sealkeep 0.9.0 → 0.11.0

package/dist/src/daemon.js

@@ -1,14 +1,21 @@
 import { freeBytes, resolveReserveBytes } from "./disk.js";
 import { ArchiveQueue } from "./queue.js";
-import { applyRetention, retentionSettings } from "./retention.js";
+import { applyRetention, readApprovals, reconcileCodexReclaims, retentionSettings } from "./retention.js";
 import { readConfig } from "./vault.js";
 import { drainQueue } from "./worker.js";
 import { uploadAndOffloadPending } from "./heartbeat.js";
-import { signerEnabled } from "./control-plane.js";
+import { acquireDaemonSignerGrant, signerEnabled } from "./control-plane.js";
 import { startTranscriptWatcher } from "./watcher.js";
-import { isVaultlineError } from "./errors.js";
+import { fail, isSealkeepError } from "./errors.js";
 import { writeHeartbeat } from "./heartbeat.js";
 import { notify, NotificationGate, summarize } from "./notify.js";
+import { startTeamRealtime } from "./team-realtime.js";
+import { automaticTranscriptIsEnabled, backgroundUploadBytesPerSecond, readLocalSettings, resolvedTrashStrategy } from "./machine-settings.js";
+import { hasDueAutomaticAgentContextRequest, recoverAutomaticAgentContextClaims, } from "./agent-context.js";
+import { reconcileTeamHistoryBackfill } from "./team-backfill.js";
+import { acquireDaemonWorkerLease } from "./daemon-lease.js";
+import { createProgressDeadline } from "./progress-deadline.js";
+import { recoverBackgroundBandwidthLockAtDaemonStartup } from "./background-bandwidth.js";
 // One definition, shared with the worker's per-job check in src/disk.ts. Two
 // copies of "how much room is there" is how the two came to disagree about
 // whether there was any.
@@ -20,123 +27,1093 @@ import { notify, NotificationGate, summarize } from "./notify.js";
  * exposed directly so behaviour can be tested without waiting on timers.
  */
 export async function startDaemon(dataDir, options) {
-    const queue = options.queue ?? new ArchiveQueue(dataDir);
-    const intervalMs = options.intervalMs ?? 30_000;
-    const now = options.now ?? Date.now;
-    const startedAt = new Date(now()).toISOString();
-    const totals = { archived: 0, uploaded: 0, reclaimed: 0, failed: 0 };
-    const gate = new NotificationGate();
-    const rescanEveryMs = options.rescanEveryMs ?? 60_000;
-    let lastScanAt = 0;
-    let paused = false;
-    let watcher;
-    if (options.watch !== false) {
-        watcher = await startTranscriptWatcher(dataDir, { home: options.home, queue });
-        await watcher.scan();
-        lastScanAt = now();
+    // The service manager is not a lock: an in-place upgrade or manager crash
+    // can orphan its child, then launch a replacement. Elect one complete vault
+    // worker before any heartbeat, watcher, queue, index, upload, retention or
+    // team lane starts. The lease remains owned until close has joined them all.
+    const workerLease = await acquireDaemonWorkerLease(dataDir, {
+        identityLookup: options.processIdentityLookup,
+    });
+    if (!workerLease) {
+        return fail("daemon_already_running", "Another Sealkeep worker already owns this vault");
     }
-    async function tick() {
-        const notes = [];
-        const free = await freeBytes(dataDir);
-        const result = { at: new Date(now()).toISOString(), paused, archived: 0, failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0, freeBytes: free, notes };
-        let freedBytes = 0;
-        if (paused) {
-            notes.push("daemon is paused; no work was done");
-            await beat(result);
-            options.onTick?.(result);
-            return result;
-        }
-        // File-system watchers drop events: FSEvents coalesces, inotify runs out of
-        // watches, and a watcher can die with its directory. Re-walking the roots on a
-        // slow cadence means a missed event costs latency, never a lost session. The
-        // walk is cheap because content-addressed ids make re-queuing a no-op.
-        if (watcher && now() - lastScanAt >= rescanEveryMs) {
-            const found = await watcher.scan().catch(() => 0);
-            lastScanAt = now();
-            if (found)
-                notes.push(`rescanned transcript roots (${found} seen)`);
+    // Upload permission belongs to this daemon lifetime, not to whether a target
+    // happened to exist when the process started. Destination configuration and
+    // machine-local credentials still gate every real write, so a service can
+    // safely wait for storage to be connected later without a restart.
+    const signerGrant = options.upload === false ? null : acquireDaemonSignerGrant();
+    try {
+        // A per-transfer contender is never allowed to steal a stale-looking fixed
+        // lock: that check-then-unlink race could remove a successor's live lock and
+        // open a second transfer lane. Only the elected daemon, before it starts any
+        // child/watcher/upload/reclaim work, may recover an exactly identified lock
+        // whose process generation is proved dead.
+        await recoverBackgroundBandwidthLockAtDaemonStartup(dataDir, workerLease, {
+            processIdentityLookup: options.processIdentityLookup,
+        });
+        // Only an installed/service-owned daemon follows this live authorization.
+        // A malformed or unreadable local setting resolves to the safe default, and
+        // a malformed/unreadable vault policy throws; both therefore fail closed.
+        const authorizeServiceReclaim = options.reclaimFromSettings
+            ? async (archiveId) => {
+                const local = await readLocalSettings(dataDir);
+                if (local.reclaimEnabled !== true)
+                    return false;
+                const policy = retentionSettings(await readConfig(dataDir)).policy;
+                if (policy === "archive-and-reclaim")
+                    return true;
+                if (policy === "manual-approval")
+                    return (await readApprovals(dataDir)).includes(archiveId);
+                return false;
+            }
+            : undefined;
+        // Complete or roll back any crash-interrupted native pointer transaction
+        // before a watcher can observe it or another retention pass can begin. A
+        // service restart does not preserve old deletion authority: reconciliation
+        // uses the same current setting/policy gate as a new pass.
+        const startupConfig = await readConfig(dataDir);
+        await reconcileCodexReclaims(dataDir, startupConfig.storage.root, options.home, undefined, undefined, undefined, undefined, undefined, undefined, authorizeServiceReclaim);
+        const queue = options.queue ?? new ArchiveQueue(dataDir);
+        const intervalMs = options.intervalMs ?? 30_000;
+        const now = options.now ?? Date.now;
+        const startedAt = new Date(now()).toISOString();
+        const totals = { archived: 0, indexed: 0, uploaded: 0, reclaimed: 0, failed: 0 };
+        const gate = new NotificationGate();
+        const rescanEveryMs = options.rescanEveryMs ?? 60_000;
+        let lastScanAt = 0;
+        let paused = false;
+        let watcher;
+        let watcherStartup;
+        let startupScan;
+        let teamRealtime;
+        let teamRealtimeStartup;
+        let serviceReconciliation;
+        let indexMigration;
+        let historicalIndexTask;
+        let indexCatchupNeeded = false;
+        let indexPublicationNeeded = false;
+        let indexRetryTimer;
+        let indexFailures = 0;
+        let indexingState = { state: "idle", attempts: 0 };
+        let closing = false;
+        let closed = false;
+        const workCancellation = new AbortController();
+        const closeGraceMs = Math.max(1, options.closeGraceMs ?? 5_000);
+        let retentionGate = false;
+        let uploadInFlight = null;
+        let uploadTimer;
+        let accessTimer;
+        let backfillTimer;
+        let storageHealthTimer;
+        let storageHealthInFlight = null;
+        let contextTimer;
+        let contextInFlight = null;
+        let contextDrainTask;
+        let accessInFlight = null;
+        let accessState = { state: "idle", failures: 0 };
+        let contextState = { state: "idle", failures: 0 };
+        let backfillInFlight = null;
+        let backfillState = {
+            state: "idle", total: 0, indexed: 0, registered: 0, pending: 0, failed: 0, blocked: 0,
+        };
+        const pendingAccessNotes = [];
+        let tickInFlight = null;
+        let backlogTimer;
+        let closeInFlight = null;
+        // A foreground daemon follows its explicit flag for its whole lifetime. The
+        // installed service follows the machine setting so toggling Autopilot in the
+        // local UI takes effect on the next pass, without recycling the service.
