apsimo 1.3.0__py3-none-any.whl

apsimo/autonomy/loop.py

@@ -0,0 +1,4316 @@
+"""AutonomyLoop — Colony's continuous operating cycle.
+
+Wires existing subsystems into a coherent tick-based loop that runs
+as a background asyncio task inside the sidecar. Each tick drains
+events, checks goals, runs cognition, and executes initiatives.
+
+Design principle: wire what exists. The loop is pure glue — it
+orchestrates subsystems that are already wired in the sidecar.
+
+State lives in Neo4j + SQLite. The loop is stateless and restartable.
+Kill it at any point and it picks up cleanly on restart.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import copy
+import functools
+import hashlib
+import json
+import logging
+import os
+import time
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, List, Optional
+from zoneinfo import ZoneInfo
+
+from apsimo.autonomy.config import AutonomyConfig, AutonomyMode
+from apsimo.autonomy.registry import SubsystemRegistry
+from apsimo.events.bus import EventBus
+from apsimo.events.types import Event
+
+# Lazy import to avoid circular dependency — broadcast_event is defined
+# in the host router which imports from this module.
+_broadcast = None
+
+
+def _get_broadcast():
+    global _broadcast
+    if _broadcast is None:
+        try:
+            from apsimo.api.routers.host import broadcast_event
+            _broadcast = broadcast_event
+        except ImportError:
+            # A circular import during startup must not permanently replace the
+            # durable publisher for the process lifetime.
+            return lambda _event: None
+    return _broadcast
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class _ProactiveFindingSnapshot:
+    """Immutable, scalar-only finding projection used for feedback/logging."""
+
+    check: str
+    severity: str
+    reason: str
+    excerpt: Optional[str]
+
+
+@dataclass(frozen=True)
+class _ProactiveVerdictSnapshot:
+    """One-read authority snapshot of a guard result.
+
+    A guard result may be an arbitrary object with descriptors rather than a
+    plain ``GuardResult``.  The send boundary therefore reads every field it
+    uses exactly once, rejects non-built-in scalar types, and never consults
+    the source object again.  Frozen scalar values close the validation/use
+    gap even for stateful or adversarial properties.
+    """
+
+    decision: Optional[str]
+    mode: Optional[str]
+    surface: Optional[str]
+    surface_family: Optional[str]
+    applicability: Optional[str]
+    guard_status: Optional[str]
+    policy_id: Optional[str]
+    policy_digest: Optional[str]
+    candidate_digest: Optional[str]
+    blocked: Optional[bool]
+    findings: tuple[_ProactiveFindingSnapshot, ...]
+
+
+def _exact_builtin_text(value: Any) -> Optional[str]:
+    return value if type(value) is str else None
+
+
+def _snapshot_proactive_findings(value: Any) -> tuple[_ProactiveFindingSnapshot, ...]:
+    # GuardResult.findings is a list.  Reject custom iterables at this
+    # authority boundary instead of executing caller-controlled iteration.
+    if type(value) not in {list, tuple}:
+        return ()
+    snapshots = []
+    for finding in tuple(value)[:64]:
+        raw_check = getattr(finding, "check", None)
+        raw_severity = getattr(finding, "severity", None)
+        raw_reason = getattr(finding, "reason", None)
+        raw_excerpt = getattr(finding, "excerpt", None)
+        snapshots.append(_ProactiveFindingSnapshot(
+            check=_exact_builtin_text(raw_check) or "blocked",
+            severity=_exact_builtin_text(raw_severity) or "",
+            reason=_exact_builtin_text(raw_reason) or "",
+            excerpt=_exact_builtin_text(raw_excerpt),
+        ))
+    return tuple(snapshots)
+
+
+def _snapshot_proactive_verdict(result: Any) -> _ProactiveVerdictSnapshot:
+    """Read every egress-relevant raw verdict field exactly once."""
+
+    raw_decision = getattr(result, "decision", None)
+    raw_mode = getattr(result, "mode", None)
+    raw_surface = getattr(result, "surface", None)
+    raw_surface_family = getattr(result, "surface_family", None)
+    raw_applicability = getattr(result, "applicability", None)
+    raw_guard_status = getattr(result, "guard_status", None)
+    raw_policy_id = getattr(result, "policy_id", None)
+    raw_policy_digest = getattr(result, "policy_digest", None)
+    raw_candidate_digest = getattr(result, "candidate_digest", None)
+    raw_blocked = getattr(result, "blocked", None)
+    raw_findings = getattr(result, "findings", None)
+    return _ProactiveVerdictSnapshot(
+        decision=_exact_builtin_text(raw_decision),
+        mode=_exact_builtin_text(raw_mode),
+        surface=_exact_builtin_text(raw_surface),
+        surface_family=_exact_builtin_text(raw_surface_family),
+        applicability=_exact_builtin_text(raw_applicability),
+        guard_status=_exact_builtin_text(raw_guard_status),
+        policy_id=_exact_builtin_text(raw_policy_id),
+        policy_digest=_exact_builtin_text(raw_policy_digest),
+        candidate_digest=_exact_builtin_text(raw_candidate_digest),
+        blocked=raw_blocked if type(raw_blocked) is bool else None,
+        findings=_snapshot_proactive_findings(raw_findings),
+    )
+
+
+def _proactive_enforce_verdict_error(
+    result: _ProactiveVerdictSnapshot,
+    candidate: str,
+) -> Optional[str]:
+    """Return why an enforce verdict cannot authorize this exact candidate.
+
+    The guard object is an in-process dependency, but its result still crosses
+    an authority boundary: only a canonical policy decision over the exact
+    UTF-8 candidate may reach a delivery adapter.  Keep this validation local
+    to the send path so a malformed result object cannot inherit authority from
+    a truthy/falsey ``blocked`` attribute.
+    """
+
+    from apsimo.gate.response_guard import (
+        GuardDecision,
+        response_text_digest,
+    )
+    from apsimo.gate.surface_policy import ResponseGuardSurfacePolicyV1
+
+    expected = ResponseGuardSurfacePolicyV1().resolve(
+        "proactive_text",
+        configured_mode="enforce",
+        requested_mode="enforce",
+    )
+    decision = result.decision
+    valid_decisions = {item.value for item in GuardDecision}
+    if type(decision) is not str or decision not in valid_decisions:
+        return "decision is absent or invalid"
+
+    guard_status = result.guard_status
+    if type(guard_status) is not str or guard_status not in {
+        "evaluated",
+        "degraded",
+    }:
+        return "guard_status is absent or invalid"
+    if (
+        guard_status == "degraded"
+        and decision != GuardDecision.BLOCK.value
+    ):
+        return "degraded enforce verdict is not a block"
+
+    expected_fields = {
+        "mode": expected.effective_mode,
+        "surface": expected.surface,
+        "surface_family": expected.family,
+        "applicability": expected.disposition,
+        "policy_id": expected.policy_id,
+        "policy_digest": expected.policy_digest,
+        "candidate_digest": response_text_digest(candidate),
+    }
+    for field_name, expected_value in expected_fields.items():
+        observed = getattr(result, field_name)
+        if type(observed) is not str or observed != expected_value:
+            return "%s does not match the canonical proactive policy" % field_name
+
+    blocked = result.blocked
+    if type(blocked) is not bool or blocked != (
+        decision != GuardDecision.ALLOW.value
+    ):
+        return "blocked projection conflicts with decision"
+    return None
+
+
+def _record_p3_thinker_candidates(workspace: Any, initiatives: list[Any]) -> int:
+    """Record SelfDirectedThinker output as shadow provenance, never live.
+
+    Workspace mode describes the scheduler consuming a concern. It cannot
+    relabel the trust/mode of the producer that originated the candidate.
+    """
+
+    recorded = 0
+    for init in initiatives:
+        key = str(getattr(init, "dedup_key", "") or "").strip()
+        if not key:
+            import hashlib
+            key = hashlib.sha256(
+                str(getattr(init, "description", init)).encode("utf-8")
+            ).hexdigest()[:24]
+        workspace.bump(
+            kind="question",
+            summary=str(getattr(init, "description", init))[:300],
+            dedup_key=f"self-directed:{key}"[:200],
+            salience=max(0.3, min(0.85, float(
+                getattr(init, "priority", 0.5) or 0.5))),
+            sources=[f"self-directed-thinker:{key}"],
+            producer_name="self_directed_thinker",
+            producer_mode="shadow",
+            producer_revision="self-directed-thinker:v1",
+        )
+        recorded += 1
+    return recorded
+
+
+@dataclass
+class LoopStats:
+    """Lightweight counters updated each tick for observability."""
+
+    ticks: int = 0
+    events_processed: int = 0
+    goals_checked: int = 0
+    initiatives_generated: int = 0
+    actions_executed: int = 0
+    errors: int = 0
+    actions_this_hour: int = 0
+    hour_bucket: int = field(default_factory=lambda: datetime.now(timezone.utc).hour)
+    skills_loaded: int = 0
+    skills_evicted: int = 0
+    signals_collected: int = 0
+    scoring_runs: int = 0
+    tier_changes: int = 0
+    memories_promoted: int = 0
+    task_follow_ups: int = 0
+    scheduled_runs: int = 0
+    phases_skipped: int = 0
+    boundary_check_errors: int = 0
+    phases_cancelled: int = 0
+    last_cancelled_phase: Optional[str] = None
+
+    def as_dict(self) -> dict:
+        return {
+            "ticks": self.ticks,
+            "events_processed": self.events_processed,
+            "goals_checked": self.goals_checked,
+            "initiatives_generated": self.initiatives_generated,
+            "actions_executed": self.actions_executed,
+            "errors": self.errors,
+            "actions_this_hour": self.actions_this_hour,
+            "hour_bucket": self.hour_bucket,
+            "skills_loaded": self.skills_loaded,
+            "skills_evicted": self.skills_evicted,
+            "signals_collected": self.signals_collected,
+            "scoring_runs": self.scoring_runs,
+            "tier_changes": self.tier_changes,
+            "memories_promoted": self.memories_promoted,
+            "task_follow_ups": self.task_follow_ups,
+            "scheduled_runs": self.scheduled_runs,
+            "phases_skipped": self.phases_skipped,
+            "boundary_check_errors": self.boundary_check_errors,
+            "phases_cancelled": self.phases_cancelled,
+            "last_cancelled_phase": self.last_cancelled_phase,
+        }
+
+
+class AutonomyLoop:
+    """Colony's continuous operating cycle.
+
+    Takes a SubsystemRegistry and AutonomyConfig. The registry provides
+    lazy access to all wired subsystems — if something isn't wired,
+    the corresponding phase is a no-op.
+
+    The loop does NOT auto-start. The host calls ``start()`` or uses
+    the ``/v1/host/autonomy/start`` API endpoint.
+
+    Each tick:
+      1. Drain pending events
+      2. Check goal engine for goals needing attention
+      3. Check anomaly detections above severity threshold
+      4. Run initiative engine — Colony decides whether to act
+      5. Execute approved actions
+      6. Run cognition pipeline tick
+      7. (memory consolidation runs via the memory_consolidate scheduler
+         task, not a tick phase)
+      8. Memory decay (daily)
+      9. Memory pruning (weekly)
+     10. Task completion follow-ups
+     11. Frustration back-off update
+     12. Bootstrap self-check (daily)
+     13. Self-reflection (weekly)
+     14. Relationship scoring
+     15. Synthesis (connection discovery)
+     16. Skill trigger evaluation + eviction
+     17. Sleep until next tick or event wakes early
+    """
+
+    def __init__(
+        self,
+        registry: SubsystemRegistry,
+        config: Optional[AutonomyConfig] = None,
+        event_bus: Optional[EventBus] = None,
+        scheduler: Any = None,
+    ) -> None:
+        self._registry = registry
+        self.config = config or AutonomyConfig()
+        for phase in self.config.enabled_phases or ():
+            if not callable(getattr(self, '_phase_' + phase, None)):
+                raise ValueError(f'Unknown autonomy phase: {phase}')
+        self.events = event_bus or EventBus()
+        self.stats = LoopStats()
+        self._scheduler = scheduler
+
+        self._running = False
+        self._wake_event = asyncio.Event()
+        self._stop_event = asyncio.Event()
+        self._wake_sub: Any = None
+        self._pending_initiatives: List[Any] = []
+        # Per-domain timestamps of the last observation-sync request, so
+        # a slow agent isn't spammed with duplicate sync jobs every tick.
+        self._last_sync_request: dict = {}
+        self._periodic_last: dict = {}
+        self._last_task_completion_check: Optional[datetime] = None
+        # Phases already warned about skipping (warn once, count always).
+        self._phase_skip_warned: set = set()
+        # Which tick phase is running right now (None between ticks), and how
+        # long each phase took on its last run and at its worst. A tick that
+        # blows its budget is cancelled as a whole, so without this the log
+        # could not say which phase ate the budget.
+        self._current_phase: Optional[str] = None
+        self._phase_seconds: dict[str, float] = {}
+        self._phase_seconds_max: dict[str, float] = {}
+        # High-water mark for _phase_events so each event is counted once.
+        self._last_event_seen_id: Optional[str] = None
+        # Exact already-admitted requests awaiting a terminal gateway outcome.
+        # This is intentionally bounded and in-memory; the initiative store +
+        # startup re-push rebuild it after a proactive-mode restart.
+        self._governed_delivery_replays: dict[str, dict] = {}
+        self._governed_reconcile_task: Optional[asyncio.Task] = None
+
+    # ------------------------------------------------------------------
+    # Lifecycle
+    # ------------------------------------------------------------------
+
+    async def start(self) -> None:
+        """Start the autonomy loop. Runs until stop() is called."""
+        self._running = True
+        self._stop_event.clear()
+
+        # Fail loudly at startup if the owner identity is missing or
+        # unresolvable (v0.16.0). Relationship generation fails closed at
+        # tick time either way; this surfaces the misconfiguration once,
+        # at CRITICAL, instead of letting it hide in per-tick noise.
+        try:
+            from apsimo.identity.resolver import (
+                OwnerIdentityError,
+                get_identity_resolver,
+            )
+            await get_identity_resolver().owner_identities()
+        except OwnerIdentityError as exc:
+            logger.critical(
+                "OWNER IDENTITY NOT RESOLVED — relationship initiative "
+                "generation will be disabled until fixed: %s", exc,
+            )
+        except Exception as exc:
+            logger.warning("Owner identity startup check failed: %s", exc)
+
+        # Boot self-check: a periodic phase that dispatches on a graph
+        # capability which does not exist would otherwise no-op silently
+        # forever (exactly how the old consolidation and pruning phases went
+        # dead for months). Surface any such mismatch once, loudly, at start.
+        self._check_phase_capabilities()
+
+        # Governed message lifecycle reconciliation is independent of the
+        # main autonomy cadence. It must also run in REACTIVE mode: an already
+        # admitted message can reach provider delivery while no new event or
+        # initiative wakes the ordinary loop.
+        self._start_governed_delivery_reconciler()
+
+        # Reactive mode: just mark as running, no timer
+        if self.config.mode == AutonomyMode.REACTIVE:
+            logger.info(
+                "Autonomy loop started in REACTIVE mode (on-demand only, tz=%s)",
+                self.config.timezone,
+            )
+            return
+
+        # Proactive mode: start timer loop
+        logger.info(
+            "Autonomy loop starting in PROACTIVE mode (tick=%.0fs, quiet=%s-%s %s)",
+            self.config.tick_interval_secs,
+            self.config.quiet_hours_start,
+            self.config.quiet_hours_end,
+            self.config.timezone,
+        )
+
+        self._wake_sub = self.events.subscribe(
+            handler=self._on_wake_signal,
+            event_types=[Event],
+        )
+
+        try:
+            while not self._stop_event.is_set():
+                # Bound the whole tick so no single slow/hung phase (a wedged
+                # LLM, graph, or Docker call) can freeze the loop forever. The
+                # phases are re-run each tick, so a cancelled tick is safe; the
+                # loop advances and retries next cycle.
+                try:
+                    await asyncio.wait_for(
+                        self._tick(), timeout=self._tick_budget_secs())
+                except asyncio.TimeoutError:
+                    self._note_tick_cancelled()
+                await self._sleep_until_next_tick()
+        finally:
+            await self._stop_governed_delivery_reconciler()
+            if self._wake_sub is not None:
+                self.events.unsubscribe(self._wake_sub)
+            self._running = False
+            logger.info("Autonomy loop stopped. Stats: %s", self.stats.as_dict())
+
+    async def stop(self) -> None:
+        """Signal the loop to stop after the current tick completes."""
+        logger.info("Autonomy loop stop requested")
+        self._stop_event.set()
+        self._wake_event.set()
+        await self._stop_governed_delivery_reconciler()
+
+    def _start_governed_delivery_reconciler(self) -> None:
+        delivery = getattr(self._registry, "delivery", None)
+        enabled = False
+        if delivery is not None and hasattr(
+            delivery, "governed_gateway_admission_enabled"
+        ):
+            try:
+                enabled = delivery.governed_gateway_admission_enabled() is True
+            except Exception:
+                enabled = False
+        if not enabled:
+            return
+        task = self._governed_reconcile_task
+        if task is None or task.done():
+            self._governed_reconcile_task = asyncio.create_task(
+                self._governed_delivery_reconciliation_loop(),
+                name="colony-governed-delivery-reconciliation",
+            )
+
+    async def _stop_governed_delivery_reconciler(self) -> None:
+        task = self._governed_reconcile_task
+        self._governed_reconcile_task = None
+        if task is None or task.done():
+            return
+        task.cancel()
+        try:
+            await task
+        except asyncio.CancelledError:
+            pass
+
+    async def _governed_delivery_reconciliation_loop(self) -> None:
+        """Poll admitted requests until the boundary reports a terminal state."""
+
+        while not self._stop_event.is_set():
+            delivery = getattr(self._registry, "delivery", None)
+            interval = 5.0
+            getter = getattr(delivery, "governed_gateway_poll_seconds", None)
+            if callable(getter):
+                try:
+                    interval = max(0.01, min(300.0, float(getter())))
+                except (TypeError, ValueError):
+                    interval = 5.0
+            try:
+                await asyncio.wait_for(self._stop_event.wait(), timeout=interval)
+                continue
+            except asyncio.TimeoutError:
+                pass
+            try:
+                await self._phase_governed_delivery_reconciliation()
+            except asyncio.CancelledError:
+                raise
+            except Exception:
+                self.stats.errors += 1
+                logger.exception("Governed delivery reconciliation failed")
+
+    def wake(self) -> None:
+        """Wake the loop early from its sleep. Thread-safe."""
+        self._wake_event.set()
+
+    @property
+    def is_running(self) -> bool:
+        return self._running
+
+    # ------------------------------------------------------------------
+    # Main tick
+    # ------------------------------------------------------------------
+
+    async def _tick(self) -> None:
+        """One autonomy tick. The running-phase marker is cleared on every
+        exit except cancellation, where _note_tick_cancelled reads it."""
+        try:
+            await self._tick_phases()
+        except asyncio.CancelledError:
+            raise
+        except BaseException:
+            self._current_phase = None
+            raise
+        else:
+            self._current_phase = None
+
+    async def _tick_phases(self) -> None:
+        self.stats.ticks += 1
+        self._reset_hour_bucket()
+        tick_start = datetime.now(timezone.utc)
+
+        logger.debug("Tick #%d starting", self.stats.ticks)
+
+        # Phase -1: reconcile terminal WorkOrder truth before any phase that
+        # may invoke an LLM.  This is bounded separately and never dispatches
+        # work, so a slow thinking/planning phase (or whole-tick cancellation)
+        # cannot starve durable queue-result projection.
+        await self._run_phase("project_result_reconciliation", self._phase_project_result_reconciliation())
+
+        # Phase 0: evaluate skill triggers
+        event_text = self._gather_event_text()
+        await self._run_phase("skill_triggers", self._phase_skill_triggers(event_text))
+
+        # Phase 1: drain pending events
+        await self._run_phase("events", self._phase_events())
+
+        # Phase 2: check goals needing attention
+        await self._run_phase("goals", self._phase_goals())
+
+        # Phase 2b: system-condition sweep (hourly) — commitment overdue flip,
+        # affect decline, surprise accumulation
+        await self._run_phase("condition_checks", self._phase_condition_checks())
+
+        # Phase 3: check anomalies
+        await self._run_phase("anomalies", self._phase_anomalies())
+
+        # Phase 4: scheduled periodic tasks (memory consolidate, briefing, etc.)
