reflectt-node 0.1.4 → 0.1.6

package/dist/server.js

@@ -11,9 +11,9 @@ import { createHash } from 'crypto';
 import { promises as fs, existsSync, readFileSync, readdirSync } from 'fs';
 import { resolve, sep, join } from 'path';
 import { execSync } from 'child_process';
-import { serverConfig, openclawConfig, isDev, REFLECTT_HOME } from './config.js';
+import { serverConfig, openclawConfig, isDev, REFLECTT_HOME, DATA_DIR } from './config.js';
 import { trackRequest, getRequestMetrics } from './request-tracker.js';
-import { getPreflightMetrics } from './alert-preflight.js';
+import { getPreflightMetrics, snapshotDailyMetrics, getDailySnapshots, startAutoSnapshot } from './alert-preflight.js';
 // ── Build info (read once at startup) ──────────────────────────────────────
 const BUILD_VERSION = (() => {
     try {
@@ -37,7 +37,11 @@ import { chatManager } from './chat.js';
 import { taskManager } from './tasks.js';
 import { detectApproval, applyApproval } from './chat-approval-detector.js';
 import { inboxManager } from './inbox.js';
+import { getFocus, setFocus, clearFocus, getFocusSummary } from './focus.js';
+import { generatePulse, generateCompactPulse } from './pulse.js';
+import { scanScopeOverlap, scanAndNotify } from './scopeOverlap.js';
 import { getDb } from './db.js';
+import { isTestHarnessTask } from './test-task-filter.js';
 import { handleMCPRequest, handleSSERequest, handleMessagesRequest } from './mcp.js';
 import { memoryManager } from './memory.js';
 import { buildContextInjection, getContextBudgets, getContextMemo, upsertContextMemo } from './context-budget.js';
@@ -54,6 +58,7 @@ import { emitActivationEvent, getUserFunnelState, getFunnelSummary, hasCompleted
 import { alertUnauthorizedApproval, alertFlipAttempt, getMutationAlertStatus, pruneOldAttempts } from './mutationAlert.js';
 import { mentionAckTracker } from './mention-ack.js';
 import { analyticsManager } from './analytics.js';
+import { processRequest as complianceProcessRequest, queryViolations, getViolationSummary } from './compliance-detector.js';
 import { getDashboardHTML } from './dashboard.js';
 import { healthMonitor, computeActiveLane } from './health.js';
 import { getSystemLoopTicks, recordSystemLoopTick } from './system-loop-state.js';
@@ -89,8 +94,9 @@ import { submitFeedback, listFeedback, getFeedback, updateFeedback, voteFeedback
 import { createEscalation, acknowledgeEscalation, resolveEscalation, tickEscalations, getEscalation, getEscalationByFeedback, listEscalations, } from './escalation.js';
 import { slotManager as canvasSlots } from './canvas-slots.js';
 import { createReflection, getReflection, listReflections, countReflections, reflectionStats, validateReflection, ROLE_TYPES, SEVERITY_LEVELS, recordReflectionDuplicate } from './reflections.js';
-import { ingestReflection, getInsight, listInsights, insightStats, extractClusterKey, tickCooldowns, updateInsightStatus, getOrphanedInsights, reconcileInsightTaskLinks, getLoopSummary } from './insights.js';
-import { patchInsightById } from './insight-mutation.js';
+import { ingestReflection, getInsight, listInsights, insightStats, extractClusterKey, tickCooldowns, updateInsightStatus, getOrphanedInsights, reconcileInsightTaskLinks, getLoopSummary, sweepShippedCandidates } from './insights.js';
+import { queryActivity, ACTIVITY_SOURCES } from './activity.js';
+import { patchInsightById, cooldownInsightById, closeInsightById } from './insight-mutation.js';
 import { promoteInsight, validatePromotionInput, generateRecurringCandidates, listPromotionAudits, getPromotionAuditByInsight } from './insight-promotion.js';
 import { runIntake, batchIntake, pipelineMaintenance, getPipelineStats } from './intake-pipeline.js';
 import { listLineage, getLineage, lineageStats } from './lineage.js';
@@ -140,7 +146,7 @@ const CreateTaskSchema = z.object({
     title: z.string().min(1),
     type: z.enum(TASK_TYPES).optional(), // optional for backward compat, validated when present
     description: z.string().optional(),
-    status: z.enum(['todo', 'doing', 'blocked', 'validating', 'done']).default('todo'),
+    status: z.enum(['todo', 'doing', 'blocked', 'validating', 'done', 'cancelled']).default('todo'),
     assignee: z.string().trim().min(1).optional().default('unassigned'),
     reviewer: z.string().trim().min(1).or(z.literal('auto')).default('auto'), // 'auto' triggers load-balanced assignment
     done_criteria: z.array(z.string().trim().min(1)).optional().default([]),
@@ -152,6 +158,8 @@ const CreateTaskSchema = z.object({
     tags: z.array(z.string()).optional(),
     teamId: z.string().optional(),
     metadata: z.record(z.unknown()).optional(),
+    dueAt: z.number().int().positive().optional(), // epoch ms — when the task is due
+    scheduledFor: z.number().int().positive().optional(), // epoch ms — when work should start
 });
 /**
  * Definition-of-ready check: validates task quality at creation time.
@@ -267,7 +275,7 @@ function normalizeConfiguredModel(value) {
 const UpdateTaskSchema = z.object({
     title: z.string().min(1).optional(),
     description: z.string().optional(),
-    status: z.enum(['todo', 'doing', 'blocked', 'validating', 'done']).optional(),
+    status: z.enum(['todo', 'doing', 'blocked', 'validating', 'done', 'cancelled']).optional(),
     assignee: z.string().optional(),
     reviewer: z.string().optional(),
     done_criteria: z.array(z.string().min(1)).optional(),
@@ -277,6 +285,8 @@ const UpdateTaskSchema = z.object({
     tags: z.array(z.string()).optional(),
     metadata: z.record(z.unknown()).optional(),
     actor: z.string().trim().min(1).optional(),
+    dueAt: z.number().int().positive().nullable().optional(), // epoch ms, null to clear
+    scheduledFor: z.number().int().positive().nullable().optional(), // epoch ms, null to clear
 });
 const CreateTaskCommentSchema = z.object({
     author: z.string().trim().min(1),
@@ -328,7 +338,7 @@ const CreateRecurringTaskSchema = z.object({
     metadata: z.record(z.unknown()).optional(),
     schedule: RecurringTaskScheduleSchema,
     enabled: z.boolean().optional(),
-    status: z.enum(['todo', 'doing', 'blocked', 'validating', 'done']).optional(),
+    status: z.enum(['todo', 'doing', 'blocked', 'validating', 'done', 'cancelled']).optional(),
 });
 const UpdateRecurringTaskSchema = z.object({
     enabled: z.boolean().optional(),
@@ -580,10 +590,26 @@ function enforceQaBundleGateForValidating(status, metadata, expectedTaskId) {
             };
         }
     }
+    // Early format validation: PR URL must be a valid GitHub PR URL
+    if (reviewPacket?.pr_url && !/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+$/.test(reviewPacket.pr_url)) {
+        return {
+            ok: false,
+            error: `Invalid PR URL format: "${reviewPacket.pr_url}"`,
+            hint: 'Expected format: https://github.com/owner/repo/pull/123',
+        };
+    }
+    // Early format validation: commit SHA must be 7-40 hex chars
+    if (reviewPacket?.commit && !/^[a-f0-9]{7,40}$/i.test(reviewPacket.commit)) {
+        return {
+            ok: false,
+            error: `Invalid commit SHA format: "${reviewPacket.commit}"`,
+            hint: 'Expected 7-40 hex characters, e.g. "a1b2c3d"',
+        };
+    }
     if (reviewPacket && !nonCodeLane && expectedTaskId && reviewPacket.task_id !== expectedTaskId) {
         return {
             ok: false,
-            error: `Review packet task mismatch: metadata.qa_bundle.review_packet.task_id must match ${expectedTaskId}`,
+            error: `Review packet task mismatch: got "${reviewPacket.task_id}", expected "${expectedTaskId}"`,
             hint: 'Set review_packet.task_id to the current task ID before moving to validating.',
         };
     }
@@ -591,7 +617,7 @@ function enforceQaBundleGateForValidating(status, metadata, expectedTaskId) {
     if (reviewPacket && !nonCodeLane && artifactPath && artifactPath !== reviewPacket.artifact_path) {
         return {
             ok: false,
-            error: 'Review packet mismatch: metadata.qa_bundle.review_packet.artifact_path must match metadata.artifact_path',
+            error: `Review packet artifact_path mismatch: got "${reviewPacket.artifact_path}", expected "${artifactPath}"`,
             hint: 'Use the same canonical process/... artifact path in both fields.',
         };
     }
@@ -855,7 +881,7 @@ function enforceReviewHandoffGateForValidating(status, taskId, metadata) {
     if (handoff.task_id !== taskId) {
         return {
             ok: false,
-            error: `Review handoff task_id mismatch: expected ${taskId}`,
+            error: `Review handoff task_id mismatch: got "${handoff.task_id}", expected "${taskId}"`,
             hint: 'Set metadata.review_handoff.task_id to the exact task being transitioned.',
         };
     }
@@ -1325,33 +1351,47 @@ function extractMentions(content) {
         return resolveAgentMention(raw) || raw;
     }).filter(Boolean)));
 }
-function buildAutonomyWarnings(content) {
-    const mentions = extractMentions(content);
-    if (mentions.length === 0)
+function getOwnerHandlesFromEnv() {
+    const raw = String(process.env.REFLECTT_OWNER_HANDLES || '').trim();
+    if (!raw)
         return [];
-    // Only warn when the message is explicitly directed at Ryan.