+        let reclaimActive = options.reclaimFromSettings
+            ? (await readLocalSettings(dataDir)).reclaimEnabled === true
+            : options.reclaim === true;
+        // Startup indexing, the liveness pulse, uploads and the preservation pass can
+        // all report at once. Keep their atomic file replacements in invocation
+        // order so an older in-flight write cannot land after a newer paused/status
+        // update and make the dashboard move backwards.
+        let heartbeatWrite = Promise.resolve();
+        let lastHeartbeatAtMs = Date.parse(startedAt);
+        const loadIndexing = async () => options.indexing ?? await import("./search.js");
+        const indexRetryBaseMs = Math.max(10, options.indexRetryBaseMs ?? 30_000);
+        const indexRetryMaxMs = Math.max(indexRetryBaseMs, options.indexRetryMaxMs ?? 30 * 60_000);
+        const buildHistoricalIndex = async (buildInProcess) => {
+            // Dependency-injected indexing remains in-process so deterministic tests
+            // can control it. The real historical rebuild gets its own low-priority
+            // process: much of indexing is synchronous CPU work, despite returning a
+            // Promise, and would otherwise stop this daemon's heartbeat and tick lanes.
+            if (options.indexing)
+                return buildInProcess(dataDir, options.phrase, { sync: true, signal: workCancellation.signal });
+            if (closing)
+                throw new Error("daemon is closing");
+            const startBackgroundIndexBuild = options.startIndexBuild
+                ?? (await import("./index-background.js")).startBackgroundIndexBuild;
+            if (closing)
+                throw new Error("daemon is closing");
+            const task = startBackgroundIndexBuild(dataDir, options.phrase, {
+                sync: true,
+                idleMs: options.indexIdleMs,
+                stopGraceMs: closeGraceMs,
+                lanes: 1,
+                cpuTarget: 0.30,
+                signerAuthorized: signerGrant !== null,
+                onWorkerExit: async (worker) => {
+                    // An unexpected child death can strand its reservation while this
+                    // daemon remains alive. Unrelated live lane ownership is never touched.
+                    await recoverBackgroundBandwidthLockAtDaemonStartup(dataDir, workerLease, { expectedOwner: worker });
+                },
+            });
+            historicalIndexTask = task;
+            try {
+                return await task.result;
+            }
+            finally {
+                try {
+                    await task.stop();
+                }
+                finally {
+                    if (historicalIndexTask === task)
+                        historicalIndexTask = undefined;
+                }
+            }
+        };
+        const indexErrorCode = (error) => {
+            if (isSealkeepError(error))
+                return error.code;
+            const code = error?.code;
+            if (typeof code === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(code))
+                return code;
+            const name = error instanceof Error ? error.name : "unexpected_error";
+            return /^[A-Za-z0-9_-]{1,64}$/.test(name) ? name : "unexpected_error";
+        };
+        let startIndexMigration;
+        const scheduleIndexRetry = (error) => {
+            if (closing || indexRetryTimer)
+                return;
+            indexFailures += 1;
+            const delay = Math.min(indexRetryMaxMs, indexRetryBaseMs * 2 ** Math.min(indexFailures - 1, 10));
+            const nextAttemptAt = new Date(now() + delay).toISOString();
+            indexingState = { state: "retry-wait", attempts: indexFailures, nextAttemptAt, lastError: indexErrorCode(error) };
+            indexRetryTimer = setTimeout(() => {
+                indexRetryTimer = undefined;
+                startIndexMigration();
+            }, delay);
+            indexRetryTimer.unref?.();
+            void beat({
+                at: new Date(now()).toISOString(), paused, archived: 0, indexed: 0,
+                failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                notes: [`search indexing is waiting to retry (${indexingState.lastError})`]
+            });
+        };
+        const runIndexMigration = async () => {
+            indexingState = { state: "building", attempts: indexFailures + 1, startedAt: new Date(now()).toISOString() };
+            await beat({
+                at: new Date(now()).toISOString(), paused, archived: 0, indexed: 0,
+                failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                notes: ["search index catch-up is running in the background"]
+            });
+            try {
+                const { buildContentIndex, contentIndexNeedsPolicyUpgrade } = await loadIndexing();
+                // Always the real module, never the injected DaemonIndexing seam: a
+                // segments-mode publish is not part of that test contract, and a vault
+                // driven through it is never in segments mode, so the real
+                // segmentsEnabled check inside publishPending answers false for it.
+                const { publishPending } = await import("./index-publish.js");
+                const needsWork = indexCatchupNeeded || await contentIndexNeedsPolicyUpgrade(dataDir) || await publishPending(dataDir);
+                if (closing)
+                    return;
+                if (!needsWork) {
+                    indexFailures = 0;
+                    indexingState = { state: "idle", attempts: 0 };
+                    await beat({
+                        at: new Date(now()).toISOString(), paused, archived: 0, indexed: 0,
+                        failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                        notes: ["search index is current"]
+                    });
+                    return;
+                }
+                do {
+                    indexCatchupNeeded = false;
+                    const built = await buildHistoricalIndex(buildContentIndex);
+                    totals.indexed += built.indexedNow;
+                } while (!closing && indexCatchupNeeded);
+                if (closing)
+                    return;
+                // A resolved build may still have skipped inaccessible archives. Recheck
+                // the durable coverage marker; incomplete derived state cools down and
+                // retries just like a child crash instead of looking successfully done.
+                const coverageIncomplete = await contentIndexNeedsPolicyUpgrade(dataDir);
+                if (closing)
+                    return;
+                if (coverageIncomplete) {
+                    const incomplete = new Error("search index coverage remains incomplete");
+                    incomplete.name = "index_incomplete";
+                    throw incomplete;
+                }
+                indexFailures = 0;
+                indexingState = { state: "idle", attempts: 0 };
+                await beat({
+                    at: new Date(now()).toISOString(), paused, archived: 0, indexed: 0,
+                    failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                    notes: ["search index catch-up completed"]
+                });
+            }
+            catch (error) {
+                if (!closing)
+                    scheduleIndexRetry(error);
+            }
+        };
+        startIndexMigration = () => {
+            if (closing || indexMigration)
+                return;
+            const migration = runIndexMigration();
+            indexMigration = migration;
+            void migration.finally(() => {
+                if (indexMigration !== migration)
+                    return;
+                indexMigration = undefined;
+                // A seal can finish while the migration is awaiting its final durable
+                // coverage check. It then observes the existing writer and only raises
+                // this flag. Re-arm after releasing the single-writer slot so that exact
+                // edge cannot strand a searchable-copy request until another event or
+                // process restart.
