiveInstance done elapsed=${Date.now() - _pollStart}ms port=${result.httpPort} via=${via}\n`);
-      } else {
-        teeStderr(`[session-start] pollActiveInstance end elapsed=${Date.now() - _pollStart}ms result=null\n`, { critical: true });
-      }
-      resolve(result);
-    };
-
-    const checkOnce = async () => {
-      if (settled || inFlight) return;
-      inFlight = true;
-      try {
-        const a = await tryRead();
-        if (a) finish(a, 'poll');
-      } finally {
-        inFlight = false;
-      }
-    };
-
-    // Node setInterval / setTimeout are ref'd by default, so they keep the
-    // event loop alive. The outer caller also awaits this Promise, which is
-    // itself a liveness guarantee.
-    pollTimer = setInterval(checkOnce, 200);
-    const remaining = Math.max(0, deadline - Date.now());
-    deadlineTimer = setTimeout(() => finish(null, null), remaining);
-  });
-}
-
-// Wait until memory_port appears in active-instance.json and /health is ready.
-// pollActiveInstance only proves channels httpPort;
-// memory_port is written later via memory worker `ready` IPC. Without this,
-// getMemoryServicePort throws on fast /clear paths and recap emits 0 lines.
-async function awaitMemoryPort(graceMs) {
-  const _t0 = Date.now();
-  const deadline = _t0 + Math.max(0, graceMs);
-  teeStderr(`[session-start] awaitMemoryPort start graceMs=${graceMs}\n`);
-
-  while (Date.now() < deadline) {
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) break;
-    try {
-      if (!fs.existsSync(ACTIVE_INSTANCE_FILE)) {
-        await sleepMs(Math.min(200, remaining));
-        continue;
-      }
-      const advertised = readAdvertisedMemoryPort();
-      if (!advertised) {
-        await sleepMs(Math.min(200, remaining));
-        continue;
-      }
-      if (advertised.stale) {
-        teeStderr(`[session-start] awaitMemoryPort stalePort=${advertised.port} activeServerPid=${advertised.activeServerPid} memoryServerPid=${advertised.memoryServerPid}\n`);
-        await sleepMs(Math.min(200, remaining));
-        continue;
-      }
-      const port = advertised.port;
-      const probeMs = Math.min(200, remaining);
-      const healthy = await probeMemoryHealthy(port, probeMs);
-      let supersededBy = null;
-      let staleAfterProbe = false;
-      try {
-        const latest = readAdvertisedMemoryPort();
-        if (latest && latest.stale) staleAfterProbe = true;
-        else if (latest && latest.port !== port) supersededBy = latest.port;
-      } catch {}
-      const suffix = `${staleAfterProbe ? ' staleAfterProbe=true' : ''}${supersededBy ? ` supersededBy=${supersededBy}` : ''}`;
-      teeStderr(`[session-start] awaitMemoryPort probePort=${port} probeMs=${probeMs} healthy=${healthy}${suffix}\n`);
-      if (staleAfterProbe || supersededBy) continue;
-      if (healthy) {
-        teeStderr(`[session-start] awaitMemoryPort done elapsed=${Date.now() - _t0}ms port=${port} via=poll\n`);
-        return port;
-      }
-    } catch {
-      // Re-read active-instance.json on the next tick; atomic rename can
-      // transiently hide the file on Windows.
-    }
-    await sleepMs(Math.min(200, Math.max(0, deadline - Date.now())));
-  }
-
-  teeStderr(`[session-start] awaitMemoryPort end elapsed=${Date.now() - _t0}ms result=null\n`, { critical: true });
-  return null;
-}
-
-function httpPostJson({ hostname, port, path: urlPath, timeoutMs, body, ownerActive, authHeaders: explicitAuthHeaders }) {
-  return new Promise((resolve, reject) => {
-    const _t0 = Date.now();
-    const payload = typeof body === 'string' ? body : JSON.stringify(body);
-    const authHeaders = explicitAuthHeaders || (ownerActive ? ownerAuthHeaders(ownerActive) : {});
-    if (ownerActive && !authHeaders) {
-      resolve({
-        statusCode: 0,
-        body: JSON.stringify({ ok: false, reason: 'owner-route-unavailable' }),
-        ownerRouteUnavailable: true,
-      });
-      return;
-    }
-    const req = http.request({
-      hostname,
-      port,
-      path: urlPath,
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(payload),
-        ...authHeaders,
-      },
-      timeout: Math.max(1, timeoutMs),
-    }, (res) => {
-      const chunks = [];
-      res.on('data', (c) => chunks.push(c));
-      res.on('end', () => {
-        const _body = Buffer.concat(chunks).toString('utf8');
-        const _elapsed = Date.now() - _t0;
-        let _bodyReason = null;
-        try { const _p = JSON.parse(_body); if (_p && typeof _p.reason === 'string') _bodyReason = _p.reason; } catch {}
-        teeStderr(`[session-start] httpPostJson path=${urlPath} port=${port} timeoutMs=${timeoutMs} statusCode=${res.statusCode} bodyReason=${_bodyReason || ''} elapsed=${_elapsed}ms\n`);
-        resolve({ statusCode: res.statusCode, body: _body });
-      });
-    });
-    req.on('error', (e) => reject(e));
-    req.on('timeout', () => { req.destroy(new Error('timeout')); });
-    req.end(payload);
-  });
-}
-
-// Pull cycle1 signals from a cycle1 response. Memory worker returns an MCP
-// envelope { content:[{type:'text', text:'cycle1: chunks=N processed=M
-// skipped=K pending=P inFlight=B'}], isError }; channels owner returns
-// { ok, result } where result may carry the same text shape. Each field is
-// null when not parseable (treated downstream as "unknown / cannot verify").