-    const directedAtRyan = mentions.includes('ryan') || mentions.includes('ryancampbell');
-    if (!directedAtRyan)
+    return raw
+        .split(',')
+        .map(s => s.trim().toLowerCase())
+        .filter(Boolean);
+}
+function isDirectedAtConfiguredOwner(content) {
+    const owners = getOwnerHandlesFromEnv();
+    if (owners.length === 0)
+        return false;
+    const mentions = extractMentions(content);
+    return owners.some(o => mentions.includes(o));
+}
+function buildAutonomyWarnings(content) {
+    // If no owner handles are configured, keep this feature off by default.
+    // reflectt-node must remain generic for customers.
+    if (!isDirectedAtConfiguredOwner(content))
         return [];
     const normalized = content.toLowerCase();
-    // Detect the specific anti-pattern: asking leadership what to do next.
+    // Detect the specific anti-pattern: asking a human leader/operator what to do next.
     // Keep the pattern narrow to avoid false positives on legitimate asks.
     const approvalSeeking = /\b(what should i (do|work on) next|what(?:['’]?s) next(?: for me)?|what do i do next|what do you want me to do next|should i (do|work on)( [^\n\r]{0,80})? next)\b/i;
     if (!approvalSeeking.test(normalized))
         return [];
     return [
-        'Autonomy guardrail: avoid asking Ryan what to do next. Pull from the board (/tasks/next) or pick the highest-priority task and ship. Escalate to Ryan only if blocked on a decision only a human can make.',
+        'Autonomy guardrail: avoid asking a human operator what to do next. Pull from the board (/tasks/next) or pick the highest-priority task and ship. Escalate only if you are blocked on a decision or permission that only a human can provide.',
     ];
 }
-function validateRyanApprovalPing(content, from, channel) {
-    // Only gate messages directed at Ryan.
-    const mentions = extractMentions(content);
-    const directedAtRyan = mentions.includes('ryan') || mentions.includes('ryancampbell');
-    if (!directedAtRyan)
+function validateOwnerApprovalPing(content, from, channel) {
+    const owners = getOwnerHandlesFromEnv();
+    if (owners.length === 0)
         return {};
-    // Don't gate Ryan/system talking to themselves.
+    // Only gate messages directed at configured owner handles.
+    if (!isDirectedAtConfiguredOwner(content))
+        return {};
+    // Don't gate the owner/system talking to themselves.
     const sender = String(from || '').toLowerCase();
-    if (sender === 'ryan' || sender === 'system')
+    if (owners.includes(sender) || sender === 'system')
         return {};
     const normalized = content.toLowerCase();
     // We only care about PR approval/merge requests.
@@ -1359,15 +1399,15 @@ function validateRyanApprovalPing(content, from, channel) {
         (/(\bpr\b|pull request|github\.com\/[^\s]+\/pull\/[0-9]+|#\d+)/i.test(normalized));
     if (!looksLikePrRequest)
         return {};
-    // Allow if the message explicitly explains why Ryan is required and references a task id.
+    // Allow if the message explicitly explains why a human is required and references a task id.
     const hasTaskId = hasTaskIdReference(content);
     const hasPermissionsReason = /(permission|permissions|auth|authed|rights|cannot|can\s*not|can't|blocked|branch protection|required)/i.test(normalized);
     if (hasTaskId && hasPermissionsReason)
         return {};
     const normalizedChannel = (channel || 'general').toLowerCase();
     return {
-        blockingError: `Don't ask @ryan to approve/merge PRs by default (channel=${normalizedChannel}). Ask the assigned reviewer, or merge it yourself. Escalate to Ryan only when truly blocked by permissions/auth.`,
-        hint: 'If Ryan is genuinely required: include task-<id> and a short permissions/auth reason (e.g., "no merge rights" / "branch protection"), plus the PR link.',
+        blockingError: `Don't ask a human operator to approve/merge PRs by default (channel=${normalizedChannel}). Ask the assigned reviewer, or merge it yourself. Escalate only when truly blocked by permissions/auth.`,
+        hint: 'If a human is genuinely required: include task-<id> and a short permissions/auth reason (e.g., "no merge rights" / "branch protection"), plus the PR link.',
     };
 }
 function buildMentionWarnings(content) {
@@ -1553,6 +1593,11 @@ export async function createServer() {
         healthMonitor.trackRequest(duration);
         trackTelemetryRequest(request.method, request.url, reply.statusCode, duration);
         trackRequest(request.method, request.url, reply.statusCode, request.headers['user-agent']);
+        // Compliance detector: flag state-read-before-assertion violations
+        try {
+            complianceProcessRequest(request.method, request.url, reply.statusCode, request.query ?? {}, request.body, request.headers);
+        }
+        catch { /* never let compliance logging break a request */ }
         if (reply.statusCode >= 400) {
             healthMonitor.trackError();
             // Normalize URL before telemetry to prevent PII leaks in query params
@@ -1758,7 +1803,7 @@ export async function createServer() {
         reflectionPipelineHealth.recentPromotions = recentPromotions;
         reflectionPipelineHealth.lastCheckedAt = now;
         if (recentReflections === 0) {
-            reflectionPipelineHealth.status = 'healthy';
+            reflectionPipelineHealth.status = 'idle';
             reflectionPipelineHealth.firstZeroInsightAt = 0;
             return reflectionPipelineHealth;
         }
@@ -1791,7 +1836,7 @@ export async function createServer() {
                 chatManager.sendMessage({
                     channel: 'general',
                     from: 'system',
-                    content: `🚨 Reflection pipeline broken: ${health.recentReflections} reflections in last ${health.windowMin}m but 0 insights created. @link @sage investigate ingestion/listener path.`,
+                    content: `🚨 Reflection pipeline broken: ${health.recentReflections} reflections in last ${health.windowMin}m but 0 recentInsightActivity (created+updated). @link @sage investigate ingestion/listener path.`,
                 }).catch(() => { });
             }
         }
@@ -1888,7 +1933,7 @@ export async function createServer() {
                 : {
                     status: 'not configured',
                     hint: 'Set OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN environment variables, or run: openclaw gateway token',
-                    docs: 'https://reflectt.ai/bootstrap',
+                    docs: 'https://app.reflectt.ai',
                 },
             chat: chatManager.getStats(),
             tasks: taskManager.getStats({ includeTest }),
@@ -1901,6 +1946,15 @@ export async function createServer() {
         };
     });
     // ─── Request errors — last N errors for launch-day debugging ───
+    app.get('/health/chat', async () => {
+        const stats = chatManager.getStats();
+        return {
+            totalMessages: stats.totalMessages,
+            rooms: stats.rooms,
+            subscribers: stats.subscribers,
+            drops: stats.drops,
+        };
+    });
     app.get('/health/errors', async () => {
         const m = getRequestMetrics();
         return {
@@ -1909,6 +1963,7 @@ export async function createServer() {
             error_rate: m.total > 0 ? Math.round((m.errors / m.total) * 10000) / 100 : 0,
             rolling: m.rolling,
             recent: m.recentErrors.slice(0, 20),
+            top_buckets: m.topErrorBuckets,
             timestamp: Date.now(),
         };
     });
@@ -2188,8 +2243,25 @@ export async function createServer() {
     });
     // ─── Alert preflight metrics ───
     app.get('/health/alert-preflight', async () => {
+        snapshotDailyMetrics(); // Persist daily checkpoint on health check
         return { ...getPreflightMetrics(), timestamp: Date.now() };
     });
+    app.get('/health/alert-preflight/history', async () => {
+        snapshotDailyMetrics();
+        return { snapshots: getDailySnapshots(), currentSession: getPreflightMetrics() };
+    });
+    // ─── Todo hoarding health: orphan detection + auto-unassign status ───
+    app.get('/health/hoarding', async (request) => {
+        const query = request.query;
+        const dryRun = query.dry_run !== '0' && query.dry_run !== 'false'; // default: dry run
+        const { sweepTodoHoarding, TODO_CAP, IDLE_THRESHOLD_MS } = await import('./todoHoardingGuard.js');
+        const result = await sweepTodoHoarding({ dryRun });
+        return {
+            ...result,
+            config: { todoCap: TODO_CAP, idleThresholdMinutes: Math.round(IDLE_THRESHOLD_MS / 60000) },