+                if (!closing && indexCatchupNeeded && !indexRetryTimer)
+                    startIndexMigration();
+            });
+        };
+        const indexBacklogActive = () => Boolean(indexMigration || indexRetryTimer || indexingState.state !== "idle");
+        // Team access is a small control-plane lane, not preservation work. Running
+        // it independently keeps a cloud Project/Invite click from waiting for the
+        // next 30-second archive pass (or for a multi-GB seal already in flight),
+        // while single-flight keeps rapid timer ticks from duplicating key work.
+        const requestAccessReconciliation = () => {
+            if (closing || accessInFlight)
+                return;
+            accessState = { ...accessState, state: "working", lastAttemptAt: new Date(now()).toISOString() };
+            // Own both the work and its completion handler. Timer subscribers must
+            // not each duplicate the same success note or swallow its failure.
+            const task = Promise.resolve().then(async () => {
+                const reconcile = options.teamAccess ?? (await import("./team-presence.js")).reconcileCloudTeamAccess;
+                return reconcile(dataDir, options.phrase);
+            }).then((access) => {
+                if (access.created)
+                    pendingAccessNotes.push(`prepared ${access.created} cloud project memory pool${access.created === 1 ? "" : "s"}`);
+                if (access.prepared)
+                    pendingAccessNotes.push(`prepared ${access.prepared} encrypted team invitation${access.prepared === 1 ? "" : "s"}`);
+                if (access.bound)
+                    pendingAccessNotes.push(`connected ${access.bound} shared project${access.bound === 1 ? "" : "s"}`);
+                if (access.removed)
+                    pendingAccessNotes.push(`completed ${access.removed} team access removal${access.removed === 1 ? "" : "s"}`);
+                if (access.failures?.length) {
+                    accessState = { ...accessState, state: "attention", failures: access.failures.length, lastError: access.failures[0].code };
+                }
+                else {
+                    accessState = { state: "idle", failures: 0, lastAttemptAt: accessState.lastAttemptAt, lastSuccessAt: new Date(now()).toISOString() };
+                }
+            }).catch((error) => {
+                accessState = { ...accessState, state: "attention", failures: accessState.failures + 1, lastError: indexErrorCode(error) };
+            }).then(async () => {
+                if (!closing)
+                    await beat({
+                        at: new Date(now()).toISOString(), paused,
+                        archived: 0, indexed: 0, failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                        notes: [heartbeatPhase, ...(accessState.state === "attention" ? [`team access is waiting to retry (${accessState.lastError})`] : [])],
+                    });
+            });
+            accessInFlight = task;
+            void task.finally(() => { if (accessInFlight === task)
+                accessInFlight = null; }).catch(() => undefined);
+        };
+        // Connecting a hosted project applies to the history already sealed for its
+        // local folders, not only to tomorrow's sessions. This lane owns one durable
+        // job at a time and never sits on the preservation, hook-context, or UI
+        // request path. Each archive is uploaded and verified before its team grant
+        // and search alias are allowed to appear.
+        const requestTeamBackfill = () => {
+            if (closing || paused)
+                return null;
+            if (backfillInFlight)
+                return backfillInFlight;
+            backfillState = { ...backfillState, state: "working" };
+            const task = (options.teamBackfill ?? reconcileTeamHistoryBackfill)(dataDir, options.phrase, {
+                limit: Math.max(1, Math.min(8, Math.trunc(options.teamBackfillBatchSize ?? 4))),
+                maxBatchMs: Math.max(100, options.teamBackfillBatchMs ?? 5_000),
+                signal: workCancellation.signal,
+                idleMs: Math.max(100, options.teamBackfillIdleMs ?? 2 * 60_000),
+            }).then(async (outcome) => {
+                backfillState = {
+                    state: outcome.state,
+                    total: outcome.total,
+                    indexed: outcome.indexed,
+                    registered: outcome.registered,
+                    pending: outcome.pending,
+                    failed: outcome.failed,
+                    blocked: outcome.blocked,
+                    ...((Object.values(outcome.spaces).find((space) => space.lastError)?.lastError)
+                        ? { lastError: Object.values(outcome.spaces).find((space) => space.lastError).lastError }
+                        : {}),
+                };
+                if (outcome.registeredNow > 0) {
+                    indexPublicationNeeded = true;
+                    indexCatchupNeeded = true;
+                    startIndexMigration();
+                }
+                if (outcome.processed || outcome.scheduled || outcome.failed || outcome.blocked) {
+                    const note = outcome.registeredNow
+                        ? `prepared ${outcome.registeredNow} verified shared session${outcome.registeredNow === 1 ? "" : "s"}; search publication is catching up`
+                        : outcome.state === "attention"
+                            ? `earlier project history needs attention (${outcome.failed} retrying, ${outcome.blocked} blocked)`
+                            : outcome.pending
+                                ? `sharing earlier project history in the background (${outcome.indexed} of ${outcome.total} searchable)`
+                                : "earlier project history is shared";
+                    await beat({
+                        at: new Date(now()).toISOString(), paused,
+                        archived: 0, indexed: 0, failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                        notes: [note],
+                    });
+                }
+                return outcome;
+            }).catch(async (error) => {
+                backfillState = { ...backfillState, state: "attention", failed: Math.max(1, backfillState.failed), lastError: indexErrorCode(error) };
+                await beat({
+                    at: new Date(now()).toISOString(), paused,
+                    archived: 0, indexed: 0, failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0,
+                    notes: [`earlier project history is waiting to retry (${backfillState.lastError})`],
+                });
+                throw error;
+            });
+            backfillInFlight = task;
+            void task.then(() => { if (backfillInFlight === task)
+                backfillInFlight = null; }, () => { if (backfillInFlight === task)
+                backfillInFlight = null; });
+            return task;
+        };
+        // Discovery itself can take noticeable time on a machine with hundreds of
+        // gigabytes of agent sessions. Publish liveness before scanning or sealing,
+        // otherwise Settings says archiving is off while the service is already
+        // walking the agent folders.
+        await beat({
+            at: startedAt,
+            paused: false,
+            archived: 0,
+            indexed: 0,
+            failed: 0,
+            uploaded: 0,
+            uploadErrors: 0,
+            reclaimed: 0,
+            notes: ["starting first preservation pass"]
+        });
+        // Keep that promise fresh while startup discovers a very large history.
+        // On a machine with hundreds of gigabytes of sessions, the first scan can
+        // legitimately outlast the normal 90-second liveness window. Silence during
+        // useful work must not turn the dashboard from "running" to "late".
+        let heartbeatPhase = "discovering preserved agent sessions";
+        const livenessPulse = setInterval(() => {
+            void beat({
+                at: new Date(now()).toISOString(), paused: false,
+                archived: 0, indexed: 0, failed: 0, uploaded: 0,
+                uploadErrors: 0, reclaimed: 0,
+                notes: [heartbeatPhase]
+            });
+        }, Math.min(intervalMs, 30_000));
+        livenessPulse.unref?.();
+        // Hook processes only persist small encrypted requests. Search, hosted
+        // reconciliation and presence work belongs to this independent daemon lane.
