mulmoclaude 0.6.2 → 0.6.4

package/server/encore/tick.ts

@@ -0,0 +1,191 @@
+// Encore tick — time-driven invoker for the reconciler.
+//
+// The tick used to carry its own copy of trim/escalate/publish logic.
+// That moved into `reconcile.ts` (the sole owner of bell state). The
+// tick is now a thin walker:
+//
+//   1. For every obligation directory, reconcile the latest cycle.
+//   2. Sweep stuck tickets — reconcile any (obligationId, cycleId)
+//      pair found in tickets/ that step 1 didn't cover. This
+//      retries clear failures on closed/non-latest cycles, which
+//      step 1 alone would skip (it only picks the latest cycle).
+//   3. Prune orphan tickets older than 30 days.
+//
+// `Ticket` still lives here because dispatch.ts, reconcile.ts, and
+// the host UI all import the type — keeping it adjacent to the on-disk
+// shape (the only consumer is `tickets/*.json`) makes the locus of
+// schema changes obvious.
+
+import path from "node:path";
+
+import { log as defaultLog } from "../system/logger/index.js";
+import { ONE_DAY_MS } from "../utils/time.js";
+import type { Severity } from "../../src/types/encore-dsl/schema.js";
+import { TICKETS_DIRNAME, OBLIGATIONS_DIRNAME } from "./paths.js";
+import { readDir, readDirSubdirs, readTextOrNull, unlink } from "../utils/files/encore-io.js";
+import * as encoreNotifier from "./notifier.js";
+import { reconcileCycleNotifications } from "./reconcile.js";
+
+const ORPHAN_TICKET_AGE_MS = 30 * ONE_DAY_MS;
+
+export interface TickDeps {
+  now: Date;
+  log?: typeof defaultLog;
+}
+
+/** Shape of a ticket on disk. Authoritative record of every live
+ *  Encore bell entry: which obligation+cycle+step it belongs to,
+ *  which targets it covers, what severity it was published at
+ *  (used for escalation diff), and the seed prompt
+ *  resolveNotification will use to start the chat on user click.
+ *
+ *  A ticket's existence asserts that a matching bell is alive and
+ *  awaiting a `clear` operation. Tickets are regeneratable cache
+ *  for everything except `chatSessionId` (the binding to a user's
+ *  open chat); a sweep of `tickets/*.json` plus the matching bell
+ *  entries leaves the system in a recoverable state — the
+ *  reconciler rebuilds from cycle files on the next tick. */
+export interface Ticket {
+  pendingId: string;
+  obligationId: string;
+  cycleId: string;
+  notificationId: string;
+  stepId: string;
+  /** Target ids covered by this bundled notification. */
+  targets: string[];
+  /** Severity at last publish — used as the escalation-diff
+   *  baseline. The cycle file used to carry
+   *  `lastPublishedSeverity`; that moved here when status flags
+   *  were removed. */
+  severity: Severity;
+  /** Title and body as last rendered to the bell — the drift
+   *  baseline. Trim path compares these against `bundleTitle` /
+   *  `bundleBody` recomputed from the current DSL; if either has
+   *  drifted (most commonly via `amendDefinition` editing a
+   *  `displayName`), the path calls `notifier.update` in place
+   *  instead of clear-then-publish. Optional on the wire so
+   *  tickets written by pre-update-API builds load cleanly — they
+   *  are treated as "always drifted" on first sight, which causes
+   *  an idempotent in-place update to the bell and a ticket
+   *  rewrite that backfills the fields. */
+  title?: string;
+  body?: string;
+  seedPrompt: string;
+  createdAt: string;
+  /** Filled by resolveNotification on first bell click. Subsequent
+   *  clicks reuse it (idempotent). */
+  chatSessionId?: string;
+}
+
+export async function runTick(deps: TickDeps): Promise<void> {
+  const log = deps.log ?? defaultLog;
+  const obligationIds = await readDirSubdirs(OBLIGATIONS_DIRNAME);
+  for (const obligationId of obligationIds) {
+    try {
+      await reconcileCycleNotifications({ obligationId, now: deps.now, log });
+    } catch (err) {
+      log.warn("encore", "tick: reconcile failed", { obligationId, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  await sweepStuckTickets(new Set(obligationIds), deps.now, log);
+  await pruneOrphanTickets(deps.now, log);
+}
+
+// ── stuck-ticket sweep (Phase 2) ──────────────────────────────────