-function extractCycleSignals(parsed) {
-  const empty = { processed: null, pendingRows: null, skippedInFlight: null };
-  if (!parsed) return empty;
-  let text = '';
-  if (Array.isArray(parsed.content) && parsed.content[0] && typeof parsed.content[0].text === 'string') {
-    text = parsed.content[0].text;
-  } else if (parsed.result && typeof parsed.result === 'object'
-             && Array.isArray(parsed.result.content)
-             && parsed.result.content[0]
-             && typeof parsed.result.content[0].text === 'string') {
-    // Channels owner wraps the memory worker's MCP envelope as
-    // { ok, result: { content:[{type:'text',text:'cycle1: ...'}], isError } },
-    // so the signal text lives at parsed.result.content[0].text.
-    text = parsed.result.content[0].text;
-  } else if (parsed.result && typeof parsed.result === 'object' && typeof parsed.result.text === 'string') {
-    text = parsed.result.text;
-  } else if (typeof parsed.result === 'string') {
-    text = parsed.result;
-  }
-  if (typeof text !== 'string') return empty;
-  const proc = text.match(/processed=(\d+)/);
-  const pend = text.match(/pending=(\d+)/);
-  const inflight = text.match(/inFlight=(true|false)/);
-  return {
-    processed: proc ? parseInt(proc[1], 10) : null,
-    pendingRows: pend ? parseInt(pend[1], 10) : null,
-    skippedInFlight: inflight ? inflight[1] === 'true' : null,
-  };
-}
-
-async function requestCycle1MemoryDirect(deadline, opts = {}, priorReason = '') {
-  const slot = opts.slot || 'unknown';
-  const start = Date.now();
-  const remainingForProbe = deadline - Date.now();
-  if (remainingForProbe <= 0) {
-    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=timeout-before-probe prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-    return null;
-  }
-  const port = await getLiveMemoryServicePort(Math.min(200, remainingForProbe));
-  if (!port) {
-    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=no-memory-port prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-    return null;
-  }
-  const remaining = deadline - Date.now();
-  if (remaining <= 0) {
-    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=timeout-before-post prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-    return null;
-  }
-
-  try {
-    const ON_DEMAND_CYCLE1_ARGS = { min_batch: 1, session_cap: 5, batch_size: 20, concurrency: 5 };
-    const res = await httpPostJson({
-      hostname: '127.0.0.1',
-      port,
-      path: '/api/tool',
-      timeoutMs: remaining,
-      body: {
-        name: 'memory',
-        arguments: {
-          action: 'cycle1',
-          ...ON_DEMAND_CYCLE1_ARGS,
-          _callerDeadlineMs: remaining,
-        },
-      },
-    });
-    if (res.statusCode !== 200) {
-      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=non-200 statusCode=${res.statusCode} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-      return { ok: false, reason: 'memory-direct-non-200', statusCode: res.statusCode, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
-    }
-    let parsed;
-    try { parsed = JSON.parse(res.body); }
-    catch {
-      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=parse-error prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-      return { ok: false, reason: 'memory-direct-parse-error', statusCode: 200, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
-    }
-    if (parsed && parsed.isError) {
-      const sigText = Array.isArray(parsed.content) && parsed.content[0] ? parsed.content[0].text : '';
-      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=body-is-error text=${String(sigText || '').slice(0, 200)} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-      return { ok: false, reason: 'memory-direct-body-is-error', statusCode: 200, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
-    }
-    const sig = extractCycleSignals(parsed);
-    const procStr = sig.processed != null ? sig.processed : '?';
-    const pendStr = sig.pendingRows != null ? sig.pendingRows : '?';