+        await self._run_phase("scheduled", self._phase_scheduled())
+
+        # Phase 5: run initiative engine
+        await self._run_phase("initiative", self._phase_initiative())
+
+        # Phase 5b: self-directed thinking (v0.17.0) — novel work the
+        # data-reactive generators can't see. Appends to the same
+        # pending-initiative batch Phase 6 consumes.
+        await self._run_phase("thinking", self._phase_thinking())
+
+        # Phase 6: execute approved actions
+        await self._run_phase("execute", self._phase_execute())
+
+        # Phase 6a: sustained project pursuit (cognition item 1)
+        await self._run_phase("projects", self._phase_projects())
+
+        # Phase 6a2: trust-engine graduation/demotion notices (Amendment 1)
+        await self._run_phase("trust_notices", self._phase_trust_notices())
+
+        # Phase 6b: request fresh observations for stale domains (v0.16.0)
+        await self._run_phase("observation_sync", self._phase_observation_sync())
+
+        # Phase 6c: feed completed agent work back into memory (v0.17.0)
+        await self._run_phase("job_writeback", self._phase_job_writeback())
+
+        # Phase 7: cognition pipeline tick
+        await self._run_phase("cognition", self._phase_cognition())
+
+        # (memory consolidation is NOT a tick phase: the consolidator runs
+        # hourly via the memory_consolidate scheduler task. The old phase
+        # here dispatched on graph.consolidate_memories, which never
+        # existed — deleted rather than repointed to avoid a double-run.)
+
+        # Phase 9: memory decay (daily)
+        await self._run_phase("memory_decay", self._phase_memory_decay())
+
+        # Phase 10: memory reconciliation (daily)
+        await self._run_phase("memory_reconciliation", self._phase_memory_reconciliation())
+
+        # Phase 11: memory pruning (weekly)
+        await self._run_phase("memory_pruning", self._phase_memory_pruning())
+
+        # Phase 11b: memory distillation — promote recalled episodics into semantic facts (daily)
+        await self._run_phase("memory_distillation", self._phase_memory_distillation())
+
+        # Phase 12: memory archive (weekly)
+        await self._run_phase("memory_archive", self._phase_memory_archive())
+
+        # Phase 11c: belief maintenance (daily, cognition item 7)
+        await self._run_phase("belief_maintenance", self._phase_belief_maintenance())
+
+        # Phase 11d: LLM-assisted world-model extraction (daily, batch)
+        await self._run_phase("world_llm_extract", self._phase_world_llm_extract())
+
+        # Phase 11d2: tom2 knowledge asymmetry (daily; COLONY_TOM2, default off)
+        await self._run_phase("tom2_asymmetry", self._phase_tom2_asymmetry())
+
+        # Phase 11e: connector ingest (read-only pull senses, cognition item 2)
+        await self._run_phase("connectors", self._phase_connectors())
+
+        # Phase 11f: relationship profiling (standing/psyche/approach briefs)
+        await self._run_phase("relationship_profiling", self._phase_relationship_profiling())
+
+        # Phase 12: task completion follow-ups
+        # (memory distillation already ran as Phase 11b — it was called twice)
+        await self._run_phase("task_completion", self._phase_task_completion())
+
+        # Phase 13: frustration back-off
+        await self._run_phase("frustration_update", self._phase_frustration_update())
+
+        # Phase 14: relationship scoring
+        await self._run_phase("relationships", self._phase_relationships())
+
+        # Phase 15: synthesis
+        await self._run_phase("synthesis", self._phase_synthesis())
+
+        # Phase 16: bootstrap self-check (daily)
+        await self._run_phase("bootstrap_check", self._phase_bootstrap_check())
+
+        # Phase 17: self-reflection (weekly)
+        await self._run_phase("self_reflection", self._phase_self_reflection())
+
+        # Phase 17b: selfhood benchmark (weekly, Mind M0a)
+        await self._run_phase("selfhood_benchmark", self._phase_selfhood_benchmark())
+
+        # Phase 17c: experiment decisions (daily, Mind M0b)
+        await self._run_phase("experiments", self._phase_experiments())
+
+        # Phase 17d: toolsmith (daily, Mind M1)
+        await self._run_phase("toolsmith", self._phase_toolsmith())
+
+        # Phase 18: skill eviction
+        await self._run_phase("skill_evict", self._phase_skill_evict())
+
+        # === Multi-Agent Phases (v0.7.0) ===
+
+        # Phase 19: startup re-push (first tick only)
+        await self._run_phase("startup_repush", self._phase_startup_repush())
+
+        # Phase 20: agent heartbeat (every tick)
+        await self._run_phase("agent_heartbeat", self._phase_agent_heartbeat())
+
+        # Phase 21: initiative timeout (every tick)
+        await self._run_phase("initiative_timeout", self._phase_initiative_timeout())
+
+        # Phase 21b: owner-approval timeout for blocked jobs (every tick)
+        await self._run_phase("approval_timeout", self._phase_approval_timeout())
+
+        # Phase 21: stale initiative cleanup (every 5 ticks)
+        if self.stats.ticks % 5 == 0:
+            await self._run_phase("stale_initiative_cleanup", self._phase_stale_initiative_cleanup())
+
+        # Phase 22: ghost agent cleanup (every 10 ticks)
+        if self.stats.ticks % 10 == 0:
+            await self._run_phase("ghost_cleanup", self._phase_ghost_cleanup())
+
+        # Phase 22b: cognitive workspace (every 3 ticks, Mind M2)
+        if self.stats.ticks % 3 == 0:
+            await self._run_phase("workspace", self._phase_workspace())
+
+        # Phase 22c: expectations — predict + check (every 2 ticks, Mind M3a)
+        if self.stats.ticks % 2 == 0:
+            await self._run_phase("expectations", self._phase_expectations())
+
+        # Phase 23: database backup (every 100 ticks)
+        if self.stats.ticks % 100 == 0:
+            await self._run_phase("database_backup", self._phase_database_backup())
+
+        # Telemetry liveness stamp — at the END of the tick, so last_tick_at
+        # means "a tick actually completed". Stamping at the top made a tick
+        # whose phases all threw (or that was cancelled on its budget) report
+        # fresh forever.
+        await self._run_phase("telemetry", self._phase_telemetry())
+
+        elapsed = (datetime.now(timezone.utc) - tick_start).total_seconds()
+        logger.debug("Tick #%d complete in %.2fs", self.stats.ticks, elapsed)
+
+    async def _phase_telemetry(self) -> None:
+        try:
+            from apsimo.api.routers.host import _telemetry
+            if _telemetry is not None:
+                await _telemetry.touch("last_tick_at")
+        except Exception:
+            logger.warning("Telemetry touch failed (non-critical)")
+
+    # ------------------------------------------------------------------
+    # Phase implementations
+    # ------------------------------------------------------------------
+
+    async def _phase_events(self) -> None:
+        """Reduce the durable host journal, with the private bus as fallback.
+
+        When the event-to-concern reducer is enabled its persisted cursor is
+        authoritative across restarts.  The old in-memory history remains only
+        for deployments that have not enabled the migration flag.
+        """
+        try:
+            registry = getattr(self, "_registry", None)
+            workspace = getattr(registry, "workspace", None) if registry is not None else None
+            external_reducer = (
+                getattr(workspace, "external_event_reducer", None)
+                if workspace else None
+            )
+            if (
+                external_reducer is not None
+                and getattr(external_reducer, "mode", "off") != "off"
+            ):
+                try:
+                    result = external_reducer.run_once(limit=100)
+                    self.stats.events_processed += int(
+                        result.get("processed") or 0
+                    )
+                    if result.get("error"):
+                        self.stats.errors += 1
+                        logger.warning(
+                            "External event concern reducer paused: %s",
+                            result["error"],
+                        )
+                except Exception:
+                    self.stats.errors += 1
+                    logger.exception(
+                        "External event concern reducer failed this tick"
+                    )
+
+            turn_reducer = (
+                getattr(workspace, "turn_event_reducer", None)
+                if workspace else None
+            )
+            if (
+                turn_reducer is not None
+                and getattr(turn_reducer, "mode", "off") != "off"
+            ):
+                try:
+                    result = turn_reducer.run_once(limit=100)
+                    self.stats.events_processed += int(
+                        result.get("processed") or 0
+                    )
+                    if result.get("error"):
+                        self.stats.errors += 1
+                        logger.warning(
+                            "Conversation turn concern reducer paused: %s",
+                            result["error"],
+                        )
+                except Exception:
+                    self.stats.errors += 1
+                    logger.exception(
+                        "Conversation turn concern reducer failed this tick"
+                    )
+
+            reducer = getattr(workspace, "event_reducer", None) if workspace else None
+            if reducer is not None and getattr(reducer, "mode", "off") != "off":
+                result = reducer.run_once(limit=100)
+                self.stats.events_processed += int(result.get("processed") or 0)
+                if result.get("error"):
+                    self.stats.errors += 1
+                    logger.warning("Durable event reducer paused: %s", result["error"])
+                return
+
+            recent = list(self.events.get_history(limit=50))
+            if self._last_event_seen_id is not None:
+                for i in range(len(recent) - 1, -1, -1):
+                    if getattr(recent[i], "id", None) == self._last_event_seen_id:
+                        recent = recent[i + 1:]
+                        break
+                # marker not found (aged out of the window): count the whole
+                # window, same bounded over-count the old code always had
+            if recent:
+                self._last_event_seen_id = getattr(recent[-1], "id", None)
+            self.stats.events_processed += len(recent)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase events error: %s", exc, exc_info=True)
+
+    async def _phase_goals(self) -> None:
+        """Check goal engine for goals needing attention."""
+        goals = self._registry.goals
+        if goals is None:
+            return
+        try:
+            from apsimo.cognition.goal_spine import cognition_spine_exclusive
+            legacy_read_only = cognition_spine_exclusive()
+            blocked = goals.list_goals(status="blocked", limit=20) if hasattr(goals, "list_goals") else []
+            accepted = goals.list_goals(status="accepted", limit=20) if hasattr(goals, "list_goals") else []
+            active = goals.list_goals(status="active", limit=50) if hasattr(goals, "list_goals") else []
+
+            for goal in ([] if legacy_read_only else accepted):
+                try:
+                    if hasattr(goals, "activate_goal"):
+                        goals.activate_goal(goal.get("goal_id", goal.get("id")))
+                        logger.info("Loop activated goal: %r", goal.get("title"))
+                except Exception as exc:
+                    logger.warning("Failed to activate goal: %s", exc)
+
+            total = len(blocked) + len(accepted) + len(active)
+            self.stats.goals_checked += total
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase goals error: %s", exc, exc_info=True)
+
+    async def _phase_anomalies(self) -> None:
+        """Check anomaly detector for signals above severity threshold."""
+        try:
+            detector = self._registry.anomalies
+            if detector is None:
+                return
+            if hasattr(detector, "detect"):
+                recent_anomalies = await detector.detect(
+                    threshold=self.config.anomaly_severity_threshold,
+                )
+            elif hasattr(detector, "get_recent"):
+                recent_anomalies = detector.get_recent(
+                    min_severity=self.config.anomaly_severity_threshold,
+                    limit=20,
+                )
+            else:
+                return
+
+            if recent_anomalies:
+                logger.info("Phase anomalies: %d above threshold", len(recent_anomalies))
+                _get_broadcast()({
+                    "type": "anomaly",
+                    "occurred_at": datetime.now(timezone.utc).isoformat(),
+                    "payload": {"count": len(recent_anomalies)},
+                })
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase anomalies error: %s", exc, exc_info=True)
+
+    async def _phase_scheduled(self) -> None:
+        """Run scheduled periodic tasks that are due (cron-style)."""
+        scheduler = self._scheduler or self._registry.scheduler
+        if scheduler is None:
+            return
+        try:
+            results = await scheduler.tick()
+            if results:
+                ok = sum(1 for r in results if r.get("status") == "ok")
+                skipped = sum(
+                    1 for r in results if r.get("status") == "skipped")
+                self.stats.scheduled_runs += ok
+                errs = len(results) - ok - skipped
+                if errs:
+                    self.stats.errors += errs
+                    for r in results:
+                        if r.get("status") not in ("ok", "skipped"):
+                            logger.warning(
+                                "Scheduled task failed: %s — %s",
+                                r.get("task"), r.get("error"),
+                            )
+                if ok:
+                    logger.info("Phase scheduled: %d task(s) ran", ok)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase scheduled error: %s", exc, exc_info=True)
+
+    async def _phase_initiative(self) -> None:
+        """Run initiative engine to generate autonomous action proposals."""
+        engine = self._registry.initiative_engine
+        if engine is None:
+            return
+
+        try:
+            engine.clear_context()
+            await self._feed_pending_tasks(engine)
+            await self._feed_neglected_contacts(engine)
+            await self._feed_commitment_reminders(engine)
+            await self._feed_introduction_candidates(engine)
+
+            initiatives = await engine.generate(
+                min_priority=self.config.initiative_confidence_threshold,
+                cooldown_tasks=float(os.environ.get(
+                    "COLONY_INITIATIVE_COOLDOWN_TASKS", "12",
+                )),
+                cooldown_contacts=float(os.environ.get(
+                    "COLONY_INITIATIVE_COOLDOWN_CONTACTS", "72",
+                )),
+            )
+
+            if self._in_quiet_hours():
+                initiatives = [i for i in initiatives if getattr(i, "priority", 0) >= 0.9]
+
+            # Deferred initiatives queued by later phases of the previous
+            # tick (e.g. skill-capture reviews from Phase 6c).
+            deferred = getattr(self, "_deferred_initiatives", None)
+            if deferred:
+                initiatives = list(initiatives) + deferred
+                self._deferred_initiatives = []
+
+            if initiatives:
+                logger.info("Phase initiative: %d new proposals", len(initiatives))
+            sm = getattr(self._registry, 'self_model', None)
+            perspective = getattr(sm, 'perspective', None)
+            if perspective is not None:
+                initiatives = perspective.rank(initiatives, load=sm.load())
+            self._pending_initiatives = initiatives
+            self.stats.initiatives_generated += len(initiatives)
+
+            # Capture context for payload building in _phase_execute
+            self._last_initiative_context = dict(getattr(engine, "_context", {}))
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase initiative error: %s", exc, exc_info=True)
+            self._pending_initiatives = []
+
+    async def _phase_thinking(self) -> None:
+        """Phase 5b: self-directed thinking (v0.17.0).
+
+        On a slow cadence (COLONY_THINKING_INTERVAL_SECS), hand the LLM a
+        situation report and let it propose novel initiatives the
+        data-reactive generators can't see. Results join the same
+        pending batch Phase 6 stores/delivers, so they inherit identical
+        dedup, quiet-hours, rate-limit, and approval treatment.
+        Disabled unless COLONY_ENABLE_INTERNAL_THINKING=true.
+        """
+        # Mode: off | shadow | live (COLONY_THINKING_MODE). Back-compat:
+        # COLONY_ENABLE_INTERNAL_THINKING=true means "live". The autonomy
+        # preset fills the unset case (explicit env always wins).
+        mode = os.environ.get("COLONY_THINKING_MODE", "").strip().lower()
+        if mode not in ("off", "shadow", "live"):
+            if os.environ.get(
+                    "COLONY_ENABLE_INTERNAL_THINKING", "false").lower() == "true":
+                mode = "live"
+            else:
+                from apsimo.util.autonomy_preset import resolve
+                mode = resolve("COLONY_THINKING_MODE",
+                               ("off", "shadow", "live"), "off")
+        if mode == "off":
+            return
+        router = self._registry.llm_router
+        if router is None:
+            return
+        thinker = getattr(self, "_thinker", None)
+        if thinker is None:
+            from apsimo.intelligence.components.self_directed_thinker import (
+                SelfDirectedThinker,
+            )
+
+            def _brief():
+                sm = getattr(self._registry, "self_model", None)
+                return sm.brief() if sm is not None else ""
+
+            def _bounds():
+                dm = getattr(self._registry, "directives", None)
+                return dm.context_brief() if dm is not None else ""
+
+            thinker = SelfDirectedThinker(router, self_brief_fn=_brief,
+                                          boundaries_fn=_bounds)
+            self._thinker = thinker
+        if not thinker.due():
+            return
+        thinker.mark_ran()
+        try:
+            situation = self._build_thinking_situation()
+            initiatives = await thinker.think(situation)
+            if not initiatives:
+                return
+
+            # P3 turns the legacy free-running thinker into a candidate
+            # generator only.  Its observations enter the scoped workspace;
+            # it may no longer write initiatives/projects in parallel with
+            # the canonical Concern -> ThoughtJob -> Project path.
+            try:
+                from apsimo.cognition.goal_spine import cognition_spine_exclusive
+                if cognition_spine_exclusive():
+                    workspace = getattr(self._registry, "workspace", None)
+                    if workspace is None:
+                        logger.warning(
+                            "P3 thinker candidates held: workspace unavailable")
+                        return
+                    _record_p3_thinker_candidates(workspace, initiatives)
+                    logger.info(
+                        "P3 thinker: converted %d proposal(s) to workspace candidates",
+                        len(initiatives),
+                    )
+                    return
+            except Exception:
+                logger.exception("P3 thinker candidate conversion failed")
+                return
+
+            # Package each thought into a well-formed Proposal and route it
+            # through the guarded (shadow-held, boundary-checked, rate-limited)
+            # delivery path. Nothing is sent while delivery shadow is on.
+            from apsimo.proposals import build_from_thinker, proposal_to_payload
+            delivery = self._registry.delivery
+            pstore = getattr(self._registry, "proposal_store", None)
+            fb = getattr(self._registry, "feedback_store", None)
+            n = 0
+            for init in initiatives:
+                try:
+                    prop = build_from_thinker(init)
+                    if prop is None:
+                        # Ungrounded thought: no honest why_it_helps, so it
+                        # does not ship (item 4).
+                        continue
+                    # Outcome-driven priority: decay proposal classes the owner
+                    # ignores/dismisses, boost the ones he acts on (item 3b).
+                    if fb is not None:
+                        try:
+                            prop.confidence = max(0.0, min(1.0,
+                                prop.confidence * fb.multiplier(prop.initiative_type)))
+                        except Exception:
+                            pass
+                    if delivery is not None:
+                        await self._route_reachout_delivery(proposal_to_payload(prop), delivery)
+                    if pstore is not None:
+                        pstore.add(prop)
+                    n += 1
+                except Exception:
+                    logger.debug("proposal routing failed", exc_info=True)
+            logger.info("Phase thinking[%s]: %d proposal(s) generated", mode, n)
+
+            # Only in LIVE mode do the thought-up items ALSO become internal
+            # work (research/knowledge initiatives the executor will run).
+            if mode == "live":
+                self._pending_initiatives = list(
+                    self._pending_initiatives or []) + initiatives
+                self.stats.initiatives_generated += len(initiatives)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase thinking error: %s", exc, exc_info=True)
+
+    def _build_thinking_situation(self) -> dict:
+        """Assemble the situation report for the thinking phase."""
+        situation: dict = {}
+        ctx = dict(getattr(self, "_last_initiative_context", {}) or {})
+        for key in ("pending_tasks", "neglected_contacts",
+                    "commitment_reminders"):
+            if ctx.get(key):
+                situation[key] = list(ctx[key])[:10]
+
+        goals = self._registry.goals
+        if goals is not None and hasattr(goals, "list_goals"):
+            try:
+                situation["active_goals"] = goals.list_goals(
+                    status="active", limit=20)
+                situation["blocked_goals"] = goals.list_goals(
+                    status="blocked", limit=10)
+            except Exception:
+                pass
+
+        pending = getattr(self, "_pending_initiatives", None) or []
+        situation["current_initiatives"] = [
+            getattr(i, "description", "") for i in pending][:20]
+
+        # Agent capability awareness (v0.18.0): the plugin reports the
+        # Hermes skill index into the "skills" observation domain, so the
+        # thinker proposes work the agent can actually do — and spots
+        # genuine skill gaps instead of guessing.
+        try:
+            from apsimo.api.routers.observations import (
+                get_observation_store,
+            )
+            obs_store = get_observation_store()
+            if obs_store is not None:
+                skills = obs_store.list("skills", limit=40)
+                if skills:
+                    situation["agent_skills"] = [
+                        {"name": o.entity_id,
+                         "description": str(
+                             (o.payload or {}).get("description", ""))[:120]}
+                        for o in skills]
+        except Exception:
+            pass
+        return situation
+
+    def _build_initiative_context(self, initiative: Any, type_value: str) -> dict:
+        """Build a focused, per-initiative context dict.