+//
+// The per-obligation reconcile above only touches the obligation's
+// latest cycle (and its just-provisioned successor on cycle-close).
+// A ticket on a NON-latest cycle never gets revisited there — which
+// matters because `safeClearBell` failures are intentionally
+// non-destructive: when the clear fails, the reconciler keeps the
+// ticket so a later attempt can retry. Without this sweep, that
+// "later attempt" would never come for tickets on closed cycles
+// (until the 30-day age-based prune).
+//
+// This sweep collects every (obligationId, cycleId) pair present in
+// tickets/ and reconciles each. It overlaps Phase 1 for the
+// latest cycle, but reconcile is idempotent (proven by the
+// "idempotency" test in test_encore_reconcile.ts) so the redundancy
+// is cheap and the contract stays simple.
+
+async function sweepStuckTickets(knownObligationIds: Set<string>, now: Date, log: typeof defaultLog): Promise<void> {
+  const entries = await readDir(TICKETS_DIRNAME);
+  const pairsToReconcile = await collectStuckCyclePairs(entries, knownObligationIds);
+  for (const pair of pairsToReconcile) {
+    try {
+      await reconcileCycleNotifications({ obligationId: pair.obligationId, cycleId: pair.cycleId, now, log });
+    } catch (err) {
+      log.warn("encore", "tick: stuck-ticket sweep failed", {
+        obligationId: pair.obligationId,
+        cycleId: pair.cycleId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+}
+
+async function collectStuckCyclePairs(entries: string[], knownObligationIds: Set<string>): Promise<{ obligationId: string; cycleId: string }[]> {
+  const seen = new Set<string>();
+  const out: { obligationId: string; cycleId: string }[] = [];
+  for (const entry of entries) {
+    if (!entry.endsWith(".json")) continue;
+    const raw = await readTextOrNull(path.join(TICKETS_DIRNAME, entry));
+    if (!raw) continue;
+    let ticket: Ticket;
+    try {
+      ticket = JSON.parse(raw) as Ticket;
+    } catch {
+      continue;
+    }
+    // Skip tickets pointing at obligations that no longer exist on
+    // disk — those get cleaned up by the age-based prune below.
+    if (!knownObligationIds.has(ticket.obligationId)) continue;
+    const key = `${ticket.obligationId}::${ticket.cycleId}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ obligationId: ticket.obligationId, cycleId: ticket.cycleId });
+  }
+  return out;
+}
+
+// ── orphan ticket sweep (time-driven, lives here not in reconcile) ──
+//
+// Orphan tickets are records older than 30 days that somehow weren't
+// trimmed by reconcile (e.g. the cycle file was deleted manually,
+// or a host crash left a ticket without its bell counterpart). The
+// sweep is age-based, not state-based, so it belongs with the
+// time-driven tick rather than the state-driven reconciler.
+
+async function pruneOneTicket(rel: string, raw: string, now: Date, log: typeof defaultLog): Promise<void> {
+  let ticket: Ticket;
+  try {
+    ticket = JSON.parse(raw) as Ticket;
+  } catch {
+    await unlink(rel);
+    return;
+  }
+  const ageMs = now.getTime() - new Date(ticket.createdAt).getTime();
+  if (ageMs <= ORPHAN_TICKET_AGE_MS) return;
+  log.info("encore", "tick: pruning orphan ticket", { pendingId: ticket.pendingId, ageMs });
+  // Clear the host bell entry BEFORE unlinking the ticket. Otherwise
+  // the bell entry stays visible but the ticket is gone — next tick
+  // treats the step as un-fired and publishes a duplicate while the
+  // stale entry is still up.
+  try {
+    await encoreNotifier.clear(ticket.notificationId);
+  } catch (err) {
+    log.warn("encore", "tick: prune-bell-clear failed", { notificationId: ticket.notificationId, error: err instanceof Error ? err.message : String(err) });
+  }
+  await unlink(rel);
+}
+
+async function pruneOrphanTickets(now: Date, log: typeof defaultLog): Promise<void> {
+  const entries = await readDir(TICKETS_DIRNAME);
+  for (const entry of entries) {
+    if (!entry.endsWith(".json")) continue;
+    const rel = path.join(TICKETS_DIRNAME, entry);
+    const raw = await readTextOrNull(rel);
+    if (!raw) continue;
+    await pruneOneTicket(rel, raw, now, log);
+  }
+}