+        // Default work runs one request per owned child: its wall-clock deadline can
+        // terminate a wedged fetch/parser, rather than merely abandoning a Promise
+        // that keeps the state lock and silently multiplies on every timer tick.
+        // Hosted cooperation measured around five seconds at p95. Eight seconds is
+        // the STALL limit, not the total runtime: a safely throttled 71 MB index can
+        // take longer while continuing to report real parsed/downloaded bytes.
+        // A recall pass on a large vault is a 15–20 s cold scan whose progress
+        // reports can be 4–6 s apart under ordinary load; at 8 s the deadline was
+        // killing healthy passes at the finish line. The absolute ceiling below is
+        // what bounds a pass; this only has to tell a stuck child from a slow one.
+        const contextAttemptTimeoutMs = Math.max(100, options.contextAttemptTimeoutMs ?? 20_000);
+        const contextAbsoluteTimeoutMs = Math.max(contextAttemptTimeoutMs, options.contextAbsoluteTimeoutMs ?? 2 * 60_000);
+        const contextRetryMs = Math.max(0, options.contextRetryMs ?? 30_000);
+        const runOwnedContextPass = async () => {
+            if (!await hasDueAutomaticAgentContextRequest(dataDir)) {
+                return { processed: 0, failed: 0, discarded: 0, pending: 0 };
+            }
+            if (options.contextRequests) {
+                // Tests and embedded callers can supply bounded in-process work. The
+                // installed daemon always uses the cancellable child below.
+                return options.contextRequests(dataDir, options.phrase, { limit: 1 });
+            }
+            const starter = options.startContextDrain
+                ?? (await import("./context-background.js")).startBackgroundContextDrain;
+            if (closing)
+                return { processed: 0, failed: 0, discarded: 0, pending: 0 };
+            const owned = starter(dataDir, options.phrase, { limit: 1 });
+            contextDrainTask = owned;
+            let deadline;
+            let absoluteDeadline;
+            let removeProgressListener;
+            const settled = owned.result.then((result) => ({ kind: "result", result }), (error) => ({ kind: "error", error }));
+            try {
+                const timedOut = new Promise((resolve) => {
+                    const armStallDeadline = () => {
+                        if (deadline)
+                            clearTimeout(deadline);
+                        deadline = setTimeout(() => resolve({ kind: "timeout", reason: "stalled" }), contextAttemptTimeoutMs);
+                    };
+                    armStallDeadline();
+                    removeProgressListener = owned.onProgress?.(armStallDeadline);
+                    absoluteDeadline = setTimeout(() => resolve({ kind: "timeout", reason: "absolute" }), contextAbsoluteTimeoutMs);
+                });
+                const outcome = await Promise.race([
+                    settled,
+                    timedOut,
+                ]);
+                if (outcome.kind === "result")
+                    return outcome.result;
+                if (outcome.kind === "error") {
+                    await owned.stop();
+                    if (owned.pid !== undefined) {
+                        await recoverAutomaticAgentContextClaims(dataDir, owned.pid, {
+                            retryAt: Date.now() + contextRetryMs,
+                        });
+                    }
+                    throw outcome.error;
+                }
+                // The deadline already spent the graceful budget. Kill this exact owned
+                // child immediately rather than adding another parent-loop timer before
+                // its encrypted claim can be recovered.
+                await owned.forceStop();
+                if (owned.pid !== undefined) {
+                    await recoverAutomaticAgentContextClaims(dataDir, owned.pid, {
+                        retryAt: Date.now() + contextRetryMs,
+                    });
+                }
+                throw new Error(outcome.reason === "stalled"
+                    ? `Automatic context attempt made no progress for ${contextAttemptTimeoutMs} ms`
+                    : `Automatic context attempt exceeded its ${contextAbsoluteTimeoutMs} ms absolute ceiling`);
+            }
+            finally {
+                if (deadline)
+                    clearTimeout(deadline);
+                if (absoluteDeadline)
+                    clearTimeout(absoluteDeadline);
+                removeProgressListener?.();
+                if (contextDrainTask === owned)
+                    contextDrainTask = undefined;
+            }
+        };
+        const requestContextPass = () => {
+            if (closing)
+                return null;
+            if (contextInFlight)
+                return contextInFlight;
+            const task = Promise.resolve().then(runOwnedContextPass);
+            contextInFlight = task;
+            // Hooks fail open, so a recall lane that keeps dying looks exactly like
+            // one with nothing to do. The heartbeat is where that difference lives.
+            const stableReason = (error) => {
+                const message = error instanceof Error ? error.message : String(error);
+                if (/made no progress/.test(message))
+                    return "stalled";
+                if (/absolute ceiling/.test(message))
+                    return "absolute";
+                const code = error?.code;
+                return typeof code === "string" ? code : error instanceof Error ? error.name : "error";
+            };
+            void task.then((result) => {
+                if (contextInFlight === task)
+                    contextInFlight = null;
+                if (result.processed === 0 && result.failed === 0)
+                    return;
+                const at = new Date(now()).toISOString();
+                contextState = result.processed > 0
+                    ? { state: "idle", failures: 0, lastAttemptAt: at, lastSuccessAt: at }
+                    : { ...contextState, state: "attention", failures: contextState.failures + 1, lastAttemptAt: at, lastError: "prepare-failed" };
+            }, (error) => {
+                if (contextInFlight === task)
+                    contextInFlight = null;
+                contextState = { ...contextState, state: "attention", failures: contextState.failures + 1, lastAttemptAt: new Date(now()).toISOString(), lastError: stableReason(error) };
+            });
+            return task;
+        };
+        void requestContextPass()?.catch(() => undefined);
+        const contextEveryMs = Math.max(25, options.contextEveryMs ?? 1_000);
+        contextTimer = setInterval(() => { void requestContextPass()?.catch(() => undefined); }, contextEveryMs);
+        contextTimer.unref?.();
+        /**
+         * Uploads are an independent durability lane. A 663 MB seal can legitimately
+         * run for minutes; making the cloud backlog wait behind it wastes both time
+         * and the disk headroom verified offload could recover. One bounded pass may
+         * run at a time, and retention closes this gate before evaluating sources.
+         */
+        const requestUploadPass = () => {
+            if (closing || paused || retentionGate || options.upload === false || !signerEnabled())
+                return null;
+            if (uploadInFlight)
+                return uploadInFlight;
+            const deadline = createProgressDeadline({
+                operation: "Automatic archive upload",
+                idleMs: Math.max(100, options.uploadIdleMs ?? options.sealIdleMs ?? 2 * 60_000),
+                signal: workCancellation.signal,
+            });
+            const pass = Promise.resolve().then(() => (options.uploadPending ?? uploadAndOffloadPending)(dataDir, {
+                maxArchives: 8,
+                signal: deadline.signal,
+                onProgress: () => deadline.progress(),
+            }));
+            const bounded = (async () => {
+                try {
+                    return await deadline.wait(pass);
+                }
+                finally {
+                    deadline.close();
+                }
+            })();
+            const task = bounded.then(async (outcome) => {
+                totals.uploaded += outcome.uploaded.length;
+                if (outcome.teamRegistered > 0 || outcome.uploaded.some((item) => item.provider === "vaultline")) {
+                    indexPublicationNeeded = true;
+                    if (indexBacklogActive())
+                        indexCatchupNeeded = true;
+                }
+                await beat({
+                    at: new Date(now()).toISOString(), paused: false,
+                    archived: 0, indexed: 0, failed: 0,
+                    uploaded: outcome.uploaded.length, uploadErrors: outcome.failed.length,
+                    reclaimed: 0,
+                    notes: [outcome.uploaded.length
+                            ? `uploaded ${outcome.uploaded.length} encrypted archive${outcome.uploaded.length === 1 ? "" : "s"} while preservation continued`
+                            : heartbeatPhase],
+                });
+                return outcome;
+            });
+            uploadInFlight = task;
+            void task.then(() => { if (uploadInFlight === task)
+                uploadInFlight = null; }, () => { if (uploadInFlight === task)
+                uploadInFlight = null; });
+            return task;
+        };
+        const uploadEveryMs = Math.max(25, options.uploadEveryMs ?? Math.min(intervalMs, 30_000));
+        uploadTimer = setInterval(() => { void requestUploadPass()?.catch(() => undefined); }, uploadEveryMs);
+        uploadTimer.unref?.();
+        // Package upgrades must not leave an older archive-only hook behind until a
+        // person happens to revisit setup. Reconcile only files that already contain
+        // a Sealkeep hook (prior consent); a daemon on a never-hooked machine edits
+        // nothing. Failure is advisory and cannot stop preservation.