-    const inFlightStr = sig.skippedInFlight === true ? 'true'
-      : sig.skippedInFlight === false ? 'false' : '?';
-    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=ok processed=${procStr} pending=${pendStr} inFlight=${inFlightStr} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-    return {
-      ok: true,
-      processed: sig.processed,
-      pendingRows: sig.pendingRows,
-      skippedInFlight: sig.skippedInFlight,
-      route: 'memory-direct',
-      elapsedMs: Date.now() - start,
-    };
-  } catch (e) {
-    const msg = (e && e.message) || e;
-    const reason = /timeout/i.test(String(msg)) ? 'memory-direct-timeout' : 'memory-direct-http-error';
-    teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct reason=${reason} err=${String(msg).slice(0, 200)} prior=${priorReason} elapsed=${Date.now() - start}ms\n`);
-    return { ok: false, reason, statusCode: null, bodyReason: null, elapsedMs: Date.now() - start, route: 'memory-direct' };
-  }
-}
-
-async function waitCycle1MemoryDirect(deadline, opts = {}, waitMs = 1800) {
-  const slot = opts.slot || 'unknown';
-  const start = Date.now();
-  const waitUntil = Math.min(deadline, start + Math.max(0, waitMs));
-  const pollMs = 50;
-  let attempt = 0;
-  while (Date.now() < waitUntil) {
-    const sleepMs = Math.min(pollMs, waitUntil - Date.now());
-    if (sleepMs > 0) await new Promise((r) => setTimeout(r, sleepMs));
-    const direct = await requestCycle1MemoryDirect(deadline, opts, `pre-channels-wait-${attempt}`);
-    if (direct && direct.ok) {
-      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct wait-hit attempt=${attempt} elapsed=${Date.now() - start}ms\n`);
-      return direct;
-    }
-    if (direct && !direct.ok) {
-      teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct wait-stop attempt=${attempt} reason=${direct.reason || 'unknown'} elapsed=${Date.now() - start}ms\n`);
-      return null;
-    }
-    attempt++;
-  }
-  teeStderr(`[session-start] cycle1 slot=${slot} route=memory-direct wait-miss attempts=${attempt} elapsed=${Date.now() - start}ms\n`);
-  return null;
-}
-
-// One full cycle1 attempt. Prefer the memory service when it is already
-// advertised and alive: channels /cycle1 is only a proxy to the same memory
-// action, while the channels owner can lag during session handoff. If memory
-// is not ready, fall back to the channels owner readiness path.
-async function requestCycle1Once(deadline, opts) {
-  const slot = opts.slot || 'unknown';
-  const graceMs = Number.isFinite(opts.graceMs) ? opts.graceMs : 5000;
-  const start = Date.now();
-
-  const finish = (payload) => {
-    const elapsedMs = Date.now() - start;
-    if (payload.ok) {
-      const procStr = payload.processed != null ? payload.processed : '?';
-      const pendStr = payload.pendingRows != null ? payload.pendingRows : '?';
-      const inFlightStr = payload.skippedInFlight === true ? 'true'
-        : payload.skippedInFlight === false ? 'false' : '?';
-      teeStderr(`[session-start] cycle1 slot=${slot} route=channels reason=ok processed=${procStr} pending=${pendStr} inFlight=${inFlightStr} elapsed=${elapsedMs}ms\n`);
-      return {
-        ok: true,
-        processed: payload.processed,
-        pendingRows: payload.pendingRows,
-        skippedInFlight: payload.skippedInFlight,
-        route: 'channels',
-        elapsedMs,
-      };
-    }
-    const sc = payload.statusCode != null ? ` statusCode=${payload.statusCode}` : '';
-    teeStderr(`[session-start] cycle1 slot=${slot} route=channels reason=${payload.reason}${sc} elapsed=${elapsedMs}ms\n`);
-    return { ok: false, reason: payload.reason, statusCode: payload.statusCode, bodyReason: payload.bodyReason || null, elapsedMs, route: 'channels' };
-  };
-
-  const classifyError = (e) => {
-    const msg = (e && e.message) || '';
-    if (/timeout/i.test(msg)) return 'timeout';
-    if ((e && e.code === 'ECONNREFUSED') || /ECONNREFUSED/i.test(msg)) return 'connect-refused';
-    return 'http-error';
-  };
-
