Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/core/feeds/daemon-process.ts`:
- Around line 303-306: The code assumes parsed._dispatch_heartbeat.value is a
number via a cast (heartbeat) but doesn't validate it; update the logic around
parsed/_dispatch_heartbeat/heartbeat/referenceTime so heartbeat is checked with
Number.isFinite (or typeof === 'number' and isFinite) and only used when valid
(and optionally within a sensible range), otherwise fall back to daemonStartTime
before computing Date.now() - referenceTime and using
config.daemon.inactivityTimeoutMinutes; ensure any downstream math never
receives NaN by performing this validation and assigning referenceTime
accordingly.
- Around line 259-261: Wrap the initial heartbeat cache write call in a
try/catch so a failing mergeKey(cachePath, "_daemon_heartbeat", { value:
Date.now() }, DAEMON_HEARTBEAT_TTL) cannot abort daemon startup; catch and log
the error (using the module's existing logger) and proceed to start the
refresh/timer logic regardless. Locate the Step 5 startup code around the
mergeKey invocation in daemon-process (the daemon startup/initialization
function) and replace the raw call with a guarded async/await call inside try {
await mergeKey(...) } catch (err) { logger.error(..., err) } so timers/intervals
are still established even if the cache write fails. Ensure behavior/return flow
is unchanged on success.

In `@src/core/feeds/producers/insights.ts`:
- Around line 205-206: The code currently computes offsetMinutes with new Date()
and divides by 60 producing fractional hours; replace new Date() with the
provided now parameter to be deterministic, compute an integer hour offset using
Math.trunc(offsetMinutes / 60) (or Math.floor/Math.trunc as appropriate for
negative values) instead of dividing to a float, and then calculate peakHour as
((peakHourUtc - offsetHour) + 24) % 24 so peakHour remains an integer hour;
update references to offsetMinutes, peakHourUtc, and peakHour in the function to
use now.getTimezoneOffset() and the integer offsetHour variable.

In `@src/core/status-line/segments.ts`:
- Line 456: The hardcoded staleThresholdMs = 90_000 in segments.ts duplicates
the daemon heartbeat TTL; replace the magic number with the shared constant
exported from the daemon heartbeat logic (e.g., import DAEMON_HEARTBEAT_TTL_MS
or HEARTBEAT_TTL_MS) and use that value (or a clearly derived value) for
staleThresholdMs; if the daemon module does not yet export a named TTL constant,
add an export (e.g., export const DAEMON_HEARTBEAT_TTL_MS = 90_000) in the
daemon code and import it into segments.ts so both places reference the same
symbol.

In `@tests/core/tui-launcher.test.ts`:
- Around line 205-219: The test currently uses
mockedExecSync.mockReturnValue("12345\n") and then resets it later; change this
to a one-shot mock (e.g., mockedExecSync.mockReturnValueOnce("12345\n") or
mockedExecSync.mockImplementationOnce(() => "12345\n")) so the execSync behavior
only applies for this call and you can remove the manual reset at the end;
update the assertion block around launchTui(config, pidPath) that references
mockedSpawn and keep references to mockedExecSync and launchTui for context.

In `@tui/hookwise_tui/data.py`:
- Around line 84-93: write_config currently always writes to
_default_config_path(), which can differ from the file read_config actually
reads; update write_config to use the same path-resolution logic as read_config
(i.e., if config_path is None, locate the effective config file the same way
read_config does—prefer any existing config file read_config checks and fall
back to the same _default_config_path()/~/.hookwise/config.yaml). In practice
either call the common resolver used by read_config or replicate its lookup
(iterate the same candidate paths, pick an existing one if present, otherwise
use _default_config_path()), then write to that resolved Path before returning
True.

In `@tui/hookwise_tui/tabs/coaching.py`:
- Around line 106-129: The FeatureCard visuals aren't updated after toggling
because on_switch_changed only persists config; after a successful
write_config(config) locate the mounted FeatureCard for the toggled feature (use
feature_key from switch_id, e.g. query_one or query for an element with an
id/class like f"feature-{feature_key}" and the FeatureCard class) and call its
update method(s) to reflect the new state (e.g. set an enabled property, call a
method like set_enabled/refresh/update_badge or update attributes/classes to
change badge and border) so the UI matches the persisted config immediately;
perform this update only after write_config returns true and keep the existing
notify logic.

In `@tui/hookwise_tui/tabs/status.py`:
- Around line 230-279: _refresh_preview currently only builds preview_text and
summary_lines from FIXED_SEGMENTS and ROTATING_SEGMENTS, so any toggled entries
in OTHER_SEGMENTS are omitted; modify _refresh_preview to also collect
other_active = [s for s in OTHER_SEGMENTS if s in active_set], render each via
self._render_segment(seg, cache) and include non-empty results in the live
preview (e.g., append them as separate lines after line1/line2 or as additional
lines in preview_text) and add a summary entry (e.g., "[bold]Other:[/bold] " +
delimiter.join(other_active) or a per-segment list) to summary_lines so
standalone segments appear in both the mounted preview (the
Static(preview_text,...)) and the tier summary.