+            dryRun,
+        };
+    });
     // ─── Backlog health: ready counts per lane, breach status, floor compliance ───
     app.get('/health/backlog', async (request, reply) => {
         const query = request.query;
@@ -2206,7 +2278,7 @@ export async function createServer() {
                 return false;
             return task.blocked_by.some((blockerId) => {
                 const blocker = taskManager.getTask(blockerId);
-                return blocker && blocker.status !== 'done';
+                return blocker && !['done', 'resolved_externally', 'cancelled'].includes(blocker.status);
             });
         };
         // Definition-of-ready gate for backlog readiness: todo + required fields + unblocked
@@ -2217,14 +2289,23 @@ export async function createServer() {
             const hasDoneCriteria = Array.isArray(task.done_criteria) && task.done_criteria.length > 0;
             return hasTitle && hasPriority && hasReviewer && hasDoneCriteria;
         };
+        // Count tasks missing metadata.lane for visibility
+        const missingLaneCount = allTasks.filter(t => !t.metadata?.lane && !['done', 'cancelled', 'resolved_externally'].includes(t.status)).length;
         // Build per-lane health
+        // Task belongs to a lane if: (1) metadata.lane matches, OR (2) assignee is in lane agents (fallback)
         const laneHealth = Object.entries(lanes).map(([laneName, config]) => {
-            const laneTasks = allTasks.filter(t => config.agents.includes(t.assignee || ''));
+            const laneTasks = allTasks.filter(t => {
+                const taskLane = t.metadata?.lane;
+                if (taskLane)
+                    return taskLane === laneName;
+                return config.agents.includes(t.assignee || '');
+            });
             const todo = laneTasks.filter(t => t.status === 'todo');
             const doing = laneTasks.filter(t => t.status === 'doing');
             const validating = laneTasks.filter(t => t.status === 'validating');
             const blocked = laneTasks.filter(t => t.status === 'blocked' || (t.status === 'todo' && isBlocked(t)));
             const done = laneTasks.filter(t => t.status === 'done');
+            const resolvedExternally = laneTasks.filter(t => t.status === 'resolved_externally');
             // Ready = todo + required fields + unblocked
             const ready = todo.filter(t => !isBlocked(t) && hasRequiredFields(t));
             const notReady = todo.filter(t => isBlocked(t) || !hasRequiredFields(t));
@@ -2260,9 +2341,19 @@ export async function createServer() {
                     validating: validating.length,
                     blocked: blocked.length,
                     done: done.length,
+                    resolvedExternally: resolvedExternally.length,
                 },
+                // Top-level convenience aliases (never null)
+                readyCount: ready.length,
+                wipCount: doing.length,
                 compliance: {
                     status: floorBreaches.length > 0 ? 'breach' : ready.length >= config.readyFloor ? 'healthy' : 'warning',
+                    breaches: floorBreaches.map(a => ({
+                        agent: a.agent,
+                        ready: a.ready,
+                        required: config.readyFloor,
+                        deficit: config.readyFloor - a.ready,
+                    })),
                     floorBreaches: floorBreaches.map(a => ({
                         agent: a.agent,
                         ready: a.ready,
@@ -2307,6 +2398,7 @@ export async function createServer() {
                 breachedLaneCount: breachedLanes.length,
                 overallStatus: breachedLanes.length > 0 ? 'breach' : totalReady === 0 ? 'critical' : 'healthy',
                 staleValidatingCount: staleValidating.length,
+                missingLaneMetadata: missingLaneCount,
             },
             lanes: laneHealth,
             staleValidating,
@@ -2634,6 +2726,8 @@ export async function createServer() {
             pid: build.pid,
             nodeVersion: build.nodeVersion,
             uptime: build.uptime,
+            dataDir: DATA_DIR,
+            reflecttHome: REFLECTT_HOME,
         };
     });
     // Error logs (for debugging)
@@ -2733,8 +2827,11 @@ export async function createServer() {
     app.get('/', async (_request, reply) => {
         reply.redirect('/dashboard');
     });
-    app.get('/dashboard', async (_request, reply) => {
-        reply.type('text/html').send(getDashboardHTML());
+    app.get('/dashboard', async (request, reply) => {
+        const envFlag = process.env.REFLECTT_INTERNAL_UI === '1';
+        const queryFlag = request.query?.internal === '1';
+        const internalMode = envFlag && queryFlag;
+        reply.type('text/html').send(getDashboardHTML({ internalMode }));
     });
     // API docs page (markdown — token-efficient for agents)
     // UI Kit reference page — living component/states documentation
@@ -2768,13 +2865,13 @@ export async function createServer() {
             reply.code(500).send({ error: 'Failed to load docs' });
         }
     });
-    // Serve avatar images
+    // Serve avatar images (with fallback for missing avatars)
     app.get('/avatars/:filename', async (request, reply) => {
         const { filename } = request.params;
-        // Basic security: only allow .png files with alphanumeric names
-        if (!/^[a-z]+\.png$/.test(filename)) {
-            return reply.code(404).send({ error: 'Not found' });
-        }
+        // Security: allow alphanumeric, hyphens, underscores + .png/.svg extension
+        // (no slashes / traversal). If invalid, still return a safe default avatar (200)
+        // to avoid error-rate pollution from bad/mismatched filenames.
+        const safe = /^[a-z0-9_-]+\.(png|svg)$/i.test(filename);
         try {
             const { promises: fs } = await import('fs');
             const { join } = await import('path');
@@ -2783,13 +2880,59 @@ export async function createServer() {
             const __filename = fileURLToPath(import.meta.url);
             const __dirname = dirname(__filename);
             const publicDir = join(__dirname, '..', 'public', 'avatars');
-            const filePath = join(publicDir, filename);
-            const data = await fs.readFile(filePath);
-            reply.type('image/png').send(data);
+            if (safe) {
+                const lower = filename.toLowerCase();
+                const ext = lower.endsWith('.svg') ? 'image/svg+xml' : 'image/png';
+                // 1) Exact avatar file
+                try {
+                    const filePath = join(publicDir, filename);
+                    const data = await fs.readFile(filePath);
+                    reply.type(ext).header('Cache-Control', 'public, max-age=3600').send(data);
+                    return;
+                }
+                catch {
+                    // fall through to fallback handling below
+                }
+                // 2) Some clients request generic agent-N.png assets. Serve a deterministic
+                // fallback PNG instead of returning 404 (noise) or a mismatched SVG.
+                if (lower.endsWith('.png')) {
+                    const match = /^agent-(\d+)\.png$/.exec(lower);
+                    const fallbackPool = [
+                        'kai.png',
+                        'link.png',
+                        'sage.png',
+                        'pixel.png',
+                        'echo.png',
+                        'scout.png',
+                        'harmony.png',
+                        'spark.png',
+                        'rhythm.png',
+                        'ryan.png',
+                    ];
+                    const n = match ? Number(match[1]) : NaN;
+                    const index = Number.isFinite(n) ? (Math.max(1, n) - 1) % fallbackPool.length : 0;
+                    const fallbackName = fallbackPool[index] || 'ryan.png';
+                    try {
+                        const data = await fs.readFile(join(publicDir, fallbackName));
+                        reply.type('image/png').header('Cache-Control', 'public, max-age=3600').send(data);
+                        return;
+                    }
+                    catch {
+                        // fall through to SVG default below
+                    }
+                }
+            }
         }
-        catch (err) {
-            reply.code(404).send({ error: 'Avatar not found' });
+        catch {
+            // fall through to default avatar below
         }
+        // Default avatar: render an initial when possible, else '?'