-  const directFirst = await requestCycle1MemoryDirect(deadline, opts, 'pre-channels');
-  if (directFirst && directFirst.ok) return directFirst;
-  if (!directFirst) {
-    const directAfterWait = await waitCycle1MemoryDirect(deadline, opts, Math.min(graceMs, 1800));
-    if (directAfterWait && directAfterWait.ok) return directAfterWait;
-  }
-
-  const remainingForGrace = deadline - Date.now();
-  if (remainingForGrace <= 0) return finish({ ok: false, reason: 'timeout' });
-  const active = await pollActiveInstance(Math.min(graceMs, remainingForGrace));
-  const tPollEnd = Date.now();
-  if (!active) {
-    const direct = await requestCycle1MemoryDirect(deadline, opts, 'no-active-instance');
-    if (direct && direct.ok) return direct;
-    const reason = (Date.now() >= deadline) ? 'timeout' : 'no-active-instance';
-    return finish({ ok: false, reason });
-  }
-  const port = active.httpPort;
-  const remaining = deadline - Date.now();
-  if (remaining <= 0) return finish({ ok: false, reason: 'timeout' });
-  const authHeaders = ownerAuthHeaders(active);
-  if (!authHeaders) return finish({ ok: false, reason: 'owner-route-unavailable' });
-
-  try {
-    const tPostStart = Date.now();
-    // On-demand cycle1 (SessionStart hook path): min_batch=1 triggers on a
-    // single pending row; session_cap=5 × batch_size=20 caps a single hook
-    // pass at 100 rows so wallclock stays low. Use modest 2-way fan-out when
-    // multiple windows are ready; periodic path also runs 2×50 in parallel.
-    const ON_DEMAND_CYCLE1_ARGS = { min_batch: 1, session_cap: 5, batch_size: 20, concurrency: 5 };
-    const res = await httpPostJson({
-      hostname: '127.0.0.1',
-      port,
-      path: '/cycle1',
-      timeoutMs: remaining,
-      ownerActive: active,
-      authHeaders,
-      body: { timeout_ms: remaining, args: ON_DEMAND_CYCLE1_ARGS },
-    });
-    teeStderr(`[session-start] cycle1 slot=${slot} timing pollMs=${tPollEnd - start} postMs=${Date.now() - tPostStart}\n`);
-    if (res.ownerRouteUnavailable) {
-      return finish({ ok: false, reason: 'owner-route-unavailable' });
-    }
-    if (res.statusCode !== 200) {
-      // Surface the channels endpoint's body `reason` (memory-not-ready,
-      // worker-unavailable, ipc-error, memory-timeout, ...) so downstream
-      // retry logic and operators can see the precise transient class.
-      let bodyReason = null;
-      try {
-        const parsed = JSON.parse(res.body);
-        if (parsed && typeof parsed.reason === 'string') bodyReason = parsed.reason;
-      } catch {}
-      const reason = bodyReason ? `non-200/${bodyReason}` : 'non-200';
-      return finish({ ok: false, reason, statusCode: res.statusCode, bodyReason });
-    }
-    try {
-      const parsed = JSON.parse(res.body);
-      if (parsed && parsed.ok) {
-        const sig = extractCycleSignals(parsed);
-        return finish({
-          ok: true,
-          processed: sig.processed,
-          pendingRows: sig.pendingRows,
-          skippedInFlight: sig.skippedInFlight,
-        });
-      }
-      return finish({ ok: false, reason: 'body-not-ok', statusCode: 200 });
-    } catch {
-      return finish({ ok: false, reason: 'parse-error', statusCode: 200 });
-    }
-  } catch (e) {
-    const reason = classifyError(e);
-    if (reason === 'connect-refused' || reason === 'timeout') {
-      const direct = await requestCycle1MemoryDirect(deadline, opts, reason);
-      if (direct && direct.ok) return direct;
-    }
-    return finish({ ok: false, reason });
-  }
-}
-
-// Public entry point. Single in-flight call — server-main.callWorker now
-// awaits the worker's first 'ready' IPC, so a pre-ready /cycle1 holds until
-// memory is up instead of bouncing 503. Keep one follow-up retry for the
-// processed=0 case: that means either an in-flight dedup hit (server
-// returned the prior run's empty result) or a pre-ingest race
-// (transcript-watch had not yet ingested pending raw entries). A short sleep
-// + second call covers both. If the second pass also returns 0, genuinely
-// empty.