+        try {
+            const { upgradeOwnedAgentHooks } = await import("./adapters.js");
+            await upgradeOwnedAgentHooks({ dataDir, home: options.home });
         }
-        // This used to read `options.diskPressureFreeBytes` with no default, and
-        // nothing anywhere set it — so the guard was dead code and the installed
-        // service ran with no floor at all, on machines chosen for being short of
-        // space. It now defaults, and `drainQueue` additionally refuses any single
-        // job it has no room to finish, because one floor cannot know that the next
-        // transcript is 4 GB.
-        // One knob where there could be two: an operator who set a reserve meant it
-        // for both checks, and a tick-level floor that ignored it would refuse
-        // everything while the per-job check was happy to proceed.
-        const floor = options.diskPressureFreeBytes ?? options.reserveBytes ?? await resolveReserveBytes(dataDir);
-        if (free !== undefined && free < floor) {
-            notes.push(`disk is low (${(free / 1024 ** 3).toFixed(1)} GB free, holding ${(floor / 1024 ** 3).toFixed(1)} GB back); reclaiming instead of archiving`);
+        catch { /* setup/doctor explains an unreadable hook file */ }
+        const reconcileService = import("./service.js").then(async ({ daemonInvocation, reconcileInstalledService, serviceUnitEnvironment }) => {
+            if (closing)
+                return;
+            const invocation = daemonInvocation(dataDir, {
+                reclaim: reclaimActive,
+                upload: options.upload,
+                intervalSeconds: intervalMs / 1000,
+            });
+            await reconcileInstalledService({
+                dataDir, home: options.home, executable: invocation.executable, args: invocation.args,
+                environment: serviceUnitEnvironment({}, process.env, { uploads: options.upload !== false }),
+            });
+        }).catch(() => undefined); // a later login retries; preservation itself still starts
+        serviceReconciliation = reconcileService;
+        void reconcileService.then(() => { if (serviceReconciliation === reconcileService)
+            serviceReconciliation = undefined; });
+        // The live team lane is package-owned infrastructure, like the transcript
+        // watcher: it starts automatically, discovers newly bound spaces while the
+        // daemon stays up, and fails open to the durable REST catch-up path.
+        const realtimeStartup = startTeamRealtime(dataDir).then(async (listener) => {
+            if (closing)
+                await listener.close();
+            else
+                teamRealtime = listener;
+        }).catch(() => undefined);
+        teamRealtimeStartup = realtimeStartup;
+        void realtimeStartup.then(() => { if (teamRealtimeStartup === realtimeStartup)
+            teamRealtimeStartup = undefined; });
+        accessTimer = setInterval(requestAccessReconciliation, Math.max(25, options.teamAccessEveryMs ?? 3_000));
+        accessTimer.unref?.();
+        // Destination rules are shared by the account, while provider credentials
+        // stay on each machine. Report only reachability (never credentials) on an
+        // independent advisory lane so a disconnected Drive is visible in the
+        // account panel before the next archive tries and fails to upload.
+        const reportStorageHealth = async () => {
+            if (storageHealthInFlight)
+                return storageHealthInFlight;
+            const task = import("./storage-targets.js").then(({ pushTargetUsage }) => pushTargetUsage(dataDir));
+            storageHealthInFlight = task;
+            try {
+                await task;
+            }
+            finally {
+                if (storageHealthInFlight === task)
+                    storageHealthInFlight = null;
+            }
+        };
+        void reportStorageHealth().catch(() => undefined);
+        storageHealthTimer = setInterval(() => { void reportStorageHealth().catch(() => undefined); }, 60_000);
+        storageHealthTimer.unref?.();
+        if (options.watch !== false) {
+            const setupWatcher = (async () => {
+                const active = await (options.startWatcher ?? startTranscriptWatcher)(dataDir, { home: options.home, queue });
+                if (closing) {
+                    await active.close();
+                    return;
+                }
+                watcher = active;
+                lastScanAt = now();
+                const scan = active.scan();
+                startupScan = scan;
+                // Discovery is its own lane. A mature vault can take minutes to walk, but
+                // jobs already in the durable queue must not sit idle behind that walk.
+                // When discovery finishes, ask for a follow-up pass so sessions found on a
+                // fresh machine do not wait for the normal five-minute cadence.
+                void scan.then(() => {
+                    if (startupScan === scan)
+                        startupScan = undefined;
+                    lastScanAt = now();
+                    if (closing)
+                        return;
+                    const current = tickInFlight;
+                    if (current)
+                        void current.finally(() => { if (!closing)
+                            void tick().catch(() => undefined); });
+                    else
+                        void tick().catch(() => undefined);
+                }, () => {
+                    if (startupScan === scan)
+                        startupScan = undefined;
+                    lastScanAt = now();
+                });
+            })().catch(() => undefined);
+            watcherStartup = setupWatcher;
+            void setupWatcher.finally(() => { if (watcherStartup === setupWatcher)
+                watcherStartup = undefined; });
         }
-        else {
-            const processed = await drainQueue(dataDir, options.phrase, { queue, reserveBytes: options.reserveBytes });
+        // Retrieval provenance changed: older indexes may contain SealKeep's own
+        // recalled context as if it were newly learned. The unsealed coverage marker
+        // makes this a cheap one-time check; the rebuild is checkpointed and runs in
+        // the background so startup and preservation are never held hostage by it.
+        // Claim the single-writer slot before even checking coverage. Otherwise a
+        // fast first seal can start an incremental writer during that check and race
+        // the historical migration it is about to request.