+
+        Instead of dumping the entire engine state (which leaks internal
+        context like all pending tasks, all neglected contacts, etc.), we
+        look up only the item relevant to this specific initiative.
+        """
+        raw_ctx = getattr(self, "_last_initiative_context", {})
+        entity_id = getattr(initiative, "entity_id", None)
+        desc = getattr(initiative, "description", "")
+
+        if type_value == "follow_up":
+            for item in raw_ctx.get("pending_tasks", []):
+                if item.get("entity_id") == entity_id:
+                    return {
+                        "blocked_goal": {
+                            "goal_id": entity_id,
+                            "title": item.get("description", desc),
+                            "days_pending": item.get("days_pending", 0),
+                        }
+                    }
+            return {}
+
+        if type_value == "relationship":
+            for contact in raw_ctx.get("neglected_contacts", []):
+                if contact.get("entity_id") == entity_id:
+                    return {
+                        "neglected_contact": {
+                            "contact_id": entity_id,
+                            "contact_name": contact.get("name"),
+                            "days_since_contact": contact.get("days_since_contact", 0),
+                        }
+                    }
+            return {}
+
+        if type_value == "commitment":
+            for c in raw_ctx.get("upcoming_commitments", []):
+                if c.get("commitment_id") == entity_id:
+                    return {
+                        "commitment": {
+                            "commitment_id": entity_id,
+                            "commitment_text": c.get("description"),
+                            "deadline": c.get("due_at"),
+                            "status": c.get("status"),
+                            "person_id": c.get("person_id"),
+                            "hours_until_due": c.get("hours_until_due"),
+                        }
+                    }
+            return {}
+
+        if type_value == "scheduling":
+            for slot in raw_ctx.get("scheduling_opportunities", []):
+                if slot.get("description") == desc:
+                    return {
+                        "upcoming_commitment": {
+                            "description": slot.get("description", ""),
+                            "hours_until_due": 0,  # not stored in opportunity dict
+                        }
+                    }
+            return {}
+
+        if type_value == "health":
+            for alert in raw_ctx.get("health_alerts", []):
+                if alert.get("metric") == entity_id:
+                    return {
+                        "health_alert": {
+                            "metric": entity_id,
+                            "value": alert.get("value"),
+                            "target": alert.get("target"),
+                        }
+                    }
+            return {}
+
+        if type_value == "capability_gap":
+            for gap in raw_ctx.get("capability_gaps", []):
+                if gap.get("id") == entity_id:
+                    return {"capability_gap": gap}
+            return {}
+
+        if type_value == "knowledge_acquisition":
+            for gap in raw_ctx.get("knowledge_gaps", []):
+                if gap.get("id") == entity_id:
+                    return {"knowledge_gap": gap}
+            return {}
+
+        if type_value == "behavioral_correction":
+            for pattern in raw_ctx.get("behavioral_patterns", []):
+                if pattern.get("id") == entity_id:
+                    return {"behavioral_pattern": pattern}
+            return {}
+
+        return {}
+
+    async def _phase_execute(self) -> None:
+        """Execute self-initiatives in the sidecar, then push remaining to delivery."""
+        engine = self._registry.initiative_engine
+        delivery = self._registry.delivery
+
+        for initiative in list(self._pending_initiatives):
+            if (not self.config.proposals_only
+                    and self.stats.actions_this_hour >= self.config.max_actions_per_hour):
+                logger.warning("Hourly action limit reached")
+                break
+
+            initiative_type = getattr(initiative, "type", "unknown")
+            type_value = initiative_type.value if hasattr(initiative_type, "value") else str(initiative_type)
+
+            is_self_initiative = type_value in {
+                "subsystem_health", "data_quality", "operational",
+                "capability_gap", "knowledge_acquisition", "behavioral_correction",
+            }
+
+            # Try auto-execute for self-initiatives
+            if is_self_initiative and engine is not None and not self.config.proposals_only:
+                try:
+                    exec_result = await engine.execute_initiative(initiative.id)
+                    result_status = exec_result.get("status")
+                    skill_result = exec_result.get("result")
+
+                    if result_status == "executed" and skill_result == "auto_fixed":
+                        self.stats.actions_executed += 1
+                        self.stats.actions_this_hour += 1
+                        logger.info("Auto-fixed initiative: %s", initiative.id)
+                        continue  # Don't push to delivery
+
+                    if result_status == "executed" and skill_result == "proposal_created":
+                        # Still push to delivery, but mark as proposed
+                        pass
+
+                    if result_status in ("no_skill", "not_self_initiative"):
+                        # No skill matched — push to delivery for human decision
+                        pass
+                except Exception as exc:
+                    logger.error("Auto-execution failed for %s: %s", initiative.id, exc)
+
+            # Build and push payload
+            try:
+                # Situational context snapshot (v0.16.0): persisted with the
+                # initiative so the agent gets it over the REST API, not just
+                # in push payloads. Carries the rationale and a capture
+                # timestamp (volatile types check it against their TTL).
+                initiative_context = self._build_initiative_context(initiative, type_value)
+                trigger_data = getattr(initiative, "trigger_data", None)
+                if trigger_data and not initiative_context:
+                    initiative_context = dict(trigger_data)
+                rationale = getattr(initiative, "rationale", "")
+                if rationale:
+                    initiative_context.setdefault("rationale", rationale)
+                initiative_context.setdefault(
+                    "context_captured_at",
+                    datetime.now(timezone.utc).isoformat(),
+                )
+                initiative_context.setdefault("candidate_id", str(initiative.id))
+
+                # Persist initiative before dispatch so it survives restarts
+                store = getattr(self._registry, "initiative_store", None)
+                if store:
+                    try:
+                        loop = asyncio.get_event_loop()
+                        create_call = functools.partial(
+                            store.create_with_outcome,
+                            type=type_value,
+                            description=getattr(initiative, "description", ""),
+                            priority=getattr(initiative, "priority", 0.5),
+                            rationale=rationale,
+                            action_hint=getattr(initiative, "action_hint", None),
+                            entity_id=getattr(initiative, "entity_id", None),
+                            dedup_key=getattr(initiative, "dedup_key", None),
+                            dedup_base=getattr(initiative, "dedup_base", None),
+                            context=initiative_context or None,
+                            expires_at=getattr(initiative, "expires_at", None),
+                            source_type=type_value,
+                            created_by="autonomy_loop",
+                        )
+                        stored, outcome = await loop.run_in_executor(None, create_call)
+                        # Dispatch ONLY genuinely-new work: a fresh row ("created") or a retried
+                        # failure ("reactivated"). An already-active instance, or one that already
+                        # ran this period, must not be re-dispatched. (This replaces the old
+                        # id-comparison guard, which compared the store's uuid to the engine's
+                        # logical id — never equal — and so skipped every fresh initiative.)
+                        if outcome not in ("created", "reactivated"):
+                            logger.debug("Initiative %s: %s, skipping dispatch",
+                                         getattr(initiative, "id", "?"), outcome)
+                            continue
+                        # Use the persisted id for the payload
+                        initiative_id = stored.id if stored else getattr(initiative, "id", str(uuid.uuid4()))
+                    except Exception as exc:
+                        logger.error("Failed to persist initiative, skipping dispatch: %s", exc)
+                        continue
+                else:
+                    initiative_id = getattr(initiative, "id", str(uuid.uuid4()))
+
+                if self.config.proposals_only:
+                    # Ranking and durable proposal creation are the complete
+                    # effect of this selected rollout. Do not wake legacy
+                    # executor skills or enqueue/deliver the proposal here.
+                    continue
+
+                # --- v0.13.0: Route AGENT_ACTION initiatives to task queue ---
+                action_hint = getattr(initiative, "action_hint", None) or ""
+                is_agent_action = (
+                    type_value == "agent_action"
+                    or action_hint.startswith("agent_")
+                )
+
+                if is_agent_action:
+                    await self._post_agent_action_to_queue(
+                        initiative, initiative_id, type_value, action_hint
+                    )
+                    continue  # Do NOT push to delivery bridge
+
+                payload = {
+                    "id": initiative_id,
+                    "type": type_value,
+                    "priority": getattr(initiative, "priority", 0.5),
+                    "title": getattr(initiative, "description", "").split(".")[0][:80] if getattr(initiative, "description", "") else "(no title)",
+                    "description": getattr(initiative, "description", ""),
+                    "rationale": getattr(initiative, "rationale", ""),
+                    "suggested_action": action_hint or "review_and_decide",
+                    "entity_id": getattr(initiative, "entity_id", None),
+                    "entity_type": type_value,
+                    "channel_hint": "home" if is_self_initiative else "dm",
+                    "context": initiative_context,
+                    "generated_at": datetime.now(timezone.utc).isoformat(),
+                }
+
+                if delivery:
+                    await self._route_reachout_delivery(payload, delivery)
+
+                # WebSocket broadcast
+                try:
+                    broadcast = _get_broadcast()
+                    broadcast({
+                        "type": "initiative",
+                        "occurred_at": datetime.now(timezone.utc).isoformat(),
+                        "payload": payload,
+                    })
+                except Exception:
+                    logger.warning("WebSocket broadcast failed (non-critical)")
+            except Exception as exc:
+                logger.error("Failed to push initiative: %s", exc)
+
+        self._pending_initiatives = []
+
+    @staticmethod
+    def _stored_initiative_delivery_payload(initiative: Any) -> dict:
+        initiative_type = getattr(initiative, "type", "unknown")
+        type_value = (
+            initiative_type.value
+            if hasattr(initiative_type, "value")
+            else str(initiative_type)
+        )
+        created_at = getattr(initiative, "created_at", None)
+        description = getattr(initiative, "description", "") or ""
+        return {
+            "id": str(getattr(initiative, "id", "")),
+            "type": type_value,
+            "priority": getattr(initiative, "priority", 0.5),
+            "title": description.split(".")[0][:80] if description else "(no title)",
+            "description": description,
+            "rationale": getattr(initiative, "rationale", "") or "",
+            "suggested_action": (
+                getattr(initiative, "action_hint", None) or "review_and_decide"
+            ),
+            "entity_id": getattr(initiative, "entity_id", None),
+            "entity_type": type_value,
+            "context": getattr(initiative, "context", None) or {},
+            "generated_at": (
+                created_at.isoformat()
+                if created_at is not None
+                else datetime.now(timezone.utc).isoformat()
+            ),
+        }
+
+    async def _rebuild_governed_delivery_replays(self, delivery: Any) -> None:
+        """Rebuild exact admitted replays after restart without admitting new work."""
+
+        getter = getattr(delivery, "governed_pending_delivery_ids", None)
+        initiative_store = getattr(self._registry, "initiative_store", None)
+        if not callable(getter) or initiative_store is None:
+            return
+        try:
+            pending_delivery_ids = set(getter(limit=100))
+        except Exception:
+            logger.exception("Could not read durable governed delivery identities")
+            return
+        if not pending_delivery_ids:
+            return
+        loop = asyncio.get_running_loop()
+        try:
+            initiatives = await loop.run_in_executor(
+                None,
+                functools.partial(
+                    initiative_store.list, status=["pending"], limit=1000
+                ),
+            )
+        except Exception:
+            logger.exception("Could not read pending initiatives for delivery rebuild")
+            return
+        for initiative in initiatives:
+            initiative_id = str(getattr(initiative, "id", "") or "")
+            initiative_type = getattr(initiative, "type", "unknown")
+            type_value = (
+                initiative_type.value
+                if hasattr(initiative_type, "value")
+                else str(initiative_type)
+            )
+            if not initiative_id:
+                continue
+            source_id = "initiative:" + initiative_id
+            delivery_id = "initiative:" + hashlib.sha256(
+                (type_value + "\0" + source_id).encode("utf-8")
+            ).hexdigest()
+            if delivery_id not in pending_delivery_ids:
+                continue
+            self._governed_delivery_replays[delivery_id] = (
+                self._stored_initiative_delivery_payload(initiative)
+            )
+            if len(self._governed_delivery_replays) >= 100:
+                break
+
+    async def _phase_governed_delivery_reconciliation(self) -> None:
+        """Re-poll a bounded set of admitted messages without a new trigger."""
+
+        delivery = getattr(self._registry, "delivery", None)
+        if delivery is None:
+            return
+        if not self._governed_delivery_replays:
+            await self._rebuild_governed_delivery_replays(delivery)
+        if not self._governed_delivery_replays:
+            return
+        # A hard bound prevents a large approval backlog from monopolizing the
+        # event loop. The next cadence continues from the same stable requests;
+        # the bridge itself suppresses HTTP until each row's next_poll_at.
+        for _delivery_id, payload in list(
+            self._governed_delivery_replays.items()
+        )[:25]:
+            try:
+                await self._route_reachout_delivery(copy.deepcopy(payload), delivery)
+            except Exception:
+                self.stats.errors += 1
+                logger.exception(
+                    "Governed delivery lifecycle replay failed for %s", _delivery_id
+                )
+
+    async def _recipient_is_owner(self, person_id: str, payload: dict) -> bool:
+        """True when a delivery is owner-directed (exempt from the outbound
+        third-party approval gate).
+
+        Proposals target the owner by construction. Otherwise resolve the
+        recipient identity: fail closed (treat as NON-owner, so the approval
+        gate engages) if the owner identity cannot be established.
+        """
+        if payload.get("entity_type") == "proposal":
+            return True
+        if not person_id or person_id == "owner":
+            return True
+        try:
+            from apsimo.identity.resolver import get_identity_resolver
+            resolver = get_identity_resolver()
+            return bool(await resolver.is_owner(person_id))
+        except Exception:
+            # Owner unresolved -> cannot prove owner-directed -> gate engages.
+            return False
+
+    async def _route_reachout_delivery(self, payload: dict, delivery: Any) -> bool:
+        """Sanitise, staleness-guard, rate-check and (shadow-)deliver ONE
+        reach-out initiative through the guarded Hermes path.
+
+        Shared by _phase_execute and _phase_startup_repush so both apply
+        identical gating (classification, sanitisation, staleness, quiet-hours
+        urgency cap, per-recipient rate limit). Internal initiatives are a
+        no-op here. Returns True only when a real push was sent.
+        """
+        from apsimo.delivery.classification import is_reachout
+        from apsimo.delivery import reachout_policy as rp
+
+        type_value = payload.get("type", "")
+        iid = payload.get("id")
+
+        # Reach-out initiatives AND proposals (a dedicated type) leave the
+        # machine; everything else is internal. reachout_types() is NOT
+        # overloaded -- proposals are handled as their own delivered type.
+        is_proposal = (type_value == "proposal")
+        if not is_reachout(type_value) and not is_proposal:
+            logger.debug("Initiative %s (%s) is internal — not routed to delivery",
+                         iid, type_value)
+            return False
+
+        # Boundary gate: never message about a subject the owner set off-limits.
+        directives = getattr(self._registry, "directives", None)
+        if directives is not None:
+            try:
+                from apsimo.directives import Action
+                verdict = directives.check(Action(
+                    kind="deliver",
+                    text=f"{payload.get('title','')} {payload.get('description','')}",
+                    target=payload.get("entity_id", "") or "",
+                    entity_id=payload.get("entity_id", "") or "",
+                    high_risk=True,
+                ))
+                if not verdict.allowed:
+                    logger.warning(
+                        "Reach-out %s (%s) REFUSED by boundary: %s",
+                        iid, type_value, verdict.reason,
+                    )
+                    return False
+            except Exception:
+                # An owner boundary we cannot evaluate must not be assumed
+                # permissive: fail CLOSED by default (a missed delivery is
+                # recoverable; messaging about a forbidden subject is not).
+                self.stats.boundary_check_errors += 1
+                from apsimo.directives.guard import boundary_fail_closed
+                if boundary_fail_closed():
+                    logger.warning(
+                        "Reach-out %s (%s) REFUSED: boundary_check_error "
+                        "(boundary check raised; failing closed)",
+                        iid, type_value, exc_info=True,
+                    )
+                    return False
+                logger.debug("delivery boundary check failed (allowing)", exc_info=True)
+
+        # Staleness guard: a long-overdue reach-out is noise, not a timely ping.
+        # Proposals are timely by construction and exempt.
+        if not is_proposal and rp.is_aged_out(payload):
+            logger.info(
+                "Reach-out %s (%s) aged out (%.1fd > %.1fd) — not delivered",
+                iid, type_value, rp.reachout_age_days(payload), rp.max_age_days(),
+            )
+            return False
+
+        # Clean the outward-facing text before it reaches Hermes.
+        payload = rp.sanitize_payload(payload)
+
+        # Resolve the ACTUAL recipient bucket + target the same way a real send
+        # would, so the rate gate binds per recipient and the shadow view
+        # matches reality.
+        transport = os.environ.get(
+            "COLONY_DELIVERY_TRANSPORT", "hermes_webhook"
+        ).strip().lower()
+        preview = None
+        if (
+            transport == "gateway"
+            and hasattr(delivery, "preview_initiative_async")
+        ):
+            try:
+                preview = await delivery.preview_initiative_async(payload)
+            except Exception as exc:
+                logger.warning("Delivery preview failed for %s: %s", iid, exc)
+        elif hasattr(delivery, "preview_initiative"):
+            try:
+                preview = delivery.preview_initiative(payload)
+            except Exception as exc:
+                logger.warning("Delivery preview failed for %s: %s", iid, exc)
+        person_id = (preview or {}).get("person_id") or payload.get("entity_id") or "owner"
+        raw_urgency = float(
+            (preview or {}).get("urgency", payload.get("priority", 0.5)) or 0.5
+        )
+        # Reach-out respects quiet hours unless explicitly urgent.
+        gate_urgency = rp.quiet_hours_urgency(payload, raw_urgency)
+
+        rate_limiter = getattr(delivery, "_rate_limiter", None)
+        allowed, reason = True, "ok"
+        if rate_limiter is not None:
+            allowed, reason = rate_limiter.can_deliver(person_id, urgency=gate_urgency)
+
+        if getattr(self.config, "delivery_shadow_mode", False):
+            # Shadow: log the intended (sanitised) delivery; send nothing,
+            # consume no budget.
+            self._observe_p8_outbound(payload, preview or {})
+            target = (preview or {}).get("target", {})
+            logger.info(
+                "SHADOW-DELIVERY reach-out id=%s type=%s recipient=%s target=%s "
+                "rate_allowed=%s(%s) urgency=%.2f(gate=%.2f) age=%.1fd title=%r",
+                iid, type_value, person_id, target, allowed, reason,
+                raw_urgency, gate_urgency, rp.reachout_age_days(payload),
+                (payload.get("title") or payload.get("description", ""))[:200],
+            )
+            return False
+
+        governed_admission_route = False
+        preview_target = (preview or {}).get("target", {})
+        preview_chat = (
+            preview_target.get("user_chat")
+            or preview_target.get("home_chat")
+            or ""
+        )
+        preview_platform, _, _preview_chat_id = preview_chat.partition(":")
+        if transport == "gateway" and hasattr(
+            delivery, "governed_gateway_admission_enabled"
+        ):
+            try:
+                governed_admission_route = (
+                    delivery.governed_gateway_admission_enabled(
+                        preview_platform,
+                    ) is True
+                )
+            except Exception:
+                governed_admission_route = False
+
+        # Legacy outbound third-party gate remains the default.  A deployment
+        # may instead opt one gateway transport into a downstream governed
+        # admission contract: that boundary owns bounded route/one-off
+        # authorization and must later return an exact, non-delivery admission
+        # receipt.  A mere gateway HTTP 200 is never enough in that mode.
+        recipient_is_owner = await self._recipient_is_owner(person_id, payload)
+        if not recipient_is_owner:
+            from apsimo.initiatives import standing_approvals
+            if (
+                not governed_admission_route
+                and not standing_approvals.is_approved(
+                    "outbound_third_party_delivery"
+                )
+            ):
+                logger.warning(
+                    "Reach-out %s (%s) to non-owner recipient %s BLOCKED: "
+                    "outbound third-party delivery requires owner approval "
+                    "(grant 'outbound_third_party_delivery')",
+                    iid, type_value, person_id,
+                )
+                return False
+
+        if not allowed:
+            logger.debug("Reach-out push rate-limited for %s: %s (urgency=%.2f)",
+                         person_id, reason, gate_urgency)
+            return False
+
+        # Content safety on the actual outbound text (secret leak / disclosure
+        # tier / injection / provenance). The ResponseGuard runs here on the
+        # real send path so it is not merely an opt-in endpoint: in shadow it
+        # logs, in enforce (COLONY_GUARD_MODE=enforce) it blocks a leaking
+        # proactive message before it leaves. Owner-directed delivery is
+        # authorized; third-party delivery already spent a bounded approval
+        # gate above.