-async function requestCycle1(timeoutMs, opts = {}) {
-  const slot = opts.slot || 'unknown';
-  const graceMs = Number.isFinite(opts.graceMs) ? opts.graceMs : 5000;
-  const start = Date.now();
-  const deadline = start + Math.max(0, timeoutMs);
-  teeStderr(`[session-start] cycle1 slot=${slot} start graceMs=${graceMs} timeoutMs=${timeoutMs}\n`);
-  teeStderr(`[boot-time] tag=cycle1-entry slot=${slot} tMs=${start}\n`);
-
-  // Boot-race transient classifier: a fresh session can fire cycle1 while the
-  // new owner's channels worker is still binding 3462 (connect-refused), the
-  // active-instance.json is briefly empty (no-active-instance), or channels is
-  // up but the parent's memory worker hasn't sent its first 'ready' IPC yet
-  // (503 with bodyReason in {memory-not-ready, worker-unavailable, ipc-error,
-  // memory-timeout}). Warm peer boots often clear in 1–3s; cold first-boot
-  // runtime init (PG attach + embedding warmup under multi-instance contention)
-  // can take longer, so retry with backoff up to a wider budget rather than
-  // skipping recap entirely.
-  const TRANSIENT_BOOT_BODY_REASONS = new Set([
-    'memory-not-ready',
-    'worker-unavailable',
-    'ipc-error',
-    'memory-timeout',
-    'backend-not-ready',
-    'beacon-booting',
-  ]);
-  // memory-degraded is NOT transient: restart cap exceeded or PG PANIC.
-  // Retrying it within the transient budget (~45s) would only delay the
-  // session with no benefit, so it is excluded before transient classification.
-  const NON_TRANSIENT_BOOT_BODY_REASONS = new Set([
-    'memory-degraded',
-  ]);
-  const TRANSIENT_TOP_REASONS = new Set([
-    'connect-refused',
-    'no-active-instance',
-  ]);
-  const isTransientBootFailure = (r) => {
-    if (!r || r.ok) return false;
-    if (r.bodyReason && NON_TRANSIENT_BOOT_BODY_REASONS.has(r.bodyReason)) return false;
-    if (r.bodyReason && TRANSIENT_BOOT_BODY_REASONS.has(r.bodyReason)) return true;
-    if (TRANSIENT_TOP_REASONS.has(r.reason)) return true;
-    // 5xx + missing body — boot/restart race: a worker socket closed
-    // mid-request surfaces as a channels /cycle1 500 (bodyReason empty), and
-    // a pre-stub 503 looks the same. Both resolve once the worker finishes
-    // (re)starting, so retry within the boot budget instead of aborting
-    // recap/core. Known degraded states carry a bodyReason and are filtered
-    // by NON_TRANSIENT_BOOT_BODY_REASONS above before reaching here.
-    if (r.statusCode >= 500 && !r.bodyReason) return true;
-    return false;
-  };
-  const TRANSIENT_RETRY_DELAY_MS = 250;
-  const TRANSIENT_RETRY_BUDGET_MS = 45000;
-  const transientDeadline = start + TRANSIENT_RETRY_BUDGET_MS;
-
-  try {
-    await awaitPriorTranscriptIngested(deadline, opts);
-    let r1 = await requestCycle1Once(deadline, opts);
-    let transientAttempt = 0;
-    while (
-      isTransientBootFailure(r1)
-      && Date.now() < transientDeadline
-      && (deadline - Date.now()) > TRANSIENT_RETRY_DELAY_MS + 500
-    ) {
-      transientAttempt++;
-      teeStderr(`[session-start] cycle1 slot=${slot} transient-retry attempt=${transientAttempt} bodyReason=${r1.bodyReason || ''} statusCode=${r1.statusCode != null ? r1.statusCode : ''} elapsed=${r1.elapsedMs}ms nextDelay=${TRANSIENT_RETRY_DELAY_MS}ms reason=${r1.reason}\n`);
-      await new Promise((r) => setTimeout(r, TRANSIENT_RETRY_DELAY_MS));
-      r1 = await requestCycle1Once(deadline, { ...opts, slot: `${slot}:t${transientAttempt}` });
-    }
-    if (!r1.ok) return r1;
-    if (r1.processed != null && r1.processed > 0) return r1;
-    // After ingest-barrier, pendingRows===0 with no in-flight dedup is terminal.