package/server/encore/yaml-fm.ts

@@ -0,0 +1,63 @@
+// Encore-local YAML-frontmatter parser/serializer.
+//
+// The host's `server/utils/markdown/frontmatter.ts` uses
+// `yaml.FAILSAFE_SCHEMA` on load, which keeps every scalar as a
+// string. That's the right call for wiki/topic files where
+// `'1.20'` / `'true'` need to round-trip verbatim, but it breaks
+// Encore's DSL which expects real numbers (`version: 1`) and
+// booleans (`required: true`) for Zod validation on re-parse.
+//
+// We use js-yaml's default schema (CORE_SCHEMA) on both load and
+// dump so numbers + booleans + nulls round-trip natively. Output
+// is byte-compatible with the host's serializer for the same
+// `---\n...\n---\n\nbody` envelope shape.
+
+import yaml from "js-yaml";
+
+const FRONTMATTER_OPEN = /^---\r?\n/;
+const FRONTMATTER_CLOSE = /(?:^|\r?\n)---\s*(?:\r?\n|$)/;
+
+export interface ParsedMarkdown {
+  meta: Record<string, unknown>;
+  body: string;
+  hasHeader: boolean;
+}
+
+function safeLoad(text: string): Record<string, unknown> | null {
+  try {
+    const loaded = yaml.load(text);
+    if (loaded === null || loaded === undefined) return null;
+    if (typeof loaded !== "object" || Array.isArray(loaded)) return null;
+    return loaded as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+/** Parse a markdown document, splitting frontmatter from body. */
+export function parseEncoreFrontmatter(raw: string): ParsedMarkdown {
+  if (!FRONTMATTER_OPEN.test(raw)) {
+    return { meta: {}, body: raw, hasHeader: false };
+  }
+  const afterOpen = raw.replace(FRONTMATTER_OPEN, "");
+  const closeMatch = FRONTMATTER_CLOSE.exec(afterOpen);
+  if (!closeMatch || closeMatch.index === undefined) {
+    return { meta: {}, body: raw, hasHeader: false };
+  }
+  const yamlText = afterOpen.slice(0, closeMatch.index);
+  const body = afterOpen.slice(closeMatch.index + closeMatch[0].length);
+  const meta = safeLoad(yamlText);
+  if (meta === null) {
+    return { meta: {}, body: raw, hasHeader: false };
+  }
+  return { meta, body, hasHeader: true };
+}
+
+/** Serialize a meta object + body back into the canonical
+ *  `---\n...\n---\n\nbody` shape. Empty `meta` returns the body
+ *  alone. */
+export function serializeEncoreFrontmatter(meta: Record<string, unknown>, body: string): string {
+  if (Object.keys(meta).length === 0) return body;
+  const yamlText = yaml.dump(meta, { lineWidth: -1, noRefs: true }).trimEnd();
+  return `---\n${yamlText}\n---\n\n${body}`;
+}