+        guard_enforcing = (
+            os.environ.get("COLONY_GUARD_MODE", "").strip().lower()
+            == "enforce"
+        )
+        try:
+            from apsimo.api.routers.host import _response_guard
+            if _response_guard is None:
+                if guard_enforcing:
+                    logger.warning(
+                        "Reach-out %s BLOCKED: configured ResponseGuard is unavailable",
+                        iid,
+                    )
+                    return False
+            else:
+                configured_mode = getattr(_response_guard, "configured_mode", None)
+                configured_value = str(
+                    getattr(configured_mode, "value", configured_mode) or ""
+                ).strip().lower()
+                # Configuration sources are monotonic at this boundary: a
+                # stale in-process shadow instance cannot weaken an explicit
+                # deployment-level enforce request, while an enforce instance
+                # still strengthens an unset/shadow environment.
+                guard_enforcing = (
+                    guard_enforcing or configured_value == "enforce"
+                )
+                _msg = (payload.get("description") or payload.get("title") or "")
+                _tgt = (preview or {}).get("target", {})
+                _chat = _tgt.get("user_chat") or _tgt.get("home_chat") or ""
+                _plat, _, _cid = _chat.partition(":")
+                _authorized = recipient_is_owner
+                _guard_context = {
+                    "surface": "proactive_text",
+                    "target_contact_id": person_id,
+                    "target_gateway": _plat,
+                    "session_id": str(iid),
+                    "turn_id": str(iid),
+                    "authorized": _authorized,
+                }
+                _guard_result = await _response_guard.evaluate(
+                    response_text=_msg,
+                    **_guard_context,
+                )
+                _guard = _snapshot_proactive_verdict(_guard_result)
+                verdict_error = (
+                    _proactive_enforce_verdict_error(_guard, _msg)
+                    if guard_enforcing else None
+                )
+                if verdict_error is not None:
+                    logger.warning(
+                        "Reach-out %s BLOCKED: ResponseGuard returned an invalid "
+                        "enforce verdict (%s)",
+                        iid, verdict_error,
+                    )
+                    return False
+                guard_blocked = (
+                    _guard.decision != "allow"
+                    if guard_enforcing else _guard.blocked is True
+                )
+                if guard_blocked:
+                    # Enforce branch: one guarded regeneration attempt through
+                    # the rejection feedback loop. A loop-internal error never
+                    # overrides the guard BLOCK (fail closed on the block
+                    # side); only a revision the guard itself clears may ship.
+                    revised = None
+                    try:
+                        revised = await self._run_rejection_feedback(
+                            _msg, _guard, person_id=person_id, gateway=_plat,
+                            iid=iid, authorized=_authorized)
+                    except Exception:
+                        logger.debug("rejection feedback loop failed "
+                                     "(block stands)", exc_info=True)
+                    if revised and guard_enforcing:
+                        # The feedback loop is not an egress authority. Recheck
+                        # its exact revision at this boundary and require a
+                        # canonical ALLOW bound to those bytes before mutation.
+                        revised_result = await _response_guard.evaluate(
+                            response_text=revised,
+                            **_guard_context,
+                        )
+                        revised_guard = _snapshot_proactive_verdict(
+                            revised_result
+                        )
+                        revised_error = _proactive_enforce_verdict_error(
+                            revised_guard, revised
+                        )
+                        if (
+                            revised_error is not None
+                            or revised_guard.decision != "allow"
+                        ):
+                            logger.warning(
+                                "Reach-out %s BLOCKED: ResponseGuard did not "
+                                "authorize the exact revision (%s)",
+                                iid, revised_error or "decision is not allow",
+                            )
+                            return False
+                    if revised:
+                        logger.info(
+                            "Reach-out %s revised by rejection feedback loop "
+                            "after ResponseGuard block", iid)
+                        if payload.get("description"):
+                            payload["description"] = revised
+                        else:
+                            payload["title"] = revised
+                    else:
+                        logger.warning(
+                            "Reach-out %s BLOCKED by ResponseGuard (%s): %s",
+                            iid, _guard.decision,
+                            "; ".join(str(getattr(f, "name", f))
+                                      for f in (_guard.findings or [])[:4]))
+                        return False
+        except Exception:
+            if guard_enforcing:
+                logger.warning(
+                    "Reach-out %s BLOCKED: enforce ResponseGuard check failed",
+                    iid,
+                    exc_info=True,
+                )
+                return False
+            logger.debug(
+                "delivery ResponseGuard shadow check failed (allowing)",
+                exc_info=True,
+            )
+
+        # P8 is a write-only observer at this boundary: it sees a detached,
+        # bounded snapshot of the final sanitized/revised text. Its result is
+        # deliberately ignored and it cannot mutate transport-owned objects.
+        self._observe_p8_outbound(payload, preview or {})
+
+        if not getattr(self.config, "proactive_delivery_enabled", False):
+            logger.debug("Proactive delivery disabled — initiative stored for agent polling")
+            return False
+
+        # Transport selection (env-driven, generic):
+        #   hermes_webhook (default) -- POST the structured initiative to a
+        #     composing agent's webhook (push_initiative), which writes the
+        #     final owner-facing message itself.
+        #   gateway -- POST the sanitised text directly to the deployment's
+        #     message gateway /internal/deliver (push_to_gateway), for
+        #     deployments whose channel transport speaks the flat
+        #     {platform, chat_id, message} contract.
+        if transport == "gateway" and hasattr(delivery, "push_to_gateway"):
+            target = (preview or {}).get("target", {})
+            chat = target.get("user_chat") or target.get("home_chat") or ""
+            platform, _, chat_id = chat.partition(":")
+            message = (payload.get("description") or payload.get("title") or "").strip()
+            if not (platform and chat_id and message):
+                logger.warning(
+                    "Reach-out %s: gateway transport missing target/message "
+                    "(target=%r) — not delivered", iid, target,
+                )
+                return False
+            raw_source_id = str(iid or "")
+            if raw_source_id:
+                source_id = "initiative:" + raw_source_id
+            else:
+                # Older/custom producers may omit an initiative ID.  Preserve
+                # their delivery behavior while deriving a retry-stable,
+                # deployment-neutral source identity from the final sanitized
+                # initiative instead of generating a fresh UUID per attempt.
+                source_id = "initiative-derived:" + hashlib.sha256(
+                    json.dumps(
+                        payload,
+                        ensure_ascii=False,
+                        allow_nan=False,
+                        separators=(",", ":"),
+                        sort_keys=True,
+                        default=str,
+                    ).encode("utf-8")
+                ).hexdigest()
+            delivery_id = "initiative:" + hashlib.sha256(
+                (str(type_value) + "\0" + source_id).encode("utf-8")
+            ).hexdigest()
+            if (
+                governed_admission_route
+                and delivery_id not in self._governed_delivery_replays
+                and len(self._governed_delivery_replays) >= 100
+            ):
+                logger.error(
+                    "Governed delivery reconciliation backlog is full; "
+                    "refusing a new admission for %s", iid,
+                )
+                return False
+            outcome = await delivery.push_to_gateway(
+                platform=platform, chat_id=chat_id, message=message,
+                source=type_value,
+                delivery_id=delivery_id,
+                source_id=source_id,
+            )
+        else:
+            outcome = await delivery.push_initiative(payload)
+
+        transport_accepted = bool(outcome)
+        outcome_state = str(getattr(outcome, "admission_state", ""))
+        outcome_provider_delivered = getattr(outcome, "provider_delivered", None)
+        outcome_terminal = getattr(outcome, "terminal", None)
+        observation_new = getattr(outcome, "observation_new", True) is True
+        governed_admitted = bool(
+            governed_admission_route
+            and getattr(outcome, "contract", "") == "governed_admission_v1"
+            and transport_accepted
+            and outcome_provider_delivered is False
+            and outcome_state in {"accepted", "awaiting_approval"}
+            and outcome_terminal is False
+        )
+        governed_delivered = bool(
+            governed_admission_route
+            and getattr(outcome, "contract", "") == "governed_admission_v1"
+            and transport_accepted
+            and outcome_provider_delivered is True
+            and outcome_state == "delivered"
+            and outcome_terminal is True
+        )
+        governed_terminal_failure = bool(
+            governed_admission_route
+            and getattr(outcome, "contract", "") == "governed_admission_v1"
+            and not transport_accepted
+            and outcome_provider_delivered is False
+            and outcome_state in {"failed", "ambiguous"}
+            and outcome_terminal is True
+        )
+        governed_boundary_attested = bool(
+            governed_admitted or governed_delivered or governed_terminal_failure
+        )
+        if governed_admission_route and not governed_boundary_attested:
+            logger.warning(
+                "Governed gateway returned no permitted exact boundary attestation; "
+                "treating the attempt as failed"
+            )
+            transport_accepted = False
+        outcome_delivery_id = str(getattr(outcome, "delivery_id", "") or "")
+        if governed_admitted and outcome_delivery_id:
+            self._governed_delivery_replays[outcome_delivery_id] = copy.deepcopy(payload)
+        elif (governed_delivered or governed_terminal_failure) and outcome_delivery_id:
+            self._governed_delivery_replays.pop(outcome_delivery_id, None)
+        provider_delivered = bool(
+            governed_delivered
+            if governed_admission_route
+            else (
+                transport_accepted
+                and getattr(outcome, "provider_delivered", transport_accepted) is True
+            )
+        )
+
+        # Self-model delivery success means provider delivery, never admission
+        # to an approval/dispatch queue.  A rejected transport remains a real
+        # failure; a governed pending admission is neither.
+        sm = getattr(self._registry, "self_model", None)
+        if sm is not None and observation_new:
+            try:
+                if provider_delivered:
+                    sm.record("delivery", "success")
+                elif governed_terminal_failure or not transport_accepted:
+                    sm.record("delivery", "failure")
+            except Exception:
+                pass
+        if provider_delivered and observation_new:
+            # Consume the per-recipient rate budget so the 3/day + cooldown
+            # caps actually bind (the push path previously never recorded).
+            if rate_limiter is not None:
+                try:
+                    rate_limiter.record_delivery(person_id)
+                except Exception:
+                    logger.debug("record_delivery failed", exc_info=True)
+            self.stats.actions_executed += 1
+            self.stats.actions_this_hour += 1
+            logger.info("Pushed initiative: %s -> %s", iid, person_id)
+            try:
+                from apsimo.api.routers.host import _telemetry
+                if _telemetry is not None:
+                    await _telemetry.touch("last_initiative_at")
+            except Exception:
+                logger.warning("Telemetry touch failed (non-critical)")
+        elif governed_admitted and observation_new:
+            logger.info(
+                "Admitted initiative pending provider delivery: %s -> %s (%s)",
+                iid, person_id, getattr(outcome, "admission_state", "pending"),
+            )
+        elif governed_terminal_failure and observation_new:
+            logger.warning(
+                "Governed initiative reached terminal non-delivery: %s -> %s (%s)",
+                iid, person_id, outcome_state,
+            )
+        return provider_delivered
+
+    def _observe_p8_outbound(self, payload: dict, preview: dict) -> None:
+        """Best-effort, synchronous journal hook for non-real-time text.
+
+        The runtime itself enforces explicit shadow mode and excludes all
+        real-time voice surfaces.  Exceptions remain advisory and therefore
+        never change the established delivery result.
+        """
+        runtime = getattr(self._registry, "p8", None)
+        if runtime is None:
+            return
+        try:
+            context = payload.get("context")
+            context = context if isinstance(context, dict) else {}
+            values = context.get("fact_refs") or payload.get("fact_refs") or ()
+            if not isinstance(values, (list, tuple)):
+                values = ()
+            fact_refs = [
+                str(value).strip()[:256]
+                for value in values[:64]
+                if str(value).strip()
+            ]
+            target = preview.get("target")
+            target = target if isinstance(target, dict) else {}
+            payload_snapshot = {
+                "id": str(payload.get("id") or "")[:256],
+                # Strings are immutable; preserve the exact text that may ship
+                # so the sample digest is truthful. The simulator's own size
+                # bound may reject it after sampling, leaving incomplete
+                # coverage rather than a false truncated evaluation.
+                "title": str(payload.get("title") or ""),
+                "description": str(payload.get("description") or ""),
+                "context": {"fact_refs": fact_refs},
+            }
+            preview_snapshot = {
+                "person_id": str(
+                    preview.get("person_id") or "")[:256],
+                "target": {
+                    "user_chat": str(
+                        target.get("user_chat") or "")[:512],
+                    "home_chat": str(
+                        target.get("home_chat") or "")[:512],
+                },
+            }
+            runtime.observe_outbound_payload(
+                payload_snapshot, preview_snapshot)
+        except Exception:
+            logger.debug("P8 outbound shadow observation failed", exc_info=True)
+
+    def _get_rejection_store(self) -> Any:
+        """Lazy durable RejectionStore under the state dir (best-effort)."""
+        if not hasattr(self, "_rejection_store"):
+            self._rejection_store = None
+            try:
+                from pathlib import Path
+                from apsimo.gate.rejection import RejectionStore
+                state_dir = Path(os.environ.get(
+                    "COLONY_STATE_DIR", os.path.expanduser("~/.colony")))
+                self._rejection_store = RejectionStore(
+                    str(state_dir / "colony-gate-rejections.db"))
+            except Exception:
+                logger.debug("RejectionStore unavailable", exc_info=True)
+        return self._rejection_store
+
+    async def _run_rejection_feedback(self, text: str, guard_result: Any, *,
+                                      person_id: str, gateway: str,
+                                      iid: Any, authorized: bool) -> Optional[str]:
+        """One rejection-feedback cycle for a proactive message the guard
+        blocked in enforce mode. Returns the guard-cleared revision, or None
+        when no clean revision exists (the block stands). Regeneration uses
+        the registry's LLM router when wired; without one the loop records
+        the rejection and the block stands."""
+        from apsimo.api.routers.host import _response_guard
+        from apsimo.gate.rejection import RejectionFeedbackLoop
+        if _response_guard is None:
+            return None
+
+        regen = None
+        llm = getattr(self._registry, "llm_router", None)
+        if llm is not None and hasattr(llm, "complete"):
+            async def regen(prompt_fragment: str, blocked_text: str):
+                resp = await llm.complete(
+                    [{"role": "system",
+                      "content": ("You revise outbound messages that were "
+                                  "blocked by a safety gate. Reply with ONLY "
+                                  "the revised message text.")},
+                     {"role": "user",
+                      "content": (f"{prompt_fragment}\n\n"
+                                  f"Original message:\n{blocked_text}")}],
+                    context={"task": "guard_revision"})
+                return getattr(resp, "content", None)
+
+        floop = RejectionFeedbackLoop(
+            _response_guard, store=self._get_rejection_store(),
+            regenerate=regen)
+        res = await floop.run(
+            text, initial_result=guard_result,
+            surface="proactive_text",
+            target_contact_id=person_id, target_gateway=gateway,
+            session_id=str(iid), turn_id=str(iid), authorized=authorized)
+        return res.payload if (res.passed and res.payload) else None
+
+    async def _phase_observation_sync(self) -> None:
+        """Request fresh observations for stale domains (v0.16.0).
+
+        The agent is Colony's sensor array: when a domain's newest
+        observation outlives its sync interval, post a read-only
+        ``agent_sync_<domain>`` job to the task queue. The agent claims
+        it, observes through its own Hermes connections, and POSTs
+        snapshots back to /v1/host/observations. Colony never calls
+        external APIs itself.
+        """
+        task_queue = getattr(self._registry, "task_queue", None)
+        if task_queue is None:
+            return
+        try:
+            from apsimo.api.routers.observations import get_observation_store
+            obs_store = get_observation_store()
+        except Exception:
+            obs_store = None
+        if obs_store is None:
+            return
+
+        from apsimo.initiatives.action_registry import OBSERVATION_SYNC_ACTIONS
+        from apsimo.observations.store import OBSERVATION_SYNC_INTERVALS
+
+        enabled = os.environ.get(
+            "COLONY_SYNC_DOMAINS",
+            "coding,task,calendar,research,project,system",
+        )
+        now = datetime.now(timezone.utc)
+
+        for domain in (d.strip() for d in enabled.split(",")):
+            action = OBSERVATION_SYNC_ACTIONS.get(domain)
+            if action is None:
+                continue
+            interval = OBSERVATION_SYNC_INTERVALS.get(domain, 3600)
+            try:
+                age = obs_store.domain_age_seconds(domain)
+            except Exception:
+                continue
+            if age is not None and age < interval:
+                continue
+            last_request = self._last_sync_request.get(domain)
+            if last_request and (now - last_request).total_seconds() < interval:
+                continue  # already asked; the agent may just be slow
+            try:
+                bucket = int(now.timestamp() // max(interval, 300))
+                await task_queue.submit(
+                    task_type="agent_action",
+                    priority="normal",
+                    params={
+                        "action_hint": action,
+                        "domain": domain,
+                        "risk": "read_only",
+                        "description": (
+                            f"Observe the {domain} domain through your own "
+                            f"connections and report snapshots to Colony"
+                        ),
+                        "report_to": "/v1/host/observations",
+                        "report_example": {
+                            "domain": domain,
+                            "reported_by": "<your agent id>",
+                            "observations": [
+                                {"entity_id": "<stable id>", "payload": {}}
+                            ],
+                        },
+                    },
+                    idempotency_key=f"agent_sync:{domain}:{bucket}",
+                )
+                self._last_sync_request[domain] = now
+                logger.info(
+                    "Requested %s observation sync (domain age: %s)",
+                    domain,
+                    f"{age:.0f}s" if age is not None else "never observed",
+                )
+            except Exception as exc:
+                logger.warning("Observation sync request failed for %s: %s", domain, exc)
+
+    async def _post_agent_action_to_queue(
+        self,
+        initiative: Any,
+        initiative_id: str,
+        type_value: str,
+        action_hint: str,
+    ) -> None:
+        """Post an AGENT_ACTION initiative to the task queue (v0.13.0).
+
+        Gated actions are posted as BLOCKED awaiting owner approval; the
+        rest are posted as QUEUED for immediate claiming. What counts as
+        gated depends on the immutable effect floor: every non-read-only
+        mutation, disclosure, destructive, or outbound action requires a
+        canonical direct decision or exact bounded grant. Graduated policy is
+        retained for presentation compatibility, not execution authority.
+        """
+        task_queue = getattr(self._registry, "task_queue", None)
+        if task_queue is None:
+            logger.warning("No task_queue available, skipping agent_action: %s", initiative_id)
+            return
+
+        # v0.16.0: action_hint must be a named capability in the action
+        # registry. Initiatives are built from graph data that can include
+        # untrusted content — an unregistered hint NEVER reaches the queue.
+        # The initiative stays stored (visible to the agent as information)
+        # but nothing executes it.
+        from apsimo.initiatives.action_registry import (
+            RiskTier,
+            classify_agent_action,
+            get_approval_policy,
+        )
+
+        policy = get_approval_policy()
+        verdict = classify_agent_action(action_hint, policy=policy)
+        if not verdict["executable"]:
+            logger.warning(
+                "action_hint %r is not in the action registry — initiative "
+                "%s stored but NOT queued for execution",
+                action_hint, initiative_id,
+            )
+            return
+
+        legacy_auto_approve_requested = (
+            os.environ.get("COLONY_AGENT_AUTO_APPROVE", "false").lower()
+            == "true"
+        )
+
+        # Mirror _phase_execute's fallback: when there is no focused context for this type,
+        # carry the initiative's own trigger_data. Agent_action initiatives (e.g. a deliverable)
+        # stash their executable params there — including the recipient the graduated policy
+        # resolves to decide auto-approval — so the worker and the gate both see them.
+        action_context = self._build_initiative_context(initiative, type_value)
+        if not action_context:
+            trigger_data = getattr(initiative, "trigger_data", None)
+            if trigger_data:
+                action_context = dict(trigger_data)
+
+        job_payload = {
+            "initiative_id": initiative_id,
+            "action_hint": action_hint,
+            "description": getattr(initiative, "description", ""),
+            "entity_id": getattr(initiative, "entity_id", None),
+            "risk": verdict["risk"],
+            # Compatibility field retained for old workers, but the historical
+            # env toggle is no longer authority and is always projected false.
+            "auto_approve": False,
+            "context": action_context,
+        }
+
+        # A contact-store match is identity/context, not execution authority.