---

Outside diff comments:
In `@tests/core/dispatcher.test.ts`:
- Around line 790-799: The test uses getDefaultConfig() directly which is
inconsistent with other tests; update the call to use makeConfig() (the same
helper used elsewhere) when constructing the config passed to dispatch in the
"safeDispatch wraps dispatch for fail-open" test so analytics are disabled
consistently—locate the test that calls dispatch("InvalidEvent" as EventType,
makePayload(), { config: getDefaultConfig() }) and replace getDefaultConfig()
with makeConfig().

In `@tests/core/feeds/producers/insights.test.ts`:
- Around line 198-213: The test duplicates the production timezone conversion
logic when computing expectedLocalPeak; instead, stub/spy the system timezone
offset to a fixed value (e.g. jest.spyOn(Date.prototype,
"getTimezoneOffset").mockReturnValue(fixedOffsetMinutes) or equivalent) before
calling aggregateInsights, then compute the expected local peak using that known
fixed offset and assert result!.peak_hour equals that constant; update the test
around aggregateInsights and the offset calculation to remove the mirrored
implementation and restore the spy after the test.

In `@tests/core/feeds/segments.test.ts`:
- Around line 518-523: The expected built-ins list in
tests/core/feeds/segments.test.ts is missing one entry (the test asserts length
20 but the array contains 19), so add the missing segment name "daemon_health"
to the expected-names array used in the test (the array starting with "clock",
"mantra", ... "memories") so the membership check and length assertion match the
actual registered segments.

In `@tui/hookwise_tui/tabs/analytics.py`:
- Around line 43-99: The analytics code still builds an unused AuthorshipSummary
from the authorship_ledger in read_analytics; remove the authorship query and
the AuthorshipSummary population inside read_analytics in
tui/hookwise_tui/data.py (delete the block that queries authorship_ledger and
any construction/return of AuthorshipSummary), and update any imports/typing
that referenced AuthorshipSummary; then edit the dashboard feature description
string in tui/hookwise_tui/tabs/dashboard.py to remove the phrase "AI authorship
ratio" so the description only lists the remaining features. Ensure no other
code references AuthorshipSummary or the authorship_ledger query after removal.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@hooks/agent-tracker.sh`:
- Around line 42-47: The current read-modify-write around STATE_FILE using
CURRENT is racy—wrap both the read and write when handling
SubagentStart/SubagentStop so updates cannot interleave; acquire an exclusive
lock (e.g., using flock on a dedicated lockfile or mkdir-based lock) before
reading CURRENT, perform the modify, then atomically write the updated
STATE_FILE and release the lock; ensure the same locking is applied to the other
block that handles state (the similar logic referenced around the later
SubagentStart/SubagentStop handling) so all accesses to STATE_FILE use the same
lock identifier.
- Around line 50-62: The inline python block assigning UPDATED is
injection-prone because it interpolates shell variables directly into the -c
string; instead invoke python3 with no source interpolation by passing the JSON
payload via stdin (read with json.loads(sys.stdin.read())) and pass scalars
(EVENT, agent_id, name, NOW, STALE_SECONDS, team_name, strategy) as safe argv
values or environment variables (access via sys.argv or os.environ) so you avoid
embedding unescaped values; update the python3 -c call that produces UPDATED to
read CURRENT from stdin and read other inputs from sys.argv (and apply the
fallback logic for team_name/strategy using current.get(...) inside the Python
code) to eliminate quote/newline injection risks.
- Line 7: The script currently uses the strict failure flag "set -euo pipefail"
which breaks the intended “always exits 0” fail-open contract; change it to
remove -e (e.g., "set -uo pipefail") and make potential-failing operations
(notably mkdir -p, temp file writes, mv and the block around lines 93-95)
resilient by either guarding them (if ...; then ...; fi) or appending "|| true"
so failures do not cause an exit, and ensure the script ends with an explicit
"exit 0" to guarantee a zero exit code; look for the literal "set -euo
pipefail", the mkdir/mv/temp write calls, and the block around lines 93-95 to
apply these changes.

In `@src/cli/commands/status-line.ts`:
- Line 18: ACTIVE_AGENTS_PATH is hardcoded to ~/.hookwise which diverges from
hooks/agent-tracker.sh that writes to HOOKWISE_STATE_DIR; update the code that
defines ACTIVE_AGENTS_PATH (const ACTIVE_AGENTS_PATH) to resolve the state
directory using the same logic the rest of the app/hooks use (check
process.env.HOOKWISE_STATE_DIR and fall back to join(homedir(), ".hookwise") or
reuse any existing resolveStateDir/getStateDir helper), and apply the same fix
to the related code around the block referenced at 82-85 so both reads/writes
target the same directory as the hook.