package/server/events/notifications.ts

@@ -2,7 +2,7 @@
 // wrapper over the new notifier engine (PR 4 of feat-encore).
 //
 // The signature is preserved so the existing host call sites
-// (`server/agent/mcp-tools/notify.ts`, `server/api/routes/notifications.ts`,
+// (`server/agent/mcp-tools/notify.ts`,
 // `server/workspace/sources/pipeline/notify.ts`,
 // `server/plugins/diagnostics.ts`) keep working without source changes.
 // Internally it now:
@@ -16,14 +16,17 @@
 //      legacy entries publish with `lifecycle: "fyi"`, so the
 //      `action`-lifecycle rules don't apply and clicking still routes).
 //   4. Stashes the legacy fields (`kind`, `priority`, `action`,
-//      `i18n`, `transportId`, `sessionId`, the caller-supplied dedup
-//      `id`) on `pluginData` so the bell can preserve icon, i18n
-//      localization, and transport routing.
+//      `i18n`, `sessionId`, the caller-supplied dedup `id`) on
+//      `pluginData` so the bell can preserve icon, i18n localization,
+//      and dedup.
 //
-// Bridge push (`chat-service.pushToBridge`) and macOS Reminder push
-// no longer happen inline here — they're owned by adapters that
-// subscribe to the `notifier` pubsub channel. See
-// `server/notifier/legacy-adapters.ts`.
+// macOS Reminder push happens via the `macosReminderAdapter` listener
+// subscribed to the notifier pubsub channel. The previous bridge
+// fan-out path was removed (#1351 follow-up): the only callers
+// setting `transportId` were the PoC `/api/notifications/test` route
+// and `scheduleTestNotification`, both deleted in the same change.
+// Production callers never set `transportId`, so the entire bridge
+// side-channel was dead code.
 
 import { PAGE_ROUTES } from "../../src/router/pageRoutes.js";
 import {
@@ -38,7 +41,6 @@ import {
 } from "../../src/types/notification.js";
 import { publish as notifierPublish } from "../notifier/engine.js";
 import type { NotifierSeverity } from "../notifier/types.js";
-import { ONE_SECOND_MS, MAX_NOTIFICATION_DELAY_SEC } from "../utils/time.js";
 import { log } from "../system/logger/index.js";
 import { makeUuid } from "../utils/id.js";
 
@@ -51,7 +53,6 @@ export interface PublishNotificationOpts {
   action?: NotificationAction;
   priority?: NotificationPriority;
   sessionId?: string;
-  transportId?: string;
   /** Override the auto-generated UUID with a caller-supplied stable
    *  id. Used by the plugin-meta diagnostics: the same diagnostic
    *  id is returned from `/api/plugins/diagnostics`, and `pluginData`
@@ -60,7 +61,7 @@ export interface PublishNotificationOpts {
   id?: string;
   /** vue-i18n keys + params for clients to localize the title/body.
    *  Server-side `title` / `body` stay set as English fallbacks for
-   *  logs, macOS Reminder push, and bridge push paths. */
+   *  logs and the macOS Reminder push. */
   i18n?: NotificationI18n;
 }
 
@@ -79,7 +80,6 @@ export interface LegacyNotifierPluginData {
   priority: NotificationPriority;
   action: NotificationAction;
   i18n?: NotificationI18n;
-  transportId?: string;
   sessionId?: string;
 }
 
@@ -155,9 +155,7 @@ function buildChatTarget(target: Extract<NavigateTarget, { view: typeof NOTIFICA
   // redirect is worse UX than a non-clickable entry. Dot-segment
   // sessionId would normalize off /chat, so drop too.
   if (!target.sessionId || !isSafePathComponent(target.sessionId)) return undefined;
-  const sessionPath = `/${PAGE_ROUTES.chat}/${encodeURIComponent(target.sessionId)}`;
-  if (target.resultUuid) return `${sessionPath}?result=${encodeURIComponent(target.resultUuid)}`;
-  return sessionPath;
+  return `/${PAGE_ROUTES.chat}/${encodeURIComponent(target.sessionId)}`;
 }
 
