fix(daemon,docs,upload): resolve P1+6 P2 Codex findings on PR #105

P1 entrypoint stub executor → refusal (codex 3352439151):
  The stub returned a sentinel dispatchedTaskId, causing the leader loop
  to call markIntentDispatched + completeIntent and record real pending
  intents as 'done' without execution. Replace with an explicit throw so
  the loop's failure path runs (intent → failed with clear refusal
  message). The real executor lands in PR #107.

P2 entrypoint SIGTERM release sessionId (codex 3353069328):
  releaseLeadership gates on session ownership (codex-p2 PR#101); the
  fallback shutdown release passed no sessionId, so it always no-op'd
  against our own session-stamped lease. Pass the loop's sessionId.

P2 install-daemon-vm.sh devDeps prune (codex 3352439158):
  npm ci --omit=dev pruned typescript, breaking 'npm run build:daemon'.
  Install full deps for the repo build step; runtime image in
   still gets --omit=dev separately.

P2 systemd unit NODE_BIN (codex 3352439162):
  Hard-coded /usr/bin/node breaks nvm / /usr/local/bin installs. Ship
  unit with @@NODE_BIN@@ placeholder; install script substitutes the
  detected node path before installing.

P2 systemd MDWE+JIT (codex 3352439169):
  MemoryDenyWriteExecute=true is documented incompatible with V8 JIT
  and would abort node at startup. Remove the flag; document why.

P2 launchd plist missing env (codex 3352439167):
  launchd has no EnvironmentFile equivalent. Plist invoked node
  directly without DATABASE_URL/NODE_CHITTY_ID/NODE_DESCRIPTOR, hitting
  entrypoint.ts's fatal-missing-env branch on Mac Mini nodes. Add a
  launchd-shim.sh that sources /etc/chittycommand/env (same shape as
  systemd EnvironmentFile) then execs node.

P2 migration 0016 single-upload conflict (codex 3352439160):
  Unique partial index on r2_key broke single /upload's plain
  INSERT...RETURNING — re-uploads now 500'd on unique violation. Add
  ON CONFLICT (r2_key) WHERE (r2_key IS NOT NULL) DO NOTHING to match
  batch path; fall back to SELECT-existing returning 200.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chitcommit

daemon/runtime/chittycommand-daemon.service

@@ -11,7 +11,13 @@ User=chittycommand
 Group=chittycommand
 WorkingDirectory=/opt/chittycommand
 EnvironmentFile=/etc/chittycommand/env
-ExecStart=/usr/bin/node /opt/chittycommand/dist/daemon/runtime/entrypoint.js
+# NOTE: install-daemon-vm.sh substitutes @@NODE_BIN@@ with the detected
+# node path (command -v node) before installing this unit, so deployments
+# using nvm or /usr/local/bin/node still start. If editing this file by
+# hand, replace @@NODE_BIN@@ with the absolute path to node.
+# Codex P2 PR#105: previously hard-coded /usr/bin/node failed when node was
+# installed elsewhere (nvm, /usr/local/bin).
+ExecStart=@@NODE_BIN@@ /opt/chittycommand/dist/daemon/runtime/entrypoint.js
 Restart=always
 RestartSec=5
 KillSignal=SIGTERM
@@ -32,7 +38,10 @@ ProtectControlGroups=true
 RestrictNamespaces=true
 RestrictRealtime=true
 LockPersonality=true
-MemoryDenyWriteExecute=true
+# MemoryDenyWriteExecute is intentionally OMITTED.
+# Codex P2 PR#105: systemd documents MDWE as incompatible with JIT engines
+# (V8 generates executable code pages at runtime). Enabling it would abort
+# Node at startup. Source maps in NODE_OPTIONS do not affect this.
 ReadWritePaths=/var/log/chittycommand
 