In `@src/core/status-line/segments.ts`:
- Around line 8-10: The agents segment currently performs synchronous disk I/O
during render (uses existsSync/readFileSync/join/homedir); remove those calls
from the render path in the agents segment and make it read only from the cache
bus (the cache key used for agents data). If the cache key is missing or stale,
return a sensible fallback (e.g., "no agents" or a placeholder string) rather
than performing I/O or returning empty string. Move any file reading logic into
the cache-population/updater code (so functions that write to the cache perform
existsSync/readFileSync and set the agents cache key), and ensure the agents
renderer function (agents in segments.ts) only reads the cache and formats the
value.
- Around line 539-544: The daemon_health SegmentRenderer currently returns an
empty string when cache._daemon_heartbeat or heartbeat.value is missing; instead
return a sensible fallback status string (e.g., a clear "daemon: unknown" or
"daemon: no heartbeat/stale") so the daemon state is visible; update the
daemon_health function to detect missing or stale heartbeat
(cache._daemon_heartbeat and heartbeat.value) and return that explicit fallback
rather than "".
- Around line 486-491: The current staleness filter uses started_at
(activeAgents: data.agents.filter(...) comparing now - started_at <
staleThreshold) which wrongly excludes legitimate long-running agents; change
the logic to base staleness on a heartbeat/last-seen timestamp (e.g.,
last_heartbeat, last_seen, or updated_at) if available on the agent object and
only filter out agents whose last_heartbeat is older than staleThreshold,
falling back to not filtering by started_at if no heartbeat field exists, and
keep the variable names staleThreshold and activeAgents but update the predicate
to use the heartbeat/last-seen field (or agent.status) instead of started_at.

In `@src/core/status-line/two-tier.ts`:
- Around line 21-24: Update the TwoTierConfig interface to make middleSegments
and showSeparator optional to match the implementation: change the property
declarations for middleSegments and showSeparator on TwoTierConfig so they
accept undefined (e.g., add ? to middleSegments and showSeparator) because the
code already uses middleSegments ?? [] and showSeparator ?? true in
renderTwoTierSections and buildTwoTierSeparator.

In `@tui/hookwise_tui/data.py`:
- Around line 92-101: write_config currently writes directly to the target file
and may produce truncated configs on interruption; change it to perform an
atomic write by writing the YAML to a temporary file in the same directory (use
the same parent from _effective_config_path(path) / Path.parent), flush and
fsync the temp file, close it, then atomically replace the target with
os.replace (or Path.rename) so the switch is atomic; preserve the existing
return True/False behavior and catch exceptions around the write/replace steps,
cleaning up the temp file on failure.

In `@tui/hookwise_tui/tabs/status.py`:
- Around line 322-326: The saved toggles are written to
config["status_line"]["segments"] but the CLI renderer still uses
renderTwoTier(DEFAULT_TWO_TIER_CONFIG, cache), so persisted toggles have no
effect; update the CLI renderer (src/cli/commands/status-line.ts) to load the
persisted config (status_line.segments) and merge or replace
DEFAULT_TWO_TIER_CONFIG with those segments before calling renderTwoTier (or
alternatively read the same cache key you persist to), ensuring renderTwoTier
receives the persisted segments instead of always using DEFAULT_TWO_TIER_CONFIG.

---

Outside diff comments:
In `@src/core/status-line/segments.ts`:
- Around line 559-581: BUILTIN_SEGMENTS currently lists 21 keys but should match
the 20-segment TUI list exactly; reconcile the arrays by comparing
BUILTIN_SEGMENTS to the canonical TUI segment list and remove the extra entry
from the record so the map contains exactly the 20 expected keys. Update the
BUILTIN_SEGMENTS object (and any corresponding imports/exports for the segment
symbol you remove) so it only includes the official segment identifiers (leave
the SegmentRenderer type intact) and run tests to confirm parity.

---

Duplicate comments:
In `@src/core/status-line/segments.ts`:
- Around line 545-547: Replace the hardcoded staleThresholdMs = 90_000 in
src/core/status-line/segments.ts with a shared daemon heartbeat TTL constant so
health calculation stays in sync; import the canonical TTL (e.g.,
DAEMON_HEARTBEAT_TTL_MS or HEARTBEAT_TTL_MS) from the daemon/heartbeat or
daemon/constants module and use that instead of 90_000 where ageMs = Date.now()
- heartbeat.value is compared to staleThresholdMs (update any local variable
name like staleThresholdMs to use the imported constant).