+        const initial = safe ? (filename.replace(/\.(png|svg)$/i, '').charAt(0) || '?').toUpperCase() : '?';
+        const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64">
+      <rect width="64" height="64" rx="12" fill="#21262d"/>
+      <text x="32" y="38" text-anchor="middle" font-family="system-ui,sans-serif" font-size="24" font-weight="600" fill="#8d96a0">${initial}</text>
+    </svg>`;
+        reply.type('image/svg+xml').header('Cache-Control', 'public, max-age=3600').send(svg);
     });
     // Serve dashboard JS (extracted from inline template)
     app.get('/dashboard.js', async (_request, reply) => {
@@ -2933,14 +3076,14 @@ export async function createServer() {
                 hint: actionValidation.hint,
             };
         }
-        const ryanApprovalGate = validateRyanApprovalPing(data.content, data.from, data.channel);
-        if (ryanApprovalGate.blockingError) {
+        const ownerApprovalGate = validateOwnerApprovalPing(data.content, data.from, data.channel);
+        if (ownerApprovalGate.blockingError) {
             reply.code(400);
             return {
                 success: false,
-                error: ryanApprovalGate.blockingError,
-                gate: 'ryan_approval_gate',
-                hint: ryanApprovalGate.hint,
+                error: ownerApprovalGate.blockingError,
+                gate: 'owner_approval_gate',
+                hint: ownerApprovalGate.hint,
             };
         }
         const message = await chatManager.sendMessage(data);
@@ -2954,7 +3097,7 @@ export async function createServer() {
         // Auto-update presence: if you're posting, you're active
         if (data.from) {
             presenceManager.recordActivity(data.from, 'message');
-            presenceManager.updatePresence(data.from, 'working');
+            presenceManager.touchPresence(data.from);
             // Activation funnel: first team message
             emitActivationEvent('first_team_message_sent', data.from, {
                 channel: data.channel || 'general',
@@ -3150,7 +3293,7 @@ export async function createServer() {
                     return false;
                 return t.blocked_by.some((blockerId) => {
                     const blocker = taskManager.getTask(blockerId);
-                    return blocker && blocker.status !== 'done';
+                    return blocker && !['done', 'resolved_externally', 'cancelled'].includes(blocker.status);
                 });
             };
             const nextTodo = taskManager
@@ -3593,22 +3736,38 @@ export async function createServer() {
         const { metadata, description, done_criteria, ...slim } = task;
         return slim;
     };
-    const isCompact = (query) => query.compact === '1' || query.compact === 'true';
+    const isCompact = (query) => {
+        const v = Array.isArray(query.compact) ? query.compact[0] : query.compact;
+        return v === '1' || v === 'true';
+    };
     // List tasks
     app.get('/tasks', async (request, reply) => {
         const query = request.query;
-        const updatedSince = parseEpochMs(query.updatedSince || query.since);
-        const limit = boundedLimit(query.limit, DEFAULT_LIMITS.tasks, MAX_LIMITS.tasks);
-        const tagFilter = query.tag
-            ? [query.tag]
-            : (query.tags ? query.tags.split(',') : undefined);
-        const includeTest = query.include_test === '1' || query.include_test === 'true';
+        const updatedSince = parseEpochMs((Array.isArray(query.updatedSince) ? query.updatedSince[0] : query.updatedSince) || (Array.isArray(query.since) ? query.since[0] : query.since));
+        const limitRaw = Array.isArray(query.limit) ? query.limit[0] : query.limit;
+        const limit = boundedLimit(limitRaw, DEFAULT_LIMITS.tasks, MAX_LIMITS.tasks);
+        const tagRaw = Array.isArray(query.tag) ? query.tag[0] : query.tag;
+        const tagsRaw = Array.isArray(query.tags) ? query.tags[0] : query.tags;
+        const tagFilter = tagRaw
+            ? [tagRaw]
+            : (tagsRaw ? tagsRaw.split(',') : undefined);
+        const includeTestRaw = Array.isArray(query.include_test) ? query.include_test[0] : query.include_test;
+        const includeTest = includeTestRaw === '1' || includeTestRaw === 'true';
+        // Normalize status: supports ?status=todo, ?status[]=todo&status[]=doing,
+        // and repeated ?status=todo&status=doing (Fastify parses as array)
+        const VALID_STATUSES = ['todo', 'doing', 'blocked', 'validating', 'done', 'cancelled'];
+        const statusRaw = query.status;
+        const statusFilter = statusRaw === undefined
+            ? undefined
+            : (Array.isArray(statusRaw)
+                ? statusRaw.filter((s) => VALID_STATUSES.includes(s))
+                : VALID_STATUSES.includes(statusRaw) ? [statusRaw] : undefined);
         let tasks = taskManager.listTasks({
-            status: query.status,
-            assignee: query.assignee || query.assignedTo, // Support both for backward compatibility
-            createdBy: query.createdBy,
-            teamId: normalizeTeamId(query.teamId),
-            priority: query.priority,
+            status: statusFilter && statusFilter.length === 1 ? statusFilter[0] : (statusFilter && statusFilter.length > 1 ? statusFilter : undefined),
+            assignee: (Array.isArray(query.assignee) ? query.assignee[0] : query.assignee) || (Array.isArray(query.assignedTo) ? query.assignedTo[0] : query.assignedTo),
+            createdBy: Array.isArray(query.createdBy) ? query.createdBy[0] : query.createdBy,
+            teamId: normalizeTeamId(Array.isArray(query.teamId) ? query.teamId[0] : query.teamId),
+            priority: (Array.isArray(query.priority) ? query.priority[0] : query.priority),
             tags: tagFilter,
             includeTest,
         });
@@ -3616,7 +3775,8 @@ export async function createServer() {
             tasks = tasks.filter(task => task.updatedAt >= updatedSince);
         }
         // Text search filter
-        const searchQuery = (query.q || '').trim().toLowerCase();
+        const qRaw = Array.isArray(query.q) ? query.q[0] : query.q;
+        const searchQuery = (qRaw || '').trim().toLowerCase();
         if (searchQuery) {
             tasks = tasks.filter(task => (task.title || '').toLowerCase().includes(searchQuery) ||
                 (task.description || '').toLowerCase().includes(searchQuery) ||
@@ -3624,7 +3784,7 @@ export async function createServer() {
                 (task.id || '').toLowerCase().includes(searchQuery));
         }
         const total = tasks.length;
-        const offset = parsePositiveInt(query.offset) || 0;
+        const offset = parsePositiveInt(Array.isArray(query.offset) ? query.offset[0] : query.offset) || 0;
         tasks = tasks.slice(offset, offset + limit);
         const hasMore = offset + tasks.length < total;
         const enriched = tasks.map(enrichTaskWithComments);
@@ -4827,7 +4987,13 @@ export async function createServer() {
             // fan out inbox-visible notifications to assignee/reviewer + explicit @mentions.
             // Notification routing respects per-agent preferences (quiet hours, mute, filters).
             const task = taskManager.getTask(resolved.resolvedId);
-            if (task && !comment.suppressed) {
+            // Never fan out notifications for test-harness tasks.
+            // Our repo contains a few "LIVE server" tests (BASE=127.0.0.1:4445) that create
+            // tasks/comments with metadata.is_test=true. Without this guard, running `npm test`
+            // on a machine with a live node will spam real chat channels and look like a human
+            // (e.g. @link) posted the comment.
+            const shouldFanOut = task ? !isTestHarnessTask(task) : false;
+            if (task && !comment.suppressed && shouldFanOut) {
                 const targets = new Set();
                 if (task.assignee)
                     targets.add(task.assignee);
@@ -4875,7 +5041,7 @@ export async function createServer() {
                 }
             }
             presenceManager.recordActivity(data.author, 'message');
-            presenceManager.updatePresence(data.author, 'working');
+            presenceManager.touchPresence(data.author);
             // Heartbeat discipline: compute gap since previous comment for doing tasks
             let heartbeatWarning;
             if (task && task.status === 'doing' && !comment.suppressed) {
@@ -4940,6 +5106,44 @@ export async function createServer() {
             return { success: false, error: err.message || 'Failed to capture outcome verdict' };
         }
     });
+    // ── Cancel a task (convenience endpoint) ──
+    app.post('/tasks/:id/cancel', async (request, reply) => {
+        const task = taskManager.getTask(request.params.id);
+        if (!task) {
+            reply.code(404);
+            return { success: false, error: 'Task not found' };
+        }
+        if (task.status === 'cancelled') {
+            return { success: true, message: 'Task already cancelled', task: enrichTaskWithComments(task) };
+        }
+        if (task.status === 'done') {
+            reply.code(400);
+            return { success: false, error: 'Cannot cancel a done task. Use metadata.reopen=true first.' };
+        }
+        const body = (request.body || {});
+        const reason = typeof body.reason === 'string' ? body.reason : undefined;
+        const author = typeof body.author === 'string' ? body.author : 'system';
+        if (!reason) {
+            reply.code(400);
+            return { success: false, error: 'Cancel reason required. Include { "reason": "..." } in request body.' };
+        }
+        try {
+            const updated = await taskManager.updateTask(task.id, {
+                status: 'cancelled',
+                metadata: {
+                    ...(task.metadata || {}),
+                    cancel_reason: reason,
+                    cancelled_by: author,
+                    cancelled_at: new Date().toISOString(),
+                },
+            });
+            return { success: true, task: updated ? enrichTaskWithComments(updated) : null };
+        }
+        catch (err) {
+            reply.code(400);
+            return { success: false, error: err.message || 'Failed to cancel task' };
+        }
+    });
     // Build normalized reviewer packet (PR + CI + artifacts)
     app.post('/tasks/:id/review-bundle', async (request, reply) => {
         const task = taskManager.getTask(request.params.id);
@@ -5249,7 +5453,12 @@ export async function createServer() {
     // Create task
     app.post('/tasks', async (request, reply) => {
         try {
-            const data = CreateTaskSchema.parse(request.body);
+            // Normalize legacy "in-progress" → "doing" before schema validation
+            const rawPostBody = request.body;
+            if (rawPostBody && typeof rawPostBody === 'object' && rawPostBody.status === 'in-progress') {
+                rawPostBody.status = 'doing';
+            }
+            const data = CreateTaskSchema.parse(rawPostBody);
             // Reject TEST: prefixed tasks in production to prevent CI pollution
             if (process.env.NODE_ENV === 'production' && typeof data.title === 'string' && data.title.startsWith('TEST:')) {
                 reply.code(400);
@@ -5359,9 +5568,10 @@ export async function createServer() {
                 ...(normalizedTeamId ? { teamId: normalizedTeamId } : {}),
                 metadata: newMetadata,
             });
-            // Auto-update presence: creating tasks = working
+            // Touch presence: creating tasks proves the agent is alive, but shouldn't
+            // override task-derived status (e.g. agent filing a task while reviewing)
             if (data.createdBy) {
-                presenceManager.updatePresence(data.createdBy, 'working');
+                presenceManager.touchPresence(data.createdBy);
             }
             // Fire-and-forget: index task for semantic search
             if (!data.title.startsWith('TEST:')) {
@@ -5398,7 +5608,7 @@ export async function createServer() {
                     // Deduplication: check existing tasks for similar titles
                     if (data.deduplicate) {
                         const existingTasks = taskManager.listTasks({});
-                        const activeTasks = existingTasks.filter(t => t.status !== 'done');
+                        const activeTasks = existingTasks.filter(t => t.status !== 'done' && t.status !== 'cancelled' && t.status !== 'resolved_externally');
                         const normalizedNew = taskData.title.toLowerCase().trim();
                         // Exact title match
                         const exactMatch = activeTasks.find(t => t.title.toLowerCase().trim() === normalizedNew);
@@ -5856,7 +6066,13 @@ export async function createServer() {
     // Update task
     app.patch('/tasks/:id', async (request, reply) => {
         try {
-            const parsed = UpdateTaskSchema.parse(request.body);
+            // Normalize legacy "in-progress" → "doing" before schema validation.