 function buildFilesTarget(target: Extract<NavigateTarget, { view: typeof NOTIFICATION_VIEWS.files }>): string {
@@ -233,12 +231,12 @@ export function legacyActionToNavigateTarget(action: NotificationAction | undefi
  * to the calling plugin so plugins cannot impersonate each other.
  *
  * This wrapper exists for host-side callers (`server/agent/`,
- * `server/api/routes/`, `server/workspace/`, `server/plugins/diagnostics.ts`)
- * that don't have a `PluginRuntime` to hand. It forwards into
- * `notifier.publish` with `lifecycle: "fyi"` and stashes legacy fields
- * on `pluginData` so the bell can preserve icon / i18n / transport
- * semantics. Bridge + macOS push are owned by separate adapters
- * subscribed to the `notifier` pubsub channel, not by this function.
+ * `server/workspace/`, `server/plugins/diagnostics.ts`) that don't
+ * have a `PluginRuntime` to hand. It forwards into `notifier.publish`
+ * with `lifecycle: "fyi"` and stashes legacy fields on `pluginData`
+ * so the bell can preserve icon / i18n / dedup semantics. macOS
+ * Reminder push is owned by the adapter subscribed to the notifier
+ * pubsub channel, not by this function.
  */
 export function publishNotification(opts: PublishNotificationOpts): void {
   const legacyId = opts.id ?? makeUuid();
@@ -250,7 +248,6 @@ export function publishNotification(opts: PublishNotificationOpts): void {
     priority: opts.priority ?? NOTIFICATION_PRIORITIES.normal,
     action,
     i18n: opts.i18n,
-    transportId: opts.transportId,
     sessionId: opts.sessionId,
   };
   // Fire-and-forget — the engine queues writes through its own
@@ -269,72 +266,3 @@ export function publishNotification(opts: PublishNotificationOpts): void {
     log.warn("notifications", "publish failed", { error: String(err), legacyId, kind: opts.kind });
   });
 }
-
-// ── Legacy test notification (kept for PoC endpoint) ────────────
-
-export const DEFAULT_NOTIFICATION_MESSAGE = "Test notification";
-export const DEFAULT_NOTIFICATION_TRANSPORT_ID = "cli";
-
-export interface ScheduleNotificationOptions {
-  message?: string;
-  body?: string;
-  delaySeconds?: number;
-  transportId?: string;
-  // Optional deep-link action — lets dev-side callers fire a
-  // notification that navigates to a specific permalink when
-  // clicked. Without this the fired notification has no click
-  // behaviour (same as before #762).
-  action?: NotificationAction;
-  // Optional kind override — lets the manual-test helper fire a
-  // representative notification for every NotificationKind (todo,
-  // scheduler, agent, …) so the bell's icons can be eyeballed.
-  kind?: NotificationKind;
-}
-
-export interface ScheduledNotification {
-  firesAt: string;
-  delaySeconds: number;
-  cancel: () => void;
-}
-
-/** PoC: schedules one `publishNotification` after a delay. Bridge
- *  push is no longer sent inline here — the bridge adapter (subscribed
- *  to the notifier channel) fans out to bridges based on the entry's
- *  `pluginData.transportId`. */
-export function scheduleTestNotification(opts: ScheduleNotificationOptions): ScheduledNotification {
-  const message = opts.message ?? DEFAULT_NOTIFICATION_MESSAGE;
-  const transportId = opts.transportId ?? DEFAULT_NOTIFICATION_TRANSPORT_ID;
-  const delaySeconds = clampDelay(opts.delaySeconds);
-  const delayMs = delaySeconds * ONE_SECOND_MS;
-  const kind = opts.kind ?? NOTIFICATION_KINDS.push;
-
-  const firesAt = new Date(Date.now() + delayMs).toISOString();
-
-  const timer = setTimeout(() => {
-    publishNotification({
-      kind,
-      title: message,
-      body: opts.body,
-      priority: NOTIFICATION_PRIORITIES.normal,
-      action: opts.action,
-      transportId,
-    });
-  }, delayMs);
-
-  return {
-    firesAt,
-    delaySeconds,
-    cancel: () => clearTimeout(timer),
-  };
-}
-
-const DEFAULT_DELAY_SECONDS = 60;
-
-function clampDelay(raw: number | undefined): number {
-  if (typeof raw !== "number" || !Number.isFinite(raw)) {
-    return DEFAULT_DELAY_SECONDS;
-  }
-  if (raw < 0) return 0;
-  if (raw > MAX_NOTIFICATION_DELAY_SEC) return MAX_NOTIFICATION_DELAY_SEC;
-  return Math.floor(raw);
-}