+        startIndexMigration();
+        void requestTeamBackfill()?.catch(() => undefined);
+        const teamBackfillEveryMs = Math.max(250, options.teamBackfillEveryMs ?? 3_000);
+        backfillTimer = setInterval(() => { void requestTeamBackfill()?.catch(() => undefined); }, teamBackfillEveryMs);
+        backfillTimer.unref?.();
+        async function runTick() {
+            if (options.reclaimFromSettings) {
+                reclaimActive = (await readLocalSettings(dataDir)).reclaimEnabled === true;
+            }
+            heartbeatPhase = "preserving and indexing agent sessions";
+            const notes = [];
+            notes.push(...pendingAccessNotes.splice(0, pendingAccessNotes.length));
+            const free = await freeBytes(dataDir);
+            const result = { at: new Date(now()).toISOString(), paused, archived: 0, indexed: 0, failed: 0, uploaded: 0, uploadErrors: 0, reclaimed: 0, freeBytes: free, notes };
+            let freedBytes = 0;
+            const activeSeals = [];
+            if (paused) {
+                notes.push("daemon is paused; no work was done");
+                await beat(result);
+                options.onTick?.(result);
+                return result;
+            }
+            // Start cloud durability before discovery/access/sealing. The promise is
+            // joined later for reporting, but the work itself progresses beside a long
+            // seal instead of sitting behind it.
+            const uploadAlongsidePreservation = requestUploadPass();
+            // File-system watchers drop events: FSEvents coalesces, inotify runs out of
+            // watches, and a watcher can die with its directory. Re-walking the roots on a
+            // slow cadence means a missed event costs latency, never a lost session. The
+            // walk is cheap because content-addressed ids make re-queuing a no-op.
+            // On a brand-new/empty queue, wait for the first discovery because it is
+            // the only source of work. With an existing backlog, do the durable work
+            // now while startup discovery continues independently.
+            let hasQueuedWork = await queue.hasClaimable();
+            if (!hasQueuedWork && watcherStartup) {
+                await watcherStartup;
+                hasQueuedWork = await queue.hasClaimable();
+            }
+            if (!hasQueuedWork && startupScan) {
+                const found = await startupScan.catch(() => 0);
+                if (found)
+                    notes.push(`discovered transcript roots (${found} seen)`);
+            }
+            if (watcher && !startupScan && now() - lastScanAt >= rescanEveryMs) {
+                const found = await watcher.scan().catch(() => 0);
+                lastScanAt = now();
+                if (found)
+                    notes.push(`rescanned transcript roots (${found} seen)`);
+            }
+            // Human access decisions live in SealKeep Cloud; private-key work stays on
+            // this machine. Polling here closes both loops automatically: owners wrap
+            // new invitations and accepted teammates/fresh machines bind the project.
+            requestAccessReconciliation();
+            // This used to read `options.diskPressureFreeBytes` with no default, and
+            // nothing anywhere set it — so the guard was dead code and the installed
+            // service ran with no floor at all, on machines chosen for being short of
+            // space. It now defaults, and `drainQueue` additionally refuses any single
+            // job it has no room to finish, because one floor cannot know that the next
+            // transcript is 4 GB.
+            // One knob where there could be two: an operator who set a reserve meant it
+            // for both checks, and a tick-level floor that ignored it would refuse
+            // everything while the per-job check was happy to proceed.
+            const floor = options.diskPressureFreeBytes ?? options.reserveBytes ?? await resolveReserveBytes(dataDir);
+            const underPressure = free !== undefined && free < floor;
+            if (underPressure) {
+                notes.push(`disk is low (${(free / 1024 ** 3).toFixed(1)} GB free, holding ${(floor / 1024 ** 3).toFixed(1)} GB back); new sessions stream to connected cloud storage when possible`);
+            }
+            // Fairness is part of autopilot: a growing multi-GB transcript must not
+            // keep an existing cloud backlog behind as many as 25 seals. Finish one
+            // durable unit, index it, then let cloud sync make progress before the next
+            // timer claims more preservation work.
+            //
+            // Crucially, low disk does not bypass the worker. The worker owns the
+            // bounded stream-directly-to-cloud pressure valve; skipping it here left
+            // ready jobs at zero attempts forever on the exact machines that needed
+            // that path. Passing the pressure floor into its per-job guard makes it
+            // stream when a target supports chunks, or release the job unchanged when
+            // offline/Drive-only, without spending the protected headroom.
+            const processed = await (options.drain ?? drainQueue)(dataDir, options.phrase, {
+                queue,
+                signal: workCancellation.signal,
+                sealIdleMs: options.sealIdleMs,
+                reserveBytes: underPressure ? floor : options.reserveBytes,
+                max: 1,
+                backgroundCpuTarget: 0.30,
+                // The daemon owns index serialization. In particular, while a
+                // historical migration is writing, the worker must not sneak a real
+                // foreground build around the migration guard merely because this is
+                // an active project.
+                announce: false,
+                onActiveSealed: (sealed) => { activeSeals.push(...sealed); },
+            });
             result.archived = processed.filter((job) => job.status === "done").length;
             result.failed = processed.filter((job) => job.status !== "done" && job.lastError?.code !== "insufficient_disk_space").length;
             const waiting = processed.filter((job) => job.lastError?.code === "insufficient_disk_space").length;
             if (waiting)
-                notes.push(`${waiting} session${waiting === 1 ? "" : "s"} left queued: not enough free space to seal ${waiting === 1 ? "it" : "them"} safely`);
-        }
-        if (options.upload !== false && signerEnabled()) {
-            try {
-                // Upload, verify, then offload: a verified push whose blob stays on
-                // this disk has not freed anything, and this daemon exists to free it.
-                const uploads = await uploadAndOffloadPending(dataDir);
-                result.uploaded = uploads.uploaded.length;
-                result.uploadErrors = uploads.failed.length;
-                if (uploads.freedBytes > 0)
-                    notes.push(`freed ${(uploads.freedBytes / 1073741824).toFixed(1)} GB of sealed copies this disk no longer needs`);
+                notes.push(`${waiting} session${waiting === 1 ? "" : "s"} left queued: not enough free space to seal ${waiting === 1 ? "it" : "them"} safely and no connected chunk-capable cloud target was available`);
+            /**
+             * Index BEFORE anything is reclaimed.
+             *
+             * This loop archived, uploaded and reclaimed, and never indexed — so it
+             * deleted people's sessions and left the archives unfindable, which is the
+             * one outcome the product exists to prevent. Indexing here also costs
+             * nothing extra in practice: it runs on the handful sealed this tick, not
+             * the whole vault, which is the difference between a second and the twenty
+             * minutes a from-scratch rebuild takes.
+            */
+            if (result.archived > 0) {
+                // Even one fresh archive may parse and rewrite the existing 808 MB
+                // index. Production always schedules the owned child; it never does this
+                // inside the responsive daemon. Retention keeps the source until the
+                // child's coverage lands on a later tick.
+                indexCatchupNeeded = true;
+                if (!indexBacklogActive())
+                    startIndexMigration();
+                notes.push("search indexing is catching up in the background; the new archive stays protected on disk until searchable");
             }
-            catch (error) {
-                result.uploadErrors += 1;
-                notes.push(`upload pass failed: ${isVaultlineError(error) ? error.code : "unexpected error"}`);
+            if (options.upload !== false && signerEnabled()) {
+                try {
+                    const passes = [];
+                    if (uploadAlongsidePreservation)
+                        passes.push(await uploadAlongsidePreservation);
+                    // The concurrent pass snapshots the archive list before sealing. When
+                    // this tick created a new archive, one more bounded pass makes that
+                    // fresh unit durable too; it never overlaps because requestUploadPass
+                    // is process-wide single-flight for this daemon.