+            // Some agents (and older MCP callers) use the deprecated status name.
+            const rawBody = request.body;
+            if (rawBody && typeof rawBody === 'object' && rawBody.status === 'in-progress') {
+                rawBody.status = 'doing';
+            }
+            const parsed = UpdateTaskSchema.parse(rawBody);
             const lookup = taskManager.resolveTaskId(request.params.id);
             if (lookup.matchType === 'ambiguous') {
                 reply.code(400);
@@ -5885,12 +6101,13 @@ export async function createServer() {
             // Must run before all other gates to give a clear rejection message.
             if (parsed.status && parsed.status !== existing.status) {
                 const ALLOWED_TRANSITIONS = {
-                    'todo': ['doing'],
-                    'doing': ['blocked', 'validating'],
-                    'blocked': ['doing', 'todo'],
+                    'todo': ['doing', 'cancelled'],
+                    'doing': ['blocked', 'validating', 'cancelled'],
+                    'blocked': ['doing', 'todo', 'cancelled'],
                     'validating': ['done', 'doing'], // doing = reviewer rejection / rework
                     'done': [], // all exits require reopen
-                    'in-progress': ['blocked', 'validating', 'done', 'doing', 'todo'], // legacy, permissive
+                    'cancelled': [], // terminal state, like done — requires reopen to revive
+                    'in-progress': ['blocked', 'validating', 'done', 'doing', 'todo', 'cancelled'], // legacy, permissive
                 };
                 const allowed = ALLOWED_TRANSITIONS[existing.status] ?? [];
                 if (!allowed.includes(parsed.status)) {
@@ -5915,6 +6132,24 @@ export async function createServer() {
                     mergedMeta.reopened_from = existing.status;
                 }
             }
+            // ── Cancel reason gate: require cancel_reason when transitioning to cancelled ──
+            if (parsed.status === 'cancelled') {
+                const meta = (incomingMeta ?? {});
+                const cancelReason = typeof meta.cancel_reason === 'string' ? String(meta.cancel_reason).trim() : '';
+                if (!cancelReason) {
+                    reply.code(422);
+                    return {
+                        success: false,
+                        error: 'Cancellation requires a cancel_reason in metadata (e.g. "duplicate", "out of scope", "won\'t fix").',
+                        code: 'CANCEL_REASON_REQUIRED',
+                        gate: 'cancel_reason',
+                        hint: 'Include metadata.cancel_reason explaining why this task is being cancelled.',
+                    };
+                }
+                mergedMeta.cancel_reason = cancelReason;
+                mergedMeta.cancelled_at = Date.now();
+                mergedMeta.cancelled_from = existing.status;
+            }
             // Reviewer-identity gate: only assigned reviewer can set reviewer_approved=true.
             const incomingReviewerApproved = incomingMeta.reviewer_approved;
             if (incomingReviewerApproved === true) {
@@ -6000,6 +6235,29 @@ export async function createServer() {
                     hint: duplicateGate.hint,
                 };
             }
+            // Early format validation: catch bad PR URLs and commit SHAs on any update, not just at validating transition
+            const earlyReviewPacket = mergedMeta?.qa_bundle?.review_packet;
+            const earlyHandoff = mergedMeta?.review_handoff;
+            const earlyPrUrl = (earlyReviewPacket?.pr_url ?? earlyHandoff?.pr_url);
+            const earlyCommit = (earlyReviewPacket?.commit ?? earlyHandoff?.commit_sha);
+            if (earlyPrUrl && typeof earlyPrUrl === 'string' && !/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+$/.test(earlyPrUrl)) {
+                reply.code(400);
+                return {
+                    success: false,
+                    error: `Invalid PR URL format: "${earlyPrUrl}"`,
+                    gate: 'format_validation',
+                    hint: 'Expected format: https://github.com/owner/repo/pull/123',
+                };
+            }
+            if (earlyCommit && typeof earlyCommit === 'string' && earlyCommit.length > 0 && !/^[a-f0-9]{7,40}$/i.test(earlyCommit)) {
+                reply.code(400);
+                return {
+                    success: false,
+                    error: `Invalid commit SHA format: "${earlyCommit}"`,
+                    gate: 'format_validation',
+                    hint: 'Expected 7-40 hex characters, e.g. "a1b2c3d"',
+                };
+            }
             // QA bundle gate: validating requires structured review evidence.
             const effectiveStatus = parsed.status ?? existing.status;
             const qaGate = enforceQaBundleGateForValidating(parsed.status, mergedMeta, existing.id);
@@ -6335,6 +6593,25 @@ export async function createServer() {
                     presenceManager.updatePresence(task.assignee, 'reviewing');
                 }
             }
+            // ── Reviewer notification: @mention reviewer when task enters validating ──
+            if (parsed.status === 'validating' && existing.status !== 'validating' && existing.reviewer) {
+                const taskMeta = task.metadata;
+                const prUrl = taskMeta?.review_handoff?.pr_url
+                    ?? taskMeta?.qa_bundle?.pr_url
+                    ?? '';
+                const prLine = prUrl ? `\nPR: ${prUrl}` : '';
+                chatManager.sendMessage({
+                    from: 'system',
+                    content: `@${existing.reviewer} [reviewRequested:${task.id}] ${task.title} → validating${prLine}`,
+                    channel: 'task-notifications',
+                    metadata: {
+                        kind: 'review_requested',
+                        taskId: task.id,
+                        reviewer: existing.reviewer,
+                        prUrl: prUrl || undefined,
+                    },
+                }).catch(() => { }); // Non-blocking
+            }
             // ── Activation funnel: track first_task_started / first_task_completed ──
             {
                 const funnelUserId = task.metadata?.userId || task.assignee || '';
@@ -6426,6 +6703,24 @@ export async function createServer() {
             }
             if (parsed.status === 'validating' && task.reviewer) {
                 statusNotifTargets.push({ agent: task.reviewer, type: 'reviewRequested' });
+                // ── Explicit reviewer routing: ping reviewer with PR link + ask ──
+                const prUrl = task.metadata?.pr_url
+                    || task.metadata?.qa_bundle?.pr_url
+                    || task.metadata?.review_handoff?.pr_url;
+                const prLink = typeof prUrl === 'string' && prUrl ? ` — ${prUrl}` : '';
+                const reviewMsg = `@${task.reviewer} review requested: **${task.title}** (${task.id})${prLink}. Please approve or flag issues.`;
+                chatManager.sendMessage({
+                    from: 'system',
+                    content: reviewMsg,
+                    channel: 'reviews',
+                    metadata: {
+                        kind: 'review_routing',
+                        taskId: task.id,
+                        reviewer: task.reviewer,
+                        assignee: task.assignee,
+                        prUrl: prUrl || null,
+                    },
+                }).catch(() => { }); // Non-blocking
             }
             if (parsed.status === 'done') {
                 if (task.assignee)
@@ -6433,7 +6728,21 @@ export async function createServer() {
                 if (task.reviewer)
                     statusNotifTargets.push({ agent: task.reviewer, type: 'taskCompleted' });
             }
+            // Dedupe guard: prevent stale/out-of-order notification events
+            const { shouldEmitNotification } = await import('./notificationDedupeGuard.js');
             for (const target of statusNotifTargets) {
+                // Check dedupe guard before emitting
+                const dedupeCheck = shouldEmitNotification({
+                    taskId: task.id,
+                    eventUpdatedAt: task.updatedAt,
+                    eventStatus: parsed.status,
+                    currentTaskStatus: task.status,
+                    currentTaskUpdatedAt: task.updatedAt,
+                });
+                if (!dedupeCheck.emit) {
+                    console.log(`[NotifDedupe] Suppressed: ${dedupeCheck.reason}`);
+                    continue;
+                }
                 const routing = notifMgr.shouldNotify({