package/server/index.ts

@@ -4,6 +4,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import agentRoutes, { startChat } from "./api/routes/agent.js";
 import accountingRoutes from "./api/routes/accounting.js";
+import encoreRoutes from "./api/routes/encore.js";
 import photoLocationsRoutes from "./api/routes/photo-locations.js";
 import schedulerRoutes from "./api/routes/scheduler.js";
 import sessionsRoutes, { loadAllSessions } from "./api/routes/sessions.js";
@@ -36,8 +37,9 @@ import { loadPresetPlugins } from "./plugins/preset-loader.js";
 import { registerRuntimePlugins } from "./plugins/runtime-registry.js";
 import { makePluginRuntime } from "./plugins/runtime.js";
 import { MCP_PLUGIN_NAMES } from "./agent/plugin-names.js";
-import { createNotificationsRouter } from "./api/routes/notifications.js";
-import { startLegacyAdapters } from "./notifier/legacy-adapters.js";
+import { setActiveBackend } from "./agent/backend/index.js";
+import { fakeEchoBackend } from "./agent/backend/fake-echo.js";
+import { startMacosReminderAdapter } from "./notifier/macosReminderAdapter.js";
 import notifierRoutes from "./api/routes/notifier.js";
 import { initNotifier } from "./notifier/engine.js";
 import { registerSaveAttachmentHook } from "./utils/files/attachment-store.js";
@@ -45,6 +47,8 @@ import { capturePhotoLocation } from "./workspace/photo-locations/index.js";
 import { createJournalRouter } from "./api/routes/journal.js";
 import { createTranslationRouter } from "./api/routes/translation.js";
 import { announcePluginMetaDiagnostics } from "./plugins/diagnostics.js";
+import { announceOptionalDeps } from "./system/announceOptionalDeps.js";
+import { APP_VERSION } from "./system/appVersion.js";
 import { createChatService } from "@mulmobridge/chat-service";
 import { readSessionJsonl } from "./utils/files/session-io.js";
 import { onSessionEvent, initSessionStore } from "./events/session-store/index.js";
@@ -56,6 +60,8 @@ import { WORKSPACE_PATHS } from "./workspace/paths.js";
 import { serverError } from "./utils/httpError.js";
 import { makeUuid } from "./utils/id.js";
 import { mcpToolsRouter, mcpTools, isMcpToolEnabled } from "./agent/mcp-tools/index.js";
+import { preflightUserServers, logPreflightResult } from "./agent/mcpPreflight.js";
+import { loadMcpConfig } from "./system/config.js";
 import { initWorkspace, workspacePath } from "./workspace/workspace.js";
 import { runMemoryMigrationOnce } from "./workspace/memory/run.js";
 import { runTopicMigrationOnce } from "./workspace/memory/topic-run.js";
@@ -86,12 +92,13 @@ import { logBackgroundError } from "./utils/logBackgroundError.js";
 import { errorMessage } from "./utils/errors.js";
 import { registerScheduledSkills } from "./workspace/skills/scheduler.js";
 import { registerUserTasks } from "./workspace/skills/user-tasks.js";
+import { registerEncoreTick } from "./encore/boot.js";
 import { API_ROUTES } from "../src/config/apiRoutes.js";
 import { EVENT_TYPES } from "../src/types/events.js";
 import { SESSION_ORIGINS } from "../src/types/session.js";
 import { buildHtmlPreviewCsp } from "../src/utils/html/previewCsp.js";
 import { readAndInjectHtmlArtifact } from "./utils/html/htmlArtifactSplicer.js";
-import { ONE_SECOND_MS, ONE_MINUTE_MS, ONE_HOUR_MS, STARTUP_FAILURE_FORCE_EXIT_MS } from "./utils/time.js";
+import { ONE_SECOND_MS, ONE_MINUTE_MS, ONE_HOUR_MS, STARTUP_FAILURE_FORCE_EXIT_MS, FATAL_LOG_FLUSH_MS } from "./utils/time.js";
 import { isPortFree, findAvailablePort, MAX_PORT_PROBES } from "./utils/port.mjs";
 import { SCHEDULE_TYPES, MISSED_RUN_POLICIES } from "@receptron/task-scheduler";
 