+        # Outbound actions remain gated until a durable human/bounded decision
+        # (phone or Operator Deck) is consumed. A future server-issued target
+        # and transport attestation may safely restore a graduated fast path.
+
+        # Gated actions require HUMAN OWNER approval — the agent and legacy
+        # environment toggles cannot approve mutations.
+        is_gated = bool(verdict["requires_approval"])
+        job_payload["destructive"] = is_gated  # legacy field name, kept for workers
+        if legacy_auto_approve_requested and is_gated:
+            logger.warning(
+                "Ignoring retired COLONY_AGENT_AUTO_APPROVE for effectful %s",
+                action_hint,
+            )
+
+        # v0.17.0: gated jobs are created directly in BLOCKED so no worker
+        # can claim them in the window before a post-hoc transition lands.
+        gate_pending = is_gated
+
+        # v0.18.0: non-read-only jobs that the POLICY (not the legacy env
+        # bypass) waved through get a visible audit trail.
+        policy_auto_pass = (
+            not is_gated and verdict["risk"] != RiskTier.READ_ONLY.value
+        )
+        if gate_pending:
+            job_tags = {"blocked_reason": "awaiting_owner_approval"}
+        elif policy_auto_pass:
+            job_tags = {
+                "auto_approved_by_policy": policy,
+                "risk": str(verdict["risk"]),
+            }
+        else:
+            job_tags = None
+
+        try:
+            from apsimo.task_queue.models import JobStatus
+
+            job_result = await task_queue.submit(
+                task_type="agent_action",
+                priority="high" if getattr(initiative, "priority", 0.5) > 0.7 else "normal",
+                params=job_payload,
+                idempotency_key=f"agent_action:{action_hint}:{getattr(initiative, 'entity_id', 'global')}",
+                initial_status=JobStatus.BLOCKED if gate_pending else None,
+                tags=job_tags,
+            )
+            job_id = job_result.get("id")
+            logger.info("Posted agent_action job %s for initiative %s", job_id, initiative_id)
+
+            # QueueManager is the sole approval-at-birth owner. Read its
+            # server-stamped result instead of independently consuming grants
+            # or creating a second request in the autonomy loop.
+            approval_request = None
+            bounded_grant = None
+            if gate_pending and job_id:
+                stored_job = await task_queue.queue.get_job(job_id)
+                stamped = dict(stored_job.tags or {}) if stored_job else {}
+                if (
+                    stored_job is not None
+                    and stored_job.status is JobStatus.QUEUED
+                    and stamped.get("approval_provenance")
+                    == "server_bounded_grant"
+                ):
+                    bounded_grant = {
+                        "grant_id": stamped.get("bounded_grant_id"),
+                    }
+                    gate_pending = False
+                elif (
+                    stored_job is not None
+                    and stored_job.status is JobStatus.QUEUED
+                    and stamped.get("approval_provenance")
+                    == "server_direct_decision"
+                ):
+                    gate_pending = False
+                elif stamped.get("approval_request_id"):
+                    approval_request = {
+                        "request_id": stamped["approval_request_id"],
+                        "action_digest": stamped.get("action_digest"),
+                    }
+
+            if bounded_grant is not None and job_id:
+                logger.info(
+                    "Bounded grant %s authorized %s job %s",
+                    bounded_grant["grant_id"], verdict["risk"], job_id,
+                )
+                try:
+                    from apsimo.events.broadcaster import emit as broadcast
+                    broadcast("action_auto_approved", {
+                        "job_id": job_id,
+                        "initiative_id": initiative_id,
+                        "action_hint": action_hint,
+                        "risk": verdict["risk"],
+                        "policy": "bounded_grant",
+                        "grant_id": bounded_grant["grant_id"],
+                    })
+                except Exception:
+                    pass
+
+            if policy_auto_pass and job_id:
+                logger.info(
+                    "Auto-approved %s job %s (%s: %s)",
+                    verdict["risk"], job_id, policy, verdict["reason"],
+                )
+                try:
+                    from apsimo.events.broadcaster import emit as broadcast
+                    broadcast("action_auto_approved", {
+                        "job_id": job_id,
+                        "initiative_id": initiative_id,
+                        "action_hint": action_hint,
+                        "risk": verdict["risk"],
+                        "policy": policy,
+                        "reason": verdict["reason"],
+                    })
+                except Exception:
+                    pass
+
+            # Update initiative with job_id
+            store = getattr(self._registry, "initiative_store", None)
+            if store and job_id:
+                try:
+                    loop = asyncio.get_event_loop()
+                    await loop.run_in_executor(
+                        None,
+                        lambda sid=initiative_id, jid=job_id: store.update(sid, job_id=jid, status="assigned"),
+                    )
+                except Exception as exc:
+                    logger.warning("Failed to link initiative %s to job %s: %s", initiative_id, job_id, exc)
+
+            # mutating/outbound and not auto-approved → blocked awaiting owner
+            if gate_pending and job_id:
+                logger.info(
+                    "Blocked %s job %s awaiting owner approval",
+                    verdict["risk"], job_id,
+                )
+                # Push approval request to delivery
+                delivery = self._registry.delivery
+                if delivery and hasattr(delivery, "push_initiative"):
+                    # Approval requests must ALWAYS surface — proactive_delivery_enabled
+                    # gates Colony's *own* proactive outreach, not the owner's need to
+                    # unblock a gated job. Gating this dropped the request silently and
+                    # left the job blocked forever.
+                    await delivery.push_initiative({
+                        "id": initiative_id,
+                        "type": "agent_action",
+                        "priority": getattr(initiative, "priority", 0.5),
+                        "title": f"Approval required: {getattr(initiative, 'description', '')[:60]}",
+                        "description": getattr(initiative, "description", ""),
+                        "rationale": getattr(initiative, "rationale", ""),
+                        "suggested_action": "colony_approve_initiative",
+                        "entity_id": getattr(initiative, "entity_id", None),
+                        "channel_hint": "dm",
+                        "context": {
+                            "job_id": job_id,
+                            "action_hint": action_hint,
+                            "approval_request_id": (
+                                approval_request.get("request_id")
+                                if approval_request else None
+                            ),
+                            "action_digest": (
+                                approval_request.get("action_digest")
+                                if approval_request else None
+                            ),
+                        },
+                        "generated_at": datetime.now(timezone.utc).isoformat(),
+                    })
+
+            # Only count as executed if the job was not blocked awaiting approval
+            if not gate_pending:
+                self.stats.actions_executed += 1
+                self.stats.actions_this_hour += 1
+        except Exception as exc:
+            logger.error("Failed to post agent_action to queue: %s", exc)
+
+    async def _feed_pending_tasks(self, engine: Any) -> None:
+        """Feed active goals as pending tasks, respecting cooldown.
+
+        Filters out abandoned and completed goals so the autonomy loop
+        does not generate follow-up initiatives for dead tasks forever.
+        An inferred proposal is awaiting acceptance, not an undertaking.
+        """
+        goals = self._registry.goals
+        if goals is None:
+            return
+
+        try:
+            from apsimo.cognition.goal_spine import cognition_spine_exclusive
+            if cognition_spine_exclusive():
+                engine.add_context("pending_tasks", [])
+                return
+        except Exception:
+            pass
+
+        try:
+            # Use get_active_tasks which respects cooldown and snooze (v0.7.10)
+            cooldown_tasks = float(os.environ.get(
+                "COLONY_INITIATIVE_COOLDOWN_TASKS", "12",
+            ))
+
+            if hasattr(goals, "get_active_tasks"):
+                active = goals.get_active_tasks(cooldown_hours=cooldown_tasks)
+                pending_tasks = []
+                for goal in active:
+                    # Skip abandoned / completed / cancelled goals
+                    g_status = getattr(goal, "status", None)
+                    if g_status in ("abandoned", "completed", "cancelled"):
+                        continue
+                    if g_status == "proposed" and getattr(goal, "source", None) == "inferred":
+                        continue
+                    days_pending = 0
+                    if goal.created_at:
+                        days_pending = (datetime.now(timezone.utc) - goal.created_at).total_seconds() / 86400
+                    pending_tasks.append({
+                        "description": goal.title or "pending task",
+                        "days_pending": days_pending,
+                        "entity_id": goal.goal_id,
+                    })
+            else:
+                # Fallback for stores without get_active_tasks
+                blocked = goals.list_goals(status="blocked", limit=20) if hasattr(goals, "list_goals") else []
+                pending_tasks = []
+                for goal in blocked:
+                    # Skip abandoned / completed / cancelled goals
+                    if isinstance(goal, dict):
+                        g_status = goal.get("status", "")
+                    else:
+                        g_status = getattr(goal, "status", "")
+                    if g_status in ("abandoned", "completed", "cancelled"):
+                        continue
+                    created = goal.created_at
+                    days_pending = 0
+                    if created:
+                        days_pending = (datetime.now(timezone.utc) - created).total_seconds() / 86400
+                    # Handle both dict and object representations
+                    if isinstance(goal, dict):
+                        entity_id = goal.get("context", {}).get("contact_id") if goal.get("context") else goal.get("goal_id")
+                    else:
+                        ctx = getattr(goal, "context", None)
+                        entity_id = ctx.get("contact_id") if ctx else getattr(goal, "goal_id", None)
+                    pending_tasks.append({
+                        "description": goal.title or "blocked goal",
+                        "days_pending": days_pending,
+                        "entity_id": entity_id,
+                    })
+
+            # Always set pending_tasks so graph loader doesn't fall back to stale
+            # graph data when the SQL store has no active goals (Bug 41).
+            engine.add_context("pending_tasks", pending_tasks)
+        except Exception as e:
+            logger.warning("Failed to feed pending tasks: %s", e)
+
+    async def _feed_neglected_contacts(self, engine: Any) -> None:
+        """Feed contacts with declining affect AND genuine neglect.
+
+        Combines affect-store signals with graph-based days-since-contact.
+        Only feeds contacts that have both declining affect AND no recent
+        interaction (≥7 days).  Skips the host's own contact.
+        """
+        affect = self._registry.affect_store
+        if affect is None:
+            return
+
+        # Owner exclusion is a relationship-domain policy (the agent must
+        # not "check in with" its own operator) — fail closed when the
+        # owner identity can't be established. Other domains (commitment,
+        # calendar, agent_action) legitimately target the owner and must
+        # NOT inherit this filter.
+        from apsimo.identity.resolver import (
+            OwnerIdentityError,
+            get_identity_resolver,
+        )
+        resolver = get_identity_resolver()
+        try:
+            await resolver.owner_identities()
+        except OwnerIdentityError as exc:
+            logger.critical(
+                "Owner identity unresolved — neglected-contact feed "
+                "disabled (fail closed): %s", exc,
+            )
+            return
+
+        try:
+            states = affect.get_all_states() if hasattr(affect, "get_all_states") else []
+            neglected = []
+
+            for state in states[:20]:
+                contact_id = state.get("contact_id")
+                if not contact_id or await resolver.is_owner(contact_id):
+                    continue
+
+                # Only sustained decline, not a single bad event
+                if hasattr(affect, "detect_sustained_decline"):
+                    if not affect.detect_sustained_decline(contact_id, min_events=3):
+                        continue
+                else:
+                    # Fallback: declining trend + negative valence
+                    if state.get("trend") != "declining":
+                        continue
+                    if state.get("current_valence", 0) >= -0.3:
+                        continue
+
+                neglected.append({
+                    "name": contact_id,
+                    "entity_id": contact_id,
+                    "days_since_contact": 7,  # minimum threshold; engine loads exact days from graph
+                })
+
+            if neglected:
+                engine.add_context("neglected_contacts", neglected)
+        except Exception as e:
+            logger.warning("Failed to feed neglected contacts: %s", e)
+
+    async def _feed_introduction_candidates(self, engine: Any) -> None:
+        """Feed pairs of contacts the agent might organically introduce.
+
+        Pairs share related work and both sit above the trust floor; the engine
+        turns each into an OWNER-APPROVED introduction proposal (never an
+        auto-executed action). Owner exclusion fails closed. Disabled by setting
+        COLONY_INTROS_ENABLED=false; trust floor via COLONY_INTRO_TRUST_FLOOR.
+        """
+        if os.environ.get("COLONY_INTROS_ENABLED", "true").lower() != "true":
+            return
+        contacts = getattr(self._registry, "contacts", None)
+        if contacts is None or not hasattr(contacts, "introduction_candidates"):
+            return
+
+        from apsimo.identity.resolver import (
+            OwnerIdentityError,
+            get_identity_resolver,
+            get_owner_contact_id,
+        )
+        resolver = get_identity_resolver()
+        try:
+            await resolver.owner_identities()
+        except OwnerIdentityError as exc:
+            logger.critical(
+                "Owner identity unresolved — introduction feed disabled "
+                "(fail closed): %s", exc,
+            )
+            return
+
+        try:
+            floor = os.environ.get("COLONY_INTRO_TRUST_FLOOR", "regular")
+            candidates = await contacts.introduction_candidates(
+                trust_floor=floor,
+                owner_contact_id=get_owner_contact_id(),
+                limit=10,
+            )
+            if candidates:
+                engine.add_context("introduction_candidates", candidates)
+        except Exception as e:
+            logger.warning("Failed to feed introduction candidates: %s", e)
+
+    async def _feed_commitment_reminders(self, engine: Any) -> None:
+        """Feed upcoming/overdue commitments for COMMITMENT initiatives.
+
+        v0.16.0: commitments are first-class COMMITMENT initiatives
+        (durable context, dedup ``commitment:{id}``) instead of being
+        flattened into anonymous scheduling opportunities. The owner is a
+        legitimate subject here.
+        """
+        commitments = self._registry.commitment_store
+        if commitments is None:
+            return
+
+        try:
+            # CommitmentStore.list() returns {"commitments": [...], "total": N}.
+            # Include 'overdue': a flipped item is MORE deserving of an
+            # initiative, not invisible to it.
+            result = commitments.list(status=["pending", "overdue"], limit=20) if hasattr(commitments, "list") else {"commitments": []}
+            active = result.get("commitments", [])
+
+            now = datetime.now(timezone.utc)
+            upcoming = []
+
+            for c in active:
+                due = c.get("due_at")
+                if not due:
+                    continue
+
+                if isinstance(due, str):
+                    due = datetime.fromisoformat(due.replace("Z", "+00:00"))
+
+                hours_until = (due - now).total_seconds() / 3600
+
+                # Surface anything due in the next 48h, plus overdue
+                # commitments up to a week old (they need follow-up most).
+                if -168 < hours_until < 48:
+                    upcoming.append({
+                        "commitment_id": c.get("id"),
+                        "description": c.get("description", "untitled"),
+                        "due_at": due.isoformat(),
+                        "hours_until_due": hours_until,
+                        "overdue": hours_until <= 0,
+                        "status": c.get("status", "pending"),
+                        "person_id": c.get("person_id"),
+                        # carried through so the initiative engine can route a
+                        # deliverable (metadata.kind == "deliverable") to an
+                        # agent_action that actually SENDS it, vs a plain reminder.
+                        "metadata": c.get("metadata") or {},
+                        "source_type": c.get("source_type"),
+                    })
+
+            if upcoming:
+                engine.add_context("upcoming_commitments", upcoming)
+        except Exception as e:
+            logger.warning("Failed to feed commitment reminders: %s", e)
+
+    async def _phase_job_writeback(self) -> None:
+        """Phase 6c (v0.17.0): close the act → learn loop.
+
+        Completed/failed agent jobs become episodic memories, advance
+        their goals, complete their linked initiatives, and broadcast
+        events. Before this phase, agent work landed in the queue DB and
+        was invisible to memory — Colony could act but never learn from
+        acting. Idempotent via the ``memory_synced`` job tag; a poison
+        job is retried up to 3 ticks then tagged off.
+        """
+        task_queue = getattr(self._registry, "task_queue", None)
+        if task_queue is None:
+            return
+        qm = getattr(task_queue, "queue", None) or task_queue
+        if not hasattr(qm, "get_jobs_by_status"):
+            return
+        from apsimo.task_queue.models import JobStatus
+
+        try:
+            done = list(await qm.get_jobs_by_status(JobStatus.COMPLETED))
+            done += list(await qm.get_jobs_by_status(JobStatus.FAILED))
+        except Exception as exc:
+            logger.debug("Job writeback: queue scan failed: %s", exc)
+            return
+
+        synced = 0
+        for job in done:
+            tags = job.tags or {}
+            if tags.get("memory_synced") == "true":
+                continue
+            if job.job_type != "agent_action":
+                continue
+            action_hint = (job.payload or {}).get("action_hint", "")
+            if str(action_hint).startswith("agent_sync_"):
+                # Observation syncs already land in the observation store;
+                # recording them as memories would be routine-plumbing noise.
+                await self._tag_job_synced(qm, job)
+                continue
+            try:
+                await self._writeback_one_job(job)
+                await self._tag_job_synced(qm, job)
+                synced += 1
+            except Exception as exc:
+                attempts = int(tags.get("memory_sync_attempts", "0")) + 1
+                logger.warning("Job writeback failed for %s (attempt %d): %s",
+                               job.job_id, attempts, exc)
+                new_tags = {"memory_sync_attempts": str(attempts)}
+                if attempts >= 3:
+                    new_tags["memory_synced"] = "true"  # give up, stop retrying
+                try:
+                    if hasattr(qm, "merge_job_tags"):
+                        await qm.merge_job_tags(job.job_id, new_tags)
+                    else:
+                        await qm.update_job_status(job.job_id, job.status,
+                                                   tags=new_tags)
+                except Exception:
+                    pass
+        if synced:
+            logger.info("Phase job-writeback: %d agent job(s) fed back to memory",
+                        synced)
+
+    @staticmethod
+    async def _tag_job_synced(qm: Any, job: Any) -> None:
+        # Tag-only merge: the job is terminal (completed/failed), so
+        # update_job_status would refuse it. merge_job_tags persists the
+        # idempotency marker so this finished job is not re-written every
+        # cycle. Falls back to update_job_status on older queue managers.
+        # A failed tag write means this job WILL be re-processed next cycle —
+        # log it loudly rather than silently looping (the bug class this guards).
+        if hasattr(qm, "merge_job_tags"):
+            ok = await qm.merge_job_tags(job.job_id, {"memory_synced": "true"})
+            if ok is False:
+                logger.warning(
+                    "Writeback could not persist memory_synced on job %s; it "
+                    "will be re-processed next cycle (re-written to memory).",
+                    job.job_id)
+        else:
+            await qm.update_job_status(job.job_id, job.status,
+                                       tags={"memory_synced": "true"})
+
+    async def _writeback_one_job(self, job: Any) -> None:
+        """Propagate one finished agent job to goals, memory, initiatives."""
+        result = job.result
+        payload = job.payload or {}
+        reported_succeeded = bool(result is not None and result.succeeded)
+        tags = job.tags or {}
+        operational_only = (
+            tags.get("operational_completion_only") == "true"
+            and tags.get("success_attested") != "true"
+        )
+        try:
+            from apsimo.task_queue.governor import job_declares_effect
+            effectful = job_declares_effect(job)
+        except Exception:
+            # Unknown classification cannot authorize downstream effects.
+            effectful = True
+        verification_pending = bool(
+            reported_succeeded and operational_only and effectful
+        )
+        succeeded = bool(reported_succeeded and not verification_pending)
+        action = payload.get("action_hint") or job.job_type
+        description = payload.get("description", "")
+
+        # 1. Goal progress — the engine method existed since v0.13 but
+        # nothing ever called it.
+        goals = self._registry.goals
+        if (goals is not None and result is not None
+                and hasattr(goals, "on_job_completed")):
+            output = result.output or {}
+            if (
+                not verification_pending
+                and output.get("goal_id")
+                and output.get("subtask_id")
+            ):
+                try:
+                    goals.on_job_completed(result)
+                except Exception as exc:
+                    logger.warning("Goal writeback failed for %s: %s",
+                                   job.job_id, exc)
+
+        # 2. Episodic memory of what the agent did.
+        graph = self._registry.graph
+        if graph is not None and hasattr(graph, "store_memory"):
+            if verification_pending:
+                outcome = "reported completion; verification pending"
+            else:
+                outcome = "completed" if succeeded else (
+                    f"FAILED ({(result.error if result else None) or 'unknown error'})")
+            summary = ""
+            if result is not None and isinstance(result.output, dict):
+                raw = result.output.get("summary") or result.output.get("result")
+                if raw:
+                    summary = f" Result: {str(raw)[:300]}"
+            content = (f"Agent {outcome} action '{action}'"
+                       + (f" — {description}" if description else "")
+                       + f".{summary}")
+            await graph.store_memory(
+                content=content,
+                memory_type="episodic",
+                entities=[],
+                metadata={"job_id": job.job_id, "action_hint": str(action),
+                          "succeeded": succeeded,
+                          "verification_pending": verification_pending},
+                importance=0.6 if succeeded else 0.7,
+                source_type="tool_output",
+                source_uri=f"colony://jobs/{job.job_id}",
+            )
+
+        # 3. Linked initiative closure.