                     type: target.type,
                     agent: target.agent,
@@ -6450,6 +6759,7 @@ export async function createServer() {
                             kind: target.type,
                             taskId: task.id,
                             status: parsed.status,
+                            updatedAt: task.updatedAt,
                             deliveryMethod: routing.deliveryMethod,
                         },
                     }).catch(() => { }); // Non-blocking
@@ -6734,6 +7044,40 @@ export async function createServer() {
         }
         return { success: true, agent, displayName };
     });
+    // ── Write TEAM-ROLES.yaml (used by bootstrap agent to configure the team) ──
+    app.put('/config/team-roles', async (request, reply) => {
+        const body = request.body;
+        const yaml = typeof body.yaml === 'string' ? body.yaml.trim() : '';
+        if (!yaml) {
+            reply.code(400);
+            return { success: false, error: 'yaml field is required (TEAM-ROLES.yaml content)' };
+        }
+        // Basic validation: must contain 'agents:' and at least one agent name
+        if (!yaml.includes('agents:')) {
+            reply.code(400);
+            return { success: false, error: 'Invalid TEAM-ROLES.yaml: must contain "agents:" section' };
+        }
+        try {
+            const { writeFileSync } = await import('node:fs');
+            const { join } = await import('node:path');
+            const filePath = join(REFLECTT_HOME, 'TEAM-ROLES.yaml');
+            writeFileSync(filePath, yaml, 'utf-8');
+            // Hot-reload the team config
+            const { loadAgentRoles } = await import('./assignment.js');
+            const reloaded = loadAgentRoles();
+            return {
+                success: true,
+                path: filePath,
+                agents: reloaded.roles.length,
+                hint: 'TEAM-ROLES.yaml saved and hot-reloaded. Agents will pick up new routing immediately.',
+            };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'Failed to write TEAM-ROLES.yaml';
+            reply.code(500);
+            return { success: false, error: msg };
+        }
+    });
     // Resolve a mention string (name, displayName, or alias) to an agent ID
     app.get('/resolve/mention/:mention', async (request) => {
         const agentName = resolveAgentMention(request.params.mention);
@@ -7537,8 +7881,41 @@ export async function createServer() {
         reply.code(201);
         return { success: true, insight, cluster_key: extractClusterKey(reflection) };
     });
+    // ── Activity Timeline ──────────────────────────────────────────────────
+    app.get('/activity', async (request) => {
+        const query = request.query;
+        const range = query.range === '7d' ? '7d' : '24h';
+        const type = query.type ? query.type.split(',').map(t => t.trim()).filter(Boolean) : undefined;
+        const agent = query.agent || undefined;
+        const limit = query.limit ? Number(query.limit) : undefined;
+        const after = query.after || undefined;
+        // debug=1 only allowed from localhost
+        const isLocalhost = request.ip === '127.0.0.1' || request.ip === '::1' || request.ip === '::ffff:127.0.0.1';
+        const debug = query.debug === '1' && isLocalhost;
+        try {
+            return queryActivity({ range, type, agent, limit, after, debug });
+        }
+        catch (err) {
+            request.log.error({ err }, 'Activity query failed');
+            throw err;
+        }
+    });
+    app.get('/activity/sources', async () => {
+        return {
+            sources: [...ACTIVITY_SOURCES],
+            description: 'Allowed values for partial.missing[] and type filter',
+        };
+    });
     app.get('/insights', async (request) => {
         const query = request.query;
+        // Hygiene: when listing candidate insights, proactively cool down any
+        // candidates whose promoted task is already done/cancelled so they don't resurface.
+        // Keep listInsights() itself pure (no DB writes on read).
+        if (query.status === 'candidate') {
+            const offset = query.offset ? Number(query.offset) || 0 : 0;
+            if (offset === 0)
+                sweepShippedCandidates();
+        }
         const result = listInsights({
             status: query.status,
             priority: query.priority,
@@ -7657,6 +8034,104 @@ export async function createServer() {
         }
         return { success: true, insight: result.insight };
     });
+    // Narrow localhost-only admin endpoints for routine hygiene: cooldown/close.
+    // These avoid enabling the broader PATCH /insights/:id mutation API.
+    app.post('/insights/:id/cooldown', async (request, reply) => {
+        const ip = String(request.ip || '');
+        const isLoopback = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+        if (!isLoopback) {
+            reply.code(403);
+            return {
+                success: false,
+                error: 'Forbidden: localhost-only endpoint',
+                hint: `Request ip (${ip || 'unknown'}) is not loopback`,
+            };
+        }
+        const requiredToken = process.env.REFLECTT_INSIGHT_MUTATION_TOKEN;
+        if (requiredToken) {
+            const raw = request.headers['x-reflectt-admin-token'];
+            let provided = Array.isArray(raw) ? raw[0] : raw;
+            const auth = request.headers.authorization;
+            if ((!provided || typeof provided !== 'string') && typeof auth === 'string' && auth.startsWith('Bearer ')) {
+                provided = auth.slice('Bearer '.length);
+            }
+            if (typeof provided !== 'string' || provided !== requiredToken) {
+                reply.code(403);
+                return {
+                    success: false,
+                    error: 'Forbidden: missing/invalid admin token',
+                    hint: 'Provide x-reflectt-admin-token header (or Authorization: Bearer ...) matching REFLECTT_INSIGHT_MUTATION_TOKEN.'
+                };
+            }
+        }
+        const body = (request.body ?? {});
+        const actor = typeof body.actor === 'string' ? body.actor : '';
+        const reason = typeof body.reason === 'string' ? body.reason : '';
+        const notes = typeof body.notes === 'string' ? body.notes : undefined;
+        const cooldown_reason = typeof body.cooldown_reason === 'string' ? body.cooldown_reason : undefined;
+        const cooldown_until = typeof body.cooldown_until === 'number' && Number.isFinite(body.cooldown_until)
+            ? body.cooldown_until
+            : (typeof body.cooldown_ms === 'number' && Number.isFinite(body.cooldown_ms)
+                ? Date.now() + Math.max(0, body.cooldown_ms)
+                : undefined);
+        const result = cooldownInsightById(request.params.id, {
+            actor,
+            reason,
+            ...(notes ? { notes } : {}),
+            ...(cooldown_until ? { cooldown_until } : {}),
+            ...(cooldown_reason ? { cooldown_reason } : {}),
+        });
+        if (!result.success) {
+            const notFound = result.error === 'Insight not found';
+            reply.code(notFound ? 404 : 400);
+            return { success: false, error: result.error };
+        }
+        return { success: true, insight: result.insight };
+    });
+    app.post('/insights/:id/close', async (request, reply) => {
+        const ip = String(request.ip || '');
+        const isLoopback = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+        if (!isLoopback) {
+            reply.code(403);
+            return {
+                success: false,
+                error: 'Forbidden: localhost-only endpoint',
+                hint: `Request ip (${ip || 'unknown'}) is not loopback`,
+            };
+        }
+        const requiredToken = process.env.REFLECTT_INSIGHT_MUTATION_TOKEN;
+        if (requiredToken) {
+            const raw = request.headers['x-reflectt-admin-token'];
+            let provided = Array.isArray(raw) ? raw[0] : raw;
+            const auth = request.headers.authorization;
+            if ((!provided || typeof provided !== 'string') && typeof auth === 'string' && auth.startsWith('Bearer ')) {
+                provided = auth.slice('Bearer '.length);
+            }
+            if (typeof provided !== 'string' || provided !== requiredToken) {
+                reply.code(403);
+                return {
+                    success: false,
+                    error: 'Forbidden: missing/invalid admin token',
+                    hint: 'Provide x-reflectt-admin-token header (or Authorization: Bearer ...) matching REFLECTT_INSIGHT_MUTATION_TOKEN.'