+                    if (result.archived > 0) {
+                        const freshPass = requestUploadPass();
+                        if (freshPass)
+                            passes.push(await freshPass);
+                    }
+                    for (const uploads of passes) {
+                        result.uploaded += uploads.uploaded.length;
+                        result.uploadErrors += uploads.failed.length;
+                        freedBytes += uploads.freedBytes;
+                        if (uploads.failed.length) {
+                            const first = uploads.failed[0].error.replace(/\s+/g, " ").slice(0, 240);
+                            notes.push(`${uploads.failed.length} upload${uploads.failed.length === 1 ? "" : "s"} waiting: ${first}`);
+                        }
+                    }
+                    if (freedBytes > 0)
+                        notes.push(`freed ${(freedBytes / 1073741824).toFixed(1)} GB of sealed copies this disk no longer needs`);
+                    // The first index pass intentionally precedes upload, because source
+                    // reclamation must never outrun searchability. A managed archive only
+                    // becomes eligible for its shared shard after durability and the
+                    // separate space grant land, so publish any independently completed
+                    // team grant here, still under the single index-writer guard.
+                    if (indexPublicationNeeded) {
+                        indexPublicationNeeded = false;
+                        indexCatchupNeeded = true;
+                        if (!indexBacklogActive())
+                            startIndexMigration();
+                        notes.push("shared search publication is catching up in the background");
+                    }
+                }
+                catch (error) {
+                    result.uploadErrors += 1;
+                    notes.push(`upload pass failed: ${isSealkeepError(error) ? error.code : "unexpected error"}`);
+                }
+            }
+            // Presence is independent of the search migration too, but it follows the
+            // upload lane so a slow/unavailable team feed can never delay ciphertext
+            // durability. Indexing was already handled (or explicitly deferred) above.
+            if (activeSeals.length > 0) {
+                try {
+                    const { finishLineFrom, publishPresence } = await import("./presence.js");
+                    for (const { project, projectKey, sourcePath } of activeSeals) {
+                        await publishPresence(dataDir, {
+                            project,
+                            projectKey,
+                            kind: "finished",
+                            line: await finishLineFrom(sourcePath),
+                        }, options.phrase);
+                    }
+                }
+                catch (error) {
+                    notes.push(`active sharing is waiting: ${isSealkeepError(error) ? error.code : "unexpected error"}`);
+                }
+            }
+            if (reclaimActive) {
+                const config = await readConfig(dataDir);
+                const settings = retentionSettings(config);
+                if (settings.policy !== "archive-and-reclaim" && settings.policy !== "manual-approval") {
+                    notes.push(`retention policy ${settings.policy} never reclaims`);
+                }
+                else if (indexBacklogActive()) {
+                    // Indexing is derived/background work, so preservation and upload never
+                    // wait for it. Reclaim is different: removing the native source while a
+                    // freshly granted team archive is still absent from the shared shard
+                    // creates a real window where teammates cannot find the preserved
+                    // memory. Leave the source intact and retry on a later cadence after the
+                    // single index writer has published complete coverage.
+                    notes.push("disk reclaim is waiting for background search indexing to finish; originals remain on this machine");
+                }
+                else {
+                    retentionGate = true;
+                    try {
+                        // Do not let a cadence tick begin a record/offload mutation while
+                        // retention is proving index coverage and durable copies. An already
+                        // started verified upload is safe to finish and may improve the proof.
+                        await uploadInFlight?.catch(() => undefined);
+                        const localSettings = await readLocalSettings(dataDir);
+                        const applied = await applyRetention(dataDir, {
+                            confirm: true,
+                            home: options.home,
+                            phrase: options.phrase,
+                            strategy: resolvedTrashStrategy(localSettings),
+                            backgroundCpuTarget: 0.30,
+                            backgroundRemoteBytesPerSecond: backgroundUploadBytesPerSecond(localSettings),
+                            signal: workCancellation.signal,
+                            operations: options.retentionOperations,
+                            authorizeReclaim: authorizeServiceReclaim,
+                        });
+                        result.reclaimed = applied.mode === "apply" ? applied.reclaimed.length : 0;
+                        freedBytes += applied.mode === "apply" ? applied.freedBytes : 0;
+                    }
+                    finally {
+                        retentionGate = false;
+                    }
+                }
+            }
+            totals.archived += result.archived;
+            totals.indexed += result.indexed;
+            totals.reclaimed += result.reclaimed;
+            totals.failed += result.failed;
+            await beat(result);
+            // One notification at most per round, and only for something worth interrupting for.
+            const summary = summarize({ archived: result.archived, uploaded: result.uploaded, reclaimed: result.reclaimed, failed: result.failed, freedBytes });
+            if (summary && gate.allow(now(), result.failed > 0 || result.reclaimed > 0)) {
+                await notify(summary, { ...options.notify, enabled: options.notifications ?? options.notify?.enabled });
             }
+            options.onTick?.(result);
+            return result;
         }
-        else if (options.upload !== false) {
-            notes.push("uploads are disabled: no signer is enabled");
+        /**
+         * Keep an established backlog moving without turning the normal cadence
+         * into a hot loop. A completed archive or a real failed attempt changes the
+         * queue: the next row may safely run after yielding to upload/index/UI work.
+         * A capacity-held row is deliberately excluded because it remains
+         * immediately claimable until disk or storage conditions change.
+         */
+        async function scheduleBacklogPass(result) {
+            if (closing || paused || backlogTimer || (result.archived === 0 && result.failed === 0))
+                return;
+            const local = await readLocalSettings(dataDir);
+            const eligible = (job) => job.event === "manual"
+                || automaticTranscriptIsEnabled(local, job.agent, job.sourcePath, options.home);
+            if (!await queue.hasClaimable(eligible) || closing || paused || backlogTimer)
+                return;
+            backlogTimer = setTimeout(() => {
+                backlogTimer = undefined;
+                if (!closing && !paused)
+                    void tick().catch(() => undefined);
+            }, 25);
+            backlogTimer.unref?.();
         }
-        if (options.reclaim) {
-            const config = await readConfig(dataDir);
-            const settings = retentionSettings(config);
-            if (settings.policy === "archive-and-reclaim" || settings.policy === "manual-approval") {
-                const applied = await applyRetention(dataDir, { confirm: true, home: options.home });
-                result.reclaimed = applied.mode === "apply" ? applied.reclaimed.length : 0;
-                freedBytes = applied.mode === "apply" ? applied.freedBytes : 0;
+        // A first pass over a large history can run longer than the normal timer.
+        // Joining the in-flight promise prevents the timer, a UI action and CLI
+        // startup from draining/uploading/reclaiming the same vault concurrently.
+        async function tick() {
+            if (tickInFlight)
+                return tickInFlight;
+            tickInFlight = runTick();
+            let completed;
+            try {
+                completed = await tickInFlight;
+                return completed;
             }
-            else {
-                notes.push(`retention policy ${settings.policy} never reclaims`);
+            finally {
+                tickInFlight = null;
+                heartbeatPhase = "watching for new agent sessions";
+                if (completed)
+                    void scheduleBacklogPass(completed).catch(() => undefined);
             }
         }
-        totals.archived += result.archived;
-        totals.uploaded += result.uploaded;
-        totals.reclaimed += result.reclaimed;
-        totals.failed += result.failed;
-        await beat(result);
-        // One notification at most per round, and only for something worth interrupting for.