+        initiative_id = payload.get("initiative_id")
+        store = getattr(self._registry, "initiative_store", None)
+        if initiative_id and store is not None:
+            try:
+                if succeeded and hasattr(store, "complete"):
+                    store.complete(initiative_id,
+                                   agent_id=job.claimed_by or "agent",
+                                   result=f"job {job.job_id} completed")
+                elif not succeeded and not verification_pending and hasattr(store, "update"):
+                    store.update(initiative_id, status="failed",
+                                 failed_reason=f"job {job.job_id} failed")
+            except Exception as exc:
+                logger.warning("Initiative closure failed for %s: %s",
+                               initiative_id, exc)
+
+        # 3b. Deliverable commitment fulfillment. A completed delivery flips its linked
+        # commitment to fulfilled so it stops being re-surfaced; a FAILED one is left pending
+        # so the next tick regenerates the agent_action and retries.
+        if action == "agent_deliver_message" and succeeded:
+            commitment_id = payload.get("entity_id")
+            commitments = getattr(self._registry, "commitment_store", None)
+            if commitment_id and commitments is not None and hasattr(commitments, "update"):
+                try:
+                    commitments.update(
+                        commitment_id, status="fulfilled",
+                        fulfilled_at=datetime.now(timezone.utc).isoformat())
+                except Exception as exc:
+                    logger.warning("Deliverable commitment %s fulfill failed: %s",
+                                   commitment_id, exc)
+
+        # 4. Skill capture (v0.17.0, COLONY_ENABLE_SKILL_SYNTHESIS) — feed
+        # successful novel work into the existing learning pipeline
+        # (novelty gate → pattern extraction → DRAFT skill package).
+        # Captured skills are DRAFT and deny-by-default; the v0.13
+        # approval workflow gates activation, so nothing synthesized can
+        # execute without the owner.
+        if succeeded and not operational_only:
+            await self._maybe_capture_skill(job, action, description)
+
+        # 5. Broadcast for anything listening (WS clients, audit log).
+        try:
+            from apsimo.events.broadcaster import emit as broadcast
+            event_type = (
+                "job_verification_pending"
+                if verification_pending
+                else ("job_completed" if succeeded else "job_failed")
+            )
+            broadcast(event_type,
+                      {"job_id": job.job_id, "action_hint": str(action),
+                       "initiative_id": initiative_id,
+                       "verification_pending": verification_pending})
+        except Exception:
+            pass
+
+    def _get_skill_learning(self) -> Any:
+        """Lazily build the SkillLearningService (or None if disabled)."""
+        if os.environ.get("COLONY_ENABLE_SKILL_SYNTHESIS",
+                          "false").lower() != "true":
+            return None
+        service = getattr(self, "_skill_learning", None)
+        if service is not None:
+            return service
+        skills_registry = self._registry.skills
+        if skills_registry is None:
+            return None
+        try:
+            import pathlib
+
+            from apsimo.skills.learning import (
+                NoveltyDetector,
+                PatternExtractor,
+                SkillLearningService,
+            )
+            from apsimo.skills.packager import SkillPackager
+
+            library = pathlib.Path(
+                os.environ.get("COLONY_SKILL_LIBRARY")
+                or os.path.join(os.environ.get("COLONY_STATE_DIR", "."),
+                                "skill_library"))
+            packager = SkillPackager(
+                registry=skills_registry,
+                colony_id=os.environ.get("COLONY_NODE_ID", "colony"),
+                library_root=library,
+            )
+            service = SkillLearningService(
+                detector=NoveltyDetector(skills_registry),
+                extractor=PatternExtractor(),
+                packager=packager,
+            )
+            self._skill_learning = service
+            logger.info("Skill synthesis enabled (library=%s)", library)
+            return service
+        except Exception as exc:
+            logger.warning("Skill synthesis unavailable: %s", exc)
+            self._skill_learning = None
+            return None
+
+    async def _maybe_capture_skill(self, job: Any, action: str,
+                                   description: str) -> None:
+        service = self._get_skill_learning()
+        if service is None:
+            return
+        try:
+            from datetime import datetime, timezone
+
+            from apsimo.skills.learning.triggers import (
+                LearningTriggerEvent,
+                TriggerSource,
+            )
+            from apsimo.skills.models import TaskSolution
+
+            result = job.result
+            output = (result.output or {}) if result is not None else {}
+            solution = TaskSolution(
+                task_id=job.job_id,
+                task_description=description or str(action),
+                inputs=dict(job.payload or {}),
+                output=output,
+                trace=list(output.get("trace", [])),
+                dependencies=[],
+                embedding=None,
+                step_fingerprint=None,
+                duration_secs=float(
+                    getattr(result, "duration_seconds", None) or 0.0),
+                completed_at=getattr(result, "completed_at", None)
+                or datetime.now(timezone.utc),
+            )
+            skill_id = await service.handle(LearningTriggerEvent(
+                source=TriggerSource.POST_TASK_HOOK, solution=solution))
+            if skill_id:
+                self._queue_deferred_initiative(skill_id, description or action)
+        except Exception as exc:
+            logger.warning("Skill capture failed for %s: %s", job.job_id, exc)
+
+    def _queue_deferred_initiative(self, skill_id: str, task_desc: str) -> None:
+        """Surface a captured DRAFT skill to the owner next tick."""
+        from apsimo.intelligence.components.initiative_engine import (
+            Initiative,
+            InitiativeType,
+        )
+        deferred = getattr(self, "_deferred_initiatives", None)
+        if deferred is None:
+            deferred = []
+            self._deferred_initiatives = deferred
+        deferred.append(Initiative(
+            id=f"init-skill-{skill_id[:24]}",
+            type=InitiativeType.CAPABILITY_GAP,
+            description=f"Review new draft skill '{skill_id}' captured from: "
+                        f"{task_desc[:120]}",
+            priority=0.7,
+            rationale="[skill synthesis] novel successful work was captured "
+                      "as a DRAFT skill; it cannot run until you approve it.",
+            action_hint=None,
+            dedup_key=f"skill_review:{skill_id}",
+        ))
+
+    async def _phase_cognition(self) -> None:
+        """Run cognition pipeline tick."""
+        cognition = self._registry.cognition
+        if cognition is None:
+            return
+        try:
+            if hasattr(cognition, "run_cycle"):
+                result = await cognition.run_cycle()
+                # run_cycle() catches each internal step's failure into
+                # result.errors and returns "successfully"; without inspecting
+                # them the self-improvement loop can be fully degraded while this
+                # phase reports a clean tick. Surface them (errors gate nothing —
+                # this is purely observability).
+                cycle_errors = list(getattr(result, "errors", None) or [])
+                if cycle_errors:
+                    self.stats.errors += len(cycle_errors)
+                    logger.warning(
+                        "Phase cognition: cycle completed with %d step error(s): %s",
+                        len(cycle_errors),
+                        "; ".join(str(e) for e in cycle_errors[:5]),
+                    )
+                else:
+                    logger.debug("Phase cognition: cycle complete")
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase cognition error: %s", exc, exc_info=True)
+
+    async def _phase_projects(self) -> None:
+        """Phase 6a: sustained multi-tick project pursuit (cognition item 1).
+
+        The engine plans (LLM, validated), boundary-checks and advances one
+        ready step per due project; every step dispatch routes through that
+        action kind's own gated sub-path. Shadow mode simulates and logs.
+        """
+        try:
+            from apsimo.projects.models import projects_mode
+            if projects_mode() == "off":
+                return
+        except Exception:
+            return
+        engine = getattr(self._registry, "project_engine", None)
+        if engine is None:
+            return
+        try:
+            report = await engine.tick()
+            if (report.get("adopted") or report.get("planned")
+                    or report.get("steps_dispatched")):
+                logger.info("Phase projects[%s]: adopted=%d planned=%d steps=%d",
+                            report.get("mode"), report.get("adopted", 0),
+                            report.get("planned", 0),
+                            report.get("steps_dispatched", 0))
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase projects error: %s", exc, exc_info=True)
+
+    async def _phase_project_result_reconciliation(self) -> None:
+        """Bounded early projection of already-terminal WorkOrder results."""
+
+        engine = getattr(self._registry, "project_engine", None)
+        reconcile = getattr(engine, "reconcile_terminal_results", None)
+        if not callable(reconcile):
+            return
+        try:
+            raw_limit = int(os.environ.get(
+                "COLONY_PROJECT_RECONCILIATION_LIMIT", "25",
+            ))
+        except (TypeError, ValueError):
+            raw_limit = 25
+        limit = max(1, min(100, raw_limit))
+        try:
+            raw_budget = float(os.environ.get(
+                "COLONY_PROJECT_RECONCILIATION_BUDGET_SECS", "5",
+            ))
+        except (TypeError, ValueError):
+            raw_budget = 5.0
+        # Preserve most of the whole-tick budget for ordinary cognition while
+        # guaranteeing reconciliation gets the first bounded slice.
+        budget = max(0.05, min(10.0, raw_budget,
+                               self._tick_budget_secs() * 0.25))
+        try:
+            report = await asyncio.wait_for(
+                reconcile(limit=limit), timeout=budget,
+            )
+        except asyncio.TimeoutError:
+            self.stats.errors += 1
+            logger.warning(
+                "project result reconciliation exceeded %.2fs budget; "
+                "durable rows remain retryable", budget,
+            )
+            return
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error(
+                "Phase project result reconciliation error: %s",
+                exc, exc_info=True,
+            )
+            return
+        errors = int(report.get("errors") or 0) if isinstance(report, dict) else 0
+        self.stats.errors += errors
+        if isinstance(report, dict) and (
+            report.get("projected") or errors
+        ):
+            logger.info(
+                "Phase project-result reconciliation: checked=%d "
+                "terminal=%d projected=%d errors=%d",
+                int(report.get("checked") or 0),
+                int(report.get("terminal") or 0),
+                int(report.get("projected") or 0),
+                errors,
+            )
+
+    async def _phase_trust_notices(self) -> None:
+        """Deliver trust-engine graduation/demotion notices to the owner
+        (Amendment 1.2: notifications, not permission requests). The queue is
+        durable: a notice retries every tick until a real delivery succeeds,
+        surviving restarts and rate-limit windows."""
+        sm = getattr(self._registry, "self_model", None)
+        trust = getattr(sm, "trust", None) if sm is not None else None
+        if trust is None or not hasattr(trust, "undelivered_notices"):
+            return
+        delivery = self._registry.delivery
+        if delivery is None:
+            return
+        try:
+            from apsimo.proposals import Proposal, proposal_to_payload
+        except Exception:
+            return
+        for n in trust.undelivered_notices(limit=3):
+            try:
+                if n.get("demotion"):
+                    title = f"Autonomy pulled back: {n['domain']}"
+                    finding = (
+                        f"I demoted myself to ask-first on {n['domain']}: "
+                        f"{n.get('reason', 'circuit breaker')}. I will ask "
+                        "before doing this class of work again.")
+                else:
+                    stage_txt = ("asking you first before"
+                                 if n.get("stage") == "ask_first"
+                                 else "handling autonomously")
+                    title = f"Autonomy update: {n['domain']}"
+                    finding = (
+                        f"My track record on {n['domain']} crossed the "
+                        f"threshold ({n.get('reason', '')}), so I am now "
+                        f"{stage_txt} this class of work. Say stop if you "
+                        "do not want that.")
+                prop = Proposal(
+                    title=title[:100], finding=finding,
+                    why_it_helps="you always know exactly what I do on my own",
+                    suggested_action="Say 'stop acting' any time to pause "
+                                     "all autonomy.",
+                    source="trust-engine", initiative_type="proposal",
+                    confidence=0.85)
+                delivered = await self._route_reachout_delivery(
+                    proposal_to_payload(prop), delivery)
+                if delivered:
+                    trust.mark_notice_delivered(n["id"])
+                    pstore = getattr(self._registry, "proposal_store", None)
+                    if pstore is not None:
+                        prop.status = "delivered"
+                        pstore.add(prop)
+            except Exception:
+                logger.debug("trust notice delivery failed", exc_info=True)
+
+    async def _phase_selfhood_benchmark(self) -> None:
+        """Weekly (Mind M0a): compute the previous week's selfhood-benchmark
+        rollups and deliver the scorecard to the owner. Own weekly dedup
+        (not _run_periodic_phase) because the benchmark must run even when
+        graph memory is absent; the dedup key is only advanced on success."""
+        bench = getattr(self._registry, "benchmark", None)
+        if bench is None:
+            return
+        key = datetime.now(timezone.utc).strftime("%Y-W%W")
+        if self._periodic_last.get("selfhood_benchmark") == key:
+            return
+        try:
+            # compute_week runs recall probes against the graph; bound it so a
+            # wedged graph connection can't stall the tick.
+            with self._periodic_attempt("selfhood_benchmark", key):
+                result = await asyncio.wait_for(
+                    bench.compute_week(), timeout=self._phase_budget_secs())
+        except asyncio.TimeoutError:
+            # counted as this week's attempt: retrying every tick for the rest
+            # of the week would spend a phase budget per tick on the same stall
+            self._periodic_last["selfhood_benchmark"] = key
+            logger.warning("selfhood_benchmark exceeded budget; skipping "
+                           "until next week")
+            return
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase selfhood_benchmark error: %s", exc,
+                         exc_info=True)
+            return
+        if os.environ.get("COLONY_BENCHMARK_REPORT",
+                          "true").strip().lower() == "false":
+            return
+        metrics = result.get("metrics") or {}
+        delivery = self._registry.delivery
+        if not metrics or delivery is None:
+            return
+        try:
+            from apsimo.proposals import Proposal, proposal_to_payload
+        except Exception:
+            return
+        try:
+            trends = bench.snapshot(weeks=2).get("trends", {})
+            lines = []
+            for m, r in sorted(metrics.items()):
+                v = r.get("value")
+                if v is None:
+                    continue
+                d = trends.get(m)
+                wow = "" if d is None else f" ({'+' if d >= 0 else ''}{d:.2f} wow)"
+                lines.append(f"{m} {v:.2f}{wow}")
+            prop = Proposal(
+                title=f"Weekly selfhood report {result.get('week')}"[:100],
+                finding="; ".join(lines)[:900],
+                why_it_helps="a falsifiable trend line on whether I am "
+                             "actually getting better, straight from my "
+                             "journals",
+                suggested_action="Reply if any line looks wrong; every "
+                                 "number is derived from recorded outcomes.",
+                source="selfhood-benchmark", initiative_type="proposal",
+                confidence=0.9)
+            await self._route_reachout_delivery(
+                proposal_to_payload(prop), delivery)
+        except Exception:
+            logger.debug("benchmark report delivery failed", exc_info=True)
+
+    async def _phase_workspace(self) -> None:
+        """Every few ticks (Mind M2): feed concerns from live signals, decay
+        the salience field, and run bounded thinking jobs. More thinking runs
+        during the sleep window when the cluster is idle."""
+        ws = getattr(self._registry, "workspace", None)
+        if ws is None:
+            return
+        try:
+            from apsimo.self_model.workspace import (
+                in_sleep_window, workspace_mode,
+            )
+        except Exception:
+            return
+        # During migration, polling remains only when the durable reducer is
+        # absent/off.  Re-polling the same live state otherwise manufactures
+        # salience without a material event.
+        reducer = getattr(ws, "event_reducer", None)
+        if reducer is None or getattr(reducer, "mode", "off") == "off":
+            try:
+                self._workspace_ingest(ws)
+            except Exception:
+                logger.debug("workspace ingest failed", exc_info=True)
+        # decay + evict
+        try:
+            ws.decay()
+        except Exception:
+            logger.debug("workspace decay failed", exc_info=True)
+        # think: 1 per pass normally, a few during the sleep window. Each
+        # thought calls the LLM; bound it so a slow model can't stall the tick.
+        rounds = 4 if in_sleep_window() else 1
+        live = workspace_mode() == "live"
+        try:
+            from apsimo.cognition.goal_spine import (
+                cognition_spine_enabled, cognition_spine_exclusive,
+            )
+            if cognition_spine_enabled():
+                spine = getattr(ws, "cognition_spine", None)
+                if spine is None:
+                    logger.warning("P3 cognition spine enabled but not wired")
+                    if cognition_spine_exclusive():
+                        return
+                else:
+                    for _ in range(rounds):
+                        try:
+                            result = await asyncio.wait_for(
+                                spine.run_once(), timeout=self._phase_budget_secs())
+                        except asyncio.TimeoutError:
+                            logger.warning("P3 thought phase exceeded budget; stopping")
+                            break
+                        if result.get("status") in {"idle", "off"}:
+                            break
+                    return
+        except Exception:
+            logger.exception("P3 workspace phase failed")
+            return
+        for _ in range(rounds):
+            try:
+                outcome = await asyncio.wait_for(
+                    ws.think_once(), timeout=self._phase_budget_secs())
+            except asyncio.TimeoutError:
+                logger.warning("workspace thought exceeded budget; stopping")
+                break
+            if outcome is None:
+                break
+            if live and outcome.get("action"):
+                try:
+                    await self._workspace_act(outcome["action"])
+                except Exception:
+                    logger.debug("workspace act failed", exc_info=True)
+
+    async def _workspace_act(self, action: dict) -> None:
+        """Live-mode: turn a thought's action into a real, gated effect. An
+        initiative surfaces to the owner (through the same reachout gates);
+        an experiment is proposed to the experiment framework."""
+        try:
+            from apsimo.cognition.goal_spine import cognition_spine_exclusive
+            if cognition_spine_exclusive():
+                return
+        except Exception:
+            pass
+        kind = (action or {}).get("kind")
+        if kind == "initiative":
+            delivery = self._registry.delivery
+            if delivery is None:
+                return
+            try:
+                from apsimo.proposals import Proposal, proposal_to_payload
+                prop = Proposal(
+                    title=str(action.get("title", "A thought"))[:100],
+                    finding=str(action.get("detail", ""))[:600],
+                    why_it_helps="something on my mind that seemed worth "
+                                 "raising with you",
+                    suggested_action="No action needed unless you want to "
+                                     "weigh in.",
+                    source="workspace", initiative_type="proposal",
+                    confidence=0.7)
+                await self._route_reachout_delivery(
+                    proposal_to_payload(prop), delivery)
+            except Exception:
+                logger.debug("workspace initiative failed", exc_info=True)
+        elif kind == "experiment":
+            engine = getattr(self._registry, "experiments", None)
+            if engine is None:
+                return
+            try:
+                engine.propose_and_start(
+                    hypothesis=str(action.get("hypothesis", ""))[:300],
+                    ref=str(action.get("ref", "")),
+                    variant=float(action.get("variant", 0.0)),
+                    metric=str(action.get("metric", "")),
+                    source="workspace")
+            except (ValueError, TypeError):
+                pass  # invalid experiment spec is simply not started
+
+    async def _phase_expectations(self) -> None:
+        """Hourly (Mind M3a): form predictions from live signals and resolve
+        the ones whose horizon passed. Misses become surprises on her mind."""
+        eng = getattr(self._registry, "expectations", None)
+        if eng is None:
+            return
+        # link the workspace so a miss raises salience there
+        if getattr(eng, "_workspace", None) is None:
+            eng._workspace = getattr(self._registry, "workspace", None)
+        # generate + check every run: generate_from_commitments dedups on a
+        # stable key (create() refuses an existing pending prediction), so a
+        # newly due-dated commitment gets a prediction promptly instead of
+        # waiting for an hour boundary.
+        try:
+            eng.generate_from_commitments()
+            eng.check()
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase expectations error: %s", exc, exc_info=True)
+
+    def _workspace_ingest(self, ws) -> None:
+        """Turn live signals into concerns. Each source dedups on a stable
+        key so repeated ticks raise salience rather than pile up."""