 [Install]

daemon/runtime/entrypoint.ts

@@ -72,9 +72,12 @@ async function main(): Promise<void> {
     log('signal_received', { signal });
     controller.abort();
     // Belt-and-suspenders release in case the loop is wedged before the
-    // abort path reaches releaseLeadership.
+    // abort path reaches releaseLeadership. Pass sessionId — releaseLeadership
+    // gates on session ownership (codex-p2 PR#101 finding-2), so omitting it
+    // would no-op against a lease claimed with our sessionId.
     releaseLeadership({ DATABASE_URL: env.DATABASE_URL }, env.NODE_CHITTY_ID, {
       role: META_LEADER_ROLE,
+      sessionId,
     })
       .then((released) => log('release_on_signal', { released }))
       .catch((err) =>
@@ -89,15 +92,24 @@ async function main(): Promise<void> {
 
   const executor = async (intent: { id: string; intentType: string }) => {
     // Foundation entrypoint: no real executor wired yet — the ActionAgent
-    // bridge ships in the follow-up PR per ADR-001 out-of-scope list.
-    // We mark the intent as dispatched to a sentinel ID so the leader loop
-    // makes forward progress in smoke tests without inventing fake work.
-    log('intent_executor_stub', {
+    // bridge ships in PR #107 (feat/daemon-loop-executes-intents) per
+    // ADR-001 out-of-scope list. Until then, claimed intents must NOT be
+    // recorded as `done`. Throwing here routes the intent through the
+    // loop's failure path (failIntent), which records a clear refusal
+    // reason instead of inventing a successful dispatch.
+    //
+    // Codex P1 PR#105: previously returned a sentinel dispatchedTaskId,
+    // causing markIntentDispatched + completeIntent to record real work
+    // as `done` without execution. Refuse instead.
+    log('intent_executor_unwired', {
       intentId: intent.id,
       intentType: intent.intentType,
-      note: 'executor wiring deferred to follow-up PR',
+      note: 'real executor lands in PR #107; refusing to record fake success',
     });
-    return { dispatchedTaskId: `pending-executor:${intent.id}` };
+    throw new Error(
+      `daemon executor not wired on PR #105 (foundation only); ` +
+        `intent ${intent.id} routed to failed — real executor lands in PR #107`,
+    );
   };
 
   try {

daemon/runtime/launchd-shim.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+#
+# launchd-shim.sh — macOS env-loading shim for the ChittyCommand daemon.
+#
+# launchd has no native EnvironmentFile equivalent (unlike systemd), so this
+# shim sources /etc/chittycommand/env before exec'ing node. The systemd unit
+# uses EnvironmentFile=/etc/chittycommand/env directly; this shim keeps the
+# macOS path consistent.
+#
+# Codex P2 PR#105: previously the launchd plist invoked node directly with
+# only NODE_ENV/NODE_OPTIONS exported, which meant entrypoint.ts's readEnv()
+# always tripped its fatal-missing-env branch on Mac Mini nodes.
+#
+# Install path: /opt/chittycommand/dist/daemon/runtime/launchd-shim.sh
+# Mode: 0755, owned by chittycommand:chittycommand
+#
+# canonical-uri: chittycanon://docs/architecture/chittycommand/daemon-supervisor
+
+set -euo pipefail
+
+ENV_FILE="${CHITTYCOMMAND_ENV_FILE:-/etc/chittycommand/env}"
+NODE_BIN="${CHITTYCOMMAND_NODE_BIN:-/usr/local/bin/node}"
+ENTRYPOINT="/opt/chittycommand/dist/daemon/runtime/entrypoint.js"
+
+if [[ ! -r "${ENV_FILE}" ]]; then
+  echo "[chittycommand-daemon-shim] fatal: env file not readable: ${ENV_FILE}" >&2
+  exit 7
+fi
+
+# Source env file. The file is the same KEY=VALUE format the systemd
+# EnvironmentFile expects, rendered by `op inject` at install time.
+set -a
+# shellcheck disable=SC1090
+. "${ENV_FILE}"
+set +a
+
+# Preserve NODE_ENV / NODE_OPTIONS if launchd set them.
+export NODE_ENV="${NODE_ENV:-production}"
+export NODE_OPTIONS="${NODE_OPTIONS:---enable-source-maps}"
+
+if [[ ! -x "${NODE_BIN}" ]]; then
+  echo "[chittycommand-daemon-shim] fatal: node not executable at ${NODE_BIN}" >&2
+  exit 8
+fi
+
+exec "${NODE_BIN}" "${ENTRYPOINT}"

daemon/runtime/launchd/com.chittyos.chittycommand-daemon.plist

@@ -19,10 +19,16 @@
   <key>Label</key>
   <string>com.chittyos.chittycommand-daemon</string>
 