+                };
+            }
+        }
+        const body = (request.body ?? {});
+        const actor = typeof body.actor === 'string' ? body.actor : '';
+        const reason = typeof body.reason === 'string' ? body.reason : '';
+        const notes = typeof body.notes === 'string' ? body.notes : undefined;
+        const result = closeInsightById(request.params.id, {
+            actor,
+            reason,
+            ...(notes ? { notes } : {}),
+        });
+        if (!result.success) {
+            const notFound = result.error === 'Insight not found';
+            reply.code(notFound ? 404 : 400);
+            return { success: false, error: result.error };
+        }
+        return { success: true, insight: result.insight };
+    });
     app.get('/insights/stats', async () => {
         return insightStats();
     });
@@ -8274,7 +8749,41 @@ export async function createServer() {
         }
         const task = taskManager.getNextTask(agent, { includeTest });
         if (!task) {
-            return { task: null, message: 'No available tasks' };
+            const aliases = agent ? getAgentAliases(agent) : [];
+            // "Ready" counts: match /tasks/next selection semantics (blocked excluded)
+            const readyTodo = taskManager.listTasks({ status: 'todo', includeBlocked: false, includeTest });
+            const ready_todo_unassigned = readyTodo.filter(t => {
+                const a = String(t.assignee || '').trim().toLowerCase();
+                return a.length === 0 || a === 'unassigned';
+            }).length;
+            const ready_todo_assigned = agent
+                ? taskManager.listTasks({ status: 'todo', assigneeIn: aliases, includeBlocked: false, includeTest }).length
+                : 0;
+            const ready_doing_assigned = agent
+                ? taskManager.listTasks({ status: 'doing', assigneeIn: aliases, includeBlocked: false, includeTest }).length
+                : 0;
+            const ready_validating_assigned = agent
+                ? taskManager.listTasks({ status: 'validating', assigneeIn: aliases, includeBlocked: false, includeTest }).length
+                : 0;
+            const { formatTasksNextEmptyResponse } = await import('./tasks-next-diagnostics.js');
+            const payload = formatTasksNextEmptyResponse({
+                agent,
+                ready_doing_assigned,
+                ready_todo_unassigned,
+                ready_todo_assigned,
+                ready_validating_assigned,
+            });
+            return { task: null, ...payload };
+        }
+        // Rule C: auto-claim (todo→doing) when ?claim=1
+        const shouldClaim = query.claim === '1' || query.claim === 'true';
+        if (shouldClaim && agent && task.status === 'todo') {
+            const { claimTask } = await import('./todoHoardingGuard.js');
+            const claimed = await claimTask(task.id, agent);
+            if (claimed) {
+                const enriched = enrichTaskWithComments(claimed);
+                return { task: isCompact(query) ? compactTask(enriched) : enriched, claimed: true };
+            }
         }
         const enriched = enrichTaskWithComments(task);
         return { task: isCompact(query) ? compactTask(enriched) : enriched };
@@ -8367,7 +8876,11 @@ export async function createServer() {
         }));
         const todoTasks = taskManager.listTasks({ status: 'todo', assigneeIn: getAgentAliases(agent) });
         const validatingTasks = taskManager.listTasks({ status: 'validating', assigneeIn: getAgentAliases(agent) });
-        const slim = (t) => t ? { id: t.id, title: t.title, status: t.status, priority: t.priority } : null;
+        const slim = (t) => t ? {
+            id: t.id, title: t.title, status: t.status, priority: t.priority,
+            ...(t.dueAt ? { dueAt: t.dueAt } : {}),
+            ...(t.scheduledFor ? { scheduledFor: t.scheduledFor } : {}),
+        } : null;
         presenceManager.recordActivity(agent, 'heartbeat');
         // Check pause status
         const pauseStatus = checkPauseStatus(agent);
@@ -8375,12 +8888,18 @@ export async function createServer() {
         const { getIntensity, checkPullBudget } = await import('./intensity.js');
         const intensity = getIntensity();
         const pullBudget = checkPullBudget(agent);
+        // Drop stats for this agent
+        const allDrops = chatManager.getDropStats();
+        const agentDrops = allDrops[agent];
+        const focusSummary = getFocusSummary();
         return {
             agent, ts: Date.now(),
             active: slim(activeTask), next: pauseStatus.paused ? null : slim(nextTask),
             inbox: slimInbox, inboxCount: inbox.length,
             queue: { todo: todoTasks.length, doing: doingTasks.length, validating: validatingTasks.length },
             intensity: { preset: intensity.preset, pullsRemaining: pullBudget.remaining, wipLimit: intensity.limits.wipLimit },
+            ...(focusSummary ? { focus: focusSummary } : {}),
+            ...(agentDrops ? { drops: { total: agentDrops.total, rolling_1h: agentDrops.rolling_1h } } : {}),
             ...(pauseStatus.paused ? { paused: true, pauseMessage: pauseStatus.message, resumesAt: pauseStatus.entry?.pausedUntil ?? null } : {}),
             action: pauseStatus.paused ? `PAUSED: ${pauseStatus.message}`
                 : activeTask ? `Continue ${activeTask.id}`
@@ -8413,12 +8932,26 @@ export async function createServer() {
 3. If inbox has messages, respond to direct mentions.
 4. **Never report task status from memory alone** — always query the API first.
 
+## No-Task Idle Loop (recommended)
+If your heartbeat shows **no active task** and **no next task**:
+1. Post a brief status in team chat **once per hour max**: "[no task] checking board + signals".
+2. Check the board + top signals:
+   - \`curl -s "${baseUrl}/tasks?status=todo&limit=5&compact=true"\`
+   - \`curl -s "${baseUrl}/loop/summary?compact=true"\`
+3. If there’s a clear next task for your lane, claim it and start work. If a signal/insight is actionable, create/claim a task and start work.
+4. If the board + signals are empty, write up what you checked and propose a next step in a problems/ideas channel if your team has one (otherwise use \`#general\`).
+5. If you’re still idle after checking, propose the next highest-leverage work item with evidence — don’t wait for someone else to assign it.
+
 ## Comms Protocol (required)
-1. **Status updates belong in task comments first** (\`POST /tasks/:id/comments\`).
-2. **Shipped artifacts go to \`#shipping\`** and must include \`@reviewer\` + task ID + PR/artifact link.
-3. **Review requests go to \`#reviews\`** and must include \`@reviewer\` + task ID + exact ask.
-4. **Blockers go to \`#blockers\`** and must include \`@kai\` + task ID + concrete unblock needed.
-5. **\`#general\` is decisions/cross-team coordination only** (not routine heartbeat chatter).
+**Rule: task updates go to the task, not to chat.**
+- \`POST /tasks/:id/comments\` for all progress, blockers, and decisions on a task.
+- Chat channels are for coordination, not status reports. Do not post "working on task-xyz" or "done with task-xyz" to chat.
+
+1. **Task progress, blockers, decisions** → \`POST /tasks/:id/comments\` (always first)
+2. **Shipped artifacts** → post in shipping channel after the task comment, include \`@reviewer\` + task ID + PR/artifact link
+3. **Review requests** → post in reviews channel after the task comment, include \`@reviewer\` + task ID + exact ask
+4. **Blockers needing human action** → post in blockers channel after the task comment, include **who you need** + task ID + concrete unblock needed
+5. \`#general\` is for decisions and cross-team coordination only — not task status updates
 
 ## API Quick Reference
 - Heartbeat check: \`GET /heartbeat/${agent}\`
@@ -8517,15 +9050,30 @@ export async function createServer() {
                     { method: 'GET', path: '/reflections', hint: 'List. Query: author, limit' },
                 ],
             },
+            activity: {
+                description: 'Unified activity timeline',
+                endpoints: [
+                    { method: 'GET', path: '/activity', hint: 'Timeline feed. Query: range (24h|7d), type, agent, limit, after (cursor)' },
+                ],
+            },
             system: {
                 description: 'System health and discovery',
                 endpoints: [
                     { method: 'GET', path: '/health', hint: 'System health + version + stats' },
+                    { method: 'GET', path: '/pulse', compact: true, hint: 'Team pulse snapshot: deploy + board + per-agent doing + reviews. Query: compact' },
                     { method: 'GET', path: '/capabilities', hint: 'This endpoint. Query: category to filter' },
                     { method: 'GET', path: '/me/:agent', compact: true, hint: 'Full dashboard. Use /heartbeat/:agent for polls.' },
                     { method: 'GET', path: '/docs', hint: 'Full API reference (68K chars). Use /capabilities instead when possible.' },
                 ],
             },
+            hosts: {
+                description: 'Multi-host registry and cloud connection',
+                endpoints: [
+                    { method: 'GET', path: '/hosts', compact: true, hint: 'List registered hosts. Query: compact' },
+                    { method: 'GET', path: '/cloud/status', hint: 'Cloud connection state + health summary' },
+                    { method: 'GET', path: '/cloud/events', hint: 'Connection lifecycle event log. Query: limit' },
+                ],
+            },
             manage: {
                 description: 'Remote node management (auth-gated)',
                 endpoints: [
@@ -8962,21 +9510,71 @@ export async function createServer() {
             return { success: false, error: err.message };
         }
     });
+    // ── Team Pulse ─────────────────────────────────────────────────────
+    app.get('/pulse', async (request) => {
+        const compact = request.query.compact === 'true' || request.query.compact === '1';
+        if (compact) {
+            return generateCompactPulse();
+        }
+        return generatePulse();
+    });
+    // ── Scope Overlap Scanner ──────────────────────────────────────────
+    // POST /scope-overlap — trigger scope overlap scan after a PR merge
+    app.post('/scope-overlap', async (request) => {
+        const { prNumber, prTitle, prBranch, mergedTaskId, repo, mergeCommit, notify } = request.body || {};
+        if (!prNumber || !prTitle || !prBranch) {
+            return { success: false, error: 'Required: prNumber, prTitle, prBranch' };
+        }
+        if (notify !== false) {
+            const result = await scanAndNotify(prNumber, prTitle, prBranch, mergedTaskId, repo, mergeCommit);