+        # overdue commitments -> concerns
+        cstore = getattr(self._registry, "commitment_store", None)
+        if cstore is not None:
+            try:
+                for c in cstore.get_overdue()[:10]:
+                    desc = (c.get("description") if isinstance(c, dict)
+                            else getattr(c, "description", "")) or "commitment"
+                    cid = (c.get("id") if isinstance(c, dict)
+                           else getattr(c, "id", "")) or desc
+                    ws.bump(kind="goal",
+                            summary=f"overdue commitment: {desc}",
+                            dedup_key=f"commitment:{cid}", salience=0.7,
+                            sources=[f"commitment:{cid}"])
+            except Exception:
+                pass
+        # recent anomalies -> concerns (registry property is `anomalies`;
+        # the detector exposes get_recent() -> List[Anomaly dataclass])
+        detector = getattr(self._registry, "anomalies", None)
+        get_recent = getattr(detector, "get_recent", None) if detector else None
+        if callable(get_recent):
+            try:
+                for a in (get_recent(limit=10) or [])[:10]:
+                    summary = getattr(a, "description", None) or str(a)
+                    key = getattr(a, "id", None) or summary
+                    ws.bump(kind="anomaly", summary=str(summary)[:200],
+                            dedup_key=f"anomaly:{key}",
+                            salience=min(0.9, 0.4 + float(getattr(a, "severity", 0.4))),
+                            sources=[f"anomaly:{key}"])
+            except Exception:
+                logger.debug("workspace anomaly ingest failed", exc_info=True)
+        # benchmark regressions -> a concern to look into
+        bench = getattr(self._registry, "benchmark", None)
+        if bench is not None:
+            try:
+                trends = bench.snapshot(weeks=2).get("trends", {})
+                for metric, d in trends.items():
+                    if isinstance(d, (int, float)) and d < -0.15\
+                            and not str(metric).startswith("latency."):
+                        ws.bump(kind="question",
+                                summary=f"my {metric} regressed "
+                                        f"{d:.2f} week-over-week; why, and "
+                                        "can I improve it",
+                                dedup_key=f"benchmark:{metric}",
+                                salience=0.65, sources=[f"benchmark:{metric}"])
+            except Exception:
+                pass
+
+    async def _phase_toolsmith(self) -> None:
+        """Daily (Mind M1): mine the journal for repeated procedures, draft +
+        sandbox-verify a tool, exercise verified tools in shadow, and propose
+        graduation once a tool has enough clean shadow runs. Bounded per run:
+        at most one new draft, to keep LLM+sandbox cost predictable. Wrapped in
+        a hard timeout so a slow LLM draft or a wedged Docker run can never
+        freeze the autonomy loop (the draft/verify calls are off-loop, but the
+        tick still awaits the phase)."""
+        try:
+            await asyncio.wait_for(self._toolsmith_body(),
+                                   timeout=self._phase_budget_secs())
+        except asyncio.TimeoutError:
+            logger.warning("toolsmith phase exceeded budget; skipping this tick")
+
+    def _phase_budget_secs(self) -> float:
+        try:
+            return float(os.environ.get("COLONY_PHASE_BUDGET_SECS", "150"))
+        except ValueError:
+            return 150.0
+
+    def _tick_budget_secs(self) -> float:
+        """Whole-tick wall-clock ceiling; kept under the tick interval so the
+        loop always reaches the next cycle."""
+        try:
+            v = float(os.environ.get("COLONY_TICK_BUDGET_SECS", "0") or 0)
+        except ValueError:
+            v = 0.0
+        if v > 0:
+            return v
+        return max(60.0, self.config.tick_interval_secs * 0.8)
+
+    async def _toolsmith_body(self) -> None:
+        ts = getattr(self._registry, "toolsmith", None)
+        if ts is None:
+            return
+        key = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+        if self._periodic_last.get("toolsmith") == key:
+            return
+        self._periodic_last["toolsmith"] = key
+        try:
+            from apsimo.toolsmith.registry import ToolStatus
+            # 1. mine + draft one candidate that has no tool yet
+            candidates = ts.miner.mine(limit=1000)
+            drafted = None
+            for cand in candidates[:3]:
+                tool = await ts.draft(cand)
+                if tool is not None:
+                    drafted = tool
+                    break
+            # 2. verify any draft
+            for tool in ts.registry.list(status=ToolStatus.DRAFT):
+                await ts.verify(tool)
+            # 3. Shadow evidence is supplied only when the incumbent and the
+            # candidate can be compared on the same bounded captured input.
+            # Replaying a generated self-test is verification, not operational
+            # evidence, so the daily loop intentionally does not manufacture
+            # shadow wins here.
+            # 4. auto-retire failing tools
+            for tool in ts.retirement_candidates():
+                ts.retire(tool.tool_id, reason="failing/unused")
+            # 5. propose graduation for eligible shadow tools
+            await self._toolsmith_propose_graduations(ts)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase toolsmith error: %s", exc, exc_info=True)
+
+    async def _toolsmith_propose_graduations(self, ts) -> None:
+        delivery = self._registry.delivery
+        cands = ts.graduation_candidates()
+        if not cands:
+            return
+        for tool in cands:
+            # Trust is useful evidence, but never publication authority.  A
+            # one-shot owner-scoped graduation envelope is required at every
+            # trust stage, including act_first.
+            title = f"New tool ready: {tool.name}"
+            comparison_count = ts.registry.clean_comparison_count(tool.tool_id)
+            finding = (f"I built a tool, {tool.name}: {tool.description}. "
+                       f"It passed sandbox verification and "
+                       f"{comparison_count} clean same-input comparisons. "
+                       "Approve its exact artifact to let me use it for real.")
+            if delivery is None:
+                continue
+            try:
+                from apsimo.proposals import Proposal, proposal_to_payload
+                prop = Proposal(
+                    title=title[:100], finding=finding[:600],
+                    why_it_helps="I get more capable at things I do often, "
+                                 "and you see every new capability first",
+                    suggested_action=(
+                        f"Approve the bounded artifact digest via the tools "
+                        f"API to graduate {tool.name}."),
+                    source="toolsmith", initiative_type="proposal",
+                    confidence=0.85)
+                await self._route_reachout_delivery(
+                    proposal_to_payload(prop), delivery)
+            except Exception:
+                logger.debug("toolsmith graduation notice failed",
+                             exc_info=True)
+
+    async def _phase_experiments(self) -> None:
+        """Daily (Mind M0b): decide running self-experiments whose window
+        ended (adopt within guard, auto-revert on regression, abort when
+        superseded). Notifies the owner of every decision."""
+        engine = getattr(self._registry, "experiments", None)
+        if engine is None:
+            return
+        key = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+        if self._periodic_last.get("experiments") == key:
+            return
+        try:
+            decided = engine.evaluate()
+            self._periodic_last["experiments"] = key
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase experiments error: %s", exc, exc_info=True)
+            return
+        if not decided:
+            return
+        delivery = self._registry.delivery
+        if delivery is None:
+            return
+        try:
+            from apsimo.proposals import Proposal, proposal_to_payload
+        except Exception:
+            return
+        for exp in decided:
+            try:
+                prop = Proposal(
+                    title=f"Experiment {exp.get('status')}: "
+                          f"{exp.get('ref')}"[:100],
+                    finding=(f"{exp.get('hypothesis', '')[:200]}. Decision: "
+                             f"{exp.get('decision_reason', '')[:400]}"),
+                    why_it_helps="self-changes stay measured and reversible",
+                    suggested_action="No action needed; abort any running "
+                                     "experiment via the experiments API.",
+                    source="experiment-framework",
+                    initiative_type="proposal", confidence=0.85)
+                await self._route_reachout_delivery(
+                    proposal_to_payload(prop), delivery)
+            except Exception:
+                logger.debug("experiment notice delivery failed",
+                             exc_info=True)
+
+    async def _phase_belief_maintenance(self) -> None:
+        """Phase 11c (daily): belief maintenance (cognition item 7)."""
+        engine = getattr(self._registry, "belief_engine", None)
+        if engine is None:
+            return
+        key = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+        if self._periodic_last.get("belief_maintenance") == key:
+            return
+        try:
+            with self._periodic_attempt("belief_maintenance", key):
+                await engine.run()
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase belief_maintenance error: %s", exc,
+                         exc_info=True)
+
+    async def _phase_relationship_profiling(self) -> None:
+        """Phase 11f (periodic): refresh RelationshipBriefs for contacts that
+        accrued enough new interactions (docs/RELATIONSHIPS.md #7)."""
+        try:
+            from apsimo.api.routers.host import _relationship_profiler
+        except ImportError:
+            return
+        if _relationship_profiler is None:
+            return
+        refresh_secs = 21600.0
+        try:
+            refresh_secs = float(os.environ.get(
+                "COLONY_RELATIONSHIP_PROFILE_REFRESH_SECS", "21600"))
+        except ValueError:
+            pass
+        now = time.time()
+        last = self._periodic_last.get("relationship_profiling", 0.0)
+        if isinstance(last, str):
+            last = 0.0
+        if now - float(last or 0.0) < refresh_secs:
+            return
+        try:
+            with self._periodic_attempt("relationship_profiling", now):
+                report = await _relationship_profiler.refresh_due()
+            if report.get("profiled"):
+                logger.info("relationship profiling: %s", report)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase relationship_profiling error: %s", exc,
+                         exc_info=True)
+
+    async def _phase_world_llm_extract(self) -> None:
+        """Phase 11d (daily): LLM-assisted world-model extraction (batch,
+        journaled; piggybacks the daily memory-distillation cadence)."""
+        extractor = getattr(self._registry, "world_llm_extractor", None)
+        if extractor is None:
+            return
+        try:
+            from apsimo.world_model.llm_extract import llm_extract_mode
+            if llm_extract_mode() == "off":
+                return
+        except Exception:
+            return
+        key = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+        if self._periodic_last.get("world_llm_extract") == key:
+            return
+        try:
+            with self._periodic_attempt("world_llm_extract", key):
+                await extractor.run()
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase world_llm_extract error: %s", exc,
+                         exc_info=True)
+
+    async def _phase_tom2_asymmetry(self) -> None:
+        """Phase 11d2 (daily): tom2 knowledge-asymmetry sweep. Inert unless
+        COLONY_TOM2 is set (default off; shadow computes counts only, live
+        writes refs-not-content inference rows)."""
+        engine = getattr(self._registry, "tom2_engine", None)
+        if engine is None:
+            return
+        try:
+            from apsimo.tom.asymmetry import tom2_mode
+            if tom2_mode() == "off":
+                return
+        except Exception:
+            return
+        key = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+        if self._periodic_last.get("tom2_asymmetry") == key:
+            return
+        try:
+            engine.run()
+            self._periodic_last["tom2_asymmetry"] = key
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase tom2_asymmetry error: %s", exc, exc_info=True)
+
+    async def _phase_connectors(self) -> None:
+        """Phase 11e: poll due read-only connectors (cognition item 2).
+
+        The manager owns per-connector cadence and mode gating (off/shadow/
+        live); this phase just gives it a tick. Off by default -- a no-op
+        until connectors are configured and enabled per deployment."""
+        manager = getattr(self._registry, "connector_manager", None)
+        if manager is None:
+            return
+        try:
+            from apsimo.connectors import connectors_mode
+            if connectors_mode() == "off":
+                return
+        except Exception:
+            return
+        try:
+            await manager.poll_due()
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase connectors error: %s", exc, exc_info=True)
+
+    async def _run_phase(self, name: str, awaitable) -> None:
+        """Await one tick phase, recording its name while it runs and its
+        wall-clock duration (last and worst) afterwards. The marker is left in
+        place on cancellation so the budget-cancel path can name the phase."""
+        selected = self.config.enabled_phases
+        if selected is not None and name not in selected:
+            awaitable.close()
+            self.stats.phases_skipped += 1
+            return
+        self._current_phase = name
+        started = time.monotonic()
+        try:
+            await awaitable
+        finally:
+            elapsed = time.monotonic() - started
+            self._phase_seconds[name] = elapsed
+            if elapsed > self._phase_seconds_max.get(name, 0.0):
+                self._phase_seconds_max[name] = elapsed
+
+    def _note_tick_cancelled(self) -> None:
+        """The whole tick overran its budget and was cancelled mid-phase."""
+        phase = self._current_phase or "unknown"
+        self._current_phase = None
+        self.stats.errors += 1
+        self.stats.phases_cancelled += 1
+        self.stats.last_cancelled_phase = phase
+        logger.error(
+            "Tick #%d exceeded budget (%.0fs) in phase %s (%.1fs so far) and "
+            "was cancelled; loop continues", self.stats.ticks,
+            self._tick_budget_secs(), phase,
+            self._phase_seconds.get(phase, 0.0))
+
+    def phase_timings(self) -> dict:
+        """Per-phase wall-clock seconds: last run and worst run, plus the
+        phase running right now (None between ticks)."""
+        return {
+            "current": self._current_phase,
+            "seconds_last": {k: round(v, 3) for k, v in self._phase_seconds.items()},
+            "seconds_max": {k: round(v, 3) for k, v in self._phase_seconds_max.items()},
+        }
+
+    @contextlib.contextmanager
+    def _periodic_attempt(self, name: str, key):
+        """Mark a periodic phase attempted for its period.
+
+        The body is the phase's work. On normal exit the period key is stored;
+        on cancellation (the tick overran its budget) the key is stored too,
+        because otherwise the key never advances and the slow phase runs again
+        on the very next tick, eating every tick and starving every phase
+        after it until the period rolls over. An ordinary exception leaves the
+        key alone so the phase retries next tick, as before.
+        """
+        try:
+            yield
+        except asyncio.CancelledError:
+            self._periodic_last[name] = key
+            logger.error(
+                "Phase %s was cancelled before it finished; counted as "
+                "attempted for this period (%s), next attempt when the "
+                "period rolls", name, key)
+            raise
+        else:
+            self._periodic_last[name] = key
+
+    async def _run_periodic_phase(self, name: str, period: str, work) -> None:
+        """Run a memory-lifecycle phase at most once per period ("hour"|"day"|"week").
+        work(graph) does the phase-specific work; the dedup key is cached per name.
+        Replaces six near-identical _phase_memory_* skeletons (behavior preserved).
+        See _periodic_attempt for why a cancelled run still counts."""
+        graph = self._registry.graph
+        if graph is None:
+            return
+        now = datetime.now(timezone.utc)
+        key = {"hour": now.hour, "day": now.strftime("%Y-%m-%d"),
+               "week": now.strftime("%Y-W%W")}[period]
+        if self._periodic_last.get(name) == key:
+            return
+        try:
+            with self._periodic_attempt(name, key):
+                await work(graph)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase %s error: %s", name, exc, exc_info=True)
+
+    async def _phase_condition_checks(self) -> None:
+        """System-condition sweep (hourly) + blocked-goal condition polling
+        (every tick, per-condition cadence).
+
+        System checks: the pending→overdue commitment flip (fires
+        commitment.overdue exactly once per item), sustained affect decline,
+        and surprise accumulation — written for a queue-scheduled path that
+        nothing enqueues; the loop is the reliable place to run them.
+
+        Blocked goals: a goal blocked with context.condition_type is polled
+        via handle_check_condition at get_check_interval() cadence and
+        auto-unblocks when the condition is met. This is the missing PRODUCER
+        for the per-goal condition path."""
+        now = datetime.now(timezone.utc)
+        key = now.strftime("%Y-%m-%dT%H")
+        if self._periodic_last.get("condition_checks") != key:
+            self._periodic_last["condition_checks"] = key
+            from apsimo.autonomy.condition_worker import (
+                _check_affect_decline,
+                _check_commitment_overdue,
+                _check_surprise_accumulation,
+            )
+            for checker in (_check_commitment_overdue, _check_affect_decline,
+                            _check_surprise_accumulation):
+                try:
+                    await checker({})
+                except Exception:
+                    logger.debug("condition check %s failed",
+                                 getattr(checker, "__name__", "?"), exc_info=True)
+        await self._poll_blocked_goal_conditions()
+
+    async def _poll_blocked_goal_conditions(self) -> None:
+        """Poll every BLOCKED goal that carries an external condition.
+
+        Cadence is the condition type's interval, floored by the tick
+        interval (a 30s deployment_health check can only fire once per tick).
+        Every step is per-goal fault-isolated; one malformed goal can never
+        take down the loop."""
+        goals = getattr(self._registry, "goals", None)
+        if goals is None:
+            return
+        from apsimo.autonomy.condition_worker import (
+            get_check_interval, handle_check_condition)
+        from apsimo.goals.models import GoalStatus
+        try:
+            blocked = goals.list_goals(status="blocked", limit=100) or []
+        except Exception:
+            logger.debug("blocked-goal listing failed", exc_info=True)
+            return
+        now = time.time()
+        for goal in blocked:
+            try:
+                ctx = getattr(goal, "context", None) or {}
+                ctype = ctx.get("condition_type")
+                if not ctype:
+                    continue      # blocked on a human/approval, not a condition
+                interval = get_check_interval(ctype, getattr(goal, "deadline", None))
+                try:
+                    last = float(ctx.get("condition_last_check") or 0.0)
+                except (TypeError, ValueError):
+                    last = 0.0
+                if now - last < interval:
+                    continue
+                await handle_check_condition(
+                    {"goal_id": goal.goal_id, "condition_type": ctype,
+                     "condition_params": ctx.get("condition_params") or {}},
+                    goal_engine=goals,
+                )
+                # RE-LOAD before persisting the poll time: the check may have
+                # awaited a slow network call, and writing the pre-await
+                # object back would clobber any concurrent update (lost
+                # update). GoalEngine exposes no public save; _store is the
+                # sanctioned persistence path here. If the goal is still
+                # BLOCKED — condition not met, OR met but unblock failed —
+                # stamp the fresh object so the cadence holds either way (a
+                # failed unblock must not busy-repoll every tick).
+                fresh = goals._store.get_goal(goal.goal_id)
+                if fresh is not None and fresh.status == GoalStatus.BLOCKED\
+                        and fresh.context.get("condition_type"):
+                    fresh.context["condition_last_check"] = now
+                    goals._store.save_goal(fresh)
+            except Exception:
+                logger.debug("condition poll failed for goal %s",
+                             getattr(goal, "goal_id", "?"), exc_info=True)
+
+    # Graph capabilities the periodic memory phases dispatch on. A missing
+    # method means the phase silently does nothing every cycle — checked
+    # once at loop start and counted (stats.phases_skipped) at skip time.
+    _GRAPH_PHASE_CAPABILITIES = {
+        "memory_decay": "decay_memories",
+        "memory_pruning": "prune_weak_memories",
+        "memory_archive": "archive_memories",
+    }
+
+    def _check_phase_capabilities(self) -> None:
+        """Boot self-check: warn once per phase whose graph capability is
+        missing, so a renamed/removed backend method can never turn a
+        maintenance phase into a silent no-op again."""
+        try:
+            graph = self._registry.graph
+        except Exception:
+            graph = None
+        if graph is None:
+            return
+        for phase, attr in self._GRAPH_PHASE_CAPABILITIES.items():
+            if not hasattr(graph, attr):
+                self._note_phase_skipped(
+                    phase, f"graph backend lacks {attr}()", count=False)
+
+    def _note_phase_skipped(self, name: str, reason: str,
+                            count: bool = True) -> None:
+        """Record a phase skip: count every occurrence, warn only once."""
+        if count:
+            self.stats.phases_skipped += 1
+        if name not in self._phase_skip_warned:
+            self._phase_skip_warned.add(name)
+            logger.warning("Phase %s skipped: %s", name, reason)
+
+    async def _phase_memory_decay(self) -> None:
+        async def work(graph):
+            if hasattr(graph, "decay_memories"):
+                await graph.decay_memories()
+            else:
+                self._note_phase_skipped(
+                    "memory_decay", "graph backend lacks decay_memories()")
+        await self._run_periodic_phase("memory_decay", "day", work)
+
+    async def _phase_memory_pruning(self) -> None:
+        """Weekly: prune memories whose strength decayed below threshold.
+
+        COLONY_MEMORY_PRUNE_MODE gates the phase: ``off`` disables it,
+        ``shadow`` (default) counts what WOULD be pruned without deleting
+        anything, ``live`` deletes for real (capped per pass, graph node +
+        vector together). The default preserves shipped behavior — nothing
+        is ever deleted until a deployment flips the flag deliberately.