-        const summary = summarize({ archived: result.archived, uploaded: result.uploaded, reclaimed: result.reclaimed, failed: result.failed, freedBytes });
-        if (summary && gate.allow(now(), result.failed > 0 || result.reclaimed > 0)) {
-            await notify(summary, { ...options.notify, enabled: options.notifications ?? options.notify?.enabled });
+        /** Records the sign of life every other surface reads. */
+        async function beat(result) {
+            const write = heartbeatWrite.then(async () => {
+                if (closed)
+                    return;
+                // Snapshot mutable state only when this write reaches the front of the
+                // lane. For example, pause() may have happened while an earlier disk
+                // write was still pending; publishing the stale snapshot would lie.
+                const resultAtMs = Date.parse(result.at);
+                lastHeartbeatAtMs = Math.max(lastHeartbeatAtMs, now(), Number.isFinite(resultAtMs) ? resultAtMs : lastHeartbeatAtMs);
+                const state = {
+                    version: 1, pid: process.pid, startedAt, lastTickAt: new Date(lastHeartbeatAtMs).toISOString(), intervalMs,
+                    totals: { ...totals },
+                    last: { archived: result.archived, uploaded: result.uploaded, reclaimed: result.reclaimed, failed: result.failed, notes: result.notes },
+                    paused, watching: watcher?.roots ?? [],
+                    // Capability belongs to the service doing the work, not to whichever
+                    // browser/API process happens to read this file. Health surfaces use
+                    // these facts instead of inspecting their own unrelated environment.
+                    capabilities: { uploads: options.upload !== false && signerEnabled(), reclaim: reclaimActive },
+                    indexing: { ...indexingState },
+                    teamAccess: { ...accessState },
+                    context: { ...contextState },
+                    backfill: { ...backfillState },
+                };
+                await writeHeartbeat(dataDir, state);
+            });
+            // A transient status-write failure is advisory and must not poison later
+            // heartbeats, but callers still wait for their own ordered publication.
+            heartbeatWrite = write.catch(() => undefined);
+            await write.catch(() => undefined);
         }
-        options.onTick?.(result);
-        return result;
-    }
-    /** Records the sign of life every other surface reads. */
-    async function beat(result) {
-        const state = {
-            version: 1, pid: process.pid, startedAt, lastTickAt: result.at, intervalMs,
-            totals: { ...totals },
-            last: { archived: result.archived, uploaded: result.uploaded, reclaimed: result.reclaimed, failed: result.failed, notes: result.notes },
-            paused, watching: watcher?.roots ?? []
+        const timer = setInterval(() => { void tick().catch(() => undefined); }, intervalMs);
+        timer.unref?.();
+        return {
+            tick,
+            pause: () => { paused = true; },
+            resume: () => { paused = false; },
+            status: async () => ({ paused, queue: await queue.stats(), watching: watcher?.roots ?? [] }),
+            close: () => {
+                if (closeInFlight)
+                    return closeInFlight;
+                closeInFlight = (async () => {
+                    try {
+                        closing = true;
+                        const cancellation = new Error("Sealkeep daemon is closing");
+                        cancellation.name = "AbortError";
+                        workCancellation.abort(cancellation);
+                        indexCatchupNeeded = false;
+                        if (indexRetryTimer)
+                            clearTimeout(indexRetryTimer);
+                        indexRetryTimer = undefined;
+                        clearInterval(timer);
+                        clearInterval(livenessPulse);
+                        if (uploadTimer)
+                            clearInterval(uploadTimer);
+                        if (accessTimer)
+                            clearInterval(accessTimer);
+                        if (backfillTimer)
+                            clearInterval(backfillTimer);
+                        if (storageHealthTimer)
+                            clearInterval(storageHealthTimer);
+                        if (contextTimer)
+                            clearInterval(contextTimer);
+                        if (backlogTimer)
+                            clearTimeout(backlogTimer);
+                        backlogTimer = undefined;
+                        // Snapshot every producer after closing their timers. Stop and await
+                        // the index child concurrently: stop is what settles its result.
+                        const indexTask = historicalIndexTask;
+                        const migration = indexMigration;
+                        const tickTask = tickInFlight;
+                        const uploadTask = uploadInFlight;
+                        const contextTask = contextDrainTask;
+                        const watcherSetup = watcherStartup;
+                        const realtimeSetup = teamRealtimeStartup;
+                        const serviceSetup = serviceReconciliation;
+                        const owned = Promise.all([
+                            watcher?.close(),
+                            teamRealtime?.close(),
+                            watcherSetup?.catch(() => undefined),
+                            realtimeSetup?.catch(() => undefined),
+                            serviceSetup?.catch(() => undefined),
+                            indexTask?.stop().catch(() => undefined),
+                            contextTask?.stop().catch(() => undefined),
+                            migration?.catch(() => undefined),
+                            // A service stop/upgrade must never exit underneath a leased seal.
+                            // Waiting here guarantees the archive/queue commit reaches its
+                            // atomic completion boundary before the process goes away.
+                            tickTask?.catch(() => undefined),
+                            uploadTask?.catch(() => undefined),
+                            backfillInFlight?.catch(() => undefined),
+                            contextInFlight?.catch(() => undefined),
+                        ]);
+                        let closeDeadline;
+                        await Promise.race([
+                            owned,
+                            new Promise((resolve) => { closeDeadline = setTimeout(resolve, closeGraceMs); }),
+                        ]);
+                        if (closeDeadline)
+                            clearTimeout(closeDeadline);
+                        // A startup scan is intentionally independent from watcher startup so
+                        // existing queue work does not wait for a large history walk. It is
+                        // still owned by this daemon and must quiesce before close returns.
+                        const trailing = Promise.all([
+                            startupScan?.catch(() => undefined),
+                            accessInFlight?.catch(() => undefined),
+                            storageHealthInFlight?.catch(() => undefined),
+                        ]);
+                        let trailingDeadline;
+                        await Promise.race([
+                            trailing,
+                            new Promise((resolve) => { trailingDeadline = setTimeout(resolve, closeGraceMs); }),
+                        ]);
+                        if (trailingDeadline)
+                            clearTimeout(trailingDeadline);
+                        // Every producer above may append one final ordered status write while
+                        // shutting down. Read the tail only after they have all settled.
+                        let heartbeatDeadline;
+                        await Promise.race([
+                            heartbeatWrite,
+                            new Promise((resolve) => { heartbeatDeadline = setTimeout(resolve, closeGraceMs); }),
+                        ]);
+                        if (heartbeatDeadline)
+                            clearTimeout(heartbeatDeadline);
+                    }
+                    finally {
+                        closed = true;
+                        // Release last. Until this point a replacement must not start any
+                        // vault-mutating lane, even if the UI listener has already moved.
+                        try {
+                            await workerLease.release();
+                        }
+                        finally {
+                            signerGrant?.release();
+                        }
+                    }
+                })();
+                return closeInFlight;
+            }
         };
-        await writeHeartbeat(dataDir, state).catch(() => undefined);
     }
-    const timer = setInterval(() => { void tick().catch(() => undefined); }, intervalMs);
-    timer.unref?.();
-    return {
-        tick,
-        pause: () => { paused = true; },
-        resume: () => { paused = false; },
-        status: async () => ({ paused, queue: await queue.stats(), watching: watcher?.roots ?? [] }),
-        close: async () => { clearInterval(timer); await watcher?.close(); }
-    };
+    catch (error) {
+        signerGrant?.release();
+        await workerLease.release().catch(() => undefined);
+        throw error;
+    }
 }