-    if (r1.pendingRows === 0 && r1.skippedInFlight === false) return r1;
-    const RETRY_DELAY_MS = 800;
-    const remaining = deadline - Date.now();
-    if (remaining <= RETRY_DELAY_MS + 200) return r1;
-    await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
-    const r2 = await requestCycle1Once(deadline, { ...opts, slot: `${slot}:r` });
-    if (!r2.ok) {
-      teeStderr(`[session-start] cycle1 slot=${slot} r2-failed stale-fallback r1.pendingRows=${r1.pendingRows != null ? r1.pendingRows : '?'} r1.skippedInFlight=${r1.skippedInFlight != null ? r1.skippedInFlight : '?'}\n`);
-    }
-    return r2.ok ? r2 : r1;
-  } catch (e) {
-    teeStderr(`[session-start] cycle1 slot=${slot} exception=${(e && e.message) || e}\n`);
-    return { ok: false, reason: 'exception', elapsedMs: Date.now() - start };
-  }
-}
-
-// Best-effort POST /recap/reset to the channels owner. Used on `/clear` so
-// the forked status server's recapState (which lives in a child process the
-// hook can't reach via IPC) drops the prior session's badge. Bounded by
-// graceMs and silent on failure — recap reset is cosmetic, never block
-// SessionStart on it.
-async function requestRecapReset(graceMs) {
-  try {
-    const active = await pollActiveInstance(Math.max(0, graceMs));
-    if (!active || !active.httpPort) {
-      teeStderr('[session-start] recap-reset skipped: no active instance\n');
-      return;
-    }
-    const authHeaders = ownerAuthHeaders(active);
-    if (!authHeaders) {
-      teeStderr('[session-start] recap-reset skipped: owner route unavailable in this session\n');
-      return;
-    }
-    const res = await httpPostJson({
-      hostname: '127.0.0.1',
-      port: active.httpPort,
-      path: '/recap/reset',
-      timeoutMs: 2000,
-      ownerActive: active,
-      authHeaders,
-      body: {},
-    });
-    if (res.statusCode !== 200) {
-      teeStderr(`[session-start] recap-reset non-200 status=${res.statusCode}\n`);
-    }
-  } catch (e) {
-    teeStderr(`[session-start] recap-reset failed: ${(e && e.message) || e}\n`);
-  }
-}
-
-async function runRulesPart() {
-  teeStderr(`[session-start] runRulesPart enter PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()}\n`);
-  // First-boot one-shot work — only slot 1 (rules) runs this. Other slots
-  // skip it entirely so they stay read-only and side-effect free.
-  try {
-    const flagPath = path.join(DATA_DIR, '.first-boot-seen');
-    if (!fs.existsSync(flagPath)) {
-      // No first-boot config-window open here: it double-booted the
-      // setup-server against the unconditional every-session `--prewarm`
-      // below (both racing to bind the port). The server is warmed by the
-      // prewarm; the window opens only on an explicit `/mixdog:config`.
-      fs.writeFileSync(flagPath, '');
-    }
-  } catch {}
-
-  // Every-session pre-warm: boot the config-UI setup-server in the
-  // background (window-free) so the first `/mixdog:config` open is instant.
-  // Fire-and-forget + hidden; `--prewarm` makes launch-core boot the server
-  // only when it is not already alive and never opens a browser window, so
-  // this is a cheap no-op once the server is running.
-  try {
-    const _prewarm = spawn('bun', [path.join(PLUGIN_ROOT, 'setup', 'launch.mjs'), '--prewarm'], {
-      detached: true,
-      stdio: 'ignore',
-      windowsHide: true,
-    });
-    // ENOENT (bun not on PATH) and other spawn failures surface ASYNC as an
-    // 'error' event, NOT via the try/catch above. Without a listener Node
-    // throws it as an uncaught exception and crashes the hook. Fail soft:
-    // prewarm is a best-effort optimization, never required for a session.
-    _prewarm.on('error', (e) => {
-      teeStderr(`[session-start] prewarm spawn failed (non-fatal): ${(e && e.message) || e}\n`);
-    });
-    _prewarm.unref();
-  } catch {}
-
-  try {
-    const asp = path.join(DATA_DIR, 'active-session.txt');
-    if (fs.existsSync(asp)) fs.unlinkSync(asp);
-  } catch {}
-
-  // Persist user cwd so the MCP server (spawned from cache dir) can resolve
-  // the correct sandbox root. Atomic rename prevents partial reads.