+        """
+        mode = os.environ.get(
+            "COLONY_MEMORY_PRUNE_MODE", "shadow").strip().lower()
+        if mode == "off":
+            return
+        if mode not in ("shadow", "live"):
+            mode = "shadow"  # unknown values fail safe to counting only
+
+        async def work(graph):
+            if not hasattr(graph, "prune_weak_memories"):
+                self._note_phase_skipped(
+                    "memory_pruning",
+                    "graph backend lacks prune_weak_memories()")
+                return
+            result = await graph.prune_weak_memories(dry_run=(mode != "live"))
+            logger.info(
+                "Phase memory_pruning (%s): matched=%s deleted=%s",
+                mode, result.get("matched"), result.get("deleted"))
+            # Post-prune orphan-vector sweep (live mode only, bounded):
+            # pruning couples vector deletion to node deletion, but any
+            # vector delete that failed leaves an orphan that keeps
+            # matching in ANN search. Best-effort — a sweep failure never
+            # fails the prune pass; leftovers are caught next week or via
+            # the explicit /memory/vector-vacuum endpoint.
+            if mode == "live" and hasattr(graph, "vacuum_orphan_vectors"):
+                try:
+                    sweep = await graph.vacuum_orphan_vectors(
+                        dry_run=False, max_delete=2000)
+                    logger.info(
+                        "Phase memory_pruning orphan sweep: orphans=%s "
+                        "deleted=%s", sweep.get("orphans"),
+                        sweep.get("deleted"))
+                except Exception:
+                    logger.warning("post-prune orphan-vector sweep failed",
+                                   exc_info=True)
+        await self._run_periodic_phase("memory_pruning", "week", work)
+
+    async def _phase_memory_distillation(self) -> None:
+        """Daily: promote frequently-recalled episodic memories into durable semantic facts via
+        MemoryDistiller. The distiller was built but never scheduled — this is the missing wiring
+        that turns accumulated conversation history into lasting knowledge instead of decaying logs."""
+        async def work(graph):
+            try:
+                from apsimo.intelligence.graph.distiller import MemoryDistiller
+                result = await MemoryDistiller(graph).run()
+                self.stats.memories_promoted += result.memories_promoted
+                if result.memories_promoted:
+                    logger.info("memory distillation: %d semantic fact(s) from %d cluster(s)",
+                                result.memories_promoted, result.clusters_found)
+            except Exception:
+                logger.debug("memory distillation phase failed", exc_info=True)
+        await self._run_periodic_phase("memory_distillation", "day", work)
+
+    async def _phase_memory_reconciliation(self) -> None:
+        async def work(graph):
+            from apsimo.intelligence.graph.reconciler import FileReconciler
+            result = await FileReconciler(graph).reconcile(dry_run=False)
+            logger.info(
+                "Phase memory_reconciliation: checked=%d verified=%d staled=%d superseded=%d errors=%d",
+                result["files_checked"], result["memories_verified"],
+                result["memories_staled"], result["memories_superseded"], len(result["errors"]),
+            )
+        await self._run_periodic_phase("memory_reconciliation", "day", work)
+
+    async def _phase_memory_archive(self) -> None:
+        async def work(graph):
+            if hasattr(graph, "archive_memories"):
+                archived = await graph.archive_memories(max_age_days=30)
+                logger.info("Phase memory_archive: archived=%d", archived)
+            else:
+                self._note_phase_skipped(
+                    "memory_archive",
+                    "graph backend lacks archive_memories()")
+        await self._run_periodic_phase("memory_archive", "week", work)
+
+    async def _phase_task_completion(self) -> None:
+        """Emit follow-up events for goals that completed since the last check.
+
+        Runs at most hourly. Emits one ``task_completed_followup`` event per
+        newly-completed goal and asks the connection discoverer for
+        reflection insights when a backlog accumulates.
+        """
+        now = datetime.now(timezone.utc)
+        if self._last_task_completion_check is not None:
+            elapsed = (now - self._last_task_completion_check).total_seconds()
+            if elapsed < 3600:  # Check hourly
+                return
+
+        goals = self._registry.goals
+        if goals is None:
+            self._last_task_completion_check = now
+            return
+
+        try:
+            from apsimo.goals.models import GoalStatus
+            completed = goals.list_goals(status=GoalStatus.COMPLETED, limit=50)
+
+            window_start = self._last_task_completion_check
+            new_completions = []
+            for g in completed:
+                cat = getattr(g, "completed_at", None)
+                if cat is None:
+                    continue
+                if window_start is None or cat >= window_start:
+                    new_completions.append(g)
+
+            for g in new_completions:
+                try:
+                    self.events.emit(Event(
+                        id=f"task-followup-{getattr(g, 'goal_id', uuid.uuid4())}",
+                        source="autonomy.task_completion",
+                    ))
+                    broadcast = _get_broadcast()
+                    if broadcast is not None:
+                        try:
+                            broadcast({
+                                "type": "task_followup",
+                                "goal_id": getattr(g, "goal_id", ""),
+                                "title": getattr(g, "title", ""),
+                            })
+                        except Exception:
+                            logger.debug("broadcast task_followup failed", exc_info=True)
+                except Exception:
+                    logger.debug("emit task_followup failed", exc_info=True)
+
+            # If several goals finished in the window, ask synthesis for
+            # reflection connections to surface patterns.
+            if len(new_completions) >= 3:
+                discoverer = self._registry.connection_discoverer
+                if discoverer is not None and hasattr(discoverer, "discover_connections"):
+                    try:
+                        await discoverer.discover_connections(min_novelty=0.3)
+                    except Exception:
+                        logger.debug("reflection discovery failed", exc_info=True)
+
+            self.stats.task_follow_ups += len(new_completions)
+            self._last_task_completion_check = now
+            if new_completions:
+                logger.info(
+                    "Phase task_completion: %d follow-up(s)", len(new_completions)
+                )
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase task_completion error: %s", exc, exc_info=True)
+
+    async def _phase_frustration_update(self) -> None:
+        """Update delivery rate limiter based on engagement feedback."""
+        delivery = self._registry.delivery
+        if delivery is None:
+            return
+        try:
+            learner = self._registry.learner
+            if learner is not None and hasattr(delivery, "update_rate_limiter"):
+                await delivery.update_rate_limiter(learner)
+        except Exception as exc:
+            logger.debug("Phase frustration_update error (non-fatal): %s", exc)
+
+    async def _phase_relationships(self) -> None:
+        """Legacy scheduler slot: scalar relationship scoring is retired.
+
+        Attributed preferences and appraisals are updated by the canonical
+        source worker. Quiet periods and contact mood cannot lower standing.
+        """
+        return
+
+    async def _phase_synthesis(self) -> None:
+        """Discover cross-domain connections."""
+        discoverer = self._registry.connection_discoverer
+        if discoverer is None:
+            return
+        try:
+            connections = await discoverer.discover_connections()
+            if connections:
+                logger.info("Phase synthesis: %d new connections", len(connections))
+                _get_broadcast()({
+                    "type": "insight",
+                    "occurred_at": datetime.now(timezone.utc).isoformat(),
+                    "payload": {"new_connections": len(connections)},
+                })
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase synthesis error: %s", exc, exc_info=True)
+
+    async def _phase_bootstrap_check(self) -> None:
+        """Run identity bootstrap self-check daily."""
+        chain = self._registry.chain
+        if chain is None:
+            return
+        now = datetime.now(timezone.utc)
+        interval_hours = self.config.bootstrap_check_interval_hours
+        last = self._periodic_last.get("bootstrap_check")
+        if isinstance(last, datetime):
+            elapsed = (now - last).total_seconds() / 3600
+            if elapsed < interval_hours:
+                return
+        try:
+            if hasattr(chain, "health_check"):
+                with self._periodic_attempt("bootstrap_check", now):
+                    healthy = await chain.health_check()
+                if not healthy:
+                    logger.warning("Phase bootstrap_check: chain health degraded")
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase bootstrap_check error: %s", exc, exc_info=True)
+
+    async def _phase_self_reflection(self) -> None:
+        """Run self-reflection component weekly."""
+        now = datetime.now(timezone.utc)
+        interval_days = self.config.self_reflection_interval_days
+        last = self._periodic_last.get("self_reflection")
+        if isinstance(last, datetime):
+            elapsed = (now - last).total_seconds() / 86400
+            if elapsed < interval_days:
+                return
+        try:
+            cognition = self._registry.cognition
+            if cognition is not None and hasattr(cognition, "self_reflect"):
+                with self._periodic_attempt("self_reflection", now):
+                    await cognition.self_reflect()
+                logger.info("Phase self_reflection: complete")
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase self_reflection error: %s", exc, exc_info=True)
+
+    async def _phase_skill_triggers(self, event_text: str) -> None:
+        """Evaluate skill triggers from recent events."""
+        skills = self._registry.skills
+        if skills is None:
+            return
+        try:
+            if hasattr(skills, "evaluate_triggers"):
+                loaded = await skills.evaluate_triggers(event_text)
+                self.stats.skills_loaded = len(loaded)
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Phase skill_triggers error: %s", exc, exc_info=True)
+
+    async def _phase_skill_evict(self) -> None:
+        """Evict cold skills after execution."""
+        skills = self._registry.skills
+        if skills is None:
+            return
+        try:
+            if hasattr(skills, "evict_cold"):
+                evicted = await skills.evict_cold()
+                self.stats.skills_evicted += evicted
+        except Exception as exc:
+            logger.debug("Phase skill_evict error (non-fatal): %s", exc)
+
+    # ------------------------------------------------------------------
+    # Multi-Agent Phases (v0.7.0)
+    # ------------------------------------------------------------------
+
+    async def _phase_agent_heartbeat(self) -> None:
+        """Check agent status and mark offline if heartbeat timeout."""
+        agent_store = self._registry.agent_store
+        if agent_store is None:
+            return
+        try:
+            # Get agents with old last_seen_at
+            from datetime import timedelta
+            threshold = datetime.now(timezone.utc) - timedelta(minutes=5)
+
+            agents = agent_store.list(status=["online", "busy"])
+            for agent in agents:
+                if agent.last_seen_at and agent.last_seen_at < threshold:
+                    logger.info("Agent %s marked offline (no heartbeat)", agent.name)
+                    await agent_store.set_offline(agent.agent_id)
+
+                    # Reassign pending initiatives
+                    initiative_store = self._registry.initiative_store
+                    if initiative_store:
+                        reassigned = initiative_store.reassign_from_agent(
+                            agent.agent_id,
+                            only_pending=True,
+                        )
+                        if reassigned:
+                            logger.info("Reassigned %d initiatives from offline agent %s", reassigned, agent.name)
+        except Exception as exc:
+            logger.debug("Phase agent_heartbeat error (non-fatal): %s", exc)
+
+    async def _phase_startup_repush(self) -> None:
+        """On first tick: prune orphaned initiatives and re-push pending to delivery."""
+        if self.stats.ticks != 1:
+            return
+
+        initiative_store = self._registry.initiative_store
+        delivery = self._registry.delivery
+        graph = self._registry.graph
+
+        if initiative_store is None:
+            return
+
+        try:
+            # 1. Cancel initiatives whose entity no longer exists in graph
+            if graph is not None and hasattr(graph, "driver"):
+                pending = initiative_store.list(status=["pending"], limit=1000)
+                pruned = 0
+                for initiative in pending:
+                    entity_id = initiative.entity_id
+                    if not entity_id:
+                        continue
+                    try:
+                        async with graph.driver.session(database=graph.database) as session:
+                            result = await session.run(
+                                "MATCH (n {id: $id}) RETURN count(n) as c",
+                                {"id": entity_id},
+                            )
+                            record = await result.single()
+                            if record is None or record["c"] == 0:
+                                initiative_store.cancel(
+                                    initiative.id,
+                                    cancelled_by="autonomy_loop",
+                                    reason="entity_no_longer_exists",
+                                )
+                                pruned += 1
+                                logger.info(
+                                    "Pruned orphaned initiative %s (entity %s not in graph)",
+                                    initiative.id,
+                                    entity_id,
+                                )
+                    except Exception as exc:
+                        logger.debug("Graph check failed for %s: %s", entity_id, exc)
+
+                if pruned:
+                    logger.info("Pruned %d orphaned initiatives on startup", pruned)
+
+            # 2. Re-push remaining pending initiatives to delivery bridge.
+            #    Routed through the SAME gated path as the main loop, so a
+            #    go-live restart cannot flush an unfiltered / unrated backlog:
+            #    only reach-out types, sanitised, staleness-guarded, and rate-
+            #    limited per recipient are (shadow-)delivered.
+            if delivery is not None:
+                pending = initiative_store.list(status=["pending"], limit=100)
+                repushed = 0
+                for initiative in pending:
+                    payload = self._stored_initiative_delivery_payload(initiative)
+                    try:
+                        if await self._route_reachout_delivery(payload, delivery):
+                            repushed += 1
+                    except Exception as exc:
+                        logger.debug("Failed to re-push initiative %s: %s", initiative.id, exc)
+
+                if repushed:
+                    logger.info("Re-pushed %d pending reach-out initiatives to delivery bridge", repushed)
+
+        except Exception as exc:
+            self.stats.errors += 1
+            logger.error("Startup re-push phase error: %s", exc, exc_info=True)
+
+    async def _phase_initiative_timeout(self) -> None:
+        """Check for timed-out initiatives."""
+        initiative_store = self._registry.initiative_store
+        if initiative_store is None:
+            return
+        try:
+            now = datetime.now(timezone.utc)
+            timed_out = initiative_store.find_timed_out(now)
+
+            for initiative in timed_out:
+                logger.warning(
+                    "Initiative %s timed out after %ds",
+                    initiative.id,
+                    initiative.timeout_seconds,
+                )
+
+                initiative_store.update(
+                    initiative.id,
+                    status="failed",
+                    failed_at=now.isoformat(),
+                    failed_reason="timeout_exceeded",
+                )
+
+                initiative_store.log_history(
+                    initiative.id,
+                    action="timed_out",
+                    agent_id=initiative.assigned_agent_id,
+                    details={"timeout_seconds": initiative.timeout_seconds},
+                )
+        except Exception as exc:
+            logger.debug("Phase initiative_timeout error (non-fatal): %s", exc)
+
+    async def _phase_approval_timeout(self) -> None:
+        """Fail BLOCKED jobs whose owner-approval window expired (v0.17.0).
+
+        Jobs blocked with ``awaiting_owner_approval`` older than
+        COLONY_APPROVAL_TIMEOUT_HOURS (default 72) are failed with reason
+        ``owner_approval_timeout`` so they never execute silently later.
+        """
+        task_queue = getattr(self._registry, "task_queue", None)
+        if task_queue is None:
+            return
+        try:
+            timeout_hours = float(os.environ.get("COLONY_APPROVAL_TIMEOUT_HOURS", "72"))
+            expired = await task_queue.queue.expire_blocked_approvals(
+                datetime.now(timezone.utc), timeout_hours,
+            )
+            if expired:
+                logger.info(
+                    "Failed %d blocked job(s) after %.0fh without owner approval",
+                    expired, timeout_hours,
+                )
+        except Exception as exc:
+            logger.debug("Phase approval_timeout error (non-fatal): %s", exc)
+
+    async def _phase_stale_initiative_cleanup(self) -> None:
+        """Clean up initiatives stuck in acknowledged state."""
+        initiative_store = self._registry.initiative_store
+        agent_store = self._registry.agent_store
+        if initiative_store is None or agent_store is None:
+            return
+        try:
+            from datetime import timedelta
+            threshold = datetime.now(timezone.utc) - timedelta(hours=1)
+
+            stale = initiative_store.find_stale_acknowledged(threshold)
+
+            for initiative in stale:
+                agent = agent_store.get(initiative.assigned_agent_id)
+
+                if agent is None or agent.status != "online":
+                    logger.warning(
+                        "Initiative %s stuck in acknowledged, reassigning",
+                        initiative.id,
+                    )
+                    initiative_store.update(
+                        initiative.id,
+                        status="pending",
+                        assigned_agent_id=None,
+                        stale_reason="agent_offline_with_acknowledged",
+                    )
+        except Exception as exc:
+            logger.debug("Phase stale_initiative_cleanup error (non-fatal): %s", exc)
+
+    async def _phase_ghost_cleanup(self) -> None:
+        """Remove agents that registered but never connected."""
+        agent_store = self._registry.agent_store
+        initiative_store = self._registry.initiative_store
+        if agent_store is None:
+            return
+        try:
+            from datetime import timedelta
+            threshold = datetime.now(timezone.utc) - timedelta(minutes=10)
+
+            ghosts = agent_store.list_ghosts(registered_before=threshold)
+
+            for ghost in ghosts:
+                # Reassign initiatives first
+                if initiative_store:
+                    initiatives = initiative_store.list(assigned_agent_id=ghost.agent_id)
+                    for init in initiatives:
+                        initiative_store.update(
+                            init.id,
+                            status="pending",
+                            assigned_agent_id=None,
+                            recovery_reason="agent_ghost",
+                        )
+
+                # Remove ghost
+                agent_store.delete(ghost.agent_id)
+                logger.info("Removed ghost agent %s", ghost.agent_id)
+
+            # Also expire stale in_session deliveries (v0.13.0)
+            delivery = getattr(self._registry, "delivery", None)
+            if delivery and hasattr(delivery, "expire_in_session_deliveries"):
+                expired = delivery.expire_in_session_deliveries(max_age_hours=24)
+                if expired:
+                    logger.info("Expired %d stale in_session deliveries", expired)
+        except Exception as exc:
+            logger.debug("Phase ghost_cleanup error (non-fatal): %s", exc)
+
+    async def _phase_database_backup(self) -> None:
+        """Periodic database backup for crash recovery."""
+        try:
+            agent_store = self._registry.agent_store
+            initiative_store = self._registry.initiative_store
+
+            if agent_store and hasattr(agent_store, "backup"):
+                agent_store.backup()
+
+            if initiative_store and hasattr(initiative_store, "backup"):
+                initiative_store.backup()
+
+            logger.debug("Database backup complete")
+        except Exception as exc:
+            logger.warning("Phase database_backup error: %s", exc)
+
+    # ------------------------------------------------------------------
+    # Sleep / wake
+    # ------------------------------------------------------------------
+
+    async def _sleep_until_next_tick(self) -> None:
+        self._wake_event.clear()
+        try:
+            await asyncio.wait_for(
+                asyncio.shield(self._wake_event.wait()),
+                timeout=self.config.tick_interval_secs,
+            )
+        except asyncio.TimeoutError:
+            pass
+
+    def _on_wake_signal(self, event: Event) -> None:
+        self._wake_event.set()
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    def _in_quiet_hours(self) -> bool:
+        """Check if current time is within quiet hours (in configured timezone)."""
+        try:
+            # Use configured timezone, fallback to UTC
+            tz = ZoneInfo(self.config.timezone)
+            now = datetime.now(tz)
+        except Exception:
+            now = datetime.now(timezone.utc)
+
+        try:
+            start_h, start_m = map(int, self.config.quiet_hours_start.split(":"))
+            end_h, end_m = map(int, self.config.quiet_hours_end.split(":"))
+        except (ValueError, AttributeError):
+            return False
+
+        from apsimo.util.quiet_hours import in_quiet_window
+        return in_quiet_window(
+            now.hour * 60 + now.minute,
+            start_h * 60 + start_m,
+            end_h * 60 + end_m,
+        )
+
+    def _reset_hour_bucket(self) -> None:
+        current_hour = datetime.now(timezone.utc).hour
+        if current_hour != self.stats.hour_bucket:
+            self.stats.actions_this_hour = 0
+            self.stats.hour_bucket = current_hour
+
+    def _gather_event_text(self) -> str:
+        try:
+            recent = self.events.get_history(limit=10)
+            parts = []
+            for event in recent:
+                event_type = getattr(event, "event_type", "")
+                if event_type:
+                    parts.append(event_type)
+            return " ".join(parts)
+        except Exception:
+            return ""
+
+    def status(self) -> dict:
+        return {
+            "running": self._running,
+            "mode": self.config.mode.value,
+            "timezone": self.config.timezone,
+            "in_quiet_hours": self._in_quiet_hours(),
+            "config": {
+                "mode": self.config.mode.value,
+                "enabled_phases": (list(self.config.enabled_phases)
+                                   if self.config.enabled_phases is not None else None),
+                "proposals_only": self.config.proposals_only,
+                "timezone": self.config.timezone,
+                "tick_interval_secs": self.config.tick_interval_secs,
+                "initiative_confidence_threshold": self.config.initiative_confidence_threshold,
+                "max_actions_per_hour": self.config.max_actions_per_hour,
+                "quiet_hours_start": self.config.quiet_hours_start,
+                "quiet_hours_end": self.config.quiet_hours_end,
+            },
+            "stats": self.stats.as_dict(),
+            "phases": self.phase_timings(),
+        }