+  <!--
+    Codex P2 PR#105: launchd has no native EnvironmentFile equivalent and
+    entrypoint.ts requires NODE_CHITTY_ID, DATABASE_URL, and
+    NODE_DESCRIPTOR/HOSTNAME. Invoke a shim that sources
+    /etc/chittycommand/env before exec'ing node, so the daemon sees the
+    same env shape on macOS as on systemd Linux.
+  -->
   <key>ProgramArguments</key>
   <array>
-    <string>/usr/local/bin/node</string>
-    <string>/opt/chittycommand/dist/daemon/runtime/entrypoint.js</string>
+    <string>/opt/chittycommand/dist/daemon/runtime/launchd-shim.sh</string>
   </array>
 
   <key>WorkingDirectory</key>

scripts/install-daemon-vm.sh

@@ -83,8 +83,12 @@ else
 fi
 
 # 2. Build
+# Build needs typescript (devDependency). We install ALL deps for the repo
+# build step here, then install --omit=dev separately into ${INSTALL_DIR}
+# below so the runtime image is dev-free.
+# Codex P2 PR#105: previously --omit=dev pruned tsc, breaking build:daemon.
 log "building daemon (npm run build:daemon)"
-run "cd ${REPO_ROOT} && npm ci --omit=dev --no-audit --no-fund || npm install --no-audit --no-fund"
+run "cd ${REPO_ROOT} && npm ci --no-audit --no-fund || npm install --no-audit --no-fund"
 run "cd ${REPO_ROOT} && npm run build:daemon"
 
 # 3. Install dir + artifact sync
@@ -118,8 +122,18 @@ else
   chown "root:${SERVICE_USER}" "${ENV_FILE}"
 fi
 
-# 6. systemd unit
-run "install -m 0644 -o root -g root ${UNIT_SRC} ${UNIT_DST}"
+# 6. systemd unit — substitute @@NODE_BIN@@ with detected node path.
+# Codex P2 PR#105: the unit ships with a placeholder so installs that use
+# nvm or /usr/local/bin/node don't fail on ExecStart=/usr/bin/node.
+if (( DRY_RUN )); then
+  plan "sed s|@@NODE_BIN@@|${NODE_BIN}| ${UNIT_SRC} > /tmp/chittycommand-daemon.service"
+  plan "install -m 0644 -o root -g root /tmp/chittycommand-daemon.service ${UNIT_DST}"
+else
+  RENDERED_UNIT="$(mktemp)"
+  sed "s|@@NODE_BIN@@|${NODE_BIN}|g" "${UNIT_SRC}" > "${RENDERED_UNIT}"
+  install -m 0644 -o root -g root "${RENDERED_UNIT}" "${UNIT_DST}"
+  rm -f "${RENDERED_UNIT}"
+fi
 run "systemctl daemon-reload"
 run "systemctl enable chittycommand-daemon.service"
 

src/routes/documents.ts

@@ -104,12 +104,24 @@ documentRoutes.post('/upload', async (c) => {
     httpMetadata: { contentType: file.type },
     customMetadata: { filename: safeName, source: 'chittycommand' },
   });
-  const [doc] = await sql`
+  // Codex P2 PR#105: migration 0016 adds a unique partial index on r2_key,
+  // so re-uploading an already-ingested sha256/* key would raise a unique-
+  // violation 500 here. Match the batch path's ON CONFLICT semantics: skip
+  // the insert, then SELECT the existing row to return.
+  const inserted = await sql`
     INSERT INTO cc_documents (doc_type, source, filename, r2_key, processing_status)
     VALUES ('upload', 'manual', ${safeName}, ${r2Key}, 'pending')
+    ON CONFLICT (r2_key) WHERE (r2_key IS NOT NULL) DO NOTHING
     RETURNING *
   `;
-  return c.json(doc, 201);
+  if (inserted.length > 0) {
+    return c.json(inserted[0], 201);
+  }
+  // Existing row already had this r2_key — return it with 200 instead of 201.
+  const [existing] = await sql`
+    SELECT * FROM cc_documents WHERE r2_key = ${r2Key} LIMIT 1
+  `;
+  return c.json(existing, 200);
 });
 
 // Batch upload via ChittyStorage