+            return { success: true, ...result };
+        }
+        const result = scanScopeOverlap(prNumber, prTitle, prBranch, mergedTaskId, repo);
+        return { success: true, ...result };
+    });
+    // ── Team Focus ─────────────────────────────────────────────────────
+    // GET /focus — current team focus directive
+    app.get('/focus', async () => {
+        const focus = getFocus();
+        return focus ? { focus } : { focus: null, message: 'No focus set. Use POST /focus to set one.' };
+    });
+    // POST /focus — set team focus directive
+    app.post('/focus', async (request) => {
+        const { directive, setBy, expiresAt, tags } = request.body || {};
+        if (!directive || !setBy) {
+            return { success: false, error: 'Required: directive, setBy' };
+        }
+        const focus = setFocus(directive, setBy, { expiresAt, tags });
+        return { success: true, focus };
+    });
+    // DELETE /focus — clear team focus
+    app.delete('/focus', async () => {
+        clearFocus();
+        return { success: true, message: 'Focus cleared' };
+    });
     // Get all agent presences
     app.get('/presence', async () => {
         const explicitPresences = presenceManager.getAllPresence();
         const allActivity = presenceManager.getAllActivity();
-        // Build map of explicit presence by agent
-        const presenceMap = new Map(explicitPresences.map(p => [p.agent, p]));
-        // Add inferred presence for agents with only activity
+        // Filter to agents known to this node's TEAM-ROLES registry
+        const knownAgentNames = new Set(getAgentRoles().map(r => r.name.toLowerCase()));
+        // Build map of explicit presence by agent (filtered to registry)
+        const presenceMap = new Map(explicitPresences
+            .filter(p => knownAgentNames.size === 0 || knownAgentNames.has(p.agent.toLowerCase()))
+            .map(p => [p.agent, p]));
+        // Add inferred presence for agents with only activity (registry-gated)
         const now = Date.now();
         for (const activity of allActivity) {
-            if (!presenceMap.has(activity.agent) && activity.last_active) {
+            if (!presenceMap.has(activity.agent) && activity.last_active
+                && (knownAgentNames.size === 0 || knownAgentNames.has(activity.agent.toLowerCase()))) {
                 const inactiveMs = now - activity.last_active;
                 let status = 'offline';
-                if (inactiveMs < 10 * 60 * 1000) { // Active in last 10 minutes
+                if (inactiveMs < 15 * 60 * 1000) { // Active in last 15 minutes — match presence.ts IDLE_THRESHOLD_MS
                     status = activity.tasks_completed_today > 0 ? 'working' : 'idle';
                 }
+                else if (inactiveMs < 30 * 60 * 1000) { // 15-30 min — idle grace period before offline
+                    status = 'idle';
+                }
                 presenceMap.set(activity.agent, {
                     agent: activity.agent,
                     status,
@@ -9022,11 +9620,14 @@ export async function createServer() {
             if (activity && activity.last_active) {
                 const now = Date.now();
                 const inactiveMs = now - activity.last_active;
-                // Infer status based on recent activity
+                // Infer status based on recent activity — match presence.ts thresholds
                 let status = 'offline';
-                if (inactiveMs < 10 * 60 * 1000) { // Active in last 10 minutes
+                if (inactiveMs < 15 * 60 * 1000) { // Active in last 15 minutes
                     status = activity.tasks_completed_today > 0 ? 'working' : 'idle';
                 }
+                else if (inactiveMs < 30 * 60 * 1000) { // 15-30 min idle grace
+                    status = 'idle';
+                }
                 presence = {
                     agent: request.params.agent,
                     status,
@@ -9130,21 +9731,7 @@ export async function createServer() {
         }
     });
     // ============ ACTIVITY FEED ENDPOINT ============
-    // Get recent activity across all systems
-    app.get('/activity', async (request, reply) => {
-        const query = request.query;
-        const events = eventBus.getEvents({
-            agent: query.agent,
-            limit: boundedLimit(query.limit, DEFAULT_LIMITS.activity, MAX_LIMITS.activity),
-            since: parseEpochMs(query.since),
-        });
-        const payload = { events, count: events.length };
-        const lastModified = events.length > 0 ? Math.max(...events.map(e => e.timestamp || 0)) : undefined;
-        if (applyConditionalCaching(request, reply, payload, lastModified)) {
-            return;
-        }
-        return payload;
-    });
+    // Legacy activity endpoint replaced by unified /activity timeline (see above)
     // ============ SECRET VAULT ENDPOINTS ============
     // List secrets (metadata only — no plaintext)
     app.get('/secrets', async () => {
@@ -9347,15 +9934,17 @@ export async function createServer() {
      * GET /activation/funnel — per-user funnel state + aggregate summary.
      * Query params:
      *   ?userId=xxx — get single user's funnel state
-     *   (no params) — get aggregate summary across all users
+     *   ?raw=true   — include internal/infrastructure users (for debugging)
+     *   (no params) — get aggregate summary across all users (clean, external only)
      */
     app.get('/activation/funnel', async (request) => {
         const query = request.query;
         const userId = query.userId;
+        const raw = query.raw === 'true';
         if (userId) {
             return { funnel: getUserFunnelState(userId) };
         }
-        return { funnel: getFunnelSummary() };
+        return { funnel: getFunnelSummary({ raw }) };
     });
     /**
      * POST /activation/event — manually emit an activation event.
@@ -9392,14 +9981,17 @@ export async function createServer() {
     app.get('/activation/dashboard', async (request) => {
         const query = request.query;
         const weeks = query.weeks ? parseInt(query.weeks, 10) : 12;
-        return { success: true, dashboard: getOnboardingDashboard({ weeks }) };
+        const raw = query.raw === 'true';
+        return { success: true, dashboard: getOnboardingDashboard({ weeks, raw }) };
     });
     /**
      * GET /activation/funnel/conversions — Step-by-step conversion rates.
      * Returns per-step reach count, conversion rate, and median step time.
      */
-    app.get('/activation/funnel/conversions', async () => {
-        return { success: true, conversions: getConversionFunnel() };
+    app.get('/activation/funnel/conversions', async (request) => {
+        const query = request.query;
+        const raw = query.raw === 'true';
+        return { success: true, conversions: getConversionFunnel({ raw }) };
     });
     /**
      * GET /activation/funnel/failures — Failure-reason distribution per step.
@@ -9645,10 +10237,10 @@ export async function createServer() {
                 };
             }
             const publication = await contentManager.logPublication(body);
-            // Update presence: publishing content = working
+            // Touch presence: publishing content proves agent is alive
             if (body.publishedBy) {
                 presenceManager.recordActivity(body.publishedBy, 'message');
-                presenceManager.updatePresence(body.publishedBy, 'working');
+                presenceManager.touchPresence(body.publishedBy);
             }
             return { success: true, publication };
         }
@@ -9692,9 +10284,9 @@ export async function createServer() {
                 };
             }
             const item = await contentManager.upsertCalendarItem(body);
-            // Update presence when adding content to calendar
+            // Touch presence when adding content to calendar
             if (body.createdBy) {
-                presenceManager.updatePresence(body.createdBy, 'working');
+                presenceManager.touchPresence(body.createdBy);
             }
             return { success: true, item };
         }
@@ -9819,8 +10411,17 @@ export async function createServer() {
     });
     // ============ CLOUD INTEGRATION (see docs/CLOUD_ENDPOINTS.md) ============
     app.get('/cloud/status', async () => {
-        const { getCloudStatus } = await import('./cloud.js');
-        return getCloudStatus();
+        const { getCloudStatus, getConnectionHealth, getConnectionEvents } = await import('./cloud.js');
+        return {
+            ...getCloudStatus(),
+            connectionHealth: getConnectionHealth(),
+        };
+    });
+    app.get('/cloud/events', async (request) => {
+        const { getConnectionEvents } = await import('./cloud.js');
+        const url = new URL(request.url, 'http://localhost');
+        const limit = Math.min(Number(url.searchParams.get('limit')) || 50, 100);
+        return { events: getConnectionEvents(limit) };
     });
     app.post('/cloud/reload', async () => {
         const { stopCloudIntegration, startCloudIntegration, getCloudStatus } = await import('./cloud.js');
@@ -10417,6 +11018,22 @@ export async function createServer() {
     // Prune old mutation alert tracking every 30 minutes
     const pruneTimer = setInterval(pruneOldAttempts, 30 * 60 * 1000);
     pruneTimer.unref();
+    // GET /compliance/violations — state-read-before-assertion compliance violations
+    app.get('/compliance/violations', async (request, reply) => {
+        const query = request.query;
+        const agent = query.agent || undefined;
+        const severity = query.severity || undefined;
+        const limit = Math.min(parseInt(query.limit || '100', 10) || 100, 1000);
+        const since = query.since ? parseInt(query.since, 10) : undefined;
+        const violations = queryViolations({ agent, severity, limit, since });
+        const summary = getViolationSummary(since);
+        reply.send({
+            violations,
+            count: violations.length,
+            summary,
+            query: { agent: agent ?? null, severity: severity ?? null, limit, since: since ?? null },
+        });
+    });
     // GET /audit/reviews — review-field mutation audit ledger
     app.get('/audit/reviews', async (request, reply) => {
         const query = request.query;
@@ -10883,6 +11500,8 @@ export async function createServer() {
         const result = calendarEvents.getAgentNextEvent(query.agent);
         return { agent: query.agent, next_event: result?.event || null, starts_at: result?.starts_at || null };
     });
+    // Start hourly auto-snapshot for alert-preflight daily metrics
+    startAutoSnapshot();
     return app;
 }
 //# sourceMappingURL=server.js.map