@@ -102,6 +109,46 @@ const __dirname = path.dirname(__filename);
 
 const debugMode = process.argv.includes("--debug");
 
+// Global crash diagnostics (#1364). These handlers log loudly so a
+// fatal failure is triagable, then EXIT — keeping the loop running
+// after an uncaught exception is process-unsafe per the Node docs
+// (invariants may already be broken). The launcher / supervisor
+// (Electron wrapper, systemd, etc.) is responsible for restart.
+//
+// The canonical failure this PR set out to fix — missing `claude`
+// on PATH crashing the server via spawn's `error` event — is now
+// caught at the local boundary in `server/agent/backend/claude-code.ts`
+// (an explicit `error` listener turns ENOENT into an AgentEvent).
+// These handlers are the BACKSTOP for anything we missed, not a
+// substitute for local error handling. (Codex review on #1364.)
+//
+// `process.exit(1)` is non-zero so supervisors that branch on exit
+// code treat the bounce as an error condition.
+process.on("uncaughtException", (err) => {
+  log.error("uncaughtException", err instanceof Error ? err.message : String(err), {
+    stack: err instanceof Error ? err.stack : undefined,
+  });
+  // Tiny grace so the log line flushes to disk before we exit.
+  setTimeout(() => process.exit(1), FATAL_LOG_FLUSH_MS);
+});
+process.on("unhandledRejection", (reason) => {
+  log.error("unhandledRejection", reason instanceof Error ? reason.message : String(reason), {
+    stack: reason instanceof Error ? reason.stack : undefined,
+  });
+  setTimeout(() => process.exit(1), FATAL_LOG_FLUSH_MS);
+});
+
+// Test-seam: CI runs without a Claude CLI / API key set the
+// MULMOCLAUDE_FAKE_AGENT env var, which swaps in an echo-stub
+// backend so the chat flow still completes. Decided once at boot;
+// the orchestrator reads the active backend with zero per-call
+// overhead. Production callers never trip this branch (no runtime
+// import-time cost beyond the small fake-echo module itself).
+if (process.env.MULMOCLAUDE_FAKE_AGENT === "1") {
+  setActiveBackend(fakeEchoBackend);
+  log.info("agent", "MULMOCLAUDE_FAKE_AGENT=1 — active backend = fake-echo");
+}
+
 initWorkspace();
 