-  try {
-    const eventCwd = typeof _event.cwd === 'string' ? _event.cwd.trim() : '';
-    if (eventCwd) {
-      const cwdTxtPath = path.join(DATA_DIR, 'user-cwd.txt');
-      const cwdTmpPath = cwdTxtPath + '.tmp';
-      fs.writeFileSync(cwdTmpPath, eventCwd);
-      fs.renameSync(cwdTmpPath, cwdTxtPath);
-    }
-  } catch {}
-
-  try {
-    const stalePending = path.join(DATA_DIR, 'recap-pending.json');
-    if (fs.existsSync(stalePending)) fs.unlinkSync(stalePending);
-  } catch {}
-
-  injectStatusLine(PLUGIN_ROOT);
-  rebindActiveInstance();
-
-  let _channelsConfig = {};
-  try { _channelsConfig = readSection('channels'); } catch {}
-  const injection = _channelsConfig && typeof _channelsConfig.promptInjection === 'object' ? _channelsConfig.promptInjection : {};
-  const claudeMdMode = injection.mode === 'claude_md';
-  const claudeMdTargetPath = typeof injection.targetPath === 'string' && injection.targetPath
-    ? injection.targetPath
-    : '~/.claude/CLAUDE.md';
-  const needsBootstrapInjection = claudeMdMode && !hasManagedClaudeMdBlock(claudeMdTargetPath);
-
-  let additionalContext = '';
-  if (!claudeMdMode || needsBootstrapInjection) {
-    try {
-      const { buildInjectionContent } = require(path.join(PLUGIN_ROOT, 'lib', 'rules-builder.cjs'));
-      additionalContext = buildInjectionContent({ PLUGIN_ROOT, DATA_DIR }) || '';
-    } catch {}
-  }
-
-  // claude_md mode + missing managed block: persist the file alongside emit so the
-  // next session boots from the managed block instead of the inline fallback.
-  if (claudeMdMode && needsBootstrapInjection && additionalContext) {
-    try {
-      const { upsertManagedBlock } = require(path.join(PLUGIN_ROOT, 'lib', 'claude-md-writer.cjs'));
-      upsertManagedBlock(claudeMdTargetPath, additionalContext);
-      teeStderr(`[session-start] claude_md: regenerated ${claudeMdTargetPath} after missing managed block\n`);
-    } catch (e) {
-      teeStderr(`[session-start] claude_md regenerate failed: ${e && e.message || e}\n`);
-    }
-  }
-
-  // On `/clear`, drop the prior session's recap badge from the forked status
-  // server. Hook runs in a separate cjs process with no IPC handle to that
-  // child, so we POST /recap/reset to the channels owner instead. Best
-  // effort, short grace — channels owner is usually already up on /clear.
-  if (_event.source === 'clear') {
-    // Fire-and-forget — recap reset is cosmetic, never block response path.
-    requestRecapReset(3000).catch(() => {});
-  }
-
-  // Surface the session-entry working directory so the Lead knows where
-  // relative paths resolve before any `cwd set`. Reads the user-cwd.txt seed
-  // written just above (mirrors the host's _event.cwd). Best-effort — never
-  // let it break rule injection.
-  let _startDir = '';
-  try {
-    _startDir = fs.readFileSync(path.join(DATA_DIR, 'user-cwd.txt'), 'utf8').trim();
-    if (_startDir) {
-      const _startBlock = `## Starting directory\n${_startDir}`;
-      additionalContext = additionalContext ? `${additionalContext}\n\n${_startBlock}` : _startBlock;
-    }
-  } catch {}
-
-  // Other owned directories — full paths (the cwd tool's background scan
-  // persists them to cwd-projects.json). Best-effort — never let it break
-  // rule injection. Dynamic, so it lives here not in static rules.
-  try {
-    const _projParsed = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'cwd-projects.json'), 'utf8'));
-    const _projects = Array.isArray(_projParsed && _projParsed.projects) ? _projParsed.projects : [];
-    const _paths = _projects
-      .map((p) => String(p.path || '').trim())
-      .filter((p) => p && p !== _startDir);
-    if (_paths.length) {
-      const _otherBlock = `## Other directories\n${_paths.map((p) => `- ${p}`).join('\n')}`;
-      additionalContext = additionalContext ? `${additionalContext}\n\n${_otherBlock}` : _otherBlock;
-    }
-  } catch {}
-
-  emit(additionalContext);
-  teeStderr(`[session-start] runRulesPart done\n`);
-}
-
-// ---------------------------------------------------------------------------
-// Part: core (slot 2) — Core Memory only. Runs in its own process so each
-// SessionStart additionalContext is sized independently against the host
-// preview cap. Pairs with recap (slot 3); both are spawned in parallel by
-// the host and share the cycle1 await on the server side.
-// ---------------------------------------------------------------------------
-async function runCorePart() {
-  if (_skipMemoryInject()) {
-    teeStderr(`[session-start] runCorePart skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=skipMemoryInject\n`);
-    return;
-  }
-  // graceMs=8000 covers supervisor cold-start ceiling. fs.watch unblocks
-  // immediately on active-instance.json creation, so normal boots pay only
-  // the actual startup time (no extra wait). Without this, first attempt
-  // timed out at 3000ms before supervisor finished spawning, forcing a
-  // transient-retry round-trip that added ~3s to wall-clock.