 // Fire-and-forget memory migrations: legacy `memory.md` → atomic
@@ -522,6 +569,7 @@ app.get(API_ROUTES.health, (_req: Request, res: Response) => {
   const cores = cpus().length;
   res.json({
     status: "OK",
+    version: APP_VERSION,
     geminiAvailable: isGeminiAvailable(),
     sandboxEnabled,
     cpu: { load1, cores },
@@ -549,6 +597,7 @@ app.get(API_ROUTES.sandbox, (_req: Request, res: Response) => {
 // the `/api` literal into each `router.post(API_ROUTES.…)` call.
 app.use(agentRoutes);
 app.use(accountingRoutes);
+app.use(encoreRoutes);
 app.use(photoLocationsRoutes);
 // todosRoutes removed (#1145) — todo is now a runtime plugin
 // (`@mulmoclaude/todo-plugin`); the dispatch route is generated by
@@ -653,7 +702,6 @@ app.use(chatService.router);
 // `startRuntimeServices` has it. Calls that arrive before fill-in
 // (impossible in practice — the HTTP server isn't listening yet)
 // would no-op on publish but still queue the bridge push.
-app.use(createNotificationsRouter());
 app.use(notifierRoutes);
 app.use(createJournalRouter());
 app.use(createTranslationRouter());
@@ -768,6 +816,29 @@ function logMcpStatus(): void {
     const names = disabledMcpTools.map((toolDef) => `${toolDef.definition.name} (${(toolDef.requiredEnv ?? []).join(", ")})`).join(", ");
     log.info("mcp", "Unavailable (missing env)", { tools: names });
   }
+  logExternalMcpPreflight();
+}
+
+// External MCP servers (the `mcp.json` ones — Notion / GitHub /…)
+// get a separate preflight pass that mirrors the built-in
+// `Available / Unavailable` summary above. Servers with catalog
+// entries whose `required: true` fields are unset are excluded from
+// the config handed to Claude Code (filtered inside
+// `prepareUserServers`); this boot-time log gives the operator one
+// clear startup signal (#1352).
+function logExternalMcpPreflight(): void {
+  try {
+    const userMcpRaw = loadMcpConfig().mcpServers;
+    const preflight = preflightUserServers(userMcpRaw);
+    logPreflightResult(preflight, "boot");
+  } catch (err) {
+    // Best-effort: a broken mcp.json shouldn't take down boot. The
+    // per-agent-run path will still attempt the preflight and surface
+    // any genuine issue when the user actually starts a chat.
+    log.warn("mcp", "preflight at boot failed; will retry per-agent-run", {
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
 }
 
 function maybeForceJournalRun(): void {
@@ -807,11 +878,9 @@ async function startRuntimeServices(httpServer: ReturnType<typeof app.listen>, p
   // is forwarded in here so the rest of `startRuntimeServices` can
   // share the same instance.
 
-  // --- Legacy adapters (bridge + macOS Reminder push) ---
-  // Subscribe in-process to the engine so any `notifier.publish` —
-  // legacy wrapper or plugin-runtime — triggers the same fan-out the
-  // legacy `publishNotification()` did inline before PR 4.
-  startLegacyAdapters({ pushToBridge: chatService.pushToBridge });
+  // macOS Reminder adapter wiring lives in the `app.listen` callback,
+  // alongside `initNotifier`, so it's subscribed before the first
+  // await opens a publish-can-fire-but-no-one's-listening window.
 
   // --- Plugin META aggregator diagnostics ---
   // After the notifier engine is initialized so the wrapper has a
@@ -820,6 +889,12 @@ async function startRuntimeServices(httpServer: ReturnType<typeof app.listen>, p
   // notification.
   await announcePluginMetaDiagnostics();
 
+  // --- Optional host-dependency probe (#1385) ---
+  // Probes docker / ffmpeg / … once, warns (log + bell) for any
+  // missing one so a feature degrading is visible instead of a
+  // later opaque crash. Never throws.
+  await announceOptionalDeps();
+
   // --- Chat socket transport (Phase A of #268) ---
   chatService.attachSocket(httpServer);
 
@@ -1027,6 +1102,8 @@ async function startRuntimeServices(httpServer: ReturnType<typeof app.listen>, p
     })
     .catch(logBackgroundError("user-tasks", "failed to register user tasks"));
 
+  registerEncoreTick(taskManager);
+
   taskManager.start();
 
   maybeForceJournalRun();
@@ -1123,6 +1200,14 @@ process.on("SIGTERM", () => {
     initNotifier({
       publish: (channel, payload) => earlyPubsub.publish(channel, payload),
     });
+    // Subscribe the macOS Reminder side-channel BEFORE the first
+    // await below — `initNotifier` opens the engine to publishes,
+    // and any boot-time diagnostic that lands during the
+    // `.server-port` write / `startRuntimeServices` setup would
+    // otherwise miss the Reminder fan-out (CodeRabbit review on
+    // PR #1358). The adapter is sync + no-op outside darwin, so
+    // wiring it here costs nothing.
+    startMacosReminderAdapter();
 
     // Publish the actually-bound port so the hook script can
     // address us — the requested PORT may have walked forward