-  const r = await requestCycle1(SESSION_START_CYCLE1_TIMEOUT_MS, { graceMs: 8000, slot: 'core' });
-  if (r.ok !== true) {
-    if (r.reason === 'owner-route-unavailable') {
-      teeStderr('[session-start] core cycle1 skipped: owner route unavailable in this session\n');
-    } else {
-      teeStderr(`[session-start] core aborted: cycle1 await failed reason=${r.reason}\n`);
-      return;
-    }
-  }
-  // cycle1 ok guarantees channels owner liveness only; memory_port lands
-  // later via worker `ready` IPC. Wait so getMemoryServicePort below does
-  // not throw on fast /clear paths.
-  const memPort = await awaitMemoryPort(8000);
-  if (!memPort) {
-    teeStderr(`[session-start] core aborted: memory_port unavailable within graceMs\n`);
-    return;
-  }
-  const tStart = Date.now();
-  try {
-    const tCtxStart = Date.now();
-    const ctx = await buildContext(_event.cwd || process.cwd());
-    teeStderr(`[session-start] core stage=buildContext elapsed=${Date.now() - tCtxStart}ms hasCtx=${!!ctx}\n`);
-    if (ctx) {
-      const tEmitStart = Date.now();
-      emit(ctx);
-      teeStderr(`[session-start] core stage=emit elapsed=${Date.now() - tEmitStart}ms\n`);
-    }
-  } catch (e) {
-    process.stderr.write(`[session-start] core build failed: ${e.message}\n`);
-  }
-  teeStderr(`[session-start] core done totalElapsed=${Date.now() - tStart}ms\n`);
-}
-
-// ---------------------------------------------------------------------------
-// Part: recap (slot 3) — Recap entries only. Spawned in parallel with core.
-// ---------------------------------------------------------------------------
-async function runRecapPart() {
-  if (_skipMemoryInject()) {
-    teeStderr(`[session-start] runRecapPart skip PART=${PART} source=${_event.source || ''} cwd=${_event.cwd || process.cwd()} reason=skipMemoryInject\n`);
-    return;
-  }
-  // graceMs=8000: see runCorePart for invariant rationale.
-  const r = await requestCycle1(SESSION_START_CYCLE1_TIMEOUT_MS, { graceMs: 8000, slot: 'recap' });
-  if (r.ok !== true) {
-    if (r.reason === 'owner-route-unavailable') {
-      teeStderr('[session-start] recap cycle1 skipped: owner route unavailable in this session\n');
-    } else {
-      teeStderr(`[session-start] recap aborted: cycle1 await failed reason=${r.reason}\n`);
-      return;
-    }
-  }
-  // See runCorePart: cycle1 success does not imply memory_port readiness.
-  const memPort = await awaitMemoryPort(8000);
-  if (!memPort) {
-    teeStderr(`[session-start] recap aborted: memory_port unavailable within graceMs\n`);
-    return;
-  }
-  const tStart = Date.now();
-  try {
-    const tRecapStart = Date.now();
-    const recapData = await buildRecapData(_event.cwd || process.cwd());
-    const lines = (recapData && recapData.lines) || [];
-    teeStderr(`[session-start] recap stage=buildRecapData elapsed=${Date.now() - tRecapStart}ms lines=${lines.length}\n`);
-    if (lines.length > 0) {
-      const tEmitStart = Date.now();
-      emit(`## Recap\n${lines.join('\n')}`);
-      teeStderr(`[session-start] recap stage=emit elapsed=${Date.now() - tEmitStart}ms\n`);
-    }
-  } catch (e) {
-    process.stderr.write(`[session-start] recap build failed: ${e.message}\n`);
-  }
-  teeStderr(`[session-start] recap done totalElapsed=${Date.now() - tStart}ms\n`);
-}
-
-// ---------------------------------------------------------------------------
-// Exports for in-process daemon use (mixdog-shim → hook-pipe-server.mjs).
-// ---------------------------------------------------------------------------
-module.exports = { runRulesPart, runCorePart, runRecapPart, setEvent, setEmitSink, setPart };
-
-// ---------------------------------------------------------------------------
-// Main IIFE — dispatch on PART. Only runs when invoked as the entry script;
-// require'd from the daemon stays a no-op (PART is undefined).
-// ---------------------------------------------------------------------------
-if (require.main === module) {
-  (async () => {
-    if (PART === 'rules') {
-      await runRulesPart();
-    } else if (PART === 'core') {
-      await runCorePart();
-    } else if (PART === 'recap') {
-      await runRecapPart();
-    }
-  })();
-}